@skillsmith/core 0.4.0 → 0.4.2

package/dist/src/session/SessionManager.d.ts

@@ -7,71 +7,9 @@
  * to enable context restoration across sessions.
  */
 import type { SessionData, Checkpoint } from './SessionContext.js';
-/**
- * Options for creating a new session
- */
-export interface SessionOptions {
-    issueId?: string;
-    worktree?: string;
-    description?: string;
-}
-/**
- * Result from claude-flow memory operations
- */
-export interface MemoryResult {
-    success: boolean;
-    data?: string;
-    error?: string;
-}
-/**
- * Command executor interface for dependency injection
- * Allows mocking claude-flow commands in tests
- *
- * Supports two modes:
- * - spawn(): Secure argument-array based execution (preferred)
- * - execute(): Legacy string-based execution (deprecated, for backwards compatibility)
- */
-export interface CommandExecutor {
-    /**
-     * @deprecated Use spawn() instead for security
-     */
-    execute(command: string): Promise<{
-        stdout: string;
-        stderr: string;
-    }>;
-    /**
-     * Secure spawn-based execution with argument array
-     * Prevents command injection by not using shell interpolation
-     */
-    spawn?(executable: string, args: string[]): Promise<{
-        stdout: string;
-        stderr: string;
-    }>;
-}
-/**
- * Default command executor using child_process.spawn
- * Uses argument arrays to prevent command injection
- */
-export declare class DefaultCommandExecutor implements CommandExecutor {
-    /**
-     * @deprecated Legacy string-based execution - use spawn instead
-     */
-    execute(command: string): Promise<{
-        stdout: string;
-        stderr: string;
-    }>;
-    /**
-     * Secure spawn-based execution with argument array
-     */
-    spawn(executable: string, args: string[]): Promise<{
-        stdout: string;
-        stderr: string;
-    }>;
-    /**
-     * Parse legacy string command and execute via spawn
-     */
-    private executeWithSpawn;
-}
+import type { CommandExecutor, SessionOptions } from './SessionManager.types.js';
+export type { CommandExecutor, MemoryResult, SessionOptions } from './SessionManager.types.js';
+export { DefaultCommandExecutor } from './SessionManager.helpers.js';
 /**
  * Session Manager for claude-flow memory integration
  *
@@ -152,8 +90,6 @@ export declare class SessionManager {
      *
      * SMI-674: Uses spawn() with argument array to prevent command injection
      * SMI-1518: V3 API Migration - Use direct storeEntry() when available
-     *
-     * Values are passed as separate arguments, never interpolated into shell commands
      */
     private storeMemory;
     /**

package/dist/src/session/SessionManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../../src/session/SessionManager.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AA6DlE;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAErE;;;OAGG;IACH,KAAK,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACxF;AAED;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,eAAe;IAC5D;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAK3E;;OAEG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAiC5F;;OAEG;YACW,gBAAgB;CAO/B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,cAAc,CAA2B;IAEjD;;;OAGG;IACH,OAAO,CAAC,WAAW,CAAmC;gBAE1C,QAAQ,CAAC,EAAE,eAAe;IAItC;;;OAGG;YACW,QAAQ;IAiBtB;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAI3B;;OAEG;IACG,YAAY,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BtE;;;;;OAKG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAoDhE;;;OAGG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAezD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBjC;;OAEG;IACH,iBAAiB,IAAI,WAAW,GAAG,IAAI;IAIvC;;OAEG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAehE;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAenD;;OAEG;YACW,YAAY;IAM1B;;OAEG;YACW,iBAAiB;IAI/B;;OAEG;YACW,mBAAmB;IAIjC;;;;;;;OAOG;YACW,WAAW;IA+CzB;;;;;OAKG;YACW,cAAc;IAiD5B;;;;;OAKG;YACW,YAAY;IA2C1B;;;;OAIG;YACW,cAAc;IAsC5B;;;;OAIG;YACW,eAAe;CA2B9B"}
+{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../../src/session/SessionManager.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAGlE,OAAO,KAAK,EAAE,eAAe,EAAgB,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAe9F,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC9F,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAEpE;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,cAAc,CAA2B;IAEjD;;;OAGG;IACH,OAAO,CAAC,WAAW,CAAmC;gBAE1C,QAAQ,CAAC,EAAE,eAAe;IAItC;;;OAGG;YACW,QAAQ;IAiBtB;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAI3B;;OAEG;IACG,YAAY,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BtE;;;;;OAKG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAoDhE;;;OAGG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAezD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBjC;;OAEG;IACH,iBAAiB,IAAI,WAAW,GAAG,IAAI;IAIvC;;OAEG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAehE;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAenD;;OAEG;YACW,YAAY;IAM1B;;OAEG;YACW,iBAAiB;IAI/B;;OAEG;YACW,mBAAmB;IAIjC;;;;;OAKG;YACW,WAAW;IA4CzB;;;;;OAKG;YACW,cAAc;IAgD5B;;;;;OAKG;YACW,YAAY;IA4C1B;;;;OAIG;YACW,cAAc;IAwC5B;;;;OAIG;YACW,eAAe;CA6B9B"}

package/dist/src/session/SessionManager.helpers.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Session Manager Helper Functions and Classes
+ * @module @skillsmith/core/session/SessionManager.helpers
+ */
+import type { ClaudeFlowMemoryModule, ClaudeFlowMcpModule, CommandExecutor } from './SessionManager.types.js';
+/**
+ * Lazily load claude-flow memory module
+ * Returns undefined if claude-flow is not installed
+ *
+ * Uses string concatenation for the import path to prevent Node.js
+ * ESM static analysis from resolving the module at parse time.
+ */
+export declare function getClaudeFlowMemory(): Promise<ClaudeFlowMemoryModule | undefined>;
+/**
+ * Lazily load claude-flow MCP module
+ * Returns undefined if claude-flow is not installed
+ *
+ * Uses string concatenation for the import path to prevent Node.js
+ * ESM static analysis from resolving the module at parse time.
+ */
+export declare function getClaudeFlowMcp(): Promise<ClaudeFlowMcpModule | undefined>;
+/**
+ * Memory key patterns for session storage
+ */
+export declare const MEMORY_KEYS: {
+    readonly CURRENT: "session/current";
+    readonly SESSION_PREFIX: "session/";
+    readonly CHECKPOINT_PREFIX: "checkpoint/";
+};
+/**
+ * SMI-1518: Feature flag to enable V3 direct API
+ * Set CLAUDE_FLOW_USE_V3_API=true to use direct API calls
+ * Falls back to spawn-based CLI if not set or if V3 API fails
+ */
+export declare const USE_V3_API: boolean;
+/**
+ * Default namespace for session memory entries
+ */
+export declare const MEMORY_NAMESPACE = "skillsmith-sessions";
+/**
+ * Validates a memory key to prevent injection attacks
+ */
+export declare function validateMemoryKey(key: string): boolean;
+/**
+ * Default command executor using child_process.spawn
+ * Uses argument arrays to prevent command injection
+ */
+export declare class DefaultCommandExecutor implements CommandExecutor {
+    /**
+     * @deprecated Legacy string-based execution - use spawn instead
+     */
+    execute(command: string): Promise<{
+        stdout: string;
+        stderr: string;
+    }>;
+    /**
+     * Secure spawn-based execution with argument array
+     */
+    spawn(executable: string, args: string[]): Promise<{
+        stdout: string;
+        stderr: string;
+    }>;
+    /**
+     * Parse legacy string command and execute via spawn
+     */
+    private executeWithSpawn;
+}
+//# sourceMappingURL=SessionManager.helpers.d.ts.map

package/dist/src/session/SessionManager.helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionManager.helpers.d.ts","sourceRoot":"","sources":["../../../src/session/SessionManager.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EAChB,MAAM,2BAA2B,CAAA;AAoBlC;;;;;;GAMG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAWvF;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAWjF;AAMD;;GAEG;AACH,eAAO,MAAM,WAAW;;;;CAId,CAAA;AAEV;;;;GAIG;AACH,eAAO,MAAM,UAAU,SAAgD,CAAA;AAEvE;;GAEG;AACH,eAAO,MAAM,gBAAgB,wBAAwB,CAAA;AAYrD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AAMD;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,eAAe;IAC5D;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAK3E;;OAEG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAiC5F;;OAEG;YACW,gBAAgB;CAO/B"}

package/dist/src/session/SessionManager.helpers.js

@@ -0,0 +1,152 @@
+/**
+ * Session Manager Helper Functions and Classes
+ * @module @skillsmith/core/session/SessionManager.helpers
+ */
+import { spawn } from 'node:child_process';
+// ============================================================================
+// Module Loading State
+// ============================================================================
+// Use symbol to distinguish "not yet attempted" from "attempted but failed (undefined)"
+const NOT_LOADED = Symbol('not-loaded');
+let claudeFlowMemory = NOT_LOADED;
+let claudeFlowMcp = NOT_LOADED;
+// Module paths are constructed dynamically to prevent ESM static analysis
+const CLAUDE_FLOW_BASE = 'claude-flow';
+const MEMORY_MODULE_PATH = '/v3/@claude-flow/cli/dist/src/memory/memory-initializer.js';
+const MCP_MODULE_PATH = '/v3/@claude-flow/cli/dist/src/mcp-client.js';
+// ============================================================================
+// Dynamic Module Loaders
+// ============================================================================
+/**
+ * Lazily load claude-flow memory module
+ * Returns undefined if claude-flow is not installed
+ *
+ * Uses string concatenation for the import path to prevent Node.js
+ * ESM static analysis from resolving the module at parse time.
+ */
+export async function getClaudeFlowMemory() {
+    if (claudeFlowMemory === NOT_LOADED) {
+        try {
+            // String concatenation prevents static analysis
+            const modulePath = CLAUDE_FLOW_BASE + MEMORY_MODULE_PATH;
+            claudeFlowMemory = await import(/* webpackIgnore: true */ modulePath);
+        }
+        catch {
+            claudeFlowMemory = undefined; // Mark as attempted but failed
+        }
+    }
+    return claudeFlowMemory === NOT_LOADED ? undefined : claudeFlowMemory;
+}
+/**
+ * Lazily load claude-flow MCP module
+ * Returns undefined if claude-flow is not installed
+ *
+ * Uses string concatenation for the import path to prevent Node.js
+ * ESM static analysis from resolving the module at parse time.
+ */
+export async function getClaudeFlowMcp() {
+    if (claudeFlowMcp === NOT_LOADED) {
+        try {
+            // String concatenation prevents static analysis
+            const modulePath = CLAUDE_FLOW_BASE + MCP_MODULE_PATH;
+            claudeFlowMcp = await import(/* webpackIgnore: true */ modulePath);
+        }
+        catch {
+            claudeFlowMcp = undefined; // Mark as attempted but failed
+        }
+    }
+    return claudeFlowMcp === NOT_LOADED ? undefined : claudeFlowMcp;
+}
+// ============================================================================
+// Constants
+// ============================================================================
+/**
+ * Memory key patterns for session storage
+ */
+export const MEMORY_KEYS = {
+    CURRENT: 'session/current',
+    SESSION_PREFIX: 'session/',
+    CHECKPOINT_PREFIX: 'checkpoint/',
+};
+/**
+ * SMI-1518: Feature flag to enable V3 direct API
+ * Set CLAUDE_FLOW_USE_V3_API=true to use direct API calls
+ * Falls back to spawn-based CLI if not set or if V3 API fails
+ */
+export const USE_V3_API = process.env.CLAUDE_FLOW_USE_V3_API === 'true';
+/**
+ * Default namespace for session memory entries
+ */
+export const MEMORY_NAMESPACE = 'skillsmith-sessions';
+// ============================================================================
+// Validation
+// ============================================================================
+/**
+ * Pattern for safe memory keys
+ * Only allows alphanumeric characters, hyphens, underscores, and forward slashes
+ */
+const SAFE_KEY_PATTERN = /^[a-zA-Z0-9/_-]+$/;
+/**
+ * Validates a memory key to prevent injection attacks
+ */
+export function validateMemoryKey(key) {
+    return SAFE_KEY_PATTERN.test(key) && key.length <= 256;
+}
+// ============================================================================
+// Default Command Executor
+// ============================================================================
+/**
+ * Default command executor using child_process.spawn
+ * Uses argument arrays to prevent command injection
+ */
+export class DefaultCommandExecutor {
+    /**
+     * @deprecated Legacy string-based execution - use spawn instead
+     */
+    async execute(command) {
+        // For backwards compatibility only - prefer spawn()
+        return this.executeWithSpawn(command);
+    }
+    /**
+     * Secure spawn-based execution with argument array
+     */
+    async spawn(executable, args) {
+        return new Promise((resolve, reject) => {
+            const proc = spawn(executable, args, {
+                shell: false,
+                env: { ...process.env },
+                timeout: 30000,
+            });
+            let stdout = '';
+            let stderr = '';
+            proc.stdout?.on('data', (data) => {
+                stdout += data.toString();
+            });
+            proc.stderr?.on('data', (data) => {
+                stderr += data.toString();
+            });
+            proc.on('close', (code) => {
+                if (code === 0) {
+                    resolve({ stdout: stdout.trim(), stderr: stderr.trim() });
+                }
+                else {
+                    reject(new Error(stderr || `Command failed with code ${code}`));
+                }
+            });
+            proc.on('error', (err) => {
+                reject(err);
+            });
+        });
+    }
+    /**
+     * Parse legacy string command and execute via spawn
+     */
+    async executeWithSpawn(command) {
+        // Parse the command safely
+        const parts = command.split(' ');
+        const executable = parts[0];
+        const args = parts.slice(1);
+        return this.spawn(executable, args);
+    }
+}
+//# sourceMappingURL=SessionManager.helpers.js.map

package/dist/src/session/SessionManager.helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionManager.helpers.js","sourceRoot":"","sources":["../../../src/session/SessionManager.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAO1C,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,wFAAwF;AACxF,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;AACvC,IAAI,gBAAgB,GAA2D,UAAU,CAAA;AACzF,IAAI,aAAa,GAAwD,UAAU,CAAA;AAEnF,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,aAAa,CAAA;AACtC,MAAM,kBAAkB,GAAG,4DAA4D,CAAA;AACvF,MAAM,eAAe,GAAG,6CAA6C,CAAA;AAErE,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,CAAA;YACxD,gBAAgB,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,SAAS,CAAA,CAAC,+BAA+B;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAA;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,UAAU,GAAG,gBAAgB,GAAG,eAAe,CAAA;YACrD,aAAa,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAA;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,GAAG,SAAS,CAAA,CAAC,+BAA+B;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAA;AACjE,CAAC;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,OAAO,EAAE,iBAAiB;IAC1B,cAAc,EAAE,UAAU;IAC1B,iBAAiB,EAAE,aAAa;CACxB,CAAA;AAEV;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,CAAA;AAEvE;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAErD,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,gBAAgB,GAAG,mBAAmB,CAAA;AAE5C;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAA;AACxD,CAAC;AAED,+EAA+E;AAC/E,2BAA2B;AAC3B,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IACjC;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,OAAe;QAC3B,oDAAoD;QACpD,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,IAAc;QAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;gBACnC,KAAK,EAAE,KAAK;gBACZ,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;gBACvB,OAAO,EAAE,KAAK;aACf,CAAC,CAAA;YAEF,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,IAAI,MAAM,GAAG,EAAE,CAAA;YAEf,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;YAC3B,CAAC,CAAC,CAAA;YAEF,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;YAC3B,CAAC,CAAC,CAAA;YAEF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC3D,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,4BAA4B,IAAI,EAAE,CAAC,CAAC,CAAA;gBACjE,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,MAAM,CAAC,GAAG,CAAC,CAAA;YACb,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,OAAe;QAC5C,2BAA2B;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IACrC,CAAC;CACF"}

package/dist/src/session/SessionManager.js

@@ -7,111 +7,10 @@
  * to enable context restoration across sessions.
  */
 import { randomUUID } from 'node:crypto';
-import { spawn } from 'node:child_process';
-// V3 API imports - SMI-1518
-// These provide direct TypeScript API access instead of spawning CLI commands
-// Note: claude-flow V3 alpha doesn't export all functions from root, use direct paths
-import { storeEntry, getEntry, } from 'claude-flow/v3/@claude-flow/cli/dist/src/memory/memory-initializer.js';
-import { callMCPTool, MCPClientError } from 'claude-flow/v3/@claude-flow/cli/dist/src/mcp-client.js';
-/**
- * Memory key patterns for session storage
- */
-const MEMORY_KEYS = {
-    CURRENT: 'session/current',
-    SESSION_PREFIX: 'session/',
-    CHECKPOINT_PREFIX: 'checkpoint/',
-};
-/**
- * SMI-1518: Feature flag to enable V3 direct API
- * Set CLAUDE_FLOW_USE_V3_API=true to use direct API calls
- * Falls back to spawn-based CLI if not set or if V3 API fails
- */
-const USE_V3_API = process.env.CLAUDE_FLOW_USE_V3_API === 'true';
-/**
- * Default namespace for session memory entries
- */
-const MEMORY_NAMESPACE = 'skillsmith-sessions';
-/**
- * Validates a memory key to prevent injection attacks
- * Only allows alphanumeric characters, hyphens, underscores, and forward slashes
- */
-function validateMemoryKey(key) {
-    const SAFE_KEY_PATTERN = /^[a-zA-Z0-9/_-]+$/;
-    return SAFE_KEY_PATTERN.test(key) && key.length <= 256;
-}
-/**
- * Sanitizes session data before storage
- */
-function sanitizeSessionData(data) {
-    return {
-        sessionId: data.sessionId,
-        startedAt: data.startedAt,
-        issueId: data.issueId?.replace(/[<>]/g, ''),
-        worktree: data.worktree?.replace(/[<>]/g, ''),
-        checkpoints: data.checkpoints.map((cp) => ({
-            id: cp.id,
-            timestamp: cp.timestamp,
-            description: cp.description.substring(0, 500),
-            memoryKey: cp.memoryKey,
-        })),
-        filesModified: data.filesModified.map((f) => f.substring(0, 500)),
-        lastActivity: data.lastActivity,
-    };
-}
-/**
- * Default command executor using child_process.spawn
- * Uses argument arrays to prevent command injection
- */
-export class DefaultCommandExecutor {
-    /**
-     * @deprecated Legacy string-based execution - use spawn instead
-     */
-    async execute(command) {
-        // For backwards compatibility only - prefer spawn()
-        return this.executeWithSpawn(command);
-    }
-    /**
-     * Secure spawn-based execution with argument array
-     */
-    async spawn(executable, args) {
-        return new Promise((resolve, reject) => {
-            const proc = spawn(executable, args, {
-                shell: false,
-                env: { ...process.env },
-                timeout: 30000,
-            });
-            let stdout = '';
-            let stderr = '';
-            proc.stdout?.on('data', (data) => {
-                stdout += data.toString();
-            });
-            proc.stderr?.on('data', (data) => {
-                stderr += data.toString();
-            });
-            proc.on('close', (code) => {
-                if (code === 0) {
-                    resolve({ stdout: stdout.trim(), stderr: stderr.trim() });
-                }
-                else {
-                    reject(new Error(stderr || `Command failed with code ${code}`));
-                }
-            });
-            proc.on('error', (err) => {
-                reject(err);
-            });
-        });
-    }
-    /**
-     * Parse legacy string command and execute via spawn
-     */
-    async executeWithSpawn(command) {
-        // Parse the command safely
-        const parts = command.split(' ');
-        const executable = parts[0];
-        const args = parts.slice(1);
-        return this.spawn(executable, args);
-    }
-}
+import { sanitizeSessionData } from './SessionManager.types.js';
+// Import helpers
+import { getClaudeFlowMemory, getClaudeFlowMcp, MEMORY_KEYS, USE_V3_API, MEMORY_NAMESPACE, validateMemoryKey, DefaultCommandExecutor, } from './SessionManager.helpers.js';
+export { DefaultCommandExecutor } from './SessionManager.helpers.js';
 /**
  * Session Manager for claude-flow memory integration
  *
@@ -327,42 +226,37 @@ export class SessionManager {
      *
      * SMI-674: Uses spawn() with argument array to prevent command injection
      * SMI-1518: V3 API Migration - Use direct storeEntry() when available
-     *
-     * Values are passed as separate arguments, never interpolated into shell commands
      */
     async storeMemory(key, value) {
         if (!validateMemoryKey(key)) {
             return { success: false, error: 'Invalid memory key' };
         }
-        // SMI-1518: Try V3 direct API first if enabled
+        // SMI-1518, SMI-1609: Try V3 direct API first if enabled
         if (USE_V3_API) {
             try {
-                const result = await storeEntry({
-                    key,
-                    value,
-                    namespace: MEMORY_NAMESPACE,
-                });
-                if (result.success) {
-                    return { success: true };
+                const memoryModule = await getClaudeFlowMemory();
+                if (memoryModule?.storeEntry) {
+                    const result = await memoryModule.storeEntry({
+                        key,
+                        value,
+                        namespace: MEMORY_NAMESPACE,
+                    });
+                    if (result.success) {
+                        return { success: true };
+                    }
+                    console.warn(`V3 storeEntry failed: ${result.error}, falling back to spawn`);
                 }
-                // Fall through to spawn if V3 API reports failure
-                console.warn(`V3 storeEntry failed: ${result.error}, falling back to spawn`);
             }
             catch (error) {
-                // V3 API threw an exception, fall back to spawn
                 console.warn(`V3 storeEntry exception: ${error}, falling back to spawn`);
             }
         }
         try {
-            // SMI-674 FIX: Use spawn with argument array instead of string interpolation
-            // This prevents command injection attacks like $(whoami) or `id`
             const args = ['claude-flow', 'memory', 'store', '--key', key, '--value', value];
             if (this.executor.spawn) {
                 await this.executor.spawn('npx', args);
             }
             else {
-                // Fallback to execute for backwards compatibility (legacy executors)
-                // Note: This path should not be used in production
                 const escapedValue = value.replace(/'/g, "'\\''");
                 const command = `npx claude-flow memory store --key "${key}" --value '${escapedValue}'`;
                 await this.executor.execute(command);
@@ -386,29 +280,29 @@ export class SessionManager {
         if (!validateMemoryKey(key)) {
             return { success: false, error: 'Invalid memory key' };
         }
-        // SMI-1518: Try V3 direct API first if enabled
+        // SMI-1518, SMI-1609: Try V3 direct API first if enabled
         if (USE_V3_API) {
             try {
-                const result = await getEntry({
-                    key,
-                    namespace: MEMORY_NAMESPACE,
-                });
-                if (result.success && result.found && result.entry) {
-                    return { success: true, data: result.entry.content };
+                const memoryModule = await getClaudeFlowMemory();
+                if (memoryModule?.getEntry) {
+                    const result = await memoryModule.getEntry({
+                        key,
+                        namespace: MEMORY_NAMESPACE,
+                    });
+                    if (result.success && result.found && result.entry) {
+                        return { success: true, data: result.entry.content };
+                    }
+                    if (result.success && !result.found) {
+                        return { success: false, error: 'Key not found' };
+                    }
+                    console.warn(`V3 getEntry failed: ${result.error}, falling back to spawn`);
                 }
-                if (result.success && !result.found) {
-                    return { success: false, error: 'Key not found' };
-                }
-                // Fall through to spawn if V3 API reports failure
-                console.warn(`V3 getEntry failed: ${result.error}, falling back to spawn`);
             }
             catch (error) {
-                // V3 API threw an exception, fall back to spawn
                 console.warn(`V3 getEntry exception: ${error}, falling back to spawn`);
             }
         }
         try {
-            // SMI-674 FIX: Use spawn with argument array
             const args = ['claude-flow', 'memory', 'get', '--key', key];
             let stdout;
             if (this.executor.spawn) {
@@ -416,7 +310,6 @@ export class SessionManager {
                 stdout = result.stdout;
             }
             else {
-                // Fallback for backwards compatibility
                 const command = `npx claude-flow memory get --key "${key}"`;
                 const result = await this.executor.execute(command);
                 stdout = result.stdout;
@@ -440,34 +333,32 @@ export class SessionManager {
         if (!validateMemoryKey(key)) {
             return { success: false, error: 'Invalid memory key' };
         }
-        // SMI-1518: Try V3 MCP API first if enabled
+        // SMI-1518, SMI-1609: Try V3 MCP API first if enabled
         if (USE_V3_API) {
             try {
-                const result = await callMCPTool('memory/delete', {
-                    key,
-                });
-                if (result.success) {
-                    return { success: true };
+                const mcpModule = await getClaudeFlowMcp();
+                if (mcpModule?.callMCPTool) {
+                    const result = (await mcpModule.callMCPTool('memory/delete', { key }));
+                    if (result.success) {
+                        return { success: true };
+                    }
+                    console.warn(`V3 memory/delete failed, falling back to spawn`);
                 }
-                // Fall through to spawn if V3 API reports failure
-                console.warn(`V3 memory/delete failed, falling back to spawn`);
             }
             catch (error) {
-                // V3 API threw an exception, fall back to spawn
-                // MCPClientError indicates the tool wasn't available
-                if (!(error instanceof MCPClientError)) {
+                const mcpModule = await getClaudeFlowMcp();
+                const MCPClientError = mcpModule?.MCPClientError;
+                if (!MCPClientError || !(error instanceof MCPClientError)) {
                     console.warn(`V3 memory/delete exception: ${error}, falling back to spawn`);
                 }
             }
         }
         try {
-            // SMI-674 FIX: Use spawn with argument array
             const args = ['claude-flow', 'memory', 'delete', '--key', key];
             if (this.executor.spawn) {
                 await this.executor.spawn('npx', args);
             }
             else {
-                // Fallback for backwards compatibility
                 const command = `npx claude-flow memory delete --key "${key}"`;
                 await this.executor.execute(command);
             }
@@ -484,14 +375,17 @@ export class SessionManager {
      * SMI-1518: V3 API Migration - Use callMCPTool('hooks/pre-task') when available
      */
     async runPreTaskHook(description) {
-        // SMI-1518: Try V3 MCP API first if enabled
+        // SMI-1518, SMI-1609: Try V3 MCP API first if enabled
         if (USE_V3_API) {
             try {
-                await callMCPTool('hooks/pre-task', {
-                    description,
-                    memoryKey: 'session/current',
-                });
-                return; // Success, no need to fall back
+                const mcpModule = await getClaudeFlowMcp();
+                if (mcpModule?.callMCPTool) {
+                    await mcpModule.callMCPTool('hooks/pre-task', {
+                        description,
+                        memoryKey: 'session/current',
+                    });
+                    return;
+                }
             }
             catch {
                 // V3 API not available or failed, fall back to spawn
@@ -511,7 +405,6 @@ export class SessionManager {
                 await this.executor.spawn('npx', args);
             }
             else {
-                // Fallback for backwards compatibility
                 const escapedDesc = description.replace(/'/g, "'\\''");
                 const command = `npx claude-flow hooks pre-task --description '${escapedDesc}' --memory-key "session/current"`;
                 await this.executor.execute(command);
@@ -527,13 +420,16 @@ export class SessionManager {
      * SMI-1518: V3 API Migration - Use callMCPTool('hooks/post-task') when available
      */
     async runPostTaskHook(taskId) {
-        // SMI-1518: Try V3 MCP API first if enabled
+        // SMI-1518, SMI-1609: Try V3 MCP API first if enabled
         if (USE_V3_API) {
             try {
-                await callMCPTool('hooks/post-task', {
-                    taskId,
-                });
-                return; // Success, no need to fall back
+                const mcpModule = await getClaudeFlowMcp();
+                if (mcpModule?.callMCPTool) {
+                    await mcpModule.callMCPTool('hooks/post-task', {
+                        taskId,
+                    });
+                    return;
+                }
             }
             catch {
                 // V3 API not available or failed, fall back to spawn
@@ -545,7 +441,6 @@ export class SessionManager {
                 await this.executor.spawn('npx', args);
             }
             else {
-                // Fallback for backwards compatibility
                 const command = `npx claude-flow hooks post-task --task-id "${taskId}"`;
                 await this.executor.execute(command);
             }