claude-flow 3.25.6 → 3.26.0

package/v3/@claude-flow/shared/dist/hooks/safety/bash-safety.js

@@ -1,481 +0,0 @@
-/**
- * V3 Bash Safety Hook
- *
- * TypeScript conversion of V2 bash-hook.sh.
- * Provides command safety analysis, dangerous command detection,
- * secret detection, and safe alternatives.
- *
- * @module v3/shared/hooks/safety/bash-safety
- */
-import { HookEvent, HookPriority, } from '../types.js';
-/**
- * Dangerous command patterns
- */
-const DANGEROUS_PATTERNS = [
-    // Critical - Always block
-    {
-        pattern: /rm\s+(-[rRf]+\s+)*\//,
-        type: 'destructive',
-        severity: 'critical',
-        description: 'Recursive deletion from root directory',
-        block: true,
-    },
-    {
-        pattern: /rm\s+-rf\s+\/\*/,
-        type: 'destructive',
-        severity: 'critical',
-        description: 'Recursive deletion of all root files',
-        block: true,
-    },
-    {
-        pattern: /dd\s+if=.*of=\/dev\/(sd|hd|nvme)/,
-        type: 'destructive',
-        severity: 'critical',
-        description: 'Direct disk write that can destroy data',
-        block: true,
-    },
-    {
-        pattern: /mkfs\./,
-        type: 'destructive',
-        severity: 'critical',
-        description: 'Filesystem formatting command',
-        block: true,
-    },
-    {
-        pattern: />\s*\/dev\/sd[a-z]/,
-        type: 'destructive',
-        severity: 'critical',
-        description: 'Direct write to disk device',
-        block: true,
-    },
-    {
-        // Fork bomb patterns - various formats (with flexible spacing)
-        pattern: /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:|bomb\s*\(\)|while\s+true.*fork/,
-        type: 'resource',
-        severity: 'critical',
-        description: 'Fork bomb detected',
-        block: true,
-    },
-    {
-        pattern: /chmod\s+(-R\s+)?777\s+\//,
-        type: 'privilege',
-        severity: 'critical',
-        description: 'Setting dangerous permissions on root',
-        block: true,
-    },
-    // High - Block but offer alternatives
-    {
-        pattern: /rm\s+-rf\s+\*/,
-        type: 'destructive',
-        severity: 'high',
-        description: 'Recursive deletion of all files in directory',
-        block: true,
-    },
-    {
-        pattern: /rm\s+-rf\s+\.\//,
-        type: 'destructive',
-        severity: 'high',
-        description: 'Recursive deletion of current directory',
-        block: true,
-    },
-    {
-        pattern: /rm\s+-rf\s+~/,
-        type: 'destructive',
-        severity: 'high',
-        description: 'Recursive deletion of home directory',
-        block: true,
-    },
-    {
-        pattern: /curl.*\|\s*(bash|sh|zsh)/,
-        type: 'dangerous',
-        severity: 'high',
-        description: 'Piping remote content directly to shell',
-        block: true,
-    },
-    {
-        pattern: /wget.*-O-\s*\|\s*(bash|sh|zsh)/,
-        type: 'dangerous',
-        severity: 'high',
-        description: 'Piping remote content directly to shell',
-        block: true,
-    },
-    {
-        pattern: /eval\s+.*\$\(/,
-        type: 'dangerous',
-        severity: 'high',
-        description: 'Dynamic code execution with command substitution',
-        block: true,
-    },
-    // Medium - Warn
-    {
-        pattern: /rm\s+(?!.*-i)/,
-        type: 'destructive',
-        severity: 'medium',
-        description: 'Remove command without interactive flag',
-        block: false,
-    },
-    {
-        pattern: /sudo\s+rm/,
-        type: 'privilege',
-        severity: 'medium',
-        description: 'Privileged file deletion',
-        block: false,
-    },
-    {
-        pattern: /sudo\s+chmod/,
-        type: 'privilege',
-        severity: 'medium',
-        description: 'Privileged permission change',
-        block: false,
-    },
-    {
-        pattern: /git\s+push\s+.*--force/,
-        type: 'destructive',
-        severity: 'medium',
-        description: 'Force push can overwrite remote history',
-        block: false,
-    },
-    {
-        pattern: /git\s+reset\s+--hard/,
-        type: 'destructive',
-        severity: 'medium',
-        description: 'Hard reset discards uncommitted changes',
-        block: false,
-    },
-    {
-        pattern: /DROP\s+(DATABASE|TABLE)/i,
-        type: 'destructive',
-        severity: 'high',
-        description: 'Database/table deletion command',
-        block: false,
-    },
-    {
-        pattern: /TRUNCATE\s+TABLE/i,
-        type: 'destructive',
-        severity: 'medium',
-        description: 'Table truncation command',
-        block: false,
-    },
-    // Low - Informational
-    {
-        pattern: /kill\s+-9/,
-        type: 'dangerous',
-        severity: 'low',
-        description: 'Force kill signal prevents graceful shutdown',
-        block: false,
-    },
-    {
-        pattern: /killall/,
-        type: 'dangerous',
-        severity: 'low',
-        description: 'Kills all processes by name',
-        block: false,
-    },
-];
-/**
- * Secret patterns to detect and redact
- */
-const SECRET_PATTERNS = [
-    { pattern: /(password|passwd|pwd)\s*[=:]\s*['"]?([^\s'"]+)/i, name: 'password', redactGroup: 2 },
-    { pattern: /(api[_-]?key)\s*[=:]\s*['"]?([^\s'"]+)/i, name: 'API key', redactGroup: 2 },
-    { pattern: /(secret[_-]?key)\s*[=:]\s*['"]?([^\s'"]+)/i, name: 'secret key', redactGroup: 2 },
-    { pattern: /(access[_-]?token)\s*[=:]\s*['"]?([^\s'"]+)/i, name: 'access token', redactGroup: 2 },
-    { pattern: /(auth[_-]?token)\s*[=:]\s*['"]?([^\s'"]+)/i, name: 'auth token', redactGroup: 2 },
-    { pattern: /(bearer)\s+([a-zA-Z0-9._-]+)/i, name: 'bearer token', redactGroup: 2 },
-    { pattern: /(private[_-]?key)\s*[=:]\s*['"]?([^\s'"]+)/i, name: 'private key', redactGroup: 2 },
-    { pattern: /(\bsk-[a-zA-Z0-9]{20,})/i, name: 'OpenAI API key' },
-    { pattern: /(\bghp_[a-zA-Z0-9]{36,})/i, name: 'GitHub token' },
-    { pattern: /(\bnpm_[a-zA-Z0-9]{36,})/i, name: 'npm token' },
-    { pattern: /(AKIA[0-9A-Z]{16})/i, name: 'AWS access key' },
-];
-/**
- * Common dependencies to check
- */
-const DEPENDENCY_CHECKS = [
-    { command: /\bjq\b/, dependency: 'jq' },
-    { command: /\byq\b/, dependency: 'yq' },
-    { command: /\bawk\b/, dependency: 'awk' },
-    { command: /\bsed\b/, dependency: 'sed' },
-    { command: /\bcurl\b/, dependency: 'curl' },
-    { command: /\bwget\b/, dependency: 'wget' },
-    { command: /\bgit\b/, dependency: 'git' },
-    { command: /\bdocker\b/, dependency: 'docker' },
-    { command: /\bkubectl\b/, dependency: 'kubectl' },
-    { command: /\bpython3?\b/, dependency: 'python' },
-    { command: /\bnode\b/, dependency: 'node' },
-    { command: /\bnpm\b/, dependency: 'npm' },
-    { command: /\byarn\b/, dependency: 'yarn' },
-    { command: /\bpnpm\b/, dependency: 'pnpm' },
-];
-/**
- * Safe alternatives for dangerous commands (with patterns for matching)
- */
-const SAFE_ALTERNATIVES = [
-    {
-        pattern: /rm\s+-rf\s+\*/,
-        alternatives: [
-            'rm -ri * (interactive mode)',
-            'find . -maxdepth 1 -type f -delete (only files)',
-            'git clean -fd (for git repositories)',
-        ],
-    },
-    {
-        pattern: /rm\s+-rf/,
-        alternatives: [
-            'rm -ri (interactive mode)',
-            'trash-cli (move to trash instead)',
-            'mv to backup directory first',
-        ],
-    },
-    {
-        pattern: /kill\s+-9/,
-        alternatives: [
-            'kill (graceful termination first)',
-            'kill -15 (SIGTERM)',
-            'systemctl stop (for services)',
-        ],
-    },
-    {
-        pattern: /curl.*\|\s*(bash|sh|zsh)/,
-        alternatives: [
-            'Download script first, review, then execute',
-            'Use package managers when available',
-            'Verify script hash before execution',
-        ],
-    },
-    {
-        pattern: /wget.*\|\s*(bash|sh|zsh)/,
-        alternatives: [
-            'Download script first, review, then execute',
-            'Use package managers when available',
-            'Verify script hash before execution',
-        ],
-    },
-    {
-        pattern: /git\s+push.*--force/,
-        alternatives: [
-            'git push --force-with-lease (safer)',
-            'Create backup branch first',
-            'git push --force-if-includes',
-        ],
-    },
-    {
-        pattern: /git\s+reset\s+--hard/,
-        alternatives: [
-            'git stash (save changes first)',
-            'git reset --soft (keep changes staged)',
-            'Create backup branch first',
-        ],
-    },
-];
-/**
- * Bash Safety Hook Manager
- */
-export class BashSafetyHook {
-    registry;
-    blockedCommands = new Set();
-    availableDependencies = new Set();
-    constructor(registry) {
-        this.registry = registry;
-        this.registerHooks();
-        this.detectAvailableDependencies();
-    }
-    /**
-     * Register bash safety hooks
-     */
-    registerHooks() {
-        this.registry.register(HookEvent.PreCommand, this.analyzeCommand.bind(this), HookPriority.Critical, { name: 'bash-safety:pre-command' });
-    }
-    /**
-     * Detect available dependencies
-     */
-    async detectAvailableDependencies() {
-        // In a real implementation, this would check which commands are available
-        // For now, assume common ones are available
-        const commonDeps = ['git', 'node', 'npm', 'curl', 'sed', 'awk'];
-        commonDeps.forEach(dep => this.availableDependencies.add(dep));
-    }
-    /**
-     * Analyze a command for safety
-     */
-    async analyzeCommand(context) {
-        const commandInfo = context.command;
-        if (!commandInfo) {
-            return this.createResult('low', false, []);
-        }
-        const command = commandInfo.command;
-        const risks = [];
-        const warnings = [];
-        let blocked = false;
-        let blockReason;
-        let modifiedCommand;
-        let safeAlternatives;
-        // Check for dangerous patterns
-        for (const pattern of DANGEROUS_PATTERNS) {
-            if (pattern.pattern.test(command)) {
-                risks.push({
-                    type: pattern.type,
-                    severity: pattern.severity,
-                    description: pattern.description,
-                    pattern: pattern.pattern.toString(),
-                });
-                if (pattern.block) {
-                    blocked = true;
-                    blockReason = pattern.description;
-                }
-                // Find safe alternatives using pattern matching
-                for (const { pattern: altPattern, alternatives } of SAFE_ALTERNATIVES) {
-                    if (altPattern.test(command)) {
-                        safeAlternatives = alternatives;
-                        break;
-                    }
-                }
-            }
-        }
-        // Check for secrets
-        const { secrets, redactedCommand } = this.detectSecrets(command);
-        for (const secret of secrets) {
-            risks.push({
-                type: 'secret',
-                severity: 'high',
-                description: `Potential ${secret.name} detected in command`,
-            });
-            warnings.push(`Detected potential secret: ${secret.name}`);
-        }
-        // Check for missing dependencies
-        const missingDependencies = this.checkDependencies(command);
-        // Add -i flag to rm commands if not present
-        if (/\brm\s+/.test(command) && !/-i\b/.test(command) && !blocked) {
-            modifiedCommand = command.replace(/\brm\s+/, 'rm -i ');
-            warnings.push('Added -i flag for interactive confirmation');
-        }
-        // Calculate overall risk level
-        const riskLevel = this.calculateRiskLevel(risks);
-        // Determine if we should proceed
-        const shouldProceed = !blocked;
-        return {
-            success: true,
-            riskLevel,
-            blocked,
-            blockReason,
-            modifiedCommand,
-            risks,
-            safeAlternatives,
-            warnings: warnings.length > 0 ? warnings : undefined,
-            missingDependencies: missingDependencies.length > 0 ? missingDependencies : undefined,
-            redactedCommand: secrets.length > 0 ? redactedCommand : undefined,
-            abort: blocked,
-            data: blocked ? undefined : {
-                command: {
-                    ...commandInfo,
-                    command: modifiedCommand || command,
-                    isDestructive: risks.some(r => r.type === 'destructive'),
-                },
-            },
-        };
-    }
-    /**
-     * Detect secrets in command
-     */
-    detectSecrets(command) {
-        const secrets = [];
-        let redactedCommand = command;
-        for (const { pattern, name, redactGroup } of SECRET_PATTERNS) {
-            const match = pattern.exec(command);
-            if (match) {
-                secrets.push({ name, position: match.index });
-                // Redact the secret value
-                if (redactGroup && match[redactGroup]) {
-                    redactedCommand = redactedCommand.replace(match[redactGroup], '[REDACTED]');
-                }
-                else {
-                    redactedCommand = redactedCommand.replace(match[0], `[REDACTED_${name.toUpperCase().replace(/\s/g, '_')}]`);
-                }
-            }
-        }
-        return { secrets, redactedCommand };
-    }
-    /**
-     * Check for missing dependencies
-     */
-    checkDependencies(command) {
-        const missing = [];
-        for (const { command: pattern, dependency } of DEPENDENCY_CHECKS) {
-            if (pattern.test(command) && !this.availableDependencies.has(dependency)) {
-                missing.push(dependency);
-            }
-        }
-        return missing;
-    }
-    /**
-     * Calculate overall risk level
-     */
-    calculateRiskLevel(risks) {
-        if (risks.length === 0) {
-            return 'low';
-        }
-        const severities = risks.map(r => r.severity);
-        if (severities.includes('critical')) {
-            return 'critical';
-        }
-        if (severities.includes('high')) {
-            return 'high';
-        }
-        if (severities.includes('medium')) {
-            return 'medium';
-        }
-        return 'low';
-    }
-    /**
-     * Create a result object
-     */
-    createResult(riskLevel, blocked, risks) {
-        return {
-            success: true,
-            riskLevel,
-            blocked,
-            risks,
-        };
-    }
-    /**
-     * Manually analyze a command
-     */
-    async analyze(command) {
-        const context = {
-            event: HookEvent.PreCommand,
-            timestamp: new Date(),
-            command: { command },
-        };
-        return this.analyzeCommand(context);
-    }
-    /**
-     * Add a custom dangerous pattern
-     */
-    addDangerousPattern(pattern, type, severity, description, block = true) {
-        DANGEROUS_PATTERNS.push({ pattern, type, severity, description, block });
-    }
-    /**
-     * Mark a dependency as available
-     */
-    markDependencyAvailable(dependency) {
-        this.availableDependencies.add(dependency);
-    }
-    /**
-     * Check if a command would be blocked
-     */
-    wouldBlock(command) {
-        for (const pattern of DANGEROUS_PATTERNS) {
-            if (pattern.block && pattern.pattern.test(command)) {
-                return true;
-            }
-        }
-        return false;
-    }
-}
-/**
- * Create bash safety hook
- */
-export function createBashSafetyHook(registry) {
-    return new BashSafetyHook(registry);
-}
-//# sourceMappingURL=bash-safety.js.map

package/v3/@claude-flow/shared/dist/hooks/safety/file-organization.d.ts

@@ -1,144 +0,0 @@
-/**
- * V3 File Organization Hook
- *
- * TypeScript conversion of V2 file-hook.sh.
- * Enforces file organization, blocks writes to root folder,
- * suggests proper directories, and recommends formatters.
- *
- * @module v3/shared/hooks/safety/file-organization
- */
-import { HookContext, HookResult } from '../types.js';
-import { HookRegistry } from '../registry.js';
-/**
- * File organization hook result
- */
-export interface FileOrganizationResult extends HookResult {
-    /** Whether the file operation should be blocked */
-    blocked: boolean;
-    /** Reason for blocking */
-    blockReason?: string;
-    /** Suggested new path */
-    suggestedPath?: string;
-    /** Suggested directory */
-    suggestedDirectory?: string;
-    /** Formatter recommendation */
-    formatter?: FormatterRecommendation;
-    /** Linter recommendation */
-    linter?: LinterRecommendation;
-    /** File type detected */
-    fileType?: string;
-    /** Warnings */
-    warnings?: string[];
-    /** Organization issues detected */
-    issues?: OrganizationIssue[];
-}
-/**
- * Formatter recommendation
- */
-export interface FormatterRecommendation {
-    /** Formatter name */
-    name: string;
-    /** Command to run */
-    command: string;
-    /** Config file to check for */
-    configFile?: string;
-    /** Whether config exists */
-    configExists?: boolean;
-}
-/**
- * Linter recommendation
- */
-export interface LinterRecommendation {
-    /** Linter name */
-    name: string;
-    /** Command to run */
-    command: string;
-    /** Config file to check for */
-    configFile?: string;
-}
-/**
- * Organization issue
- */
-export interface OrganizationIssue {
-    /** Issue type */
-    type: 'wrong-directory' | 'naming-convention' | 'missing-config' | 'root-write';
-    /** Issue severity */
-    severity: 'info' | 'warning' | 'error';
-    /** Issue description */
-    description: string;
-    /** Suggested fix */
-    suggestedFix?: string;
-}
-/**
- * File Organization Hook Manager
- */
-export declare class FileOrganizationHook {
-    private registry;
-    private projectRoot;
-    constructor(registry: HookRegistry);
-    /**
-     * Register file organization hooks
-     */
-    private registerHooks;
-    /**
-     * Analyze file operation for organization issues
-     */
-    analyzeFileOperation(context: HookContext): Promise<FileOrganizationResult>;
-    /**
-     * Check if directory is root
-     */
-    private isRootDirectory;
-    /**
-     * Normalize path for comparison
-     */
-    private normalizePath;
-    /**
-     * Get file type information
-     */
-    private getFileTypeInfo;
-    /**
-     * Check naming convention
-     */
-    private checkNamingConvention;
-    /**
-     * Get formatter recommendation
-     */
-    private getFormatterRecommendation;
-    /**
-     * Get linter recommendation
-     */
-    private getLinterRecommendation;
-    /**
-     * Create result object
-     */
-    private createResult;
-    /**
-     * Manually analyze a file path
-     */
-    analyze(filePath: string): Promise<FileOrganizationResult>;
-    /**
-     * Get suggested directory for a file
-     */
-    getSuggestedDirectory(fileName: string): string | null;
-    /**
-     * Check if a file path would be blocked
-     */
-    wouldBlock(filePath: string): boolean;
-    /**
-     * Set project root directory
-     */
-    setProjectRoot(root: string): void;
-    /**
-     * Get all formatter recommendations
-     */
-    getAllFormatters(): Record<string, FormatterRecommendation>;
-    /**
-     * Get all linter recommendations
-     */
-    getAllLinters(): Record<string, LinterRecommendation>;
-}
-/**
- * Create file organization hook
- */
-export declare function createFileOrganizationHook(registry: HookRegistry): FileOrganizationHook;
-//# sourceMappingURL=file-organization.d.ts.map