/** * @claude-flow/codex - config.toml Generator * * Generates Codex CLI configuration files in TOML format */ import type { ConfigTomlOptions, McpServerConfig, SkillConfig, ConfigProfile } from '../types.js'; /** * Security configuration options */ interface SecurityConfig { inputValidation?: boolean; pathTraversal?: boolean; secretScanning?: boolean; cveScanning?: boolean; maxFileSize?: number; allowedExtensions?: string[]; blockedPatterns?: string[]; } /** * Performance configuration options */ interface PerformanceConfig { maxAgents?: number; taskTimeout?: number; memoryLimit?: string; cacheEnabled?: boolean; cacheTtl?: number; parallelExecution?: boolean; } /** * Logging configuration options */ interface LoggingConfig { level?: 'debug' | 'info' | 'warn' | 'error'; format?: 'json' | 'text' | 'pretty'; destination?: 'stdout' | 'file' | 'both'; filePath?: string; maxFiles?: number; maxSize?: string; } /** * Extended configuration options */ interface ExtendedConfigTomlOptions extends ConfigTomlOptions { security?: SecurityConfig; performance?: PerformanceConfig; logging?: LoggingConfig; } /** * Generate a config.toml file based on the provided options */ export async function generateConfigToml(options: ExtendedConfigTomlOptions = {}): Promise { const { model = 'gpt-5.3-codex', approvalPolicy = 'on-request', sandboxMode = 'workspace-write', webSearch = 'cached', projectDocMaxBytes = 65536, features = {}, mcpServers = [], skills = [], profiles = {}, historyPersistence = 'save-all', security = {}, performance = {}, logging = {}, } = options; const lines: string[] = []; // Header lines.push('# ============================================================================='); lines.push('# Claude Flow V3 - Codex Configuration'); lines.push('# ============================================================================='); lines.push('# Generated by: @claude-flow/codex'); lines.push('# Documentation: https://github.com/ruvnet/ruflo'); lines.push('# '); lines.push('# This file configures the Codex CLI for Claude Flow integration.'); lines.push('# Place in .agents/config.toml (project) or .codex/config.toml (user).'); lines.push('# ============================================================================='); lines.push(''); lines.push('# ============================================================================='); lines.push('# Core Settings'); lines.push('# ============================================================================='); lines.push(''); lines.push('# Model selection - the AI model to use for code generation'); lines.push('# Options: gpt-5.3-codex, gpt-4o, claude-sonnet, claude-opus'); lines.push(`model = "${model}"`); lines.push(''); lines.push('# Approval policy determines when human approval is required'); lines.push('# - untrusted: Always require approval'); lines.push('# - on-failure: Require approval only after failures'); lines.push('# - on-request: Require approval for significant changes'); lines.push('# - never: Auto-approve all actions (use with caution)'); lines.push(`approval_policy = "${approvalPolicy}"`); lines.push(''); lines.push('# Sandbox mode controls file system access'); lines.push('# - read-only: Can only read files, no modifications'); lines.push('# - workspace-write: Can write within workspace directory'); lines.push('# - danger-full-access: Full file system access (dangerous)'); lines.push(`sandbox_mode = "${sandboxMode}"`); lines.push(''); lines.push('# Web search enables internet access for research'); lines.push('# - disabled: No web access'); lines.push('# - cached: Use cached results when available'); lines.push('# - live: Always fetch fresh results'); lines.push(`web_search = "${webSearch}"`); lines.push(''); // Project Documentation lines.push('# ============================================================================='); lines.push('# Project Documentation'); lines.push('# ============================================================================='); lines.push(''); lines.push('# Maximum bytes to read from AGENTS.md files'); lines.push(`project_doc_max_bytes = ${projectDocMaxBytes}`); lines.push(''); lines.push('# Fallback filenames if AGENTS.md not found'); lines.push('project_doc_fallback_filenames = ['); lines.push(' "AGENTS.md",'); lines.push(' "TEAM_GUIDE.md",'); lines.push(' ".agents.md"'); lines.push(']'); lines.push(''); // Features lines.push('# ============================================================================='); lines.push('# Features'); lines.push('# ============================================================================='); lines.push(''); lines.push('[features]'); lines.push('# Enable child AGENTS.md guidance'); lines.push(`child_agents_md = ${features.childAgentsMd ?? true}`); lines.push(''); lines.push('# Cache shell environment for faster repeated commands'); lines.push(`shell_snapshot = ${features.shellSnapshot ?? true}`); lines.push(''); lines.push('# Smart approvals based on request context'); lines.push(`request_rule = ${features.requestRule ?? true}`); lines.push(''); lines.push('# Enable remote compaction for large histories'); lines.push(`remote_compaction = ${features.remoteCompaction ?? true}`); lines.push(''); // MCP Servers if (mcpServers.length > 0 || true) { // Always include claude-flow by default lines.push('# ============================================================================='); lines.push('# MCP Servers'); lines.push('# ============================================================================='); lines.push(''); // Default claude-flow server const hasRuflo = mcpServers.some(s => s.name === 'ruflo' || s.name === 'claude-flow'); if (!hasRuflo) { lines.push(...generateMcpServer({ name: 'ruflo', command: 'npx', args: ['-y', 'ruflo@latest', 'mcp', 'start'], enabled: true, toolTimeout: 120, })); lines.push(''); } for (const server of mcpServers) { lines.push(...generateMcpServer(server)); lines.push(''); } } // Skills Configuration if (skills.length > 0) { lines.push('# ============================================================================='); lines.push('# Skills Configuration'); lines.push('# ============================================================================='); lines.push(''); for (const skill of skills) { lines.push(...generateSkillConfig(skill)); lines.push(''); } } // Profiles lines.push('# ============================================================================='); lines.push('# Profiles'); lines.push('# ============================================================================='); lines.push(''); // Default profiles const defaultProfiles: Record = { dev: { approvalPolicy: 'never', sandboxMode: 'danger-full-access', webSearch: 'live', }, safe: { approvalPolicy: 'untrusted', sandboxMode: 'read-only', webSearch: 'disabled', }, ci: { approvalPolicy: 'never', sandboxMode: 'workspace-write', webSearch: 'cached', }, ...profiles, }; for (const [name, profile] of Object.entries(defaultProfiles)) { lines.push(...generateProfile(name, profile)); lines.push(''); } // History lines.push('# ============================================================================='); lines.push('# History'); lines.push('# ============================================================================='); lines.push(''); lines.push('[history]'); lines.push('# Save all session transcripts'); lines.push(`persistence = "${historyPersistence}"`); lines.push(''); // Shell Environment Policy lines.push('# ============================================================================='); lines.push('# Shell Environment'); lines.push('# ============================================================================='); lines.push(''); lines.push('[shell_environment_policy]'); lines.push('# Inherit environment variables'); lines.push('inherit = "core"'); lines.push(''); lines.push('# Exclude sensitive variables'); lines.push('exclude = ["*_KEY", "*_SECRET", "*_TOKEN", "*_PASSWORD"]'); lines.push(''); // Sandbox Workspace Write Settings lines.push('# ============================================================================='); lines.push('# Sandbox Workspace Write Settings'); lines.push('# ============================================================================='); lines.push(''); lines.push('[sandbox_workspace_write]'); lines.push('# Additional writable paths beyond workspace'); lines.push('writable_roots = []'); lines.push(''); lines.push('# Allow network access'); lines.push('network_access = true'); lines.push(''); lines.push('# Exclude temp directories'); lines.push('exclude_slash_tmp = false'); lines.push(''); // Security Settings lines.push('# ============================================================================='); lines.push('# Security Settings'); lines.push('# ============================================================================='); lines.push(''); lines.push('[security]'); lines.push('# Enable input validation for all user inputs'); lines.push(`input_validation = ${security.inputValidation ?? true}`); lines.push(''); lines.push('# Prevent directory traversal attacks'); lines.push(`path_traversal_prevention = ${security.pathTraversal ?? true}`); lines.push(''); lines.push('# Scan for hardcoded secrets'); lines.push(`secret_scanning = ${security.secretScanning ?? true}`); lines.push(''); lines.push('# Scan dependencies for known CVEs'); lines.push(`cve_scanning = ${security.cveScanning ?? true}`); lines.push(''); lines.push('# Maximum file size for operations (bytes)'); lines.push(`max_file_size = ${security.maxFileSize ?? 10485760}`); lines.push(''); lines.push('# Allowed file extensions (empty = allow all)'); const allowedExts = security.allowedExtensions ?? []; if (allowedExts.length > 0) { lines.push(`allowed_extensions = [${allowedExts.map((e) => `"${e}"`).join(', ')}]`); } else { lines.push('allowed_extensions = []'); } lines.push(''); lines.push('# Blocked file patterns (regex)'); const blockedPatterns = security.blockedPatterns ?? ['\\.env$', 'credentials\\.json$', '\\.pem$', '\\.key$']; lines.push(`blocked_patterns = [${blockedPatterns.map((p) => `"${escapeTomlString(p)}"`).join(', ')}]`); lines.push(''); // Performance Settings lines.push('# ============================================================================='); lines.push('# Performance Settings'); lines.push('# ============================================================================='); lines.push(''); lines.push('[performance]'); lines.push('# Maximum concurrent agents'); lines.push(`max_agents = ${performance.maxAgents ?? 8}`); lines.push(''); lines.push('# Task timeout in seconds'); lines.push(`task_timeout = ${performance.taskTimeout ?? 300}`); lines.push(''); lines.push('# Memory limit per agent'); lines.push(`memory_limit = "${performance.memoryLimit ?? '512MB'}"`); lines.push(''); lines.push('# Enable response caching'); lines.push(`cache_enabled = ${performance.cacheEnabled ?? true}`); lines.push(''); lines.push('# Cache TTL in seconds'); lines.push(`cache_ttl = ${performance.cacheTtl ?? 3600}`); lines.push(''); lines.push('# Enable parallel task execution'); lines.push(`parallel_execution = ${performance.parallelExecution ?? true}`); lines.push(''); // Logging Settings lines.push('# ============================================================================='); lines.push('# Logging Settings'); lines.push('# ============================================================================='); lines.push(''); lines.push('[logging]'); lines.push('# Log level: debug, info, warn, error'); lines.push(`level = "${logging.level ?? 'info'}"`); lines.push(''); lines.push('# Log format: json, text, pretty'); lines.push(`format = "${logging.format ?? 'pretty'}"`); lines.push(''); lines.push('# Log destination: stdout, file, both'); lines.push(`destination = "${logging.destination ?? 'stdout'}"`); lines.push(''); if (logging.filePath || logging.destination === 'file' || logging.destination === 'both') { lines.push('# Log file path'); lines.push(`file_path = "${logging.filePath ?? './logs/claude-flow.log'}"`); lines.push(''); lines.push('# Maximum number of log files to retain'); lines.push(`max_files = ${logging.maxFiles ?? 10}`); lines.push(''); lines.push('# Maximum size per log file'); lines.push(`max_size = "${logging.maxSize ?? '10MB'}"`); lines.push(''); } // Neural/Intelligence Settings lines.push('# ============================================================================='); lines.push('# Neural Intelligence Settings'); lines.push('# ============================================================================='); lines.push(''); lines.push('[neural]'); lines.push('# Enable SONA (Self-Optimizing Neural Architecture)'); lines.push('sona_enabled = true'); lines.push(''); lines.push('# Enable HNSW vector search'); lines.push('hnsw_enabled = true'); lines.push(''); lines.push('# HNSW index parameters'); lines.push('hnsw_m = 16'); lines.push('hnsw_ef_construction = 200'); lines.push('hnsw_ef_search = 100'); lines.push(''); lines.push('# Enable pattern learning'); lines.push('pattern_learning = true'); lines.push(''); lines.push('# Learning rate for neural adaptation'); lines.push('learning_rate = 0.01'); lines.push(''); // Swarm Settings lines.push('# ============================================================================='); lines.push('# Swarm Orchestration Settings'); lines.push('# ============================================================================='); lines.push(''); lines.push('[swarm]'); lines.push('# Default topology: hierarchical, mesh, ring, star'); lines.push('default_topology = "hierarchical"'); lines.push(''); lines.push('# Default strategy: balanced, specialized, adaptive'); lines.push('default_strategy = "specialized"'); lines.push(''); lines.push('# Consensus algorithm: raft, byzantine, gossip'); lines.push('consensus = "raft"'); lines.push(''); lines.push('# Enable anti-drift measures'); lines.push('anti_drift = true'); lines.push(''); lines.push('# Checkpoint interval (tasks)'); lines.push('checkpoint_interval = 10'); lines.push(''); // Hooks Settings lines.push('# ============================================================================='); lines.push('# Hooks Configuration'); lines.push('# ============================================================================='); lines.push(''); lines.push('[hooks]'); lines.push('# Enable lifecycle hooks'); lines.push('enabled = true'); lines.push(''); lines.push('# Pre-task hook'); lines.push('pre_task = true'); lines.push(''); lines.push('# Post-task hook (for learning)'); lines.push('post_task = true'); lines.push(''); lines.push('# Enable neural training on post-edit'); lines.push('train_on_edit = true'); lines.push(''); // Background Workers lines.push('# ============================================================================='); lines.push('# Background Workers'); lines.push('# ============================================================================='); lines.push(''); lines.push('[workers]'); lines.push('# Enable background workers'); lines.push('enabled = true'); lines.push(''); lines.push('# Worker configuration'); lines.push('[workers.audit]'); lines.push('enabled = true'); lines.push('priority = "critical"'); lines.push('interval = 300'); lines.push(''); lines.push('[workers.optimize]'); lines.push('enabled = true'); lines.push('priority = "high"'); lines.push('interval = 600'); lines.push(''); lines.push('[workers.consolidate]'); lines.push('enabled = true'); lines.push('priority = "low"'); lines.push('interval = 1800'); lines.push(''); return lines.join('\n'); } /** * Escape special characters in TOML strings */ function escapeTomlString(str: string): string { return str .replace(/\\/g, '\\\\') .replace(/"/g, '\\"') .replace(/\n/g, '\\n') .replace(/\r/g, '\\r') .replace(/\t/g, '\\t'); } /** * Generate MCP server configuration lines */ function generateMcpServer(server: McpServerConfig): string[] { const lines: string[] = []; lines.push(`[mcp_servers.${server.name}]`); lines.push(`command = "${server.command}"`); if (server.args && server.args.length > 0) { const argsStr = server.args.map(a => `"${a}"`).join(', '); lines.push(`args = [${argsStr}]`); } lines.push(`enabled = ${server.enabled ?? true}`); if (server.toolTimeout) { lines.push(`tool_timeout_sec = ${server.toolTimeout}`); } if (server.env && Object.keys(server.env).length > 0) { lines.push(''); lines.push(`[mcp_servers.${server.name}.env]`); for (const [key, value] of Object.entries(server.env)) { lines.push(`${key} = "${value}"`); } } return lines; } /** * Generate skill configuration lines */ function generateSkillConfig(skill: SkillConfig): string[] { const lines: string[] = []; lines.push('[[skills.config]]'); lines.push(`path = "${skill.path}"`); lines.push(`enabled = ${skill.enabled ?? true}`); return lines; } /** * Generate profile configuration lines */ function generateProfile(name: string, profile: ConfigProfile): string[] { const lines: string[] = []; const comment = name === 'dev' ? 'Development profile - more permissive for local work' : name === 'safe' ? 'Safe profile - maximum restrictions' : name === 'ci' ? 'CI profile - for automated pipelines' : `${name} profile`; lines.push(`# ${comment}`); lines.push(`[profiles.${name}]`); if (profile.approvalPolicy) { lines.push(`approval_policy = "${profile.approvalPolicy}"`); } if (profile.sandboxMode) { lines.push(`sandbox_mode = "${profile.sandboxMode}"`); } if (profile.webSearch) { lines.push(`web_search = "${profile.webSearch}"`); } return lines; } /** * Generate minimal config.toml */ export async function generateMinimalConfigToml(options: ConfigTomlOptions = {}): Promise { const { model = 'gpt-5.3-codex', approvalPolicy = 'on-request', sandboxMode = 'workspace-write', } = options; return `# Claude Flow V3 - Minimal Codex Configuration model = "${model}" approval_policy = "${approvalPolicy}" sandbox_mode = "${sandboxMode}" [mcp_servers.ruflo] command = "npx" args = ["-y", "ruflo@latest", "mcp", "start"] enabled = true `; } /** * Generate CI/CD config.toml */ export async function generateCIConfigToml(): Promise { return `# ============================================================================= # Claude Flow V3 - CI/CD Pipeline Configuration # ============================================================================= # Optimized for automated CI/CD environments # No interactive approvals, ephemeral history, minimal overhead # ============================================================================= model = "gpt-5.3-codex" approval_policy = "never" sandbox_mode = "workspace-write" web_search = "disabled" # Project documentation project_doc_max_bytes = 65536 [features] # Disable interactive features for CI shell_snapshot = false remote_compaction = false child_agents_md = true request_rule = false [mcp_servers.ruflo] command = "npx" args = ["-y", "ruflo@latest", "mcp", "start"] enabled = true tool_timeout_sec = 300 [history] persistence = "none" [shell_environment_policy] inherit = "core" exclude = ["*_KEY", "*_SECRET", "*_TOKEN", "*_PASSWORD", "CI_*"] [security] input_validation = true path_traversal_prevention = true secret_scanning = true cve_scanning = true [performance] max_agents = 4 task_timeout = 600 cache_enabled = false parallel_execution = true [logging] level = "info" format = "json" destination = "stdout" [swarm] default_topology = "hierarchical" default_strategy = "specialized" anti_drift = true [hooks] enabled = true pre_task = true post_task = false train_on_edit = false `; } /** * Generate enterprise config.toml with full governance */ export async function generateEnterpriseConfigToml(): Promise { return `# ============================================================================= # Claude Flow V3 - Enterprise Configuration # ============================================================================= # Full governance, audit logging, and compliance features enabled # Suitable for enterprise environments with strict security requirements # ============================================================================= model = "gpt-5.3-codex" approval_policy = "on-request" sandbox_mode = "workspace-write" web_search = "cached" # Project documentation project_doc_max_bytes = 131072 project_doc_fallback_filenames = [ "AGENTS.md", "TEAM_GUIDE.md", ".agents.md", "CONTRIBUTING.md" ] [features] child_agents_md = true shell_snapshot = true request_rule = true remote_compaction = true # ============================================================================= # MCP Servers # ============================================================================= [mcp_servers.ruflo] command = "npx" args = ["-y", "ruflo@latest", "mcp", "start"] enabled = true tool_timeout_sec = 120 [mcp_servers.ruflo.env] CLAUDE_FLOW_LOG_LEVEL = "info" # ============================================================================= # Profiles # ============================================================================= # Development profile - more permissive for local work [profiles.dev] approval_policy = "never" sandbox_mode = "danger-full-access" web_search = "live" # Safe profile - maximum restrictions [profiles.safe] approval_policy = "untrusted" sandbox_mode = "read-only" web_search = "disabled" # CI profile - for automated pipelines [profiles.ci] approval_policy = "never" sandbox_mode = "workspace-write" web_search = "disabled" # Production profile - careful changes only [profiles.production] approval_policy = "untrusted" sandbox_mode = "workspace-write" web_search = "cached" # ============================================================================= # History # ============================================================================= [history] persistence = "save-all" retention_days = 90 audit_log = true # ============================================================================= # Shell Environment # ============================================================================= [shell_environment_policy] inherit = "core" exclude = ["*_KEY", "*_SECRET", "*_TOKEN", "*_PASSWORD", "AWS_*", "AZURE_*"] [sandbox_workspace_write] writable_roots = [] network_access = true exclude_slash_tmp = false # ============================================================================= # Security (Enterprise) # ============================================================================= [security] input_validation = true path_traversal_prevention = true secret_scanning = true cve_scanning = true max_file_size = 10485760 blocked_patterns = ["\\\\.env$", "credentials\\\\.json$", "\\\\.pem$", "\\\\.key$", "secrets\\\\.yaml$"] # RBAC configuration [security.rbac] enabled = true default_role = "developer" # Audit configuration [security.audit] enabled = true destination = "file" file_path = "./logs/audit.json" retention_days = 90 # ============================================================================= # Performance # ============================================================================= [performance] max_agents = 8 task_timeout = 300 memory_limit = "1GB" cache_enabled = true cache_ttl = 3600 parallel_execution = true # ============================================================================= # Logging (Enterprise) # ============================================================================= [logging] level = "info" format = "json" destination = "both" file_path = "./logs/claude-flow.log" max_files = 30 max_size = "50MB" # ============================================================================= # Neural Intelligence # ============================================================================= [neural] sona_enabled = true hnsw_enabled = true hnsw_m = 16 hnsw_ef_construction = 200 hnsw_ef_search = 100 pattern_learning = true learning_rate = 0.01 # ============================================================================= # Swarm Orchestration # ============================================================================= [swarm] default_topology = "hierarchical" default_strategy = "specialized" consensus = "raft" anti_drift = true checkpoint_interval = 10 # ============================================================================= # Hooks # ============================================================================= [hooks] enabled = true pre_task = true post_task = true train_on_edit = true # ============================================================================= # Background Workers # ============================================================================= [workers] enabled = true [workers.audit] enabled = true priority = "critical" interval = 300 [workers.optimize] enabled = true priority = "high" interval = 600 [workers.consolidate] enabled = true priority = "low" interval = 1800 [workers.testgaps] enabled = true priority = "normal" interval = 3600 # ============================================================================= # Compliance # ============================================================================= [compliance] soc2 = true gdpr = true pci_dss = false hipaa = false `; } /** * Generate development config.toml with permissive settings */ export async function generateDevConfigToml(): Promise { return `# ============================================================================= # Claude Flow V3 - Development Configuration # ============================================================================= # Permissive settings for local development # Auto-approve most actions, full access, live web search # ============================================================================= model = "gpt-5.3-codex" approval_policy = "never" sandbox_mode = "danger-full-access" web_search = "live" # Project documentation project_doc_max_bytes = 65536 [features] child_agents_md = true shell_snapshot = true request_rule = false remote_compaction = true [mcp_servers.ruflo] command = "npx" args = ["-y", "ruflo@latest", "mcp", "start"] enabled = true tool_timeout_sec = 120 [history] persistence = "save-all" [shell_environment_policy] inherit = "all" exclude = [] [sandbox_workspace_write] writable_roots = ["/tmp", "~/.cache"] network_access = true exclude_slash_tmp = false [security] input_validation = true path_traversal_prevention = true secret_scanning = true cve_scanning = false [performance] max_agents = 8 task_timeout = 600 cache_enabled = true parallel_execution = true [logging] level = "debug" format = "pretty" destination = "stdout" [neural] sona_enabled = true hnsw_enabled = true pattern_learning = true [swarm] default_topology = "hierarchical" default_strategy = "specialized" anti_drift = true [hooks] enabled = true pre_task = true post_task = true train_on_edit = true [workers] enabled = true `; } /** * Generate security-focused config.toml */ export async function generateSecureConfigToml(): Promise { return `# ============================================================================= # Claude Flow V3 - Security-Focused Configuration # ============================================================================= # Maximum security restrictions for sensitive environments # All actions require approval, read-only access, no web search # ============================================================================= model = "gpt-5.3-codex" approval_policy = "untrusted" sandbox_mode = "read-only" web_search = "disabled" # Project documentation project_doc_max_bytes = 32768 [features] child_agents_md = true shell_snapshot = false request_rule = true remote_compaction = false [mcp_servers.ruflo] command = "npx" args = ["-y", "ruflo@latest", "mcp", "start"] enabled = true tool_timeout_sec = 60 [history] persistence = "save-all" retention_days = 365 [shell_environment_policy] inherit = "none" exclude = ["*"] [sandbox_workspace_write] writable_roots = [] network_access = false exclude_slash_tmp = true [security] input_validation = true path_traversal_prevention = true secret_scanning = true cve_scanning = true max_file_size = 1048576 allowed_extensions = [".ts", ".js", ".json", ".md", ".yaml", ".yml"] blocked_patterns = ["\\\\.env", "secret", "credential", "password", "key", "token", "\\\\.pem", "\\\\.p12"] [security.rbac] enabled = true default_role = "observer" [security.audit] enabled = true destination = "both" file_path = "./logs/security-audit.json" retention_days = 365 [performance] max_agents = 4 task_timeout = 120 cache_enabled = false parallel_execution = false [logging] level = "info" format = "json" destination = "both" file_path = "./logs/claude-flow.log" max_files = 100 max_size = "10MB" [neural] sona_enabled = false hnsw_enabled = true pattern_learning = false [swarm] default_topology = "hierarchical" default_strategy = "specialized" consensus = "byzantine" anti_drift = true checkpoint_interval = 5 [hooks] enabled = true pre_task = true post_task = true train_on_edit = false [workers] enabled = true [workers.audit] enabled = true priority = "critical" interval = 60 [workers.optimize] enabled = false [workers.consolidate] enabled = false `; }