@monoes/monomindcli 1.11.14 → 1.12.0

package/.claude/helpers/handlers/task-handler.cjs

@@ -172,7 +172,7 @@ module.exports = {
         const remaining = fs.readdirSync(regDir).filter(f => f.endsWith('.json')).length;
         const _actPath = path.join(CWD, '.monomind', 'metrics', 'swarm-activity.json');
         let _prevLastActive = 0;
-        try { _prevLastActive = (JSON.parse(fs.readFileSync(_actPath, 'utf-8'))?.swarm?.lastActive) || 0; } catch { /* ignore */ }
+        try { var _actSt = fs.statSync(_actPath); if (_actSt.size < 65536) { _prevLastActive = (JSON.parse(fs.readFileSync(_actPath, 'utf-8'))?.swarm?.lastActive) || 0; } } catch { /* ignore */ }
         fs.writeFileSync(_actPath, JSON.stringify({
           timestamp: new Date().toISOString(),
           swarm: {
@@ -217,7 +217,8 @@ module.exports = {
       try {
         var haltFile = path.join(CWD, 'data', 'halt-signals.jsonl');
         if (fs.existsSync(haltFile)) {
-          var haltLines = fs.readFileSync(haltFile, 'utf-8').trim().split('\n').filter(Boolean);
+          var haltSt = fs.statSync(haltFile);
+          var haltLines = haltSt.size < 1048576 ? fs.readFileSync(haltFile, 'utf-8').trim().split('\n').filter(Boolean) : [];
           if (haltLines.length > 0) {
             console.warn('[HALT_DETECTED] ' + haltLines.length + ' halt signal(s) present');
           }
@@ -298,8 +299,11 @@ module.exports = {
       var settingsPath = path.join(CWD, '.claude', 'settings.json');
       var adrCfg = {};
       if (fs.existsSync(settingsPath)) {
-        var s = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
-        adrCfg = (s.monomind && s.monomind.adr) || {};
+        var settingsSt = fs.statSync(settingsPath);
+        if (settingsSt.size < 524288) {
+          var s = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+          adrCfg = (s.monomind && s.monomind.adr) || {};
+        }
       }
       if (adrCfg.autoGenerate) {
         var taskAgent = hookInput.agentSlug || hookInput.agent_slug || '';
@@ -307,7 +311,11 @@ module.exports = {
         var isArchitectLevel = ['architect', 'system-architect', 'software-architect'].includes(taskAgent)
           || /\b(architecture|design decision|adr|trade-?off|migration strategy)\b/.test(taskDescAdr);
         if (isArchitectLevel && taskDescAdr.length > 30) {
-          var adrDir = path.join(CWD, adrCfg.directory || 'docs/adrs');
+          // Guard adrCfg.directory against path traversal outside CWD
+          var rawAdrDir = typeof adrCfg.directory === 'string' ? adrCfg.directory : 'docs/adrs';
+          var resolvedAdrDir = path.resolve(CWD, rawAdrDir);
+          if (!resolvedAdrDir.startsWith(CWD + path.sep) && resolvedAdrDir !== CWD) { throw new Error('adr.directory outside project'); }
+          var adrDir = resolvedAdrDir;
           fs.mkdirSync(adrDir, { recursive: true });
           var adrNum = (fs.readdirSync(adrDir).filter(function(f) { return f.endsWith('.md'); }).length + 1)
             .toString().padStart(4, '0');

package/.claude/helpers/intelligence.cjs

@@ -20,9 +20,13 @@ function ensureDir() {
   try { fs.mkdirSync(INTEL_DIR, { recursive: true }); } catch (_) {}
 }
 
+var MAX_PATTERNS_SIZE = 10 * 1024 * 1024; // 10 MiB guard
+
 function loadPatterns() {
   try {
     if (fs.existsSync(PATTERNS_FILE)) {
+      var st = fs.statSync(PATTERNS_FILE);
+      if (st.size > MAX_PATTERNS_SIZE) { _patterns = []; return; }
       _patterns = JSON.parse(fs.readFileSync(PATTERNS_FILE, 'utf-8'));
     }
   } catch (_) { _patterns = []; }
@@ -77,8 +81,9 @@ function feedback(success) {
 function storePattern(pattern) {
   ensureDir();
   loadPatterns();
-  _patterns = _patterns.filter(function(p) { return p.id !== pattern.id; });
-  _patterns.push(Object.assign({ storedAt: new Date().toISOString() }, pattern));
+  var safeId = String(pattern.id || '').slice(0, 256);
+  _patterns = _patterns.filter(function(p) { return p.id !== safeId; });
+  _patterns.push(Object.assign({ storedAt: new Date().toISOString() }, pattern, { id: safeId }));
   try {
     fs.writeFileSync(PATTERNS_FILE, JSON.stringify(_patterns.slice(-500), null, 2), 'utf-8');
   } catch (_) {}

package/.claude/helpers/loop-tracker.cjs

@@ -15,13 +15,20 @@ const path = require('path');
 const CWD = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 const LOOPS_DIR = path.join(CWD, '.monomind', 'loops');
 
+const STDIN_MAX_BYTES = 1 * 1024 * 1024; // 1 MiB cap to prevent OOM
+
 async function readStdin() {
   if (process.stdin.isTTY) return '';
   return new Promise((resolve) => {
     let data = '';
+    let bytesRead = 0;
     const timer = setTimeout(() => { process.stdin.removeAllListeners(); resolve(data); }, 3000);
     process.stdin.setEncoding('utf8');
-    process.stdin.on('data', chunk => { data += chunk; });
+    process.stdin.on('data', chunk => {
+      bytesRead += Buffer.byteLength(chunk, 'utf8');
+      if (bytesRead > STDIN_MAX_BYTES) { clearTimeout(timer); resolve(''); return; }
+      data += chunk;
+    });
     process.stdin.on('end', () => { clearTimeout(timer); resolve(data); });
     process.stdin.on('error', () => { clearTimeout(timer); resolve(data); });
     process.stdin.resume();
@@ -60,7 +67,9 @@ async function main() {
   try { hookInput = JSON.parse(raw); } catch { process.exit(0); }
 
   const toolInput = hookInput.tool_input || hookInput.toolInput || {};
-  const sessionId = hookInput.session_id || hookInput.sessionId || hookInput.id || '';
+  const rawSessionId = hookInput.session_id || hookInput.sessionId || hookInput.id || '';
+  // Sanitize sessionId to prevent path traversal — allow only alphanumeric, dash, underscore, dot
+  const sessionId = String(rawSessionId).replace(/[^a-zA-Z0-9_.\-]/g, '').slice(0, 128);
 
   if (!sessionId) { process.exit(0); }
 
@@ -75,7 +84,10 @@ async function main() {
   let existing = {};
   try {
     if (fs.existsSync(loopFile)) {
-      existing = JSON.parse(fs.readFileSync(loopFile, 'utf-8'));
+      const stat = fs.statSync(loopFile);
+      if (stat.size <= 512 * 1024) { // 512 KiB guard to prevent OOM
+        existing = JSON.parse(fs.readFileSync(loopFile, 'utf-8'));
+      }
     }
   } catch { /* start fresh */ }
 

package/.claude/helpers/memory.cjs

@@ -16,9 +16,13 @@ function ensureDir() {
   try { fs.mkdirSync(MEMORY_DIR, { recursive: true }); } catch (_) {}
 }
 
+var MAX_INDEX_SIZE = 50 * 1024 * 1024; // 50 MiB guard
+
 function loadIndex() {
   try {
     if (!fs.existsSync(MEMORY_INDEX)) return [];
+    var st = fs.statSync(MEMORY_INDEX);
+    if (st.size > MAX_INDEX_SIZE) return [];
     return JSON.parse(fs.readFileSync(MEMORY_INDEX, 'utf-8'));
   } catch (_) {
     return [];
@@ -36,7 +40,8 @@ function saveIndex(entries) {
 
 function store(key, value, namespace) {
   var entries = loadIndex();
-  var ns = namespace || 'default';
+  var ns = String(namespace || 'default').slice(0, 128);
+  key = String(key || '').slice(0, 512);
   // Remove existing entry with same key+namespace
   entries = entries.filter(function(e) { return !(e.key === key && e.namespace === ns); });
   entries.push({ key: key, value: value, namespace: ns, storedAt: new Date().toISOString() });

package/.claude/helpers/router.cjs

@@ -35,13 +35,16 @@ const DEFAULT_RESULT = {
   extrasMatches: [],
 };
 
+var MAX_PROMPT = 2000;
+
 function routeTask(prompt) {
   if (!prompt || typeof prompt !== 'string') return DEFAULT_RESULT;
+  var safePrompt = prompt.slice(0, MAX_PROMPT);
 
   var best = null;
   for (var i = 0; i < KEYWORD_ROUTES.length; i++) {
     var rule = KEYWORD_ROUTES[i];
-    if (rule.pattern.test(prompt)) {
+    if (rule.pattern.test(safePrompt)) {
       if (!best || rule.confidence > best.confidence) {
         best = rule;
       }
@@ -54,7 +57,7 @@ function routeTask(prompt) {
     agent: best.agent,
     agentSlug: best.agent.toLowerCase().replace(/\s+/g, '-'),
     confidence: best.confidence,
-    reason: 'Keyword match: ' + best.pattern.toString().slice(1, 40),
+    reason: ('Keyword match: ' + best.pattern.toString()).slice(0, 80),
     semanticRouting: false,
     specificAgents: [],
     skillMatches: [],

package/.claude/helpers/session.cjs

@@ -17,6 +17,8 @@ function ensureDir() {
 function restore() {
   try {
     if (!fs.existsSync(SESSION_FILE)) return null;
+    var st = fs.statSync(SESSION_FILE);
+    if (st.size > 1 * 1024 * 1024) return null; // 1 MiB guard
     var raw = fs.readFileSync(SESSION_FILE, 'utf-8');
     var data = JSON.parse(raw);
     if (!data || !data.sessionId) return null;

package/.claude/helpers/statusline.cjs

@@ -16,7 +16,7 @@
 /* eslint-disable @typescript-eslint/no-var-requires */
 const fs = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
+const { execSync, spawnSync } = require('child_process');
 const os = require('os');
 
 // Configuration
@@ -204,6 +204,8 @@ function getModelFromSessionJSONL() {
     if (files.length === 0) return null;
 
     const sessionFile = path.join(projectsDir, files[0].f);
+    // Guard against OOM: skip session files larger than 10 MB
+    try { if (fs.statSync(sessionFile).size > 10 * 1024 * 1024) return null; } catch { return null; }
     const raw = fs.readFileSync(sessionFile, 'utf-8');
     const lines = raw.split('\n').filter(Boolean);
 
@@ -922,7 +924,13 @@ function getGraphifyStats() {
 
   try {
     if (fs.existsSync(dbPath)) {
-      const out = safeExec(`sqlite3 "${dbPath}" "SELECT (SELECT COUNT(*) FROM nodes), (SELECT COUNT(*) FROM edges);"`, 1000);
+      // Use spawnSync array args to prevent shell injection via dbPath (CWD-derived)
+      const result = spawnSync(
+        'sqlite3',
+        [dbPath, 'SELECT (SELECT COUNT(*) FROM nodes), (SELECT COUNT(*) FROM edges);'],
+        { encoding: 'utf-8', timeout: 1000 }
+      );
+      const out = (result.stdout || '').trim();
       if (out) {
         const [n, e] = out.split('|').map(v => parseInt(v, 10) || 0);
         if (n > 0) return { nodes: n, edges: e, exists: true };

package/.claude/helpers/utils/micro-agents.cjs

@@ -77,15 +77,18 @@ function _triggerExtractFromFrontmatter(content, agentSlug) {
   return triggers;
 }
 
-function _triggerCollectMdFiles(dir) {
+function _triggerCollectMdFiles(dir, _depth) {
+  var depth = (_depth === undefined) ? 0 : _depth;
+  if (depth > 5) return []; // cap recursion depth to prevent stack overflow DoS
   var results = [];
   try {
     var entries = fs.readdirSync(dir);
     for (var i = 0; i < entries.length; i++) {
+      if (results.length >= 200) break; // cap total file count to prevent DoS
       var full = path.join(dir, entries[i]);
       try {
         var st = fs.lstatSync(full);
-        if (st.isDirectory()) results = results.concat(_triggerCollectMdFiles(full));
+        if (st.isDirectory()) results = results.concat(_triggerCollectMdFiles(full, depth + 1));
         else if (entries[i].endsWith('.md')) results.push(full);
       } catch (e) {}
     }
@@ -98,7 +101,11 @@ function _triggerBuildIndex(agentDir) {
   var files = _triggerCollectMdFiles(agentDir);
   for (var i = 0; i < files.length; i++) {
     var content;
-    try { content = fs.readFileSync(files[i], 'utf-8'); } catch (e) { continue; }
+    try {
+      var _fst = fs.statSync(files[i]);
+      if (_fst.size > 256 * 1024) continue; // skip files > 256 KiB to prevent OOM
+      content = fs.readFileSync(files[i], 'utf-8');
+    } catch (e) { continue; }
     var slug = files[i].split('/').pop().replace(/\.md$/i, '').toLowerCase().replace(/[^a-z0-9-]/g, '-');
     patterns = patterns.concat(_triggerExtractFromFrontmatter(content, slug));
   }
@@ -114,6 +121,8 @@ function scanMicroAgentTriggers(prompt) {
 
   try {
     if (fs.existsSync(indexPath)) {
+      var _idxSt = fs.statSync(indexPath);
+      if (_idxSt.size > 512 * 1024) { throw new Error('trigger-index.json exceeds 512 KiB'); }
       var idx = JSON.parse(fs.readFileSync(indexPath, 'utf-8'));
       var age = Date.now() - new Date(idx.builtAt || 0).getTime();
       if (age < 3600000 && Array.isArray(idx.patterns)) {
@@ -140,6 +149,7 @@ function scanMicroAgentTriggers(prompt) {
     if (p.mode !== 'inject' && p.mode !== 'takeover') continue;
     if (seen[p.agentSlug]) continue;
     try {
+      if (typeof p.pattern !== 'string' || p.pattern.length > 500) continue; // cap pattern length to prevent ReDoS
       var re = new RegExp(p.pattern, 'i');
       var m = re.exec(prompt);
       if (m) {
@@ -164,6 +174,8 @@ function _buildKnowledgeSearchFn(knowledgeDir) {
     if (!fs.existsSync(chunksFile)) return [];
     var lines;
     try {
+      var _cSt = fs.statSync(chunksFile);
+      if (_cSt.size > 4 * 1024 * 1024) return []; // skip > 4 MiB to prevent OOM
       lines = fs.readFileSync(chunksFile, 'utf-8').trim().split('\n').filter(Boolean);
     } catch (e) { return []; }
 
@@ -209,6 +221,8 @@ function _autoIndexKnowledge(knowledgeDir) {
     } catch (e) {}
   }
   try {
+    var _sSt = fs.statSync(path.join(CWD, '.monomind', 'graph', 'stats.json'));
+    if (_sSt.size > 256 * 1024) { throw new Error('stats.json exceeds 256 KiB'); }
     var statsForHash = JSON.parse(fs.readFileSync(path.join(CWD, '.monomind', 'graph', 'stats.json'), 'utf-8'));
     hashInput += 'monograph:' + (statsForHash.builtAt || 0) + ';';
   } catch(e) {}
@@ -220,7 +234,7 @@ function _autoIndexKnowledge(knowledgeDir) {
   try { existingHash = fs.readFileSync(hashFile, 'utf-8').trim(); } catch (e) {}
 
   var existingChunkCount = 0;
-  try { if (fs.existsSync(chunksFile)) { existingChunkCount = fs.readFileSync(chunksFile, 'utf-8').trim().split('\n').filter(Boolean).length; } } catch (e) {}
+  try { if (fs.existsSync(chunksFile)) { var _ecSt = fs.statSync(chunksFile); if (_ecSt.size <= 4 * 1024 * 1024) { existingChunkCount = fs.readFileSync(chunksFile, 'utf-8').trim().split('\n').filter(Boolean).length; } } } catch (e) {}
   if (existingHash === contentHash && existingChunkCount > 0) return 0;
 
   var newLines = [];
@@ -228,6 +242,8 @@ function _autoIndexKnowledge(knowledgeDir) {
     var src = sources[si];
     try {
       if (!fs.existsSync(src.filePath)) continue;
+      var _srcSt = fs.statSync(src.filePath);
+      if (_srcSt.size > 512 * 1024) continue; // skip > 512 KiB to prevent OOM
       var content = fs.readFileSync(src.filePath, 'utf-8');
       var sections = content.split(/\n{2,}|\n(?=#{1,3} )/);
       for (var ci = 0; ci < sections.length; ci++) {

package/.claude/skills/mastermind/_protocol.md

@@ -289,14 +289,16 @@ If the user is running across multiple repos for the same project, they MUST use
 # Compatible with macOS bash 3.2
 project_name="${project_name:-$(basename "$PWD")}"
 canonical="${project_name}-<domain>"
+board_tracking=true
 
 # Step 1 — Resolve space
 space_id=$(monotask space list 2>/dev/null | awk -F'|' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$project_name" | head -1)
 [ -z "$space_id" ] && space_id=$(monotask space create "$project_name" 2>/dev/null | grep -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}')
-[ -z "$space_id" ] && { echo "ERROR: Could not find or create space '$project_name' — verify monotask is installed (monotask --version)"; exit 1; }
+[ -z "$space_id" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
 
 # Step 2 — Find existing board by canonical name or create
 # board list format is "uuid: name" (colon-space separator, NOT pipe)
+if [ "$board_tracking" = "true" ]; then
 board_id=$(monotask board list 2>/dev/null | awk -F': ' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$canonical" | head -1)
 if [ -n "$board_id" ]; then
   # Step 3a — Fetch column IDs from existing board
@@ -306,13 +308,16 @@ if [ -n "$board_id" ]; then
   done_col=$(echo "$cols_json" | jq -r '[.[] | select(.title=="Done")] | .[0].id // empty')
 else
   # Step 3b — Create board and columns
-  board_id=$(monotask board create --space "$space_id" "$canonical" --json | jq -r '.id // empty')
-  [ -z "$board_id" ] && { echo "ERROR: Failed to create board '$canonical'"; exit 1; }
+  board_id=$(monotask board create --space "$space_id" "$canonical" --json 2>/dev/null | jq -r '.id // empty')
+  [ -z "$board_id" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
+  if [ "$board_tracking" = "true" ]; then
   monotask space boards add "$space_id" "$board_id" >/dev/null 2>&1 || true
-  todo_col=$(monotask column create "$board_id" "Todo"  --json | jq -r '.id // empty')
-  doing_col=$(monotask column create "$board_id" "Doing" --json | jq -r '.id // empty')
-  done_col=$(monotask column create "$board_id" "Done"  --json | jq -r '.id // empty')
-  [ -z "$todo_col" ] && { echo "ERROR: Failed to create Todo column for $canonical"; exit 1; }
+  todo_col=$(monotask column create "$board_id" "Todo"  --json 2>/dev/null | jq -r '.id // empty')
+  doing_col=$(monotask column create "$board_id" "Doing" --json 2>/dev/null | jq -r '.id // empty')
+  done_col=$(monotask column create "$board_id" "Done"  --json 2>/dev/null | jq -r '.id // empty')
+  [ -z "$todo_col" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
+  fi
+fi
 fi
 ```
 
@@ -321,28 +326,33 @@ When master.md runs multiple domains, resolve the space **once** before the loop
 ```bash
 # Compatible with macOS bash 3.2 — jq accumulation instead of declare -A
 project_name="<resolved project_name>"
+board_tracking=true
 space_id=$(monotask space list 2>/dev/null | awk -F'|' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$project_name" | head -1)
 [ -z "$space_id" ] && space_id=$(monotask space create "$project_name" 2>/dev/null | grep -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}')
-[ -z "$space_id" ] && { echo "ERROR: Could not find or create space '$project_name'"; exit 1; }
+[ -z "$space_id" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
 
 state_patch='{}'
 for domain in build marketing ops; do   # substitute actual domain list
   canonical="${project_name}-${domain}"
+  if [ "$board_tracking" = "true" ]; then
   # board list format is "uuid: name" (colon-space separator, NOT pipe)
-board_id=$(monotask board list 2>/dev/null | awk -F': ' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$canonical" | head -1)
+  board_id=$(monotask board list 2>/dev/null | awk -F': ' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$canonical" | head -1)
   if [ -n "$board_id" ]; then
     cols_json=$(monotask column list "$board_id" --json 2>/dev/null || echo '[]')
     todo_col=$(echo "$cols_json" | jq -r '[.[] | select(.title=="Todo" or .title=="Backlog")] | .[0].id // empty')
     doing_col=$(echo "$cols_json" | jq -r '[.[] | select(.title=="Doing" or .title=="In Progress")] | .[0].id // empty')
     done_col=$(echo "$cols_json" | jq -r '[.[] | select(.title=="Done")] | .[0].id // empty')
   else
-    board_id=$(monotask board create --space "$space_id" "$canonical" --json | jq -r '.id // empty')
-    [ -z "$board_id" ] && { echo "ERROR: Failed to create $canonical board"; exit 1; }
+    board_id=$(monotask board create --space "$space_id" "$canonical" --json 2>/dev/null | jq -r '.id // empty')
+    [ -z "$board_id" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
+    if [ "$board_tracking" = "true" ]; then
     monotask space boards add "$space_id" "$board_id" >/dev/null 2>&1 || true
-    todo_col=$(monotask column create "$board_id" "Todo"  --json | jq -r '.id // empty')
-    doing_col=$(monotask column create "$board_id" "Doing" --json | jq -r '.id // empty')
-    done_col=$(monotask column create "$board_id" "Done"  --json | jq -r '.id // empty')
-    [ -z "$todo_col" ] && { echo "ERROR: Failed to create Todo column for $canonical"; exit 1; }
+    todo_col=$(monotask column create "$board_id" "Todo"  --json 2>/dev/null | jq -r '.id // empty')
+    doing_col=$(monotask column create "$board_id" "Doing" --json 2>/dev/null | jq -r '.id // empty')
+    done_col=$(monotask column create "$board_id" "Done"  --json 2>/dev/null | jq -r '.id // empty')
+    [ -z "$todo_col" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
+    fi
+  fi
   fi
   state_patch=$(echo "$state_patch" | jq \
     --arg d "$domain" --arg b "$board_id" \

package/.claude/skills/mastermind/architect.md

@@ -95,10 +95,10 @@ If this skill is invoked directly (not by master):
    result=$(monotask board create "architect" --json 2>/dev/null)
    board_id=$(echo "$result" | jq -r '.id // empty')
    [ -n "$board_id" ] && [ -n "$space_id" ] && monotask space boards add "$space_id" "$board_id" >/dev/null 2>&1 || true
-   [ -z "$board_id" ] && { echo "ERROR: Failed to create monotask board — verify monotask is installed (run: monotask --version)"; exit 1; }
-   echo "$board_id"
+   [ -z "$board_id" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
+   echo "${board_id:-}"
    ```
-   If this block exits with an error (board_id is still empty), stop execution and return an error to the caller — do not proceed to complexity assessment.
+   If board_id is empty after this block, set `board_tracking=false` and continue — do not abort. Card creation steps later are skipped when `board_tracking=false`.
 6. Proceed with complexity assessment below
 7. At end: emit `session:complete` (if `caller` is `standalone`). Before executing the curl below, substitute the resolved sessionId for `<sessionId>`:
    ```bash

package/.claude/skills/mastermind/autodev.md

@@ -432,7 +432,7 @@ Invoke `Skill("mastermind:build")` with:
 - `brain_context`: the loaded brain context
 - `project_name`: `$(basename "$PWD")`
 - `mode`: `auto`
-- `board_id`: the autodev board (create once at startup, reuse)
+- `board_id`: the autodev board (only if non-empty; omit if monotask was unavailable)
 
 The brief passed to build MUST include:
 - What to build (concrete spec, not vague)
@@ -490,11 +490,13 @@ If `N < count`: log `[autodev] Moving to improvement <N+1>/<count>...` and repea
 
 1. Extract flags (leading integer for count, --newfeature N, --focus, --auto/--confirm)
 2. Load brain context via _protocol.md Brain Load Procedure (namespace: `autodev`)
-3. Create monotask board:
+3. Create monotask board (optional — skip gracefully if monotask is not installed):
    ```bash
    project_name="${project_name:-$(basename "$PWD")}"
    board_id=$(monotask board create "autodev" --json 2>/dev/null | jq -r '.id // empty')
+   [ -z "$board_id" ] && echo "[autodev] monotask board unavailable — board tracking skipped."
    ```
+   Pass `board_id` to `mastermind:build` only if non-empty; omit the parameter otherwise.
 4. **If `--newfeature` was parsed:** run the Feature Pipeline (FP-0 through FP-End) and skip the improvement loop entirely.
    **Otherwise:** run the Loop section above for each improvement.
 5. At end: follow _protocol.md Brain Write Procedure (namespace: `autodev`)

package/.claude/skills/mastermind/idea.md

@@ -9,6 +9,16 @@ default_mode: confirm
 
 This skill is invoked by `mastermind:master` or directly via `/mastermind:idea`.
 
+**Extract `--monotask` flag:** If present in `$ARGUMENTS`, set `USE_MONOTASK=true` and remove it from `$ARGUMENTS`. Default: `USE_MONOTASK=false`.
+
+**File mode (default, `USE_MONOTASK=false`):**
+
+Invoke `Skill("mastermind:ideate", $ARGUMENTS)` immediately — it provides the same research, evaluation, elaboration, and task-decomposition pipeline with file-first storage (`docs/ideas/` and `docs/tasks/`). The rest of this skill is skipped in file mode.
+
+**Board mode (`USE_MONOTASK=true`):**
+
+Continue with the full monotask board pipeline below (Steps 3-6).
+
 ---
 
 ## Inputs

package/.claude/skills/mastermind/ops.md

@@ -51,8 +51,8 @@ If this skill is invoked directly (not by master):
    space_id=$(monotask space list 2>/dev/null | awk -F' \| ' -v n="$project_name" '$2==n{print $1}' | head -1)
    [ -z "$space_id" ] && space_id=$(monotask space create "$project_name" 2>&1 | grep -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}')
    [ -z "$space_id" ] && { echo "ERROR: Could not find or create space '$project_name'"; exit 1; }
-   board_id=$(monotask board create "ops" --json | jq -r '.id // empty')
-   [ -z "$board_id" ] && { echo "ERROR: Failed to create ops board"; exit 1; }
+   board_id=$(monotask board create "ops" --json 2>/dev/null | jq -r '.id // empty')
+   [ -z "$board_id" ] && echo "[ops] monotask board unavailable — board tracking skipped."
    monotask space boards add "$space_id" "$board_id" >/dev/null 2>&1 || true
    todo_col=$(monotask column create "$board_id" "Todo"  --json | jq -r '.id')
    doing_col=$(monotask column create "$board_id" "Doing" --json | jq -r '.id')
@@ -118,7 +118,7 @@ Spawn one Task agent per workstream (star topology — hub aggregates independen
 - Infrastructure automation: subagent_type "DevOps Automator"
 - CI/CD pipelines: subagent_type "cicd-engineer"
 
-Also run /mastermind:do --board <board_id> to track execution.
+Tasks are saved to `docs/tasks/` by default. To execute: `/mastermind:do --file <TASK_FILE>`. With monotask: `/mastermind:do --monotask --space $SPACE_ID --board $TASK_BOARD_ID`.
 
 STEP 4 — COLLECT AND RETURN
 Collect all agent outputs. Return to caller: