@monoes/monomindcli 1.18.15 → 2.0.0

package/dist/src/utils/cosine-similarity.js

@@ -0,0 +1,38 @@
+/**
+ * Shared cosine similarity utility.
+ *
+ * Previously duplicated in 5 independent implementations:
+ *   - memory/intelligence.ts (ReasoningBank.cosineSim)
+ *   - mcp-tools/neural-tools.ts (cosineSimilarity)
+ *   - mcp-tools/embeddings-tools.ts (cosineSimilarity)
+ *   - mcp-tools/coherence/types.ts (cosineSimilarity)
+ *   - mcp-tools/coherence/coherence-check.ts (cosineSimilarity)
+ *
+ * This is the single canonical implementation. Accepts number[] or
+ * Float32Array. Handles dimension mismatches gracefully (uses the shorter
+ * length) and returns 0 for zero-magnitude vectors.
+ */
+/**
+ * Compute cosine similarity between two vectors.
+ *
+ * Returns a value in [-1, 1]. Returns 0 when either vector is empty or
+ * has zero magnitude.
+ */
+export function cosineSimilarity(a, b) {
+    if (!a || !b || a.length === 0 || b.length === 0)
+        return 0;
+    const len = Math.min(a.length, b.length);
+    let dot = 0;
+    let normA = 0;
+    let normB = 0;
+    for (let i = 0; i < len; i++) {
+        const ai = a[i];
+        const bi = b[i];
+        dot += ai * bi;
+        normA += ai * ai;
+        normB += bi * bi;
+    }
+    const mag = Math.sqrt(normA) * Math.sqrt(normB);
+    return mag === 0 ? 0 : dot / mag;
+}
+//# sourceMappingURL=cosine-similarity.js.map

package/dist/src/utils/cosine-similarity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cosine-similarity.js","sourceRoot":"","sources":["../../../src/utils/cosine-similarity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,CAA0B,EAC1B,CAA0B;IAE1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAE3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChB,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;QACf,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC;QACjB,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AACnC,CAAC"}

package/dist/src/utils/input-guards.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Input validation and prompt-injection guards.
+ *
+ * Inlined from the former @monomind/security package. Provides a single
+ * typed entry point for input validation covering string, number, path,
+ * url, and orgName types, plus a heuristic prompt-injection detector
+ * for untrusted external content.
+ *
+ * @module @monomind/cli/utils/input-guards
+ */
+export interface ValidationResult {
+    valid: boolean;
+    error?: string;
+    sanitized?: string;
+}
+export interface ValidateInputOpts {
+    type: 'string' | 'number' | 'path' | 'url' | 'orgName';
+    maxLength?: number;
+    required?: boolean;
+}
+/**
+ * Validate and sanitize an input value.
+ *
+ * @example
+ * const result = validateInput(req.body.name, { type: 'orgName' });
+ * if (!result.valid) throw new Error(result.error);
+ * const safeName = result.sanitized!;
+ */
+export declare function validateInput(value: unknown, opts: ValidateInputOpts): ValidationResult;
+export interface ExternalContentResult {
+    safe: boolean;
+    reason?: string;
+}
+/**
+ * Heuristically check whether `content` contains prompt-injection
+ * patterns. This is a structural / regex-based guard — it does not
+ * call any LLM.
+ *
+ * @param content - The untrusted string to inspect.
+ * @param source  - Optional label describing where the content came
+ *                  from (used only in log-friendly diagnostics, not
+ *                  in the returned reason).
+ * @returns `{ safe: true }` when no injection signal is found, or
+ *          `{ safe: false, reason }` describing the first match.
+ *
+ * @example
+ * const check = await validateExternalContent(userQuery, 'memory search');
+ * if (!check.safe) throw new Error(`Blocked: ${check.reason}`);
+ */
+export declare function validateExternalContent(content: string, source?: string): Promise<ExternalContentResult>;
+//# sourceMappingURL=input-guards.d.ts.map

package/dist/src/utils/input-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-guards.d.ts","sourceRoot":"","sources":["../../../src/utils/input-guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAmHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,iBAAiB,GACtB,gBAAgB,CAalB;AAMD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAyCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,CAuChC"}

package/dist/src/utils/input-guards.js

@@ -0,0 +1,223 @@
+/**
+ * Input validation and prompt-injection guards.
+ *
+ * Inlined from the former @monomind/security package. Provides a single
+ * typed entry point for input validation covering string, number, path,
+ * url, and orgName types, plus a heuristic prompt-injection detector
+ * for untrusted external content.
+ *
+ * @module @monomind/cli/utils/input-guards
+ */
+import { resolve, isAbsolute } from 'node:path';
+import { cwd } from 'node:process';
+/**
+ * Strip C0 and C1 control characters (U+0000–U+001F, U+007F–U+009F)
+ * but preserve printable ASCII and extended Unicode.
+ */
+function stripControlChars(s) {
+    // eslint-disable-next-line no-control-regex
+    return s.replace(/[\x00-\x1F\x7F-\x9F]/g, '');
+}
+function validateString(value, opts) {
+    if (typeof value !== 'string') {
+        if (opts.required !== false && value == null) {
+            return { valid: false, error: 'Value is required' };
+        }
+        return { valid: false, error: 'Value must be a string' };
+    }
+    if (opts.required !== false && value.length === 0) {
+        return { valid: false, error: 'Value must not be empty' };
+    }
+    const maxLen = opts.maxLength ?? 4096;
+    if (value.length > maxLen) {
+        return {
+            valid: false,
+            error: `Value exceeds maximum length of ${maxLen}`,
+        };
+    }
+    const sanitized = stripControlChars(value);
+    return { valid: true, sanitized };
+}
+function validateNumber(value, opts) {
+    const parsed = typeof value === 'number'
+        ? value
+        : typeof value === 'string' && value.trim() !== ''
+            ? Number(value)
+            : NaN;
+    if (!Number.isFinite(parsed)) {
+        if (opts.required === false && value == null) {
+            return { valid: true };
+        }
+        return { valid: false, error: 'Value must be a finite number' };
+    }
+    return { valid: true, sanitized: String(parsed) };
+}
+function validatePath(value, opts) {
+    if (typeof value !== 'string') {
+        return { valid: false, error: 'Path must be a string' };
+    }
+    if (value.includes('\0')) {
+        return { valid: false, error: 'Path must not contain null bytes' };
+    }
+    // Reject traversal segments
+    if (/(^|[\\/])\.\.($|[\\/])/.test(value)) {
+        return { valid: false, error: 'Path must not contain directory traversal (..)' };
+    }
+    // Reject absolute paths that escape cwd
+    if (isAbsolute(value)) {
+        const cwdPath = cwd();
+        const resolved = resolve(value);
+        if (!resolved.startsWith(cwdPath + '/') && resolved !== cwdPath) {
+            return { valid: false, error: 'Absolute path must not escape the current working directory' };
+        }
+    }
+    const maxLen = opts.maxLength ?? 4096;
+    if (value.length > maxLen) {
+        return { valid: false, error: `Path exceeds maximum length of ${maxLen}` };
+    }
+    return { valid: true, sanitized: value };
+}
+function validateUrl(value, opts) {
+    if (typeof value !== 'string') {
+        return { valid: false, error: 'URL must be a string' };
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return { valid: false, error: 'Value is not a valid URL' };
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return { valid: false, error: 'URL must use http or https protocol' };
+    }
+    const maxLen = opts.maxLength ?? 4096;
+    if (value.length > maxLen) {
+        return { valid: false, error: `URL exceeds maximum length of ${maxLen}` };
+    }
+    return { valid: true, sanitized: parsed.toString() };
+}
+/** Org name: lowercase alphanumeric + hyphens, 1–64 chars, must start with alnum */
+const ORG_NAME_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+function validateOrgName(value, _opts) {
+    if (typeof value !== 'string') {
+        return { valid: false, error: 'Org name must be a string' };
+    }
+    if (!ORG_NAME_RE.test(value)) {
+        return {
+            valid: false,
+            error: 'Org name must match ^[a-z0-9][a-z0-9-]{0,63}$ (lowercase, alphanumeric + hyphens, 1–64 chars)',
+        };
+    }
+    return { valid: true, sanitized: value };
+}
+/**
+ * Validate and sanitize an input value.
+ *
+ * @example
+ * const result = validateInput(req.body.name, { type: 'orgName' });
+ * if (!result.valid) throw new Error(result.error);
+ * const safeName = result.sanitized!;
+ */
+export function validateInput(value, opts) {
+    switch (opts.type) {
+        case 'string':
+            return validateString(value, opts);
+        case 'number':
+            return validateNumber(value, opts);
+        case 'path':
+            return validatePath(value, opts);
+        case 'url':
+            return validateUrl(value, opts);
+        case 'orgName':
+            return validateOrgName(value, opts);
+    }
+}
+/**
+ * Case-insensitive patterns that indicate an attempt to override
+ * system-level instructions or inject prompt directives.
+ */
+const INJECTION_PATTERNS = [
+    { re: /ignore\s+(all\s+)?previous\s+instructions/i, label: 'instruction override ("ignore previous instructions")' },
+    { re: /ignore\s+(all\s+)?prior\s+instructions/i, label: 'instruction override ("ignore prior instructions")' },
+    { re: /disregard\s+(all\s+)?(previous|prior|above)\s+instructions/i, label: 'instruction override ("disregard instructions")' },
+    { re: /forget\s+(all\s+)?(previous|prior|above)\s+(instructions|context)/i, label: 'instruction override ("forget instructions")' },
+    { re: /you\s+are\s+now\b/i, label: 'identity hijack ("you are now")' },
+    { re: /act\s+as\s+(if\s+you\s+are|a|an)\b/i, label: 'identity hijack ("act as")' },
+    { re: /pretend\s+(you\s+are|to\s+be)\b/i, label: 'identity hijack ("pretend to be")' },
+    { re: /^system\s*:/im, label: 'system prompt injection ("system:")' },
+    { re: /\[system\]/i, label: 'system prompt injection ("[system]")' },
+    { re: /<<\s*system\s*>>/i, label: 'system prompt injection ("<<system>>")' },
+    { re: /^IMPORTANT\s*:/im, label: 'directive injection ("IMPORTANT:")' },
+    { re: /^INSTRUCTION\s*:/im, label: 'directive injection ("INSTRUCTION:")' },
+    { re: /^OVERRIDE\s*:/im, label: 'directive injection ("OVERRIDE:")' },
+    { re: /\bdo\s+not\s+follow\s+(any\s+)?(previous|prior|earlier)\b/i, label: 'instruction override ("do not follow previous")' },
+    { re: /\bnew\s+instructions?\s*:/i, label: 'directive injection ("new instructions:")' },
+];
+/**
+ * Suspicious encoding patterns that may attempt to smuggle directives
+ * through Base64, hex escapes, or Unicode homoglyphs.
+ */
+const ENCODING_PATTERNS = [
+    // Large Base64 blobs (>80 chars of contiguous base64 alphabet)
+    { re: /[A-Za-z0-9+/=]{80,}/, label: 'suspicious Base64-encoded blob' },
+    // Excessive hex escapes (\x41\x42...)
+    { re: /(\\x[0-9a-fA-F]{2}){6,}/, label: 'suspicious hex-escape sequence' },
+    // Excessive Unicode escapes (AB...)
+    { re: /(\\u[0-9a-fA-F]{4}){6,}/, label: 'suspicious Unicode-escape sequence' },
+];
+/** Threshold ratio of uppercase + directive-like words to total words. */
+const DIRECTIVE_DENSITY_THRESHOLD = 0.4;
+const DIRECTIVE_WORDS = /\b(MUST|SHALL|ALWAYS|NEVER|IMPORTANT|OVERRIDE|IMMEDIATELY|MANDATORY|REQUIRED|CRITICAL)\b/g;
+/**
+ * Heuristically check whether `content` contains prompt-injection
+ * patterns. This is a structural / regex-based guard — it does not
+ * call any LLM.
+ *
+ * @param content - The untrusted string to inspect.
+ * @param source  - Optional label describing where the content came
+ *                  from (used only in log-friendly diagnostics, not
+ *                  in the returned reason).
+ * @returns `{ safe: true }` when no injection signal is found, or
+ *          `{ safe: false, reason }` describing the first match.
+ *
+ * @example
+ * const check = await validateExternalContent(userQuery, 'memory search');
+ * if (!check.safe) throw new Error(`Blocked: ${check.reason}`);
+ */
+export async function validateExternalContent(content, source) {
+    if (typeof content !== 'string') {
+        return { safe: false, reason: 'Content must be a string' };
+    }
+    // Empty / very short content is trivially safe.
+    if (content.length === 0) {
+        return { safe: true };
+    }
+    // --- 1. Direct injection patterns ---
+    for (const { re, label } of INJECTION_PATTERNS) {
+        if (re.test(content)) {
+            return { safe: false, reason: `Prompt injection detected: ${label}` };
+        }
+    }
+    // --- 2. Suspicious encoding ---
+    for (const { re, label } of ENCODING_PATTERNS) {
+        if (re.test(content)) {
+            return { safe: false, reason: `Suspicious encoding: ${label}` };
+        }
+    }
+    // --- 3. Directive density ---
+    // Only check strings long enough to be meaningful (>20 words).
+    const words = content.split(/\s+/).filter(Boolean);
+    if (words.length > 20) {
+        const matches = content.match(DIRECTIVE_WORDS);
+        const density = (matches?.length ?? 0) / words.length;
+        if (density >= DIRECTIVE_DENSITY_THRESHOLD) {
+            return {
+                safe: false,
+                reason: `Excessive directive density (${(density * 100).toFixed(0)}% directive keywords)`,
+            };
+        }
+    }
+    return { safe: true };
+}
+//# sourceMappingURL=input-guards.js.map

package/dist/src/utils/input-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-guards.js","sourceRoot":"","sources":["../../../src/utils/input-guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAcnC;;;GAGG;AACH,SAAS,iBAAiB,CAAC,CAAS;IAClC,4CAA4C;IAC5C,OAAO,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,IAAuB;IAEvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,mCAAmC,MAAM,EAAE;SACnD,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,IAAuB;IAC7D,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAClD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACf,CAAC,CAAC,GAAG,CAAC;IAEV,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAuB;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;IACrE,CAAC;IACD,4BAA4B;IAC5B,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IACnF,CAAC;IACD,wCAAwC;IACxC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,6DAA6D,EAAE,CAAC;QAChG,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,MAAM,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,IAAuB;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,MAAM,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,oFAAoF;AACpF,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,SAAS,eAAe,CAAC,KAAc,EAAE,KAAwB;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EACH,+FAA+F;SAClG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAc,EACd,IAAuB;IAEvB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,KAAK,MAAM;YACT,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,KAAK,KAAK;YACR,OAAO,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClC,KAAK,SAAS;YACZ,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAWD;;;GAGG;AACH,MAAM,kBAAkB,GAAyC;IAC/D,EAAE,EAAE,EAAE,4CAA4C,EAAE,KAAK,EAAE,uDAAuD,EAAE;IACpH,EAAE,EAAE,EAAE,yCAAyC,EAAE,KAAK,EAAE,oDAAoD,EAAE;IAC9G,EAAE,EAAE,EAAE,6DAA6D,EAAE,KAAK,EAAE,iDAAiD,EAAE;IAC/H,EAAE,EAAE,EAAE,oEAAoE,EAAE,KAAK,EAAE,8CAA8C,EAAE;IACnI,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACtE,EAAE,EAAE,EAAE,qCAAqC,EAAE,KAAK,EAAE,4BAA4B,EAAE;IAClF,EAAE,EAAE,EAAE,kCAAkC,EAAE,KAAK,EAAE,mCAAmC,EAAE;IACtF,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,qCAAqC,EAAE;IACrE,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,sCAAsC,EAAE;IACpE,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,wCAAwC,EAAE;IAC5E,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,oCAAoC,EAAE;IACvE,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,sCAAsC,EAAE;IAC3E,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IACrE,EAAE,EAAE,EAAE,4DAA4D,EAAE,KAAK,EAAE,iDAAiD,EAAE;IAC9H,EAAE,EAAE,EAAE,4BAA4B,EAAE,KAAK,EAAE,2CAA2C,EAAE;CACzF,CAAC;AAEF;;;GAGG;AACH,MAAM,iBAAiB,GAAyC;IAC9D,+DAA+D;IAC/D,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,gCAAgC,EAAE;IACtE,sCAAsC;IACtC,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,gCAAgC,EAAE;IAC1E,oCAAoC;IACpC,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,oCAAoC,EAAE;CAC/E,CAAC;AAEF,0EAA0E;AAC1E,MAAM,2BAA2B,GAAG,GAAG,CAAC;AACxC,MAAM,eAAe,GAAG,2FAA2F,CAAC;AAEpH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,MAAe;IAEf,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC7D,CAAC;IAED,gDAAgD;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,uCAAuC;IACvC,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,kBAAkB,EAAE,CAAC;QAC/C,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,KAAK,EAAE,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,iBAAiB,EAAE,CAAC;QAC9C,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,KAAK,EAAE,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,+DAA+D;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QACtD,IAAI,OAAO,IAAI,2BAA2B,EAAE,CAAC;YAC3C,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,gCAAgC,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;aAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}

package/dist/src/utils/json-file.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Shared atomic JSON file I/O utility.
+ *
+ * Previously duplicated across 10+ files with the same
+ * writeFileSync(tmp) + renameSync(tmp, path) pattern:
+ *   - mcp-tools/neural-tools.ts
+ *   - memory/intelligence.ts
+ *   - autopilot-state.ts
+ *   - commands/claims.ts
+ *   - commands/swarm.ts
+ *   - commands/neural-optimize.ts
+ *   - commands/neural-registry.ts
+ *   - commands/agent-lifecycle.ts
+ *   - commands/memory-admin.ts
+ *   - commands/memory-list.ts
+ *   - commands/security-cve.ts
+ *
+ * This is the single canonical implementation. Uses atomic
+ * rename to prevent partial writes on crash.
+ */
+/**
+ * Read and parse a JSON file. Returns `fallback` if file doesn't exist,
+ * exceeds maxBytes, or fails to parse.
+ */
+export declare function readJsonFileSync<T>(filePath: string, fallback: T, maxBytes?: number): T;
+/**
+ * Atomically write a JSON value to disk.
+ *
+ * Writes to a temporary file first (PID + timestamp suffix to avoid
+ * collisions), then renames into place. Ensures the directory exists.
+ */
+export declare function writeJsonFileAtomic(filePath: string, data: unknown, pretty?: boolean): void;
+//# sourceMappingURL=json-file.d.ts.map

package/dist/src/utils/json-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-file.d.ts","sourceRoot":"","sources":["../../../src/utils/json-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAChC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,CAAC,EACX,QAAQ,SAAmB,GAC1B,CAAC,CAUH;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,UAAO,GACZ,IAAI,CASN"}

package/dist/src/utils/json-file.js

@@ -0,0 +1,57 @@
+/**
+ * Shared atomic JSON file I/O utility.
+ *
+ * Previously duplicated across 10+ files with the same
+ * writeFileSync(tmp) + renameSync(tmp, path) pattern:
+ *   - mcp-tools/neural-tools.ts
+ *   - memory/intelligence.ts
+ *   - autopilot-state.ts
+ *   - commands/claims.ts
+ *   - commands/swarm.ts
+ *   - commands/neural-optimize.ts
+ *   - commands/neural-registry.ts
+ *   - commands/agent-lifecycle.ts
+ *   - commands/memory-admin.ts
+ *   - commands/memory-list.ts
+ *   - commands/security-cve.ts
+ *
+ * This is the single canonical implementation. Uses atomic
+ * rename to prevent partial writes on crash.
+ */
+import { readFileSync, writeFileSync, renameSync, existsSync, statSync, mkdirSync } from 'fs';
+import { dirname } from 'path';
+/**
+ * Read and parse a JSON file. Returns `fallback` if file doesn't exist,
+ * exceeds maxBytes, or fails to parse.
+ */
+export function readJsonFileSync(filePath, fallback, maxBytes = 50 * 1024 * 1024) {
+    try {
+        if (!existsSync(filePath))
+            return fallback;
+        const stat = statSync(filePath);
+        if (stat.size > maxBytes)
+            return fallback;
+        const raw = readFileSync(filePath, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return fallback;
+    }
+}
+/**
+ * Atomically write a JSON value to disk.
+ *
+ * Writes to a temporary file first (PID + timestamp suffix to avoid
+ * collisions), then renames into place. Ensures the directory exists.
+ */
+export function writeJsonFileAtomic(filePath, data, pretty = true) {
+    const dir = dirname(filePath);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    const content = pretty ? JSON.stringify(data, null, 2) : JSON.stringify(data);
+    const tmp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(tmp, content, 'utf-8');
+    renameSync(tmp, filePath);
+}
+//# sourceMappingURL=json-file.js.map

package/dist/src/utils/json-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-file.js","sourceRoot":"","sources":["../../../src/utils/json-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC9F,OAAO,EAAE,OAAO,EAAQ,MAAM,MAAM,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,QAAW,EACX,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;IAE3B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,IAAa,EACb,MAAM,GAAG,IAAI;IAEb,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IAC3D,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC5B,CAAC"}