fix: resolve CodeQL alerts #99-#104, #107 + ClawHub suspicious flag

jovanSAPFIONEER · jovanSAPFIONEER · commit d373bd3f1f39 · 2026-04-04T01:34:31.000+02:00
- security.ts: fix bad HTML filter regex — &lt;/script\s*&gt; handles browser variants (#107)
- agent-runtime.ts: remove unused startTime variable (#99)
- strategy-agent.ts: rename unused loop variable target → _target (#100/#104)
- test-phase9.ts: remove unused imports AgentPool/WorkloadPartitioner (#101),
  unused function assertThrows (#102), unused variable echoCmd (#103)
- .clawhubignore: exclude scripts/postinstall.js from Python skill bundle
- skill.json: clarify TypeScript engine exists alongside Python scripts

Bump to v4.15.2. All 2,357 tests pass across 25 suites.
diff --git a/.clawhubignore b/.clawhubignore
@@ -16,6 +16,7 @@ package.json
 package-lock.json
 node_modules/
 setup.ts
+scripts/postinstall.js
 
 # ── Tests ──
 test.ts
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
@@ -2,7 +2,7 @@
 
 ## Project Overview
 
-Network-AI is a TypeScript/Node.js multi-agent orchestrator — shared state, guardrails, budgets, and cross-framework coordination (v4.15.1). 2,357 tests across 25 suites.
+Network-AI is a TypeScript/Node.js multi-agent orchestrator — shared state, guardrails, budgets, and cross-framework coordination (v4.15.2). 2,357 tests across 25 suites.
 
 ## Architecture
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,17 @@ All notable changes to Network-AI will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.15.2] - 2026-04-04
+
+### Fixed
+- **CodeQL #107 — Bad HTML filtering regexp** (`security.ts`): Changed `<\/script>` to `<\/script\s*>` to match browser-accepted variants like `</script >` per HTML spec.
+- **CodeQL #99 — Unused variable `startTime`** (`lib/agent-runtime.ts`): Removed unused local.
+- **CodeQL #100/#104 — Unused loop variable `target`** (`lib/strategy-agent.ts`): Renamed to `_target`.
+- **CodeQL #101 — Unused imports `AgentPool`, `WorkloadPartitioner`** (`test-phase9.ts`): Removed.
+- **CodeQL #102 — Unused function `assertThrows`** (`test-phase9.ts`): Removed.
+- **CodeQL #103 — Unused variable `echoCmd`** (`test-phase9.ts`): Removed.
+- **ClawHub suspicious flag** — Added `scripts/postinstall.js` to `.clawhubignore` so Node-only dev tooling is excluded from the Python skill bundle; updated `skill.json` description to acknowledge the TypeScript engine.
+
 ## [4.15.1] - 2026-04-04
 
 ### Fixed
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -4,7 +4,7 @@ This file is read automatically by Claude Code when working in this repository.
 
 ## Project Overview
 
-Network-AI is a TypeScript/Node.js multi-agent orchestrator — shared state, guardrails, budgets, and cross-framework coordination. Version 4.15.1.
+Network-AI is a TypeScript/Node.js multi-agent orchestrator — shared state, guardrails, budgets, and cross-framework coordination. Version 4.15.2.
 
 ## Build & Test Commands
 
diff --git a/CODEX.md b/CODEX.md
@@ -4,7 +4,7 @@ This file is read automatically by OpenAI Codex CLI when working in this reposit
 
 ## Project Overview
 
-Network-AI is a TypeScript/Node.js multi-agent orchestrator — shared state, guardrails, budgets, and cross-framework coordination. Version 4.15.1.
+Network-AI is a TypeScript/Node.js multi-agent orchestrator — shared state, guardrails, budgets, and cross-framework coordination. Version 4.15.2.
 
 ## Build & Test Commands
 
diff --git a/INTEGRATION_GUIDE.md b/INTEGRATION_GUIDE.md
@@ -477,4 +477,4 @@ Run these before declaring the integration production-ready:
 
 ---
 
-*Network-AI v4.15.1 · MIT License · https://github.com/Jovancoding/Network-AI*
+*Network-AI v4.15.2 · MIT License · https://github.com/Jovancoding/Network-AI*
diff --git a/README.md b/README.md
@@ -5,7 +5,7 @@
 [![Website](https://img.shields.io/badge/website-network--ai.org-4b9df2?style=flat&logo=web&logoColor=white)](https://network-ai.org/)
 [![CI](https://github.com/Jovancoding/Network-AI/actions/workflows/ci.yml/badge.svg)](https://github.com/Jovancoding/Network-AI/actions/workflows/ci.yml)
 [![CodeQL](https://github.com/Jovancoding/Network-AI/actions/workflows/codeql.yml/badge.svg)](https://github.com/Jovancoding/Network-AI/actions/workflows/codeql.yml)
-[![Release](https://img.shields.io/badge/release-v4.15.1-blue.svg)](https://github.com/Jovancoding/Network-AI/releases)
+[![Release](https://img.shields.io/badge/release-v4.15.2-blue.svg)](https://github.com/Jovancoding/Network-AI/releases)
 [![npm](https://img.shields.io/npm/dw/network-ai.svg?label=npm%20downloads)](https://www.npmjs.com/package/network-ai)
 [![Tests](https://img.shields.io/badge/tests-2357%20passing-brightgreen.svg)](#testing)
 [![Adapters](https://img.shields.io/badge/frameworks-17%20supported-blueviolet.svg)](#adapter-system)
diff --git a/lib/agent-runtime.ts b/lib/agent-runtime.ts
@@ -369,7 +369,6 @@ export class ShellExecutor {
     const maxBytes = opts.maxOutputBytes ?? this.policy.defaultMaxOutputBytes;
 
     this.activeProcesses++;
-    const startTime = Date.now();
 
     try {
       return await this.spawnCommand(command, cwd, timeoutMs, maxBytes, opts.env);
diff --git a/lib/strategy-agent.ts b/lib/strategy-agent.ts
@@ -689,7 +689,7 @@ export class StrategyAgent extends EventEmitter {
     }
 
     // Scale down: mark excess agents for recycling
-    for (const [poolId, target] of plan.scaleDown) {
+    for (const [poolId, _target] of plan.scaleDown) {
       const pool = this.pools.get(poolId);
       if (!pool) continue;
       const before = pool.active;
diff --git a/openapi.yaml b/openapi.yaml
@@ -6,7 +6,7 @@ info:
     blackboard coordination, parallel agent spawning, and permission gating
     via AuthGuardian. Requires the companion MCP server:
     `npm install -g network-ai && npx network-ai-server --port 3001`
-  version: 4.15.1
+  version: 4.15.2
   license:
     name: MIT
     url: https://github.com/Jovancoding/Network-AI/blob/main/LICENSE
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "network-ai",
-  "version": "4.15.1",
+  "version": "4.15.2",
   "description": "AI agent orchestration framework for TypeScript/Node.js - 17 adapters (LangChain, AutoGen, CrewAI, OpenAI Assistants, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, OpenClaw, A2A, Codex, MiniMax, NemoClaw, APS + streaming variants). Built-in CLI, security, swarm intelligence, real-time streaming, and agentic workflow patterns.",
   "homepage": "https://network-ai.org",
   "main": "dist/index.js",
diff --git a/security.ts b/security.ts
@@ -201,7 +201,7 @@ export class InputSanitizer {
   // Dangerous patterns that could indicate injection attempts
   private static DANGEROUS_PATTERNS = [
     /\$\{.*\}/g,           // Template injection
-    /<script\b[^>]*>[\s\S]*?<\/script>/gi, // XSS (non-backtracking open-tag)
+    /<script\b[^>]*>[\s\S]*?<\/script\s*>/gi, // XSS (handles </script > variants)
     /javascript:/gi,        // JavaScript protocol
     /on\w+\s*=/gi,         // Event handlers
     /\.\.\//g,             // Path traversal
diff --git a/skill.json b/skill.json
@@ -1,7 +1,7 @@
 {
   "name": "SwarmOrchestrator",
-  "version": "4.15.1",
-  "description": "Local Python orchestration skill: multi-agent workflows via shared blackboard file, permission gating, token budget scripts, and persistent project context. The bundled Python scripts make no network calls and have zero third-party dependencies. Workflow delegations via the host platform's sessions_send may invoke external model APIs.",
+  "version": "4.15.2",
+  "description": "Local Python orchestration skill: multi-agent workflows via shared blackboard file, permission gating, token budget scripts, and persistent project context. The bundled Python scripts make no network calls and have zero third-party dependencies. The parent repository also contains a TypeScript engine (not included in this skill bundle). Workflow delegations via the host platform's sessions_send may invoke external model APIs.",
   "author": "Network-AI Community",
   "homepage": "https://network-ai.org",
   "repository": "https://github.com/Jovancoding/Network-AI",  "source": "https://github.com/Jovancoding/Network-AI",  "license": "MIT",
diff --git a/test-phase9.ts b/test-phase9.ts
@@ -47,8 +47,6 @@ import { FederatedBudget } from './lib/federated-budget';
 import { JourneyFSM } from './lib/fsm-journey';
 import { AdapterRegistry } from './adapters/adapter-registry';
 import {
-  AgentPool,
-  WorkloadPartitioner,
   StrategyAgent,
   adaptiveStrategy,
 } from './lib/strategy-agent';
@@ -95,11 +93,6 @@ function assert(condition: boolean, test: string, detail?: string) {
   else fail(test, detail);
 }
 
-function assertThrows(fn: () => void, test: string) {
-  try { fn(); fail(test, 'Expected to throw'); }
-  catch { pass(test); }
-}
-
 async function assertRejects(fn: () => Promise<unknown>, test: string) {
   try { await fn(); fail(test, 'Expected to reject'); }
   catch { pass(test); }
@@ -293,7 +286,6 @@ async function testShellExecutor() {
   header('Phase 9b — ShellExecutor');
 
   const isWindows = process.platform === 'win32';
-  const echoCmd = isWindows ? 'echo hello' : 'echo hello';
 
   // 1. Execute a simple command
   {

Original file line number	Diff line number	Diff line change
`@@ -477,4 +477,4 @@ Run these before declaring the integration production-ready:`
`477`	`477`
`478`	`478`	`---`
`479`	`479`
`480`		`-Network-AI v4.15.1 · MIT License · https://github.com/Jovancoding/Network-AI`
	`480`	`+Network-AI v4.15.2 · MIT License · https://github.com/Jovancoding/Network-AI`
Original file line number	Diff line number	Diff line change
`@@ -689,7 +689,7 @@ export class StrategyAgent extends EventEmitter {`
`689`	`689`	`}`
`690`	`690`
`691`	`691`	`// Scale down: mark excess agents for recycling`
`692`		`- for (const [poolId, target] of plan.scaleDown) {`
	`692`	`+ for (const [poolId, _target] of plan.scaleDown) {`
`693`	`693`	`const pool = this.pools.get(poolId);`
`694`	`694`	`if (!pool) continue;`
`695`	`695`	`const before = pool.active;`