@claude-flow/cli 3.32.29 → 3.32.32

package/node_modules/@claude-flow/plugin-agent-federation/dist/transport/midstream-aware-loader.js

@@ -0,0 +1,269 @@
+/**
+ * Midstream-aware federation transport loader (ADR-120, Step 2).
+ *
+ * Extends the agentic-flow `loadQuicTransport` loader pattern with a
+ * preferred branch that probes `midstreamer` first. When `midstreamer`
+ * ships real QUIC (currently the WASM build is a counter-tracking
+ * stub per ADR-119), this loader picks it up automatically without
+ * any change to consumer plugins.
+ *
+ * Resolution order:
+ *
+ *   1. If `MIDSTREAMER_QUIC_NATIVE=1` AND the `midstreamer` module
+ *      exposes a real `QuicMultistream`-derived `AgentTransport`,
+ *      use it. (Today: probes fail closed and we fall through.)
+ *
+ *   2. Otherwise: defer to agentic-flow's existing loader, which
+ *      itself respects `AGENTIC_FLOW_QUIC_NATIVE=1` (ADR-108) and
+ *      falls back to WebSocket (ADR-104) otherwise.
+ *
+ * The loader is opt-in: callers must explicitly invoke
+ * `loadFederationTransport()` instead of `loadQuicTransport()`.
+ * Behavior is identical to `loadQuicTransport()` until upstream
+ * `midstreamer` ships its real QUIC build AND the operator sets the
+ * env flag — so this change is safe to land before any of that
+ * happens.
+ *
+ * Re-exports the `AgentTransport` / `AgentMessage` / `QuicTransportConfig`
+ * surface from agentic-flow so consumers only import from one place.
+ */
+function isCompatibleTransport(value, requireListen = false) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const transport = value;
+    return (typeof transport.send === 'function' &&
+        typeof transport.onMessage === 'function' &&
+        (!requireListen || typeof transport.listen === 'function'));
+}
+/**
+ * Lazy loader for agentic-flow's `loadQuicTransport`. Returns `null`
+ * when `agentic-flow` is not installed — callers must then fall back
+ * to the midstream-first path or surface a clear error.
+ *
+ * Per ADR-120 + issue #1949, `agentic-flow` is now an **optional**
+ * peer dependency. Operators who only want the midstream-native
+ * transport (via `MIDSTREAMER_QUIC_NATIVE=1`) can omit it to avoid
+ * the deep `koa-router` → `cookies@0.9.1` transitive chain that
+ * hardened npm registries reject.
+ */
+async function loadAgenticFlowQuicTransport(config) {
+    // Direct dynamic `import()` (not the `new Function` trick) so
+    // test frameworks like vitest can intercept via `vi.mock`. The
+    // try/catch makes the module-not-found case a clean `null` so the
+    // caller falls back gracefully — agentic-flow is now an optional
+    // peer dependency.
+    let mod;
+    try {
+        // Cast through `unknown` because upstream's exported AgentTransport /
+        // AgentMessage carry a richer surface (InboundMessageHandler with an
+        // options bag, extra fields) that intentionally differs from our
+        // locally-declared minimal shim. The shim exists so the plugin can
+        // compile without importing agentic-flow's exports map at all
+        // (#2578). Downstream code (`plugin.ts`) uses our shim types.
+        mod = (await import('agentic-flow/transport/loader'));
+    }
+    catch {
+        return null;
+    }
+    const fn = typeof mod.loadQuicTransport === 'function'
+        ? mod.loadQuicTransport
+        : mod.default?.loadQuicTransport;
+    if (typeof fn !== 'function') {
+        return null;
+    }
+    try {
+        const transport = await fn(config);
+        return isCompatibleTransport(transport, typeof config?.port === 'number')
+            ? transport
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Plugin-owned ADR-104 WebSocket fallback. This closes issue #2618's
+ * failure mode: current `agentic-flow` releases do not export
+ * `agentic-flow/transport/loader`, so the federation plugin must not
+ * depend on that subpath for its baseline wire transport.
+ */
+class WebSocketFallbackTransport {
+    config;
+    handlers = [];
+    server = null;
+    sockets = new Set();
+    constructor(config = {}) {
+        this.config = config;
+    }
+    async send(address, message) {
+        const { default: WebSocket } = await import('ws');
+        const url = address.includes('://') ? address : `ws://${address}`;
+        const socket = new WebSocket(url);
+        await new Promise((resolve, reject) => {
+            socket.on('open', () => {
+                socket.send(JSON.stringify(message), (err) => {
+                    socket.close();
+                    if (err)
+                        reject(err);
+                    else
+                        resolve();
+                });
+            });
+            socket.on('error', (err) => reject(err instanceof Error ? err : new Error(String(err))));
+        });
+    }
+    onMessage(handler) {
+        this.handlers.push(handler);
+    }
+    async listen(port = Number(this.config.port ?? 0), host = String(this.config.host ?? '0.0.0.0')) {
+        const { WebSocketServer } = await import('ws');
+        const server = new WebSocketServer({ port, host });
+        this.server = server;
+        await new Promise((resolve, reject) => {
+            server.on('listening', () => resolve());
+            server.on('error', (err) => reject(err instanceof Error ? err : new Error(String(err))));
+            server.on('connection', (socket, request) => {
+                const ws = socket;
+                this.sockets.add(ws);
+                const remoteAddress = (request?.socket);
+                const address = remoteAddress?.remoteAddress
+                    ? `${remoteAddress.remoteAddress}${remoteAddress.remotePort ? `:${remoteAddress.remotePort}` : ''}`
+                    : 'unknown';
+                ws.on('message', (data) => {
+                    try {
+                        const raw = typeof data === 'string'
+                            ? data
+                            : Buffer.isBuffer(data)
+                                ? data.toString('utf8')
+                                : String(data);
+                        const message = JSON.parse(raw);
+                        for (const handler of this.handlers)
+                            handler(address, message);
+                    }
+                    catch {
+                        // Drop malformed frames. Signature/envelope validation happens
+                        // above this layer in inbound-dispatcher.
+                    }
+                });
+                ws.on('close', () => this.sockets.delete(ws));
+            });
+        });
+    }
+    async close() {
+        for (const socket of this.sockets)
+            socket.close();
+        this.sockets.clear();
+        if (this.server) {
+            await new Promise((resolve) => this.server?.close(resolve));
+            this.server = null;
+        }
+    }
+}
+/**
+ * Probe the `midstreamer` npm package for a real QUIC transport.
+ * Returns `null` when the env flag is off, when the package isn't
+ * installed, when the import surface doesn't match expectations, or
+ * when the loaded module is detectably the WASM stub (per ADR-119
+ * the current shipped build is a counter-tracking stub — `isNative()`
+ * or `isStub()` probes are checked when available).
+ *
+ * The function never throws — any failure becomes `null` so the
+ * outer `loadFederationTransport` can transparently fall back.
+ */
+async function probeMidstreamerTransport(config) {
+    if (process.env.MIDSTREAMER_QUIC_NATIVE !== '1') {
+        return null;
+    }
+    let mod;
+    try {
+        // Lazy + indirect so bundlers don't try to resolve at compile time.
+        // Prefer the `midstreamer/quic` sub-path (added in midstreamer@0.3.1
+        // per upstream ruvnet/midstream#81) which exposes
+        // `loadQuicTransport` directly without WASM init. Fall back to the
+        // root `midstreamer` package for older versions that put the QUIC
+        // surface on the default export.
+        const dynamicImport = new Function('s', 'return import(s)');
+        try {
+            mod = await dynamicImport('midstreamer/quic');
+        }
+        catch {
+            mod = await dynamicImport('midstreamer');
+        }
+    }
+    catch {
+        return null;
+    }
+    const candidate = mod;
+    // CommonJS sub-path exposes its API via `module.exports = {...};
+    // module.exports.default = module.exports;` — so we also accept the
+    // `.default` form. ESM imports flatten the named exports directly.
+    const surface = (typeof candidate.loadQuicTransport === 'function'
+        ? candidate
+        : candidate.default);
+    if (!surface) {
+        return null;
+    }
+    // Refuse to use the WASM stub. ADR-119 documented the previous
+    // QuicMultistream as a counter-tracking stub with no real UDP, TLS,
+    // or protocol — using it would silently downgrade the federation
+    // path. midstreamer@0.3.1+ ships a real QUIC transport via
+    // `midstreamer/quic` (ADR-120, Step 1 — upstream PR ruvnet/midstream#81)
+    // and reports `isNative() === true`. Older versions either expose
+    // `isStub()` returning true or omit both probes.
+    if (typeof surface.isStub === 'function' && surface.isStub()) {
+        return { transport: null, reason: 'midstreamer module reports isStub() === true; refusing to bind a stub QUIC backend (ADR-119)' };
+    }
+    if (typeof surface.loadQuicTransport !== 'function') {
+        return null;
+    }
+    if (typeof surface.isNative === 'function' && !surface.isNative()) {
+        return null;
+    }
+    try {
+        const transport = await surface.loadQuicTransport(config);
+        return isCompatibleTransport(transport, typeof config?.port === 'number')
+            ? { transport }
+            : {
+                transport: null,
+                reason: 'midstreamer transport does not implement the federation send/onMessage/listen contract',
+            };
+    }
+    catch (err) {
+        return {
+            transport: null,
+            reason: `midstreamer.loadQuicTransport failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+/**
+ * Top-level loader for federation transport. Identical signature to
+ * agentic-flow's `loadQuicTransport`, but with the midstreamer-first
+ * preference. Use this from `plugins/ruflo-federation` in place of
+ * the bare `loadQuicTransport`.
+ *
+ * Failure mode: if midstreamer is requested but rejects (stub, init
+ * error, missing package), this function falls through to the
+ * agentic-flow loader. If current agentic-flow does not export its
+ * historical loader subpath, the plugin-owned WebSocket fallback is
+ * used directly (ADR-104, #2618).
+ */
+export async function loadFederationTransport(config) {
+    const probe = await probeMidstreamerTransport(config);
+    if (probe && probe.transport) {
+        return { transport: probe.transport, source: 'midstreamer-native' };
+    }
+    const transport = await loadAgenticFlowQuicTransport(config);
+    if (transport) {
+        return {
+            transport,
+            source: 'agentic-flow-loader',
+            fallbackReason: probe?.reason,
+        };
+    }
+    return {
+        transport: new WebSocketFallbackTransport(config),
+        source: 'websocket-fallback',
+        fallbackReason: probe?.reason ?? 'agentic-flow transport loader unavailable; using plugin-owned WebSocket fallback',
+    };
+}
+//# sourceMappingURL=midstream-aware-loader.js.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/transport/midstream-aware-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"midstream-aware-loader.js","sourceRoot":"","sources":["../../src/transport/midstream-aware-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA+BH,SAAS,qBAAqB,CAC5B,KAAc,EACd,aAAa,GAAG,KAAK;IAErB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,OAAO,CACL,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;QACpC,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU;QACzC,CAAC,CAAC,aAAa,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,4BAA4B,CACzC,MAA4B;IAE5B,8DAA8D;IAC9D,+DAA+D;IAC/D,kEAAkE;IAClE,iEAAiE;IACjE,mBAAmB;IACnB,IAAI,GAKH,CAAC;IACF,IAAI,CAAC;QACH,sEAAsE;QACtE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,8DAA8D;QAC9D,8DAA8D;QAC9D,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAA0B,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GACN,OAAO,GAAG,CAAC,iBAAiB,KAAK,UAAU;QACzC,CAAC,CAAC,GAAG,CAAC,iBAAiB;QACvB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,qBAAqB,CAAC,SAAS,EAAE,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC;YACvE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAuBD;;;;;GAKG;AACH,MAAM,0BAA0B;IAOD;IAJrB,QAAQ,GAA4D,EAAE,CAAC;IACvE,MAAM,GAA+B,IAAI,CAAC;IAC1C,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE3C,YAA6B,SAA8B,EAAE;QAAhC,WAAM,GAAN,MAAM,CAA0B;IAAG,CAAC;IAEjE,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,CAAkB,CAAC;QAEnD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;gBACrB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,GAAW,EAAE,EAAE;oBACnD,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,IAAI,GAAG;wBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;wBAChB,OAAO,EAAE,CAAC;gBACjB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,OAAyD;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC;QAC7F,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAwB,CAAC;QAC1E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACxC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClG,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAe,EAAE,OAAgB,EAAE,EAAE;gBAC5D,MAAM,EAAE,GAAG,MAAuB,CAAC;gBACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrB,MAAM,aAAa,GAAG,CAAE,OAAwE,EAAE,MAAM,CAAC,CAAC;gBAC1G,MAAM,OAAO,GAAG,aAAa,EAAE,aAAa;oBAC1C,CAAC,CAAC,GAAG,aAAa,CAAC,aAAa,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;oBACnG,CAAC,CAAC,SAAS,CAAC;gBAEd,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,EAAE;oBACjC,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ;4BAClC,CAAC,CAAC,IAAI;4BACN,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gCACrB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gCACvB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;wBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;wBAChD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;4BAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACjE,CAAC;oBAAC,MAAM,CAAC;wBACP,+DAA+D;wBAC/D,0CAA0C;oBAC5C,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK;QACT,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,yBAAyB,CACtC,MAA4B;IAE5B,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,GAAG,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,oEAAoE;QACpE,qEAAqE;QACrE,kDAAkD;QAClD,mEAAmE;QACnE,kEAAkE;QAClE,iCAAiC;QACjC,MAAM,aAAa,GAAoC,IAAI,QAAQ,CACjE,GAAG,EACH,kBAAkB,CACgB,CAAC;QACrC,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,GASjB,CAAC;IAEF,iEAAiE;IACjE,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,iBAAiB,KAAK,UAAU;QAChE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,OAAO,CAIR,CAAC;IACd,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAC/D,oEAAoE;IACpE,iEAAiE;IACjE,2DAA2D;IAC3D,yEAAyE;IACzE,kEAAkE;IAClE,iDAAiD;IACjD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7D,OAAO,EAAE,SAAS,EAAE,IAAiC,EAAE,MAAM,EAAE,8FAA8F,EAAE,CAAC;IAClK,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,qBAAqB,CAAC,SAAS,EAAE,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC;YACvE,CAAC,CAAC,EAAE,SAAS,EAAE;YACf,CAAC,CAAC;gBACE,SAAS,EAAE,IAAiC;gBAC5C,MAAM,EAAE,wFAAwF;aACjG,CAAC;IACR,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,SAAS,EAAE,IAAiC;YAC5C,MAAM,EAAE,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACpG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAA4B;IAE5B,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,SAAS;YACT,MAAM,EAAE,qBAAqB;YAC7B,cAAc,EAAE,KAAK,EAAE,MAAM;SAC9B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,IAAI,0BAA0B,CAAC,MAAM,CAAC;QACjD,MAAM,EAAE,oBAAoB;QAC5B,cAAc,EAAE,KAAK,EAAE,MAAM,IAAI,kFAAkF;KACpH,CAAC;AACJ,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/version.d.ts

@@ -0,0 +1,3 @@
+/** Single source of truth for runtime, manifest, CLI, and MCP version metadata. */
+export declare const FEDERATION_PLUGIN_VERSION: "1.0.0-alpha.18";
+//# sourceMappingURL=version.d.ts.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,EAAG,gBAAyB,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/dist/version.js

@@ -0,0 +1,3 @@
+/** Single source of truth for runtime, manifest, CLI, and MCP version metadata. */
+export const FEDERATION_PLUGIN_VERSION = '1.0.0-alpha.18';
+//# sourceMappingURL=version.js.map

package/node_modules/@claude-flow/plugin-agent-federation/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAyB,CAAC"}

package/node_modules/@claude-flow/plugin-agent-federation/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@claude-flow/plugin-agent-federation",
+  "version": "1.0.0-alpha.18",
+  "description": "Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails.",
+  "homepage": "https://github.com/ruvnet/ruflo",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "ruflo-federation": "dist/bin.js"
+  },
+  "files": [
+    "dist/**",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "benchmark:canonicalization": "npm run build && node scripts/benchmark-envelope-canonicalization.mjs",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist"
+  },
+  "devDependencies": {
+    "@claude-flow/shared": "3.0.0-alpha.8",
+    "@claude-flow/security": "file:../security",
+    "@types/ws": "^8.18.1",
+    "agentic-flow": "2.0.12-fix.8",
+    "typescript": "^5.4.0",
+    "vitest": "^4.1.0"
+  },
+  "keywords": [
+    "federation",
+    "multi-agent",
+    "trust",
+    "pii",
+    "security",
+    "audit",
+    "compliance"
+  ],
+  "author": "Claude Flow Team",
+  "license": "MIT",
+  "rufloBundledRuntime": {
+    "format": 1,
+    "sourceDependencies": {
+      "dependencies": {
+        "@noble/ed25519": "^2.0.0",
+        "ws": "^8.20.0"
+      },
+      "peerDependencies": {
+        "agentic-flow": ">=2.0.12-fix.8 <4.0.0",
+        "midstreamer": ">=0.3.1"
+      },
+      "peerDependenciesMeta": {
+        "agentic-flow": {
+          "optional": true
+        },
+        "midstreamer": {
+          "optional": true
+        }
+      }
+    }
+  }
+}

package/node_modules/@claude-flow/security/README.md

@@ -0,0 +1,292 @@
+# @claude-flow/security
+
+[![npm version](https://img.shields.io/npm/v/@claude-flow/security.svg)](https://www.npmjs.com/package/@claude-flow/security)
+[![npm downloads](https://img.shields.io/npm/dm/@claude-flow/security.svg)](https://www.npmjs.com/package/@claude-flow/security)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.0+-blue.svg)](https://www.typescriptlang.org/)
+[![Security Audit](https://img.shields.io/badge/Security-Audited-green.svg)](https://github.com/ruvnet/claude-flow)
+
+> Comprehensive security module for Claude Flow V3 - CVE fixes, input validation, path security, and secure credential management.
+
+## Features
+
+- **CVE Remediation** - Fixes for CVE-2 (Weak Password Hashing), CVE-3 (Hardcoded Credentials), HIGH-1 (Command Injection), HIGH-2 (Path Traversal)
+- **Password Hashing** - Secure bcrypt-based password hashing with configurable rounds (12+ recommended)
+- **Credential Generation** - Cryptographically secure credential and API key generation
+- **Safe Command Execution** - Allowlist-based command execution preventing injection attacks
+- **Path Validation** - Protection against path traversal and symlink attacks
+- **Input Validation** - Zod-based schema validation for all input types
+- **Token Generation** - Secure token creation with HMAC signing
+
+## Installation
+
+```bash
+npm install @claude-flow/security
+```
+
+## Standalone use (without the Ruflo CLI)
+
+This is a plain library — every primitive (`PasswordHasher`,
+`PathValidator`, `SafeExecutor`, `InputValidator`, `CredentialGenerator`)
+is independently importable. No CLI, no MCP server, no daemon. The
+primitives close CVE-2 (weak hashing), CVE-3 (default credentials),
+HIGH-1 (command injection), and HIGH-2 (path traversal) — drop them
+into any Node app that needs to validate at a system boundary.
+
+### Recipe — Validate input, hash a password, generate an API key
+
+```typescript
+// recipe.mjs
+import {
+  InputValidator,
+  EmailSchema,
+  PasswordHasher,
+  createCredentialGenerator,
+} from '@claude-flow/security';
+
+// 1. Validate user input at the boundary (Zod schemas, no surprises)
+const email = InputValidator.validate(EmailSchema, 'user@example.com');
+//             ↳ throws if invalid; returns the typed value otherwise
+
+// 2. Hash a password with bcrypt at the recommended cost (CVE-2)
+//    Default policy: ≥8 chars, ≥1 upper, ≥1 lower, ≥1 digit.
+//    Tune with new PasswordHasher({ rounds, requireUppercase, ... }).
+const hasher = new PasswordHasher({ rounds: 12 });
+const hash   = await hasher.hash('CorrectHorseBatteryStaple9');
+const ok     = await hasher.verify('CorrectHorseBatteryStaple9', hash); // true
+
+// 3. Generate a high-entropy API key (CVE-3) — uses crypto.randomBytes
+//    under the hood and refuses to emit keys below 32 bytes of entropy.
+const creds = createCredentialGenerator();
+const apiKey = creds.generateApiKey('ck_live_');
+console.log(apiKey.keyId, apiKey.key.slice(0, 16) + '…');
+// → 7e2b1a9c-…  ck_live_xX9aQ…
+```
+
+### Recipe — Refuse command injection + path traversal
+
+```typescript
+import {
+  createDevelopmentExecutor,
+  createProjectPathValidator,
+} from '@claude-flow/security';
+
+// SafeExecutor — only the allow-listed commands ever run (HIGH-1)
+const exec = createDevelopmentExecutor({ projectRoot: process.cwd() });
+const { stdout } = await exec.execute('git', ['status', '--porcelain']);
+
+// PathValidator — refuses traversal and symlinks out of the project (HIGH-2)
+const paths = createProjectPathValidator(process.cwd());
+const result = await paths.validate('../../etc/passwd');
+if (!result.isValid) console.log('blocked:', result.errors.join('; '));
+// → blocked: Path traversal pattern detected
+```
+
+## Quick Start
+
+```typescript
+import { createSecurityModule } from '@claude-flow/security';
+
+// Create a complete security module
+const security = createSecurityModule({
+  projectRoot: '/workspaces/project',
+  hmacSecret: process.env.HMAC_SECRET!,
+  bcryptRounds: 12,
+  allowedCommands: ['git', 'npm', 'node']
+});
+
+// Hash a password
+const hash = await security.passwordHasher.hash('userPassword123');
+
+// Validate a path
+const pathResult = await security.pathValidator.validate('/workspaces/project/src/file.ts');
+
+// Execute command safely
+const output = await security.safeExecutor.execute('git', ['status']);
+
+// Generate secure credentials
+const creds = await security.credentialGenerator.generate();
+```
+
+## API Reference
+
+### Password Hashing (CVE-2 Fix)
+
+```typescript
+import { PasswordHasher, createPasswordHasher } from '@claude-flow/security';
+
+const hasher = createPasswordHasher({ rounds: 12 });
+
+// Hash password
+const hash = await hasher.hash('password');
+
+// Verify password
+const isValid = await hasher.verify('password', hash);
+
+// Check if hash needs rehashing
+const needsRehash = hasher.needsRehash(hash);
+```
+
+### Credential Generation (CVE-3 Fix)
+
+```typescript
+import { CredentialGenerator, generateCredentials } from '@claude-flow/security';
+
+const generator = new CredentialGenerator();
+
+// Generate API key
+const apiKey = await generator.generateApiKey({
+  prefix: 'cf',
+  length: 32
+});
+
+// Generate complete credentials
+const creds = generateCredentials({
+  includeApiKey: true,
+  includeSecret: true
+});
+```
+
+### Safe Command Execution (HIGH-1 Fix)
+
+```typescript
+import { SafeExecutor, createDevelopmentExecutor } from '@claude-flow/security';
+
+const executor = createDevelopmentExecutor();
+
+// Execute allowed command
+const result = await executor.execute('git', ['status']);
+
+// With timeout
+const result2 = await executor.execute('npm', ['install'], {
+  timeout: 60000,
+  cwd: '/workspaces/project'
+});
+```
+
+### Path Validation (HIGH-2 Fix)
+
+```typescript
+import { PathValidator, createProjectPathValidator } from '@claude-flow/security';
+
+const validator = createProjectPathValidator('/workspaces/project');
+
+// Validate path
+const result = await validator.validate('../../../etc/passwd');
+// { valid: false, reason: 'Path traversal detected' }
+
+// Safe path
+const result2 = await validator.validate('/workspaces/project/src/index.ts');
+// { valid: true, normalized: '/workspaces/project/src/index.ts' }
+```
+
+### Input Validation
+
+```typescript
+import {
+  InputValidator,
+  SafeStringSchema,
+  EmailSchema,
+  PasswordSchema,
+  SpawnAgentSchema
+} from '@claude-flow/security';
+
+// Validate email
+const email = EmailSchema.parse('user@example.com');
+
+// Validate password
+const password = PasswordSchema.parse('SecurePass123!');
+
+// Validate agent spawn request
+const agentRequest = SpawnAgentSchema.parse({
+  type: 'coder',
+  name: 'code-agent-1'
+});
+
+// Sanitize HTML
+import { sanitizeHtml } from '@claude-flow/security';
+const safe = sanitizeHtml('<script>alert("xss")</script>Hello');
+// 'Hello'
+```
+
+### Token Generation
+
+```typescript
+import { TokenGenerator, quickGenerate } from '@claude-flow/security';
+
+const generator = new TokenGenerator({
+  hmacSecret: process.env.HMAC_SECRET!
+});
+
+// Generate signed token
+const token = await generator.generate({
+  type: 'session',
+  expiresIn: 3600
+});
+
+// Verify token
+const verified = await generator.verify(token);
+
+// Quick generation
+const sessionToken = quickGenerate.sessionToken();
+const verificationCode = quickGenerate.verificationCode();
+```
+
+## Security Constants
+
+```typescript
+import {
+  MIN_BCRYPT_ROUNDS,      // 12
+  MAX_BCRYPT_ROUNDS,      // 14
+  MIN_PASSWORD_LENGTH,    // 8
+  MAX_PASSWORD_LENGTH,    // 72 (bcrypt limit)
+  DEFAULT_TOKEN_EXPIRATION,   // 3600 (1 hour)
+  DEFAULT_SESSION_EXPIRATION  // 86400 (24 hours)
+} from '@claude-flow/security';
+```
+
+## Security Audit
+
+```typescript
+import { auditSecurityConfig } from '@claude-flow/security';
+
+const warnings = auditSecurityConfig({
+  bcryptRounds: 10,
+  hmacSecret: 'short'
+});
+
+// ['bcryptRounds (10) below recommended minimum (12)',
+//  'hmacSecret should be at least 32 characters']
+```
+
+## Validation Schemas
+
+| Schema | Description |
+|--------|-------------|
+| `SafeStringSchema` | Basic safe string with length limits |
+| `IdentifierSchema` | Alphanumeric identifiers |
+| `FilenameSchema` | Safe filenames |
+| `EmailSchema` | Email addresses |
+| `PasswordSchema` | Secure passwords |
+| `UUIDSchema` | UUID v4 format |
+| `HttpsUrlSchema` | HTTPS URLs only |
+| `SemverSchema` | Semantic versions |
+| `PortSchema` | Valid port numbers |
+| `IPv4Schema` | IPv4 addresses |
+| `SpawnAgentSchema` | Agent spawn requests |
+| `TaskInputSchema` | Task definitions |
+| `SecurityConfigSchema` | Security configuration |
+
+## Dependencies
+
+- `bcrypt` - Password hashing
+- `zod` - Schema validation
+
+## Related Packages
+
+- [@claude-flow/shared](../shared) - Shared types and utilities
+- [@claude-flow/swarm](../swarm) - Swarm coordination (secure agent spawning)
+
+## License
+
+MIT