@claude-flow/cli 3.32.26 → 3.32.30

package/node_modules/@claude-flow/security/dist/oauth/client.js

@@ -0,0 +1,120 @@
+/**
+ * HTTP client for `auth.cognitum.one`'s OAuth surface (ADR-306): authorize
+ * URL construction, `POST /oauth/token` (`authorization_code` and
+ * `refresh_token` grants), and `POST /v1/oauth/code-exchange` (OOB fallback).
+ *
+ * A TypeScript port of meta-proxy's `src/oauth/client.rs`
+ * (cognitum-one/meta-proxy) — same base URL, same endpoints, same
+ * form/query parameter names, confirmed live 2026-07-16 (a real
+ * `GET /oauth/authorize?...&client_id=meta-proxy&redirect_uri=<ruflo-controlled
+ * loopback>` returns a working consent page, not a redirect_uri-mismatch
+ * error — so this client reuses meta-proxy's registered `client_id` rather
+ * than requiring a new one).
+ *
+ * Deliberately NOT `api.cognitum.one/v1/auth/*` — that's what ruflo's own
+ * checked-in OpenAPI spec (v3/docs/api/cognitum-v1.openapi.yaml, ADR-308)
+ * describes, but it does not match what the real identity server serves.
+ * This client targets the proven, live surface instead.
+ *
+ * @module v3/security/oauth/client
+ */
+export const CLIENT_ID = 'meta-proxy';
+export const SCOPE = 'inference';
+/** RFC 8252 out-of-band sentinel — the OOB/manual-paste flow's `redirect_uri`. */
+export const OOB_REDIRECT_URI = 'urn:ietf:wg:oauth:2.0:oob';
+function authBaseUrl() {
+    const override = process.env.COGNITUM_AUTH_URL;
+    return override && override.trim() ? override : 'https://auth.cognitum.one';
+}
+export class OAuthError extends Error {
+    code;
+    oauthError;
+    oauthDescription;
+    constructor(message, code, oauthError, oauthDescription) {
+        super(message);
+        this.code = code;
+        this.oauthError = oauthError;
+        this.oauthDescription = oauthDescription;
+        this.name = 'OAuthError';
+    }
+}
+/** Builds the `/oauth/authorize` URL for the standard loopback-redirect flow. */
+export function authorizeUrl(redirectUri, state, codeChallenge) {
+    const url = new URL(`${authBaseUrl()}/oauth/authorize`);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', CLIENT_ID);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('scope', SCOPE);
+    url.searchParams.set('state', state);
+    url.searchParams.set('code_challenge', codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    return url.toString();
+}
+async function parseTokenResponse(resp) {
+    if (resp.ok) {
+        try {
+            return (await resp.json());
+        }
+        catch {
+            throw new OAuthError('unexpected response shape from the server', 'unexpected_shape');
+        }
+    }
+    try {
+        const body = (await resp.json());
+        throw new OAuthError(`oauth error: ${body.error} — ${body.error_description}`, 'protocol', body.error, body.error_description);
+    }
+    catch (e) {
+        if (e instanceof OAuthError)
+            throw e;
+        throw new OAuthError('unexpected response shape from the server', 'unexpected_shape');
+    }
+}
+async function postForm(path, form, base = authBaseUrl()) {
+    let resp;
+    try {
+        resp = await fetch(`${base}${path}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams(form).toString(),
+        });
+    }
+    catch (e) {
+        throw new OAuthError(`network error: ${e instanceof Error ? e.message : String(e)}`, 'network');
+    }
+    return parseTokenResponse(resp);
+}
+/** `POST /oauth/token` with `grant_type=authorization_code`. */
+export async function exchangeCode(code, codeVerifier, redirectUri, base = authBaseUrl()) {
+    return postForm('/oauth/token', { grant_type: 'authorization_code', code, code_verifier: codeVerifier, client_id: CLIENT_ID, redirect_uri: redirectUri }, base);
+}
+/**
+ * `POST /oauth/token` with `grant_type=refresh_token`. identity rotates
+ * refresh tokens with reuse detection: presenting a refresh token returns a
+ * NEW refresh token and revokes the old one, and re-presenting a spent one
+ * revokes the whole session family. Callers MUST persist the returned
+ * `refresh_token` atomically before using the new access token, and must
+ * never retry a failed refresh with the same token.
+ */
+export async function refreshToken(refreshTokenValue, base = authBaseUrl()) {
+    return postForm('/oauth/token', { grant_type: 'refresh_token', refresh_token: refreshTokenValue, client_id: CLIENT_ID }, base);
+}
+/**
+ * `POST /v1/oauth/code-exchange` — the OOB manual-entry fallback for
+ * headless/SSH/container environments where no browser round-trip to
+ * `127.0.0.1` is reachable.
+ */
+export async function exchangeManualCode(code, codeVerifier, base = authBaseUrl()) {
+    let resp;
+    try {
+        resp = await fetch(`${base}/v1/oauth/code-exchange`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ code, code_verifier: codeVerifier, client_id: CLIENT_ID }),
+        });
+    }
+    catch (e) {
+        throw new OAuthError(`network error: ${e instanceof Error ? e.message : String(e)}`, 'network');
+    }
+    return parseTokenResponse(resp);
+}
+//# sourceMappingURL=client.js.map

package/node_modules/@claude-flow/security/dist/oauth/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/oauth/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC;AACtC,MAAM,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC;AACjC,kFAAkF;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,SAAS,WAAW;IAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC/C,OAAO,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,2BAA2B,CAAC;AAC9E,CAAC;AAeD,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGjB;IACA;IACA;IAJlB,YACE,OAAe,EACC,IAAiD,EACjD,UAAmB,EACnB,gBAAyB;QAEzC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAA6C;QACjD,eAAU,GAAV,UAAU,CAAS;QACnB,qBAAgB,GAAhB,gBAAgB,CAAS;QAGzC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,KAAa,EAAE,aAAqB;IACpF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAc;IAC9C,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAkB,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,UAAU,CAAC,2CAA2C,EAAE,kBAAkB,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAmB,CAAC;QACnD,MAAM,IAAI,UAAU,CAClB,gBAAgB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,iBAAiB,EAAE,EACxD,UAAU,EACV,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,iBAAiB,CACvB,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,UAAU;YAAE,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,UAAU,CAAC,2CAA2C,EAAE,kBAAkB,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAA4B,EAAE,IAAI,GAAG,WAAW,EAAE;IACtF,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,kBAAkB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,YAAoB,EACpB,WAAmB,EACnB,IAAI,GAAG,WAAW,EAAE;IAEpB,OAAO,QAAQ,CACb,cAAc,EACd,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,EACxH,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,iBAAyB,EAAE,IAAI,GAAG,WAAW,EAAE;IAChF,OAAO,QAAQ,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;AACjI,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,YAAoB,EACpB,IAAI,GAAG,WAAW,EAAE;IAEpB,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,yBAAyB,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;SAClF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,kBAAkB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/node_modules/@claude-flow/security/dist/oauth/pkce.d.ts

@@ -0,0 +1,25 @@
+/**
+ * OAuth 2.0 + PKCE (RFC 7636) client-side generation (ADR-306).
+ *
+ * A TypeScript port of meta-proxy's `src/oauth/pkce.rs` (cognitum-one/meta-proxy,
+ * itself ported from `dashboard/apps/cli/src/pkce.rs`) so a verifier generated
+ * here validates against the same `services/identity` authorization server
+ * meta-proxy already talks to successfully — same byte lengths, same encoding,
+ * same hash. Intentionally duplicated rather than imported from
+ * `@claude-flow/mcp/src/oauth.ts` (a different, unrelated OAuth client in this
+ * monorepo) — ADR-306 assigns PKCE ownership to this package specifically.
+ *
+ * @module v3/security/oauth/pkce
+ */
+export interface PkceRequest {
+    state: string;
+    codeVerifier: string;
+    codeChallenge: string;
+}
+export declare function challengeFromVerifier(verifier: string): string;
+/**
+ * Generates a fresh `state` + PKCE verifier/challenge pair for one login
+ * attempt.
+ */
+export declare function generate(): PkceRequest;
+//# sourceMappingURL=pkce.d.ts.map

package/node_modules/@claude-flow/security/dist/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAWD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,QAAQ,IAAI,WAAW,CAKtC"}

package/node_modules/@claude-flow/security/dist/oauth/pkce.js

@@ -0,0 +1,36 @@
+/**
+ * OAuth 2.0 + PKCE (RFC 7636) client-side generation (ADR-306).
+ *
+ * A TypeScript port of meta-proxy's `src/oauth/pkce.rs` (cognitum-one/meta-proxy,
+ * itself ported from `dashboard/apps/cli/src/pkce.rs`) so a verifier generated
+ * here validates against the same `services/identity` authorization server
+ * meta-proxy already talks to successfully — same byte lengths, same encoding,
+ * same hash. Intentionally duplicated rather than imported from
+ * `@claude-flow/mcp/src/oauth.ts` (a different, unrelated OAuth client in this
+ * monorepo) — ADR-306 assigns PKCE ownership to this package specifically.
+ *
+ * @module v3/security/oauth/pkce
+ */
+import { randomBytes, createHash } from 'crypto';
+/**
+ * 32 random bytes, base64url-encoded (no padding) — comfortably within RFC
+ * 7636's 43-128 character verifier length requirement (32 bytes -> 43 chars).
+ * Matches the Rust port's `random_url_safe_token(32)` exactly.
+ */
+function randomUrlSafeToken(byteLen) {
+    return randomBytes(byteLen).toString('base64url');
+}
+export function challengeFromVerifier(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+/**
+ * Generates a fresh `state` + PKCE verifier/challenge pair for one login
+ * attempt.
+ */
+export function generate() {
+    const state = randomUrlSafeToken(32);
+    const codeVerifier = randomUrlSafeToken(32);
+    const codeChallenge = challengeFromVerifier(codeVerifier);
+    return { state, codeVerifier, codeChallenge };
+}
+//# sourceMappingURL=pkce.js.map

package/node_modules/@claude-flow/security/dist/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAQjD;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ;IACtB,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AAChD,CAAC"}

package/node_modules/@claude-flow/security/dist/password-hasher.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Password Hasher - CVE-2 Remediation
+ *
+ * Fixes weak password hashing by replacing SHA-256 with hardcoded salt
+ * with bcrypt using 12 rounds (configurable).
+ *
+ * Security Properties:
+ * - bcrypt with adaptive cost factor (12 rounds)
+ * - Automatic salt generation per password
+ * - Timing-safe comparison
+ * - Minimum password length enforcement
+ *
+ * @module v3/security/password-hasher
+ */
+export interface PasswordHasherConfig {
+    /**
+     * Number of bcrypt rounds (cost factor).
+     * Default: 12 (recommended minimum for production)
+     * Each increment doubles the computation time.
+     */
+    rounds?: number;
+    /**
+     * Minimum password length.
+     * Default: 8 characters
+     */
+    minLength?: number;
+    /**
+     * Maximum password length.
+     * Default: 128 characters (bcrypt limit is 72 bytes)
+     */
+    maxLength?: number;
+    /**
+     * Require at least one uppercase letter.
+     * Default: true
+     */
+    requireUppercase?: boolean;
+    /**
+     * Require at least one lowercase letter.
+     * Default: true
+     */
+    requireLowercase?: boolean;
+    /**
+     * Require at least one digit.
+     * Default: true
+     */
+    requireDigit?: boolean;
+    /**
+     * Require at least one special character.
+     * Default: false
+     */
+    requireSpecial?: boolean;
+}
+export interface PasswordValidationResult {
+    isValid: boolean;
+    errors: string[];
+}
+export declare class PasswordHashError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/**
+ * Secure password hasher using bcrypt.
+ *
+ * This class replaces the vulnerable SHA-256 + hardcoded salt implementation
+ * with industry-standard bcrypt hashing.
+ *
+ * @example
+ * ```typescript
+ * const hasher = new PasswordHasher({ rounds: 12 });
+ * const hash = await hasher.hash('securePassword123');
+ * const isValid = await hasher.verify('securePassword123', hash);
+ * ```
+ */
+export declare class PasswordHasher {
+    private readonly config;
+    constructor(config?: PasswordHasherConfig);
+    /**
+     * Validates password against configured requirements.
+     *
+     * @param password - The password to validate
+     * @returns Validation result with errors if any
+     */
+    validate(password: string): PasswordValidationResult;
+    /**
+     * Hashes a password using bcrypt.
+     *
+     * @param password - The plaintext password to hash
+     * @returns The bcrypt hash
+     * @throws PasswordHashError if password is invalid
+     */
+    hash(password: string): Promise<string>;
+    /**
+     * Verifies a password against a bcrypt hash.
+     * Uses timing-safe comparison internally.
+     *
+     * @param password - The plaintext password to verify
+     * @param hash - The bcrypt hash to compare against
+     * @returns True if password matches, false otherwise
+     */
+    verify(password: string, hash: string): Promise<boolean>;
+    /**
+     * Checks if a hash needs to be rehashed with updated parameters.
+     * Useful for upgrading hash strength over time.
+     *
+     * @param hash - The bcrypt hash to check
+     * @returns True if hash should be updated
+     */
+    needsRehash(hash: string): boolean;
+    /**
+     * Validates bcrypt hash format.
+     *
+     * @param hash - The hash to validate
+     * @returns True if valid bcrypt hash format
+     */
+    private isValidBcryptHash;
+    /**
+     * Returns current configuration (without sensitive defaults).
+     */
+    getConfig(): Readonly<Omit<Required<PasswordHasherConfig>, never>>;
+}
+/**
+ * Factory function to create a production-ready password hasher.
+ *
+ * @param rounds - Bcrypt rounds (default: 12)
+ * @returns Configured PasswordHasher instance
+ */
+export declare function createPasswordHasher(rounds?: number): PasswordHasher;
+//# sourceMappingURL=password-hasher.d.ts.map

package/node_modules/@claude-flow/security/dist/password-hasher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hasher.d.ts","sourceRoot":"","sources":["../src/password-hasher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAWH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAK/B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;gBAE5C,MAAM,GAAE,oBAAyB;IA2B7C;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB;IAsCpD;;;;;;OAMG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAqB7C;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB9D;;;;;;OAMG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAelC;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAMzB;;OAEG;IACH,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,CAAC;CAGnE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,SAAK,GAAG,cAAc,CAEhE"}

package/node_modules/@claude-flow/security/dist/password-hasher.js

@@ -0,0 +1,190 @@
+/**
+ * Password Hasher - CVE-2 Remediation
+ *
+ * Fixes weak password hashing by replacing SHA-256 with hardcoded salt
+ * with bcrypt using 12 rounds (configurable).
+ *
+ * Security Properties:
+ * - bcrypt with adaptive cost factor (12 rounds)
+ * - Automatic salt generation per password
+ * - Timing-safe comparison
+ * - Minimum password length enforcement
+ *
+ * @module v3/security/password-hasher
+ */
+// #1608 — switched from `bcrypt` to `bcryptjs` to drop the
+// `@mapbox/node-pre-gyp → tar <=7.5.10` transitive chain that pulled in
+// 6 HIGH-severity CVEs (GHSA-34x7-hfp2-rc4v, GHSA-8qq5-rm4j-mr97, etc.).
+// `bcryptjs` is a pure-JS implementation that produces the same `$2a$` /
+// `$2b$` hash format and exposes the same `hash()` / `compare()` API
+// surface this module uses, so the swap is transparent to callers and to
+// any persisted hashes.
+import * as bcrypt from 'bcryptjs';
+export class PasswordHashError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'PasswordHashError';
+    }
+}
+/**
+ * Secure password hasher using bcrypt.
+ *
+ * This class replaces the vulnerable SHA-256 + hardcoded salt implementation
+ * with industry-standard bcrypt hashing.
+ *
+ * @example
+ * ```typescript
+ * const hasher = new PasswordHasher({ rounds: 12 });
+ * const hash = await hasher.hash('securePassword123');
+ * const isValid = await hasher.verify('securePassword123', hash);
+ * ```
+ */
+export class PasswordHasher {
+    config;
+    constructor(config = {}) {
+        this.config = {
+            rounds: config.rounds ?? 12,
+            minLength: config.minLength ?? 8,
+            maxLength: config.maxLength ?? 128,
+            requireUppercase: config.requireUppercase ?? true,
+            requireLowercase: config.requireLowercase ?? true,
+            requireDigit: config.requireDigit ?? true,
+            requireSpecial: config.requireSpecial ?? false,
+        };
+        // Validate configuration
+        if (this.config.rounds < 10 || this.config.rounds > 20) {
+            throw new PasswordHashError('Bcrypt rounds must be between 10 and 20 for security and performance balance', 'INVALID_ROUNDS');
+        }
+        if (this.config.minLength < 8) {
+            throw new PasswordHashError('Minimum password length must be at least 8 characters', 'INVALID_MIN_LENGTH');
+        }
+    }
+    /**
+     * Validates password against configured requirements.
+     *
+     * @param password - The password to validate
+     * @returns Validation result with errors if any
+     */
+    validate(password) {
+        const errors = [];
+        if (!password) {
+            errors.push('Password is required');
+            return { isValid: false, errors };
+        }
+        if (password.length < this.config.minLength) {
+            errors.push(`Password must be at least ${this.config.minLength} characters`);
+        }
+        if (password.length > this.config.maxLength) {
+            errors.push(`Password must not exceed ${this.config.maxLength} characters`);
+        }
+        if (this.config.requireUppercase && !/[A-Z]/.test(password)) {
+            errors.push('Password must contain at least one uppercase letter');
+        }
+        if (this.config.requireLowercase && !/[a-z]/.test(password)) {
+            errors.push('Password must contain at least one lowercase letter');
+        }
+        if (this.config.requireDigit && !/\d/.test(password)) {
+            errors.push('Password must contain at least one digit');
+        }
+        if (this.config.requireSpecial && !/[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password)) {
+            errors.push('Password must contain at least one special character');
+        }
+        return {
+            isValid: errors.length === 0,
+            errors,
+        };
+    }
+    /**
+     * Hashes a password using bcrypt.
+     *
+     * @param password - The plaintext password to hash
+     * @returns The bcrypt hash
+     * @throws PasswordHashError if password is invalid
+     */
+    async hash(password) {
+        const validation = this.validate(password);
+        if (!validation.isValid) {
+            throw new PasswordHashError(validation.errors.join('; '), 'VALIDATION_FAILED');
+        }
+        try {
+            // bcrypt automatically generates a random salt per hash
+            return await bcrypt.hash(password, this.config.rounds);
+        }
+        catch (error) {
+            throw new PasswordHashError('Failed to hash password', 'HASH_FAILED');
+        }
+    }
+    /**
+     * Verifies a password against a bcrypt hash.
+     * Uses timing-safe comparison internally.
+     *
+     * @param password - The plaintext password to verify
+     * @param hash - The bcrypt hash to compare against
+     * @returns True if password matches, false otherwise
+     */
+    async verify(password, hash) {
+        if (!password || !hash) {
+            return false;
+        }
+        // Validate hash format (bcrypt hashes start with $2a$, $2b$, or $2y$)
+        if (!this.isValidBcryptHash(hash)) {
+            return false;
+        }
+        try {
+            // bcrypt.compare uses timing-safe comparison
+            return await bcrypt.compare(password, hash);
+        }
+        catch (error) {
+            // Return false on any error to prevent timing attacks
+            return false;
+        }
+    }
+    /**
+     * Checks if a hash needs to be rehashed with updated parameters.
+     * Useful for upgrading hash strength over time.
+     *
+     * @param hash - The bcrypt hash to check
+     * @returns True if hash should be updated
+     */
+    needsRehash(hash) {
+        if (!this.isValidBcryptHash(hash)) {
+            return true;
+        }
+        // Extract rounds from hash (format: $2b$XX$...)
+        const match = hash.match(/^\$2[aby]\$(\d{2})\$/);
+        if (!match) {
+            return true;
+        }
+        const hashRounds = parseInt(match[1], 10);
+        return hashRounds < this.config.rounds;
+    }
+    /**
+     * Validates bcrypt hash format.
+     *
+     * @param hash - The hash to validate
+     * @returns True if valid bcrypt hash format
+     */
+    isValidBcryptHash(hash) {
+        // bcrypt hash format: $2a$XX$22charsSalt31charsHash
+        // Total length: 60 characters
+        return /^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/.test(hash);
+    }
+    /**
+     * Returns current configuration (without sensitive defaults).
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+}
+/**
+ * Factory function to create a production-ready password hasher.
+ *
+ * @param rounds - Bcrypt rounds (default: 12)
+ * @returns Configured PasswordHasher instance
+ */
+export function createPasswordHasher(rounds = 12) {
+    return new PasswordHasher({ rounds });
+}
+//# sourceMappingURL=password-hasher.js.map

package/node_modules/@claude-flow/security/dist/password-hasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hasher.js","sourceRoot":"","sources":["../src/password-hasher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,2DAA2D;AAC3D,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,yEAAyE;AACzE,wBAAwB;AACxB,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AAoDnC,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAGxB;IAFlB,YACE,OAAe,EACC,IAAY;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,cAAc;IACR,MAAM,CAAiC;IAExD,YAAY,SAA+B,EAAE;QAC3C,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,CAAC;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,GAAG;YAClC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACjD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACjD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;YACzC,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;SAC/C,CAAC;QAEF,yBAAyB;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACvD,MAAM,IAAI,iBAAiB,CACzB,8EAA8E,EAC9E,gBAAgB,CACjB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CACzB,uDAAuD,EACvD,oBAAoB,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,QAAgB;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,MAAM,CAAC,SAAS,aAAa,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,MAAM,CAAC,SAAS,aAAa,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,uCAAuC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1F,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC5B,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CACzB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,mBAAmB,CACpB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,wDAAwD;YACxD,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,aAAa,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAY;QACzC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sEAAsE;QACtE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,6CAA6C;YAC7C,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sDAAsD;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,IAAY;QACtB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gDAAgD;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,IAAY;QACpC,oDAAoD;QACpD,8BAA8B;QAC9B,OAAO,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAM,GAAG,EAAE;IAC9C,OAAO,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC"}

package/node_modules/@claude-flow/security/dist/path-validator.d.ts

@@ -0,0 +1,148 @@
+/**
+ * Path Validator - HIGH-2 Remediation
+ *
+ * Fixes path traversal vulnerabilities by:
+ * - Validating all file paths against allowed prefixes
+ * - Using path.resolve() for canonicalization
+ * - Blocking traversal patterns (../, etc.)
+ * - Enforcing path length limits
+ *
+ * Security Properties:
+ * - Path canonicalization
+ * - Prefix validation
+ * - Symlink resolution (optional)
+ * - Traversal pattern detection
+ *
+ * @module v3/security/path-validator
+ */
+export interface PathValidatorConfig {
+    /**
+     * Allowed directory prefixes.
+     * Paths must start with one of these after resolution.
+     */
+    allowedPrefixes: string[];
+    /**
+     * Blocked file extensions.
+     * Files with these extensions are rejected.
+     */
+    blockedExtensions?: string[];
+    /**
+     * Blocked file names.
+     * Files matching these names are rejected.
+     */
+    blockedNames?: string[];
+    /**
+     * Maximum path length.
+     * Default: 4096 characters
+     */
+    maxPathLength?: number;
+    /**
+     * Whether to resolve symlinks.
+     * Default: true
+     */
+    resolveSymlinks?: boolean;
+    /**
+     * Whether to allow paths that don't exist.
+     * Default: true (for write operations)
+     */
+    allowNonExistent?: boolean;
+    /**
+     * Whether to allow hidden files/directories.
+     * Default: false
+     */
+    allowHidden?: boolean;
+}
+export interface PathValidationResult {
+    isValid: boolean;
+    resolvedPath: string;
+    relativePath: string;
+    matchedPrefix: string;
+    errors: string[];
+}
+export declare class PathValidatorError extends Error {
+    readonly code: string;
+    readonly path?: string | undefined;
+    constructor(message: string, code: string, path?: string | undefined);
+}
+/**
+ * Path validator that prevents traversal attacks.
+ *
+ * This class validates file paths to ensure they stay within
+ * allowed directories and don't access sensitive files.
+ *
+ * @example
+ * ```typescript
+ * const validator = new PathValidator({
+ *   allowedPrefixes: ['/workspaces/project']
+ * });
+ *
+ * const result = await validator.validate('/workspaces/project/src/file.ts');
+ * if (result.isValid) {
+ *   // Safe to use result.resolvedPath
+ * }
+ * ```
+ */
+export declare class PathValidator {
+    private readonly config;
+    private readonly resolvedPrefixes;
+    constructor(config: PathValidatorConfig);
+    /**
+     * Validates a path against security rules.
+     *
+     * @param inputPath - The path to validate
+     * @returns Validation result with resolved path
+     */
+    validate(inputPath: string): Promise<PathValidationResult>;
+    /**
+     * Validates and returns resolved path, throwing on failure.
+     *
+     * @param inputPath - The path to validate
+     * @returns Resolved path if valid
+     * @throws PathValidatorError if validation fails
+     */
+    validateOrThrow(inputPath: string): Promise<string>;
+    /**
+     * Synchronous validation (without symlink resolution).
+     *
+     * @param inputPath - The path to validate
+     * @returns Validation result
+     */
+    validateSync(inputPath: string): PathValidationResult;
+    /**
+     * Securely joins path segments within allowed directories.
+     *
+     * @param prefix - Base directory (must be in allowedPrefixes)
+     * @param segments - Path segments to join
+     * @returns Validated resolved path
+     */
+    securePath(prefix: string, ...segments: string[]): Promise<string>;
+    /**
+     * Adds a prefix to the allowed list at runtime.
+     *
+     * @param prefix - Prefix to add
+     */
+    addPrefix(prefix: string): void;
+    /**
+     * Returns the current allowed prefixes.
+     */
+    getAllowedPrefixes(): readonly string[];
+    /**
+     * Checks if a path is within allowed prefixes (quick check).
+     */
+    isWithinAllowed(inputPath: string): boolean;
+}
+/**
+ * Factory function to create a path validator for a project directory.
+ *
+ * @param projectRoot - Root directory of the project
+ * @returns Configured PathValidator
+ */
+export declare function createProjectPathValidator(projectRoot: string): PathValidator;
+/**
+ * Factory function to create a path validator for the entire project.
+ *
+ * @param projectRoot - Root directory of the project
+ * @returns Configured PathValidator
+ */
+export declare function createFullProjectPathValidator(projectRoot: string): PathValidator;
+//# sourceMappingURL=path-validator.d.ts.map