@monoes/monomindcli 2.10.9 → 2.10.13

package/dist/src/commands/org.js

@@ -100,7 +100,54 @@ function liveServeDaemonPid(cwd) {
         return null;
     }
 }
+/** Mutual-exclusion check for `org serve` startup.
+ *
+ *  Two `org serve` processes started against the same project root have zero
+ *  visibility into each other — each builds its own in-memory `OrgDaemon` and
+ *  independently decides which orgs are "due now", so both can call
+ *  `daemon.startOrg(name)` for the same org and have both processes write to
+ *  the same on-disk state (runtime.json, decisions.jsonl, history.jsonl,
+ *  .mail/) at once. `liveServeDaemonPid` already knows how to read this
+ *  project's serve-heartbeat.json and tell a live daemon's heartbeat from a
+ *  stale one (dead pid, or aged past a few missed 30s beats) — reused here
+ *  as the actual pidfile lock, rather than inventing a second file, since it
+ *  already IS a pidfile (pid + timestamp, written at startup and every
+ *  heartbeat, removed on clean shutdown by `daemon.clearHeartbeat()`).
+ *
+ *  Call this before the daemon/server/scheduler are constructed, so a
+ *  refusal never opens a port, binds a broker lease, or touches any org's
+ *  state. */
+export function checkServeLock(cwd) {
+    const owner = liveServeDaemonPid(cwd);
+    if (owner != null)
+        return { ok: false, pid: owner };
+    // liveServeDaemonPid() has already ruled out a live owner — any heartbeat
+    // file still on disk here is stale (dead pid, or a SIGKILLed daemon that
+    // never reached clearHeartbeat()). Remove it so it can't be misread by
+    // `org run`/`org status` before this daemon's own writeHeartbeat() lands.
+    const heartbeatPath = join(cwd, '.monomind', 'serve-heartbeat.json');
+    const staleHeartbeatRemoved = existsSync(heartbeatPath);
+    if (staleHeartbeatRemoved)
+        rmSync(heartbeatPath, { force: true });
+    return { ok: true, staleHeartbeatRemoved };
+}
 const runAction = async (ctx) => {
+    // Org runs skip local embeddings entirely — on some machines
+    // @huggingface/transformers' native ONNX runtime crashes the whole
+    // process (a libc++abi terminate, not a catchable JS error) the moment
+    // any memory/KG lookup tries to load its model. A crashed unattended org
+    // run is much worse than one that falls back to keyword-only memory
+    // search — see the matching guards in memory-bridge.ts/embedding-operations.ts.
+    process.env.MONOMIND_NO_LOCAL_EMBEDDINGS = '1';
+    // The embedding-model crash above has a sibling: loadReranker() in
+    // memory-bridge.ts loads a SEPARATE cross-encoder model
+    // (cross-encoder/ettin-reranker-32m-v1, its own tokenizer architecture)
+    // for search-result reranking, independent of the embedder guard above —
+    // reranking runs on (query, passage) text pairs directly, so it can
+    // still fire and hit the same native crash even with embeddings off.
+    // MONOMIND_RERANKER=0 is an existing, already-wired guard (see
+    // loadReranker's own early-return) — just never set for org runs before.
+    process.env.MONOMIND_RERANKER = '0';
     if (!ctx.args[0])
         return { success: false, message: 'org name required: monomind org run <name> [--task "..."]' };
     const validated = validateOrgName(ctx.args[0]);
@@ -136,7 +183,11 @@ const runAction = async (ctx) => {
             const glossary = await (async () => {
                 try {
                     const kg = await import('../memory/memory-kg.js');
-                    return await kg.kgGlossary({ dbPath: join(process.cwd(), '.monomind', 'org-memory') });
+                    const { orgKgScope } = await import('../orgrt/org-memory.js');
+                    return await kg.kgGlossary({
+                        dbPath: join(process.cwd(), '.monomind', 'org-memory'),
+                        scope: orgKgScope(name),
+                    });
                 }
                 catch {
                     return [];
@@ -327,7 +378,7 @@ const runAction = async (ctx) => {
     let srv;
     if (crossProcess) {
         srv = await startOrgServer(daemon, 0);
-        daemon.setInboxUrl(`http://127.0.0.1:${srv.port}`, srv.credential);
+        daemon.setInboxUrl(`http://127.0.0.1:${srv.port}`, srv.operatorCredential);
     }
     let running;
     try {
@@ -988,21 +1039,58 @@ WantedBy=default.target
     return { success: true, message: `${format} unit emitted` };
 };
 const serveAction = async (ctx) => {
+    // Mutual exclusion: refuse to start a second `org serve` for this project
+    // root. Checked before anything else so a refusal never opens a port,
+    // registers a broker lease, or starts a scheduled org that a live daemon
+    // is already running — see checkServeLock's header for the failure mode
+    // this prevents.
+    const lock = checkServeLock(ctx.cwd);
+    if (!lock.ok) {
+        log(output.error(`org serve: another daemon (pid ${lock.pid}) is already running for this project root.`));
+        log(output.info(`  Check what it's doing with: monomind org status`));
+        log(output.info(`  Stop it first (Ctrl-C in its terminal, or "kill ${lock.pid}"), then retry.`));
+        return { success: false, message: `org serve already running (pid ${lock.pid})` };
+    }
+    if (lock.staleHeartbeatRemoved) {
+        log(output.warning('org serve: cleaned up a stale heartbeat left by a previous daemon that did not shut down cleanly.'));
+    }
+    // See the matching comment in runAction — same rationale, same guard.
+    process.env.MONOMIND_NO_LOCAL_EMBEDDINGS = '1';
+    // The embedding-model crash above has a sibling: loadReranker() in
+    // memory-bridge.ts loads a SEPARATE cross-encoder model
+    // (cross-encoder/ettin-reranker-32m-v1, its own tokenizer architecture)
+    // for search-result reranking, independent of the embedder guard above —
+    // reranking runs on (query, passage) text pairs directly, so it can
+    // still fire and hit the same native crash even with embeddings off.
+    // MONOMIND_RERANKER=0 is an existing, already-wired guard (see
+    // loadReranker's own early-return) — just never set for org runs before.
+    process.env.MONOMIND_RERANKER = '0';
     const crossProcess = ctx.flags.crossProcess !== false;
     const daemon = new OrgDaemon(ctx.cwd, { crossProcess });
     let srv;
     if (crossProcess) {
         srv = await startOrgServer(daemon, 0);
-        daemon.setInboxUrl(`http://127.0.0.1:${srv.port}`, srv.credential);
+        daemon.setInboxUrl(`http://127.0.0.1:${srv.port}`, srv.operatorCredential);
     }
     // Crash handlers: log the reason and persist crashed state so `org status`
-    // shows what happened instead of a silent "pid is gone".
+    // shows what happened instead of a silent "pid is gone". A truly unknown
+    // uncaught exception's blast radius can't always be attributed to one org,
+    // so the whole process still exits (the safety-first default) — but naming
+    // which orgs were in flight at the moment it fired at least tells the
+    // operator the blast radius they actually hit, instead of leaving them to
+    // guess from an error with no org context.
     const crashExit = (label, err) => {
         try {
-            console.error(`[org serve] ${label}:`, err);
+            const running = daemon.listRunning();
+            console.error(`[org serve] ${label}:`, err, running.length ? `— orgs in flight: ${running.join(', ')}` : '— no orgs were running');
         }
         catch {
-            /* stderr gone */
+            try {
+                console.error(`[org serve] ${label}:`, err);
+            }
+            catch {
+                /* stderr gone */
+            }
         }
         daemon.persistCrashStateAll(`${label}: ${err instanceof Error ? err.message : String(err)}`);
         daemon.clearHeartbeat();
@@ -1180,16 +1268,30 @@ const serveAction = async (ctx) => {
             }
         }
     }
+    // Each poll pass already wraps its own per-org daemon calls in try/catch,
+    // but a synchronous throw from something ahead of those (e.g.
+    // daemon.listRunning(), listOrgConfigFiles()) still rejects the async
+    // function itself. `void`-ing that call, as before, discards the promise
+    // without observing a rejection — which becomes an unhandled rejection at
+    // the process level and takes down every other org's in-flight run via
+    // crashExit, even though the failure was local to one poll pass. .catch()
+    // keeps it a per-pass, logged failure instead.
     const stopPoll = setInterval(() => {
-        void pollStopfiles(ctx.cwd, daemon);
+        pollStopfiles(ctx.cwd, daemon).catch((err) => {
+            console.error('[org serve] stopfile poll failed:', err);
+        });
     }, 2000);
     stopPoll.unref?.();
     const runPoll = setInterval(() => {
-        void pollRunfiles(ctx.cwd, daemon);
+        pollRunfiles(ctx.cwd, daemon).catch((err) => {
+            console.error('[org serve] runfile poll failed:', err);
+        });
     }, 2000);
     runPoll.unref?.();
     const reloadPoll = setInterval(() => {
-        void pollReloadfiles(ctx.cwd, daemon);
+        pollReloadfiles(ctx.cwd, daemon).catch((err) => {
+            console.error('[org serve] reloadfile poll failed:', err);
+        });
     }, 2000);
     reloadPoll.unref?.();
     await new Promise((r) => {
@@ -1771,7 +1873,7 @@ export const orgCommand = {
         },
         {
             name: 'memory',
-            description: "Inspect an org's cross-run memory and knowledge graph (stats | search <query> | rules | rollback <run-ref>)",
+            description: "Inspect an org's cross-run memory and knowledge graph (stats | search <query> | rules | rollback <run-ref> | promote <run-ref>)",
             examples: [
                 { command: 'monomind org memory growth stats', description: 'KG size and namespaces' },
                 {
@@ -1780,7 +1882,11 @@ export const orgCommand = {
                 },
                 {
                     command: 'monomind org memory growth rollback run:m4x2',
-                    description: 'Delete everything one run wrote to the KG',
+                    description: "Withdraw one run's support from this org's KG",
+                },
+                {
+                    command: 'monomind org memory growth promote run:m4x2',
+                    description: "Share one run's claims with project-wide knowledge",
                 },
             ],
             action: async (ctx) => {
@@ -1789,31 +1895,47 @@ export const orgCommand = {
                     return v.result;
                 const sub = String(ctx.args[1] ?? 'stats');
                 const { join } = await import('node:path');
-                const dbPath = join(process.cwd(), '.monomind', 'org-memory');
+                const cwd = ctx.cwd || process.cwd();
+                const dbPath = join(cwd, '.monomind', 'org-memory');
                 const kg = await import('../memory/memory-kg.js');
                 const bridge = await import('../memory/memory-bridge.js');
+                const { orgKgScope, orgMemoryNamespace } = await import('../orgrt/org-memory.js');
+                // Every KG operation below is scoped to the requested org, so the org
+                // name in the output describes what was actually read, not just what
+                // was asked for. Reads of the shared store are unchanged.
+                const scope = orgKgScope(v.name);
+                const kgNs = kg.kgNamespaces(scope);
+                // Flat org memory is namespaced by the org DEFINITION, not by name —
+                // resolve it the way the runtime writes it (B4), so a configured
+                // `memory_namespace` is searched instead of a guessed `org:<name>`.
+                const defPath = join(cwd, ORG_DIR, `${v.name}.json`);
+                const flatNs = existsSync(defPath)
+                    ? orgMemoryNamespace(v.name, OrgDefSchema.parse(JSON.parse(readFileSync(defPath, 'utf8'))))
+                    : `org:${v.name}`;
                 try {
                     if (sub === 'stats') {
                         const [stats, glossary, backend] = await Promise.all([
-                            kg.kgStats({ dbPath }),
-                            kg.kgGlossary({ dbPath, limit: 15 }),
+                            kg.kgStats({ dbPath, scope }),
+                            kg.kgGlossary({ dbPath, limit: 15, scope }),
                             bridge.bridgeGetBackendStats(dbPath),
                         ]);
+                        // The backend reports every namespace in the SHARED store, so
+                        // listing it raw put other orgs' namespaces (and their counts)
+                        // under this org's name. Keep only what this org owns.
+                        // Spread kgNs rather than listing namespaces: the identity work
+                        // added `names` (the entity name index), and a hand-written list
+                        // silently omits any namespace added later, hiding rows this org
+                        // does own.
+                        const owned = new Set([...Object.values(kgNs), flatNs]);
+                        const byNs = Object.fromEntries(Object.entries(backend?.entriesByNamespace ?? {}).filter(([ns]) => owned.has(ns) || ns.startsWith(`agent:${flatNs}:`)));
                         if (ctx.flags.format === 'json') {
-                            const payload = {
-                                v: 1,
-                                org: v.name,
-                                ...stats,
-                                glossary,
-                                namespaces: backend?.entriesByNamespace ?? {},
-                            };
+                            const payload = { v: 1, org: v.name, ...stats, glossary, namespaces: byNs };
                             process.stdout.write(`${JSON.stringify(payload)}\n`);
                             return { success: true, data: payload };
                         }
                         log(output.info(`Knowledge graph: ${stats.nodes} entities, ${stats.edges} relations, ${stats.rules} rules`));
                         if (glossary.length)
                             log(output.info(`Top entities: ${glossary.join(', ')}`));
-                        const byNs = backend?.entriesByNamespace ?? {};
                         for (const [ns, count] of Object.entries(byNs))
                             log(output.info(`  ${ns}: ${count} entries`));
                         return {
@@ -1829,11 +1951,11 @@ export const orgCommand = {
                         const [mem, graph] = await Promise.all([
                             bridge.bridgeSearchEntries({
                                 query: q,
-                                namespace: `org:${v.name}`,
+                                namespace: flatNs,
                                 limit: 5,
                                 dbPath,
                             }),
-                            kg.kgSearch({ query: q, dbPath, limit: 8 }),
+                            kg.kgSearch({ query: q, dbPath, limit: 8, scope }),
                         ]);
                         if (ctx.flags.format === 'json') {
                             const payload = {
@@ -1857,7 +1979,7 @@ export const orgCommand = {
                         };
                     }
                     if (sub === 'rules') {
-                        const rules = await kg.kgListRules({ dbPath, limit: 50 });
+                        const rules = await kg.kgListRules({ dbPath, limit: 50, scope });
                         if (ctx.flags.format === 'json') {
                             const payload = { v: 1, org: v.name, items: rules };
                             process.stdout.write(`${JSON.stringify(payload)}\n`);
@@ -1874,18 +1996,39 @@ export const orgCommand = {
                                 success: false,
                                 message: 'usage: org memory <org> rollback <origin-ref> (e.g. run:m4x2)',
                             };
-                        const res = await kg.kgRollback({ originRef: ref, dbPath });
+                        // Scoped: the ref is resolved inside this org's namespaces and
+                        // origin space, so the org name in the command is an ownership
+                        // restriction rather than a label on an unfiltered rollback.
+                        const res = await kg.kgRollback({ originRef: ref, scope, dbPath });
                         if (ctx.flags.format === 'json') {
                             const payload = { v: 1, org: v.name, ref, ...res };
                             process.stdout.write(`${JSON.stringify(payload)}\n`);
                             return { success: res.success, data: payload };
                         }
-                        log(output.info(`Rolled back ${ref}: ${res.deleted} deleted, ${res.retained} retained (shared with other origins)`));
+                        log(output.info(`Rolled back ${ref} for org ${v.name}: ${res.deleted} deleted, ${res.retained} retained (shared with other origins)`));
                         return { success: res.success, message: `rollback ${ref}`, data: res };
                     }
+                    if (sub === 'promote') {
+                        const ref = ctx.args[2];
+                        if (!ref)
+                            return {
+                                success: false,
+                                message: 'usage: org memory <org> promote <origin-ref> (e.g. run:m4x2)',
+                            };
+                        const res = await kg.kgPromote({ originRef: ref, from: scope, dbPath });
+                        if (ctx.flags.format === 'json') {
+                            const payload = { v: 1, org: v.name, ref, ...res };
+                            process.stdout.write(`${JSON.stringify(payload)}\n`);
+                            return { success: res.success, data: payload };
+                        }
+                        log(output.info(res.success
+                            ? `Promoted ${ref} from org ${v.name} to project-shared knowledge: ${res.nodes} entities, ${res.edges} relations, ${res.rules} rules. Withdraw with origin ref ${res.promotedAs}.`
+                            : `Promotion of ${ref} failed: ${res.error ?? 'unknown error'}`));
+                        return { success: res.success, message: `promote ${ref}`, data: res };
+                    }
                     return {
                         success: false,
-                        message: `unknown subcommand "${sub}" — use stats | search | rules | rollback`,
+                        message: `unknown subcommand "${sub}" — use stats | search | rules | rollback | promote`,
                     };
                 }
                 finally {
@@ -1979,6 +2122,21 @@ export const orgCommand = {
                 return questionsAction(ctx, v.name);
             },
         },
+        {
+            name: 'approvals',
+            description: "List pending tool/action approval requests from an org's agents",
+            options: [{ name: 'all', description: 'Include resolved approvals', type: 'boolean' }],
+            examples: [
+                { command: 'monomind org approvals growth', description: 'Show pending approvals' },
+            ],
+            action: async (ctx) => {
+                const v = validateOrgName(ctx.args[0]);
+                if (!v.ok)
+                    return v.result;
+                const { approvalsAction } = await import('./org-observe.js');
+                return approvalsAction(ctx, v.name);
+            },
+        },
         {
             name: 'answer',
             description: 'Answer a pending ask_human question (live if the org is running, queued otherwise)',