@monoes/monomindcli 1.11.14 → 1.13.0

package/.claude/helpers/utils/micro-agents.cjs

@@ -77,15 +77,18 @@ function _triggerExtractFromFrontmatter(content, agentSlug) {
   return triggers;
 }
 
-function _triggerCollectMdFiles(dir) {
+function _triggerCollectMdFiles(dir, _depth) {
+  var depth = (_depth === undefined) ? 0 : _depth;
+  if (depth > 5) return []; // cap recursion depth to prevent stack overflow DoS
   var results = [];
   try {
     var entries = fs.readdirSync(dir);
     for (var i = 0; i < entries.length; i++) {
+      if (results.length >= 200) break; // cap total file count to prevent DoS
       var full = path.join(dir, entries[i]);
       try {
         var st = fs.lstatSync(full);
-        if (st.isDirectory()) results = results.concat(_triggerCollectMdFiles(full));
+        if (st.isDirectory()) results = results.concat(_triggerCollectMdFiles(full, depth + 1));
         else if (entries[i].endsWith('.md')) results.push(full);
       } catch (e) {}
     }
@@ -98,7 +101,11 @@ function _triggerBuildIndex(agentDir) {
   var files = _triggerCollectMdFiles(agentDir);
   for (var i = 0; i < files.length; i++) {
     var content;
-    try { content = fs.readFileSync(files[i], 'utf-8'); } catch (e) { continue; }
+    try {
+      var _fst = fs.statSync(files[i]);
+      if (_fst.size > 256 * 1024) continue; // skip files > 256 KiB to prevent OOM
+      content = fs.readFileSync(files[i], 'utf-8');
+    } catch (e) { continue; }
     var slug = files[i].split('/').pop().replace(/\.md$/i, '').toLowerCase().replace(/[^a-z0-9-]/g, '-');
     patterns = patterns.concat(_triggerExtractFromFrontmatter(content, slug));
   }
@@ -114,6 +121,8 @@ function scanMicroAgentTriggers(prompt) {
 
   try {
     if (fs.existsSync(indexPath)) {
+      var _idxSt = fs.statSync(indexPath);
+      if (_idxSt.size > 512 * 1024) { throw new Error('trigger-index.json exceeds 512 KiB'); }
       var idx = JSON.parse(fs.readFileSync(indexPath, 'utf-8'));
       var age = Date.now() - new Date(idx.builtAt || 0).getTime();
       if (age < 3600000 && Array.isArray(idx.patterns)) {
@@ -140,6 +149,7 @@ function scanMicroAgentTriggers(prompt) {
     if (p.mode !== 'inject' && p.mode !== 'takeover') continue;
     if (seen[p.agentSlug]) continue;
     try {
+      if (typeof p.pattern !== 'string' || p.pattern.length > 500) continue; // cap pattern length to prevent ReDoS
       var re = new RegExp(p.pattern, 'i');
       var m = re.exec(prompt);
       if (m) {
@@ -164,6 +174,8 @@ function _buildKnowledgeSearchFn(knowledgeDir) {
     if (!fs.existsSync(chunksFile)) return [];
     var lines;
     try {
+      var _cSt = fs.statSync(chunksFile);
+      if (_cSt.size > 4 * 1024 * 1024) return []; // skip > 4 MiB to prevent OOM
       lines = fs.readFileSync(chunksFile, 'utf-8').trim().split('\n').filter(Boolean);
     } catch (e) { return []; }
 
@@ -209,6 +221,8 @@ function _autoIndexKnowledge(knowledgeDir) {
     } catch (e) {}
   }
   try {
+    var _sSt = fs.statSync(path.join(CWD, '.monomind', 'graph', 'stats.json'));
+    if (_sSt.size > 256 * 1024) { throw new Error('stats.json exceeds 256 KiB'); }
     var statsForHash = JSON.parse(fs.readFileSync(path.join(CWD, '.monomind', 'graph', 'stats.json'), 'utf-8'));
     hashInput += 'monograph:' + (statsForHash.builtAt || 0) + ';';
   } catch(e) {}
@@ -220,7 +234,7 @@ function _autoIndexKnowledge(knowledgeDir) {
   try { existingHash = fs.readFileSync(hashFile, 'utf-8').trim(); } catch (e) {}
 
   var existingChunkCount = 0;
-  try { if (fs.existsSync(chunksFile)) { existingChunkCount = fs.readFileSync(chunksFile, 'utf-8').trim().split('\n').filter(Boolean).length; } } catch (e) {}
+  try { if (fs.existsSync(chunksFile)) { var _ecSt = fs.statSync(chunksFile); if (_ecSt.size <= 4 * 1024 * 1024) { existingChunkCount = fs.readFileSync(chunksFile, 'utf-8').trim().split('\n').filter(Boolean).length; } } } catch (e) {}
   if (existingHash === contentHash && existingChunkCount > 0) return 0;
 
   var newLines = [];
@@ -228,6 +242,8 @@ function _autoIndexKnowledge(knowledgeDir) {
     var src = sources[si];
     try {
       if (!fs.existsSync(src.filePath)) continue;
+      var _srcSt = fs.statSync(src.filePath);
+      if (_srcSt.size > 512 * 1024) continue; // skip > 512 KiB to prevent OOM
       var content = fs.readFileSync(src.filePath, 'utf-8');
       var sections = content.split(/\n{2,}|\n(?=#{1,3} )/);
       for (var ci = 0; ci < sections.length; ci++) {

package/.claude/helpers/utils/monograph.cjs

@@ -25,6 +25,30 @@ function _requireMonograph() {
 // Memoized at module scope — opening monograph.db can take 7-10s.
 // Callers MUST NOT close the returned handle.
 var _cachedMonographDb = undefined;
+
+// LRU cache for getMonographSuggestions: avoids re-querying the DB for
+// the same task text within a single hook execution process lifetime.
+// Max 20 entries; evicts the least-recently-used on overflow.
+var _suggestCache = { _map: Object.create(null), _order: [], _max: 20 };
+function _suggestCacheGet(key) {
+  if (key in _suggestCache._map) {
+    // Move to end (most recently used)
+    var idx = _suggestCache._order.indexOf(key);
+    if (idx !== -1) { _suggestCache._order.splice(idx, 1); _suggestCache._order.push(key); }
+    return _suggestCache._map[key];
+  }
+  return undefined;
+}
+function _suggestCacheSet(key, value) {
+  if (!(key in _suggestCache._map)) {
+    if (_suggestCache._order.length >= _suggestCache._max) {
+      var evict = _suggestCache._order.shift();
+      delete _suggestCache._map[evict];
+    }
+    _suggestCache._order.push(key);
+  }
+  _suggestCache._map[key] = value;
+}
 function _openMonographDb() {
   if (_cachedMonographDb !== undefined) return _cachedMonographDb;
   try {
@@ -39,6 +63,10 @@ function _openMonographDb() {
 
 function getMonographSuggestions(taskText, limit) {
   if (!taskText || typeof taskText !== 'string') return [];
+  // Fast path: return cached result for repeated identical queries.
+  var cacheKey = taskText.slice(0, 200) + '|' + (limit || 5);
+  var cached = _suggestCacheGet(cacheKey);
+  if (cached !== undefined) return cached;
   var db = _openMonographDb();
   if (!db) return [];
   try {
@@ -56,7 +84,7 @@ function getMonographSuggestions(taskText, limit) {
     var rows = [];
     try {
       rows = db.prepare(
-        'SELECT n.id, n.name, n.label, n.file_path AS file, ' +
+        'SELECT n.id, n.name, n.label, n.file_path AS file, n.start_line AS startLine, ' +
         'bm25(nodes_fts) AS bm25_score, ' +
         '(SELECT COUNT(*) FROM edges WHERE source_id=n.id OR target_id=n.id) AS deg, ' +
         'CASE n.label WHEN \'File\' THEN 3 WHEN \'Function\' THEN 3 WHEN \'Class\' THEN 3 ' +
@@ -72,7 +100,7 @@ function getMonographSuggestions(taskText, limit) {
       var likeFrag = keys.map(function(){ return 'lower(n.name) LIKE ?'; }).join(' OR ');
       var likeArgs = keys.map(function(k){ return '%' + k + '%'; });
       var stmt = db.prepare(
-        'SELECT n.id, n.name, n.label, n.file_path AS file, ' +
+        'SELECT n.id, n.name, n.label, n.file_path AS file, n.start_line AS startLine, ' +
         '(SELECT COUNT(*) FROM edges WHERE source_id=n.id OR target_id=n.id) AS deg ' +
         'FROM nodes n WHERE (' + likeFrag + ') AND n.file_path IS NOT NULL AND n.file_path != \'\' ' +
         'AND n.label NOT IN (\'Concept\') ' +
@@ -80,7 +108,9 @@ function getMonographSuggestions(taskText, limit) {
       );
       rows = stmt.all.apply(stmt, likeArgs.concat([lim]));
     }
-    return rows || [];
+    var result = rows || [];
+    _suggestCacheSet(cacheKey, result);
+    return result;
   } catch (e) { return []; }
   finally { /* db is shared/cached; do not close */ }
 }
@@ -287,8 +317,13 @@ function injectGodNodesContext(CWD) {
       // Staleness indicator: compare stored commit hash with current HEAD.
       var staleIndicator = '';
       try {
+        // The orchestrator writes 'last_commit_hash'; fall back to legacy keys.
         var lastCommitRow = null;
-        try { lastCommitRow = db.prepare("SELECT value FROM index_meta WHERE key='ua_last_commit'").get(); } catch (_) {}
+        try {
+          lastCommitRow = db.prepare("SELECT value FROM index_meta WHERE key='last_commit_hash'").get() ||
+                          db.prepare("SELECT value FROM index_meta WHERE key='lastCommit'").get() ||
+                          db.prepare("SELECT value FROM index_meta WHERE key='ua_last_commit'").get();
+        } catch (_) {}
         if (lastCommitRow && lastCommitRow.value) {
           var { execFileSync: execSync } = require('child_process');
           var currentHead = '';

package/.claude/helpers/utils/telemetry.cjs

@@ -10,14 +10,14 @@ const CWD = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 function _recordRecentEdit(filePath) {
   if (!filePath) return;
   try {
-    var relPath = path.isAbsolute(filePath) ? path.relative(CWD, filePath) : filePath;
+    var storedPath = filePath;
     var f = path.join(CWD, '.monomind', 'metrics', 'recent-edits.json');
     fs.mkdirSync(path.dirname(f), { recursive: true });
     var d = { edits: [] };
     try { d = JSON.parse(fs.readFileSync(f, 'utf-8')); } catch (_) {}
     if (!Array.isArray(d.edits)) d.edits = [];
-    d.edits = d.edits.filter(function(e) { return e.file !== relPath; });
-    d.edits.unshift({ file: relPath, editedAt: Date.now() });
+    d.edits = d.edits.filter(function(e) { return e.file !== storedPath; });
+    d.edits.unshift({ file: storedPath, editedAt: Date.now() });
     if (d.edits.length > 10) d.edits = d.edits.slice(0, 10);
     fs.writeFileSync(f, JSON.stringify(d));
   } catch (e) { /* non-fatal */ }

package/.claude/skills/mastermind/_protocol.md

@@ -289,14 +289,16 @@ If the user is running across multiple repos for the same project, they MUST use
 # Compatible with macOS bash 3.2
 project_name="${project_name:-$(basename "$PWD")}"
 canonical="${project_name}-<domain>"
+board_tracking=true
 
 # Step 1 — Resolve space
 space_id=$(monotask space list 2>/dev/null | awk -F'|' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$project_name" | head -1)
 [ -z "$space_id" ] && space_id=$(monotask space create "$project_name" 2>/dev/null | grep -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}')
-[ -z "$space_id" ] && { echo "ERROR: Could not find or create space '$project_name' — verify monotask is installed (monotask --version)"; exit 1; }
+[ -z "$space_id" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
 
 # Step 2 — Find existing board by canonical name or create
 # board list format is "uuid: name" (colon-space separator, NOT pipe)
+if [ "$board_tracking" = "true" ]; then
 board_id=$(monotask board list 2>/dev/null | awk -F': ' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$canonical" | head -1)
 if [ -n "$board_id" ]; then
   # Step 3a — Fetch column IDs from existing board
@@ -306,13 +308,16 @@ if [ -n "$board_id" ]; then
   done_col=$(echo "$cols_json" | jq -r '[.[] | select(.title=="Done")] | .[0].id // empty')
 else
   # Step 3b — Create board and columns
-  board_id=$(monotask board create --space "$space_id" "$canonical" --json | jq -r '.id // empty')
-  [ -z "$board_id" ] && { echo "ERROR: Failed to create board '$canonical'"; exit 1; }
+  board_id=$(monotask board create --space "$space_id" "$canonical" --json 2>/dev/null | jq -r '.id // empty')
+  [ -z "$board_id" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
+  if [ "$board_tracking" = "true" ]; then
   monotask space boards add "$space_id" "$board_id" >/dev/null 2>&1 || true
-  todo_col=$(monotask column create "$board_id" "Todo"  --json | jq -r '.id // empty')
-  doing_col=$(monotask column create "$board_id" "Doing" --json | jq -r '.id // empty')
-  done_col=$(monotask column create "$board_id" "Done"  --json | jq -r '.id // empty')
-  [ -z "$todo_col" ] && { echo "ERROR: Failed to create Todo column for $canonical"; exit 1; }
+  todo_col=$(monotask column create "$board_id" "Todo"  --json 2>/dev/null | jq -r '.id // empty')
+  doing_col=$(monotask column create "$board_id" "Doing" --json 2>/dev/null | jq -r '.id // empty')
+  done_col=$(monotask column create "$board_id" "Done"  --json 2>/dev/null | jq -r '.id // empty')
+  [ -z "$todo_col" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
+  fi
+fi
 fi
 ```
 
@@ -321,28 +326,33 @@ When master.md runs multiple domains, resolve the space **once** before the loop
 ```bash
 # Compatible with macOS bash 3.2 — jq accumulation instead of declare -A
 project_name="<resolved project_name>"
+board_tracking=true
 space_id=$(monotask space list 2>/dev/null | awk -F'|' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$project_name" | head -1)
 [ -z "$space_id" ] && space_id=$(monotask space create "$project_name" 2>/dev/null | grep -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}')
-[ -z "$space_id" ] && { echo "ERROR: Could not find or create space '$project_name'"; exit 1; }
+[ -z "$space_id" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
 
 state_patch='{}'
 for domain in build marketing ops; do   # substitute actual domain list
   canonical="${project_name}-${domain}"
+  if [ "$board_tracking" = "true" ]; then
   # board list format is "uuid: name" (colon-space separator, NOT pipe)
-board_id=$(monotask board list 2>/dev/null | awk -F': ' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$canonical" | head -1)
+  board_id=$(monotask board list 2>/dev/null | awk -F': ' '{gsub(/^ +| +$/,"",$1);gsub(/^ +| +$/,"",$2);if($2==n)print $1}' n="$canonical" | head -1)
   if [ -n "$board_id" ]; then
     cols_json=$(monotask column list "$board_id" --json 2>/dev/null || echo '[]')
     todo_col=$(echo "$cols_json" | jq -r '[.[] | select(.title=="Todo" or .title=="Backlog")] | .[0].id // empty')
     doing_col=$(echo "$cols_json" | jq -r '[.[] | select(.title=="Doing" or .title=="In Progress")] | .[0].id // empty')
     done_col=$(echo "$cols_json" | jq -r '[.[] | select(.title=="Done")] | .[0].id // empty')
   else
-    board_id=$(monotask board create --space "$space_id" "$canonical" --json | jq -r '.id // empty')
-    [ -z "$board_id" ] && { echo "ERROR: Failed to create $canonical board"; exit 1; }
+    board_id=$(monotask board create --space "$space_id" "$canonical" --json 2>/dev/null | jq -r '.id // empty')
+    [ -z "$board_id" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
+    if [ "$board_tracking" = "true" ]; then
     monotask space boards add "$space_id" "$board_id" >/dev/null 2>&1 || true
-    todo_col=$(monotask column create "$board_id" "Todo"  --json | jq -r '.id // empty')
-    doing_col=$(monotask column create "$board_id" "Doing" --json | jq -r '.id // empty')
-    done_col=$(monotask column create "$board_id" "Done"  --json | jq -r '.id // empty')
-    [ -z "$todo_col" ] && { echo "ERROR: Failed to create Todo column for $canonical"; exit 1; }
+    todo_col=$(monotask column create "$board_id" "Todo"  --json 2>/dev/null | jq -r '.id // empty')
+    doing_col=$(monotask column create "$board_id" "Doing" --json 2>/dev/null | jq -r '.id // empty')
+    done_col=$(monotask column create "$board_id" "Done"  --json 2>/dev/null | jq -r '.id // empty')
+    [ -z "$todo_col" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
+    fi
+  fi
   fi
   state_patch=$(echo "$state_patch" | jq \
     --arg d "$domain" --arg b "$board_id" \

package/.claude/skills/mastermind/architect.md

@@ -95,10 +95,10 @@ If this skill is invoked directly (not by master):
    result=$(monotask board create "architect" --json 2>/dev/null)
    board_id=$(echo "$result" | jq -r '.id // empty')
    [ -n "$board_id" ] && [ -n "$space_id" ] && monotask space boards add "$space_id" "$board_id" >/dev/null 2>&1 || true
-   [ -z "$board_id" ] && { echo "ERROR: Failed to create monotask board — verify monotask is installed (run: monotask --version)"; exit 1; }
-   echo "$board_id"
+   [ -z "$board_id" ] && { echo "[mastermind] monotask board unavailable — board tracking skipped."; board_tracking=false; }
+   echo "${board_id:-}"
    ```
-   If this block exits with an error (board_id is still empty), stop execution and return an error to the caller — do not proceed to complexity assessment.
+   If board_id is empty after this block, set `board_tracking=false` and continue — do not abort. Card creation steps later are skipped when `board_tracking=false`.
 6. Proceed with complexity assessment below
 7. At end: emit `session:complete` (if `caller` is `standalone`). Before executing the curl below, substitute the resolved sessionId for `<sessionId>`:
    ```bash

package/.claude/skills/mastermind/autodev.md

@@ -432,7 +432,7 @@ Invoke `Skill("mastermind:build")` with:
 - `brain_context`: the loaded brain context
 - `project_name`: `$(basename "$PWD")`
 - `mode`: `auto`
-- `board_id`: the autodev board (create once at startup, reuse)
+- `board_id`: the autodev board (only if non-empty; omit if monotask was unavailable)
 
 The brief passed to build MUST include:
 - What to build (concrete spec, not vague)
@@ -490,11 +490,13 @@ If `N < count`: log `[autodev] Moving to improvement <N+1>/<count>...` and repea
 
 1. Extract flags (leading integer for count, --newfeature N, --focus, --auto/--confirm)
 2. Load brain context via _protocol.md Brain Load Procedure (namespace: `autodev`)
-3. Create monotask board:
+3. Create monotask board (optional — skip gracefully if monotask is not installed):
    ```bash
    project_name="${project_name:-$(basename "$PWD")}"
    board_id=$(monotask board create "autodev" --json 2>/dev/null | jq -r '.id // empty')
+   [ -z "$board_id" ] && echo "[autodev] monotask board unavailable — board tracking skipped."
    ```
+   Pass `board_id` to `mastermind:build` only if non-empty; omit the parameter otherwise.
 4. **If `--newfeature` was parsed:** run the Feature Pipeline (FP-0 through FP-End) and skip the improvement loop entirely.
    **Otherwise:** run the Loop section above for each improvement.
 5. At end: follow _protocol.md Brain Write Procedure (namespace: `autodev`)

package/.claude/skills/mastermind/idea.md

@@ -9,6 +9,16 @@ default_mode: confirm
 
 This skill is invoked by `mastermind:master` or directly via `/mastermind:idea`.
 
+**Extract `--monotask` flag:** If present in `$ARGUMENTS`, set `USE_MONOTASK=true` and remove it from `$ARGUMENTS`. Default: `USE_MONOTASK=false`.
+
+**File mode (default, `USE_MONOTASK=false`):**
+
+Invoke `Skill("mastermind:ideate", $ARGUMENTS)` immediately — it provides the same research, evaluation, elaboration, and task-decomposition pipeline with file-first storage (`docs/ideas/` and `docs/tasks/`). The rest of this skill is skipped in file mode.
+
+**Board mode (`USE_MONOTASK=true`):**
+
+Continue with the full monotask board pipeline below (Steps 3-6).
+
 ---
 
 ## Inputs

package/.claude/skills/mastermind/ops.md

@@ -51,8 +51,8 @@ If this skill is invoked directly (not by master):
    space_id=$(monotask space list 2>/dev/null | awk -F' \| ' -v n="$project_name" '$2==n{print $1}' | head -1)
    [ -z "$space_id" ] && space_id=$(monotask space create "$project_name" 2>&1 | grep -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}')
    [ -z "$space_id" ] && { echo "ERROR: Could not find or create space '$project_name'"; exit 1; }
-   board_id=$(monotask board create "ops" --json | jq -r '.id // empty')
-   [ -z "$board_id" ] && { echo "ERROR: Failed to create ops board"; exit 1; }
+   board_id=$(monotask board create "ops" --json 2>/dev/null | jq -r '.id // empty')
+   [ -z "$board_id" ] && echo "[ops] monotask board unavailable — board tracking skipped."
    monotask space boards add "$space_id" "$board_id" >/dev/null 2>&1 || true
    todo_col=$(monotask column create "$board_id" "Todo"  --json | jq -r '.id')
    doing_col=$(monotask column create "$board_id" "Doing" --json | jq -r '.id')
@@ -118,7 +118,7 @@ Spawn one Task agent per workstream (star topology — hub aggregates independen
 - Infrastructure automation: subagent_type "DevOps Automator"
 - CI/CD pipelines: subagent_type "cicd-engineer"
 
-Also run /mastermind:do --board <board_id> to track execution.
+Tasks are saved to `docs/tasks/` by default. To execute: `/mastermind:do --file <TASK_FILE>`. With monotask: `/mastermind:do --monotask --space $SPACE_ID --board $TASK_BOARD_ID`.
 
 STEP 4 — COLLECT AND RETURN
 Collect all agent outputs. Return to caller: