@claude-flow/cli 3.72.2 → 3.73.0

package/dist/src/transfer/store/download.d.ts

@@ -36,7 +36,7 @@ export declare class PatternDownloader {
      */
     private verifyChecksum;
     /**
-     * Verify content signature using crypto
+     * Verify an Ed25519 signature over the content. Any error is a failure.
      */
     private verifySignature;
     /**

package/dist/src/transfer/store/download.js

@@ -75,15 +75,20 @@ export class PatternDownloader {
                     console.log(`[Download] Checksum verified!`);
                 }
             }
-            // Verify signature if available
+            // Verify signature if available. A pattern that carries a signature
+            // which does not verify is refused rather than written.
             if (pattern.signature && pattern.publicKey) {
-                const sigVerified = this.verifySignature(content, pattern.signature, pattern.publicKey);
+                const sigVerified = await this.verifySignature(content, pattern.signature, pattern.publicKey);
                 if (!sigVerified) {
-                    console.warn(`[Download] Warning: Signature verification failed!`);
-                }
-                else {
-                    console.log(`[Download] Signature verified!`);
+                    console.warn(`[Download] Signature verification failed, not writing the pattern.`);
+                    return {
+                        success: false,
+                        pattern,
+                        verified: false,
+                        size: content.length,
+                    };
                 }
+                console.log(`[Download] Signature verified!`);
             }
             // Write to file
             fs.writeFileSync(outputPath, content);
@@ -228,28 +233,24 @@ export class PatternDownloader {
         return actualChecksum === expectedChecksum;
     }
     /**
-     * Verify content signature using crypto
+     * Verify an Ed25519 signature over the content. Any error is a failure.
      */
-    verifySignature(content, signature, publicKey) {
-        // Check signature format
+    async verifySignature(content, signature, publicKey) {
         if (!signature.startsWith('ed25519:') || !publicKey.startsWith('ed25519:')) {
             return false;
         }
         try {
-            // For HMAC-based signatures (used in publish.ts)
-            const sigHex = signature.replace('ed25519:', '');
-            const keyHex = publicKey.replace('ed25519:', '');
-            // Verify HMAC signature
-            const expectedSig = crypto
-                .createHmac('sha256', keyHex)
-                .update(content)
-                .digest('hex');
-            // Constant-time comparison to prevent timing attacks
-            return crypto.timingSafeEqual(Buffer.from(sigHex, 'hex'), Buffer.from(expectedSig, 'hex'));
+            const ed = await import('@noble/ed25519');
+            const sigBytes = Buffer.from(signature.slice('ed25519:'.length), 'hex');
+            const pubBytes = Buffer.from(publicKey.slice('ed25519:'.length), 'hex');
+            if (sigBytes.length !== 64 || pubBytes.length !== 32) {
+                return false;
+            }
+            // RFC 8032 strict mode, as in transfer/ipfs/client.ts.
+            return await ed.verifyAsync(sigBytes, content, pubBytes, { zip215: false });
         }
         catch {
-            // If crypto verification fails, check basic format
-            return signature.length > 20 && publicKey.length > 20;
+            return false;
         }
     }
     /**

package/dist/src/transfer/store/publish.d.ts

@@ -16,7 +16,7 @@ export declare class PatternPublisher {
      */
     publishPattern(cfp: CFPFormat, options: PublishOptions): Promise<PublishResult>;
     /**
-     * Sign content with private key
+     * Sign content with Ed25519. The private key file holds a 32-byte hex seed.
      */
     private signContent;
     /**

package/dist/src/transfer/store/publish.js

@@ -37,7 +37,7 @@ export class PatternPublisher {
             let signature;
             let publicKey;
             if (options.privateKeyPath && fs.existsSync(options.privateKeyPath)) {
-                const signResult = this.signContent(contentBuffer, options.privateKeyPath);
+                const signResult = await this.signContent(contentBuffer, options.privateKeyPath);
                 signature = signResult.signature;
                 publicKey = signResult.publicKey;
                 console.log(`[Publish] Content signed`);
@@ -148,21 +148,20 @@ export class PatternPublisher {
         }
     }
     /**
-     * Sign content with private key
+     * Sign content with Ed25519. The private key file holds a 32-byte hex seed.
      */
-    signContent(content, privateKeyPath) {
-        // In production: Use actual Ed25519 signing
-        // For demo: Generate mock signature
-        const privateKey = fs.readFileSync(privateKeyPath, 'utf-8').trim();
-        const signature = crypto
-            .createHmac('sha256', privateKey)
-            .update(content)
-            .digest('hex');
-        const publicKey = 'ed25519:' +
-            crypto.createHash('sha256').update(privateKey).digest('hex').slice(0, 32);
+    async signContent(content, privateKeyPath) {
+        const ed = await import('@noble/ed25519');
+        const raw = fs.readFileSync(privateKeyPath, 'utf-8').trim();
+        const seed = Buffer.from(raw, 'hex');
+        if (seed.length !== 32 || seed.toString('hex') !== raw.toLowerCase()) {
+            throw new Error(`[Publish] Ed25519 private key at ${privateKeyPath} must be a 32-byte hex seed.`);
+        }
+        const pub = await ed.getPublicKeyAsync(seed);
+        const sig = await ed.signAsync(content, seed);
         return {
-            signature: `ed25519:${signature}`,
-            publicKey,
+            signature: 'ed25519:' + Buffer.from(sig).toString('hex'),
+            publicKey: 'ed25519:' + Buffer.from(pub).toString('hex'),
         };
     }
     /**

package/node_modules/@claude-flow/plugin-agent-federation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/plugin-agent-federation",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails.",
   "homepage": "https://github.com/ruvnet/ruflo",
   "type": "module",
@@ -26,7 +26,7 @@
     "@claude-flow/shared": "^3.0.0",
     "@claude-flow/security": "^3.0.0",
     "@types/ws": "^8.18.1",
-    "agentic-flow": "2.0.12-fix.8",
+    "agentic-flow": "2.0.14",
     "typescript": "^5.4.0",
     "vitest": "^4.1.0"
   },
@@ -46,11 +46,11 @@
     "sourceDependencies": {
       "dependencies": {
         "@noble/ed25519": "^2.0.0",
-        "ws": "^8.20.0"
+        "ws": "^8.21.0"
       },
       "peerDependencies": {
-        "agentic-flow": ">=2.0.12-fix.8 <4.0.0",
-        "midstreamer": ">=0.3.1"
+        "agentic-flow": "^2.0.14 || ^3.0.0",
+        "midstreamer": "^0.3.2"
       },
       "peerDependenciesMeta": {
         "agentic-flow": {

package/node_modules/@claude-flow/security/dist/input-validator.d.ts

@@ -159,14 +159,14 @@ export declare const SpawnAgentSchema: z.ZodObject<{
     timeout: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
+    id?: string | undefined;
     config?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
-    id?: string | undefined;
 }, {
     type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
+    id?: string | undefined;
     config?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
-    id?: string | undefined;
 }>;
 /**
  * Task input schema
@@ -181,13 +181,13 @@ export declare const TaskInputSchema: z.ZodObject<{
     taskId: string;
     content: string;
     agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    priority?: "critical" | "high" | "medium" | "low" | undefined;
+    priority?: "low" | "medium" | "high" | "critical" | undefined;
     metadata?: Record<string, unknown> | undefined;
 }, {
     taskId: string;
     content: string;
     agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    priority?: "critical" | "high" | "medium" | "low" | undefined;
+    priority?: "low" | "medium" | "high" | "critical" | undefined;
     metadata?: Record<string, unknown> | undefined;
 }>;
 /**
@@ -234,16 +234,16 @@ export declare const ExecutorConfigSchema: z.ZodObject<{
     cwd: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
     allowSudo: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    allowedCommands: string[];
     timeout: number;
+    allowedCommands: string[];
     maxBuffer: number;
     allowSudo: boolean;
     blockedPatterns?: string[] | undefined;
     cwd?: string | undefined;
 }, {
     allowedCommands: string[];
-    blockedPatterns?: string[] | undefined;
     timeout?: number | undefined;
+    blockedPatterns?: string[] | undefined;
     maxBuffer?: number | undefined;
     cwd?: string | undefined;
     allowSudo?: boolean | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.72.2",
+  "version": "3.73.0",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -105,12 +105,13 @@
     "@claude-flow/codex": "3.0.6",
     "@claude-flow/mcp": "3.1.6",
     "@claude-flow/neural": "3.0.3",
-    "@claude-flow/plugin-agent-federation": "1.0.5",
+    "@claude-flow/plugin-agent-federation": "1.0.7",
     "@claude-flow/security": "3.0.6",
     "@claude-flow/shared": "3.0.7",
     "@iarna/toml": "^2.2.5",
     "@noble/ed25519": "2.3.0",
     "@ruvector/rabitq-wasm": "0.1.2",
+    "agentic-flow": "^3.0.0",
     "ajv": "^8.20.0",
     "bcryptjs": "^3.0.3",
     "chalk": "^5.3.0",
@@ -132,15 +133,14 @@
   },
   "optionalDependencies": {
     "@agntcy/slim-bindings": "2.1.1",
-    "@claude-flow/aidefence": "3.1.0",
+    "@claude-flow/aidefence": "3.1.1",
     "@claude-flow/memory": "3.2.3",
     "@metaharness/darwin": "~0.13.0",
     "@metaharness/flywheel": "~0.1.10",
     "@metaharness/radio": "~0.1.0",
     "@metaharness/turn-credit": "~0.1.0",
     "@napi-rs/keyring": "1.3.0",
-    "agentdb": "^3.3.0",
-    "agentic-flow": "^3.0.0",
+    "agentdb": "^3.6.0",
     "better-sqlite3": "^12.9.0",
     "ruvector": "^0.3.13",
     "nostr-tools": "^2.7.0",