@aigentic/claude-flow 3.7.0-alpha.69

package/.claude/agents/v3/v3-security-architect.md

@@ -0,0 +1,140 @@
+---
+name: v3-security-architect
+description: |
+  V3 Security Architect responsible for complete security overhaul, threat modeling, and CVE remediation planning. Addresses critical vulnerabilities CVE-1, CVE-2, CVE-3 and implements secure-by-default patterns.
+---
+
+# V3 Security Architect
+
+**🛡️ Complete Security Overhaul & Threat Modeling Specialist**
+
+## Critical Security Mission
+
+Design and implement comprehensive security architecture for v3, addressing all identified vulnerabilities and establishing secure-by-default patterns for the entire codebase.
+
+## Priority Security Fixes
+
+### **CVE-1: Vulnerable Dependencies**
+- **Issue**: Outdated @anthropic-ai/claude-code version
+- **Action**: Update to @anthropic-ai/claude-code@^2.0.31
+- **Files**: package.json
+- **Timeline**: Phase 1 Week 1
+
+### **CVE-2: Weak Password Hashing**
+- **Issue**: SHA-256 with hardcoded salt
+- **Action**: Implement bcrypt with 12 rounds
+- **Files**: api/auth-service.ts:580-588
+- **Timeline**: Phase 1 Week 1
+
+### **CVE-3: Hardcoded Default Credentials**
+- **Issue**: Default credentials in auth service
+- **Action**: Generate random credentials on installation
+- **Files**: api/auth-service.ts:602-643
+- **Timeline**: Phase 1 Week 1
+
+### **HIGH-1: Command Injection**
+- **Issue**: shell:true in spawn() calls
+- **Action**: Use execFile without shell
+- **Files**: Multiple spawn() locations
+- **Timeline**: Phase 1 Week 2
+
+### **HIGH-2: Path Traversal**
+- **Issue**: Unvalidated file paths
+- **Action**: Implement path.resolve() + prefix validation
+- **Files**: All file operation modules
+- **Timeline**: Phase 1 Week 2
+
+## Security Architecture Design
+
+### **Threat Model Domains**
+```
+┌─────────────────────────────────────────┐
+│              API BOUNDARY               │
+├─────────────────────────────────────────┤
+│  Input Validation & Authentication      │
+├─────────────────────────────────────────┤
+│           CORE SECURITY LAYER          │
+├─────────────────────────────────────────┤
+│  Agent Communication & Authorization    │
+├─────────────────────────────────────────┤
+│        STORAGE & PERSISTENCE           │
+└─────────────────────────────────────────┘
+```
+
+### **Security Boundaries**
+- **API Layer**: Input validation, rate limiting, CORS
+- **Authentication**: Token-based auth, session management
+- **Authorization**: Role-based access control (RBAC)
+- **Agent Communication**: Encrypted inter-agent messaging
+- **Data Protection**: Encryption at rest, secure key management
+
+## Secure Patterns Catalog
+
+### **Input Validation**
+```typescript
+// Zod-based validation
+const TaskInputSchema = z.object({
+  taskId: z.string().uuid(),
+  content: z.string().max(10000),
+  agentType: z.enum(['security', 'core', 'integration'])
+});
+```
+
+### **Path Sanitization**
+```typescript
+// Secure path handling
+function securePath(userPath: string, allowedPrefix: string): string {
+  const resolved = path.resolve(allowedPrefix, userPath);
+  if (!resolved.startsWith(path.resolve(allowedPrefix))) {
+    throw new SecurityError('Path traversal detected');
+  }
+  return resolved;
+}
+```
+
+### **Command Execution**
+```typescript
+// Safe command execution
+import { execFile } from 'child_process';
+
+// ❌ Dangerous: shell injection possible
+// exec(`git ${userInput}`, { shell: true });
+
+// ✅ Safe: no shell interpretation
+execFile('git', [userInput], { shell: false });
+```
+
+## Deliverables
+
+### **Phase 1 (Week 1-2)**
+- [ ] **SECURITY-ARCHITECTURE.md** - Complete threat model
+- [ ] **CVE-REMEDIATION-PLAN.md** - Detailed fix timeline
+- [ ] **SECURE-PATTERNS.md** - Reusable security patterns
+- [ ] **THREAT-MODEL.md** - Attack surface analysis
+
+### **Validation Criteria**
+- [ ] All CVEs addressed with tested fixes
+- [ ] npm audit shows 0 high/critical vulnerabilities
+- [ ] Security patterns documented and implemented
+- [ ] Threat model covers all v3 domains
+- [ ] Security testing framework established
+
+## Coordination with Security Team
+
+### **Security Implementer (Agent #3)**
+- Provide detailed implementation specifications
+- Review all security-critical code changes
+- Validate CVE remediation implementations
+
+### **Security Tester (Agent #4)**
+- Supply test specifications for security patterns
+- Define penetration testing requirements
+- Establish security regression test suite
+
+## Success Metrics
+
+- **Security Score**: 90/100 (npm audit + custom scans)
+- **CVE Resolution**: 100% of identified CVEs fixed
+- **Test Coverage**: >95% for security-critical code
+- **Documentation**: Complete security architecture docs
+- **Timeline**: All deliverables within Phase 1

package/.claude/checkpoints/1767754460.json

@@ -0,0 +1,8 @@
+{
+  "tag": "checkpoint-20260107-025420",
+  "file": ".claude/settings.json",
+  "timestamp": "2026-01-07T02:54:20Z",
+  "type": "post-edit",
+  "branch": "v3",
+  "diff_summary": " .claude/helpers/standard-checkpoint-hooks.sh       |  14 +-  .claude/settings.json                              |  20 +-  v3/.agentic-flow/intelligence.json                 |   6 +-  v3/@claude-flow/claims/package.json                |   2 +-  v3/@claude-flow/claims/src/api/cli-types.ts        |   2 +-  v3/@claude-flow/claims/src/api/mcp-tools.ts        |   4 +-  v3/@claude-flow/cli/package.json                   |   2 +-  v3/@claude-flow/cli/src/commands/agent.ts          |   2 +-  v3/@claude-flow/cli/src/commands/config.ts         |   4 +-  v3/@claude-flow/cli/src/commands/hooks.ts          |   2 +-  v3/@claude-flow/cli/src/commands/mcp.ts            |   2 +-  v3/@claude-flow/cli/src/commands/memory.ts         | 460 +++++++++++++--------  v3/@claude-flow/cli/src/commands/migrate.ts        |   2 +-  v3/@claude-flow/cli/src/commands/process.ts        | 118 +++++-  v3/@claude-flow/cli/src/commands/start.ts          |   4 +-  v3/@claude-flow/cli/src/commands/status.ts         |  35 +-  v3/@claude-flow/cli/src/commands/swarm.ts          |  12 +-  v3/@claude-flow/cli/src/init/settings-generator.ts |   6 +-  v3/@claude-flow/cli/src/mcp-client.ts              |   4 +-  v3/@claude-flow/cli/src/mcp-tools/hooks-tools.ts   |  52 ++-  v3/@claude-flow/cli/src/mcp-tools/index.ts         |   2 +  v3/@claude-flow/cli/src/mcp-tools/memory-tools.ts  | 199 ++++++++-  v3/@claude-flow/cli/src/mcp-tools/swarm-tools.ts   |  40 +-  v3/@claude-flow/deployment/package.json            |   2 +-  v3/@claude-flow/embeddings/package.json            |   2 +-  v3/@claude-flow/hooks/package.json                 |   2 +-  v3/@claude-flow/hooks/src/swarm/index.ts           |   2 +-  v3/@claude-flow/integration/package.json           |   2 +-  .../integration/src/agentic-flow-agent.ts          |   6 +-  .../integration/src/long-running-worker.ts         |   4 +-  .../integration/src/multi-model-router.ts          |  10 +-  .../integration/src/provider-adapter.ts            |   2 +-  v3/@claude-flow/integration/src/sdk-bridge.ts      |  11 +-  v3/@claude-flow/integration/src/sona-adapter.ts    |   2 +-  v3/@claude-flow/integration/src/swarm-adapter.ts   |   4 +-  v3/@claude-flow/mcp/package.json                   |   2 +-  v3/@claude-flow/mcp/src/sampling.ts                |   2 +-  v3/@claude-flow/memory/package.json                |   2 +-  v3/@claude-flow/neural/package.json                |   2 +-  .../neural/src/algorithms/decision-transformer.js  |   2 +-  .../neural/src/algorithms/decision-transformer.ts  |   2 +-  v3/@claude-flow/performance/package.json           |   2 +-  v3/@claude-flow/plugins/package.json               |   2 +-  .../plugins/src/integrations/agentic-flow.ts       |  70 +++-  v3/@claude-flow/plugins/src/workers/index.ts       |   8 +-  v3/@claude-flow/providers/package.json             |   2 +-  v3/@claude-flow/security/package.json              |   2 +-  v3/@claude-flow/shared/package.json                |   2 +-  v3/@claude-flow/shared/src/events/example-usage.ts |   2 +-  v3/@claude-flow/shared/src/hooks/example-usage.ts  |   6 +-  .../src/plugins/official/hive-mind-plugin.ts       |   4 +-  .../shared/src/plugins/official/maestro-plugin.ts  |   6 +-  v3/@claude-flow/swarm/package.json                 |   2 +-  v3/@claude-flow/swarm/src/attention-coordinator.ts |   4 +-  v3/@claude-flow/swarm/src/consensus/byzantine.ts   |   2 +-  v3/@claude-flow/swarm/src/consensus/gossip.ts      |   2 +-  v3/@claude-flow/swarm/src/consensus/raft.ts        |   6 +-  v3/@claude-flow/swarm/src/federation-hub.ts        |   2 +-  v3/@claude-flow/swarm/src/queen-coordinator.ts     |   7 +-  .../swarm/src/workers/worker-dispatch.d.ts         |   2 +-  .../swarm/src/workers/worker-dispatch.ts           |  86 ++--  v3/@claude-flow/testing/package.json               |   2 +-  v3/implementation/adrs/README.md                   |  18 +-  v3/mcp/tools/hooks-tools.ts                        |   6 +-  v3/mcp/tools/sona-tools.ts                         |  96 ++++-  v3/mcp/tools/system-tools.ts                       |   2 +-  v3/package-lock.json                               | 125 +++---  v3/src/agent-lifecycle/domain/Agent.ts             |  25 +-  68 files changed, 1085 insertions(+), 463 deletions(-) "
+}

package/.claude/commands/agents/README.md

@@ -0,0 +1,10 @@
+# Agents Commands
+
+Commands for agents operations in Claude Flow.
+
+## Available Commands
+
+- [agent-types](./agent-types.md)
+- [agent-capabilities](./agent-capabilities.md)
+- [agent-coordination](./agent-coordination.md)
+- [agent-spawning](./agent-spawning.md)

package/.claude/commands/agents/agent-capabilities.md

@@ -0,0 +1,21 @@
+# agent-capabilities
+
+Matrix of agent capabilities and their specializations.
+
+## Capability Matrix
+
+| Agent Type | Primary Skills | Best For |
+|------------|---------------|----------|
+| coder | Implementation, debugging | Feature development |
+| researcher | Analysis, synthesis | Requirements gathering |
+| tester | Testing, validation | Quality assurance |
+| architect | Design, planning | System architecture |
+
+## Querying Capabilities
+```bash
+# List all capabilities
+npx claude-flow agents capabilities
+
+# For specific agent
+npx claude-flow agents capabilities --type coder
+```

package/.claude/commands/agents/agent-coordination.md

@@ -0,0 +1,28 @@
+# agent-coordination
+
+Coordination patterns for multi-agent collaboration.
+
+## Coordination Patterns
+
+### Hierarchical
+Queen-led with worker specialization
+```bash
+npx claude-flow swarm init --topology hierarchical
+```
+
+### Mesh
+Peer-to-peer collaboration
+```bash
+npx claude-flow swarm init --topology mesh
+```
+
+### Adaptive
+Dynamic topology based on workload
+```bash
+npx claude-flow swarm init --topology adaptive
+```
+
+## Best Practices
+- Use hierarchical for complex projects
+- Use mesh for research tasks
+- Use adaptive for unknown workloads

package/.claude/commands/agents/agent-spawning.md

@@ -0,0 +1,28 @@
+# agent-spawning
+
+Guide to spawning agents with Claude Code's Task tool.
+
+## Using Claude Code's Task Tool
+
+**CRITICAL**: Always use Claude Code's Task tool for actual agent execution:
+
+```javascript
+// Spawn ALL agents in ONE message
+Task("Researcher", "Analyze requirements...", "researcher")
+Task("Coder", "Implement features...", "coder")
+Task("Tester", "Create tests...", "tester")
+```
+
+## MCP Coordination Setup (Optional)
+
+MCP tools are ONLY for coordination:
+```javascript
+mcp__claude-flow__swarm_init { topology: "mesh" }
+mcp__claude-flow__agent_spawn { type: "researcher" }
+```
+
+## Best Practices
+1. Always spawn agents concurrently
+2. Use Task tool for execution
+3. MCP only for coordination
+4. Batch all operations

package/.claude/commands/agents/agent-types.md

@@ -0,0 +1,26 @@
+# agent-types
+
+Complete guide to all 54 available agent types in Claude Flow.
+
+## Core Development Agents
+- `coder` - Implementation specialist
+- `reviewer` - Code quality assurance
+- `tester` - Test creation and validation
+- `planner` - Strategic planning
+- `researcher` - Information gathering
+
+## Swarm Coordination Agents
+- `hierarchical-coordinator` - Queen-led coordination
+- `mesh-coordinator` - Peer-to-peer networks
+- `adaptive-coordinator` - Dynamic topology
+
+## Specialized Agents
+- `backend-dev` - API development
+- `mobile-dev` - React Native development
+- `ml-developer` - Machine learning
+- `system-architect` - High-level design
+
+For full list and details:
+```bash
+npx claude-flow agents list
+```

package/.claude/commands/analysis/COMMAND_COMPLIANCE_REPORT.md

@@ -0,0 +1,54 @@
+# Analysis Commands Compliance Report
+
+## Overview
+Reviewed all command files in `.claude/commands/analysis/` directory to ensure proper usage of:
+- `mcp__claude-flow__*` tools (preferred)
+- `npx claude-flow` commands (as fallback)
+- No direct implementation calls
+
+## Files Reviewed
+
+### 1. token-efficiency.md
+**Status**: ✅ Updated
+**Changes Made**:
+- Replaced `npx ruv-swarm hook session-end --export-metrics` with proper MCP tool call
+- Updated to: `Tool: mcp__claude-flow__token_usage` with appropriate parameters
+- Maintained result format and context
+
+**Before**:
+```bash
+npx ruv-swarm hook session-end --export-metrics
+```
+
+**After**:
+```
+Tool: mcp__claude-flow__token_usage
+Parameters: {"operation": "session", "timeframe": "24h"}
+```
+
+### 2. performance-bottlenecks.md
+**Status**: ✅ Compliant (No changes needed)
+**Reason**: Already uses proper `mcp__claude-flow__task_results` tool format
+
+## Summary
+
+- **Total files reviewed**: 2
+- **Files updated**: 1
+- **Files already compliant**: 1
+- **Compliance rate after updates**: 100%
+
+## Compliance Patterns Enforced
+
+1. **MCP Tool Usage**: All direct tool calls now use `mcp__claude-flow__*` format
+2. **Parameter Format**: JSON parameters properly structured
+3. **Command Context**: Preserved original functionality and expected results
+4. **Documentation**: Maintained clarity and examples
+
+## Recommendations
+
+1. All analysis commands now follow the proper pattern
+2. No direct bash commands or implementation calls remain
+3. Token usage analysis properly integrated with MCP tools
+4. Performance analysis already using correct tool format
+
+The analysis directory is now fully compliant with the Claude Flow command standards.

package/.claude/commands/analysis/README.md

@@ -0,0 +1,9 @@
+# Analysis Commands
+
+Commands for analysis operations in Claude Flow.
+
+## Available Commands
+
+- [bottleneck-detect](./bottleneck-detect.md)
+- [token-usage](./token-usage.md)
+- [performance-report](./performance-report.md)

package/.claude/commands/analysis/bottleneck-detect.md

@@ -0,0 +1,162 @@
+# bottleneck detect
+
+Analyze performance bottlenecks in swarm operations and suggest optimizations.
+
+## Usage
+
+```bash
+npx claude-flow bottleneck detect [options]
+```
+
+## Options
+
+- `--swarm-id, -s <id>` - Analyze specific swarm (default: current)
+- `--time-range, -t <range>` - Analysis period: 1h, 24h, 7d, all (default: 1h)
+- `--threshold <percent>` - Bottleneck threshold percentage (default: 20)
+- `--export, -e <file>` - Export analysis to file
+- `--fix` - Apply automatic optimizations
+
+## Examples
+
+### Basic bottleneck detection
+
+```bash
+npx claude-flow bottleneck detect
+```
+
+### Analyze specific swarm
+
+```bash
+npx claude-flow bottleneck detect --swarm-id swarm-123
+```
+
+### Last 24 hours with export
+
+```bash
+npx claude-flow bottleneck detect -t 24h -e bottlenecks.json
+```
+
+### Auto-fix detected issues
+
+```bash
+npx claude-flow bottleneck detect --fix --threshold 15
+```
+
+## Metrics Analyzed
+
+### Communication Bottlenecks
+
+- Message queue delays
+- Agent response times
+- Coordination overhead
+- Memory access patterns
+
+### Processing Bottlenecks
+
+- Task completion times
+- Agent utilization rates
+- Parallel execution efficiency
+- Resource contention
+
+### Memory Bottlenecks
+
+- Cache hit rates
+- Memory access patterns
+- Storage I/O performance
+- Neural pattern loading
+
+### Network Bottlenecks
+
+- API call latency
+- MCP communication delays
+- External service timeouts
+- Concurrent request limits
+
+## Output Format
+
+```
+🔍 Bottleneck Analysis Report
+━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+📊 Summary
+├── Time Range: Last 1 hour
+├── Agents Analyzed: 6
+├── Tasks Processed: 42
+└── Critical Issues: 2
+
+🚨 Critical Bottlenecks
+1. Agent Communication (35% impact)
+   └── coordinator → coder-1 messages delayed by 2.3s avg
+
+2. Memory Access (28% impact)
+   └── Neural pattern loading taking 1.8s per access
+
+⚠️ Warning Bottlenecks
+1. Task Queue (18% impact)
+   └── 5 tasks waiting > 10s for assignment
+
+💡 Recommendations
+1. Switch to hierarchical topology (est. 40% improvement)
+2. Enable memory caching (est. 25% improvement)
+3. Increase agent concurrency to 8 (est. 20% improvement)
+
+✅ Quick Fixes Available
+Run with --fix to apply:
+- Enable smart caching
+- Optimize message routing
+- Adjust agent priorities
+```
+
+## Automatic Fixes
+
+When using `--fix`, the following optimizations may be applied:
+
+1. **Topology Optimization**
+
+   - Switch to more efficient topology
+   - Adjust communication patterns
+   - Reduce coordination overhead
+
+2. **Caching Enhancement**
+
+   - Enable memory caching
+   - Optimize cache strategies
+   - Preload common patterns
+
+3. **Concurrency Tuning**
+
+   - Adjust agent counts
+   - Optimize parallel execution
+   - Balance workload distribution
+
+4. **Priority Adjustment**
+   - Reorder task queues
+   - Prioritize critical paths
+   - Reduce wait times
+
+## Performance Impact
+
+Typical improvements after bottleneck resolution:
+
+- **Communication**: 30-50% faster message delivery
+- **Processing**: 20-40% reduced task completion time
+- **Memory**: 40-60% fewer cache misses
+- **Overall**: 25-45% performance improvement
+
+## Integration with Claude Code
+
+```javascript
+// Check for bottlenecks in Claude Code
+mcp__claude-flow__bottleneck_detect {
+  timeRange: "1h",
+  threshold: 20,
+  autoFix: false
+}
+```
+
+## See Also
+
+- `performance report` - Detailed performance analysis
+- `token usage` - Token optimization analysis
+- `swarm monitor` - Real-time monitoring
+- `cache manage` - Cache optimization

package/.claude/commands/analysis/performance-bottlenecks.md

@@ -0,0 +1,59 @@
+# Performance Bottleneck Analysis
+
+## Purpose
+Identify and resolve performance bottlenecks in your development workflow.
+
+## Automated Analysis
+
+### 1. Real-time Detection
+The post-task hook automatically analyzes:
+- Execution time vs. complexity
+- Agent utilization rates
+- Resource constraints
+- Operation patterns
+
+### 2. Common Bottlenecks
+
+**Time Bottlenecks:**
+- Tasks taking > 5 minutes
+- Sequential operations that could parallelize
+- Redundant file operations
+
+**Coordination Bottlenecks:**
+- Single agent for complex tasks
+- Unbalanced agent workloads
+- Poor topology selection
+
+**Resource Bottlenecks:**
+- High operation count (> 100)
+- Memory constraints
+- I/O limitations
+
+### 3. Improvement Suggestions
+
+```
+Tool: mcp__claude-flow__task_results
+Parameters: {"taskId": "task-123", "format": "detailed"}
+
+Result includes:
+{
+  "bottlenecks": [
+    {
+      "type": "coordination",
+      "severity": "high",
+      "description": "Single agent used for complex task",
+      "recommendation": "Spawn specialized agents for parallel work"
+    }
+  ],
+  "improvements": [
+    {
+      "area": "execution_time",
+      "suggestion": "Use parallel task execution",
+      "expectedImprovement": "30-50% time reduction"
+    }
+  ]
+}
+```
+
+## Continuous Optimization
+The system learns from each task to prevent future bottlenecks!

package/.claude/commands/analysis/performance-report.md

@@ -0,0 +1,25 @@
+# performance-report
+
+Generate comprehensive performance reports for swarm operations.
+
+## Usage
+```bash
+npx claude-flow analysis performance-report [options]
+```
+
+## Options
+- `--format <type>` - Report format (json, html, markdown)
+- `--include-metrics` - Include detailed metrics
+- `--compare <id>` - Compare with previous swarm
+
+## Examples
+```bash
+# Generate HTML report
+npx claude-flow analysis performance-report --format html
+
+# Compare swarms
+npx claude-flow analysis performance-report --compare swarm-123
+
+# Full metrics report
+npx claude-flow analysis performance-report --include-metrics --format markdown
+```

package/.claude/commands/analysis/token-efficiency.md

@@ -0,0 +1,45 @@
+# Token Usage Optimization
+
+## Purpose
+Reduce token consumption while maintaining quality through intelligent coordination.
+
+## Optimization Strategies
+
+### 1. Smart Caching
+- Search results cached for 5 minutes
+- File content cached during session
+- Pattern recognition reduces redundant searches
+
+### 2. Efficient Coordination
+- Agents share context automatically
+- Avoid duplicate file reads
+- Batch related operations
+
+### 3. Measurement & Tracking
+
+```bash
+# Check token savings after session
+Tool: mcp__claude-flow__token_usage
+Parameters: {"operation": "session", "timeframe": "24h"}
+
+# Result shows:
+{
+  "metrics": {
+    "tokensSaved": 15420,
+    "operations": 45,
+    "efficiency": "343 tokens/operation"
+  }
+}
+```
+
+## Best Practices
+1. **Use Task tool** for complex searches
+2. **Enable caching** in pre-search hooks
+3. **Batch operations** when possible
+4. **Review session summaries** for insights
+
+## Token Reduction Results
+- 📉 32.3% average token reduction
+- 🎯 More focused operations
+- 🔄 Intelligent result reuse
+- 📊 Cumulative improvements

package/.claude/commands/analysis/token-usage.md

@@ -0,0 +1,25 @@
+# token-usage
+
+Analyze token usage patterns and optimize for efficiency.
+
+## Usage
+```bash
+npx claude-flow analysis token-usage [options]
+```
+
+## Options
+- `--period <time>` - Analysis period (1h, 24h, 7d, 30d)
+- `--by-agent` - Break down by agent
+- `--by-operation` - Break down by operation type
+
+## Examples
+```bash
+# Last 24 hours token usage
+npx claude-flow analysis token-usage --period 24h
+
+# By agent breakdown
+npx claude-flow analysis token-usage --by-agent
+
+# Export detailed report
+npx claude-flow analysis token-usage --period 7d --export tokens.csv
+```

package/.claude/commands/automation/README.md

@@ -0,0 +1,9 @@
+# Automation Commands
+
+Commands for automation operations in Claude Flow.
+
+## Available Commands
+
+- [auto-agent](./auto-agent.md)
+- [smart-spawn](./smart-spawn.md)
+- [workflow-select](./workflow-select.md)