@monoes/monomindcli 2.8.3 → 2.9.1

package/.claude/helpers/handlers/route-handler.cjs

@@ -492,6 +492,17 @@ module.exports = {
                   fs.writeFileSync(sbMetricsFile, sbOld.slice(-500).join('\n') + '\n', 'utf-8');
                 }
               } catch (_) {}
+              // Derive store provenance from individual hits: 'project', 'global',
+              // or 'mixed' when both brains contributed. Hits carry a boolean
+              // `global` flag set by the warm endpoint / fallback path above.
+              var _sbStore = 'none';
+              if (sbHits && sbHits.length > 0) {
+                var _sbHasProject = false, _sbHasGlobal = false;
+                for (var _sbSi = 0; _sbSi < sbHits.length; _sbSi++) {
+                  if (sbHits[_sbSi].global) _sbHasGlobal = true; else _sbHasProject = true;
+                }
+                _sbStore = _sbHasProject && _sbHasGlobal ? 'mixed' : _sbHasGlobal ? 'global' : 'project';
+              }
               fs.appendFileSync(sbMetricsFile, JSON.stringify({
                 ts: Date.now(),
                 method: sbMethod,
@@ -501,6 +512,7 @@ module.exports = {
                 terms: _sbSubstantive.length,
                 corpus: sbCorpus,
                 injected: !!(sbHits && sbHits.length > 0),
+                store: _sbStore,
               }) + '\n', 'utf-8');
             } catch (_) { /* telemetry never blocks */ }
 

package/.claude/helpers/handlers/session-restore-handler.cjs

@@ -212,18 +212,39 @@ module.exports = {
       }
     } catch (e) { /* non-fatal */ }
 
+    // Migrate: remove legacy MONOMIND_GRAPH_GATE=off from settings.json.
+    // The graph gate is now on by default — monograph_query/suggest must be
+    // called before grep/Glob/Grep once per session. Existing installs that
+    // ran `monomind init` before this change have the env var baked in; this
+    // removes it so the gate activates on next session.
+    var settingsPath = path.join(CWD, '.claude', 'settings.json');
+    var MAX_SETTINGS = 256 * 1024; // 256 KiB
+    var settingsData = null;
+    try {
+      if (fs.existsSync(settingsPath) && (function() { try { return fs.statSync(settingsPath).size <= MAX_SETTINGS; } catch(_) { return false; } }())) {
+        settingsData = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+        if (settingsData.env && settingsData.env.MONOMIND_GRAPH_GATE === 'off') {
+          delete settingsData.env.MONOMIND_GRAPH_GATE;
+          var tmpSettings = settingsPath + '.' + process.pid + '.tmp';
+          fs.writeFileSync(tmpSettings, JSON.stringify(settingsData, null, 2) + '\n');
+          fs.renameSync(tmpSettings, settingsPath);
+          log('[MIGRATE] Removed MONOMIND_GRAPH_GATE=off — graph gate now enforced by default');
+        }
+      }
+    } catch (e) { /* non-fatal — migration is best-effort */ }
+
     // Initialize intelligence — respects monomind.neural.enabled kill switch.
     var neuralEnabled = true;
     try {
-      var settingsPath = path.join(CWD, '.claude', 'settings.json');
-      var MAX_SETTINGS = 256 * 1024; // 256 KiB
-      if (fs.existsSync(settingsPath) && (function() { try { return fs.statSync(settingsPath).size <= MAX_SETTINGS; } catch(_) { return false; } }())) {
-        var settingsData = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
-        if (settingsData.monomind && settingsData.monomind.neural && settingsData.monomind.neural.enabled === false) {
-          neuralEnabled = false;
-          log('[NEURAL] Disabled via monomind.neural.enabled=false');
+      if (!settingsData) {
+        if (fs.existsSync(settingsPath) && (function() { try { return fs.statSync(settingsPath).size <= MAX_SETTINGS; } catch(_) { return false; } }())) {
+          settingsData = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
         }
       }
+      if (settingsData && settingsData.monomind && settingsData.monomind.neural && settingsData.monomind.neural.enabled === false) {
+        neuralEnabled = false;
+        log('[NEURAL] Disabled via monomind.neural.enabled=false');
+      }
     } catch (e) { /* non-fatal */ }
     if (neuralEnabled && intelligence && intelligence.init) {
       var initResult = await runWithTimeout(function() { return intelligence.init(); }, 'intelligence.init()');

package/.claude/helpers/utils/micro-agents.cjs

@@ -213,8 +213,30 @@ function _autoIndexKnowledge(knowledgeDir) {
     { filePath: path.join(CWD, 'CLAUDE.md'), label: 'project-instructions' },
     { filePath: path.join(CWD, 'docs/todo.md'), label: 'project-todo' },
     { filePath: path.join(CWD, 'CLAUDE.local.md'), label: 'local-instructions' },
+    { filePath: path.join(CWD, 'README.md'), label: 'project-readme' },
+    { filePath: path.join(CWD, 'CONTRIBUTING.md'), label: 'project-contributing' },
+    { filePath: path.join(CWD, 'CHANGELOG.md'), label: 'project-changelog' },
   ];
 
+  // Scan doc/ and docs/ directories for markdown files (depth 1 only to keep
+  // the keyword index bounded — the full Second Brain ingestion handles deeper
+  // trees via the embedding pipeline on init and session-start re-index).
+  var _docDirs = ['doc', 'docs'];
+  for (var _ddi = 0; _ddi < _docDirs.length; _ddi++) {
+    var _ddPath = path.join(CWD, _docDirs[_ddi]);
+    try {
+      if (fs.existsSync(_ddPath) && fs.statSync(_ddPath).isDirectory()) {
+        var _ddFiles = fs.readdirSync(_ddPath);
+        for (var _dfi = 0; _dfi < _ddFiles.length; _dfi++) {
+          var _dfName = _ddFiles[_dfi];
+          if (_dfName.charAt(0) === '.' || _dfName.charAt(0) === '_') continue;
+          if (!_dfName.endsWith('.md') && !_dfName.endsWith('.txt')) continue;
+          sources.push({ filePath: path.join(_ddPath, _dfName), label: _docDirs[_ddi] + '/' + _dfName });
+        }
+      }
+    } catch (e) {}
+  }
+
   var hashInput = '';
   for (var i = 0; i < sources.length; i++) {
     try {

package/.claude/skills/monodesign/scripts/live/sveltekit-adapter.mjs

@@ -36,14 +36,17 @@ export function detectSvelteKitProject(cwd = process.cwd(), config = null) {
   };
 }
 
-export function applySvelteKitLiveAdapter({ cwd = process.cwd(), port, config = null } = {}) {
+export function applySvelteKitLiveAdapter({ cwd = process.cwd(), port, authCred, config = null } = {}) {
   if (!Number.isFinite(Number(port))) {
     throw new Error('SvelteKit live adapter requires a numeric port');
   }
+  if (!authCred) {
+    throw new Error('SvelteKit live adapter requires an auth credential');
+  }
   const detected = detectSvelteKitProject(cwd, config);
   if (!detected) return null;
 
-  ensureSvelteLiveRootComponent(cwd, Number(port));
+  ensureSvelteLiveRootComponent(cwd, Number(port), authCred);
 
   const layoutRel = detected.layoutFile;
   const layoutAbs = path.join(cwd, layoutRel);
@@ -136,18 +139,20 @@ export function unpatchSvelteLayout(content) {
   return out.replace(/\n{3,}/g, '\n\n');
 }
 
-export function ensureSvelteLiveRootComponent(cwd, port) {
+export function ensureSvelteLiveRootComponent(cwd, port, authCred) {
   const file = path.join(cwd, SVELTE_LIVE_ROOT_COMPONENT);
   fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, buildSvelteLiveRootComponent(port), 'utf-8');
+  fs.writeFileSync(file, buildSvelteLiveRootComponent(port, authCred), 'utf-8');
   return file;
 }
 
-export function buildSvelteLiveRootComponent(port) {
+export function buildSvelteLiveRootComponent(port, authCred) {
+  const authQuery = new URLSearchParams();
+  authQuery.set('token', String(authCred ?? ''));
   return `<script>
   import { onMount } from 'svelte';
 
-  const LIVE_URL = 'http://localhost:${Number(port)}/live.js';
+  const LIVE_URL = 'http://localhost:${Number(port)}/live.js?${authQuery.toString()}';
   const HOST_ID = 'monodesign-live-root';
 
   onMount(() => {

package/.claude/skills/monodesign/scripts/live-inject.mjs

@@ -16,7 +16,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { resolveLiveConfigPath } from './lib/monodesign-paths.mjs';
+import { resolveLiveConfigPath, readLiveServerInfo } from './lib/monodesign-paths.mjs';
 import {
   applySvelteKitLiveAdapter,
   detectSvelteKitProject,
@@ -27,6 +27,8 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const CONFIG_PATH = resolveLiveConfigPath({ cwd: process.cwd(), scriptsDir: __dirname });
 const MARKER_OPEN_TEXT = 'monodesign-live-start';
 const MARKER_CLOSE_TEXT = 'monodesign-live-end';
+// Query param name live-server.mjs checks on every protected route.
+const AUTH_QUERY_KEY = 'token';
 const IGNORE_MARKER_OPEN = '# monodesign-live-ignore-start';
 const IGNORE_MARKER_CLOSE = '# monodesign-live-ignore-end';
 
@@ -145,10 +147,19 @@ Output (JSON):
     console.error(JSON.stringify({ ok: false, error: 'missing_port' }));
     process.exit(1);
   }
+  // The injected tag must authenticate like every other server route does —
+  // read the per-process credential live-server.mjs persisted at startup.
+  const liveInfo = readLiveServerInfo(process.cwd());
+  const credentialFields = liveInfo?.info ?? {};
+  const authCred = credentialFields['token'];
+  if (!authCred) {
+    console.error(JSON.stringify({ ok: false, error: 'missing_auth_credential', detail: 'no running live server info found for this project — start it before injecting' }));
+    process.exit(1);
+  }
   const gitIgnore = ensureLiveGitIgnores(process.cwd());
 
   if (svelteKit) {
-    const adapterResult = applySvelteKitLiveAdapter({ cwd: process.cwd(), port, config });
+    const adapterResult = applySvelteKitLiveAdapter({ cwd: process.cwd(), port, authCred, config });
     console.log(JSON.stringify({ ok: true, port, adapter: 'sveltekit', gitIgnore, results: [adapterResult] }));
     return;
   }
@@ -158,7 +169,7 @@ Output (JSON):
     if (!fs.existsSync(absFile)) return { file: relFile, error: 'file_not_found' };
     const content = fs.readFileSync(absFile, 'utf-8');
     const withoutOld = revertCspMeta(removeTag(content, config.commentSyntax));
-    const withTag = insertTag(withoutOld, config, port, relFile);
+    const withTag = insertTag(withoutOld, config, port, authCred, relFile);
     if (withTag === withoutOld) {
       return { file: relFile, error: 'insertion_point_not_found', anchor: config.insertBefore || config.insertAfter };
     }
@@ -356,16 +367,18 @@ function validateConfig(cfg) {
 function commentOpen(syntax) { return syntax === 'jsx' ? '{/*' : '<!--'; }
 function commentClose(syntax) { return syntax === 'jsx' ? '*/}' : '-->'; }
 
-function buildTagBlock(syntax, port, filePath) {
+function buildTagBlock(syntax, port, authCred, filePath) {
   const open = commentOpen(syntax);
   const close = commentClose(syntax);
   // Astro processes <script> tags by default and rewrites src to its own
   // bundled URL. is:inline opts out so the literal external src survives.
   const isAstro = typeof filePath === 'string' && filePath.endsWith('.astro');
   const scriptAttrs = isAstro ? 'is:inline ' : '';
+  const authQuery = new URLSearchParams();
+  authQuery.set(AUTH_QUERY_KEY, authCred);
   return (
     open + ' ' + MARKER_OPEN_TEXT + ' ' + close + '\n' +
-    '<script ' + scriptAttrs + 'src="http://localhost:' + port + '/live.js"></script>\n' +
+    '<script ' + scriptAttrs + 'src="http://localhost:' + port + '/live.js?' + authQuery.toString() + '"></script>\n' +
     open + ' ' + MARKER_CLOSE_TEXT + ' ' + close + '\n'
   );
 }
@@ -387,9 +400,9 @@ function readLineEndingAt(content, index) {
   return '';
 }
 
-function insertTag(content, config, port, filePath) {
+function insertTag(content, config, port, authCred, filePath) {
   const lineEnding = detectLineEnding(content);
-  const block = normalizeLineEndings(buildTagBlock(config.commentSyntax, port, filePath), lineEnding);
+  const block = normalizeLineEndings(buildTagBlock(config.commentSyntax, port, authCred, filePath), lineEnding);
   // insertBefore: match the LAST occurrence. Anchors like `</body>` naturally
   // belong at the end, and the same literal can appear earlier in code blocks
   // within rendered documentation pages.

package/.claude/skills/monodesign/scripts/live-server.mjs

@@ -63,6 +63,8 @@ const DESIGN_MD_PATH = PROJECT_CONTEXT.designPath
   : null;
 const DEFAULT_POLL_TIMEOUT = 600_000;   // 10 min — agent re-polls on timeout anyway
 const SSE_HEARTBEAT_INTERVAL = 30_000;  // keepalive ping every 30s
+// Query param name every protected route checks against the per-process credential.
+const AUTH_QUERY_KEY = 'token';
 
 // ---------------------------------------------------------------------------
 // Port detection
@@ -383,6 +385,20 @@ function statOrNull(filePath) {
   try { return fs.statSync(filePath); } catch { return null; }
 }
 
+// Shared gate for every protected route, including /live.js (see its call
+// site for why that one needs it too). Writes the 401 itself and returns
+// false so callers can `if (!requireAuthQueryCred(url, res)) return;`.
+function requireAuthQueryCred(url, res) {
+  const provided = url.searchParams.get(AUTH_QUERY_KEY);
+  const expected = state[AUTH_QUERY_KEY];
+  if (provided !== expected) {
+    res.writeHead(401);
+    res.end('Unauthorized');
+    return false;
+  }
+  return true;
+}
+
 // HTTP request handler
 // ---------------------------------------------------------------------------
 
@@ -398,6 +414,15 @@ function createRequestHandler({ detectScript, liveScriptParts }) {
 
     // --- Scripts ---
     if (p === '/live.js') {
+      // This response embeds the shared bearer credential (below) — unlike
+      // /detect.js and the vendored scripts, it must be gated the same way
+      // every OTHER protected route already is. Without this, requesting this
+      // one route defeats every other route's check: whoever fetches it walks
+      // away with the value that's supposed to distinguish the legitimate
+      // preview tab from any other page. See requireAuthQueryCred() below —
+      // callers must supply the credential the running server printed at
+      // startup (also mirrored into the live-server info file for tooling).
+      if (!requireAuthQueryCred(url, res)) return;
       // Re-read from disk each request so edits to live-browser.js land on
       // the next tab reload. No-store headers prevent browser caching across
       // sessions — during iteration, a cached old script silently breaks
@@ -604,8 +629,19 @@ function createRequestHandler({ detectScript, liveScriptParts }) {
       if (token !== state.token) { res.writeHead(401); res.end('Unauthorized'); return; }
       const filePath = url.searchParams.get('path');
       if (!filePath || filePath.includes('..')) { res.writeHead(400); res.end('Bad path'); return; }
-      const absPath = path.resolve(process.cwd(), filePath);
-      if (!absPath.startsWith(process.cwd())) { res.writeHead(403); res.end('Forbidden'); return; }
+      // Resolve symlinks on BOTH sides before comparing: a lexical prefix check
+      // (path.resolve + startsWith) can't tell a symlink that lexically resolves
+      // inside cwd from one that physically points outside it, and startsWith on
+      // its own also has no path-boundary — "/proj-evil" lexically "starts with"
+      // "/proj". realpath + path.relative closes both gaps (the same pattern
+      // already used correctly elsewhere in this package).
+      let root, absPath;
+      try {
+        root = fs.realpathSync(process.cwd());
+        absPath = fs.realpathSync(path.resolve(process.cwd(), filePath));
+      } catch { res.writeHead(404); res.end('File not found'); return; }
+      const rel = path.relative(root, absPath);
+      if (rel.startsWith('..') || path.isAbsolute(rel)) { res.writeHead(403); res.end('Forbidden'); return; }
       let content;
       try { content = fs.readFileSync(absPath, 'utf-8'); }
       catch { res.writeHead(404); res.end('File not found'); return; }

package/LICENSE

@@ -0,0 +1,191 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright
+      owner or by an individual or Legal Entity authorized to submit on
+      behalf of the copyright owner. For the purposes of this definition,
+      "submitted" means any form of electronic, verbal, or written
+      communication sent to the Licensor or its representatives, including
+      but not limited to communication on electronic mailing lists, source
+      code control systems, and issue tracking systems that are managed by,
+      or on behalf of, the Licensor for the purpose of discussing and
+      improving the Work, but excluding communication that is conspicuously
+      marked or otherwise designated in writing by the copyright owner as
+      "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 monoes
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <strong>An open-source MCP server that extends Claude Code with a codebase knowledge graph, persistent memory, and multi-agent coordination.</strong><br/>
-  MIT licensed &middot; Fully local &middot; No data leaves your machine
+  Apache 2.0 licensed &middot; Fully local &middot; No data leaves your machine
 </p>
 
 <p align="center">
@@ -14,7 +14,7 @@
   <a href="https://www.npmjs.com/package/monomind"><img src="https://img.shields.io/npm/v/monomind?color=%2300D2AA&label=monomind&style=flat-square" alt="npm" /></a>
   <a href="https://www.npmjs.com/package/monomind"><img src="https://img.shields.io/npm/dm/monomind?color=%2310B981&style=flat-square" alt="downloads" /></a>
   <a href="https://github.com/monoes/monomind/stargazers"><img src="https://img.shields.io/github/stars/monoes/monomind?color=%23F59E0B&style=flat-square" alt="stars" /></a>
-  <a href="https://github.com/monoes/monomind/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-%238B5CF6?style=flat-square" alt="license" /></a>
+  <a href="https://github.com/monoes/monomind/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache_2.0-%238B5CF6?style=flat-square" alt="license" /></a>
   <a href="https://nodejs.org/"><img src="https://img.shields.io/badge/node-%3E%3D20-339933?style=flat-square&logo=node.js&logoColor=white" alt="node" /></a>
 </p>
 
@@ -38,7 +38,7 @@ Monomind is an **open-source CLI and MCP server** that plugs into Claude Code (a
 - **Reusable slash commands** — 30+ development workflows (build, review, debug, TDD, architecture) available as `/mastermind:*` commands inside Claude Code.
 
 ```bash
-npm install -g monomind        # MIT licensed, runs entirely on your machine
+npm install -g monomind        # Apache 2.0 licensed, runs entirely on your machine
 cd your-project && monomind init
 claude mcp add monomind -- npx -y monomind@latest mcp start
 ```
@@ -76,7 +76,7 @@ monomind init --kimicode       # emits .kimi-code/ + AGENTS.md alongside Claude/
 
 | Concern | Answer |
 |---|---|
-| **License** | [MIT](LICENSE) — use it however you want |
+| **License** | [Apache 2.0](LICENSE) — use it however you want |
 | **Data privacy** | Everything runs locally — your code and memory store never leave your machine. The one exception: crash reporting is on by default (`monomind crash-reporting disable` to opt out) — a hard crash in monomind/mono-agent/monotask/mono-clip files a GitHub issue on that tool's own repo via the GitHub API. That's the only network call Monomind itself makes; it never phones a monoes-controlled server. |
 | **Dependencies** | Standard npm packages (tree-sitter, better-sqlite3, sql.js, zod). tree-sitter and better-sqlite3 are native (prebuilt) Node addons, not pure JS/WASM — sql.js is WASM. No post-install scripts that download code. |
 | **Permissions** | Registers as an MCP server — Claude Code controls what tools are available and prompts you before executing anything sensitive. |
@@ -232,11 +232,13 @@ claude mcp add monomind -- npx -y monomind@latest mcp start
 monomind doctor --fix
 ```
 
+> **Semantic routing (opt-in download):** embedding-based task routing needs a local model (~88 MB, `Snowflake/snowflake-arctic-embed-xs` via transformers.js). `monomind init` asks interactively whether to download it — the default is No, and non-interactive/CI installs never download it silently. Declining is fine: routing falls back to keyword mode. Fetch it any time with `monomind download-embeddings` (or `node scripts/download-embedding-model.mjs` on a source checkout).
+
 Open Claude Code. You now have 49 `/mastermind:*` workflows available:
 
 ```bash
 /mastermind:autodev --tillend     # start autonomous code loop
-monomind org run my-team          # run your first AI org (see .monomind/orgs/sample-team.json)
+monomind org run sample-team      # run your first AI org (init writes a runnable sample-team.json — edit it, or run it as-is)
 /mastermind:help                  # show all commands
 ```
 
@@ -445,5 +447,5 @@ graph TD
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/monoes/monomind/main/assets/mascot.png" alt="Monomind" width="72" /><br/>
-  <sub>Built with ♥ by <a href="https://github.com/monoes">monoes</a> · MIT License</sub>
+  <sub>Built with ♥ by <a href="https://github.com/monoes">monoes</a> · Apache 2.0 License</sub>
 </p>

package/dist/src/browser/dashboard/server.d.ts

@@ -3,6 +3,11 @@ interface DashboardServer {
     broadcast(event: StepEvent): void;
     close(): void;
     port: number;
+    /** Returns the bound host:port, or null if not listening. */
+    address(): {
+        address: string;
+        port: number;
+    } | null;
 }
 export declare function getDashboardServer(port?: number): DashboardServer;
 export {};

package/dist/src/browser/dashboard/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/browser/dashboard/server.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAa,MAAM,sBAAsB,CAAC;AA2DjE,UAAU,eAAe;IACvB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IAClC,KAAK,IAAI,IAAI,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAgB,kBAAkB,CAAC,IAAI,SAAe,GAAG,eAAe,CAgJvE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/browser/dashboard/server.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAa,MAAM,sBAAsB,CAAC;AA6EjE,UAAU,eAAe;IACvB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IAClC,KAAK,IAAI,IAAI,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,OAAO,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACrD;AAID,wBAAgB,kBAAkB,CAAC,IAAI,SAAe,GAAG,eAAe,CAiLvE"}