@monoes/monomindcli 1.8.0 → 1.9.1

package/dist/src/mcp-tools/hooks-tools.js

@@ -2,17 +2,9 @@
  * Hooks MCP Tools
  * Provides intelligent hooks functionality via MCP protocol
  */
-import { mkdirSync, writeFileSync, existsSync, readFileSync, statSync, unlinkSync, readdirSync, appendFileSync } from 'fs';
-import { dirname, join, resolve } from 'path';
+import { mkdirSync, writeFileSync, renameSync, existsSync, readFileSync, statSync, unlinkSync, readdirSync } from 'fs';
+import { dirname, join, resolve, sep } from 'path';
 import { getProjectCwd } from './types.js';
-function logEvent(kind, data) {
-    try {
-        const dir = join(getProjectCwd(), '.monomind', 'swarm');
-        if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-        const event = { ts: new Date().toISOString(), source: 'hook', kind, ...data };
-        appendFileSync(join(dir, 'events.jsonl'), JSON.stringify(event) + '\n');
-    } catch { }
-}
 // Real vector search functions - lazy loaded to avoid circular imports
 let searchEntriesFn = null;
 async function getRealSearchFunction() {
@@ -92,7 +84,8 @@ let semanticRouter = null;
 let nativeVectorDb = null;
 let semanticRouterInitialized = false;
 let routerBackend = 'none';
-// Pre-computed embeddings for common task patterns (cached)
+// Pre-computed embeddings for common task patterns (cached, capped to prevent unbounded growth)
+const MAX_PATTERN_EMBEDDINGS = 2000;
 const TASK_PATTERN_EMBEDDINGS = new Map();
 function generateSimpleEmbedding(text, dimension = 384) {
     // Simple deterministic embedding based on character codes
@@ -168,7 +161,9 @@ function saveRoutingOutcomes(outcomes) {
             mkdirSync(dir, { recursive: true });
         // Cap at 500 entries to bound file size
         const capped = outcomes.slice(-500);
-        writeFileSync(ROUTING_OUTCOMES_PATH, JSON.stringify({ outcomes: capped }, null, 2));
+        const tmp = ROUTING_OUTCOMES_PATH + '.tmp';
+        writeFileSync(tmp, JSON.stringify({ outcomes: capped }, null, 2));
+        renameSync(tmp, ROUTING_OUTCOMES_PATH);
     }
     catch { /* non-critical */ }
 }
@@ -293,7 +288,9 @@ async function getSemanticRouter() {
                 for (const keyword of keywords) {
                     const embedding = generateSimpleEmbedding(keyword);
                     db.insert(`${patternName}:${keyword}`, embedding);
-                    TASK_PATTERN_EMBEDDINGS.set(`${patternName}:${keyword}`, embedding);
+                    if (TASK_PATTERN_EMBEDDINGS.size < MAX_PATTERN_EMBEDDINGS) {
+                        TASK_PATTERN_EMBEDDINGS.set(`${patternName}:${keyword}`, embedding);
+                    }
                 }
             }
             nativeVectorDb = db;
@@ -313,9 +310,11 @@ async function getSemanticRouter() {
         for (const [patternName, { keywords, agents }] of Object.entries(getMergedTaskPatterns())) {
             const embeddings = keywords.map(kw => generateSimpleEmbedding(kw));
             semanticRouter.addIntentWithEmbeddings(patternName, embeddings, { agents, keywords });
-            // Cache embeddings for keywords
+            // Cache embeddings for keywords (capped)
             keywords.forEach((kw, i) => {
-                TASK_PATTERN_EMBEDDINGS.set(kw, embeddings[i]);
+                if (TASK_PATTERN_EMBEDDINGS.size < MAX_PATTERN_EMBEDDINGS) {
+                    TASK_PATTERN_EMBEDDINGS.set(kw, embeddings[i]);
+                }
             });
         }
         routerBackend = 'pure-js';
@@ -353,18 +352,10 @@ async function getFlashAttention() {
     }
     return flashAttention;
 }
-// LoRA Adapter - lazy loaded
+// LoRA Adapter removed — superseded by SONA instant adaptation
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
 let loraAdapter = null;
 async function getLoRAAdapter() {
-    if (!loraAdapter) {
-        try {
-            const { getLoRAAdapter: getLora } = await import('../ruvector/lora-adapter.js');
-            loraAdapter = await getLora();
-        }
-        catch {
-            loraAdapter = null;
-        }
-    }
     return loraAdapter;
 }
 // In-memory trajectory tracking (persisted on end)
@@ -372,7 +363,7 @@ const activeTrajectories = new Map();
 const MEMORY_DIR = '.monomind/memory';
 const MEMORY_FILE = 'store.json';
 function getMemoryPath() {
-    return resolve(join(MEMORY_DIR, MEMORY_FILE));
+    return join(getProjectCwd(), MEMORY_DIR, MEMORY_FILE);
 }
 function loadMemoryStore() {
     try {
@@ -718,10 +709,13 @@ export const hooksPostCommand = {
                 const store = loadMemoryStore();
                 const key = `cmd-${Date.now()}`;
                 store.entries[key] = { key, value: JSON.stringify({ command, exitCode, success }), namespace: 'commands', createdAt: new Date().toISOString() };
-                const memDir = resolve(MEMORY_DIR);
+                const memDir = join(getProjectCwd(), MEMORY_DIR);
                 if (!existsSync(memDir))
                     mkdirSync(memDir, { recursive: true });
-                writeFileSync(getMemoryPath(), JSON.stringify(store, null, 2), 'utf-8');
+                const _mp = getMemoryPath();
+                const _mptmp = _mp + '.tmp';
+                writeFileSync(_mptmp, JSON.stringify(store, null, 2), 'utf-8');
+                renameSync(_mptmp, _mp);
                 _storedIn = 'json-store';
             }
             catch { /* non-critical */ }
@@ -1078,7 +1072,7 @@ export const hooksPreTask = {
                 });
                 for (const r of (heuristicResults?.results ?? [])) {
                     try {
-                        const h = JSON.parse(r.content ?? r.value ?? '{}');
+                        const h = JSON.parse(r.content ?? '{}');
                         if (h.action && h.confidence !== undefined && h.confidence >= 0.6) {
                             erlHints.push(`ERL hint (conf=${h.confidence.toFixed(2)}): use "${h.action}" for tasks involving "${h.condition ?? 'similar context'}"`);
                         }
@@ -1094,7 +1088,7 @@ export const hooksPreTask = {
                     threshold: 0.55,
                 });
                 for (const r of (gradientResults?.results ?? [])) {
-                    const critique = r.content ?? r.value ?? '';
+                    const critique = r.content ?? '';
                     if (critique && critique.length > 10) {
                         erlHints.push(`TextGrad warning: ${critique.slice(0, 120)}`);
                     }
@@ -1102,7 +1096,6 @@ export const hooksPreTask = {
             }
         }
         catch { /* non-critical */ }
-        logEvent('task.start', { taskId, description: description?.slice(0, 200), complexity, suggestedAgent: suggestion.agents[0], modelTier: modelRouting?.tier });
         return {
             taskId,
             description,
@@ -1246,7 +1239,7 @@ export const hooksPostTask = {
                         key: `textual_gradient:${taskId}`,
                         value: critique,
                         namespace: 'gradients',
-                        tags: ['textual_gradient', agent, 'failure'],
+                        tags: ['textual_gradient', agent ?? 'unknown', 'failure'],
                     });
                 }
             }
@@ -1265,7 +1258,6 @@ export const hooksPostTask = {
             storeAs: 'heuristics',
             note: 'Spawn agents sequentially: Diagnoser → Critics in parallel → Aggregator',
         } : { needed: false };
-        logEvent('task.end', { taskId, success, duration, agent, quality, task: taskText?.slice(0, 200) });
         return {
             taskId,
             success,
@@ -1375,6 +1367,10 @@ export const hooksPretrain = {
     },
     handler: async (params) => {
         const repoPath = resolve(params.path || '.');
+        const projectRoot = getProjectCwd();
+        if (repoPath !== projectRoot && !repoPath.startsWith(projectRoot + sep)) {
+            return { error: 'Invalid path: must be within the project directory.' };
+        }
         const depth = params.depth || 'medium';
         const startTime = performance.now();
         // Real file scanning — count files by extension, extract patterns
@@ -1472,9 +1468,20 @@ export const hooksBuildAgents = {
         },
     },
     handler: async (params) => {
-        const outputDir = resolve(params.outputDir || './agents');
+        const rawOutputDir = resolve(params.outputDir || './agents');
+        const outputDir = rawOutputDir;
+        if (!outputDir.startsWith(getProjectCwd() + sep) && outputDir !== getProjectCwd()) {
+            return { error: 'Invalid outputDir: must be within the project directory.' };
+        }
         const focus = params.focus || 'all';
-        const format = params.format || 'yaml';
+        // Strict allowlist on `format` — without this, `format = "yaml/../../../etc/cron.d/x"`
+        // collapses through `join` and lets writes escape the validated outputDir.
+        const ALLOWED_FORMATS = new Set(['yaml', 'json']);
+        const formatRaw = params.format || 'yaml';
+        if (!ALLOWED_FORMATS.has(formatRaw)) {
+            return { error: 'Invalid format: must be yaml or json' };
+        }
+        const format = formatRaw;
         const persist = params.persist !== false; // Default to true
         const agents = [
             { type: 'coder', configFile: join(outputDir, `coder.${format}`), capabilities: ['code-generation', 'refactoring', 'debugging'], optimizations: ['flash-attention', 'token-reduction'] },
@@ -1505,7 +1512,9 @@ export const hooksBuildAgents = {
                 const content = format === 'json'
                     ? JSON.stringify(config, null, 2)
                     : `# ${agent.type} agent configuration\ntype: ${agent.type}\nversion: "3.0.0"\ncapabilities:\n${agent.capabilities.map(c => `  - ${c}`).join('\n')}\noptimizations:\n${agent.optimizations.map(o => `  - ${o}`).join('\n')}\ncreatedAt: "${config.createdAt}"\n`;
-                writeFileSync(agent.configFile, content, 'utf-8');
+                const _cftmp = agent.configFile + '.tmp';
+                writeFileSync(_cftmp, content, 'utf-8');
+                renameSync(_cftmp, agent.configFile);
             }
         }
         return {
@@ -1538,8 +1547,25 @@ export const hooksTransfer = {
         const sourcePath = params.sourcePath;
         const minConfidence = params.minConfidence || 0.7;
         const filter = params.filter;
+        // Validate sourcePath is an existing directory before reading from it
+        const resolvedSource = resolve(sourcePath);
+        const { statSync } = await import('fs');
+        const { homedir } = await import('os');
+        const home = homedir();
+        if (resolvedSource !== home && !resolvedSource.startsWith(home + sep)) {
+            return { error: 'sourcePath must be within the home directory.' };
+        }
+        try {
+            const st = statSync(resolvedSource);
+            if (!st.isDirectory()) {
+                return { error: 'sourcePath must be a directory' };
+            }
+        }
+        catch {
+            return { error: 'sourcePath does not exist' };
+        }
         // Try to load patterns from source project's memory store
-        const sourceMemoryPath = join(resolve(sourcePath), MEMORY_DIR, MEMORY_FILE);
+        const sourceMemoryPath = join(resolvedSource, MEMORY_DIR, MEMORY_FILE);
         let sourceStore = { entries: {}, version: '3.0.0' };
         try {
             if (existsSync(sourceMemoryPath)) {
@@ -2051,6 +2077,13 @@ export const hooksTrajectoryStart = {
             steps: [],
             startedAt,
         };
+        const MAX_TRAJECTORIES = 10000;
+        if (activeTrajectories.size >= MAX_TRAJECTORIES) {
+            // Evict the oldest trajectory
+            const oldest = activeTrajectories.keys().next().value;
+            if (oldest)
+                activeTrajectories.delete(oldest);
+        }
         activeTrajectories.set(trajectoryId, trajectory);
         return {
             trajectoryId,