claude-flow 3.6.24 → 3.6.25

package/v3/@claude-flow/cli/dist/src/fs-secure.js

@@ -0,0 +1,74 @@
+/**
+ * Restricted-permission file helpers.
+ *
+ * audit_1776853149979: session/memory/terminal stores were written with the
+ * process umask, which on most macOS/Linux setups leaves them world-readable
+ * (mode 0644). They contain conversation snapshots, agent prompts, and
+ * terminal command history — anyone else on the host can read them.
+ *
+ * These helpers write atomically and force mode 0600 (files) / 0700 (dirs).
+ * chmod fails silently on Windows, where POSIX modes don't apply — that's
+ * fine, the OS-level ACL surface there is different.
+ *
+ * ADR-096 Phase 2: optional opt-in encryption-at-rest. When the caller
+ * passes `encrypt: true` AND the env-gated vault is enabled, payloads are
+ * AES-256-GCM-encrypted before hitting disk. Reads use the magic-byte
+ * sniff so legacy plaintext files keep working unchanged during the
+ * incremental migration.
+ */
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { decryptBuffer, encryptBuffer, getKey, isEncryptedBlob, isEncryptionEnabled, } from './encryption/vault.js';
+/**
+ * Create a directory tree with mode 0700 (owner-only). No-op if exists.
+ * Uses recursive: true so missing parents are created with the same mode.
+ */
+export function mkdirRestricted(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+}
+/**
+ * Write a file and tighten its permissions to mode 0600 (owner read/write).
+ *
+ * Two call signatures, both supported (the legacy positional one keeps
+ * existing call sites working without churn):
+ *
+ *   writeFileRestricted(path, data)                      // plaintext, utf-8
+ *   writeFileRestricted(path, data, 'utf-8')             // legacy: encoding only
+ *   writeFileRestricted(path, data, { encrypt: true })   // opt-in encryption
+ */
+export function writeFileRestricted(path, data, optsOrEncoding = 'utf-8') {
+    const opts = typeof optsOrEncoding === 'string'
+        ? { encoding: optsOrEncoding }
+        : optsOrEncoding;
+    const encoding = opts.encoding ?? 'utf-8';
+    let payload = data;
+    if (opts.encrypt && isEncryptionEnabled()) {
+        const plaintext = Buffer.isBuffer(data) ? data : Buffer.from(data, encoding);
+        payload = encryptBuffer(plaintext, getKey());
+    }
+    // For encrypted payloads we always have a Buffer — pass through without an
+    // encoding so writeFileSync doesn't try to text-decode it.
+    if (Buffer.isBuffer(payload)) {
+        writeFileSync(path, payload);
+    }
+    else {
+        writeFileSync(path, payload, encoding);
+    }
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // Windows / FS without POSIX modes — silently skip.
+    }
+}
+export function readFileMaybeEncrypted(path, encoding = 'utf-8') {
+    const raw = readFileSync(path);
+    let plain;
+    if (isEncryptedBlob(raw)) {
+        plain = decryptBuffer(raw, getKey());
+    }
+    else {
+        plain = raw;
+    }
+    return encoding === null ? plain : plain.toString(encoding);
+}
+//# sourceMappingURL=fs-secure.js.map

package/v3/@claude-flow/cli/dist/src/mcp-tools/github-tools.js

@@ -8,7 +8,7 @@ import { getProjectCwd } from './types.js';
 import { validateIdentifier, validateText } from './validate-input.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
-import { execSync } from 'node:child_process';
+import { execFileSync, execSync } from 'node:child_process';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const GITHUB_DIR = 'github';
@@ -41,7 +41,20 @@ function saveGitHubStore(store) {
     ensureGitHubDir();
     writeFileSync(getGitHubPath(), JSON.stringify(store, null, 2), 'utf-8');
 }
-/** Run a shell command, return stdout or null on failure */
+/**
+ * Run a shell command, return stdout or null on failure.
+ *
+ * SECURITY (audit_1776853149979): only call this with a STATIC command
+ * string (no template-string interpolation of user input). For any
+ * caller that needs to pass dynamic / user-supplied values, use
+ * runArgv below — it routes through execFileSync with shell:false so
+ * backticks, $(...), ;, and friends become literal argv bytes.
+ *
+ * The shell-string form is preserved here only because the surviving
+ * callers (`gh issue list ...`, `git rev-list --count HEAD`, …) use
+ * pipes / wc -l and need a shell. Any new caller with user input
+ * MUST use runArgv.
+ */
 function run(cmd, cwd) {
     try {
         return execSync(cmd, { encoding: 'utf-8', timeout: 15000, cwd: cwd || getProjectCwd(), stdio: ['pipe', 'pipe', 'pipe'] }).trim();
@@ -50,6 +63,49 @@ function run(cmd, cwd) {
         return null;
     }
 }
+/**
+ * Run a program with an argv array (no shell). Use this for any callsite
+ * that mixes user input into the command line — argv elements aren't
+ * interpreted by /bin/sh, so shell metacharacters in user-supplied
+ * strings stay literal.
+ */
+function runArgv(file, args, cwd) {
+    try {
+        return execFileSync(file, args, {
+            encoding: 'utf-8',
+            timeout: 15000,
+            cwd: cwd || getProjectCwd(),
+            stdio: ['pipe', 'pipe', 'pipe'],
+            shell: false,
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Coerce a user-supplied PR / issue / run number to a positive integer.
+ * Returns null if the input can't be safely passed as an argv element to
+ * gh (which would otherwise accept any string).
+ */
+function toPositiveInt(value) {
+    const n = typeof value === 'number' ? value : Number(value);
+    if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0 || n > 2 ** 31)
+        return null;
+    return n;
+}
+const LABEL_RE = /^[A-Za-z0-9][A-Za-z0-9 _\-./]{0,63}$/;
+function sanitizeLabels(value) {
+    if (!Array.isArray(value))
+        return null;
+    const out = [];
+    for (const v of value) {
+        if (typeof v !== 'string' || !LABEL_RE.test(v))
+            return null;
+        out.push(v);
+    }
+    return out;
+}
 /** Check if gh CLI is available */
 function hasGhCli() {
     return run('gh --version') !== null;
@@ -219,7 +275,17 @@ export const githubTools = [
                     const headBranch = input.branch || run('git rev-parse --abbrev-ref HEAD') || 'feature';
                     const baseBranch = input.baseBranch || 'main';
                     const body = input.body || '';
-                    const result = run(`gh pr create --title "${title.replace(/"/g, '\\"')}" --base "${baseBranch}" --head "${headBranch}" --body "${body.replace(/"/g, '\\"')}"`);
+                    // audit_1776853149979: title/body only had length validation, and
+                    // the inline .replace(/"/g, '\\"') was a porous escape (no handling
+                    // of `, $(...), \). Routes via argv array now — no shell to
+                    // interpret metas.
+                    const result = runArgv('gh', [
+                        'pr', 'create',
+                        '--title', title,
+                        '--base', baseBranch,
+                        '--head', headBranch,
+                        '--body', body,
+                    ]);
                     if (result) {
                         return { success: true, _real: true, action: 'created', url: result };
                     }
@@ -232,9 +298,15 @@ export const githubTools = [
                 return { success: true, source: 'local-store', action: 'created', pullRequest: pr };
             }
             if (action === 'review') {
-                const prNumber = input.prNumber;
+                // audit_1776853149979: prNumber was typed `number` in schema but only
+                // cast at runtime, so a string "1; touch /tmp/x" would interpolate
+                // into the shell. Coerce + validate as positive integer.
+                const prNumber = toPositiveInt(input.prNumber);
                 if (gh && prNumber) {
-                    const raw = run(`gh pr view ${prNumber} --json number,title,state,body,additions,deletions,changedFiles,reviews,mergeable,statusCheckRollup`);
+                    const raw = runArgv('gh', [
+                        'pr', 'view', String(prNumber),
+                        '--json', 'number,title,state,body,additions,deletions,changedFiles,reviews,mergeable,statusCheckRollup',
+                    ]);
                     if (raw) {
                         try {
                             return { success: true, _real: true, action: 'review', pullRequest: JSON.parse(raw) };
@@ -242,18 +314,18 @@ export const githubTools = [
                         catch { /* fall through */ }
                     }
                 }
-                return { success: false, error: prNumber ? 'gh CLI not available or PR not found. Install gh: https://cli.github.com' : 'prNumber is required for review.' };
+                return { success: false, error: prNumber ? 'gh CLI not available or PR not found. Install gh: https://cli.github.com' : 'prNumber is required (positive integer) for review.' };
             }
             if (action === 'merge') {
-                const prNumber = input.prNumber;
+                const prNumber = toPositiveInt(input.prNumber);
                 if (gh && prNumber) {
-                    const result = run(`gh pr merge ${prNumber} --merge`);
+                    const result = runArgv('gh', ['pr', 'merge', String(prNumber), '--merge']);
                     if (result !== null) {
                         return { success: true, _real: true, action: 'merged', prNumber, mergedAt: new Date().toISOString() };
                     }
                 }
                 // Fallback: local store
-                const prKey = Object.keys(store.prs).find(k => k.includes(String(prNumber)));
+                const prKey = prNumber ? Object.keys(store.prs).find(k => k.includes(String(prNumber))) : undefined;
                 if (prKey && store.prs[prKey]) {
                     store.prs[prKey].status = 'merged';
                     saveGitHubStore(store);
@@ -261,14 +333,14 @@ export const githubTools = [
                 return { success: true, source: 'local-store', action: 'merged', prNumber, mergedAt: new Date().toISOString() };
             }
             if (action === 'close') {
-                const prNumber = input.prNumber;
+                const prNumber = toPositiveInt(input.prNumber);
                 if (gh && prNumber) {
-                    const result = run(`gh pr close ${prNumber}`);
+                    const result = runArgv('gh', ['pr', 'close', String(prNumber)]);
                     if (result !== null) {
                         return { success: true, _real: true, action: 'closed', prNumber, closedAt: new Date().toISOString() };
                     }
                 }
-                const prKey = Object.keys(store.prs).find(k => k.includes(String(prNumber)));
+                const prKey = prNumber ? Object.keys(store.prs).find(k => k.includes(String(prNumber))) : undefined;
                 if (prKey && store.prs[prKey]) {
                     store.prs[prKey].status = 'closed';
                     saveGitHubStore(store);
@@ -336,10 +408,16 @@ export const githubTools = [
             if (action === 'create') {
                 const title = input.title || 'New Issue';
                 const body = input.body || '';
-                const labels = input.labels || [];
+                // audit_1776853149979: labels was joined into a shell string with no
+                // validation of the label content. sanitizeLabels rejects anything
+                // outside [A-Za-z0-9 _\-./] and caps each label at 64 chars.
+                const labels = sanitizeLabels(input.labels) ?? [];
                 if (gh) {
-                    const labelArg = labels.length > 0 ? ` --label "${labels.join(',')}"` : '';
-                    const result = run(`gh issue create --title "${title.replace(/"/g, '\\"')}" --body "${body.replace(/"/g, '\\"')}"${labelArg}`);
+                    const argv = ['issue', 'create', '--title', title, '--body', body];
+                    if (labels.length > 0) {
+                        argv.push('--label', labels.join(','));
+                    }
+                    const result = runArgv('gh', argv);
                     if (result) {
                         return { success: true, _real: true, action: 'created', url: result };
                     }
@@ -351,37 +429,45 @@ export const githubTools = [
                 return { success: true, source: 'local-store', action: 'created', issue };
             }
             if (action === 'update') {
-                const issueNumber = input.issueNumber;
+                const issueNumber = toPositiveInt(input.issueNumber);
                 if (gh && issueNumber) {
-                    const parts = [];
+                    const argv = ['issue', 'edit', String(issueNumber)];
                     if (input.title)
-                        parts.push(`--title "${input.title.replace(/"/g, '\\"')}"`);
-                    if (input.labels)
-                        parts.push(`--add-label "${input.labels.join(',')}"`);
-                    if (parts.length > 0) {
-                        const result = run(`gh issue edit ${issueNumber} ${parts.join(' ')}`);
+                        argv.push('--title', input.title);
+                    if (input.labels) {
+                        const labels = sanitizeLabels(input.labels);
+                        if (labels === null)
+                            return { success: false, error: 'labels contains disallowed characters' };
+                        if (labels.length > 0)
+                            argv.push('--add-label', labels.join(','));
+                    }
+                    if (argv.length > 3) {
+                        const result = runArgv('gh', argv);
                         if (result !== null)
                             return { success: true, _real: true, action: 'updated', issueNumber };
                     }
                 }
-                const issueKey = Object.keys(store.issues).find(k => k.includes(String(issueNumber)));
+                const issueKey = issueNumber ? Object.keys(store.issues).find(k => k.includes(String(issueNumber))) : undefined;
                 if (issueKey && store.issues[issueKey]) {
                     if (input.title)
                         store.issues[issueKey].title = input.title;
-                    if (input.labels)
-                        store.issues[issueKey].labels = input.labels;
+                    if (input.labels) {
+                        const labels = sanitizeLabels(input.labels);
+                        if (labels !== null)
+                            store.issues[issueKey].labels = labels;
+                    }
                     saveGitHubStore(store);
                 }
                 return { success: true, source: 'local-store', action: 'updated', issueNumber };
             }
             if (action === 'close') {
-                const issueNumber = input.issueNumber;
+                const issueNumber = toPositiveInt(input.issueNumber);
                 if (gh && issueNumber) {
-                    const result = run(`gh issue close ${issueNumber}`);
+                    const result = runArgv('gh', ['issue', 'close', String(issueNumber)]);
                     if (result !== null)
                         return { success: true, _real: true, action: 'closed', issueNumber, closedAt: new Date().toISOString() };
                 }
-                const issueKey = Object.keys(store.issues).find(k => k.includes(String(issueNumber)));
+                const issueKey = issueNumber ? Object.keys(store.issues).find(k => k.includes(String(issueNumber))) : undefined;
                 if (issueKey && store.issues[issueKey]) {
                     store.issues[issueKey].status = 'closed';
                     saveGitHubStore(store);
@@ -450,7 +536,12 @@ export const githubTools = [
             if (action === 'status') {
                 const workflowId = input.workflowId;
                 if (workflowId) {
-                    const raw = run(`gh run view ${workflowId} --json databaseId,displayTitle,status,conclusion,jobs`);
+                    // workflowId is already validated by validateIdentifier above, but
+                    // route through argv anyway for consistency / defense-in-depth.
+                    const raw = runArgv('gh', [
+                        'run', 'view', workflowId,
+                        '--json', 'databaseId,displayTitle,status,conclusion,jobs',
+                    ]);
                     if (raw) {
                         try {
                             return { success: true, _real: true, run: JSON.parse(raw) };
@@ -471,7 +562,7 @@ export const githubTools = [
                 const workflowId = input.workflowId;
                 const ref = input.ref || 'main';
                 if (workflowId) {
-                    const result = run(`gh workflow run "${workflowId}" --ref "${ref}"`);
+                    const result = runArgv('gh', ['workflow', 'run', workflowId, '--ref', ref]);
                     if (result !== null)
                         return { success: true, _real: true, action: 'triggered', workflowId, ref };
                 }
@@ -480,7 +571,7 @@ export const githubTools = [
             if (action === 'cancel') {
                 const workflowId = input.workflowId;
                 if (workflowId) {
-                    const result = run(`gh run cancel ${workflowId}`);
+                    const result = runArgv('gh', ['run', 'cancel', workflowId]);
                     if (result !== null)
                         return { success: true, _real: true, action: 'cancelled', runId: workflowId };
                 }

package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js

@@ -1388,8 +1388,8 @@ export const hooksPretrain = {
         const repoPath = resolve(params.path || '.');
         const depth = params.depth || 'medium';
         const startTime = performance.now();
-        // Real file scanning — count files by extension, extract patterns
-        const { readdirSync, statSync } = await import('node:fs');
+        // Real file scanning — count files by extension, extract patterns.
+        // (readdirSync/statSync already imported statically at the top.)
         const extCounts = {};
         let filesAnalyzed = 0;
         let totalLines = 0;

package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.js

@@ -9,7 +9,8 @@
  *
  * @module v3/cli/mcp-tools/memory-tools
  */
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
 import { join, resolve } from 'path';
 import { validateIdentifier } from './validate-input.js';
 // #1604: Align with memory-initializer.ts — single source of truth is .swarm/memory.db
@@ -598,7 +599,6 @@ export const memoryTools = [
         handler: async (input) => {
             await ensureInitialized();
             const { storeEntry } = await getMemoryFunctions();
-            const { homedir } = await import('os');
             const ns = input.namespace || 'claude-memories';
             if (input.namespace) {
                 const vNs = validateIdentifier(ns, 'namespace');
@@ -613,15 +613,13 @@ export const memoryTools = [
                 // Scan all projects
                 if (existsSync(claudeProjectsDir)) {
                     try {
-                        const projects = readFileSync; // just need fs methods already imported
-                        const { readdirSync: readDir } = await import('fs');
-                        for (const project of readDir(claudeProjectsDir, { withFileTypes: true })) {
+                        for (const project of readdirSync(claudeProjectsDir, { withFileTypes: true })) {
                             if (!project.isDirectory())
                                 continue;
                             const memDir = join(claudeProjectsDir, project.name, 'memory');
                             if (!existsSync(memDir))
                                 continue;
-                            for (const file of readDir(memDir).filter((f) => f.endsWith('.md'))) {
+                            for (const file of readdirSync(memDir).filter((f) => f.endsWith('.md'))) {
                                 memoryFiles.push({ path: join(memDir, file), project: project.name, file });
                             }
                         }
@@ -636,8 +634,7 @@ export const memoryTools = [
                 const memDir = join(claudeProjectsDir, projectHash, 'memory');
                 if (existsSync(memDir)) {
                     try {
-                        const { readdirSync: readDir } = await import('fs');
-                        for (const file of readDir(memDir).filter((f) => f.endsWith('.md'))) {
+                        for (const file of readdirSync(memDir).filter((f) => f.endsWith('.md'))) {
                             memoryFiles.push({ path: join(memDir, file), project: projectHash, file });
                         }
                     }
@@ -704,21 +701,19 @@ export const memoryTools = [
         inputSchema: { type: 'object', properties: {} },
         handler: async () => {
             await ensureInitialized();
-            const { homedir } = await import('os');
             // Count Claude memory files
             const claudeProjectsDir = join(homedir(), '.claude', 'projects');
             let claudeFiles = 0;
             let claudeProjects = 0;
             if (existsSync(claudeProjectsDir)) {
                 try {
-                    const { readdirSync: readDir } = await import('fs');
-                    for (const project of readDir(claudeProjectsDir, { withFileTypes: true })) {
+                    for (const project of readdirSync(claudeProjectsDir, { withFileTypes: true })) {
                         if (!project.isDirectory())
                             continue;
                         const memDir = join(claudeProjectsDir, project.name, 'memory');
                         if (!existsSync(memDir))
                             continue;
-                        const files = readDir(memDir).filter((f) => f.endsWith('.md'));
+                        const files = readdirSync(memDir).filter((f) => f.endsWith('.md'));
                         if (files.length > 0) {
                             claudeProjects++;
                             claudeFiles += files.length;

package/v3/@claude-flow/cli/dist/src/mcp-tools/session-tools.js

@@ -3,9 +3,10 @@
  *
  * Tool definitions for session management with file persistence.
  */
-import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, unlinkSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
 import { validateIdentifier, validateText } from './validate-input.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
@@ -21,14 +22,17 @@ function getSessionPath(sessionId) {
 function ensureSessionDir() {
     const dir = getSessionDir();
     if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true });
+        mkdirRestricted(dir);
     }
 }
 function loadSession(sessionId) {
     try {
         const path = getSessionPath(sessionId);
         if (existsSync(path)) {
-            const data = readFileSync(path, 'utf-8');
+            // ADR-096 Phase 2: readFileMaybeEncrypted transparently handles both
+            // legacy plaintext sessions and post-migration encrypted ones via the
+            // RFE1 magic-byte sniff.
+            const data = readFileMaybeEncrypted(path, 'utf-8');
             return JSON.parse(data);
         }
     }
@@ -39,7 +43,12 @@ function loadSession(sessionId) {
 }
 function saveSession(session) {
     ensureSessionDir();
-    writeFileSync(getSessionPath(session.sessionId), JSON.stringify(session, null, 2), 'utf-8');
+    // audit_1776853149979: session JSON contains memory snapshots and agent
+    // prompts — restrict to owner read/write.
+    // ADR-096 Phase 2: opt-in encrypt-at-rest. The encrypt flag is honored
+    // only when CLAUDE_FLOW_ENCRYPT_AT_REST is set; otherwise the legacy
+    // plaintext path runs unchanged.
+    writeFileRestricted(getSessionPath(session.sessionId), JSON.stringify(session, null, 2), { encrypt: true });
 }
 function listSessions() {
     ensureSessionDir();
@@ -48,7 +57,9 @@ function listSessions() {
     const sessions = [];
     for (const file of files) {
         try {
-            const data = readFileSync(join(dir, file), 'utf-8');
+            // ADR-096 Phase 2: same magic-byte sniff for the listing path so a
+            // mixed plaintext+encrypted dir still enumerates cleanly.
+            const data = readFileMaybeEncrypted(join(dir, file), 'utf-8');
             sessions.push(JSON.parse(data));
         }
         catch {
@@ -192,12 +203,13 @@ export const sessionTools = [
                 }
             }
             if (session) {
-                // Restore data to respective stores (legacy JSON for backward compat)
+                // Restore data to respective stores (legacy JSON for backward compat).
+                // audit_1776853149979: tighten perms on the restored stores too.
                 if (session.data?.memory) {
                     const memoryDir = join(getProjectCwd(), STORAGE_DIR, 'memory');
                     if (!existsSync(memoryDir))
-                        mkdirSync(memoryDir, { recursive: true });
-                    writeFileSync(join(memoryDir, 'store.json'), JSON.stringify(session.data.memory, null, 2), 'utf-8');
+                        mkdirRestricted(memoryDir);
+                    writeFileRestricted(join(memoryDir, 'store.json'), JSON.stringify(session.data.memory, null, 2));
                     // Also populate active sql.js SQLite database so memory-tools can find entries
                     try {
                         const { storeEntry } = await import('../memory/memory-initializer.js');
@@ -224,14 +236,14 @@ export const sessionTools = [
                 if (session.data?.tasks) {
                     const taskDir = join(getProjectCwd(), STORAGE_DIR, 'tasks');
                     if (!existsSync(taskDir))
-                        mkdirSync(taskDir, { recursive: true });
-                    writeFileSync(join(taskDir, 'store.json'), JSON.stringify(session.data.tasks, null, 2), 'utf-8');
+                        mkdirRestricted(taskDir);
+                    writeFileRestricted(join(taskDir, 'store.json'), JSON.stringify(session.data.tasks, null, 2));
                 }
                 if (session.data?.agents) {
                     const agentDir = join(getProjectCwd(), STORAGE_DIR, 'agents');
                     if (!existsSync(agentDir))
-                        mkdirSync(agentDir, { recursive: true });
-                    writeFileSync(join(agentDir, 'store.json'), JSON.stringify(session.data.agents, null, 2), 'utf-8');
+                        mkdirRestricted(agentDir);
+                    writeFileRestricted(join(agentDir, 'store.json'), JSON.stringify(session.data.agents, null, 2));
                 }
                 return {
                     sessionId: session.sessionId,

package/v3/@claude-flow/cli/dist/src/mcp-tools/terminal-tools.js

@@ -4,8 +4,9 @@
  * Terminal session management with real command execution.
  */
 import { getProjectCwd } from './types.js';
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-import { validateIdentifier, validatePath, validateText } from './validate-input.js';
+import { existsSync } from 'node:fs';
+import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
+import { validateEnv, validateIdentifier, validatePath, validateText } from './validate-input.js';
 import { join } from 'node:path';
 import { execSync } from 'node:child_process';
 // Storage paths
@@ -21,14 +22,17 @@ function getTerminalPath() {
 function ensureTerminalDir() {
     const dir = getTerminalDir();
     if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true });
+        mkdirRestricted(dir);
     }
 }
 function loadTerminalStore() {
     try {
         const path = getTerminalPath();
         if (existsSync(path)) {
-            return JSON.parse(readFileSync(path, 'utf-8'));
+            // ADR-096 Phase 3: readFileMaybeEncrypted handles both legacy
+            // plaintext stores and post-migration encrypted ones via the RFE1
+            // magic-byte sniff.
+            return JSON.parse(readFileMaybeEncrypted(path, 'utf-8'));
         }
     }
     catch {
@@ -38,7 +42,12 @@ function loadTerminalStore() {
 }
 function saveTerminalStore(store) {
     ensureTerminalDir();
-    writeFileSync(getTerminalPath(), JSON.stringify(store, null, 2), 'utf-8');
+    // audit_1776853149979: terminal command history can contain credentials
+    // pasted into commands; restrict to owner read/write (mode 0600).
+    // ADR-096 Phase 3: opt-in AES-256-GCM encrypt-at-rest. Honored only
+    // when CLAUDE_FLOW_ENCRYPT_AT_REST is set; otherwise legacy plaintext
+    // path runs unchanged.
+    writeFileRestricted(getTerminalPath(), JSON.stringify(store, null, 2), { encrypt: true });
 }
 export const terminalTools = [
     {
@@ -54,7 +63,7 @@ export const terminalTools = [
             },
         },
         handler: async (input) => {
-            // Validate user-provided input (#1425)
+            // Validate user-provided input (#1425, audit_1776853149979)
             if (input.name) {
                 const v = validateText(input.name, 'name', 256);
                 if (!v.valid)
@@ -65,6 +74,12 @@ export const terminalTools = [
                 if (!v.valid)
                     return { success: false, error: v.error };
             }
+            // env is merged into execSync's process env on every command; reject
+            // loader/runtime hijack vars (LD_PRELOAD, NODE_OPTIONS, …) and enforce
+            // POSIX-shaped names + null-byte-free values.
+            const vEnv = validateEnv(input.env, 'env');
+            if (!vEnv.valid)
+                return { success: false, error: vEnv.error };
             const store = loadTerminalStore();
             const id = `term-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
             const session = {
@@ -75,7 +90,7 @@ export const terminalTools = [
                 lastActivity: new Date().toISOString(),
                 workingDir: input.workingDir || getProjectCwd(),
                 history: [],
-                env: input.env || {},
+                env: vEnv.sanitized,
             };
             store.sessions[id] = session;
             saveTerminalStore(store);

package/v3/@claude-flow/cli/dist/src/mcp-tools/validate-input.d.ts

@@ -34,6 +34,18 @@ export declare function validatePath(value: unknown, label: string): ValidationR
  * Allows most characters but rejects shell metacharacters that could cause injection.
  */
 export declare function validateText(value: unknown, label: string, maxLen?: number): ValidationResult;
+export interface EnvValidationResult {
+    valid: boolean;
+    sanitized: Record<string, string>;
+    error?: string;
+}
+/**
+ * Validate a Record<string,string> of environment variables: enforce POSIX
+ * names, reject hijack-prone names (LD_PRELOAD, NODE_OPTIONS, …), forbid null
+ * bytes in values, and cap value length so a malicious caller can't bloat the
+ * stored session past reasonable bounds.
+ */
+export declare function validateEnv(value: unknown, label?: string): EnvValidationResult;
 /**
  * Assert validation or throw with a structured error.
  */