claude-flow-novice 2.15.3 → 2.15.5

package/.claude/hooks/cfn-post-edit-cfn-retrospective.sh

@@ -2,6 +2,37 @@
 
 # Post-Edit Hook for CFN Retrospective Skills
 
+# Determine PROJECT_ROOT portably
+if [[ -z "$PROJECT_ROOT" ]]; then
+    # Resolve script location (handle symlinks)
+    SCRIPT_SOURCE="${BASH_SOURCE[0]}"
+    if [[ -L "$SCRIPT_SOURCE" ]]; then
+        SCRIPT_SOURCE="$(readlink -f "$SCRIPT_SOURCE" 2>/dev/null)" || {
+            echo "❌ Failed to resolve symlink for ${BASH_SOURCE[0]}" >&2
+            exit 1
+        }
+    fi
+
+    # Get script directory
+    SCRIPT_DIR="$(dirname "$SCRIPT_SOURCE")"
+    if ! cd "$SCRIPT_DIR" 2>/dev/null; then
+        echo "❌ Failed to cd to script directory: $SCRIPT_DIR" >&2
+        exit 1
+    fi
+    SCRIPT_DIR="$(pwd)"
+
+    # Navigate to project root (.claude/hooks -> ../..)
+    if ! cd "$SCRIPT_DIR/../.." 2>/dev/null; then
+        echo "❌ Failed to navigate to project root from $SCRIPT_DIR" >&2
+        exit 1
+    fi
+
+    export PROJECT_ROOT="$(pwd)"
+
+    # Return to original directory (optional, for safety)
+    cd - >/dev/null || true
+fi
+
 # Validate script permissions
 validate_script_permissions() {
     local script_path="$1"
@@ -23,7 +54,7 @@ validate_json_syntax() {
 
 # Specific validation for retrospective components
 validate_retrospective_skills() {
-    local base_path="/mnt/c/Users/masha/Documents/claude-flow-novice/.claude/skills"
+    local base_path="${PROJECT_ROOT}/.claude/skills"
     local skills=(
         "pattern-extraction/extract-patterns.sh"
         "playbook-auto-update/auto-update-playbook.sh"
@@ -49,7 +80,7 @@ validate_retrospective_skills() {
 
 # Validate playbook JSON
 validate_playbook() {
-    local playbook_path="/mnt/c/Users/masha/Documents/claude-flow-novice/docs/PLAYBOOK.json"
+    local playbook_path="${PROJECT_ROOT}/docs/PLAYBOOK.json"
     validate_json_syntax "$playbook_path"
 }
 

package/.claude/hooks/cfn-pre-edit-security-warning.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+#
+# Pre-Edit Security Warning Hook
+# Warns security-specialist agents when editing documentation files
+# to remind them about credential redaction requirements
+#
+# Usage: Called automatically by cfn-invoke-pre-edit.sh
+#
+
+set -euo pipefail
+
+FILE_PATH="${1:-}"
+AGENT_TYPE="${2:-unknown}"
+
+# Only warn when editing documentation as security-specialist
+if [[ "$FILE_PATH" == docs/* ]] && [[ "$AGENT_TYPE" == "security-specialist" ]]; then
+  echo ""
+  echo "⚠️  SECURITY WARNING: Editing documentation as security-specialist"
+  echo "    ════════════════════════════════════════════════════════════"
+  echo ""
+  echo "    📋 MANDATORY REDACTION PROTOCOL:"
+  echo "       • ALWAYS redact sensitive values: API keys, passwords, tokens"
+  echo "       • Use [REDACTED] or placeholder patterns only"
+  echo "       • See: docs/templates/SECURITY_AUDIT_TEMPLATE.md"
+  echo ""
+  echo "    ✅ CORRECT:"
+  echo "       API_KEY=sk-ant-[REDACTED]"
+  echo "       PASSWORD=[REDACTED]"
+  echo "       JWT_TOKEN=eyJhbGci[REDACTED]..."
+  echo ""
+  echo "    ❌ WRONG:"
+  echo "       API_KEY=sk-ant-actual-key-value"
+  echo "       PASSWORD=actual-password-123"
+  echo ""
+  echo "    🛡️  Pre-commit hook will BLOCK commits with exposed credentials"
+  echo ""
+fi
+
+# Exit 0 (non-blocking warning)
+exit 0

package/.claude/skills/cfn-agent-spawning/spawn-agent.sh

@@ -6,24 +6,26 @@
 set -euo pipefail
 
 
-# ⚠️ ANTI-023 MEMORY LEAK PROTECTION: Environment Sanitization
-# Load and apply environment sanitization to prevent memory leaks
-# shellcheck source=../cfn-environment-sanitization/sanitize-environment.sh
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-if [[ -f "$SCRIPT_DIR/../cfn-environment-sanitization/sanitize-environment.sh" ]]; then
-    source "$SCRIPT_DIR/../cfn-environment-sanitization/sanitize-environment.sh" --strict
-    echo "✅ Agent spawning environment sanitized" >&2
-else
-    echo "⚠️ Environment sanitization not available - proceeding without protection" >&2
-fi
-
 # ⚠️ ANTI-023 MEMORY LEAK PROTECTION: Block Task Mode agents
 # Task Mode agents spawn via Task() tool and should NOT use agent spawning CLI
-if [[ -z "${1:-}" || -z "${TASK_ID:-}" ]]; then
-    echo "❌ TASK MODE DETECTED - Agent spawning CLI forbidden" >&2
+# CLI mode requires TASK_ID environment variable (validates existence, not pattern)
+if [[ -z "${TASK_ID:-}" ]]; then
+    echo "❌ ERROR: TASK_ID environment variable required for CLI mode" >&2
     echo "🚨 ANTI-023: This script is for CLI-spawned coordinators only" >&2
-    echo "💡 Task Mode agent spawning should be handled directly by Main Chat" >&2
-    echo "🔧 Agent spawned via Task() tool - use Task() tool for spawning instead" >&2
+    echo "💡 Task Mode agents should use Task() tool, not CLI spawning" >&2
+    exit 1
+fi
+
+# Sanitize TASK_ID to prevent command injection
+if [[ "${TASK_ID}" =~ [^a-zA-Z0-9._-] ]]; then
+    echo "❌ ERROR: TASK_ID contains invalid characters: ${TASK_ID}" >&2
+    echo "Allowed: alphanumeric, dot, underscore, hyphen" >&2
+    exit 1
+fi
+
+# Validate required parameters for CLI mode
+if [[ -z "${1:-}" ]]; then
+    echo "❌ ERROR: Agent type required" >&2
     exit 1
 fi
 
@@ -121,18 +123,14 @@ spawn_agents() {
   log_info "Spawning agents: $agents"
   log_info "Task: $task"
 
-  # Build spawn command
-  local spawn_cmd="npx claude-flow-spawn \"$task\" --agents=$agents --provider=$provider"
-
-  # Add optional Redis channel
+  # Execute spawn command directly with proper quoting (no eval - prevents command injection)
+  local exit_code=0
   if [[ -n "$redis_channel" ]]; then
-    spawn_cmd="$spawn_cmd --redis-channel=$redis_channel"
+    npx claude-flow-spawn "$task" --agents="$agents" --provider="$provider" --redis-channel="$redis_channel" || exit_code=$?
+  else
+    npx claude-flow-spawn "$task" --agents="$agents" --provider="$provider" || exit_code=$?
   fi
 
-  # Execute spawn
-  eval "$spawn_cmd"
-  local exit_code=$?
-
   if [[ $exit_code -eq 0 ]]; then
     log_info "Agents spawned successfully"
   else

package/.claude/skills/cfn-docker-agent-spawning/SKILL.md

@@ -156,15 +156,39 @@ cfn-docker-agent-spawn \
 - **Batch Operations**: 0.3-0.5 CPU units per agent
 
 ### Network Configuration
+
+**Multi-Worktree Network Isolation:**
+
+For multi-worktree environments, use project-scoped network names:
+
 ```bash
-# Create isolated network for MCP communication
-docker network create mcp-network --driver bridge
+# Set project name from environment (set by run-in-worktree.sh)
+PROJECT_NAME="${COMPOSE_PROJECT_NAME:-cfn-default}"
+
+# Create isolated network for MCP communication (worktree-scoped)
+docker network create "${PROJECT_NAME}_mcp-network" --driver bridge
 
 # Connect containers to MCP network
-docker network connect mcp-network agent-frontend-001
-docker network connect mcp-network playwright-mcp
+docker network connect "${PROJECT_NAME}_mcp-network" agent-frontend-001
+docker network connect "${PROJECT_NAME}_mcp-network" playwright-mcp
 ```
 
+**Service Discovery Within Networks:**
+
+Agents within the Docker network can access services by name:
+```bash
+# Use service names (not container names) for connections
+redis-cli -h redis              # Resolves to Redis service
+psql -h postgres                # Resolves to PostgreSQL service
+curl http://orchestrator:3001   # Resolves to orchestrator service
+```
+
+**Why Project-Scoped Networks?**
+- Prevents network name conflicts between worktrees
+- Isolates agent communication per branch
+- Enables simultaneous multi-worktree development
+- Automatically managed by docker-compose with COMPOSE_PROJECT_NAME
+
 ## Integration with CFN Docker Skills
 
 ### Skill-Based MCP Selection

package/.claude/skills/cfn-docker-agent-spawning/spawn-agent.sh

@@ -8,7 +8,9 @@ set -euo pipefail
 # Default configuration
 DEFAULT_MEMORY_LIMIT="1g"
 DEFAULT_CPU_LIMIT="1.0"
-DEFAULT_NETWORK="mcp-network"
+# Dynamic network detection for multi-worktree support
+DEFAULT_NETWORK="${COMPOSE_PROJECT_NAME:+${COMPOSE_PROJECT_NAME}_mcp-network}"
+DEFAULT_NETWORK="${DEFAULT_NETWORK:-mcp-network}"
 DEFAULT_IMAGE="claude-flow-novice-agent:latest"
 
 # Colors for output

package/.claude/skills/cfn-docker-loop-orchestration/orchestrate.sh

@@ -1,9 +1,16 @@
 #!/bin/bash
+set -euo pipefail
 
 # CFN Docker Loop Orchestration Implementation
 # Usage: ./orchestrate.sh [OPERATION] [TASK_ID] [OPTIONS]
 
-set -euo pipefail
+# Determine PROJECT_ROOT
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+
+# Detect worktree/branch for environment injection
+CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "main")
+export WORKTREE_BRANCH="${CURRENT_BRANCH}"
 
 # Default configuration
 DEFAULT_MAX_ITERATIONS=10
@@ -75,6 +82,7 @@ Options:
   --gate-threshold NUM     Gate threshold (default: 0.75)
   --consensus-threshold NUM Consensus threshold (default: 0.90)
   --context-file PATH      Task context file
+  --success-criteria JSON  Success criteria for test-driven validation
   --timeout SECONDS        Operation timeout
   --memory-limit LIMIT     Agent memory limit
   --network NAME           Docker network
@@ -98,6 +106,72 @@ Examples:
 EOF
 }
 
+# JSON validation helper with security bounds checking
+validate_json_context() {
+    local json_str="$1"
+
+    if [ -z "$json_str" ]; then
+        return 1
+    fi
+
+    # Security: Check size (max 10MB) BEFORE parsing
+    local size=$(echo -n "$json_str" | wc -c)
+    local MAX_JSON_SIZE=10485760  # 10MB limit
+
+    if [ "$size" -gt "$MAX_JSON_SIZE" ]; then
+        log_error "JSON exceeds maximum size (10MB): ${size} bytes"
+        log_error "Security Risk: DoS via excessive memory consumption"
+        return 1
+    fi
+
+    # Validate JSON structure
+    if ! echo "$json_str" | jq empty 2>/dev/null; then
+        log_error "Invalid JSON structure"
+        return 1
+    fi
+
+    # Security: Bounds check - validate array sizes if success criteria
+    if echo "$json_str" | jq -e '.test_suites' >/dev/null 2>&1; then
+        local TEST_SUITE_COUNT=$(echo "$json_str" | jq '.test_suites | length' 2>/dev/null || echo "0")
+        local MAX_TEST_SUITES=50
+
+        if [ "$TEST_SUITE_COUNT" -gt "$MAX_TEST_SUITES" ]; then
+            log_error "Test suites exceed maximum ($MAX_TEST_SUITES): $TEST_SUITE_COUNT"
+            log_error "Security Risk: DoS via resource exhaustion"
+            return 1
+        fi
+    fi
+
+    return 0
+}
+
+# Input sanitization helper
+sanitize_input() {
+    local input="$1"
+    local max_length="${2:-256}"
+
+    # SECURITY FIX #2: Command injection prevention - strict alphanumeric whitelist
+    # Allows ONLY: letters, numbers, dash, underscore, space, comma, period, colon
+    local sanitized=$(echo "$input" | tr -cd '[:alnum:] _,.:-')
+
+    # Length bounds check
+    if [ ${#input} -gt "$max_length" ]; then
+        log_error "Input exceeds maximum length ($max_length): ${#input}"
+        return 1
+    fi
+
+    # Reject if input contains shell metacharacters: $, `, ;, |, &, >, <, (, ), {, }, [, ], \, ", ', =
+    if [[ "$input" =~ (\$|`|;|\||&|>|<|\(|\)|\{|\}|\[|\]|\\|\"|\'|=) ]]; then
+        log_error "Input contains dangerous shell metacharacters"
+        log_error "Original: $input"
+        log_error "Security Risk: Command injection attack prevented"
+        return 1
+    fi
+
+    echo "$sanitized"
+    return 0
+}
+
 # Mode configuration
 get_mode_config() {
     local mode="$1"
@@ -118,10 +192,6 @@ get_mode_config() {
     esac
 }
 
-# Get script directory
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$(dirname "$SCRIPT_DIR")/../.." && pwd)"
-
 # Path to skills
 REDIS_COORDINATION_SKILL="$PROJECT_ROOT/.claude/skills/cfn-docker-redis-coordination/coordinate.sh"
 AGENT_SPAWNING_SKILL="$PROJECT_ROOT/.claude/skills/cfn-docker-agent-spawning/spawn-agent.sh"
@@ -144,6 +214,7 @@ GATE_THRESHOLD="$DEFAULT_GATE_THRESHOLD"
 CONSENSUS_THRESHOLD="$DEFAULT_CONSENSUS_THRESHOLD"
 CONTEXT_FILE=""
 TIMEOUT=""
+SUCCESS_CRITERIA=""
 MEMORY_LIMIT=""
 NETWORK=""
 ADAPTIVE_SELECTION=false
@@ -187,6 +258,10 @@ while [[ $# -gt 0 ]]; do
             CONTEXT_FILE="$2"
             shift 2
             ;;
+        --success-criteria)
+            SUCCESS_CRITERIA="$2"
+            shift 2
+            ;;
         --timeout)
             TIMEOUT="$2"
             shift 2
@@ -534,6 +609,23 @@ init() {
 }
 EOF
 
+    # Store success criteria if provided
+    if [[ -n "$SUCCESS_CRITERIA" ]]; then
+        if validate_json_context "$SUCCESS_CRITERIA"; then
+            # Store in Redis using coordination skill
+            if command -v redis-cli >/dev/null 2>&1; then
+                redis-cli HSET "task:${task_id}:context" "success-criteria" "$SUCCESS_CRITERIA" >/dev/null 2>&1 || {
+                    log_warning "Failed to store success criteria in Redis, will pass via env vars"
+                }
+                log "Stored success criteria ($(echo "$SUCCESS_CRITERIA" | jq -r '.test_suites | length' 2>/dev/null || echo '0') test suites)"
+            else
+                log_warning "Redis not available, success criteria will be passed via environment variables"
+            fi
+        else
+            log_error "Invalid success criteria JSON, skipping storage"
+        fi
+    fi
+
     log_success "Loop orchestration initialized: $task_id"
 }
 
@@ -550,6 +642,36 @@ spawn_loop3() {
     log_loop "Spawning Loop 3 implementers (iteration $iteration)"
     log "Agents: $agents"
 
+    # Load success criteria from Redis (if available)
+    local AGENT_SUCCESS_CRITERIA=""
+    local AGENT_SUCCESS_CRITERIA_B64=""
+
+    if command -v redis-cli >/dev/null 2>&1; then
+        local LOADED_CRITERIA=$(redis-cli HGET "task:${task_id}:context" "success-criteria" 2>/dev/null || echo "")
+
+        if [[ -n "$LOADED_CRITERIA" && "$LOADED_CRITERIA" != "null" ]]; then
+            # Validate JSON
+            if echo "$LOADED_CRITERIA" | jq empty 2>/dev/null; then
+                AGENT_SUCCESS_CRITERIA="$LOADED_CRITERIA"
+
+                # Base64-encode for safe environment variable passing
+                AGENT_SUCCESS_CRITERIA_B64=$(echo -n "$AGENT_SUCCESS_CRITERIA" | base64 -w 0 2>/dev/null || echo -n "$AGENT_SUCCESS_CRITERIA" | base64)
+
+                local TEST_SUITE_COUNT=$(echo "$AGENT_SUCCESS_CRITERIA" | jq -r '.test_suites | length' 2>/dev/null || echo "0")
+                log "Success criteria loaded ($TEST_SUITE_COUNT test suites)"
+            else
+                log_warning "Invalid success criteria JSON in Redis, skipping"
+            fi
+        fi
+    fi
+
+    # Fallback to global SUCCESS_CRITERIA if not in Redis
+    if [[ -z "$AGENT_SUCCESS_CRITERIA" && -n "$SUCCESS_CRITERIA" ]]; then
+        AGENT_SUCCESS_CRITERIA="$SUCCESS_CRITERIA"
+        AGENT_SUCCESS_CRITERIA_B64=$(echo -n "$AGENT_SUCCESS_CRITERIA" | base64 -w 0 2>/dev/null || echo -n "$AGENT_SUCCESS_CRITERIA" | base64)
+        log "Using global success criteria (not in Redis)"
+    fi
+
     # Check for execution plan
     local plan_file="/tmp/cfn-docker-plan-${task_id}.json"
     local has_plan=false
@@ -587,7 +709,7 @@ spawn_loop3() {
         local context_file="/tmp/task-context-${task_id}-loop3-${iteration}-${agent_type}.json"
 
         # Create enhanced context with atomic task assignment
-        cat > "$context_file" << EOF
+        local context_json=$(cat << EOF
 {
   "task_id": "$task_id",
   "loop_number": 3,
@@ -603,6 +725,14 @@ spawn_loop3() {
   "created_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 }
 EOF
+)
+
+        # Add success criteria if available (stored separately due to potential size)
+        if [[ -n "$AGENT_SUCCESS_CRITERIA_B64" ]]; then
+            context_json=$(echo "$context_json" | jq --arg criteria_b64 "$AGENT_SUCCESS_CRITERIA_B64" '. + {success_criteria_b64: $criteria_b64}')
+        fi
+
+        echo "$context_json" > "$context_file"
 
         # Get task context from Redis if available
         if [[ -n "$CONTEXT_FILE" ]]; then
@@ -612,6 +742,11 @@ EOF
         fi
 
         if [[ "$DRY_RUN" == false ]]; then
+            # Docker container environment: Agent spawning skill will extract
+            # success_criteria_b64 from context file and pass to container via:
+            # docker run --env AGENT_SUCCESS_CRITERIA_B64=<base64-encoded-json>
+            # This enables secure test-driven validation in containerized agents
+
             local agent_id
             agent_id=$("$AGENT_SPAWNING_SKILL" \
                 "$agent_type" \
@@ -726,26 +861,95 @@ gate_check() {
 
     log_loop "Performing gate check for iteration $iteration"
 
-    if monitor_loop3 "$task_id" "$gate_threshold" "$iteration"; then
-        # Gate passed - proceed to Loop 2
-        log_success "Gate PASSED - proceeding to Loop 2 validation"
+    # First, ensure Loop 3 agents have completed
+    if ! monitor_loop3 "$task_id" "$gate_threshold" "$iteration"; then
+        log_error "Loop 3 monitoring failed"
+        return 1
+    fi
 
-        # Signal gate passed for Loop 2 agents
-        "$REDIS_COORDINATION_SKILL" "$REDIS_CMD" LPUSH "cfn_docker:task:$task_id:gate-passed" "proceed" > /dev/null
+    # Get Loop 3 agent IDs for gate check
+    local agents_file="/tmp/loop3-agents-${task_id}-${iteration}.txt"
+    local loop3_agent_ids=""
 
-        return 0
+    if [[ -f "$agents_file" ]]; then
+        loop3_agent_ids=$(cat "$agents_file" | tr '\n' ',' | sed 's/,$//')
     else
-        # Gate failed - check if we can iterate
-        if [[ $iteration -lt $max_iterations ]]; then
-            log_warning "Gate FAILED - iterating Loop 3 ($iteration/$max_iterations)"
+        log_error "No Loop 3 agent IDs found for gate check"
+        return 1
+    fi
 
-            # Force next iteration
-            spawn_loop3 "$task_id" "$AGENTS" $((iteration + 1))
-            return 2  # Signal to iterate
+    # Load success criteria from Redis
+    local gate_success_criteria=""
+    if command -v redis-cli >/dev/null 2>&1; then
+        gate_success_criteria=$(redis-cli HGET "task:${task_id}:context" "success-criteria" 2>/dev/null || echo "")
+    fi
+
+    # Fallback to global SUCCESS_CRITERIA
+    if [[ -z "$gate_success_criteria" && -n "$SUCCESS_CRITERIA" ]]; then
+        gate_success_criteria="$SUCCESS_CRITERIA"
+    fi
+
+    # Use test-driven gate check helper if available
+    local GATE_CHECK_HELPER="$PROJECT_ROOT/.claude/skills/cfn-loop-orchestration/helpers/gate-check.sh"
+
+    if [[ -x "$GATE_CHECK_HELPER" ]]; then
+        log "Using test-driven gate check"
+
+        # Prepare arguments
+        local gate_args=(
+            --task-id "$task_id"
+            --agents "$loop3_agent_ids"
+            --threshold "$gate_threshold"
+            --min-quorum "0.66"
+            --mode "$MODE"
+        )
+
+        # Add success criteria if available
+        if [[ -n "$gate_success_criteria" ]]; then
+            gate_args+=(--success-criteria "$gate_success_criteria")
+            gate_args+=(--strategy "test-driven")
         else
-            log_error "Gate FAILED - max iterations reached ($max_iterations)"
-            return 1
+            gate_args+=(--strategy "confidence")
+            log_warning "No success criteria available, using confidence-based gate check"
+        fi
+
+        if "$GATE_CHECK_HELPER" "${gate_args[@]}"; then
+            # Gate passed - proceed to Loop 2
+            log_success "Gate PASSED - proceeding to Loop 2 validation"
+
+            # Signal gate passed for Loop 2 agents
+            if command -v redis-cli >/dev/null 2>&1; then
+                redis-cli LPUSH "cfn_docker:task:$task_id:gate-passed" "proceed" > /dev/null 2>&1 || true
+            fi
+
+            return 0
+        else
+            # Gate failed - check if we can iterate
+            if [[ $iteration -lt $max_iterations ]]; then
+                log_warning "Gate FAILED - iterating Loop 3 ($iteration/$max_iterations)"
+
+                # Force next iteration
+                spawn_loop3 "$task_id" "$AGENTS" $((iteration + 1))
+                return 2  # Signal to iterate
+            else
+                log_error "Gate FAILED - max iterations reached ($max_iterations)"
+                return 1
+            fi
         fi
+    else
+        # Fallback to legacy confidence-based gate check
+        log_warning "Gate check helper not found, using legacy confidence-based validation"
+
+        # The monitor_loop3 function already checked confidence
+        # If we got here, monitoring succeeded, so gate passes
+        log_success "Gate PASSED (legacy mode)"
+
+        # Signal gate passed
+        if command -v redis-cli >/dev/null 2>&1; then
+            redis-cli LPUSH "cfn_docker:task:$task_id:gate-passed" "proceed" > /dev/null 2>&1 || true
+        fi
+
+        return 0
     fi
 }