claude-flow 3.6.24 → 3.6.26

package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.js

@@ -9,7 +9,8 @@
  *
  * @module v3/cli/mcp-tools/memory-tools
  */
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
 import { join, resolve } from 'path';
 import { validateIdentifier } from './validate-input.js';
 // #1604: Align with memory-initializer.ts — single source of truth is .swarm/memory.db
@@ -598,7 +599,6 @@ export const memoryTools = [
         handler: async (input) => {
             await ensureInitialized();
             const { storeEntry } = await getMemoryFunctions();
-            const { homedir } = await import('os');
             const ns = input.namespace || 'claude-memories';
             if (input.namespace) {
                 const vNs = validateIdentifier(ns, 'namespace');
@@ -613,15 +613,13 @@ export const memoryTools = [
                 // Scan all projects
                 if (existsSync(claudeProjectsDir)) {
                     try {
-                        const projects = readFileSync; // just need fs methods already imported
-                        const { readdirSync: readDir } = await import('fs');
-                        for (const project of readDir(claudeProjectsDir, { withFileTypes: true })) {
+                        for (const project of readdirSync(claudeProjectsDir, { withFileTypes: true })) {
                             if (!project.isDirectory())
                                 continue;
                             const memDir = join(claudeProjectsDir, project.name, 'memory');
                             if (!existsSync(memDir))
                                 continue;
-                            for (const file of readDir(memDir).filter((f) => f.endsWith('.md'))) {
+                            for (const file of readdirSync(memDir).filter((f) => f.endsWith('.md'))) {
                                 memoryFiles.push({ path: join(memDir, file), project: project.name, file });
                             }
                         }
@@ -636,8 +634,7 @@ export const memoryTools = [
                 const memDir = join(claudeProjectsDir, projectHash, 'memory');
                 if (existsSync(memDir)) {
                     try {
-                        const { readdirSync: readDir } = await import('fs');
-                        for (const file of readDir(memDir).filter((f) => f.endsWith('.md'))) {
+                        for (const file of readdirSync(memDir).filter((f) => f.endsWith('.md'))) {
                             memoryFiles.push({ path: join(memDir, file), project: projectHash, file });
                         }
                     }
@@ -704,21 +701,19 @@ export const memoryTools = [
         inputSchema: { type: 'object', properties: {} },
         handler: async () => {
             await ensureInitialized();
-            const { homedir } = await import('os');
             // Count Claude memory files
             const claudeProjectsDir = join(homedir(), '.claude', 'projects');
             let claudeFiles = 0;
             let claudeProjects = 0;
             if (existsSync(claudeProjectsDir)) {
                 try {
-                    const { readdirSync: readDir } = await import('fs');
-                    for (const project of readDir(claudeProjectsDir, { withFileTypes: true })) {
+                    for (const project of readdirSync(claudeProjectsDir, { withFileTypes: true })) {
                         if (!project.isDirectory())
                             continue;
                         const memDir = join(claudeProjectsDir, project.name, 'memory');
                         if (!existsSync(memDir))
                             continue;
-                        const files = readDir(memDir).filter((f) => f.endsWith('.md'));
+                        const files = readdirSync(memDir).filter((f) => f.endsWith('.md'));
                         if (files.length > 0) {
                             claudeProjects++;
                             claudeFiles += files.length;

package/v3/@claude-flow/cli/dist/src/mcp-tools/session-tools.js

@@ -3,9 +3,10 @@
  *
  * Tool definitions for session management with file persistence.
  */
-import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, unlinkSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
 import { validateIdentifier, validateText } from './validate-input.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
@@ -21,14 +22,17 @@ function getSessionPath(sessionId) {
 function ensureSessionDir() {
     const dir = getSessionDir();
     if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true });
+        mkdirRestricted(dir);
     }
 }
 function loadSession(sessionId) {
     try {
         const path = getSessionPath(sessionId);
         if (existsSync(path)) {
-            const data = readFileSync(path, 'utf-8');
+            // ADR-096 Phase 2: readFileMaybeEncrypted transparently handles both
+            // legacy plaintext sessions and post-migration encrypted ones via the
+            // RFE1 magic-byte sniff.
+            const data = readFileMaybeEncrypted(path, 'utf-8');
             return JSON.parse(data);
         }
     }
@@ -39,7 +43,12 @@ function loadSession(sessionId) {
 }
 function saveSession(session) {
     ensureSessionDir();
-    writeFileSync(getSessionPath(session.sessionId), JSON.stringify(session, null, 2), 'utf-8');
+    // audit_1776853149979: session JSON contains memory snapshots and agent
+    // prompts — restrict to owner read/write.
+    // ADR-096 Phase 2: opt-in encrypt-at-rest. The encrypt flag is honored
+    // only when CLAUDE_FLOW_ENCRYPT_AT_REST is set; otherwise the legacy
+    // plaintext path runs unchanged.
+    writeFileRestricted(getSessionPath(session.sessionId), JSON.stringify(session, null, 2), { encrypt: true });
 }
 function listSessions() {
     ensureSessionDir();
@@ -48,7 +57,9 @@ function listSessions() {
     const sessions = [];
     for (const file of files) {
         try {
-            const data = readFileSync(join(dir, file), 'utf-8');
+            // ADR-096 Phase 2: same magic-byte sniff for the listing path so a
+            // mixed plaintext+encrypted dir still enumerates cleanly.
+            const data = readFileMaybeEncrypted(join(dir, file), 'utf-8');
             sessions.push(JSON.parse(data));
         }
         catch {
@@ -192,12 +203,13 @@ export const sessionTools = [
                 }
             }
             if (session) {
-                // Restore data to respective stores (legacy JSON for backward compat)
+                // Restore data to respective stores (legacy JSON for backward compat).
+                // audit_1776853149979: tighten perms on the restored stores too.
                 if (session.data?.memory) {
                     const memoryDir = join(getProjectCwd(), STORAGE_DIR, 'memory');
                     if (!existsSync(memoryDir))
-                        mkdirSync(memoryDir, { recursive: true });
-                    writeFileSync(join(memoryDir, 'store.json'), JSON.stringify(session.data.memory, null, 2), 'utf-8');
+                        mkdirRestricted(memoryDir);
+                    writeFileRestricted(join(memoryDir, 'store.json'), JSON.stringify(session.data.memory, null, 2));
                     // Also populate active sql.js SQLite database so memory-tools can find entries
                     try {
                         const { storeEntry } = await import('../memory/memory-initializer.js');
@@ -224,14 +236,14 @@ export const sessionTools = [
                 if (session.data?.tasks) {
                     const taskDir = join(getProjectCwd(), STORAGE_DIR, 'tasks');
                     if (!existsSync(taskDir))
-                        mkdirSync(taskDir, { recursive: true });
-                    writeFileSync(join(taskDir, 'store.json'), JSON.stringify(session.data.tasks, null, 2), 'utf-8');
+                        mkdirRestricted(taskDir);
+                    writeFileRestricted(join(taskDir, 'store.json'), JSON.stringify(session.data.tasks, null, 2));
                 }
                 if (session.data?.agents) {
                     const agentDir = join(getProjectCwd(), STORAGE_DIR, 'agents');
                     if (!existsSync(agentDir))
-                        mkdirSync(agentDir, { recursive: true });
-                    writeFileSync(join(agentDir, 'store.json'), JSON.stringify(session.data.agents, null, 2), 'utf-8');
+                        mkdirRestricted(agentDir);
+                    writeFileRestricted(join(agentDir, 'store.json'), JSON.stringify(session.data.agents, null, 2));
                 }
                 return {
                     sessionId: session.sessionId,

package/v3/@claude-flow/cli/dist/src/mcp-tools/terminal-tools.js

@@ -4,8 +4,9 @@
  * Terminal session management with real command execution.
  */
 import { getProjectCwd } from './types.js';
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-import { validateIdentifier, validatePath, validateText } from './validate-input.js';
+import { existsSync } from 'node:fs';
+import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
+import { validateEnv, validateIdentifier, validatePath, validateText } from './validate-input.js';
 import { join } from 'node:path';
 import { execSync } from 'node:child_process';
 // Storage paths
@@ -21,14 +22,17 @@ function getTerminalPath() {
 function ensureTerminalDir() {
     const dir = getTerminalDir();
     if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true });
+        mkdirRestricted(dir);
     }
 }
 function loadTerminalStore() {
     try {
         const path = getTerminalPath();
         if (existsSync(path)) {
-            return JSON.parse(readFileSync(path, 'utf-8'));
+            // ADR-096 Phase 3: readFileMaybeEncrypted handles both legacy
+            // plaintext stores and post-migration encrypted ones via the RFE1
+            // magic-byte sniff.
+            return JSON.parse(readFileMaybeEncrypted(path, 'utf-8'));
         }
     }
     catch {
@@ -38,7 +42,12 @@ function loadTerminalStore() {
 }
 function saveTerminalStore(store) {
     ensureTerminalDir();
-    writeFileSync(getTerminalPath(), JSON.stringify(store, null, 2), 'utf-8');
+    // audit_1776853149979: terminal command history can contain credentials
+    // pasted into commands; restrict to owner read/write (mode 0600).
+    // ADR-096 Phase 3: opt-in AES-256-GCM encrypt-at-rest. Honored only
+    // when CLAUDE_FLOW_ENCRYPT_AT_REST is set; otherwise legacy plaintext
+    // path runs unchanged.
+    writeFileRestricted(getTerminalPath(), JSON.stringify(store, null, 2), { encrypt: true });
 }
 export const terminalTools = [
     {
@@ -54,7 +63,7 @@ export const terminalTools = [
             },
         },
         handler: async (input) => {
-            // Validate user-provided input (#1425)
+            // Validate user-provided input (#1425, audit_1776853149979)
             if (input.name) {
                 const v = validateText(input.name, 'name', 256);
                 if (!v.valid)
@@ -65,6 +74,12 @@ export const terminalTools = [
                 if (!v.valid)
                     return { success: false, error: v.error };
             }
+            // env is merged into execSync's process env on every command; reject
+            // loader/runtime hijack vars (LD_PRELOAD, NODE_OPTIONS, …) and enforce
+            // POSIX-shaped names + null-byte-free values.
+            const vEnv = validateEnv(input.env, 'env');
+            if (!vEnv.valid)
+                return { success: false, error: vEnv.error };
             const store = loadTerminalStore();
             const id = `term-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
             const session = {
@@ -75,7 +90,7 @@ export const terminalTools = [
                 lastActivity: new Date().toISOString(),
                 workingDir: input.workingDir || getProjectCwd(),
                 history: [],
-                env: input.env || {},
+                env: vEnv.sanitized,
             };
             store.sessions[id] = session;
             saveTerminalStore(store);

package/v3/@claude-flow/cli/dist/src/mcp-tools/validate-input.d.ts

@@ -34,6 +34,18 @@ export declare function validatePath(value: unknown, label: string): ValidationR
  * Allows most characters but rejects shell metacharacters that could cause injection.
  */
 export declare function validateText(value: unknown, label: string, maxLen?: number): ValidationResult;
+export interface EnvValidationResult {
+    valid: boolean;
+    sanitized: Record<string, string>;
+    error?: string;
+}
+/**
+ * Validate a Record<string,string> of environment variables: enforce POSIX
+ * names, reject hijack-prone names (LD_PRELOAD, NODE_OPTIONS, …), forbid null
+ * bytes in values, and cap value length so a malicious caller can't bloat the
+ * stored session past reasonable bounds.
+ */
+export declare function validateEnv(value: unknown, label?: string): EnvValidationResult;
 /**
  * Assert validation or throw with a structured error.
  */

package/v3/@claude-flow/cli/dist/src/mcp-tools/validate-input.js

@@ -104,6 +104,62 @@ export function validateText(value, label, maxLen = 10_000) {
     const sanitized = value.replace(/\0/g, '');
     return { valid: true, sanitized };
 }
+/**
+ * Names that let an attacker pivot a child process before any user code runs:
+ * shared-library injection on Linux/macOS, Node hooks, and command resolution.
+ *
+ * audit_1776853149979: terminal_create previously merged caller-supplied env
+ * straight into execSync's environment for every subsequent command in the
+ * session. Setting LD_PRELOAD or NODE_OPTIONS via that path is functionally
+ * equivalent to remote code execution, so the env input needs an allowlist
+ * shape and a denylist on these specific names.
+ */
+const DENYLISTED_ENV_NAMES = new Set([
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'LD_AUDIT',
+    'DYLD_INSERT_LIBRARIES',
+    'DYLD_LIBRARY_PATH',
+    'DYLD_FALLBACK_LIBRARY_PATH',
+    'DYLD_FORCE_FLAT_NAMESPACE',
+    'NODE_OPTIONS',
+    'NODE_PATH',
+]);
+const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+/**
+ * Validate a Record<string,string> of environment variables: enforce POSIX
+ * names, reject hijack-prone names (LD_PRELOAD, NODE_OPTIONS, …), forbid null
+ * bytes in values, and cap value length so a malicious caller can't bloat the
+ * stored session past reasonable bounds.
+ */
+export function validateEnv(value, label = 'env') {
+    if (value === undefined || value === null) {
+        return { valid: true, sanitized: {} };
+    }
+    if (typeof value !== 'object' || Array.isArray(value)) {
+        return { valid: false, sanitized: {}, error: `${label} must be an object of string→string` };
+    }
+    const out = {};
+    for (const [name, rawVal] of Object.entries(value)) {
+        if (!ENV_NAME_RE.test(name)) {
+            return { valid: false, sanitized: {}, error: `${label} key "${name}" is not a valid POSIX env name` };
+        }
+        if (DENYLISTED_ENV_NAMES.has(name)) {
+            return { valid: false, sanitized: {}, error: `${label} key "${name}" is denylisted (loader/runtime hijack)` };
+        }
+        if (typeof rawVal !== 'string') {
+            return { valid: false, sanitized: {}, error: `${label}["${name}"] must be a string` };
+        }
+        if (rawVal.length > 32_768) {
+            return { valid: false, sanitized: {}, error: `${label}["${name}"] exceeds 32768 characters` };
+        }
+        if (rawVal.includes('\0')) {
+            return { valid: false, sanitized: {}, error: `${label}["${name}"] contains a null byte` };
+        }
+        out[name] = rawVal;
+    }
+    return { valid: true, sanitized: out };
+}
 /**
  * Assert validation or throw with a structured error.
  */

package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.js

@@ -10,6 +10,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
+import { readFileMaybeEncrypted, writeFileRestricted } from '../fs-secure.js';
 // ADR-053: Lazy import of AgentDB v3 bridge
 let _bridge;
 async function getBridge() {
@@ -403,7 +404,7 @@ export async function getHNSWIndex(options) {
             try {
                 const initSqlJs = (await import('sql.js')).default;
                 const SQL = await initSqlJs();
-                const fileBuffer = fs.readFileSync(dbPath);
+                const fileBuffer = readFileMaybeEncrypted(dbPath, null);
                 const sqlDb = new SQL.Database(fileBuffer);
                 // Load all entries with embeddings
                 const result = sqlDb.exec(`
@@ -828,7 +829,7 @@ export async function ensureSchemaColumns(dbPath) {
         }
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
-        const fileBuffer = fs.readFileSync(dbPath);
+        const fileBuffer = readFileMaybeEncrypted(dbPath, null);
         const db = new SQL.Database(fileBuffer);
         // Get current columns in memory_entries
         const tableInfo = db.exec("PRAGMA table_info(memory_entries)");
@@ -865,7 +866,7 @@ export async function ensureSchemaColumns(dbPath) {
         if (modified) {
             // Save updated database
             const data = db.export();
-            fs.writeFileSync(dbPath, Buffer.from(data));
+            writeFileRestricted(dbPath, Buffer.from(data), { encrypt: true });
         }
         db.close();
         return { success: true, columnsAdded };
@@ -1035,7 +1036,7 @@ export async function initializeMemoryDatabase(options) {
             // Save to file
             const data = db.export();
             const buffer = Buffer.from(data);
-            fs.writeFileSync(dbPath, buffer);
+            writeFileRestricted(dbPath, buffer, { encrypt: true });
             // Close database
             db.close();
             // Also create schema file for reference
@@ -1101,7 +1102,7 @@ export async function initializeMemoryDatabase(options) {
             sqliteHeader[25] = 0x40;
             sqliteHeader[26] = 0x20; // min embedded payload
             sqliteHeader[27] = 0x20; // leaf payload
-            fs.writeFileSync(dbPath, sqliteHeader);
+            writeFileRestricted(dbPath, sqliteHeader, { encrypt: true });
             // ADR-053: Activate ControllerRegistry even on fallback path
             const controllerResult = await activateControllerRegistry(dbPath, verbose);
             return {
@@ -1546,7 +1547,7 @@ export async function verifyMemoryInit(dbPath, options) {
         const SQL = await initSqlJs();
         const fs = await import('fs');
         // Load database
-        const fileBuffer = fs.readFileSync(dbPath);
+        const fileBuffer = readFileMaybeEncrypted(dbPath, null);
         const db = new SQL.Database(fileBuffer);
         // Test 1: Schema verification
         const schemaStart = Date.now();
@@ -1679,7 +1680,7 @@ export async function verifyMemoryInit(dbPath, options) {
         db.run(`DELETE FROM memory_entries WHERE id = ?`, [testId]);
         // Save changes
         const data = db.export();
-        fs.writeFileSync(dbPath, Buffer.from(data));
+        writeFileRestricted(dbPath, Buffer.from(data), { encrypt: true });
         db.close();
         const passed = tests.filter(t => t.passed).length;
         const failed = tests.filter(t => !t.passed).length;
@@ -1740,7 +1741,7 @@ export async function storeEntry(options) {
         await ensureSchemaColumns(dbPath);
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
-        const fileBuffer = fs.readFileSync(dbPath);
+        const fileBuffer = readFileMaybeEncrypted(dbPath, null);
         const db = new SQL.Database(fileBuffer);
         const id = `entry_${Date.now()}_${Math.random().toString(36).substring(7)}`;
         const now = Date.now();
@@ -1782,7 +1783,7 @@ export async function storeEntry(options) {
         ]);
         // Save
         const data = db.export();
-        fs.writeFileSync(dbPath, Buffer.from(data));
+        writeFileRestricted(dbPath, Buffer.from(data), { encrypt: true });
         db.close();
         // Add to HNSW index for faster future searches
         if (embeddingJson) {
@@ -1843,7 +1844,7 @@ export async function searchEntries(options) {
                 // Rerank candidates with exact cosine similarity from SQLite
                 const initSqlJs = (await import('sql.js')).default;
                 const SQL = await initSqlJs();
-                const fileBuffer = fs.readFileSync(dbPath);
+                const fileBuffer = readFileMaybeEncrypted(dbPath, null);
                 const db = new SQL.Database(fileBuffer);
                 const reranked = [];
                 for (const candidate of rabitqCandidates) {
@@ -1893,7 +1894,7 @@ export async function searchEntries(options) {
         // Fall back to brute-force SQLite search
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
-        const fileBuffer = fs.readFileSync(dbPath);
+        const fileBuffer = readFileMaybeEncrypted(dbPath, null);
         const db = new SQL.Database(fileBuffer);
         // Get entries with embeddings
         const searchStmt = db.prepare(effectiveNamespace !== 'all'
@@ -2004,7 +2005,7 @@ export async function listEntries(options) {
         await ensureSchemaColumns(dbPath);
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
-        const fileBuffer = fs.readFileSync(dbPath);
+        const fileBuffer = readFileMaybeEncrypted(dbPath, null);
         const db = new SQL.Database(fileBuffer);
         // Get total count
         const countStmt = namespace
@@ -2089,7 +2090,7 @@ export async function getEntry(options) {
         await ensureSchemaColumns(dbPath);
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
-        const fileBuffer = fs.readFileSync(dbPath);
+        const fileBuffer = readFileMaybeEncrypted(dbPath, null);
         const db = new SQL.Database(fileBuffer);
         // Find entry by key
         const getStmt = db.prepare(`
@@ -2120,7 +2121,7 @@ export async function getEntry(options) {
     `, [String(id)]);
         // Save updated database
         const data = db.export();
-        fs.writeFileSync(dbPath, Buffer.from(data));
+        writeFileRestricted(dbPath, Buffer.from(data), { encrypt: true });
         db.close();
         let tags = [];
         if (tagsJson) {
@@ -2200,7 +2201,7 @@ export async function deleteEntry(options) {
         await ensureSchemaColumns(dbPath);
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
-        const fileBuffer = fs.readFileSync(dbPath);
+        const fileBuffer = readFileMaybeEncrypted(dbPath, null);
         const db = new SQL.Database(fileBuffer);
         // Check if entry exists first
         const checkStmt = db.prepare(`
@@ -2249,7 +2250,7 @@ export async function deleteEntry(options) {
         const remainingEntries = countResult[0]?.values?.[0]?.[0] || 0;
         // Save updated database
         const data = db.export();
-        fs.writeFileSync(dbPath, Buffer.from(data));
+        writeFileRestricted(dbPath, Buffer.from(data), { encrypt: true });
         db.close();
         // Clean up in-memory HNSW index so ghost vectors don't appear in searches.
         // Remove the entry from the HNSW entries map and invalidate the index.

package/v3/@claude-flow/cli/dist/src/transfer/ipfs/upload.js

@@ -279,6 +279,8 @@ export async function checkContent(cid, gateway = 'https://w3s.link') {
     try {
         const response = await fetch(`${gateway}/ipfs/${cid}`, {
             method: 'HEAD',
+            // audit_1776853149979: HEAD probe should never hang; 10s upper bound.
+            signal: AbortSignal.timeout(10000),
         });
         if (response.ok) {
             const size = parseInt(response.headers.get('content-length') || '0', 10);

package/v3/@claude-flow/cli/dist/src/update/executor.d.ts

@@ -4,6 +4,7 @@
  */
 import { UpdateCheckResult } from './checker.js';
 import { ValidationResult } from './validator.js';
+export declare function isSafePackageSpec(pkg: string, version: string): boolean;
 export interface UpdateHistoryEntry {
     timestamp: string;
     package: string;

package/v3/@claude-flow/cli/dist/src/update/executor.js

@@ -2,11 +2,27 @@
  * Update executor - performs actual package updates
  * Includes rollback capability
  */
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
 import { validateUpdate } from './validator.js';
+/**
+ * audit_1776853149979: package name and version come from npm-view output and
+ * the update-history.json file (writable by anyone with FS access). Both
+ * previously interpolated straight into a shell string for `npm install`.
+ * These regexes pre-flight values so a hostile package name can't slip
+ * shell metacharacters through, even though execFileSync below already
+ * eliminates the shell.
+ */
+// First char of the unscoped name forbids `-` to defang CLI-flag confusion
+// when the spec is passed to npm (npm install -evil@1.0.0 looks flag-shaped).
+const SAFE_PKG_RE = /^(@[a-zA-Z0-9_\-]+\/)?[a-zA-Z0-9_][a-zA-Z0-9_\-.]{0,213}$/;
+// semver / dist-tag / range chars only — no shell metas.
+const SAFE_VERSION_RE = /^[a-zA-Z0-9._\-+~^*xX]{1,64}$/;
+export function isSafePackageSpec(pkg, version) {
+    return SAFE_PKG_RE.test(pkg) && SAFE_VERSION_RE.test(version);
+}
 const HISTORY_FILE = path.join(os.homedir(), '.claude-flow', 'update-history.json');
 const MAX_HISTORY_ENTRIES = 100;
 function ensureDir() {
@@ -58,13 +74,25 @@ export async function executeUpdate(update, installedPackages, dryRun = false) {
             validation,
         };
     }
+    // audit_1776853149979: validate package + version regex before any exec.
+    if (!isSafePackageSpec(update.package, update.latestVersion)) {
+        return {
+            success: false,
+            package: update.package,
+            version: update.latestVersion,
+            error: `Refusing to install: package or version contains disallowed characters (pkg="${update.package}", version="${update.latestVersion}")`,
+            validation,
+        };
+    }
     try {
-        // Execute npm install
-        const installCmd = `npm install ${update.package}@${update.latestVersion} --save-exact`;
-        execSync(installCmd, {
+        // audit_1776853149979: switched to execFileSync('npm', argv) — no shell,
+        // so even if validation regressed, metas in update.package would stay
+        // literal in the argv slot.
+        execFileSync('npm', ['install', `${update.package}@${update.latestVersion}`, '--save-exact'], {
             encoding: 'utf-8',
             stdio: 'pipe',
             timeout: 60000, // 1 minute timeout
+            shell: false,
         });
         // Record successful update
         recordUpdate({
@@ -139,13 +167,21 @@ export async function rollbackUpdate(packageName) {
                 : 'No rollback available',
         };
     }
+    // audit_1776853149979: history entries can be tampered with by anyone who
+    // can write update-history.json — gate before exec.
+    if (!isSafePackageSpec(lastUpdate.package, lastUpdate.fromVersion)) {
+        return {
+            success: false,
+            message: `Refusing to rollback: package or version contains disallowed characters (pkg="${lastUpdate.package}", version="${lastUpdate.fromVersion}")`,
+        };
+    }
     try {
-        // Install the previous version
-        const installCmd = `npm install ${lastUpdate.package}@${lastUpdate.fromVersion} --save-exact`;
-        execSync(installCmd, {
+        // execFileSync, no shell.
+        execFileSync('npm', ['install', `${lastUpdate.package}@${lastUpdate.fromVersion}`, '--save-exact'], {
             encoding: 'utf-8',
             stdio: 'pipe',
             timeout: 60000,
+            shell: false,
         });
         // Record the rollback
         recordUpdate({

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.6.24",
+  "version": "3.6.26",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

package/.claude/scheduled_tasks.lock

@@ -1 +0,0 @@
-{"sessionId":"36428a63-dfb2-42a4-a159-cf8be916193e","pid":71027,"procStart":"Sun May  3 23:00:23 2026","acquiredAt":1777849234814}