mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-09-14 14:01:28 +08:00
rUv
f074987ea0
Implements all 3 phases of ADR-377 (ruvnet/ruflo#2516, tracked in #2873): AgentDB's retrieval and write paths had zero certified defenses against memory poisoning — SMSR (arXiv:2606.12703) shows 93-100% undefended attack success. All three phases are off by default; enabling each is opt-in via env flag until independently benchmarked, per the ADR's own gate criteria. Phase 1 — AgentDbRetrievalGuard (@claude-flow/memory) - New `agentdb-retrieval-guard.ts`, wired into `AgentDBBackend.search()` (covers `query()`'s semantic path too, since it calls `search()` internally). Reuses `@claude-flow/security`'s `ToolOutputGuardrail` (ADR-131) for the actual OWASP LLM01/LLM08 pattern scan rather than duplicating it — `@claude-flow/memory` now depends on `@claude-flow/security` (no cycle: security has zero workspace deps). - Size gate + guardrail scan per retrieved chunk. Flag-only by default; `CLAUDE_FLOW_RETRIEVAL_GUARD_STRICT=true` drops unsafe/oversized chunks instead of just annotating them. Both flags off by default (`CLAUDE_FLOW_RETRIEVAL_GUARD=true` to enable scanning at all). Phase 2 — MemoryPoisonForensics (@claude-flow/hooks) - New `workers/memory-poison-forensics.ts`: rolling-window z-score anomaly detection on write-interval and content-length features per (agentId, namespace), reproducing the Forensic Trajectory Signatures (arXiv:2606.30566) shape (behavioral features on write *sequences*, not content). Opt-in `HookEvent.PostToolUse` handler for memory-write tools; `CLAUDE_FLOW_POISON_FORENSICS=0` disables recording. - NOT wired into any of this repo's three separate "worker" dispatch systems (hooks' own workers/index.ts codebase-analyzers, @claude-flow/swarm's worker-dispatch.ts 12-trigger table, or the CLI's scheduled daemon) — @claude-flow/swarm is a deliberately zero-workspace-dependency package and adding hooks there would break that property; picking the wrong one of three ambiguous dispatch tables seemed worse than leaving that integration as an explicit follow-up. See the file header for detail. Phase 3 — McpCallerIdentity (@claude-flow/security) - New `mcp-caller-identity.ts`: per-invocation Ed25519-signed capability tokens (callerId + toolName + nonce + 30s TTL by default), native node:crypto sign/verify following the same pattern already used by `@claude-flow/browser`'s witness-signer.ts (reimplemented rather than cross-imported — a security-primitives module depending on the browser package would be a backwards layering dependency). - Standalone issue/verify API; deliberately NOT wired into `AgentAuthorizationPropagator.checkToolCall` (ADR-144) or any tool dispatcher — this repo has at least 3 distinct `ToolRegistry` implementations and guessing which is authoritative risked silently wiring the wrong path. `CLAUDE_FLOW_MCP_CALLER_AUTH` defaults to disabled, matching the ADR's own text: key distribution needs a follow-on ADR before this ships enabled. Deviations from the ADR's guessed file paths/class names (documented inline where relevant): the ADR was written against aspirational paths (`agentdb/retrieval-guard.ts`, a `BackgroundWorker` interface, `SafeExecutor`) that don't match the real repo layout — implementation targets the actual `AgentDBBackend`, the actual worker systems, and the actual `AgentAuthorizationPropagator`/tool-registries respectively. Tests: 31 new tests across the three packages (9 + 11 + 11), all passing; full existing suites re-run clean (memory 451, hooks 145, security 570 — zero regressions).