claude-flow-novice 2.18.13 → 2.18.14

package/epic-with-personas-2025-12-09-17-15-13.json

@@ -0,0 +1,253 @@
+{
+  "epic": {
+    "id": "EPIC-329313",
+    "title": "Build a real-time analytics dashboard with user au",
+    "description": "Build a real-time analytics dashboard with user authentication, data visualization, and automated reporting capabilities\n",
+    "priority": "high",
+    "estimatedDuration": "TBD",
+    "budget": "TBD",
+    "status": "in-review",
+    "metadata": {
+      "createdAt": "2025-12-10T01:15:13.018Z",
+      "reviewMode": "standard",
+      "devopsEnforced": false
+    },
+    "personas": [
+      {
+        "name": "product-owner",
+        "reviewOrder": 1,
+        "status": "completed",
+        "insights": [
+          "User-centric approach identified in requirements",
+          "Clear value proposition needed for stakeholder alignment"
+        ],
+        "recommendations": [
+          {
+            "id": "PO-001",
+            "title": "Create detailed user story mapping",
+            "type": "blocking",
+            "priority": "critical",
+            "estimatedCost": "$5,000",
+            "description": "Map user journeys to ensure all features address real user needs"
+          },
+          {
+            "id": "PO-003",
+            "title": "Define success metrics and KPIs",
+            "type": "suggested",
+            "priority": "high",
+            "estimatedCost": "$3,000",
+            "description": "Establish measurable success criteria for the epic"
+          }
+        ],
+        "costAnalysis": {
+          "productPlanning": "$8,000",
+          "userResearch": "$5,000",
+          "stakeholderManagement": "$4,000"
+        }
+      },
+      {
+        "name": "architect",
+        "reviewOrder": 2,
+        "status": "completed",
+        "insights": [
+          "Architecture must balance complexity with maintainability"
+        ],
+        "recommendations": [
+          {
+            "id": "ARCH-001",
+            "title": "Design system architecture with clear component boundaries",
+            "type": "blocking",
+            "priority": "critical",
+            "estimatedCost": "$15,000",
+            "description": "Create detailed architecture diagrams and component specifications"
+          },
+          {
+            "id": "ARCH-002",
+            "title": "Define integration patterns and data flows",
+            "type": "suggested",
+            "priority": "high",
+            "estimatedCost": "$8,000",
+            "description": "Document how components will interact and share data"
+          },
+          {
+            "id": "ARCH-004",
+            "title": "Plan for future extensibility and evolution",
+            "type": "suggested",
+            "priority": "medium",
+            "estimatedCost": "$5,000",
+            "description": "Design for anticipated future requirements"
+          }
+        ],
+        "costAnalysis": {
+          "architectureDesign": "$20,000",
+          "technologySelection": "$10,000",
+          "documentation": "$5,000"
+        }
+      },
+      {
+        "name": "security-specialist",
+        "reviewOrder": 3,
+        "status": "completed",
+        "insights": [
+          "Authentication and authorization mechanisms are critical",
+          "Data protection and privacy must be addressed early",
+          "Security should be integrated throughout the development lifecycle"
+        ],
+        "recommendations": [
+          {
+            "id": "SEC-001",
+            "title": "Conduct threat modeling and security assessment",
+            "type": "blocking",
+            "priority": "critical",
+            "estimatedCost": "$12,000",
+            "description": "Identify potential security threats and mitigation strategies"
+          },
+          {
+            "id": "SEC-002",
+            "title": "Implement secure coding standards and reviews",
+            "type": "suggested",
+            "priority": "high",
+            "estimatedCost": "$8,000",
+            "description": "Establish security guidelines and review processes"
+          },
+          {
+            "id": "SEC-004",
+            "title": "Plan for incident response and monitoring",
+            "type": "suggested",
+            "priority": "medium",
+            "estimatedCost": "$6,000",
+            "description": "Prepare for security incident handling"
+          }
+        ],
+        "costAnalysis": {
+          "securityAssessment": "$15,000",
+          "implementation": "$10,000",
+          "testing": "$8,000"
+        }
+      },
+      {
+        "name": "performance-specialist",
+        "reviewOrder": 4,
+        "status": "completed",
+        "insights": [
+          "Performance requirements will be critical for user experience",
+          "Database performance and query optimization must be considered",
+          "Performance testing should start early and continue throughout"
+        ],
+        "recommendations": [
+          {
+            "id": "PERF-001",
+            "title": "Define performance requirements and success criteria",
+            "type": "blocking",
+            "priority": "critical",
+            "estimatedCost": "$8,000",
+            "description": "Establish measurable performance targets and SLAs"
+          },
+          {
+            "id": "PERF-002",
+            "title": "Implement performance monitoring and alerting",
+            "type": "suggested",
+            "priority": "high",
+            "estimatedCost": "$6,000",
+            "description": "Set up tools to track performance metrics in production"
+          },
+          {
+            "id": "PERF-004",
+            "title": "Create performance optimization plan",
+            "type": "suggested",
+            "priority": "medium",
+            "estimatedCost": "$5,000",
+            "description": "Identify and plan for performance improvements"
+          }
+        ],
+        "costAnalysis": {
+          "performanceTesting": "$10,000",
+          "monitoring": "$7,000",
+          "optimization": "$8,000"
+        }
+      },
+      {
+        "name": "accessibility-advocate",
+        "reviewOrder": 5,
+        "status": "completed",
+        "insights": [
+          "UI components must meet WCAG 2.1 AA standards",
+          "Accessibility benefits all users, not just those with disabilities"
+        ],
+        "recommendations": [
+          {
+            "id": "A11Y-001",
+            "title": "Ensure WCAG 2.1 AA compliance for all user interfaces",
+            "type": "blocking",
+            "priority": "critical",
+            "estimatedCost": "$10,000",
+            "description": "Make the application accessible to users with disabilities"
+          },
+          {
+            "id": "A11Y-002",
+            "title": "Conduct accessibility testing with assistive technologies",
+            "type": "suggested",
+            "priority": "high",
+            "estimatedCost": "$6,000",
+            "description": "Test with screen readers, keyboard navigation, and other tools"
+          },
+          {
+            "id": "A11Y-004",
+            "title": "Create accessibility documentation and guides",
+            "type": "suggested",
+            "priority": "medium",
+            "estimatedCost": "$4,000",
+            "description": "Document accessibility features and usage"
+          }
+        ],
+        "costAnalysis": {
+          "accessibilityImplementation": "$15,000",
+          "testing": "$5,000",
+          "training": "$3,000"
+        }
+      },
+      {
+        "name": "devops-engineer",
+        "reviewOrder": 6,
+        "status": "completed",
+        "insights": [
+          "Infrastructure as Code provides reproducibility and consistency"
+        ],
+        "recommendations": [
+          {
+            "id": "DEVOPS-001",
+            "title": "Set up CI/CD pipeline for automated builds and deployments",
+            "type": "suggested",
+            "priority": "high",
+            "estimatedCost": "$10,000",
+            "description": "Automate testing, building, and deployment processes"
+          },
+          {
+            "id": "DEVOPS-002",
+            "title": "Implement infrastructure monitoring and alerting",
+            "type": "suggested",
+            "priority": "high",
+            "estimatedCost": "$7,000",
+            "description": "Monitor application and infrastructure health"
+          },
+          {
+            "id": "DEVOPS-004",
+            "title": "Create runbooks and operational documentation",
+            "type": "suggested",
+            "priority": "medium",
+            "estimatedCost": "$5,000",
+            "description": "Document operational procedures and troubleshooting"
+          }
+        ],
+        "costAnalysis": {
+          "infrastructureSetup": "$15,000",
+          "automation": "$10,000",
+          "monitoring": "$8,000"
+        }
+      }
+    ],
+    "implementationRoadmap": [],
+    "totalCostBreakdown": {},
+    "riskAssessment": {}
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow-novice",
-  "version": "2.18.13",
+  "version": "2.18.14",
   "description": "Claude Flow Novice - Advanced orchestration platform for multi-agent AI workflows with CFN Loop architecture\n\nIncludes Local RuVector Accelerator and all CFN skills for complete functionality.",
   "main": "index.js",
   "type": "module",
@@ -118,6 +118,7 @@
     "yaml": "^2.3.4"
   },
   "devDependencies": {
+    "@cerebras/cerebras_cloud_sdk": "^1.59.0",
     "@types/bcryptjs": "^2.4.6",
     "@types/compression": "^1.7.5",
     "@types/cors": "^2.8.17",

package/test-epic-creator-security.sh

@@ -0,0 +1,203 @@
+#!/bin/bash
+set -euo pipefail
+
+# Test script to validate epic-creator-v2 security fixes
+# Tests command injection, path traversal, and input sanitization
+
+# Color codes for output
+readonly GREEN='\033[0;32m'
+readonly RED='\033[0;31m'
+readonly YELLOW='\033[1;33m'
+readonly NC='\033[0m' # No Color
+
+# Test counters
+TESTS_RUN=0
+TESTS_PASSED=0
+TESTS_FAILED=0
+
+# Logging functions
+log_test() {
+    echo -e "${YELLOW}[TEST]${NC} $1"
+}
+
+log_pass() {
+    echo -e "${GREEN}[PASS]${NC} $1"
+    ((TESTS_PASSED++))
+}
+
+log_fail() {
+    echo -e "${RED}[FAIL]${NC} $1"
+    ((TESTS_FAILED++))
+}
+
+# Run a test case
+run_test() {
+    ((TESTS_RUN++))
+    log_test "Running: $1"
+
+    if eval "$2"; then
+        log_pass "Test passed: $1"
+    else
+        log_fail "Test failed: $1"
+    fi
+    echo
+}
+
+# Test command injection protection
+test_command_injection() {
+    echo "=== Testing Command Injection Protection ==="
+
+    # Test 1: Command substitution attempt
+    run_test "Command substitution \$(whoami)" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! sanitize_string "test\$(whoami)" 2>/dev/null'
+
+    # Test 2: Backtick command substitution
+    run_test "Backtick command substitution \`whoami\`" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! sanitize_string "test\`whoami\`" 2>/dev/null'
+
+    # Test 3: Pipe character
+    run_test "Pipe character injection" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! sanitize_string "test | ls" 2>/dev/null'
+
+    # Test 4: Command chaining
+    run_test "Command chaining &&" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! sanitize_string "test && rm -rf" 2>/dev/null'
+
+    # Test 5: Command chaining ||"
+    run_test "Command chaining ||" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! sanitize_string "test || rm -rf" 2>/dev/null'
+
+    # Test 6: Semicolon
+    run_test "Semicolon separator" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! sanitize_string "test; rm -rf" 2>/dev/null'
+
+    # Test 7: Output redirection
+    run_test "Output redirection >" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! sanitize_string "test > /etc/passwd" 2>/dev/null'
+}
+
+# Test path traversal protection
+test_path_traversal() {
+    echo "=== Testing Path Traversal Protection ==="
+
+    # Test 1: Directory traversal
+    run_test "Directory traversal ../etc/passwd" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! validate_path "../../../etc/passwd" 2>/dev/null'
+
+    # Test 2: Absolute path outside
+    run_test "Absolute path outside /etc/passwd" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! validate_path "/etc/passwd" 2>/dev/null'
+
+    # Test 3: Home directory
+    run_test "Home directory ~/" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! validate_path "~/.ssh/id_rsa" 2>/dev/null'
+
+    # Test 4: Valid relative path
+    run_test "Valid relative path" \
+        '. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && validate_path "./output.json" 2>/dev/null'
+}
+
+# Test input validation
+test_input_validation() {
+    echo "=== Testing Input Validation ==="
+
+    # Test 1: Empty input
+    run_test "Empty epic description" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! validate_epic_description "" 2>/dev/null'
+
+    # Test 2: Too short input
+    run_test "Too short epic description" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! validate_epic_description "ab" 2>/dev/null'
+
+    # Test 3: Valid input
+    run_test "Valid epic description" \
+        '. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && validate_epic_description "This is a valid epic description" 2>/dev/null'
+
+    # Test 4: Input exceeding max length
+    run_test "Input exceeding max length" \
+        '!. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && ! sanitize_string "$(printf "a%.0s" {1..10001})" 2>/dev/null'
+}
+
+# Test secure temp file creation
+test_temp_file_creation() {
+    echo "=== Testing Secure Temp File Creation ==="
+
+    # Test 1: Create secure temp file
+    run_test "Create secure temp file" \
+        '. ./.claude/skills/cfn-epic-creator/security-utils.sh \
+            && temp_file=$(create_secure_temp "test" "tmp") \
+            && [[ -f "$temp_file" ]] \
+            && [[ "$(stat -c %a "$temp_file" 2>/dev/null || stat -f%A "$temp_file" 2>/dev/null)" == "600" ]] \
+            && rm -f "$temp_file"'
+}
+
+# Test epic creator with malicious inputs
+test_epic_creator_malicious() {
+    echo "=== Testing Epic Creator with Malicious Inputs ==="
+
+    # Test 1: Command injection in description
+    run_test "Epic creator with command injection" \
+        '! ./.claude/agents/cfn-dev-team/utility/epic-creator-v2.sh \
+            "test\$(whoami) injection" --mode=mvp >/dev/null 2>&1'
+
+    # Test 2: Path traversal in output
+    run_test "Epic creator with path traversal output" \
+        '! ./.claude/agents/cfn-dev-team/utility/epic-creator-v2.sh \
+            "test epic" --output="../../../etc/passwd" >/dev/null 2>&1'
+
+    # Test 3: Valid epic creation
+    run_test "Valid epic creation" \
+        'temp_out=$(mktemp) \
+            && ./.claude/agents/cfn-dev-team/utility/epic-creator-v2.sh \
+                "Test epic for validation" --output="$temp_out" >/dev/null 2>&1 \
+            && [[ -f "$temp_out" ]] \
+            && jq . "$temp_out" >/dev/null 2>&1 \
+            && rm -f "$temp_out"'
+}
+
+# Main execution
+main() {
+    echo "Starting Epic Creator v2 Security Validation Tests"
+    echo "=============================================="
+    echo
+
+    # Run all test suites
+    test_command_injection
+    test_path_traversal
+    test_input_validation
+    test_temp_file_creation
+    test_epic_creator_malicious
+
+    # Summary
+    echo "=============================================="
+    echo "Test Summary:"
+    echo "  Total tests run: $TESTS_RUN"
+    echo -e "  Passed: ${GREEN}$TESTS_PASSED${NC}"
+    echo -e "  Failed: ${RED}$TESTS_FAILED${NC}"
+
+    if [[ $TESTS_FAILED -eq 0 ]]; then
+        echo -e "\n${GREEN}✅ All security tests passed!${NC}"
+        exit 0
+    else
+        echo -e "\n${RED}❌ Some security tests failed!${NC}"
+        exit 1
+    fi
+}
+
+# Run main function
+main "$@"

package/.claude/skills/cfn-local-ruvector-accelerator/search_engine.py

@@ -1,200 +0,0 @@
-from sklearn.metrics.pairwise import cosine_similarity
-import numpy as np
-from typing import List, Dict, Optional, Tuple
-import sqlite3
-from datetime import datetime
-
-class EmbeddingsManager:
-    def __init__(self):
-        self.embeddings = {}
-    
-    def get_embedding(self, text: str) -> np.ndarray:
-        if text not in self.embeddings:
-            self.embeddings[text] = np.random.rand(1536).astype(np.float32)
-        return self.embeddings[text]
-
-class SQLiteStore:
-    def __init__(self, db_path: str = ":memory:"):
-        self.conn = sqlite3.connect(db_path)
-        self._init_db()
-    
-    def _init_db(self):
-        self.conn.execute("""
-            CREATE TABLE IF NOT EXISTS patterns (
-                id TEXT PRIMARY KEY,
-                pattern TEXT NOT NULL,
-                file_type TEXT,
-                embedding BLOB,
-                success_rate REAL DEFAULT 0.0,
-                usage_count INTEGER DEFAULT 0,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        self.conn.commit()
-    
-    def get_patterns(self, file_type: str = None, limit: int = 10) -> List[Dict]:
-        query = "SELECT * FROM patterns"
-        params = []
-        if file_type:
-            query += " WHERE file_type = ?"
-            params.append(file_type)
-        query += " ORDER BY usage_count DESC LIMIT ?"
-        params.append(limit)
-        
-        cursor = self.conn.execute(query, params)
-        columns = [desc[0] for desc in cursor.description]
-        return [dict(zip(columns, row)) for row in cursor.fetchall()]
-    
-    def get_pattern_by_id(self, pattern_id: str) -> Optional[Dict]:
-        cursor = self.conn.execute("SELECT * FROM patterns WHERE id = ?", (pattern_id,))
-        row = cursor.fetchone()
-        if row:
-            columns = [desc[0] for desc in cursor.description]
-            return dict(zip(columns, row))
-        return None
-    
-    def text_search(self, query: str, file_type: str = None, limit: int = 10) -> List[Dict]:
-        query_sql = "SELECT * FROM patterns WHERE pattern LIKE ?"
-        params = [f"%{query}%"]
-        if file_type:
-            query_sql += " AND file_type = ?"
-            params.append(file_type)
-        query_sql += " ORDER BY usage_count DESC LIMIT ?"
-        params.append(limit)
-        
-        cursor = self.conn.execute(query_sql, params)
-        columns = [desc[0] for desc in cursor.description]
-        return [dict(zip(columns, row)) for row in cursor.fetchall()]
-
-class SearchEngine:
-    def __init__(self, embeddings_manager: EmbeddingsManager, sqlite_store: SQLiteStore):
-        self.embeddings = embeddings_manager
-        self.db = sqlite_store
-        self._embedding_cache = {}
-        
-    def search(self, query_pattern: str, file_type: str = None, 
-               limit: int = 10, min_similarity: float = 0.7) -> List[Dict]:
-        """Search for similar patterns using semantic similarity"""
-        query_embedding = self.get_embedding(query_pattern)
-        
-        patterns = self.db.get_patterns(file_type=file_type, limit=limit * 3)
-        
-        if not patterns:
-            return []
-        
-        pattern_embeddings = []
-        valid_patterns = []
-        
-        for pattern in patterns:
-            if pattern['embedding']:
-                embedding = np.frombuffer(pattern['embedding'], dtype=np.float32)
-                pattern_embeddings.append(embedding)
-                valid_patterns.append(pattern)
-        
-        if not pattern_embeddings:
-            return self.search_by_text(query_pattern, file_type, limit)
-        
-        pattern_embeddings = np.array(pattern_embeddings)
-        similarities = self._calculate_similarity(query_embedding, pattern_embeddings)
-        
-        results = []
-        for i, pattern in enumerate(valid_patterns):
-            similarity = similarities[i]
-            if similarity >= min_similarity:
-                pattern['similarity_score'] = float(similarity)
-                pattern['hybrid_score'] = self._calculate_hybrid_score(pattern, similarity)
-                results.append(pattern)
-        
-        results.sort(key=lambda x: x['hybrid_score'], reverse=True)
-        return results[:limit]
-        
-    def search_by_text(self, query_text: str, file_type: str = None,
-                      limit: int = 10) -> List[Dict]:
-        """Full-text search fallback"""
-        patterns = self.db.text_search(query_text, file_type, limit)
-        
-        for pattern in patterns:
-            pattern['similarity_score'] = 0.5
-            pattern['hybrid_score'] = self._calculate_hybrid_score(pattern, 0.5)
-        
-        return patterns
-        
-    def get_embedding(self, text: str) -> np.ndarray:
-        """Get embedding for text with caching"""
-        if text in self._embedding_cache:
-            return self._embedding_cache[text]
-            
-        embedding = self.embeddings.get_embedding(text)
-        self._embedding_cache[text] = embedding
-        return embedding
-        
-    def _calculate_similarity(self, query_embedding: np.ndarray,
-                             pattern_embeddings: np.ndarray) -> np.ndarray:
-        """Calculate cosine similarities"""
-        return cosine_similarity([query_embedding], pattern_embeddings)[0]
-        
-    def get_similar_patterns(self, pattern_id: str, limit: int = 5) -> List[Dict]:
-        """Get patterns similar to a given pattern"""
-        pattern = self.db.get_pattern_by_id(pattern_id)
-        if not pattern:
-            return []
-        
-        return self.search(
-            query_pattern=pattern['pattern'],
-            file_type=pattern['file_type'],
-            limit=limit,
-            min_similarity=0.5
-        )
-    
-    def _calculate_hybrid_score(self, pattern: Dict, similarity: float) -> float:
-        """Calculate hybrid ranking score combining similarity, success rate, and usage"""
-        similarity_weight = 0.6
-        success_weight = 0.25
-        usage_weight = 0.15
-        
-        max_usage = 100
-        usage_score = min(pattern['usage_count'] / max_usage, 1.0)
-        
-        hybrid_score = (
-            similarity * similarity_weight +
-            pattern['success_rate'] * success_weight +
-            usage_score * usage_weight
-        )
-        
-        return hybrid_score
-    
-    def add_pattern(self, pattern_id: str, pattern_text: str, 
-                   file_type: str = None, success_rate: float = 0.0,
-                   usage_count: int = 0) -> None:
-        """Add a new pattern to the database"""
-        embedding = self.get_embedding(pattern_text)
-        embedding_blob = embedding.tobytes()
-        
-        self.db.conn.execute("""
-            INSERT OR REPLACE INTO patterns 
-            (id, pattern, file_type, embedding, success_rate, usage_count)
-            VALUES (?, ?, ?, ?, ?, ?)
-        """, (pattern_id, pattern_text, file_type, embedding_blob, 
-              success_rate, usage_count))
-        self.db.conn.commit()
-    
-    def update_usage(self, pattern_id: str, success: bool = True) -> None:
-        """Update pattern usage statistics"""
-        pattern = self.db.get_pattern_by_id(pattern_id)
-        if pattern:
-            new_usage = pattern['usage_count'] + 1
-            if success:
-                new_success_rate = ((pattern['success_rate'] * pattern['usage_count']) + 1) / new_usage
-            else:
-                new_success_rate = (pattern['success_rate'] * pattern['usage_count']) / new_usage
-            
-            self.db.conn.execute("""
-                UPDATE patterns 
-                SET usage_count = ?, success_rate = ?
-                WHERE id = ?
-            """, (new_usage, new_success_rate, pattern_id))
-            self.db.conn.commit()
-    
-    def clear_cache(self) -> None:
-        """Clear the embedding cache"""
-        self._embedding_cache.clear()

package/jest.config.ts.cjs

@@ -1,17 +0,0 @@
-module.exports = {
-  preset: 'ts-jest',
-  testEnvironment: 'node',
-  testMatch: ['**/*.test.ts', '**/*.test.cjs'],
-  transform: {
-    '^.+\\.ts$': 'ts-jest',
-  },
-  moduleNameMapper: {
-    '^(\\.{1,2}/.*)\\.js$': '$1',
-  },
-  extensionsToTreatAsEsm: ['.ts'],
-  globals: {
-    'ts-jest': {
-      useESM: true,
-    },
-  },
-};