* fix(security): ADR-165 Phase 1 — close all critical CVEs, refresh registry, add CI gate Closes ADR-165 Phase 1. Both workspaces pass `npm audit --audit-level=critical`. ## Before (2026-06-29) | Workspace | Critical | High | Moderate | Total | |-----------|----------|------|----------|-------| | Root | **1** | 6 | 31 | 38 | | v3 | **4** | 33 | 57 | 97 | ## After | Workspace | Critical | High | Moderate | Total | |-----------|----------|------|----------|-------| | Root | **0** | 0 | 31 | 31 | | v3 | **0** | 27 | 58 | 88 | All 5 critical advisories closed (vitest GHSA-5xrq, handlebars prototype-pollution, protobufjs constructor-pollution, plus 2 more in v3). 12 of 39 high advisories closed via overrides; the remaining 27 v3 highs are deeper transitive chains that would require breaking-change major bumps — flagged for ADR-165 Phase 2. ## Changes ### Root workspace overrides (package.json) - `vitest`: `^1.0.0` → `^3.2.6` (closes critical GHSA-5xrq CVSS 9.8) - `hono`: `>=4.11.4` → `>=4.12.25` (closes 6 hono advisories) - `undici`: `>=7.18.0` → `>=8.5.0` (closes 7 undici advisories — bumps the stale pin that ADR-165 flagged as still-in-vulnerable-range) - `vite`: `>=6.4.6` → `>=8.0.16` (closes 2 vite advisories) - NEW `@grpc/grpc-js`: `>=1.14.4` - NEW `form-data`: `>=4.0.6` - NEW `http-proxy-middleware`: `>=3.0.7` - `@hono/node-server`: `>=1.19.10` → `>=1.19.14` ### v3 workspace overrides (v3/package.json + pnpm.overrides) - `vitest`: `^4.0.16` → `^4.1.0` (and `@vitest/coverage-v8` matched) - Top-level + pnpm overrides: `handlebars: >=4.7.9`, `protobufjs: >=8.6.0` - 27 sub-package `package.json` updated to `vitest ^4.1.0` ### CVE registry refresh (v3/@claude-flow/security/src/CVE-REMEDIATION.ts) Rewritten from 5 stale Jan-2026 entries to 16 total: 15 fixed, 1 open (ADR165-OPEN-01 — PII pipeline wiring per ADR-164 §6.1 not yet on dispatch-layer). `SECURITY_SUMMARY` is now computed dynamically from the registry; `validateRemediation()` correctly returns `allFixed: false` with 1 issue. ADR-165 §5 flagged this as THE Phase 2 priority — now closed. ### New CI gate `.github/workflows/cve-audit.yml`: - `audit-root` — `npm audit --audit-level=critical` in root, blocking - `audit-v3` — same in v3, blocking - `audit-high-report` — warn-only summary on high-severity drift - Triggers: PR, push to main, daily cron ### ADR-165 §9 evidence ledger addendum Captures AFTER-remediation `npm audit --json` metadata for both workspaces. The diff between BEFORE (already in §9) and AFTER makes Phase 1 verifiable. Also CORRECTED one prior surprise in §9: the `validate-input.ts` in `mcp-tools/` is NOT a 9-line shim. It's 269 lines of real implementation. (That was an inaccurate findings note from the initial audit.) ### §7.3 research items resolved - `protobufjs` v3 chain confirmed gone after override pins - `handlebars` v3 chain confirmed not user-reachable on the workflow path (toolchain-only; override sufficient) - `validate-input.ts` confirmed real implementation, not a shim (registry entry corrected) - CORS surface check: no `cors()` / `app.use(cors` call sites — the hono CORS-wildcard advisory is not exploitable on the current server - ADR-164 §6.1 PII pipeline NOT wired in current agentbbs dispatch — recorded as ADR165-OPEN-01 (Phase 3 work) ## Gates (all PASS) - `npm audit --audit-level=critical` root: exit 0 (was non-zero) - `npm audit --audit-level=critical` v3: exit 0 (was non-zero) - vitest suites: 105/109 pass (4 skip-conditional — same as before) - ADR-112 audit: 352/352 tools with guidance - business-pods smoke: 11/11 PASS - agentbbs smoke: 8/8 PASS - agenticow smoke: 8/8 PASS - cli build: clean (tsc) ## Phase 2+ deferred The 27 v3 high-severity advisories that remain are transitive chains with no patched-in-range version. ADR-165 §6 Phase 2 picks these up after the `cve-watch.yml` automation in §6 lands (NEW PR — not in scope here). Co-Authored-By: RuFlo <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01WbBa4nccx5aGhXphoHxcni * chore(lock): regen v3/pnpm-lock.yaml after override updates (PR #2508 CI fix) PR #2508 added handlebars + protobufjs to v3 overrides + bumped vitest pin, but v3/pnpm-lock.yaml wasn't regenerated. CI surfaced ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on every install step. Same pattern as the previous lockfile-drift fixes on PR #2500 and #2503. * fix(ci): cve-audit.yml jq-only + regen witness manifests for #1609 marker drift Two PR #2508 CI failures fixed: 1. Static-regression-guard tripped on cve-audit.yml line 52: the static YAML strict-parser sees `if high > 0:` inside the `run: |` block as a YAML block-mapping key indicator. Refactored all 3 inline-python blocks to use jq (preinstalled on ubuntu-latest) — no embedded `if x > 0:` lines, so the YAML guard passes. 2. Witness marker drift smoke flagged fix-marker #1609 — the Phase 1 vitest bump (4.0.16 → 4.1.0) drifted the cited marker string in v3/@claude-flow/aidefence/package.json. Updated `marker` field in all 3 platform manifests + `desc` to reference ADR-165 Phase 1, then re-signed via plugins/ruflo-core/scripts/witness/regen.mjs. Co-Authored-By: RuFlo <ruv@ruv.net>
@claude-flow/plugin-performance-optimizer
A comprehensive performance optimization plugin combining sparse inference for efficient trace analysis with graph neural networks for dependency chain optimization. The plugin enables intelligent bottleneck detection, memory leak identification, N+1 query detection, and bundle size optimization while providing explainable recommendations based on historical performance patterns.
Features
- Bottleneck Detection: Identify performance bottlenecks using GNN-based dependency analysis
- Memory Analysis: Detect memory leaks, retention chains, and GC pressure points
- Query Optimization: Detect N+1 queries, missing indexes, and slow joins
- Bundle Optimization: Analyze and optimize JavaScript bundle size with tree shaking and code splitting
- Configuration Optimization: Learn optimal configurations from workload patterns using SONA
Installation
npm
npm install @claude-flow/plugin-performance-optimizer
CLI
npx claude-flow plugins install --name @claude-flow/plugin-performance-optimizer
Quick Start
import { PerfOptimizerPlugin } from '@claude-flow/plugin-performance-optimizer';
// Initialize the plugin
const plugin = new PerfOptimizerPlugin();
await plugin.initialize();
// Detect performance bottlenecks
const bottlenecks = await plugin.detectBottlenecks({
traceData: {
format: 'otlp',
spans: traceSpans,
metrics: performanceMetrics
},
analysisScope: ['cpu', 'memory', 'database'],
threshold: {
latencyP95: 500, // 500ms
throughput: 1000,
errorRate: 0.01
}
});
console.log('Detected bottlenecks:', bottlenecks);
MCP Tools
1. perf/bottleneck-detect
Detect performance bottlenecks using GNN-based dependency analysis.
// Example usage via MCP
const result = await mcp.call('perf/bottleneck-detect', {
traceData: {
format: 'chrome_devtools',
spans: chromeTraceSpans,
metrics: { renderTime: 150, scriptTime: 200 }
},
analysisScope: ['cpu', 'render', 'network'],
threshold: {
latencyP95: 100,
throughput: 60
}
});
Returns: List of identified bottlenecks with severity, location, and recommended fixes.
2. perf/memory-analyze
Analyze memory usage patterns and detect potential leaks.
const result = await mcp.call('perf/memory-analyze', {
heapSnapshot: '/path/to/heap-snapshot.heapsnapshot',
timeline: memoryTimelineData,
analysis: ['leak_detection', 'retention_analysis', 'gc_pressure'],
compareBaseline: '/path/to/baseline-snapshot.heapsnapshot'
});
Returns: Memory analysis report with leak candidates, retention chains, and optimization suggestions.
3. perf/query-optimize
Detect N+1 queries and suggest database optimizations.
const result = await mcp.call('perf/query-optimize', {
queries: [
{ sql: 'SELECT * FROM users WHERE id = ?', duration: 5, resultSize: 1 },
{ sql: 'SELECT * FROM orders WHERE user_id = ?', duration: 3, resultSize: 10 }
],
patterns: ['n_plus_1', 'missing_index', 'slow_join'],
suggestIndexes: true
});
Returns: Detected query anti-patterns with suggested batch alternatives and index recommendations.
4. perf/bundle-optimize
Analyze and optimize JavaScript bundle size.
const result = await mcp.call('perf/bundle-optimize', {
bundleStats: '/path/to/webpack-stats.json',
analysis: ['tree_shaking', 'code_splitting', 'duplicate_deps', 'large_modules'],
targets: {
maxSize: 250, // 250KB
maxChunks: 10
}
});
Returns: Bundle analysis with optimization recommendations for tree shaking, code splitting, and dependency deduplication.
5. perf/config-optimize
Suggest optimal configurations based on workload patterns using SONA learning.
const result = await mcp.call('perf/config-optimize', {
workloadProfile: {
type: 'api',
metrics: { requestsPerSecond: 1000, avgLatency: 50 },
constraints: { maxMemory: '4GB', maxCpu: 4 }
},
configSpace: {
poolSize: { type: 'number', range: [10, 100], current: 25 },
cacheSize: { type: 'number', range: [100, 1000], current: 200 }
},
objective: 'latency'
});
Returns: Optimized configuration values with expected performance improvements.
Configuration Options
interface PerfOptimizerConfig {
// WASM memory limit (default: 2GB)
memoryLimit: number;
// Analysis timeout in seconds (default: 300)
analysisTimeout: number;
// Enable SONA learning for configuration optimization
enableSONALearning: boolean;
// Supported trace formats
supportedFormats: ('otlp' | 'chrome_devtools' | 'jaeger' | 'zipkin')[];
// Performance thresholds for alerting
thresholds: {
latencyP95: number;
throughput: number;
errorRate: number;
};
}
Performance Targets
| Metric | Target | Improvement vs Baseline |
|---|---|---|
| Trace analysis (1M spans) | <5s | 24x faster |
| Memory analysis (1GB heap) | <30s | 10x faster |
| Query pattern detection (10K queries) | <1s | 600x faster |
| Bundle analysis (10MB) | <10s | 6x faster |
| Config optimization | <1min convergence | 1440x+ faster |
Security Considerations
- Trace Data Sanitization: Automatically sanitizes sensitive data (passwords, tokens, cookies) from trace data before processing
- Query Parse-Only: SQL queries are parsed and analyzed but never executed
- WASM Sandboxing: All analysis runs in isolated WASM sandbox with 2GB memory limit and no network access
- Path Validation: Bundle stats paths are validated to prevent path traversal attacks
- Input Validation: All inputs validated with Zod schemas to prevent injection attacks
- No Code Execution: Performance suggestions are recommendations only - no automatic code modification
WASM Security Constraints
| Constraint | Value | Rationale |
|---|---|---|
| Memory Limit | 2GB max | Handle large trace datasets |
| CPU Time Limit | 300 seconds | Allow deep performance analysis |
| No Network Access | Enforced | Prevent data exfiltration |
| No File System Write | Enforced | Read-only analysis mode |
| Sandboxed Paths | Validated prefixes only | Prevent path traversal |
Input Limits
| Input | Limit |
|---|---|
| Max spans per trace | 1,000,000 |
| Max query size | 10KB |
| Max queries per batch | 10,000 |
| Max heap snapshot size | 1GB |
| Max bundle stats size | 50MB |
| CPU time limit | 300 seconds |
Rate Limiting
const rateLimits = {
'perf/bottleneck-detect': { requestsPerMinute: 10, maxConcurrent: 2 },
'perf/memory-analyze': { requestsPerMinute: 5, maxConcurrent: 1 },
'perf/query-optimize': { requestsPerMinute: 30, maxConcurrent: 3 },
'perf/bundle-optimize': { requestsPerMinute: 10, maxConcurrent: 2 },
'perf/config-optimize': { requestsPerMinute: 5, maxConcurrent: 1 }
};
Dependencies
ruvector-sparse-inference-wasm- Efficient sparse performance trace processingruvector-gnn-wasm- Dependency chain analysis and critical path detectionmicro-hnsw-wasm- Similar performance pattern matchingruvector-fpga-transformer-wasm- Fast transformer inference for trace analysissona- Learning optimal configurations from historical data
Supported Formats
| Category | Formats |
|---|---|
| Tracing | OpenTelemetry, Jaeger, Zipkin, Chrome DevTools |
| Profiling | Chrome CPU Profile, Node.js Profile, pprof |
| Memory | Chrome Heap Snapshot, Node.js Heap |
| Bundles | Webpack Stats, Vite Stats, Rollup |
Related Plugins
| Plugin | Description | Use Case |
|---|---|---|
| @claude-flow/plugin-code-intelligence | Code analysis | Identify code causing performance issues |
| @claude-flow/plugin-test-intelligence | Test optimization | Performance regression test selection |
| @claude-flow/plugin-financial-risk | Risk analysis | Trading system latency optimization |
License
MIT License
Copyright (c) 2026 Claude Flow
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.