agentic-flow 2.0.6 → 3.0.0-alpha.1

package/dist/agentic-flow/src/sdk/index.js

@@ -0,0 +1,27 @@
+/**
+ * SDK Integration Module
+ *
+ * Re-exports available SDK integration components.
+ *
+ * NOTE: Many SDK utilities are planned but not yet implemented.
+ * This file will be expanded as new SDK features are added.
+ */
+// Orchestration runtime API (stable programmatic API + loop policy + generic client)
+export { createOrchestrator, getRunStatus, cancelRun, getRunArtifacts, seedMemory, recordLearning, searchMemory, harvestMemory, createOrchestrationClient, } from '../orchestration/index.js';
+// Security utilities
+export { validateFilePath, validateReadPath, validateWritePath, } from '../security/path-validator.js';
+export { validateString, validateLanguage, validateRunId, validateMemoryKey, validateMemoryValue, } from '../security/input-validation.js';
+export { redactKey, sanitizeEnvironment, } from '../security/secret-redaction.js';
+export { RateLimiter, ConcurrencyLimiter, } from '../security/rate-limiter.js';
+// TODO: Implement remaining SDK utilities
+// - hooks-bridge.js (session/tool hooks)
+// - session-manager.js (session tracking)
+// - permission-handler.js (custom permissions)
+// - agent-converter.js (agent format conversion)
+// - e2b-sandbox.js (E2B sandbox integration)
+// - e2b-swarm.js (E2B swarm orchestration)
+// - e2b-swarm-optimizer.js (swarm optimization)
+// - query-control.js (query management)
+// - plugins.js (plugin system)
+// - streaming-input.js (streaming utilities)
+//# sourceMappingURL=index.js.map

package/dist/agentic-flow/src/sdk/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/sdk/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qFAAqF;AACrF,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,eAAe,EAcf,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EAKb,yBAAyB,GAQ1B,MAAM,2BAA2B,CAAC;AAEnC,qBAAqB;AACrB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,SAAS,EACT,mBAAmB,GAEpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,WAAW,EACX,kBAAkB,GAGnB,MAAM,6BAA6B,CAAC;AAErC,0CAA0C;AAC1C,yCAAyC;AACzC,0CAA0C;AAC1C,+CAA+C;AAC/C,iDAAiD;AACjD,6CAA6C;AAC7C,2CAA2C;AAC3C,gDAAgD;AAChD,wCAAwC;AACxC,+BAA+B;AAC/B,6CAA6C","sourcesContent":["/**\n * SDK Integration Module\n *\n * Re-exports available SDK integration components.\n *\n * NOTE: Many SDK utilities are planned but not yet implemented.\n * This file will be expanded as new SDK features are added.\n */\n\n// Orchestration runtime API (stable programmatic API + loop policy + generic client)\nexport {\n  createOrchestrator,\n  getRunStatus,\n  cancelRun,\n  getRunArtifacts,\n  type Orchestrator,\n  type OrchestratorConfig,\n  type OrchestratorBackend,\n  type RunHandle,\n  type RunStatus,\n  type RunPhase,\n  type RunArtifacts,\n  type RunProvenance,\n  type OrchestrateTaskInput,\n  type LoopPolicy,\n  type SuccessCriteria,\n  type RetryPolicy,\n  type BudgetLimits,\n  seedMemory,\n  recordLearning,\n  searchMemory,\n  harvestMemory,\n  type MemoryEntry,\n  type MemorySearchResult,\n  type MemorySearchScope,\n  type RunLearning,\n  createOrchestrationClient,\n  type StartRunInput,\n  type ClientRunStatus,\n  type ClientHarvestResult,\n  type RunStatusState,\n  type CancelRunResult,\n  type OrchestrationClient,\n  type CreateOrchestrationClientOptions,\n} from '../orchestration/index.js';\n\n// Security utilities\nexport {\n  validateFilePath,\n  validateReadPath,\n  validateWritePath,\n  type PathValidationOptions,\n} from '../security/path-validator.js';\n\nexport {\n  validateString,\n  validateLanguage,\n  validateRunId,\n  validateMemoryKey,\n  validateMemoryValue,\n  type ValidationOptions,\n} from '../security/input-validation.js';\n\nexport {\n  redactKey,\n  sanitizeEnvironment,\n  type RedactionOptions,\n} from '../security/secret-redaction.js';\n\nexport {\n  RateLimiter,\n  ConcurrencyLimiter,\n  type RateLimitConfig,\n  type RateLimitInfo,\n} from '../security/rate-limiter.js';\n\n// TODO: Implement remaining SDK utilities\n// - hooks-bridge.js (session/tool hooks)\n// - session-manager.js (session tracking)\n// - permission-handler.js (custom permissions)\n// - agent-converter.js (agent format conversion)\n// - e2b-sandbox.js (E2B sandbox integration)\n// - e2b-swarm.js (E2B swarm orchestration)\n// - e2b-swarm-optimizer.js (swarm optimization)\n// - query-control.js (query management)\n// - plugins.js (plugin system)\n// - streaming-input.js (streaming utilities)\n"]}

package/dist/agentic-flow/src/security/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Security Module Index
+ * Centralized security utilities for agentic-flow v3
+ */
+export * from './path-validator.js';
+export * from './input-validation.js';
+export * from './secret-redaction.js';
+export * from './rate-limiter.js';
+export { validateFilePath, validateReadPath, validateWritePath, validateDirPath, PathValidator, } from './path-validator.js';
+export { validateString, validateLanguage, validateRunId, validateMemoryKey, validateTaskDescription, validateNumber, validateArray, validateMetadata, validateProvenance, sanitizeHtml, InputValidator, } from './input-validation.js';
+export { redactKey, redactString, redactObject, sanitizeEnvironment, logEnvStatus, SecretRedactor, } from './secret-redaction.js';
+export { orchestrationLimiter, memoryOperationLimiter, fileOperationLimiter, concurrencyLimiter, RateLimiter, ConcurrencyLimiter, RateLimitError, } from './rate-limiter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/agentic-flow/src/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,aAAa,GACd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,cAAc,GACf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,cAAc,GACf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,cAAc,GACf,MAAM,mBAAmB,CAAC"}

package/dist/agentic-flow/src/security/index.js

@@ -0,0 +1,14 @@
+/**
+ * Security Module Index
+ * Centralized security utilities for agentic-flow v3
+ */
+export * from './path-validator.js';
+export * from './input-validation.js';
+export * from './secret-redaction.js';
+export * from './rate-limiter.js';
+// Re-export commonly used validators
+export { validateFilePath, validateReadPath, validateWritePath, validateDirPath, PathValidator, } from './path-validator.js';
+export { validateString, validateLanguage, validateRunId, validateMemoryKey, validateTaskDescription, validateNumber, validateArray, validateMetadata, validateProvenance, sanitizeHtml, InputValidator, } from './input-validation.js';
+export { redactKey, redactString, redactObject, sanitizeEnvironment, logEnvStatus, SecretRedactor, } from './secret-redaction.js';
+export { orchestrationLimiter, memoryOperationLimiter, fileOperationLimiter, concurrencyLimiter, RateLimiter, ConcurrencyLimiter, RateLimitError, } from './rate-limiter.js';
+//# sourceMappingURL=index.js.map

package/dist/agentic-flow/src/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAElC,qCAAqC;AACrC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,aAAa,GACd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,cAAc,GACf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,cAAc,GACf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,cAAc,GACf,MAAM,mBAAmB,CAAC","sourcesContent":["/**\n * Security Module Index\n * Centralized security utilities for agentic-flow v3\n */\n\nexport * from './path-validator.js';\nexport * from './input-validation.js';\nexport * from './secret-redaction.js';\nexport * from './rate-limiter.js';\n\n// Re-export commonly used validators\nexport {\n  validateFilePath,\n  validateReadPath,\n  validateWritePath,\n  validateDirPath,\n  PathValidator,\n} from './path-validator.js';\n\nexport {\n  validateString,\n  validateLanguage,\n  validateRunId,\n  validateMemoryKey,\n  validateTaskDescription,\n  validateNumber,\n  validateArray,\n  validateMetadata,\n  validateProvenance,\n  sanitizeHtml,\n  InputValidator,\n} from './input-validation.js';\n\nexport {\n  redactKey,\n  redactString,\n  redactObject,\n  sanitizeEnvironment,\n  logEnvStatus,\n  SecretRedactor,\n} from './secret-redaction.js';\n\nexport {\n  orchestrationLimiter,\n  memoryOperationLimiter,\n  fileOperationLimiter,\n  concurrencyLimiter,\n  RateLimiter,\n  ConcurrencyLimiter,\n  RateLimitError,\n} from './rate-limiter.js';\n"]}

package/dist/agentic-flow/src/security/input-validation.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Input Validation Security Module
+ * Centralized validation for all user inputs
+ */
+export interface ValidationOptions {
+    maxLength?: number;
+    minLength?: number;
+    allowEmpty?: boolean;
+    pattern?: RegExp;
+    allowedValues?: string[];
+}
+export declare class InputValidator {
+    /**
+     * Validate string input
+     */
+    validateString(input: string, fieldName: string, options?: ValidationOptions): string;
+    /**
+     * Validate language identifier (for Agent Booster)
+     */
+    validateLanguage(language: string): string;
+    /**
+     * Validate run ID format
+     */
+    validateRunId(runId: string): string;
+    /**
+     * Validate memory key format
+     */
+    validateMemoryKey(key: string): string;
+    /**
+     * Sanitize HTML to prevent XSS
+     */
+    sanitizeHtml(input: string): string;
+    /**
+     * Validate and sanitize memory value
+     */
+    validateMemoryValue(value: any, maxSize?: number): any;
+    /**
+     * Validate task description
+     */
+    validateTaskDescription(description: string): string;
+    /**
+     * Validate number within range
+     */
+    validateNumber(input: number, fieldName: string, min?: number, max?: number): number;
+    /**
+     * Validate array
+     */
+    validateArray<T>(input: T[], fieldName: string, maxLength?: number): T[];
+    /**
+     * Validate metadata object
+     */
+    validateMetadata(metadata: Record<string, any>, maxSize?: number): Record<string, any>;
+    /**
+     * Validate provenance object
+     */
+    validateProvenance(provenance: Record<string, any>): Record<string, any>;
+}
+export declare const inputValidator: InputValidator;
+export declare const validateString: (input: string, fieldName: string, options?: ValidationOptions) => string, validateLanguage: (language: string) => string, validateRunId: (runId: string) => string, validateMemoryKey: (key: string) => string, sanitizeHtml: (input: string) => string, validateMemoryValue: (value: any, maxSize?: number) => any, validateTaskDescription: (description: string) => string, validateNumber: (input: number, fieldName: string, min?: number, max?: number) => number, validateArray: <T>(input: T[], fieldName: string, maxLength?: number) => T[], validateMetadata: (metadata: Record<string, any>, maxSize?: number) => Record<string, any>, validateProvenance: (provenance: Record<string, any>) => Record<string, any>;
+//# sourceMappingURL=input-validation.d.ts.map

package/dist/agentic-flow/src/security/input-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../../src/security/input-validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,qBAAa,cAAc;IACzB;;OAEG;IACH,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,iBAAsB,GAC9B,MAAM;IAyCT;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAwB1C;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAQpC;;OAEG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAQtC;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAInC;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,GAAE,MAAe,GAAG,GAAG;IA4B9D;;OAEG;IACH,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAOpD;;OAEG;IACH,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,GACX,MAAM;IAgBT;;OAEG;IACH,aAAa,CAAC,CAAC,EACb,KAAK,EAAE,CAAC,EAAE,EACV,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,CAAC,EAAE;IAYN;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAE,MAAc,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAqB7F;;OAEG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CAYzE;AAGD,eAAO,MAAM,cAAc,gBAAuB,CAAC;AAGnD,eAAO,MACL,cAAc,UAtOL,MAAM,aACF,MAAM,YACR,iBAAiB,KACzB,MAAM,EAoOT,gBAAgB,aAxLW,MAAM,KAAG,MAAM,EAyL1C,aAAa,UA9JQ,MAAM,KAAG,MAAM,EA+JpC,iBAAiB,QApJM,MAAM,KAAG,MAAM,EAqJtC,YAAY,UA1IQ,MAAM,KAAG,MAAM,EA2InC,mBAAmB,UApIQ,GAAG,YAAW,MAAM,KAAY,GAAG,EAqI9D,uBAAuB,gBAtGc,MAAM,KAAG,MAAM,EAuGpD,cAAc,UA5FL,MAAM,aACF,MAAM,QACX,MAAM,QACN,MAAM,KACX,MAAM,EAyFT,aAAa,GAtEC,CAAC,SACN,CAAC,EAAE,aACC,MAAM,cACL,MAAM,KACjB,CAAC,EAAE,EAmEN,gBAAgB,aApDW,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,YAAW,MAAM,KAAW,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAqD7F,kBAAkB,eA7Ba,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CA8BvD,CAAC"}

package/dist/agentic-flow/src/security/input-validation.js

@@ -0,0 +1,192 @@
+/**
+ * Input Validation Security Module
+ * Centralized validation for all user inputs
+ */
+import validator from 'validator';
+export class InputValidator {
+    /**
+     * Validate string input
+     */
+    validateString(input, fieldName, options = {}) {
+        // Type check
+        if (typeof input !== 'string') {
+            throw new Error(`${fieldName} must be a string`);
+        }
+        // Empty check
+        if (!options.allowEmpty && input.trim().length === 0) {
+            throw new Error(`${fieldName} cannot be empty`);
+        }
+        // Length checks
+        if (options.minLength && input.length < options.minLength) {
+            throw new Error(`${fieldName} must be at least ${options.minLength} characters`);
+        }
+        if (options.maxLength && input.length > options.maxLength) {
+            throw new Error(`${fieldName} exceeds maximum length of ${options.maxLength}`);
+        }
+        // Pattern matching
+        if (options.pattern && !options.pattern.test(input)) {
+            throw new Error(`${fieldName} format is invalid`);
+        }
+        // Allowed values
+        if (options.allowedValues && !options.allowedValues.includes(input)) {
+            throw new Error(`${fieldName} must be one of: ${options.allowedValues.join(', ')}`);
+        }
+        // Remove null bytes
+        if (input.includes('\0') || input.includes('\x00')) {
+            throw new Error(`${fieldName} contains null bytes`);
+        }
+        // Remove control characters (except newline, tab)
+        const sanitized = input.replace(/[\x00-\x08\x0B-\x0C\x0E-\x1F\x7F]/g, '');
+        return sanitized;
+    }
+    /**
+     * Validate language identifier (for Agent Booster)
+     */
+    validateLanguage(language) {
+        const allowedLanguages = [
+            'typescript',
+            'javascript',
+            'python',
+            'rust',
+            'go',
+            'java',
+            'c',
+            'cpp',
+            'csharp',
+            'ruby',
+            'php',
+            'swift',
+            'kotlin',
+            'scala',
+        ];
+        return this.validateString(language, 'language', {
+            allowedValues: allowedLanguages,
+            maxLength: 20,
+        });
+    }
+    /**
+     * Validate run ID format
+     */
+    validateRunId(runId) {
+        return this.validateString(runId, 'runId', {
+            pattern: /^[a-zA-Z0-9_-]+$/,
+            minLength: 1,
+            maxLength: 128,
+        });
+    }
+    /**
+     * Validate memory key format
+     */
+    validateMemoryKey(key) {
+        return this.validateString(key, 'memory key', {
+            pattern: /^[a-zA-Z0-9_-]+$/,
+            minLength: 1,
+            maxLength: 256,
+        });
+    }
+    /**
+     * Sanitize HTML to prevent XSS
+     */
+    sanitizeHtml(input) {
+        return validator.escape(input);
+    }
+    /**
+     * Validate and sanitize memory value
+     */
+    validateMemoryValue(value, maxSize = 100000) {
+        if (typeof value === 'string') {
+            // Remove null bytes and control characters
+            let sanitized = value.replace(/[\x00-\x1F\x7F]/g, '');
+            // Escape HTML for UI safety
+            sanitized = validator.escape(sanitized);
+            // Check size
+            if (sanitized.length > maxSize) {
+                throw new Error(`Memory value exceeds maximum size of ${maxSize} bytes`);
+            }
+            return sanitized;
+        }
+        // For objects, check JSON size
+        if (typeof value === 'object') {
+            const jsonStr = JSON.stringify(value);
+            if (jsonStr.length > maxSize) {
+                throw new Error(`Memory value exceeds maximum size of ${maxSize} bytes`);
+            }
+            return value;
+        }
+        return value;
+    }
+    /**
+     * Validate task description
+     */
+    validateTaskDescription(description) {
+        return this.validateString(description, 'task description', {
+            minLength: 1,
+            maxLength: 10000,
+        });
+    }
+    /**
+     * Validate number within range
+     */
+    validateNumber(input, fieldName, min, max) {
+        if (typeof input !== 'number' || isNaN(input)) {
+            throw new Error(`${fieldName} must be a valid number`);
+        }
+        if (min !== undefined && input < min) {
+            throw new Error(`${fieldName} must be at least ${min}`);
+        }
+        if (max !== undefined && input > max) {
+            throw new Error(`${fieldName} must be at most ${max}`);
+        }
+        return input;
+    }
+    /**
+     * Validate array
+     */
+    validateArray(input, fieldName, maxLength) {
+        if (!Array.isArray(input)) {
+            throw new Error(`${fieldName} must be an array`);
+        }
+        if (maxLength && input.length > maxLength) {
+            throw new Error(`${fieldName} exceeds maximum length of ${maxLength}`);
+        }
+        return input;
+    }
+    /**
+     * Validate metadata object
+     */
+    validateMetadata(metadata, maxSize = 10000) {
+        if (typeof metadata !== 'object' || metadata === null || Array.isArray(metadata)) {
+            throw new Error('Metadata must be a plain object');
+        }
+        const jsonStr = JSON.stringify(metadata);
+        if (jsonStr.length > maxSize) {
+            throw new Error(`Metadata exceeds maximum size of ${maxSize} bytes`);
+        }
+        // Check for suspicious keys
+        const suspiciousKeys = ['__proto__', 'constructor', 'prototype'];
+        for (const key of Object.keys(metadata)) {
+            if (suspiciousKeys.includes(key)) {
+                throw new Error(`Metadata contains forbidden key: ${key}`);
+            }
+        }
+        return metadata;
+    }
+    /**
+     * Validate provenance object
+     */
+    validateProvenance(provenance) {
+        const validated = this.validateMetadata(provenance);
+        // Check for path traversal in values
+        for (const [key, value] of Object.entries(validated)) {
+            if (typeof value === 'string' && (value.includes('..') || value.startsWith('/'))) {
+                throw new Error(`Path traversal detected in provenance.${key}: ${value}`);
+            }
+        }
+        return validated;
+    }
+}
+// Singleton instance
+export const inputValidator = new InputValidator();
+// Convenience exports
+export const { validateString, validateLanguage, validateRunId, validateMemoryKey, sanitizeHtml, validateMemoryValue, validateTaskDescription, validateNumber, validateArray, validateMetadata, validateProvenance, } = inputValidator;
+//# sourceMappingURL=input-validation.js.map

package/dist/agentic-flow/src/security/input-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../../../src/security/input-validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,SAAS,MAAM,WAAW,CAAC;AAUlC,MAAM,OAAO,cAAc;IACzB;;OAEG;IACH,cAAc,CACZ,KAAa,EACb,SAAiB,EACjB,UAA6B,EAAE;QAE/B,aAAa;QACb,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,cAAc;QACd,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,kBAAkB,CAAC,CAAC;QAClD,CAAC;QAED,gBAAgB;QAChB,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,qBAAqB,OAAO,CAAC,SAAS,aAAa,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,8BAA8B,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,mBAAmB;QACnB,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,oBAAoB,CAAC,CAAC;QACpD,CAAC;QAED,iBAAiB;QACjB,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,oBAAoB,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,oBAAoB;QACpB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,kDAAkD;QAClD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;QAE1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,MAAM,gBAAgB,GAAG;YACvB,YAAY;YACZ,YAAY;YACZ,QAAQ;YACR,MAAM;YACN,IAAI;YACJ,MAAM;YACN,GAAG;YACH,KAAK;YACL,QAAQ;YACR,MAAM;YACN,KAAK;YACL,OAAO;YACP,QAAQ;YACR,OAAO;SACR,CAAC;QAEF,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE;YAC/C,aAAa,EAAE,gBAAgB;YAC/B,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAa;QACzB,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE;YACzC,OAAO,EAAE,kBAAkB;YAC3B,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,GAAW;QAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE;YAC5C,OAAO,EAAE,kBAAkB;YAC3B,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,KAAa;QACxB,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,KAAU,EAAE,UAAkB,MAAM;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,2CAA2C;YAC3C,IAAI,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAEtD,4BAA4B;YAC5B,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAExC,aAAa;YACb,IAAI,SAAS,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,QAAQ,CAAC,CAAC;YAC3E,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,+BAA+B;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,QAAQ,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,WAAmB;QACzC,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,kBAAkB,EAAE;YAC1D,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,KAAa,EACb,SAAiB,EACjB,GAAY,EACZ,GAAY;QAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,qBAAqB,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,oBAAoB,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,aAAa,CACX,KAAU,EACV,SAAiB,EACjB,SAAkB;QAElB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,8BAA8B,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAA6B,EAAE,UAAkB,KAAK;QACrE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,QAAQ,CAAC,CAAC;QACvE,CAAC;QAED,4BAA4B;QAC5B,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;QACjE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,UAA+B;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAEpD,qCAAqC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,qBAAqB;AACrB,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;AAEnD,sBAAsB;AACtB,MAAM,CAAC,MAAM,EACX,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,kBAAkB,GACnB,GAAG,cAAc,CAAC","sourcesContent":["/**\n * Input Validation Security Module\n * Centralized validation for all user inputs\n */\n\nimport validator from 'validator';\n\nexport interface ValidationOptions {\n  maxLength?: number;\n  minLength?: number;\n  allowEmpty?: boolean;\n  pattern?: RegExp;\n  allowedValues?: string[];\n}\n\nexport class InputValidator {\n  /**\n   * Validate string input\n   */\n  validateString(\n    input: string,\n    fieldName: string,\n    options: ValidationOptions = {}\n  ): string {\n    // Type check\n    if (typeof input !== 'string') {\n      throw new Error(`${fieldName} must be a string`);\n    }\n\n    // Empty check\n    if (!options.allowEmpty && input.trim().length === 0) {\n      throw new Error(`${fieldName} cannot be empty`);\n    }\n\n    // Length checks\n    if (options.minLength && input.length < options.minLength) {\n      throw new Error(`${fieldName} must be at least ${options.minLength} characters`);\n    }\n\n    if (options.maxLength && input.length > options.maxLength) {\n      throw new Error(`${fieldName} exceeds maximum length of ${options.maxLength}`);\n    }\n\n    // Pattern matching\n    if (options.pattern && !options.pattern.test(input)) {\n      throw new Error(`${fieldName} format is invalid`);\n    }\n\n    // Allowed values\n    if (options.allowedValues && !options.allowedValues.includes(input)) {\n      throw new Error(`${fieldName} must be one of: ${options.allowedValues.join(', ')}`);\n    }\n\n    // Remove null bytes\n    if (input.includes('\\0') || input.includes('\\x00')) {\n      throw new Error(`${fieldName} contains null bytes`);\n    }\n\n    // Remove control characters (except newline, tab)\n    const sanitized = input.replace(/[\\x00-\\x08\\x0B-\\x0C\\x0E-\\x1F\\x7F]/g, '');\n\n    return sanitized;\n  }\n\n  /**\n   * Validate language identifier (for Agent Booster)\n   */\n  validateLanguage(language: string): string {\n    const allowedLanguages = [\n      'typescript',\n      'javascript',\n      'python',\n      'rust',\n      'go',\n      'java',\n      'c',\n      'cpp',\n      'csharp',\n      'ruby',\n      'php',\n      'swift',\n      'kotlin',\n      'scala',\n    ];\n\n    return this.validateString(language, 'language', {\n      allowedValues: allowedLanguages,\n      maxLength: 20,\n    });\n  }\n\n  /**\n   * Validate run ID format\n   */\n  validateRunId(runId: string): string {\n    return this.validateString(runId, 'runId', {\n      pattern: /^[a-zA-Z0-9_-]+$/,\n      minLength: 1,\n      maxLength: 128,\n    });\n  }\n\n  /**\n   * Validate memory key format\n   */\n  validateMemoryKey(key: string): string {\n    return this.validateString(key, 'memory key', {\n      pattern: /^[a-zA-Z0-9_-]+$/,\n      minLength: 1,\n      maxLength: 256,\n    });\n  }\n\n  /**\n   * Sanitize HTML to prevent XSS\n   */\n  sanitizeHtml(input: string): string {\n    return validator.escape(input);\n  }\n\n  /**\n   * Validate and sanitize memory value\n   */\n  validateMemoryValue(value: any, maxSize: number = 100000): any {\n    if (typeof value === 'string') {\n      // Remove null bytes and control characters\n      let sanitized = value.replace(/[\\x00-\\x1F\\x7F]/g, '');\n\n      // Escape HTML for UI safety\n      sanitized = validator.escape(sanitized);\n\n      // Check size\n      if (sanitized.length > maxSize) {\n        throw new Error(`Memory value exceeds maximum size of ${maxSize} bytes`);\n      }\n\n      return sanitized;\n    }\n\n    // For objects, check JSON size\n    if (typeof value === 'object') {\n      const jsonStr = JSON.stringify(value);\n      if (jsonStr.length > maxSize) {\n        throw new Error(`Memory value exceeds maximum size of ${maxSize} bytes`);\n      }\n      return value;\n    }\n\n    return value;\n  }\n\n  /**\n   * Validate task description\n   */\n  validateTaskDescription(description: string): string {\n    return this.validateString(description, 'task description', {\n      minLength: 1,\n      maxLength: 10000,\n    });\n  }\n\n  /**\n   * Validate number within range\n   */\n  validateNumber(\n    input: number,\n    fieldName: string,\n    min?: number,\n    max?: number\n  ): number {\n    if (typeof input !== 'number' || isNaN(input)) {\n      throw new Error(`${fieldName} must be a valid number`);\n    }\n\n    if (min !== undefined && input < min) {\n      throw new Error(`${fieldName} must be at least ${min}`);\n    }\n\n    if (max !== undefined && input > max) {\n      throw new Error(`${fieldName} must be at most ${max}`);\n    }\n\n    return input;\n  }\n\n  /**\n   * Validate array\n   */\n  validateArray<T>(\n    input: T[],\n    fieldName: string,\n    maxLength?: number\n  ): T[] {\n    if (!Array.isArray(input)) {\n      throw new Error(`${fieldName} must be an array`);\n    }\n\n    if (maxLength && input.length > maxLength) {\n      throw new Error(`${fieldName} exceeds maximum length of ${maxLength}`);\n    }\n\n    return input;\n  }\n\n  /**\n   * Validate metadata object\n   */\n  validateMetadata(metadata: Record<string, any>, maxSize: number = 10000): Record<string, any> {\n    if (typeof metadata !== 'object' || metadata === null || Array.isArray(metadata)) {\n      throw new Error('Metadata must be a plain object');\n    }\n\n    const jsonStr = JSON.stringify(metadata);\n    if (jsonStr.length > maxSize) {\n      throw new Error(`Metadata exceeds maximum size of ${maxSize} bytes`);\n    }\n\n    // Check for suspicious keys\n    const suspiciousKeys = ['__proto__', 'constructor', 'prototype'];\n    for (const key of Object.keys(metadata)) {\n      if (suspiciousKeys.includes(key)) {\n        throw new Error(`Metadata contains forbidden key: ${key}`);\n      }\n    }\n\n    return metadata;\n  }\n\n  /**\n   * Validate provenance object\n   */\n  validateProvenance(provenance: Record<string, any>): Record<string, any> {\n    const validated = this.validateMetadata(provenance);\n\n    // Check for path traversal in values\n    for (const [key, value] of Object.entries(validated)) {\n      if (typeof value === 'string' && (value.includes('..') || value.startsWith('/'))) {\n        throw new Error(`Path traversal detected in provenance.${key}: ${value}`);\n      }\n    }\n\n    return validated;\n  }\n}\n\n// Singleton instance\nexport const inputValidator = new InputValidator();\n\n// Convenience exports\nexport const {\n  validateString,\n  validateLanguage,\n  validateRunId,\n  validateMemoryKey,\n  sanitizeHtml,\n  validateMemoryValue,\n  validateTaskDescription,\n  validateNumber,\n  validateArray,\n  validateMetadata,\n  validateProvenance,\n} = inputValidator;\n"]}

package/dist/agentic-flow/src/security/path-validator.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Path Validation Security Module
+ * Prevents path traversal attacks (CVE-2026-004)
+ */
+export interface PathValidationOptions {
+    allowedDir?: string;
+    blockedPaths?: string[];
+    allowAbsolute?: boolean;
+    mustExist?: boolean;
+    mustBeFile?: boolean;
+    mustBeDirectory?: boolean;
+}
+export declare class PathValidator {
+    private allowedDir;
+    private blockedPaths;
+    constructor(allowedDir?: string, blockedPaths?: string[]);
+    /**
+     * Validate a file path against traversal and sensitive path attacks
+     */
+    validate(filePath: string, options?: PathValidationOptions): string;
+    /**
+     * Validate multiple paths at once
+     */
+    validateMany(paths: string[], options?: PathValidationOptions): string[];
+    /**
+     * Check if a path is safe without throwing
+     */
+    isSafe(filePath: string, options?: PathValidationOptions): boolean;
+}
+export declare const pathValidator: PathValidator;
+/**
+ * Quick validation helper
+ */
+export declare function validateFilePath(filePath: string, allowedDir?: string, options?: PathValidationOptions): string;
+/**
+ * Validate path is safe to read
+ */
+export declare function validateReadPath(filePath: string, allowedDir?: string): string;
+/**
+ * Validate path is safe to write
+ */
+export declare function validateWritePath(filePath: string, allowedDir?: string): string;
+/**
+ * Validate directory path
+ */
+export declare function validateDirPath(filePath: string, allowedDir?: string): string;
+//# sourceMappingURL=path-validator.d.ts.map

package/dist/agentic-flow/src/security/path-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-validator.d.ts","sourceRoot":"","sources":["../../../../src/security/path-validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAqBD,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,YAAY,CAAW;gBAEnB,UAAU,GAAE,MAAsB,EAAE,YAAY,GAAE,MAAM,EAA0B;IAK9F;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM;IAqEvE;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,EAAE;IAI5E;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO;CAQvE;AAGD,eAAO,MAAM,aAAa,eAAsB,CAAC;AAEjD;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,MAAsB,EAClC,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAGR;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAK7E"}

package/dist/agentic-flow/src/security/path-validator.js

@@ -0,0 +1,144 @@
+/**
+ * Path Validation Security Module
+ * Prevents path traversal attacks (CVE-2026-004)
+ */
+import { resolve, relative, isAbsolute, normalize } from 'path';
+import { existsSync, statSync } from 'fs';
+const DEFAULT_BLOCKED_PATHS = [
+    '/etc/',
+    '/sys/',
+    '/proc/',
+    '/dev/',
+    '/root/',
+    '.env',
+    '.git/',
+    'node_modules/',
+    '.ssh/',
+    '.aws/',
+    '.config/',
+    'id_rsa',
+    'id_ed25519',
+    'credentials',
+    'secret',
+    'private',
+];
+export class PathValidator {
+    allowedDir;
+    blockedPaths;
+    constructor(allowedDir = process.cwd(), blockedPaths = DEFAULT_BLOCKED_PATHS) {
+        this.allowedDir = resolve(allowedDir);
+        this.blockedPaths = [...blockedPaths];
+    }
+    /**
+     * Validate a file path against traversal and sensitive path attacks
+     */
+    validate(filePath, options = {}) {
+        // 1. Basic validation
+        if (!filePath || typeof filePath !== 'string') {
+            throw new Error('Invalid file path: must be a non-empty string');
+        }
+        if (filePath.length > 4096) {
+            throw new Error('File path too long (max 4096 characters)');
+        }
+        // 2. Normalize and resolve path
+        const normalizedPath = normalize(filePath);
+        const resolvedPath = resolve(normalizedPath);
+        // 3. Check for null bytes (common attack vector)
+        if (filePath.includes('\0') || filePath.includes('\x00')) {
+            throw new Error('Path contains null bytes');
+        }
+        // 4. Check for path traversal patterns
+        if (filePath.includes('..') && !options.allowAbsolute) {
+            // Additional check: ensure resolved path doesn't escape allowed dir
+            const allowedDirResolved = resolve(options.allowedDir || this.allowedDir);
+            const relativePath = relative(allowedDirResolved, resolvedPath);
+            if (relativePath.startsWith('..') || isAbsolute(relativePath)) {
+                throw new Error(`Path traversal detected: ${filePath}`);
+            }
+        }
+        // 5. Check if path is within allowed directory
+        if (!options.allowAbsolute) {
+            const allowedDirResolved = resolve(options.allowedDir || this.allowedDir);
+            const relativePath = relative(allowedDirResolved, resolvedPath);
+            if (relativePath.startsWith('..') || isAbsolute(relativePath)) {
+                throw new Error(`Path outside allowed directory: ${filePath}`);
+            }
+        }
+        // 6. Check against blocked paths
+        const blockedPaths = options.blockedPaths || this.blockedPaths;
+        for (const blocked of blockedPaths) {
+            if (resolvedPath.toLowerCase().includes(blocked.toLowerCase())) {
+                throw new Error(`Access to blocked path: ${blocked}`);
+            }
+        }
+        // 7. Existence checks
+        if (options.mustExist && !existsSync(resolvedPath)) {
+            throw new Error(`Path does not exist: ${filePath}`);
+        }
+        // 8. Type checks
+        if (existsSync(resolvedPath)) {
+            const stats = statSync(resolvedPath);
+            if (options.mustBeFile && !stats.isFile()) {
+                throw new Error(`Path is not a file: ${filePath}`);
+            }
+            if (options.mustBeDirectory && !stats.isDirectory()) {
+                throw new Error(`Path is not a directory: ${filePath}`);
+            }
+        }
+        return resolvedPath;
+    }
+    /**
+     * Validate multiple paths at once
+     */
+    validateMany(paths, options = {}) {
+        return paths.map(path => this.validate(path, options));
+    }
+    /**
+     * Check if a path is safe without throwing
+     */
+    isSafe(filePath, options = {}) {
+        try {
+            this.validate(filePath, options);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+// Singleton instance for convenience
+export const pathValidator = new PathValidator();
+/**
+ * Quick validation helper
+ */
+export function validateFilePath(filePath, allowedDir = process.cwd(), options = {}) {
+    const validator = new PathValidator(allowedDir);
+    return validator.validate(filePath, options);
+}
+/**
+ * Validate path is safe to read
+ */
+export function validateReadPath(filePath, allowedDir) {
+    return validateFilePath(filePath, allowedDir, {
+        mustExist: true,
+        mustBeFile: true,
+    });
+}
+/**
+ * Validate path is safe to write
+ */
+export function validateWritePath(filePath, allowedDir) {
+    return validateFilePath(filePath, allowedDir, {
+        mustBeFile: false, // File may not exist yet
+    });
+}
+/**
+ * Validate directory path
+ */
+export function validateDirPath(filePath, allowedDir) {
+    return validateFilePath(filePath, allowedDir, {
+        mustExist: true,
+        mustBeDirectory: true,
+    });
+}
+//# sourceMappingURL=path-validator.js.map

package/dist/agentic-flow/src/security/path-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-validator.js","sourceRoot":"","sources":["../../../../src/security/path-validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAW1C,MAAM,qBAAqB,GAAG;IAC5B,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,eAAe;IACf,OAAO;IACP,OAAO;IACP,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,MAAM,OAAO,aAAa;IAChB,UAAU,CAAS;IACnB,YAAY,CAAW;IAE/B,YAAY,aAAqB,OAAO,CAAC,GAAG,EAAE,EAAE,eAAyB,qBAAqB;QAC5F,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB,EAAE,UAAiC,EAAE;QAC5D,sBAAsB;QACtB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QAE7C,iDAAiD;QACjD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,uCAAuC;QACvC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,oEAAoE;YACpE,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;YAEhE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;YAEhE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;QAC/D,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,iBAAiB;QACjB,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YAErC,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC;YAED,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,KAAe,EAAE,UAAiC,EAAE;QAC/D,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAgB,EAAE,UAAiC,EAAE;QAC1D,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,qCAAqC;AACrC,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;AAEjD;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,aAAqB,OAAO,CAAC,GAAG,EAAE,EAClC,UAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,UAAmB;IACpE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE;QAC5C,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,UAAmB;IACrE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE;QAC5C,UAAU,EAAE,KAAK,EAAE,yBAAyB;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,UAAmB;IACnE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE;QAC5C,SAAS,EAAE,IAAI;QACf,eAAe,EAAE,IAAI;KACtB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Path Validation Security Module\n * Prevents path traversal attacks (CVE-2026-004)\n */\n\nimport { resolve, relative, isAbsolute, normalize } from 'path';\nimport { existsSync, statSync } from 'fs';\n\nexport interface PathValidationOptions {\n  allowedDir?: string;\n  blockedPaths?: string[];\n  allowAbsolute?: boolean;\n  mustExist?: boolean;\n  mustBeFile?: boolean;\n  mustBeDirectory?: boolean;\n}\n\nconst DEFAULT_BLOCKED_PATHS = [\n  '/etc/',\n  '/sys/',\n  '/proc/',\n  '/dev/',\n  '/root/',\n  '.env',\n  '.git/',\n  'node_modules/',\n  '.ssh/',\n  '.aws/',\n  '.config/',\n  'id_rsa',\n  'id_ed25519',\n  'credentials',\n  'secret',\n  'private',\n];\n\nexport class PathValidator {\n  private allowedDir: string;\n  private blockedPaths: string[];\n\n  constructor(allowedDir: string = process.cwd(), blockedPaths: string[] = DEFAULT_BLOCKED_PATHS) {\n    this.allowedDir = resolve(allowedDir);\n    this.blockedPaths = [...blockedPaths];\n  }\n\n  /**\n   * Validate a file path against traversal and sensitive path attacks\n   */\n  validate(filePath: string, options: PathValidationOptions = {}): string {\n    // 1. Basic validation\n    if (!filePath || typeof filePath !== 'string') {\n      throw new Error('Invalid file path: must be a non-empty string');\n    }\n\n    if (filePath.length > 4096) {\n      throw new Error('File path too long (max 4096 characters)');\n    }\n\n    // 2. Normalize and resolve path\n    const normalizedPath = normalize(filePath);\n    const resolvedPath = resolve(normalizedPath);\n\n    // 3. Check for null bytes (common attack vector)\n    if (filePath.includes('\\0') || filePath.includes('\\x00')) {\n      throw new Error('Path contains null bytes');\n    }\n\n    // 4. Check for path traversal patterns\n    if (filePath.includes('..') && !options.allowAbsolute) {\n      // Additional check: ensure resolved path doesn't escape allowed dir\n      const allowedDirResolved = resolve(options.allowedDir || this.allowedDir);\n      const relativePath = relative(allowedDirResolved, resolvedPath);\n\n      if (relativePath.startsWith('..') || isAbsolute(relativePath)) {\n        throw new Error(`Path traversal detected: ${filePath}`);\n      }\n    }\n\n    // 5. Check if path is within allowed directory\n    if (!options.allowAbsolute) {\n      const allowedDirResolved = resolve(options.allowedDir || this.allowedDir);\n      const relativePath = relative(allowedDirResolved, resolvedPath);\n\n      if (relativePath.startsWith('..') || isAbsolute(relativePath)) {\n        throw new Error(`Path outside allowed directory: ${filePath}`);\n      }\n    }\n\n    // 6. Check against blocked paths\n    const blockedPaths = options.blockedPaths || this.blockedPaths;\n    for (const blocked of blockedPaths) {\n      if (resolvedPath.toLowerCase().includes(blocked.toLowerCase())) {\n        throw new Error(`Access to blocked path: ${blocked}`);\n      }\n    }\n\n    // 7. Existence checks\n    if (options.mustExist && !existsSync(resolvedPath)) {\n      throw new Error(`Path does not exist: ${filePath}`);\n    }\n\n    // 8. Type checks\n    if (existsSync(resolvedPath)) {\n      const stats = statSync(resolvedPath);\n\n      if (options.mustBeFile && !stats.isFile()) {\n        throw new Error(`Path is not a file: ${filePath}`);\n      }\n\n      if (options.mustBeDirectory && !stats.isDirectory()) {\n        throw new Error(`Path is not a directory: ${filePath}`);\n      }\n    }\n\n    return resolvedPath;\n  }\n\n  /**\n   * Validate multiple paths at once\n   */\n  validateMany(paths: string[], options: PathValidationOptions = {}): string[] {\n    return paths.map(path => this.validate(path, options));\n  }\n\n  /**\n   * Check if a path is safe without throwing\n   */\n  isSafe(filePath: string, options: PathValidationOptions = {}): boolean {\n    try {\n      this.validate(filePath, options);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n\n// Singleton instance for convenience\nexport const pathValidator = new PathValidator();\n\n/**\n * Quick validation helper\n */\nexport function validateFilePath(\n  filePath: string,\n  allowedDir: string = process.cwd(),\n  options: PathValidationOptions = {}\n): string {\n  const validator = new PathValidator(allowedDir);\n  return validator.validate(filePath, options);\n}\n\n/**\n * Validate path is safe to read\n */\nexport function validateReadPath(filePath: string, allowedDir?: string): string {\n  return validateFilePath(filePath, allowedDir, {\n    mustExist: true,\n    mustBeFile: true,\n  });\n}\n\n/**\n * Validate path is safe to write\n */\nexport function validateWritePath(filePath: string, allowedDir?: string): string {\n  return validateFilePath(filePath, allowedDir, {\n    mustBeFile: false, // File may not exist yet\n  });\n}\n\n/**\n * Validate directory path\n */\nexport function validateDirPath(filePath: string, allowedDir?: string): string {\n  return validateFilePath(filePath, allowedDir, {\n    mustExist: true,\n    mustBeDirectory: true,\n  });\n}\n"]}

package/dist/agentic-flow/src/security/rate-limiter.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Rate Limiting Security Module
+ * Prevents DoS attacks (VUL-010)
+ */
+export interface RateLimitConfig {
+    maxRequests: number;
+    windowMs: number;
+    keyGenerator?: (context: any) => string;
+}
+export interface RateLimitInfo {
+    remaining: number;
+    resetTime: number;
+    retryAfter?: number;
+}
+export declare class RateLimiter {
+    private requests;
+    private config;
+    constructor(config: RateLimitConfig);
+    /**
+     * Check if request should be allowed
+     */
+    consume(key?: string): Promise<RateLimitInfo>;
+    /**
+     * Get current limit status without consuming
+     */
+    getStatus(key?: string): RateLimitInfo;
+    /**
+     * Reset limit for a specific key
+     */
+    reset(key?: string): void;
+    /**
+     * Cleanup expired entries
+     */
+    private cleanup;
+}
+export declare class RateLimitError extends Error {
+    info: RateLimitInfo;
+    constructor(message: string, info: RateLimitInfo);
+}
+export declare const orchestrationLimiter: RateLimiter;
+export declare const memoryOperationLimiter: RateLimiter;
+export declare const fileOperationLimiter: RateLimiter;
+/**
+ * Max concurrent runs tracker
+ */
+export declare class ConcurrencyLimiter {
+    private activeRuns;
+    private maxConcurrent;
+    constructor(maxConcurrent?: number);
+    /**
+     * Acquire a run slot
+     */
+    acquire(runId: string): void;
+    /**
+     * Release a run slot
+     */
+    release(runId: string): void;
+    /**
+     * Get current status
+     */
+    getStatus(): {
+        active: number;
+        available: number;
+        max: number;
+    };
+}
+export declare const concurrencyLimiter: ConcurrencyLimiter;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/agentic-flow/src/security/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../../src/security/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,MAAM,CAAkB;gBAEpB,MAAM,EAAE,eAAe;IAOnC;;OAEG;IACG,OAAO,CAAC,GAAG,GAAE,MAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IAmC9D;;OAEG;IACH,SAAS,CAAC,GAAG,GAAE,MAAkB,GAAG,aAAa;IAcjD;;OAEG;IACH,KAAK,CAAC,GAAG,GAAE,MAAkB,GAAG,IAAI;IAIpC;;OAEG;IACH,OAAO,CAAC,OAAO;CAchB;AAED,qBAAa,cAAe,SAAQ,KAAK;IAG9B,IAAI,EAAE,aAAa;gBAD1B,OAAO,EAAE,MAAM,EACR,IAAI,EAAE,aAAa;CAK7B;AAGD,eAAO,MAAM,oBAAoB,aAG/B,CAAC;AAEH,eAAO,MAAM,sBAAsB,aAGjC,CAAC;AAEH,eAAO,MAAM,oBAAoB,aAG/B,CAAC;AAEH;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,UAAU,CAA0B;IAC5C,OAAO,CAAC,aAAa,CAAS;gBAElB,aAAa,GAAE,MAAY;IAIvC;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAU5B;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B;;OAEG;IACH,SAAS,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;CAOhE;AAED,eAAO,MAAM,kBAAkB,oBAA8B,CAAC"}