@monoes/monomindcli 2.12.0 → 2.14.0

package/dist/src/ui/server.mjs

@@ -6,6 +6,10 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import zlib from 'node:zlib';
+import {
+  detectDashboardTokenLeak,
+  formatDashboardTokenLeakWarning,
+} from '../mcp/monoes-mcp-entry.mjs';
 import {
   collectAgents,
   collectAll,
@@ -574,17 +578,34 @@ function _getGitMonomindDir(workDir) {
 }
 
 // Returns the monomind home directory for server-level data (capture, control.json, loops).
-// Priority: MONOMIND_HOME env var > walk up from cwd finding .monomind/control.json > cwd fallback
-function getMonomindHome() {
+// Priority: an EXPLICIT project dir (--project-dir / CLAUDE_PROJECT_DIR) > MONOMIND_HOME env
+// var > walk up from cwd finding .monomind/control.json, never past the enclosing git root >
+// cwd fallback.
+//
+// #308: the walk used to run unconditionally, ignoring --project-dir, so it could resolve to
+// any ancestor that happened to hold a control.json from an earlier dashboard run. Per-project
+// state written under this home — the monoes.me connection file with its OAuth tokens,
+// capture/, orgs/ — then landed in that ancestor instead of the project the dashboard is for.
+//
+// `projectDirExplicit` is what keeps the walk alive: both entry points always hand startServer
+// a projectDir (`monomind ui` defaults the flag to cwd, the run-directly block below defaults
+// CLAUDE_PROJECT_DIR to cwd), so short-circuiting on the dir alone would silently move the home
+// of every dashboard started from a subdirectory of its project down into that subdirectory.
+// Only a dir the caller actually named counts.
+export function getMonomindHome(projectDir, projectDirExplicit) {
+  if (projectDirExplicit && projectDir) return path.resolve(projectDir);
   if (process.env.MONOMIND_HOME) return path.resolve(process.env.MONOMIND_HOME);
   let dir = process.cwd();
   while (dir !== path.dirname(dir)) {
     if (fs.existsSync(path.join(dir, '.monomind', 'control.json'))) return dir;
+    if (fs.existsSync(path.join(dir, '.git'))) break;
     dir = path.dirname(dir);
   }
   return process.cwd();
 }
-const MONOMIND_HOME = getMonomindHome();
+// Re-resolved from the options at startServer() time (the projectDir only exists then); the
+// call sites below all read it from inside startServer, after that assignment.
+let MONOMIND_HOME = getMonomindHome();
 
 // Resolve an org's project directory by searching across known projects.
 // Returns the first project dir where {dir}/.monomind/orgs/{orgName}.json exists, or null.
@@ -878,6 +899,9 @@ function bindServer(server, port) {
  * @param {object} [options]
  * @param {number}  [options.port=4242]        - Preferred port. Tries up to port+10 on collision.
  * @param {string}  [options.projectDir]       - Root of the project to collect data from.
+ * @param {boolean} [options.projectDirExplicit=false] - True when projectDir was named by the
+ *   caller (--project-dir / CLAUDE_PROJECT_DIR) rather than defaulted to cwd; only then does it
+ *   set the monomind home (see getMonomindHome, #308).
  * @param {boolean} [options.openBrowser=true] - Whether to open the dashboard in the default browser.
  * @returns {Promise<{port: number, url: string, server: http.Server}>}
  */
@@ -973,9 +997,24 @@ function _resolveSlugToPathUncached(slug, projDir) {
 export async function startServer({
   port = 4242,
   projectDir,
+  projectDirExplicit = false,
   openBrowser = true,
   allowedHosts,
 } = {}) {
+  // #308: resolve the home now that the caller's project dir is in hand.
+  MONOMIND_HOME = getMonomindHome(projectDir, projectDirExplicit);
+  // i-052 commit 3: warn on every start, not only at `init` (executor.ts).
+  // The dashboard is what WRITES dashboard-token — a user who never
+  // re-runs `init` after the file got committed (e.g. before commits 1-2
+  // shipped `.gitignore` coverage) would otherwise never see this warning
+  // at all. Same "name the file, never the value" contract as the
+  // monoes.me leak warning; best-effort (never blocks startup on a git
+  // failure — detectDashboardTokenLeak already treats git-unavailable as
+  // "not a leak signal", not an error).
+  const dashboardTokenStartupWarning = formatDashboardTokenLeakWarning(
+    await detectDashboardTokenLeak(projectDir || process.cwd()),
+  );
+  if (dashboardTokenStartupWarning) console.error(dashboardTokenStartupWarning);
   // Extra Host names accepted beyond loopback (see isAllowedHost above).
   const _allowedHosts = resolveAllowedHosts(allowedHosts);
   // ── Security: per-process auth credential for mutating (non-GET) requests ─
@@ -991,6 +1030,17 @@ export async function startServer({
   // silently degrading per-prompt Second Brain injection to keyword fallback.
   // So the write is deferred to bind time and gated: primary instances write
   // `dashboard-token`; secondaries write `dashboard-token-<port>` instead.
+  // i-052 commit 4: the path THIS process actually wrote (primary
+  // `dashboard-token` xor its own `dashboard-token-<port>` secondary) — set
+  // once, at the bottom of writeDashboardToken(), and read by shutdown()
+  // below for best-effort cleanup on a clean exit. `mode` is create-only
+  // on `fs.writeFileSync` (POSIX `open(2)` ignores it when the file
+  // exists) — measured on this machine: 2 of 11 token files were 644
+  // despite every write site passing `{ mode: 0o600 }`, because a prior
+  // run had already created them. `fs.chmodSync` after every write, here
+  // and in propagateDashboardToken() below, enforces the mode on rewrite
+  // too, not just on first creation.
+  let _dashboardTokenFilePath = null;
   async function writeDashboardToken(actualPort) {
     try {
       actualPort = Number(actualPort);
@@ -1032,14 +1082,17 @@ export async function startServer({
       } catch (_) {
         /* no readable control.json — treat as primary */
       }
-      fs.writeFileSync(
-        path.join(authFileDir, primary ? 'dashboard-token' : `dashboard-token-${actualPort}`),
-        dashboardAuthValue,
-        { mode: 0o600 },
+      const tokenPath = path.join(
+        authFileDir,
+        primary ? 'dashboard-token' : `dashboard-token-${actualPort}`,
       );
+      fs.writeFileSync(tokenPath, dashboardAuthValue, { mode: 0o600 });
+      fs.chmodSync(tokenPath, 0o600); // enforce on rewrite — {mode} above is create-only
+      _dashboardTokenFilePath = tokenPath;
       // Sweep stale secondary tokens (dead scratch/test instances) so they
       // don't accumulate as orphaned credential files.
-      // monolean: age-based sweep only — no on-exit unlink plumbing.
+      // Age-based sweep — the belt-and-braces backstop for a dirty death
+      // (kill -9) that never reaches shutdown()'s cleanup below.
       try {
         const weekMs = 7 * 24 * 3600 * 1000;
         for (const f of fs.readdirSync(authFileDir)) {
@@ -1050,9 +1103,45 @@ export async function startServer({
       } catch (_) {}
     } catch (_) {}
   }
+  // i-052 commit 4: this is the code path that actually planted
+  // dashboard-token in the incident's other repos — a paired project may
+  // never have run `init` (so it never got commits 1-2's `.gitignore`
+  // coverage) yet still receives a live token here on every restart.
+  // Ensures the SAME coverage `init` would have given it before writing
+  // the token, content-guarded exactly like write-runtime-config.ts's
+  // append (creates the file if absent; appends the one missing line if
+  // present; no-ops if already covered) — duplicated locally rather than
+  // imported because this file ships as plain ESM with no build step and
+  // cannot import compiled TypeScript (see monoes-mcp-entry.mjs's own doc
+  // comment for the identical constraint). Best-effort: a coverage-ensure
+  // failure must never block token delivery, which is the more urgent
+  // property (a stale token 401s every cross-project caller).
+  function ensureDashboardTokenGitignoreCoverage(kpMonoDir) {
+    try {
+      const gitignorePath = path.join(kpMonoDir, '.gitignore');
+      const reason =
+        'live monomind dashboard credential (i-052) — grants cross-project file reads and agent execution; rewritten on every dashboard restart, so an already-tracked path re-commits a fresh live token on every restart';
+      if (!fs.existsSync(gitignorePath)) {
+        fs.mkdirSync(kpMonoDir, { recursive: true });
+        fs.writeFileSync(gitignorePath, `# ${reason}\ndashboard-token\n`);
+        return;
+      }
+      const existing = fs.readFileSync(gitignorePath, 'utf8');
+      const existingLines = new Set(existing.split('\n').map((l) => l.trim()));
+      if (!existingLines.has('dashboard-token')) {
+        fs.writeFileSync(gitignorePath, `${existing.trimEnd()}\n# ${reason}\ndashboard-token\n`);
+      }
+    } catch (_) {
+      /* best effort — see doc comment above */
+    }
+  }
+
   // Propagate the fresh token to every known project whose control.json points
   // at this server — otherwise each restart silently orphans cross-project
-  // callers (their curls/CLI reads a stale token and 401s forever).
+  // callers (their curls/CLI reads a stale token and 401s forever). The
+  // population is `data/known-projects.json`'s own content, never a
+  // directory glob (i-052 owner correction: the incident's affected-repo
+  // count included projects outside any assumed directory layout).
   // Called after bind so the match uses the ACTUAL bound port.
   function propagateDashboardToken(actualPort) {
     try {
@@ -1064,9 +1153,10 @@ export async function startServer({
           const _kpCtl = JSON.parse(fs.readFileSync(path.join(_kpMono, 'control.json'), 'utf8'));
           // Only pair projects that direct their traffic to this server's port.
           if (_kpCtl && String(_kpCtl.url || '').includes(`:${actualPort}`)) {
-            fs.writeFileSync(path.join(_kpMono, 'dashboard-token'), dashboardAuthValue, {
-              mode: 0o600,
-            });
+            ensureDashboardTokenGitignoreCoverage(_kpMono);
+            const _kpTokenPath = path.join(_kpMono, 'dashboard-token');
+            fs.writeFileSync(_kpTokenPath, dashboardAuthValue, { mode: 0o600 });
+            fs.chmodSync(_kpTokenPath, 0o600); // enforce on rewrite — {mode} above is create-only
           }
         } catch (_) {
           /* project missing/unreadable — skip */
@@ -1342,10 +1432,26 @@ export async function startServer({
                 } catch (_e) {}
                 if (!_st.agents) _st.agents = {};
                 const _ex = _st.agents[_arole] || {};
-                const _tokensIn = event.type === 'agent:usage' ? Number(event.tokens_in) || 0 : 0;
-                const _tokensOut = event.type === 'agent:usage' ? Number(event.tokens_out) || 0 : 0;
-                // 'org:usage' carries a single total (data.tokens), not an in/out split —
-                // counted toward tokens_used so the budget total still reflects it honestly.
+                // ADR-O001 D1: orgrt's 'org:usage' now carries the four billable
+                // quantities separately (tokens_in / tokens_out / cache_read /
+                // cache_creation) alongside the `tokens` total, so the per-role rows
+                // record real values instead of the 0s they used to persist.
+                const _tokensIn =
+                  event.type === 'agent:usage'
+                    ? Number(event.tokens_in) || 0
+                    : Number(event.data?.tokens_in) || 0;
+                const _tokensOut =
+                  event.type === 'agent:usage'
+                    ? Number(event.tokens_out) || 0
+                    : Number(event.data?.tokens_out) || 0;
+                const _cacheRead =
+                  event.type === 'org:usage' ? Number(event.data?.cache_read) || 0 : 0;
+                const _cacheCreation =
+                  event.type === 'org:usage' ? Number(event.data?.cache_creation) || 0 : 0;
+                // 'org:usage' carries the billable total in data.tokens (cache
+                // reads and writes included) — counted toward tokens_used, and NOT
+                // re-added from the split fields, which are that same total broken
+                // down rather than an extra amount.
                 const _tokensTotal =
                   event.type === 'org:usage' ? Number(event.data?.tokens) || 0 : 0;
                 const _costUsd =
@@ -1356,7 +1462,11 @@ export async function startServer({
                   ..._ex,
                   tokens_in: (_ex.tokens_in || 0) + _tokensIn,
                   tokens_out: (_ex.tokens_out || 0) + _tokensOut,
-                  tokens_used: (_ex.tokens_used || 0) + _tokensIn + _tokensOut + _tokensTotal,
+                  cache_read_tokens: (_ex.cache_read_tokens || 0) + _cacheRead,
+                  cache_creation_tokens: (_ex.cache_creation_tokens || 0) + _cacheCreation,
+                  tokens_used:
+                    (_ex.tokens_used || 0) +
+                    (event.type === 'org:usage' ? _tokensTotal : _tokensIn + _tokensOut),
                   total_cost_usd: (_ex.total_cost_usd || 0) + _costUsd,
                   lastUpdated: event.ts,
                 };
@@ -1771,7 +1881,16 @@ export async function startServer({
 
   const _checkAuth = (req) => {
     let _suppliedAuth = req.headers['x-monomind-token'] || '';
-    if (!_suppliedAuth) {
+    // i-073: the query-token fallback is for EventSource (which cannot send
+    // headers) and other subresource GETs ONLY. It used to apply
+    // unconditionally, which meant a mutation needed only the header OR the
+    // query param — and the header is what forces a CORS preflight (a
+    // mutation becomes a "simple request" without it). A plain
+    // `<form method=POST action="...?token=LEAKED">` has no header to omit,
+    // so accepting the query param on POST turned every mutation into a
+    // CSRF target reachable with no preflight and no JS. Restoring the
+    // unconditional fallback here reopens that hole — see i-073.
+    if (!_suppliedAuth && (req.method === 'GET' || req.method === 'HEAD')) {
       try {
         _suppliedAuth = new URL(req.url, 'http://localhost').searchParams.get('token') || '';
       } catch (_) {}
@@ -1855,6 +1974,32 @@ export async function startServer({
         _sendUnauthorized(res, corsOrigin);
         return;
       }
+      // ── Security: Sec-Fetch-Site CSRF guard on mutations (i-073) ──────────
+      // The token check alone cannot stop CSRF if the token ever leaks (a
+      // browser cache, a proxy log, `ps` on a shared host). Reject when the
+      // header is PRESENT and not `same-origin` — deliberately NOT "reject
+      // cross-site": `Sec-Fetch-Site: same-site` covers a *different port on
+      // the same host*, i.e. a page served by another local server (another
+      // monomind dashboard among them — o-04 shows there can be eleven).
+      // Rejecting anything that isn't `same-origin` closes that case too, at
+      // no cost to the dashboard's own pages.
+      // Header ABSENT must stay allowed, or every first-party non-browser
+      // caller breaks: control-start.cjs, event-logger.cjs,
+      // capture-handler.cjs, route-handler.cjs, forwarder.ts and the
+      // `/mastermind:*` commands all POST with the token header and send no
+      // Sec-Fetch-* at all. A browser too old to send Sec-Fetch-Site is
+      // treated the same as a non-browser client — it still needs the token.
+      if (req.method !== 'GET' && req.method !== 'HEAD') {
+        const _secFetchSite = req.headers['sec-fetch-site'];
+        if (_secFetchSite && _secFetchSite !== 'same-origin') {
+          res.writeHead(403, {
+            'Content-Type': 'application/json',
+            ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
+          });
+          res.end(JSON.stringify({ error: 'Forbidden: cross-origin mutation' }));
+          return;
+        }
+      }
     }
 
     // ------------------------------------------------------------------ GET /
@@ -5911,6 +6056,21 @@ export async function startServer({
     // Close all SSE connections
     closeSseClients();
 
+    // i-052 commit 4: best-effort cleanup of the credential THIS process
+    // wrote (primary `dashboard-token`, or this process's own
+    // `dashboard-token-<port>` secondary) — belt-and-braces only.
+    // writeDashboardToken's age-based sweep is the actual backstop for a
+    // dirty death: SIGKILL never reaches this handler at all, and a
+    // failed unlink here (permissions, already-gone) must not block the
+    // rest of shutdown.
+    if (_dashboardTokenFilePath) {
+      try {
+        fs.unlinkSync(_dashboardTokenFilePath);
+      } catch (_) {
+        /* already gone, or unremovable — the age sweep is the backstop */
+      }
+    }
+
     // Drain in-flight JSONL appends before closing (prevents truncated writes on fast SIGTERM)
     Promise.all([..._writeQueue.values()])
       .catch(() => {})
@@ -5955,8 +6115,14 @@ export function getServerStatus() {
 const _isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
 if (_isMain) {
   const _port = parseInt(process.argv[2] || process.env.CONTROL_PORT || '4242', 10);
+  // CLAUDE_PROJECT_DIR names a project; the bare cwd fallback does not (#308).
   const _dir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-  startServer({ port: _port, openBrowser: false, projectDir: _dir }).catch((err) => {
+  startServer({
+    port: _port,
+    openBrowser: false,
+    projectDir: _dir,
+    projectDirExplicit: Boolean(process.env.CLAUDE_PROJECT_DIR),
+  }).catch((err) => {
     process.stderr.write(`[server] failed to start: ${err.message}\n`);
     process.exit(1);
   });