@monoes/monomindcli 1.11.14 → 1.13.0

package/.claude/helpers/handlers/session-restore-handler.cjs

@@ -88,7 +88,8 @@ module.exports = {
     var neuralEnabled = true;
     try {
       var settingsPath = path.join(CWD, '.claude', 'settings.json');
-      if (fs.existsSync(settingsPath)) {
+      var MAX_SETTINGS = 256 * 1024; // 256 KiB
+      if (fs.existsSync(settingsPath) && (function() { try { return fs.statSync(settingsPath).size <= MAX_SETTINGS; } catch(_) { return false; } }())) {
         var settingsData = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
         if (settingsData.monomind && settingsData.monomind.neural && settingsData.monomind.neural.enabled === false) {
           neuralEnabled = false;
@@ -215,7 +216,8 @@ module.exports = {
         fs.writeFileSync(updateCheckFile, JSON.stringify({ timestamp: new Date().toISOString() }), 'utf-8');
         try {
           var localPkg = path.join(CWD, 'packages/@monomind/cli/package.json');
-          if (fs.existsSync(localPkg)) {
+          var MAX_PKG = 64 * 1024; // 64 KiB
+          if (fs.existsSync(localPkg) && (function() { try { return fs.statSync(localPkg).size <= MAX_PKG; } catch(_) { return false; } }())) {
             var localVer = JSON.parse(fs.readFileSync(localPkg, 'utf-8')).version;
             if (localVer) {
               var spawnFn = require('child_process').spawn;
@@ -225,9 +227,9 @@ module.exports = {
               });
               child.on('error', function() {});
               var out = '';
-              child.stdout.on('data', function(d) { out += d; });
+              child.stdout.on('data', function(d) { if (out.length < 256) out += d; });
               child.on('close', function() {
-                var current = out.trim();
+                var current = out.trim().slice(0, 64);
                 var pendingUpdatePath = path.join(CWD, '.monomind', 'pending-update.json');
                 if (current && current !== localVer) {
                   try {
@@ -248,7 +250,8 @@ module.exports = {
       }
       try {
         var pendingUpdate = path.join(CWD, '.monomind', 'pending-update.json');
-        if (fs.existsSync(pendingUpdate)) {
+        var MAX_UPD = 4096; // 4 KiB
+        if (fs.existsSync(pendingUpdate) && (function() { try { return fs.statSync(pendingUpdate).size <= MAX_UPD; } catch(_) { return false; } }())) {
           var upd = JSON.parse(fs.readFileSync(pendingUpdate, 'utf-8'));
           if (upd && upd.from && upd.to && upd.from !== upd.to) {
             console.log('[UPDATE_AVAILABLE] @monomind/cli ' + upd.from + ' → ' + upd.to + ' (run: npx monomind update)');
@@ -263,16 +266,22 @@ module.exports = {
       var daemonRunning = false;
       if (fs.existsSync(daemonPid)) {
         try {
-          var pid = parseInt(fs.readFileSync(daemonPid, 'utf-8').trim(), 10);
-          process.kill(pid, 0);
-          daemonRunning = true;
+          var MAX_PID = 32; // 32 bytes — enough for any pid
+          if (fs.statSync(daemonPid).size <= MAX_PID) {
+            var pid = parseInt(fs.readFileSync(daemonPid, 'utf-8').trim(), 10);
+            if (Number.isInteger(pid) && pid > 0 && pid < 4194304) {
+              process.kill(pid, 0);
+              daemonRunning = true;
+            }
+          }
         } catch (e) { /* pid stale */ }
       }
       if (!daemonRunning) {
         var daemonCfg = {};
         try {
           var cfgPath = path.join(CWD, 'monomind.config.json');
-          if (fs.existsSync(cfgPath)) daemonCfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8')).daemon || {};
+          var MAX_CFG = 256 * 1024; // 256 KiB
+          if (fs.existsSync(cfgPath) && fs.statSync(cfgPath).size <= MAX_CFG) daemonCfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8')).daemon || {};
         } catch (e) {}
         if (daemonCfg.autoStart) {
           var spawn = require('child_process').spawn;
@@ -282,8 +291,11 @@ module.exports = {
           daemonChild.on('error', function() {});
           daemonChild.unref();
           console.log('[DAEMON_AUTOSTART] Background daemon started (pid ' + daemonChild.pid + ')');
-        } else {
-          console.log('[DAEMON_STOPPED] Background daemon is not running. To auto-start, set daemon.autoStart=true in monomind.config.json or run: npx monomind daemon start');
+        }
+        // Daemon not running + no autoStart: emit only if this project has a config
+        // (i.e. daemon was intentionally set up). Avoids noisy output in daemon-less projects.
+        else if (fs.existsSync(path.join(CWD, 'monomind.config.json'))) {
+          console.log('[DAEMON_STOPPED] Run `npx monomind daemon start` to enable background workers');
         }
       }
     } catch (e) { /* non-fatal */ }
@@ -309,7 +321,8 @@ module.exports = {
     // Registry Surfacing (SR-001) — show agent count.
     try {
       var regPath = path.join(CWD, '.monomind', 'registry.json');
-      if (fs.existsSync(regPath)) {
+      var MAX_REG = 512 * 1024; // 512 KiB
+      if (fs.existsSync(regPath) && (function() { try { return fs.statSync(regPath).size <= MAX_REG; } catch(_) { return false; } }())) {
         var reg = JSON.parse(fs.readFileSync(regPath, 'utf-8'));
         var agentCount = (reg.agents || []).length;
         if (agentCount > 0) {
@@ -318,11 +331,13 @@ module.exports = {
       }
     } catch (e) { /* non-fatal */ }
 
-    // Monomind Control UI Status — only probe when a daemon has previously run
-    // (indicated by daemon.pid or monomind.config.json). Skips silently in fresh
-    // environments and test fixtures that have no daemon history.
-    var _controlUiShouldProbe = fs.existsSync(path.join(CWD, '.monomind', 'daemon.pid'))
-      || fs.existsSync(path.join(CWD, 'monomind.config.json'));
+    // Monomind Control UI Status — only probe when a daemon.pid file exists,
+    // meaning the daemon was intentionally started in this project. This avoids
+    // printing "[CONTROL_UI] offline" noise on every session in projects that
+    // never run the daemon.  The broader "monomind.config.json" check is dropped
+    // because that file is present in the dev repo itself and in any initialized
+    // project, making the old condition nearly always true.
+    var _controlUiShouldProbe = fs.existsSync(path.join(CWD, '.monomind', 'daemon.pid'));
     if (_controlUiShouldProbe) {
       try {
         var http = require('http');
@@ -334,7 +349,8 @@ module.exports = {
           res.resume();
         });
         req.on('error', function() {
-          console.log('[CONTROL_UI] offline — run: npx monomind mcp start');
+          // Only warn when daemon was previously running (pid file exists but server is gone)
+          console.log('[CONTROL_UI] offline — restart with: npx monomind mcp start');
         });
         req.setTimeout(800, function() { req.destroy(); });
       } catch (e) { /* non-fatal */ }
@@ -344,7 +360,7 @@ module.exports = {
     try {
       var dispatchDir = path.join(CWD, '.monomind', 'worker-dispatch');
       if (fs.existsSync(dispatchDir)) {
-        var pendingFiles = fs.readdirSync(dispatchDir).filter(function(f) { return f.startsWith('pending-'); });
+        var pendingFiles = fs.readdirSync(dispatchDir).filter(function(f) { return f.startsWith('pending-'); }).slice(0, 500);
         if (pendingFiles.length > 0) {
           console.log('[WORKER_RESUME] ' + pendingFiles.length + ' worker dispatch(es) pending from prior session');
         }

package/.claude/helpers/handlers/task-handler.cjs

@@ -172,7 +172,7 @@ module.exports = {
         const remaining = fs.readdirSync(regDir).filter(f => f.endsWith('.json')).length;
         const _actPath = path.join(CWD, '.monomind', 'metrics', 'swarm-activity.json');
         let _prevLastActive = 0;
-        try { _prevLastActive = (JSON.parse(fs.readFileSync(_actPath, 'utf-8'))?.swarm?.lastActive) || 0; } catch { /* ignore */ }
+        try { var _actSt = fs.statSync(_actPath); if (_actSt.size < 65536) { _prevLastActive = (JSON.parse(fs.readFileSync(_actPath, 'utf-8'))?.swarm?.lastActive) || 0; } } catch { /* ignore */ }
         fs.writeFileSync(_actPath, JSON.stringify({
           timestamp: new Date().toISOString(),
           swarm: {
@@ -217,7 +217,8 @@ module.exports = {
       try {
         var haltFile = path.join(CWD, 'data', 'halt-signals.jsonl');
         if (fs.existsSync(haltFile)) {
-          var haltLines = fs.readFileSync(haltFile, 'utf-8').trim().split('\n').filter(Boolean);
+          var haltSt = fs.statSync(haltFile);
+          var haltLines = haltSt.size < 1048576 ? fs.readFileSync(haltFile, 'utf-8').trim().split('\n').filter(Boolean) : [];
           if (haltLines.length > 0) {
             console.warn('[HALT_DETECTED] ' + haltLines.length + ' halt signal(s) present');
           }
@@ -298,8 +299,11 @@ module.exports = {
       var settingsPath = path.join(CWD, '.claude', 'settings.json');
       var adrCfg = {};
       if (fs.existsSync(settingsPath)) {
-        var s = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
-        adrCfg = (s.monomind && s.monomind.adr) || {};
+        var settingsSt = fs.statSync(settingsPath);
+        if (settingsSt.size < 524288) {
+          var s = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+          adrCfg = (s.monomind && s.monomind.adr) || {};
+        }
       }
       if (adrCfg.autoGenerate) {
         var taskAgent = hookInput.agentSlug || hookInput.agent_slug || '';
@@ -307,7 +311,11 @@ module.exports = {
         var isArchitectLevel = ['architect', 'system-architect', 'software-architect'].includes(taskAgent)
           || /\b(architecture|design decision|adr|trade-?off|migration strategy)\b/.test(taskDescAdr);
         if (isArchitectLevel && taskDescAdr.length > 30) {
-          var adrDir = path.join(CWD, adrCfg.directory || 'docs/adrs');
+          // Guard adrCfg.directory against path traversal outside CWD
+          var rawAdrDir = typeof adrCfg.directory === 'string' ? adrCfg.directory : 'docs/adrs';
+          var resolvedAdrDir = path.resolve(CWD, rawAdrDir);
+          if (!resolvedAdrDir.startsWith(CWD + path.sep) && resolvedAdrDir !== CWD) { throw new Error('adr.directory outside project'); }
+          var adrDir = resolvedAdrDir;
           fs.mkdirSync(adrDir, { recursive: true });
           var adrNum = (fs.readdirSync(adrDir).filter(function(f) { return f.endsWith('.md'); }).length + 1)
             .toString().padStart(4, '0');

package/.claude/helpers/hook-handler.cjs

@@ -288,6 +288,46 @@ const handlers = {
     var tool = hCtx.toolName || '';
     if (tool === 'Grep') _recordGraphTelemetry('grep_call');
     else if (tool === 'Glob') _recordGraphTelemetry('glob_call');
+
+    // Monograph symbol hint: when the Grep pattern looks like a plain symbol name
+    // (no regex metacharacters), look it up directly in the graph index and print
+    // the file:line so the LLM may skip or narrow the Grep.
+    // Session-level cache prevents repeated identical DB lookups across Grep bursts.
+    try {
+      var grepPattern = (typeof toolInput === 'object' && toolInput !== null)
+        ? (toolInput.pattern || toolInput.query || '')
+        : '';
+      // Only attempt lookup for clean identifiers — skip regexes and paths
+      var isCleanSymbol = grepPattern.length >= 3 && grepPattern.length <= 80
+        && /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(grepPattern);
+      if (isCleanSymbol) {
+        if (!hCtx._preSearchCache) hCtx._preSearchCache = {};
+        var cacheKey = 'presearch:' + grepPattern;
+        if (!(cacheKey in hCtx._preSearchCache)) {
+          var db = _openMonographDb();
+          var hint = null;
+          if (db) {
+            try {
+              var row = db.prepare(
+                'SELECT n.name, n.label, n.file_path, n.start_line FROM nodes n ' +
+                'WHERE n.name = ? AND n.label NOT IN (\'Concept\',\'Community\',\'Folder\') ' +
+                'AND n.file_path IS NOT NULL LIMIT 1'
+              ).get(grepPattern);
+              if (row) {
+                hint = row.file_path + (row.start_line != null ? ':' + row.start_line : '');
+              }
+            } catch (e) { /* non-fatal */ }
+          }
+          hCtx._preSearchCache[cacheKey] = hint;
+        }
+        var cachedHint = hCtx._preSearchCache[cacheKey];
+        if (cachedHint) {
+          // Use the correct MCP tool name — monograph_context does not exist;
+          // the callable tool is mcp__monomind__monograph_query
+          console.log('[MONOGRAPH_HINT] ' + grepPattern + ' found at ' + cachedHint + ' — use mcp__monomind__monograph_query instead of Grep for better results');
+        }
+      }
+    } catch (e) { /* non-fatal — telemetry always proceeds */ }
   },
 
   'post-graph-tool': () => {

package/.claude/helpers/intelligence.cjs

@@ -1,87 +1,164 @@
 'use strict';
 /**
  * Intelligence context module for hook-handler.cjs
- * Provides context injection, trajectory logging, and feedback recording.
+ * Provides context injection, trajectory logging, feedback recording,
+ * edit tracking, consolidation, and stats.
+ *
+ * Data directory: $CLAUDE_PROJECT_DIR/.monomind/data/
+ *   auto-memory-store.json      — persisted memory entries
+ *   ranked-context.json         — ranked view written by init()
+ *   pending-insights.jsonl      — pending entries to consolidate
+ *   intelligence-outcomes.jsonl — feedback records
  */
 
 const path = require('path');
 const fs = require('fs');
 
+// Resolve base dir at require-time so tests can inject CLAUDE_PROJECT_DIR
+// per fresh require() call.
 const CWD = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-const INTEL_DIR = path.join(CWD, '.monomind', 'intelligence');
-const PATTERNS_FILE = path.join(INTEL_DIR, 'patterns.json');
-const TRAJECTORY_FILE = path.join(INTEL_DIR, 'trajectory.json');
+const DATA_DIR = path.join(CWD, '.monomind', 'data');
+const STORE_FILE = path.join(DATA_DIR, 'auto-memory-store.json');
+const RANKED_FILE = path.join(DATA_DIR, 'ranked-context.json');
+const PENDING_FILE = path.join(DATA_DIR, 'pending-insights.jsonl');
+const OUTCOMES_FILE = path.join(DATA_DIR, 'intelligence-outcomes.jsonl');
 
-var _initialized = false;
-var _patterns = [];
-var _trajectory = [];
+const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10 MiB guard
+const RING_BUFFER_MAX = 50;
 
-function ensureDir() {
-  try { fs.mkdirSync(INTEL_DIR, { recursive: true }); } catch (_) {}
+var _entries = [];        // deduplicated memory entries loaded from store
+var _recentEdits = [];    // ring buffer of recently edited paths
+
+function ensureDataDir() {
+  try { fs.mkdirSync(DATA_DIR, { recursive: true }); } catch (_) {}
 }
 
-function loadPatterns() {
+function safeReadJson(filePath) {
   try {
-    if (fs.existsSync(PATTERNS_FILE)) {
-      _patterns = JSON.parse(fs.readFileSync(PATTERNS_FILE, 'utf-8'));
-    }
-  } catch (_) { _patterns = []; }
+    if (!fs.existsSync(filePath)) return null;
+    var st = fs.statSync(filePath);
+    if (st.size > MAX_FILE_SIZE) return null;
+    return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+  } catch (_) { return null; }
 }
 
+function safeReadLines(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) return [];
+    var st = fs.statSync(filePath);
+    if (st.size > MAX_FILE_SIZE) return [];
+    return fs.readFileSync(filePath, 'utf-8')
+      .split('\n')
+      .filter(function(l) { return l.trim().length > 0; });
+  } catch (_) { return []; }
+}
+
+// ── init ───────────────────────────────────────────────────────────────────────
+
 function init() {
-  if (_initialized) return { ok: true, patternCount: _patterns.length };
-  ensureDir();
-  loadPatterns();
-  _initialized = true;
-  return { ok: true, patternCount: _patterns.length };
+  ensureDataDir();
+
+  // Load entries from store, deduplicate by id
+  var raw = safeReadJson(STORE_FILE);
+  var arr = Array.isArray(raw) ? raw : [];
+  var seen = new Set();
+  _entries = arr.filter(function(e) {
+    var key = e && e.id ? String(e.id) : null;
+    if (!key) return true;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+
+  // Write ranked-context.json (sorted by confidence desc) with version envelope
+  var ranked = _entries.slice().sort(function(a, b) {
+    return (b.confidence || 0) - (a.confidence || 0);
+  });
+  try {
+    fs.writeFileSync(RANKED_FILE, JSON.stringify({ version: 1, entries: ranked }, null, 2), 'utf-8');
+  } catch (_) {}
+
+  return { nodes: _entries.length, edges: 0 };
 }
 
+// ── getContext ─────────────────────────────────────────────────────────────────
+
 function getContext(prompt) {
-  if (!prompt || typeof prompt !== 'string') return null;
-  if (!_initialized) init();
-  // Match patterns against prompt
-  var matches = _patterns.filter(function(p) {
-    return p.keywords && p.keywords.some(function(kw) {
-      return prompt.toLowerCase().includes(kw.toLowerCase());
-    });
+  if (!prompt || typeof prompt !== 'string' || prompt.trim() === '') return null;
+  if (_entries.length === 0) return null;
+
+  var promptWords = prompt.toLowerCase().split(/\W+/).filter(Boolean);
+  var promptSet = new Set(promptWords);
+
+  var matches = _entries.filter(function(e) {
+    var content = ((e.content || '') + ' ' + (e.summary || '')).toLowerCase();
+    var words = content.split(/\W+/).filter(Boolean);
+    return words.some(function(w) { return promptSet.has(w); });
   });
+
   if (matches.length === 0) return null;
+
   var top = matches[0];
-  return '[INTELLIGENCE] Pattern match: ' + (top.name || top.id || 'pattern') +
-         (top.suggestion ? ' — ' + top.suggestion : '');
+  return '[INTELLIGENCE] ' + (top.summary || top.content || top.id || 'context match');
 }
 
-function logTrajectory(step) {
-  ensureDir();
-  _trajectory.push(Object.assign({ ts: new Date().toISOString() }, step || {}));
-  // Flush every 10 steps to avoid excessive writes
-  if (_trajectory.length % 10 === 0) {
-    try {
-      fs.writeFileSync(TRAJECTORY_FILE, JSON.stringify(_trajectory.slice(-200), null, 2), 'utf-8');
-    } catch (_) {}
+// ── recordEdit ────────────────────────────────────────────────────────────────
+
+function recordEdit(filePath) {
+  _recentEdits.push({ path: String(filePath || ''), ts: Date.now() });
+  if (_recentEdits.length > RING_BUFFER_MAX) {
+    _recentEdits = _recentEdits.slice(-RING_BUFFER_MAX);
   }
 }
 
+// ── consolidate ───────────────────────────────────────────────────────────────
+
+function consolidate() {
+  ensureDataDir();
+  var lines = safeReadLines(PENDING_FILE);
+  var count = lines.length;
+
+  // Clear the pending file
+  try { fs.writeFileSync(PENDING_FILE, '', 'utf-8'); } catch (_) {}
+
+  return { entries: count, edges: 0, newEntries: count };
+}
+
+// ── feedback ──────────────────────────────────────────────────────────────────
+
 function feedback(success) {
-  // Record outcome for last trajectory step
-  if (_trajectory.length > 0) {
-    _trajectory[_trajectory.length - 1].outcome = success ? 'success' : 'failure';
-  }
-  // Persist
-  ensureDir();
-  try {
-    fs.writeFileSync(TRAJECTORY_FILE, JSON.stringify(_trajectory.slice(-200), null, 2), 'utf-8');
-  } catch (_) {}
+  ensureDataDir();
+  var record = JSON.stringify({
+    ts: Date.now(),
+    success: !!success,
+    context: null,
+    recentEdits: _recentEdits.slice(),
+  }) + '\n';
+  try { fs.appendFileSync(OUTCOMES_FILE, record, 'utf-8'); } catch (_) {}
+}
+
+// ── stats ─────────────────────────────────────────────────────────────────────
+
+function stats(asJson) {
+  var result = {
+    entries: _entries.length,
+    recentEdits: _recentEdits.length,
+    pending: safeReadLines(PENDING_FILE).length,
+  };
+  if (asJson) return JSON.stringify(result);
+  return result;
+}
+
+// ── legacy ────────────────────────────────────────────────────────────────────
+
+function logTrajectory(step) {
+  // no-op stub for backward compatibility
+  void step;
 }
 
 function storePattern(pattern) {
-  ensureDir();
-  loadPatterns();
-  _patterns = _patterns.filter(function(p) { return p.id !== pattern.id; });
-  _patterns.push(Object.assign({ storedAt: new Date().toISOString() }, pattern));
-  try {
-    fs.writeFileSync(PATTERNS_FILE, JSON.stringify(_patterns.slice(-500), null, 2), 'utf-8');
-  } catch (_) {}
+  // no-op stub for backward compatibility
+  void pattern;
 }
 
-module.exports = { init, getContext, logTrajectory, feedback, storePattern };
+module.exports = { init, getContext, recordEdit, consolidate, feedback, stats, logTrajectory, storePattern };

package/.claude/helpers/loop-tracker.cjs

@@ -15,13 +15,20 @@ const path = require('path');
 const CWD = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 const LOOPS_DIR = path.join(CWD, '.monomind', 'loops');
 
+const STDIN_MAX_BYTES = 1 * 1024 * 1024; // 1 MiB cap to prevent OOM
+
 async function readStdin() {
   if (process.stdin.isTTY) return '';
   return new Promise((resolve) => {
     let data = '';
+    let bytesRead = 0;
     const timer = setTimeout(() => { process.stdin.removeAllListeners(); resolve(data); }, 3000);
     process.stdin.setEncoding('utf8');
-    process.stdin.on('data', chunk => { data += chunk; });
+    process.stdin.on('data', chunk => {
+      bytesRead += Buffer.byteLength(chunk, 'utf8');
+      if (bytesRead > STDIN_MAX_BYTES) { clearTimeout(timer); resolve(''); return; }
+      data += chunk;
+    });
     process.stdin.on('end', () => { clearTimeout(timer); resolve(data); });
     process.stdin.on('error', () => { clearTimeout(timer); resolve(data); });
     process.stdin.resume();
@@ -60,7 +67,9 @@ async function main() {
   try { hookInput = JSON.parse(raw); } catch { process.exit(0); }
 
   const toolInput = hookInput.tool_input || hookInput.toolInput || {};
-  const sessionId = hookInput.session_id || hookInput.sessionId || hookInput.id || '';
+  const rawSessionId = hookInput.session_id || hookInput.sessionId || hookInput.id || '';
+  // Sanitize sessionId to prevent path traversal — allow only alphanumeric, dash, underscore, dot
+  const sessionId = String(rawSessionId).replace(/[^a-zA-Z0-9_.\-]/g, '').slice(0, 128);
 
   if (!sessionId) { process.exit(0); }
 
@@ -75,7 +84,10 @@ async function main() {
   let existing = {};
   try {
     if (fs.existsSync(loopFile)) {
-      existing = JSON.parse(fs.readFileSync(loopFile, 'utf-8'));
+      const stat = fs.statSync(loopFile);
+      if (stat.size <= 512 * 1024) { // 512 KiB guard to prevent OOM
+        existing = JSON.parse(fs.readFileSync(loopFile, 'utf-8'));
+      }
     }
   } catch { /* start fresh */ }