@claude-flow/cli 3.71.2 → 3.71.4

package/dist/src/mcp-tools/memory-tools.js

@@ -12,6 +12,7 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from 'fs';
 import { homedir } from 'os';
 import { basename, dirname, join, resolve } from 'path';
+import { containedReadPath, containedWritePath, dbPathError, isLocalCliCall } from './path-containment.js';
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'crypto';
 import { getProjectCwd } from './types.js';
@@ -27,10 +28,21 @@ const LEGACY_MEMORY_DIR = '.claude-flow/memory';
  * deliberately not an implicit `CLAUDE_FLOW_DB_PATH` override because the
  * native/encrypted CLI store and the AgentDB sibling are separate backends.
  */
-function resolveDbPathOption(inputDbPath) {
-    return typeof inputDbPath === 'string' && inputDbPath.trim().length > 0
-        ? resolve(inputDbPath)
-        : undefined;
+/**
+ * Resolve an explicit `dbPath`. MCP callers may only name a SQLite database
+ * file, so the memory tools cannot be aimed at and overwrite an unrelated file;
+ * the local CLI (`--path`) keeps operator-chosen paths as-is.
+ */
+function resolveDbPathOption(inputDbPath, context) {
+    if (typeof inputDbPath !== 'string' || inputDbPath.trim().length === 0)
+        return undefined;
+    const dbPath = resolve(inputDbPath);
+    if (!isLocalCliCall(context)) {
+        const error = dbPathError(dbPath);
+        if (error)
+            throw new Error(error);
+    }
+    return dbPath;
 }
 const MIGRATION_MARKER = '.migrated-to-sqlite';
 function getMemoryDir() {
@@ -462,12 +474,12 @@ export const memoryTools = [
             },
             required: ['key', 'value'],
         },
-        handler: async (input) => {
+        handler: async (input, context) => {
             const missingKey = missingRequiredString(input, 'key', 'memory_store');
             if (missingKey) {
                 return { success: false, key: input.key, stored: false, hasEmbedding: false, ...missingKey };
             }
-            const dbPath = resolveDbPathOption(input.dbPath);
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             if (!dbPath)
                 await ensureInitialized();
             const { storeEntry } = await getMemoryFunctions();
@@ -549,12 +561,12 @@ export const memoryTools = [
             },
             required: ['key'],
         },
-        handler: async (input) => {
+        handler: async (input, context) => {
             const missingKey = missingRequiredString(input, 'key', 'memory_retrieve');
             if (missingKey) {
                 return { key: input.key, namespace: input.namespace, value: null, found: false, ...missingKey };
             }
-            const dbPath = resolveDbPathOption(input.dbPath);
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             if (!dbPath)
                 await ensureInitialized();
             const { getEntry } = await getMemoryFunctions();
@@ -624,12 +636,12 @@ export const memoryTools = [
             },
             required: ['query'],
         },
-        handler: async (input) => {
+        handler: async (input, context) => {
             const missingQuery = missingRequiredString(input, 'query', 'memory_search');
             if (missingQuery) {
                 return { query: input.query, results: [], total: 0, ...missingQuery };
             }
-            const dbPath = resolveDbPathOption(input.dbPath);
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             if (!dbPath)
                 await ensureInitialized();
             const { searchEntries } = await getMemoryFunctions();
@@ -810,12 +822,12 @@ export const memoryTools = [
             },
             required: ['key'],
         },
-        handler: async (input) => {
+        handler: async (input, context) => {
             const missingKey = missingRequiredString(input, 'key', 'memory_delete');
             if (missingKey) {
                 return { success: false, key: input.key, namespace: input.namespace, deleted: false, ...missingKey };
             }
-            const dbPath = resolveDbPathOption(input.dbPath);
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             if (!dbPath)
                 await ensureInitialized();
             const { deleteEntry } = await getMemoryFunctions();
@@ -862,8 +874,8 @@ export const memoryTools = [
                 dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
         },
-        handler: async (input) => {
-            const dbPath = resolveDbPathOption(input.dbPath);
+        handler: async (input, context) => {
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             if (!dbPath)
                 await ensureInitialized();
             const { listEntries } = await getMemoryFunctions();
@@ -939,11 +951,11 @@ export const memoryTools = [
                 dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
         },
-        handler: async (input) => {
+        handler: async (input, context) => {
             if (input.dbPath !== undefined && (typeof input.dbPath !== 'string' || !input.dbPath.trim())) {
                 return memoryStatsUnavailable('dbPath must be a non-empty string');
             }
-            const dbPath = resolveDbPathOption(input.dbPath);
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             // An explicit read must not initialize or migrate the unrelated default store.
             if (!dbPath)
                 await ensureInitialized();
@@ -1648,18 +1660,19 @@ export const memoryTools = [
             },
             required: ['outputPath'],
         },
-        handler: async (input) => {
-            const requestedDbPath = typeof input.dbPath === 'string' && input.dbPath.trim()
-                ? resolve(input.dbPath)
-                : undefined;
+        handler: async (input, context) => {
+            const requestedOutput = String(input.outputPath ?? '');
+            if (!requestedOutput)
+                return { error: 'outputPath is required' };
+            const outputPath = isLocalCliCall(context) ? resolve(requestedOutput) : containedWritePath(requestedOutput, ['.json']);
+            if (!outputPath)
+                return { error: 'outputPath must be a .json file inside the project directory (not a symlink, not in .git)' };
+            const requestedDbPath = resolveDbPathOption(input.dbPath, context);
             // An explicit file selection is a single-store read. Do not initialize or
             // migrate the unrelated default store just to export a snapshot.
             if (!requestedDbPath)
                 await ensureInitialized();
             const { listEntries } = await getMemoryFunctions();
-            const outputPath = String(input.outputPath ?? '');
-            if (!outputPath)
-                return { error: 'outputPath is required' };
             const namespace = input.namespace ? String(input.namespace) : undefined;
             if (namespace) {
                 const v = validateIdentifier(namespace, 'namespace');
@@ -1770,25 +1783,29 @@ export const memoryTools = [
             },
             required: ['inputPath'],
         },
-        handler: async (input) => {
-            const dbPath = typeof input.dbPath === 'string' && input.dbPath.trim()
-                ? resolve(input.dbPath)
-                : undefined;
+        handler: async (input, context) => {
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             await ensureInitialized(dbPath);
             const { storeEntry } = await getMemoryFunctions();
             const t0 = Date.now();
             // Values are re-embedded on import; count the vectors actually written
             // rather than reporting a constant 0 next to entries that show a vector.
             let vectors = 0;
-            const inputPath = String(input.inputPath ?? '');
-            if (!inputPath || !existsSync(inputPath))
-                return { error: `File not found: ${inputPath || '(empty)'}` };
+            const requestedInput = String(input.inputPath ?? '');
+            const inputPath = !requestedInput ? null
+                : isLocalCliCall(context) ? (existsSync(requestedInput) ? resolve(requestedInput) : null)
+                    : containedReadPath(requestedInput);
+            if (!inputPath) {
+                return { error: isLocalCliCall(context) || !requestedInput
+                        ? `File not found: ${requestedInput || '(empty)'}`
+                        : 'inputPath must be an existing regular file inside the project directory (not a symlink)' };
+            }
             let doc;
             try {
                 doc = JSON.parse(readFileSync(inputPath, 'utf-8'));
             }
-            catch (e) {
-                return { error: `Invalid export JSON: ${e.message}` };
+            catch {
+                return { error: 'inputPath is not a valid memory export (JSON parse failed)' };
             }
             const entries = Array.isArray(doc.entries) ? doc.entries : [];
             const nsOverride = input.namespace ? String(input.namespace) : undefined;

package/dist/src/mcp-tools/neural-tools.js

@@ -12,6 +12,7 @@
  * Note: For production neural features, use @claude-flow/neural module
  */
 import { getProjectCwd } from './types.js';
+import { nullPrototypeRecords } from './record-store.js';
 import { validateIdentifier, validateText } from './validate-input.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
@@ -223,13 +224,18 @@ function loadNeuralStore() {
     try {
         const path = getNeuralPath();
         if (existsSync(path)) {
-            return JSON.parse(readFileSync(path, 'utf-8'));
+            const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                parsed.models = nullPrototypeRecords(parsed.models);
+                parsed.patterns = nullPrototypeRecords(parsed.patterns);
+                return parsed;
+            }
         }
     }
     catch {
         // Return empty store
     }
-    return { models: {}, patterns: {}, version: '3.0.0' };
+    return { models: nullPrototypeRecords(undefined), patterns: nullPrototypeRecords(undefined), version: '3.0.0' };
 }
 /**
  * ADR-176 flywheel: expose the stored patterns (id/name/content) so the

package/dist/src/mcp-tools/path-containment.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Path checks for MCP tools that read or write a caller-named file.
+ *
+ * Paths in tool input come from whoever drives the MCP server, including a
+ * model following injected instructions. A tool that writes or reads such a
+ * path must keep it inside the project directory, and must not follow a
+ * symlink out of it.
+ */
+/**
+ * Resolve a caller-named output file inside the project. The real parent
+ * directory must be inside the real project root and outside `.git`, and an
+ * existing target must be a regular, non-executable file — not a symlink.
+ * `extensions`, when given, lists the allowed lower-case file extensions.
+ */
+export declare function containedWritePath(p: string, extensions?: readonly string[]): string | null;
+/** Resolve a caller-named input file inside the project: a regular file, not a symlink. */
+export declare function containedReadPath(p: string): string | null;
+/**
+ * Check a caller-named memory database path. It may live outside the project
+ * (the CLI's `--path` flag passes one), so this does not contain it; instead
+ * it refuses anything that is not plainly a SQLite database (plaintext, or
+ * encrypted at rest per ADR-096), so the memory tools cannot be pointed at and
+ * overwrite an unrelated file.
+ */
+export declare function dbPathError(p: string): string | null;
+/**
+ * Marks a tool call made by the local CLI on the operator's behalf (for
+ * example `ruflo memory export --output ~/backup.json`). MCP requests arrive
+ * as JSON and cannot carry a symbol key, so this cannot be forged remotely.
+ */
+export declare const LOCAL_CLI_CALL: unique symbol;
+export declare function localCliContext(): Record<string, unknown>;
+export declare function isLocalCliCall(context: unknown): boolean;
+//# sourceMappingURL=path-containment.d.ts.map

package/dist/src/mcp-tools/path-containment.js

@@ -0,0 +1,133 @@
+/**
+ * Path checks for MCP tools that read or write a caller-named file.
+ *
+ * Paths in tool input come from whoever drives the MCP server, including a
+ * model following injected instructions. A tool that writes or reads such a
+ * path must keep it inside the project directory, and must not follow a
+ * symlink out of it.
+ */
+import { closeSync, lstatSync, openSync, readSync, realpathSync } from 'node:fs';
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { isNonProjectDir } from '@claude-flow/cli-core/mcp-tools/types';
+import { getProjectCwd } from './types.js';
+import { existingFileIsEncrypted } from '../fs-secure.js';
+function lstatOrNull(p) {
+    try {
+        return lstatSync(p);
+    }
+    catch {
+        return null;
+    }
+}
+function projectRoot() {
+    const root = realpathSync(getProjectCwd());
+    // A server started in a home or filesystem root has no project to contain
+    // writes to; "inside the root" would mean the whole home directory.
+    return isNonProjectDir(root) ? null : root;
+}
+function insideRoot(root, target) {
+    const rel = relative(root, target);
+    if (!rel || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+        return false;
+    return !rel.split(sep).includes('.git');
+}
+/**
+ * Resolve a caller-named output file inside the project. The real parent
+ * directory must be inside the real project root and outside `.git`, and an
+ * existing target must be a regular, non-executable file — not a symlink.
+ * `extensions`, when given, lists the allowed lower-case file extensions.
+ */
+export function containedWritePath(p, extensions) {
+    if (!p || p.includes('\0'))
+        return null;
+    try {
+        const root = projectRoot();
+        if (!root)
+            return null;
+        const abs = resolve(root, p);
+        if (extensions && !extensions.includes(extname(abs).toLowerCase()))
+            return null;
+        const target = join(realpathSync(dirname(abs)), basename(abs));
+        if (!insideRoot(root, target))
+            return null;
+        const existing = lstatOrNull(target);
+        if (existing && (existing.isSymbolicLink() || !existing.isFile() || (existing.mode & 0o111) !== 0))
+            return null;
+        return target;
+    }
+    catch {
+        return null;
+    }
+}
+/** Resolve a caller-named input file inside the project: a regular file, not a symlink. */
+export function containedReadPath(p) {
+    if (!p || p.includes('\0'))
+        return null;
+    try {
+        const root = projectRoot();
+        if (!root)
+            return null;
+        const abs = resolve(root, p);
+        const existing = lstatOrNull(abs);
+        if (!existing || existing.isSymbolicLink() || !existing.isFile())
+            return null;
+        const target = realpathSync(abs);
+        return insideRoot(root, target) ? target : null;
+    }
+    catch {
+        return null;
+    }
+}
+const DB_EXTENSIONS = ['.db', '.sqlite', '.sqlite3'];
+const SQLITE_HEADER = 'SQLite format 3\0';
+/**
+ * Check a caller-named memory database path. It may live outside the project
+ * (the CLI's `--path` flag passes one), so this does not contain it; instead
+ * it refuses anything that is not plainly a SQLite database (plaintext, or
+ * encrypted at rest per ADR-096), so the memory tools cannot be pointed at and
+ * overwrite an unrelated file.
+ */
+export function dbPathError(p) {
+    if (p.includes('\0'))
+        return 'dbPath contains a null byte';
+    if (!DB_EXTENSIONS.includes(extname(p).toLowerCase())) {
+        return `dbPath must end in ${DB_EXTENSIONS.join(', ')}`;
+    }
+    const existing = lstatOrNull(p);
+    if (!existing)
+        return null;
+    if (existing.isSymbolicLink())
+        return 'dbPath must not be a symlink';
+    if (!existing.isFile())
+        return 'dbPath must be a regular file';
+    if (existing.size === 0 || existingFileIsEncrypted(p) === true)
+        return null;
+    const header = Buffer.alloc(SQLITE_HEADER.length);
+    let fd;
+    try {
+        fd = openSync(p, 'r');
+        readSync(fd, header, 0, header.length, 0);
+    }
+    catch {
+        return 'dbPath could not be read';
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+    return header.toString('latin1') === SQLITE_HEADER ? null : 'dbPath is not a SQLite database';
+}
+/**
+ * Marks a tool call made by the local CLI on the operator's behalf (for
+ * example `ruflo memory export --output ~/backup.json`). MCP requests arrive
+ * as JSON and cannot carry a symbol key, so this cannot be forged remotely.
+ */
+export const LOCAL_CLI_CALL = Symbol('ruflo.localCliCall');
+export function localCliContext() {
+    return { [LOCAL_CLI_CALL]: true };
+}
+export function isLocalCliCall(context) {
+    return !!context && typeof context === 'object'
+        && context[LOCAL_CLI_CALL] === true;
+}
+//# sourceMappingURL=path-containment.js.map

package/dist/src/mcp-tools/record-store.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Give a record map a null prototype. Record keys come from MCP tool input; on
+ * a plain object `__proto__` or `constructor` resolve to Object.prototype or a
+ * built-in, which a handler would then write into. A null-prototype map only
+ * ever returns its own records.
+ */
+export declare function nullPrototypeRecords<M extends object>(map: M | undefined | null): M;
 /** Only an absent store is empty. Failed reads must never authorize replacement. */
 export declare function readRecordStore<T>(path: string, collection: string, empty: () => T): T;
 //# sourceMappingURL=record-store.d.ts.map

package/dist/src/mcp-tools/record-store.js

@@ -1,4 +1,17 @@
 import { readFileSync } from 'node:fs';
+/**
+ * Give a record map a null prototype. Record keys come from MCP tool input; on
+ * a plain object `__proto__` or `constructor` resolve to Object.prototype or a
+ * built-in, which a handler would then write into. A null-prototype map only
+ * ever returns its own records.
+ */
+export function nullPrototypeRecords(map) {
+    if (map && typeof map === 'object' && !Array.isArray(map)) {
+        Object.setPrototypeOf(map, null);
+        return map;
+    }
+    return Object.create(null);
+}
 /** Only an absent store is empty. Failed reads must never authorize replacement. */
 export function readRecordStore(path, collection, empty) {
     let text;
@@ -6,8 +19,11 @@ export function readRecordStore(path, collection, empty) {
         text = readFileSync(path, 'utf-8');
     }
     catch (error) {
-        if (error.code === 'ENOENT')
-            return empty();
+        if (error.code === 'ENOENT') {
+            const store = empty();
+            store[collection] = nullPrototypeRecords(store[collection]);
+            return store;
+        }
         throw error;
     }
     const store = JSON.parse(text);
@@ -16,6 +32,7 @@ export function readRecordStore(path, collection, empty) {
         || !records || typeof records !== 'object' || Array.isArray(records)) {
         throw new Error(`Invalid ${collection} store at ${path}; existing data was preserved`);
     }
+    nullPrototypeRecords(records);
     return store;
 }
 //# sourceMappingURL=record-store.js.map

package/dist/src/mcp-tools/session-tools.js

@@ -3,11 +3,12 @@
  *
  * Tool definitions for session management with file persistence.
  */
-import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { gunzipSync } from 'node:zlib';
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { containedWritePath } from './path-containment.js';
 import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
 import { validateIdentifier, validateText } from './validate-input.js';
 function isRecord(value) {
@@ -351,41 +352,6 @@ function isSessionRecordLike(value) {
     const v = value;
     return 'data' in v || 'stats' in v || 'sessionId' in v || 'savedAt' in v;
 }
-/**
- * SECURITY: `outputPath` comes from MCP tool input. Resolve it against the
- * project root and require the real (symlink-resolved) parent directory to stay
- * inside the real project root, and refuse an existing symlink as the target,
- * so session_export cannot write files elsewhere on the host. The CLI's
- * `session export` writes its own file and does not pass outputPath.
- */
-function containedExportPath(outputPath) {
-    if (!outputPath || outputPath.includes('\0'))
-        return null;
-    try {
-        const root = realpathSync(getProjectCwd());
-        const abs = resolve(root, outputPath);
-        const parent = realpathSync(dirname(abs));
-        const target = join(parent, basename(abs));
-        const rel = relative(root, target);
-        if (!rel || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))
-            return null;
-        const existing = lstatOrNull(target);
-        if (existing && (existing.isSymbolicLink() || !existing.isFile()))
-            return null;
-        return target;
-    }
-    catch {
-        return null;
-    }
-}
-function lstatOrNull(p) {
-    try {
-        return lstatSync(p);
-    }
-    catch {
-        return null;
-    }
-}
 export const sessionTools = [
     {
         name: 'session_save',
@@ -740,7 +706,7 @@ export const sessionTools = [
             let path = null;
             const outputPath = input.outputPath ? String(input.outputPath) : null;
             if (outputPath) {
-                const target = containedExportPath(outputPath);
+                const target = containedWritePath(outputPath);
                 if (!target)
                     return { sessionId, error: 'outputPath must be a file inside the project directory (no symlinks)' };
                 try {

package/dist/src/mcp-tools/swarm-tools.js

@@ -6,6 +6,7 @@
  */
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { join } from 'node:path';
+import { nullPrototypeRecords } from './record-store.js';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier } from './validate-input.js';
 import { createApscState, isApscAgentEligible, normalizeApscConfig, recordApscSignal, } from '../services/pheromone-adaptive.js';
@@ -92,6 +93,9 @@ export function loadSwarmStore() {
         }
     }
     catch { /* fall through with default */ }
+    if (!store || typeof store !== 'object' || Array.isArray(store))
+        store = { swarms: {}, version: '3.0.0' };
+    store.swarms = nullPrototypeRecords(store.swarms);
     // #1799 — reconcile orphans on every load and persist if anything changed.
     // Cheap (process.kill(pid, 0) is sub-millisecond) and means
     // `swarm_status`/`swarm_health` never see ghost "running" entries.

package/dist/src/mcp-tools/task-tools.js

@@ -117,6 +117,10 @@ export const taskTools = [
             const vDesc = validateText(input.description, 'description');
             if (!vDesc.valid)
                 return { success: false, error: vDesc.error };
+            if (input.assignTo !== undefined && (!Array.isArray(input.assignTo)
+                || !input.assignTo.every(id => validateIdentifier(id, 'assignTo').valid))) {
+                return { success: false, error: 'assignTo must be an array of agent ids' };
+            }
             const store = loadTaskStore();
             const taskId = `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
             const task = {
@@ -134,6 +138,13 @@ export const taskTools = [
             };
             store.tasks[taskId] = task;
             saveTaskStore(store);
+            // Assigning at creation must mark the workers busy, as task_assign and task_update do;
+            // otherwise they read idle while holding the task, and task_complete or task_cancel,
+            // which only release a worker whose currentTask is this task, never free them either.
+            updateAgents(task.assignedTo, (agent) => {
+                agent.status = 'busy';
+                agent.currentTask = taskId;
+            });
             return {
                 taskId,
                 type: task.type,

package/dist/src/mcp-tools/terminal-tools.js

@@ -4,6 +4,7 @@
  * Terminal session management with real command execution.
  */
 import { getProjectCwd } from './types.js';
+import { nullPrototypeRecords } from './record-store.js';
 import { existsSync } from 'node:fs';
 import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
 import { validateEnv, validateIdentifier, validatePath, validateText } from './validate-input.js';
@@ -33,13 +34,17 @@ function loadTerminalStore() {
             // ADR-096 Phase 3: readFileMaybeEncrypted handles both legacy
             // plaintext stores and post-migration encrypted ones via the RFE1
             // magic-byte sniff.
-            return JSON.parse(readFileMaybeEncrypted(path, 'utf-8'));
+            const parsed = JSON.parse(readFileMaybeEncrypted(path, 'utf-8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                parsed.sessions = nullPrototypeRecords(parsed.sessions);
+                return parsed;
+            }
         }
     }
     catch {
         // Return empty store
     }
-    return { sessions: {}, version: '3.0.0' };
+    return { sessions: nullPrototypeRecords(undefined), version: '3.0.0' };
 }
 function saveTerminalStore(store) {
     ensureTerminalDir();

package/dist/src/mcp-tools/validate-input.d.ts

@@ -5,5 +5,7 @@
  * Was a 256-line byte-identical copy. Loads @claude-flow/security validators
  * when available, with lightweight fallback otherwise.
  */
+import { type ValidationResult } from '@claude-flow/cli-core/mcp-tools/validate-input';
 export * from '@claude-flow/cli-core/mcp-tools/validate-input';
+export declare function validateIdentifier(value: unknown, label: string): ValidationResult;
 //# sourceMappingURL=validate-input.d.ts.map

package/dist/src/mcp-tools/validate-input.js

@@ -5,5 +5,19 @@
  * Was a 256-line byte-identical copy. Loads @claude-flow/security validators
  * when available, with lightweight fallback otherwise.
  */
+import { validateIdentifier as coreValidateIdentifier, } from '@claude-flow/cli-core/mcp-tools/validate-input';
 export * from '@claude-flow/cli-core/mcp-tools/validate-input';
+/**
+ * Names that resolve to Object.prototype or a built-in when used as a key on a
+ * plain object. Identifiers key the JSON record stores, so they are refused.
+ * Move this check into cli-core on its next release.
+ */
+const RESERVED_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+export function validateIdentifier(value, label) {
+    const result = coreValidateIdentifier(value, label);
+    if (result.valid && RESERVED_KEYS.has(result.sanitized)) {
+        return { valid: false, sanitized: '', error: `${label} must not be a reserved name (${result.sanitized})` };
+    }
+    return result;
+}
 //# sourceMappingURL=validate-input.js.map

package/dist/src/missions/schemas.d.ts

@@ -77,15 +77,15 @@ export declare const missionRecordSchema: z.ZodObject<{
     updatedAt: string;
     schemaVersion: 1;
     state: "completed" | "cancelled" | "failed" | "blocked" | "running" | "paused" | "queued" | "draft" | "planned" | "awaitingAuthorization" | "pauseRequested" | "verifying" | "cancelRequested";
-    acceptance: {
-        revision: number;
-        criteriaDigest: string;
-    };
     plan: {
         digest: string;
         revision: number;
         taskGraphRef: string;
     };
+    acceptance: {
+        revision: number;
+        criteriaDigest: string;
+    };
     objective: string;
     missionId: string;
     tenantId: string;
@@ -103,15 +103,15 @@ export declare const missionRecordSchema: z.ZodObject<{
     updatedAt: string;
     schemaVersion: 1;
     state: "completed" | "cancelled" | "failed" | "blocked" | "running" | "paused" | "queued" | "draft" | "planned" | "awaitingAuthorization" | "pauseRequested" | "verifying" | "cancelRequested";
-    acceptance: {
-        revision: number;
-        criteriaDigest: string;
-    };
     plan: {
         digest: string;
         revision: number;
         taskGraphRef: string;
     };
+    acceptance: {
+        revision: number;
+        criteriaDigest: string;
+    };
     objective: string;
     missionId: string;
     tenantId: string;
@@ -580,7 +580,6 @@ export declare const planInputSchema: z.ZodObject<{
         } | undefined;
     }>;
 }, "strict", z.ZodTypeAny, {
-    requestId: string;
     plan: {
         tasks: {
             id: string;
@@ -617,10 +616,10 @@ export declare const planInputSchema: z.ZodObject<{
             baseline?: string | undefined;
         }[];
     };
+    requestId: string;
     missionId: string;
     expectedRevision: number;
 }, {
-    requestId: string;
     plan: {
         tasks: {
             id: string;
@@ -657,6 +656,7 @@ export declare const planInputSchema: z.ZodObject<{
             capabilities?: string[] | undefined;
         } | undefined;
     };
+    requestId: string;
     missionId: string;
     expectedRevision: number;
 }>;