registry / moflo / 4.11.1

moflo@4.11.1

MoFlo — AI agent orchestration for Claude Code. A standalone, opinionated toolkit with semantic memory, learned routing, gates, spells, and the /flo issue-execution skill.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

The package has an npm postinstall hook that updates a consumer project's Claude Code control surface. If a project already has .claude, install-time code copies MoFlo scripts and helpers into .claude/scripts and .claude/helpers without an explicit runtime command.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install moflo@4.11.1 in a project with .claude present

Impact

Package-supplied hooks, launchers, helpers, and guidance can affect future Claude Code sessions from install time rather than explicit user invocation.

Mechanism

unconsented lifecycle mutation of Claude agent files

Attack narrative

On npm postinstall, package.json runs post-install-bootstrap. That script resolves the consumer project from INIT_CWD/cwd, checks for an existing .claude directory, then copies package-controlled scripts, lib files, migrations, and helpers into .claude/scripts and .claude/helpers. The shipped manifest includes Claude-facing hooks, launchers, prompt/statusline helpers, and VCS hook files. This is lifecycle-triggered mutation of a foreign/broad AI-agent control surface, even though it appears product-aligned and skips projects without .claude.

Rationale

Source inspection confirms automatic postinstall writes into consumer .claude agent-control paths, matching the blockable AI-agent control hijack policy. The native pruning and restart notice do not show classic malware, but they do not mitigate the unconsented lifecycle control-surface mutation.

Evidence

package.jsonscripts/post-install-bootstrap.mjsscripts/post-install-notice.mjsscripts/prune-native-binaries.mjsbin/lib/shipped-scripts.json.claude/scripts/*.claude/scripts/lib/*.claude/scripts/migrations/*.claude/helpers/*.moflo/restart-pending.json.moflo/last-install-banner.json.moflo/bootstrap-failed.json

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for block

postinstall runs scripts/post-install-bootstrap.mjs automatically from package.json
scripts/post-install-bootstrap.mjs uses INIT_CWD/project cwd and copies package files into consumer .claude/scripts and .claude/helpers when .claude exists
bin/lib/shipped-scripts.json includes agent/control helpers such as hooks.mjs, session-start-launcher.mjs, prompt-hook.mjs, statusline.cjs, pre-commit, post-commit
scripts/post-install-notice.mjs writes .moflo/restart-pending.json during Claude sessions to instruct restart after install

Evidence against

post-install-bootstrap skips when no consumer .claude directory exists and exits 0 on failures
prune-native-binaries.mjs is scoped to onnxruntime-node binary pruning with opt-out MOFLO_NO_PRUNE
No credential harvesting or exfiltration endpoint was confirmed in inspected lifecycle scripts

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 637 file(s), 7.13 MB of source, external domains: api.moflo.io, api.npmjs.org, api.openai.com, api.pinata.cloud, claude.com, cli.github.com, cloudflare-ipfs.com, dev.moflo.io, docs.anthropic.com, dweb.link, fonts.googleapis.com, fonts.gstatic.com, gateway.pinata.cloud, git-scm.com, github.com, graph.microsoft.com, imapflow.com, ipfs.io, nodejs.org, nvd.nist.gov, outlook.live.com, pinata.cloud, playwright.dev, registry.npmjs.org, slack.com, staging.moflo.io, storage.googleapis.com, us-central1-claude-flow.cloudfunctions.net, w3s.link, www.apple.com, www.docker.com

Source & flagged code

15 flagged

package.jsonView file

Lines 33-73json

33 "!**/__tests__/**",

34 ".claude/commands/**/*.md",

35 ".claude/agents/**/*.md",

36 ".claude/helpers/**",

37 ".claude/guidance/shipped/**",

38 ".claude/skills/**/*.md",

39 "!.claude/**/*.db",

40 "!.claude/**/*.map",

41 "README.md",

42 "LICENSE",

43 "retired-files.json",

44 "scripts/prune-native-binaries.mjs",

45 "scripts/post-install-notice.mjs",

46 "scripts/post-install-bootstrap.mjs"

47 ],

48 "scripts": {

49 "dev": "tsx watch src/cli/index.ts",

50 "prebuild": "node scripts/sync-version.mjs && node scripts/clean-dist.mjs",

51 "build": "tsc",

52 "prepublishOnly": "npm run build",

53 "postinstall": "node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "test": "node scripts/test-runner.mjs",

55 "test:ui": "vitest --ui",

56 "test:smoke": "node harness/consumer-smoke/run.mjs",

57 "test:smoke:populated": "node harness/consumer-smoke/run-populated.mjs",

58 "bench": "vitest run --config vitest.bench.config.ts",

59 "lint": "eslint src/ bin/ .claude/scripts/ --ext .ts,.tsx,.mts,.cts,.js,.mjs,.cjs --max-warnings 0",

60 "security:audit": "npm audit --omit=dev --audit-level high",

61 "security:fix": "npm audit fix",

62 "version": "node scripts/sync-version.mjs && git add src/cli/version.ts",

63 "flo": "node bin/cli.js"

64 },

65 "dependencies": {

66 "@anush008/tokenizers": "^0.6.0",

67 "@modelcontextprotocol/sdk": "^1.0.0",

68 "js-yaml": "^5.2.0",

69 "lru-cache": "^11.3.5",

70 "onnxruntime-node": "^1.27.0",

71 "semver": "^7.7.4",

72 "tar": "^7.5.16",

73 "valibot": "^1.3.1"

dist/src/cli/guidance/manifest-validator.jsView file

Lines 682-722javascript

682 // Trace 2: Secret detected and blocked

683 {

684 traceId: 'default-secret-blocked',

685 name: 'Secret detected and blocked',

686 description: 'Verifies that secrets in tool parameters are detected and blocked',

687 events: [

688 {

689 seq: 1,

690 eventType: 'tool-use',

691 payload: {

692 tool: 'Write',

693 params: { content: 'api_key = "sk-abc123456789012345678901234567890"' },

694 },

695 expectedOutcome: 'deny',

696 },

697 {

698 seq: 2,

699 eventType: 'tool-use',

700 payload: {

701 tool: 'Edit',

702 params: { content: '-----BEGIN RSA PRIVATE KEY-----' },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/cli/guidance/manifest-validator.jsView on unpkg · L702

703 },

704 expectedOutcome: 'deny',

705 },

706 ],

707 expectedDecisions: { '1': 'deny', '2': 'deny' },

708 expectedMemoryLineage: {},

709 },

710 // Trace 3: Budget exceeded and denied

711 {

712 traceId: 'default-budget-exceeded',

713 name: 'Budget exceeded and denied',

714 description: 'Verifies that operations exceeding budget limits are denied',

715 events: [

716 {

717 seq: 1,

718 eventType: 'budget-check',

719 payload: {

720 resource: 'toolCalls',

721 current: 999,

722 limit: 1000,

702patternName = private_key_rsa severity = critical line = 702 matchedText = params: ...' },

Critical

Secret Pattern

RSA private key in dist/src/cli/guidance/manifest-validator.js

dist/src/cli/guidance/manifest-validator.jsView on unpkg · L702

bin/generate-code-map.mjsView file

Lines 10-50javascript

10 * 5. file: — ONE PER FILE with exported types (file-level granularity)

11 *

12 * The `file:` entries are the key improvement — they enable precise semantic search

13 * for individual types, entities, and services instead of diluting results across

14 * large batches.

15 *

16 * Design: regex-based extraction (no AST parser), incremental via SHA-256 hash,

17 * stores in sql.js memory DB, triggers embedding generation in background.

18 *

19 * Usage:

20 * node node_modules/moflo/bin/generate-code-map.mjs # Incremental

21 * node node_modules/moflo/bin/generate-code-map.mjs --force # Full regenerate

22 * node node_modules/moflo/bin/generate-code-map.mjs --verbose # Detailed logging

23 * node node_modules/moflo/bin/generate-code-map.mjs --no-embeddings # Skip embedding generation

24 * node node_modules/moflo/bin/generate-code-map.mjs --stats # Print stats and exit

25 * flo-codemap # Via PATH

26 */

28import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from 'fs';

29import { resolve, dirname, relative, basename, extname } from 'path';

30import { fileURLToPath } from 'url';

31import { execSync, execFileSync, spawn } from 'child_process';

32import { memoryDbPath, MOFLO_DIR, findProjectRoot } from './lib/moflo-paths.mjs';

High

Child Process

Package source references child process execution.

bin/generate-code-map.mjsView on unpkg · L30

33import { openBackend } from './lib/get-backend.mjs';

34import { applyIncrementalChunks, computeContentListHash } from './lib/incremental-write.mjs';

35import { resolveMofloBin } from './lib/resolve-bin.mjs';

38const __dirname = dirname(fileURLToPath(import.meta.url));

40const projectRoot = findProjectRoot();

41const NAMESPACE = 'code-map';

42const DB_PATH = memoryDbPath(projectRoot);

43const HASH_CACHE_PATH = resolve(projectRoot, MOFLO_DIR, 'code-map-hash.txt');

45// Directories to exclude from indexing

46const EXCLUDE_DIRS = [

47 'node_modules', 'dist', 'build', '.next', 'coverage',

48 '.claude', 'template', 'back-office-template',

49];

bin/hooks.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/**

3 * Cross-platform Claude Code hook runner

4 * Works on Windows (cmd/powershell) and Linux/WSL (bash)

5 *

High

Shell

Package source references shell execution.

bin/hooks.mjsView on unpkg · L3

6 * Usage: node .claude/scripts/hooks.mjs <hook-type> [args...]

7 *

8 * Hook types:

9 * pre-edit --file <path>

10 * post-edit --file <path> --success <bool>

11 * pre-command --command <cmd>

12 * post-command --command <cmd> --success <bool>

13 * pre-task --description <desc>

14 * post-task --task-id <id> --success <bool>

15 * session-start

16 * session-restore --session-id <id>

17 * route --task <prompt>

18 * index-guidance [--file <path>] [--force]

19 * daemon-start

20 */

22import { spawn } from 'child_process';

23import { existsSync, appendFileSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'fs';

dist/src/cli/guidance/analyzer.jsView file

Lines 2023-2063javascript

2023 },

2024 {

2025 id: 'refactor-consolidate-validators',

2026 description: 'Consolidate duplicate validation helpers',

2027 taskClass: 'refactor',

2028 prompt: 'Consolidate the duplicate assertion evaluation functions across analyzer and headless modules into a shared validation utility.',

2029 assertions: [

2030 { type: 'must-match-pattern', value: 'shared|common|util|helper', severity: 'major' },

2031 { type: 'must-contain', value: 'test', severity: 'major' },

2032 ],

2033 gatePatterns: [missingTestGate, destructiveGate, policyGate],

2034 },

2035 // ── Security (3 tasks) ────────────────────────────────────────────

2036 {

2037 id: 'security-cli-input-sanitize',

2038 description: 'Sanitize user input in CLI arguments',

2039 taskClass: 'security',

2040 prompt: 'Add input sanitization for all CLI arguments to prevent command injection. Never pass unsanitized user input to shell commands.',

2041 assertions: [

2042 { type: 'must-contain', value: 'sanitiz', severity: 'critical' },

2043 { type: 'must-match-pattern', value: 'escape|validate|regex|filter', severity: 'major' },

2044 { type: 'must-not-contain', value: 'eval(', severity: 'critical' },

2045 ],

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L2043

2046 gatePatterns: [destructiveGate, secretGate, policyGate],

2047 },

2048 {

2049 id: 'security-hmac-verification',

2050 description: 'Add HMAC verification to proof chain',

2051 taskClass: 'security',

2052 prompt: 'Implement HMAC-SHA256 verification for proof chain envelopes. Reject any envelope that fails signature verification.',

2053 assertions: [

2054 { type: 'must-match-pattern', value: 'hmac|sha256|verify|signature', severity: 'critical' },

2055 { type: 'must-contain', value: 'reject', severity: 'major' },

2056 ],

2057 gatePatterns: [secretGate, policyGate],

2058 },

2059 {

2060 id: 'security-secret-scanning',

2061 description: 'Implement secret scanning for committed files',

2062 taskClass: 'security',

2063 prompt: 'Build a secret scanner that detects hardcoded passwords, API keys, and credentials in staged files before commit.',

1284patternName = generic_password severity = medium line = 1284 matchedText = { type: ...' },

Medium

Secret Pattern

Hardcoded password in dist/src/cli/guidance/analyzer.js

dist/src/cli/guidance/analyzer.jsView on unpkg · L1284

2067patternName = generic_password severity = medium line = 2067 matchedText = { type: ...' },

Medium

Secret Pattern

Hardcoded password in dist/src/cli/guidance/analyzer.js

dist/src/cli/guidance/analyzer.jsView on unpkg · L2067

bin/run-migrations.mjsView file

Lines 41-81javascript

41 const manifest = listMigrations(projectRoot);

42 const keys = Object.keys(manifest);

43 if (keys.length === 0) {

44 console.log('(no migrations recorded)');

45 } else {

46 for (const key of keys) {

47 const m = manifest[key];

48 console.log(`${key}: ranAt=${m.ranAt} version=${m.version ?? '?'} details=${JSON.stringify(m.details ?? {})}`);

49 }

50 }

51 process.exit(0);

52}

54async function loadMigrations() {

55 const dir = resolve(__dirname, 'migrations');

56 if (!existsSync(dir)) return [];

57 const entries = readdirSync(dir).filter((f) => f.endsWith('.mjs'));

58 const loaded = [];

59 for (const f of entries) {

60 const url = pathToFileURL(resolve(dir, f)).href;

61 try {

62 const mod = await import(url);

63 if (mod && typeof mod.run === 'function' && typeof mod.name === 'string') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/run-migrations.mjsView on unpkg · L61

64 loaded.push(mod);

65 } else {

66 debug(`SKIP ${f} — missing { name, run } exports`);

67 }

68 } catch (err) {

69 debug(`SKIP ${f} — load error: ${err.message}`);

70 }

71 }

72 // Stable order: by `order` (default 0) ascending, then by `name`. A

73 // migration that depends on another should `export const order = N` with N

74 // larger than the dep's. readdirSync is filesystem-dependent across OSes,

75 // so explicit ordering is the only portable way to express dependencies.

76 loaded.sort((a, b) => {

77 const ao = typeof a.order === 'number' ? a.order : 0;

78 const bo = typeof b.order === 'number' ? b.order : 0;

79 if (ao !== bo) return ao - bo;

80 return a.name.localeCompare(b.name);

81 });

bin/lib/file-sync.mjsView file

Lines 1-21javascript

1/**

2 * Shared file-sync helper for the launcher (#854 §3) and the postinstall

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/file-sync.mjsView on unpkg · L1

3 * bootstrap (#857 / #975).

4 *

5 * Both layers used to inline the same retry/breaker + copy logic. They drifted

6 * once already (the bootstrap added hash-skip + atomic tmp+rename for #975

7 * while the launcher kept the bare copyFileSync), so this module is the single

8 * source of truth.

9 *

10 * Responsibilities:

11 * - hash-skip when src and dest are byte-identical (eliminates the dominant

12 * failure class — overwriting an unchanged file open by Claude/indexer).

13 * - atomic tmp + rename so concurrent readers never see a torn write.

14 * - post-write size verify to catch torn writes from AV mid-stream and

15 * partial DrvFs writes that returned success codes.

16 * - retry the transient error class (EBUSY/EPERM/EACCES + EVERIFY) with

17 * exponential backoff [50,200,800]ms.

18 * - circuit-break after CIRCUIT_BREAK_THRESHOLD distinct exhausted-retry

19 * failures so a sick host (AV mid-scan over node_modules) doesn't compound

20 * wall-clock cost.

21 *

dist/src/cli/services/daemon-service.jsView file

8* - Linux: systemd --user unit in ~/.config/systemd/user/ L9: * - Windows: Task Scheduler ONLOGON trigger via schtasks L10: */ ... L14: import { homedir } from 'os'; L15: import { execSync } from 'child_process'; L16: import { locateMofloCliBin } from './moflo-require.js'; ... L31: const resolvedRoot = resolve(projectRoot); L32: const platform = process.platform; L33: if (platform === 'darwin') { ... L93: const slug = projectRootSlug(projectRoot); L94: return join(homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.${slug}.plist`); L95: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/cli/services/daemon-service.jsView on unpkg · L8

dist/src/cli/update/executor.jsView file

62// Execute npm install L63: const installCmd = `npm install ${update.package}@${update.latestVersion} --save-exact`; L64: execSync(installCmd, { L65: encoding: 'utf-8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/update/executor.jsView on unpkg · L62

dist/src/cli/init/executor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = moflo@4.10.29 matchedIdentity = npm:bW9mbG8:4.10.29 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli/init/executor.jsView on unpkg

.claude/agents/core/reviewer.mdView file

81patternName = generic_password severity = medium line = 81 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in .claude/agents/core/reviewer.md

.claude/agents/core/reviewer.mdView on unpkg · L81

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/cli/guidance/manifest-validator.jsView file

702patternName = private_key_rsa severity = critical line = 702 matchedText = params: ...' },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/cli/guidance/manifest-validator.jsView on unpkg · L702

702patternName = private_key_rsa severity = critical line = 702 matchedText = params: ...' },

Critical

Secret Pattern

RSA private key in dist/src/cli/guidance/manifest-validator.js

dist/src/cli/guidance/manifest-validator.jsView on unpkg · L702

bin/generate-code-map.mjsView file

30import { fileURLToPath } from 'url'; L31: import { execSync, execFileSync, spawn } from 'child_process'; L32: import { memoryDbPath, MOFLO_DIR, findProjectRoot } from './lib/moflo-paths.mjs';

High

Child Process

Package source references child process execution.

bin/generate-code-map.mjsView on unpkg · L30

bin/hooks.mjsView file

3* Cross-platform Claude Code hook runner L4: * Works on Windows (cmd/powershell) and Linux/WSL (bash) L5: *

High

Shell

Package source references shell execution.

bin/hooks.mjsView on unpkg · L3

dist/src/cli/guidance/analyzer.jsView file

1284patternName = generic_password severity = medium line = 1284 matchedText = { type: ...' },

Medium

Secret Pattern

Hardcoded password in dist/src/cli/guidance/analyzer.js

dist/src/cli/guidance/analyzer.jsView on unpkg · L1284

2067patternName = generic_password severity = medium line = 2067 matchedText = { type: ...' },

Medium

Secret Pattern

Hardcoded password in dist/src/cli/guidance/analyzer.js

dist/src/cli/guidance/analyzer.jsView on unpkg · L2067

2043{ type: 'must-match-pattern', value: 'escape|validate|regex|filter', severity: 'major' }, L2044: { type: 'must-not-contain', value: 'eval(', severity: 'critical' }, L2045: ],

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L2043

bin/run-migrations.mjsView file

61try { L62: const mod = await import(url); L63: if (mod && typeof mod.run === 'function' && typeof mod.name === 'string') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/run-migrations.mjsView on unpkg · L61

bin/lib/file-sync.mjsView file

1/** L2: * Shared file-sync helper for the launcher (#854 §3) and the postinstall

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/file-sync.mjsView on unpkg · L1

dist/src/cli/services/daemon-service.jsView file

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/cli/services/daemon-service.jsView on unpkg · L8

dist/src/cli/update/executor.jsView file

62// Execute npm install L63: const installCmd = `npm install ${update.package}@${update.latestVersion} --save-exact`; L64: execSync(installCmd, { L65: encoding: 'utf-8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/update/executor.jsView on unpkg · L62

dist/src/cli/init/executor.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli/init/executor.jsView on unpkg

.claude/agents/core/reviewer.mdView file

81patternName = generic_password severity = medium line = 81 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in .claude/agents/core/reviewer.md

.claude/agents/core/reviewer.mdView on unpkg · L81

Findings

3 Critical4 High9 Medium7 Low

CriticalCritical Secretdist/src/cli/guidance/manifest-validator.js

CriticalPrevious Version Dangerous Deltadist/src/cli/init/executor.js

CriticalSecret Patterndist/src/cli/guidance/manifest-validator.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/generate-code-map.mjs

HighShellbin/hooks.mjs

HighRuntime Package Installdist/src/cli/update/executor.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/run-migrations.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/src/cli/services/daemon-service.js

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/src/cli/guidance/analyzer.js

MediumSecret Pattern.claude/agents/core/reviewer.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/src/cli/guidance/analyzer.js

LowWeak Cryptobin/lib/file-sync.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

95%Block

Verdict confidence

IntentDangerous Capability

TypeAI Agent Control Hijack

False-positive riskLow

Review stagesource_first_review

Static policyMatched malicious

Package metadata

npm

AuthorEric Cielo

Version4.11.1

PublishedJul 3, 2026

LicenseMIT

Dependencies10

Integrityverified

Package size1.95 MB

Files754

Keywordsmofloclaudeclaude-codeanthropicai-agentsagent-orchestrationmcpmodel-context-protocol

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/src/cli/index.jstypes → ./dist/src/cli/index.d.tsbin → claude-flow, flo, flo-codemap +6

Runtimenode >=22.0.0

Artifact7.94 MB · 754 files1 signature(s)

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

15 flagged

package.jsonView file

Lines 33-73json

33 "!**/__tests__/**",

34 ".claude/commands/**/*.md",

35 ".claude/agents/**/*.md",

36 ".claude/helpers/**",

37 ".claude/guidance/shipped/**",

38 ".claude/skills/**/*.md",

39 "!.claude/**/*.db",

40 "!.claude/**/*.map",

41 "README.md",

42 "LICENSE",

43 "retired-files.json",

44 "scripts/prune-native-binaries.mjs",

45 "scripts/post-install-notice.mjs",

46 "scripts/post-install-bootstrap.mjs"

47 ],

48 "scripts": {

49 "dev": "tsx watch src/cli/index.ts",

50 "prebuild": "node scripts/sync-version.mjs && node scripts/clean-dist.mjs",

51 "build": "tsc",

52 "prepublishOnly": "npm run build",

53 "postinstall": "node scripts/prune-native-binaries.mjs && node scripts/post-install-notice.mjs && node scripts/post-install-bootstrap.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "test": "node scripts/test-runner.mjs",

55 "test:ui": "vitest --ui",

56 "test:smoke": "node harness/consumer-smoke/run.mjs",

57 "test:smoke:populated": "node harness/consumer-smoke/run-populated.mjs",

58 "bench": "vitest run --config vitest.bench.config.ts",

59 "lint": "eslint src/ bin/ .claude/scripts/ --ext .ts,.tsx,.mts,.cts,.js,.mjs,.cjs --max-warnings 0",

60 "security:audit": "npm audit --omit=dev --audit-level high",

61 "security:fix": "npm audit fix",

62 "version": "node scripts/sync-version.mjs && git add src/cli/version.ts",

63 "flo": "node bin/cli.js"

64 },

65 "dependencies": {

66 "@anush008/tokenizers": "^0.6.0",

67 "@modelcontextprotocol/sdk": "^1.0.0",

68 "js-yaml": "^5.2.0",

69 "lru-cache": "^11.3.5",

70 "onnxruntime-node": "^1.27.0",

71 "semver": "^7.7.4",

72 "tar": "^7.5.16",

73 "valibot": "^1.3.1"

dist/src/cli/guidance/manifest-validator.jsView file

Lines 682-722javascript

682 // Trace 2: Secret detected and blocked

683 {

684 traceId: 'default-secret-blocked',

685 name: 'Secret detected and blocked',

686 description: 'Verifies that secrets in tool parameters are detected and blocked',

687 events: [

688 {

689 seq: 1,

690 eventType: 'tool-use',

691 payload: {

692 tool: 'Write',

693 params: { content: 'api_key = "sk-abc123456789012345678901234567890"' },

694 },

695 expectedOutcome: 'deny',

696 },

697 {

698 seq: 2,

699 eventType: 'tool-use',

700 payload: {

701 tool: 'Edit',

702 params: { content: '-----BEGIN RSA PRIVATE KEY-----' },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/cli/guidance/manifest-validator.jsView on unpkg · L702

703 },

704 expectedOutcome: 'deny',

705 },

706 ],

707 expectedDecisions: { '1': 'deny', '2': 'deny' },

708 expectedMemoryLineage: {},

709 },

710 // Trace 3: Budget exceeded and denied

711 {

712 traceId: 'default-budget-exceeded',

713 name: 'Budget exceeded and denied',

714 description: 'Verifies that operations exceeding budget limits are denied',

715 events: [

716 {

717 seq: 1,

718 eventType: 'budget-check',

719 payload: {

720 resource: 'toolCalls',

721 current: 999,

722 limit: 1000,

702patternName = private_key_rsa severity = critical line = 702 matchedText = params: ...' },

Critical

Secret Pattern

RSA private key in dist/src/cli/guidance/manifest-validator.js

dist/src/cli/guidance/manifest-validator.jsView on unpkg · L702

bin/generate-code-map.mjsView file

Lines 10-50javascript

10 * 5. file: — ONE PER FILE with exported types (file-level granularity)

11 *

12 * The `file:` entries are the key improvement — they enable precise semantic search

13 * for individual types, entities, and services instead of diluting results across

14 * large batches.

15 *

16 * Design: regex-based extraction (no AST parser), incremental via SHA-256 hash,

17 * stores in sql.js memory DB, triggers embedding generation in background.

18 *

19 * Usage:

20 * node node_modules/moflo/bin/generate-code-map.mjs # Incremental

21 * node node_modules/moflo/bin/generate-code-map.mjs --force # Full regenerate

22 * node node_modules/moflo/bin/generate-code-map.mjs --verbose # Detailed logging

23 * node node_modules/moflo/bin/generate-code-map.mjs --no-embeddings # Skip embedding generation

24 * node node_modules/moflo/bin/generate-code-map.mjs --stats # Print stats and exit

25 * flo-codemap # Via PATH

26 */

28import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from 'fs';

29import { resolve, dirname, relative, basename, extname } from 'path';

30import { fileURLToPath } from 'url';

31import { execSync, execFileSync, spawn } from 'child_process';

32import { memoryDbPath, MOFLO_DIR, findProjectRoot } from './lib/moflo-paths.mjs';

High

Child Process

Package source references child process execution.

bin/generate-code-map.mjsView on unpkg · L30

33import { openBackend } from './lib/get-backend.mjs';

34import { applyIncrementalChunks, computeContentListHash } from './lib/incremental-write.mjs';

35import { resolveMofloBin } from './lib/resolve-bin.mjs';

38const __dirname = dirname(fileURLToPath(import.meta.url));

40const projectRoot = findProjectRoot();

41const NAMESPACE = 'code-map';

42const DB_PATH = memoryDbPath(projectRoot);

43const HASH_CACHE_PATH = resolve(projectRoot, MOFLO_DIR, 'code-map-hash.txt');

45// Directories to exclude from indexing

46const EXCLUDE_DIRS = [

47 'node_modules', 'dist', 'build', '.next', 'coverage',

48 '.claude', 'template', 'back-office-template',

49];

bin/hooks.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/**

3 * Cross-platform Claude Code hook runner

4 * Works on Windows (cmd/powershell) and Linux/WSL (bash)

5 *

High

Shell

Package source references shell execution.

bin/hooks.mjsView on unpkg · L3

6 * Usage: node .claude/scripts/hooks.mjs <hook-type> [args...]

7 *

8 * Hook types:

9 * pre-edit --file <path>

10 * post-edit --file <path> --success <bool>

11 * pre-command --command <cmd>

12 * post-command --command <cmd> --success <bool>

13 * pre-task --description <desc>

14 * post-task --task-id <id> --success <bool>

15 * session-start

16 * session-restore --session-id <id>

17 * route --task <prompt>

18 * index-guidance [--file <path>] [--force]

19 * daemon-start

20 */

22import { spawn } from 'child_process';

23import { existsSync, appendFileSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'fs';

dist/src/cli/guidance/analyzer.jsView file

Lines 2023-2063javascript

2023 },

2024 {

2025 id: 'refactor-consolidate-validators',

2026 description: 'Consolidate duplicate validation helpers',

2027 taskClass: 'refactor',

2028 prompt: 'Consolidate the duplicate assertion evaluation functions across analyzer and headless modules into a shared validation utility.',

2029 assertions: [

2030 { type: 'must-match-pattern', value: 'shared|common|util|helper', severity: 'major' },

2031 { type: 'must-contain', value: 'test', severity: 'major' },

2032 ],

2033 gatePatterns: [missingTestGate, destructiveGate, policyGate],

2034 },

2035 // ── Security (3 tasks) ────────────────────────────────────────────

2036 {

2037 id: 'security-cli-input-sanitize',

2038 description: 'Sanitize user input in CLI arguments',

2039 taskClass: 'security',

2040 prompt: 'Add input sanitization for all CLI arguments to prevent command injection. Never pass unsanitized user input to shell commands.',

2041 assertions: [

2042 { type: 'must-contain', value: 'sanitiz', severity: 'critical' },

2043 { type: 'must-match-pattern', value: 'escape|validate|regex|filter', severity: 'major' },

2044 { type: 'must-not-contain', value: 'eval(', severity: 'critical' },

2045 ],

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli/guidance/analyzer.jsView on unpkg · L2043

2046 gatePatterns: [destructiveGate, secretGate, policyGate],

2047 },

2048 {

2049 id: 'security-hmac-verification',

2050 description: 'Add HMAC verification to proof chain',

2051 taskClass: 'security',

2052 prompt: 'Implement HMAC-SHA256 verification for proof chain envelopes. Reject any envelope that fails signature verification.',

2053 assertions: [

2054 { type: 'must-match-pattern', value: 'hmac|sha256|verify|signature', severity: 'critical' },

2055 { type: 'must-contain', value: 'reject', severity: 'major' },

2056 ],

2057 gatePatterns: [secretGate, policyGate],

2058 },

2059 {

2060 id: 'security-secret-scanning',

2061 description: 'Implement secret scanning for committed files',

2062 taskClass: 'security',

2063 prompt: 'Build a secret scanner that detects hardcoded passwords, API keys, and credentials in staged files before commit.',

1284patternName = generic_password severity = medium line = 1284 matchedText = { type: ...' },

Medium

Secret Pattern

Hardcoded password in dist/src/cli/guidance/analyzer.js

dist/src/cli/guidance/analyzer.jsView on unpkg · L1284

2067patternName = generic_password severity = medium line = 2067 matchedText = { type: ...' },

Medium

Secret Pattern

Hardcoded password in dist/src/cli/guidance/analyzer.js

dist/src/cli/guidance/analyzer.jsView on unpkg · L2067

bin/run-migrations.mjsView file

Lines 41-81javascript

41 const manifest = listMigrations(projectRoot);

42 const keys = Object.keys(manifest);

43 if (keys.length === 0) {

44 console.log('(no migrations recorded)');

45 } else {

46 for (const key of keys) {

47 const m = manifest[key];

48 console.log(`${key}: ranAt=${m.ranAt} version=${m.version ?? '?'} details=${JSON.stringify(m.details ?? {})}`);

49 }

50 }

51 process.exit(0);

52}

54async function loadMigrations() {

55 const dir = resolve(__dirname, 'migrations');

56 if (!existsSync(dir)) return [];

57 const entries = readdirSync(dir).filter((f) => f.endsWith('.mjs'));

58 const loaded = [];

59 for (const f of entries) {

60 const url = pathToFileURL(resolve(dir, f)).href;

61 try {

62 const mod = await import(url);

63 if (mod && typeof mod.run === 'function' && typeof mod.name === 'string') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/run-migrations.mjsView on unpkg · L61

64 loaded.push(mod);

65 } else {

66 debug(`SKIP ${f} — missing { name, run } exports`);

67 }

68 } catch (err) {

69 debug(`SKIP ${f} — load error: ${err.message}`);

70 }

71 }

72 // Stable order: by `order` (default 0) ascending, then by `name`. A

73 // migration that depends on another should `export const order = N` with N

74 // larger than the dep's. readdirSync is filesystem-dependent across OSes,

75 // so explicit ordering is the only portable way to express dependencies.

76 loaded.sort((a, b) => {

77 const ao = typeof a.order === 'number' ? a.order : 0;

78 const bo = typeof b.order === 'number' ? b.order : 0;

79 if (ao !== bo) return ao - bo;

80 return a.name.localeCompare(b.name);

81 });

bin/lib/file-sync.mjsView file

Lines 1-21javascript

1/**

2 * Shared file-sync helper for the launcher (#854 §3) and the postinstall

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/file-sync.mjsView on unpkg · L1

3 * bootstrap (#857 / #975).

4 *

5 * Both layers used to inline the same retry/breaker + copy logic. They drifted

6 * once already (the bootstrap added hash-skip + atomic tmp+rename for #975

7 * while the launcher kept the bare copyFileSync), so this module is the single

8 * source of truth.

9 *

10 * Responsibilities:

11 * - hash-skip when src and dest are byte-identical (eliminates the dominant

12 * failure class — overwriting an unchanged file open by Claude/indexer).

13 * - atomic tmp + rename so concurrent readers never see a torn write.

14 * - post-write size verify to catch torn writes from AV mid-stream and

15 * partial DrvFs writes that returned success codes.

16 * - retry the transient error class (EBUSY/EPERM/EACCES + EVERIFY) with

17 * exponential backoff [50,200,800]ms.

18 * - circuit-break after CIRCUIT_BREAK_THRESHOLD distinct exhausted-retry

19 * failures so a sick host (AV mid-scan over node_modules) doesn't compound

20 * wall-clock cost.

21 *

dist/src/cli/services/daemon-service.jsView file

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/cli/services/daemon-service.jsView on unpkg · L8

dist/src/cli/update/executor.jsView file

62// Execute npm install L63: const installCmd = `npm install ${update.package}@${update.latestVersion} --save-exact`; L64: execSync(installCmd, { L65: encoding: 'utf-8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/update/executor.jsView on unpkg · L62

dist/src/cli/init/executor.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli/init/executor.jsView on unpkg

.claude/agents/core/reviewer.mdView file

81patternName = generic_password severity = medium line = 81 matchedText = console....rd);

Medium

Secret Pattern

Hardcoded password in .claude/agents/core/reviewer.md

.claude/agents/core/reviewer.mdView on unpkg · L81