@claude-flow/cli 3.5.67 → 3.5.69

package/dist/src/mcp-tools/validate-input.js

@@ -0,0 +1,135 @@
+/**
+ * Input Validation for MCP Tools
+ *
+ * Loads @claude-flow/security validators when available
+ * and provides lightweight fallback validation otherwise.
+ *
+ * Addresses #1425: security validators were implemented but never wired to runtime.
+ */
+// Patterns for input sanitization (inline — no external dependency required)
+const SHELL_META = /[;&|`$(){}[\]<>!#\\]/;
+const PATH_TRAVERSAL = /\.\.[/\\]/;
+const IDENTIFIER_RE = /^[a-zA-Z0-9_][a-zA-Z0-9_\-.:]{0,127}$/;
+/**
+ * Validate an identifier (agent ID, agent type, namespace, key, etc.)
+ * Rejects shell metacharacters and path traversal.
+ */
+export function validateIdentifier(value, label) {
+    if (typeof value !== 'string' || value.length === 0) {
+        return { valid: false, sanitized: '', error: `${label} must be a non-empty string` };
+    }
+    if (value.length > 128) {
+        return { valid: false, sanitized: '', error: `${label} exceeds 128 characters` };
+    }
+    if (SHELL_META.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains disallowed characters` };
+    }
+    if (PATH_TRAVERSAL.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains path traversal` };
+    }
+    if (!IDENTIFIER_RE.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains invalid characters (allowed: alphanumeric, _, -, ., :)` };
+    }
+    return { valid: true, sanitized: value };
+}
+/**
+ * Validate a file path (prevents traversal and shell injection).
+ */
+export function validatePath(value, label) {
+    if (typeof value !== 'string' || value.length === 0) {
+        return { valid: false, sanitized: '', error: `${label} must be a non-empty string` };
+    }
+    if (value.length > 4096) {
+        return { valid: false, sanitized: '', error: `${label} exceeds 4096 characters` };
+    }
+    if (PATH_TRAVERSAL.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains path traversal (..)` };
+    }
+    if (SHELL_META.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains shell metacharacters` };
+    }
+    return { valid: true, sanitized: value };
+}
+/**
+ * Validate a free-text string (description, value, etc.)
+ * Allows most characters but rejects shell metacharacters that could cause injection.
+ */
+export function validateText(value, label, maxLen = 10_000) {
+    if (typeof value !== 'string') {
+        return { valid: false, sanitized: '', error: `${label} must be a string` };
+    }
+    if (value.length > maxLen) {
+        return { valid: false, sanitized: '', error: `${label} exceeds ${maxLen} characters` };
+    }
+    // Strip null bytes
+    const sanitized = value.replace(/\0/g, '');
+    return { valid: true, sanitized };
+}
+/**
+ * Assert validation or throw with a structured error.
+ */
+export function assertValid(result) {
+    if (!result.valid) {
+        throw new Error(`Validation failed: ${result.error}`);
+    }
+    return result.sanitized;
+}
+// Try to load the full @claude-flow/security module for enhanced validation
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+let _securityModule = null;
+let _securityLoaded = false;
+async function getSecurityModule() {
+    if (_securityLoaded)
+        return _securityModule;
+    _securityLoaded = true;
+    try {
+        // Dynamic import — @claude-flow/security is an optional dependency
+        _securityModule = await Function('return import("@claude-flow/security")')();
+    }
+    catch {
+        // @claude-flow/security is optional — fallback to inline validation above
+    }
+    return _securityModule;
+}
+/**
+ * Enhanced validation using @claude-flow/security Zod schemas when available.
+ * Falls back to inline regex validation otherwise.
+ */
+export async function validateAgentSpawn(input) {
+    const errors = [];
+    // Always run inline validation
+    if (input.agentType) {
+        const r = validateIdentifier(input.agentType, 'agentType');
+        if (!r.valid)
+            errors.push(r.error);
+    }
+    if (input.agentId) {
+        const r = validateIdentifier(input.agentId, 'agentId');
+        if (!r.valid)
+            errors.push(r.error);
+    }
+    if (input.domain) {
+        const r = validateIdentifier(input.domain, 'domain');
+        if (!r.valid)
+            errors.push(r.error);
+    }
+    // Try enhanced Zod validation if available
+    const sec = await getSecurityModule();
+    if (sec?.SpawnAgentSchema) {
+        try {
+            sec.SpawnAgentSchema.parse({
+                agentType: input.agentType,
+                name: input.agentId,
+            });
+        }
+        catch (zodErr) {
+            if (zodErr.issues) {
+                for (const issue of zodErr.issues) {
+                    errors.push(`${issue.path.join('.')}: ${issue.message}`);
+                }
+            }
+        }
+    }
+    return { valid: errors.length === 0, errors };
+}
+//# sourceMappingURL=validate-input.js.map

package/dist/src/mcp-tools/validate-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-input.js","sourceRoot":"","sources":["../../../src/mcp-tools/validate-input.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6EAA6E;AAC7E,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAC1C,MAAM,cAAc,GAAG,WAAW,CAAC;AACnC,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAQ9D;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,KAAa;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,6BAA6B,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,yBAAyB,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,iCAAiC,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,0BAA0B,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,kEAAkE,EAAE,CAAC;IAC5H,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,6BAA6B,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,0BAA0B,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,+BAA+B,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,gCAAgC,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,KAAa,EAAE,MAAM,GAAG,MAAM;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,mBAAmB,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,YAAY,MAAM,aAAa,EAAE,CAAC;IACzF,CAAC;IACD,mBAAmB;IACnB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,MAAwB;IAClD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,CAAC;AAC1B,CAAC;AAED,4EAA4E;AAC5E,8DAA8D;AAC9D,IAAI,eAAe,GAA+B,IAAI,CAAC;AACvD,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,KAAK,UAAU,iBAAiB;IAC9B,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,eAAe,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,mEAAmE;QACnE,eAAe,GAAG,MAAO,QAAQ,CAAC,wCAAwC,CAAC,EAAmC,CAAC;IACjH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B;IACrE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,+BAA+B;IAC/B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC3D,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC;IACtC,CAAC;IAED,2CAA2C;IAC3C,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACtC,IAAI,GAAG,EAAE,gBAAgB,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC;gBACzB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI,EAAE,KAAK,CAAC,OAAO;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,MAAW,EAAE,CAAC;YACrB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC"}