claude-flow-novice 2.15.3 → 2.15.4

package/claude-assets/skills/agent-lifecycle/execute-lifecycle-hook.sh

@@ -7,8 +7,11 @@
 set -euo pipefail
 
 # Configuration
-DB_PATH="${AGENT_LIFECYCLE_DB:-./agent-lifecycle.db}"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+DB_PATH="${AGENT_LIFECYCLE_DB:-./agent-lifecycle.db}"
+
+# Source parameterized query library for SQL injection prevention
+source "${SCRIPT_DIR}/../bootstrap/sqlite-params.sh"
 
 # Colors for output
 RED='\033[0;31m'
@@ -118,31 +121,19 @@ spawn_agent() {
 
     log_info "Registering agent spawn: $agent_id (type: $agent_type, ACL: $acl_level)"
 
-    sqlite3 "$DB_PATH" << EOF
-INSERT OR REPLACE INTO agents (
-    id, name, type, status, metadata, spawned_at, updated_at
-) VALUES (
-    '$agent_id',
-    '$agent_name',
-    '$agent_type',
-    'spawned',
-    '{"aclLevel": $acl_level, "spawnedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"}',
-    datetime('now'),
-    datetime('now')
-);
-EOF
+    # Use parameterized query for agent insertion
+    local spawn_timestamp
+    spawn_timestamp="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    local metadata_json="{\"aclLevel\": $acl_level, \"spawnedAt\": \"$spawn_timestamp\"}"
 
-    # Log spawn event
-    sqlite3 "$DB_PATH" << EOF
-INSERT INTO lifecycle_events (
-    agent_id, event_type, reasoning, timestamp
-) VALUES (
-    '$agent_id',
-    'spawn',
-    'Agent spawned via lifecycle hook',
-    datetime('now')
-);
-EOF
+    sqlite_upsert "$DB_PATH" \
+        "INSERT OR REPLACE INTO agents (id, name, type, status, metadata, spawned_at, updated_at) VALUES (?1, ?2, ?3, 'spawned', ?4, datetime('now'), datetime('now'))" \
+        "$agent_id" "$agent_name" "$agent_type" "$metadata_json"
+
+    # Log spawn event (parameterized query)
+    sqlite_insert "$DB_PATH" \
+        "INSERT INTO lifecycle_events (agent_id, event_type, reasoning, timestamp) VALUES (?1, 'spawn', 'Agent spawned via lifecycle hook', datetime('now'))" \
+        "$agent_id"
 
     log_success "Agent $agent_id registered successfully"
 }
@@ -160,27 +151,29 @@ update_confidence() {
 
     log_info "Updating confidence for agent $agent_id: $confidence"
 
-    # Update agent confidence
-    sqlite3 "$DB_PATH" << EOF
-UPDATE agents
-SET confidence = $confidence, updated_at = datetime('now')
-WHERE id = '$agent_id';
-EOF
-
-    # Log confidence update event
-    sqlite3 "$DB_PATH" << EOF
-INSERT INTO lifecycle_events (
-    agent_id, event_type, confidence, reasoning, phase, iteration, timestamp
-) VALUES (
-    '$agent_id',
-    'confidence_update',
-    $confidence,
-    '$reasoning',
-    ${phase:+"'${phase}'":NULL},
-    ${iteration:+$iteration},
-    datetime('now')
-);
-EOF
+    # Update agent confidence (parameterized query)
+    sqlite_update "$DB_PATH" \
+        "UPDATE agents SET confidence = ?1, updated_at = datetime('now') WHERE id = ?2" \
+        "$confidence" "$agent_id"
+
+    # Log confidence update event (parameterized query with optional fields)
+    if [[ -n "$phase" && -n "$iteration" ]]; then
+        sqlite_insert "$DB_PATH" \
+            "INSERT INTO lifecycle_events (agent_id, event_type, confidence, reasoning, phase, iteration, timestamp) VALUES (?1, 'confidence_update', ?2, ?3, ?4, ?5, datetime('now'))" \
+            "$agent_id" "$confidence" "$reasoning" "$phase" "$iteration"
+    elif [[ -n "$phase" ]]; then
+        sqlite_insert "$DB_PATH" \
+            "INSERT INTO lifecycle_events (agent_id, event_type, confidence, reasoning, phase, timestamp) VALUES (?1, 'confidence_update', ?2, ?3, ?4, datetime('now'))" \
+            "$agent_id" "$confidence" "$reasoning" "$phase"
+    elif [[ -n "$iteration" ]]; then
+        sqlite_insert "$DB_PATH" \
+            "INSERT INTO lifecycle_events (agent_id, event_type, confidence, reasoning, iteration, timestamp) VALUES (?1, 'confidence_update', ?2, ?3, ?4, datetime('now'))" \
+            "$agent_id" "$confidence" "$reasoning" "$iteration"
+    else
+        sqlite_insert "$DB_PATH" \
+            "INSERT INTO lifecycle_events (agent_id, event_type, confidence, reasoning, timestamp) VALUES (?1, 'confidence_update', ?2, ?3, datetime('now'))" \
+            "$agent_id" "$confidence" "$reasoning"
+    fi
 
     log_success "Confidence updated for agent $agent_id"
 }
@@ -198,31 +191,36 @@ complete_agent() {
 
     log_info "Completing agent $agent_id with confidence: $confidence"
 
-    # Mark agent as completed
-    sqlite3 "$DB_PATH" << EOF
-UPDATE agents
-SET status = 'completed',
-    confidence = $confidence,
-    output = ${output:+"'${output}'":NULL},
-    completed_at = datetime('now'),
-    updated_at = datetime('now')
-WHERE id = '$agent_id';
-EOF
+    # Mark agent as completed (parameterized query)
+    if [[ -n "$output" ]]; then
+        sqlite_update "$DB_PATH" \
+            "UPDATE agents SET status = 'completed', confidence = ?1, output = ?2, completed_at = datetime('now'), updated_at = datetime('now') WHERE id = ?3" \
+            "$confidence" "$output" "$agent_id"
+    else
+        sqlite_update "$DB_PATH" \
+            "UPDATE agents SET status = 'completed', confidence = ?1, completed_at = datetime('now'), updated_at = datetime('now') WHERE id = ?2" \
+            "$confidence" "$agent_id"
+    fi
 
-    # Log completion event
-    sqlite3 "$DB_PATH" << EOF
-INSERT INTO lifecycle_events (
-    agent_id, event_type, confidence, reasoning, phase, iteration, timestamp
-) VALUES (
-    '$agent_id',
-    'complete',
-    $confidence,
-    ${output:="'${output}'":'Agent completed'},
-    ${phase:+"'${phase}'":NULL},
-    ${iteration:+$iteration},
-    datetime('now')
-);
-EOF
+    # Log completion event (parameterized query with optional fields)
+    local reasoning="${output:-Agent completed}"
+    if [[ -n "$phase" && -n "$iteration" ]]; then
+        sqlite_insert "$DB_PATH" \
+            "INSERT INTO lifecycle_events (agent_id, event_type, confidence, reasoning, phase, iteration, timestamp) VALUES (?1, 'complete', ?2, ?3, ?4, ?5, datetime('now'))" \
+            "$agent_id" "$confidence" "$reasoning" "$phase" "$iteration"
+    elif [[ -n "$phase" ]]; then
+        sqlite_insert "$DB_PATH" \
+            "INSERT INTO lifecycle_events (agent_id, event_type, confidence, reasoning, phase, timestamp) VALUES (?1, 'complete', ?2, ?3, ?4, datetime('now'))" \
+            "$agent_id" "$confidence" "$reasoning" "$phase"
+    elif [[ -n "$iteration" ]]; then
+        sqlite_insert "$DB_PATH" \
+            "INSERT INTO lifecycle_events (agent_id, event_type, confidence, reasoning, iteration, timestamp) VALUES (?1, 'complete', ?2, ?3, ?4, datetime('now'))" \
+            "$agent_id" "$confidence" "$reasoning" "$iteration"
+    else
+        sqlite_insert "$DB_PATH" \
+            "INSERT INTO lifecycle_events (agent_id, event_type, confidence, reasoning, timestamp) VALUES (?1, 'complete', ?2, ?3, datetime('now'))" \
+            "$agent_id" "$confidence" "$reasoning"
+    fi
 
     # Check CFN Loop gate
     local gate_status="FAIL"
@@ -242,24 +240,15 @@ terminate_agent() {
 
     log_info "Terminating agent $agent_id: $reason"
 
-    # Mark agent as terminated
-    sqlite3 "$DB_PATH" << EOF
-UPDATE agents
-SET status = 'terminated', updated_at = datetime('now')
-WHERE id = '$agent_id';
-EOF
+    # Mark agent as terminated (parameterized query)
+    sqlite_update "$DB_PATH" \
+        "UPDATE agents SET status = 'terminated', updated_at = datetime('now') WHERE id = ?1" \
+        "$agent_id"
 
-    # Log termination event
-    sqlite3 "$DB_PATH" << EOF
-INSERT INTO lifecycle_events (
-    agent_id, event_type, reasoning, timestamp
-) VALUES (
-    '$agent_id',
-    'terminate',
-    '$reason',
-    datetime('now')
-);
-EOF
+    # Log termination event (parameterized query)
+    sqlite_insert "$DB_PATH" \
+        "INSERT INTO lifecycle_events (agent_id, event_type, reasoning, timestamp) VALUES (?1, 'terminate', ?2, datetime('now'))" \
+        "$agent_id" "$reason"
 
     log_success "Agent $agent_id terminated"
 }
@@ -275,33 +264,15 @@ query_status() {
 
     echo ""
     echo "=== Agent Status ==="
-    sqlite3 "$DB_PATH" << EOF
-SELECT
-    id,
-    name,
-    type,
-    status,
-    confidence,
-    spawned_at,
-    completed_at,
-    updated_at
-FROM agents
-WHERE id = '$agent_id';
-EOF
+    sqlite_select "$DB_PATH" \
+        "SELECT id, name, type, status, confidence, spawned_at, completed_at, updated_at FROM agents WHERE id = ?1" \
+        "$agent_id"
 
     echo ""
     echo "=== Recent Lifecycle Events ==="
-    sqlite3 "$DB_PATH" << EOF
-SELECT
-    timestamp,
-    event_type,
-    confidence,
-    reasoning
-FROM lifecycle_events
-WHERE agent_id = '$agent_id'
-ORDER BY timestamp DESC
-LIMIT $limit;
-EOF
+    sqlite_select "$DB_PATH" \
+        "SELECT timestamp, event_type, confidence, reasoning FROM lifecycle_events WHERE agent_id = ?1 ORDER BY timestamp DESC LIMIT ?2" \
+        "$agent_id" "$limit"
 }
 
 # Show usage
@@ -322,8 +293,8 @@ show_usage() {
     echo ""
     echo "Examples:"
     echo "  $0 spawn --agent-id docker-1 --agent-type docker-specialist --acl-level 1"
-    echo "  $0 update --agent-id docker-1 --confidence 0.85 --reasoning 'Implementation complete'"
-    echo "  $0 complete --agent-id docker-1 --confidence 0.90 --output 'Docker setup complete'"
+    echo "  $0 update --agent-id docker-1 --confidence 0.85 --reasoning \"Implementation complete\""
+    echo "  $0 complete --agent-id docker-1 --confidence 0.90 --output \"Docker setup complete\""
     echo "  $0 status --agent-id docker-1"
 }
 

package/claude-assets/skills/agent-lifecycle/simple-audit.sh

@@ -3,28 +3,55 @@
 # Simple Agent Audit Trail Script
 # Usage: ./simple-audit.sh <agent_id> <agent_type> <confidence> <status>
 
+# Source parameterized query library for SQL injection prevention
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/../bootstrap/sqlite-params.sh"
+
 AGENT_ID="$1"
 AGENT_TYPE="$2"
 CONFIDENCE="${3:-0.0}"
 STATUS="${4:-spawned}"
 
-DB_PATH="./claude-assets/skills/cfn-redis-coordination/data/cfn-loop.db"
+# Resolve database path relative to script location
+DB_PATH="${SCRIPT_DIR}/../../../claude-assets/skills/cfn-redis-coordination/data/cfn-loop.db"
 
 if [[ -z "$AGENT_ID" || -z "$AGENT_TYPE" ]]; then
     echo "Usage: $0 <agent_id> <agent_type> [confidence] [status]"
     exit 1
 fi
 
-# Create agents table if not exists
-sqlite3 "$DB_PATH" "CREATE TABLE IF NOT EXISTS agents (id TEXT PRIMARY KEY, type TEXT, status TEXT, confidence REAL, spawned_at TEXT, completed_at TEXT, metadata TEXT);" 2>/dev/null
+# Ensure database directory exists
+mkdir -p "$(dirname "$DB_PATH")"
+
+# Create agents table if not exists (schema creation - no user input)
+sqlite3 "$DB_PATH" "CREATE TABLE IF NOT EXISTS agents (id TEXT PRIMARY KEY, type TEXT, status TEXT, confidence REAL, spawned_at TEXT, completed_at TEXT, metadata TEXT);" || {
+    echo "❌ Failed to initialize database at $DB_PATH" >&2
+    exit 1
+}
+
+# Validate confidence (must be numeric)
+if [[ ! "$CONFIDENCE" =~ ^[0-9]+(\.[0-9]+)?$ ]]; then
+    echo "❌ Invalid confidence value: $CONFIDENCE (must be numeric 0.0-1.0)" >&2
+    exit 1
+fi
 
-# Record agent activity
+# Record agent activity using parameterized queries
 case "$STATUS" in
     "spawned")
-        sqlite3 "$DB_PATH" "INSERT OR REPLACE INTO agents (id, type, status, spawned_at, metadata) VALUES ('$AGENT_ID', '$AGENT_TYPE', 'spawned', datetime('now'), '{\"source\": \"task_mode\"}');"
+        sqlite_upsert "$DB_PATH" \
+            "INSERT OR REPLACE INTO agents (id, type, status, spawned_at, metadata) VALUES (?1, ?2, 'spawned', datetime('now'), '{\"source\": \"task_mode\"}')" \
+            "$AGENT_ID" "$AGENT_TYPE" || {
+            echo "❌ Failed to record agent spawn" >&2
+            exit 1
+        }
         ;;
     "completed")
-        sqlite3 "$DB_PATH" "UPDATE agents SET status = 'completed', confidence = $CONFIDENCE, completed_at = datetime('now') WHERE id = '$AGENT_ID';"
+        sqlite_update "$DB_PATH" \
+            "UPDATE agents SET status = 'completed', confidence = ?1, completed_at = datetime('now') WHERE id = ?2" \
+            "$CONFIDENCE" "$AGENT_ID" || {
+            echo "❌ Failed to record agent completion" >&2
+            exit 1
+        }
         ;;
 esac