@monoes/monomindcli 1.9.16 → 1.10.0

package/.claude/skills/mastermind/environments.md

@@ -0,0 +1,250 @@
+---
+name: mastermind-environments
+description: Mastermind environments — manage execution environments (local, SSH, sandbox) for an org. Controls where agent workloads run, SSH connection details, and which environment is the default.
+type: domain-skill
+default_mode: confirm
+---
+
+# Mastermind Environments
+
+This skill is invoked by `mastermind:environments` or directly via `/mastermind:environments`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block (injected by command, or loaded below if standalone)
+- `org_name`: org to manage environments for (required)
+- `action`: list | create | edit | delete | probe | set-default
+- `env_id`: environment id (required for edit/delete/probe/set-default)
+- `kind`: local | ssh | sandbox (required for create)
+- `name`: display name (required for create)
+- `host`: SSH hostname or IP (required for ssh kind)
+- `port`: SSH port (default 22)
+- `user`: SSH username (required for ssh kind)
+- `secret_ref`: secret name holding the SSH private key (see mastermind:secrets — NEVER pass raw key values)
+- `work_dir`: remote working directory (default: /tmp/monomind)
+- `caller`: command | master
+
+---
+
+## Security Constraints
+
+- NEVER print SSH private key values
+- NEVER store key material in environment JSON files — store only the secret_ref name
+- SSH keys must be stored via `mastermind:secrets` and referenced by name only
+- Probe connection is read-only (runs `echo ok` over SSH)
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Load Environments File
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+[ ! -f "$orgFile" ] && { echo "ERROR: Org '${org_name}' not found."; exit 1; }
+
+envFile=".monomind/orgs/${org_name}-environments.json"
+[ ! -f "$envFile" ] && cat > "$envFile" <<'EOF'
+{"environments":[],"default_env":null}
+EOF
+```
+
+---
+
+## Step 2 — Execute Action
+
+### list (default)
+
+```bash
+echo "ENVIRONMENTS — org: $org_name"
+echo "────────────────────────────────────────────────────────"
+printf "%-20s %-10s %-28s %-8s %s\n" "ID" "KIND" "HOST / PATH" "DEFAULT" "SECRET REF"
+echo "────────────────────────────────────────────────────────"
+
+defaultEnv=$(jq -r '.default_env // "none"' "$envFile")
+count=$(jq '.environments | length' "$envFile")
+
+if [ "$count" -eq 0 ]; then
+  echo "  No environments. Use --action create to add one."
+else
+  jq -r --arg def "$defaultEnv" '.environments[] |
+    [
+      .id,
+      (.kind // "local"),
+      (if .kind == "ssh" then ((.user // "?") + "@" + (.host // "?") + ":" + ((.port // 22) | tostring)) else (.work_dir // "(local)") end),
+      (if .id == $def then "yes" else "-" end),
+      (.secret_ref // "-")
+    ] | @tsv' "$envFile" | while IFS=$'\t' read -r id kind loc def sref; do
+    printf "%-20s %-10s %-28s %-8s %s\n" "$id" "$kind" "$loc" "$def" "$sref"
+  done
+fi
+
+echo ""
+echo "Total: $count environment(s)  |  Default: $defaultEnv"
+```
+
+### create
+
+```bash
+[ -z "$kind" ] && { echo "ERROR: --kind required (local|ssh|sandbox)."; exit 1; }
+[ -z "$name" ] && { echo "ERROR: --name required."; exit 1; }
+case "$kind" in local|ssh|sandbox) : ;; *)
+  echo "ERROR: --kind must be local, ssh, or sandbox"; exit 1 ;;
+esac
+if [ "$kind" = "ssh" ]; then
+  [ -z "$host" ] && { echo "ERROR: --host required for ssh kind."; exit 1; }
+  [ -z "$user" ] && { echo "ERROR: --user required for ssh kind."; exit 1; }
+  [ -z "$secret_ref" ] && { echo "WARNING: No --secret-ref supplied. SSH key must be pre-configured on the agent."; }
+fi
+
+envId=$(echo "${name}" | tr '[:upper:]' '[:lower:]' | tr -cs 'a-z0-9' '-' | sed 's/^-//;s/-$//')
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+tmp="${envFile}.tmp"
+jq --arg id "$envId" \
+   --arg n "$name" \
+   --arg kind "$kind" \
+   --arg host "${host:-}" \
+   --argjson port "${port:-22}" \
+   --arg user "${user:-}" \
+   --arg sref "${secret_ref:-}" \
+   --arg wdir "${work_dir:-/tmp/monomind}" \
+   --arg ts "$ts" \
+  '.environments = [.environments[] | select(.id != $id)] +
+   [{"id":$id,"name":$n,"kind":$kind,
+     "host":(if $host != "" then $host else null end),
+     "port":(if $host != "" then $port else null end),
+     "user":(if $user != "" then $user else null end),
+     "secret_ref":(if $sref != "" then $sref else null end),
+     "work_dir":$wdir,
+     "createdAt":$ts,"lastProbe":null,"probeStatus":null}]' \
+  "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+
+echo "Created environment: $envId (kind: $kind)"
+[ "$kind" = "ssh" ] && echo "  SSH: ${user}@${host}:${port:-22}  key ref: ${secret_ref:-(none)}"
+echo "Run --action probe --env-id $envId to verify connectivity."
+```
+
+### edit
+
+```bash
+[ -z "$env_id" ] && { echo "ERROR: --env-id required."; exit 1; }
+exists=$(jq --arg id "$env_id" '[.environments[] | select(.id == $id)] | length' "$envFile")
+[ "$exists" -eq 0 ] && { echo "ERROR: Environment '$env_id' not found."; exit 1; }
+
+tmp="${envFile}.tmp"
+jq --arg id "$env_id" \
+   --arg host "${host:-}" \
+   --argjson port "${port:-0}" \
+   --arg user "${user:-}" \
+   --arg sref "${secret_ref:-}" \
+   --arg wdir "${work_dir:-}" \
+  '.environments = [.environments[] | if .id == $id then
+     . *
+     (if $host != "" then {"host":$host} else {} end) *
+     (if $port > 0 then {"port":$port} else {} end) *
+     (if $user != "" then {"user":$user} else {} end) *
+     (if $sref != "" then {"secret_ref":$sref} else {} end) *
+     (if $wdir != "" then {"work_dir":$wdir} else {} end)
+   else . end]' \
+  "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+
+echo "Updated environment: $env_id"
+```
+
+### delete
+
+```bash
+[ -z "$env_id" ] && { echo "ERROR: --env-id required."; exit 1; }
+tmp="${envFile}.tmp"
+jq --arg id "$env_id" \
+  '.environments = [.environments[] | select(.id != $id)] |
+   if .default_env == $id then .default_env = null else . end' \
+  "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+echo "Deleted environment: $env_id"
+```
+
+### probe
+
+```bash
+[ -z "$env_id" ] && { echo "ERROR: --env-id required."; exit 1; }
+envData=$(jq -r --arg id "$env_id" '.environments[] | select(.id == $id)' "$envFile")
+[ -z "$envData" ] && { echo "ERROR: Environment '$env_id' not found."; exit 1; }
+
+kind=$(echo "$envData" | jq -r '.kind')
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+case "$kind" in
+  local)
+    if [ -d "$(echo "$envData" | jq -r '.work_dir // "/tmp/monomind"')" ]; then
+      status="ok"
+    else
+      status="unreachable"
+    fi
+    ;;
+  ssh)
+    sshHost=$(echo "$envData" | jq -r '.host')
+    sshUser=$(echo "$envData" | jq -r '.user')
+    sshPort=$(echo "$envData" | jq -r '.port // 22')
+    sref=$(echo "$envData" | jq -r '.secret_ref // ""')
+    keyPath=""
+    [ -n "$sref" ] && keyPath=$(cat ".monomind/orgs/.secrets/${org_name}/${sref}" 2>/dev/null | jq -r '.path // ""' 2>/dev/null || echo "")
+    
+    if [ -n "$keyPath" ] && [ -f "$keyPath" ]; then
+      result=$(ssh -i "$keyPath" -p "$sshPort" -o ConnectTimeout=5 -o StrictHostKeyChecking=no \
+        "${sshUser}@${sshHost}" "echo ok" 2>&1)
+    else
+      result=$(ssh -p "$sshPort" -o ConnectTimeout=5 -o StrictHostKeyChecking=no \
+        "${sshUser}@${sshHost}" "echo ok" 2>&1)
+    fi
+    [ "$result" = "ok" ] && status="ok" || status="unreachable"
+    ;;
+  sandbox)
+    status="unknown"
+    ;;
+esac
+
+tmp="${envFile}.tmp"
+jq --arg id "$env_id" --arg st "$status" --arg ts "$ts" \
+  '.environments = [.environments[] | if .id == $id then .probeStatus = $st | .lastProbe = $ts else . end]' \
+  "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+
+echo "Probe [$env_id]: $status  (checked at $ts)"
+```
+
+### set-default
+
+```bash
+[ -z "$env_id" ] && { echo "ERROR: --env-id required."; exit 1; }
+exists=$(jq --arg id "$env_id" '[.environments[] | select(.id == $id)] | length' "$envFile")
+[ "$exists" -eq 0 ] && { echo "ERROR: Environment '$env_id' not found."; exit 1; }
+
+tmp="${envFile}.tmp"
+jq --arg id "$env_id" '.default_env = $id' "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+echo "Default environment → $env_id"
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name>
+environments_count: <N>
+default_env: <id or null>
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.

package/.claude/skills/mastermind/export.md

@@ -0,0 +1,324 @@
+---
+name: mastermind-export
+description: Mastermind export — full org portability. Export an org to a compressed archive (tar.gz or zip) with file tree selection, and import from an archive with collision strategy and adapter override. Mirrors Paperclip's CompanyExport/CompanyImport pages.
+type: domain-skill
+default_mode: confirm
+---
+
+# Mastermind Export
+
+This skill is invoked by `mastermind:export` or directly via `/mastermind:export`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block (injected by command, or loaded below if standalone)
+- `org_name`: org to export/import (required)
+- `action`: export | import | preview | list-archives
+- `output_path`: destination path for exported archive (optional, default: `.monomind/exports/<org>-<ts>.tar.gz`)
+- `input_path`: path to archive file to import (required for import)
+- `collision_strategy`: merge | overwrite | skip (default: merge — for import)
+- `adapter_override`: adapter type to substitute during import (optional: claude-local | gemini-local | codex-local)
+- `include`: comma-separated sections to include (config,goals,routines,projects,members,adapters,secrets-refs,activity — default: all except secrets-refs)
+- `dry_run`: true | false — for import, preview changes without writing (default false)
+- `caller`: command | master
+
+---
+
+## Sections Available for Export
+
+| Section | Files Included | Default |
+|---------|---------------|---------|
+| `config` | `<org>.json` | ✓ |
+| `goals` | `<org>-goals.json` | ✓ |
+| `routines` | `<org>-routines.json` | ✓ |
+| `projects` | `<org>-projects.json` | ✓ |
+| `members` | `<org>-members.json` | ✓ |
+| `adapters` | `<org>-adapters.json` | ✓ |
+| `environments` | `<org>-environments.json` | ✓ |
+| `workspaces` | `<org>-workspaces.json` | ✓ |
+| `activity` | `<org>-activity.jsonl` (last 500 events) | ✓ |
+| `secrets-refs` | secret reference names only (NO values) | opt-in |
+
+**SECURITY:** Secret *values* are NEVER exported. Only masked reference names may be included if `secrets-refs` is explicitly listed in `include`.
+
+## Collision Strategies (import)
+
+| Strategy | Behavior |
+|----------|----------|
+| `merge` | New records added; existing records with same ID kept as-is |
+| `overwrite` | New records replace existing ones with same ID |
+| `skip` | Skip entire section if any file already exists in org |
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Validate Org
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+[ ! -f "$orgFile" ] && { echo "ERROR: Org '${org_name}' not found."; exit 1; }
+
+exportsDir=".monomind/exports"
+mkdir -p "$exportsDir"
+ts=$(date -u +%Y%m%dT%H%M%SZ)
+defaultOutput="${exportsDir}/${org_name}-${ts}.tar.gz"
+outputPath="${output_path:-$defaultOutput}"
+```
+
+---
+
+## Step 2 — Execute Action
+
+### preview
+
+Show what would be included in an export without writing anything:
+
+```bash
+echo "EXPORT PREVIEW — org: $org_name"
+echo "────────────────────────────────────────────────────────"
+
+allSections="config goals routines projects members adapters environments workspaces activity"
+includeSections="${include:-$allSections}"
+
+for section in $allSections; do
+  echo "$includeSections" | grep -qw "$section" || continue
+  case "$section" in
+    config)      srcFile=".monomind/orgs/${org_name}.json" ;;
+    goals)       srcFile=".monomind/orgs/${org_name}-goals.json" ;;
+    routines)    srcFile=".monomind/orgs/${org_name}-routines.json" ;;
+    projects)    srcFile=".monomind/orgs/${org_name}-projects.json" ;;
+    members)     srcFile=".monomind/orgs/${org_name}-members.json" ;;
+    adapters)    srcFile=".monomind/orgs/${org_name}-adapters.json" ;;
+    environments) srcFile=".monomind/orgs/${org_name}-environments.json" ;;
+    workspaces)  srcFile=".monomind/orgs/${org_name}-workspaces.json" ;;
+    activity)    srcFile=".monomind/orgs/${org_name}-activity.jsonl" ;;
+    secrets-refs) srcFile=".monomind/orgs/.secrets/${org_name}/" ;;
+  esac
+  if [ -f "$srcFile" ] || [ -d "$srcFile" ]; then
+    size=$(du -sh "$srcFile" 2>/dev/null | cut -f1 || echo "?")
+    echo "  ✓ $section  ($srcFile)  [$size]"
+  else
+    echo "  - $section  ($srcFile)  [not found — will be skipped]"
+  fi
+done
+
+echo ""
+echo "Output would be: $outputPath"
+echo "Run with --action export to proceed."
+```
+
+### export
+
+```bash
+echo "Exporting org '$org_name'…"
+
+allSections="config goals routines projects members adapters environments workspaces activity"
+includeSections="${include:-$allSections}"
+
+# Build list of files to include
+tmpDir=$(mktemp -d)
+orgExportDir="${tmpDir}/${org_name}"
+mkdir -p "$orgExportDir"
+
+fileCount=0
+for section in $allSections; do
+  echo "$includeSections" | grep -qw "$section" || continue
+  case "$section" in
+    config)       srcFile=".monomind/orgs/${org_name}.json" ; dstName="${org_name}.json" ;;
+    goals)        srcFile=".monomind/orgs/${org_name}-goals.json" ; dstName="${org_name}-goals.json" ;;
+    routines)     srcFile=".monomind/orgs/${org_name}-routines.json" ; dstName="${org_name}-routines.json" ;;
+    projects)     srcFile=".monomind/orgs/${org_name}-projects.json" ; dstName="${org_name}-projects.json" ;;
+    members)      srcFile=".monomind/orgs/${org_name}-members.json" ; dstName="${org_name}-members.json" ;;
+    adapters)     srcFile=".monomind/orgs/${org_name}-adapters.json" ; dstName="${org_name}-adapters.json" ;;
+    environments) srcFile=".monomind/orgs/${org_name}-environments.json" ; dstName="${org_name}-environments.json" ;;
+    workspaces)   srcFile=".monomind/orgs/${org_name}-workspaces.json" ; dstName="${org_name}-workspaces.json" ;;
+    activity)     srcFile=".monomind/orgs/${org_name}-activity.jsonl" ; dstName="${org_name}-activity.jsonl" ;;
+    secrets-refs)
+      # Export ONLY secret reference names — NO values
+      secretsDir=".monomind/orgs/.secrets/${org_name}"
+      if [ -d "$secretsDir" ]; then
+        refsList=$(ls "$secretsDir" 2>/dev/null | jq -Rsc 'split("\n") | map(select(. != ""))')
+        echo "{\"secret_refs\":$refsList,\"note\":\"values_not_exported\"}" > "${orgExportDir}/${org_name}-secret-refs.json"
+        echo "  ✓ secrets-refs (reference names only)"
+        fileCount=$((fileCount + 1))
+      fi
+      continue ;;
+  esac
+  if [ -f "$srcFile" ]; then
+    # For environments: strip key material before including
+    if [ "$section" = "environments" ]; then
+      jq '.environments = [.environments[] | del(.key_material,.private_key,.ssh_key,.password)]' \
+        "$srcFile" > "${orgExportDir}/${dstName}"
+    elif [ "$section" = "activity" ]; then
+      # Only last 500 events
+      tail -500 "$srcFile" > "${orgExportDir}/${dstName}"
+    else
+      cp "$srcFile" "${orgExportDir}/${dstName}"
+    fi
+    echo "  ✓ $section"
+    fileCount=$((fileCount + 1))
+  else
+    echo "  - $section (skipped — file not found)"
+  fi
+done
+
+# Write manifest
+jq -cn \
+  --arg org "$org_name" \
+  --arg ts "$ts" \
+  --arg sections "$includeSections" \
+  --argjson files "$fileCount" \
+  '{"org":$org,"exported_at":$ts,"sections":($sections|split(" ")),"file_count":$files,"version":"1.0"}' \
+  > "${orgExportDir}/manifest.json"
+
+# Create archive
+tar -czf "$outputPath" -C "$tmpDir" "$org_name" 2>/dev/null
+rm -rf "$tmpDir"
+
+echo ""
+echo "Export complete: $outputPath"
+echo "  Files: $fileCount  |  Sections: $includeSections"
+echo "  Size: $(du -sh "$outputPath" 2>/dev/null | cut -f1)"
+```
+
+### import
+
+```bash
+[ -z "$input_path" ] && { echo "ERROR: --input-path required."; exit 1; }
+[ ! -f "$input_path" ] && { echo "ERROR: Archive not found: $input_path"; exit 1; }
+
+collision="${collision_strategy:-merge}"
+case "$collision" in merge|overwrite|skip) : ;; *)
+  echo "ERROR: --collision-strategy must be merge, overwrite, or skip"; exit 1 ;;
+esac
+
+dryRun="${dry_run:-false}"
+[ "$dryRun" = "true" ] && echo "DRY RUN — no changes will be written."
+
+echo "IMPORT — org: $org_name"
+echo "Collision strategy: $collision"
+[ -n "$adapter_override" ] && echo "Adapter override: $adapter_override"
+echo "────────────────────────────────────────────────────────"
+
+# Extract archive to temp dir
+tmpDir=$(mktemp -d)
+tar -xzf "$input_path" -C "$tmpDir" 2>/dev/null || { echo "ERROR: Failed to extract archive."; rm -rf "$tmpDir"; exit 1; }
+
+# Find org dir in archive
+archiveOrgDir=$(find "$tmpDir" -name "manifest.json" -maxdepth 3 | head -1 | xargs dirname 2>/dev/null)
+[ -z "$archiveOrgDir" ] && { echo "ERROR: No manifest.json found in archive. Invalid export?"; rm -rf "$tmpDir"; exit 1; }
+
+archiveOrg=$(jq -r '.org // ""' "${archiveOrgDir}/manifest.json")
+echo "Archive org: $archiveOrg → importing as: $org_name"
+echo ""
+
+imported=0
+skipped=0
+for srcFile in "${archiveOrgDir}"/*.json "${archiveOrgDir}"/*.jsonl; do
+  [ -f "$srcFile" ] || continue
+  # Rewrite filename for target org name
+  dstName=$(basename "$srcFile" | sed "s/^${archiveOrg}/${org_name}/")
+  dstPath=".monomind/orgs/${dstName}"
+
+  # Skip manifest
+  [[ "$dstName" == "manifest.json" ]] && continue
+
+  # Skip secret refs — never auto-import
+  [[ "$dstName" == *secret-refs* ]] && echo "  SKIP: secret refs (never auto-imported)" && continue
+
+  # Apply adapter override
+  if [ -n "$adapter_override" ] && [[ "$dstName" == *-adapters.json ]]; then
+    echo "  OVERRIDE: applying adapter_override=$adapter_override to adapters file"
+  fi
+
+  if [ -f "$dstPath" ]; then
+    case "$collision" in
+      skip)
+        echo "  SKIP: $dstName (exists, strategy=skip)"
+        skipped=$((skipped + 1))
+        continue ;;
+      merge)
+        echo "  MERGE: $dstName"
+        if [ "$dryRun" = "false" ]; then
+          # JSON files: merge arrays; jsonl files: append deduplicated
+          if [[ "$dstPath" == *.jsonl ]]; then
+            cat "$srcFile" >> "$dstPath"
+          else
+            # Merge: combine top-level arrays from both files
+            python3 -c "
+import json, sys
+with open('$dstPath') as f: existing = json.load(f)
+with open('$srcFile') as f: incoming = json.load(f)
+for k, v in incoming.items():
+    if isinstance(v, list) and isinstance(existing.get(k), list):
+        existIds = {i.get('id') for i in existing[k] if isinstance(i,dict)}
+        existing[k] += [i for i in v if isinstance(i,dict) and i.get('id') not in existIds]
+    elif k not in existing:
+        existing[k] = v
+with open('$dstPath', 'w') as f: json.dump(existing, f, indent=2)
+" 2>/dev/null || cp "$srcFile" "$dstPath"
+          fi
+        fi ;;
+      overwrite)
+        echo "  OVERWRITE: $dstName"
+        [ "$dryRun" = "false" ] && cp "$srcFile" "$dstPath" ;;
+    esac
+  else
+    echo "  CREATE: $dstName (new)"
+    [ "$dryRun" = "false" ] && cp "$srcFile" "$dstPath"
+  fi
+  imported=$((imported + 1))
+done
+
+rm -rf "$tmpDir"
+echo ""
+[ "$dryRun" = "true" ] && echo "DRY RUN complete — $imported file(s) would be imported, $skipped skipped." \
+  || echo "Import complete — $imported file(s) imported, $skipped skipped."
+```
+
+### list-archives
+
+```bash
+echo "EXPORT ARCHIVES — org: $org_name"
+echo "────────────────────────────────────────────────────────"
+
+found=0
+for f in ".monomind/exports/${org_name}-"*.tar.gz ".monomind/exports/${org_name}-"*.zip; do
+  [ -f "$f" ] || continue
+  size=$(du -sh "$f" 2>/dev/null | cut -f1 || echo "?")
+  ts=$(stat -f "%Sm" -t "%Y-%m-%d %H:%M" "$f" 2>/dev/null || stat -c "%y" "$f" 2>/dev/null | cut -c1-16 || echo "?")
+  printf "  %-50s %8s  %s\n" "$(basename "$f")" "$size" "$ts"
+  found=$((found + 1))
+done
+
+[ "$found" -eq 0 ] && echo "  No archives found. Run --action export to create one."
+echo ""
+echo "Total: $found archive(s) in .monomind/exports/"
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name>
+output_path: <path if export>
+files_processed: <N>
+collision_strategy: <strategy if import>
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.