agentic-flow 3.0.0-alpha.2 → 3.0.0

package/dist/mcp/standalone-stdio.js

@@ -1,9 +1,17 @@
 #!/usr/bin/env node
+/* eslint-disable @typescript-eslint/no-explicit-any -- pre-existing catch(error: any) handlers; outside scope of CWE-78 fix */
 // Standalone agentic-flow MCP server - runs directly via stdio without spawning subprocesses
 import { FastMCP } from 'fastmcp';
 import { z } from 'zod';
-import { execSync } from 'child_process';
-import { validateWritePath } from '../security/path-validator.js';
+import { execFileSync } from 'child_process';
+import { registerHarnessTools } from './tools/harness-tools.js';
+import { installMcpPolicy, parseMcpProfile } from './mcp-policy.js';
+import { assertCategoryPath, resolveInsideCwd } from '../utils/path-safety.js';
+// Security: All shell-outs use execFileSync with argv arrays (shell: false) to
+// prevent OS command injection via tool parameters (CWE-78). Do NOT reintroduce
+// execSync with template-string interpolation here — every prior occurrence in
+// this file was an injection sink reachable through MCP tool arguments.
+const NPX_EXEC_OPTS = { shell: false };
 // Suppress FastMCP internal warnings for cleaner output
 const originalConsoleWarn = console.warn;
 console.warn = (...args) => {
@@ -22,6 +30,15 @@ const server = new FastMCP({
     name: 'agentic-flow',
     version: '1.0.8'
 });
+const mcpProfile = parseMcpProfile(process.env.AGENTIC_FLOW_MCP_PROFILE);
+installMcpPolicy(server, {
+    profile: mcpProfile,
+    allowDarwinExecution: process.env.AGENTIC_FLOW_MCP_ENABLE_DARWIN === 'true',
+});
+console.error(`🔐 MCP capability profile: ${mcpProfile}`);
+// ADR-075: harness evolution/repair + provenance tools (harness_repair,
+// harness_manifest, harness_verify).
+registerHarnessTools(server);
 // Tool: Run agentic-flow agent
 server.addTool({
     name: 'agentic_flow_agent',
@@ -50,13 +67,14 @@ server.addTool({
     }),
     execute: async ({ agent, task, model, provider, anthropicApiKey, openrouterApiKey, stream, temperature, maxTokens, agentsDir, outputFormat, verbose, timeout, retryOnError }) => {
         try {
-            // Build command with all parameters
-            let cmd = `npx --yes agentic-flow --agent "${agent}" --task "${task}"`;
+            // Build argv (NOT a shell string) — every user-supplied value stays a
+            // separate argv element and cannot be reinterpreted by the shell.
+            const args = ['--yes', 'agentic-flow', '--agent', agent, '--task', task];
             // Provider & Model
             if (model)
-                cmd += ` --model "${model}"`;
+                args.push('--model', model);
             if (provider)
-                cmd += ` --provider ${provider}`;
+                args.push('--provider', provider);
             // API Keys (set as env vars)
             const env = { ...process.env };
             if (anthropicApiKey)
@@ -65,23 +83,24 @@ server.addTool({
                 env.OPENROUTER_API_KEY = openrouterApiKey;
             // Agent Behavior
             if (stream)
-                cmd += ' --stream';
+                args.push('--stream');
             if (temperature !== undefined)
-                cmd += ` --temperature ${temperature}`;
+                args.push('--temperature', String(temperature));
             if (maxTokens)
-                cmd += ` --max-tokens ${maxTokens}`;
+                args.push('--max-tokens', String(maxTokens));
             // Directories
             if (agentsDir)
-                cmd += ` --agents-dir "${agentsDir}"`;
+                args.push('--agents-dir', agentsDir);
             // Output
             if (outputFormat)
-                cmd += ` --output ${outputFormat}`;
+                args.push('--output', outputFormat);
             if (verbose)
-                cmd += ' --verbose';
+                args.push('--verbose');
             // Execution
             if (retryOnError)
-                cmd += ' --retry';
-            const result = execSync(cmd, {
+                args.push('--retry');
+            const result = execFileSync('npx', args, {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024,
                 timeout: timeout || 300000,
@@ -108,9 +127,8 @@ server.addTool({
     parameters: z.object({}),
     execute: async () => {
         try {
-            // Use npx to run agentic-flow from npm registry
-            const cmd = `npx --yes agentic-flow --list`;
-            const result = execSync(cmd, {
+            const result = execFileSync('npx', ['--yes', 'agentic-flow', '--list'], {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 5 * 1024 * 1024,
                 timeout: 30000
@@ -138,12 +156,20 @@ server.addTool({
     }),
     execute: async ({ name, description, systemPrompt, category, tools }) => {
         try {
-            let cmd = `npx --yes agentic-flow agent create --name "${name}" --description "${description}" --prompt "${systemPrompt}"`;
+            // The CLI turns category into a directory under .claude/agents
+            assertCategoryPath(category || 'custom');
+            const args = [
+                '--yes', 'agentic-flow', 'agent', 'create',
+                '--name', name,
+                '--description', description,
+                '--prompt', systemPrompt
+            ];
             if (category && category !== 'custom')
-                cmd += ` --category "${category}"`;
+                args.push('--category', category);
             if (tools && tools.length > 0)
-                cmd += ` --tools "${tools.join(',')}"`;
-            const result = execSync(cmd, {
+                args.push('--tools', tools.join(','));
+            const result = execFileSync('npx', args, {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024,
                 timeout: 60000,
@@ -172,8 +198,8 @@ server.addTool({
     }),
     execute: async ({ format, filterSource }) => {
         try {
-            const cmd = `npx --yes agentic-flow agent list ${format || 'summary'}`;
-            const result = execSync(cmd, {
+            const result = execFileSync('npx', ['--yes', 'agentic-flow', 'agent', 'list', format || 'summary'], {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024,
                 timeout: 30000
@@ -210,8 +236,8 @@ server.addTool({
     }),
     execute: async ({ name }) => {
         try {
-            const cmd = `npx --yes agentic-flow agent info "${name}"`;
-            const result = execSync(cmd, {
+            const result = execFileSync('npx', ['--yes', 'agentic-flow', 'agent', 'info', name], {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024,
                 timeout: 30000
@@ -234,8 +260,8 @@ server.addTool({
     parameters: z.object({}),
     execute: async () => {
         try {
-            const cmd = `npx --yes agentic-flow agent conflicts`;
-            const result = execSync(cmd, {
+            const result = execFileSync('npx', ['--yes', 'agentic-flow', 'agent', 'conflicts'], {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024,
                 timeout: 30000
@@ -262,16 +288,17 @@ server.addTool({
     }),
     execute: async ({ agent, task, priority, max_cost }) => {
         try {
-            let cmd = `npx --yes agentic-flow --agent "${agent}" --task "${task}" --optimize`;
+            const args = ['--yes', 'agentic-flow', '--agent', agent, '--task', task, '--optimize'];
             if (priority && priority !== 'balanced') {
-                cmd += ` --priority ${priority}`;
+                args.push('--priority', priority);
             }
             if (max_cost) {
-                cmd += ` --max-cost ${max_cost}`;
+                args.push('--max-cost', String(max_cost));
             }
             // Add dry-run to just get recommendation without execution
-            cmd += ' --help'; // This will show the optimization without running
-            const result = execSync(cmd, {
+            args.push('--help'); // This will show the optimization without running
+            execFileSync('npx', args, {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024,
                 timeout: 10000
@@ -308,11 +335,13 @@ server.addTool({
         try {
             const fs = await import('fs');
             const path = await import('path');
+            // Only files inside the working directory may be read or written
+            const safePath = resolveInsideCwd(target_filepath);
             // Read current file
-            if (!fs.existsSync(target_filepath)) {
+            if (!fs.existsSync(safePath)) {
                 throw new Error(`File not found: ${target_filepath}`);
             }
-            const originalCode = fs.readFileSync(target_filepath, 'utf-8');
+            const originalCode = fs.readFileSync(safePath, 'utf-8');
             // Detect language if not provided
             if (!language) {
                 const ext = path.extname(target_filepath).slice(1);
@@ -323,33 +352,18 @@ server.addTool({
                 };
                 language = langMap[ext] || 'javascript';
             }
-            // CVE-2026-003 FIX: Use spawnSync with array args to prevent command injection
-            const { spawnSync } = await import('child_process');
-            // Validate language parameter
-            const allowedLanguages = ['typescript', 'javascript', 'python', 'rust', 'go', 'java', 'c', 'cpp'];
-            if (!allowedLanguages.includes(language)) {
-                throw new Error(`Invalid language: ${language}. Must be one of: ${allowedLanguages.join(', ')}`);
-            }
-            const result = spawnSync('npx', ['--yes', 'agent-booster@0.2.2', 'apply', '--language', language], {
+            // Apply edit using agent-booster@0.2.2 CLI (automatically installs from npm if not available)
+            const result = execFileSync('npx', ['--yes', 'agent-booster@0.2.2', 'apply', '--language', language], {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 input: JSON.stringify({ code: originalCode, edit: code_edit }),
                 maxBuffer: 10 * 1024 * 1024,
-                timeout: 30000,
-                shell: false // Prevent shell injection
+                timeout: 30000 // Allow time for npx to download package on first run
             });
-            if (result.error) {
-                throw result.error;
-            }
-            if (result.status !== 0) {
-                throw new Error(`Agent Booster failed: ${result.stderr || result.stdout}`);
-            }
-            const resultStr = result.stdout;
-            const parsed = JSON.parse(resultStr);
+            const parsed = JSON.parse(result);
             if (parsed.success && parsed.confidence >= 0.7) {
                 // High confidence - use Agent Booster result
-                // CVE-2026-004 FIX: Validate write path
-                const safeWritePath = validateWritePath(target_filepath);
-                fs.writeFileSync(safeWritePath, parsed.output);
+                fs.writeFileSync(safePath, parsed.output);
                 return JSON.stringify({
                     success: true,
                     method: 'agent_booster',
@@ -404,22 +418,10 @@ server.addTool({
             const path = await import('path');
             const results = [];
             let totalLatency = 0;
-            for (const edit of edits) {
-                // CVE-2026-004 FIX: Validate file paths
-                let safePath;
-                try {
-                    safePath = validateWritePath(edit.target_filepath);
-                }
-                catch (error) {
-                    results.push({
-                        file: edit.target_filepath,
-                        success: false,
-                        confidence: '0%',
-                        latency_ms: 0,
-                        reason: `Path validation failed: ${error.message}`
-                    });
-                    continue;
-                }
+            // Validate every path before touching any file: all must be inside cwd
+            const safePaths = edits.map(edit => resolveInsideCwd(edit.target_filepath));
+            for (const [index, edit] of edits.entries()) {
+                const safePath = safePaths[index];
                 const originalCode = fs.existsSync(safePath)
                     ? fs.readFileSync(safePath, 'utf-8')
                     : '';
@@ -434,38 +436,15 @@ server.addTool({
                     };
                     language = langMap[ext] || 'javascript';
                 }
-                // CVE-2026-003 FIX: Use spawnSync with array args
-                const { spawnSync } = await import('child_process');
-                const allowedLanguages = ['typescript', 'javascript', 'python', 'rust', 'go', 'java', 'c', 'cpp'];
-                if (!allowedLanguages.includes(language)) {
-                    results.push({
-                        file: edit.target_filepath,
-                        success: false,
-                        confidence: '0%',
-                        latency_ms: 0,
-                        reason: `Invalid language: ${language}`
-                    });
-                    continue;
-                }
-                const result = spawnSync('npx', ['--yes', 'agent-booster@0.2.2', 'apply', '--language', language], {
+                // Apply edit
+                const result = execFileSync('npx', ['--yes', 'agent-booster@0.2.2', 'apply', '--language', language], {
+                    ...NPX_EXEC_OPTS,
                     encoding: 'utf-8',
                     input: JSON.stringify({ code: originalCode, edit: edit.code_edit }),
                     maxBuffer: 10 * 1024 * 1024,
-                    timeout: 5000,
-                    shell: false
+                    timeout: 5000
                 });
-                if (result.error || result.status !== 0) {
-                    results.push({
-                        file: edit.target_filepath,
-                        success: false,
-                        confidence: '0%',
-                        latency_ms: 0,
-                        reason: result.error?.message || result.stderr || 'Agent Booster failed'
-                    });
-                    continue;
-                }
-                const resultStr = result.stdout;
-                const parsed = JSON.parse(resultStr);
+                const parsed = JSON.parse(result);
                 totalLatency += parsed.latency;
                 if (parsed.success && parsed.confidence >= 0.7) {
                     fs.writeFileSync(safePath, parsed.output);
@@ -518,7 +497,7 @@ server.addTool({
             const edits = [];
             let match;
             while ((match = regex.exec(markdown)) !== null) {
-                const [_, language, filepath, instruction, code_edit] = match;
+                const [, language, filepath, instruction, code_edit] = match;
                 edits.push({
                     target_filepath: filepath.trim(),
                     instructions: instruction.trim(),
@@ -532,20 +511,10 @@ server.addTool({
             // Apply all edits using batch tool
             const results = [];
             let totalLatency = 0;
-            for (const edit of edits) {
-                // CVE-2026-004 FIX: Validate file paths
-                let safePath;
-                try {
-                    safePath = validateWritePath(edit.target_filepath);
-                }
-                catch (error) {
-                    results.push({
-                        file: edit.target_filepath,
-                        success: false,
-                        confidence: '0%'
-                    });
-                    continue;
-                }
+            // Validate every path before touching any file: all must be inside cwd
+            const safePaths = edits.map(edit => resolveInsideCwd(edit.target_filepath));
+            for (const [index, edit] of edits.entries()) {
+                const safePath = safePaths[index];
                 const originalCode = fs.existsSync(safePath)
                     ? fs.readFileSync(safePath, 'utf-8')
                     : '';
@@ -559,34 +528,14 @@ server.addTool({
                     };
                     language = langMap[ext] || 'javascript';
                 }
-                // CVE-2026-003 FIX: Use spawnSync with array args
-                const { spawnSync } = await import('child_process');
-                const allowedLanguages = ['typescript', 'javascript', 'python', 'rust', 'go', 'java', 'c', 'cpp'];
-                if (!allowedLanguages.includes(language)) {
-                    results.push({
-                        file: edit.target_filepath,
-                        success: false,
-                        confidence: '0%'
-                    });
-                    continue;
-                }
-                const result = spawnSync('npx', ['--yes', 'agent-booster@0.2.2', 'apply', '--language', language], {
+                const result = execFileSync('npx', ['--yes', 'agent-booster@0.2.2', 'apply', '--language', language], {
+                    ...NPX_EXEC_OPTS,
                     encoding: 'utf-8',
                     input: JSON.stringify({ code: originalCode, edit: edit.code_edit }),
                     maxBuffer: 10 * 1024 * 1024,
-                    timeout: 5000,
-                    shell: false
+                    timeout: 5000
                 });
-                if (result.error || result.status !== 0) {
-                    results.push({
-                        file: edit.target_filepath,
-                        success: false,
-                        confidence: '0%'
-                    });
-                    continue;
-                }
-                const resultStr = result.stdout;
-                const parsed = JSON.parse(resultStr);
+                const parsed = JSON.parse(result);
                 totalLatency += parsed.latency;
                 if (parsed.success && parsed.confidence >= 0.7) {
                     fs.writeFileSync(safePath, parsed.output);
@@ -630,8 +579,8 @@ server.addTool({
     parameters: z.object({}),
     execute: async () => {
         try {
-            const cmd = `npx agentdb db stats`;
-            const result = execSync(cmd, {
+            const result = execFileSync('npx', ['agentdb', 'db', 'stats'], {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 5 * 1024 * 1024,
                 timeout: 10000
@@ -664,24 +613,25 @@ server.addTool({
     }),
     execute: async ({ sessionId, task, reward, success, critique, input, output, latencyMs, tokensUsed }) => {
         try {
-            const args = [
+            const cliArgs = [
+                'agentdb', 'reflexion', 'store',
                 sessionId,
-                `"${task}"`,
+                task,
                 reward.toString(),
                 success.toString()
             ];
             if (critique)
-                args.push(`"${critique}"`);
+                cliArgs.push(critique);
             if (input)
-                args.push(`"${input}"`);
+                cliArgs.push(input);
             if (output)
-                args.push(`"${output}"`);
+                cliArgs.push(output);
             if (latencyMs !== undefined)
-                args.push(latencyMs.toString());
+                cliArgs.push(latencyMs.toString());
             if (tokensUsed !== undefined)
-                args.push(tokensUsed.toString());
-            const cmd = `npx agentdb reflexion store ${args.join(' ')}`;
-            const result = execSync(cmd, {
+                cliArgs.push(tokensUsed.toString());
+            const result = execFileSync('npx', cliArgs, {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024,
                 timeout: 30000
@@ -714,15 +664,15 @@ server.addTool({
     }),
     execute: async ({ task, k, minReward, onlySuccesses, onlyFailures }) => {
         try {
-            const args = [`"${task}"`, (k || 5).toString()];
+            const cliArgs = ['agentdb', 'reflexion', 'retrieve', task, (k || 5).toString()];
             if (minReward !== undefined)
-                args.push(minReward.toString());
+                cliArgs.push(minReward.toString());
             if (onlyFailures)
-                args.push('true', 'false');
+                cliArgs.push('true', 'false');
             else if (onlySuccesses)
-                args.push('false', 'true');
-            const cmd = `npx agentdb reflexion retrieve ${args.join(' ')}`;
-            const result = execSync(cmd, {
+                cliArgs.push('false', 'true');
+            const result = execFileSync('npx', cliArgs, {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024,
                 timeout: 30000
@@ -755,8 +705,8 @@ server.addTool({
     }),
     execute: async ({ task, k }) => {
         try {
-            const cmd = `npx agentdb reflexion critique-summary "${task}" ${k || 5}`;
-            const result = execSync(cmd, {
+            const result = execFileSync('npx', ['agentdb', 'reflexion', 'critique-summary', task, String(k || 5)], {
+                ...NPX_EXEC_OPTS,
                 encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024,
                 timeout: 30000