claude-flow 3.32.29 → 3.32.30

package/node_modules/@claude-flow/security/dist/tool-output-guardrail.js

@@ -0,0 +1,257 @@
+/**
+ * ToolOutputGuardrail — semantic screening of content returned by MCP tool
+ * calls, memory reads, and external API responses before that content enters
+ * agent reasoning. Closes the OWASP ASI01 (Agent Goal Hijacking) gap
+ * identified in ruvnet/ruflo#2149 / ADR-131.
+ *
+ * Threat model
+ * ------------
+ * Attackers embed malicious instructions in content the agent retrieves
+ * autonomously (web page, MCP tool response, memory entry). An LLM cannot
+ * reliably distinguish instructions from data once both are in the prompt.
+ * System-level per-boundary guardrails are the only category with
+ * sub-millisecond latency and no model dependency (arXiv:2601.17548,
+ * Jan 2026 systematic review).
+ *
+ * Scope
+ * -----
+ * - Detection only — does NOT modify the running prompt; callers decide
+ *   what action to take (allow, flag, redact, reject) via `scanAndEnforce`.
+ * - Synchronous pattern match — designed for <1ms p99 on typical tool
+ *   responses (≤32KB). Large content is capped at `maxScanBytes` and the
+ *   truncation itself is reported as a low-severity finding.
+ * - Pure-function shape — no I/O, no async, no model calls. Safe to invoke
+ *   in hot paths (every MCP tool result, every memory read).
+ *
+ * Non-goals
+ * ---------
+ * - Not a replacement for input validation at HTTP/CLI boundaries
+ *   (InputValidator handles that). This is the *content* boundary.
+ * - Not a model-based classifier. False-positive rate is bounded by
+ *   pattern specificity; tune via `customPatterns` and `policy`.
+ *
+ * Reference: ADR-131, OpenAI Agents SDK ToolGuardrail API (March 2025).
+ */
+const DEFAULT_POLICY = {
+    low: 'allow',
+    medium: 'flag',
+    high: 'redact',
+    critical: 'reject',
+};
+const DEFAULT_MAX_SCAN_BYTES = 1024 * 1024;
+/**
+ * Built-in pattern library. Ordered by severity (critical first) so the
+ * `highest` field reflects the worst category. Patterns are intentionally
+ * conservative — they target the explicit instruction-override / role-hijack
+ * shapes that show up in published indirect-injection corpora rather than
+ * general "suspicious looking" text.
+ */
+const BUILTIN_PATTERNS = [
+    // ── critical: instruction override + embedded system frames ──
+    {
+        label: 'ignore-previous-instructions',
+        // Allow optional filler words between the verb and the temporal keyword
+        // ("ignore the above", "disregard your earlier", "forget all prior").
+        regex: /\b(?:ignore|disregard|forget)\s+(?:all\s+|any\s+|the\s+|my\s+|your\s+|these\s+|those\s+)?(?:previous|prior|above|earlier|preceding|aforementioned)\s+(?:instructions?|prompts?|rules?|directives?)\b/gi,
+        severity: 'critical',
+        category: 'instruction-override',
+    },
+    {
+        label: 'chatml-frame',
+        regex: /<\|(?:im_start|im_end|system|assistant|user|endoftext)\|>/gi,
+        severity: 'critical',
+        category: 'embedded-system',
+    },
+    {
+        label: 'llama-inst-frame',
+        regex: /\[\/?INST\]/g,
+        severity: 'critical',
+        category: 'embedded-system',
+    },
+    {
+        label: 'exfiltrate-secret',
+        regex: /\b(?:exfiltrate|leak|send|post|upload|transmit)\b[^.\n]{0,80}\b(?:secret|token|api[-_\s]?keys?|password|credential|env\s+vars?)\b/gi,
+        severity: 'critical',
+        category: 'exfiltration',
+    },
+    // ── high: role hijack + jailbreak + system tags + bidi unicode ──
+    {
+        label: 'system-tag-injection',
+        regex: /<\/?system>/gi,
+        severity: 'high',
+        category: 'embedded-system',
+    },
+    {
+        label: 'role-hijack-you-are-now',
+        regex: /\byou\s+are\s+(?:now|actually|secretly)\s+(?:a|an|the)\s+/gi,
+        severity: 'high',
+        category: 'role-hijack',
+    },
+    {
+        label: 'jailbreak-dan',
+        regex: /\b(?:DAN(?:\s+mode)?|developer\s+mode|jailbreak\s+mode|do\s+anything\s+now)\b/gi,
+        severity: 'high',
+        category: 'jailbreak',
+    },
+    {
+        label: 'new-instructions-directive',
+        regex: /\b(?:new|updated|revised|additional)\s+(?:instructions?|task|directives?|objectives?)\s*[:.]/gi,
+        severity: 'high',
+        category: 'instruction-override',
+    },
+    {
+        label: 'bidi-override',
+        regex: /[‪-‮⁦-⁩]/g,
+        severity: 'high',
+        category: 'hidden-unicode',
+    },
+    // ── medium: softer role manipulation + tool spoofing ──
+    {
+        label: 'role-hijack-act-as',
+        regex: /\b(?:act|behave|pretend|role[-\s]?play)\s+as\s+(?:if\s+)?(?:a|an|the)\s+/gi,
+        severity: 'medium',
+        category: 'role-hijack',
+    },
+    {
+        label: 'tool-call-spoof',
+        regex: /\b(?:tool_call|function_call|mcp_tool)\s*[:=]\s*["'{]/gi,
+        severity: 'medium',
+        category: 'tool-spoofing',
+    },
+    // ── low: zero-width whitespace (common in copy-paste attacks) ──
+    {
+        label: 'zero-width-char',
+        regex: /[​-‍]/g,
+        severity: 'low',
+        category: 'hidden-unicode',
+    },
+];
+const SEVERITY_ORDER = {
+    none: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+function snippet(text, idx, len) {
+    const start = Math.max(0, idx - 24);
+    const end = Math.min(text.length, idx + len + 24);
+    const head = start > 0 ? '…' : '';
+    const tail = end < text.length ? '…' : '';
+    return head + text.slice(start, end).replace(/\s+/g, ' ') + tail;
+}
+function maxSeverity(a, b) {
+    return SEVERITY_ORDER[a] >= SEVERITY_ORDER[b]
+        ? (a === 'none' ? b : a)
+        : b;
+}
+export class ToolOutputGuardrail {
+    patterns;
+    policy;
+    maxScanBytes;
+    constructor(config = {}) {
+        this.patterns = [...BUILTIN_PATTERNS, ...(config.customPatterns ?? [])];
+        this.policy = { ...DEFAULT_POLICY, ...(config.policy ?? {}) };
+        this.maxScanBytes = config.maxScanBytes ?? DEFAULT_MAX_SCAN_BYTES;
+    }
+    /**
+     * Pure scan — no side effects, no content modification. Useful when the
+     * caller wants to log findings but cannot drop the content (e.g. read-only
+     * audit mode).
+     */
+    scan(content) {
+        if (typeof content !== 'string') {
+            return { safe: true, findings: [], highest: 'none' };
+        }
+        let scanned = content;
+        const findings = [];
+        if (this.maxScanBytes > 0 && content.length > this.maxScanBytes) {
+            scanned = content.slice(0, this.maxScanBytes);
+            findings.push({
+                pattern: 'content-truncated',
+                severity: 'medium',
+                category: 'truncation',
+                position: this.maxScanBytes,
+                context: `(content truncated at ${this.maxScanBytes} bytes; ${content.length - this.maxScanBytes} bytes unscanned)`,
+            });
+        }
+        for (const { label, regex, severity, category } of this.patterns) {
+            // Clone the RegExp so that the global-flag lastIndex state doesn't
+            // leak between calls. Built-in patterns are immutable; user-supplied
+            // patterns are also defensively cloned.
+            const re = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
+            let match;
+            while ((match = re.exec(scanned)) !== null) {
+                findings.push({
+                    pattern: label,
+                    severity,
+                    category,
+                    position: match.index,
+                    context: snippet(scanned, match.index, match[0].length),
+                });
+                // Defensive: zero-length match would loop forever
+                if (match[0].length === 0)
+                    re.lastIndex++;
+            }
+        }
+        let highest = 'none';
+        for (const f of findings)
+            highest = maxSeverity(highest, f.severity);
+        const action = highest === 'none' ? 'allow' : this.policy[highest];
+        const safe = action === 'allow' || action === 'flag';
+        return { safe, findings, highest };
+    }
+    /**
+     * Scan + enforce policy. Returns the content to pass forward (possibly
+     * redacted or empty) plus the scan result and the action that was taken.
+     * Callers should treat `reject` as "drop the tool result and signal an
+     * error" — do NOT silently substitute empty content.
+     */
+    scanAndEnforce(content) {
+        const result = this.scan(content);
+        const action = result.highest === 'none' ? 'allow' : this.policy[result.highest];
+        let outgoing = content;
+        if (action === 'redact') {
+            outgoing = this.redact(content, result.findings);
+        }
+        else if (action === 'reject') {
+            outgoing = '';
+        }
+        return { content: outgoing, result, action };
+    }
+    /**
+     * Replace each non-truncation finding's matched substring with
+     * `[REDACTED:<pattern>]`. Truncation findings have no substring to redact
+     * (their `position` is a length, not an offset into the content) and are
+     * skipped. Idempotent for already-redacted strings.
+     */
+    redact(content, findings) {
+        if (findings.length === 0)
+            return content;
+        // Build a single combined regex per pattern label to avoid replacing
+        // overlapping matches multiple times.
+        const labels = new Set(findings
+            .filter((f) => f.category !== 'truncation')
+            .map((f) => f.pattern));
+        let out = content;
+        for (const { label, regex } of this.patterns) {
+            if (!labels.has(label))
+                continue;
+            const re = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
+            out = out.replace(re, `[REDACTED:${label}]`);
+        }
+        return out;
+    }
+}
+/** Convenience factory that returns a guardrail with the default policy. */
+export function createToolOutputGuardrail(config) {
+    return new ToolOutputGuardrail(config);
+}
+/**
+ * One-shot helper for callers that just want a yes/no answer without
+ * constructing a guardrail. Uses the default policy.
+ */
+export function isToolOutputSafe(content) {
+    return createToolOutputGuardrail().scan(content).safe;
+}
+//# sourceMappingURL=tool-output-guardrail.js.map

package/node_modules/@claude-flow/security/dist/tool-output-guardrail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-output-guardrail.js","sourceRoot":"","sources":["../src/tool-output-guardrail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAwEH,MAAM,cAAc,GAAqD;IACvE,GAAG,EAAE,OAAO;IACZ,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,gBAAgB,GAKjB;IACH,gEAAgE;IAChE;QACE,KAAK,EAAE,8BAA8B;QACrC,wEAAwE;QACxE,sEAAsE;QACtE,KAAK,EAAE,wMAAwM;QAC/M,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,sBAAsB;KACjC;IACD;QACE,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,qIAAqI;QAC5I,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;KACzB;IAED,mEAAmE;IACnE;QACE,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,yBAAyB;QAChC,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,iFAAiF;QACxF,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,WAAW;KACtB;IACD;QACE,KAAK,EAAE,4BAA4B;QACnC,KAAK,EAAE,gGAAgG;QACvG,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,sBAAsB;KACjC;IACD;QACE,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,gBAAgB;KAC3B;IAED,yDAAyD;IACzD;QACE,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,4EAA4E;QACnF,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,yDAAyD;QAChE,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,eAAe;KAC1B;IAED,kEAAkE;IAClE;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,gBAAgB;KAC3B;CACF,CAAC;AAEF,MAAM,cAAc,GAA+C;IACjE,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,CAA6B,EAAE,CAAoB;IACtE,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,OAAO,mBAAmB;IACb,QAAQ,CAAiD;IACzD,MAAM,CAAmD;IACzD,YAAY,CAAS;IAEtC,YAAY,SAA0B,EAAE;QACtC,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,OAAe;QAClB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,OAAO,GAAG,OAAO,CAAC;QACtB,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAChE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,mBAAmB;gBAC5B,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,IAAI,CAAC,YAAY;gBAC3B,OAAO,EAAE,yBAAyB,IAAI,CAAC,YAAY,WAAW,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,mBAAmB;aACpH,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjE,mEAAmE;YACnE,qEAAqE;YACrE,wCAAwC;YACxC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACjG,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,KAAK;oBACd,QAAQ;oBACR,QAAQ;oBACR,QAAQ,EAAE,KAAK,CAAC,KAAK;oBACrB,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;iBACxD,CAAC,CAAC;gBACH,kDAAkD;gBAClD,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAA+B,MAAM,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC;QAErD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,OAAe;QAK5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAElC,MAAM,MAAM,GACV,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpE,IAAI,QAAQ,GAAG,OAAO,CAAC;QACvB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,OAAe,EAAE,QAA4B;QAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAE1C,qEAAqE;QACrE,sCAAsC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC;aAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACzB,CAAC;QAEF,IAAI,GAAG,GAAG,OAAO,CAAC;QAClB,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACjC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACjG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,KAAK,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CAAC,MAAwB;IAChE,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,yBAAyB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}

package/node_modules/@claude-flow/security/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@claude-flow/security",
+  "version": "3.0.0-alpha.14",
+  "type": "module",
+  "description": "Security module - CVE fixes, input validation, path security",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "exports": {
+    ".": "./dist/index.js",
+    "./*": "./dist/*.js"
+  },
+  "scripts": {
+    "test": "vitest run",
+    "benchmark:policy": "npm run build && node scripts/benchmark-policy-engine.mjs",
+    "benchmark:product-plane": "npm run build && node scripts/benchmark-product-plane.mjs",
+    "test:oauth-surface": "vitest run __tests__/oauth-export-surface.test.ts __tests__/oauth-pkce.test.ts __tests__/oauth-browser.test.ts",
+    "build": "tsc && node scripts/verify-oauth-exports.mjs",
+    "prepublishOnly": "npm run build && npm run test:oauth-surface"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "v3alpha"
+  },
+  "rufloBundledRuntime": {
+    "format": 1,
+    "sourceDependencies": {
+      "dependencies": {
+        "@noble/ed25519": "^2.1.0",
+        "bcryptjs": "^3.0.3",
+        "zod": "^3.22.0"
+      },
+      "optionalDependencies": {
+        "@napi-rs/keyring": "1.3.0"
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "claude-flow",
-  "version": "3.32.29",
+  "version": "3.32.30",
+  "workspaces": [
+    "v3/@claude-flow/codex",
+    "v3/@claude-flow/plugin-agent-federation",
+    "v3/@claude-flow/security"
+  ],
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",
@@ -61,16 +66,28 @@
   },
   "dependencies": {
     "@claude-flow/cli-core": "3.7.0-alpha.5",
+    "@claude-flow/codex": "3.0.3",
     "@claude-flow/mcp": "3.0.0-alpha.9",
     "@claude-flow/neural": "3.0.0-alpha.9",
+    "@claude-flow/plugin-agent-federation": "1.0.0-alpha.18",
+    "@claude-flow/security": "3.0.0-alpha.14",
     "@claude-flow/shared": "3.0.0-alpha.8",
+    "@iarna/toml": "^2.2.5",
     "@noble/ed25519": "2.3.0",
     "@ruvector/rabitq-wasm": "0.1.0",
+    "bcryptjs": "^3.0.3",
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "fs-extra": "^11.2.0",
+    "inquirer": "^9.2.0",
     "semver": "7.7.3",
+    "toml": "^3.0.0",
+    "ws": ">=8.21.0",
+    "yaml": "^2.8.0",
     "zod": "3.25.76"
   },
   "optionalDependencies": {
-    "@claude-flow/codex": "^3.0.1",
+    "@napi-rs/keyring": "1.3.0",
     "@claude-flow/plugin-gastown-bridge": "^0.1.3",
     "@ruvector/attention": "^0.1.3",
     "@ruvector/core": "^0.1.30",
@@ -142,7 +159,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/ruvnet/claude-flow.git"
+    "url": "git+https://github.com/ruvnet/claude-flow.git"
   },
   "keywords": [
     "ruvflow",
@@ -179,14 +196,19 @@
     "consensus",
     "self-learning"
   ],
-  "author": {
-    "name": "RuvNet",
-    "email": "ruv@ruv.io",
-    "url": "https://ruv.io"
-  },
+  "author": "RuvNet <ruv@ruv.io> (https://ruv.io)",
   "license": "MIT",
   "publishConfig": {
     "access": "public",
     "tag": "latest"
+  },
+  "bundleDependencies": [
+    "@claude-flow/codex",
+    "@claude-flow/plugin-agent-federation",
+    "@claude-flow/security"
+  ],
+  "directories": {
+    "doc": "docs",
+    "test": "tests"
   }
 }

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 3,
-  "generatedAt": "2026-07-29T04:47:25.187Z",
-  "gitSha": "39bc5fd9",
+  "generatedAt": "2026-07-29T05:35:40.000Z",
+  "gitSha": "1385e21b",
   "catalog": {
     "agents": 164,
     "tools": 395,

package/v3/@claude-flow/cli/dist/src/init/claudemd-generator.js

@@ -19,6 +19,49 @@ function behavioralRules() {
 - Keep files under 500 lines
 - Validate input at system boundaries`;
 }
+function policyGovernedWorkflow() {
+    return `## Ruflo Capability Brain & Implementation Loop
+
+Ruflo is the coordination ledger and policy decision point. Claude Code is the
+executor: after a Ruflo coordination call, continue implementing the task.
+
+When it is registered, call
+\`guidance_brain({ mode: "recommend", task: "..." })\` before complex Ruflo
+work. Use its live registry instead of guessing tool names. Treat
+\`registered\`, \`configured\`, \`reachable\`, \`healthy\`, and \`authorized\`
+as separate facts. If the brain is unavailable, continue with the compatible
+\`guidance_recommend\` tool, CLI discovery, and repository instructions.
+
+Follow the returned loop:
+
+1. Recall memory and ADR constraints.
+2. Inspect source, runtime, dependencies, policy, and health.
+3. Route to the smallest capable topology, agents, skills, and tools.
+4. Plan acceptance criteria, safety envelope, ownership, and validation.
+5. Execute in isolated scopes; the coding agent performs the work.
+6. Test focused, regression, and failure paths.
+7. Validate types, security, policy, compatibility, and artifacts.
+8. Benchmark a source-bound candidate against a source-bound baseline.
+9. Optimize measured bottlenecks without weakening safety.
+10. Bind claims and evidence to exact source/build receipts.
+11. Reconcile concurrent handoffs and disclose limitations.
+12. Publish only through a separately authorized release gate.
+
+### Concurrency and authority
+
+- Never allow two writers in one worktree; give each writing agent an isolated
+  worktree and explicit file ownership.
+- Read-only research may run concurrently and report findings to the owner.
+- Only the integration owner edits shared manifests and lockfiles or reconciles
+  overlapping changes.
+- A child may drop capabilities but cannot add tools, network, secrets, spend,
+  concurrency, namespaces, or delegation depth.
+- A lease or claim coordinates ownership; it does not authorize a side effect.
+- Darwin, Flywheel, MetaHarness, memory, and neural systems may propose or
+  evaluate candidates but cannot self-promote or expand their SafetyEnvelope.
+- Bind tests, benchmarks, policy decisions, and release evidence to an exact
+  commit or immutable dirty-worktree snapshot.`;
+}
 function agentComms() {
     return `## Agent Comms (SendMessage-First Coordination)
 
@@ -61,8 +104,10 @@ SendMessage({ to: "researcher", summary: "Start", message: "[task context]" })
 - ALWAYS name agents — \`name: "role"\` makes them addressable
 - ALWAYS include comms instructions in prompts — who to message, what to send
 - Spawn ALL agents in ONE message with \`run_in_background: true\`
-- After spawning: STOP, tell user what's running, wait for results
-- NEVER poll status — agents message back or complete automatically`;
+- After spawning, continue independent local work; wait only when a dependency
+  genuinely blocks progress
+- Do not poll repeatedly — agents message back or complete automatically
+- Give every writing agent an isolated worktree and a non-overlapping file scope`;
 }
 function swarmConfig(options) {
     return `## Swarm & Routing
@@ -283,6 +328,7 @@ CLAUDE_FLOW_MEMORY_PATH=./data/memory
 const TEMPLATE_SECTIONS = {
     minimal: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => buildAndTest(),
@@ -291,6 +337,7 @@ const TEMPLATE_SECTIONS = {
     ],
     standard: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => memoryAndLearning(),
@@ -301,6 +348,7 @@ const TEMPLATE_SECTIONS = {
     ],
     full: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => memoryAndLearning(),
@@ -315,6 +363,7 @@ const TEMPLATE_SECTIONS = {
     ],
     security: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => securitySection(),
@@ -326,6 +375,7 @@ const TEMPLATE_SECTIONS = {
     ],
     performance: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => performanceSection(),
@@ -338,6 +388,7 @@ const TEMPLATE_SECTIONS = {
     ],
     solo: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         (_opts) => memoryAndLearning(),
         (_opts) => buildAndTest(),