v5.15.1 - Security Patch

Fixes two high-severity vulnerabilities reported against the v5.14.0/v5.15.0 ecosystem-expansion and context-composer features shipped in the last two releases. Both are validator/executor representation mismatches (CWE-436, CWE-863) - a security gate matched one string form while the actual executor ran a different, derived form.

GHSA-743h-jr5x-mpcr - ClaudeHookBridge deny-pattern bypass via truncation before the security decision (High)

extractTarget() truncated the string evaluated against denyPatterns/allowPatterns to 500 characters, while Claude Code always executes the complete, untruncated tool input. Dangerous content positioned past byte 500 (trivially achievable via leading padding) was invisible to the operator's hard-deny list yet still ran. In the default observe mode, denyPatterns is the sole hard block, so this was a complete bypass.

Fixed: deny/allow pattern matching now runs against the full, untruncated target (extractFullTarget()). A new maxTargetLength option (default 65,536 chars) denies oversized targets outright instead of matching against them, closing the bypass and bounding regex evaluation cost. Truncation (truncateForDisplay()) is applied only afterward, for audit-log/reason-text display.

GHSA-9v4f-j8cv-fhxw - SandboxPolicy blocklist/approval-gate bypass via quote/whitespace mismatch (High)

isCommandAllowed's blocklist/allowlist glob, requiresApproval, and assessRisk matched the raw, quote-and-whitespace-preserving command string, while the executor tokenizes the command (stripping quotes, collapsing whitespace) before spawn(..., { shell: false }). A compromised/constrained agent could quote a destructive command (rm -rf '/') to defeat the blocklist's flagship recursive-delete entry, or quote a gated command (git "push" origin main) to skip the human approval gate - both executing identically to their unquoted form. Same validator/executor mismatch class as GHSA-qw6v-5fcf-5666, on a distinct code path that fix did not cover.

Fixed: isCommandAllowed, requiresApproval, and assessRisk now all match against a canonicalized form (parseCommandLine -> argv.join(' ')) - the exact representation the executor runs - via a new shared canonicalize() helper. requiresApproval/assessRisk fail closed (require approval / assess high risk) when a command cannot be safely canonicalized.

Testing

• New test-phase20.ts (35 assertions) reproduces both published PoCs verbatim, plus oversized-target fail-closed behavior, audit-display truncation, a whitespace-variant bypass check, and normal-command non-regression checks.
• Full suite: 3,638 tests passing across 41 suites; tsc --noEmit clean.

Docs

Version bump across all 17 tracked files, including two that had drifted stale across the last two releases (BENCHMARKS.md, AUDIT_LOG_SCHEMA.md). THREAT_MODEL.md Security Controls Summary table updated with both new mitigations.

v5.15.0 — Context Signal-Over-Noise

Agents have large context windows, but their effective reasoning window is smaller: irrelevant, stale, or noisy context degrades output quality long before the hard token limit ("context rot"). This release makes curated context a first-class primitive.

ContextComposer (lib/context-composer.ts)

Token-budgeted, relevance-ranked context assembly for any LLM call:

• Ranking — every candidate entry is scored by relevance (pluggable BYOE SemanticRanker with a deterministic lexical-overlap fallback) x recency (exponential half-life decay) x scope affinity (ContextThrottler tag semantics).
• Hard token budget — enforced via the new zero-dependency estimateTokens() heuristic; over-budget items are excluded with reasons.
• Pinned sources — task-critical instructions and Layer-3 project context always lead the pack.
• Staleness — TTL-expired entries are dropped automatically.
• Position-aware layout — strongest items placed first and last ("lost in the middle" mitigation), serpentine ordering in between.
• Full observability — included/excluded lists with per-item scores, token costs, and budget utilization.
• createSemanticMemoryRanker() adapts an existing SemanticMemory; ContextComposer.fromSnapshot() converts blackboard snapshots.

Two new MCP tools (lib/mcp-tools-context.ts, registered by default — 24 tools total)

• context_pack — "give me everything relevant to task X in <= N tokens": one call returns a curated, ranked, budget-enforced context brief from the agent's scoped blackboard snapshot. Use instead of blackboard_list + many blackboard_read calls.
• blackboard_search — ranked top-K search over blackboard entries; semantic when a SemanticMemory is wired, lexical otherwise (mode reported in the response).

Works out of the box in Claude Code, OpenAI Codex, Gemini CLI, Cursor, and any other MCP client.

Testing

• New test-phase19.ts (78 assertions): token estimation, ranking/budget/pinning/staleness/serpentine layout, semantic-ranker integration + failure fallback, both MCP tools including scoped snapshots and argument validation.
• Full suite: 3,603 tests passing across 40 suites; tsc --noEmit clean.

Docs

• README: context feature bullet, MCP tools list, test table, Gemini CLI callout, AGENTS.md row.
• Consistency sweep: stale test counts fixed in CONTRIBUTING.md and SUPPLY_CHAIN.md; claude-project-prompt.md banner updated; SECURITY.md supported-versions tables move 5.15.x to current.

v5.14.0 — Ecosystem Expansion

Making Network-AI the neutral coordination layer for every major agent ecosystem: Claude, OpenAI, Gemini, and OpenClaw.

New Adapters (29 → 32)

• GeminiAdapter — Google Gemini Developer API (AI Studio) as swarm agents: BYOC @google/genai-compatible client or built-in fetch with GEMINI_API_KEY; system instructions, generation config, thinking budgets. Complements the enterprise VertexAIAdapter.
• OpenAIResponsesAdapter — OpenAI Responses API (POST /v1/responses), the successor to the deprecated Assistants API: instructions, max_output_tokens, temperature, and reasoning-effort control (minimal/low/medium/high).
• ClaudeAgentSDKAdapter — runs full Claude Agent SDK agentic loops (query()) as swarm agents, strictly BYOC: surfaces session id, turn count, cost, and usage; streams intermediate messages via onMessage.

Cross-Vendor Governance

• ClaudeHookBridge + network-ai hook CLI (lib/claude-hooks.ts) — gate any hook-capable coding agent (Claude Code PreToolUse/PostToolUse) through AuthGuardian. observe mode audits every tool call to data/hooks_audit.jsonl; enforce mode maps tools to resource types (Bash -> SHELL_EXEC, Write/Edit -> FILE_SYSTEM, WebFetch/mcp__* -> EXTERNAL_SERVICE) and requires a weighted permission grant. --deny/--allow patterns take precedence. Config template: examples/claude-code-hooks.json.
• MCP elicitation (lib/mcp-elicitation.ts) — approval prompts rendered natively inside the MCP client (Claude Code, Codex, Gemini CLI, Cursor): StdioElicitationChannel + createElicitationApprovalCallback() adapt the round-trip into an ApprovalCallback for ApprovalGate — fail-closed on decline, cancel, timeout, and transport errors.
• A2AServer (lib/a2a-server.ts) — expose the orchestrator as a Google A2A (Agent2Agent) agent: Agent Card at /.well-known/agent.json plus tasks/send / tasks/get / tasks/cancel JSON-RPC; optional Bearer secret (fail closed), 127.0.0.1 default bind, body-size caps.

New Install Surfaces

• Gemini CLI extension — gemini extensions install https://github.com/Jovancoding/Network-AI (new gemini-extension.json + GEMINI.md context file).
• Claude Code plugin slash commands — /network-ai:status, /network-ai:budget, /network-ai:audit, /network-ai:blackboard.
• AGENTS.md — cross-vendor agent instructions (Codex, Gemini CLI, Cursor, Factory, and other AGENTS.md-compatible tools).
• server.json — MCP Registry manifest (io.github.jovancoding/network-ai).

Testing

• New test-phase18.ts (85 assertions): hook bridge observe/enforce/deny-allow/parsing, elicitation channel routing + fail-closed approval mapping, A2A server card/tasks/auth/eviction.
• Adapter suite grows to 271 assertions with the three new adapters.
• Full suite: 3,525 tests passing across 39 suites; tsc --noEmit clean.

Security Fixes

GHSA-m4jg-6w3q-gm86 — ApprovalInbox read routes unauthenticated + wildcard CORS (High, CWE-862, CWE-352)

The v5.12.2 secret / checkAuth() gate covered only the two mutating routes (POST /approve, POST /deny), leaving GET /, GET /stats, GET /sse, and GET /:id unauthenticated even when a secret was configured, disclosing queued high-risk action content. The handler also hardcoded Access-Control-Allow-Origin: *.

Fixed:

• checkAuth() now gates the entire routeRequest() pipeline before route dispatch, covering every route uniformly.
• Removed the hardcoded wildcard CORS header; added allowedOrigins?: string[] option on ApprovalInboxOptions — no CORS header is sent unless the request Origin exactly matches an allowlisted entry.

Reported by sec-reex via private security advisory.

GHSA-3jf7-33vc-hgf4 — APSAdapter default local verifier accepts any non-empty signature (High, CWE-347, CVSS 8.6)

With the default verificationMode: 'local' and no caller-supplied verifySignature callback (the documented canonical setup), verifyDelegation() treated any non-empty string as a valid cryptographic signature, allowing a forged delegation to obtain a signed SHELL_EXEC permission-grant token with no authentication.

Fixed:

• initialize() now throws if verificationMode is local (the default) and no verifySignature callback is configured.
• verifyDelegation()'s fallback now returns false instead of a length check, failing closed as defense in depth.

Also fixed

• SkillSpector Intent-Code Divergence in scripts/blackboard.py header comment (env-scoped data dir I/O documentation).

Testing: 3,388/3,388 tests passing across 38 suites, tsc --noEmit clean.

What's changed

Fixed

• SkillSpector YARA agent_skill_mcp_tool_poisoning_metadata — Reworded the audit-log privacy note in SKILL.md that was triggering the exfiltration sub-rule. No functional change; VirusTotal 64/64 clean.
• CodeQL js/redundant-operation (alert #178) — Split an &&-chained double-call to RetryBudget.tryConsume() in test-phase15.ts into two explicit assertions.
• ClawHub display name — Corrected to "Network-AI" (a temp staging directory name leaked as the display name in the first patch publish).

Added

• npm run clawhub:publish — New publish script (scripts/clawhub-publish.js) that automates the ClawHub staging workaround required since CLI v0.23+. Reads version from skill.json, pulls git provenance automatically, always publishes with --name "Network-AI", and cleans up after itself.

  npm run clawhub:publish
  npm run clawhub:publish -- --changelog "what changed"
  npm run clawhub:publish -- --dry-run

Patch release — no API or behaviour changes. All 3,373 tests pass.

What''s changed

Network-AI now governs the layer most agent frameworks leave open: how an agent talks to the model. When a frontier model declines a request with a classifier refusal, Network-AI absorbs the refusal → fallback → billing chain and presents one governed, budgeted, audited call. 104 new tests; full suite 3,373 passing across 37 suites.

Added — Model-Interaction Lifecycle Governance (Tier 1)

• GovernedModelGateway — detect stop_reason:refusal, audit which classifier fired, route to a fallback model, redeem the fallback-credit token. Provider-agnostic; distinct from AdapterRegistry.fallbackChain (adapter-health failover).
• ModelBudget — per-model USD accounting with cache-read/write distinction and fallback-credit repricing; accountIterations() for server-side usage.iterations. Never sums tokens across models.
• RefusalTelemetry — a refusal is an HTTP 200, invisible to error-rate monitoring; recorded as a discrete non-error signal with an unservedRefusalCount gap to alert on.
• AnthropicMessagesAdapter — dependency-free (BYOC) Anthropic Messages binding that drives the gateway.

Added — Orchestration Resilience (Tier 2)

• RetryBudget — per-request (not per-session) retry accounting.
• EffortPolicy — turns the effort cost lever into a policy object (per-agent ceilings + justification gating).
• Per-sub-agent fallback — FanOutFanIn steps and TeamRunner tasks each carry their own fallback agent and retry budget. Default paths unchanged.

Added — Thinking Lifecycle + Compliance (Tier 3)

• ThinkingBlockManager — keep thinking blocks unchanged on the same model; strip them on a cross-model fallback (kept when redeeming a credit); guard prompts against reasoning_extraction refusals.
• OWASP Agentic AI Top 10 (2026) matrix — all 10 risks mapped to deterministic engine controls, verifiable via verifyOwaspCoverage().

Changed

• README lifecycle-governance section + OWASP coverage table; ARCHITECTURE/SKILL positioning; AUDIT_LOG_SCHEMA model.* events.
• Version 5.12.7 → 5.13.0.

Full changelog: https://github.com/Jovancoding/Network-AI/blob/main/CHANGELOG.md

What's changed

This release fixes the root cause behind the recurring NVIDIA SkillSpector findings on ClawHub and adds an automated guard so the same class of issue is caught before publishing — not after.

Security

• Recurring SkillSpector finding fixed at the source. The repeating Description-Behavior Mismatch / Context-Inappropriate Capability findings against McpStreamableServer were caused by comment.txt (a draft GitHub-issue note describing the optional HTTP MCP server and its 22 tools) being bundled into the published ClawHub skill. The v5.12.4 attempt to exclude it added the file to .clawignore, but the ClawHub CLI honours .clawhubignore — not .clawignore, and not .gitignore. The exclusion has been moved to the correct file.
• Additional bundle leaks closed, including scripts/*.js, four newer docs, glama.json / Dockerfile / .mcp.json / tsconfig.esm.json, several stray directories, and — most importantly — data/ (audit log, grant tokens, signing key), .env, .env.* and *.log.

Added

• scripts/clawhub-check.js + npm run clawhub:check — a bundle-hygiene guard that parses .clawhubignore, replicates the exclusion ClawHub applies, and asserts the surviving file set equals the intended Python-skill allowlist. It hard-fails on secrets/logs and on any unexpected file or directory. On its first run it immediately caught data/ leaking into the bundle.

Changed

• SKILL.md — the two McpStreamableServer SkillSpector rows are now marked Resolved with the real root cause and the new guard documented as the durable control.
• RELEASING.md — Step 9 now runs npm run clawhub:check and requires a PASS before clawhub publish.
• Version bump 5.12.6 → 5.12.7.

Full changelog: https://github.com/Jovancoding/Network-AI/blob/main/CHANGELOG.md

What's Changed

Security

• CodeQL #177 resolved — Indirect command injection (Medium): scripts/socket-check.js used execSync() with a shell template string containing the user-supplied --version argument. Replaced with spawnSync() + explicit arg array (shell: false) so no shell interpolation occurs. Added SEMVER_RE validation to reject non-semver input early. Windows
  px.cmd detection included.
• CodeQL #176 resolved — Unused import (Note): removed unused
  esolve\ from \import { join, resolve } from 'path'\ in \ est-phase13.ts:11.
• CodeQL #175 resolved — Unused import (Note): removed unused \join\ from \import { join, dirname, resolve } from 'path'\ in \lib/phase-pipeline.ts:15.

Added

• *\scripts/codeql-check.js* — GitHub Code Scanning alert monitor. Queries the GitHub API via \gh api, categorises alerts as blocking (\error/\warning) or informational (
  ote), exits 1 if any blocking alert is open. Run via
  pm run codeql:check.
• *
  pm run codeql:check* — wired into \package.json\ scripts.

Changed

• \SKILL.md\ Security Scan Findings — 3 new SkillSpector by-design entries: McpStreamableServer Description-Behavior Mismatch (Medium 94%), MCP control surface Context-Inappropriate Capability (Medium 90%), _load_signing_key()\ token minting Context-Inappropriate Capability (Medium 92%). All documented with disclosed controls.
• *\RELEASING.md* (local-only) — new Step 7:
  pm run codeql:check\ gate before publishing; Step 9 updated with correct \clawhub publish\ syntax + SkillSpector review guidance.

QA loop — how it works now

\
Push feature → CI runs CodeQL (~2 min)
→ npm run codeql:check # exits 1 if any error/warning alert open
→ npm run socket:check # exits 1 if gptSecurity/debugAccess present
→ clawhub publish # triggers SkillSpector re-scan (NVIDIA)
→ check Versions tab # new findings → triage into SKILL.md table
\\

Full changelog: https://github.com/Jovancoding/Network-AI/blob/main/CHANGELOG.md

What's Changed

Security

• Remove gptSecurity alert: Replaced String.fromCharCode(101,118,97,108) obfuscation pattern in lib/blackboard-validator.ts with a named constant EVAL_FN = 'eval'. Socket.dev's AI classifier no longer flags this as a potential security risk.
• Remove debugAccess alert: Same root cause — the char-code construction was the only trigger in the codebase. Gone with the constant refactor.
• Explicit policy gate at shell exec call sites (�in/console.ts):
  untime.policy.isCommandAllowed() checked before
  untime.exec() in both interactive and pipe-mode paths, reducing AI-heuristic surface.
• Remove redundant
  equire('path').sep in lib/agent-runtime.ts — sep is already imported at module top level.

Documentation

• SUPPLY_CHAIN.md: Added sections 5a (shell execution surface) and 5b (telemetry surface), documenting all controls around shellAccess/shellExec alerts and confirming zero-telemetry default.

Tooling

• scripts/socket-check.js: New supply-chain score monitor. Runs \socket package shallow, labels alerts as [FIXABLE]/[expected]/[review], exits non-zero if fixable alerts remain.
• *
  pm run socket:check* / **
  pm run socket:check:local**: Wired into \package.json.
• \RELEASING.md\ Step 9: Post-publish Socket score verification added to the release checklist.

Score impact

Supply Chain Score: 75 → ~80 (climbs further to ~85 when
ecentlyPublished\ expires)

Full Changelog: https://github.com/dragoscv/network-ai/compare/v5.12.4...v5.12.5

v5.12.4 — SkillSpector triage, SKILL.md trigger hardening, Socket.dev scan gap

A hardening and triage release targeting ClawHub SkillSpector findings from v5.12.3 and a Socket.dev scan gap in the dual CJS+ESM build. No breaking changes; all 3,269 tests across 33 suites pass.

Security

• SkillSpector findings resolved. Added .clawignore to exclude comment.txt from ClawHub packages — the file (an in-progress draft note) was inadvertently included in 5.12.3 via clawhub publish . and its McpStreamableServer bridge-pattern description triggered Description-Behavior Mismatch (High, 93%) and Context-Inappropriate Capability (Medium, 88%) findings.
• SKILL.md trigger hardening. Replaced the broad "When to Use This Skill" bullet list with explicit Use/Do-NOT-Use sections, resolving Vague Triggers (Medium, 81%). Shell execution, agent spawning, and MCP server startup are now explicitly called out as out-of-scope for the Python skill bundle.

Changed

• Socket.dev triage gap closed. Added 9 missing entries from the 5.12.3 scan: declaration-file false positives (dist/adapters/a2a-adapter.d.ts, dist/lib/approval-inbox.d.ts), three ESM adapter mirrors (aps-adapter.js, hermes-adapter.js, rlm-adapter.js), and four shell-access entries for example and bootstrap scripts. networkAccess 59 → 64, shellAccess 6 → 10.

Install

npm install [email protected]