agentic-flow 3.0.0-alpha.1 → 3.0.0

package/dist/mcp/fastmcp/auth/http-auth.d.ts

@@ -0,0 +1,23 @@
+import type { IncomingMessage } from 'http';
+export declare const DEFAULT_MCP_HTTP_HOST = "127.0.0.1";
+export declare const DEFAULT_MCP_HTTP_PORT = 8080;
+export interface McpHttpAuthConfig {
+    host: string;
+    token: string;
+    /** True when no AGENTIC_FLOW_MCP_TOKEN was set and a token was generated. */
+    generated: boolean;
+    /** Browser origins allowed to open a session. Empty means none. */
+    allowedOrigins: Set<string>;
+}
+export declare function parseAllowedOrigins(raw: string | undefined): Set<string>;
+/**
+ * Read AGENTIC_FLOW_MCP_HOST, AGENTIC_FLOW_MCP_TOKEN and
+ * AGENTIC_FLOW_MCP_ALLOWED_ORIGINS, generating a token when none is set.
+ */
+export declare function resolveMcpHttpAuth(env?: NodeJS.ProcessEnv): McpHttpAuthConfig;
+export type McpHttpSession = {
+    authenticated: true;
+};
+/** Build fastmcp's `authenticate` hook: origin allowlist, then bearer token. */
+export declare function createMcpHttpAuthenticate(config: Pick<McpHttpAuthConfig, 'token' | 'allowedOrigins'>): (req: IncomingMessage) => Promise<McpHttpSession>;
+//# sourceMappingURL=http-auth.d.ts.map

package/dist/mcp/fastmcp/auth/http-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth.d.ts","sourceRoot":"","sources":["../../../../src/mcp/fastmcp/auth/http-auth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAE5C,eAAO,MAAM,qBAAqB,cAAc,CAAC;AACjD,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,SAAS,EAAE,OAAO,CAAC;IACnB,mEAAmE;IACnE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B;AAYD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAOxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,iBAAiB,CAQ1F;AAuBD,MAAM,MAAM,cAAc,GAAG;IAAE,aAAa,EAAE,IAAI,CAAA;CAAE,CAAC;AAErD,gFAAgF;AAChF,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC,GAC1D,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,CAAC,CAenD"}

package/dist/mcp/fastmcp/auth/http-auth.js

@@ -0,0 +1,80 @@
+// Access control for the HTTP/SSE MCP server.
+//
+// fastmcp 3.x has no CORS option, and the mcp-proxy HTTP server under it
+// reflects any Origin with Access-Control-Allow-Credentials. Those headers
+// cannot be turned off at this version, so the origin allowlist is enforced
+// here, in `authenticate`, which runs before a session is created (the
+// initialize POST on /mcp and the GET on /sse). Requests carrying a session id
+// are bound to a session that already passed this check.
+import { randomBytes, timingSafeEqual } from 'crypto';
+export const DEFAULT_MCP_HTTP_HOST = '127.0.0.1';
+export const DEFAULT_MCP_HTTP_PORT = 8080;
+/** Normalise `https://Example.com:443/` style entries to `https://example.com`. */
+function toOrigin(value) {
+    try {
+        const origin = new URL(value.trim()).origin;
+        return origin === 'null' ? undefined : origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function parseAllowedOrigins(raw) {
+    const origins = new Set();
+    for (const entry of (raw ?? '').split(',')) {
+        const origin = entry.trim() ? toOrigin(entry) : undefined;
+        if (origin)
+            origins.add(origin);
+    }
+    return origins;
+}
+/**
+ * Read AGENTIC_FLOW_MCP_HOST, AGENTIC_FLOW_MCP_TOKEN and
+ * AGENTIC_FLOW_MCP_ALLOWED_ORIGINS, generating a token when none is set.
+ */
+export function resolveMcpHttpAuth(env = process.env) {
+    const fromEnv = env.AGENTIC_FLOW_MCP_TOKEN?.trim();
+    return {
+        host: env.AGENTIC_FLOW_MCP_HOST?.trim() || DEFAULT_MCP_HTTP_HOST,
+        token: fromEnv || randomBytes(32).toString('hex'),
+        generated: !fromEnv,
+        allowedOrigins: parseAllowedOrigins(env.AGENTIC_FLOW_MCP_ALLOWED_ORIGINS),
+    };
+}
+function presentedToken(req) {
+    const auth = req.headers.authorization;
+    if (typeof auth === 'string') {
+        const match = /^Bearer\s+(.+)$/i.exec(auth.trim());
+        if (match)
+            return match[1].trim();
+    }
+    const apiKey = req.headers['x-api-key'];
+    return typeof apiKey === 'string' && apiKey ? apiKey : undefined;
+}
+function sameToken(presented, expected) {
+    const a = Buffer.from(presented);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/** mcp-proxy writes a thrown Response straight back to the client. */
+function reject(status, statusText) {
+    throw new Response(null, { status, statusText });
+}
+/** Build fastmcp's `authenticate` hook: origin allowlist, then bearer token. */
+export function createMcpHttpAuthenticate(config) {
+    return async (req) => {
+        const origin = req.headers.origin;
+        if (origin !== undefined) {
+            const normalised = typeof origin === 'string' ? toOrigin(origin) : undefined;
+            if (!normalised || !config.allowedOrigins.has(normalised)) {
+                reject(403, 'Origin not allowed');
+            }
+        }
+        const token = presentedToken(req);
+        if (!token || !sameToken(token, config.token)) {
+            reject(401, 'Unauthorized');
+        }
+        return { authenticated: true };
+    };
+}
+//# sourceMappingURL=http-auth.js.map

package/dist/mcp/fastmcp/auth/http-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth.js","sourceRoot":"","sources":["../../../../src/mcp/fastmcp/auth/http-auth.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,+EAA+E;AAC/E,yDAAyD;AACzD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAGtD,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAW1C,mFAAmF;AACnF,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC5C,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,IAAI,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,qBAAqB;QAChE,KAAK,EAAE,OAAO,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACjD,SAAS,EAAE,CAAC,OAAO;QACnB,cAAc,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB,EAAE,QAAgB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,sEAAsE;AACtE,SAAS,MAAM,CAAC,MAAiB,EAAE,UAAkB;IACnD,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AACnD,CAAC;AAID,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CACvC,MAA2D;IAE3D,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// Access control for the HTTP/SSE MCP server.\n//\n// fastmcp 3.x has no CORS option, and the mcp-proxy HTTP server under it\n// reflects any Origin with Access-Control-Allow-Credentials. Those headers\n// cannot be turned off at this version, so the origin allowlist is enforced\n// here, in `authenticate`, which runs before a session is created (the\n// initialize POST on /mcp and the GET on /sse). Requests carrying a session id\n// are bound to a session that already passed this check.\nimport { randomBytes, timingSafeEqual } from 'crypto';\nimport type { IncomingMessage } from 'http';\n\nexport const DEFAULT_MCP_HTTP_HOST = '127.0.0.1';\nexport const DEFAULT_MCP_HTTP_PORT = 8080;\n\nexport interface McpHttpAuthConfig {\n  host: string;\n  token: string;\n  /** True when no AGENTIC_FLOW_MCP_TOKEN was set and a token was generated. */\n  generated: boolean;\n  /** Browser origins allowed to open a session. Empty means none. */\n  allowedOrigins: Set<string>;\n}\n\n/** Normalise `https://Example.com:443/` style entries to `https://example.com`. */\nfunction toOrigin(value: string): string | undefined {\n  try {\n    const origin = new URL(value.trim()).origin;\n    return origin === 'null' ? undefined : origin;\n  } catch {\n    return undefined;\n  }\n}\n\nexport function parseAllowedOrigins(raw: string | undefined): Set<string> {\n  const origins = new Set<string>();\n  for (const entry of (raw ?? '').split(',')) {\n    const origin = entry.trim() ? toOrigin(entry) : undefined;\n    if (origin) origins.add(origin);\n  }\n  return origins;\n}\n\n/**\n * Read AGENTIC_FLOW_MCP_HOST, AGENTIC_FLOW_MCP_TOKEN and\n * AGENTIC_FLOW_MCP_ALLOWED_ORIGINS, generating a token when none is set.\n */\nexport function resolveMcpHttpAuth(env: NodeJS.ProcessEnv = process.env): McpHttpAuthConfig {\n  const fromEnv = env.AGENTIC_FLOW_MCP_TOKEN?.trim();\n  return {\n    host: env.AGENTIC_FLOW_MCP_HOST?.trim() || DEFAULT_MCP_HTTP_HOST,\n    token: fromEnv || randomBytes(32).toString('hex'),\n    generated: !fromEnv,\n    allowedOrigins: parseAllowedOrigins(env.AGENTIC_FLOW_MCP_ALLOWED_ORIGINS),\n  };\n}\n\nfunction presentedToken(req: IncomingMessage): string | undefined {\n  const auth = req.headers.authorization;\n  if (typeof auth === 'string') {\n    const match = /^Bearer\\s+(.+)$/i.exec(auth.trim());\n    if (match) return match[1].trim();\n  }\n  const apiKey = req.headers['x-api-key'];\n  return typeof apiKey === 'string' && apiKey ? apiKey : undefined;\n}\n\nfunction sameToken(presented: string, expected: string): boolean {\n  const a = Buffer.from(presented);\n  const b = Buffer.from(expected);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\n/** mcp-proxy writes a thrown Response straight back to the client. */\nfunction reject(status: 401 | 403, statusText: string): never {\n  throw new Response(null, { status, statusText });\n}\n\nexport type McpHttpSession = { authenticated: true };\n\n/** Build fastmcp's `authenticate` hook: origin allowlist, then bearer token. */\nexport function createMcpHttpAuthenticate(\n  config: Pick<McpHttpAuthConfig, 'token' | 'allowedOrigins'>,\n): (req: IncomingMessage) => Promise<McpHttpSession> {\n  return async (req) => {\n    const origin = req.headers.origin;\n    if (origin !== undefined) {\n      const normalised = typeof origin === 'string' ? toOrigin(origin) : undefined;\n      if (!normalised || !config.allowedOrigins.has(normalised)) {\n        reject(403, 'Origin not allowed');\n      }\n    }\n    const token = presentedToken(req);\n    if (!token || !sameToken(token, config.token)) {\n      reject(401, 'Unauthorized');\n    }\n    return { authenticated: true };\n  };\n}\n"]}

package/dist/mcp/fastmcp/servers/claude-flow-sdk.js

@@ -1,9 +1,14 @@
 #!/usr/bin/env node
+/* eslint-disable @typescript-eslint/no-explicit-any -- pre-existing catch(error: any) handlers; outside scope of CWE-78 fix */
 // FastMCP implementation of claude-flow-sdk server (in-process, 6 tools)
 // Phase 1: Migration from claudeFlowSdkServer.ts to fastmcp
 import { FastMCP } from 'fastmcp';
 import { z } from 'zod';
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
+// Security: All shell-outs use execFileSync with argv arrays (shell: false) to
+// prevent OS command injection via tool parameters (CWE-78). Do NOT reintroduce
+// execSync with template-string interpolation here.
+const NPX_EXEC_OPTS = { shell: false };
 import { logger } from '../../../utils/logger.js';
 console.error('🚀 Starting FastMCP claude-flow-sdk Server...');
 // Create server
@@ -24,14 +29,10 @@ server.addTool({
     execute: async ({ key, value, namespace, ttl }) => {
         try {
             logger.info('Storing memory', { key, namespace });
-            const cmd = [
-                'npx claude-flow@alpha memory store',
-                `"${key}"`,
-                `"${value}"`,
-                `--namespace "${namespace}"`,
-                ttl ? `--ttl ${ttl}` : ''
-            ].filter(Boolean).join(' ');
-            const result = execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
+            const args = ['claude-flow@alpha', 'memory', 'store', key, value, '--namespace', namespace];
+            if (ttl)
+                args.push('--ttl', String(ttl));
+            execFileSync('npx', args, { ...NPX_EXEC_OPTS, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
             logger.info('Memory stored successfully', { key });
             return JSON.stringify({
                 success: true,
@@ -59,8 +60,7 @@ server.addTool({
     }),
     execute: async ({ key, namespace }) => {
         try {
-            const cmd = `npx claude-flow@alpha memory retrieve "${key}" --namespace "${namespace}"`;
-            const result = execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
+            const result = execFileSync('npx', ['claude-flow@alpha', 'memory', 'retrieve', key, '--namespace', namespace], { ...NPX_EXEC_OPTS, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
             return JSON.stringify({
                 success: true,
                 key,
@@ -85,8 +85,11 @@ server.addTool({
     }),
     execute: async ({ pattern, namespace, limit }) => {
         try {
-            const cmd = `npx claude-flow@alpha memory search "${pattern}"${namespace ? ` --namespace "${namespace}"` : ''} --limit ${limit}`;
-            const result = execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
+            const args = ['claude-flow@alpha', 'memory', 'search', pattern];
+            if (namespace)
+                args.push('--namespace', namespace);
+            args.push('--limit', String(limit));
+            const result = execFileSync('npx', args, { ...NPX_EXEC_OPTS, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
             return JSON.stringify({
                 success: true,
                 pattern,
@@ -112,8 +115,7 @@ server.addTool({
     }),
     execute: async ({ topology, maxAgents, strategy }) => {
         try {
-            const cmd = `npx claude-flow@alpha swarm init --topology ${topology} --max-agents ${maxAgents} --strategy ${strategy}`;
-            const result = execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
+            const result = execFileSync('npx', ['claude-flow@alpha', 'swarm', 'init', '--topology', topology, '--max-agents', String(maxAgents), '--strategy', strategy], { ...NPX_EXEC_OPTS, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
             return JSON.stringify({
                 success: true,
                 topology,
@@ -139,10 +141,12 @@ server.addTool({
     }),
     execute: async ({ type, capabilities, name }) => {
         try {
-            const capStr = capabilities ? ` --capabilities "${capabilities.join(',')}"` : '';
-            const nameStr = name ? ` --name "${name}"` : '';
-            const cmd = `npx claude-flow@alpha agent spawn --type ${type}${capStr}${nameStr}`;
-            const result = execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
+            const args = ['claude-flow@alpha', 'agent', 'spawn', '--type', type];
+            if (capabilities && capabilities.length > 0)
+                args.push('--capabilities', capabilities.join(','));
+            if (name)
+                args.push('--name', name);
+            const result = execFileSync('npx', args, { ...NPX_EXEC_OPTS, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
             return JSON.stringify({
                 success: true,
                 type,
@@ -169,9 +173,10 @@ server.addTool({
     }),
     execute: async ({ task, strategy, priority, maxAgents }) => {
         try {
-            const maxStr = maxAgents ? ` --max-agents ${maxAgents}` : '';
-            const cmd = `npx claude-flow@alpha task orchestrate "${task}" --strategy ${strategy} --priority ${priority}${maxStr}`;
-            const result = execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
+            const args = ['claude-flow@alpha', 'task', 'orchestrate', task, '--strategy', strategy, '--priority', priority];
+            if (maxAgents)
+                args.push('--max-agents', String(maxAgents));
+            const result = execFileSync('npx', args, { ...NPX_EXEC_OPTS, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
             return JSON.stringify({
                 success: true,
                 task,

package/dist/mcp/fastmcp/servers/claude-flow-sdk.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-flow-sdk.js","sourceRoot":"","sources":["../../../../src/mcp/fastmcp/servers/claude-flow-sdk.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,4DAA4D;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;AAE/D,gBAAgB;AAChB,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC;IACzB,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,uBAAuB;AACvB,MAAM,CAAC,OAAO,CAAC;IACb,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,oEAAoE;IACjF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAChF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;KAC1E,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE;QAChD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YAElD,MAAM,GAAG,GAAG;gBACV,oCAAoC;gBACpC,IAAI,GAAG,GAAG;gBACV,IAAI,KAAK,GAAG;gBACZ,gBAAgB,SAAS,GAAG;gBAC5B,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE;aAC1B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE5B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAEjF,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAEnD,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,IAAI;gBACb,GAAG;gBACH,SAAS;gBACT,IAAI,EAAE,KAAK,CAAC,MAAM;gBAClB,GAAG;gBACH,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,OAAO,EAAE,4BAA4B;aACtC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,0BAA0B;AAC1B,MAAM,CAAC,OAAO,CAAC;IACb,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,yCAAyC;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;KACjF,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,0CAA0C,GAAG,kBAAkB,SAAS,GAAG,CAAC;YACxF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAEjF,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,IAAI;gBACb,GAAG;gBACH,SAAS;gBACT,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE;gBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,wBAAwB;AACxB,MAAM,CAAC,OAAO,CAAC;IACb,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,8CAA8C;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QAC1E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC1E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;KAC1F,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,wCAAwC,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,iBAAiB,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,EAAE,CAAC;YACjI,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAEjF,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,IAAI;gBACb,OAAO;gBACP,SAAS,EAAE,SAAS,IAAI,KAAK;gBAC7B,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;gBACtB,KAAK;gBACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,qBAAqB;AACrB,MAAM,CAAC,OAAO,CAAC;IACb,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,wDAAwD;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC3F,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;KACjI,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,+CAA+C,QAAQ,iBAAiB,SAAS,eAAe,QAAQ,EAAE,CAAC;YACvH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAEjF,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,SAAS;gBACT,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,sBAAsB;AACtB,MAAM,CAAC,OAAO,CAAC;IACb,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,gCAAgC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QACnG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAC3E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;KAC1D,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,4CAA4C,IAAI,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;YAClF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAEjF,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,IAAI;gBACb,IAAI;gBACJ,YAAY;gBACZ,IAAI;gBACJ,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,2BAA2B;AAC3B,MAAM,CAAC,OAAO,CAAC;IACb,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,6CAA6C;IAC1D,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QACpE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACtH,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC9G,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;KAC5F,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,2CAA2C,IAAI,gBAAgB,QAAQ,eAAe,QAAQ,GAAG,MAAM,EAAE,CAAC;YACtH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAEjF,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,IAAI;gBACb,IAAI;gBACJ,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,OAAO,CAAC,KAAK,CAAC,gHAAgH,CAAC,CAAC;AAChI,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEhD,6BAA6B;AAC7B,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;IACjD,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\n// FastMCP implementation of claude-flow-sdk server (in-process, 6 tools)\n// Phase 1: Migration from claudeFlowSdkServer.ts to fastmcp\nimport { FastMCP } from 'fastmcp';\nimport { z } from 'zod';\nimport { execSync } from 'child_process';\nimport { logger } from '../../../utils/logger.js';\n\nconsole.error('🚀 Starting FastMCP claude-flow-sdk Server...');\n\n// Create server\nconst server = new FastMCP({\n  name: 'claude-flow-sdk',\n  version: '1.0.0'\n});\n\n// Tool 1: Memory Store\nserver.addTool({\n  name: 'memory_store',\n  description: 'Store a value in persistent memory with optional namespace and TTL',\n  parameters: z.object({\n    key: z.string().min(1).describe('Memory key'),\n    value: z.string().describe('Value to store'),\n    namespace: z.string().optional().default('default').describe('Memory namespace'),\n    ttl: z.number().positive().optional().describe('Time-to-live in seconds')\n  }),\n  execute: async ({ key, value, namespace, ttl }) => {\n    try {\n      logger.info('Storing memory', { key, namespace });\n\n      const cmd = [\n        'npx claude-flow@alpha memory store',\n        `\"${key}\"`,\n        `\"${value}\"`,\n        `--namespace \"${namespace}\"`,\n        ttl ? `--ttl ${ttl}` : ''\n      ].filter(Boolean).join(' ');\n\n      const result = execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });\n\n      logger.info('Memory stored successfully', { key });\n\n      return JSON.stringify({\n        success: true,\n        key,\n        namespace,\n        size: value.length,\n        ttl,\n        timestamp: new Date().toISOString(),\n        message: 'Memory stored successfully'\n      }, null, 2);\n    } catch (error: any) {\n      logger.error('Failed to store memory', { error: error.message });\n      throw new Error(`Failed to store memory: ${error.message}`);\n    }\n  }\n});\n\n// Tool 2: Memory Retrieve\nserver.addTool({\n  name: 'memory_retrieve',\n  description: 'Retrieve a value from persistent memory',\n  parameters: z.object({\n    key: z.string().min(1).describe('Memory key'),\n    namespace: z.string().optional().default('default').describe('Memory namespace')\n  }),\n  execute: async ({ key, namespace }) => {\n    try {\n      const cmd = `npx claude-flow@alpha memory retrieve \"${key}\" --namespace \"${namespace}\"`;\n      const result = execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });\n\n      return JSON.stringify({\n        success: true,\n        key,\n        namespace,\n        value: result.trim(),\n        timestamp: new Date().toISOString()\n      }, null, 2);\n    } catch (error: any) {\n      throw new Error(`Failed to retrieve memory: ${error.message}`);\n    }\n  }\n});\n\n// Tool 3: Memory Search\nserver.addTool({\n  name: 'memory_search',\n  description: 'Search for keys matching a pattern in memory',\n  parameters: z.object({\n    pattern: z.string().min(1).describe('Search pattern (supports wildcards)'),\n    namespace: z.string().optional().describe('Memory namespace to search in'),\n    limit: z.number().positive().optional().default(10).describe('Maximum results to return')\n  }),\n  execute: async ({ pattern, namespace, limit }) => {\n    try {\n      const cmd = `npx claude-flow@alpha memory search \"${pattern}\"${namespace ? ` --namespace \"${namespace}\"` : ''} --limit ${limit}`;\n      const result = execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });\n\n      return JSON.stringify({\n        success: true,\n        pattern,\n        namespace: namespace || 'all',\n        results: result.trim(),\n        limit,\n        timestamp: new Date().toISOString()\n      }, null, 2);\n    } catch (error: any) {\n      throw new Error(`Failed to search memory: ${error.message}`);\n    }\n  }\n});\n\n// Tool 4: Swarm Init\nserver.addTool({\n  name: 'swarm_init',\n  description: 'Initialize a multi-agent swarm with specified topology',\n  parameters: z.object({\n    topology: z.enum(['mesh', 'hierarchical', 'ring', 'star']).describe('Swarm topology'),\n    maxAgents: z.number().positive().optional().default(8).describe('Maximum number of agents'),\n    strategy: z.enum(['balanced', 'specialized', 'adaptive']).optional().default('balanced').describe('Agent distribution strategy')\n  }),\n  execute: async ({ topology, maxAgents, strategy }) => {\n    try {\n      const cmd = `npx claude-flow@alpha swarm init --topology ${topology} --max-agents ${maxAgents} --strategy ${strategy}`;\n      const result = execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });\n\n      return JSON.stringify({\n        success: true,\n        topology,\n        maxAgents,\n        strategy,\n        result: result.trim(),\n        timestamp: new Date().toISOString()\n      }, null, 2);\n    } catch (error: any) {\n      throw new Error(`Failed to initialize swarm: ${error.message}`);\n    }\n  }\n});\n\n// Tool 5: Agent Spawn\nserver.addTool({\n  name: 'agent_spawn',\n  description: 'Spawn a new agent in the swarm',\n  parameters: z.object({\n    type: z.enum(['researcher', 'coder', 'analyst', 'optimizer', 'coordinator']).describe('Agent type'),\n    capabilities: z.array(z.string()).optional().describe('Agent capabilities'),\n    name: z.string().optional().describe('Custom agent name')\n  }),\n  execute: async ({ type, capabilities, name }) => {\n    try {\n      const capStr = capabilities ? ` --capabilities \"${capabilities.join(',')}\"` : '';\n      const nameStr = name ? ` --name \"${name}\"` : '';\n      const cmd = `npx claude-flow@alpha agent spawn --type ${type}${capStr}${nameStr}`;\n      const result = execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });\n\n      return JSON.stringify({\n        success: true,\n        type,\n        capabilities,\n        name,\n        result: result.trim(),\n        timestamp: new Date().toISOString()\n      }, null, 2);\n    } catch (error: any) {\n      throw new Error(`Failed to spawn agent: ${error.message}`);\n    }\n  }\n});\n\n// Tool 6: Task Orchestrate\nserver.addTool({\n  name: 'task_orchestrate',\n  description: 'Orchestrate a complex task across the swarm',\n  parameters: z.object({\n    task: z.string().min(1).describe('Task description or instructions'),\n    strategy: z.enum(['parallel', 'sequential', 'adaptive']).optional().default('adaptive').describe('Execution strategy'),\n    priority: z.enum(['low', 'medium', 'high', 'critical']).optional().default('medium').describe('Task priority'),\n    maxAgents: z.number().positive().optional().describe('Maximum agents to use for this task')\n  }),\n  execute: async ({ task, strategy, priority, maxAgents }) => {\n    try {\n      const maxStr = maxAgents ? ` --max-agents ${maxAgents}` : '';\n      const cmd = `npx claude-flow@alpha task orchestrate \"${task}\" --strategy ${strategy} --priority ${priority}${maxStr}`;\n      const result = execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });\n\n      return JSON.stringify({\n        success: true,\n        task,\n        strategy,\n        priority,\n        maxAgents,\n        result: result.trim(),\n        timestamp: new Date().toISOString()\n      }, null, 2);\n    } catch (error: any) {\n      throw new Error(`Failed to orchestrate task: ${error.message}`);\n    }\n  }\n});\n\nconsole.error('📦 Registered 6 tools: memory_store, memory_retrieve, memory_search, swarm_init, agent_spawn, task_orchestrate');\nconsole.error('🔌 Starting stdio transport...');\n\n// Start with stdio transport\nserver.start({ transportType: 'stdio' }).then(() => {\n  console.error('✅ FastMCP claude-flow-sdk server running on stdio');\n}).catch((error) => {\n  console.error('❌ Failed to start server:', error);\n  process.exit(1);\n});\n"]}
+{"version":3,"file":"claude-flow-sdk.js","sourceRoot":"","sources":["../../../../src/mcp/fastmcp/servers/claude-flow-sdk.ts"],"names":[],"mappings":";AACA,+HAA+H;AAC/H,yEAAyE;AACzE,4DAA4D;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,+EAA+E;AAC/E,gFAAgF;AAChF,oDAAoD;AACpD,MAAM,aAAa,GAAG,EAAE,KAAK,EAAE,KAAc,EAAE,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;AAE/D,gBAAgB;AAChB,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC;IACzB,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,uBAAuB;AACvB,MAAM,CAAC,OAAO,CAAC;IACb,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,oEAAoE;IACjF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAChF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;KAC1E,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE;QAChD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YAElD,MAAM,IAAI,GAAG,CAAC,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;YAC5F,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAEzC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAEhG,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAEnD,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,IAAI;gBACb,GAAG;gBACH,SAAS;gBACT,IAAI,EAAE,KAAK,CAAC,MAAM;gBAClB,GAAG;gBACH,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,OAAO,EAAE,4BAA4B;aACtC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,0BAA0B;AAC1B,MAAM,CAAC,OAAO,CAAC;IACb,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,yCAAyC;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;KACjF,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,CAAC,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,EAC1E,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CACrE,CAAC;YAEF,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,IAAI;gBACb,GAAG;gBACH,SAAS;gBACT,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE;gBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,wBAAwB;AACxB,MAAM,CAAC,OAAO,CAAC;IACb,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,8CAA8C;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QAC1E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC1E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;KAC1F,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAE/G,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,IAAI;gBACb,OAAO;gBACP,SAAS,EAAE,SAAS,IAAI,KAAK;gBAC7B,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;gBACtB,KAAK;gBACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,qBAAqB;AACrB,MAAM,CAAC,OAAO,CAAC;IACb,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,wDAAwD;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC3F,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;KACjI,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,CAAC,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,EACzH,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CACrE,CAAC;YAEF,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,SAAS;gBACT,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,sBAAsB;AACtB,MAAM,CAAC,OAAO,CAAC;IACb,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,gCAAgC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QACnG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAC3E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;KAC1D,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACrE,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACjG,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAE/G,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,IAAI;gBACb,IAAI;gBACJ,YAAY;gBACZ,IAAI;gBACJ,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,2BAA2B;AAC3B,MAAM,CAAC,OAAO,CAAC;IACb,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,6CAA6C;IAC1D,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QACpE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACtH,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC9G,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;KAC5F,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;YAChH,IAAI,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAE/G,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,IAAI;gBACb,IAAI;gBACJ,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,OAAO,CAAC,KAAK,CAAC,gHAAgH,CAAC,CAAC;AAChI,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEhD,6BAA6B;AAC7B,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;IACjD,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\n/* eslint-disable @typescript-eslint/no-explicit-any -- pre-existing catch(error: any) handlers; outside scope of CWE-78 fix */\n// FastMCP implementation of claude-flow-sdk server (in-process, 6 tools)\n// Phase 1: Migration from claudeFlowSdkServer.ts to fastmcp\nimport { FastMCP } from 'fastmcp';\nimport { z } from 'zod';\nimport { execFileSync } from 'child_process';\n\n// Security: All shell-outs use execFileSync with argv arrays (shell: false) to\n// prevent OS command injection via tool parameters (CWE-78). Do NOT reintroduce\n// execSync with template-string interpolation here.\nconst NPX_EXEC_OPTS = { shell: false as const };\nimport { logger } from '../../../utils/logger.js';\n\nconsole.error('🚀 Starting FastMCP claude-flow-sdk Server...');\n\n// Create server\nconst server = new FastMCP({\n  name: 'claude-flow-sdk',\n  version: '1.0.0'\n});\n\n// Tool 1: Memory Store\nserver.addTool({\n  name: 'memory_store',\n  description: 'Store a value in persistent memory with optional namespace and TTL',\n  parameters: z.object({\n    key: z.string().min(1).describe('Memory key'),\n    value: z.string().describe('Value to store'),\n    namespace: z.string().optional().default('default').describe('Memory namespace'),\n    ttl: z.number().positive().optional().describe('Time-to-live in seconds')\n  }),\n  execute: async ({ key, value, namespace, ttl }) => {\n    try {\n      logger.info('Storing memory', { key, namespace });\n\n      const args = ['claude-flow@alpha', 'memory', 'store', key, value, '--namespace', namespace];\n      if (ttl) args.push('--ttl', String(ttl));\n\n      execFileSync('npx', args, { ...NPX_EXEC_OPTS, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });\n\n      logger.info('Memory stored successfully', { key });\n\n      return JSON.stringify({\n        success: true,\n        key,\n        namespace,\n        size: value.length,\n        ttl,\n        timestamp: new Date().toISOString(),\n        message: 'Memory stored successfully'\n      }, null, 2);\n    } catch (error: any) {\n      logger.error('Failed to store memory', { error: error.message });\n      throw new Error(`Failed to store memory: ${error.message}`);\n    }\n  }\n});\n\n// Tool 2: Memory Retrieve\nserver.addTool({\n  name: 'memory_retrieve',\n  description: 'Retrieve a value from persistent memory',\n  parameters: z.object({\n    key: z.string().min(1).describe('Memory key'),\n    namespace: z.string().optional().default('default').describe('Memory namespace')\n  }),\n  execute: async ({ key, namespace }) => {\n    try {\n      const result = execFileSync(\n        'npx',\n        ['claude-flow@alpha', 'memory', 'retrieve', key, '--namespace', namespace],\n        { ...NPX_EXEC_OPTS, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 }\n      );\n\n      return JSON.stringify({\n        success: true,\n        key,\n        namespace,\n        value: result.trim(),\n        timestamp: new Date().toISOString()\n      }, null, 2);\n    } catch (error: any) {\n      throw new Error(`Failed to retrieve memory: ${error.message}`);\n    }\n  }\n});\n\n// Tool 3: Memory Search\nserver.addTool({\n  name: 'memory_search',\n  description: 'Search for keys matching a pattern in memory',\n  parameters: z.object({\n    pattern: z.string().min(1).describe('Search pattern (supports wildcards)'),\n    namespace: z.string().optional().describe('Memory namespace to search in'),\n    limit: z.number().positive().optional().default(10).describe('Maximum results to return')\n  }),\n  execute: async ({ pattern, namespace, limit }) => {\n    try {\n      const args = ['claude-flow@alpha', 'memory', 'search', pattern];\n      if (namespace) args.push('--namespace', namespace);\n      args.push('--limit', String(limit));\n      const result = execFileSync('npx', args, { ...NPX_EXEC_OPTS, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });\n\n      return JSON.stringify({\n        success: true,\n        pattern,\n        namespace: namespace || 'all',\n        results: result.trim(),\n        limit,\n        timestamp: new Date().toISOString()\n      }, null, 2);\n    } catch (error: any) {\n      throw new Error(`Failed to search memory: ${error.message}`);\n    }\n  }\n});\n\n// Tool 4: Swarm Init\nserver.addTool({\n  name: 'swarm_init',\n  description: 'Initialize a multi-agent swarm with specified topology',\n  parameters: z.object({\n    topology: z.enum(['mesh', 'hierarchical', 'ring', 'star']).describe('Swarm topology'),\n    maxAgents: z.number().positive().optional().default(8).describe('Maximum number of agents'),\n    strategy: z.enum(['balanced', 'specialized', 'adaptive']).optional().default('balanced').describe('Agent distribution strategy')\n  }),\n  execute: async ({ topology, maxAgents, strategy }) => {\n    try {\n      const result = execFileSync(\n        'npx',\n        ['claude-flow@alpha', 'swarm', 'init', '--topology', topology, '--max-agents', String(maxAgents), '--strategy', strategy],\n        { ...NPX_EXEC_OPTS, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 }\n      );\n\n      return JSON.stringify({\n        success: true,\n        topology,\n        maxAgents,\n        strategy,\n        result: result.trim(),\n        timestamp: new Date().toISOString()\n      }, null, 2);\n    } catch (error: any) {\n      throw new Error(`Failed to initialize swarm: ${error.message}`);\n    }\n  }\n});\n\n// Tool 5: Agent Spawn\nserver.addTool({\n  name: 'agent_spawn',\n  description: 'Spawn a new agent in the swarm',\n  parameters: z.object({\n    type: z.enum(['researcher', 'coder', 'analyst', 'optimizer', 'coordinator']).describe('Agent type'),\n    capabilities: z.array(z.string()).optional().describe('Agent capabilities'),\n    name: z.string().optional().describe('Custom agent name')\n  }),\n  execute: async ({ type, capabilities, name }) => {\n    try {\n      const args = ['claude-flow@alpha', 'agent', 'spawn', '--type', type];\n      if (capabilities && capabilities.length > 0) args.push('--capabilities', capabilities.join(','));\n      if (name) args.push('--name', name);\n      const result = execFileSync('npx', args, { ...NPX_EXEC_OPTS, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });\n\n      return JSON.stringify({\n        success: true,\n        type,\n        capabilities,\n        name,\n        result: result.trim(),\n        timestamp: new Date().toISOString()\n      }, null, 2);\n    } catch (error: any) {\n      throw new Error(`Failed to spawn agent: ${error.message}`);\n    }\n  }\n});\n\n// Tool 6: Task Orchestrate\nserver.addTool({\n  name: 'task_orchestrate',\n  description: 'Orchestrate a complex task across the swarm',\n  parameters: z.object({\n    task: z.string().min(1).describe('Task description or instructions'),\n    strategy: z.enum(['parallel', 'sequential', 'adaptive']).optional().default('adaptive').describe('Execution strategy'),\n    priority: z.enum(['low', 'medium', 'high', 'critical']).optional().default('medium').describe('Task priority'),\n    maxAgents: z.number().positive().optional().describe('Maximum agents to use for this task')\n  }),\n  execute: async ({ task, strategy, priority, maxAgents }) => {\n    try {\n      const args = ['claude-flow@alpha', 'task', 'orchestrate', task, '--strategy', strategy, '--priority', priority];\n      if (maxAgents) args.push('--max-agents', String(maxAgents));\n      const result = execFileSync('npx', args, { ...NPX_EXEC_OPTS, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });\n\n      return JSON.stringify({\n        success: true,\n        task,\n        strategy,\n        priority,\n        maxAgents,\n        result: result.trim(),\n        timestamp: new Date().toISOString()\n      }, null, 2);\n    } catch (error: any) {\n      throw new Error(`Failed to orchestrate task: ${error.message}`);\n    }\n  }\n});\n\nconsole.error('📦 Registered 6 tools: memory_store, memory_retrieve, memory_search, swarm_init, agent_spawn, task_orchestrate');\nconsole.error('🔌 Starting stdio transport...');\n\n// Start with stdio transport\nserver.start({ transportType: 'stdio' }).then(() => {\n  console.error('✅ FastMCP claude-flow-sdk server running on stdio');\n}).catch((error) => {\n  console.error('❌ Failed to start server:', error);\n  process.exit(1);\n});\n"]}

package/dist/mcp/fastmcp/servers/http-sse.d.ts

@@ -1,3 +1,10 @@
 #!/usr/bin/env node
-export {};
+export interface HttpSseServerHandle {
+    host: string;
+    port: number;
+    token: string;
+    stop: () => Promise<void>;
+}
+/** Start the HTTP/SSE transport. Port defaults to AGENTIC_FLOW_MCP_PORT or 8080. */
+export declare function startHttpSseServer(port?: number, host?: string): Promise<HttpSseServerHandle>;
 //# sourceMappingURL=http-sse.d.ts.map

package/dist/mcp/fastmcp/servers/http-sse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-sse.d.ts","sourceRoot":"","sources":["../../../../src/mcp/fastmcp/servers/http-sse.ts"],"names":[],"mappings":""}
+{"version":3,"file":"http-sse.d.ts","sourceRoot":"","sources":["../../../../src/mcp/fastmcp/servers/http-sse.ts"],"names":[],"mappings":";AAyaA,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,oFAAoF;AACpF,wBAAsB,kBAAkB,CACtC,IAAI,GAAE,MAA2E,EACjF,IAAI,GAAE,MAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CAoB9B"}

package/dist/mcp/fastmcp/servers/http-sse.js

@@ -1,15 +1,30 @@
 #!/usr/bin/env node
+/* eslint-disable @typescript-eslint/no-explicit-any -- pre-existing catch(error: any) handlers; outside scope of CWE-78 fix */
 // FastMCP server with HTTP/SSE transport - All agentic-flow tools
-// Accessible via HTTP at http://localhost:8080/mcp
-// SSE endpoint at http://localhost:8080/sse
+// Accessible via HTTP at http://127.0.0.1:8080/mcp
+// SSE endpoint at http://127.0.0.1:8080/sse
+//
+// Access control: binds AGENTIC_FLOW_MCP_HOST (default 127.0.0.1) and requires
+// AGENTIC_FLOW_MCP_TOKEN as a bearer token (generated and printed once when
+// unset). Browser origins must be listed in AGENTIC_FLOW_MCP_ALLOWED_ORIGINS.
 import { FastMCP } from 'fastmcp';
 import { z } from 'zod';
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
+import { realpathSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { createMcpHttpAuthenticate, resolveMcpHttpAuth, DEFAULT_MCP_HTTP_PORT, } from '../auth/http-auth.js';
+import { toAgentSlug, resolveAgentDir, resolveWithin } from '../../../utils/path-safety.js';
+// Security: All shell-outs use execFileSync with argv arrays (shell: false) to
+// prevent OS command injection via tool parameters (CWE-78). Do NOT reintroduce
+// execSync with template-string interpolation here.
+const NPX_EXEC_OPTS = { shell: false };
 console.error('🚀 Starting Agentic-Flow MCP Server (HTTP/SSE transport)...');
 console.error('📦 Loading agentic-flow tools');
+const httpAuth = resolveMcpHttpAuth();
 const server = new FastMCP({
     name: 'agentic-flow-http',
-    version: '1.1.12'
+    version: '1.1.12',
+    authenticate: createMcpHttpAuthenticate(httpAuth)
 });
 // Tool: Run agentic-flow agent
 server.addTool({
@@ -21,6 +36,9 @@ server.addTool({
         // Provider Configuration
         model: z.string().optional().describe('Model to use (e.g., "claude-sonnet-4-5-20250929" for Anthropic, "meta-llama/llama-3.1-8b-instruct" for OpenRouter, or "Xenova/gpt2" for ONNX local models)'),
         provider: z.enum(['anthropic', 'openrouter', 'onnx', 'gemini']).optional().describe('LLM provider: "anthropic" (default, highest quality, requires ANTHROPIC_API_KEY), "gemini" (free tier, requires GOOGLE_GEMINI_API_KEY), "openrouter" (99% cost savings, requires OPENROUTER_API_KEY), "onnx" (free local inference, no API key needed)'),
+        // API Configuration
+        anthropicApiKey: z.string().optional().describe('Anthropic API key (sk-ant-...) - overrides ANTHROPIC_API_KEY environment variable'),
+        openrouterApiKey: z.string().optional().describe('OpenRouter API key (sk-or-...) - overrides OPENROUTER_API_KEY environment variable'),
         // Agent Behavior
         stream: z.boolean().optional().default(false).describe('Enable streaming output (real-time response chunks)'),
         temperature: z.number().min(0).max(1).optional().describe('Sampling temperature (0.0-1.0): lower = more focused/deterministic, higher = more creative/random. Default varies by agent.'),
@@ -34,37 +52,44 @@ server.addTool({
         timeout: z.number().positive().optional().describe('Execution timeout in milliseconds (default: 300000 = 5 minutes)'),
         retryOnError: z.boolean().optional().default(false).describe('Automatically retry on transient errors (rate limits, network issues)')
     }),
-    execute: async ({ agent, task, model, provider, stream, temperature, maxTokens, agentsDir, outputFormat, verbose, timeout, retryOnError }) => {
+    execute: async ({ agent, task, model, provider, anthropicApiKey, openrouterApiKey, stream, temperature, maxTokens, agentsDir, outputFormat, verbose, timeout, retryOnError }) => {
         try {
-            // Build command with all parameters
-            let cmd = `npx --yes agentic-flow --agent "${agent}" --task "${task}"`;
+            // Build argv (NOT a shell string) — every user-supplied value stays a
+            // separate argv element and cannot be reinterpreted by the shell.
+            const args = ['--yes', 'agentic-flow', '--agent', agent, '--task', task];
             // Provider & Model
             if (model)
-                cmd += ` --model "${model}"`;
+                args.push('--model', model);
             if (provider)
-                cmd += ` --provider ${provider}`;
+                args.push('--provider', provider);
+            // API Keys (set as env vars)
             const env = { ...process.env };
+            if (anthropicApiKey)
+                env.ANTHROPIC_API_KEY = anthropicApiKey;
+            if (openrouterApiKey)
+                env.OPENROUTER_API_KEY = openrouterApiKey;
             // Agent Behavior
             if (stream)
-                cmd += ' --stream';
+                args.push('--stream');
             if (temperature !== undefined)
-                cmd += ` --temperature ${temperature}`;
+                args.push('--temperature', String(temperature));
             if (maxTokens)
-                cmd += ` --max-tokens ${maxTokens}`;
+                args.push('--max-tokens', String(maxTokens));
             // Directories
             if (agentsDir)
-                cmd += ` --agents-dir "${agentsDir}"`;
+                args.push('--agents-dir', agentsDir);
             // Output
             if (outputFormat)
-                cmd += ` --output ${outputFormat}`;
+                args.push('--output', outputFormat);
             if (verbose)
-                cmd += ' --verbose';
+                args.push('--verbose');
             // Execution
             if (timeout)
-                cmd += ` --timeout ${timeout}`;
+                args.push('--timeout', String(timeout));
             if (retryOnError)
-                cmd += ' --retry';
-            const result = execSync(cmd, {
+                args.push('--retry');
+            const result = execFileSync('npx', args, {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024,
                 timeout: timeout || 300000,
@@ -109,7 +134,8 @@ server.addTool({
     }),
     execute: async ({ format }) => {
         try {
-            const result = execSync('npx --yes agentic-flow --list', {
+            const result = execFileSync('npx', ['--yes', 'agentic-flow', '--list'], {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 5 * 1024 * 1024,
                 timeout: 30000
@@ -183,9 +209,9 @@ server.addTool({
         try {
             const { writeFileSync, existsSync, mkdirSync } = await import('fs');
             const { join } = await import('path');
-            // Convert to kebab-case
-            const agentName = name.toLowerCase().replace(/\s+/g, '-');
-            const agentsDir = join(process.cwd(), '.claude', 'agents', category || 'custom');
+            // Convert to kebab-case; name and category must be slugs under .claude/agents
+            const agentName = toAgentSlug(name);
+            const agentsDir = resolveAgentDir(category || 'custom');
             if (!existsSync(agentsDir)) {
                 mkdirSync(agentsDir, { recursive: true });
             }
@@ -207,7 +233,7 @@ npx agentic-flow --agent ${agentName} --task "Your task"
 ---
 *Created: ${new Date().toISOString()}*
 `;
-            const filePath = join(agentsDir, `${agentName}.md`);
+            const filePath = resolveWithin(agentsDir, `${agentName}.md`);
             if (existsSync(filePath)) {
                 throw new Error(`Agent '${agentName}' already exists at ${filePath}`);
             }
@@ -250,7 +276,8 @@ server.addTool({
     }),
     execute: async ({ name }) => {
         try {
-            const result = execSync(`npx --yes agentic-flow agent info ${name}`, {
+            // Use execFileSync with array args to prevent shell injection from user-supplied `name`
+            const result = execFileSync('npx', ['--yes', 'agentic-flow', 'agent', 'info', name], {
                 encoding: 'utf-8',
                 maxBuffer: 5 * 1024 * 1024,
                 timeout: 30000
@@ -284,7 +311,8 @@ server.addTool({
     parameters: z.object({}),
     execute: async () => {
         try {
-            const result = execSync('npx --yes agentic-flow agent conflicts', {
+            const result = execFileSync('npx', ['--yes', 'agentic-flow', 'agent', 'conflicts'], {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 5 * 1024 * 1024,
                 timeout: 30000
@@ -324,10 +352,11 @@ server.addTool({
     }),
     execute: async ({ agent, task, priority, max_cost }) => {
         try {
-            let cmd = `npx --yes agentic-flow --agent ${agent} --task "${task}" --optimize --priority ${priority}`;
+            const args = ['--yes', 'agentic-flow', '--agent', agent, '--task', task, '--optimize', '--priority', priority];
             if (max_cost)
-                cmd += ` --max-cost ${max_cost}`;
-            const result = execSync(cmd, {
+                args.push('--max-cost', String(max_cost));
+            const result = execFileSync('npx', args, {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024,
                 timeout: 60000
@@ -355,20 +384,41 @@ server.addTool({
     }
 });
 console.error('✅ Registered 6 tools successfully');
-console.error('🌐 Starting HTTP/SSE transport...');
-// Start with HTTP/SSE transport
-server.start({
-    transportType: 'httpStream',
-    httpStream: {
-        port: 8080
-    }
-}).then(() => {
+/** Start the HTTP/SSE transport. Port defaults to AGENTIC_FLOW_MCP_PORT or 8080. */
+export async function startHttpSseServer(port = Number(process.env.AGENTIC_FLOW_MCP_PORT) || DEFAULT_MCP_HTTP_PORT, host = httpAuth.host) {
+    await server.start({
+        transportType: 'httpStream',
+        httpStream: { port, host }
+    });
+    const base = `http://${host.includes(':') ? `[${host}]` : host}:${port}`;
     console.error('✅ Agentic-Flow MCP Server running!');
-    console.error('📡 HTTP endpoint: http://localhost:8080/mcp');
-    console.error('📡 SSE endpoint: http://localhost:8080/sse');
-    console.error('💊 Health check: http://localhost:8080/health');
-}).catch((error) => {
-    console.error('❌ Failed to start HTTP/SSE server:', error);
-    process.exit(1);
-});
+    console.error(`📡 HTTP endpoint: ${base}/mcp`);
+    console.error(`📡 SSE endpoint: ${base}/sse`);
+    console.error(`💊 Health check: ${base}/health`);
+    if (httpAuth.generated) {
+        console.error('🔑 No AGENTIC_FLOW_MCP_TOKEN set; generated one for this run:');
+        console.error(`   Authorization: Bearer ${httpAuth.token}`);
+    }
+    if (httpAuth.allowedOrigins.size === 0) {
+        console.error('🌐 Browser origins: none allowed (set AGENTIC_FLOW_MCP_ALLOWED_ORIGINS)');
+    }
+    return { host, port, token: httpAuth.token, stop: () => server.stop() };
+}
+function isMainModule() {
+    if (!process.argv[1])
+        return false;
+    try {
+        return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+    }
+    catch {
+        return false;
+    }
+}
+if (isMainModule()) {
+    console.error('🌐 Starting HTTP/SSE transport...');
+    startHttpSseServer().catch((error) => {
+        console.error('❌ Failed to start HTTP/SSE server:', error);
+        process.exit(1);
+    });
+}
 //# sourceMappingURL=http-sse.js.map