@claude-flow/cli 3.71.3 → 3.72.0

package/dist/src/mcp-tools/import-limits.js

@@ -0,0 +1,28 @@
+import { closeSync, constants, fstatSync, openSync, readSync } from 'node:fs';
+export const MAX_IMPORT_BYTES = 16 * 1024 * 1024;
+/** Bound allocation and reads even if an import file grows after its size check. */
+export function readImportFile(file) {
+    const fd = openSync(file, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0));
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile())
+            throw new Error('Import input must be a regular file');
+        if (stat.size > MAX_IMPORT_BYTES)
+            throw new Error('Import file exceeds the 16 MiB limit');
+        const buffer = Buffer.alloc(stat.size + 1);
+        let total = 0;
+        while (total < buffer.length) {
+            const count = readSync(fd, buffer, total, buffer.length - total, null);
+            if (count === 0)
+                break;
+            total += count;
+        }
+        if (total > stat.size)
+            throw new Error('Import input changed size while reading');
+        return buffer.subarray(0, total);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+//# sourceMappingURL=import-limits.js.map

package/dist/src/mcp-tools/memory-tools.js

@@ -12,11 +12,14 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from 'fs';
 import { homedir } from 'os';
 import { basename, dirname, join, resolve } from 'path';
+import { containedReadPath, containedWritePath, dbPathError, isLocalCliCall } from './path-containment.js';
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'crypto';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier } from './validate-input.js';
 import { DEFAULT_SEARCH_THRESHOLD, nearMisses } from '../memory/search-defaults.js';
+import { compileExclusionPatterns, MAX_EXCLUDE_PATTERNS, MAX_EXCLUDE_PATTERN_LENGTH } from './glob-exclusions.js';
+import { readImportFile } from './import-limits.js';
 // #1604: Align with memory-initializer.ts — single source of truth is .swarm/memory.db
 const MEMORY_DIR = '.swarm';
 const LEGACY_MEMORY_FILE = 'store.json';
@@ -27,10 +30,21 @@ const LEGACY_MEMORY_DIR = '.claude-flow/memory';
  * deliberately not an implicit `CLAUDE_FLOW_DB_PATH` override because the
  * native/encrypted CLI store and the AgentDB sibling are separate backends.
  */
-function resolveDbPathOption(inputDbPath) {
-    return typeof inputDbPath === 'string' && inputDbPath.trim().length > 0
-        ? resolve(inputDbPath)
-        : undefined;
+/**
+ * Resolve an explicit `dbPath`. MCP callers may only name a SQLite database
+ * file, so the memory tools cannot be aimed at and overwrite an unrelated file;
+ * the local CLI (`--path`) keeps operator-chosen paths as-is.
+ */
+function resolveDbPathOption(inputDbPath, context) {
+    if (typeof inputDbPath !== 'string' || inputDbPath.trim().length === 0)
+        return undefined;
+    const dbPath = resolve(inputDbPath);
+    if (!isLocalCliCall(context)) {
+        const error = dbPathError(dbPath);
+        if (error)
+            throw new Error(error);
+    }
+    return dbPath;
 }
 const MIGRATION_MARKER = '.migrated-to-sqlite';
 function getMemoryDir() {
@@ -112,37 +126,6 @@ function sanitizeMemoryKey(key) {
     const safe = key.replace(DANGEROUS_KEY_CHARS, '_');
     return safe.length > MAX_KEY_LENGTH ? safe.slice(0, MAX_KEY_LENGTH) : safe;
 }
-// #1937 — minimal glob → RegExp helper for memory_import_claude exclusion
-// patterns. Anchored. Supports the three operators the issue's voice-fidelity
-// workflow needs:
-//   `**` — any chars including path separators
-//   `*`  — any chars except path separators
-//   `?`  — exactly one char except a path separator
-// Everything else is regex-escaped. Used to match absolute file paths.
-function globToRegex(pattern) {
-    // Tokenize so we can replace `**` before `*` without overlap.
-    let out = '';
-    for (let i = 0; i < pattern.length; i++) {
-        const c = pattern[i];
-        if (c === '*' && pattern[i + 1] === '*') {
-            out += '.*';
-            i++;
-        }
-        else if (c === '*') {
-            out += '[^/\\\\]*';
-        }
-        else if (c === '?') {
-            out += '[^/\\\\]';
-        }
-        else if (/[.+^$|(){}\[\]\\]/.test(c)) {
-            out += '\\' + c;
-        }
-        else {
-            out += c;
-        }
-    }
-    return new RegExp('^' + out + '$');
-}
 // #1883 — resolve the Claude-Code project memory directory for the *current*
 // project. Claude Code hashes the project path differently per host OS, and
 // our previous logic only POSIX-slash-replaced cwd, which breaks for:
@@ -462,12 +445,12 @@ export const memoryTools = [
             },
             required: ['key', 'value'],
         },
-        handler: async (input) => {
+        handler: async (input, context) => {
             const missingKey = missingRequiredString(input, 'key', 'memory_store');
             if (missingKey) {
                 return { success: false, key: input.key, stored: false, hasEmbedding: false, ...missingKey };
             }
-            const dbPath = resolveDbPathOption(input.dbPath);
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             if (!dbPath)
                 await ensureInitialized();
             const { storeEntry } = await getMemoryFunctions();
@@ -549,12 +532,12 @@ export const memoryTools = [
             },
             required: ['key'],
         },
-        handler: async (input) => {
+        handler: async (input, context) => {
             const missingKey = missingRequiredString(input, 'key', 'memory_retrieve');
             if (missingKey) {
                 return { key: input.key, namespace: input.namespace, value: null, found: false, ...missingKey };
             }
-            const dbPath = resolveDbPathOption(input.dbPath);
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             if (!dbPath)
                 await ensureInitialized();
             const { getEntry } = await getMemoryFunctions();
@@ -624,12 +607,12 @@ export const memoryTools = [
             },
             required: ['query'],
         },
-        handler: async (input) => {
+        handler: async (input, context) => {
             const missingQuery = missingRequiredString(input, 'query', 'memory_search');
             if (missingQuery) {
                 return { query: input.query, results: [], total: 0, ...missingQuery };
             }
-            const dbPath = resolveDbPathOption(input.dbPath);
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             if (!dbPath)
                 await ensureInitialized();
             const { searchEntries } = await getMemoryFunctions();
@@ -810,12 +793,12 @@ export const memoryTools = [
             },
             required: ['key'],
         },
-        handler: async (input) => {
+        handler: async (input, context) => {
             const missingKey = missingRequiredString(input, 'key', 'memory_delete');
             if (missingKey) {
                 return { success: false, key: input.key, namespace: input.namespace, deleted: false, ...missingKey };
             }
-            const dbPath = resolveDbPathOption(input.dbPath);
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             if (!dbPath)
                 await ensureInitialized();
             const { deleteEntry } = await getMemoryFunctions();
@@ -862,8 +845,8 @@ export const memoryTools = [
                 dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
         },
-        handler: async (input) => {
-            const dbPath = resolveDbPathOption(input.dbPath);
+        handler: async (input, context) => {
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             if (!dbPath)
                 await ensureInitialized();
             const { listEntries } = await getMemoryFunctions();
@@ -939,11 +922,11 @@ export const memoryTools = [
                 dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
         },
-        handler: async (input) => {
+        handler: async (input, context) => {
             if (input.dbPath !== undefined && (typeof input.dbPath !== 'string' || !input.dbPath.trim())) {
                 return memoryStatsUnavailable('dbPath must be a non-empty string');
             }
-            const dbPath = resolveDbPathOption(input.dbPath);
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             // An explicit read must not initialize or migrate the unrelated default store.
             if (!dbPath)
                 await ensureInitialized();
@@ -1116,8 +1099,9 @@ export const memoryTools = [
                 projectPath: { type: 'string', description: '#1883 — explicit project path to hash, used when cwd does not match Claude Code\'s view (e.g. WSL bridge to Windows host). Pass the canonical project root as Claude Code sees it.' },
                 excludeFilePatterns: {
                     type: 'array',
-                    items: { type: 'string' },
-                    description: '#1937 — glob patterns matched against the absolute file path. Files matching ANY pattern are skipped. Supports `*` (any chars within a path segment), `**` (any chars including separators), and `?` (single char). Examples: `**/voice-*.md`, `**/persona-*.md`. Combine with excludeFiles for explicit paths.',
+                    maxItems: MAX_EXCLUDE_PATTERNS,
+                    items: { type: 'string', maxLength: MAX_EXCLUDE_PATTERN_LENGTH },
+                    description: '#1937 — glob patterns matched against the absolute file path. Files matching ANY pattern are skipped. Supports `*` (any chars within a path segment), `**` (any chars including separators), and `?` (single char). At most 64 patterns, 1024 characters and 32 wildcard operators per pattern. Examples: `**/voice-*.md`, `**/persona-*.md`. Combine with excludeFiles for explicit paths.',
                 },
                 excludeFiles: {
                     type: 'array',
@@ -1127,6 +1111,13 @@ export const memoryTools = [
             },
         },
         handler: async (input) => {
+            let excludeMatchers;
+            try {
+                excludeMatchers = compileExclusionPatterns(input.excludeFilePatterns);
+            }
+            catch (error) {
+                return { success: false, imported: 0, error: error.message };
+            }
             await ensureInitialized();
             const { storeEntry } = await getMemoryFunctions();
             const ns = input.namespace || 'claude-memories';
@@ -1139,13 +1130,11 @@ export const memoryTools = [
             const projectPathOverride = input.projectPath;
             const claudeProjectsDir = join(homedir(), '.claude', 'projects');
             // #1937 — voice-fidelity / persona-restricted exclusion.
-            const excludeFilePatterns = Array.isArray(input.excludeFilePatterns) ? input.excludeFilePatterns : [];
             const excludeFilesList = Array.isArray(input.excludeFiles) ? new Set(input.excludeFiles) : new Set();
-            const excludeRegexes = excludeFilePatterns.map(globToRegex);
             const isExcluded = (absPath) => {
                 if (excludeFilesList.has(absPath))
                     return true;
-                return excludeRegexes.some(re => re.test(absPath));
+                return excludeMatchers.some(matches => matches(absPath));
             };
             // Find memory files
             const memoryFiles = [];
@@ -1648,18 +1637,19 @@ export const memoryTools = [
             },
             required: ['outputPath'],
         },
-        handler: async (input) => {
-            const requestedDbPath = typeof input.dbPath === 'string' && input.dbPath.trim()
-                ? resolve(input.dbPath)
-                : undefined;
+        handler: async (input, context) => {
+            const requestedOutput = String(input.outputPath ?? '');
+            if (!requestedOutput)
+                return { error: 'outputPath is required' };
+            const outputPath = isLocalCliCall(context) ? resolve(requestedOutput) : containedWritePath(requestedOutput, ['.json']);
+            if (!outputPath)
+                return { error: 'outputPath must be a .json file inside the project directory (not a symlink, not in .git)' };
+            const requestedDbPath = resolveDbPathOption(input.dbPath, context);
             // An explicit file selection is a single-store read. Do not initialize or
             // migrate the unrelated default store just to export a snapshot.
             if (!requestedDbPath)
                 await ensureInitialized();
             const { listEntries } = await getMemoryFunctions();
-            const outputPath = String(input.outputPath ?? '');
-            if (!outputPath)
-                return { error: 'outputPath is required' };
             const namespace = input.namespace ? String(input.namespace) : undefined;
             if (namespace) {
                 const v = validateIdentifier(namespace, 'namespace');
@@ -1763,33 +1753,39 @@ export const memoryTools = [
         inputSchema: {
             type: 'object',
             properties: {
-                inputPath: { type: 'string', description: 'Path to the JSON export file' },
+                inputPath: { type: 'string', description: 'Path to the JSON export file (maximum 16 MiB)' },
                 merge: { type: 'boolean', description: 'Merge into existing entries (upsert) vs. fail on conflict (default true)' },
                 namespace: { type: 'string', description: 'Override the namespace for all imported entries' },
                 dbPath: { type: 'string', description: 'Database file to import into (defaults to the MCP memory store)' },
             },
             required: ['inputPath'],
         },
-        handler: async (input) => {
-            const dbPath = typeof input.dbPath === 'string' && input.dbPath.trim()
-                ? resolve(input.dbPath)
-                : undefined;
-            await ensureInitialized(dbPath);
-            const { storeEntry } = await getMemoryFunctions();
+        handler: async (input, context) => {
+            const dbPath = resolveDbPathOption(input.dbPath, context);
             const t0 = Date.now();
             // Values are re-embedded on import; count the vectors actually written
             // rather than reporting a constant 0 next to entries that show a vector.
             let vectors = 0;
-            const inputPath = String(input.inputPath ?? '');
-            if (!inputPath || !existsSync(inputPath))
-                return { error: `File not found: ${inputPath || '(empty)'}` };
+            const requestedInput = String(input.inputPath ?? '');
+            const inputPath = !requestedInput ? null
+                : isLocalCliCall(context) ? (existsSync(requestedInput) ? resolve(requestedInput) : null)
+                    : containedReadPath(requestedInput);
+            if (!inputPath) {
+                return { error: isLocalCliCall(context) || !requestedInput
+                        ? `File not found: ${requestedInput || '(empty)'}`
+                        : 'inputPath must be an existing regular file inside the project directory (not a symlink)' };
+            }
             let doc;
             try {
-                doc = JSON.parse(readFileSync(inputPath, 'utf-8'));
+                doc = JSON.parse(readImportFile(inputPath).toString('utf-8'));
             }
-            catch (e) {
-                return { error: `Invalid export JSON: ${e.message}` };
+            catch (error) {
+                return { error: error instanceof SyntaxError
+                        ? 'inputPath is not a valid memory export (JSON parse failed)'
+                        : error instanceof Error ? error.message : 'Could not read memory import' };
             }
+            await ensureInitialized(dbPath);
+            const { storeEntry } = await getMemoryFunctions();
             const entries = Array.isArray(doc.entries) ? doc.entries : [];
             const nsOverride = input.namespace ? String(input.namespace) : undefined;
             if (nsOverride) {

package/dist/src/mcp-tools/neural-tools.js

@@ -12,6 +12,7 @@
  * Note: For production neural features, use @claude-flow/neural module
  */
 import { getProjectCwd } from './types.js';
+import { nullPrototypeRecords } from './record-store.js';
 import { validateIdentifier, validateText } from './validate-input.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
@@ -223,13 +224,18 @@ function loadNeuralStore() {
     try {
         const path = getNeuralPath();
         if (existsSync(path)) {
-            return JSON.parse(readFileSync(path, 'utf-8'));
+            const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                parsed.models = nullPrototypeRecords(parsed.models);
+                parsed.patterns = nullPrototypeRecords(parsed.patterns);
+                return parsed;
+            }
         }
     }
     catch {
         // Return empty store
     }
-    return { models: {}, patterns: {}, version: '3.0.0' };
+    return { models: nullPrototypeRecords(undefined), patterns: nullPrototypeRecords(undefined), version: '3.0.0' };
 }
 /**
  * ADR-176 flywheel: expose the stored patterns (id/name/content) so the

package/dist/src/mcp-tools/path-containment.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Path checks for MCP tools that read or write a caller-named file.
+ *
+ * Paths in tool input come from whoever drives the MCP server, including a
+ * model following injected instructions. A tool that writes or reads such a
+ * path must keep it inside the project directory, and must not follow a
+ * symlink out of it.
+ */
+/**
+ * Resolve a caller-named output file inside the project. The real parent
+ * directory must be inside the real project root and outside `.git`, and an
+ * existing target must be a regular, non-executable file — not a symlink.
+ * `extensions`, when given, lists the allowed lower-case file extensions.
+ */
+export declare function containedWritePath(p: string, extensions?: readonly string[]): string | null;
+/** Resolve a caller-named input file inside the project: a regular file, not a symlink. */
+export declare function containedReadPath(p: string): string | null;
+/**
+ * Check a caller-named memory database path. It may live outside the project
+ * (the CLI's `--path` flag passes one), so this does not contain it; instead
+ * it refuses anything that is not plainly a SQLite database (plaintext, or
+ * encrypted at rest per ADR-096), so the memory tools cannot be pointed at and
+ * overwrite an unrelated file.
+ */
+export declare function dbPathError(p: string): string | null;
+/**
+ * Marks a tool call made by the local CLI on the operator's behalf (for
+ * example `ruflo memory export --output ~/backup.json`). MCP requests arrive
+ * as JSON and cannot carry a symbol key, so this cannot be forged remotely.
+ */
+export declare const LOCAL_CLI_CALL: unique symbol;
+export declare function localCliContext(): Record<string, unknown>;
+export declare function isLocalCliCall(context: unknown): boolean;
+//# sourceMappingURL=path-containment.d.ts.map

package/dist/src/mcp-tools/path-containment.js

@@ -0,0 +1,133 @@
+/**
+ * Path checks for MCP tools that read or write a caller-named file.
+ *
+ * Paths in tool input come from whoever drives the MCP server, including a
+ * model following injected instructions. A tool that writes or reads such a
+ * path must keep it inside the project directory, and must not follow a
+ * symlink out of it.
+ */
+import { closeSync, lstatSync, openSync, readSync, realpathSync } from 'node:fs';
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { isNonProjectDir } from '@claude-flow/cli-core/mcp-tools/types';
+import { getProjectCwd } from './types.js';
+import { existingFileIsEncrypted } from '../fs-secure.js';
+function lstatOrNull(p) {
+    try {
+        return lstatSync(p);
+    }
+    catch {
+        return null;
+    }
+}
+function projectRoot() {
+    const root = realpathSync(getProjectCwd());
+    // A server started in a home or filesystem root has no project to contain
+    // writes to; "inside the root" would mean the whole home directory.
+    return isNonProjectDir(root) ? null : root;
+}
+function insideRoot(root, target) {
+    const rel = relative(root, target);
+    if (!rel || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+        return false;
+    return !rel.split(sep).includes('.git');
+}
+/**
+ * Resolve a caller-named output file inside the project. The real parent
+ * directory must be inside the real project root and outside `.git`, and an
+ * existing target must be a regular, non-executable file — not a symlink.
+ * `extensions`, when given, lists the allowed lower-case file extensions.
+ */
+export function containedWritePath(p, extensions) {
+    if (!p || p.includes('\0'))
+        return null;
+    try {
+        const root = projectRoot();
+        if (!root)
+            return null;
+        const abs = resolve(root, p);
+        if (extensions && !extensions.includes(extname(abs).toLowerCase()))
+            return null;
+        const target = join(realpathSync(dirname(abs)), basename(abs));
+        if (!insideRoot(root, target))
+            return null;
+        const existing = lstatOrNull(target);
+        if (existing && (existing.isSymbolicLink() || !existing.isFile() || (existing.mode & 0o111) !== 0))
+            return null;
+        return target;
+    }
+    catch {
+        return null;
+    }
+}
+/** Resolve a caller-named input file inside the project: a regular file, not a symlink. */
+export function containedReadPath(p) {
+    if (!p || p.includes('\0'))
+        return null;
+    try {
+        const root = projectRoot();
+        if (!root)
+            return null;
+        const abs = resolve(root, p);
+        const existing = lstatOrNull(abs);
+        if (!existing || existing.isSymbolicLink() || !existing.isFile())
+            return null;
+        const target = realpathSync(abs);
+        return insideRoot(root, target) ? target : null;
+    }
+    catch {
+        return null;
+    }
+}
+const DB_EXTENSIONS = ['.db', '.sqlite', '.sqlite3'];
+const SQLITE_HEADER = 'SQLite format 3\0';
+/**
+ * Check a caller-named memory database path. It may live outside the project
+ * (the CLI's `--path` flag passes one), so this does not contain it; instead
+ * it refuses anything that is not plainly a SQLite database (plaintext, or
+ * encrypted at rest per ADR-096), so the memory tools cannot be pointed at and
+ * overwrite an unrelated file.
+ */
+export function dbPathError(p) {
+    if (p.includes('\0'))
+        return 'dbPath contains a null byte';
+    if (!DB_EXTENSIONS.includes(extname(p).toLowerCase())) {
+        return `dbPath must end in ${DB_EXTENSIONS.join(', ')}`;
+    }
+    const existing = lstatOrNull(p);
+    if (!existing)
+        return null;
+    if (existing.isSymbolicLink())
+        return 'dbPath must not be a symlink';
+    if (!existing.isFile())
+        return 'dbPath must be a regular file';
+    if (existing.size === 0 || existingFileIsEncrypted(p) === true)
+        return null;
+    const header = Buffer.alloc(SQLITE_HEADER.length);
+    let fd;
+    try {
+        fd = openSync(p, 'r');
+        readSync(fd, header, 0, header.length, 0);
+    }
+    catch {
+        return 'dbPath could not be read';
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+    return header.toString('latin1') === SQLITE_HEADER ? null : 'dbPath is not a SQLite database';
+}
+/**
+ * Marks a tool call made by the local CLI on the operator's behalf (for
+ * example `ruflo memory export --output ~/backup.json`). MCP requests arrive
+ * as JSON and cannot carry a symbol key, so this cannot be forged remotely.
+ */
+export const LOCAL_CLI_CALL = Symbol('ruflo.localCliCall');
+export function localCliContext() {
+    return { [LOCAL_CLI_CALL]: true };
+}
+export function isLocalCliCall(context) {
+    return !!context && typeof context === 'object'
+        && context[LOCAL_CLI_CALL] === true;
+}
+//# sourceMappingURL=path-containment.js.map

package/dist/src/mcp-tools/performance-tools.js

@@ -21,6 +21,7 @@ const STORAGE_DIR = '.claude-flow';
 const PERF_DIR = 'performance';
 const METRICS_FILE = 'metrics.json';
 const BENCHMARKS_FILE = 'benchmarks.json';
+const MAX_BENCHMARK_ITERATIONS = 10_000;
 function getPerfDir() {
     return join(getProjectCwd(), STORAGE_DIR, PERF_DIR);
 }
@@ -246,14 +247,18 @@ export const performanceTools = [
             type: 'object',
             properties: {
                 suite: { type: 'string', enum: ['all', 'memory', 'neural', 'swarm', 'io'], description: 'Benchmark suite' },
-                iterations: { type: 'number', description: 'Number of iterations' },
+                iterations: { type: 'integer', minimum: 1, maximum: MAX_BENCHMARK_ITERATIONS, description: 'Number of iterations (maximum 10000)' },
                 warmup: { type: 'boolean', description: 'Include warmup phase' },
             },
         },
         handler: async (input) => {
+            const requestedIterations = input.iterations === undefined ? 100 : input.iterations;
+            if (typeof requestedIterations !== 'number' || !Number.isSafeInteger(requestedIterations) || requestedIterations < 1) {
+                return { success: false, error: 'iterations must be a positive safe integer' };
+            }
+            const iterations = Math.min(requestedIterations, MAX_BENCHMARK_ITERATIONS);
             const store = loadPerfStore();
             const suite = input.suite || 'all';
-            const iterations = input.iterations || 100;
             const warmup = input.warmup !== false;
             // Synthetic data benchmarks — measures actual CPU/memory throughput
             const benchmarkFunctions = {

package/dist/src/mcp-tools/record-store.d.ts

@@ -1,3 +1,18 @@
+/**
+ * Give a record map a null prototype. Record keys come from MCP tool input; on
+ * a plain object `__proto__` or `constructor` resolve to Object.prototype or a
+ * built-in, which a handler would then write into. A null-prototype map only
+ * ever returns its own records.
+ */
+export declare function nullPrototypeRecords<M extends object>(map: M | undefined | null): M;
 /** Only an absent store is empty. Failed reads must never authorize replacement. */
 export declare function readRecordStore<T>(path: string, collection: string, empty: () => T): T;
+/**
+ * JSON object store read for workflow, hive-mind, and swarm (#4737).
+ * Same rule as {@link readRecordStore}: only a missing file is empty.
+ * A parse failure, a non-object document, or a document `accept` rejects is
+ * copied to `${path}.corrupt-<timestamp>` and thrown, so a later save cannot
+ * replace the original.
+ */
+export declare function readPreservedJsonStore<T extends object>(path: string, label: string, empty: () => T, accept?: (store: T) => boolean): T;
 //# sourceMappingURL=record-store.d.ts.map