claude-flow-novice 2.15.2 → 2.15.4

package/scripts/verify-no-secrets.sh

@@ -1,55 +1,108 @@
 #!/bin/bash
-# Verify npm package contains no secrets before publishing
+#
+# Pre-Publish Security Verification: Detect Hardcoded Secrets
+# Version: 1.0.0 - CVSS 9.0 Critical Vulnerability Prevention
+#
+# This script prevents publishing npm packages with hardcoded credentials.
+#
+# Used by: npm run prepublishOnly
+# Exit Codes: 0 = safe, 1 = secrets detected
+#
 
-set -e
+set -euo pipefail
 
-echo "🔍 Scanning npm package for secrets..."
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+FOUND_SECRETS=0
+
+echo -e "${YELLOW}[SECURITY] Scanning npm package for hardcoded secrets...${NC}"
 
 # Get list of files that would be included (without actually packing)
 PACKAGE_FILES=$(npm pack --dry-run 2>&1 | grep -E '^[0-9.]+[kKMG]?B?\s+' | awk '{print $2}' || true)
 
-# Check for sensitive file patterns
-if echo "$PACKAGE_FILES" | grep -E '\.(env|key|pem|secrets|credentials)$' > /dev/null 2>&1; then
-  echo "❌ ERROR: Sensitive files detected in package:"
-  echo "$PACKAGE_FILES" | grep -E '\.(env|key|pem|secrets|credentials)$'
-  exit 1
+# Check for sensitive file patterns that should NEVER be published
+if echo "$PACKAGE_FILES" | grep -E '\.(env|key|pem|secrets|credentials|pass|pwd)$' > /dev/null 2>&1; then
+  echo -e "${RED}[ERROR] Sensitive files detected in package:${NC}"
+  echo "$PACKAGE_FILES" | grep -E '\.(env|key|pem|secrets|credentials|pass|pwd)$'
+  FOUND_SECRETS=1
 fi
 
 # Check for .claude/api-configs directory
 if echo "$PACKAGE_FILES" | grep -q '.claude/api-configs' 2>/dev/null; then
-  echo "❌ ERROR: API config directory included in package"
-  exit 1
+  echo -e "${RED}[ERROR] API config directory included in package${NC}"
+  FOUND_SECRETS=1
 fi
 
-# Check actual file contents for secret patterns
-# Use dist/ and .claude/ directories since those are included in package
-SECRET_PATTERNS='(ANTHROPIC_API_KEY|ZAI_API_KEY|NPM_API_KEY|REDIS_PASSWORD)=[A-Za-z0-9_-]{20,}'
-KEY_PATTERNS='(sk-ant-api03-[A-Za-z0-9_-]{95}|npm_[A-Za-z0-9]{36})'
+# Expanded secret patterns (CVSS 9.0 critical fixes)
+SECRET_PATTERNS=(
+  # Anthropic keys
+  "sk-ant-v1-[a-zA-Z0-9_-]{50,}"
+
+  # Environment variable assignments with secrets
+  "(ANTHROPIC_API_KEY|ZAI_API_KEY|NPM_API_KEY|REDIS_PASSWORD|POSTGRES_PASSWORD|JWT_SECRET|SESSION_SECRET)=[A-Za-z0-9_-/+]{20,}"
+
+  # AWS keys
+  "AKIA[0-9A-Z]{16}"
+  "aws_secret_access_key"
+
+  # Database credentials
+  "(postgres|mysql|mongo).*password.*[a-zA-Z0-9!@#$]{8,}"
 
+  # Bearer tokens
+  "Bearer\s+[a-zA-Z0-9_.-]{20,}"
+
+  # Private keys
+  "-----BEGIN.*PRIVATE KEY"
+)
+
+# Check actual file contents for secret patterns
 if [ -d "dist" ]; then
-  if grep -r -E "$SECRET_PATTERNS" dist/ 2>/dev/null; then
-    echo "❌ ERROR: API key environment variables detected in dist/"
-    exit 1
-  fi
-
-  if grep -r -E "$KEY_PATTERNS" dist/ 2>/dev/null; then
-    echo "❌ ERROR: Live API keys detected in dist/"
-    exit 1
-  fi
+  echo "Scanning dist/ directory..."
+  for pattern in "${SECRET_PATTERNS[@]}"; do
+    if grep -r -E "$pattern" dist/ 2>/dev/null || true | grep -q .; then
+      echo -e "${RED}[ERROR] Secret pattern detected in dist/: $pattern${NC}"
+      FOUND_SECRETS=1
+    fi
+  done
 fi
 
 if [ -d ".claude" ]; then
-  # Check .claude directory (excluding known safe locations)
-  if grep -r -E "$SECRET_PATTERNS" .claude/ --exclude-dir=legacy 2>/dev/null; then
-    echo "❌ ERROR: API key environment variables detected in .claude/"
-    exit 1
-  fi
-
-  if grep -r -E "$KEY_PATTERNS" .claude/ --exclude-dir=legacy 2>/dev/null; then
-    echo "❌ ERROR: Live API keys detected in .claude/"
-    exit 1
-  fi
+  echo "Scanning .claude/ directory..."
+  for pattern in "${SECRET_PATTERNS[@]}"; do
+    if grep -r -E "$pattern" .claude/ --exclude-dir=legacy 2>/dev/null || true | grep -q .; then
+      echo -e "${RED}[ERROR] Secret pattern detected in .claude/: $pattern${NC}"
+      FOUND_SECRETS=1
+    fi
+  done
 fi
 
-echo "✅ No secrets detected in package"
-exit 0
+if [ -d "src" ]; then
+  echo "Scanning src/ directory..."
+  for pattern in "${SECRET_PATTERNS[@]}"; do
+    if grep -r -E "$pattern" src/ 2>/dev/null || true | grep -q .; then
+      echo -e "${RED}[ERROR] Secret pattern detected in src/: $pattern${NC}"
+      FOUND_SECRETS=1
+    fi
+  done
+fi
+
+# Final status
+echo ""
+if [ $FOUND_SECRETS -eq 0 ]; then
+  echo -e "${GREEN}[SUCCESS] No secrets detected in package. Safe to publish.${NC}"
+  exit 0
+else
+  echo -e "${RED}[ERROR] Hardcoded secrets detected. Publishing blocked.${NC}"
+  echo ""
+  echo "How to fix:"
+  echo "1. Review flagged patterns above"
+  echo "2. Replace hardcoded values with process.env.VARIABLE_NAME"
+  echo "3. Add documentation to README or docs/CREDENTIAL_MANAGEMENT.md"
+  echo "4. Run npm run prepublishOnly again to verify"
+  echo ""
+  echo "Reference: docs/CREDENTIAL_MANAGEMENT.md"
+  exit 1
+fi

package/.claude/cfn-extras/agents/deprecated-coordinators/adaptive-coordinator.md.backup

@@ -1,161 +0,0 @@
----
-name: adaptive-coordinator-optimized
-type: coordinator
-color: "#9C27B0"
-description: Dynamic topology switching coordinator with self-organizing swarm patterns and real-time optimization. Optimized for CLI/Redis/SQLite coordination with enhanced consensus building and evidence chain validation.
-tools: [Read, Write, Edit, Bash, Task, SlashCommand, TodoWrite]
-model: sonnet
-acl_level: 3
-capabilities:
-  - topology_adaptation
-  - performance_optimization
-  - real_time_reconfiguration
-  - pattern_recognition
-  - predictive_scaling
-  - intelligent_routing
-  - consensus_building
-  - evidence_coordination
-priority: critical
-coordination_role: coordinator
-mode_support: [mvp, standard, enterprise]
-
-### Include common templates
-{{> redis-coordination.md}}
-{{> memory-operations.md}}
-{{> post-edit-validation.md}}
-{{> cfn-loop-mechanics.md}}
-{{> team-dynamics.md}}
-
-## Adaptive Swarm Coordinator
-
-### Team Role Awareness
-
-- **Specialty:** Adaptive topology coordination
-- **Authority Level:** High (Dynamic Coordinator)
-- **Solo Confidence:** ≥0.85
-- **Team Confidence:** ≥0.80
-
-### Topology Adaptation Strategies
-
-#### Mode-Specific Thresholds
-
-| Mode | Consensus | Complexity | Evidence Level |
-|------|-----------|------------|----------------|
-| MVP | 0.70 | Basic | Minimal |
-| Standard | 0.75 | Moderate | Adequate |
-| Enterprise | 0.85 | Advanced | Comprehensive |
-
-### Dynamic Topology Optimization
-
-```typescript
-class TopologyAdaptationEngine {
-  async optimizeSwarmTopology(currentMetrics): Promise<AdaptationResult> {
-    // 1. Analyze current performance
-    const adaptationNeeds = this.analyzeAdaptationNeeds(currentMetrics);
-
-    // Exit early if no adaptation required
-    if (!adaptationNeeds.requiresAdaptation) {
-      return { adapted: false, reason: 'Optimal performance' };
-    }
-
-    // 2. Generate adaptation options
-    const adaptationOptions = this.generateAdaptationOptions(adaptationNeeds);
-
-    // 3. Build evidence chain for validation
-    const evidenceChains = await this.buildEvidenceChains(adaptationOptions);
-
-    // 4. Select best adaptation option
-    const selectedOption = this.selectBestAdaptation(
-      adaptationOptions,
-      evidenceChains
-    );
-
-    // 5. Build consensus
-    const consensusResult = await this.buildConsensus(
-      selectedOption,
-      evidenceChains
-    );
-
-    // 6. Execute adaptation if consensus achieved
-    return consensusResult.achieved
-      ? this.executeAdaptation(selectedOption)
-      : { adapted: false, reason: 'Consensus not achieved' };
-  }
-}
-```
-
-### Consensus Building Pattern
-
-```javascript
-async function buildAdaptiveConsensus(adaptationProposal) {
-  const participants = determineParticipants(adaptationProposal);
-  const consensusResult = await signals.buildConsensus({
-    type: 'topology_change',
-    participants,
-    threshold: getThresholdByMode(mode),
-    evidenceChainRequired: true
-  });
-
-  return {
-    achieved: consensusResult.consensus >= consensusThreshold,
-    confidence: consensusResult.confidence,
-    adaptationDecision: adaptationProposal
-  };
-}
-```
-
-### Redis Coordination
-
-```javascript
-// Publish topology adaptation event
-await redis.publish('swarm:topology:adaptation', JSON.stringify({
-  coordinatorId: process.env.AGENT_ID,
-  swarmId: process.env.SWARM_ID,
-  adaptation: {
-    from: currentTopology,
-    to: targetTopology,
-    confidence: 0.87,
-    reason: 'Performance optimization'
-  }
-}));
-```
-
-### Performance Metrics Tracking
-
-```sql
-CREATE TABLE swarm_coordination_metrics (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  topology_type TEXT,
-  adaptation_count INTEGER,
-  consensus_rate REAL,
-  performance_improvement REAL,
-  timestamp DATETIME DEFAULT CURRENT_TIMESTAMP
-);
-```
-
-### Fault Tolerance Strategies
-
-1. Detect topology performance degradation
-2. Generate multiple adaptation options
-3. Build cross-validator evidence chain
-4. Achieve consensus before adaptation
-5. Execute adaptation with minimal disruption
-6. Monitor and rollback if performance drops
-
-### Post-Edit Validation
-
-```bash
-# Always run comprehensive validation
-/hooks post-edit [FILE_PATH] \
-  --memory-key "adaptive-coordinator/optimization" \
-  --structured
-```
-
-## Confidence and Quality Gates
-
-- **Minimal Confidence**: 0.75 (basic adaptation)
-- **Target Confidence**: 0.90 (advanced adaptation)
-- **Maximum Adaptation Attempts**: 3
-- **Fallback Strategy**: Revert to previous topology
-
-Remember: Successful adaptation requires balancing performance optimization with system stability, maintaining robust consensus mechanisms, and preserving overall system resilience.