claude-flow 3.48.0 → 3.50.0

package/v3/@claude-flow/cli/dist/src/plugins/manager.js

@@ -4,9 +4,11 @@
  * Bridges discovery service with file system persistence
  */
 import * as fs from 'fs';
+import * as os from 'os';
 import * as path from 'path';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
+import { evaluatePluginTrust, parseSha256Checksum, readDeclaredTrust, sha256Hex, shouldRunInstallScripts, } from './trust-policy.js';
 const execFileAsync = promisify(execFile);
 // On Windows, `npm` is a shell script (no `.exe`) and `npm.cmd` is a batch
 // wrapper. Since Node 18.20.2 / 20.12.2 (CVE-2024-27980) the runtime refuses
@@ -30,6 +32,30 @@ function validatePackageName(spec) {
         throw new Error(`Invalid package name: ${spec}`);
     }
 }
+/**
+ * Apply the #3557 trust policy to a plugin's package.json: record its declared
+ * trust and permissions, and withhold hooks/commands the policy doesn't allow.
+ */
+function applyTrustPolicy(pkg, opts) {
+    const block = (pkg['claude-flow'] ?? {});
+    const commands = Array.isArray(block.commands) ? block.commands : [];
+    const hooks = Array.isArray(block.hooks) ? block.hooks : [];
+    const declared = readDeclaredTrust(pkg);
+    const permissions = [...new Set([...(opts.registryPermissions ?? []), ...declared.permissions])];
+    const trustLevel = opts.registryTrustLevel ?? declared.trustLevel;
+    const decision = evaluatePluginTrust({ trustLevel: declared.trustLevel, permissions }, { verify: opts.verify !== false, trust: opts.trust === true, registryTrustLevel: opts.registryTrustLevel });
+    if (decision.allowed) {
+        return { commands, hooks, trustLevel, permissions, decision };
+    }
+    return {
+        commands: [],
+        hooks: [],
+        trustLevel,
+        permissions,
+        withheld: { hooks, commands, reasons: decision.reasons },
+        decision,
+    };
+}
 // ============================================================================
 // Plugin Manager
 // ============================================================================
@@ -98,11 +124,14 @@ export class PluginManager {
     /**
      * Install a plugin from npm
      */
-    async installFromNpm(packageName, version) {
+    async installFromNpm(packageName, version, opts = {}) {
         if (!this.manifest) {
             await this.initialize();
         }
         const versionSpec = version ? `${packageName}@${version}` : packageName;
+        const verify = opts.verify !== false;
+        const warnings = [];
+        let tmpDir;
         try {
             // Check if already installed
             if (this.manifest.plugins[packageName]) {
@@ -116,23 +145,56 @@ export class PluginManager {
             await this.ensureDirectory(installDir);
             // Validate package name to prevent injection (S-3)
             validatePackageName(versionSpec);
+            // #3557: with --verify, a registry checksum must match the tarball we
+            // install. Pack first, hash that exact file, then install from it, so the
+            // bytes that were checked are the bytes that get installed.
+            let installTarget = versionSpec;
+            let verification = verify ? 'npm-integrity' : 'skipped';
+            const expected = verify ? parseSha256Checksum(opts.expectedChecksum) : null;
+            if (expected) {
+                tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ruflo-plugin-verify-'));
+                const packed = await runNpm(['pack', versionSpec, '--pack-destination', tmpDir, '--json', '--ignore-scripts'], 120000);
+                const info = JSON.parse(packed.stdout);
+                const filename = info[0]?.filename;
+                if (!filename)
+                    throw new Error(`npm pack returned no tarball for ${versionSpec}`);
+                const tarball = path.join(tmpDir, path.basename(filename));
+                const actual = sha256Hex(fs.readFileSync(tarball));
+                if (actual !== expected) {
+                    return {
+                        success: false,
+                        error: `Checksum mismatch for ${versionSpec}: registry expects sha256:${expected}, ` +
+                            `downloaded tarball is sha256:${actual}. Refusing to install (--verify).`,
+                    };
+                }
+                installTarget = tarball;
+                verification = 'checksum';
+            }
+            else if (verify && opts.expectedChecksum) {
+                warnings.push(`Registry checksum "${opts.expectedChecksum}" is not a verifiable sha256 digest; ` +
+                    `relying on npm's own registry integrity check.`);
+            }
             // Use npm to install (array form prevents shell injection)
             console.log(`[PluginManager] Installing ${versionSpec}...`);
-            await runNpm(['install', '--prefix', this.config.pluginsDir, versionSpec], 120000);
+            // #3557 follow-up: lifecycle scripts run before the package's own trust
+            // declaration can be read, so untrusted installs skip them entirely.
+            const scriptsRun = shouldRunInstallScripts(opts);
+            const installArgs = ['install', '--prefix', this.config.pluginsDir, installTarget];
+            if (!scriptsRun) {
+                installArgs.push('--ignore-scripts');
+                warnings.push(`Install scripts were skipped for ${packageName} (--ignore-scripts): it is not registry-vouched and --trust was not given. ` +
+                    `Reinstall with --trust to run them.`);
+            }
+            await runNpm(installArgs, 120000);
             // Get installed version
             const packageJsonPath = path.join(installDir, packageName, 'package.json');
             let installedVersion = version || 'latest';
-            let commands = [];
-            let hooks = [];
+            let pkg = {};
             if (fs.existsSync(packageJsonPath)) {
-                const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
-                installedVersion = pkg.version;
-                // Check for claude-flow plugin metadata
-                if (pkg['claude-flow']) {
-                    commands = pkg['claude-flow'].commands || [];
-                    hooks = pkg['claude-flow'].hooks || [];
-                }
+                pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+                installedVersion = String(pkg.version ?? installedVersion);
             }
+            const trusted = applyTrustPolicy(pkg, opts);
             // Create plugin entry
             const plugin = {
                 name: packageName,
@@ -141,25 +203,34 @@ export class PluginManager {
                 enabled: true,
                 source: 'npm',
                 path: path.join(installDir, packageName),
-                commands,
-                hooks,
+                commands: trusted.commands,
+                hooks: trusted.hooks,
+                trustLevel: trusted.trustLevel,
+                permissions: trusted.permissions,
+                verification,
+                scriptsRun,
+                ...(trusted.withheld ? { withheld: trusted.withheld } : {}),
             };
             // Save to manifest
             this.manifest.plugins[packageName] = plugin;
             await this.saveManifest();
             console.log(`[PluginManager] Installed ${packageName}@${installedVersion}`);
-            return { success: true, plugin };
+            return { success: true, plugin, decision: trusted.decision, warnings };
         }
         catch (error) {
             const errorMsg = error instanceof Error ? error.message : String(error);
             console.error(`[PluginManager] Failed to install ${packageName}:`, errorMsg);
             return { success: false, error: errorMsg };
         }
+        finally {
+            if (tmpDir)
+                fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
     }
     /**
      * Install a plugin from a local path
      */
-    async installFromLocal(sourcePath) {
+    async installFromLocal(sourcePath, opts = {}) {
         if (!this.manifest) {
             await this.initialize();
         }
@@ -182,6 +253,10 @@ export class PluginManager {
                     error: `Plugin ${packageName} is already installed`,
                 };
             }
+            // #3557: record declared trust/permissions; withhold hooks and commands
+            // the policy doesn't allow without --trust. A local path has no registry
+            // entry to vouch for it, so the plugin's own declaration decides.
+            const trusted = applyTrustPolicy(pkg, { verify: opts.verify, trust: opts.trust });
             // Create plugin entry (link to local path, don't copy)
             const plugin = {
                 name: packageName,
@@ -190,14 +265,20 @@ export class PluginManager {
                 enabled: true,
                 source: 'local',
                 path: absolutePath,
-                commands: pkg['claude-flow']?.commands || [],
-                hooks: pkg['claude-flow']?.hooks || [],
+                commands: trusted.commands,
+                hooks: trusted.hooks,
+                trustLevel: trusted.trustLevel,
+                permissions: trusted.permissions,
+                verification: opts.verify === false ? 'skipped' : 'policy',
+                // A local install links the path; it never runs npm or package scripts.
+                scriptsRun: false,
+                ...(trusted.withheld ? { withheld: trusted.withheld } : {}),
             };
             // Save to manifest
             this.manifest.plugins[packageName] = plugin;
             await this.saveManifest();
             console.log(`[PluginManager] Installed local plugin ${packageName}@${pkg.version}`);
-            return { success: true, plugin };
+            return { success: true, plugin, decision: trusted.decision };
         }
         catch (error) {
             const errorMsg = error instanceof Error ? error.message : String(error);
@@ -345,8 +426,13 @@ export class PluginManager {
             const versionSpec = version ? `${packageName}@${version}` : `${packageName}@latest`;
             // Validate package name to prevent injection (S-3)
             validatePackageName(versionSpec);
-            // Reinstall with new version (array form prevents shell injection)
-            await runNpm(['install', '--prefix', this.config.pluginsDir, versionSpec], 120000);
+            // Reinstall with new version (array form prevents shell injection).
+            // An install recorded with scriptsRun:false stays script-free on upgrade;
+            // legacy entries (no field) keep their pre-#3557 behaviour.
+            const upgradeArgs = ['install', '--prefix', this.config.pluginsDir, versionSpec];
+            if (existing.scriptsRun === false)
+                upgradeArgs.push('--ignore-scripts');
+            await runNpm(upgradeArgs, 120000);
             // Update manifest
             const installDir = path.join(this.config.pluginsDir, 'node_modules');
             const packageJsonPath = path.join(installDir, packageName, 'package.json');

package/v3/@claude-flow/cli/dist/src/plugins/trust-policy.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Plugin install trust policy (#3557).
+ *
+ * `plugins install --verify` used to be parsed and never read, and a plugin's
+ * declared `trustLevel`/`permissions` were neither recorded nor enforced.
+ * These pure helpers decide what an install may register.
+ */
+/**
+ * Permissions a plugin may declare and still have its hooks and commands
+ * registered without `--trust`. Anything else (filesystem, network, shell,
+ * secrets, config, privileged, …) needs an explicit `--trust`.
+ */
+export declare const DEFAULT_PLUGIN_PERMISSIONS: readonly string[];
+/** Trust levels that are withheld unless the user passes `--trust`. */
+export declare const UNTRUSTED_TRUST_LEVELS: readonly string[];
+/** Registry trust levels that the registry itself vouches for. */
+export declare const REGISTRY_VOUCHED_TRUST_LEVELS: readonly string[];
+export interface DeclaredTrust {
+    trustLevel?: string;
+    permissions: string[];
+}
+export interface TrustDecision {
+    /** Hooks and commands may be registered. */
+    allowed: boolean;
+    /** Verification was skipped with `--no-verify`. */
+    verificationSkipped: boolean;
+    /** Why registration was withheld (empty when allowed). */
+    reasons: string[];
+    /** Declared permissions outside {@link DEFAULT_PLUGIN_PERMISSIONS}. */
+    excessPermissions: string[];
+}
+export interface TrustOptions {
+    /** `--verify` (default true). */
+    verify: boolean;
+    /** `--trust` (default false). */
+    trust: boolean;
+    /** Trust level from a registry entry, when the plugin was found there. */
+    registryTrustLevel?: string;
+}
+/**
+ * Read the trust declaration from a plugin's package.json. The `claude-flow`
+ * block wins; top-level fields are accepted as a fallback.
+ */
+export declare function readDeclaredTrust(pkg: Record<string, unknown>): DeclaredTrust;
+/** Decide whether an install may register the plugin's hooks and commands. */
+export declare function evaluatePluginTrust(declared: DeclaredTrust, opts: TrustOptions): TrustDecision;
+/**
+ * Whether npm may run the package's lifecycle scripts (preinstall/install/
+ * postinstall, and those of its dependencies). Scripts execute before the
+ * package's own trust declaration can be read, so only an explicit `--trust`
+ * or a registry-vouched entry allows them; everything else installs with
+ * `--ignore-scripts`.
+ */
+export declare function shouldRunInstallScripts(opts: {
+    trust?: boolean;
+    registryTrustLevel?: string;
+}): boolean;
+/** A registry checksum we can actually verify: `sha256:` + 64 hex chars. */
+export declare function parseSha256Checksum(checksum: unknown): string | null;
+export declare function sha256Hex(data: Buffer): string;
+//# sourceMappingURL=trust-policy.d.ts.map

package/v3/@claude-flow/cli/dist/src/plugins/trust-policy.js

@@ -0,0 +1,84 @@
+/**
+ * Plugin install trust policy (#3557).
+ *
+ * `plugins install --verify` used to be parsed and never read, and a plugin's
+ * declared `trustLevel`/`permissions` were neither recorded nor enforced.
+ * These pure helpers decide what an install may register.
+ */
+import { createHash } from 'crypto';
+/**
+ * Permissions a plugin may declare and still have its hooks and commands
+ * registered without `--trust`. Anything else (filesystem, network, shell,
+ * secrets, config, privileged, …) needs an explicit `--trust`.
+ */
+export const DEFAULT_PLUGIN_PERMISSIONS = Object.freeze(['memory:read']);
+/** Trust levels that are withheld unless the user passes `--trust`. */
+export const UNTRUSTED_TRUST_LEVELS = Object.freeze(['untrusted', 'unverified']);
+/** Registry trust levels that the registry itself vouches for. */
+export const REGISTRY_VOUCHED_TRUST_LEVELS = Object.freeze(['official', 'verified']);
+function asStringList(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((v) => typeof v === 'string' && v.trim() !== '').map((v) => v.trim());
+}
+/**
+ * Read the trust declaration from a plugin's package.json. The `claude-flow`
+ * block wins; top-level fields are accepted as a fallback.
+ */
+export function readDeclaredTrust(pkg) {
+    const block = (pkg['claude-flow'] && typeof pkg['claude-flow'] === 'object'
+        ? pkg['claude-flow']
+        : {});
+    const trustLevel = typeof block.trustLevel === 'string'
+        ? block.trustLevel
+        : typeof pkg.trustLevel === 'string' ? pkg.trustLevel : undefined;
+    const permissions = asStringList(block.permissions).length > 0
+        ? asStringList(block.permissions)
+        : asStringList(pkg.permissions);
+    return { trustLevel, permissions };
+}
+/** Decide whether an install may register the plugin's hooks and commands. */
+export function evaluatePluginTrust(declared, opts) {
+    const excessPermissions = declared.permissions.filter((p) => !DEFAULT_PLUGIN_PERMISSIONS.includes(p));
+    if (!opts.verify) {
+        return { allowed: true, verificationSkipped: true, reasons: [], excessPermissions };
+    }
+    const reasons = [];
+    const registryVouched = opts.registryTrustLevel !== undefined
+        && REGISTRY_VOUCHED_TRUST_LEVELS.includes(opts.registryTrustLevel);
+    if (!registryVouched) {
+        if (declared.trustLevel && UNTRUSTED_TRUST_LEVELS.includes(declared.trustLevel)) {
+            reasons.push(`declares trustLevel "${declared.trustLevel}"`);
+        }
+        if (excessPermissions.length > 0) {
+            reasons.push(`declares permissions beyond the default set (${DEFAULT_PLUGIN_PERMISSIONS.join(', ')}): ${excessPermissions.join(', ')}`);
+        }
+    }
+    if (reasons.length > 0 && !opts.trust) {
+        return { allowed: false, verificationSkipped: false, reasons, excessPermissions };
+    }
+    return { allowed: true, verificationSkipped: false, reasons: [], excessPermissions };
+}
+/**
+ * Whether npm may run the package's lifecycle scripts (preinstall/install/
+ * postinstall, and those of its dependencies). Scripts execute before the
+ * package's own trust declaration can be read, so only an explicit `--trust`
+ * or a registry-vouched entry allows them; everything else installs with
+ * `--ignore-scripts`.
+ */
+export function shouldRunInstallScripts(opts) {
+    if (opts.trust === true)
+        return true;
+    return opts.registryTrustLevel !== undefined && REGISTRY_VOUCHED_TRUST_LEVELS.includes(opts.registryTrustLevel);
+}
+/** A registry checksum we can actually verify: `sha256:` + 64 hex chars. */
+export function parseSha256Checksum(checksum) {
+    if (typeof checksum !== 'string')
+        return null;
+    const m = /^sha256:([0-9a-f]{64})$/i.exec(checksum.trim());
+    return m ? m[1].toLowerCase() : null;
+}
+export function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+//# sourceMappingURL=trust-policy.js.map

package/v3/@claude-flow/cli/dist/src/services/policy-runtime.d.ts

@@ -17,6 +17,12 @@ export declare function issuePolicyApproval(approval: Omit<PolicyApproval, 'uses
     issuedAt?: number;
 }, projectRoot?: string, approvalIssuerVerifier?: (issuer: string) => boolean): Promise<PolicyApproval>;
 export declare function revokePolicyApproval(id: string, projectRoot?: string): Promise<boolean>;
+/**
+ * Read-only verification (#3568). It must not run inside
+ * `withPolicyTransaction`, whose own post-operation check throws a generic
+ * `policy-ledger-verification-failed` and hides which check failed. The only
+ * write is persisting an anchor established for a pre-anchor ledger.
+ */
 export declare function verifyPolicyLedger(projectRoot?: string): Promise<ReturnType<AgenticPolicyEngine['verifyLedger']>>;
 export declare function authorizeMcpTool(toolName: string, input: Record<string, unknown>, context?: Record<string, unknown>, attributes?: Readonly<{
     actionType?: string;

package/v3/@claude-flow/cli/dist/src/services/policy-runtime.js

@@ -4,6 +4,7 @@ import { execFileSync } from 'node:child_process';
 import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readlinkSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { hostname, userInfo } from 'node:os';
+import { syncPolicyProjection } from '../mods/policy-projection.js';
 const POLICY_DIR = join('.claude-flow', 'policy');
 const POLICY_FILE = 'state.json';
 const LOCK_FILE = 'state.lock';
@@ -227,6 +228,20 @@ function verifyStateAnchor(projectRoot, state) {
     }
 }
 async function writePolicyState(projectRoot, statePath, state) {
+    await writePolicyStateFiles(projectRoot, statePath, state);
+    // ADR-404: the ruflo mod reads Claude Code tool rules from a small
+    // projection, never from state.json. Written only after the state and its
+    // anchor are safely down; a failure here never fails the state write. A
+    // projection left stale by such a failure can only tighten, never loosen,
+    // a Claude Code verdict (the mod merges with `stricter`).
+    try {
+        syncPolicyProjection(projectRoot, state);
+    }
+    catch (error) {
+        process.stderr.write(`[policy] claude-code projection not written: ${error.message}\n`);
+    }
+}
+async function writePolicyStateFiles(projectRoot, statePath, state) {
     const anchorPath = trustPaths(projectRoot).anchor;
     if (state.mode === 'enforce' || existsSync(anchorPath)) {
         const key = trustKey(projectRoot, true);
@@ -338,9 +353,12 @@ export async function withPolicyTransaction(projectRoot, operation, options = {}
             approvalIssuerVerifier: options.approvalIssuerVerifier,
         });
         const result = await operation(engine);
-        const nextState = engine.exportState();
+        // Verify before exporting: verification establishes the ledger anchor
+        // (#3568) on state written before the anchor existed, and that anchor
+        // must be part of what is persisted.
         if (!engine.verifyLedger().valid)
             throw new Error('policy-ledger-verification-failed');
+        const nextState = engine.exportState();
         await writePolicyState(projectRoot, target.state, nextState);
         return result;
     }
@@ -393,8 +411,30 @@ export async function issuePolicyApproval(approval, projectRoot = process.cwd(),
 export async function revokePolicyApproval(id, projectRoot = process.cwd()) {
     return withPolicyTransaction(projectRoot, (engine) => engine.revokeApproval(id));
 }
+/**
+ * Read-only verification (#3568). It must not run inside
+ * `withPolicyTransaction`, whose own post-operation check throws a generic
+ * `policy-ledger-verification-failed` and hides which check failed. The only
+ * write is persisting an anchor established for a pre-anchor ledger.
+ */
 export async function verifyPolicyLedger(projectRoot = process.cwd()) {
-    return withPolicyTransaction(projectRoot, (engine) => engine.verifyLedger());
+    const target = paths(projectRoot);
+    mkdirSync(target.dir, { recursive: true, mode: 0o700 });
+    const release = await acquireLock(target.lock);
+    try {
+        const engine = AgenticPolicyEngine.fromState(loadPolicyState(projectRoot), {
+            signingKey: process.env.CLAUDE_FLOW_POLICY_SIGNING_KEY,
+            keyId: process.env.CLAUDE_FLOW_POLICY_KEY_ID,
+        });
+        const result = engine.verifyLedger();
+        if (result.anchor === 'established-now') {
+            await writePolicyState(projectRoot, target.state, engine.exportState());
+        }
+        return result;
+    }
+    finally {
+        release();
+    }
 }
 /**
  * Resolve the caller identity for `authorizeMcpTool`.

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.48.0",
+  "version": "3.50.0",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -103,7 +103,7 @@
     "@claude-flow/mcp": "3.0.0",
     "@claude-flow/neural": "3.0.0",
     "@claude-flow/plugin-agent-federation": "1.0.0",
-    "@claude-flow/security": "3.0.0",
+    "@claude-flow/security": "3.0.1",
     "@claude-flow/shared": "3.0.0",
     "@iarna/toml": "^2.2.5",
     "@noble/ed25519": "2.3.0",