Files
rUv 402b701a9d fix(security): ADR-165 Phase 1 — close 5 critical CVEs + refresh registry + audit CI gate (#2508)
* fix(security): ADR-165 Phase 1 — close all critical CVEs, refresh registry, add CI gate

Closes ADR-165 Phase 1. Both workspaces pass `npm audit --audit-level=critical`.

## Before (2026-06-29)

| Workspace | Critical | High | Moderate | Total |
|-----------|----------|------|----------|-------|
| Root      | **1**    | 6    | 31       | 38    |
| v3        | **4**    | 33   | 57       | 97    |

## After

| Workspace | Critical | High | Moderate | Total |
|-----------|----------|------|----------|-------|
| Root      | **0**    | 0    | 31       | 31    |
| v3        | **0**    | 27   | 58       | 88    |

All 5 critical advisories closed (vitest GHSA-5xrq, handlebars prototype-pollution,
protobufjs constructor-pollution, plus 2 more in v3). 12 of 39 high advisories
closed via overrides; the remaining 27 v3 highs are deeper transitive chains
that would require breaking-change major bumps — flagged for ADR-165 Phase 2.

## Changes

### Root workspace overrides (package.json)

- `vitest`: `^1.0.0` → `^3.2.6` (closes critical GHSA-5xrq CVSS 9.8)
- `hono`: `>=4.11.4` → `>=4.12.25` (closes 6 hono advisories)
- `undici`: `>=7.18.0` → `>=8.5.0` (closes 7 undici advisories — bumps the
  stale pin that ADR-165 flagged as still-in-vulnerable-range)
- `vite`: `>=6.4.6` → `>=8.0.16` (closes 2 vite advisories)
- NEW `@grpc/grpc-js`: `>=1.14.4`
- NEW `form-data`: `>=4.0.6`
- NEW `http-proxy-middleware`: `>=3.0.7`
- `@hono/node-server`: `>=1.19.10` → `>=1.19.14`

### v3 workspace overrides (v3/package.json + pnpm.overrides)

- `vitest`: `^4.0.16` → `^4.1.0` (and `@vitest/coverage-v8` matched)
- Top-level + pnpm overrides: `handlebars: >=4.7.9`, `protobufjs: >=8.6.0`
- 27 sub-package `package.json` updated to `vitest ^4.1.0`

### CVE registry refresh (v3/@claude-flow/security/src/CVE-REMEDIATION.ts)

Rewritten from 5 stale Jan-2026 entries to 16 total: 15 fixed, 1 open
(ADR165-OPEN-01 — PII pipeline wiring per ADR-164 §6.1 not yet on
dispatch-layer). `SECURITY_SUMMARY` is now computed dynamically from the
registry; `validateRemediation()` correctly returns `allFixed: false`
with 1 issue. ADR-165 §5 flagged this as THE Phase 2 priority — now closed.

### New CI gate

`.github/workflows/cve-audit.yml`:
- `audit-root` — `npm audit --audit-level=critical` in root, blocking
- `audit-v3` — same in v3, blocking
- `audit-high-report` — warn-only summary on high-severity drift
- Triggers: PR, push to main, daily cron

### ADR-165 §9 evidence ledger addendum

Captures AFTER-remediation `npm audit --json` metadata for both workspaces.
The diff between BEFORE (already in §9) and AFTER makes Phase 1 verifiable.

Also CORRECTED one prior surprise in §9: the `validate-input.ts` in
`mcp-tools/` is NOT a 9-line shim. It's 269 lines of real implementation.
(That was an inaccurate findings note from the initial audit.)

### §7.3 research items resolved

- `protobufjs` v3 chain confirmed gone after override pins
- `handlebars` v3 chain confirmed not user-reachable on the workflow path
  (toolchain-only; override sufficient)
- `validate-input.ts` confirmed real implementation, not a shim (registry
  entry corrected)
- CORS surface check: no `cors()` / `app.use(cors` call sites — the hono
  CORS-wildcard advisory is not exploitable on the current server
- ADR-164 §6.1 PII pipeline NOT wired in current agentbbs dispatch —
  recorded as ADR165-OPEN-01 (Phase 3 work)

## Gates (all PASS)

- `npm audit --audit-level=critical` root: exit 0 (was non-zero)
- `npm audit --audit-level=critical` v3:   exit 0 (was non-zero)
- vitest suites: 105/109 pass (4 skip-conditional — same as before)
- ADR-112 audit: 352/352 tools with guidance
- business-pods smoke: 11/11 PASS
- agentbbs smoke: 8/8 PASS
- agenticow smoke: 8/8 PASS
- cli build: clean (tsc)

## Phase 2+ deferred

The 27 v3 high-severity advisories that remain are transitive chains with
no patched-in-range version. ADR-165 §6 Phase 2 picks these up after the
`cve-watch.yml` automation in §6 lands (NEW PR — not in scope here).

Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_01WbBa4nccx5aGhXphoHxcni

* chore(lock): regen v3/pnpm-lock.yaml after override updates (PR #2508 CI fix)

PR #2508 added handlebars + protobufjs to v3 overrides + bumped vitest pin,
but v3/pnpm-lock.yaml wasn't regenerated. CI surfaced
ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on every install step.

Same pattern as the previous lockfile-drift fixes on PR #2500 and #2503.

* fix(ci): cve-audit.yml jq-only + regen witness manifests for #1609 marker drift

Two PR #2508 CI failures fixed:

1. Static-regression-guard tripped on cve-audit.yml line 52: the static
   YAML strict-parser sees `if high > 0:` inside the `run: |` block as
   a YAML block-mapping key indicator. Refactored all 3 inline-python
   blocks to use jq (preinstalled on ubuntu-latest) — no embedded
   `if x > 0:` lines, so the YAML guard passes.

2. Witness marker drift smoke flagged fix-marker #1609 — the Phase 1
   vitest bump (4.0.16 → 4.1.0) drifted the cited marker string in
   v3/@claude-flow/aidefence/package.json. Updated `marker` field in
   all 3 platform manifests + `desc` to reference ADR-165 Phase 1, then
   re-signed via plugins/ruflo-core/scripts/witness/regen.mjs.

Co-Authored-By: RuFlo <ruv@ruv.net>
2026-06-29 22:41:24 -04:00
..

@claude-flow/plugin-performance-optimizer

npm version npm downloads License: MIT

A comprehensive performance optimization plugin combining sparse inference for efficient trace analysis with graph neural networks for dependency chain optimization. The plugin enables intelligent bottleneck detection, memory leak identification, N+1 query detection, and bundle size optimization while providing explainable recommendations based on historical performance patterns.

Features

  • Bottleneck Detection: Identify performance bottlenecks using GNN-based dependency analysis
  • Memory Analysis: Detect memory leaks, retention chains, and GC pressure points
  • Query Optimization: Detect N+1 queries, missing indexes, and slow joins
  • Bundle Optimization: Analyze and optimize JavaScript bundle size with tree shaking and code splitting
  • Configuration Optimization: Learn optimal configurations from workload patterns using SONA

Installation

npm

npm install @claude-flow/plugin-performance-optimizer

CLI

npx claude-flow plugins install --name @claude-flow/plugin-performance-optimizer

Quick Start

import { PerfOptimizerPlugin } from '@claude-flow/plugin-performance-optimizer';

// Initialize the plugin
const plugin = new PerfOptimizerPlugin();
await plugin.initialize();

// Detect performance bottlenecks
const bottlenecks = await plugin.detectBottlenecks({
  traceData: {
    format: 'otlp',
    spans: traceSpans,
    metrics: performanceMetrics
  },
  analysisScope: ['cpu', 'memory', 'database'],
  threshold: {
    latencyP95: 500,  // 500ms
    throughput: 1000,
    errorRate: 0.01
  }
});

console.log('Detected bottlenecks:', bottlenecks);

MCP Tools

1. perf/bottleneck-detect

Detect performance bottlenecks using GNN-based dependency analysis.

// Example usage via MCP
const result = await mcp.call('perf/bottleneck-detect', {
  traceData: {
    format: 'chrome_devtools',
    spans: chromeTraceSpans,
    metrics: { renderTime: 150, scriptTime: 200 }
  },
  analysisScope: ['cpu', 'render', 'network'],
  threshold: {
    latencyP95: 100,
    throughput: 60
  }
});

Returns: List of identified bottlenecks with severity, location, and recommended fixes.

2. perf/memory-analyze

Analyze memory usage patterns and detect potential leaks.

const result = await mcp.call('perf/memory-analyze', {
  heapSnapshot: '/path/to/heap-snapshot.heapsnapshot',
  timeline: memoryTimelineData,
  analysis: ['leak_detection', 'retention_analysis', 'gc_pressure'],
  compareBaseline: '/path/to/baseline-snapshot.heapsnapshot'
});

Returns: Memory analysis report with leak candidates, retention chains, and optimization suggestions.

3. perf/query-optimize

Detect N+1 queries and suggest database optimizations.

const result = await mcp.call('perf/query-optimize', {
  queries: [
    { sql: 'SELECT * FROM users WHERE id = ?', duration: 5, resultSize: 1 },
    { sql: 'SELECT * FROM orders WHERE user_id = ?', duration: 3, resultSize: 10 }
  ],
  patterns: ['n_plus_1', 'missing_index', 'slow_join'],
  suggestIndexes: true
});

Returns: Detected query anti-patterns with suggested batch alternatives and index recommendations.

4. perf/bundle-optimize

Analyze and optimize JavaScript bundle size.

const result = await mcp.call('perf/bundle-optimize', {
  bundleStats: '/path/to/webpack-stats.json',
  analysis: ['tree_shaking', 'code_splitting', 'duplicate_deps', 'large_modules'],
  targets: {
    maxSize: 250,  // 250KB
    maxChunks: 10
  }
});

Returns: Bundle analysis with optimization recommendations for tree shaking, code splitting, and dependency deduplication.

5. perf/config-optimize

Suggest optimal configurations based on workload patterns using SONA learning.

const result = await mcp.call('perf/config-optimize', {
  workloadProfile: {
    type: 'api',
    metrics: { requestsPerSecond: 1000, avgLatency: 50 },
    constraints: { maxMemory: '4GB', maxCpu: 4 }
  },
  configSpace: {
    poolSize: { type: 'number', range: [10, 100], current: 25 },
    cacheSize: { type: 'number', range: [100, 1000], current: 200 }
  },
  objective: 'latency'
});

Returns: Optimized configuration values with expected performance improvements.

Configuration Options

interface PerfOptimizerConfig {
  // WASM memory limit (default: 2GB)
  memoryLimit: number;

  // Analysis timeout in seconds (default: 300)
  analysisTimeout: number;

  // Enable SONA learning for configuration optimization
  enableSONALearning: boolean;

  // Supported trace formats
  supportedFormats: ('otlp' | 'chrome_devtools' | 'jaeger' | 'zipkin')[];

  // Performance thresholds for alerting
  thresholds: {
    latencyP95: number;
    throughput: number;
    errorRate: number;
  };
}

Performance Targets

Metric Target Improvement vs Baseline
Trace analysis (1M spans) <5s 24x faster
Memory analysis (1GB heap) <30s 10x faster
Query pattern detection (10K queries) <1s 600x faster
Bundle analysis (10MB) <10s 6x faster
Config optimization <1min convergence 1440x+ faster

Security Considerations

  • Trace Data Sanitization: Automatically sanitizes sensitive data (passwords, tokens, cookies) from trace data before processing
  • Query Parse-Only: SQL queries are parsed and analyzed but never executed
  • WASM Sandboxing: All analysis runs in isolated WASM sandbox with 2GB memory limit and no network access
  • Path Validation: Bundle stats paths are validated to prevent path traversal attacks
  • Input Validation: All inputs validated with Zod schemas to prevent injection attacks
  • No Code Execution: Performance suggestions are recommendations only - no automatic code modification

WASM Security Constraints

Constraint Value Rationale
Memory Limit 2GB max Handle large trace datasets
CPU Time Limit 300 seconds Allow deep performance analysis
No Network Access Enforced Prevent data exfiltration
No File System Write Enforced Read-only analysis mode
Sandboxed Paths Validated prefixes only Prevent path traversal

Input Limits

Input Limit
Max spans per trace 1,000,000
Max query size 10KB
Max queries per batch 10,000
Max heap snapshot size 1GB
Max bundle stats size 50MB
CPU time limit 300 seconds

Rate Limiting

const rateLimits = {
  'perf/bottleneck-detect': { requestsPerMinute: 10, maxConcurrent: 2 },
  'perf/memory-analyze': { requestsPerMinute: 5, maxConcurrent: 1 },
  'perf/query-optimize': { requestsPerMinute: 30, maxConcurrent: 3 },
  'perf/bundle-optimize': { requestsPerMinute: 10, maxConcurrent: 2 },
  'perf/config-optimize': { requestsPerMinute: 5, maxConcurrent: 1 }
};

Dependencies

  • ruvector-sparse-inference-wasm - Efficient sparse performance trace processing
  • ruvector-gnn-wasm - Dependency chain analysis and critical path detection
  • micro-hnsw-wasm - Similar performance pattern matching
  • ruvector-fpga-transformer-wasm - Fast transformer inference for trace analysis
  • sona - Learning optimal configurations from historical data

Supported Formats

Category Formats
Tracing OpenTelemetry, Jaeger, Zipkin, Chrome DevTools
Profiling Chrome CPU Profile, Node.js Profile, pprof
Memory Chrome Heap Snapshot, Node.js Heap
Bundles Webpack Stats, Vite Stats, Rollup
Plugin Description Use Case
@claude-flow/plugin-code-intelligence Code analysis Identify code causing performance issues
@claude-flow/plugin-test-intelligence Test optimization Performance regression test selection
@claude-flow/plugin-financial-risk Risk analysis Trading system latency optimization

License

MIT License

Copyright (c) 2026 Claude Flow

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.