agentic-flow 3.0.0-alpha.1 → 3.0.0

package/dist/mcp/fastmcp/tools/hooks/pretrain.js.map

@@ -1 +1 @@
-{"version":3,"file":"pretrain.js","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/hooks/pretrain.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,WAAW,EAEZ,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,wDAAwD;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACvE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QACvG,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QACpF,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QACzF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KAClF,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QACrF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAEjE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAExE,kCAAkC;QAClC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAExE,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,QAAQ,CAC1B,oIAAoI,EACpI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CACnD,CAAC;gBAEF,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAE5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,KAAK,CAAC,KAAK,EAAE,CAAC;oBACd,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC/B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;oBAEpC,4BAA4B;oBAC5B,MAAM,KAAK,GAAG,QAAQ,GAAG,IAAI,SAAS,EAAE,CAAC;oBACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC3B,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;oBAC7B,CAAC;oBACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;oBACzE,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAEjB,2BAA2B;oBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnD,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;oBACzC,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,iCAAiC;YACnC,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAErE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,QAAQ,CACrB,sDAAsD,KAAK,cAAc,EACzE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CACnD,CAAC;gBAEF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC9D,MAAM,SAAS,GAA2B,EAAE,CAAC;gBAE7C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBACrF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBAE1C,iBAAiB;oBACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;wBACtC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;4BAC1C,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4BAClD,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;wBAC7C,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,gCAAgC;gBAChC,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;qBAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC;qBACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAE/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBACxD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACtC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC5B,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;oBAC9B,CAAC;oBAED,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;oBACpE,IAAI,QAAQ,EAAE,CAAC;wBACb,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC;oBAC1B,CAAC;yBAAM,CAAC;wBACN,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC7D,CAAC;oBACD,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,GAAG,CAAC,oBAAoB,cAAc,CAAC,MAAM,mBAAmB,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,gCAAgC;YAClC,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAEhF,MAAM,cAAc,GAAG;YACrB,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY;YACtD,gBAAgB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,eAAe;SACrE,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;YACpD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;oBAClE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAClB,OAAO,EAAE,IAAI,QAAQ,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;wBACrE,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACjC,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC;qBAChC,CAAC,CAAC;oBACH,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,wBAAwB;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CACnB,sGAAsG,EACtG,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;qBACvE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC;qBACpG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,0BAA0B,CAAC;qBAClG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC;qBAClF,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC;qBACnG,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC;qBAC/F,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC;YAC5G,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,sCAAsC;QACxC,CAAC;QAED,yBAAyB;QACzB,KAAK,CAAC,UAAU,GAAG;YACjB,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC9B,KAAK;SACN,CAAC;QAEF,oBAAoB;QACpB,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAExB,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAEvC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,KAAK,CAAC,KAAK;YAC1B,eAAe,EAAE,KAAK,CAAC,QAAQ;YAC/B,cAAc,EAAE,KAAK,CAAC,QAAQ;YAC9B,YAAY,EAAE,KAAK,CAAC,OAAO;YAC3B,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM;YACxD,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;CACF,CAAC","sourcesContent":["/**\n * Pretrain Hook - Analyze repository and bootstrap intelligence\n * Swarm-distributed when available, falls back to sequential\n */\n\nimport { z } from 'zod';\nimport * as path from 'path';\nimport * as fs from 'fs';\nimport { execSync } from 'child_process';\nimport type { ToolDefinition } from '../../types/index.js';\nimport {\n  loadIntelligence,\n  saveIntelligence,\n  getAgentForFile,\n  simpleEmbed,\n  agentMapping\n} from './shared.js';\n\nexport const hookPretrainTool: ToolDefinition = {\n  name: 'hook_pretrain',\n  description: 'Analyze repository with swarm for intelligent patterns',\n  parameters: z.object({\n    depth: z.number().optional().default(100).describe('Git history depth'),\n    incremental: z.boolean().optional().default(false).describe('Only analyze changes since last pretrain'),\n    skipGit: z.boolean().optional().default(false).describe('Skip git history analysis'),\n    skipFiles: z.boolean().optional().default(false).describe('Skip file structure analysis'),\n    verbose: z.boolean().optional().default(false).describe('Show detailed progress')\n  }),\n  execute: async ({ depth, incremental, skipGit, skipFiles, verbose }, { onProgress }) => {\n    const startTime = Date.now();\n    const intel = loadIntelligence();\n    const stats = { files: 0, patterns: 0, memories: 0, coedits: 0 };\n\n    onProgress?.({ progress: 0, message: 'Starting pretrain analysis...' });\n\n    // Phase 1: Analyze file structure\n    if (!skipFiles) {\n      onProgress?.({ progress: 0.1, message: 'Analyzing file structure...' });\n\n      try {\n        const filesOutput = execSync(\n          'git ls-files 2>/dev/null || find . -type f -not -path \"./.git/*\" -not -path \"./node_modules/*\" -not -path \"./target/*\" 2>/dev/null',\n          { encoding: 'utf-8', maxBuffer: 50 * 1024 * 1024 }\n        );\n\n        const files = filesOutput.trim().split('\\n').filter(f => f);\n\n        for (const file of files) {\n          stats.files++;\n          const ext = path.extname(file);\n          const agent = getAgentForFile(file);\n\n          // Create Q-learning pattern\n          const state = `edit:${ext || 'unknown'}`;\n          if (!intel.patterns[state]) {\n            intel.patterns[state] = {};\n          }\n          intel.patterns[state][agent] = (intel.patterns[state][agent] || 0) + 0.3;\n          stats.patterns++;\n\n          // Track directory patterns\n          const dir = path.dirname(file);\n          const dirParts = dir.split('/');\n          if (dirParts[0] && !intel.dirPatterns[dirParts[0]]) {\n            intel.dirPatterns[dirParts[0]] = agent;\n          }\n        }\n\n        if (verbose) {\n          console.log(`[Pretrain] Analyzed ${stats.files} files`);\n        }\n      } catch (e) {\n        // Continue without file analysis\n      }\n    }\n\n    // Phase 2: Analyze git history for co-edit patterns\n    if (!skipGit) {\n      onProgress?.({ progress: 0.4, message: 'Analyzing git history...' });\n\n      try {\n        const gitLog = execSync(\n          `git log --name-only --pretty=format:\"COMMIT:%H\" -n ${depth} 2>/dev/null`,\n          { encoding: 'utf-8', maxBuffer: 50 * 1024 * 1024 }\n        );\n\n        const commits = gitLog.split('COMMIT:').filter(c => c.trim());\n        const coEditMap: Record<string, number> = {};\n\n        for (const commit of commits) {\n          const lines = commit.trim().split('\\n').filter(l => l && !l.match(/^[a-f0-9]{40}$/));\n          const files = lines.filter(f => f.trim());\n\n          // Track co-edits\n          for (let i = 0; i < files.length; i++) {\n            for (let j = i + 1; j < files.length; j++) {\n              const key = [files[i], files[j]].sort().join('|');\n              coEditMap[key] = (coEditMap[key] || 0) + 1;\n            }\n          }\n        }\n\n        // Store strong co-edit patterns\n        const strongPatterns = Object.entries(coEditMap)\n          .filter(([, count]) => count >= 3)\n          .sort((a, b) => b[1] - a[1]);\n\n        for (const [key, count] of strongPatterns.slice(0, 100)) {\n          const [file1, file2] = key.split('|');\n          if (!intel.sequences[file1]) {\n            intel.sequences[file1] = [];\n          }\n\n          const existing = intel.sequences[file1].find(s => s.file === file2);\n          if (existing) {\n            existing.score += count;\n          } else {\n            intel.sequences[file1].push({ file: file2, score: count });\n          }\n          stats.coedits++;\n        }\n\n        if (verbose) {\n          console.log(`[Pretrain] Found ${strongPatterns.length} co-edit patterns`);\n        }\n      } catch (e) {\n        // Continue without git analysis\n      }\n    }\n\n    // Phase 3: Create memories from important files\n    onProgress?.({ progress: 0.7, message: 'Creating memories from key files...' });\n\n    const importantFiles = [\n      'README.md', 'CLAUDE.md', 'package.json', 'Cargo.toml',\n      'pyproject.toml', 'go.mod', '.claude/settings.json', 'tsconfig.json'\n    ];\n\n    for (const filename of importantFiles) {\n      const filePath = path.join(process.cwd(), filename);\n      if (fs.existsSync(filePath)) {\n        try {\n          const content = fs.readFileSync(filePath, 'utf-8').slice(0, 2000);\n          intel.memories.push({\n            content: `[${filename}] ${content.replace(/\\n/g, ' ').slice(0, 500)}`,\n            type: 'project',\n            created: new Date().toISOString(),\n            embedding: simpleEmbed(content)\n          });\n          stats.memories++;\n        } catch (e) {\n          // Skip unreadable files\n        }\n      }\n    }\n\n    // Phase 4: Build directory-agent mappings\n    onProgress?.({ progress: 0.85, message: 'Building directory mappings...' });\n\n    try {\n      const dirs = execSync(\n        'find . -type d -maxdepth 2 -not -path \"./.git*\" -not -path \"./node_modules*\" 2>/dev/null || echo \".\"',\n        { encoding: 'utf-8' }\n      ).trim().split('\\n');\n\n      for (const dir of dirs) {\n        const name = path.basename(dir);\n        if (['src', 'lib', 'core'].includes(name)) intel.dirPatterns[dir] = 'coder';\n        else if (['test', 'tests', '__tests__', 'spec'].includes(name)) intel.dirPatterns[dir] = 'test-engineer';\n        else if (['docs', 'documentation'].includes(name)) intel.dirPatterns[dir] = 'documentation-specialist';\n        else if (['scripts', 'bin'].includes(name)) intel.dirPatterns[dir] = 'devops-engineer';\n        else if (['components', 'views', 'pages'].includes(name)) intel.dirPatterns[dir] = 'frontend-developer';\n        else if (['api', 'routes', 'handlers'].includes(name)) intel.dirPatterns[dir] = 'backend-developer';\n        else if (['models', 'entities', 'schemas'].includes(name)) intel.dirPatterns[dir] = 'database-specialist';\n      }\n    } catch (e) {\n      // Continue without directory analysis\n    }\n\n    // Save pretrain metadata\n    intel.pretrained = {\n      date: new Date().toISOString(),\n      stats\n    };\n\n    // Save intelligence\n    saveIntelligence(intel);\n\n    onProgress?.({ progress: 1.0, message: 'Pretrain complete!' });\n\n    const latency = Date.now() - startTime;\n\n    return {\n      success: true,\n      filesAnalyzed: stats.files,\n      patternsCreated: stats.patterns,\n      memoriesStored: stats.memories,\n      coEditsFound: stats.coedits,\n      directoryMappings: Object.keys(intel.dirPatterns).length,\n      latencyMs: latency,\n      timestamp: new Date().toISOString()\n    };\n  }\n};\n"]}
+{"version":3,"file":"pretrain.js","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/hooks/pretrain.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,WAAW,EACZ,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,wDAAwD;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACvE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QACvG,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QACpF,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QACzF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KAClF,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QACnG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAEjE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAExE,kCAAkC;QAClC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAExE,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,oDAAoD;gBACpD,MAAM,WAAW,GAAG,QAAQ,CAC1B,oIAAoI,EACpI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CACnD,CAAC;gBAEF,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAE5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,KAAK,CAAC,KAAK,EAAE,CAAC;oBACd,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC/B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;oBAEpC,4BAA4B;oBAC5B,MAAM,KAAK,GAAG,QAAQ,GAAG,IAAI,SAAS,EAAE,CAAC;oBACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC3B,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;oBAC7B,CAAC;oBACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;oBACzE,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAEjB,2BAA2B;oBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnD,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;oBACzC,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,iCAAiC;YACnC,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAErE,IAAI,CAAC;gBACH,yEAAyE;gBACzE,uEAAuE;gBACvE,8DAA8D;gBAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,CAAC,KAAK,EAAE,aAAa,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAC5E,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CACpG,CAAC;gBAEF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC9D,MAAM,SAAS,GAA2B,EAAE,CAAC;gBAE7C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBACrF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBAE1C,iBAAiB;oBACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;wBACtC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;4BAC1C,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4BAClD,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;wBAC7C,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,gCAAgC;gBAChC,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;qBAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC;qBACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAE/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBACxD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACtC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC5B,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;oBAC9B,CAAC;oBAED,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;oBACpE,IAAI,QAAQ,EAAE,CAAC;wBACb,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC;oBAC1B,CAAC;yBAAM,CAAC;wBACN,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC7D,CAAC;oBACD,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,GAAG,CAAC,oBAAoB,cAAc,CAAC,MAAM,mBAAmB,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,gCAAgC;YAClC,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAEhF,MAAM,cAAc,GAAG;YACrB,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY;YACtD,gBAAgB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,eAAe;SACrE,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;YACpD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;oBAClE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAClB,OAAO,EAAE,IAAI,QAAQ,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;wBACrE,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACjC,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC;qBAChC,CAAC,CAAC;oBACH,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,wBAAwB;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC;YACH,4EAA4E;YAC5E,qBAAqB;YACrB,MAAM,IAAI,GAAG,QAAQ,CACnB,sGAAsG,EACtG,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;qBACvE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC;qBACpG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,0BAA0B,CAAC;qBAClG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC;qBAClF,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC;qBACnG,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC;qBAC/F,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC;YAC5G,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,sCAAsC;QACxC,CAAC;QAED,yBAAyB;QACzB,KAAK,CAAC,UAAU,GAAG;YACjB,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC9B,KAAK;SACN,CAAC;QAEF,oBAAoB;QACpB,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAExB,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAEvC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,KAAK,CAAC,KAAK;YAC1B,eAAe,EAAE,KAAK,CAAC,QAAQ;YAC/B,cAAc,EAAE,KAAK,CAAC,QAAQ;YAC9B,YAAY,EAAE,KAAK,CAAC,OAAO;YAC3B,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM;YACxD,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;CACF,CAAC","sourcesContent":["/**\n * Pretrain Hook - Analyze repository and bootstrap intelligence\n * Swarm-distributed when available, falls back to sequential\n */\n\nimport { z } from 'zod';\nimport * as path from 'path';\nimport * as fs from 'fs';\nimport { execSync, execFileSync } from 'child_process';\nimport type { ToolDefinition } from '../../types/index.js';\nimport {\n  loadIntelligence,\n  saveIntelligence,\n  getAgentForFile,\n  simpleEmbed\n} from './shared.js';\n\nexport const hookPretrainTool: ToolDefinition = {\n  name: 'hook_pretrain',\n  description: 'Analyze repository with swarm for intelligent patterns',\n  parameters: z.object({\n    depth: z.number().optional().default(100).describe('Git history depth'),\n    incremental: z.boolean().optional().default(false).describe('Only analyze changes since last pretrain'),\n    skipGit: z.boolean().optional().default(false).describe('Skip git history analysis'),\n    skipFiles: z.boolean().optional().default(false).describe('Skip file structure analysis'),\n    verbose: z.boolean().optional().default(false).describe('Show detailed progress')\n  }),\n  execute: async ({ depth, incremental: _incremental, skipGit, skipFiles, verbose }, { onProgress }) => {\n    const startTime = Date.now();\n    const intel = loadIntelligence();\n    const stats = { files: 0, patterns: 0, memories: 0, coedits: 0 };\n\n    onProgress?.({ progress: 0, message: 'Starting pretrain analysis...' });\n\n    // Phase 1: Analyze file structure\n    if (!skipFiles) {\n      onProgress?.({ progress: 0.1, message: 'Analyzing file structure...' });\n\n      try {\n        // Static command, no user input — shell is required for the `||` fallback\n        // and `2>/dev/null` redirection. NOT a CWE-78 sink.\n        const filesOutput = execSync(\n          'git ls-files 2>/dev/null || find . -type f -not -path \"./.git/*\" -not -path \"./node_modules/*\" -not -path \"./target/*\" 2>/dev/null',\n          { encoding: 'utf-8', maxBuffer: 50 * 1024 * 1024 }\n        );\n\n        const files = filesOutput.trim().split('\\n').filter(f => f);\n\n        for (const file of files) {\n          stats.files++;\n          const ext = path.extname(file);\n          const agent = getAgentForFile(file);\n\n          // Create Q-learning pattern\n          const state = `edit:${ext || 'unknown'}`;\n          if (!intel.patterns[state]) {\n            intel.patterns[state] = {};\n          }\n          intel.patterns[state][agent] = (intel.patterns[state][agent] || 0) + 0.3;\n          stats.patterns++;\n\n          // Track directory patterns\n          const dir = path.dirname(file);\n          const dirParts = dir.split('/');\n          if (dirParts[0] && !intel.dirPatterns[dirParts[0]]) {\n            intel.dirPatterns[dirParts[0]] = agent;\n          }\n        }\n\n        if (verbose) {\n          console.log(`[Pretrain] Analyzed ${stats.files} files`);\n        }\n      } catch (e) {\n        // Continue without file analysis\n      }\n    }\n\n    // Phase 2: Analyze git history for co-edit patterns\n    if (!skipGit) {\n      onProgress?.({ progress: 0.4, message: 'Analyzing git history...' });\n\n      try {\n        // Security (CWE-78): depth is z.number() validated, but use execFileSync\n        // with argv to hard-prevent any future schema relaxation from becoming\n        // an injection sink. Coerce to a positive integer explicitly.\n        const safeDepth = Math.max(1, Math.floor(Number(depth) || 100));\n        const gitLog = execFileSync(\n          'git',\n          ['log', '--name-only', '--pretty=format:COMMIT:%H', '-n', String(safeDepth)],\n          { shell: false, encoding: 'utf-8', maxBuffer: 50 * 1024 * 1024, stdio: ['pipe', 'pipe', 'ignore'] }\n        );\n\n        const commits = gitLog.split('COMMIT:').filter(c => c.trim());\n        const coEditMap: Record<string, number> = {};\n\n        for (const commit of commits) {\n          const lines = commit.trim().split('\\n').filter(l => l && !l.match(/^[a-f0-9]{40}$/));\n          const files = lines.filter(f => f.trim());\n\n          // Track co-edits\n          for (let i = 0; i < files.length; i++) {\n            for (let j = i + 1; j < files.length; j++) {\n              const key = [files[i], files[j]].sort().join('|');\n              coEditMap[key] = (coEditMap[key] || 0) + 1;\n            }\n          }\n        }\n\n        // Store strong co-edit patterns\n        const strongPatterns = Object.entries(coEditMap)\n          .filter(([, count]) => count >= 3)\n          .sort((a, b) => b[1] - a[1]);\n\n        for (const [key, count] of strongPatterns.slice(0, 100)) {\n          const [file1, file2] = key.split('|');\n          if (!intel.sequences[file1]) {\n            intel.sequences[file1] = [];\n          }\n\n          const existing = intel.sequences[file1].find(s => s.file === file2);\n          if (existing) {\n            existing.score += count;\n          } else {\n            intel.sequences[file1].push({ file: file2, score: count });\n          }\n          stats.coedits++;\n        }\n\n        if (verbose) {\n          console.log(`[Pretrain] Found ${strongPatterns.length} co-edit patterns`);\n        }\n      } catch (e) {\n        // Continue without git analysis\n      }\n    }\n\n    // Phase 3: Create memories from important files\n    onProgress?.({ progress: 0.7, message: 'Creating memories from key files...' });\n\n    const importantFiles = [\n      'README.md', 'CLAUDE.md', 'package.json', 'Cargo.toml',\n      'pyproject.toml', 'go.mod', '.claude/settings.json', 'tsconfig.json'\n    ];\n\n    for (const filename of importantFiles) {\n      const filePath = path.join(process.cwd(), filename);\n      if (fs.existsSync(filePath)) {\n        try {\n          const content = fs.readFileSync(filePath, 'utf-8').slice(0, 2000);\n          intel.memories.push({\n            content: `[${filename}] ${content.replace(/\\n/g, ' ').slice(0, 500)}`,\n            type: 'project',\n            created: new Date().toISOString(),\n            embedding: simpleEmbed(content)\n          });\n          stats.memories++;\n        } catch (e) {\n          // Skip unreadable files\n        }\n      }\n    }\n\n    // Phase 4: Build directory-agent mappings\n    onProgress?.({ progress: 0.85, message: 'Building directory mappings...' });\n\n    try {\n      // Static command, no user input — shell required for `2>/dev/null || echo`.\n      // NOT a CWE-78 sink.\n      const dirs = execSync(\n        'find . -type d -maxdepth 2 -not -path \"./.git*\" -not -path \"./node_modules*\" 2>/dev/null || echo \".\"',\n        { encoding: 'utf-8' }\n      ).trim().split('\\n');\n\n      for (const dir of dirs) {\n        const name = path.basename(dir);\n        if (['src', 'lib', 'core'].includes(name)) intel.dirPatterns[dir] = 'coder';\n        else if (['test', 'tests', '__tests__', 'spec'].includes(name)) intel.dirPatterns[dir] = 'test-engineer';\n        else if (['docs', 'documentation'].includes(name)) intel.dirPatterns[dir] = 'documentation-specialist';\n        else if (['scripts', 'bin'].includes(name)) intel.dirPatterns[dir] = 'devops-engineer';\n        else if (['components', 'views', 'pages'].includes(name)) intel.dirPatterns[dir] = 'frontend-developer';\n        else if (['api', 'routes', 'handlers'].includes(name)) intel.dirPatterns[dir] = 'backend-developer';\n        else if (['models', 'entities', 'schemas'].includes(name)) intel.dirPatterns[dir] = 'database-specialist';\n      }\n    } catch (e) {\n      // Continue without directory analysis\n    }\n\n    // Save pretrain metadata\n    intel.pretrained = {\n      date: new Date().toISOString(),\n      stats\n    };\n\n    // Save intelligence\n    saveIntelligence(intel);\n\n    onProgress?.({ progress: 1.0, message: 'Pretrain complete!' });\n\n    const latency = Date.now() - startTime;\n\n    return {\n      success: true,\n      filesAnalyzed: stats.files,\n      patternsCreated: stats.patterns,\n      memoriesStored: stats.memories,\n      coEditsFound: stats.coedits,\n      directoryMappings: Object.keys(intel.dirPatterns).length,\n      latencyMs: latency,\n      timestamp: new Date().toISOString()\n    };\n  }\n};\n"]}

package/dist/mcp/fastmcp/tools/swarm/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/swarm/init.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,eAAO,MAAM,aAAa,EAAE,cAsC3B,CAAC"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/swarm/init.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAO3D,eAAO,MAAM,aAAa,EAAE,cAsE3B,CAAC"}

package/dist/mcp/fastmcp/tools/swarm/init.js

@@ -1,6 +1,10 @@
 // Swarm init tool implementation using FastMCP
 import { z } from 'zod';
-import { execSync } from 'child_process';
+import { spawnSync } from 'child_process';
+// Security: Allowed values for validation (defense in depth beyond Zod)
+const VALID_TOPOLOGIES = new Set(['mesh', 'hierarchical', 'ring', 'star']);
+const VALID_STRATEGIES = new Set(['balanced', 'specialized', 'adaptive']);
+const MAX_AGENTS_LIMIT = 100;
 export const swarmInitTool = {
     name: 'swarm_init',
     description: 'Initialize a multi-agent swarm with specified topology',
@@ -19,23 +23,48 @@ export const swarmInitTool = {
     }),
     execute: async ({ topology, maxAgents, strategy }, { onProgress, auth }) => {
         try {
-            const cmd = `npx claude-flow@alpha swarm init --topology ${topology} --max-agents ${maxAgents} --strategy ${strategy}`;
-            const result = execSync(cmd, {
+            // Security: Defense in depth - validate even though Zod should have validated
+            if (!VALID_TOPOLOGIES.has(topology)) {
+                throw new Error(`Invalid topology: ${topology}`);
+            }
+            if (!VALID_STRATEGIES.has(strategy)) {
+                throw new Error(`Invalid strategy: ${strategy}`);
+            }
+            // Security: Sanitize and bound maxAgents
+            const safeMaxAgents = Math.min(Math.max(1, Math.floor(Number(maxAgents) || 8)), MAX_AGENTS_LIMIT);
+            // Security: Use spawnSync with argument array to prevent command injection
+            const args = [
+                'claude-flow@alpha',
+                'swarm',
+                'init',
+                '--topology', topology,
+                '--max-agents', String(safeMaxAgents),
+                '--strategy', strategy
+            ];
+            const result = spawnSync('npx', args, {
                 encoding: 'utf-8',
-                maxBuffer: 10 * 1024 * 1024
+                maxBuffer: 10 * 1024 * 1024,
+                timeout: 60000
             });
+            if (result.error) {
+                throw result.error;
+            }
+            if (result.status !== 0) {
+                throw new Error(result.stderr || 'Command failed');
+            }
             return {
                 success: true,
                 topology,
-                maxAgents,
+                maxAgents: safeMaxAgents,
                 strategy,
-                result: result.trim(),
+                result: (result.stdout || '').trim(),
                 userId: auth?.userId,
                 timestamp: new Date().toISOString()
             };
         }
         catch (error) {
-            throw new Error(`Failed to initialize swarm: ${error.message}`);
+            // Security: Don't expose internal error details to clients
+            throw new Error('Failed to initialize swarm. Check server logs for details.');
         }
     }
 };

package/dist/mcp/fastmcp/tools/swarm/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/swarm/init.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGzC,MAAM,CAAC,MAAM,aAAa,GAAmB;IAC3C,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,wDAAwD;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;aACvD,QAAQ,CAAC,gBAAgB,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;aAClB,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,OAAO,CAAC,CAAC,CAAC;aACV,QAAQ,CAAC,0BAA0B,CAAC;QACvC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;aACtD,QAAQ,EAAE;aACV,OAAO,CAAC,UAAU,CAAC;aACnB,QAAQ,CAAC,6BAA6B,CAAC;KAC3C,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;QACzE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,+CAA+C,QAAQ,iBAAiB,SAAS,eAAe,QAAQ,EAAE,CAAC;YAEvH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE;gBAC3B,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;aAC5B,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,SAAS;gBACT,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,MAAM,EAAE,IAAI,EAAE,MAAM;gBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;CACF,CAAC","sourcesContent":["// Swarm init tool implementation using FastMCP\nimport { z } from 'zod';\nimport { execSync } from 'child_process';\nimport type { ToolDefinition } from '../../types/index.js';\n\nexport const swarmInitTool: ToolDefinition = {\n  name: 'swarm_init',\n  description: 'Initialize a multi-agent swarm with specified topology',\n  parameters: z.object({\n    topology: z.enum(['mesh', 'hierarchical', 'ring', 'star'])\n      .describe('Swarm topology'),\n    maxAgents: z.number()\n      .positive()\n      .optional()\n      .default(8)\n      .describe('Maximum number of agents'),\n    strategy: z.enum(['balanced', 'specialized', 'adaptive'])\n      .optional()\n      .default('balanced')\n      .describe('Agent distribution strategy')\n  }),\n  execute: async ({ topology, maxAgents, strategy }, { onProgress, auth }) => {\n    try {\n      const cmd = `npx claude-flow@alpha swarm init --topology ${topology} --max-agents ${maxAgents} --strategy ${strategy}`;\n\n      const result = execSync(cmd, {\n        encoding: 'utf-8',\n        maxBuffer: 10 * 1024 * 1024\n      });\n\n      return {\n        success: true,\n        topology,\n        maxAgents,\n        strategy,\n        result: result.trim(),\n        userId: auth?.userId,\n        timestamp: new Date().toISOString()\n      };\n    } catch (error: any) {\n      throw new Error(`Failed to initialize swarm: ${error.message}`);\n    }\n  }\n};\n"]}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/swarm/init.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG1C,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAC1E,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,CAAC,MAAM,aAAa,GAAmB;IAC3C,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,wDAAwD;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;aACvD,QAAQ,CAAC,gBAAgB,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;aAClB,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,OAAO,CAAC,CAAC,CAAC;aACV,QAAQ,CAAC,0BAA0B,CAAC;QACvC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;aACtD,QAAQ,EAAE;aACV,OAAO,CAAC,UAAU,CAAC;aACnB,QAAQ,CAAC,6BAA6B,CAAC;KAC3C,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;QACzE,IAAI,CAAC;YACH,8EAA8E;YAC9E,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;YACnD,CAAC;YAED,yCAAyC;YACzC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAC/C,gBAAgB,CACjB,CAAC;YAEF,2EAA2E;YAC3E,MAAM,IAAI,GAAG;gBACX,mBAAmB;gBACnB,OAAO;gBACP,MAAM;gBACN,YAAY,EAAE,QAAQ;gBACtB,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC;gBACrC,YAAY,EAAE,QAAQ;aACvB,CAAC;YAEF,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBACpC,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;gBAC3B,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,MAAM,CAAC,KAAK,CAAC;YACrB,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;YACrD,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,SAAS,EAAE,aAAa;gBACxB,QAAQ;gBACR,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBACpC,MAAM,EAAE,IAAI,EAAE,MAAM;gBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,2DAA2D;YAC3D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;CACF,CAAC","sourcesContent":["// Swarm init tool implementation using FastMCP\nimport { z } from 'zod';\nimport { spawnSync } from 'child_process';\nimport type { ToolDefinition } from '../../types/index.js';\n\n// Security: Allowed values for validation (defense in depth beyond Zod)\nconst VALID_TOPOLOGIES = new Set(['mesh', 'hierarchical', 'ring', 'star']);\nconst VALID_STRATEGIES = new Set(['balanced', 'specialized', 'adaptive']);\nconst MAX_AGENTS_LIMIT = 100;\n\nexport const swarmInitTool: ToolDefinition = {\n  name: 'swarm_init',\n  description: 'Initialize a multi-agent swarm with specified topology',\n  parameters: z.object({\n    topology: z.enum(['mesh', 'hierarchical', 'ring', 'star'])\n      .describe('Swarm topology'),\n    maxAgents: z.number()\n      .positive()\n      .optional()\n      .default(8)\n      .describe('Maximum number of agents'),\n    strategy: z.enum(['balanced', 'specialized', 'adaptive'])\n      .optional()\n      .default('balanced')\n      .describe('Agent distribution strategy')\n  }),\n  execute: async ({ topology, maxAgents, strategy }, { onProgress, auth }) => {\n    try {\n      // Security: Defense in depth - validate even though Zod should have validated\n      if (!VALID_TOPOLOGIES.has(topology)) {\n        throw new Error(`Invalid topology: ${topology}`);\n      }\n      if (!VALID_STRATEGIES.has(strategy)) {\n        throw new Error(`Invalid strategy: ${strategy}`);\n      }\n\n      // Security: Sanitize and bound maxAgents\n      const safeMaxAgents = Math.min(\n        Math.max(1, Math.floor(Number(maxAgents) || 8)),\n        MAX_AGENTS_LIMIT\n      );\n\n      // Security: Use spawnSync with argument array to prevent command injection\n      const args = [\n        'claude-flow@alpha',\n        'swarm',\n        'init',\n        '--topology', topology,\n        '--max-agents', String(safeMaxAgents),\n        '--strategy', strategy\n      ];\n\n      const result = spawnSync('npx', args, {\n        encoding: 'utf-8',\n        maxBuffer: 10 * 1024 * 1024,\n        timeout: 60000\n      });\n\n      if (result.error) {\n        throw result.error;\n      }\n\n      if (result.status !== 0) {\n        throw new Error(result.stderr || 'Command failed');\n      }\n\n      return {\n        success: true,\n        topology,\n        maxAgents: safeMaxAgents,\n        strategy,\n        result: (result.stdout || '').trim(),\n        userId: auth?.userId,\n        timestamp: new Date().toISOString()\n      };\n    } catch (error: any) {\n      // Security: Don't expose internal error details to clients\n      throw new Error('Failed to initialize swarm. Check server logs for details.');\n    }\n  }\n};\n"]}

package/dist/mcp/fastmcp/tools/swarm/orchestrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrate.d.ts","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/swarm/orchestrate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,eAAO,MAAM,mBAAmB,EAAE,cA4CjC,CAAC"}
+{"version":3,"file":"orchestrate.d.ts","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/swarm/orchestrate.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,eAAO,MAAM,mBAAmB,EAAE,cA8CjC,CAAC"}

package/dist/mcp/fastmcp/tools/swarm/orchestrate.js

@@ -1,6 +1,7 @@
+/* eslint-disable @typescript-eslint/no-explicit-any -- pre-existing catch(error: any) handlers; outside scope of CWE-78 fix */
 // Task orchestration tool implementation using FastMCP
 import { z } from 'zod';
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 export const taskOrchestrateTool = {
     name: 'task_orchestrate',
     description: 'Orchestrate a complex task across the swarm',
@@ -21,11 +22,14 @@ export const taskOrchestrateTool = {
             .optional()
             .describe('Maximum agents to use for this task')
     }),
-    execute: async ({ task, strategy, priority, maxAgents }, { onProgress, auth }) => {
+    execute: async ({ task, strategy, priority, maxAgents }, { onProgress: _onProgress, auth }) => {
         try {
-            const maxStr = maxAgents ? ` --max-agents ${maxAgents}` : '';
-            const cmd = `npx claude-flow@alpha task orchestrate "${task}" --strategy ${strategy} --priority ${priority}${maxStr}`;
-            const result = execSync(cmd, {
+            // Security (CWE-78): use execFileSync with argv array; `task` is attacker-influenceable.
+            const args = ['claude-flow@alpha', 'task', 'orchestrate', task, '--strategy', strategy, '--priority', priority];
+            if (maxAgents)
+                args.push('--max-agents', String(maxAgents));
+            const result = execFileSync('npx', args, {
+                shell: false,
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024
             });

package/dist/mcp/fastmcp/tools/swarm/orchestrate.js.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrate.js","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/swarm/orchestrate.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGzC,MAAM,CAAC,MAAM,mBAAmB,GAAmB;IACjD,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,6CAA6C;IAC1D,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;aACb,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,kCAAkC,CAAC;QAC/C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;aACrD,QAAQ,EAAE;aACV,OAAO,CAAC,UAAU,CAAC;aACnB,QAAQ,CAAC,oBAAoB,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;aACpD,QAAQ,EAAE;aACV,OAAO,CAAC,QAAQ,CAAC;aACjB,QAAQ,CAAC,eAAe,CAAC;QAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;aAClB,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,QAAQ,CAAC,qCAAqC,CAAC;KACnD,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;QAC/E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,2CAA2C,IAAI,gBAAgB,QAAQ,eAAe,QAAQ,GAAG,MAAM,EAAE,CAAC;YAEtH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE;gBAC3B,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;aAC5B,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI;gBACJ,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,MAAM,EAAE,IAAI,EAAE,MAAM;gBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;CACF,CAAC","sourcesContent":["// Task orchestration tool implementation using FastMCP\nimport { z } from 'zod';\nimport { execSync } from 'child_process';\nimport type { ToolDefinition } from '../../types/index.js';\n\nexport const taskOrchestrateTool: ToolDefinition = {\n  name: 'task_orchestrate',\n  description: 'Orchestrate a complex task across the swarm',\n  parameters: z.object({\n    task: z.string()\n      .min(1)\n      .describe('Task description or instructions'),\n    strategy: z.enum(['parallel', 'sequential', 'adaptive'])\n      .optional()\n      .default('adaptive')\n      .describe('Execution strategy'),\n    priority: z.enum(['low', 'medium', 'high', 'critical'])\n      .optional()\n      .default('medium')\n      .describe('Task priority'),\n    maxAgents: z.number()\n      .positive()\n      .optional()\n      .describe('Maximum agents to use for this task')\n  }),\n  execute: async ({ task, strategy, priority, maxAgents }, { onProgress, auth }) => {\n    try {\n      const maxStr = maxAgents ? ` --max-agents ${maxAgents}` : '';\n      const cmd = `npx claude-flow@alpha task orchestrate \"${task}\" --strategy ${strategy} --priority ${priority}${maxStr}`;\n\n      const result = execSync(cmd, {\n        encoding: 'utf-8',\n        maxBuffer: 10 * 1024 * 1024\n      });\n\n      return {\n        success: true,\n        task,\n        strategy,\n        priority,\n        maxAgents,\n        result: result.trim(),\n        userId: auth?.userId,\n        timestamp: new Date().toISOString()\n      };\n    } catch (error: any) {\n      throw new Error(`Failed to orchestrate task: ${error.message}`);\n    }\n  }\n};\n"]}
+{"version":3,"file":"orchestrate.js","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/swarm/orchestrate.ts"],"names":[],"mappings":"AAAA,+HAA+H;AAC/H,uDAAuD;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,MAAM,CAAC,MAAM,mBAAmB,GAAmB;IACjD,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,6CAA6C;IAC1D,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;aACb,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,kCAAkC,CAAC;QAC/C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;aACrD,QAAQ,EAAE;aACV,OAAO,CAAC,UAAU,CAAC;aACnB,QAAQ,CAAC,oBAAoB,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;aACpD,QAAQ,EAAE;aACV,OAAO,CAAC,QAAQ,CAAC;aACjB,QAAQ,CAAC,eAAe,CAAC;QAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;aAClB,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,QAAQ,CAAC,qCAAqC,CAAC;KACnD,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE;QAC5F,IAAI,CAAC;YACH,yFAAyF;YACzF,MAAM,IAAI,GAAa,CAAC,mBAAmB,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC1H,IAAI,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAE5D,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;aAC5B,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI;gBACJ,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,MAAM,EAAE,IAAI,EAAE,MAAM;gBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;CACF,CAAC","sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any -- pre-existing catch(error: any) handlers; outside scope of CWE-78 fix */\n// Task orchestration tool implementation using FastMCP\nimport { z } from 'zod';\nimport { execFileSync } from 'child_process';\nimport type { ToolDefinition } from '../../types/index.js';\n\nexport const taskOrchestrateTool: ToolDefinition = {\n  name: 'task_orchestrate',\n  description: 'Orchestrate a complex task across the swarm',\n  parameters: z.object({\n    task: z.string()\n      .min(1)\n      .describe('Task description or instructions'),\n    strategy: z.enum(['parallel', 'sequential', 'adaptive'])\n      .optional()\n      .default('adaptive')\n      .describe('Execution strategy'),\n    priority: z.enum(['low', 'medium', 'high', 'critical'])\n      .optional()\n      .default('medium')\n      .describe('Task priority'),\n    maxAgents: z.number()\n      .positive()\n      .optional()\n      .describe('Maximum agents to use for this task')\n  }),\n  execute: async ({ task, strategy, priority, maxAgents }, { onProgress: _onProgress, auth }) => {\n    try {\n      // Security (CWE-78): use execFileSync with argv array; `task` is attacker-influenceable.\n      const args: string[] = ['claude-flow@alpha', 'task', 'orchestrate', task, '--strategy', strategy, '--priority', priority];\n      if (maxAgents) args.push('--max-agents', String(maxAgents));\n\n      const result = execFileSync('npx', args, {\n        shell: false,\n        encoding: 'utf-8',\n        maxBuffer: 10 * 1024 * 1024\n      });\n\n      return {\n        success: true,\n        task,\n        strategy,\n        priority,\n        maxAgents,\n        result: result.trim(),\n        userId: auth?.userId,\n        timestamp: new Date().toISOString()\n      };\n    } catch (error: any) {\n      throw new Error(`Failed to orchestrate task: ${error.message}`);\n    }\n  }\n};\n"]}

package/dist/mcp/fastmcp/tools/swarm/spawn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn.d.ts","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/swarm/spawn.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,eAAO,MAAM,cAAc,EAAE,cA0D5B,CAAC"}
+{"version":3,"file":"spawn.d.ts","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/swarm/spawn.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAkB3D,eAAO,MAAM,cAAc,EAAE,cAmE5B,CAAC"}

package/dist/mcp/fastmcp/tools/swarm/spawn.js

@@ -1,8 +1,19 @@
 // Agent spawn tool implementation using FastMCP
-// SECURITY: Fixed command injection vulnerability (HIGH-001, CVSS 9.8)
-// Changed from execSync (shell interpolation) to execFileSync (argument array)
 import { z } from 'zod';
-import { execFileSync } from 'child_process';
+import { spawnSync } from 'child_process';
+// Security: Validate input to prevent command injection
+function sanitizeInput(input) {
+    // Remove any shell metacharacters
+    return input.replace(/[;&|`$(){}[\]<>\\'"!#*?~\n\r]/g, '');
+}
+function validateCapability(cap) {
+    // Only allow alphanumeric, hyphens, and underscores
+    return /^[a-zA-Z0-9_-]+$/.test(cap);
+}
+function validateName(name) {
+    // Only allow alphanumeric, hyphens, underscores, and dots (max 64 chars)
+    return /^[a-zA-Z0-9_.-]{1,64}$/.test(name);
+}
 export const agentSpawnTool = {
     name: 'agent_spawn',
     description: 'Spawn a new agent in the swarm',
@@ -13,49 +24,56 @@ export const agentSpawnTool = {
             .optional()
             .describe('Agent capabilities'),
         name: z.string()
-            .regex(/^[a-zA-Z0-9_-]+$/, 'Name must be alphanumeric with dashes/underscores only')
-            .min(1)
-            .max(50)
             .optional()
-            .describe('Custom agent name (alphanumeric, dashes, underscores only)')
+            .describe('Custom agent name')
     }),
     execute: async ({ type, capabilities, name }, { onProgress, auth }) => {
         try {
-            // SECURITY: Build argument array instead of command string
+            // Security: Build command using argument array to prevent injection
             const args = ['claude-flow@alpha', 'agent', 'spawn', '--type', type];
-            // SECURITY: Validate each capability before passing to command
+            // Validate and add capabilities
             if (capabilities && capabilities.length > 0) {
-                capabilities.forEach(cap => {
-                    if (!/^[a-zA-Z0-9_-]+$/.test(cap)) {
-                        throw new Error(`Invalid capability format: ${cap}. Only alphanumeric, dashes, and underscores allowed.`);
-                    }
-                });
-                args.push('--capabilities', capabilities.join(','));
+                const validCaps = capabilities.filter(validateCapability);
+                if (validCaps.length !== capabilities.length) {
+                    throw new Error('Invalid capability format. Only alphanumeric, hyphens, and underscores allowed.');
+                }
+                args.push('--capabilities', validCaps.join(','));
             }
+            // Validate and add name
             if (name) {
-                // Name already validated by Zod schema regex
+                if (!validateName(name)) {
+                    throw new Error('Invalid agent name. Only alphanumeric, hyphens, underscores, and dots allowed (max 64 chars).');
+                }
                 args.push('--name', name);
             }
-            // SECURITY: Use execFileSync with argument array, shell disabled
-            // This prevents command injection by not interpreting shell metacharacters
-            const result = execFileSync('npx', args, {
+            // Security: Use spawnSync with argument array instead of string interpolation
+            const result = spawnSync('npx', args, {
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024,
-                timeout: 60000,
-                shell: false // CRITICAL: Disable shell interpretation
+                timeout: 60000
             });
+            if (result.error) {
+                throw result.error;
+            }
+            if (result.status !== 0) {
+                throw new Error(result.stderr || 'Command failed');
+            }
             return {
                 success: true,
                 type,
                 capabilities,
                 name,
-                result: result.trim(),
+                result: (result.stdout || '').trim(),
                 userId: auth?.userId,
                 timestamp: new Date().toISOString()
             };
         }
         catch (error) {
-            throw new Error(`Failed to spawn agent: ${error.message}`);
+            // Security: Don't expose internal error details
+            const safeMessage = error.message?.includes('Invalid')
+                ? error.message
+                : 'Failed to spawn agent. Check server logs for details.';
+            throw new Error(safeMessage);
         }
     }
 };

package/dist/mcp/fastmcp/tools/swarm/spawn.js.map

@@ -1 +1 @@
-{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/swarm/spawn.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,uEAAuE;AACvE,+EAA+E;AAC/E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,gCAAgC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;aACzE,QAAQ,CAAC,YAAY,CAAC;QACzB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aAC9B,QAAQ,EAAE;aACV,QAAQ,CAAC,oBAAoB,CAAC;QACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;aACb,KAAK,CAAC,kBAAkB,EAAE,wDAAwD,CAAC;aACnF,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,CAAC;aACP,QAAQ,EAAE;aACV,QAAQ,CAAC,4DAA4D,CAAC;KAC1E,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;QACpE,IAAI,CAAC;YACH,2DAA2D;YAC3D,MAAM,IAAI,GAAG,CAAC,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAErE,+DAA+D;YAC/D,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;oBACzB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;wBAClC,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,uDAAuD,CAAC,CAAC;oBAC5G,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,IAAI,EAAE,CAAC;gBACT,6CAA6C;gBAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC;YAED,iEAAiE;YACjE,2EAA2E;YAC3E,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;gBACvC,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;gBAC3B,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,CAAC,yCAAyC;aACvD,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI;gBACJ,YAAY;gBACZ,IAAI;gBACJ,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,MAAM,EAAE,IAAI,EAAE,MAAM;gBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;CACF,CAAC","sourcesContent":["// Agent spawn tool implementation using FastMCP\n// SECURITY: Fixed command injection vulnerability (HIGH-001, CVSS 9.8)\n// Changed from execSync (shell interpolation) to execFileSync (argument array)\nimport { z } from 'zod';\nimport { execFileSync } from 'child_process';\nimport type { ToolDefinition } from '../../types/index.js';\n\nexport const agentSpawnTool: ToolDefinition = {\n  name: 'agent_spawn',\n  description: 'Spawn a new agent in the swarm',\n  parameters: z.object({\n    type: z.enum(['researcher', 'coder', 'analyst', 'optimizer', 'coordinator'])\n      .describe('Agent type'),\n    capabilities: z.array(z.string())\n      .optional()\n      .describe('Agent capabilities'),\n    name: z.string()\n      .regex(/^[a-zA-Z0-9_-]+$/, 'Name must be alphanumeric with dashes/underscores only')\n      .min(1)\n      .max(50)\n      .optional()\n      .describe('Custom agent name (alphanumeric, dashes, underscores only)')\n  }),\n  execute: async ({ type, capabilities, name }, { onProgress, auth }) => {\n    try {\n      // SECURITY: Build argument array instead of command string\n      const args = ['claude-flow@alpha', 'agent', 'spawn', '--type', type];\n\n      // SECURITY: Validate each capability before passing to command\n      if (capabilities && capabilities.length > 0) {\n        capabilities.forEach(cap => {\n          if (!/^[a-zA-Z0-9_-]+$/.test(cap)) {\n            throw new Error(`Invalid capability format: ${cap}. Only alphanumeric, dashes, and underscores allowed.`);\n          }\n        });\n        args.push('--capabilities', capabilities.join(','));\n      }\n\n      if (name) {\n        // Name already validated by Zod schema regex\n        args.push('--name', name);\n      }\n\n      // SECURITY: Use execFileSync with argument array, shell disabled\n      // This prevents command injection by not interpreting shell metacharacters\n      const result = execFileSync('npx', args, {\n        encoding: 'utf-8',\n        maxBuffer: 10 * 1024 * 1024,\n        timeout: 60000,\n        shell: false // CRITICAL: Disable shell interpretation\n      });\n\n      return {\n        success: true,\n        type,\n        capabilities,\n        name,\n        result: result.trim(),\n        userId: auth?.userId,\n        timestamp: new Date().toISOString()\n      };\n    } catch (error: any) {\n      throw new Error(`Failed to spawn agent: ${error.message}`);\n    }\n  }\n};\n"]}
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../../../../src/mcp/fastmcp/tools/swarm/spawn.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG1C,wDAAwD;AACxD,SAAS,aAAa,CAAC,KAAa;IAClC,kCAAkC;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,gCAAgC,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,oDAAoD;IACpD,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,yEAAyE;IACzE,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,gCAAgC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;aACzE,QAAQ,CAAC,YAAY,CAAC;QACzB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aAC9B,QAAQ,EAAE;aACV,QAAQ,CAAC,oBAAoB,CAAC;QACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;aACb,QAAQ,EAAE;aACV,QAAQ,CAAC,mBAAmB,CAAC;KACjC,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;QACpE,IAAI,CAAC;YACH,oEAAoE;YACpE,MAAM,IAAI,GAAG,CAAC,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAErE,gCAAgC;YAChC,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBAC1D,IAAI,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;oBAC7C,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;gBACrG,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACnD,CAAC;YAED,wBAAwB;YACxB,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;gBACnH,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC;YAED,8EAA8E;YAC9E,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBACpC,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;gBAC3B,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,MAAM,CAAC,KAAK,CAAC;YACrB,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;YACrD,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI;gBACJ,YAAY;gBACZ,IAAI;gBACJ,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBACpC,MAAM,EAAE,IAAI,EAAE,MAAM;gBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,gDAAgD;YAChD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC;gBACpD,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,uDAAuD,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF,CAAC","sourcesContent":["// Agent spawn tool implementation using FastMCP\nimport { z } from 'zod';\nimport { spawnSync } from 'child_process';\nimport type { ToolDefinition } from '../../types/index.js';\n\n// Security: Validate input to prevent command injection\nfunction sanitizeInput(input: string): string {\n  // Remove any shell metacharacters\n  return input.replace(/[;&|`$(){}[\\]<>\\\\'\"!#*?~\\n\\r]/g, '');\n}\n\nfunction validateCapability(cap: string): boolean {\n  // Only allow alphanumeric, hyphens, and underscores\n  return /^[a-zA-Z0-9_-]+$/.test(cap);\n}\n\nfunction validateName(name: string): boolean {\n  // Only allow alphanumeric, hyphens, underscores, and dots (max 64 chars)\n  return /^[a-zA-Z0-9_.-]{1,64}$/.test(name);\n}\n\nexport const agentSpawnTool: ToolDefinition = {\n  name: 'agent_spawn',\n  description: 'Spawn a new agent in the swarm',\n  parameters: z.object({\n    type: z.enum(['researcher', 'coder', 'analyst', 'optimizer', 'coordinator'])\n      .describe('Agent type'),\n    capabilities: z.array(z.string())\n      .optional()\n      .describe('Agent capabilities'),\n    name: z.string()\n      .optional()\n      .describe('Custom agent name')\n  }),\n  execute: async ({ type, capabilities, name }, { onProgress, auth }) => {\n    try {\n      // Security: Build command using argument array to prevent injection\n      const args = ['claude-flow@alpha', 'agent', 'spawn', '--type', type];\n\n      // Validate and add capabilities\n      if (capabilities && capabilities.length > 0) {\n        const validCaps = capabilities.filter(validateCapability);\n        if (validCaps.length !== capabilities.length) {\n          throw new Error('Invalid capability format. Only alphanumeric, hyphens, and underscores allowed.');\n        }\n        args.push('--capabilities', validCaps.join(','));\n      }\n\n      // Validate and add name\n      if (name) {\n        if (!validateName(name)) {\n          throw new Error('Invalid agent name. Only alphanumeric, hyphens, underscores, and dots allowed (max 64 chars).');\n        }\n        args.push('--name', name);\n      }\n\n      // Security: Use spawnSync with argument array instead of string interpolation\n      const result = spawnSync('npx', args, {\n        encoding: 'utf-8',\n        maxBuffer: 10 * 1024 * 1024,\n        timeout: 60000\n      });\n\n      if (result.error) {\n        throw result.error;\n      }\n\n      if (result.status !== 0) {\n        throw new Error(result.stderr || 'Command failed');\n      }\n\n      return {\n        success: true,\n        type,\n        capabilities,\n        name,\n        result: (result.stdout || '').trim(),\n        userId: auth?.userId,\n        timestamp: new Date().toISOString()\n      };\n    } catch (error: any) {\n      // Security: Don't expose internal error details\n      const safeMessage = error.message?.includes('Invalid')\n        ? error.message\n        : 'Failed to spawn agent. Check server logs for details.';\n      throw new Error(safeMessage);\n    }\n  }\n};\n"]}

package/dist/mcp/mcp-policy.d.ts

@@ -0,0 +1,15 @@
+export type McpProfile = 'readonly' | 'retrieval' | 'learning' | 'admin';
+export declare function parseMcpProfile(value: string | undefined): McpProfile;
+export declare function isMcpToolAllowed(name: string, options: {
+    profile: McpProfile;
+    allowDarwinExecution?: boolean;
+}): boolean;
+export declare function installMcpPolicy<T extends {
+    addTool: (tool: {
+        name: string;
+    }) => unknown;
+}>(server: T, options: {
+    profile: McpProfile;
+    allowDarwinExecution?: boolean;
+}): T;
+//# sourceMappingURL=mcp-policy.d.ts.map

package/dist/mcp/mcp-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-policy.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-policy.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,OAAO,CAAC;AAWzE,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAMrE;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/D,OAAO,CAQT;AAED,wBAAgB,gBAAgB,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAA;CAAE,EACzF,MAAM,EAAE,CAAC,EACT,OAAO,EAAE;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/D,CAAC,CAOH"}

package/dist/mcp/mcp-policy.js

@@ -0,0 +1,35 @@
+const READONLY = [
+    /^agentic_flow_(list|list_all|agent_info|check_conflicts)/,
+    /^agentdb_(stats|pattern_search|pattern_stats)$/,
+    /^harness_(capabilities|manifest|verify)$/,
+    /_(stats|get_profile|list_profiles|benchmark)$/,
+];
+const RETRIEVAL = [...READONLY, /search$/, /context$/];
+const LEARNING = [...RETRIEVAL, /^agentic_flow_agent$/, /^agentdb_pattern_store$/, /^sona_/];
+export function parseMcpProfile(value) {
+    const profile = value ?? 'readonly';
+    if (!['readonly', 'retrieval', 'learning', 'admin'].includes(profile)) {
+        throw new Error(`invalid MCP profile: ${profile}`);
+    }
+    return profile;
+}
+export function isMcpToolAllowed(name, options) {
+    if (name === 'harness_repair') {
+        return options.profile === 'admin' && options.allowDarwinExecution === true;
+    }
+    if (options.profile === 'admin')
+        return true;
+    const rules = options.profile === 'learning' ? LEARNING :
+        options.profile === 'retrieval' ? RETRIEVAL : READONLY;
+    return rules.some((rule) => rule.test(name));
+}
+export function installMcpPolicy(server, options) {
+    const addTool = server.addTool.bind(server);
+    server.addTool = ((tool) => {
+        if (isMcpToolAllowed(tool.name, options))
+            return addTool(tool);
+        return undefined;
+    });
+    return server;
+}
+//# sourceMappingURL=mcp-policy.js.map

package/dist/mcp/mcp-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-policy.js","sourceRoot":"","sources":["../../src/mcp/mcp-policy.ts"],"names":[],"mappings":"AAEA,MAAM,QAAQ,GAAG;IACf,0DAA0D;IAC1D,gDAAgD;IAChD,0CAA0C;IAC1C,+CAA+C;CAChD,CAAC;AACF,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AACvD,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,QAAQ,CAAC,CAAC;AAE7F,MAAM,UAAU,eAAe,CAAC,KAAyB;IACvD,MAAM,OAAO,GAAG,KAAK,IAAI,UAAU,CAAC;IACpC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,OAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,OAAgE;IAEhE,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvD,OAAO,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,MAAS,EACT,OAAgE;IAEhE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,IAAsB,EAAE,EAAE;QAC3C,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC,CAAiB,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["export type McpProfile = 'readonly' | 'retrieval' | 'learning' | 'admin';\n\nconst READONLY = [\n  /^agentic_flow_(list|list_all|agent_info|check_conflicts)/,\n  /^agentdb_(stats|pattern_search|pattern_stats)$/,\n  /^harness_(capabilities|manifest|verify)$/,\n  /_(stats|get_profile|list_profiles|benchmark)$/,\n];\nconst RETRIEVAL = [...READONLY, /search$/, /context$/];\nconst LEARNING = [...RETRIEVAL, /^agentic_flow_agent$/, /^agentdb_pattern_store$/, /^sona_/];\n\nexport function parseMcpProfile(value: string | undefined): McpProfile {\n  const profile = value ?? 'readonly';\n  if (!['readonly', 'retrieval', 'learning', 'admin'].includes(profile)) {\n    throw new Error(`invalid MCP profile: ${profile}`);\n  }\n  return profile as McpProfile;\n}\n\nexport function isMcpToolAllowed(\n  name: string,\n  options: { profile: McpProfile; allowDarwinExecution?: boolean },\n): boolean {\n  if (name === 'harness_repair') {\n    return options.profile === 'admin' && options.allowDarwinExecution === true;\n  }\n  if (options.profile === 'admin') return true;\n  const rules = options.profile === 'learning' ? LEARNING :\n    options.profile === 'retrieval' ? RETRIEVAL : READONLY;\n  return rules.some((rule) => rule.test(name));\n}\n\nexport function installMcpPolicy<T extends { addTool: (tool: { name: string }) => unknown }>(\n  server: T,\n  options: { profile: McpProfile; allowDarwinExecution?: boolean },\n): T {\n  const addTool = server.addTool.bind(server);\n  server.addTool = ((tool: { name: string }) => {\n    if (isMcpToolAllowed(tool.name, options)) return addTool(tool);\n    return undefined;\n  }) as T['addTool'];\n  return server;\n}\n"]}