claude-flow-novice 2.15.3 → 2.15.4

package/claude-assets/skills/cfn-test-runner/store-benchmarks.sh

@@ -1,10 +1,15 @@
 #!/bin/bash
 # Store test benchmarks in SQLite
+# SECURITY: Uses Pattern B parameterized queries to prevent SQL injection
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
-DB_FILE="$PROJECT_ROOT/.artifacts/test-benchmarks.db"
+# Allow DB_FILE override for testing (security: prevents modification of production DB during tests)
+DB_FILE="${DB_FILE:-$PROJECT_ROOT/.artifacts/test-benchmarks.db}"
+
+# Source sqlite parameter binding library
+source "$PROJECT_ROOT/.claude/skills/bootstrap/sqlite-params.sh"
 
 # Parse arguments
 SUITE=""
@@ -32,24 +37,17 @@ done
 
 SUCCESS_RATE=$(awk "BEGIN {printf \"%.4f\", ($PASSED / $TOTAL)}")
 
-# Get or create suite ID
-SUITE_ID=$(sqlite3 "$DB_FILE" "SELECT id FROM test_suites WHERE name='$SUITE'")
+# Get or create suite ID using parameterized query (Pattern B)
+SUITE_ID=$(sqlite_select "$DB_FILE" "SELECT id FROM test_suites WHERE name = ?1" "$SUITE")
 if [ -z "$SUITE_ID" ]; then
-  sqlite3 "$DB_FILE" "INSERT INTO test_suites (name) VALUES ('$SUITE')"
-  SUITE_ID=$(sqlite3 "$DB_FILE" "SELECT last_insert_rowid()")
+  sqlite_insert "$DB_FILE" "INSERT INTO test_suites (name) VALUES (?1)" "$SUITE"
+  SUITE_ID=$(sqlite_select "$DB_FILE" "SELECT last_insert_rowid()")
 fi
 
-# Insert test run
-sqlite3 "$DB_FILE" << EOFSQL
-INSERT INTO test_runs (
-  suite_id, git_commit, git_branch, 
-  total_tests, passed, failed, skipped, 
-  duration_seconds, success_rate
-) VALUES (
-  $SUITE_ID, '$COMMIT', '$BRANCH',
-  $TOTAL, $PASSED, $FAILED, $SKIPPED,
-  $DURATION, $SUCCESS_RATE
-);
-EOFSQL
-
-echo "✅ Benchmark stored (run_id: $(sqlite3 "$DB_FILE" "SELECT last_insert_rowid()"))"
+# Insert test run using parameterized query (Pattern B)
+sqlite_insert "$DB_FILE" \
+  "INSERT INTO test_runs (suite_id, git_commit, git_branch, total_tests, passed, failed, skipped, duration_seconds, success_rate) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)" \
+  "$SUITE_ID" "$COMMIT" "$BRANCH" "$TOTAL" "$PASSED" "$FAILED" "$SKIPPED" "$DURATION" "$SUCCESS_RATE"
+
+RUN_ID=$(sqlite_select "$DB_FILE" "SELECT last_insert_rowid()")
+echo "✅ Benchmark stored (run_id: $RUN_ID)"

package/claude-assets/skills/cfn-transparency-middleware/test-e2e.sh

@@ -4,6 +4,21 @@
 
 set -euo pipefail
 
+# Input validation (SQL injection prevention)
+validate_identifier() {
+    local input="$1"
+    local max_length="${2:-255}"
+    if ! [[ "$input" =~ ^[a-zA-Z0-9_-]+$ ]]; then
+        echo "ERROR: Invalid identifier (alphanumeric + underscore/hyphen only): $input" >&2
+        return 1
+    fi
+    if [ ${#input} -gt $max_length ]; then
+        echo "ERROR: Identifier exceeds max length ($max_length chars)" >&2
+        return 1
+    fi
+    return 0
+}
+
 # Test configuration
 TEST_TASK_ID="e2e-test-$(date +%s)"
 TEST_AGENT_ID="backend-dev-e2e"

package/claude-assets/skills/cfn-transparency-middleware/tests/input-validation.sh

@@ -4,6 +4,21 @@
 
 set -euo pipefail
 
+# Input validation (SQL injection prevention)
+validate_identifier() {
+    local input="$1"
+    local max_length="${2:-255}"
+    if ! [[ "$input" =~ ^[a-zA-Z0-9_-]+$ ]]; then
+        echo "ERROR: Invalid identifier (alphanumeric + underscore/hyphen only): $input" >&2
+        return 1
+    fi
+    if [ ${#input} -gt $max_length ]; then
+        echo "ERROR: Identifier exceeds max length ($max_length chars)" >&2
+        return 1
+    fi
+    return 0
+}
+
 # Source the main script to access validation functions
 source "$(dirname "$0")/.claude/skills/cfn-cfn-test-integration.sh"
 

package/claude-assets/skills/cfn-utilities/SKILL.md

@@ -0,0 +1,237 @@
+# CFN Utilities Skill
+
+---
+name: cfn-utilities
+category: utilities
+version: 1.0.0
+tags: [bash, logging, error-handling, retry, file-operations, utilities]
+---
+
+## Description
+
+Reusable bash utility functions for the CFN Loop system. Provides standardized logging, error handling, retry logic, and atomic file operations with zero external dependencies.
+
+## Purpose
+
+- **Structured Logging**: JSON-formatted logs compatible with TypeScript logging system
+- **Error Handling**: Consistent error management across bash scripts
+- **Retry Logic**: Exponential backoff for transient failures
+- **File Operations**: Atomic writes and file locking primitives
+
+## Dependencies
+
+- POSIX-compliant bash (4.0+)
+- Coreutils (standard Linux/macOS utilities)
+- No external dependencies required
+
+## Usage
+
+### Direct Function Invocation
+
+```bash
+# Source all utilities
+source ./.claude/skills/cfn-utilities/execute.sh
+
+# Use individual functions
+log_info "Task started" '{"task_id":"abc123"}'
+retry_with_backoff 3 2 curl https://api.example.com
+atomic_write "/path/to/file.txt" "content here"
+```
+
+### Via Execute Script
+
+```bash
+# Execute specific function
+./.claude/skills/cfn-utilities/execute.sh log_json "info" "Message" '{"key":"value"}'
+
+# Source and call
+source ./.claude/skills/cfn-utilities/execute.sh
+log_error "Operation failed" '{"error_code":"E001"}'
+```
+
+## Available Functions
+
+### Logging (lib/logging.sh)
+
+**log_json(level, message, context)**
+```bash
+log_json "info" "Task started" '{"task_id":"abc123","agent":"backend-dev"}'
+# Output: {"timestamp":"2025-11-15T20:00:00Z","level":"info","message":"Task started","context":{"task_id":"abc123","agent":"backend-dev"}}
+```
+
+**log_info(message, context)**
+```bash
+log_info "Processing file" '{"file":"data.txt"}'
+```
+
+**log_warn(message, context)**
+```bash
+log_warn "Deprecated function used" '{"function":"old_func"}'
+```
+
+**log_error(message, context)**
+```bash
+log_error "Failed to connect" '{"host":"api.example.com","code":500}'
+```
+
+**log_debug(message, context)**
+```bash
+export LOG_LEVEL=debug
+log_debug "Variable state" '{"var":"value"}'
+```
+
+### Error Handling (lib/errors.sh)
+
+**error_exit(message, exit_code, context)**
+```bash
+error_exit "Database connection failed" 1 '{"db":"postgres"}'
+```
+
+**error_handle(message, context)**
+```bash
+if ! validate_input "$data"; then
+    error_handle "Invalid input" '{"input":"'$data'"}'
+    return 1
+fi
+```
+
+**is_error_code(expected_code)**
+```bash
+curl https://api.example.com
+if is_error_code 7; then
+    echo "Connection failed"
+fi
+```
+
+### Retry Logic (lib/retry.sh)
+
+**retry_with_backoff(max_attempts, base_delay_sec, command, args...)**
+```bash
+# Retry curl with exponential backoff (2s, 4s, 8s)
+retry_with_backoff 3 2 curl -f https://api.example.com/data
+
+# Retry custom command
+retry_with_backoff 5 1 cfn-spawn agent "backend-developer" --task "task"
+```
+
+### File Operations (lib/file-ops.sh)
+
+**atomic_write(filepath, content)**
+```bash
+atomic_write "/tmp/data.json" '{"status":"complete"}'
+```
+
+**acquire_lock(lockfile, timeout_sec)**
+```bash
+if acquire_lock "/tmp/resource.lock" 30; then
+    # Critical section
+    release_lock "/tmp/resource.lock"
+fi
+```
+
+**release_lock(lockfile)**
+```bash
+release_lock "/tmp/resource.lock"
+```
+
+**with_lock(lockfile, timeout_sec, command, args...)**
+```bash
+with_lock "/tmp/database.lock" 60 ./scripts/migrate-db.sh
+```
+
+## Integration Points
+
+### TypeScript Compatibility
+
+**Logging Format**:
+- JSON output compatible with `src/utils/logging.ts`
+- Correlation ID format matches TypeScript UUID generation
+- Timestamp format: ISO 8601 (UTC)
+
+**Error Codes**:
+- Error codes align with `src/utils/errors.ts`
+- Exit codes: 0=success, 1=general error, 2=usage error, 130=timeout
+
+**File Locking**:
+- Lock files use `.lock` extension (same as `src/utils/file-operations.ts`)
+- Timeout behavior matches TypeScript implementation
+
+### CFN System Integration
+
+**Used By**:
+- `.claude/hooks/cfn-invoke-pre-edit.sh` - atomic backup creation
+- `.claude/skills/cfn-coordination/` - structured logging
+- `.claude/skills/cfn-loop-orchestration/orchestrate.sh` - retry logic
+- All CFN agents - standardized error handling
+
+**Correlation IDs**:
+```bash
+# Generate correlation ID (compatible with TypeScript)
+CORRELATION_ID=$(uuidgen 2>/dev/null || echo "$(date +%s)-$$-$RANDOM")
+log_info "Request started" '{"correlation_id":"'$CORRELATION_ID'"}'
+```
+
+## Testing
+
+```bash
+# Run all tests
+./.claude/skills/cfn-utilities/test.sh
+
+# Expected output:
+# PASS: log_json outputs valid JSON
+# PASS: retry_with_backoff succeeds after failures
+# PASS: atomic_write creates file atomically
+# PASS: with_lock prevents concurrent execution
+# All tests passed (15/15)
+```
+
+## Implementation Patterns
+
+### Safe Script Template
+
+```bash
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/.claude/skills/cfn-utilities/execute.sh"
+
+main() {
+    log_info "Script started" '{"script":"'$(basename "$0")'"}'
+
+    retry_with_backoff 3 2 risky_operation || {
+        error_exit "Operation failed after retries" 1
+    }
+
+    atomic_write "/tmp/result.txt" "Success"
+    log_info "Script completed" '{"status":"success"}'
+}
+
+main "$@"
+```
+
+### Critical Section Pattern
+
+```bash
+#!/usr/bin/env bash
+source ./.claude/skills/cfn-utilities/execute.sh
+
+# Ensure only one instance modifies shared resource
+with_lock "/tmp/shared-resource.lock" 30 bash -c '
+    log_info "Updating shared resource"
+    echo "new data" >> /tmp/shared-resource.txt
+    log_info "Update complete"
+'
+```
+
+## Best Practices
+
+1. **Always use structured logging** - Include context objects for debugging
+2. **Set strict mode** - Use `set -euo pipefail` in all scripts
+3. **Use atomic operations** - Prevent partial writes with atomic_write()
+4. **Implement retries** - Handle transient failures gracefully
+5. **Lock shared resources** - Prevent race conditions with file locks
+
+## Version History
+
+- **1.0.0** (2025-11-15): Initial release with logging, errors, retry, and file ops

package/claude-assets/skills/cfn-utilities/execute.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# CFN Utilities - Main entry point
+# Sources all utility libraries and provides function execution
+# Usage: ./.claude/skills/cfn-utilities/execute.sh <function> <args>
+
+set -euo pipefail
+
+# Get script directory (absolute path)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Source all utility libraries
+source "$SCRIPT_DIR/lib/logging.sh"
+source "$SCRIPT_DIR/lib/errors.sh"
+source "$SCRIPT_DIR/lib/retry.sh"
+source "$SCRIPT_DIR/lib/file-ops.sh"
+
+# If script is executed directly (not sourced), run the requested function
+if [ "${BASH_SOURCE[0]}" = "${0}" ]; then
+    if [ $# -eq 0 ]; then
+        echo "Usage: $0 <function> [args...]" >&2
+        echo "" >&2
+        echo "Available functions:" >&2
+        echo "  Logging: log_json, log_info, log_warn, log_error, log_debug" >&2
+        echo "  Errors: error_exit, error_handle, is_error_code" >&2
+        echo "  Retry: retry_with_backoff, retry_fixed, retry_until_timeout" >&2
+        echo "  File Ops: atomic_write, acquire_lock, release_lock, with_lock, is_locked" >&2
+        exit 2
+    fi
+
+    # Execute the requested function with its arguments
+    "$@"
+fi

package/claude-assets/skills/cfn-utilities/lib/errors.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Error handling utilities for CFN system
+# Compatible with TypeScript errors.ts conventions
+
+# Source logging if not already loaded
+if ! declare -f log_error >/dev/null 2>&1; then
+    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    source "$SCRIPT_DIR/logging.sh"
+fi
+
+# Log error and exit with specified code
+# Usage: error_exit "message" exit_code '{"context":"json"}'
+error_exit() {
+    local message="${1:-Unknown error}"
+    local exit_code="${2:-1}"
+    local context="${3:-{}}"
+
+    log_error "$message" "$context"
+    exit "$exit_code"
+}
+
+# Handle error without exiting (just log and return error code)
+# Usage: error_handle "message" '{"context":"json"}' || return 1
+error_handle() {
+    local message="${1:-Unknown error}"
+    local context="${2:-{}}"
+
+    log_error "$message" "$context"
+    return 1
+}
+
+# Check if exit code matches expected value
+# Usage: some_command; EXITCODE=$?; if is_error_code $EXITCODE 7; then echo "Connection failed"; fi
+is_error_code() {
+    local actual_code="${1:?Exit code required}"
+    local expected_code="${2:-1}"
+
+    [ "$actual_code" -eq "$expected_code" ]
+}
+
+# Capture error context from last failed command
+# Usage: get_error_context
+get_error_context() {
+    local exit_code=$?
+    local line_number="${BASH_LINENO[0]}"
+    local function_name="${FUNCNAME[1]}"
+
+    echo "{\"exit_code\":$exit_code,\"line\":$line_number,\"function\":\"$function_name\"}"
+}
+
+# Standard exit codes (compatible with TypeScript errors.ts)
+readonly EXIT_SUCCESS=0
+readonly EXIT_GENERAL_ERROR=1
+readonly EXIT_USAGE_ERROR=2
+readonly EXIT_TIMEOUT=130
+readonly EXIT_INTERRUPT=143

package/claude-assets/skills/cfn-utilities/lib/file-ops.sh

@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+# Atomic file operations and locking for CFN system
+
+# Source logging if not already loaded
+if ! declare -f log_info >/dev/null 2>&1; then
+    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    source "$SCRIPT_DIR/logging.sh"
+fi
+
+# Atomic file write (write-then-move pattern)
+# Usage: atomic_write "/path/to/file.txt" "content here"
+atomic_write() {
+    local filepath="${1:?Filepath required}"
+    local content="${2:?Content required}"
+
+    # Create parent directory if needed
+    local dirpath
+    dirpath=$(dirname "$filepath")
+    mkdir -p "$dirpath"
+
+    # Write to temporary file first
+    local tmpfile
+    tmpfile="${filepath}.tmp.$$"
+
+    if ! echo "$content" > "$tmpfile"; then
+        log_error "Failed to write temporary file" "{\"file\":\"$tmpfile\"}"
+        rm -f "$tmpfile"
+        return 1
+    fi
+
+    # Atomic move
+    if ! mv "$tmpfile" "$filepath"; then
+        log_error "Failed to move temporary file" "{\"tmpfile\":\"$tmpfile\",\"target\":\"$filepath\"}"
+        rm -f "$tmpfile"
+        return 1
+    fi
+
+    log_debug "Atomic write succeeded" "{\"file\":\"$filepath\",\"bytes\":${#content}}"
+    return 0
+}
+
+# Acquire file lock with timeout
+# Usage: if acquire_lock "/path/to/resource.lock" 30; then ... fi
+acquire_lock() {
+    local lockfile="${1:?Lockfile required}"
+    local timeout_sec="${2:-30}"
+
+    local start_time
+    start_time=$(date +%s)
+    local end_time=$((start_time + timeout_sec))
+
+    # Create lock directory if needed
+    local lockdir
+    lockdir=$(dirname "$lockfile")
+    mkdir -p "$lockdir"
+
+    while [ "$(date +%s)" -lt "$end_time" ]; do
+        # Try to create lock file atomically
+        if (set -o noclobber; echo $$ > "$lockfile") 2>/dev/null; then
+            log_debug "Lock acquired" "{\"lockfile\":\"$lockfile\",\"pid\":$$}"
+            return 0
+        fi
+
+        # Check if lock holder is still alive
+        if [ -f "$lockfile" ]; then
+            local lock_pid
+            lock_pid=$(cat "$lockfile" 2>/dev/null || echo "")
+
+            if [ -n "$lock_pid" ] && ! kill -0 "$lock_pid" 2>/dev/null; then
+                log_warn "Stale lock detected, removing" "{\"lockfile\":\"$lockfile\",\"stale_pid\":$lock_pid}"
+                rm -f "$lockfile"
+                continue
+            fi
+        fi
+
+        # Wait before retry
+        sleep 0.5
+    done
+
+    log_error "Failed to acquire lock (timeout)" "{\"lockfile\":\"$lockfile\",\"timeout\":$timeout_sec}"
+    return 1
+}
+
+# Release file lock
+# Usage: release_lock "/path/to/resource.lock"
+release_lock() {
+    local lockfile="${1:?Lockfile required}"
+
+    if [ ! -f "$lockfile" ]; then
+        log_warn "Lock file does not exist" "{\"lockfile\":\"$lockfile\"}"
+        return 1
+    fi
+
+    # Verify we own the lock
+    local lock_pid
+    lock_pid=$(cat "$lockfile" 2>/dev/null || echo "")
+
+    if [ "$lock_pid" != "$$" ]; then
+        log_warn "Cannot release lock owned by another process" "{\"lockfile\":\"$lockfile\",\"owner\":$lock_pid,\"current\":$$}"
+        return 1
+    fi
+
+    if ! rm -f "$lockfile"; then
+        log_error "Failed to remove lock file" "{\"lockfile\":\"$lockfile\"}"
+        return 1
+    fi
+
+    log_debug "Lock released" "{\"lockfile\":\"$lockfile\",\"pid\":$$}"
+    return 0
+}
+
+# Execute command with file lock held
+# Usage: with_lock "/path/to/resource.lock" timeout_sec command [args...]
+with_lock() {
+    local lockfile="${1:?Lockfile required}"
+    local timeout_sec="${2:?Timeout required}"
+    shift 2
+    local command=("$@")
+
+    # Acquire lock
+    if ! acquire_lock "$lockfile" "$timeout_sec"; then
+        log_error "Failed to acquire lock for command execution" "{\"lockfile\":\"$lockfile\",\"command\":\"${command[0]}\"}"
+        return 1
+    fi
+
+    # Setup trap to release lock on exit
+    trap "release_lock '$lockfile'" EXIT INT TERM
+
+    # Execute command
+    local exit_code=0
+    "${command[@]}" || exit_code=$?
+
+    # Release lock
+    release_lock "$lockfile" || true
+
+    # Remove trap
+    trap - EXIT INT TERM
+
+    return $exit_code
+}
+
+# Check if file lock exists and is held by a living process
+# Usage: if is_locked "/path/to/resource.lock"; then ... fi
+is_locked() {
+    local lockfile="${1:?Lockfile required}"
+
+    if [ ! -f "$lockfile" ]; then
+        return 1
+    fi
+
+    local lock_pid
+    lock_pid=$(cat "$lockfile" 2>/dev/null || echo "")
+
+    if [ -z "$lock_pid" ]; then
+        return 1
+    fi
+
+    # Check if process is alive
+    if kill -0 "$lock_pid" 2>/dev/null; then
+        return 0  # Locked by living process
+    else
+        return 1  # Stale lock
+    fi
+}

package/claude-assets/skills/cfn-utilities/lib/logging.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Structured logging utilities for CFN system
+# Compatible with TypeScript logging.ts format
+
+# Get current timestamp in ISO 8601 format (UTC)
+get_timestamp() {
+    date -u +"%Y-%m-%dT%H:%M:%SZ"
+}
+
+# Output structured JSON log
+# Usage: log_json "level" "message" '{"context":"json"}'
+log_json() {
+    local level="${1:-info}"
+    local message="${2:-}"
+    local context="${3:-{}}"
+    local timestamp
+    timestamp=$(get_timestamp)
+
+    # Escape message for JSON (basic escaping)
+    message=$(echo "$message" | sed 's/"/\\"/g' | sed 's/\\/\\\\/g')
+
+    # Output JSON (ensure context is valid JSON)
+    if [ "$context" = "{}" ]; then
+        echo "{\"timestamp\":\"$timestamp\",\"level\":\"$level\",\"message\":\"$message\"}"
+    else
+        # Remove outer braces from context and merge
+        context_inner=$(echo "$context" | sed 's/^{//' | sed 's/}$//')
+        echo "{\"timestamp\":\"$timestamp\",\"level\":\"$level\",\"message\":\"$message\",\"context\":{$context_inner}}"
+    fi
+}
+
+# Info level log
+# Usage: log_info "message" '{"key":"value"}'
+log_info() {
+    local message="${1:-}"
+    local context="${2:-{}}"
+    log_json "info" "$message" "$context" >&2
+}
+
+# Warning level log
+# Usage: log_warn "message" '{"key":"value"}'
+log_warn() {
+    local message="${1:-}"
+    local context="${2:-{}}"
+    log_json "warn" "$message" "$context" >&2
+}
+
+# Error level log
+# Usage: log_error "message" '{"key":"value"}'
+log_error() {
+    local message="${1:-}"
+    local context="${2:-{}}"
+    log_json "error" "$message" "$context" >&2
+}
+
+# Debug level log (respects LOG_LEVEL env var)
+# Usage: LOG_LEVEL=debug log_debug "message" '{"key":"value"}'
+log_debug() {
+    local message="${1:-}"
+    local context="${2:-{}}"
+
+    # Only output if LOG_LEVEL is debug or trace
+    if [[ "${LOG_LEVEL:-info}" =~ ^(debug|trace)$ ]]; then
+        log_json "debug" "$message" "$context" >&2
+    fi
+}
+
+# Generate correlation ID (compatible with TypeScript UUID format)
+# Usage: CORRELATION_ID=$(generate_correlation_id)
+generate_correlation_id() {
+    # Try uuidgen first, fallback to timestamp+pid+random
+    if command -v uuidgen >/dev/null 2>&1; then
+        uuidgen | tr '[:upper:]' '[:lower:]'
+    else
+        echo "$(date +%s)-$$-$RANDOM"
+    fi
+}