claude-flow 3.5.69 → 3.5.71

package/v3/@claude-flow/cli/dist/src/mcp-tools/claims-tools.js

@@ -6,6 +6,7 @@
  *
  * @module @claude-flow/cli/mcp-tools/claims
  */
+import { validateIdentifier, validateText } from './validate-input.js';
 // File-based persistence
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
 import { join, resolve } from 'path';
@@ -78,6 +79,21 @@ export const claimsTools = [
             const issueId = input.issueId;
             const claimantStr = input.claimant;
             const context = input.context;
+            {
+                const v = validateIdentifier(issueId, 'issueId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            {
+                const v = validateText(claimantStr, 'claimant');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (context) {
+                const v = validateText(context, 'context');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const claimant = parseClaimant(claimantStr);
             if (!claimant) {
                 return { success: false, error: 'Invalid claimant format. Use "human:userId:name" or "agent:agentId:agentType"' };
@@ -137,6 +153,21 @@ export const claimsTools = [
             const issueId = input.issueId;
             const claimantStr = input.claimant;
             const reason = input.reason;
+            {
+                const v = validateIdentifier(issueId, 'issueId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            {
+                const v = validateText(claimantStr, 'claimant');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (reason) {
+                const v = validateText(reason, 'reason');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const claimant = parseClaimant(claimantStr);
             if (!claimant) {
                 return { success: false, error: 'Invalid claimant format' };
@@ -197,6 +228,26 @@ export const claimsTools = [
             const toStr = input.to;
             const reason = input.reason;
             const progress = input.progress || 0;
+            {
+                const v = validateIdentifier(issueId, 'issueId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            {
+                const v = validateText(fromStr, 'from');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            {
+                const v = validateText(toStr, 'to');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (reason) {
+                const v = validateText(reason, 'reason');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const from = parseClaimant(fromStr);
             const to = parseClaimant(toStr);
             if (!from || !to) {
@@ -246,6 +297,16 @@ export const claimsTools = [
         handler: async (input) => {
             const issueId = input.issueId;
             const claimantStr = input.claimant;
+            {
+                const v = validateIdentifier(issueId, 'issueId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            {
+                const v = validateText(claimantStr, 'claimant');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const claimant = parseClaimant(claimantStr);
             if (!claimant) {
                 return { success: false, error: 'Invalid claimant format' };
@@ -310,6 +371,16 @@ export const claimsTools = [
             const status = input.status;
             const note = input.note;
             const progress = input.progress;
+            {
+                const v = validateIdentifier(issueId, 'issueId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (note) {
+                const v = validateText(note, 'note');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadClaims();
             const claim = store.claims[issueId];
             if (!claim) {
@@ -359,6 +430,16 @@ export const claimsTools = [
             const status = input.status;
             const claimantFilter = input.claimant;
             const agentType = input.agentType;
+            if (claimantFilter) {
+                const v = validateText(claimantFilter, 'claimant');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (agentType) {
+                const v = validateIdentifier(agentType, 'agentType');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadClaims();
             let claims = Object.values(store.claims);
             if (status && status !== 'all') {
@@ -411,6 +492,16 @@ export const claimsTools = [
             const reason = input.reason;
             const preferredTypes = input.preferredTypes;
             const context = input.context;
+            {
+                const v = validateIdentifier(issueId, 'issueId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (context) {
+                const v = validateText(context, 'context');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadClaims();
             const claim = store.claims[issueId];
             if (!claim) {
@@ -457,6 +548,16 @@ export const claimsTools = [
         handler: async (input) => {
             const issueId = input.issueId;
             const stealerStr = input.stealer;
+            {
+                const v = validateIdentifier(issueId, 'issueId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            {
+                const v = validateText(stealerStr, 'stealer');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const stealer = parseClaimant(stealerStr);
             if (!stealer) {
                 return { success: false, error: 'Invalid claimant format' };
@@ -512,6 +613,11 @@ export const claimsTools = [
         },
         handler: async (input) => {
             const agentType = input.agentType;
+            if (agentType) {
+                const v = validateIdentifier(agentType, 'agentType');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadClaims();
             let stealableIssues = Object.entries(store.stealable).map(([issueId, info]) => ({
                 issueId,
@@ -548,6 +654,16 @@ export const claimsTools = [
         handler: async (input) => {
             const agentId = input.agentId;
             const agentType = input.agentType;
+            if (agentId) {
+                const v = validateIdentifier(agentId, 'agentId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (agentType) {
+                const v = validateIdentifier(agentType, 'agentType');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadClaims();
             const claims = Object.values(store.claims);
             // Group claims by agent

package/v3/@claude-flow/cli/dist/src/mcp-tools/config-tools.js

@@ -6,6 +6,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { validateIdentifier, validateText } from './validate-input.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const CONFIG_FILE = 'config.json';
@@ -115,6 +116,15 @@ export const configTools = [
             required: ['key'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vKey = validateText(input.key, 'key', 256);
+            if (!vKey.valid)
+                return { success: false, error: vKey.error };
+            if (input.scope) {
+                const v = validateIdentifier(input.scope, 'scope');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadConfigStore();
             const key = input.key;
             const scope = input.scope || 'default';
@@ -152,6 +162,15 @@ export const configTools = [
             required: ['key', 'value'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vKey = validateText(input.key, 'key', 256);
+            if (!vKey.valid)
+                return { success: false, error: vKey.error };
+            if (input.scope) {
+                const v = validateIdentifier(input.scope, 'scope');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadConfigStore();
             const key = input.key;
             const value = input.value;
@@ -190,6 +209,17 @@ export const configTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.scope) {
+                const v = validateIdentifier(input.scope, 'scope');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.prefix) {
+                const v = validateText(input.prefix, 'prefix', 256);
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadConfigStore();
             const scope = input.scope || 'default';
             const prefix = input.prefix;
@@ -236,6 +266,17 @@ export const configTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.scope) {
+                const v = validateIdentifier(input.scope, 'scope');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.key) {
+                const v = validateText(input.key, 'key', 256);
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadConfigStore();
             const scope = input.scope || 'default';
             const key = input.key;
@@ -286,6 +327,12 @@ export const configTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.scope) {
+                const v = validateIdentifier(input.scope, 'scope');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadConfigStore();
             const scope = input.scope || 'default';
             const includeDefaults = input.includeDefaults !== false;
@@ -320,6 +367,12 @@ export const configTools = [
             required: ['config'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.scope) {
+                const v = validateIdentifier(input.scope, 'scope');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadConfigStore();
             const config = filterDangerousKeys(input.config);
             const scope = input.scope || 'default';

package/v3/@claude-flow/cli/dist/src/mcp-tools/coordination-tools.js

@@ -9,6 +9,7 @@
  * - Useful for single-machine workflow orchestration
  */
 import { getProjectCwd } from './types.js';
+import { validateIdentifier, validateText } from './validate-input.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 // Storage paths
@@ -147,6 +148,11 @@ export const coordinationTools = [
             },
         },
         handler: async (input) => {
+            if (input.task) {
+                const vTask = validateText(input.task, 'task');
+                if (!vTask.valid)
+                    return { success: false, error: vTask.error };
+            }
             const store = loadCoordStore();
             const action = input.action || 'get';
             if (action === 'get') {
@@ -286,6 +292,11 @@ export const coordinationTools = [
             },
         },
         handler: async (input) => {
+            if (input.nodeId) {
+                const vNode = validateIdentifier(input.nodeId, 'nodeId');
+                if (!vNode.valid)
+                    return { success: false, error: vNode.error };
+            }
             const store = loadCoordStore();
             const action = input.action || 'list';
             if (action === 'list') {
@@ -367,6 +378,16 @@ export const coordinationTools = [
             },
         },
         handler: async (input) => {
+            if (input.proposalId) {
+                const vProp = validateIdentifier(input.proposalId, 'proposalId');
+                if (!vProp.valid)
+                    return { success: false, error: vProp.error };
+            }
+            if (input.voterId) {
+                const vVoter = validateIdentifier(input.voterId, 'voterId');
+                if (!vVoter.valid)
+                    return { success: false, error: vVoter.error };
+            }
             const store = loadCoordStore();
             const action = input.action || 'status';
             const strategy = input.strategy || 'raft';
@@ -598,6 +619,16 @@ export const coordinationTools = [
             required: ['task'],
         },
         handler: async (input) => {
+            const vTask = validateText(input.task, 'task');
+            if (!vTask.valid)
+                return { success: false, error: vTask.error };
+            if (input.agents && Array.isArray(input.agents)) {
+                for (const a of input.agents) {
+                    const vA = validateIdentifier(a, 'agents[]');
+                    if (!vA.valid)
+                        return { success: false, error: vA.error };
+                }
+            }
             const store = loadCoordStore();
             const task = input.task;
             const agents = input.agents || Object.keys(store.nodes);

package/v3/@claude-flow/cli/dist/src/mcp-tools/daa-tools.js

@@ -9,6 +9,7 @@
  * - Useful for workflow orchestration and state tracking
  */
 import { getProjectCwd } from './types.js';
+import { validateIdentifier, validateText } from './validate-input.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 // Storage paths
@@ -62,6 +63,19 @@ export const daaTools = [
             required: ['id'],
         },
         handler: async (input) => {
+            const vId = validateIdentifier(input.id, 'id');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
+            if (input.name) {
+                const vName = validateText(input.name, 'name');
+                if (!vName.valid)
+                    return { success: false, error: vName.error };
+            }
+            if (input.type) {
+                const vType = validateIdentifier(input.type, 'type');
+                if (!vType.valid)
+                    return { success: false, error: vType.error };
+            }
             const store = loadDAAStore();
             const id = input.id;
             const agent = {
@@ -123,6 +137,14 @@ export const daaTools = [
             required: ['agentId'],
         },
         handler: async (input) => {
+            const vAgentId = validateIdentifier(input.agentId, 'agentId');
+            if (!vAgentId.valid)
+                return { success: false, error: vAgentId.error };
+            if (input.feedback) {
+                const vFeedback = validateText(input.feedback, 'feedback');
+                if (!vFeedback.valid)
+                    return { success: false, error: vFeedback.error };
+            }
             const store = loadDAAStore();
             const agentId = input.agentId;
             const agent = store.agents[agentId];
@@ -179,6 +201,12 @@ export const daaTools = [
             required: ['id', 'name'],
         },
         handler: async (input) => {
+            const vId = validateIdentifier(input.id, 'id');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
+            const vName = validateText(input.name, 'name');
+            if (!vName.valid)
+                return { success: false, error: vName.error };
             const store = loadDAAStore();
             const id = input.id;
             const workflow = {
@@ -218,6 +246,9 @@ export const daaTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
+            const vWorkflowId = validateIdentifier(input.workflowId, 'workflowId');
+            if (!vWorkflowId.valid)
+                return { success: false, error: vWorkflowId.error };
             const store = loadDAAStore();
             const workflowId = input.workflowId;
             const workflow = store.workflows[workflowId];
@@ -265,6 +296,21 @@ export const daaTools = [
             required: ['sourceAgentId', 'targetAgentIds'],
         },
         handler: async (input) => {
+            const vSourceId = validateIdentifier(input.sourceAgentId, 'sourceAgentId');
+            if (!vSourceId.valid)
+                return { success: false, error: vSourceId.error };
+            if (input.targetAgentIds && Array.isArray(input.targetAgentIds)) {
+                for (const t of input.targetAgentIds) {
+                    const vT = validateIdentifier(t, 'targetAgentIds[]');
+                    if (!vT.valid)
+                        return { success: false, error: vT.error };
+                }
+            }
+            if (input.knowledgeDomain) {
+                const vDomain = validateIdentifier(input.knowledgeDomain, 'knowledgeDomain');
+                if (!vDomain.valid)
+                    return { success: false, error: vDomain.error };
+            }
             const store = loadDAAStore();
             const sourceId = input.sourceAgentId;
             const targetIds = input.targetAgentIds;
@@ -319,6 +365,11 @@ export const daaTools = [
             },
         },
         handler: async (input) => {
+            if (input.agentId) {
+                const vAgentId = validateIdentifier(input.agentId, 'agentId');
+                if (!vAgentId.valid)
+                    return { success: false, error: vAgentId.error };
+            }
             const store = loadDAAStore();
             const agentId = input.agentId;
             if (agentId) {
@@ -371,6 +422,16 @@ export const daaTools = [
             },
         },
         handler: async (input) => {
+            if (input.agentId) {
+                const vAgentId = validateIdentifier(input.agentId, 'agentId');
+                if (!vAgentId.valid)
+                    return { success: false, error: vAgentId.error };
+            }
+            if (input.pattern) {
+                const vPattern = validateIdentifier(input.pattern, 'pattern');
+                if (!vPattern.valid)
+                    return { success: false, error: vPattern.error };
+            }
             const store = loadDAAStore();
             const agentId = input.agentId;
             const action = input.action || 'analyze';

package/v3/@claude-flow/cli/dist/src/mcp-tools/embeddings-tools.js

@@ -6,6 +6,7 @@
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
 import { join, resolve } from 'path';
+import { validateIdentifier, validateText } from './validate-input.js';
 // Configuration paths
 const CONFIG_DIR = '.claude-flow';
 const EMBEDDINGS_CONFIG = 'embeddings.json';
@@ -230,6 +231,11 @@ export const embeddingsTools = [
                 };
             }
             const text = input.text;
+            {
+                const v = validateText(text, 'text');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const useHyperbolic = input.hyperbolic === true && config.hyperbolic.enabled;
             // Generate real ONNX embedding
             const embedding = await generateRealEmbedding(text, config.dimension);
@@ -292,6 +298,16 @@ export const embeddingsTools = [
             const text1 = input.text1;
             const text2 = input.text2;
             const metric = input.metric || 'cosine';
+            {
+                const v = validateText(text1, 'text1');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            {
+                const v = validateText(text2, 'text2');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             // Generate real ONNX embeddings for both texts
             const [emb1, emb2] = await Promise.all([
                 generateRealEmbedding(text1, config.dimension),
@@ -376,6 +392,16 @@ export const embeddingsTools = [
             const topK = input.topK || 5;
             const threshold = input.threshold || 0.5;
             const namespace = input.namespace;
+            {
+                const v = validateText(query, 'query');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (namespace) {
+                const v = validateIdentifier(namespace, 'namespace');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const startTime = performance.now();
             // Generate real ONNX embedding for query
             const queryEmbedding = await generateRealEmbedding(query, config.dimension);

package/v3/@claude-flow/cli/dist/src/mcp-tools/github-tools.js

@@ -5,6 +5,7 @@
  * Falls back to local state management when CLI tools are unavailable.
  */
 import { getProjectCwd } from './types.js';
+import { validateIdentifier, validateText } from './validate-input.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { execSync } from 'node:child_process';
@@ -68,6 +69,21 @@ export const githubTools = [
             },
         },
         handler: async (input) => {
+            if (input.owner) {
+                const v = validateIdentifier(input.owner, 'owner');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.repo) {
+                const v = validateIdentifier(input.repo, 'repo');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.branch) {
+                const v = validateIdentifier(input.branch, 'branch');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadGitHubStore();
             const branch = input.branch || 'main';
             const cwd = getProjectCwd();
@@ -150,6 +166,36 @@ export const githubTools = [
             },
         },
         handler: async (input) => {
+            if (input.owner) {
+                const v = validateIdentifier(input.owner, 'owner');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.repo) {
+                const v = validateIdentifier(input.repo, 'repo');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.title) {
+                const v = validateText(input.title, 'title');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.body) {
+                const v = validateText(input.body, 'body');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.branch) {
+                const v = validateIdentifier(input.branch, 'branch');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.baseBranch) {
+                const v = validateIdentifier(input.baseBranch, 'baseBranch');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadGitHubStore();
             const action = input.action || 'list';
             const gh = hasGhCli();
@@ -250,6 +296,26 @@ export const githubTools = [
             },
         },
         handler: async (input) => {
+            if (input.owner) {
+                const v = validateIdentifier(input.owner, 'owner');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.repo) {
+                const v = validateIdentifier(input.repo, 'repo');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.title) {
+                const v = validateText(input.title, 'title');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.body) {
+                const v = validateText(input.body, 'body');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadGitHubStore();
             const action = input.action || 'list';
             const gh = hasGhCli();
@@ -340,6 +406,26 @@ export const githubTools = [
             },
         },
         handler: async (input) => {
+            if (input.owner) {
+                const v = validateIdentifier(input.owner, 'owner');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.repo) {
+                const v = validateIdentifier(input.repo, 'repo');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.workflowId) {
+                const v = validateIdentifier(input.workflowId, 'workflowId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.ref) {
+                const v = validateIdentifier(input.ref, 'ref');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const action = input.action || 'list';
             const gh = hasGhCli();
             if (!gh) {
@@ -417,6 +503,16 @@ export const githubTools = [
             },
         },
         handler: async (input) => {
+            if (input.owner) {
+                const v = validateIdentifier(input.owner, 'owner');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.repo) {
+                const v = validateIdentifier(input.repo, 'repo');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const metric = input.metric || 'all';
             const timeRange = input.timeRange || '30d';
             const cwd = getProjectCwd();