@monoes/monomindcli 2.12.0 → 2.13.0

package/dist/src/platform-adapters/renderers/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../../../src/platform-adapters/renderers/skills.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AAGtC,SAAS,wBAAwB,CAAC,OAAwB,EAAE,KAAmB;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CACrC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,OAAO,IAAI,QAAQ,WAAW,EAAE,CAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO;QACL,KAAK;QACL,kBAAkB;QAClB,qEAAqE;QACrE,KAAK;QACL,EAAE;QACF,cAAc;QACd,EAAE;QACF,uDAAuD;QACvD,SAAS;QACT,EAAE;QACF,qFAAqF;KACtF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,iBAAiB,CAAC,OAAwB,EAAE,KAAmB;IAC7E,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,EAAE,OAAgB;QACtB,WAAW,EAAE,OAAgB;QAC7B,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC;QACxF,MAAM,EAAE,UAAU,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE;QAC5C,YAAY,EAAE,GAAG,KAAK,CAAC,MAAM,WAAW;QACxC,KAAK;QACL,OAAO,EAAE,eAAwB;QACjC,MAAM,EAAE,IAAa;KACtB,CAAC,CAAC,CAAC;IACJ,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAChC,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACrD,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,EAAE,OAAgB;QACtB,WAAW,EAAE,OAAgB;QAC7B,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QACvE,MAAM,EAAE,UAAU,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,IAAI,SAAS,EAAE;QACzD,YAAY,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE;QAC5C,KAAK;QACL,OAAO,EAAE,eAAwB;QACjC,MAAM,EAAE,IAAa;KACtB,CAAC,CAAC,CACJ,CAAC;IACF,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../../../src/platform-adapters/renderers/skills.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AAGtC,SAAS,wBAAwB,CAAC,OAAwB,EAAE,KAAmB;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC;AAChE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,iBAAiB,CAAC,OAAwB,EAAE,KAAmB;IAC7E,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,+DAA+D;IAC/D,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,mCAAmC;IACnC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,EAAE,OAAgB;QACtB,WAAW,EAAE,OAAgB;QAC7B,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAClC,MAAM,EAAE,UAAU,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE;QAC5C,YAAY,EAAE,GAAG,KAAK,CAAC,MAAM,WAAW;QACxC,KAAK;QACL,OAAO,EAAE,eAAwB;QACjC,MAAM,EAAE,IAAa;KACtB,CAAC,CAAC,CAAC;IACJ,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAChC,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACrD,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,EAAE,OAAgB;QACtB,WAAW,EAAE,OAAgB;QAC7B,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QACvE,MAAM,EAAE,UAAU,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,IAAI,SAAS,EAAE;QACzD,YAAY,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE;QAC5C,KAAK;QACL,OAAO,EAAE,eAAwB;QACjC,MAAM,EAAE,IAAa;KACtB,CAAC,CAAC,CACJ,CAAC;IACF,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC,CAAC;AACtC,CAAC"}

package/dist/src/ui/dashboard.html

@@ -2446,6 +2446,13 @@ select.pb-cfg-inp { padding: 4px 7px; cursor: pointer; }
 // automatically. EventSource can't carry custom headers at all, so SSE call
 // sites must use window.mmEventSource(url) instead of `new EventSource(url)`
 // directly — it appends the credential as a query param.
+//
+// i-073: the query param is accepted for GET/HEAD ONLY — a POST/PUT/DELETE
+// with only ?token= is a CORS-simple request (no preflight, reachable from a
+// plain <form>), so mutations MUST send the header. Any new call that
+// mutates has to go through fetch() (the wrapper above), never a hand-built
+// URL with the token appended — that would silently reopen the CSRF hole
+// this item closed.
 (() => {
   const AUTH_HEADER_NAME = 'x-monomind-' + 'token';
   const AUTH_QUERY_PARAM = 'to' + 'ken';

package/dist/src/ui/orgs.html

@@ -1066,6 +1066,13 @@ html, body {
 // orgs.html and dashboard.html are served as separate pages. EventSource
 // can't carry custom headers, so SSE call sites must use
 // window.mmEventSource(url) instead of `new EventSource(url)` directly.
+//
+// i-073: the query param is accepted for GET/HEAD ONLY — a POST/PUT/DELETE
+// with only ?token= is a CORS-simple request (no preflight, reachable from a
+// plain <form>), so mutations MUST send the header. Any new call that
+// mutates has to go through fetch() (the wrapper above), never a hand-built
+// URL with the token appended — that would silently reopen the CSRF hole
+// this item closed.
 (() => {
   const AUTH_HEADER_NAME = 'x-monomind-' + 'token';
   const AUTH_QUERY_PARAM = 'to' + 'ken';

package/dist/src/ui/routes-monoes.mjs

@@ -106,14 +106,33 @@ async function _registerClient(redirectUri) {
   return data.client_id;
 }
 
+// #307: a registered client is bound to the ONE redirect_uri it was
+// registered with, so the cached clientId is only reusable while the
+// dashboard is still on that port. Caching the id alone meant a dashboard
+// that fell back to another port (4242 busy -> 4243) sent the old client
+// with a new redirect_uri, and monoes.me redirected the browser to the port
+// the client was registered for — ERR_CONNECTION_REFUSED, connection never
+// completes. Store the redirectUri alongside the id and re-register when
+// they no longer agree.
 async function _getOrRegisterClientId(monomindHome, redirectUri) {
   const existing = readMonoesConnection(monomindHome);
-  if (existing?.clientId) return existing.clientId;
+  if (existing?.clientId && existing.redirectUri === redirectUri) return existing.clientId;
   const clientId = await _registerClient(redirectUri);
-  _writeMonoesConnection(monomindHome, { ...(existing || {}), clientId });
+  _writeMonoesConnection(monomindHome, { ...(existing || {}), clientId, redirectUri });
   return clientId;
 }
 
+/** Forgets the cached OAuth client (keeping any tokens) after monoes.me has
+ * rejected it — a client that the server no longer knows stays dead for
+ * every future attempt unless it is dropped, so the next connect must
+ * register a fresh one rather than retrying the same dead id. */
+function _forgetMonoesClient(monomindHome) {
+  const existing = readMonoesConnection(monomindHome);
+  if (!existing) return;
+  const { clientId: _clientId, redirectUri: _redirectUri, ...rest } = existing;
+  _writeMonoesConnection(monomindHome, rest);
+}
+
 /** Merges (or removes) the `monoes` entry in the project's existing
  * .mcp.json. Only touches that one key — never creates or rewrites the
  * rest of the file, since .mcp.json is otherwise owned by `init`/the user.
@@ -248,7 +267,12 @@ export async function handleMonoesRoutes(req, res, url, corsOrigin, ctx) {
           code_verifier: pending.codeVerifier,
         }),
       });
-      if (!tokenRes.ok) throw new Error(`token exchange failed: ${tokenRes.status}`);
+      if (!tokenRes.ok) {
+        // 400/401 here means the client itself was refused (unknown client,
+        // or a redirect_uri it isn't registered for) — see #307.
+        if (tokenRes.status === 400 || tokenRes.status === 401) _forgetMonoesClient(MONOMIND_HOME);
+        throw new Error(`token exchange failed: ${tokenRes.status}`);
+      }
       const tokenData = await tokenRes.json();
 
       const meRes = await fetch(`${MONOES_BASE_URL}/api/community/me`, {
@@ -258,6 +282,7 @@ export async function handleMonoesRoutes(req, res, url, corsOrigin, ctx) {
 
       _writeMonoesConnection(MONOMIND_HOME, {
         clientId: existing.clientId,
+        redirectUri: existing.redirectUri,
         accessToken: /* value */ tokenData.access_token,
         refreshToken: /* value */ tokenData.refresh_token || null,
         expiresAt: Date.now() + (tokenData.expires_in || 3600) * 1000,

package/dist/src/ui/server.mjs

@@ -6,6 +6,10 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import zlib from 'node:zlib';
+import {
+  detectDashboardTokenLeak,
+  formatDashboardTokenLeakWarning,
+} from '../mcp/monoes-mcp-entry.mjs';
 import {
   collectAgents,
   collectAll,
@@ -574,17 +578,34 @@ function _getGitMonomindDir(workDir) {
 }
 
 // Returns the monomind home directory for server-level data (capture, control.json, loops).
-// Priority: MONOMIND_HOME env var > walk up from cwd finding .monomind/control.json > cwd fallback
-function getMonomindHome() {
+// Priority: an EXPLICIT project dir (--project-dir / CLAUDE_PROJECT_DIR) > MONOMIND_HOME env
+// var > walk up from cwd finding .monomind/control.json, never past the enclosing git root >
+// cwd fallback.
+//
+// #308: the walk used to run unconditionally, ignoring --project-dir, so it could resolve to
+// any ancestor that happened to hold a control.json from an earlier dashboard run. Per-project
+// state written under this home — the monoes.me connection file with its OAuth tokens,
+// capture/, orgs/ — then landed in that ancestor instead of the project the dashboard is for.
+//
+// `projectDirExplicit` is what keeps the walk alive: both entry points always hand startServer
+// a projectDir (`monomind ui` defaults the flag to cwd, the run-directly block below defaults
+// CLAUDE_PROJECT_DIR to cwd), so short-circuiting on the dir alone would silently move the home
+// of every dashboard started from a subdirectory of its project down into that subdirectory.
+// Only a dir the caller actually named counts.
+export function getMonomindHome(projectDir, projectDirExplicit) {
+  if (projectDirExplicit && projectDir) return path.resolve(projectDir);
   if (process.env.MONOMIND_HOME) return path.resolve(process.env.MONOMIND_HOME);
   let dir = process.cwd();
   while (dir !== path.dirname(dir)) {
     if (fs.existsSync(path.join(dir, '.monomind', 'control.json'))) return dir;
+    if (fs.existsSync(path.join(dir, '.git'))) break;
     dir = path.dirname(dir);
   }
   return process.cwd();
 }
-const MONOMIND_HOME = getMonomindHome();
+// Re-resolved from the options at startServer() time (the projectDir only exists then); the
+// call sites below all read it from inside startServer, after that assignment.
+let MONOMIND_HOME = getMonomindHome();
 
 // Resolve an org's project directory by searching across known projects.
 // Returns the first project dir where {dir}/.monomind/orgs/{orgName}.json exists, or null.
@@ -878,6 +899,9 @@ function bindServer(server, port) {
  * @param {object} [options]
  * @param {number}  [options.port=4242]        - Preferred port. Tries up to port+10 on collision.
  * @param {string}  [options.projectDir]       - Root of the project to collect data from.
+ * @param {boolean} [options.projectDirExplicit=false] - True when projectDir was named by the
+ *   caller (--project-dir / CLAUDE_PROJECT_DIR) rather than defaulted to cwd; only then does it
+ *   set the monomind home (see getMonomindHome, #308).
  * @param {boolean} [options.openBrowser=true] - Whether to open the dashboard in the default browser.
  * @returns {Promise<{port: number, url: string, server: http.Server}>}
  */
@@ -973,9 +997,24 @@ function _resolveSlugToPathUncached(slug, projDir) {
 export async function startServer({
   port = 4242,
   projectDir,
+  projectDirExplicit = false,
   openBrowser = true,
   allowedHosts,
 } = {}) {
+  // #308: resolve the home now that the caller's project dir is in hand.
+  MONOMIND_HOME = getMonomindHome(projectDir, projectDirExplicit);
+  // i-052 commit 3: warn on every start, not only at `init` (executor.ts).
+  // The dashboard is what WRITES dashboard-token — a user who never
+  // re-runs `init` after the file got committed (e.g. before commits 1-2
+  // shipped `.gitignore` coverage) would otherwise never see this warning
+  // at all. Same "name the file, never the value" contract as the
+  // monoes.me leak warning; best-effort (never blocks startup on a git
+  // failure — detectDashboardTokenLeak already treats git-unavailable as
+  // "not a leak signal", not an error).
+  const dashboardTokenStartupWarning = formatDashboardTokenLeakWarning(
+    await detectDashboardTokenLeak(projectDir || process.cwd()),
+  );
+  if (dashboardTokenStartupWarning) console.error(dashboardTokenStartupWarning);
   // Extra Host names accepted beyond loopback (see isAllowedHost above).
   const _allowedHosts = resolveAllowedHosts(allowedHosts);
   // ── Security: per-process auth credential for mutating (non-GET) requests ─
@@ -991,6 +1030,17 @@ export async function startServer({
   // silently degrading per-prompt Second Brain injection to keyword fallback.
   // So the write is deferred to bind time and gated: primary instances write
   // `dashboard-token`; secondaries write `dashboard-token-<port>` instead.
+  // i-052 commit 4: the path THIS process actually wrote (primary
+  // `dashboard-token` xor its own `dashboard-token-<port>` secondary) — set
+  // once, at the bottom of writeDashboardToken(), and read by shutdown()
+  // below for best-effort cleanup on a clean exit. `mode` is create-only
+  // on `fs.writeFileSync` (POSIX `open(2)` ignores it when the file
+  // exists) — measured on this machine: 2 of 11 token files were 644
+  // despite every write site passing `{ mode: 0o600 }`, because a prior
+  // run had already created them. `fs.chmodSync` after every write, here
+  // and in propagateDashboardToken() below, enforces the mode on rewrite
+  // too, not just on first creation.
+  let _dashboardTokenFilePath = null;
   async function writeDashboardToken(actualPort) {
     try {
       actualPort = Number(actualPort);
@@ -1032,14 +1082,17 @@ export async function startServer({
       } catch (_) {
         /* no readable control.json — treat as primary */
       }
-      fs.writeFileSync(
-        path.join(authFileDir, primary ? 'dashboard-token' : `dashboard-token-${actualPort}`),
-        dashboardAuthValue,
-        { mode: 0o600 },
+      const tokenPath = path.join(
+        authFileDir,
+        primary ? 'dashboard-token' : `dashboard-token-${actualPort}`,
       );
+      fs.writeFileSync(tokenPath, dashboardAuthValue, { mode: 0o600 });
+      fs.chmodSync(tokenPath, 0o600); // enforce on rewrite — {mode} above is create-only
+      _dashboardTokenFilePath = tokenPath;
       // Sweep stale secondary tokens (dead scratch/test instances) so they
       // don't accumulate as orphaned credential files.
-      // monolean: age-based sweep only — no on-exit unlink plumbing.
+      // Age-based sweep — the belt-and-braces backstop for a dirty death
+      // (kill -9) that never reaches shutdown()'s cleanup below.
       try {
         const weekMs = 7 * 24 * 3600 * 1000;
         for (const f of fs.readdirSync(authFileDir)) {
@@ -1050,9 +1103,45 @@ export async function startServer({
       } catch (_) {}
     } catch (_) {}
   }
+  // i-052 commit 4: this is the code path that actually planted
+  // dashboard-token in the incident's other repos — a paired project may
+  // never have run `init` (so it never got commits 1-2's `.gitignore`
+  // coverage) yet still receives a live token here on every restart.
+  // Ensures the SAME coverage `init` would have given it before writing
+  // the token, content-guarded exactly like write-runtime-config.ts's
+  // append (creates the file if absent; appends the one missing line if
+  // present; no-ops if already covered) — duplicated locally rather than
+  // imported because this file ships as plain ESM with no build step and
+  // cannot import compiled TypeScript (see monoes-mcp-entry.mjs's own doc
+  // comment for the identical constraint). Best-effort: a coverage-ensure
+  // failure must never block token delivery, which is the more urgent
+  // property (a stale token 401s every cross-project caller).
+  function ensureDashboardTokenGitignoreCoverage(kpMonoDir) {
+    try {
+      const gitignorePath = path.join(kpMonoDir, '.gitignore');
+      const reason =
+        'live monomind dashboard credential (i-052) — grants cross-project file reads and agent execution; rewritten on every dashboard restart, so an already-tracked path re-commits a fresh live token on every restart';
+      if (!fs.existsSync(gitignorePath)) {
+        fs.mkdirSync(kpMonoDir, { recursive: true });
+        fs.writeFileSync(gitignorePath, `# ${reason}\ndashboard-token\n`);
+        return;
+      }
+      const existing = fs.readFileSync(gitignorePath, 'utf8');
+      const existingLines = new Set(existing.split('\n').map((l) => l.trim()));
+      if (!existingLines.has('dashboard-token')) {
+        fs.writeFileSync(gitignorePath, `${existing.trimEnd()}\n# ${reason}\ndashboard-token\n`);
+      }
+    } catch (_) {
+      /* best effort — see doc comment above */
+    }
+  }
+
   // Propagate the fresh token to every known project whose control.json points
   // at this server — otherwise each restart silently orphans cross-project
-  // callers (their curls/CLI reads a stale token and 401s forever).
+  // callers (their curls/CLI reads a stale token and 401s forever). The
+  // population is `data/known-projects.json`'s own content, never a
+  // directory glob (i-052 owner correction: the incident's affected-repo
+  // count included projects outside any assumed directory layout).
   // Called after bind so the match uses the ACTUAL bound port.
   function propagateDashboardToken(actualPort) {
     try {
@@ -1064,9 +1153,10 @@ export async function startServer({
           const _kpCtl = JSON.parse(fs.readFileSync(path.join(_kpMono, 'control.json'), 'utf8'));
           // Only pair projects that direct their traffic to this server's port.
           if (_kpCtl && String(_kpCtl.url || '').includes(`:${actualPort}`)) {
-            fs.writeFileSync(path.join(_kpMono, 'dashboard-token'), dashboardAuthValue, {
-              mode: 0o600,
-            });
+            ensureDashboardTokenGitignoreCoverage(_kpMono);
+            const _kpTokenPath = path.join(_kpMono, 'dashboard-token');
+            fs.writeFileSync(_kpTokenPath, dashboardAuthValue, { mode: 0o600 });
+            fs.chmodSync(_kpTokenPath, 0o600); // enforce on rewrite — {mode} above is create-only
           }
         } catch (_) {
           /* project missing/unreadable — skip */
@@ -1771,7 +1861,16 @@ export async function startServer({
 
   const _checkAuth = (req) => {
     let _suppliedAuth = req.headers['x-monomind-token'] || '';
-    if (!_suppliedAuth) {
+    // i-073: the query-token fallback is for EventSource (which cannot send
+    // headers) and other subresource GETs ONLY. It used to apply
+    // unconditionally, which meant a mutation needed only the header OR the
+    // query param — and the header is what forces a CORS preflight (a
+    // mutation becomes a "simple request" without it). A plain
+    // `<form method=POST action="...?token=LEAKED">` has no header to omit,
+    // so accepting the query param on POST turned every mutation into a
+    // CSRF target reachable with no preflight and no JS. Restoring the
+    // unconditional fallback here reopens that hole — see i-073.
+    if (!_suppliedAuth && (req.method === 'GET' || req.method === 'HEAD')) {
       try {
         _suppliedAuth = new URL(req.url, 'http://localhost').searchParams.get('token') || '';
       } catch (_) {}
@@ -1855,6 +1954,32 @@ export async function startServer({
         _sendUnauthorized(res, corsOrigin);
         return;
       }
+      // ── Security: Sec-Fetch-Site CSRF guard on mutations (i-073) ──────────
+      // The token check alone cannot stop CSRF if the token ever leaks (a
+      // browser cache, a proxy log, `ps` on a shared host). Reject when the
+      // header is PRESENT and not `same-origin` — deliberately NOT "reject
+      // cross-site": `Sec-Fetch-Site: same-site` covers a *different port on
+      // the same host*, i.e. a page served by another local server (another
+      // monomind dashboard among them — o-04 shows there can be eleven).
+      // Rejecting anything that isn't `same-origin` closes that case too, at
+      // no cost to the dashboard's own pages.
+      // Header ABSENT must stay allowed, or every first-party non-browser
+      // caller breaks: control-start.cjs, event-logger.cjs,
+      // capture-handler.cjs, route-handler.cjs, forwarder.ts and the
+      // `/mastermind:*` commands all POST with the token header and send no
+      // Sec-Fetch-* at all. A browser too old to send Sec-Fetch-Site is
+      // treated the same as a non-browser client — it still needs the token.
+      if (req.method !== 'GET' && req.method !== 'HEAD') {
+        const _secFetchSite = req.headers['sec-fetch-site'];
+        if (_secFetchSite && _secFetchSite !== 'same-origin') {
+          res.writeHead(403, {
+            'Content-Type': 'application/json',
+            ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+          });
+          res.end(JSON.stringify({ error: 'Forbidden: cross-origin mutation' }));
+          return;
+        }
+      }
     }
 
     // ------------------------------------------------------------------ GET /
@@ -5911,6 +6036,21 @@ export async function startServer({
     // Close all SSE connections
     closeSseClients();
 
+    // i-052 commit 4: best-effort cleanup of the credential THIS process
+    // wrote (primary `dashboard-token`, or this process's own
+    // `dashboard-token-<port>` secondary) — belt-and-braces only.
+    // writeDashboardToken's age-based sweep is the actual backstop for a
+    // dirty death: SIGKILL never reaches this handler at all, and a
+    // failed unlink here (permissions, already-gone) must not block the
+    // rest of shutdown.
+    if (_dashboardTokenFilePath) {
+      try {
+        fs.unlinkSync(_dashboardTokenFilePath);
+      } catch (_) {
+        /* already gone, or unremovable — the age sweep is the backstop */
+      }
+    }
+
     // Drain in-flight JSONL appends before closing (prevents truncated writes on fast SIGTERM)
     Promise.all([..._writeQueue.values()])
       .catch(() => {})
@@ -5955,8 +6095,14 @@ export function getServerStatus() {
 const _isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
 if (_isMain) {
   const _port = parseInt(process.argv[2] || process.env.CONTROL_PORT || '4242', 10);
+  // CLAUDE_PROJECT_DIR names a project; the bare cwd fallback does not (#308).
   const _dir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-  startServer({ port: _port, openBrowser: false, projectDir: _dir }).catch((err) => {
+  startServer({
+    port: _port,
+    openBrowser: false,
+    projectDir: _dir,
+    projectDirExplicit: Boolean(process.env.CLAUDE_PROJECT_DIR),
+  }).catch((err) => {
     process.stderr.write(`[server] failed to start: ${err.message}\n`);
     process.exit(1);
   });