claude-flow 3.5.69 → 3.5.71

package/v3/@claude-flow/cli/dist/src/mcp-tools/performance-tools.js

@@ -12,6 +12,7 @@
  * Note: Some optimization suggestions are illustrative
  */
 import { getProjectCwd } from './types.js';
+import { validateIdentifier } from './validate-input.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import * as os from 'node:os';
@@ -158,6 +159,11 @@ export const performanceTools = [
             },
         },
         handler: async (_input) => {
+            if (_input.component) {
+                const v = validateIdentifier(_input.component, 'component');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const loadAvg = os.loadavg();
             const cpus = os.cpus();
             const cpuPercent = Math.min((loadAvg[0] / cpus.length) * 100, 100);
@@ -346,6 +352,11 @@ export const performanceTools = [
             },
         },
         handler: async (input) => {
+            if (input.target) {
+                const v = validateIdentifier(input.target, 'target');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const target = input.target || 'all';
             const durationSec = Math.min(input.duration || 1, 10);
             const durationMs = durationSec * 1000;

package/v3/@claude-flow/cli/dist/src/mcp-tools/ruvllm-tools.js

@@ -4,6 +4,7 @@
  * Exposes @ruvector/ruvllm-wasm operations via MCP protocol.
  * All tools gracefully degrade when the WASM package is not installed.
  */
+import { validateIdentifier, validateText } from './validate-input.js';
 async function loadRuvllmWasm() {
     return import('../ruvector/ruvllm-wasm.js');
 }
@@ -67,6 +68,16 @@ export const ruvllmWasmTools = [
             required: ['routerId', 'name', 'embedding'],
         },
         handler: async (args) => {
+            {
+                const v = validateIdentifier(args.routerId, 'routerId');
+                if (!v.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+            }
+            {
+                const v = validateIdentifier(args.name, 'name');
+                if (!v.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+            }
             try {
                 const router = hnswRouters.get(args.routerId);
                 if (!router)
@@ -97,6 +108,11 @@ export const ruvllmWasmTools = [
             required: ['routerId', 'query'],
         },
         handler: async (args) => {
+            {
+                const v = validateIdentifier(args.routerId, 'routerId');
+                if (!v.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+            }
             try {
                 const router = hnswRouters.get(args.routerId);
                 if (!router)
@@ -150,6 +166,11 @@ export const ruvllmWasmTools = [
             required: ['sonaId', 'quality'],
         },
         handler: async (args) => {
+            {
+                const v = validateIdentifier(args.sonaId, 'sonaId');
+                if (!v.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+            }
             try {
                 const sona = sonaInstances.get(args.sonaId);
                 if (!sona)
@@ -207,6 +228,11 @@ export const ruvllmWasmTools = [
             required: ['loraId', 'quality'],
         },
         handler: async (args) => {
+            {
+                const v = validateIdentifier(args.loraId, 'loraId');
+                if (!v.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+            }
             try {
                 const lora = loraInstances.get(args.loraId);
                 if (!lora)
@@ -235,6 +261,11 @@ export const ruvllmWasmTools = [
             required: ['messages', 'template'],
         },
         handler: async (args) => {
+            {
+                const v = validateText(args.template, 'template', 256);
+                if (!v.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+            }
             try {
                 const mod = await loadRuvllmWasm();
                 const messages = args.messages;

package/v3/@claude-flow/cli/dist/src/mcp-tools/security-tools.js

@@ -9,6 +9,7 @@
  *
  * Created with ❤️ by ruv.io
  */
+import { validateText, validateIdentifier } from './validate-input.js';
 import { autoInstallPackage } from './auto-install.js';
 import { createRequire } from 'module';
 // Create require for resolving module paths
@@ -93,6 +94,11 @@ const aidefenceScanTool = {
         required: ['input'],
     },
     handler: async (args) => {
+        {
+            const v = validateText(args.input, 'input');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
         const input = args.input;
         const quick = args.quick;
         try {
@@ -167,6 +173,11 @@ const aidefenceAnalyzeTool = {
         required: ['input'],
     },
     handler: async (args) => {
+        {
+            const v = validateText(args.input, 'input');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
         const input = args.input;
         const searchSimilar = args.searchSimilar !== false;
         const k = args.k || 5;
@@ -296,6 +307,21 @@ const aidefenceLearnTool = {
         required: ['input', 'wasAccurate'],
     },
     handler: async (args) => {
+        {
+            const v = validateText(args.input, 'input');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
+        if (args.verdict) {
+            const v = validateText(args.verdict, 'verdict');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
+        if (args.threatType) {
+            const v = validateIdentifier(args.threatType, 'threatType');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
         const input = args.input;
         const wasAccurate = args.wasAccurate;
         const verdict = args.verdict;
@@ -358,6 +384,11 @@ const aidefenceIsSafeTool = {
         required: ['input'],
     },
     handler: async (args) => {
+        {
+            const v = validateText(args.input, 'input');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
         const input = args.input;
         try {
             const { isSafe } = await import('@claude-flow/aidefence');
@@ -397,6 +428,11 @@ const aidefenceHasPIITool = {
         required: ['input'],
     },
     handler: async (args) => {
+        {
+            const v = validateText(args.input, 'input');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
         const input = args.input;
         try {
             const defender = await getAIDefence();

package/v3/@claude-flow/cli/dist/src/mcp-tools/session-tools.js

@@ -6,6 +6,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { validateIdentifier, validateText } from './validate-input.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const SESSION_DIR = 'sessions';
@@ -105,6 +106,15 @@ export const sessionTools = [
             required: ['name'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vName = validateText(input.name, 'name', 256);
+            if (!vName.valid)
+                return { success: false, error: vName.error };
+            if (input.description) {
+                const v = validateText(input.description, 'description');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const sessionId = `session-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
             // Load related data based on options
             const data = loadRelatedStores({
@@ -152,6 +162,17 @@ export const sessionTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.sessionId) {
+                const v = validateIdentifier(input.sessionId, 'sessionId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.name) {
+                const v = validateText(input.name, 'name', 256);
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             let session = null;
             // Try to find by sessionId first
             if (input.sessionId) {
@@ -279,6 +300,10 @@ export const sessionTools = [
             required: ['sessionId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.sessionId, 'sessionId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const sessionId = input.sessionId;
             const path = getSessionPath(sessionId);
             if (existsSync(path)) {
@@ -308,6 +333,10 @@ export const sessionTools = [
             required: ['sessionId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.sessionId, 'sessionId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const sessionId = input.sessionId;
             const session = loadSession(sessionId);
             if (session) {

package/v3/@claude-flow/cli/dist/src/mcp-tools/swarm-tools.js

@@ -7,6 +7,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { validateIdentifier } from './validate-input.js';
 // Swarm state persistence
 const SWARM_DIR = '.claude-flow/swarm';
 const SWARM_STATE_FILE = 'swarm-state.json';
@@ -55,6 +56,17 @@ export const swarmTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.topology) {
+                const v = validateIdentifier(input.topology, 'topology');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.strategy) {
+                const v = validateIdentifier(input.strategy, 'strategy');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const topology = input.topology || 'hierarchical-mesh';
             const maxAgents = Math.min(Math.max(input.maxAgents || 15, 1), 50);
             const strategy = input.strategy || 'specialized';
@@ -111,6 +123,12 @@ export const swarmTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.swarmId) {
+                const v = validateIdentifier(input.swarmId, 'swarmId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadSwarmStore();
             const swarmId = input.swarmId;
             if (swarmId && store.swarms[swarmId]) {
@@ -165,6 +183,12 @@ export const swarmTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.swarmId) {
+                const v = validateIdentifier(input.swarmId, 'swarmId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadSwarmStore();
             const swarmId = input.swarmId;
             // Find the swarm
@@ -216,6 +240,12 @@ export const swarmTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.swarmId) {
+                const v = validateIdentifier(input.swarmId, 'swarmId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadSwarmStore();
             const swarmId = input.swarmId;
             // Find the swarm

package/v3/@claude-flow/cli/dist/src/mcp-tools/system-tools.js

@@ -9,6 +9,7 @@
  * - os module for system information
  */
 import { getProjectCwd } from './types.js';
+import { validateIdentifier } from './validate-input.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -437,6 +438,11 @@ export const systemTools = [
             if (!input.confirm) {
                 return { success: false, error: 'Reset requires confirmation' };
             }
+            if (input.component) {
+                const v = validateIdentifier(input.component, 'component');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const component = input.component || 'metrics';
             // Reset metrics to defaults
             const defaultMetrics = {

package/v3/@claude-flow/cli/dist/src/mcp-tools/task-tools.js

@@ -6,6 +6,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { validateIdentifier, validateText } from './validate-input.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const TASK_DIR = 'tasks';
@@ -56,6 +57,13 @@ export const taskTools = [
             required: ['type', 'description'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vType = validateIdentifier(input.type, 'type');
+            if (!vType.valid)
+                return { success: false, error: vType.error };
+            const vDesc = validateText(input.description, 'description');
+            if (!vDesc.valid)
+                return { success: false, error: vDesc.error };
             const store = loadTaskStore();
             const taskId = `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
             const task = {
@@ -97,6 +105,10 @@ export const taskTools = [
             required: ['taskId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.taskId, 'taskId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadTaskStore();
             const taskId = input.taskId;
             const task = store.tasks[taskId];
@@ -194,6 +206,10 @@ export const taskTools = [
             required: ['taskId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.taskId, 'taskId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadTaskStore();
             const taskId = input.taskId;
             const task = store.tasks[taskId];
@@ -254,6 +270,10 @@ export const taskTools = [
             required: ['taskId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.taskId, 'taskId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadTaskStore();
             const taskId = input.taskId;
             const task = store.tasks[taskId];
@@ -301,6 +321,10 @@ export const taskTools = [
             required: ['taskId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.taskId, 'taskId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadTaskStore();
             const taskId = input.taskId;
             const task = store.tasks[taskId];
@@ -380,6 +404,15 @@ export const taskTools = [
             required: ['taskId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.taskId, 'taskId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
+            if (input.reason) {
+                const v = validateText(input.reason, 'reason');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadTaskStore();
             const taskId = input.taskId;
             const task = store.tasks[taskId];

package/v3/@claude-flow/cli/dist/src/mcp-tools/terminal-tools.js

@@ -5,6 +5,7 @@
  */
 import { getProjectCwd } from './types.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { validateIdentifier, validatePath, validateText } from './validate-input.js';
 import { join } from 'node:path';
 import { execSync } from 'node:child_process';
 // Storage paths
@@ -53,6 +54,17 @@ export const terminalTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.name) {
+                const v = validateText(input.name, 'name', 256);
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.workingDir) {
+                const v = validatePath(input.workingDir, 'workingDir');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadTerminalStore();
             const id = `term-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
             const session = {
@@ -92,6 +104,15 @@ export const terminalTools = [
             required: ['command'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vCmd = validateText(input.command, 'command', 10_000);
+            if (!vCmd.valid)
+                return { success: false, error: vCmd.error };
+            if (input.sessionId) {
+                const v = validateIdentifier(input.sessionId, 'sessionId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadTerminalStore();
             const sessionId = input.sessionId;
             const command = input.command;
@@ -201,6 +222,10 @@ export const terminalTools = [
             required: ['sessionId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.sessionId, 'sessionId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadTerminalStore();
             const sessionId = input.sessionId;
             const session = store.sessions[sessionId];
@@ -229,6 +254,12 @@ export const terminalTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.sessionId) {
+                const v = validateIdentifier(input.sessionId, 'sessionId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadTerminalStore();
             const sessionId = input.sessionId;
             const limit = input.limit || 50;

package/v3/@claude-flow/cli/dist/src/mcp-tools/transfer-tools.js

@@ -5,6 +5,7 @@
  * @module @claude-flow/cli/mcp-tools/transfer-tools
  * @version 3.0.0
  */
+import { validateIdentifier, validateText } from './validate-input.js';
 /**
  * Helper to create MCP tool result
  */
@@ -42,6 +43,11 @@ export const transferTools = [
             required: ['content'],
         },
         handler: async (input) => {
+            {
+                const v = validateText(input.content, 'content');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { detectPII } = await import('../transfer/anonymization/index.js');
                 const result = detectPII(input.content);
@@ -71,6 +77,11 @@ export const transferTools = [
             required: ['name'],
         },
         handler: async (input) => {
+            {
+                const v = validateIdentifier(input.name, 'name');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { resolveIPNS } = await import('../transfer/ipfs/client.js');
                 const result = await resolveIPNS(input.name);
@@ -115,6 +126,16 @@ export const transferTools = [
             },
         },
         handler: async (input) => {
+            if (input.query) {
+                const v = validateText(input.query, 'query');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
+            if (input.category) {
+                const v = validateIdentifier(input.category, 'category');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { PatternStore } = await import('../transfer/store/index.js');
                 const store = new PatternStore();
@@ -143,6 +164,11 @@ export const transferTools = [
             required: ['id'],
         },
         handler: async (input) => {
+            {
+                const v = validateIdentifier(input.id, 'id');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { PatternStore } = await import('../transfer/store/index.js');
                 const store = new PatternStore();
@@ -178,6 +204,11 @@ export const transferTools = [
             required: ['id'],
         },
         handler: async (input) => {
+            {
+                const v = validateIdentifier(input.id, 'id');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { PatternStore } = await import('../transfer/store/index.js');
                 const store = new PatternStore();
@@ -284,6 +315,21 @@ export const transferTools = [
             },
         },
         handler: async (input) => {
+            if (input.query) {
+                const v = validateText(input.query, 'query');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
+            if (input.category) {
+                const v = validateIdentifier(input.category, 'category');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
+            if (input.type) {
+                const v = validateIdentifier(input.type, 'type');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { createPluginDiscoveryService, searchPlugins } = await import('../plugins/store/index.js');
                 const discovery = createPluginDiscoveryService();
@@ -316,6 +362,11 @@ export const transferTools = [
             required: ['name'],
         },
         handler: async (input) => {
+            {
+                const v = validateIdentifier(input.name, 'name');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { createPluginDiscoveryService } = await import('../plugins/store/index.js');
                 const discovery = createPluginDiscoveryService();