fix(security): actually close 5 re-confirmed CodeQL alerts (141,143,230-232)

These 5 were NOT scan-lag — CodeQL re-evaluated them on a July-6 commit and kept
them OPEN (the alert updated_at only moves on state change, which masked this). My
earlier bounds/guards did not satisfy the queries. Corrected:

- 141 permission-handler.js (polynomial-redos): the DANGEROUS_PATTERNS denylist had
  ~12 regexes with unbounded .* (curl/wget/cat/dd/git-push/$( ...). Bounded every
  wildcard: .*->[^\n]{0,256}, \s+->\s{1,32}, \s*->\s{0,32}, [^)]*->[^)]{0,256}.
  Verified: still blocks all 19 dangerous cmds, allows benign, <2ms on 40k pumps.
- 143 complexity.ts (polynomial-redos): functionPatterns[3] had \([^)]*\) — the
  unbounded [^)]* is the O(n^2) driver on '\t0(' pumps. -> [^)]{0,512}; other \s*
  bounded. 830ms -> 13ms, function count identical on real code.
- 230/231/232 (prototype-pollution-utility): a PRE-LOOP key scan is not tracked by
  CodeQL's dataflow as a barrier — it flagged the recursive writes regardless. Moved
  the literal-comparison guard INLINE, immediately before each current[key] write
  (loop body + final assignment). Verified: nested set works, prototype unpollutable.

Version bumps (real published-byte changes): trio 1.3.18, swarmvector 0.2.39,
agentic-flow 2.0.17. tsc clean for all changed .ts.

Co-Authored-By: Swarmdo <maintainers@swarmdo.com>

Author: JannieP

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "swarmdo",
-  "version": "1.3.17",
+  "version": "1.3.18",
   "description": "Swarmdo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "swarmdo-bridge",
-  "version": "1.3.17",
+  "version": "1.3.18",
   "private": true,
   "description": "Swarmdo MCP-bridge + docker tooling (NOT published \u2014 the canonical `swarmdo` npm package is the repo root). Resolves the post-rename name collision where this wrapper and the root umbrella both became `swarmdo`.",
   "main": "bin/swarmdo.js",

swarmdo/package.json

@@ -431,18 +431,20 @@ function applyUpdate(doc: Record<string, unknown>, update: Record<string, unknow
 
 function setNestedValue(obj: Record<string, unknown>, path: string, value: unknown): void {
 	const parts = path.split(".");
-	// Reject prototype-polluting path segments before any nested write.
-	for (const part of parts) {
-		if (part === "__proto__" || part === "constructor" || part === "prototype") return;
-	}
 	let current = obj;
 	for (let i = 0; i < parts.length - 1; i++) {
-		if (!(parts[i] in current) || typeof current[parts[i]] !== "object") {
-			current[parts[i]] = {};
+		const key = parts[i];
+		// Guard inline at the write site — CodeQL tracks a literal comparison
+		// immediately before the assignment, not a pre-loop scan.
+		if (key === "__proto__" || key === "constructor" || key === "prototype") return;
+		if (!(key in current) || typeof current[key] !== "object") {
+			current[key] = {};
 		}
-		current = current[parts[i]] as Record<string, unknown>;
+		current = current[key] as Record<string, unknown>;
 	}
-	current[parts[parts.length - 1]] = value;
+	const lastKey = parts[parts.length - 1];
+	if (lastKey === "__proto__" || lastKey === "constructor" || lastKey === "prototype") return;
+	current[lastKey] = value;
 }
 
 function deleteNestedValue(obj: Record<string, unknown>, path: string): void {

swarmdo/src/swarmvocal/src/lib/server/database/rvf.ts

@@ -1,6 +1,6 @@
 {
   "name": "@swarmdo/cli",
-  "version": "1.3.17",
+  "version": "1.3.18",
   "type": "module",
   "description": "Swarmdo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

v3/@swarmdo/cli/package.json

@@ -104,22 +104,25 @@ function setNestedValue(obj: Record<string, unknown>, key: string, value: unknow
   if (parts.length > MAX_NESTING_DEPTH) {
     throw new Error(`Key exceeds maximum nesting depth of ${MAX_NESTING_DEPTH}`);
   }
-  for (const part of parts) {
-    // Inline literal comparison — CodeQL recognizes this as a prototype-pollution
-    // barrier, whereas DANGEROUS_KEYS.has(part) is not tracked by its dataflow.
-    if (part === '__proto__' || part === 'constructor' || part === 'prototype') {
-      throw new Error(`Dangerous key segment rejected: ${part}`);
-    }
-  }
+  // Guard each key inline at its write site — CodeQL's prototype-pollution-utility
+  // dataflow tracks a literal comparison immediately preceding the assignment, not a
+  // pre-loop scan (which still left the recursive writes below flagged).
   let current = obj;
   for (let i = 0; i < parts.length - 1; i++) {
     const part = parts[i];
+    if (part === '__proto__' || part === 'constructor' || part === 'prototype') {
+      throw new Error(`Dangerous key segment rejected: ${part}`);
+    }
     if (!(part in current) || typeof current[part] !== 'object') {
       current[part] = {};
     }
     current = current[part] as Record<string, unknown>;
   }
-  current[parts[parts.length - 1]] = value;
+  const lastKey = parts[parts.length - 1];
+  if (lastKey === '__proto__' || lastKey === 'constructor' || lastKey === 'prototype') {
+    throw new Error(`Dangerous key segment rejected: ${lastKey}`);
+  }
+  current[lastKey] = value;
 }
 
 export const configTools: MCPTool[] = [

v3/@swarmdo/cli/src/mcp-tools/config-tools.ts

@@ -207,19 +207,19 @@ function getNestedValue(obj: Record<string, unknown>, key: string): unknown {
 /** Set a nested value by dot-separated key */
 function setNestedValue(obj: Record<string, unknown>, key: string, value: unknown): void {
   const parts = key.split('.');
-  // Reject prototype-polluting path segments before any nested write.
-  for (const part of parts) {
-    if (part === '__proto__' || part === 'constructor' || part === 'prototype') return;
-  }
   let current: Record<string, unknown> = obj;
   for (let i = 0; i < parts.length - 1; i++) {
     const part = parts[i];
+    // Guard inline at the write site (CodeQL prototype-pollution barrier).
+    if (part === '__proto__' || part === 'constructor' || part === 'prototype') return;
     if (!(part in current) || typeof current[part] !== 'object' || current[part] === null) {
       current[part] = {};
     }
     current = current[part] as Record<string, unknown>;
   }
-  current[parts[parts.length - 1]] = value;
+  const lastPart = parts[parts.length - 1];
+  if (lastPart === '__proto__' || lastPart === 'constructor' || lastPart === 'prototype') return;
+  current[lastPart] = value;
 }
 
 /** Parse a string value to the appropriate type */

v3/@swarmdo/cli/src/services/config-file-manager.ts

@@ -1,6 +1,6 @@
 {
   "name": "agentic-flow",
-  "version": "2.0.16",
+  "version": "2.0.17",
   "description": "Production-ready AI agent orchestration platform with 66 specialized agents, 213 MCP tools, ReasoningBank learning memory, and autonomous multi-agent swarms. Built by @upstream with Claude Agent SDK, neural networks, memory persistence, GitHub integration, and distributed consensus protocols.",
   "type": "module",
   "main": "dist/index.js",

v3/vendor/agentic-flow/dist/sdk/permission-handler.js

@@ -1,6 +1,6 @@
 {
   "name": "swarmvector",
-  "version": "0.2.38",
+  "version": "0.2.39",
   "description": "Self-learning vector database for Node.js \u2014 hybrid search, Graph RAG, FlashAttention-3, HNSW, 50+ attention mechanisms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",