claude-flow 3.32.26 → 3.32.30

package/node_modules/@claude-flow/security/dist/tool-output-guardrail.js

@@ -0,0 +1,257 @@
+/**
+ * ToolOutputGuardrail — semantic screening of content returned by MCP tool
+ * calls, memory reads, and external API responses before that content enters
+ * agent reasoning. Closes the OWASP ASI01 (Agent Goal Hijacking) gap
+ * identified in ruvnet/ruflo#2149 / ADR-131.
+ *
+ * Threat model
+ * ------------
+ * Attackers embed malicious instructions in content the agent retrieves
+ * autonomously (web page, MCP tool response, memory entry). An LLM cannot
+ * reliably distinguish instructions from data once both are in the prompt.
+ * System-level per-boundary guardrails are the only category with
+ * sub-millisecond latency and no model dependency (arXiv:2601.17548,
+ * Jan 2026 systematic review).
+ *
+ * Scope
+ * -----
+ * - Detection only — does NOT modify the running prompt; callers decide
+ *   what action to take (allow, flag, redact, reject) via `scanAndEnforce`.
+ * - Synchronous pattern match — designed for <1ms p99 on typical tool
+ *   responses (≤32KB). Large content is capped at `maxScanBytes` and the
+ *   truncation itself is reported as a low-severity finding.
+ * - Pure-function shape — no I/O, no async, no model calls. Safe to invoke
+ *   in hot paths (every MCP tool result, every memory read).
+ *
+ * Non-goals
+ * ---------
+ * - Not a replacement for input validation at HTTP/CLI boundaries
+ *   (InputValidator handles that). This is the *content* boundary.
+ * - Not a model-based classifier. False-positive rate is bounded by
+ *   pattern specificity; tune via `customPatterns` and `policy`.
+ *
+ * Reference: ADR-131, OpenAI Agents SDK ToolGuardrail API (March 2025).
+ */
+const DEFAULT_POLICY = {
+    low: 'allow',
+    medium: 'flag',
+    high: 'redact',
+    critical: 'reject',
+};
+const DEFAULT_MAX_SCAN_BYTES = 1024 * 1024;
+/**
+ * Built-in pattern library. Ordered by severity (critical first) so the
+ * `highest` field reflects the worst category. Patterns are intentionally
+ * conservative — they target the explicit instruction-override / role-hijack
+ * shapes that show up in published indirect-injection corpora rather than
+ * general "suspicious looking" text.
+ */
+const BUILTIN_PATTERNS = [
+    // ── critical: instruction override + embedded system frames ──
+    {
+        label: 'ignore-previous-instructions',
+        // Allow optional filler words between the verb and the temporal keyword
+        // ("ignore the above", "disregard your earlier", "forget all prior").
+        regex: /\b(?:ignore|disregard|forget)\s+(?:all\s+|any\s+|the\s+|my\s+|your\s+|these\s+|those\s+)?(?:previous|prior|above|earlier|preceding|aforementioned)\s+(?:instructions?|prompts?|rules?|directives?)\b/gi,
+        severity: 'critical',
+        category: 'instruction-override',
+    },
+    {
+        label: 'chatml-frame',
+        regex: /<\|(?:im_start|im_end|system|assistant|user|endoftext)\|>/gi,
+        severity: 'critical',
+        category: 'embedded-system',
+    },
+    {
+        label: 'llama-inst-frame',
+        regex: /\[\/?INST\]/g,
+        severity: 'critical',
+        category: 'embedded-system',
+    },
+    {
+        label: 'exfiltrate-secret',
+        regex: /\b(?:exfiltrate|leak|send|post|upload|transmit)\b[^.\n]{0,80}\b(?:secret|token|api[-_\s]?keys?|password|credential|env\s+vars?)\b/gi,
+        severity: 'critical',
+        category: 'exfiltration',
+    },
+    // ── high: role hijack + jailbreak + system tags + bidi unicode ──
+    {
+        label: 'system-tag-injection',
+        regex: /<\/?system>/gi,
+        severity: 'high',
+        category: 'embedded-system',
+    },
+    {
+        label: 'role-hijack-you-are-now',
+        regex: /\byou\s+are\s+(?:now|actually|secretly)\s+(?:a|an|the)\s+/gi,
+        severity: 'high',
+        category: 'role-hijack',
+    },
+    {
+        label: 'jailbreak-dan',
+        regex: /\b(?:DAN(?:\s+mode)?|developer\s+mode|jailbreak\s+mode|do\s+anything\s+now)\b/gi,
+        severity: 'high',
+        category: 'jailbreak',
+    },
+    {
+        label: 'new-instructions-directive',
+        regex: /\b(?:new|updated|revised|additional)\s+(?:instructions?|task|directives?|objectives?)\s*[:.]/gi,
+        severity: 'high',
+        category: 'instruction-override',
+    },
+    {
+        label: 'bidi-override',
+        regex: /[‪-‮⁦-⁩]/g,
+        severity: 'high',
+        category: 'hidden-unicode',
+    },
+    // ── medium: softer role manipulation + tool spoofing ──
+    {
+        label: 'role-hijack-act-as',
+        regex: /\b(?:act|behave|pretend|role[-\s]?play)\s+as\s+(?:if\s+)?(?:a|an|the)\s+/gi,
+        severity: 'medium',
+        category: 'role-hijack',
+    },
+    {
+        label: 'tool-call-spoof',
+        regex: /\b(?:tool_call|function_call|mcp_tool)\s*[:=]\s*["'{]/gi,
+        severity: 'medium',
+        category: 'tool-spoofing',
+    },
+    // ── low: zero-width whitespace (common in copy-paste attacks) ──
+    {
+        label: 'zero-width-char',
+        regex: /[​-‍]/g,
+        severity: 'low',
+        category: 'hidden-unicode',
+    },
+];
+const SEVERITY_ORDER = {
+    none: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+function snippet(text, idx, len) {
+    const start = Math.max(0, idx - 24);
+    const end = Math.min(text.length, idx + len + 24);
+    const head = start > 0 ? '…' : '';
+    const tail = end < text.length ? '…' : '';
+    return head + text.slice(start, end).replace(/\s+/g, ' ') + tail;
+}
+function maxSeverity(a, b) {
+    return SEVERITY_ORDER[a] >= SEVERITY_ORDER[b]
+        ? (a === 'none' ? b : a)
+        : b;
+}
+export class ToolOutputGuardrail {
+    patterns;
+    policy;
+    maxScanBytes;
+    constructor(config = {}) {
+        this.patterns = [...BUILTIN_PATTERNS, ...(config.customPatterns ?? [])];
+        this.policy = { ...DEFAULT_POLICY, ...(config.policy ?? {}) };
+        this.maxScanBytes = config.maxScanBytes ?? DEFAULT_MAX_SCAN_BYTES;
+    }
+    /**
+     * Pure scan — no side effects, no content modification. Useful when the
+     * caller wants to log findings but cannot drop the content (e.g. read-only
+     * audit mode).
+     */
+    scan(content) {
+        if (typeof content !== 'string') {
+            return { safe: true, findings: [], highest: 'none' };
+        }
+        let scanned = content;
+        const findings = [];
+        if (this.maxScanBytes > 0 && content.length > this.maxScanBytes) {
+            scanned = content.slice(0, this.maxScanBytes);
+            findings.push({
+                pattern: 'content-truncated',
+                severity: 'medium',
+                category: 'truncation',
+                position: this.maxScanBytes,
+                context: `(content truncated at ${this.maxScanBytes} bytes; ${content.length - this.maxScanBytes} bytes unscanned)`,
+            });
+        }
+        for (const { label, regex, severity, category } of this.patterns) {
+            // Clone the RegExp so that the global-flag lastIndex state doesn't
+            // leak between calls. Built-in patterns are immutable; user-supplied
+            // patterns are also defensively cloned.
+            const re = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
+            let match;
+            while ((match = re.exec(scanned)) !== null) {
+                findings.push({
+                    pattern: label,
+                    severity,
+                    category,
+                    position: match.index,
+                    context: snippet(scanned, match.index, match[0].length),
+                });
+                // Defensive: zero-length match would loop forever
+                if (match[0].length === 0)
+                    re.lastIndex++;
+            }
+        }
+        let highest = 'none';
+        for (const f of findings)
+            highest = maxSeverity(highest, f.severity);
+        const action = highest === 'none' ? 'allow' : this.policy[highest];
+        const safe = action === 'allow' || action === 'flag';
+        return { safe, findings, highest };
+    }
+    /**
+     * Scan + enforce policy. Returns the content to pass forward (possibly
+     * redacted or empty) plus the scan result and the action that was taken.
+     * Callers should treat `reject` as "drop the tool result and signal an
+     * error" — do NOT silently substitute empty content.
+     */
+    scanAndEnforce(content) {
+        const result = this.scan(content);
+        const action = result.highest === 'none' ? 'allow' : this.policy[result.highest];
+        let outgoing = content;
+        if (action === 'redact') {
+            outgoing = this.redact(content, result.findings);
+        }
+        else if (action === 'reject') {
+            outgoing = '';
+        }
+        return { content: outgoing, result, action };
+    }
+    /**
+     * Replace each non-truncation finding's matched substring with
+     * `[REDACTED:<pattern>]`. Truncation findings have no substring to redact
+     * (their `position` is a length, not an offset into the content) and are
+     * skipped. Idempotent for already-redacted strings.
+     */
+    redact(content, findings) {
+        if (findings.length === 0)
+            return content;
+        // Build a single combined regex per pattern label to avoid replacing
+        // overlapping matches multiple times.
+        const labels = new Set(findings
+            .filter((f) => f.category !== 'truncation')
+            .map((f) => f.pattern));
+        let out = content;
+        for (const { label, regex } of this.patterns) {
+            if (!labels.has(label))
+                continue;
+            const re = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
+            out = out.replace(re, `[REDACTED:${label}]`);
+        }
+        return out;
+    }
+}
+/** Convenience factory that returns a guardrail with the default policy. */
+export function createToolOutputGuardrail(config) {
+    return new ToolOutputGuardrail(config);
+}
+/**
+ * One-shot helper for callers that just want a yes/no answer without
+ * constructing a guardrail. Uses the default policy.
+ */
+export function isToolOutputSafe(content) {
+    return createToolOutputGuardrail().scan(content).safe;
+}
+//# sourceMappingURL=tool-output-guardrail.js.map

package/node_modules/@claude-flow/security/dist/tool-output-guardrail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-output-guardrail.js","sourceRoot":"","sources":["../src/tool-output-guardrail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAwEH,MAAM,cAAc,GAAqD;IACvE,GAAG,EAAE,OAAO;IACZ,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,gBAAgB,GAKjB;IACH,gEAAgE;IAChE;QACE,KAAK,EAAE,8BAA8B;QACrC,wEAAwE;QACxE,sEAAsE;QACtE,KAAK,EAAE,wMAAwM;QAC/M,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,sBAAsB;KACjC;IACD;QACE,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,qIAAqI;QAC5I,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;KACzB;IAED,mEAAmE;IACnE;QACE,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,yBAAyB;QAChC,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,iFAAiF;QACxF,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,WAAW;KACtB;IACD;QACE,KAAK,EAAE,4BAA4B;QACnC,KAAK,EAAE,gGAAgG;QACvG,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,sBAAsB;KACjC;IACD;QACE,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,gBAAgB;KAC3B;IAED,yDAAyD;IACzD;QACE,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,4EAA4E;QACnF,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,yDAAyD;QAChE,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,eAAe;KAC1B;IAED,kEAAkE;IAClE;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,gBAAgB;KAC3B;CACF,CAAC;AAEF,MAAM,cAAc,GAA+C;IACjE,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,CAA6B,EAAE,CAAoB;IACtE,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,OAAO,mBAAmB;IACb,QAAQ,CAAiD;IACzD,MAAM,CAAmD;IACzD,YAAY,CAAS;IAEtC,YAAY,SAA0B,EAAE;QACtC,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,OAAe;QAClB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,OAAO,GAAG,OAAO,CAAC;QACtB,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAChE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,mBAAmB;gBAC5B,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,IAAI,CAAC,YAAY;gBAC3B,OAAO,EAAE,yBAAyB,IAAI,CAAC,YAAY,WAAW,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,mBAAmB;aACpH,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjE,mEAAmE;YACnE,qEAAqE;YACrE,wCAAwC;YACxC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACjG,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,KAAK;oBACd,QAAQ;oBACR,QAAQ;oBACR,QAAQ,EAAE,KAAK,CAAC,KAAK;oBACrB,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;iBACxD,CAAC,CAAC;gBACH,kDAAkD;gBAClD,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAA+B,MAAM,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC;QAErD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,OAAe;QAK5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAElC,MAAM,MAAM,GACV,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpE,IAAI,QAAQ,GAAG,OAAO,CAAC;QACvB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,OAAe,EAAE,QAA4B;QAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAE1C,qEAAqE;QACrE,sCAAsC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC;aAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACzB,CAAC;QAEF,IAAI,GAAG,GAAG,OAAO,CAAC;QAClB,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACjC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACjG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,KAAK,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CAAC,MAAwB;IAChE,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,yBAAyB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}

package/node_modules/@claude-flow/security/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@claude-flow/security",
+  "version": "3.0.0-alpha.14",
+  "type": "module",
+  "description": "Security module - CVE fixes, input validation, path security",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "exports": {
+    ".": "./dist/index.js",
+    "./*": "./dist/*.js"
+  },
+  "scripts": {
+    "test": "vitest run",
+    "benchmark:policy": "npm run build && node scripts/benchmark-policy-engine.mjs",
+    "benchmark:product-plane": "npm run build && node scripts/benchmark-product-plane.mjs",
+    "test:oauth-surface": "vitest run __tests__/oauth-export-surface.test.ts __tests__/oauth-pkce.test.ts __tests__/oauth-browser.test.ts",
+    "build": "tsc && node scripts/verify-oauth-exports.mjs",
+    "prepublishOnly": "npm run build && npm run test:oauth-surface"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "v3alpha"
+  },
+  "rufloBundledRuntime": {
+    "format": 1,
+    "sourceDependencies": {
+      "dependencies": {
+        "@noble/ed25519": "^2.1.0",
+        "bcryptjs": "^3.0.3",
+        "zod": "^3.22.0"
+      },
+      "optionalDependencies": {
+        "@napi-rs/keyring": "1.3.0"
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "claude-flow",
-  "version": "3.32.26",
+  "version": "3.32.30",
+  "workspaces": [
+    "v3/@claude-flow/codex",
+    "v3/@claude-flow/plugin-agent-federation",
+    "v3/@claude-flow/security"
+  ],
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",
@@ -61,16 +66,28 @@
   },
   "dependencies": {
     "@claude-flow/cli-core": "3.7.0-alpha.5",
+    "@claude-flow/codex": "3.0.3",
     "@claude-flow/mcp": "3.0.0-alpha.9",
     "@claude-flow/neural": "3.0.0-alpha.9",
+    "@claude-flow/plugin-agent-federation": "1.0.0-alpha.18",
+    "@claude-flow/security": "3.0.0-alpha.14",
     "@claude-flow/shared": "3.0.0-alpha.8",
+    "@iarna/toml": "^2.2.5",
     "@noble/ed25519": "2.3.0",
     "@ruvector/rabitq-wasm": "0.1.0",
+    "bcryptjs": "^3.0.3",
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "fs-extra": "^11.2.0",
+    "inquirer": "^9.2.0",
     "semver": "7.7.3",
+    "toml": "^3.0.0",
+    "ws": ">=8.21.0",
+    "yaml": "^2.8.0",
     "zod": "3.25.76"
   },
   "optionalDependencies": {
-    "@claude-flow/codex": "^3.0.1",
+    "@napi-rs/keyring": "1.3.0",
     "@claude-flow/plugin-gastown-bridge": "^0.1.3",
     "@ruvector/attention": "^0.1.3",
     "@ruvector/core": "^0.1.30",
@@ -142,7 +159,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/ruvnet/claude-flow.git"
+    "url": "git+https://github.com/ruvnet/claude-flow.git"
   },
   "keywords": [
     "ruvflow",
@@ -179,14 +196,19 @@
     "consensus",
     "self-learning"
   ],
-  "author": {
-    "name": "RuvNet",
-    "email": "ruv@ruv.io",
-    "url": "https://ruv.io"
-  },
+  "author": "RuvNet <ruv@ruv.io> (https://ruv.io)",
   "license": "MIT",
   "publishConfig": {
     "access": "public",
     "tag": "latest"
+  },
+  "bundleDependencies": [
+    "@claude-flow/codex",
+    "@claude-flow/plugin-agent-federation",
+    "@claude-flow/security"
+  ],
+  "directories": {
+    "doc": "docs",
+    "test": "tests"
   }
 }

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": 1,
-  "generation": 2,
-  "generatedAt": "2026-07-28T19:25:02.626Z",
-  "gitSha": "80634fa0",
+  "generation": 3,
+  "generatedAt": "2026-07-29T05:35:40.000Z",
+  "gitSha": "1385e21b",
   "catalog": {
     "agents": 164,
-    "tools": 388,
+    "tools": 395,
     "skills": 34
   },
   "benchmark": null

package/v3/@claude-flow/cli/dist/src/commands/index.d.ts

@@ -33,6 +33,7 @@ export declare function getProvidersCommand(): Promise<Command | undefined>;
 export declare function getPluginsCommand(): Promise<Command | undefined>;
 export declare function getDeploymentCommand(): Promise<Command | undefined>;
 export declare function getClaimsCommand(): Promise<Command | undefined>;
+export declare function getPolicyCommand(): Promise<Command | undefined>;
 export declare function getEmbeddingsCommand(): Promise<Command | undefined>;
 export declare function getCompletionsCommand(): Promise<Command | undefined>;
 export declare function getAnalyzeCommand(): Promise<Command | undefined>;

package/v3/@claude-flow/cli/dist/src/commands/index.js

@@ -40,6 +40,7 @@ const commandLoaders = {
     plugins: () => import('./plugins.js'),
     deployment: () => import('./deployment.js'),
     claims: () => import('./claims.js'),
+    policy: () => import('./policy.js'),
     embeddings: () => import('./embeddings.js'),
     // P0 Commands
     completions: () => import('./completions.js'),
@@ -175,6 +176,7 @@ export async function getProvidersCommand() { return loadCommand('providers'); }
 export async function getPluginsCommand() { return loadCommand('plugins'); }
 export async function getDeploymentCommand() { return loadCommand('deployment'); }
 export async function getClaimsCommand() { return loadCommand('claims'); }
+export async function getPolicyCommand() { return loadCommand('policy'); }
 export async function getEmbeddingsCommand() { return loadCommand('embeddings'); }
 export async function getCompletionsCommand() { return loadCommand('completions'); }
 export async function getAnalyzeCommand() { return loadCommand('analyze'); }
@@ -230,14 +232,14 @@ export const commandsByCategory = {
  * Use this for help display and full command listings.
  */
 export async function getCommandsByCategory() {
-    const [daemonCmd, doctorCmd, embeddingsCmd, neuralCmd, performanceCmd, securityCmd, ruvectorCmd, hiveMindCmd, configCmd, completionsCmd, migrateCmd, workflowCmd, analyzeCmd, routeCmd, progressCmd, providersCmd, pluginsCmd, deploymentCmd, claimsCmd, issuesCmd, updateCmd, processCmd, guidanceCmd, applianceCmd, cleanupCmd, autopilotCmd,] = await Promise.all([
+    const [daemonCmd, doctorCmd, embeddingsCmd, neuralCmd, performanceCmd, securityCmd, ruvectorCmd, hiveMindCmd, configCmd, completionsCmd, migrateCmd, workflowCmd, analyzeCmd, routeCmd, progressCmd, providersCmd, pluginsCmd, deploymentCmd, claimsCmd, issuesCmd, updateCmd, processCmd, guidanceCmd, applianceCmd, cleanupCmd, autopilotCmd, policyCmd,] = await Promise.all([
         loadCommand('daemon'), loadCommand('doctor'), loadCommand('embeddings'), loadCommand('neural'),
         loadCommand('performance'), loadCommand('security'), loadCommand('ruvector'), loadCommand('hive-mind'),
         loadCommand('config'), loadCommand('completions'), loadCommand('migrate'), loadCommand('workflow'),
         loadCommand('analyze'), loadCommand('route'), loadCommand('progress'), loadCommand('providers'),
         loadCommand('plugins'), loadCommand('deployment'), loadCommand('claims'), loadCommand('issues'),
         loadCommand('update'), loadCommand('process'), loadCommand('guidance'), loadCommand('appliance'),
-        loadCommand('cleanup'), loadCommand('autopilot'),
+        loadCommand('cleanup'), loadCommand('autopilot'), loadCommand('policy'),
     ]);
     return {
         primary: [
@@ -246,7 +248,7 @@ export async function getCommandsByCategory() {
             mcpCommand, hooksCommand,
         ],
         advanced: [
-            neuralCmd, securityCmd, performanceCmd, embeddingsCmd,
+            neuralCmd, securityCmd, policyCmd, performanceCmd, embeddingsCmd,
             hiveMindCmd, ruvectorCmd, guidanceCmd, autopilotCmd,
         ].filter(Boolean),
         utility: [

package/v3/@claude-flow/cli/dist/src/commands/memory.js

@@ -86,12 +86,23 @@ const storeCommand = {
             description: 'Scan the value for injection payloads before persisting (dream-cycle #2752 MemPoison gate)',
             type: 'boolean',
         },
+        {
+            // ADR-323 — typed memory provenance. Distinguishes who/what produced
+            // this entry so shared-namespace retrieval can filter by trust level
+            // instead of conflating a user's stated claim with an agent's own
+            // output or a raw tool/system observation.
+            name: 'provenance',
+            description: 'Who/what produced this value: user_claim | agent_output | system_observation | tool_result | unknown (default: unknown) — ADR-323',
+            type: 'string',
+            choices: ['user_claim', 'agent_output', 'system_observation', 'tool_result', 'unknown'],
+        },
         DB_PATH_OPTION
     ],
     examples: [
         { command: 'claude-flow memory store -k "api/auth" -v "JWT implementation"', description: 'Store text' },
         { command: 'claude-flow memory store -k "pattern/singleton" --vector', description: 'Store vector' },
-        { command: 'claude-flow memory store -k "pattern" -v "new" --no-upsert', description: 'Strict insert (fail if key exists)' }
+        { command: 'claude-flow memory store -k "pattern" -v "new" --no-upsert', description: 'Strict insert (fail if key exists)' },
+        { command: 'claude-flow memory store -k "user/goal" -v "ship by Friday" --provenance user_claim', description: 'Store with typed provenance (ADR-323)' }
     ],
     action: async (ctx) => {
         const key = ctx.flags.key;
@@ -114,6 +125,10 @@ const storeCommand = {
         // regardless of the parser gap: only an explicit `--no-upsert` (which
         // arrives as `false`) turns it off.
         const upsert = ctx.flags.upsert !== false;
+        // ADR-323: leave undefined (not 'unknown') when omitted so storeEntry's
+        // own default applies uniformly across the CLI, MCP tool, and direct
+        // callers — one place decides the default, not three.
+        const provenance = ctx.flags.provenance;
         if (!key) {
             output.printError('Key is required. Use --key or -k');
             return { success: false, exitCode: 1 };
@@ -174,6 +189,7 @@ const storeCommand = {
                 tags,
                 ttl,
                 upsert,
+                provenanceType: provenance,
                 dbPath
             });
             if (!result.success) {
@@ -193,12 +209,13 @@ const storeCommand = {
                     { property: 'TTL', val: ttl ? `${ttl}s` : 'None' },
                     { property: 'Tags', val: tags.length > 0 ? tags.join(', ') : 'None' },
                     { property: 'Vector', val: result.embedding ? `Yes (${result.embedding.dimensions}-dim)` : 'No' },
+                    { property: 'Provenance', val: provenance || 'unknown' },
                     { property: 'ID', val: result.id.substring(0, 20) }
                 ]
             });
             output.writeln();
             output.printSuccess('Data stored successfully');
-            return { success: true, data: { ...storeData, id: result.id, embedding: result.embedding } };
+            return { success: true, data: { ...storeData, id: result.id, embedding: result.embedding, provenanceType: provenance || 'unknown' } };
         }
         catch (error) {
             output.printError(`Failed to store: ${error instanceof Error ? error.message : 'Unknown error'}`);
@@ -361,6 +378,15 @@ const searchCommand = {
             choices: ['auto', 'mixed', 'episodic', 'semantic', 'procedural'],
             default: 'mixed',
         },
+        {
+            // ADR-323 — restrict results to entries with a matching provenance
+            // type (e.g. exclude user_claim when retrieving for fact-checking,
+            // per MemSyco-Bench's memory-induced sycophancy finding). Enforced
+            // across semantic, keyword, hybrid, and SmartRetrieval paths.
+            name: 'provenance-filter',
+            description: 'Comma-separated provenance types to restrict results to: user_claim,agent_output,system_observation,tool_result,unknown — ADR-323',
+            type: 'string',
+        },
         DB_PATH_OPTION
     ],
     examples: [
@@ -369,11 +395,18 @@ const searchCommand = {
         { command: 'claude-flow memory search -q "test" --build-hnsw', description: 'Build HNSW index and search' },
         { command: 'claude-flow memory search -q "auth patterns" --smart', description: 'SmartRetrieval with RRF + MMR' },
         { command: 'claude-flow memory search -q "when did we last touch auth" --intent auto', description: 'SCM-routed retrieval (dream-cycle #2760)' },
+        { command: 'claude-flow memory search -q "deploy plan" --provenance-filter agent_output,tool_result', description: 'Only trust agent/tool-sourced entries (ADR-323)' },
     ],
     action: async (ctx) => {
         const query = ctx.flags.query || ctx.args[0];
         let namespace = ctx.flags.namespace || 'all';
         const limit = ctx.flags.limit || 10;
+        // Matches the --build-hnsw / buildHnsw dual-check convention already used
+        // below: the parser doesn't consistently camelCase every hyphenated flag.
+        const provenanceFilterRaw = (ctx.flags['provenance-filter'] || ctx.flags.provenanceFilter);
+        const provenanceFilter = provenanceFilterRaw
+            ? provenanceFilterRaw.split(',').map(s => s.trim()).filter(Boolean)
+            : undefined;
         // #2790 fix — `||` discards an explicit `--threshold 0` (falsy) and
         // silently uses the fallback; that made `--threshold 0` return
         // FEWER results than `--threshold 0.01` (non-monotonic). Nullish
@@ -456,8 +489,13 @@ const searchCommand = {
                     limit: 5000,
                     includeContent: true,
                     dbPath: dbPathSearch,
+                    provenanceFilter,
                 });
-                if (list.success) {
+                if (!list.success) {
+                    output.printError(list.error || 'Keyword search failed');
+                    return { success: false, exitCode: 1 };
+                }
+                else {
                     const q = query.toLowerCase();
                     keywordResults = list.entries
                         .filter((e) => {
@@ -473,6 +511,7 @@ const searchCommand = {
                             score: inKey ? 1.0 : 0.7,
                             namespace: e.namespace,
                             preview: c.slice(0, 200),
+                            provenanceType: e.provenanceType,
                         };
                     })
                         .sort((a, b) => b.score - a.score)
@@ -526,6 +565,7 @@ const searchCommand = {
                         limit: req.limit || limit * 3,
                         threshold: req.threshold ?? threshold,
                         dbPath: dbPathSearch,
+                        provenanceFilter,
                     });
                     return {
                         results: r.results.map(e => ({
@@ -534,6 +574,7 @@ const searchCommand = {
                             content: e.content,
                             score: e.score,
                             namespace: e.namespace,
+                            provenanceType: e.provenanceType,
                         })),
                     };
                 };
@@ -548,6 +589,7 @@ const searchCommand = {
                     score: r.score,
                     namespace: r.namespace,
                     preview: r.content,
+                    provenanceType: r.provenanceType,
                 }));
                 searchTimeMs = smartResult.stats.durationMs;
                 smartStats = smartResult.stats;
@@ -559,7 +601,8 @@ const searchCommand = {
                     namespace,
                     limit,
                     threshold,
-                    dbPath: dbPathSearch
+                    dbPath: dbPathSearch,
+                    provenanceFilter
                 });
                 if (!searchResult.success) {
                     output.printError(searchResult.error || 'Search failed');
@@ -569,7 +612,8 @@ const searchCommand = {
                     key: r.key,
                     score: r.score,
                     namespace: r.namespace,
-                    preview: r.content
+                    preview: r.content,
+                    provenanceType: r.provenanceType,
                 }));
                 searchTimeMs = searchResult.searchTime;
             }