@claude-flow/cli 3.32.26 → 3.32.30

package/node_modules/@claude-flow/security/dist/tool-output-guardrail.js

@@ -0,0 +1,257 @@
+/**
+ * ToolOutputGuardrail — semantic screening of content returned by MCP tool
+ * calls, memory reads, and external API responses before that content enters
+ * agent reasoning. Closes the OWASP ASI01 (Agent Goal Hijacking) gap
+ * identified in ruvnet/ruflo#2149 / ADR-131.
+ *
+ * Threat model
+ * ------------
+ * Attackers embed malicious instructions in content the agent retrieves
+ * autonomously (web page, MCP tool response, memory entry). An LLM cannot
+ * reliably distinguish instructions from data once both are in the prompt.
+ * System-level per-boundary guardrails are the only category with
+ * sub-millisecond latency and no model dependency (arXiv:2601.17548,
+ * Jan 2026 systematic review).
+ *
+ * Scope
+ * -----
+ * - Detection only — does NOT modify the running prompt; callers decide
+ *   what action to take (allow, flag, redact, reject) via `scanAndEnforce`.
+ * - Synchronous pattern match — designed for <1ms p99 on typical tool
+ *   responses (≤32KB). Large content is capped at `maxScanBytes` and the
+ *   truncation itself is reported as a low-severity finding.
+ * - Pure-function shape — no I/O, no async, no model calls. Safe to invoke
+ *   in hot paths (every MCP tool result, every memory read).
+ *
+ * Non-goals
+ * ---------
+ * - Not a replacement for input validation at HTTP/CLI boundaries
+ *   (InputValidator handles that). This is the *content* boundary.
+ * - Not a model-based classifier. False-positive rate is bounded by
+ *   pattern specificity; tune via `customPatterns` and `policy`.
+ *
+ * Reference: ADR-131, OpenAI Agents SDK ToolGuardrail API (March 2025).
+ */
+const DEFAULT_POLICY = {
+    low: 'allow',
+    medium: 'flag',
+    high: 'redact',
+    critical: 'reject',
+};
+const DEFAULT_MAX_SCAN_BYTES = 1024 * 1024;
+/**
+ * Built-in pattern library. Ordered by severity (critical first) so the
+ * `highest` field reflects the worst category. Patterns are intentionally
+ * conservative — they target the explicit instruction-override / role-hijack
+ * shapes that show up in published indirect-injection corpora rather than
+ * general "suspicious looking" text.
+ */
+const BUILTIN_PATTERNS = [
+    // ── critical: instruction override + embedded system frames ──
+    {
+        label: 'ignore-previous-instructions',
+        // Allow optional filler words between the verb and the temporal keyword
+        // ("ignore the above", "disregard your earlier", "forget all prior").
+        regex: /\b(?:ignore|disregard|forget)\s+(?:all\s+|any\s+|the\s+|my\s+|your\s+|these\s+|those\s+)?(?:previous|prior|above|earlier|preceding|aforementioned)\s+(?:instructions?|prompts?|rules?|directives?)\b/gi,
+        severity: 'critical',
+        category: 'instruction-override',
+    },
+    {
+        label: 'chatml-frame',
+        regex: /<\|(?:im_start|im_end|system|assistant|user|endoftext)\|>/gi,
+        severity: 'critical',
+        category: 'embedded-system',
+    },
+    {
+        label: 'llama-inst-frame',
+        regex: /\[\/?INST\]/g,
+        severity: 'critical',
+        category: 'embedded-system',
+    },
+    {
+        label: 'exfiltrate-secret',
+        regex: /\b(?:exfiltrate|leak|send|post|upload|transmit)\b[^.\n]{0,80}\b(?:secret|token|api[-_\s]?keys?|password|credential|env\s+vars?)\b/gi,
+        severity: 'critical',
+        category: 'exfiltration',
+    },
+    // ── high: role hijack + jailbreak + system tags + bidi unicode ──
+    {
+        label: 'system-tag-injection',
+        regex: /<\/?system>/gi,
+        severity: 'high',
+        category: 'embedded-system',
+    },
+    {
+        label: 'role-hijack-you-are-now',
+        regex: /\byou\s+are\s+(?:now|actually|secretly)\s+(?:a|an|the)\s+/gi,
+        severity: 'high',
+        category: 'role-hijack',
+    },
+    {
+        label: 'jailbreak-dan',
+        regex: /\b(?:DAN(?:\s+mode)?|developer\s+mode|jailbreak\s+mode|do\s+anything\s+now)\b/gi,
+        severity: 'high',
+        category: 'jailbreak',
+    },
+    {
+        label: 'new-instructions-directive',
+        regex: /\b(?:new|updated|revised|additional)\s+(?:instructions?|task|directives?|objectives?)\s*[:.]/gi,
+        severity: 'high',
+        category: 'instruction-override',
+    },
+    {
+        label: 'bidi-override',
+        regex: /[‪-‮⁦-⁩]/g,
+        severity: 'high',
+        category: 'hidden-unicode',
+    },
+    // ── medium: softer role manipulation + tool spoofing ──
+    {
+        label: 'role-hijack-act-as',
+        regex: /\b(?:act|behave|pretend|role[-\s]?play)\s+as\s+(?:if\s+)?(?:a|an|the)\s+/gi,
+        severity: 'medium',
+        category: 'role-hijack',
+    },
+    {
+        label: 'tool-call-spoof',
+        regex: /\b(?:tool_call|function_call|mcp_tool)\s*[:=]\s*["'{]/gi,
+        severity: 'medium',
+        category: 'tool-spoofing',
+    },
+    // ── low: zero-width whitespace (common in copy-paste attacks) ──
+    {
+        label: 'zero-width-char',
+        regex: /[​-‍]/g,
+        severity: 'low',
+        category: 'hidden-unicode',
+    },
+];
+const SEVERITY_ORDER = {
+    none: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+function snippet(text, idx, len) {
+    const start = Math.max(0, idx - 24);
+    const end = Math.min(text.length, idx + len + 24);
+    const head = start > 0 ? '…' : '';
+    const tail = end < text.length ? '…' : '';
+    return head + text.slice(start, end).replace(/\s+/g, ' ') + tail;
+}
+function maxSeverity(a, b) {
+    return SEVERITY_ORDER[a] >= SEVERITY_ORDER[b]
+        ? (a === 'none' ? b : a)
+        : b;
+}
+export class ToolOutputGuardrail {
+    patterns;
+    policy;
+    maxScanBytes;
+    constructor(config = {}) {
+        this.patterns = [...BUILTIN_PATTERNS, ...(config.customPatterns ?? [])];
+        this.policy = { ...DEFAULT_POLICY, ...(config.policy ?? {}) };
+        this.maxScanBytes = config.maxScanBytes ?? DEFAULT_MAX_SCAN_BYTES;
+    }
+    /**
+     * Pure scan — no side effects, no content modification. Useful when the
+     * caller wants to log findings but cannot drop the content (e.g. read-only
+     * audit mode).
+     */
+    scan(content) {
+        if (typeof content !== 'string') {
+            return { safe: true, findings: [], highest: 'none' };
+        }
+        let scanned = content;
+        const findings = [];
+        if (this.maxScanBytes > 0 && content.length > this.maxScanBytes) {
+            scanned = content.slice(0, this.maxScanBytes);
+            findings.push({
+                pattern: 'content-truncated',
+                severity: 'medium',
+                category: 'truncation',
+                position: this.maxScanBytes,
+                context: `(content truncated at ${this.maxScanBytes} bytes; ${content.length - this.maxScanBytes} bytes unscanned)`,
+            });
+        }
+        for (const { label, regex, severity, category } of this.patterns) {
+            // Clone the RegExp so that the global-flag lastIndex state doesn't
+            // leak between calls. Built-in patterns are immutable; user-supplied
+            // patterns are also defensively cloned.
+            const re = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
+            let match;
+            while ((match = re.exec(scanned)) !== null) {
+                findings.push({
+                    pattern: label,
+                    severity,
+                    category,
+                    position: match.index,
+                    context: snippet(scanned, match.index, match[0].length),
+                });
+                // Defensive: zero-length match would loop forever
+                if (match[0].length === 0)
+                    re.lastIndex++;
+            }
+        }
+        let highest = 'none';
+        for (const f of findings)
+            highest = maxSeverity(highest, f.severity);
+        const action = highest === 'none' ? 'allow' : this.policy[highest];
+        const safe = action === 'allow' || action === 'flag';
+        return { safe, findings, highest };
+    }
+    /**
+     * Scan + enforce policy. Returns the content to pass forward (possibly
+     * redacted or empty) plus the scan result and the action that was taken.
+     * Callers should treat `reject` as "drop the tool result and signal an
+     * error" — do NOT silently substitute empty content.
+     */
+    scanAndEnforce(content) {
+        const result = this.scan(content);
+        const action = result.highest === 'none' ? 'allow' : this.policy[result.highest];
+        let outgoing = content;
+        if (action === 'redact') {
+            outgoing = this.redact(content, result.findings);
+        }
+        else if (action === 'reject') {
+            outgoing = '';
+        }
+        return { content: outgoing, result, action };
+    }
+    /**
+     * Replace each non-truncation finding's matched substring with
+     * `[REDACTED:<pattern>]`. Truncation findings have no substring to redact
+     * (their `position` is a length, not an offset into the content) and are
+     * skipped. Idempotent for already-redacted strings.
+     */
+    redact(content, findings) {
+        if (findings.length === 0)
+            return content;
+        // Build a single combined regex per pattern label to avoid replacing
+        // overlapping matches multiple times.
+        const labels = new Set(findings
+            .filter((f) => f.category !== 'truncation')
+            .map((f) => f.pattern));
+        let out = content;
+        for (const { label, regex } of this.patterns) {
+            if (!labels.has(label))
+                continue;
+            const re = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
+            out = out.replace(re, `[REDACTED:${label}]`);
+        }
+        return out;
+    }
+}
+/** Convenience factory that returns a guardrail with the default policy. */
+export function createToolOutputGuardrail(config) {
+    return new ToolOutputGuardrail(config);
+}
+/**
+ * One-shot helper for callers that just want a yes/no answer without
+ * constructing a guardrail. Uses the default policy.
+ */
+export function isToolOutputSafe(content) {
+    return createToolOutputGuardrail().scan(content).safe;
+}
+//# sourceMappingURL=tool-output-guardrail.js.map

package/node_modules/@claude-flow/security/dist/tool-output-guardrail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-output-guardrail.js","sourceRoot":"","sources":["../src/tool-output-guardrail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAwEH,MAAM,cAAc,GAAqD;IACvE,GAAG,EAAE,OAAO;IACZ,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,gBAAgB,GAKjB;IACH,gEAAgE;IAChE;QACE,KAAK,EAAE,8BAA8B;QACrC,wEAAwE;QACxE,sEAAsE;QACtE,KAAK,EAAE,wMAAwM;QAC/M,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,sBAAsB;KACjC;IACD;QACE,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,qIAAqI;QAC5I,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;KACzB;IAED,mEAAmE;IACnE;QACE,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,yBAAyB;QAChC,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,iFAAiF;QACxF,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,WAAW;KACtB;IACD;QACE,KAAK,EAAE,4BAA4B;QACnC,KAAK,EAAE,gGAAgG;QACvG,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,sBAAsB;KACjC;IACD;QACE,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,gBAAgB;KAC3B;IAED,yDAAyD;IACzD;QACE,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,4EAA4E;QACnF,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,yDAAyD;QAChE,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,eAAe;KAC1B;IAED,kEAAkE;IAClE;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,gBAAgB;KAC3B;CACF,CAAC;AAEF,MAAM,cAAc,GAA+C;IACjE,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,CAA6B,EAAE,CAAoB;IACtE,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,OAAO,mBAAmB;IACb,QAAQ,CAAiD;IACzD,MAAM,CAAmD;IACzD,YAAY,CAAS;IAEtC,YAAY,SAA0B,EAAE;QACtC,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,OAAe;QAClB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,OAAO,GAAG,OAAO,CAAC;QACtB,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAChE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,mBAAmB;gBAC5B,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,IAAI,CAAC,YAAY;gBAC3B,OAAO,EAAE,yBAAyB,IAAI,CAAC,YAAY,WAAW,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,mBAAmB;aACpH,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjE,mEAAmE;YACnE,qEAAqE;YACrE,wCAAwC;YACxC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACjG,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,KAAK;oBACd,QAAQ;oBACR,QAAQ;oBACR,QAAQ,EAAE,KAAK,CAAC,KAAK;oBACrB,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;iBACxD,CAAC,CAAC;gBACH,kDAAkD;gBAClD,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAA+B,MAAM,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC;QAErD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,OAAe;QAK5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAElC,MAAM,MAAM,GACV,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpE,IAAI,QAAQ,GAAG,OAAO,CAAC;QACvB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,OAAe,EAAE,QAA4B;QAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAE1C,qEAAqE;QACrE,sCAAsC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC;aAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACzB,CAAC;QAEF,IAAI,GAAG,GAAG,OAAO,CAAC;QAClB,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACjC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACjG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,KAAK,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CAAC,MAAwB;IAChE,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,yBAAyB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}

package/node_modules/@claude-flow/security/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@claude-flow/security",
+  "version": "3.0.0-alpha.14",
+  "type": "module",
+  "description": "Security module - CVE fixes, input validation, path security",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "exports": {
+    ".": "./dist/index.js",
+    "./*": "./dist/*.js"
+  },
+  "scripts": {
+    "test": "vitest run",
+    "benchmark:policy": "npm run build && node scripts/benchmark-policy-engine.mjs",
+    "benchmark:product-plane": "npm run build && node scripts/benchmark-product-plane.mjs",
+    "test:oauth-surface": "vitest run __tests__/oauth-export-surface.test.ts __tests__/oauth-pkce.test.ts __tests__/oauth-browser.test.ts",
+    "build": "tsc && node scripts/verify-oauth-exports.mjs",
+    "prepublishOnly": "npm run build && npm run test:oauth-surface"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "v3alpha"
+  },
+  "rufloBundledRuntime": {
+    "format": 1,
+    "sourceDependencies": {
+      "dependencies": {
+        "@noble/ed25519": "^2.1.0",
+        "bcryptjs": "^3.0.3",
+        "zod": "^3.22.0"
+      },
+      "optionalDependencies": {
+        "@napi-rs/keyring": "1.3.0"
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.32.26",
+  "version": "3.32.30",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -40,11 +40,7 @@
     "self-learning",
     "enterprise"
   ],
-  "author": {
-    "name": "RuvNet",
-    "email": "ruv@ruv.io",
-    "url": "https://ruv.io"
-  },
+  "author": "RuvNet <ruv@ruv.io> (https://ruv.io)",
   "license": "MIT",
   "exports": {
     ".": {
@@ -102,27 +98,55 @@
   },
   "dependencies": {
     "@claude-flow/cli-core": "3.7.0-alpha.5",
+    "@claude-flow/codex": "3.0.3",
     "@claude-flow/mcp": "3.0.0-alpha.8",
     "@claude-flow/neural": "3.0.0-alpha.9",
+    "@claude-flow/plugin-agent-federation": "1.0.0-alpha.18",
+    "@claude-flow/security": "3.0.0-alpha.14",
     "@claude-flow/shared": "3.0.0-alpha.7",
-    "@metaharness/router": "^0.3.2",
+    "@iarna/toml": "^2.2.5",
     "@noble/ed25519": "2.3.0",
     "@ruvector/rabitq-wasm": "0.1.0",
-    "metaharness": "^0.4.1",
+    "bcryptjs": "^3.0.3",
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "fs-extra": "^11.2.0",
+    "inquirer": "^9.2.0",
     "semver": "7.7.3",
     "sql.js": "^1.13.0",
-    "yaml": "^2.8.0"
+    "toml": "^3.0.0",
+    "ws": "^8.21.0",
+    "yaml": "^2.8.0",
+    "zod": "^3.22.0"
   },
   "optionalDependencies": {
+    "@napi-rs/keyring": "1.3.0",
     "@claude-flow/memory": "^3.0.0-alpha.21",
-    "@claude-flow/security": "^3.0.0-alpha.12",
-    "@metaharness/darwin": "^0.8.0",
-    "@metaharness/flywheel": "^0.1.7",
     "agentdb": "^3.0.0-alpha.17",
     "agentic-flow": "^3.0.0-alpha.1",
     "better-sqlite3": "^12.9.0",
     "ruvector": "^0.2.27"
   },
+  "peerDependencies": {
+    "@metaharness/darwin": "^0.8.0",
+    "@metaharness/flywheel": "^0.1.7",
+    "@metaharness/router": "^0.3.2",
+    "metaharness": "^0.4.1"
+  },
+  "peerDependenciesMeta": {
+    "@metaharness/darwin": {
+      "optional": true
+    },
+    "@metaharness/flywheel": {
+      "optional": true
+    },
+    "@metaharness/router": {
+      "optional": true
+    },
+    "metaharness": {
+      "optional": true
+    }
+  },
   "publishConfig": {
     "access": "public",
     "tag": "latest"
@@ -138,5 +162,13 @@
     "@opentelemetry/sdk-node": ">=0.220.0",
     "agentdb": "$agentdb",
     "better-sqlite3": "^12.9.0"
+  },
+  "bundleDependencies": [
+    "@claude-flow/codex",
+    "@claude-flow/plugin-agent-federation",
+    "@claude-flow/security"
+  ],
+  "directories": {
+    "doc": "docs"
   }
 }

package/plugins/ruflo-metaharness/scripts/smoke.sh

@@ -21,6 +21,7 @@ TOOLS_SRC="$ROOT/../../v3/@claude-flow/cli/src/mcp-tools/metaharness-tools.ts"
 SUBS_SRC="$ROOT/../../v3/@claude-flow/cli/src/commands/metaharness.ts"
 EXPECTED_TOOLS=$(grep -cE "name: 'metaharness_" "$TOOLS_SRC" 2>/dev/null; true)
 EXPECTED_SUBS=$(grep -cE "^[[:space:]]+'?[a-z-]+'?:[[:space:]]*'[a-z-]+\.mjs'" "$SUBS_SRC" 2>/dev/null; true)
+EXPECTED_IN_PROCESS_TOOLS=1 # ADR-322 metaharness_flywheel
 : "${EXPECTED_TOOLS:=0}"
 : "${EXPECTED_SUBS:=0}"
 
@@ -883,11 +884,17 @@ for f in $REFS; do
   COUNT=$((COUNT + 1))
   [[ -f "$SCRIPTS_DIR/$f" ]] || miss="$miss mcp-script-${f}-missing"
 done
-# One unique runScript() ref per MCP tool (mint deliberately excluded).
+# One unique runScript() ref per subprocess-backed MCP tool (mint deliberately
+# excluded). ADR-322's metaharness_flywheel is intentionally in-process so
+# evaluation cancellation and atomic promotion share the CLI transaction code.
 # Cross-aspect check: runScript('*.mjs') call sites vs the derived
-# `name: 'metaharness_*'` declaration count in the same file — a handler
-# added without a script ref (or vice-versa) diverges these.
-[[ "$COUNT" == "$EXPECTED_TOOLS" ]] || miss="$miss mcp-script-count-stale:$COUNT-expected-$EXPECTED_TOOLS"
+# `name: 'metaharness_*'` declaration count minus the explicitly governed
+# in-process surface.
+EXPECTED_SCRIPT_TOOLS=$((EXPECTED_TOOLS - EXPECTED_IN_PROCESS_TOOLS))
+[[ "$COUNT" == "$EXPECTED_SCRIPT_TOOLS" ]] || miss="$miss mcp-script-count-stale:$COUNT-expected-$EXPECTED_SCRIPT_TOOLS"
+grep -q "name: 'metaharness_flywheel'" "$WRAPPER" 2>/dev/null || miss="$miss no-in-process-flywheel"
+grep -q "runFlywheelWorker" "$WRAPPER" 2>/dev/null || miss="$miss no-flywheel-evaluator"
+grep -q "promoteFlywheelCandidate" "$WRAPPER" 2>/dev/null || miss="$miss no-flywheel-promoter"
 [[ -z "$miss" ]] && ok || bad "$miss"
 
 step "17z52. SUBCOMMANDS map entries point at existing script files (iter 89)"
@@ -1696,11 +1703,11 @@ CODE=$?
 step "17z9. MCP success-semantic footnote + audit_trend file inputs (iter 46)"
 miss=""
 WRAPPER="$ROOT/../../v3/@claude-flow/cli/src/mcp-tools/metaharness-tools.ts"
-# Success-semantic constant declared + appended to N tool descriptions =
-# N+1 occurrences. N is the derived tool count — cross-aspect check within
-# the wrapper: footnote appends vs `name:` declarations.
+# Success-semantic constant declared + appended to every subprocess-backed
+# tool description. The in-process flywheel has its own transaction semantics,
+# so total occurrences equal the total tool count (1 constant + N-1 tools).
 COUNT=$(grep -c "MCP_SUCCESS_SEMANTIC" "$WRAPPER" 2>/dev/null; true)
-[[ "$COUNT" == "$((EXPECTED_TOOLS + 1))" ]] || miss="$miss footnote-count:$COUNT-expected-$((EXPECTED_TOOLS + 1))"
+[[ "$COUNT" == "$EXPECTED_TOOLS" ]] || miss="$miss footnote-count:$COUNT-expected-$EXPECTED_TOOLS"
 # audit_trend now exposes baselineFile / currentFile
 grep -q "baselineFile" "$WRAPPER" 2>/dev/null || miss="$miss no-baseline-file"
 grep -q "currentFile" "$WRAPPER" 2>/dev/null || miss="$miss no-current-file"
@@ -1738,9 +1745,10 @@ grep -q "success = exitCode === 0" "$WRAPPER" 2>/dev/null || miss="$miss no-exit
 COUNT_OLD=$(grep -c "success: !r.degraded" "$WRAPPER" 2>/dev/null; true)
 [[ "$COUNT_OLD" == "0" ]] || miss="$miss old-pattern-still-present:$COUNT_OLD"
 COUNT_NEW=$(grep -c "success: r.success" "$WRAPPER" 2>/dev/null; true)
-# One `success: r.success` per handler = the derived tool count. Cross-aspect
-# check within the wrapper: handler success-wiring vs `name:` declarations.
-[[ "$COUNT_NEW" == "$EXPECTED_TOOLS" ]] || miss="$miss new-pattern-count:$COUNT_NEW-expected-$EXPECTED_TOOLS"
+# One `success: r.success` per subprocess-backed handler. The in-process
+# flywheel derives success from evaluation/promotion transaction results.
+EXPECTED_SCRIPT_TOOLS=$((EXPECTED_TOOLS - EXPECTED_IN_PROCESS_TOOLS))
+[[ "$COUNT_NEW" == "$EXPECTED_SCRIPT_TOOLS" ]] || miss="$miss new-pattern-count:$COUNT_NEW-expected-$EXPECTED_SCRIPT_TOOLS"
 # Runtime anchors: iter 44 success assertions present
 T="$ROOT/scripts/test-mcp-tools.mjs"
 grep -q "iter 44 fix" "$T" 2>/dev/null || miss="$miss no-iter44-anchors"
@@ -2099,10 +2107,10 @@ grep -q "result has 'success'" "$F" || miss="$miss no-success-assertion"
 grep -q "result has 'data'" "$F" || miss="$miss no-data-assertion"
 grep -q "result has 'degraded'" "$F" || miss="$miss no-degraded-assertion"
 grep -q "result has 'exitCode'" "$F" || miss="$miss no-exitcode-assertion"
-# All 15 tool names enumerated (similarity iter 36, drift_from_history iter 54,
+# All tool names enumerated (similarity iter 36, drift_from_history iter 54,
 # ADR-153 added bench/evolve/security_bench, @metaharness/redblue added redblue,
-# metaharness@0.3.0/darwin@0.8.0 added learn + gepa)
-for tool in metaharness_score metaharness_genome metaharness_mcp_scan metaharness_threat_model metaharness_oia_audit metaharness_audit_list metaharness_audit_trend metaharness_similarity metaharness_drift_from_history metaharness_bench metaharness_evolve metaharness_security_bench metaharness_redblue metaharness_learn metaharness_gepa; do
+# metaharness@0.3.0/darwin@0.8.0 added learn + gepa, ADR-322 added flywheel)
+for tool in metaharness_score metaharness_genome metaharness_mcp_scan metaharness_threat_model metaharness_oia_audit metaharness_audit_list metaharness_audit_trend metaharness_similarity metaharness_drift_from_history metaharness_bench metaharness_evolve metaharness_security_bench metaharness_redblue metaharness_learn metaharness_gepa metaharness_flywheel; do
   grep -q "${tool}" "$F" || miss="$miss missing-${tool}"
 done
 # test-mcp-tools.mjs keeps its own hardcoded `tools.length === N` literal —

package/plugins/ruflo-metaharness/scripts/test-mcp-tools.mjs

@@ -74,7 +74,7 @@ async function main() {
   // ──────────────────────────────────────────────────────────────────
   console.log('Phase 1 — module shape');
   assert(Array.isArray(tools), 'metaharnessTools is an array');
-  assert(tools.length === 15, `15 tools registered (got ${tools.length})`);
+  assert(tools.length === 16, `16 tools registered (got ${tools.length})`);
 
   const expectedNames = new Set([
     'metaharness_score',
@@ -98,6 +98,8 @@ async function main() {
     'metaharness_learn',
     // @metaharness/darwin@0.8.0 — GEPA library surface (genome ops)
     'metaharness_gepa',
+    // ADR-322 — in-process governed evaluation and atomic promotion
+    'metaharness_flywheel',
   ]);
   const actualNames = new Set(tools.map((t) => t.name));
   for (const name of expectedNames) {