claude-flow-novice 2.15.3 → 2.15.4

package/claude-assets/skills/cfn-utilities/lib/retry.sh

@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+# Retry logic with exponential backoff for CFN system
+
+# Source logging if not already loaded
+if ! declare -f log_info >/dev/null 2>&1; then
+    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    source "$SCRIPT_DIR/logging.sh"
+fi
+
+# Retry command with exponential backoff
+# Usage: retry_with_backoff max_attempts base_delay_sec command [args...]
+# Example: retry_with_backoff 3 2 curl -f https://api.example.com
+retry_with_backoff() {
+    local max_attempts="${1:-3}"
+    local base_delay="${2:-2}"
+    shift 2
+    local command=("$@")
+
+    local attempt=1
+    local delay=$base_delay
+
+    while [ $attempt -le "$max_attempts" ]; do
+        log_debug "Attempt $attempt/$max_attempts: ${command[*]}" "{\"attempt\":$attempt,\"max\":$max_attempts}"
+
+        # Execute command and capture exit code immediately
+        "${command[@]}"
+        local exit_code=$?
+
+        # Check if command succeeded
+        if [ $exit_code -eq 0 ]; then
+            if [ $attempt -gt 1 ]; then
+                log_info "Command succeeded after retries" "{\"attempts\":$attempt,\"command\":\"${command[0]}\"}"
+            fi
+            return 0
+        fi
+
+        # Last attempt failed
+        if [ $attempt -eq "$max_attempts" ]; then
+            log_error "Command failed after $max_attempts attempts" "{\"command\":\"${command[0]}\",\"exit_code\":$exit_code}"
+            return $exit_code
+        fi
+
+        # Calculate next delay (exponential backoff: delay = base * 2^(attempt-1))
+        log_warn "Command failed, retrying in ${delay}s" "{\"attempt\":$attempt,\"delay\":$delay,\"exit_code\":$exit_code}"
+        sleep "$delay"
+
+        attempt=$((attempt + 1))
+        delay=$((delay * 2))
+    done
+
+    return 1
+}
+
+# Retry with fixed delay (no exponential backoff)
+# Usage: retry_fixed max_attempts delay_sec command [args...]
+retry_fixed() {
+    local max_attempts="${1:-3}"
+    local delay="${2:-2}"
+    shift 2
+    local command=("$@")
+
+    local attempt=1
+
+    while [ $attempt -le "$max_attempts" ]; do
+        log_debug "Attempt $attempt/$max_attempts: ${command[*]}" "{\"attempt\":$attempt}"
+
+        "${command[@]}"
+        local exit_code=$?
+
+        if [ $exit_code -eq 0 ]; then
+            return 0
+        fi
+
+        if [ $attempt -eq "$max_attempts" ]; then
+            log_error "Command failed after $max_attempts attempts" "{\"command\":\"${command[0]}\",\"exit_code\":$exit_code}"
+            return $exit_code
+        fi
+
+        log_warn "Command failed, retrying in ${delay}s" "{\"attempt\":$attempt,\"delay\":$delay}"
+        sleep "$delay"
+
+        attempt=$((attempt + 1))
+    done
+
+    return 1
+}
+
+# Retry until timeout (wall-clock timeout instead of attempt count)
+# Usage: retry_until_timeout timeout_sec delay_sec command [args...]
+retry_until_timeout() {
+    local timeout_sec="${1:-60}"
+    local delay="${2:-2}"
+    shift 2
+    local command=("$@")
+
+    local start_time
+    start_time=$(date +%s)
+    local end_time=$((start_time + timeout_sec))
+
+    local attempt=1
+
+    while [ "$(date +%s)" -lt "$end_time" ]; do
+        log_debug "Attempt $attempt (timeout in $((end_time - $(date +%s)))s): ${command[*]}" "{\"attempt\":$attempt}"
+
+        "${command[@]}"
+        local exit_code=$?
+
+        if [ $exit_code -eq 0 ]; then
+            return 0
+        fi
+
+        local current_time
+        current_time=$(date +%s)
+
+        if [ "$current_time" -ge "$end_time" ]; then
+            log_error "Command timed out after ${timeout_sec}s" "{\"command\":\"${command[0]}\",\"attempts\":$attempt,\"exit_code\":$exit_code}"
+            return 130  # Timeout exit code
+        fi
+
+        log_warn "Command failed, retrying in ${delay}s" "{\"attempt\":$attempt,\"remaining_time\":$((end_time - current_time))}"
+        sleep "$delay"
+
+        attempt=$((attempt + 1))
+    done
+
+    return 130
+}

package/claude-assets/skills/cfn-utilities/test.sh

@@ -0,0 +1,317 @@
+#!/usr/bin/env bash
+# CFN Utilities Test Suite
+# Tests all utility functions in lib/
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/execute.sh"
+
+# Test counters
+TESTS_RUN=0
+TESTS_PASSED=0
+TESTS_FAILED=0
+
+# Test result helpers
+pass() {
+    echo "PASS: $1"
+    TESTS_PASSED=$((TESTS_PASSED + 1))
+    TESTS_RUN=$((TESTS_RUN + 1))
+}
+
+fail() {
+    echo "FAIL: $1"
+    TESTS_FAILED=$((TESTS_FAILED + 1))
+    TESTS_RUN=$((TESTS_RUN + 1))
+}
+
+assert_equals() {
+    local expected="$1"
+    local actual="$2"
+    local test_name="$3"
+
+    if [ "$expected" = "$actual" ]; then
+        pass "$test_name"
+    else
+        fail "$test_name (expected: '$expected', got: '$actual')"
+    fi
+}
+
+assert_contains() {
+    local haystack="$1"
+    local needle="$2"
+    local test_name="$3"
+
+    if [[ "$haystack" == *"$needle"* ]]; then
+        pass "$test_name"
+    else
+        fail "$test_name (string '$needle' not found in output)"
+    fi
+}
+
+assert_success() {
+    local test_name="$1"
+    pass "$test_name"
+}
+
+assert_failure() {
+    local test_name="$1"
+    fail "$test_name"
+}
+
+# Cleanup temporary test files
+cleanup() {
+    rm -f /tmp/cfn-test-*
+}
+trap cleanup EXIT
+
+echo "=== CFN Utilities Test Suite ==="
+echo ""
+
+# ===== LOGGING TESTS =====
+echo "--- Testing Logging Functions ---"
+
+# Test: log_json outputs valid JSON
+output=$(log_json "info" "test message" '{"key":"value"}' 2>&1)
+if echo "$output" | grep -q '"timestamp"' && echo "$output" | grep -q '"level":"info"' && echo "$output" | grep -q '"message":"test message"'; then
+    pass "log_json outputs valid JSON structure"
+else
+    fail "log_json output invalid: $output"
+fi
+
+# Test: log_info outputs to stderr
+output=$(log_info "info test" '{}' 2>&1 >/dev/null)
+if echo "$output" | grep -q '"level":"info"'; then
+    pass "log_info outputs to stderr"
+else
+    fail "log_info output incorrect"
+fi
+
+# Test: log_error includes error level
+output=$(log_error "error test" '{"code":"E001"}' 2>&1)
+if echo "$output" | grep -q '"level":"error"' && echo "$output" | grep -q 'E001'; then
+    pass "log_error includes error level and context"
+else
+    fail "log_error output incorrect"
+fi
+
+# Test: log_debug respects LOG_LEVEL
+LOG_LEVEL=info
+output=$(log_debug "debug test" '{}' 2>&1)
+if [ -z "$output" ]; then
+    pass "log_debug respects LOG_LEVEL=info (no output)"
+else
+    fail "log_debug should not output when LOG_LEVEL=info"
+fi
+
+LOG_LEVEL=debug
+output=$(log_debug "debug test" '{}' 2>&1)
+if echo "$output" | grep -q '"level":"debug"'; then
+    pass "log_debug outputs when LOG_LEVEL=debug"
+else
+    fail "log_debug should output when LOG_LEVEL=debug"
+fi
+
+# Test: generate_correlation_id produces output
+corr_id=$(generate_correlation_id)
+if [ -n "$corr_id" ]; then
+    pass "generate_correlation_id produces non-empty ID"
+else
+    fail "generate_correlation_id produced empty ID"
+fi
+
+# ===== ERROR HANDLING TESTS =====
+echo ""
+echo "--- Testing Error Handling Functions ---"
+
+# Test: error_handle returns error code
+if error_handle "test error" '{}' 2>/dev/null; then
+    fail "error_handle should return non-zero exit code"
+else
+    pass "error_handle returns non-zero exit code"
+fi
+
+# Test: is_error_code detects specific codes
+EXITCODE=7
+if is_error_code $EXITCODE 7; then
+    pass "is_error_code detects correct exit code"
+else
+    fail "is_error_code should detect exit code 7"
+fi
+
+# Test: get_error_context returns JSON structure
+test_exit_42() { return 42; }
+test_exit_42 || true
+context=$(get_error_context)
+if echo "$context" | grep -q '"exit_code"' && echo "$context" | grep -q '"line"'; then
+    pass "get_error_context returns JSON structure"
+else
+    fail "get_error_context output invalid: $context"
+fi
+
+# ===== RETRY TESTS =====
+echo ""
+echo "--- Testing Retry Functions ---"
+
+# Test: retry_with_backoff succeeds on first try
+counter=0
+test_command() {
+    counter=$((counter + 1))
+    return 0
+}
+if retry_with_backoff 3 1 test_command 2>/dev/null; then
+    pass "retry_with_backoff succeeds immediately"
+else
+    fail "retry_with_backoff should succeed"
+fi
+
+# Test: retry_with_backoff retries on failure
+attempt_count=0
+failing_command() {
+    attempt_count=$((attempt_count + 1))
+    [ $attempt_count -ge 3 ]
+}
+if retry_with_backoff 5 1 failing_command 2>/dev/null; then
+    assert_equals "3" "$attempt_count" "retry_with_backoff retries correct number of times"
+else
+    fail "retry_with_backoff should eventually succeed"
+fi
+
+# Test: retry_with_backoff gives up after max attempts
+always_fail() {
+    return 1
+}
+if retry_with_backoff 2 1 always_fail 2>/dev/null; then
+    fail "retry_with_backoff should fail after max attempts"
+else
+    pass "retry_with_backoff gives up after max attempts"
+fi
+
+# Test: retry_fixed uses fixed delay
+fixed_count=0
+fixed_test() {
+    fixed_count=$((fixed_count + 1))
+    [ $fixed_count -ge 2 ]
+}
+if retry_fixed 3 1 fixed_test 2>/dev/null; then
+    pass "retry_fixed works with fixed delay"
+else
+    fail "retry_fixed should succeed"
+fi
+
+# ===== FILE OPERATIONS TESTS =====
+echo ""
+echo "--- Testing File Operations ---"
+
+# Test: atomic_write creates file
+test_file="/tmp/cfn-test-atomic-$$"
+if atomic_write "$test_file" "test content" 2>/dev/null; then
+    if [ -f "$test_file" ] && [ "$(cat "$test_file")" = "test content" ]; then
+        pass "atomic_write creates file with correct content"
+    else
+        fail "atomic_write file content incorrect"
+    fi
+else
+    fail "atomic_write failed"
+fi
+
+# Test: atomic_write is actually atomic (no .tmp files left)
+test_file2="/tmp/cfn-test-atomic2-$$"
+atomic_write "$test_file2" "content" 2>/dev/null
+if ! ls /tmp/cfn-test-atomic2-$$.tmp* 2>/dev/null; then
+    pass "atomic_write cleans up temporary files"
+else
+    fail "atomic_write left temporary files"
+fi
+
+# Test: acquire_lock creates lock file
+lock_file="/tmp/cfn-test-lock-$$"
+if acquire_lock "$lock_file" 5 2>/dev/null; then
+    if [ -f "$lock_file" ] && [ "$(cat "$lock_file")" = "$$" ]; then
+        pass "acquire_lock creates lock file with PID"
+        release_lock "$lock_file" 2>/dev/null
+    else
+        fail "acquire_lock file content incorrect"
+        release_lock "$lock_file" 2>/dev/null
+    fi
+else
+    fail "acquire_lock failed"
+fi
+
+# Test: acquire_lock blocks concurrent access
+lock_file2="/tmp/cfn-test-lock2-$$"
+acquire_lock "$lock_file2" 30 2>/dev/null
+if acquire_lock "$lock_file2" 1 2>/dev/null; then
+    fail "acquire_lock should block when lock is held"
+    release_lock "$lock_file2" 2>/dev/null
+else
+    pass "acquire_lock blocks concurrent access"
+    release_lock "$lock_file2" 2>/dev/null
+fi
+
+# Test: release_lock removes lock file
+lock_file3="/tmp/cfn-test-lock3-$$"
+acquire_lock "$lock_file3" 5 2>/dev/null
+if release_lock "$lock_file3" 2>/dev/null; then
+    if [ ! -f "$lock_file3" ]; then
+        pass "release_lock removes lock file"
+    else
+        fail "release_lock did not remove lock file"
+    fi
+else
+    fail "release_lock failed"
+fi
+
+# Test: with_lock executes command with lock
+lock_file4="/tmp/cfn-test-lock4-$$"
+output_file="/tmp/cfn-test-output-$$"
+if with_lock "$lock_file4" 5 bash -c "echo 'locked' > $output_file" 2>/dev/null; then
+    if [ -f "$output_file" ] && [ "$(cat "$output_file")" = "locked" ]; then
+        pass "with_lock executes command successfully"
+    else
+        fail "with_lock command did not execute correctly"
+    fi
+else
+    fail "with_lock failed"
+fi
+
+# Test: with_lock releases lock after execution
+if [ -f "$lock_file4" ]; then
+    fail "with_lock did not release lock after execution"
+else
+    pass "with_lock releases lock after execution"
+fi
+
+# Test: is_locked detects active locks
+lock_file5="/tmp/cfn-test-lock5-$$"
+acquire_lock "$lock_file5" 5 2>/dev/null
+if is_locked "$lock_file5"; then
+    pass "is_locked detects active lock"
+else
+    fail "is_locked should detect active lock"
+fi
+release_lock "$lock_file5" 2>/dev/null
+
+# Test: is_locked returns false when no lock
+lock_file6="/tmp/cfn-test-lock6-$$"
+if is_locked "$lock_file6"; then
+    fail "is_locked should return false when no lock exists"
+else
+    pass "is_locked returns false when no lock exists"
+fi
+
+# ===== SUMMARY =====
+echo ""
+echo "==================================="
+echo "Tests run: $TESTS_RUN"
+echo "Passed: $TESTS_PASSED"
+echo "Failed: $TESTS_FAILED"
+echo "==================================="
+
+if [ $TESTS_FAILED -eq 0 ]; then
+    echo "All tests passed!"
+    exit 0
+else
+    echo "Some tests failed!"
+    exit 1
+fi

package/claude-assets/skills/integration/agent-handoff.sh

@@ -16,6 +16,11 @@
 
 set -euo pipefail
 
+# Source parameterized query library for SQL injection prevention
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+source "$PROJECT_ROOT/.claude/skills/bootstrap/sqlite-params.sh"
+
 # Configuration
 AGENT_STATE_DB="${AGENT_STATE_DB:-./.claude/agents/state/agent-state.db}"
 HEARTBEAT_INTERVAL="${HEARTBEAT_INTERVAL:-30}"
@@ -132,23 +137,15 @@ agent_spawn() {
 
     log_info "Spawning agent" "{\"agent_id\":\"$agent_id\",\"agent_type\":\"$agent_type\",\"task_id\":\"$task_id\"}"
 
-    # Register agent in database
-    sqlite3 "$AGENT_STATE_DB" <<SQL
-INSERT INTO agents (
-    agent_id, agent_type, task_id, status, spawned_at, timeout_seconds, metadata
-) VALUES (
-    '$agent_id',
-    '$agent_type',
-    '$task_id',
-    'spawned',
-    '$(date -u +"%Y-%m-%dT%H:%M:%SZ")',
-    $timeout_seconds,
-    '$metadata'
-);
-SQL
+    # Register agent in database - using parameterized query
+    local spawned_timestamp
+    spawned_timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+    sqlite_insert "$AGENT_STATE_DB" \
+        "INSERT INTO agents (agent_id, agent_type, task_id, status, spawned_at, timeout_seconds, metadata) VALUES (?1, ?2, ?3, 'spawned', ?4, ?5, ?6);" \
+        "$agent_id" "$agent_type" "$task_id" "$spawned_timestamp" "$timeout_seconds" "$metadata"
 
     # Standard agent spawn command (customizable via environment)
-    local spawn_cmd="${AGENT_SPAWN_CMD:-npx claude-flow-novice agent-spawn}"
+    local spawn_cmd="${AGENT_SPAWN_CMD:-cfn-spawn agent}"
 
     # Spawn agent in background (example - replace with actual spawn mechanism)
     (
@@ -157,10 +154,10 @@ SQL
         export TASK_ID="$task_id"
         export AGENT_TYPE="$agent_type"
 
-        # Update status to running
-        sqlite3 "$AGENT_STATE_DB" <<SQL
-UPDATE agents SET status = 'running', pid = $$ WHERE agent_id = '$agent_id';
-SQL
+        # Update status to running - using parameterized query
+        sqlite_update "$AGENT_STATE_DB" \
+            "UPDATE agents SET status = 'running', pid = ?1 WHERE agent_id = ?2;" \
+            "$$" "$agent_id"
 
         # Start heartbeat in background
         agent_heartbeat_loop "$agent_id" "$task_id" &
@@ -186,10 +183,10 @@ SQL
 
     local agent_pid=$!
 
-    # Update PID in database
-    sqlite3 "$AGENT_STATE_DB" <<SQL
-UPDATE agents SET pid = $agent_pid WHERE agent_id = '$agent_id';
-SQL
+    # Update PID in database - using parameterized query
+    sqlite_update "$AGENT_STATE_DB" \
+        "UPDATE agents SET pid = ?1 WHERE agent_id = ?2;" \
+        "$agent_pid" "$agent_id"
 
     log_info "Agent spawned successfully" "{\"agent_id\":\"$agent_id\",\"pid\":$agent_pid}"
 
@@ -208,13 +205,13 @@ agent_heartbeat() {
     local timestamp
     timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
-    # Update last heartbeat in agents table
-    sqlite3 "$AGENT_STATE_DB" <<SQL
-UPDATE agents SET last_heartbeat = '$timestamp' WHERE agent_id = '$agent_id';
-INSERT INTO heartbeats (agent_id, task_id, timestamp, metadata) VALUES (
-    '$agent_id', '$task_id', '$timestamp', '$metadata'
-);
-SQL
+    # Update last heartbeat in agents table - using parameterized queries
+    sqlite_update "$AGENT_STATE_DB" \
+        "UPDATE agents SET last_heartbeat = ?1 WHERE agent_id = ?2;" \
+        "$timestamp" "$agent_id"
+    sqlite_insert "$AGENT_STATE_DB" \
+        "INSERT INTO heartbeats (agent_id, task_id, timestamp, metadata) VALUES (?1, ?2, ?3, ?4);" \
+        "$agent_id" "$task_id" "$timestamp" "$metadata"
 
     log_debug "Heartbeat sent" "{\"agent_id\":\"$agent_id\",\"task_id\":\"$task_id\"}"
 }
@@ -229,9 +226,9 @@ agent_heartbeat_loop() {
         agent_heartbeat "$agent_id" "$task_id" || break
         sleep "$HEARTBEAT_INTERVAL"
 
-        # Check if agent is still alive
+        # Check if agent is still alive - using parameterized query
         local status
-        status=$(sqlite3 "$AGENT_STATE_DB" "SELECT status FROM agents WHERE agent_id = '$agent_id';" || echo "unknown")
+        status=$(sqlite_select "$AGENT_STATE_DB" "SELECT status FROM agents WHERE agent_id = ?1;" "$agent_id" || echo "unknown")
 
         if [[ "$status" == "completed" ]] || [[ "$status" == "failed" ]] || [[ "$status" == "timeout" ]]; then
             log_debug "Heartbeat loop stopping" "{\"agent_id\":\"$agent_id\",\"status\":\"$status\"}"
@@ -253,15 +250,10 @@ agent_complete() {
     local timestamp
     timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
-    # Update agent status
-    sqlite3 "$AGENT_STATE_DB" <<SQL
-UPDATE agents SET
-    status = 'completed',
-    completed_at = '$timestamp',
-    confidence = $confidence,
-    result = '$result'
-WHERE agent_id = '$agent_id';
-SQL
+    # Update agent status - using parameterized query
+    sqlite_update "$AGENT_STATE_DB" \
+        "UPDATE agents SET status = 'completed', completed_at = ?1, confidence = ?2, result = ?3 WHERE agent_id = ?4;" \
+        "$timestamp" "$confidence" "$result" "$agent_id"
 
     log_info "Agent completed" "{\"agent_id\":\"$agent_id\",\"task_id\":\"$task_id\",\"confidence\":$confidence}"
 
@@ -294,14 +286,10 @@ agent_fail() {
 EOF
     )
 
-    sqlite3 "$AGENT_STATE_DB" <<SQL
-UPDATE agents SET
-    status = 'failed',
-    completed_at = '$timestamp',
-    confidence = 0.0,
-    result = '$error_result'
-WHERE agent_id = '$agent_id';
-SQL
+    # Update agent status for failure - using parameterized query
+    sqlite_update "$AGENT_STATE_DB" \
+        "UPDATE agents SET status = 'failed', completed_at = ?1, confidence = 0.0, result = ?2 WHERE agent_id = ?3;" \
+        "$timestamp" "$error_result" "$agent_id"
 
     log_error "Agent failed" "{\"agent_id\":\"$agent_id\",\"task_id\":\"$task_id\",\"error\":\"$error_message\"}"
 }
@@ -314,8 +302,9 @@ SQL
 agent_check_timeout() {
     local agent_id="$1"
 
+    # Get agent data - using parameterized query
     local agent_data
-    agent_data=$(sqlite3 "$AGENT_STATE_DB" "SELECT spawned_at, timeout_seconds, status, pid FROM agents WHERE agent_id = '$agent_id';" | tr '|' ' ')
+    agent_data=$(sqlite_select "$AGENT_STATE_DB" "SELECT spawned_at, timeout_seconds, status, pid FROM agents WHERE agent_id = ?1;" "$agent_id" | tr '|' ' ')
 
     read -r spawned_at timeout_seconds status pid <<< "$agent_data"
 
@@ -349,14 +338,14 @@ agent_check_timeout() {
             fi
         fi
 
-        # Mark as timeout
-        sqlite3 "$AGENT_STATE_DB" <<SQL
-UPDATE agents SET
-    status = 'timeout',
-    completed_at = '$(date -u +"%Y-%m-%dT%H:%M:%SZ")',
-    result = '{"error": "Agent exceeded timeout", "elapsed_seconds": $elapsed}'
-WHERE agent_id = '$agent_id';
-SQL
+        # Mark as timeout - using parameterized query
+        local timeout_timestamp
+        timeout_timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+        local timeout_result
+        timeout_result="{\"error\": \"Agent exceeded timeout\", \"elapsed_seconds\": $elapsed}"
+        sqlite_update "$AGENT_STATE_DB" \
+            "UPDATE agents SET status = 'timeout', completed_at = ?1, result = ?2 WHERE agent_id = ?3;" \
+            "$timeout_timestamp" "$timeout_result" "$agent_id"
 
         return 1
     fi
@@ -380,9 +369,9 @@ agent_wait_for_completion() {
     start_time=$(date +%s)
 
     while true; do
-        # Check status
+        # Check status - using parameterized query
         local status
-        status=$(sqlite3 "$AGENT_STATE_DB" "SELECT status FROM agents WHERE agent_id = '$agent_id';" || echo "unknown")
+        status=$(sqlite_select "$AGENT_STATE_DB" "SELECT status FROM agents WHERE agent_id = ?1;" "$agent_id" || echo "unknown")
 
         if [[ "$status" == "completed" ]]; then
             log_info "Agent completed successfully" "{\"agent_id\":\"$agent_id\"}"
@@ -416,8 +405,11 @@ agent_wait_for_completion() {
 agent_get_status() {
     local agent_id="$1"
 
+    # Get status - using parameterized query (manual JSON mode as sqlite_select doesn't support -json flag)
     local status_json
-    status_json=$(sqlite3 -json "$AGENT_STATE_DB" "SELECT * FROM agents WHERE agent_id = '$agent_id';" | jq '.[0]')
+    status_json=$(sqlite3 -json "$AGENT_STATE_DB" ".parameter init
+.parameter set ?1 \"$agent_id\"
+SELECT * FROM agents WHERE agent_id = ?1;" | jq '.[0]')
 
     echo "$status_json"
 }
@@ -428,8 +420,11 @@ agent_get_status() {
 agent_get_by_task() {
     local task_id="$1"
 
+    # Get agents by task - using parameterized query (manual JSON mode)
     local agents_json
-    agents_json=$(sqlite3 -json "$AGENT_STATE_DB" "SELECT * FROM agents WHERE task_id = '$task_id' ORDER BY spawned_at DESC;")
+    agents_json=$(sqlite3 -json "$AGENT_STATE_DB" ".parameter init
+.parameter set ?1 \"$task_id\"
+SELECT * FROM agents WHERE task_id = ?1 ORDER BY spawned_at DESC;")
 
     echo "$agents_json"
 }
@@ -440,8 +435,11 @@ agent_get_by_task() {
 agent_get_heartbeats() {
     local agent_id="$1"
 
+    # Get heartbeats - using parameterized query (manual JSON mode)
     local heartbeats_json
-    heartbeats_json=$(sqlite3 -json "$AGENT_STATE_DB" "SELECT * FROM heartbeats WHERE agent_id = '$agent_id' ORDER BY timestamp DESC LIMIT 100;")
+    heartbeats_json=$(sqlite3 -json "$AGENT_STATE_DB" ".parameter init
+.parameter set ?1 \"$agent_id\"
+SELECT * FROM heartbeats WHERE agent_id = ?1 ORDER BY timestamp DESC LIMIT 100;")
 
     echo "$heartbeats_json"
 }
@@ -477,7 +475,7 @@ CONFIGURATION:
   HEARTBEAT_INTERVAL   - Heartbeat frequency in seconds (default: 30)
   COMPLETION_TIMEOUT   - Default completion timeout (default: 300)
   LOG_FILE            - Structured log file (default: /tmp/agent-handoff.log)
-  AGENT_SPAWN_CMD     - Agent spawn command (default: npx claude-flow-novice agent-spawn)
+  AGENT_SPAWN_CMD     - Agent spawn command (default: cfn-spawn agent)
 
 BEFORE (Ad-hoc):
   # ❌ No correlation, no heartbeat, no timeout handling