claude-flow 3.5.24 → 3.5.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.5.24",
+  "version": "3.5.25",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/commands/index.js

@@ -61,6 +61,8 @@ const commandLoaders = {
     guidance: () => import('./guidance.js'),
     // RVFA Appliance Management
     appliance: () => import('./appliance.js'),
+    'appliance-advanced': () => import('./appliance-advanced.js'),
+    'transfer-store': () => import('./transfer-store.js'),
 };
 // Cache for loaded commands
 const loadedCommands = new Map();

package/v3/@claude-flow/cli/dist/src/mcp-tools/browser-tools.js

@@ -10,10 +10,10 @@ const browserSessions = new Map();
  * Execute agent-browser CLI command
  */
 async function execBrowserCommand(args, session = 'default') {
-    const { execSync } = await import('child_process');
+    const { execFileSync } = await import('child_process');
     try {
         const fullArgs = ['--session', session, '--json', ...args];
-        const result = execSync(`agent-browser ${fullArgs.join(' ')}`, {
+        const result = execFileSync('agent-browser', fullArgs, {
             encoding: 'utf-8',
             timeout: 30000,
         });

package/v3/@claude-flow/cli/dist/src/mcp-tools/config-tools.js

@@ -30,7 +30,7 @@ function getConfigPath() {
 function ensureConfigDir() {
     const dir = getConfigDir();
     if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true });
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
     }
 }
 function loadConfigStore() {
@@ -80,7 +80,16 @@ function filterDangerousKeys(obj) {
     return filtered;
 }
 function setNestedValue(obj, key, value) {
+    const MAX_NESTING_DEPTH = 10;
     const parts = key.split('.');
+    if (parts.length > MAX_NESTING_DEPTH) {
+        throw new Error(`Key exceeds maximum nesting depth of ${MAX_NESTING_DEPTH}`);
+    }
+    for (const part of parts) {
+        if (DANGEROUS_KEYS.has(part)) {
+            throw new Error(`Dangerous key segment rejected: ${part}`);
+        }
+    }
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const part = parts[i];

package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.js

@@ -213,6 +213,7 @@ export const memoryTools = [
             const { getEntry } = await getMemoryFunctions();
             const key = input.key;
             const namespace = input.namespace || 'default';
+            validateMemoryInput(key);
             try {
                 const result = await getEntry({ key, namespace });
                 if (result.found && result.entry) {
@@ -337,6 +338,7 @@ export const memoryTools = [
             const { deleteEntry } = await getMemoryFunctions();
             const key = input.key;
             const namespace = input.namespace || 'default';
+            validateMemoryInput(key);
             try {
                 const result = await deleteEntry({ key, namespace });
                 return {

package/v3/@claude-flow/cli/dist/src/mcp-tools/swarm-tools.d.ts

@@ -1,7 +1,8 @@
 /**
  * Swarm MCP Tools for CLI
  *
- * Tool definitions for swarm coordination.
+ * Tool definitions for swarm coordination with file-based state persistence.
+ * Replaces previous stub implementations with real state tracking.
  */
 import type { MCPTool } from './types.js';
 export declare const swarmTools: MCPTool[];

package/v3/@claude-flow/cli/dist/src/mcp-tools/swarm-tools.js

@@ -1,82 +1,212 @@
 /**
  * Swarm MCP Tools for CLI
  *
- * Tool definitions for swarm coordination.
+ * Tool definitions for swarm coordination with file-based state persistence.
+ * Replaces previous stub implementations with real state tracking.
  */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+// Swarm state persistence
+const SWARM_DIR = '.claude-flow/swarm';
+const SWARM_STATE_FILE = 'swarm-state.json';
+function getSwarmDir() {
+    return join(process.cwd(), SWARM_DIR);
+}
+function getSwarmStatePath() {
+    return join(getSwarmDir(), SWARM_STATE_FILE);
+}
+function ensureSwarmDir() {
+    const dir = getSwarmDir();
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+}
+function loadSwarmStore() {
+    try {
+        const path = getSwarmStatePath();
+        if (existsSync(path)) {
+            return JSON.parse(readFileSync(path, 'utf-8'));
+        }
+    }
+    catch { /* return default */ }
+    return { swarms: {}, version: '3.0.0' };
+}
+function saveSwarmStore(store) {
+    ensureSwarmDir();
+    writeFileSync(getSwarmStatePath(), JSON.stringify(store, null, 2), 'utf-8');
+}
+// Input validation
+const VALID_TOPOLOGIES = new Set([
+    'hierarchical', 'mesh', 'hierarchical-mesh', 'ring', 'star', 'hybrid', 'adaptive',
+]);
 export const swarmTools = [
     {
         name: 'swarm_init',
-        description: 'Initialize a swarm',
+        description: 'Initialize a swarm with persistent state tracking',
         category: 'swarm',
         inputSchema: {
             type: 'object',
             properties: {
-                topology: { type: 'string', description: 'Swarm topology type' },
-                maxAgents: { type: 'number', description: 'Maximum number of agents' },
-                config: { type: 'object', description: 'Swarm configuration' },
+                topology: { type: 'string', description: 'Swarm topology type (hierarchical, mesh, hierarchical-mesh, ring, star, hybrid, adaptive)' },
+                maxAgents: { type: 'number', description: 'Maximum number of agents (1-50)' },
+                strategy: { type: 'string', description: 'Agent strategy (specialized, balanced, adaptive)' },
+                config: { type: 'object', description: 'Additional swarm configuration' },
             },
         },
         handler: async (input) => {
             const topology = input.topology || 'hierarchical-mesh';
-            const maxAgents = input.maxAgents || 15;
+            const maxAgents = Math.min(Math.max(input.maxAgents || 15, 1), 50);
+            const strategy = input.strategy || 'specialized';
             const config = (input.config || {});
-            return {
-                success: true,
-                swarmId: `swarm-${Date.now()}`,
+            if (!VALID_TOPOLOGIES.has(topology)) {
+                return {
+                    success: false,
+                    error: `Invalid topology: ${topology}. Valid: ${[...VALID_TOPOLOGIES].join(', ')}`,
+                };
+            }
+            const swarmId = `swarm-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const now = new Date().toISOString();
+            const swarmState = {
+                swarmId,
                 topology,
-                initializedAt: new Date().toISOString(),
+                maxAgents,
+                status: 'running',
+                agents: [],
+                tasks: [],
                 config: {
                     topology,
                     maxAgents,
-                    currentAgents: 0,
+                    strategy,
                     communicationProtocol: config.communicationProtocol || 'message-bus',
                     autoScaling: config.autoScaling ?? true,
                     consensusMechanism: config.consensusMechanism || 'majority',
                 },
+                createdAt: now,
+                updatedAt: now,
+            };
+            const store = loadSwarmStore();
+            store.swarms[swarmId] = swarmState;
+            saveSwarmStore(store);
+            return {
+                success: true,
+                swarmId,
+                topology,
+                strategy,
+                maxAgents,
+                initializedAt: now,
+                config: swarmState.config,
+                persisted: true,
             };
         },
     },
     {
         name: 'swarm_status',
-        description: 'Get swarm status',
+        description: 'Get swarm status from persistent state',
         category: 'swarm',
         inputSchema: {
             type: 'object',
             properties: {
-                swarmId: { type: 'string', description: 'Swarm ID' },
+                swarmId: { type: 'string', description: 'Swarm ID (omit for most recent)' },
             },
         },
         handler: async (input) => {
+            const store = loadSwarmStore();
+            const swarmId = input.swarmId;
+            if (swarmId && store.swarms[swarmId]) {
+                const swarm = store.swarms[swarmId];
+                return {
+                    swarmId: swarm.swarmId,
+                    status: swarm.status,
+                    topology: swarm.topology,
+                    maxAgents: swarm.maxAgents,
+                    agentCount: swarm.agents.length,
+                    taskCount: swarm.tasks.length,
+                    config: swarm.config,
+                    createdAt: swarm.createdAt,
+                    updatedAt: swarm.updatedAt,
+                };
+            }
+            // Return most recent swarm if no ID specified
+            const swarmIds = Object.keys(store.swarms);
+            if (swarmIds.length === 0) {
+                return {
+                    status: 'no_swarm',
+                    message: 'No active swarms. Use swarm_init to create one.',
+                    totalSwarms: 0,
+                };
+            }
+            const latest = swarmIds
+                .map(id => store.swarms[id])
+                .sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime())[0];
             return {
-                swarmId: input.swarmId,
-                status: 'running',
-                agentCount: 0,
-                taskCount: 0,
+                swarmId: latest.swarmId,
+                status: latest.status,
+                topology: latest.topology,
+                maxAgents: latest.maxAgents,
+                agentCount: latest.agents.length,
+                taskCount: latest.tasks.length,
+                config: latest.config,
+                createdAt: latest.createdAt,
+                updatedAt: latest.updatedAt,
+                totalSwarms: swarmIds.length,
             };
         },
     },
     {
         name: 'swarm_shutdown',
-        description: 'Shutdown a swarm',
+        description: 'Shutdown a swarm and update persistent state',
         category: 'swarm',
         inputSchema: {
             type: 'object',
             properties: {
-                swarmId: { type: 'string', description: 'Swarm ID' },
-                graceful: { type: 'boolean', description: 'Graceful shutdown' },
+                swarmId: { type: 'string', description: 'Swarm ID to shutdown' },
+                graceful: { type: 'boolean', description: 'Graceful shutdown (default: true)' },
             },
         },
         handler: async (input) => {
+            const store = loadSwarmStore();
+            const swarmId = input.swarmId;
+            // Find the swarm
+            let target;
+            if (swarmId && store.swarms[swarmId]) {
+                target = store.swarms[swarmId];
+            }
+            else {
+                // Shutdown most recent running swarm
+                const running = Object.values(store.swarms)
+                    .filter(s => s.status === 'running')
+                    .sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
+                target = running[0];
+            }
+            if (!target) {
+                return {
+                    success: false,
+                    error: swarmId ? `Swarm ${swarmId} not found` : 'No running swarms to shutdown',
+                };
+            }
+            if (target.status === 'terminated') {
+                return {
+                    success: false,
+                    swarmId: target.swarmId,
+                    error: 'Swarm already terminated',
+                };
+            }
+            target.status = 'terminated';
+            target.updatedAt = new Date().toISOString();
+            saveSwarmStore(store);
             return {
                 success: true,
-                swarmId: input.swarmId,
+                swarmId: target.swarmId,
                 terminated: true,
+                graceful: input.graceful ?? true,
+                agentsTerminated: target.agents.length,
+                terminatedAt: target.updatedAt,
             };
         },
     },
     {
         name: 'swarm_health',
-        description: 'Check swarm health status',
+        description: 'Check swarm health status with real state inspection',
         category: 'swarm',
         inputSchema: {
             type: 'object',
@@ -85,15 +215,71 @@ export const swarmTools = [
             },
         },
         handler: async (input) => {
+            const store = loadSwarmStore();
+            const swarmId = input.swarmId;
+            // Find the swarm
+            let target;
+            if (swarmId) {
+                target = store.swarms[swarmId];
+                if (!target) {
+                    return {
+                        status: 'not_found',
+                        healthy: false,
+                        checks: [
+                            { name: 'swarm_exists', status: 'fail', message: `Swarm ${swarmId} not found` },
+                        ],
+                        checkedAt: new Date().toISOString(),
+                    };
+                }
+            }
+            else {
+                const running = Object.values(store.swarms)
+                    .filter(s => s.status === 'running')
+                    .sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
+                target = running[0];
+            }
+            if (!target) {
+                return {
+                    status: 'no_swarm',
+                    healthy: false,
+                    checks: [
+                        { name: 'swarm_exists', status: 'fail', message: 'No active swarm found' },
+                    ],
+                    checkedAt: new Date().toISOString(),
+                };
+            }
+            const isRunning = target.status === 'running';
+            const stateFileExists = existsSync(getSwarmStatePath());
+            const checks = [
+                {
+                    name: 'coordinator',
+                    status: isRunning ? 'ok' : 'warn',
+                    message: isRunning ? 'Coordinator active' : `Swarm status: ${target.status}`,
+                },
+                {
+                    name: 'agents',
+                    status: target.agents.length > 0 ? 'ok' : 'info',
+                    message: `${target.agents.length} agents registered (max: ${target.maxAgents})`,
+                },
+                {
+                    name: 'persistence',
+                    status: stateFileExists ? 'ok' : 'warn',
+                    message: stateFileExists ? 'State file persisted' : 'State file missing',
+                },
+                {
+                    name: 'topology',
+                    status: 'ok',
+                    message: `Topology: ${target.topology}`,
+                },
+            ];
+            const healthy = isRunning && stateFileExists;
             return {
-                status: 'healthy',
-                swarmId: input.swarmId || 'default',
-                checks: [
-                    { name: 'coordinator', status: 'ok', message: 'Coordinator responding' },
-                    { name: 'agents', status: 'ok', message: 'Agent pool healthy' },
-                    { name: 'memory', status: 'ok', message: 'Memory backend connected' },
-                    { name: 'messaging', status: 'ok', message: 'Message bus active' },
-                ],
+                status: healthy ? 'healthy' : 'degraded',
+                healthy,
+                swarmId: target.swarmId,
+                topology: target.topology,
+                agentCount: target.agents.length,
+                checks,
                 checkedAt: new Date().toISOString(),
             };
         },

package/v3/@claude-flow/cli/dist/src/transfer/storage/gcs.js

@@ -78,6 +78,10 @@ export async function uploadToGCS(content, options = {}) {
     const contentId = generateContentId(content);
     const checksum = crypto.createHash('sha256').update(content).digest('hex');
     const fileName = options.name || `${contentId}.cfp.json`;
+    // Validate filename to prevent path traversal
+    if (!/^[a-zA-Z0-9._\-]+$/.test(fileName) || fileName.includes('..')) {
+        throw new Error(`Invalid filename: ${fileName}`);
+    }
     const objectPath = config.prefix ? `${config.prefix}/${fileName}` : fileName;
     // S-1: Validate bucket name and object path to prevent command injection
     if (!isValidBucketName(config.bucket)) {
@@ -111,8 +115,11 @@ export async function uploadToGCS(content, options = {}) {
                 // Metadata update failed, but upload succeeded
             }
         }
-        // Clean up temp file
-        fs.unlinkSync(tempFile);
+        // Clean up temp file (validate path is within temp dir)
+        const resolvedTemp = path.resolve(tempFile);
+        if (resolvedTemp.startsWith(path.resolve(tempDir))) {
+            fs.unlinkSync(tempFile);
+        }
         const uri = `gs://${config.bucket}/${objectPath}`;
         const publicUrl = `https://storage.googleapis.com/${config.bucket}/${objectPath}`;
         console.log(`[GCS] Upload complete: ${uri}`);
@@ -126,9 +133,12 @@ export async function uploadToGCS(content, options = {}) {
         };
     }
     catch (error) {
-        // Clean up temp file on error
+        // Clean up temp file on error (validate path is within temp dir)
         try {
-            fs.unlinkSync(tempFile);
+            const resolvedTemp = path.resolve(tempFile);
+            if (resolvedTemp.startsWith(path.resolve(tempDir))) {
+                fs.unlinkSync(tempFile);
+            }
         }
         catch { /* ignore */ }
         throw new Error(`GCS upload failed: ${error}`);
@@ -150,13 +160,19 @@ export async function downloadFromGCS(uri, config) {
             downloadArgs.push(`--project=${cfg.projectId}`);
         execFileSync('gcloud', downloadArgs, { encoding: 'utf-8', stdio: 'pipe' });
         const content = fs.readFileSync(tempFile);
-        fs.unlinkSync(tempFile);
+        const resolvedTemp = path.resolve(tempFile);
+        if (resolvedTemp.startsWith(path.resolve(tempDir))) {
+            fs.unlinkSync(tempFile);
+        }
         console.log(`[GCS] Downloaded ${content.length} bytes`);
         return content;
     }
     catch (error) {
         try {
-            fs.unlinkSync(tempFile);
+            const resolvedTemp = path.resolve(tempFile);
+            if (resolvedTemp.startsWith(path.resolve(tempDir))) {
+                fs.unlinkSync(tempFile);
+            }
         }
         catch { /* ignore */ }
         console.error(`[GCS] Download failed: ${error}`);

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.5.24",
+  "version": "3.5.25",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",