@claude-flow/security 3.0.0-alpha.8 → 3.0.0

package/dist/authorization/propagator.js

@@ -0,0 +1,182 @@
+/**
+ * AgentAuthorizationPropagator — action-layer security for agent delegation.
+ *
+ * Implements P1 of ADR-144 (ruvnet/ruflo#2248): scope-envelope on SendMessage
+ * + per-action authorization checks. P2-P5 wire this into the comms layer,
+ * MCP dispatcher, MCP auth validator, and provenance log respectively.
+ *
+ * Threat model
+ * ------------
+ * When agent A delegates a task to agent B via SendMessage, B can today
+ * escalate the granted scope by calling tools A was never authorized to
+ * invoke. RBAC/ABAC on agent roles do not solve this — roles don't compose
+ * under dynamic LLM delegation (arXiv:2605.05440, Grade A formal analysis).
+ *
+ * The fix is scope-based propagation: every SendMessage carries an
+ * `AuthScope` that is *monotonically reducing* — each hop can drop tools or
+ * servers from the granted set but never add them. This is the same shape
+ * as OAuth scope reduction; adding back a tool requires talking to the
+ * original principal out-of-band.
+ *
+ * Scope
+ * -----
+ * - P1 (this file): the component, the envelope, the type-level invariants.
+ *   No call sites yet — adding the wrapping/enforcement in P2-P4.
+ * - All operations synchronous, pure, allocation-light. Targets < 1 ms p99
+ *   for `wrapOutbound` + `checkToolCall` so it can sit on every SendMessage.
+ *
+ * Backwards compatibility
+ * -----------------------
+ * `scope` on the envelope is optional in v1. Agents without scope set
+ * operate in legacy permissive mode (all tools allowed, depth unlimited,
+ * server auth unchecked). `CLAUDE_FLOW_STRICT_AUTH=true` enables enforcement.
+ *
+ * Reference: ADR-144, arXiv:2605.05440 (Authorization Propagation),
+ * arXiv:2605.28914 (AIRGuard), arXiv:2605.22333 (MCP auth survey).
+ */
+/**
+ * Wrap-failure reasons surfaced to callers as a typed error. We use a
+ * discriminated union rather than throwing so the comms layer (P2) can
+ * decide whether to drop the SendMessage or surface to the user.
+ */
+export class AuthorizationPropagationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'AuthorizationPropagationError';
+    }
+}
+/**
+ * Construct a default permissive scope. Used in legacy mode when no scope
+ * was attached upstream. Callers SHOULD migrate to explicit scopes; this is
+ * here so the propagator never has to special-case "no scope".
+ */
+export function makeLegacyPermissiveScope(principalId = 'legacy') {
+    return {
+        principalId,
+        grantedTools: ['*'], // sentinel — see `checkToolCall`
+        grantedServers: ['*'],
+        delegationDepth: Number.MAX_SAFE_INTEGER,
+        expiresAt: Number.MAX_SAFE_INTEGER,
+    };
+}
+/**
+ * `AgentAuthorizationPropagator` — the load-bearing component for ADR-144.
+ *
+ * Construction is intentionally cheap (no I/O, no async). Callers can build
+ * a fresh instance per task without overhead, or share one — it holds no
+ * mutable state beyond the optional provenance buffer.
+ */
+export class AgentAuthorizationPropagator {
+    opts;
+    /**
+     * In-memory provenance buffer. P5 will flush this to the structured
+     * telemetry sink (ADR-146 GuardrailEvent shape). For P1 we just retain
+     * the last N events for inspection/tests.
+     */
+    provenance = [];
+    constructor(opts = {}) {
+        this.opts = opts;
+    }
+    /**
+     * Attach a reduced scope to an outbound SendMessage.
+     *
+     * Invariants enforced (throws `AuthorizationPropagationError` on violation):
+     *   - newly granted tools MUST be a subset of `currentScope.grantedTools`
+     *   - newly granted servers MUST be a subset of `currentScope.grantedServers`
+     *   - delegationDepth MUST decrement by ≥ 1 (must remain ≥ 0)
+     *   - principalId is propagated unchanged
+     *   - expiresAt cannot be extended; copied from the holder
+     */
+    wrapOutbound(payload, currentScope, requested = {}) {
+        if (currentScope.delegationDepth <= 0) {
+            throw new AuthorizationPropagationError('depth-underflow', `cannot delegate further — delegationDepth=${currentScope.delegationDepth}`);
+        }
+        const now = Date.now();
+        if (currentScope.expiresAt <= now) {
+            throw new AuthorizationPropagationError('scope-expired', `scope expired at ${new Date(currentScope.expiresAt).toISOString()}`);
+        }
+        const reducedTools = subsetOrThrow(currentScope.grantedTools, requested.tools ?? currentScope.grantedTools, 'tools');
+        const reducedServers = subsetOrThrow(currentScope.grantedServers, requested.servers ?? currentScope.grantedServers, 'servers');
+        const reducedScope = {
+            principalId: currentScope.principalId,
+            grantedTools: reducedTools,
+            grantedServers: reducedServers,
+            delegationDepth: currentScope.delegationDepth - 1,
+            expiresAt: currentScope.expiresAt,
+            scopeId: currentScope.scopeId,
+        };
+        return { scope: reducedScope, payload };
+    }
+    /**
+     * Validate a single tool call against a scope. Pure; never throws. Use the
+     * result's `allowed` to make the dispatch decision.
+     */
+    checkToolCall(toolId, scope, opts = {}) {
+        const now = opts.now ?? Date.now();
+        if (scope.expiresAt <= now)
+            return { allowed: false, reason: 'scope-expired' };
+        if (!matchesScopeList(scope.grantedTools, toolId)) {
+            return { allowed: false, reason: 'tool-not-in-scope' };
+        }
+        if (opts.serverId && !matchesScopeList(scope.grantedServers, opts.serverId)) {
+            return { allowed: false, reason: 'server-not-in-scope' };
+        }
+        return { allowed: true };
+    }
+    /**
+     * Verify an MCP server presented a valid credential before its response is
+     * consumed. P1 ships a permissive default (any non-empty credential is
+     * accepted) so the API is stable; P4 wires this to a real validator.
+     *
+     * Returns `false` on missing/empty credential; callers MUST treat `false`
+     * as a hard reject (same rule as ADR-131 reject findings).
+     */
+    verifyServerAuth(serverId, credential) {
+        if (!serverId || typeof serverId !== 'string')
+            return false;
+        if (credential == null)
+            return false;
+        if (typeof credential === 'string' && credential.trim().length === 0)
+            return false;
+        return true;
+    }
+    /**
+     * Record an action in the provenance buffer. P5 will route to telemetry;
+     * P1 keeps the last N events for test inspection and post-incident audit.
+     */
+    recordAction(agentId, toolId, scope, outcome, reason) {
+        const max = this.opts.provenanceBufferMax ?? 1024;
+        this.provenance.push({ agentId, toolId, scope, outcome, reason, ts: Date.now() });
+        if (this.provenance.length > max)
+            this.provenance.splice(0, this.provenance.length - max);
+    }
+    /** Read-only view of recorded provenance for tests + audit CLI (P5). */
+    getProvenance() {
+        return this.provenance.slice();
+    }
+}
+// ─── helpers ────────────────────────────────────────────────────────────
+function subsetOrThrow(parent, requested, kind) {
+    if (parent.includes('*'))
+        return Array.from(new Set(requested));
+    for (const item of requested) {
+        if (!parent.includes(item) && item !== '*') {
+            throw new AuthorizationPropagationError('scope-cannot-grow', `cannot grant ${kind} '${item}' — not in parent scope`);
+        }
+    }
+    // De-duplicate; preserve requested order
+    const seen = new Set();
+    const out = [];
+    for (const r of requested)
+        if (!seen.has(r))
+            (seen.add(r), out.push(r));
+    return out;
+}
+function matchesScopeList(list, item) {
+    if (list.includes('*'))
+        return true;
+    return list.includes(item);
+}
+//# sourceMappingURL=propagator.js.map

package/dist/authorization/propagator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propagator.js","sourceRoot":"","sources":["../../src/authorization/propagator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AA0CH;;;;GAIG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAEpC;IADlB,YACkB,IAIQ,EACxB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAPC,SAAI,GAAJ,IAAI,CAII;QAIxB,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAW,GAAG,QAAQ;IAC9D,OAAO;QACL,WAAW;QACX,YAAY,EAAE,CAAC,GAAG,CAAC,EAAM,iCAAiC;QAC1D,cAAc,EAAE,CAAC,GAAG,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC,gBAAgB;QACxC,SAAS,EAAE,MAAM,CAAC,gBAAgB;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IAeV;IAd7B;;;;OAIG;IACc,UAAU,GAOtB,EAAE,CAAC;IAER,YAA6B,OAAyC,EAAE;QAA3C,SAAI,GAAJ,IAAI,CAAuC;IAAG,CAAC;IAE5E;;;;;;;;;OASG;IACH,YAAY,CACV,OAAU,EACV,YAAuB,EACvB,YAAgF,EAAE;QAElF,IAAI,YAAY,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,6BAA6B,CACrC,iBAAiB,EACjB,6CAA6C,YAAY,CAAC,eAAe,EAAE,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,YAAY,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YAClC,MAAM,IAAI,6BAA6B,CACrC,eAAe,EACf,oBAAoB,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,aAAa,CAChC,YAAY,CAAC,YAAY,EACzB,SAAS,CAAC,KAAK,IAAI,YAAY,CAAC,YAAY,EAC5C,OAAO,CACR,CAAC;QACF,MAAM,cAAc,GAAG,aAAa,CAClC,YAAY,CAAC,cAAc,EAC3B,SAAS,CAAC,OAAO,IAAI,YAAY,CAAC,cAAc,EAChD,SAAS,CACV,CAAC;QAEF,MAAM,YAAY,GAAc;YAC9B,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,YAAY,EAAE,YAAY;YAC1B,cAAc,EAAE,cAAc;YAC9B,eAAe,EAAE,YAAY,CAAC,eAAe,GAAG,CAAC;YACjD,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,aAAa,CACX,MAAc,EACd,KAAgB,EAChB,OAA4C,EAAE;QAE9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAE/E,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAgB,EAAE,UAAmB;QACpD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5D,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,YAAY,CACV,OAAe,EACf,MAAc,EACd,KAAgB,EAChB,OAA6B,EAC7B,MAAe;QAEf,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG;YAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC5F,CAAC;IAED,wEAAwE;IACxE,aAAa;QAQX,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;CACF;AAED,2EAA2E;AAE3E,SAAS,aAAa,CACpB,MAA6B,EAC7B,SAAgC,EAChC,IAAyB;IAEzB,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC3C,MAAM,IAAI,6BAA6B,CACrC,mBAAmB,EACnB,gBAAgB,IAAI,KAAK,IAAI,yBAAyB,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,yCAAyC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,IAA2B,EAAE,IAAY;IACjE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC"}

package/dist/index.d.ts

@@ -19,6 +19,17 @@ export { SafeExecutor, SafeExecutorError, createDevelopmentExecutor, createReadO
 export { PathValidator, PathValidatorError, createProjectPathValidator, createFullProjectPathValidator, type PathValidatorConfig, type PathValidationResult, } from './path-validator.js';
 export { InputValidator, sanitizeString, sanitizeHtml, sanitizePath, SafeStringSchema, IdentifierSchema, FilenameSchema, EmailSchema, PasswordSchema, UUIDSchema, HttpsUrlSchema, UrlSchema, SemverSchema, PortSchema, IPv4Schema, IPSchema, UserRoleSchema, PermissionSchema, LoginRequestSchema, CreateUserSchema, CreateApiKeySchema, AgentTypeSchema, SpawnAgentSchema, TaskInputSchema, CommandArgumentSchema, PathSchema, SecurityConfigSchema, ExecutorConfigSchema, PATTERNS, LIMITS, z, } from './input-validator.js';
 export { TokenGenerator, TokenGeneratorError, createTokenGenerator, getDefaultGenerator, quickGenerate, type TokenConfig, type Token, type SignedToken, type VerificationCode, } from './token-generator.js';
+export { ToolOutputGuardrail, createToolOutputGuardrail, isToolOutputSafe, type GuardrailConfig, type GuardrailResult, type GuardrailAction, type InjectionFinding, type InjectionSeverity, type InjectionCategory, } from './tool-output-guardrail.js';
+export { AgentAuthorizationPropagator, AuthorizationPropagationError, makeLegacyPermissiveScope, type AuthScope, type SendMessageEnvelope, type ToolCallDecision, } from './authorization/propagator.js';
+export { generateCallerIdentityKey, loadCallerIdentityKey, issueInvocationToken, verifyInvocationToken, isMcpCallerAuthEnabled, publicKeyFromHex, encodeTokenEnvelope, decodeTokenEnvelope, type CallerIdentityKey, type InvocationToken, type TokenVerificationResult, } from './mcp-caller-identity.js';
+export * from './policy/index.js';
+export { CLIENT_ID as OAUTH_CLIENT_ID, SCOPE as OAUTH_SCOPE, OOB_REDIRECT_URI, OAuthError, authorizeUrl, exchangeCode, refreshToken, exchangeManualCode, type TokenResponse as OAuthTokenResponse, } from './oauth/client.js';
+export { generate as generatePkce, challengeFromVerifier, type PkceRequest } from './oauth/pkce.js';
+export { CallbackServer, CallbackTimeoutError, type CallbackResult } from './oauth/callback-server.js';
+export { openBrowser } from './oauth/browser.js';
+export { createKeychainAdapter, SessionOnlyKeychainAdapter, type KeychainAdapter, } from './keychain-adapter.js';
+export { PluginIntegrityVerifier, canonicalize, hashManifest, fingerprint, findAnchor, type PluginManifest, type SignedPluginManifest, type TrustAnchor, type TrustAnchors, type VerificationStatus, type VerificationResult, type VerifierConfig, } from './plugins/integrity-verifier.js';
+export { inspectToolComposition, evaluateToolComposition, isCompositionBlockEnabled, fnv1a64, simhash64, hammingDistance64, type McpToolDescriptor, type CompositionInspectorOptions, type CompositionFinding, type CompositionInspectionStats, type CompositionInspectionResult, type CompositionGuardResult, } from './mcp-composition-inspector.js';
 import { PasswordHasher } from './password-hasher.js';
 import { CredentialGenerator } from './credential-generator.js';
 import { SafeExecutor } from './safe-executor.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EAEZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ,EAER,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAElB,eAAe,EACf,gBAAgB,EAChB,eAAe,EAEf,qBAAqB,EACrB,UAAU,EAEV,oBAAoB,EACpB,oBAAoB,EAEpB,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,cAAc,CAAC;IAC/B,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAiBjF;AAMD;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAMhD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,EAAE,CAoBnF;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EAEZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ,EAER,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAElB,eAAe,EACf,gBAAgB,EAChB,eAAe,EAEf,qBAAqB,EACrB,UAAU,EAEV,oBAAoB,EACpB,oBAAoB,EAEpB,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC;AAMvC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAMlC,cAAc,mBAAmB,CAAC;AAMlC,OAAO,EACL,SAAS,IAAI,eAAe,EAC5B,KAAK,IAAI,WAAW,EACpB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,KAAK,aAAa,IAAI,kBAAkB,GACzC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,qBAAqB,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,cAAc,GACpB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,OAAO,EACP,SAAS,EACT,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,cAAc,CAAC;IAC/B,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAiBjF;AAMD;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAMhD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,EAAE,CAoBnF;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAC"}

package/dist/index.js

@@ -37,6 +37,42 @@ SecurityConfigSchema, ExecutorConfigSchema,
 PATTERNS, LIMITS, z, } from './input-validator.js';
 // Token Generation
 export { TokenGenerator, TokenGeneratorError, createTokenGenerator, getDefaultGenerator, quickGenerate, } from './token-generator.js';
+// Tool-Output Guardrail (ADR-131 — closes OWASP ASI01 gap; ruvnet/ruflo#2149)
+export { ToolOutputGuardrail, createToolOutputGuardrail, isToolOutputSafe, } from './tool-output-guardrail.js';
+// Agent Authorization Propagation (ADR-144 P1 — ruvnet/ruflo#2248)
+// Action-layer: SendMessage envelope + per-action scope check + MCP server
+// identity probe. Wraps the comms layer in P2; wraps the dispatcher in P3.
+export { AgentAuthorizationPropagator, AuthorizationPropagationError, makeLegacyPermissiveScope, } from './authorization/propagator.js';
+// MCP Caller-Identity Binding (ADR-377 Phase 3 — ruvnet/ruflo#2516, #2873)
+// Per-invocation Ed25519-signed capability tokens. Off by default
+// (CLAUDE_FLOW_MCP_CALLER_AUTH) pending a follow-on ADR for key
+// distribution; see mcp-caller-identity.ts's file header for scope notes.
+export { generateCallerIdentityKey, loadCallerIdentityKey, issueInvocationToken, verifyInvocationToken, isMcpCallerAuthEnabled, publicKeyFromHex, encodeTokenEnvelope, decodeTokenEnvelope, } from './mcp-caller-identity.js';
+// Agentic Policy Engine (ADR-324)
+// Deterministic policy evaluation, monotonic capability envelopes, approvals,
+// budgets, and tamper-evident decision receipts. Legacy mode preserves the
+// behavior of pre-ADR-324 installations until enforcement is explicitly enabled.
+export * from './policy/index.js';
+// OAuth 2.0 + PKCE + OS Keychain (ADR-306)
+// A TypeScript port of meta-proxy's proven oauth/{client,pkce,browser,
+// callback_server}.rs — see src/oauth/client.ts for why this targets the
+// live auth.cognitum.one surface rather than ADR-308's unconfirmed spec.
+export { CLIENT_ID as OAUTH_CLIENT_ID, SCOPE as OAUTH_SCOPE, OOB_REDIRECT_URI, OAuthError, authorizeUrl, exchangeCode, refreshToken, exchangeManualCode, } from './oauth/client.js';
+export { generate as generatePkce, challengeFromVerifier } from './oauth/pkce.js';
+export { CallbackServer, CallbackTimeoutError } from './oauth/callback-server.js';
+export { openBrowser } from './oauth/browser.js';
+// OS Keychain Adapter (ADR-306)
+export { createKeychainAdapter, SessionOnlyKeychainAdapter, } from './keychain-adapter.js';
+// Plugin Integrity Verifier (ADR-145 P1 — ruvnet/ruflo#2254)
+// Install-layer: Ed25519 signature verification + trust-anchor allowlist.
+// Stage-2 semantic-intent scan (SCH defence) lands in P2.
+export { PluginIntegrityVerifier, canonicalize, hashManifest, fingerprint, findAnchor, } from './plugins/integrity-verifier.js';
+// MCP Tool Composition Inspector (ADR-320 — ruvnet/ruflo dream-cycle,
+// arXiv:2606.27027 "ShareLock"). SimHash-based cross-tool instruction
+// fragment detector — the v2 successor to the CLI-only v1 in
+// @claude-flow/cli/src/security/mcp-composition-inspector.ts (#2783),
+// whose own header deferred exactly this ("Future v2: SimHash + LSH").
+export { inspectToolComposition, evaluateToolComposition, isCompositionBlockEnabled, fnv1a64, simhash64, hammingDistance64, } from './mcp-composition-inspector.js';
 // ============================================================================
 // Convenience Factory Functions
 // ============================================================================

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+BAA+B;AAC/B,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,sBAAsB,CAAC;AAE9B,oCAAoC;AACpC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,2BAA2B,CAAC;AAEnC,sCAAsC;AACtC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAE5B,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,GAG/B,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY;AACZ,eAAe;AACf,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ;AACR,eAAe;AACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB;AAClB,uBAAuB;AACvB,eAAe,EACf,gBAAgB,EAChB,eAAe;AACf,yBAAyB;AACzB,qBAAqB,EACrB,UAAU;AACV,iBAAiB;AACjB,oBAAoB,EACpB,oBAAoB;AACpB,YAAY;AACZ,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAE9B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GAKd,MAAM,sBAAsB,CAAC;AAE9B,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwCtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,OAAO;QACL,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;SAClC,CAAC;QACF,mBAAmB,EAAE,IAAI,mBAAmB,EAAE;QAC9C,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC;SAClE,CAAC;QACF,aAAa,EAAE,IAAI,aAAa,CAAC;YAC/B,eAAe,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;YACrC,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEhD,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqC;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,iBAAiB,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,YAAY,gCAAgC,iBAAiB,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+BAA+B;AAC/B,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,sBAAsB,CAAC;AAE9B,oCAAoC;AACpC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,2BAA2B,CAAC;AAEnC,sCAAsC;AACtC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAE5B,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,GAG/B,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY;AACZ,eAAe;AACf,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ;AACR,eAAe;AACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB;AAClB,uBAAuB;AACvB,eAAe,EACf,gBAAgB,EAChB,eAAe;AACf,yBAAyB;AACzB,qBAAqB,EACrB,UAAU;AACV,iBAAiB;AACjB,oBAAoB,EACpB,oBAAoB;AACpB,YAAY;AACZ,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAE9B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GAKd,MAAM,sBAAsB,CAAC;AAE9B,8EAA8E;AAC9E,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,GAOjB,MAAM,4BAA4B,CAAC;AAEpC,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,yBAAyB,GAI1B,MAAM,+BAA+B,CAAC;AAEvC,2EAA2E;AAC3E,kEAAkE;AAClE,gEAAgE;AAChE,0EAA0E;AAC1E,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,GAIpB,MAAM,0BAA0B,CAAC;AAElC,kCAAkC;AAClC,8EAA8E;AAC9E,2EAA2E;AAC3E,iFAAiF;AACjF,cAAc,mBAAmB,CAAC;AAElC,2CAA2C;AAC3C,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,EACL,SAAS,IAAI,eAAe,EAC5B,KAAK,IAAI,WAAW,EACpB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,qBAAqB,EAAoB,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAuB,MAAM,4BAA4B,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,gCAAgC;AAChC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAE/B,6DAA6D;AAC7D,0EAA0E;AAC1E,0DAA0D;AAC1D,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,GAQX,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,sEAAsE;AACtE,6DAA6D;AAC7D,sEAAsE;AACtE,uEAAuE;AACvE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,OAAO,EACP,SAAS,EACT,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwCtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,OAAO;QACL,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;SAClC,CAAC;QACF,mBAAmB,EAAE,IAAI,mBAAmB,EAAE;QAC9C,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC;SAClE,CAAC;QACF,aAAa,EAAE,IAAI,aAAa,CAAC;YAC/B,eAAe,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;YACrC,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEhD,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqC;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,iBAAiB,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,YAAY,gCAAgC,iBAAiB,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC"}

package/dist/keychain-adapter.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Cross-platform OS keychain adapter (ADR-306) — macOS Keychain, Windows
+ * Credential Manager (DPAPI), Linux Secret Service (libsecret), backed by
+ * `@napi-rs/keyring` (prebuilt N-API binaries per platform, wraps the Rust
+ * `keyring-rs` crate — no node-gyp compile step, same "optional native
+ * binding" shape this monorepo already tolerates for `ruvector`).
+ *
+ * `keytar` was considered and rejected: archived by the Electron team,
+ * compiles from source via node-gyp at install time.
+ *
+ * ADR-306's refresh-token storage rule: OS keychain only, never plain-text
+ * config. When no keychain backend is reachable (typical headless Linux —
+ * the binding can be present but no D-Bus Secret Service running), the CLI
+ * falls back to session-only tokens (never persisted) rather than writing
+ * the secret to disk unencrypted — a deliberate usability cost, not a bug.
+ * `SessionOnlyKeychainAdapter` is that fallback, made explicit rather than
+ * silently degrading.
+ *
+ * @module v3/security/keychain-adapter
+ */
+export interface KeychainAdapter {
+    /**
+     * A real write+read+delete canary probe against a throwaway entry — not
+     * just "did the native module load". A headless box can have the binding
+     * present but no reachable Secret Service, which only a real round-trip
+     * reveals.
+     */
+    isAvailable(): Promise<boolean>;
+    setSecret(service: string, account: string, secret: string): Promise<void>;
+    getSecret(service: string, account: string): Promise<string | null>;
+    deleteSecret(service: string, account: string): Promise<void>;
+}
+/** In-memory-only fallback — the ADR-306-mandated degrade path, not an error state. */
+export declare class SessionOnlyKeychainAdapter implements KeychainAdapter {
+    private readonly store;
+    private key;
+    isAvailable(): Promise<boolean>;
+    setSecret(service: string, account: string, secret: string): Promise<void>;
+    getSecret(service: string, account: string): Promise<string | null>;
+    deleteSecret(service: string, account: string): Promise<void>;
+}
+/**
+ * Selects a real OS keychain when reachable, falling back to
+ * `SessionOnlyKeychainAdapter` otherwise. Always resolves — never throws —
+ * so callers can treat "no keychain" as a normal, expected outcome.
+ */
+export declare function createKeychainAdapter(): Promise<KeychainAdapter>;
+//# sourceMappingURL=keychain-adapter.d.ts.map

package/dist/keychain-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-adapter.d.ts","sourceRoot":"","sources":["../src/keychain-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAKD,uFAAuF;AACvF,qBAAa,0BAA2B,YAAW,eAAe;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IAEnD,OAAO,CAAC,GAAG;IAIL,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1E,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAInE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpE;AAiED;;;;GAIG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,eAAe,CAAC,CAItE"}

package/dist/keychain-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-adapter.js","sourceRoot":"","sources":["../src/keychain-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAeH,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,uFAAuF;AACvF,MAAM,OAAO,0BAA0B;IACpB,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,GAAG,CAAC,OAAe,EAAE,OAAe;QAC1C,OAAO,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,CAAC,yDAAyD;IACxE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc;QAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAe;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,OAAe;QACjD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;CACF;AAUD,MAAM,qBAAqB;IACjB,SAAS,CAAsC,CAAC,+BAA+B;IAE/E,KAAK,CAAC,gBAAgB;QAC5B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAA2C,CAAC;YACzF,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,8DAA8D;QACvF,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;YACxD,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACrC,KAAK,CAAC,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,KAAK,QAAQ,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,2EAA2E;QAC3F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc;QAC9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAe;QAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,4CAA4C;QAC3D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,OAAe;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC3C,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO,IAAI,0BAA0B,EAAE,CAAC;AAC1C,CAAC"}

package/dist/mcp-caller-identity.d.ts

@@ -0,0 +1,101 @@
+/**
+ * McpCallerIdentity — ADR-377 Phase 3 (ruvnet/ruflo#2516, #2873).
+ *
+ * Per-invocation, Ed25519-signed capability tokens binding an MCP tool call
+ * to a specific caller. Closes the gap identified in arXiv:2603.07473
+ * (Caller Identity Confusion in MCP): authorization state today persists
+ * across callers with no re-verification, and `AgentAuthorizationPropagator`
+ * (ADR-144)'s `checkToolCall` validates a *scope* but not that the caller
+ * presenting it is who they claim to be for *this* call.
+ *
+ * Signing implementation follows the same pattern already used in this repo
+ * for Ed25519 signing (`@claude-flow/browser`'s `witness-signer.ts`): native
+ * `node:crypto`, zero new dependencies, sign+verify both supported (unlike
+ * `@claude-flow/security`'s own `plugins/integrity-verifier.ts`, which uses
+ * `@noble/ed25519` for verify-only). Reimplemented here rather than imported
+ * from `@claude-flow/browser` because a security-primitives module
+ * depending on the browser package would be a backwards layering
+ * dependency; the pattern is ~15 lines and not worth a cross-package import
+ * for that.
+ *
+ * Scope and honest limitations (per the ADR's own text)
+ * --------------------------------------------------------
+ * This module implements token issuance/verification only. It does NOT
+ * wire itself into any MCP tool dispatcher — this repo currently has at
+ * least two distinct `ToolRegistry` implementations
+ * (`v3/mcp/tool-registry.ts`, `v3/@claude-flow/mcp/src/tool-registry.ts`)
+ * plus a third under `@claude-flow/shared`, and it was not safe to guess
+ * which one is authoritative without risking silently wiring the wrong
+ * dispatch path. `AgentAuthorizationPropagator.checkToolCall` (ADR-144) is
+ * the natural composition point — call `verifyInvocationToken` first and
+ * only proceed to `checkToolCall` if it passes — but that composition is
+ * left to the caller rather than baked into `checkToolCall` itself, to
+ * avoid changing ADR-144's already-shipped, already-tested behavior.
+ *
+ * Key distribution (how callers obtain a private key to sign with in the
+ * first place) is explicitly out of scope — the ADR calls for "a follow-on
+ * ADR for key distribution" before this ships enabled by default, which is
+ * why `CLAUDE_FLOW_MCP_CALLER_AUTH` defaults to disabled.
+ */
+import type { KeyObject } from 'node:crypto';
+export interface CallerIdentityKey {
+    privateKey: KeyObject;
+    publicKey: KeyObject;
+    publicKeyHex: string;
+}
+export interface InvocationToken {
+    /** Agent/principal id of the caller this token was issued to. */
+    callerId: string;
+    /** Tool this token authorizes — a token issued for one tool cannot be
+     * replayed against another. */
+    toolName: string;
+    /** Unix ms the token was issued. */
+    issuedAt: number;
+    /** Unix ms after which the token is no longer valid. */
+    expiresAt: number;
+    /** Random per-token value; prevents replay of an otherwise-identical
+     * token issued in the same millisecond. */
+    nonce: string;
+    /** Hex-encoded Ed25519 signature over the canonicalized fields above. */
+    signature: string;
+}
+export interface TokenVerificationResult {
+    valid: boolean;
+    reason?: 'expired' | 'bad-signature' | 'tool-mismatch';
+}
+/** Generate a fresh Ed25519 keypair. */
+export declare function generateCallerIdentityKey(): CallerIdentityKey;
+/** Load a caller-identity key from a PEM-encoded private key string. */
+export declare function loadCallerIdentityKey(privateKeyPem: string): CallerIdentityKey;
+/**
+ * Issue a fresh, signed `InvocationToken` for `callerId` to call `toolName`.
+ * Callers must present a *new* token per invocation — tokens are
+ * single-tool-bound and short-lived (`ttlMs`, default 30s) by design; there
+ * is no renewal API on purpose.
+ */
+export declare function issueInvocationToken(callerId: string, toolName: string, key: CallerIdentityKey, opts?: {
+    ttlMs?: number;
+    now?: number;
+}): InvocationToken;
+/**
+ * Verify an `InvocationToken` against the issuing caller's public key and
+ * (if provided) the tool the caller is about to invoke. Never throws.
+ */
+export declare function verifyInvocationToken(token: InvocationToken, publicKey: KeyObject, opts?: {
+    toolName?: string;
+    now?: number;
+}): TokenVerificationResult;
+/** Off by default — see the file header re: key distribution being out of scope pending a follow-on ADR. Only the literal `'true'` enables enforcement. */
+export declare function isMcpCallerAuthEnabled(): boolean;
+/** Inverse of `extractPublicKeyHex`: rebuild a `KeyObject` from the raw hex it produced. */
+export declare function publicKeyFromHex(hex: string): KeyObject;
+/**
+ * Pack an `InvocationToken` into one env-var-safe string (JSON + base64url).
+ * The issuer's public key travels in its own env var (set alongside this
+ * one, hex is already env-var-safe) rather than being folded in here — kept
+ * separate to mirror how the two values are set independently at spawn time.
+ */
+export declare function encodeTokenEnvelope(token: InvocationToken): string;
+/** Inverse of `encodeTokenEnvelope`. Never throws — returns `undefined` on any malformed input. */
+export declare function decodeTokenEnvelope(encoded: string): InvocationToken | undefined;
+//# sourceMappingURL=mcp-caller-identity.d.ts.map

package/dist/mcp-caller-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-caller-identity.d.ts","sourceRoot":"","sources":["../src/mcp-caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB;mCAC+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB;+CAC2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,SAAS,GAAG,eAAe,GAAG,eAAe,CAAC;CACxD;AAeD,wCAAwC;AACxC,wBAAgB,yBAAyB,IAAI,iBAAiB,CAG7D;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,CAI9E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,iBAAiB,EACtB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1C,eAAe,CAWjB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,SAAS,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,uBAAuB,CAgBzB;AAQD,2JAA2J;AAC3J,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAoBD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAMvD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAElE;AAED,mGAAmG;AACnG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAmBhF"}

package/dist/mcp-caller-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-caller-identity.js","sourceRoot":"","sources":["../src/mcp-caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA+BhH,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,iGAAiG;AACjG,SAAS,cAAc,CAAC,CAAsF;IAC5G,OAAO,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAC/E,CAAC;AAED,gFAAgF;AAChF,SAAS,mBAAmB,CAAC,SAAoB;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,yBAAyB;IACvC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,QAAgB,EAChB,GAAsB,EACtB,OAAyC,EAAE;IAE3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG;QACf,QAAQ;QACR,QAAQ;QACR,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;QAC/C,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5G,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAsB,EACtB,SAAoB,EACpB,OAA4C,EAAE;IAE9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAEnC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAChJ,MAAM,CACP,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAC1E,CAAC;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAEtD,2JAA2J;AAC3J,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC;AACjD,CAAC;AAED,+EAA+E;AAC/E,oEAAoE;AACpE,+EAA+E;AAC/E,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,qEAAqE;AACrE,yEAAyE;AAEzE;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE/E,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QACzF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5D,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,IACE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;eAC3B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;eAC9B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;eAC9B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;eAC/B,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;eAC3B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAClC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAA+B,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/mcp-composition-inspector.d.ts

@@ -0,0 +1,133 @@
+/**
+ * MCP Tool Composition Inspector — ADR-320 (this ADR; ruvnet/ruflo dream-cycle
+ * proposal, arXiv:2606.27027 "ShareLock").
+ *
+ * The attack: an adversary registers N seemingly-benign MCP tools whose
+ * individual descriptions look fine in isolation, but whose CONCATENATION
+ * (or pairwise overlap) forms an injection payload targeting a downstream
+ * agent — a Shamir-secret-sharing-style split across tool descriptions.
+ * Per-tool inspection misses this because each fragment sits under any
+ * single-tool detection threshold.
+ *
+ * Relationship to prior art in this repo
+ * ---------------------------------------
+ * A CLI-only v1 of this idea already shipped directly to `main`
+ * (dream-cycle #2783, commits 381b7ebcc/581cd2bf3) as
+ * `v3/@claude-flow/cli/src/security/mcp-composition-inspector.ts` — an
+ * on-demand `ruflo security composition-scan` command using exact
+ * common-substring matching plus an injection-phrase catalog and
+ * typosquat check. That module's own header explicitly scopes itself as
+ * "a bounded engineering fix rather than an ADR-scope subsystem" and lists
+ * "Future v2: SimHash + LSH for scale" as deliberately deferred. THIS
+ * module is that v2: a reusable `@claude-flow/security` library primitive
+ * (not a CLI-only tool) built around a real SimHash fingerprint, so it can
+ * be called from a pre-task/pre-tool-use hook before a multi-tool chain
+ * executes, per this ADR's implementation target. It does not replace or
+ * import the CLI v1 — the two are independent, complementary detectors
+ * (exact-substring vs. hashed-shingle-overlap) that a caller may run
+ * together.
+ *
+ * Detection method (deterministic, no LLM call)
+ * -----------------------------------------------
+ * 1. Each tool description is normalized and split into overlapping
+ *    word-shingles (default: 5-word windows). Shingling — rather than
+ *    whole-description comparison — is what lets us find a SMALL embedded
+ *    fragment inside an otherwise unrelated, benign description.
+ * 2. Each tool gets a 64-bit SimHash fingerprint: every shingle is hashed
+ *    (FNV-1a, 64-bit) and the fingerprint bits are set by majority vote
+ *    across all of a tool's shingle hashes. Two tools whose descriptions
+ *    share enough content have a SMALL Hamming distance between
+ *    fingerprints — this is the O(1)-per-pair coarse filter that avoids an
+ *    LLM call and stays cheap even at hundreds of registered tools (fast
+ *    64-bit XOR + popcount per pair).
+ * 3. An inverted shingle-hash index (hash -> set of tool indices) is built
+ *    once, in O(total shingles). For each pair flagged by the SimHash
+ *    filter (or found in the index) the SAME index is used to compute the
+ *    actual overlapping shingle text — this is what makes the finding
+ *    reportable (the SimHash score alone can't tell an operator *what*
+ *    matched).
+ * 4. A fragment's "population" (how many distinct tools carry it) caps
+ *    false positives: shared shingles that appear in more than
+ *    `maxFragmentPopulation` (default 3) tools are template language
+ *    (e.g. every ruflo `memory_*` tool's boilerplate), not an attack —
+ *    Shamir-split attacks concentrate a fragment in a small conspiracy of
+ *    2-3 tools. Same population-cap idea as the CLI v1, reimplemented here
+ *    against the hash index instead of raw substrings.
+ *
+ * This is a heuristic detector, not a security boundary: it reports
+ * SUSPECTS. Default action is warn + log; blocking is opt-in via
+ * `CLAUDE_FLOW_MCP_COMPOSITION_BLOCK=1` (see {@link evaluateToolComposition}).
+ *
+ * @module @claude-flow/security/mcp-composition-inspector
+ */
+export interface McpToolDescriptor {
+    name: string;
+    description: string;
+}
+export interface CompositionInspectorOptions {
+    /** Words per shingle window. Default 5. */
+    shingleSize?: number;
+    /** SimHash similarity (1 - Hamming/64) at/above which a pair is a candidate. Default 0.6. */
+    simhashThreshold?: number;
+    /** Fraction of a tool's shingles shared with a peer (low-population only) at/above which a pair is flagged. Default 0.25. */
+    fragmentOverlapThreshold?: number;
+    /** Max number of distinct tools a shingle may appear in before it's treated as template language, not an attack fragment. Default 3. */
+    maxFragmentPopulation?: number;
+    /** Minimum character length for a shingle to be indexed (filters trivial/common short phrases). Default 12. */
+    minShingleChars?: number;
+    /** Max sample shared fragments recorded per finding (display only). Default 5. */
+    maxSampleFragments?: number;
+}
+export interface CompositionFinding {
+    toolA: string;
+    toolB: string;
+    /** 1 - (Hamming distance / 64) between the two tools' SimHash fingerprints. */
+    simhashSimilarity: number;
+    /** sharedLowPopulationShingles / min(shingleCount(A), shingleCount(B)). */
+    fragmentOverlapScore: number;
+    /** Sample of the actual shared shingle text driving the finding (truncated). */
+    sharedFragments: string[];
+    /** Max population (distinct tools) observed among the shared shingles that triggered this finding. */
+    fragmentPopulation: number;
+    reason: string;
+}
+export interface CompositionInspectionStats {
+    toolsScanned: number;
+    pairsCompared: number;
+    shinglesIndexed: number;
+    /** Pairs whose SimHash similarity alone crossed simhashThreshold (diagnostic — includes pairs later excluded for having no low-population shared shingle). */
+    candidatePairsFromSimhash: number;
+}
+export interface CompositionInspectionResult {
+    findings: CompositionFinding[];
+    stats: CompositionInspectionStats;
+}
+export interface CompositionGuardResult {
+    result: CompositionInspectionResult;
+    action: 'none' | 'warn' | 'block';
+    blocked: boolean;
+    message?: string;
+}
+/** FNV-1a, 64-bit. Deterministic, dependency-free, good avalanche for short strings. */
+export declare function fnv1a64(input: string): bigint;
+/**
+ * Classic SimHash: bit-vote a 64-bit fingerprint across a list of token
+ * hashes. Near-duplicate token sets (even with some fragments differing)
+ * produce fingerprints with a small Hamming distance.
+ */
+export declare function simhash64(shingles: readonly string[]): bigint;
+/** Hamming distance between two 64-bit fingerprints (0..64). */
+export declare function hammingDistance64(a: bigint, b: bigint): number;
+export declare function inspectToolComposition(tools: readonly McpToolDescriptor[], options?: CompositionInspectorOptions): CompositionInspectionResult;
+/** Reads `CLAUDE_FLOW_MCP_COMPOSITION_BLOCK` fresh on every call. '1' or 'true' (case-insensitive) enables blocking; unset/anything else keeps the default warn+log posture. */
+export declare function isCompositionBlockEnabled(): boolean;
+/**
+ * Runs {@link inspectToolComposition} and applies the ADR-320 default
+ * posture: warn + log (via `console.warn`) unless
+ * `CLAUDE_FLOW_MCP_COMPOSITION_BLOCK=1`, in which case the chain is marked
+ * `blocked: true` — the caller (the pre-task hook / MCP dispatcher) decides
+ * what "blocked" means operationally; this function does not throw or abort
+ * anything itself.
+ */
+export declare function evaluateToolComposition(tools: readonly McpToolDescriptor[], options?: CompositionInspectorOptions): CompositionGuardResult;
+//# sourceMappingURL=mcp-composition-inspector.d.ts.map

package/dist/mcp-composition-inspector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-composition-inspector.d.ts","sourceRoot":"","sources":["../src/mcp-composition-inspector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAMH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6FAA6F;IAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6HAA6H;IAC7H,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,wIAAwI;IACxI,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,+GAA+G;IAC/G,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sGAAsG;IACtG,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,8JAA8J;IAC9J,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,KAAK,EAAE,0BAA0B,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,2BAA2B,CAAC;IACpC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAUD,wFAAwF;AACxF,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO7C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAe7D;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAkCD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,iBAAiB,EAAE,EACnC,OAAO,GAAE,2BAAgC,GACxC,2BAA2B,CAyF7B;AAQD,gLAAgL;AAChL,wBAAgB,yBAAyB,IAAI,OAAO,CAGnD;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,iBAAiB,EAAE,EACnC,OAAO,GAAE,2BAAgC,GACxC,sBAAsB,CAwBxB"}