claude-flow 3.6.29 → 3.7.0-alpha.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude/settings.local.json +1 -0
- package/package.json +1 -1
- package/v3/@claude-flow/cli/dist/src/mcp-tools/agent-tools.js +1 -1
- package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js +1 -1
- package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.js +5 -5
- package/v3/@claude-flow/cli/dist/src/mcp-tools/types.d.ts +4 -33
- package/v3/@claude-flow/cli/dist/src/mcp-tools/types.js +4 -14
- package/v3/@claude-flow/cli/dist/src/mcp-tools/validate-input.d.ts +5 -57
- package/v3/@claude-flow/cli/dist/src/mcp-tools/validate-input.js +5 -233
- package/v3/@claude-flow/cli/dist/src/output.d.ts +6 -130
- package/v3/@claude-flow/cli/dist/src/output.js +6 -511
- package/v3/@claude-flow/cli/dist/src/types.d.ts +10 -195
- package/v3/@claude-flow/cli/dist/src/types.js +10 -35
- package/v3/@claude-flow/cli/package.json +2 -1
- package/.claude/scheduled_tasks.lock +0 -1
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "claude-flow",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.7.0-alpha.1",
|
|
4
4
|
"description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"type": "module",
|
|
@@ -135,7 +135,7 @@ async function determineAgentModel(agentType, config, task) {
|
|
|
135
135
|
export const agentTools = [
|
|
136
136
|
{
|
|
137
137
|
name: 'agent_spawn',
|
|
138
|
-
description: 'Spawn a
|
|
138
|
+
description: 'Spawn a Ruflo-tracked agent with cost attribution + memory persistence + swarm coordination. Use when native Task tool is wrong because you need (a) cost tracking per agent in the cost-tracking namespace, (b) cross-session learning via the patterns namespace, or (c) coordination with other agents in a swarm topology (hierarchical / mesh / consensus). For one-shot subtasks with no learning loop, native Task is fine. Pair with hooks_route to pick the right model first.',
|
|
139
139
|
category: 'agent',
|
|
140
140
|
inputSchema: {
|
|
141
141
|
type: 'object',
|
|
@@ -759,7 +759,7 @@ export const hooksPostCommand = {
|
|
|
759
759
|
};
|
|
760
760
|
export const hooksRoute = {
|
|
761
761
|
name: 'hooks_route',
|
|
762
|
-
description: '
|
|
762
|
+
description: 'Get a 3-tier routing recommendation for a task: Tier 1 (Agent Booster, 0ms / $0 — for var-to-const, add-types, etc.), Tier 2 (Haiku — simple), Tier 3 (Sonnet/Opus — complex). Use this BEFORE spawning an agent to avoid sending simple transforms to Sonnet. Native tools have no equivalent — Claude Code does not introspect its own model-selection cost. Returns the recommended model + a `[AGENT_BOOSTER_AVAILABLE]` literal when the WASM bypass applies.',
|
|
763
763
|
inputSchema: {
|
|
764
764
|
type: 'object',
|
|
765
765
|
properties: {
|
|
@@ -153,7 +153,7 @@ async function ensureInitialized() {
|
|
|
153
153
|
export const memoryTools = [
|
|
154
154
|
{
|
|
155
155
|
name: 'memory_store',
|
|
156
|
-
description: '
|
|
156
|
+
description: 'Persistent key-value store with vector embedding — survives across sessions and is searchable by meaning, not just by file path. Use when native Write is wrong because the data is not a file (e.g. a learned pattern, a decision, a budget config) AND you need to recall it later by semantic query, not by path. Defaults to namespace="default"; pass --upsert=true to update an existing key.',
|
|
157
157
|
category: 'memory',
|
|
158
158
|
inputSchema: {
|
|
159
159
|
type: 'object',
|
|
@@ -227,7 +227,7 @@ export const memoryTools = [
|
|
|
227
227
|
},
|
|
228
228
|
{
|
|
229
229
|
name: 'memory_retrieve',
|
|
230
|
-
description: '
|
|
230
|
+
description: 'Read back a value previously stored via memory_store, by exact (namespace, key) — lossless, includes metadata. Use when native Read is wrong because the value is not a file (it lives in the .swarm/memory.db SQLite store) AND you know the exact key. For semantic lookup by meaning, use memory_search.',
|
|
231
231
|
category: 'memory',
|
|
232
232
|
inputSchema: {
|
|
233
233
|
type: 'object',
|
|
@@ -287,7 +287,7 @@ export const memoryTools = [
|
|
|
287
287
|
},
|
|
288
288
|
{
|
|
289
289
|
name: 'memory_search',
|
|
290
|
-
description: '
|
|
290
|
+
description: 'Find stored memories by meaning (vector similarity), not by literal text — finds "JWT auth pattern" when you query "token-based login flow". Use when native Grep is wrong because Grep matches characters and you need to find conceptually-related entries across past sessions. Backed by HNSW index over ONNX embeddings; returns top-k with similarity scores. Pair with smart=true for query expansion + MMR diversity.',
|
|
291
291
|
category: 'memory',
|
|
292
292
|
inputSchema: {
|
|
293
293
|
type: 'object',
|
|
@@ -404,7 +404,7 @@ export const memoryTools = [
|
|
|
404
404
|
},
|
|
405
405
|
{
|
|
406
406
|
name: 'memory_delete',
|
|
407
|
-
description: '
|
|
407
|
+
description: 'Remove a stored memory entry by exact (namespace, key). Use when a previously stored decision is invalidated or contains stale data. No native equivalent — Write to a file does not affect the .swarm/memory.db SQLite store.',
|
|
408
408
|
category: 'memory',
|
|
409
409
|
inputSchema: {
|
|
410
410
|
type: 'object',
|
|
@@ -444,7 +444,7 @@ export const memoryTools = [
|
|
|
444
444
|
},
|
|
445
445
|
{
|
|
446
446
|
name: 'memory_list',
|
|
447
|
-
description: '
|
|
447
|
+
description: 'Enumerate stored memory entries (optionally filtered by namespace/tags) without semantic search. Use when native Glob is wrong because the entries are not files (they live in .swarm/memory.db). For inspection / audit / "what is in my memory" — pair with memory_search for retrieval-by-meaning.',
|
|
448
448
|
category: 'memory',
|
|
449
449
|
inputSchema: {
|
|
450
450
|
type: 'object',
|
|
@@ -1,37 +1,8 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* MCP Tool Types
|
|
2
|
+
* MCP Tool Types — re-export shim (ADR-100, alpha.5).
|
|
3
3
|
*
|
|
4
|
-
*
|
|
4
|
+
* Authoritative source: @claude-flow/cli-core/mcp-tools/types. Was a 46-line
|
|
5
|
+
* byte-identical copy. Re-exports MCPTool, MCPToolInputSchema, MCPToolResult.
|
|
5
6
|
*/
|
|
6
|
-
export
|
|
7
|
-
type: 'object';
|
|
8
|
-
properties: Record<string, unknown>;
|
|
9
|
-
required?: string[];
|
|
10
|
-
}
|
|
11
|
-
export interface MCPToolResult {
|
|
12
|
-
content: Array<{
|
|
13
|
-
type: 'text' | 'image' | 'resource';
|
|
14
|
-
text?: string;
|
|
15
|
-
data?: string;
|
|
16
|
-
mimeType?: string;
|
|
17
|
-
}>;
|
|
18
|
-
isError?: boolean;
|
|
19
|
-
}
|
|
20
|
-
/**
|
|
21
|
-
* Returns the effective project working directory.
|
|
22
|
-
* Prefers CLAUDE_FLOW_CWD (set by the install script for global/MCP installs
|
|
23
|
-
* where process.cwd() may resolve to '/') over the real process.cwd().
|
|
24
|
-
*/
|
|
25
|
-
export declare function getProjectCwd(): string;
|
|
26
|
-
export interface MCPTool {
|
|
27
|
-
name: string;
|
|
28
|
-
description: string;
|
|
29
|
-
inputSchema: MCPToolInputSchema;
|
|
30
|
-
category?: string;
|
|
31
|
-
tags?: string[];
|
|
32
|
-
version?: string;
|
|
33
|
-
cacheable?: boolean;
|
|
34
|
-
cacheTTL?: number;
|
|
35
|
-
handler: (input: Record<string, unknown>, context?: Record<string, unknown>) => Promise<MCPToolResult | unknown>;
|
|
36
|
-
}
|
|
7
|
+
export * from '@claude-flow/cli-core/mcp-tools/types';
|
|
37
8
|
//# sourceMappingURL=types.d.ts.map
|
|
@@ -1,18 +1,8 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* MCP Tool Types
|
|
2
|
+
* MCP Tool Types — re-export shim (ADR-100, alpha.5).
|
|
3
3
|
*
|
|
4
|
-
*
|
|
4
|
+
* Authoritative source: @claude-flow/cli-core/mcp-tools/types. Was a 46-line
|
|
5
|
+
* byte-identical copy. Re-exports MCPTool, MCPToolInputSchema, MCPToolResult.
|
|
5
6
|
*/
|
|
6
|
-
|
|
7
|
-
* Returns the effective project working directory.
|
|
8
|
-
* Prefers CLAUDE_FLOW_CWD (set by the install script for global/MCP installs
|
|
9
|
-
* where process.cwd() may resolve to '/') over the real process.cwd().
|
|
10
|
-
*/
|
|
11
|
-
export function getProjectCwd() {
|
|
12
|
-
const envCwd = process.env.CLAUDE_FLOW_CWD;
|
|
13
|
-
if (envCwd && envCwd !== '/' && envCwd !== process.env.HOME) {
|
|
14
|
-
return envCwd;
|
|
15
|
-
}
|
|
16
|
-
return process.cwd();
|
|
17
|
-
}
|
|
7
|
+
export * from '@claude-flow/cli-core/mcp-tools/types';
|
|
18
8
|
//# sourceMappingURL=types.js.map
|
|
@@ -1,61 +1,9 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Input Validation for MCP Tools
|
|
2
|
+
* Input Validation for MCP Tools — re-export shim (ADR-100, alpha.5).
|
|
3
3
|
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
* Addresses #1425: security validators were implemented but never wired to runtime.
|
|
8
|
-
*/
|
|
9
|
-
export interface ValidationResult {
|
|
10
|
-
valid: boolean;
|
|
11
|
-
sanitized: string;
|
|
12
|
-
error?: string;
|
|
13
|
-
}
|
|
14
|
-
/**
|
|
15
|
-
* Validate an identifier (agent ID, agent type, namespace, key, etc.)
|
|
16
|
-
* Rejects shell metacharacters and path traversal.
|
|
17
|
-
*/
|
|
18
|
-
export declare function validateIdentifier(value: unknown, label: string): ValidationResult;
|
|
19
|
-
/**
|
|
20
|
-
* Validate a git ref (HEAD~1, main..feature, commit hashes, etc.).
|
|
21
|
-
* Allows ~, ^, and / which are standard git revision selectors.
|
|
22
|
-
*/
|
|
23
|
-
export declare function validateGitRef(value: unknown, label: string): ValidationResult;
|
|
24
|
-
/**
|
|
25
|
-
* Validate an npm package name (allows @scope/name format).
|
|
26
|
-
*/
|
|
27
|
-
export declare function validatePackageName(value: unknown, label: string): ValidationResult;
|
|
28
|
-
/**
|
|
29
|
-
* Validate a file path (prevents traversal and shell injection).
|
|
30
|
-
*/
|
|
31
|
-
export declare function validatePath(value: unknown, label: string): ValidationResult;
|
|
32
|
-
/**
|
|
33
|
-
* Validate a free-text string (description, value, etc.)
|
|
34
|
-
* Allows most characters but rejects shell metacharacters that could cause injection.
|
|
35
|
-
*/
|
|
36
|
-
export declare function validateText(value: unknown, label: string, maxLen?: number): ValidationResult;
|
|
37
|
-
export interface EnvValidationResult {
|
|
38
|
-
valid: boolean;
|
|
39
|
-
sanitized: Record<string, string>;
|
|
40
|
-
error?: string;
|
|
41
|
-
}
|
|
42
|
-
/**
|
|
43
|
-
* Validate a Record<string,string> of environment variables: enforce POSIX
|
|
44
|
-
* names, reject hijack-prone names (LD_PRELOAD, NODE_OPTIONS, …), forbid null
|
|
45
|
-
* bytes in values, and cap value length so a malicious caller can't bloat the
|
|
46
|
-
* stored session past reasonable bounds.
|
|
47
|
-
*/
|
|
48
|
-
export declare function validateEnv(value: unknown, label?: string): EnvValidationResult;
|
|
49
|
-
/**
|
|
50
|
-
* Assert validation or throw with a structured error.
|
|
51
|
-
*/
|
|
52
|
-
export declare function assertValid(result: ValidationResult): string;
|
|
53
|
-
/**
|
|
54
|
-
* Enhanced validation using @claude-flow/security Zod schemas when available.
|
|
55
|
-
* Falls back to inline regex validation otherwise.
|
|
4
|
+
* Authoritative source: @claude-flow/cli-core/mcp-tools/validate-input.
|
|
5
|
+
* Was a 256-line byte-identical copy. Loads @claude-flow/security validators
|
|
6
|
+
* when available, with lightweight fallback otherwise.
|
|
56
7
|
*/
|
|
57
|
-
export
|
|
58
|
-
valid: boolean;
|
|
59
|
-
errors: string[];
|
|
60
|
-
}>;
|
|
8
|
+
export * from '@claude-flow/cli-core/mcp-tools/validate-input';
|
|
61
9
|
//# sourceMappingURL=validate-input.d.ts.map
|
|
@@ -1,237 +1,9 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Input Validation for MCP Tools
|
|
2
|
+
* Input Validation for MCP Tools — re-export shim (ADR-100, alpha.5).
|
|
3
3
|
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
* Addresses #1425: security validators were implemented but never wired to runtime.
|
|
8
|
-
*/
|
|
9
|
-
// Patterns for input sanitization (inline — no external dependency required)
|
|
10
|
-
const SHELL_META = /[;&|`$(){}[\]<>!#\\]/;
|
|
11
|
-
const PATH_TRAVERSAL = /\.\.[/\\]/;
|
|
12
|
-
const IDENTIFIER_RE = /^[a-zA-Z0-9_][a-zA-Z0-9_\-.:]{0,127}$/;
|
|
13
|
-
const GIT_REF_RE = /^[a-zA-Z0-9_][a-zA-Z0-9_\-.:~^/]{0,255}$/;
|
|
14
|
-
const NPM_PACKAGE_RE = /^(@[a-zA-Z0-9_\-]+\/)?[a-zA-Z0-9_\-][a-zA-Z0-9_\-.]{0,213}$/;
|
|
15
|
-
/**
|
|
16
|
-
* Validate an identifier (agent ID, agent type, namespace, key, etc.)
|
|
17
|
-
* Rejects shell metacharacters and path traversal.
|
|
18
|
-
*/
|
|
19
|
-
export function validateIdentifier(value, label) {
|
|
20
|
-
if (typeof value !== 'string' || value.length === 0) {
|
|
21
|
-
return { valid: false, sanitized: '', error: `${label} must be a non-empty string` };
|
|
22
|
-
}
|
|
23
|
-
if (value.length > 128) {
|
|
24
|
-
return { valid: false, sanitized: '', error: `${label} exceeds 128 characters` };
|
|
25
|
-
}
|
|
26
|
-
if (SHELL_META.test(value)) {
|
|
27
|
-
return { valid: false, sanitized: '', error: `${label} contains disallowed characters` };
|
|
28
|
-
}
|
|
29
|
-
if (PATH_TRAVERSAL.test(value)) {
|
|
30
|
-
return { valid: false, sanitized: '', error: `${label} contains path traversal` };
|
|
31
|
-
}
|
|
32
|
-
if (!IDENTIFIER_RE.test(value)) {
|
|
33
|
-
return { valid: false, sanitized: '', error: `${label} contains invalid characters (allowed: alphanumeric, _, -, ., :)` };
|
|
34
|
-
}
|
|
35
|
-
return { valid: true, sanitized: value };
|
|
36
|
-
}
|
|
37
|
-
/**
|
|
38
|
-
* Validate a git ref (HEAD~1, main..feature, commit hashes, etc.).
|
|
39
|
-
* Allows ~, ^, and / which are standard git revision selectors.
|
|
40
|
-
*/
|
|
41
|
-
export function validateGitRef(value, label) {
|
|
42
|
-
if (typeof value !== 'string' || value.length === 0) {
|
|
43
|
-
return { valid: false, sanitized: '', error: `${label} must be a non-empty string` };
|
|
44
|
-
}
|
|
45
|
-
if (value.length > 256) {
|
|
46
|
-
return { valid: false, sanitized: '', error: `${label} exceeds 256 characters` };
|
|
47
|
-
}
|
|
48
|
-
if (SHELL_META.test(value)) {
|
|
49
|
-
return { valid: false, sanitized: '', error: `${label} contains disallowed characters` };
|
|
50
|
-
}
|
|
51
|
-
if (!GIT_REF_RE.test(value)) {
|
|
52
|
-
return { valid: false, sanitized: '', error: `${label} contains invalid characters (allowed: alphanumeric, _, -, ., :, ~, ^, /)` };
|
|
53
|
-
}
|
|
54
|
-
return { valid: true, sanitized: value };
|
|
55
|
-
}
|
|
56
|
-
/**
|
|
57
|
-
* Validate an npm package name (allows @scope/name format).
|
|
58
|
-
*/
|
|
59
|
-
export function validatePackageName(value, label) {
|
|
60
|
-
if (typeof value !== 'string' || value.length === 0) {
|
|
61
|
-
return { valid: false, sanitized: '', error: `${label} must be a non-empty string` };
|
|
62
|
-
}
|
|
63
|
-
if (value.length > 214) {
|
|
64
|
-
return { valid: false, sanitized: '', error: `${label} exceeds 214 characters` };
|
|
65
|
-
}
|
|
66
|
-
if (SHELL_META.test(value)) {
|
|
67
|
-
return { valid: false, sanitized: '', error: `${label} contains disallowed characters` };
|
|
68
|
-
}
|
|
69
|
-
if (!NPM_PACKAGE_RE.test(value)) {
|
|
70
|
-
return { valid: false, sanitized: '', error: `${label} contains invalid characters (expected npm package name, e.g. @scope/name)` };
|
|
71
|
-
}
|
|
72
|
-
return { valid: true, sanitized: value };
|
|
73
|
-
}
|
|
74
|
-
/**
|
|
75
|
-
* Validate a file path (prevents traversal and shell injection).
|
|
76
|
-
*/
|
|
77
|
-
export function validatePath(value, label) {
|
|
78
|
-
if (typeof value !== 'string' || value.length === 0) {
|
|
79
|
-
return { valid: false, sanitized: '', error: `${label} must be a non-empty string` };
|
|
80
|
-
}
|
|
81
|
-
if (value.length > 4096) {
|
|
82
|
-
return { valid: false, sanitized: '', error: `${label} exceeds 4096 characters` };
|
|
83
|
-
}
|
|
84
|
-
if (PATH_TRAVERSAL.test(value)) {
|
|
85
|
-
return { valid: false, sanitized: '', error: `${label} contains path traversal (..)` };
|
|
86
|
-
}
|
|
87
|
-
if (SHELL_META.test(value)) {
|
|
88
|
-
return { valid: false, sanitized: '', error: `${label} contains shell metacharacters` };
|
|
89
|
-
}
|
|
90
|
-
return { valid: true, sanitized: value };
|
|
91
|
-
}
|
|
92
|
-
/**
|
|
93
|
-
* Validate a free-text string (description, value, etc.)
|
|
94
|
-
* Allows most characters but rejects shell metacharacters that could cause injection.
|
|
95
|
-
*/
|
|
96
|
-
export function validateText(value, label, maxLen = 10_000) {
|
|
97
|
-
if (typeof value !== 'string') {
|
|
98
|
-
return { valid: false, sanitized: '', error: `${label} must be a string` };
|
|
99
|
-
}
|
|
100
|
-
if (value.length > maxLen) {
|
|
101
|
-
return { valid: false, sanitized: '', error: `${label} exceeds ${maxLen} characters` };
|
|
102
|
-
}
|
|
103
|
-
// Strip null bytes
|
|
104
|
-
const sanitized = value.replace(/\0/g, '');
|
|
105
|
-
return { valid: true, sanitized };
|
|
106
|
-
}
|
|
107
|
-
/**
|
|
108
|
-
* Names that let an attacker pivot a child process before any user code runs:
|
|
109
|
-
* shared-library injection on Linux/macOS, Node hooks, and command resolution.
|
|
110
|
-
*
|
|
111
|
-
* audit_1776853149979: terminal_create previously merged caller-supplied env
|
|
112
|
-
* straight into execSync's environment for every subsequent command in the
|
|
113
|
-
* session. Setting LD_PRELOAD or NODE_OPTIONS via that path is functionally
|
|
114
|
-
* equivalent to remote code execution, so the env input needs an allowlist
|
|
115
|
-
* shape and a denylist on these specific names.
|
|
116
|
-
*/
|
|
117
|
-
const DENYLISTED_ENV_NAMES = new Set([
|
|
118
|
-
'LD_PRELOAD',
|
|
119
|
-
'LD_LIBRARY_PATH',
|
|
120
|
-
'LD_AUDIT',
|
|
121
|
-
'DYLD_INSERT_LIBRARIES',
|
|
122
|
-
'DYLD_LIBRARY_PATH',
|
|
123
|
-
'DYLD_FALLBACK_LIBRARY_PATH',
|
|
124
|
-
'DYLD_FORCE_FLAT_NAMESPACE',
|
|
125
|
-
'NODE_OPTIONS',
|
|
126
|
-
'NODE_PATH',
|
|
127
|
-
]);
|
|
128
|
-
const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
|
|
129
|
-
/**
|
|
130
|
-
* Validate a Record<string,string> of environment variables: enforce POSIX
|
|
131
|
-
* names, reject hijack-prone names (LD_PRELOAD, NODE_OPTIONS, …), forbid null
|
|
132
|
-
* bytes in values, and cap value length so a malicious caller can't bloat the
|
|
133
|
-
* stored session past reasonable bounds.
|
|
134
|
-
*/
|
|
135
|
-
export function validateEnv(value, label = 'env') {
|
|
136
|
-
if (value === undefined || value === null) {
|
|
137
|
-
return { valid: true, sanitized: {} };
|
|
138
|
-
}
|
|
139
|
-
if (typeof value !== 'object' || Array.isArray(value)) {
|
|
140
|
-
return { valid: false, sanitized: {}, error: `${label} must be an object of string→string` };
|
|
141
|
-
}
|
|
142
|
-
const out = {};
|
|
143
|
-
for (const [name, rawVal] of Object.entries(value)) {
|
|
144
|
-
if (!ENV_NAME_RE.test(name)) {
|
|
145
|
-
return { valid: false, sanitized: {}, error: `${label} key "${name}" is not a valid POSIX env name` };
|
|
146
|
-
}
|
|
147
|
-
if (DENYLISTED_ENV_NAMES.has(name)) {
|
|
148
|
-
return { valid: false, sanitized: {}, error: `${label} key "${name}" is denylisted (loader/runtime hijack)` };
|
|
149
|
-
}
|
|
150
|
-
if (typeof rawVal !== 'string') {
|
|
151
|
-
return { valid: false, sanitized: {}, error: `${label}["${name}"] must be a string` };
|
|
152
|
-
}
|
|
153
|
-
if (rawVal.length > 32_768) {
|
|
154
|
-
return { valid: false, sanitized: {}, error: `${label}["${name}"] exceeds 32768 characters` };
|
|
155
|
-
}
|
|
156
|
-
if (rawVal.includes('\0')) {
|
|
157
|
-
return { valid: false, sanitized: {}, error: `${label}["${name}"] contains a null byte` };
|
|
158
|
-
}
|
|
159
|
-
out[name] = rawVal;
|
|
160
|
-
}
|
|
161
|
-
return { valid: true, sanitized: out };
|
|
162
|
-
}
|
|
163
|
-
/**
|
|
164
|
-
* Assert validation or throw with a structured error.
|
|
165
|
-
*/
|
|
166
|
-
export function assertValid(result) {
|
|
167
|
-
if (!result.valid) {
|
|
168
|
-
throw new Error(`Validation failed: ${result.error}`);
|
|
169
|
-
}
|
|
170
|
-
return result.sanitized;
|
|
171
|
-
}
|
|
172
|
-
// Try to load the full @claude-flow/security module for enhanced validation
|
|
173
|
-
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
174
|
-
let _securityModule = null;
|
|
175
|
-
let _securityLoaded = false;
|
|
176
|
-
async function getSecurityModule() {
|
|
177
|
-
if (_securityLoaded)
|
|
178
|
-
return _securityModule;
|
|
179
|
-
_securityLoaded = true;
|
|
180
|
-
try {
|
|
181
|
-
// Dynamic import — @claude-flow/security is an optional dependency
|
|
182
|
-
_securityModule = await Function('return import("@claude-flow/security")')();
|
|
183
|
-
}
|
|
184
|
-
catch {
|
|
185
|
-
// @claude-flow/security is optional — fallback to inline validation above
|
|
186
|
-
}
|
|
187
|
-
return _securityModule;
|
|
188
|
-
}
|
|
189
|
-
/**
|
|
190
|
-
* Enhanced validation using @claude-flow/security Zod schemas when available.
|
|
191
|
-
* Falls back to inline regex validation otherwise.
|
|
4
|
+
* Authoritative source: @claude-flow/cli-core/mcp-tools/validate-input.
|
|
5
|
+
* Was a 256-line byte-identical copy. Loads @claude-flow/security validators
|
|
6
|
+
* when available, with lightweight fallback otherwise.
|
|
192
7
|
*/
|
|
193
|
-
export
|
|
194
|
-
const errors = [];
|
|
195
|
-
// Always run inline validation
|
|
196
|
-
if (input.agentType) {
|
|
197
|
-
const r = validateIdentifier(input.agentType, 'agentType');
|
|
198
|
-
if (!r.valid)
|
|
199
|
-
errors.push(r.error);
|
|
200
|
-
}
|
|
201
|
-
if (input.agentId) {
|
|
202
|
-
const r = validateIdentifier(input.agentId, 'agentId');
|
|
203
|
-
if (!r.valid)
|
|
204
|
-
errors.push(r.error);
|
|
205
|
-
}
|
|
206
|
-
if (input.domain) {
|
|
207
|
-
const r = validateIdentifier(input.domain, 'domain');
|
|
208
|
-
if (!r.valid)
|
|
209
|
-
errors.push(r.error);
|
|
210
|
-
}
|
|
211
|
-
// Try enhanced Zod validation if available.
|
|
212
|
-
// Fix for #1567: @claude-flow/security's SpawnAgentSchema expects `type` and
|
|
213
|
-
// `id` (not `agentType`/`name`), so the previous call always failed with
|
|
214
|
-
// "type: Required". Also swallow `invalid_enum_value` errors because the
|
|
215
|
-
// schema enumerates only 15 built-in agent types — we support custom types
|
|
216
|
-
// (the inline validator already checked the identifier is safe).
|
|
217
|
-
const sec = await getSecurityModule();
|
|
218
|
-
if (sec?.SpawnAgentSchema) {
|
|
219
|
-
try {
|
|
220
|
-
sec.SpawnAgentSchema.parse({
|
|
221
|
-
type: input.agentType,
|
|
222
|
-
id: input.agentId,
|
|
223
|
-
});
|
|
224
|
-
}
|
|
225
|
-
catch (zodErr) {
|
|
226
|
-
if (zodErr.issues) {
|
|
227
|
-
for (const issue of zodErr.issues) {
|
|
228
|
-
if (issue.code === 'invalid_enum_value')
|
|
229
|
-
continue;
|
|
230
|
-
errors.push(`${issue.path.join('.')}: ${issue.message}`);
|
|
231
|
-
}
|
|
232
|
-
}
|
|
233
|
-
}
|
|
234
|
-
}
|
|
235
|
-
return { valid: errors.length === 0, errors };
|
|
236
|
-
}
|
|
8
|
+
export * from '@claude-flow/cli-core/mcp-tools/validate-input';
|
|
237
9
|
//# sourceMappingURL=validate-input.js.map
|
|
@@ -1,133 +1,9 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* V3 CLI Output Formatter
|
|
3
|
-
*
|
|
2
|
+
* V3 CLI Output Formatter — re-export shim (ADR-100, alpha.5).
|
|
3
|
+
*
|
|
4
|
+
* Authoritative source: @claude-flow/cli-core/output. Was a byte-identical
|
|
5
|
+
* 640-line copy. The OutputFormatter class and `output` instance plus all
|
|
6
|
+
* helper exports flow through unchanged. Edit cli-core for behavior changes.
|
|
4
7
|
*/
|
|
5
|
-
|
|
6
|
-
declare const COLORS: {
|
|
7
|
-
readonly reset: "\u001B[0m";
|
|
8
|
-
readonly bold: "\u001B[1m";
|
|
9
|
-
readonly dim: "\u001B[2m";
|
|
10
|
-
readonly italic: "\u001B[3m";
|
|
11
|
-
readonly underline: "\u001B[4m";
|
|
12
|
-
readonly black: "\u001B[30m";
|
|
13
|
-
readonly red: "\u001B[31m";
|
|
14
|
-
readonly green: "\u001B[32m";
|
|
15
|
-
readonly yellow: "\u001B[33m";
|
|
16
|
-
readonly blue: "\u001B[34m";
|
|
17
|
-
readonly magenta: "\u001B[35m";
|
|
18
|
-
readonly cyan: "\u001B[36m";
|
|
19
|
-
readonly white: "\u001B[37m";
|
|
20
|
-
readonly gray: "\u001B[90m";
|
|
21
|
-
readonly brightRed: "\u001B[91m";
|
|
22
|
-
readonly brightGreen: "\u001B[92m";
|
|
23
|
-
readonly brightYellow: "\u001B[93m";
|
|
24
|
-
readonly brightBlue: "\u001B[94m";
|
|
25
|
-
readonly brightMagenta: "\u001B[95m";
|
|
26
|
-
readonly brightCyan: "\u001B[96m";
|
|
27
|
-
readonly brightWhite: "\u001B[97m";
|
|
28
|
-
readonly bgBlack: "\u001B[40m";
|
|
29
|
-
readonly bgRed: "\u001B[41m";
|
|
30
|
-
readonly bgGreen: "\u001B[42m";
|
|
31
|
-
readonly bgYellow: "\u001B[43m";
|
|
32
|
-
readonly bgBlue: "\u001B[44m";
|
|
33
|
-
readonly bgMagenta: "\u001B[45m";
|
|
34
|
-
readonly bgCyan: "\u001B[46m";
|
|
35
|
-
readonly bgWhite: "\u001B[47m";
|
|
36
|
-
};
|
|
37
|
-
type ColorName = keyof typeof COLORS;
|
|
38
|
-
export type VerbosityLevel = 'quiet' | 'normal' | 'verbose' | 'debug';
|
|
39
|
-
export declare class OutputFormatter {
|
|
40
|
-
private colorEnabled;
|
|
41
|
-
private outputStream;
|
|
42
|
-
private errorStream;
|
|
43
|
-
private verbosity;
|
|
44
|
-
constructor(options?: {
|
|
45
|
-
color?: boolean;
|
|
46
|
-
verbosity?: VerbosityLevel;
|
|
47
|
-
});
|
|
48
|
-
/**
|
|
49
|
-
* Set verbosity level
|
|
50
|
-
* - quiet: Only errors and direct results
|
|
51
|
-
* - normal: Errors, warnings, info, and results
|
|
52
|
-
* - verbose: All of normal + debug messages
|
|
53
|
-
* - debug: All output including trace
|
|
54
|
-
*/
|
|
55
|
-
setVerbosity(level: VerbosityLevel): void;
|
|
56
|
-
getVerbosity(): VerbosityLevel;
|
|
57
|
-
isQuiet(): boolean;
|
|
58
|
-
isVerbose(): boolean;
|
|
59
|
-
isDebug(): boolean;
|
|
60
|
-
private supportsColor;
|
|
61
|
-
color(text: string, ...colors: ColorName[]): string;
|
|
62
|
-
bold(text: string): string;
|
|
63
|
-
dim(text: string): string;
|
|
64
|
-
success(text: string): string;
|
|
65
|
-
error(text: string): string;
|
|
66
|
-
warning(text: string): string;
|
|
67
|
-
info(text: string): string;
|
|
68
|
-
highlight(text: string): string;
|
|
69
|
-
write(text: string): void;
|
|
70
|
-
writeln(text?: string): void;
|
|
71
|
-
writeError(text: string): void;
|
|
72
|
-
writeErrorln(text?: string): void;
|
|
73
|
-
printSuccess(message: string): void;
|
|
74
|
-
printError(message: string, details?: string): void;
|
|
75
|
-
printWarning(message: string): void;
|
|
76
|
-
printInfo(message: string): void;
|
|
77
|
-
printDebug(message: string): void;
|
|
78
|
-
printTrace(message: string): void;
|
|
79
|
-
table(options: TableOptions): string;
|
|
80
|
-
printTable(options: TableOptions): void;
|
|
81
|
-
private calculateColumnWidths;
|
|
82
|
-
private createBorderLine;
|
|
83
|
-
private alignText;
|
|
84
|
-
private truncate;
|
|
85
|
-
private stripAnsi;
|
|
86
|
-
createProgress(options: ProgressOptions): Progress;
|
|
87
|
-
progressBar(current: number, total: number, width?: number): string;
|
|
88
|
-
createSpinner(options: SpinnerOptions): Spinner;
|
|
89
|
-
json(data: unknown, pretty?: boolean): string;
|
|
90
|
-
printJson(data: unknown, pretty?: boolean): void;
|
|
91
|
-
list(items: string[], bullet?: string): string;
|
|
92
|
-
printList(items: string[], bullet?: string): void;
|
|
93
|
-
numberedList(items: string[]): string;
|
|
94
|
-
printNumberedList(items: string[]): void;
|
|
95
|
-
box(content: string, title?: string): string;
|
|
96
|
-
printBox(content: string, title?: string): void;
|
|
97
|
-
setColorEnabled(enabled: boolean): void;
|
|
98
|
-
isColorEnabled(): boolean;
|
|
99
|
-
}
|
|
100
|
-
export declare class Progress {
|
|
101
|
-
private current;
|
|
102
|
-
private total;
|
|
103
|
-
private width;
|
|
104
|
-
private startTime;
|
|
105
|
-
private formatter;
|
|
106
|
-
private showPercentage;
|
|
107
|
-
private showETA;
|
|
108
|
-
private lastRender;
|
|
109
|
-
constructor(formatter: OutputFormatter, options: ProgressOptions);
|
|
110
|
-
update(current: number): void;
|
|
111
|
-
increment(amount?: number): void;
|
|
112
|
-
render(): void;
|
|
113
|
-
finish(): void;
|
|
114
|
-
private formatTime;
|
|
115
|
-
}
|
|
116
|
-
export declare class Spinner {
|
|
117
|
-
private formatter;
|
|
118
|
-
private text;
|
|
119
|
-
private frames;
|
|
120
|
-
private interval;
|
|
121
|
-
private frameIndex;
|
|
122
|
-
private static readonly SPINNERS;
|
|
123
|
-
constructor(formatter: OutputFormatter, options: SpinnerOptions);
|
|
124
|
-
start(): void;
|
|
125
|
-
stop(message?: string): void;
|
|
126
|
-
succeed(message?: string): void;
|
|
127
|
-
fail(message?: string): void;
|
|
128
|
-
private render;
|
|
129
|
-
setText(text: string): void;
|
|
130
|
-
}
|
|
131
|
-
export declare const output: OutputFormatter;
|
|
132
|
-
export {};
|
|
8
|
+
export * from '@claude-flow/cli-core/output';
|
|
133
9
|
//# sourceMappingURL=output.d.ts.map
|