claude-flow 3.5.70 → 3.5.72

package/v3/@claude-flow/cli/dist/src/mcp-tools/neural-tools.js

@@ -12,6 +12,7 @@
  * Note: For production neural features, use @claude-flow/neural module
  */
 import { getProjectCwd } from './types.js';
+import { validateIdentifier, validateText } from './validate-input.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 // Try to import real embeddings — prefer agentic-flow v3 ReasoningBank, then @claude-flow/embeddings
@@ -24,7 +25,7 @@ try {
         realEmbeddings = { embed: (text) => rb.computeEmbedding(text) };
         embeddingServiceName = 'agentic-flow/reasoningbank';
     }
-    // Tier 2: @claude-flow/embeddings
+    // Tier 2: @claude-flow/embeddings with agentic-flow provider
     if (!realEmbeddings) {
         const embeddingsModule = await import('@claude-flow/embeddings').catch(() => null);
         if (embeddingsModule?.createEmbeddingService) {
@@ -39,6 +40,34 @@ try {
                 embeddingServiceName = 'agentic-flow';
             }
             catch {
+                // agentic-flow provider not available, try ONNX
+            }
+        }
+    }
+    // Tier 3: @claude-flow/embeddings with ONNX provider
+    if (!realEmbeddings) {
+        const embeddingsModule = await import('@claude-flow/embeddings').catch(() => null);
+        if (embeddingsModule?.createEmbeddingService) {
+            try {
+                const service = embeddingsModule.createEmbeddingService({ provider: 'onnx' });
+                realEmbeddings = {
+                    embed: async (text) => {
+                        const result = await service.embed(text);
+                        return Array.from(result.embedding);
+                    },
+                };
+                embeddingServiceName = 'onnx';
+            }
+            catch {
+                // ONNX provider not available, fall through to mock
+            }
+        }
+    }
+    // Tier 4: mock fallback (last resort — embeddings are not semantic)
+    if (!realEmbeddings) {
+        const embeddingsModule = await import('@claude-flow/embeddings').catch(() => null);
+        if (embeddingsModule?.createEmbeddingService) {
+            try {
                 const service = embeddingsModule.createEmbeddingService({ provider: 'mock' });
                 realEmbeddings = {
                     embed: async (text) => {
@@ -46,7 +75,10 @@ try {
                         return Array.from(result.embedding);
                     },
                 };
-                embeddingServiceName = 'mock';
+                embeddingServiceName = 'mock-fallback';
+            }
+            catch {
+                // No embedding service available at all
             }
         }
     }
@@ -147,6 +179,11 @@ export const neuralTools = [
             required: ['modelType'],
         },
         handler: async (input) => {
+            if (input.modelId) {
+                const v = validateIdentifier(input.modelId, 'modelId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadNeuralStore();
             const modelId = input.modelId || `model-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
             const modelType = input.modelType;
@@ -201,6 +238,7 @@ export const neuralTools = [
             return {
                 success: true,
                 _realEmbedding: !!realEmbeddings,
+                embeddingProvider: embeddingServiceName,
                 modelId,
                 type: modelType,
                 status: model.status,
@@ -225,6 +263,16 @@ export const neuralTools = [
             required: ['input'],
         },
         handler: async (input) => {
+            {
+                const v = validateText(input.input, 'input');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.modelId) {
+                const v = validateIdentifier(input.modelId, 'modelId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadNeuralStore();
             const modelId = input.modelId;
             const inputText = input.input;
@@ -259,6 +307,7 @@ export const neuralTools = [
             return {
                 success: true,
                 _realEmbedding: !!realEmbeddings,
+                embeddingProvider: embeddingServiceName,
                 _hasStoredPatterns: storedPatterns.length > 0,
                 modelId: model?.id || 'default',
                 input: inputText,
@@ -285,6 +334,26 @@ export const neuralTools = [
             },
         },
         handler: async (input) => {
+            if (input.patternId) {
+                const v = validateIdentifier(input.patternId, 'patternId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.name) {
+                const v = validateText(input.name, 'name');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.type) {
+                const v = validateIdentifier(input.type, 'type');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.query) {
+                const v = validateText(input.query, 'query');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadNeuralStore();
             const action = input.action || 'list';
             if (action === 'list') {
@@ -328,6 +397,7 @@ export const neuralTools = [
                 return {
                     success: true,
                     _realEmbedding: !!realEmbeddings,
+                    embeddingProvider: embeddingServiceName,
                     patternId,
                     name: pattern.name,
                     type: pattern.type,
@@ -350,6 +420,7 @@ export const neuralTools = [
                 return {
                     _realSimilarity: true,
                     _realEmbedding: !!realEmbeddings,
+                    embeddingProvider: embeddingServiceName,
                     query,
                     results: results.map(r => ({
                         id: r.id,
@@ -385,6 +456,11 @@ export const neuralTools = [
             },
         },
         handler: async (input) => {
+            if (input.modelId) {
+                const v = validateIdentifier(input.modelId, 'modelId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadNeuralStore();
             const method = input.method || 'quantize';
             const targetReduction = input.targetSize || 0.5;
@@ -414,6 +490,7 @@ export const neuralTools = [
                     saveNeuralStore(store);
                     return {
                         success: true, _real: true, method,
+                        embeddingProvider: embeddingServiceName,
                         patternsCompressed: totalCompressed,
                         compressionRatio: '3.92x (Int8)',
                         beforeBytes: beforeSize,
@@ -437,6 +514,7 @@ export const neuralTools = [
                 saveNeuralStore(store);
                 return {
                     success: true, _real: true, method,
+                    embeddingProvider: embeddingServiceName,
                     threshold,
                     patternsRemoved: toRemove.length,
                     patternsBefore: beforeCount,
@@ -470,6 +548,7 @@ export const neuralTools = [
                 saveNeuralStore(store);
                 return {
                     success: true, _real: true, method,
+                    embeddingProvider: embeddingServiceName,
                     patternsMerged: merged.length,
                     patternsBefore: beforeCount,
                     patternsAfter: Object.keys(store.patterns).length,
@@ -490,6 +569,11 @@ export const neuralTools = [
             },
         },
         handler: async (input) => {
+            if (input.modelId) {
+                const v = validateIdentifier(input.modelId, 'modelId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadNeuralStore();
             if (input.modelId) {
                 const model = store.models[input.modelId];
@@ -540,6 +624,11 @@ export const neuralTools = [
             },
         },
         handler: async (input) => {
+            if (input.modelId) {
+                const v = validateIdentifier(input.modelId, 'modelId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadNeuralStore();
             const target = input.target || 'balanced';
             const patterns = Object.values(store.patterns);
@@ -619,6 +708,7 @@ export const neuralTools = [
             const elapsed = Math.round(performance.now() - startTime);
             return {
                 success: true, _real: true, target,
+                embeddingProvider: embeddingServiceName,
                 actions,
                 patternsBefore: beforeCount,
                 patternsAfter: Object.keys(store.patterns).length,

package/v3/@claude-flow/cli/dist/src/mcp-tools/performance-tools.js

@@ -12,6 +12,7 @@
  * Note: Some optimization suggestions are illustrative
  */
 import { getProjectCwd } from './types.js';
+import { validateIdentifier } from './validate-input.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import * as os from 'node:os';
@@ -158,6 +159,11 @@ export const performanceTools = [
             },
         },
         handler: async (_input) => {
+            if (_input.component) {
+                const v = validateIdentifier(_input.component, 'component');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const loadAvg = os.loadavg();
             const cpus = os.cpus();
             const cpuPercent = Math.min((loadAvg[0] / cpus.length) * 100, 100);
@@ -227,15 +233,15 @@ export const performanceTools = [
             const suite = input.suite || 'all';
             const iterations = input.iterations || 100;
             const warmup = input.warmup !== false;
-            // REAL benchmark functions
+            // Synthetic data benchmarks — measures actual CPU/memory throughput
             const benchmarkFunctions = {
                 memory: () => {
-                    // Real memory allocation benchmark
+                    // Synthetic data benchmark — measures actual allocation + sort throughput
                     const arr = new Array(1000).fill(0).map(() => Math.random());
                     arr.sort();
                 },
                 neural: () => {
-                    // Real computation benchmark (matrix-like operations)
+                    // Synthetic data benchmark — measures actual matrix multiplication throughput
                     const size = 64;
                     const a = Array.from({ length: size }, () => Array.from({ length: size }, () => Math.random()));
                     const b = Array.from({ length: size }, () => Array.from({ length: size }, () => Math.random()));
@@ -249,14 +255,14 @@ export const performanceTools = [
                     }
                 },
                 swarm: () => {
-                    // Real object creation and manipulation
+                    // Synthetic data benchmark — measures actual object creation + manipulation throughput
                     const agents = Array.from({ length: 10 }, (_, i) => ({ id: i, status: 'active', tasks: [] }));
                     agents.forEach(a => { for (let i = 0; i < 100; i++)
                         a.tasks.push(i); });
                     agents.sort((a, b) => a.tasks.length - b.tasks.length);
                 },
                 io: () => {
-                    // Real JSON serialization benchmark
+                    // Synthetic data benchmark — measures actual JSON serialization throughput
                     const data = { agents: Array.from({ length: 50 }, (_, i) => ({ id: i, name: `agent-${i}` })) };
                     const json = JSON.stringify(data);
                     JSON.parse(json);
@@ -307,6 +313,7 @@ export const performanceTools = [
                         avgLatency: `${avgLatencyMs.toFixed(3)}ms`,
                         memoryUsage: `${Math.abs(memoryDelta)}KB`,
                         _real: true,
+                        _dataSource: 'synthetic',
                     });
                 }
             }
@@ -324,6 +331,7 @@ export const performanceTools = [
                 : { note: 'First benchmark run - no comparison available', totalBenchmarks: allBenchmarks.length };
             return {
                 _real: true,
+                _note: 'Benchmarks use synthetic workloads to measure throughput. Results reflect actual CPU/memory performance.',
                 suite,
                 iterations,
                 warmup,
@@ -346,6 +354,11 @@ export const performanceTools = [
             },
         },
         handler: async (input) => {
+            if (input.target) {
+                const v = validateIdentifier(input.target, 'target');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const target = input.target || 'all';
             const durationSec = Math.min(input.duration || 1, 10);
             const durationMs = durationSec * 1000;

package/v3/@claude-flow/cli/dist/src/mcp-tools/ruvllm-tools.js

@@ -4,6 +4,7 @@
  * Exposes @ruvector/ruvllm-wasm operations via MCP protocol.
  * All tools gracefully degrade when the WASM package is not installed.
  */
+import { validateIdentifier, validateText } from './validate-input.js';
 async function loadRuvllmWasm() {
     return import('../ruvector/ruvllm-wasm.js');
 }
@@ -67,6 +68,16 @@ export const ruvllmWasmTools = [
             required: ['routerId', 'name', 'embedding'],
         },
         handler: async (args) => {
+            {
+                const v = validateIdentifier(args.routerId, 'routerId');
+                if (!v.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+            }
+            {
+                const v = validateIdentifier(args.name, 'name');
+                if (!v.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+            }
             try {
                 const router = hnswRouters.get(args.routerId);
                 if (!router)
@@ -97,6 +108,11 @@ export const ruvllmWasmTools = [
             required: ['routerId', 'query'],
         },
         handler: async (args) => {
+            {
+                const v = validateIdentifier(args.routerId, 'routerId');
+                if (!v.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+            }
             try {
                 const router = hnswRouters.get(args.routerId);
                 if (!router)
@@ -150,6 +166,11 @@ export const ruvllmWasmTools = [
             required: ['sonaId', 'quality'],
         },
         handler: async (args) => {
+            {
+                const v = validateIdentifier(args.sonaId, 'sonaId');
+                if (!v.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+            }
             try {
                 const sona = sonaInstances.get(args.sonaId);
                 if (!sona)
@@ -207,6 +228,11 @@ export const ruvllmWasmTools = [
             required: ['loraId', 'quality'],
         },
         handler: async (args) => {
+            {
+                const v = validateIdentifier(args.loraId, 'loraId');
+                if (!v.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+            }
             try {
                 const lora = loraInstances.get(args.loraId);
                 if (!lora)
@@ -235,6 +261,11 @@ export const ruvllmWasmTools = [
             required: ['messages', 'template'],
         },
         handler: async (args) => {
+            {
+                const v = validateText(args.template, 'template', 256);
+                if (!v.valid)
+                    return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+            }
             try {
                 const mod = await loadRuvllmWasm();
                 const messages = args.messages;

package/v3/@claude-flow/cli/dist/src/mcp-tools/security-tools.js

@@ -9,6 +9,7 @@
  *
  * Created with ❤️ by ruv.io
  */
+import { validateText, validateIdentifier } from './validate-input.js';
 import { autoInstallPackage } from './auto-install.js';
 import { createRequire } from 'module';
 // Create require for resolving module paths
@@ -93,6 +94,11 @@ const aidefenceScanTool = {
         required: ['input'],
     },
     handler: async (args) => {
+        {
+            const v = validateText(args.input, 'input');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
         const input = args.input;
         const quick = args.quick;
         try {
@@ -167,6 +173,11 @@ const aidefenceAnalyzeTool = {
         required: ['input'],
     },
     handler: async (args) => {
+        {
+            const v = validateText(args.input, 'input');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
         const input = args.input;
         const searchSimilar = args.searchSimilar !== false;
         const k = args.k || 5;
@@ -296,6 +307,21 @@ const aidefenceLearnTool = {
         required: ['input', 'wasAccurate'],
     },
     handler: async (args) => {
+        {
+            const v = validateText(args.input, 'input');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
+        if (args.verdict) {
+            const v = validateText(args.verdict, 'verdict');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
+        if (args.threatType) {
+            const v = validateIdentifier(args.threatType, 'threatType');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
         const input = args.input;
         const wasAccurate = args.wasAccurate;
         const verdict = args.verdict;
@@ -358,6 +384,11 @@ const aidefenceIsSafeTool = {
         required: ['input'],
     },
     handler: async (args) => {
+        {
+            const v = validateText(args.input, 'input');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
         const input = args.input;
         try {
             const { isSafe } = await import('@claude-flow/aidefence');
@@ -397,6 +428,11 @@ const aidefenceHasPIITool = {
         required: ['input'],
     },
     handler: async (args) => {
+        {
+            const v = validateText(args.input, 'input');
+            if (!v.valid)
+                return { content: [{ type: 'text', text: JSON.stringify({ error: v.error }) }], isError: true };
+        }
         const input = args.input;
         try {
             const defender = await getAIDefence();

package/v3/@claude-flow/cli/dist/src/mcp-tools/system-tools.js

@@ -9,10 +9,12 @@
  * - os module for system information
  */
 import { getProjectCwd } from './types.js';
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { validateIdentifier } from './validate-input.js';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, statfsSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import * as os from 'node:os';
+import * as dns from 'node:dns';
 // Read version dynamically from package.json
 function getPackageVersion() {
     try {
@@ -331,26 +333,60 @@ export const systemTools = [
                 message: 'Neural network health not monitored',
             });
             if (input.deep) {
-                // Disk check — real free space check via os module
+                // Disk check — real free space via statfsSync (Node 18.15+)
                 {
                     const t0 = performance.now();
-                    const freeMem = os.freemem();
-                    const totalMem = os.totalmem();
-                    const elapsed = performance.now() - t0;
-                    // Use memory as a proxy; real disk check would need statvfs
-                    checks.push({
-                        name: 'disk',
-                        status: 'unknown',
-                        latency: Math.round(elapsed * 100) / 100,
-                        message: 'Disk space check not implemented — use os-level tools',
-                    });
+                    try {
+                        const stats = statfsSync(projectCwd);
+                        const totalBytes = stats.blocks * stats.bsize;
+                        const freeBytes = stats.bfree * stats.bsize;
+                        const totalGB = Math.round((totalBytes / (1024 ** 3)) * 10) / 10;
+                        const freeGB = Math.round((freeBytes / (1024 ** 3)) * 10) / 10;
+                        const freePercent = Math.round((freeBytes / totalBytes) * 100);
+                        const elapsed = performance.now() - t0;
+                        checks.push({
+                            name: 'disk',
+                            status: freePercent > 10 ? 'healthy' : 'warning',
+                            latency: Math.round(elapsed * 100) / 100,
+                            message: `${freeGB}GB free of ${totalGB}GB (${freePercent}%)`,
+                        });
+                    }
+                    catch {
+                        const elapsed = performance.now() - t0;
+                        checks.push({
+                            name: 'disk',
+                            status: 'unknown',
+                            latency: Math.round(elapsed * 100) / 100,
+                            message: 'Disk space check failed — statfsSync unavailable',
+                        });
+                    }
+                }
+                // Network — DNS resolution check with timeout
+                {
+                    const t0 = performance.now();
+                    try {
+                        await Promise.race([
+                            dns.promises.lookup('registry.npmjs.org'),
+                            new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 3000)),
+                        ]);
+                        const elapsed = performance.now() - t0;
+                        checks.push({
+                            name: 'network',
+                            status: 'healthy',
+                            latency: Math.round(elapsed * 100) / 100,
+                            message: 'DNS resolution working',
+                        });
+                    }
+                    catch {
+                        const elapsed = performance.now() - t0;
+                        checks.push({
+                            name: 'network',
+                            status: 'warning',
+                            latency: Math.round(elapsed * 100) / 100,
+                            message: 'DNS resolution failed — check network',
+                        });
+                    }
                 }
-                // Network — cannot verify without making a request
-                checks.push({
-                    name: 'network',
-                    status: 'unknown',
-                    message: 'Network connectivity not monitored',
-                });
                 // Database — check if coordination store exists
                 {
                     const t0 = performance.now();
@@ -437,6 +473,11 @@ export const systemTools = [
             if (!input.confirm) {
                 return { success: false, error: 'Reset requires confirmation' };
             }
+            if (input.component) {
+                const v = validateIdentifier(input.component, 'component');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const component = input.component || 'metrics';
             // Reset metrics to defaults
             const defaultMetrics = {

package/v3/@claude-flow/cli/dist/src/mcp-tools/transfer-tools.js

@@ -5,6 +5,7 @@
  * @module @claude-flow/cli/mcp-tools/transfer-tools
  * @version 3.0.0
  */
+import { validateIdentifier, validateText } from './validate-input.js';
 /**
  * Helper to create MCP tool result
  */
@@ -42,6 +43,11 @@ export const transferTools = [
             required: ['content'],
         },
         handler: async (input) => {
+            {
+                const v = validateText(input.content, 'content');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { detectPII } = await import('../transfer/anonymization/index.js');
                 const result = detectPII(input.content);
@@ -71,6 +77,11 @@ export const transferTools = [
             required: ['name'],
         },
         handler: async (input) => {
+            {
+                const v = validateIdentifier(input.name, 'name');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { resolveIPNS } = await import('../transfer/ipfs/client.js');
                 const result = await resolveIPNS(input.name);
@@ -115,6 +126,16 @@ export const transferTools = [
             },
         },
         handler: async (input) => {
+            if (input.query) {
+                const v = validateText(input.query, 'query');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
+            if (input.category) {
+                const v = validateIdentifier(input.category, 'category');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { PatternStore } = await import('../transfer/store/index.js');
                 const store = new PatternStore();
@@ -143,6 +164,11 @@ export const transferTools = [
             required: ['id'],
         },
         handler: async (input) => {
+            {
+                const v = validateIdentifier(input.id, 'id');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { PatternStore } = await import('../transfer/store/index.js');
                 const store = new PatternStore();
@@ -178,6 +204,11 @@ export const transferTools = [
             required: ['id'],
         },
         handler: async (input) => {
+            {
+                const v = validateIdentifier(input.id, 'id');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { PatternStore } = await import('../transfer/store/index.js');
                 const store = new PatternStore();
@@ -284,6 +315,21 @@ export const transferTools = [
             },
         },
         handler: async (input) => {
+            if (input.query) {
+                const v = validateText(input.query, 'query');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
+            if (input.category) {
+                const v = validateIdentifier(input.category, 'category');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
+            if (input.type) {
+                const v = validateIdentifier(input.type, 'type');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { createPluginDiscoveryService, searchPlugins } = await import('../plugins/store/index.js');
                 const discovery = createPluginDiscoveryService();
@@ -316,6 +362,11 @@ export const transferTools = [
             required: ['name'],
         },
         handler: async (input) => {
+            {
+                const v = validateIdentifier(input.name, 'name');
+                if (!v.valid)
+                    return createResult({ error: v.error }, true);
+            }
             try {
                 const { createPluginDiscoveryService } = await import('../plugins/store/index.js');
                 const discovery = createPluginDiscoveryService();