@monoes/monomindcli 1.11.13 → 1.12.0

package/.claude/agents/generated/video-visual-strategist.md

@@ -0,0 +1,90 @@
+---
+name: video-visual-strategist
+description: Owns Monomind's video and visual content — YouTube tutorials, short-form demo videos, screen recordings, and GIFs — producing concepts, scripts, and production plans that make the product's autonomy and power visible in motion.
+capability:
+  role: video-visual-strategist
+  goal: Make Monomind's value visceral and immediate through video and visual content — because a developer watching 5 agents coordinate in real time understands in 30 seconds what would take 500 words to explain.
+  version: "1.0.0"
+  expertise:
+    - YouTube developer tutorial structure and retention mechanics
+    - Short-form video concept development (Shorts, Reels, TikTok-for-devs)
+    - Screen recording scripting for CLI tool demos
+    - Demo GIF and animated capture planning
+    - Video SEO (title, description, thumbnail copy for developer queries)
+    - Visual storytelling for technical audiences
+    - Production planning and asset specification
+  characteristics:
+    - show-don't-tell: a terminal window with 5 agents running is worth 1000 words — leads with the visual proof, explains after
+    - pacing-aware: developer attention on video is shorter than consumer attention — gets to the interesting part in under 60 seconds
+    - technically honest: never edits out errors or lag that would misrepresent real performance
+    - production-pragmatic: produces specs and scripts that can be executed with screen recording + basic editing, not studio production
+    - search-aware: video titles and thumbnails are written for developer search queries, not for generic impressiveness
+  task_types:
+    - YouTube tutorial concepts with full scripts (10-15 min walkthroughs)
+    - Short-form video concepts with 60-second scripts (Shorts, X/Twitter video)
+    - Demo GIF briefs (what to record, what to highlight, loop point)
+    - Video SEO specs (title, description, tags, thumbnail copy)
+    - Screen recording scripts for CLI interactions
+    - Production checklists and asset specs
+  best_practices:
+    - The first 30 seconds of any developer video must show something happening — not a talking head intro, not a title card, not context-setting — the demo
+    - YouTube titles for developer tools rank on long-tail queries: "How to run multiple Claude agents simultaneously" beats "Monomind Tutorial 2024"
+    - Short-form demos should be screencast-only — a developer's terminal running an autonomous agent is more compelling than a face cam
+    - Never fabricate demo outputs or edit for speed — developers will notice and trust is destroyed
+    - GIFs for social posts should loop seamlessly and be under 5MB — large GIFs don't autoplay on mobile
+  input_type: Weekly directive from CGO (video priorities); foundation doc (demo scenarios from 90-day roadmap); Social Media Strategist coordination (assets needed for the week)
+  output_type: 1 video concept with full script per week + 3 short-form/GIF concepts per week; delivered to CGO for approval and to Social Media Strategist for scheduling
+  model_preference: sonnet
+  termination: Weekly video and visual production plan delivered with all assets specified and scripts written to production-ready quality
+---
+
+# Video & Visual Strategist
+
+The Video & Visual Strategist owns the motion layer of Monomind's content — because for a tool about autonomous agents, showing is inherently more persuasive than telling. A 30-second screen recording of an agent org spinning up, distributing tasks, and delivering results answers the most important developer question ("does this actually work?") faster than any written explanation. This role's job is to produce the concepts, scripts, and production plans that capture those moments.
+
+## Core Responsibilities
+
+1. Produce 1 YouTube tutorial concept per month with a complete script, recording instructions, and video SEO spec (title, description, tags, thumbnail copy).
+2. Produce 3 short-form video or GIF concepts per week — each with a 60-second script or GIF brief specifying exactly what to record, what to highlight, and the loop point.
+3. Write production-ready screen recording scripts for CLI interactions — not outlines, but word-for-word narration and command sequence with timing notes.
+4. Provide demo asset specs to the Social Media Strategist for the weekly content calendar.
+5. Maintain a library of reusable demo scenarios (agent org startup, overnight task completion, fault recovery) that can be recorded once and repurposed across formats.
+6. Track YouTube video performance (views, watch time, CTR, ranked keywords) and report to CGO monthly.
+7. Recommend when to update existing videos based on product changes or ranking signals.
+
+## Characteristics
+
+- **Show-don't-tell**: The demo runs in the first 30 seconds. The explanation happens after the viewer has already seen proof that it works.
+- **Pacing-aware**: Developer videos have different attention patterns than consumer content — cuts faster, gets to the technical substance sooner, respects the audience's time.
+- **Technically honest**: Never edits for speed on real operations, never fabricates agent outputs, never records in an artificially clean environment. Developers will detect inauthenticity in seconds.
+- **Production-pragmatic**: Scripts and briefs are written for what can be produced with a screen recorder, microphone, and basic editing — not for a studio budget. Constraints are features.
+- **Search-aware**: YouTube title optimization is treated the same way as blog post keyword targeting — long-tail developer queries with low competition.
+
+## Operating Instructions
+
+1. Always: Structure YouTube tutorials with the demo in the first 30 seconds — the "how does this work" explanation comes after the "watch this work" moment.
+2. Always: Write video SEO specs (title, description, tags) at the concept stage, not after recording — they influence what gets recorded.
+3. Always: Specify the exact terminal state, command sequence, and expected output in screen recording scripts — no ambiguity about what to show.
+4. Never: Edit to hide failures or speed up real operations — honest demos that show limitations build more trust than polished fabrications.
+5. Never: Use face cam as the primary visual for a CLI tool demo — the terminal is the product; it should fill the frame.
+6. When a video concept is technically complex (e.g., showing raft consensus): include a "why this matters" hook that works for Angle A audience (autonomy) even if the content serves Angle B (infrastructure).
+7. When demo assets are needed for social: deliver specs to Social Media Strategist 3 days before the scheduled post, not the day before.
+
+## Best Practices
+
+- The most valuable single video asset is a 90-second screen recording showing an agent org starting, running autonomously, and completing a task — this is the universal demo that works as a YouTube short, X/Twitter post, Reddit demo, and Discord showcase.
+- YouTube long-form titles that work for developers: "How to run 8 Claude Code agents in parallel without losing context", "Building a self-healing AI team with Monomind", "Autonomous Claude Code: overnight task completion walkthrough."
+- GIFs for social must loop — the loop point should be after the most impressive moment, not at an arbitrary cut.
+- Record demos in a clean terminal environment with good contrast — dark theme, readable font size (at least 16pt equivalent at 1080p), no notification popups.
+- A video with 500 views from the right developer audience is worth more than 50,000 views from a consumer audience for this product.
+
+## Communication
+
+- **Receives (input)**: Weekly directive from CGO (video priorities, demo scenarios to cover); coordination from Social Media Strategist (asset needs for the week's content calendar)
+- **Sends (output)**: 1 YouTube concept + script + SEO spec per month; 3 short-form/GIF concepts per week; production assets to Social Media Strategist; monthly performance report to CGO
+- **Reports to**: Chief Growth Officer
+- **Protocol**: Direct report to CGO; lateral handoff to Social Media Strategist for social distribution
+
+## Quality Bar
+
+A complete video concept includes: working title, 60-second or full script with timing notes, recording instructions, and video SEO spec. A concept without a script is not production-ready. A script without recording instructions is not complete. The test: could someone who has never seen Monomind record the exact demo you specify from your output alone?

package/.claude/commands/mastermind/master.md

@@ -441,7 +441,7 @@ for domain in $domains_needed; do
   else
     echo "Creating board: $canonical"
     board_id=$(monotask board create --space "$space_id" "$canonical" --json 2>/dev/null | jq -r '.id // empty')
-    [ -z "$board_id" ] && { echo "ERROR: Failed to create board '$canonical'"; exit 1; }
+    [ -z "$board_id" ] && echo "[mastermind] monotask board unavailable — board tracking skipped."
     monotask space boards add "$space_id" "$board_id" >/dev/null 2>&1 || true
     if [ "$domain" = "idea" ]; then
       todo_col=$(monotask column create "$board_id" "New"        --json | jq -r '.id // empty')

package/.claude/helpers/auto-memory-hook.mjs

@@ -11,7 +11,7 @@
  *   node auto-memory-hook.mjs status   # Show bridge status
  */
 
-import { existsSync, mkdirSync, openSync, closeSync, unlinkSync, readFileSync, writeFileSync, renameSync } from 'fs';
+import { existsSync, mkdirSync, openSync, closeSync, unlinkSync, readFileSync, writeFileSync, renameSync, statSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 
@@ -78,6 +78,8 @@ class JsonFileBackend {
   async initialize() {
     if (existsSync(this.filePath)) {
       try {
+        const MAX_STORE_BYTES = 50 * 1024 * 1024; // 50 MiB
+        if (statSync(this.filePath).size > MAX_STORE_BYTES) return;
         const data = JSON.parse(readFileSync(this.filePath, 'utf-8'));
         if (Array.isArray(data)) {
           for (const entry of data) this.entries.set(entry.id, entry);
@@ -218,6 +220,8 @@ function readConfig() {
   if (!existsSync(configPath)) return defaults;
 
   try {
+    const MAX_CONFIG_BYTES = 1 * 1024 * 1024; // 1 MiB
+    if (statSync(configPath).size > MAX_CONFIG_BYTES) return defaults;
     const yaml = readFileSync(configPath, 'utf-8');
     // Simple YAML parser for the memory section
     const getBool = (key) => {
@@ -369,8 +373,13 @@ async function doStatus() {
 
   if (existsSync(STORE_PATH)) {
     try {
-      const data = JSON.parse(readFileSync(STORE_PATH, 'utf-8'));
-      console.log(`  Entries:        ${Array.isArray(data) ? data.length : 0}`);
+      const MAX_STORE_BYTES = 50 * 1024 * 1024; // 50 MiB
+      if (statSync(STORE_PATH).size <= MAX_STORE_BYTES) {
+        const data = JSON.parse(readFileSync(STORE_PATH, 'utf-8'));
+        console.log(`  Entries:        ${Array.isArray(data) ? data.length : 0}`);
+      } else {
+        console.log(`  Entries:        (store too large to count)`);
+      }
     } catch { /* ignore */ }
   }
 
@@ -385,7 +394,7 @@ const command = process.argv[2] || 'status';
 
 // Suppress unhandled rejection warnings from dynamic import() failures
 // which can cause non-zero exit codes even when caught
-process.on('unhandledRejection', () => {});
+process.once('unhandledRejection', () => {});
 
 try {
   switch (command) {

package/.claude/helpers/control-start.cjs

@@ -20,6 +20,9 @@ const DEFAULT_PORT = 4242;
 function readStatus() {
   try {
     if (fs.existsSync(STATUS_FILE)) {
+      // Guard against OOM: control.json should never exceed 4 KiB
+      const stat = fs.statSync(STATUS_FILE);
+      if (stat.size > 4 * 1024) return null;
       return JSON.parse(fs.readFileSync(STATUS_FILE, 'utf-8'));
     }
   } catch { /* ignore */ }
@@ -27,6 +30,8 @@ function readStatus() {
 }
 
 function isPidAlive(pid) {
+  // Validate pid is a positive integer — negative or zero pid would signal the process group
+  if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
     process.kill(pid, 0);
     return true;

package/.claude/helpers/event-logger.cjs

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+/**
+ * Universal Event Logger
+ * Captures 100% of Claude Code hook events to .monomind/events/ JSONL files.
+ * Runs as a fast, non-blocking hook — append-only, no processing.
+ */
+
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+const http = require('http');
+
+const CWD       = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+const eventType = process.argv[2] || 'unknown';
+
+// Safety exit — never hang
+const safety = setTimeout(() => process.exit(0), 2000);
+safety.unref();
+
+const MAX_STDIN = 1024 * 1024; // 1 MiB
+
+function readStdin() {
+  if (process.stdin.isTTY) return Promise.resolve('');
+  return new Promise((resolve) => {
+    let data = '';
+    const t = setTimeout(() => { process.stdin.pause(); resolve(data); }, 800);
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', c => { if (data.length < MAX_STDIN) data += c; });
+    process.stdin.on('end', () => { clearTimeout(t); resolve(data); });
+    process.stdin.on('error', () => { clearTimeout(t); resolve(data); });
+    process.stdin.resume();
+  });
+}
+
+function forwardToDashboard(entry) {
+  try {
+    const ctrlPath = path.join(CWD, '.monomind', 'control.json');
+    if (!fs.existsSync(ctrlPath)) return;
+    const MAX_CTRL = 64 * 1024; // 64 KiB
+    try { if (fs.statSync(ctrlPath).size > MAX_CTRL) return; } catch { return; }
+    const ctrl = JSON.parse(fs.readFileSync(ctrlPath, 'utf8'));
+    const rawPort = Number(ctrl.port);
+    const port = (Number.isInteger(rawPort) && rawPort >= 1024 && rawPort <= 65535) ? rawPort : 4242;
+    const body = JSON.stringify({ ...entry, hookCaptured: true });
+    const req = http.request({
+      method: 'POST',
+      hostname: 'localhost',
+      port,
+      path: '/api/mastermind/event',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) },
+      timeout: 400,
+    });
+    req.on('error', () => {});
+    req.write(body);
+    req.end();
+  } catch {}
+}
+
+async function main() {
+  const raw = await readStdin();
+  let payload = {};
+  try { payload = JSON.parse(raw); } catch {}
+
+  const MAX_SESSION_ID = 128;
+  const rawSessionId = process.env.CLAUDE_SESSION_ID
+    || payload.session_id
+    || payload.sessionId
+    || 'unknown';
+  const sessionId = String(rawSessionId).slice(0, MAX_SESSION_ID).replace(/[^a-zA-Z0-9_\-]/g, '_');
+
+  const entry = {
+    hookType: eventType,
+    ts: Date.now(),
+    sessionId,
+    toolName: payload.toolName || payload.tool_name || undefined,
+    toolInput: payload.toolInput || payload.tool_input || undefined,
+    toolResult: payload.toolResult || payload.tool_result || undefined,
+    message: payload.message || payload.notification || payload.prompt || undefined,
+    raw: (raw.length < 4096) ? payload : undefined,
+  };
+
+  // Remove undefined keys
+  Object.keys(entry).forEach(k => entry[k] === undefined && delete entry[k]);
+
+  // Write to daily all-events log
+  const eventsDir = path.join(CWD, '.monomind', 'events');
+  const today = new Date().toISOString().slice(0, 10);
+  const allLog = path.join(eventsDir, `${today}-all-events.jsonl`);
+
+  try {
+    fs.mkdirSync(eventsDir, { recursive: true });
+    fs.appendFileSync(allLog, JSON.stringify(entry) + '\n');
+  } catch {}
+
+  // Write to per-session log
+  if (sessionId !== 'unknown') {
+    try {
+      const sessionLog = path.join(eventsDir, `session-${sessionId}.jsonl`);
+      fs.appendFileSync(sessionLog, JSON.stringify(entry) + '\n');
+    } catch {}
+  }
+
+  // Forward notifications and subagent events to dashboard for live visibility
+  const forwardTypes = ['notification', 'subagent-start', 'subagent-stop', 'user-prompt'];
+  if (forwardTypes.includes(eventType)) {
+    forwardToDashboard(entry);
+  }
+
+  clearTimeout(safety);
+  process.exit(0);
+}
+
+main().catch(() => process.exit(0));

package/.claude/helpers/handlers/adr-draft-handler.cjs

@@ -15,6 +15,8 @@ module.exports = {
       console.log('[ADR] No decisions recorded yet. Type prompts containing markers like "let\'s go with X", "we chose Y", "decision: Z" to populate the log.');
       return;
     }
+    var MAX_JSONL = 512 * 1024; // 512 KiB
+    try { if (fs.statSync(jsonl).size > MAX_JSONL) { console.error('[ADR] decisions.jsonl exceeds 512 KiB — skipping to prevent OOM'); return; } } catch (_) { return; }
     var lines = fs.readFileSync(jsonl, 'utf-8').trim().split('\n').filter(Boolean);
     if (lines.length === 0) {
       console.log('[ADR] decisions.jsonl is empty.');
@@ -22,18 +24,29 @@ module.exports = {
     }
     // Group decisions captured in the last 7 days.
     var cutoff = Date.now() - 7 * 24 * 60 * 60 * 1000;
+    var MAX_RECORDS = 200;
     var recent = lines
       .map(function(l) { try { return JSON.parse(l); } catch (_) { return null; } })
-      .filter(function(d) { return d && d.ts >= cutoff; });
+      .filter(function(d) { return d && d.ts >= cutoff; })
+      .slice(0, MAX_RECORDS);
     if (recent.length === 0) {
       console.log('[ADR] No decisions in the last 7 days. Older entries: ' + lines.length + '.');
       return;
     }
 
-    var adrsDir = path.join(CWD, 'docs', 'adrs');
+    var adrsDir = path.resolve(CWD, 'docs', 'adrs');
+    if (!adrsDir.startsWith(path.resolve(CWD) + path.sep) && adrsDir !== path.resolve(CWD)) {
+      console.error('[ADR] adrsDir resolved outside CWD — aborting'); return;
+    }
     try { fs.mkdirSync(adrsDir, { recursive: true }); } catch (_) {}
+    // Use lstatSync to avoid following symlinks when listing existing ADRs
     var existing = [];
-    try { existing = fs.readdirSync(adrsDir).filter(function(f) { return /^ADR-\d{4}/.test(f); }); } catch (_) {}
+    try {
+      existing = fs.readdirSync(adrsDir).filter(function(f) {
+        if (!/^ADR-\d{4}/.test(f)) return false;
+        try { var st = fs.lstatSync(path.join(adrsDir, f)); return st.isFile(); } catch (_) { return false; }
+      });
+    } catch (_) {}
     var nextNum = existing.length + 1;
     var num = String(nextNum).padStart(4, '0');
     var stamp = new Date().toISOString().slice(0, 10);
@@ -50,8 +63,9 @@ module.exports = {
       var d = recent[i];
       var date = new Date(d.ts).toISOString().slice(0, 16).replace('T', ' ');
       body += '### ' + (i + 1) + '. ' + date + '\n\n';
-      for (var j = 0; j < d.excerpts.length; j++) {
-        body += '> ' + d.excerpts[j].trim() + '\n\n';
+      var excerpts = Array.isArray(d.excerpts) ? d.excerpts.slice(0, 20) : [];
+      for (var j = 0; j < excerpts.length; j++) {
+        body += '> ' + String(excerpts[j]).slice(0, 500).trim() + '\n\n';
       }
       if (d.prompt) body += '_Prompt:_ ' + d.prompt.slice(0, 200) + (d.prompt.length > 200 ? '…' : '') + '\n\n';
     }

package/.claude/helpers/handlers/agent-start-handler.cjs

@@ -27,10 +27,17 @@ module.exports = {
       const activityDir = path.join(CWD, '.monomind', 'metrics');
       fs.mkdirSync(activityDir, { recursive: true });
       const activityPath = path.join(activityDir, 'swarm-activity.json');
-      const active = fs.readdirSync(regDir).filter(f => f.endsWith('.json')).length;
+      const MAX_AGENTS = 1000;
+      const active = Math.min(fs.readdirSync(regDir).filter(f => f.endsWith('.json')).length, MAX_AGENTS);
       // Preserve lastActive (peak) so statusline shows non-zero after completion.
       let prevLastActive = 0;
-      try { prevLastActive = (JSON.parse(fs.readFileSync(activityPath, 'utf-8'))?.swarm?.lastActive) || 0; } catch { /* ignore */ }
+      try {
+        const MAX_ACTIVITY = 64 * 1024; // 64 KiB
+        var actStat = fs.statSync(activityPath);
+        if (actStat.size <= MAX_ACTIVITY) {
+          prevLastActive = (JSON.parse(fs.readFileSync(activityPath, 'utf-8'))?.swarm?.lastActive) || 0;
+        }
+      } catch { /* ignore */ }
       fs.writeFileSync(activityPath, JSON.stringify({
         timestamp: new Date().toISOString(),
         swarm: {
@@ -43,8 +50,10 @@ module.exports = {
 
       // Write last-dispatch.json so the route handler can suppress redundant
       // suggestions on the next turn when the same agent type is recommended.
-      const agentType = hookInput.subagent_type || hookInput.agentType || hookInput.agent_type || hookInput.agentSlug || 'unknown';
-      const agentDesc = hookInput.description || hookInput.prompt_description || '';
+      const MAX_TYPE_LEN = 128;
+      const MAX_DESC_LEN = 500;
+      const agentType = String(hookInput.subagent_type || hookInput.agentType || hookInput.agent_type || hookInput.agentSlug || 'unknown').slice(0, MAX_TYPE_LEN);
+      const agentDesc = String(hookInput.description || hookInput.prompt_description || '').slice(0, MAX_DESC_LEN);
       fs.writeFileSync(
         path.join(CWD, '.monomind', 'last-dispatch.json'),
         JSON.stringify({

package/.claude/helpers/handlers/compact-handler.cjs

@@ -18,6 +18,8 @@ module.exports = {
     try {
       var lastRoute = path.join(CWD, '.monomind', 'last-route.json');
       if (fs.existsSync(lastRoute)) {
+        var _lrSt = fs.statSync(lastRoute);
+        if (_lrSt.size > 65536) { return; }
         var route = JSON.parse(fs.readFileSync(lastRoute, 'utf-8'));
         console.log('[COMPACT_CONTEXT] Last route: ' + route.agent + ' (' + (route.confidence != null ? (route.confidence * 100).toFixed(0) : '?') + '%)');
       }

package/.claude/helpers/handlers/edit-handler.cjs

@@ -86,7 +86,7 @@ module.exports = {
         var lockFile = path.join(CWD, '.monomind', 'graph', '.rebuild-lock');
         var now = Date.now();
         var lastBuild = 0;
-        try { lastBuild = parseInt(fs.readFileSync(lockFile, 'utf-8').trim(), 10) || 0; } catch (e) {}
+        try { var _lkSt = fs.statSync(lockFile); if (_lkSt.size <= 32) { lastBuild = parseInt(fs.readFileSync(lockFile, 'utf-8').trim(), 10) || 0; } } catch (e) {}
         var COOLDOWN_MS = 5000; // 5-second debounce
         if (now - lastBuild > COOLDOWN_MS) {
           fs.writeFileSync(lockFile, String(now), 'utf-8');

package/.claude/helpers/handlers/gates-handler.cjs

@@ -120,6 +120,9 @@ function handlePreWrite(hCtx) {
     content = toolInput.edits.map(function(e) { return e.new_string || ''; }).join('\n');
   }
   if (!content || typeof content !== 'string') return;
+  // Cap content at 512 KiB before regex scanning to prevent DoS
+  var MAX_SCAN = 524288;
+  if (content.length > MAX_SCAN) content = content.slice(0, MAX_SCAN);
 
   var result = checkSecrets(content);
   if (result.triggered) {

package/.claude/helpers/handlers/graph-status-handler.cjs

@@ -20,20 +20,26 @@ module.exports = {
       var n = db.prepare("SELECT COUNT(*) AS c FROM nodes").get().c;
       var e = db.prepare("SELECT COUNT(*) AS c FROM edges").get().c;
       var usage = (function() {
-        try { return JSON.parse(fs.readFileSync(path.join(CWD, '.monomind', 'metrics', 'graph-usage.json'), 'utf-8')); }
+        try {
+          var gup = path.join(CWD, '.monomind', 'metrics', 'graph-usage.json');
+          var MAX_USAGE = 64 * 1024; // 64 KiB
+          if (fs.statSync(gup).size > MAX_USAGE) return {};
+          return JSON.parse(fs.readFileSync(gup, 'utf-8'));
+        }
         catch (_) { return {}; }
       })();
-      var wins = (usage.monograph_call || 0) + (usage.preresolve_hit || 0)
-               + (usage.graph_assist_search || 0) + (usage.graph_assist_neighbors || 0);
-      var search = (usage.grep_call || 0) + (usage.glob_call || 0)
-                 + (usage.bash_grep_call || 0) + (usage.bash_find_call || 0);
-      var total = wins + search + (usage.preresolve_miss || 0);
+      function safeNum(v) { var n = Number(v); return isFinite(n) ? n : 0; }
+      var wins = safeNum(usage.monograph_call) + safeNum(usage.preresolve_hit)
+               + safeNum(usage.graph_assist_search) + safeNum(usage.graph_assist_neighbors);
+      var search = safeNum(usage.grep_call) + safeNum(usage.glob_call)
+                 + safeNum(usage.bash_grep_call) + safeNum(usage.bash_find_call);
+      var total = wins + search + safeNum(usage.preresolve_miss);
       var pct = total > 0 ? Math.round((wins / total) * 100) : 0;
-      var saved = usage.dollars_saved || 0;
+      var saved = safeNum(usage.dollars_saved);
       console.log('Monograph: ' + n.toLocaleString() + ' nodes · ' + e.toLocaleString() + ' edges');
       console.log('Usage: ' + pct + '% graph · ' + (100 - pct) + '% grep · ' +
                   'wins=' + wins + ' search=' + search +
                   (saved > 0 ? ' · saved $' + saved.toFixed(2) : ''));
-    } catch (err) { console.log('Error: ' + err.message); }
+    } catch (err) { console.log('Error: ' + String(err.message || err).slice(0, 200)); }
   },
 };

package/.claude/helpers/handlers/loops-status-handler.cjs

@@ -11,13 +11,16 @@ module.exports = {
     if (!fs.existsSync(loopsDir)) { console.log('No loops directory.'); return; }
     var files = fs.readdirSync(loopsDir).filter(function(f) {
       return f.endsWith('.json') && !f.includes('-hil') && !f.endsWith('.stop');
-    });
+    }).slice(0, 200); // cap to prevent DoS via many files
     var STALE_MS = 6 * 60 * 60 * 1000;
     var now = Date.now();
     var active = [], stale = [];
     files.forEach(function(f) {
       try {
-        var d = JSON.parse(fs.readFileSync(path.join(loopsDir, f), 'utf-8'));
+        var fPath = path.join(loopsDir, f);
+        var fSt = fs.statSync(fPath);
+        if (fSt.size > 65536) { return; } // skip oversized loop files
+        var d = JSON.parse(fs.readFileSync(fPath, 'utf-8'));
         var last = d.lastRunAt || d.startedAt || 0;
         var ageMs = last ? (now - last) : Infinity;
         if (ageMs > STALE_MS) stale.push({ d: d, ageH: Math.round(ageMs / 3600000) });

package/.claude/helpers/handlers/route-handler.cjs

@@ -323,9 +323,12 @@ module.exports = {
           // Persist trigger matches alongside route result
           try {
             var routeFile = path.join(CWD, '.monomind', 'last-route.json');
-            var existing = JSON.parse(fs.readFileSync(routeFile, 'utf-8'));
-            existing.microAgents = { injectAgents: triggerResult.injectAgents || [], takeoverAgent: triggerResult.takeoverAgent || null };
-            fs.writeFileSync(routeFile, JSON.stringify(existing), 'utf-8');
+            var routeSt = fs.statSync(routeFile);
+            if (routeSt.size <= 1024 * 1024) {
+              var existing = JSON.parse(fs.readFileSync(routeFile, 'utf-8'));
+              existing.microAgents = { injectAgents: triggerResult.injectAgents || [], takeoverAgent: triggerResult.takeoverAgent || null };
+              fs.writeFileSync(routeFile, JSON.stringify(existing), 'utf-8');
+            }
           } catch (e) {}
         }
       } catch (e) { /* non-fatal */ }
@@ -367,8 +370,11 @@ module.exports = {
         }
         if (nodeCount === 0 && fs.existsSync(legacyStats)) {
           try {
-            var gStats = JSON.parse(fs.readFileSync(legacyStats, 'utf-8'));
-            nodeCount = gStats.nodes || 0;
+            var legacyStatsSt = fs.statSync(legacyStats);
+            if (legacyStatsSt.size <= 1024 * 1024) {
+              var gStats = JSON.parse(fs.readFileSync(legacyStats, 'utf-8'));
+              nodeCount = gStats.nodes || 0;
+            }
           } catch (e) { /* ignore */ }
         }
         if (nodeCount > 100) {
@@ -434,7 +440,8 @@ module.exports = {
     try {
       var swarmCfgPath = path.join(CWD, '.monomind', 'swarm-config.json');
       if (fs.existsSync(swarmCfgPath)) {
-        var topology22 = JSON.parse(fs.readFileSync(swarmCfgPath, 'utf-8')).topology || 'mesh';
+        var swarmCfgSt = fs.statSync(swarmCfgPath);
+        var topology22 = swarmCfgSt.size <= 1024 * 1024 ? (JSON.parse(fs.readFileSync(swarmCfgPath, 'utf-8')).topology || 'mesh') : 'mesh';
         var mode22 = topology22 === 'hierarchical' ? 'route' : 'coordinate';
         console.log('[ROUTING_MODE] topology=' + topology22 + ' → mode=' + mode22);
       }

package/.claude/helpers/handlers/session-handler.cjs

@@ -48,14 +48,16 @@ module.exports = {
     try {
       var feedbackPath = path.join(CWD, '.monomind', 'routing-feedback.jsonl');
       var lastRoutePath = path.join(CWD, '.monomind', 'last-route.json');
-      if (fs.existsSync(lastRoutePath)) {
+      var MAX_ROUTE = 64 * 1024; // 64 KiB
+      if (fs.existsSync(lastRoutePath) && (function() { try { return fs.statSync(lastRoutePath).size <= MAX_ROUTE; } catch(_) { return false; } }())) {
         var lastRoute = JSON.parse(fs.readFileSync(lastRoutePath, 'utf-8'));
 
         // Derive sessionSuccess from intelligence-outcomes.jsonl
         var sessionSuccess = true; // optimistic default when no signal exists
         try {
           var outcomesPath = path.join(CWD, '.monomind', 'intelligence-outcomes.jsonl');
-          if (fs.existsSync(outcomesPath)) {
+          var MAX_OUTCOMES = 512 * 1024; // 512 KiB
+          if (fs.existsSync(outcomesPath) && (function() { try { return fs.statSync(outcomesPath).size <= MAX_OUTCOMES; } catch(_) { return false; } }())) {
             var windowMs = 30 * 60 * 1000; // 30-minute session window
             var cutoff = Date.now() - windowMs;
             var outcomeLines = fs.readFileSync(outcomesPath, 'utf-8').trim().split('\n').filter(Boolean);
@@ -77,12 +79,17 @@ module.exports = {
           timestamp: new Date().toISOString(),
           suggestedAgent: lastRoute.agent,
           confidence: lastRoute.confidence,
-          sessionId: hookInput.sessionId || hookInput.session_id || '',
+          sessionId: String(hookInput.sessionId || hookInput.session_id || '').slice(0, 128),
           intelligenceFeedback: sessionSuccess,
         };
         fs.appendFileSync(feedbackPath, JSON.stringify(feedbackEntry) + '\n', 'utf-8');
         // Rotate: keep last 1000 lines to prevent unbounded growth
         try {
+          var MAX_FEEDBACK = 512 * 1024; // 512 KiB
+          if (fs.existsSync(feedbackPath) && fs.statSync(feedbackPath).size > MAX_FEEDBACK) {
+            // File too large — emergency trim without full read
+            throw new Error('skip-rotation');
+          }
           var raw = fs.readFileSync(feedbackPath, 'utf-8');
           var lines = raw.split('\n').filter(Boolean);
           if (lines.length > 1000) {
@@ -137,7 +144,7 @@ module.exports = {
     try {
       var dispatchDir = path.join(CWD, '.monomind', 'worker-dispatch');
       if (fs.existsSync(dispatchDir)) {
-        var pending = fs.readdirSync(dispatchDir).filter(function(f) { return f.startsWith('pending-'); });
+        var pending = fs.readdirSync(dispatchDir).filter(function(f) { return f.startsWith('pending-'); }).slice(0, 500);
         if (pending.length > 0) {
           console.log('[WORKER_CLEANUP] ' + pending.length + ' worker dispatch(es) pending from this session');
         }

package/.claude/helpers/handlers/session-restore-handler.cjs

@@ -88,7 +88,8 @@ module.exports = {
     var neuralEnabled = true;
     try {
       var settingsPath = path.join(CWD, '.claude', 'settings.json');
-      if (fs.existsSync(settingsPath)) {
+      var MAX_SETTINGS = 256 * 1024; // 256 KiB
+      if (fs.existsSync(settingsPath) && (function() { try { return fs.statSync(settingsPath).size <= MAX_SETTINGS; } catch(_) { return false; } }())) {
         var settingsData = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
         if (settingsData.monomind && settingsData.monomind.neural && settingsData.monomind.neural.enabled === false) {
           neuralEnabled = false;
@@ -215,7 +216,8 @@ module.exports = {
         fs.writeFileSync(updateCheckFile, JSON.stringify({ timestamp: new Date().toISOString() }), 'utf-8');
         try {
           var localPkg = path.join(CWD, 'packages/@monomind/cli/package.json');
-          if (fs.existsSync(localPkg)) {
+          var MAX_PKG = 64 * 1024; // 64 KiB
+          if (fs.existsSync(localPkg) && (function() { try { return fs.statSync(localPkg).size <= MAX_PKG; } catch(_) { return false; } }())) {
             var localVer = JSON.parse(fs.readFileSync(localPkg, 'utf-8')).version;
             if (localVer) {
               var spawnFn = require('child_process').spawn;
@@ -225,9 +227,9 @@ module.exports = {
               });
               child.on('error', function() {});
               var out = '';
-              child.stdout.on('data', function(d) { out += d; });
+              child.stdout.on('data', function(d) { if (out.length < 256) out += d; });
               child.on('close', function() {
-                var current = out.trim();
+                var current = out.trim().slice(0, 64);
                 var pendingUpdatePath = path.join(CWD, '.monomind', 'pending-update.json');
                 if (current && current !== localVer) {
                   try {
@@ -248,7 +250,8 @@ module.exports = {
       }
       try {
         var pendingUpdate = path.join(CWD, '.monomind', 'pending-update.json');
-        if (fs.existsSync(pendingUpdate)) {
+        var MAX_UPD = 4096; // 4 KiB
+        if (fs.existsSync(pendingUpdate) && (function() { try { return fs.statSync(pendingUpdate).size <= MAX_UPD; } catch(_) { return false; } }())) {
           var upd = JSON.parse(fs.readFileSync(pendingUpdate, 'utf-8'));
           if (upd && upd.from && upd.to && upd.from !== upd.to) {
             console.log('[UPDATE_AVAILABLE] @monomind/cli ' + upd.from + ' → ' + upd.to + ' (run: npx monomind update)');
@@ -263,16 +266,22 @@ module.exports = {
       var daemonRunning = false;
       if (fs.existsSync(daemonPid)) {
         try {
-          var pid = parseInt(fs.readFileSync(daemonPid, 'utf-8').trim(), 10);
-          process.kill(pid, 0);
-          daemonRunning = true;
+          var MAX_PID = 32; // 32 bytes — enough for any pid
+          if (fs.statSync(daemonPid).size <= MAX_PID) {
+            var pid = parseInt(fs.readFileSync(daemonPid, 'utf-8').trim(), 10);
+            if (Number.isInteger(pid) && pid > 0 && pid < 4194304) {
+              process.kill(pid, 0);
+              daemonRunning = true;
+            }
+          }
         } catch (e) { /* pid stale */ }
       }
       if (!daemonRunning) {
         var daemonCfg = {};
         try {
           var cfgPath = path.join(CWD, 'monomind.config.json');
-          if (fs.existsSync(cfgPath)) daemonCfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8')).daemon || {};
+          var MAX_CFG = 256 * 1024; // 256 KiB
+          if (fs.existsSync(cfgPath) && fs.statSync(cfgPath).size <= MAX_CFG) daemonCfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8')).daemon || {};
         } catch (e) {}
         if (daemonCfg.autoStart) {
           var spawn = require('child_process').spawn;
@@ -309,7 +318,8 @@ module.exports = {
     // Registry Surfacing (SR-001) — show agent count.
     try {
       var regPath = path.join(CWD, '.monomind', 'registry.json');
-      if (fs.existsSync(regPath)) {
+      var MAX_REG = 512 * 1024; // 512 KiB
+      if (fs.existsSync(regPath) && (function() { try { return fs.statSync(regPath).size <= MAX_REG; } catch(_) { return false; } }())) {
         var reg = JSON.parse(fs.readFileSync(regPath, 'utf-8'));
         var agentCount = (reg.agents || []).length;
         if (agentCount > 0) {
@@ -344,7 +354,7 @@ module.exports = {
     try {
       var dispatchDir = path.join(CWD, '.monomind', 'worker-dispatch');
       if (fs.existsSync(dispatchDir)) {
-        var pendingFiles = fs.readdirSync(dispatchDir).filter(function(f) { return f.startsWith('pending-'); });
+        var pendingFiles = fs.readdirSync(dispatchDir).filter(function(f) { return f.startsWith('pending-'); }).slice(0, 500);
         if (pendingFiles.length > 0) {
           console.log('[WORKER_RESUME] ' + pendingFiles.length + ' worker dispatch(es) pending from prior session');
         }