@monoes/monomindcli 1.8.0 → 1.9.0

package/.claude/skills/stop-slop/references/structures.md

@@ -0,0 +1,136 @@
+<!-- Pattern adapted from stop-slop by Hardik Pandya (hvpandya.com) — ported for monomind -->
+
+# Structures to Avoid
+
+## Binary Contrasts
+
+These create false drama. State the point directly.
+
+| Pattern | Problem |
+|---------|---------|
+| "Not because X. Because Y." / "Not because X, but because Y." | Telegraphed reversal |
+| "[X] isn't the problem. [Y] is." | Formulaic reframe |
+| "The answer isn't X. It's Y." | Predictable pivot |
+| "It feels like X. It's actually Y." | Setup/reveal cliche |
+| "The question isn't X. It's Y." | Rhetorical misdirection |
+| "Not X. But Y." / "not X, it's Y" / "isn't X, it's Y" | Mechanical contrast |
+| "It's not this. It's that." | Same formula, different words |
+| "stops being X and starts being Y" | False transformation arc |
+| "doesn't mean X, but actually Y" | Negation-then-assertion crutch |
+| "is about X but not Y" | False distinction |
+| "not just X but also Y" | Additive hedge |
+
+**Instead:** State Y directly. "The problem is Y." "Y matters here." Drop the negation entirely.
+
+## Negative Listing
+
+Listing what something is *not* before revealing what it *is*. A rhetorical striptease.
+
+| Pattern | Problem |
+|---------|---------|
+| "Not a X... Not a Y... A Z." | Dramatic buildup through negation |
+| "It wasn't X. It wasn't Y. It was Z." | Same structure, past tense |
+
+**Instead:** State Z. The reader doesn't need the runway.
+
+## Dramatic Fragmentation
+
+Sentence fragments for emphasis read as manufactured profundity.
+
+| Pattern | Problem |
+|---------|---------|
+| "[Noun]. That's it. That's the [thing]." | Performative simplicity |
+| "X. And Y. And Z." | Staccato drama |
+| "This unlocks something. [Word]." | Artificial revelation |
+
+**Instead:** Complete sentences. Trust content over presentation.
+
+## Rhetorical Setups
+
+These announce insight rather than deliver it.
+
+| Pattern | Problem |
+|---------|---------|
+| "What if [reframe]?" | Socratic posturing |
+| "Here's what I mean:" | Redundant preview |
+| "Think about it:" | Condescending prompt |
+| "And that's okay." | Unnecessary permission |
+
+**Instead:** Make the point. Let readers draw conclusions.
+
+## Formulaic Constructions
+
+| Pattern | Problem |
+|---------|---------|
+| "By the time X, I was Y." | Narrative template |
+| "X that isn't Y" | Indirect. Say "X is broken" |
+
+## False Agency
+
+Giving inanimate things human verbs. Complaints don't "become" fixes. Bets don't "live or die." Decisions don't "emerge." A person does something to make those things happen. AI loves this because it avoids naming the actor.
+
+| Pattern | Problem |
+|---------|---------|
+| "a complaint becomes a fix" | The complaint did nothing. Someone fixed it. |
+| "a bet lives or dies in days" | Bets don't have lifespans. Someone kills the project or ships it. |
+| "the decision emerges" | Decisions don't emerge. Someone decides. |
+| "the culture shifts" | Cultures don't shift on their own. People change behavior. |
+| "the conversation moves toward" | Conversations don't move. Someone steers. |
+| "the data tells us" | Data sits there. Someone reads it and draws a conclusion. |
+| "the market rewards" | Markets don't reward. Buyers pay for things. |
+
+**Instead:** Name the human. "The team fixed it that week" beats "the complaint becomes a fix." If no specific person fits, use "you" to put the reader in the seat.
+
+## Narrator-from-a-Distance
+
+Floating above the scene instead of putting the reader in it.
+
+| Pattern | Problem |
+|---------|---------|
+| "Nobody designed this." | Disembodied observation |
+| "This happens because..." | Lecturer voice |
+| "This is why..." | Same |
+| "People tend to..." | Armchair sociologist |
+
+**Instead:** Put the reader in the room. "You don't sit down one day and decide to..." beats "Nobody designed this."
+
+## Passive Voice
+
+Every sentence needs a subject doing something. Passive voice hides the actor and drains energy.
+
+| Pattern | Fix |
+|---------|-----|
+| "X was created" | Name who created it |
+| "It is believed that" | Name who believes it |
+| "Mistakes were made" | Name who made them |
+| "The decision was reached" | Name who decided |
+
+**Instead:** Find the actor. Put them at the front of the sentence.
+
+## Sentence Starters to Avoid
+
+| Pattern | Fix |
+|---------|-----|
+| Sentences starting with What, When, Where, Which, Who, Why, How | Restructure. Lead with the subject or the verb. |
+| Paragraphs starting with "So" | Start with content |
+| Sentences starting with "Look," | Remove |
+
+Wh- openers become a crutch. "What makes this hard is..." becomes "The constraint is..." or better, name the specific constraint.
+
+## Rhythm Patterns
+
+| Pattern | Fix |
+|---------|-----|
+| Three-item lists | Use two items or one |
+| Questions answered immediately | Let questions breathe or cut them |
+| Every paragraph ends punchily | Vary endings |
+| Em-dashes | Remove. Use commas or periods. No em dashes at all. |
+| Staccato fragmentation | Don't stack short punchy sentences |
+| "Not always. Not perfectly." | Hedging disguised as reassurance |
+
+## Word Patterns
+
+| Pattern | Problem |
+|---------|---------|
+| Lazy extremes (every, always, never, everyone, everybody, nobody) | False authority. Use specifics instead of sweeping claims. |
+| All adverbs (-ly words, "really," "just," "literally," "genuinely," "honestly," "simply," "actually") | Empty emphasis. See phrases.md for full list. |

package/.claude/skills/swarm-advanced/SKILL.md

@@ -28,7 +28,7 @@ mcp__monomind__swarm_init({ topology: "mesh", maxAgents: 6 })
 mcp__monomind__agent_spawn({ type: "researcher", name: "Agent 1" })
 
 // 3. Orchestrate tasks
-mcp__monomind__task_orchestrate({ task: "...", strategy: "parallel" })
+Task("orchestrate task", "...", "coordinator")
 ```
 
 ## Core Concepts
@@ -142,7 +142,7 @@ mcp__monomind__parallel_execute({
 })
 
 // Store research findings in memory
-mcp__monomind__memory_usage({
+mcp__monomind__memory_store({
   "action": "store",
   "key": "research-findings-" + Date.now(),
   "value": JSON.stringify(findings),
@@ -199,7 +199,7 @@ mcp__monomind__neural_patterns({
 })
 
 // Store connections for future use
-mcp__monomind__memory_usage({
+mcp__monomind__memory_store({
   "action": "store",
   "key": "knowledge-graph-X",
   "value": JSON.stringify(knowledgeGraph),
@@ -211,12 +211,7 @@ mcp__monomind__memory_usage({
 #### Phase 4: Report Generation
 ```javascript
 // Orchestrate report generation
-mcp__monomind__task_orchestrate({
-  "task": "generate comprehensive research report",
-  "strategy": "sequential",
-  "priority": "high",
-  "dependencies": ["gather", "analyze", "validate", "synthesize"]
-})
+Task("generate comprehensive research report", "sequential, high priority", "documenter")
 
 // Monitor research progress
 mcp__monomind__swarm_status({
@@ -287,15 +282,10 @@ devTeam.forEach(member => {
 #### Phase 1: Architecture and Design
 ```javascript
 // System architecture design
-mcp__monomind__task_orchestrate({
-  "task": "design system architecture for REST API",
-  "strategy": "sequential",
-  "priority": "critical",
-  "assignTo": "System Architect"
-})
+Task("design system architecture for REST API", "sequential, critical priority", "System Architect")
 
 // Store architecture decisions
-mcp__monomind__memory_usage({
+mcp__monomind__memory_store({
   "action": "store",
   "key": "architecture-decisions",
   "value": JSON.stringify(architectureDoc),
@@ -479,7 +469,7 @@ mcp__monomind__pattern_recognize({
 })
 
 // Store test plan
-mcp__monomind__memory_usage({
+mcp__monomind__memory_store({
   "action": "store",
   "key": "test-plan-" + Date.now(),
   "value": JSON.stringify(testPlan),
@@ -678,26 +668,14 @@ mcp__monomind__daa_fault_tolerance({
 
 // Error handling pattern
 try {
-  await mcp__monomind__task_orchestrate({
-    "task": "complex operation",
-    "strategy": "parallel",
-    "priority": "high"
-  })
+  Task("complex operation", "parallel execution, high priority", "coordinator")
 } catch (error) {
   // Check swarm health
   const status = await mcp__monomind__swarm_status({})
 
-  // Analyze error patterns
-  await mcp__monomind__error_analysis({
-    "logs": [error.message]
-  })
-
   // Auto-recovery attempt
   if (status.healthy) {
-    await mcp__monomind__task_orchestrate({
-      "task": "retry failed operation",
-      "strategy": "sequential"
-    })
+    Task("retry failed operation", "sequential", "coordinator")
   }
 }
 ```
@@ -706,9 +684,7 @@ try {
 
 ```javascript
 // Cross-session persistence
-mcp__monomind__memory_persist({
-  "sessionId": "swarm-session-001"
-})
+// npx monomind session save --session-id "swarm-session-001"
 
 // Namespace management for different swarms
 mcp__monomind__memory_namespace({
@@ -722,13 +698,11 @@ mcp__monomind__state_snapshot({
 })
 
 // Restore from snapshot if needed
-mcp__monomind__context_restore({
-  "snapshotId": "development-checkpoint-1"
-})
+// npx monomind session restore --snapshot "development-checkpoint-1"
 
 // Backup memory stores
 mcp__monomind__memory_backup({
-  "path": "/workspaces/claude-code-flow/backups/swarm-memory.json"
+  "path": "./backups/swarm-memory.json"
 })
 ```
 
@@ -736,11 +710,7 @@ mcp__monomind__memory_backup({
 
 ```javascript
 // Train neural patterns from successful workflows
-mcp__monomind__neural_train({
-  "pattern_type": "coordination",
-  "training_data": JSON.stringify(successfulWorkflows),
-  "epochs": 50
-})
+// npx monomind neural train --pattern coordination --epochs 50
 
 // Adaptive learning from experience
 mcp__monomind__learning_adapt({

package/.claude/skills/{v3-swarm-coordination → swarm-coordination}/SKILL.md

@@ -1,13 +1,20 @@
 ---
-name: "v1 Swarm Coordination"
-description: "15-agent hierarchical mesh coordination for v1 implementation. Orchestrates parallel execution across security, core, and integration domains following 10 ADRs with 14-week timeline."
+name: swarm-coordination
+description: "15-agent hierarchical mesh coordination for complex implementations. Orchestrates parallel execution across security, core, and integration domains following 10 ADRs with 14-week timeline."
+triggers:
+  - spawn 15 agents
+  - hierarchical mesh swarm
+  - multi-agent implementation
+  - coordinate parallel agents
+  - swarm implementation
+  - orchestrate agent domains
 ---
 
 # Swarm Coordination
 
 ## What This Skill Does
 
-Orchestrates the complete 15-agent hierarchical mesh swarm for monomind v1 implementation, coordinating parallel execution across domains while maintaining dependencies and timeline adherence.
+Orchestrates the complete 15-agent hierarchical mesh swarm for monomind implementation, coordinating parallel execution across domains while maintaining dependencies and timeline adherence.
 
 ## Quick Start
 
@@ -22,7 +29,7 @@ Task("Security testing", "Implement TDD security framework", "test-architect")
 
 # Core domain (Phase 2 - Parallel execution)
 Task("Memory unification", "Implement AgentDB 150x improvement", "v1-memory-specialist")
-Task("Integration architecture", "Deep agentic-flow@alpha integration", "v1-integration-architect")
+Task("Integration architecture", "Deep monomind integration architecture", "v1-integration-architect")
 Task("Performance validation", "Validate 2.49x-7.47x targets", "v1-performance-engineer")
 ```
 
@@ -60,7 +67,7 @@ Task("Performance validation", "Validate 2.49x-7.47x targets", "v1-performance-e
 | 7   | Memory Specialist     | Core          | Systems      | AgentDB unification                   |
 | 8   | Swarm Specialist      | Core          | Systems      | Unified coordination engine           |
 | 9   | MCP Specialist        | Core          | Systems      | MCP server optimization               |
-| 10  | Integration Architect | Integration   | Integration  | agentic-flow@alpha deep integration   |
+| 10  | Integration Architect | Integration   | Integration  | monomind deep integration   |
 | 11  | CLI/Hooks Developer   | Integration   | Integration  | CLI modernization                     |
 | 12  | Neural/Learning Dev   | Integration   | Integration  | SONA integration                      |
 | 13  | TDD Test Engineer     | Quality       | All          | London School TDD                     |
@@ -149,7 +156,7 @@ const phase3 = async () => {
   // Parallel integration and optimization
   await Promise.all([
     Task(
-      "agentic-flow integration",
+      "monomind integration",
       "Eliminate 10,000+ duplicate lines",
       "v1-integration-architect",
     ),
@@ -202,9 +209,8 @@ const phase4 = async () => {
     ),
 
     // All agents: Final polish and optimization
-    ...agents.map((agent) =>
-      Task("Final polish", `Agent ${agent.id} final optimization`, agent.name),
-    ),
+    // Replace with actual agent IDs from the roster above
+    // e.g. Task("Final polish", "Agent #X final optimization", "agent-name-from-roster")
   ]);
 };
 ```
@@ -274,7 +280,7 @@ class GitHubCoordination {
     const epics = [
       { title: "Security Overhaul (CVE-1,2,3)", agents: [2, 3, 4] },
       { title: "Memory Unification (AgentDB)", agents: [7] },
-      { title: "agentic-flow Integration", agents: [10] },
+      { title: "Monomind Integration", agents: [10] },
       { title: "Performance Optimization", agents: [14] },
       { title: "DDD Architecture", agents: [5, 6] },
     ];
@@ -288,14 +294,23 @@ class GitHubCoordination {
     }
   }
 
+  private progressTimer: NodeJS.Timeout | null = null;
+
   async trackProgress(): Promise<void> {
     // Hourly progress updates from each agent
-    setInterval(async () => {
+    this.progressTimer = setInterval(async () => {
       for (const agent of this.agents) {
         await this.postAgentProgress(agent);
       }
     }, 3600000); // 1 hour
   }
+
+  stopTracking(): void {
+    if (this.progressTimer) {
+      clearInterval(this.progressTimer);
+      this.progressTimer = null;
+    }
+  }
 }
 ```
 
@@ -303,11 +318,14 @@ class GitHubCoordination {
 
 ```typescript
 class SwarmCommunication {
-  private bus = new QuicSwarmBus({
-    maxAgents: 15,
-    messageTimeout: 30000,
-    retryAttempts: 3,
-  });
+  // Communication via MCP tool calls and shared .monomind/sessions/ namespace
+  // QuicSwarmBus is aspirational — implement when QUIC transport is added
+  private bus = {
+    broadcast: async (message: SwarmMessage, opts: { targetAgents: number[]; priority: string }) => {
+      // Use mcp__monomind__* tools or write to shared session namespace
+      throw new Error("Not implemented: use MCP tool calls for inter-agent messaging");
+    },
+  };
 
   async broadcastToSecurityDomain(message: SwarmMessage): Promise<void> {
     await this.bus.broadcast(message, {
@@ -398,12 +416,12 @@ class SwarmLoadBalancer {
 - [ ] **Code Reduction**: <5,000 lines (vs 15,000+)
 - [ ] **Security**: 90/100 security score achieved
 
-## Related v1 Skills
+## Related Skills
 
-- `v1-security-overhaul` - Security domain coordination
-- `v1-memory-unification` - Memory system coordination
-- `v1-integration-deep` - Integration domain coordination
-- `v1-performance-optimization` - Performance domain coordination
+- `security-hardening` - Security domain coordination
+- `memory-unification` - Memory system coordination
+- `agentic-integration` - Integration domain coordination
+- `performance-optimization` - Performance domain coordination
 
 ## Usage Examples
 

package/.claude/skills/swarm-orchestration/SKILL.md

@@ -1,17 +1,17 @@
 ---
-name: "Swarm Orchestration"
-description: "Orchestrate multi-agent swarms with agentic-flow for parallel task execution, dynamic topology, and intelligent coordination. Use when scaling beyond single agents, implementing complex workflows, or building distributed AI systems."
+name: swarm-orchestration
+description: "Orchestrate multi-agent swarms with monomind for parallel task execution, dynamic topology, and intelligent coordination. Use when scaling beyond single agents, implementing complex workflows, or building distributed AI systems."
 ---
 
 # Swarm Orchestration
 
 ## What This Skill Does
 
-Orchestrates multi-agent swarms using agentic-flow's advanced coordination system. Supports mesh, hierarchical, and adaptive topologies with automatic task distribution, load balancing, and fault tolerance.
+Orchestrates multi-agent swarms using monomind's advanced coordination system. Supports mesh, hierarchical, and adaptive topologies with automatic task distribution, load balancing, and fault tolerance.
 
 ## Prerequisites
 
-- agentic-flow v1.5.11+
+- monomind v1.8.0+
 - Node.js 18+
 - Understanding of distributed systems (helpful)
 
@@ -19,15 +19,15 @@ Orchestrates multi-agent swarms using agentic-flow's advanced coordination syste
 
 ```bash
 # Initialize swarm
-npx agentic-flow hooks swarm-init --topology mesh --max-agents 5
+npx monomind swarm init --topology mesh --max-agents 5
 
 # Spawn agents
-npx agentic-flow hooks agent-spawn --type coder
-npx agentic-flow hooks agent-spawn --type tester
-npx agentic-flow hooks agent-spawn --type reviewer
+npx monomind agent spawn --type coder
+npx monomind agent spawn --type tester
+npx monomind agent spawn --type reviewer
 
 # Orchestrate task
-npx agentic-flow hooks task-orchestrate \
+npx monomind task run \
   --task "Build REST API with tests" \
   --mode parallel
 ```
@@ -147,13 +147,13 @@ const metrics = await swarm.getMetrics();
 
 ```bash
 # Pre-task coordination
-npx agentic-flow hooks pre-task --description "Build API"
+npx monomind hooks pre-task --description "Build API"
 
 # Post-task synchronization
-npx agentic-flow hooks post-task --task-id "task-123"
+npx monomind hooks post-task --task-id "task-123"
 
 # Session restore
-npx agentic-flow hooks session-restore --session-id "swarm-001"
+npx monomind hooks session-restore --session-id "swarm-001"
 ```
 
 ## Best Practices

package/.claude/skills/verification-quality/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: "Verification & Quality Assurance"
+name: verification-quality
 description: |
   Comprehensive truth scoring, code quality verification, and automatic rollback system with 0.95 accuracy threshold for ensuring high-quality agent outputs and codebase reliability.
 ---
@@ -121,10 +121,10 @@ Recent Tasks:
 
 **Truth Scores (0.0-1.0):**
 
-- `1.0-0.95`: Excellent ⭐ (production-ready)
-- `0.94-0.85`: Good ✅ (acceptable quality)
-- `0.84-0.75`: Warning ⚠️ (needs attention)
-- `<0.75`: Critical ❌ (requires immediate action)
+- `1.0-0.95`: Excellent (production-ready)
+- `0.94-0.85`: Good (acceptable quality)
+- `0.84-0.75`: Warning (needs attention)
+- `<0.75`: Critical (requires immediate action)
 
 **Trend Indicators:**
 

package/README.md

@@ -315,25 +315,25 @@ Every session is recorded and browsable — tool calls, agent spawns, memory ope
 
 ## Memory & Intelligence
 
-### Knowledge Graph (Graphify)
+### Knowledge Graph (Monograph)
 
 Monomind builds a full dependency graph of your codebase — automatically queried before every task:
 
 ```bash
 # What files are relevant to my task?
-graphify_suggest "add webhook retry logic"
+monograph_suggest "add webhook retry logic"
 # → returns ranked list of files with relevance scores
 
 # What depends on UserService?
-graphify_query "UserService dependencies"
+monograph_query "UserService dependencies"
 # → returns file paths + line numbers
 
 # Find the most connected files in the codebase
-graphify_god_nodes
+monograph_god_nodes
 # → returns high-centrality internal files (external/test filtered out)
 ```
 
-All graphify tools are called automatically by hooks and slash commands — you don't need to invoke them manually.
+All monograph tools are called automatically by hooks and slash commands — you don't need to invoke them manually.
 
 ### Vector Memory (AgentDB + HNSW)
 

package/bin/cli.js

@@ -4,35 +4,81 @@
  *
  * Monomind Command Line Interface
  *
- * Auto-detects MCP mode when stdin is piped and no args provided.
- * This allows: echo '{"jsonrpc":"2.0",...}' | npx @monomind/cli
+ * MCP mode requires explicit `mcp start` subcommand or MONOMIND_MCP_AUTODETECT=1.
+ * Usage: npx @monomind/cli mcp start
  */
 
 import { randomUUID } from 'crypto';
 
-// Check if we should run in MCP server mode
-// Conditions:
-//   1. stdin is being piped AND no CLI arguments provided (auto-detect)
-//   2. stdin is being piped AND args are "mcp start" (explicit, e.g. npx monomind@alpha mcp start)
+// Check if we should run in MCP server mode.
+// SECURITY: only accept explicit `mcp start` plus piped stdin, OR the explicit
+// `MONOMIND_MCP_AUTODETECT=1` opt-in for the legacy "no args + non-TTY" path.
+// Previously any `monomind` invocation with redirected stdin (CI pipes, xargs,
+// editor integrations) silently flipped into MCP server mode and accepted
+// JSON-RPC tools/call — privilege escalation by environment.
 const cliArgs = process.argv.slice(2);
 const isExplicitMCP = cliArgs.length >= 1 && cliArgs[0] === 'mcp' && (cliArgs.length === 1 || cliArgs[1] === 'start');
-const isMCPMode = !process.stdin.isTTY && (process.argv.length === 2 || isExplicitMCP);
+const allowAutoDetect = process.env.MONOMIND_MCP_AUTODETECT === '1';
+const isMCPMode = !process.stdin.isTTY && (isExplicitMCP || (allowAutoDetect && process.argv.length === 2));
 
 if (isMCPMode) {
   // Run MCP server mode
   const { listMCPTools, callMCPTool, hasTool } = await import('../dist/src/mcp-client.js');
 
-  const VERSION = '3.0.0';
+  // Read version from package.json instead of hardcoding (prevents stale
+  // version drift between bin entry and the published package).
+  let VERSION = '0.0.0';
+  try {
+    const { readFileSync } = await import('fs');
+    const { fileURLToPath } = await import('url');
+    const { dirname, join } = await import('path');
+    const pkgPath = join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json');
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+    if (typeof pkg.version === 'string') VERSION = pkg.version;
+  } catch { /* fall back to 0.0.0 */ }
   const sessionId = `mcp-${Date.now()}-${randomUUID().slice(0, 8)}`;
 
-  console.error(
-    `[${new Date().toISOString()}] INFO [monomind-mcp] (${sessionId}) Starting in stdio mode`
-  );
+  // Don't leak nodeVersion/platform/arch/pid to stderr by default; gate behind
+  // MONOMIND_LOG_LEVEL=debug to reduce fingerprinting in shared log aggregators.
+  if (process.env.MONOMIND_LOG_LEVEL === 'debug') {
+    console.error(
+      `[${new Date().toISOString()}] INFO [monomind-mcp] (${sessionId}) Starting in stdio mode (node=${process.version} platform=${process.platform} arch=${process.arch})`
+    );
+  } else {
+    console.error(
+      `[${new Date().toISOString()}] INFO [monomind-mcp] (${sessionId}) Starting in stdio mode`
+    );
+  }
+
+  // Top-level safety nets — without these, an unhandled async error in a tool
+  // handler crashes the process with no observable cleanup.
+  process.on('uncaughtException', (err) => {
+    console.error(`[${new Date().toISOString()}] FATAL [monomind-mcp] uncaughtException: ${err && err.message ? err.message : String(err)}`);
+    process.exit(1);
+  });
+  process.on('unhandledRejection', (reason) => {
+    const msg = reason instanceof Error ? reason.message : String(reason);
+    console.error(`[${new Date().toISOString()}] FATAL [monomind-mcp] unhandledRejection: ${msg}`);
+    process.exit(1);
+  });
+  const shutdown = (sig) => {
+    console.error(`[${new Date().toISOString()}] INFO [monomind-mcp] (${sessionId}) ${sig} received, shutting down`);
+    process.exit(0);
+  };
+  process.on('SIGINT', () => shutdown('SIGINT'));
+  process.on('SIGTERM', () => shutdown('SIGTERM'));
 
+  // Cap on accumulated input buffer so a peer pumping a single multi-GB line
+  // (or a slow trickle without newlines) cannot OOM-kill the process.
+  const MAX_BUFFER_BYTES = 10 * 1024 * 1024;
   let buffer = '';
   process.stdin.setEncoding('utf8');
   process.stdin.on('data', async (chunk) => {
     buffer += chunk;
+    if (buffer.length > MAX_BUFFER_BYTES) {
+      console.error(`[${new Date().toISOString()}] FATAL [monomind-mcp] input exceeds ${MAX_BUFFER_BYTES} bytes`);
+      process.exit(1);
+    }
     let lines = buffer.split('\n');
     buffer = lines.pop() || '';
 
@@ -146,11 +192,30 @@ if (isMCPMode) {
     }
   }
 } else {
-  // Run normal CLI mode
+  // Run normal CLI mode.
+  // Install top-level handlers so an asynchronous error fired from an event-
+  // loop callback does not bypass the synchronous .catch below. Default Node
+  // handler prints the full stack to stderr — which on this codebase includes
+  // attacker-influenced bytes from registry/config error messages and full
+  // filesystem paths. Sanitize before logging and exit non-zero.
+  const safeMsg = (m) =>
+    String(m == null ? '' : m).replace(/[\x00-\x1f\x7f-\x9f]/g, '?').slice(0, 1000);
+  process.on('uncaughtException', (err) => {
+    console.error(`[${new Date().toISOString()}] FATAL [monomind] uncaughtException: ${safeMsg(err && err.message)}`);
+    if (process.env.DEBUG) console.error(err && err.stack);
+    process.exit(1);
+  });
+  process.on('unhandledRejection', (reason) => {
+    const msg = reason instanceof Error ? reason.message : String(reason);
+    console.error(`[${new Date().toISOString()}] FATAL [monomind] unhandledRejection: ${safeMsg(msg)}`);
+    if (process.env.DEBUG && reason instanceof Error) console.error(reason.stack);
+    process.exit(1);
+  });
+
   const { CLI } = await import('../dist/src/index.js');
   const cli = new CLI();
   cli.run().catch((error) => {
-    console.error('Fatal error:', error.message);
+    console.error('Fatal error:', safeMsg(error && error.message));
     process.exit(1);
   });
 }

package/dist/src/agents/halt-signal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"halt-signal.d.ts","sourceRoot":"","sources":["../../../src/agents/halt-signal.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAElF,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID;;GAEG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,EACzB,QAAQ,CAAC,EAAE,MAAM,GAChB,UAAU,CAiBZ;AAED;;GAEG;AACH,wBAAgB,QAAQ,CACtB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAgBT"}
+{"version":3,"file":"halt-signal.d.ts","sourceRoot":"","sources":["../../../src/agents/halt-signal.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAElF,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAeD;;GAEG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,EACzB,QAAQ,CAAC,EAAE,MAAM,GAChB,UAAU,CAiBZ;AAED;;GAEG;AACH,wBAAgB,QAAQ,CACtB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CA+BT"}