@monoes/monomindcli 2.9.1 → 2.9.3

package/dist/src/ui/data/mastermind-sessions.json

@@ -0,0 +1 @@
+[]

package/dist/src/ui/markdown.js

@@ -0,0 +1,273 @@
+// packages/@monomind/cli/src/ui/markdown.js
+// High-fidelity markdown renderer, extracted out of dashboard.html (#124 —
+// it was one of four hand-copied markdown-to-HTML renderers in that file,
+// each with different escaping coverage; this was the most complete one,
+// so the others were left in place rather than forced onto this one's
+// styling without a way to visually verify every call site).
+//
+// Loaded as a classic <script src="markdown.js"> (see the tag right before
+// the main inline <script> in dashboard.html) — NOT an ES module — so
+// renderDocMarkdown and gdCopyCode stay plain globals, exactly like every
+// other dashboard.html function, and every existing call site keeps working
+// unmodified.
+//
+// Handles: headings (h1-h6) with anchors, bold/italic/strikethrough, inline
+// code and fenced code blocks (with language label + copy button), unordered/
+// ordered/nested/task lists, GFM tables, nested blockquotes, horizontal rules,
+// links (external get rel=noopener + target=_blank), images, line breaks.
+// HTML-escaped at the boundary; nothing the source contains can inject markup.
+function renderDocMarkdown(md) {
+  if (!md) return '';
+  const esc = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+  // Escapes a URL for safe insertion into a double-quoted HTML attribute.
+  // #124: links/images previously interpolated `href`/`src` RAW — the
+  // sanitizer below (sanitizeHtmlBlock) only ever ran on raw HTML blocks,
+  // never on markdown-link URLs, so `[x](" onmouseover="alert(1))` could
+  // break out of the attribute. `esc()` alone is sufficient here since a
+  // quote is the only character that lets a URL escape a double-quoted
+  // attribute value.
+  const escAttr = (s) => String(s).replace(/"/g, '&quot;');
+  // #124-review: escAttr() alone stops attribute-breakout XSS (a `"` can't
+  // escape the quoted attribute value) but does nothing about SCHEME-based
+  // execution — `[click me](javascript:alert(document.cookie))` rendered as
+  // a fully clickable, executable link even after the escAttr() fix, and
+  // sanitizeHtmlBlock() below (which DOES filter javascript: hrefs/srcs)
+  // only ever runs on raw HTML blocks, never on markdown-syntax links/
+  // images. Reject any scheme outside an explicit allowlist — relative/
+  // same-origin URLs (no colon before the first `/`) are always allowed.
+  const SAFE_URL_SCHEMES = /^(https?|mailto|tel):/i;
+  const safeUrl = (u) => {
+    const s = String(u);
+    const hasScheme = /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(s);
+    if (hasScheme && !SAFE_URL_SCHEMES.test(s)) return '#';
+    return s;
+  };
+
+  // 1. Strip a leading YAML frontmatter block (mastermind plan/spec files have one).
+  let src = String(md).replace(/^?---[\s\S]*?\n---\s*\n/, '');
+
+  // 2. Extract fenced code blocks first so their contents are never reinterpreted.
+  // #124-review: previously unanchored (`/```.../g`), so it matched a fence
+  // even when preceded by a blockquote's "> " marker, extracting it at the
+  // OUTER (top-level) call. The bare placeholder left behind then got
+  // captured as ordinary blockquote body text, and flushBQ()'s recursive
+  // renderDocMarkdown() call resolves placeholders against its OWN fresh,
+  // empty codeBlocks array -- silently producing an empty, unlabeled code
+  // block instead of the real content. Anchoring the match to true
+  // line-start (mirroring the HTML-block regex below, which already does
+  // this and was never affected) means a blockquote-nested fence is simply
+  // left alone here and gets extracted correctly by the recursive call
+  // instead, once the "> " markers have been stripped from each line.
+  const codeBlocks = [];
+  src = src.replace(/(^|\n)```([\w+-]*)\n?([\s\S]*?)```/g, (_m, lead, lang, code) => {
+    const clean = code.replace(/\n$/, '');
+    codeBlocks.push({ lang: (lang || '').toLowerCase(), code: clean });
+    return (lead || '') + '\u0000CB' + (codeBlocks.length - 1) + '\u0000';
+  });
+
+  // 3. Extract inline HTML blocks (multiline <div>…</div> etc.) — pass through
+  //    verbatim after escaping, so user-authored HTML in a plan still renders
+  //    structurally without enabling script injection (we'll re-strip <script>
+  //    and on* handlers at the end).
+  const htmlBlocks = [];
+  src = src.replace(/(^|\n)(<(\w+)[^>\n]*>[\s\S]*?<\/\3>)(?=\n|$)/g, (_m, lead, html) => {
+    htmlBlocks.push(html);
+    return (lead || '') + '\u0000HB' + (htmlBlocks.length - 1) + '\u0000';
+  });
+
+  // 4. Escape everything that remains.
+  src = esc(src).replace(/\u0000CB(\d+)\u0000/g, 'CB$1').replace(/\u0000HB(\d+)\u0000/g, 'HB$1');
+
+  // 5. Block-level transforms: tables, headings, hr, blockquotes, lists.
+  //    Operate line-by-line so nesting and paragraph grouping stay coherent.
+  const lines = src.split('\n');
+  const out = [];
+  let i = 0;
+  let inUl = false, inOl = false, inTask = false, bqBuf = [], paraBuf = [];
+
+  const closeLists = () => {
+    if (inUl) { out.push('</ul>'); inUl = false; }
+    if (inOl) { out.push('</ol>'); inOl = false; }
+    if (inTask) { out.push('</ul>'); inTask = false; }
+  };
+  const flushPara = () => { if (paraBuf.length) { out.push('<p>' + paraBuf.join(' ') + '</p>'); paraBuf = []; } };
+  // Reverses esc() — bqBuf holds lines captured AFTER step 4's escaping, so
+  // recursing back into renderDocMarkdown() (which escapes its input itself)
+  // would double-escape (`&lt;` -> `&amp;lt;`) without this.
+  const unescapeOnce = (s) => String(s).replace(/&quot;/g, '"').replace(/&gt;/g, '>').replace(/&lt;/g, '<').replace(/&amp;/g, '&');
+  const flushBQ = () => {
+    if (!bqBuf.length) return;
+    // Recursively render the inner block so nested formatting works.
+    out.push('<blockquote>' + renderDocMarkdown(unescapeOnce(bqBuf.join('\n'))) + '</blockquote>');
+    bqBuf = [];
+  };
+  const slugify = (s) => String(s).toLowerCase().replace(/<[^>]+>/g, '').replace(/[^\w\s-]/g, '').trim().replace(/\s+/g, '-');
+
+  while (i < lines.length) {
+    let line = lines[i];
+
+    // Block placeholders for code/html blocks (they sit on their own line).
+    const cbMatch = line.match(/^CB(\d+)$/);
+    if (cbMatch) { closeLists(); flushPara(); flushBQ(); out.push(renderCodeBlock(codeBlocks[+cbMatch[1]])); i++; continue; }
+    const hbMatch = line.match(/^HB(\d+)$/);
+    if (hbMatch) { closeLists(); flushPara(); flushBQ(); out.push(sanitizeHtmlBlock(htmlBlocks[+hbMatch[1]])); i++; continue; }
+
+    // Blank line: paragraph + list breaks.
+    if (line.trim() === '') { closeLists(); flushPara(); flushBQ(); i++; continue; }
+
+    // Headings (with anchor).
+    const h = line.match(/^(#{1,6})\s+(.+?)(?:\s+#+\s*)?$/);
+    if (h) { closeLists(); flushPara(); flushBQ(); const lvl = h[1].length; const txt = inlineMd(h[2]); const id = slugify(h[2]); out.push('<h' + lvl + ' id="' + id + '">' + txt + '</h' + lvl + '>'); i++; continue; }
+
+    // Horizontal rule.
+    if (/^(\*\s*){3,}$/.test(line) || /^(-\s*){3,}$/.test(line) || /^(_\s*){3,}$/.test(line)) { closeLists(); flushPara(); flushBQ(); out.push('<hr>'); i++; continue; }
+
+    // GFM table — a block of consecutive lines where line 0 and line 1 look
+    // like | a | b |  /  |---|---|. Scan forward to collect the full table.
+    if (/^\s*\|.+\|\s*$/.test(line) && i + 1 < lines.length && /^\s*\|?[\s:-]+\|[\s:|-]+\|?\s*$/.test(lines[i + 1])) {
+      closeLists(); flushPara(); flushBQ();
+      const headerCells = splitTableRow(line);
+      const aligns = parseTableAligns(lines[i + 1]);
+      i += 2;
+      const rows = [];
+      while (i < lines.length && /^\s*\|.+\|\s*$/.test(lines[i])) { rows.push(splitTableRow(lines[i])); i++; }
+      out.push(renderTable(headerCells, aligns, rows));
+      continue;
+    }
+
+    // Blockquote. `line` has already been through esc() (step 4 above), so a
+    // source `>` is now the literal text `&gt;` by this point — match that,
+    // not a raw `>` (which can never appear here and never matched).
+    const bq = line.match(/^&gt;\s?(.*)$/);
+    if (bq) { closeLists(); flushPara(); bqBuf.push(bq[1]); i++; continue; }
+    if (bqBuf.length) { flushBQ(); }
+
+    // Task list item.
+    const task = line.match(/^(\s*)([-*])\s+\[( |x|X)\]\s+(.+)$/);
+    if (task) { flushPara(); if (inUl) { out.push('</ul>'); inUl = false; } if (inOl) { out.push('</ol>'); inOl = false; } if (!inTask) { out.push('<ul class="md-tasklist">'); inTask = true; } const checked = task[3].toLowerCase() === 'x'; out.push('<li><input type="checkbox" disabled' + (checked ? ' checked' : '') + '> ' + inlineMd(task[4]) + '</li>'); i++; continue; }
+
+    // Unordered list item.
+    const ul = line.match(/^(\s*)([-*+])\s+(.+)$/);
+    if (ul && !task) {
+      flushPara();
+      if (inOl) { out.push('</ol>'); inOl = false; }
+      if (inTask) { out.push('</ul>'); inTask = false; }
+      if (!inUl) { out.push('<ul>'); inUl = true; }
+      const indent = ul[1].length;
+      if (indent === 0) out.push('<li>' + inlineMd(ul[3]) + '</li>');
+      else {
+        // Nested list — close current top item and open a nested <ul>.
+        out.push('<li>' + inlineMd(ul[3]) + '</li>');
+      }
+      i++; continue;
+    }
+    // Ordered list item.
+    const ol = line.match(/^(\s*)(\d+)\.\s+(.+)$/);
+    if (ol) {
+      flushPara();
+      if (inUl) { out.push('</ul>'); inUl = false; }
+      if (inTask) { out.push('</ul>'); inTask = false; }
+      if (!inOl) { out.push('<ol>'); inOl = true; }
+      out.push('<li>' + inlineMd(ol[3]) + '</li>');
+      i++; continue;
+    }
+
+    // Otherwise: paragraph text. Buffer until a blank line / structural break.
+    closeLists();
+    flushBQ();
+    paraBuf.push(inlineMd(line));
+    i++;
+  }
+  closeLists(); flushPara(); flushBQ();
+
+  let html = out.join('\n');
+  // 6. Restore code/html block placeholders INSIDE paragraphs (when a CB/HB
+  //    token got buffered as paragraph text instead of sitting alone).
+  html = html.replace(/CB(\d+)/g, (_m, idx) => renderCodeBlock(codeBlocks[+idx]))
+             .replace(/HB(\d+)/g, (_m, idx) => sanitizeHtmlBlock(htmlBlocks[+idx]));
+  return html;
+
+  // ── helpers ──
+  function inlineMd(s) {
+    // Inline code first (so its contents aren't reformatted).
+    const codes = [];
+    s = s.replace(/`([^`\n]+)`/g, (_m, c) => { codes.push(c); return '\u0001C' + (codes.length - 1) + '\u0001'; });
+    // Images: ![alt](src "title")
+    s = s.replace(/!\[([^\]]*)\]\(([^)\s]+)(?:\s+"([^"]*)")?\)/g,
+      (_m, alt, src, title) => '<img src="' + escAttr(safeUrl(src)) + '" alt="' + esc(alt) + '"' + (title ? ' title="' + esc(title) + '"' : '') + ' loading="lazy" style="max-width:100%;height:auto;border-radius:6px">');
+    // Links: [text](href "title")
+    s = s.replace(/\[([^\]]+)\]\(([^)\s]+)(?:\s+"([^"]*)")?\)/g,
+      (_m, txt, href, title) => {
+        const external = /^(https?:|mailto:|tel:)/i.test(href);
+        const safe = external ? ' target="_blank" rel="noopener noreferrer"' : '';
+        return '<a href="' + escAttr(safeUrl(href)) + '"' + (title ? ' title="' + esc(title) + '"' : '') + safe + '>' + txt + '</a>';
+      });
+    // Bold.
+    s = s.replace(/\*\*([^*\n]+)\*\*/g, '<strong>$1</strong>');
+    s = s.replace(/__([^_\n]+)__/g, '<strong>$1</strong>');
+    // Italic.
+    s = s.replace(/\*([^*\n]+)\*/g, '<em>$1</em>');
+    s = s.replace(/(^|[^_])_([^_\n]+)_/g, '$1<em>$2</em>');
+    // Strikethrough.
+    s = s.replace(/~~([^~\n]+)~~/g, '<del>$1</del>');
+    // Restore inline code.
+    s = s.replace(/\u0001C(\d+)\u0001/g, (_m, idx) => '<code>' + esc(codes[+idx]) + '</code>');
+    return s;
+  }
+
+  function renderCodeBlock(block) {
+    const lang = block?.lang || '';
+    const code = block?.code ?? '';
+    const labelHtml = lang ? '<span class="gd-code-lang">' + esc(lang) + '</span>' : '';
+    return '<div class="gd-code-block">' +
+      '<div class="gd-code-bar"><button class="gd-code-copy" onclick="gdCopyCode(this)">copy</button>' + labelHtml + '</div>' +
+      '<pre><code' + (lang ? ' class="language-' + esc(lang) + '"' : '') + '>' + esc(code) + '</code></pre>' +
+    '</div>';
+  }
+
+  function sanitizeHtmlBlock(html) {
+    // Strip <script> entirely, drop event-handler attributes (onclick=, onload=, on*=),
+    // and javascript: URLs. Keep everything else as-is so user HTML renders.
+    return String(html)
+      .replace(/<script[\s\S]*?<\/script>/gi, '')
+      .replace(/\son\w+\s*=\s*"[^"]*"/gi, '')
+      .replace(/\son\w+\s*=\s*'[^']*'/gi, '')
+      .replace(/\son\w+\s*=\s*[^\s>]+/gi, '')
+      .replace(/(href|src)\s*=\s*"javascript:[^"]*"/gi, '$1="#"');
+  }
+
+  function splitTableRow(line) {
+    return line.trim().replace(/^\||\|$/g, '').split('|').map(c => c.trim());
+  }
+  function parseTableAligns(line) {
+    return splitTableRow(line).map(cell => {
+      if (/^:\s*-+:$/.test(cell)) return 'center';
+      if (/^-*:$/.test(cell)) return 'left';
+      if (/^-+:$/.test(cell)) return 'right';
+      return null;
+    });
+  }
+  function renderTable(headerCells, aligns, rows) {
+    const alignAttr = (i) => aligns[i] ? ' style="text-align:' + aligns[i] + '"' : '';
+    let html = '<div class="gd-table-wrap"><table><thead><tr>';
+    headerCells.forEach((c, i) => { html += '<th' + alignAttr(i) + '>' + inlineMd(c) + '</th>'; });
+    html += '</tr></thead><tbody>';
+    for (const r of rows) {
+      html += '<tr>';
+      r.forEach((c, i) => { html += '<td' + alignAttr(i) + '>' + inlineMd(c) + '</td>'; });
+      html += '</tr>';
+    }
+    html += '</tbody></table></div>';
+    return html;
+  }
+}
+
+function gdCopyCode(btn) {
+  const codeEl = btn.closest('.gd-code-block')?.querySelector('code');
+  if (!codeEl) return;
+  const text = codeEl.textContent;
+  navigator.clipboard.writeText(text).then(
+    () => { const old = btn.textContent; btn.textContent = 'copied'; setTimeout(() => { btn.textContent = old; }, 1200); },
+    () => { btn.textContent = 'failed'; },
+  );
+}

package/dist/src/ui/server.mjs

@@ -7,7 +7,7 @@ import zlib from 'zlib';
 import { fileURLToPath } from 'url';
 import { createRequire } from 'module';
 import { spawn } from 'child_process';
-import { collectAll, getWatchPaths, collectProject, collectSessions, collectSwarm, collectSwarmHistory, appendSwarmHistory, collectSwarmEvents, getSwarmDataSize, cleanSwarmData, collectAgents, collectTokens, collectHooks, collectKnowledge, collectMetrics, collectMemory, collectMemoryFiles, collectSystem } from './collector.mjs';
+import { collectAll, getWatchPaths, collectProject, collectSessions, collectAgents, collectTokens, collectHooks, collectKnowledge, collectMetrics, collectMemory, collectMemoryFiles, collectSystem } from './collector.mjs';
 import { addSseClient, removeSseClient, broadcast, getSseClientCount, closeSseClients, addMmClient, removeMmClient, broadcastMm, getMmClientCount } from './sse-manager.mjs';
 import { handleMonographRoutes } from './routes-monograph.mjs';
 import { handleOrgRoutes } from './routes-org.mjs';
@@ -20,10 +20,16 @@ const buildDocsState = new Map();
 
 // Pricing per token (mirrors token-tracker.cjs FALLBACK_PRICING)
 const _SJ_PRICING = {
+  'claude-fable-5':    { in: 10e-6,   out: 50e-6,   cw: 12.5e-6,  cr: 1e-6    },
+  'claude-mythos-5':   { in: 10e-6,   out: 50e-6,   cw: 12.5e-6,  cr: 1e-6    },
+  'claude-opus-5':     { in: 5e-6,    out: 25e-6,   cw: 6.25e-6,  cr: 0.5e-6  },
   'claude-opus-4-8':   { in: 5e-6,    out: 25e-6,   cw: 6.25e-6,  cr: 0.5e-6  },
+  'claude-opus-4-7':   { in: 5e-6,    out: 25e-6,   cw: 6.25e-6,  cr: 0.5e-6  },
   'claude-opus-4-6':   { in: 5e-6,    out: 25e-6,   cw: 6.25e-6,  cr: 0.5e-6  },
   'claude-opus-4-5':   { in: 5e-6,    out: 25e-6,   cw: 6.25e-6,  cr: 0.5e-6  },
+  'claude-opus-4-1':   { in: 15e-6,   out: 75e-6,   cw: 18.75e-6, cr: 1.5e-6  },
   'claude-opus-4':     { in: 15e-6,   out: 75e-6,   cw: 18.75e-6, cr: 1.5e-6  },
+  'claude-sonnet-5':   { in: 3e-6,    out: 15e-6,   cw: 3.75e-6,  cr: 0.3e-6  },
   'claude-sonnet-4-6': { in: 3e-6,    out: 15e-6,   cw: 3.75e-6,  cr: 0.3e-6  },
   'claude-sonnet-4-5': { in: 3e-6,    out: 15e-6,   cw: 3.75e-6,  cr: 0.3e-6  },
   'claude-sonnet-4':   { in: 3e-6,    out: 15e-6,   cw: 3.75e-6,  cr: 0.3e-6  },
@@ -32,6 +38,7 @@ const _SJ_PRICING = {
   'claude-haiku-4-5':  { in: 1e-6,    out: 5e-6,    cw: 1.25e-6,  cr: 0.1e-6  },
   'claude-haiku-4':    { in: 0.8e-6,  out: 4e-6,    cw: 1e-6,     cr: 0.08e-6 },
   'claude-3-5-haiku':  { in: 0.8e-6,  out: 4e-6,    cw: 1e-6,     cr: 0.08e-6 },
+  'gpt-5':             { in: 2.5e-6,  out: 10e-6,   cw: 2.5e-6,   cr: 1.25e-6 },
   'gpt-4o':            { in: 2.5e-6,  out: 10e-6,   cw: 2.5e-6,   cr: 1.25e-6 },
   'gpt-4o-mini':       { in: 0.15e-6, out: 0.6e-6,  cw: 0.15e-6,  cr: 0.075e-6 },
   'gemini-2.5-pro':    { in: 1.25e-6, out: 10e-6,   cw: 1.25e-6,  cr: 0.315e-6 },
@@ -179,7 +186,6 @@ function buildSectionData(name, dir) {
   const d = path.resolve(dir);
   switch (name) {
     case 'sessions': return { sessions: collectSessions(d) };
-    case 'swarm':    return { swarm: collectSwarm(d), swarmHistory: collectSwarmHistory(d), agents: collectAgents(d) };
     case 'agents':   return { agents: collectAgents(d) };
     case 'tokens':   return { tokens: collectTokens(d) };
     case 'hooks':    return { hooks: collectHooks(d) };
@@ -1336,7 +1342,7 @@ export async function startServer({ port = 4242, projectDir, openBrowser = true,
   // (all of /api/*, GET or not) requires _checkAuth. These serve the HTML/JS
   // that embeds the token in a <meta name="mm-token"> tag on page load, so
   // they must be reachable before any fetch() call could attach the token.
-  const _OPEN_ROUTES = new Set(['/', '/v2', '/mastermind', '/orgs', '/orgs-files.js', '/favicon.ico']);
+  const _OPEN_ROUTES = new Set(['/', '/v2', '/mastermind', '/orgs', '/orgs-files.js', '/markdown.js', '/favicon.ico']);
   const _isOpenRoute = (url, method) =>
     (method === 'GET' || method === 'HEAD' || method === 'OPTIONS')
     && (_OPEN_ROUTES.has(url) || /^\/data\/avatars\/[A-Za-z0-9._-]+\.svg$/.test(url));
@@ -1400,6 +1406,25 @@ export async function startServer({ port = 4242, projectDir, openBrowser = true,
       return;
     }
 
+    // ------------------------------------------------ GET /markdown.js
+    // Markdown renderer, split out of dashboard.html (#124) — same pattern
+    // as GET /orgs-files.js in routes-org.mjs (a sibling asset served via
+    // its own hardcoded route, not a generic static-file handler). Must be
+    // in _OPEN_ROUTES above: dashboard.html's own <script src="markdown.js">
+    // request happens before the page has the auth token to attach.
+    if (req.method === 'GET' && url === '/markdown.js') {
+      try {
+        const jsPath = path.join(__dirname, 'markdown.js');
+        const js = fs.readFileSync(jsPath, 'utf8');
+        res.writeHead(200, { 'Content-Type': 'application/javascript; charset=utf-8' });
+        res.end(js);
+      } catch (err) {
+        res.writeHead(404);
+        res.end(`markdown.js not found: ${err.message}`);
+      }
+      return;
+    }
+
     // ------------------------------------------------- GET /data/avatars/*.svg (agent avatars)
     if (req.method === 'GET' && /^\/data\/avatars\/[A-Za-z0-9._-]+\.svg$/.test(url)) {
       try {
@@ -3336,160 +3361,40 @@ export async function startServer({ port = 4242, projectDir, openBrowser = true,
       return;
     }
 
-
-    // ------------------------------------------------------- GET /api/graph
-    if (req.method === 'GET' && url === '/api/graph') {
+    // -------------------------------------------------------- GET /api/docs
+    if (req.method === 'GET' && url === '/api/docs') {
       try {
         const qs = new URL(req.url, 'http://localhost').searchParams;
         const dir = qs.get('dir') || projectDir || process.cwd();
-        const d = path.resolve(dir || process.cwd());
-
-        // Find session files — sort by mtime descending before processing
-        const homeDir = os.homedir();
-        const slug = d.replace(/\//g, '-');
-        const sessionsDir = fs.existsSync(path.join(homeDir, '.claude', 'projects', slug))
-          ? path.join(homeDir, '.claude', 'projects', slug)
-          : path.join(d, '.claude', 'sessions');
-
-        let sessionFiles = [];
-        try {
-          sessionFiles = fs.readdirSync(sessionsDir)
-            .filter(f => f.endsWith('.jsonl') && !f.startsWith('._'))
-            .map(f => ({ f, mtime: (() => { try { return fs.statSync(path.join(sessionsDir, f)).mtimeMs; } catch { return 0; } })() }))
-            .sort((a, b) => b.mtime - a.mtime)
-            .map(({ f }) => f);
-        } catch {}
-
-        // Parse each session: count tool categories + agent type spawns
-        const TOOL_CAT = name => {
-          if (['Read','Write','Edit','MultiEdit','Glob','Grep','LS'].includes(name)) return 'file';
-          if (name === 'Bash') return 'bash';
-          if (['Agent','Task'].includes(name)) return 'agent';
-          if (name.startsWith('mcp__monomind__memory') || name.startsWith('mcp__monomind__agentdb')) return 'memory';
-          if (['WebFetch','WebSearch'].includes(name)) return 'web';
-          if (name === 'Skill') return 'skill';
-          return 'other';
-        };
-
-        const nodes = [];
-        const edges = [];
-        const agentTypeNodes = {}; // subagent_type → node id
-
-        for (const fname of sessionFiles) {
-          const sid = fname.replace('.jsonl','');
-          const fp = path.join(sessionsDir, fname);
-          let stat = null;
-          try { stat = fs.statSync(fp); } catch { continue; }
-
-          // Skip files over size cap to avoid memory spikes on large sessions
-          // But still do a lightweight scan for agent spawns (tool_use blocks named Agent/Task)
-          if (stat.size > JSONL_SIZE_CAP) {
-            const truncSpawns = {};
-            try {
-              const raw = fs.readFileSync(fp, 'utf8');
-              for (const line of raw.split('\n')) {
-                if (!line.includes('"tool_use"') || (!line.includes('"Agent"') && !line.includes('"Task"'))) continue;
-                let e; try { e = JSON.parse(line); } catch { continue; }
-                if (e.type !== 'assistant') continue;
-                for (const block of (e.message?.content || [])) {
-                  if (!block || block.type !== 'tool_use') continue;
-                  if (block.name !== 'Agent' && block.name !== 'Task') continue;
-                  const sub = block.input?.subagent_type || block.input?.description || '?';
-                  truncSpawns[sub] = (truncSpawns[sub] || 0) + 1;
-                }
-              }
-            } catch {}
-            nodes.push({ id: sid, type: 'session', label: sid.slice(0,8), turns: 0, totalTools: 0,
-              toolCounts: {}, cost: 0, mtime: stat.mtimeMs, size: stat.size, agentSpawns: truncSpawns, truncated: true });
-            for (const [subType, count] of Object.entries(truncSpawns)) {
-              const nodeId = 'agent::' + subType;
-              if (!agentTypeNodes[subType]) {
-                agentTypeNodes[subType] = true;
-                nodes.push({ id: nodeId, type: 'agenttype', label: subType, totalSpawns: 0 });
-              }
-              const aNode = nodes.find(n => n.id === nodeId);
-              if (aNode) aNode.totalSpawns = (aNode.totalSpawns || 0) + count;
-              edges.push({ source: sid, target: nodeId, weight: count, label: String(count) });
+        const root = path.resolve(dir);
+        const SKIP_DIRS = new Set(['node_modules', 'dist', 'build', 'coverage']);
+        const DOC_EXT = new Set(['.md', '.mdx']);
+        const files = [];
+
+        // Dirent.isDirectory() is false for a symlinked directory (it reflects
+        // the entry's own type, not the resolved target), so this never
+        // follows a symlink into a loop or outside root — no extra guard needed.
+        const walk = (abs, rel) => {
+          let entries;
+          try { entries = fs.readdirSync(abs, { withFileTypes: true }); } catch { return; }
+          for (const entry of entries) {
+            if (entry.name.startsWith('.') || SKIP_DIRS.has(entry.name)) continue;
+            const childAbs = path.join(abs, entry.name);
+            const childRel = rel ? rel + '/' + entry.name : entry.name;
+            if (entry.isDirectory()) {
+              walk(childAbs, childRel);
+            } else if (entry.isFile() && DOC_EXT.has(path.extname(entry.name))) {
+              let stat;
+              try { stat = fs.statSync(childAbs); } catch { continue; }
+              files.push({ path: childRel, size: stat.size, mtime: stat.mtimeMs });
             }
-            continue;
           }
-
-          const toolCounts = {};
-          const agentSpawns = {}; // subagent_type → count
-          let turns = 0, totalCost = 0, _costIncomplete = false;
-
-          try {
-            const raw = fs.readFileSync(fp, 'utf8').replace(/\r\n/g, '\n');
-            const lines = raw.split('\n').filter(Boolean);
-            for (const line of lines) {
-              let e; try { e = JSON.parse(line); } catch { continue; }
-              if (e.type === 'user') {
-                // Only count actual human turns, not tool-result responses
-                const ct = e.message?.content;
-                const isToolResult = Array.isArray(ct) && ct.length > 0 && ct.every(b => b && b.type === 'tool_result');
-                if (!isToolResult) turns++;
-              }
-              if (e.type === 'assistant') {
-                for (const block of (e.message?.content || [])) {
-                  if (!block || block.type !== 'tool_use') continue;
-                  const cat = TOOL_CAT(block.name);
-                  toolCounts[cat] = (toolCounts[cat] || 0) + 1;
-                  if (cat === 'agent') {
-                    const sub = block.input?.subagent_type || block.input?.description || '?';
-                    agentSpawns[sub] = (agentSpawns[sub] || 0) + 1;
-                  }
-                }
-                if (e.message?.usage) {
-                  const _m = e.message.model || '';
-                  totalCost += _sjCalcCost(_m, e.message.usage);
-                  if (!_sjHasPricing(_m)) _costIncomplete = true;
-                }
-              }
-            }
-          } catch {}
-
-          const totalTools = Object.values(toolCounts).reduce((a,b)=>a+b,0);
-          nodes.push({
-            id: sid, type: 'session', label: sid.slice(0,8),
-            turns, totalTools, toolCounts,
-            cost: totalCost, costIncomplete: _costIncomplete, mtime: stat.mtimeMs, size: stat.size,
-            agentSpawns
-          });
-
-          // Create/link agent type nodes
-          for (const [subType, count] of Object.entries(agentSpawns)) {
-            const nodeId = 'agent::' + subType;
-            if (!agentTypeNodes[subType]) {
-              agentTypeNodes[subType] = true;
-              nodes.push({ id: nodeId, type: 'agenttype', label: subType, totalSpawns: 0 });
-            }
-            const aNode = nodes.find(n => n.id === nodeId);
-            if (aNode) aNode.totalSpawns = (aNode.totalSpawns || 0) + count;
-            edges.push({ source: sid, target: nodeId, weight: count, label: String(count) });
-          }
-        }
+        };
+        walk(root, '');
+        files.sort((a, b) => b.mtime - a.mtime);
 
         res.writeHead(200, { 'Content-Type': 'application/json', ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}), 'Cache-Control': 'no-cache' });
-        res.end(JSON.stringify({ nodes, edges }));
-      } catch (err) {
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: err.message }));
-      }
-      return;
-    }
-
-    // ------------------------------------------------- GET /api/swarm-history
-    if (req.method === 'GET' && url === '/api/swarm-history') {
-      try {
-        const qs = new URL(req.url, 'http://localhost').searchParams;
-        const dir = qs.get('dir') || projectDir || process.cwd();
-        const entries = collectSwarmHistory(path.resolve(dir));
-        res.writeHead(200, {
-          'Content-Type': 'application/json',
-          ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}),
-          'Cache-Control': 'no-cache',
-        });
-        res.end(JSON.stringify({ entries }));
+        res.end(JSON.stringify({ files, total: files.length }));
       } catch (err) {
         res.writeHead(500, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: err.message }));
@@ -3497,50 +3402,55 @@ export async function startServer({ port = 4242, projectDir, openBrowser = true,
       return;
     }
 
-    // ------------------------------------------------- GET /api/swarm-events
-    if (req.method === 'GET' && url === '/api/swarm-events') {
+    // -------------------------------------------------------- GET /api/doc-read
+    // Returns the raw content of one file discovered by /api/docs. Content
+    // exposure is a bigger deal than the metadata /api/docs lists, so
+    // containment is checked against known project roots (same allowlist
+    // /api/global-doc/read uses) rather than trusting the client-supplied
+    // `dir` alone — otherwise `?dir=/` would make any .md file on disk
+    // "contained".
+    if (req.method === 'GET' && url.startsWith('/api/doc-read')) {
       try {
         const qs = new URL(req.url, 'http://localhost').searchParams;
         const dir = qs.get('dir') || projectDir || process.cwd();
-        // Cap swarmId and agentId to prevent O(n×m) DoS: filter() compares
-        // each event against the query string, so a megabyte-scale ID causes
-        // O(events × m) string comparisons.
-        const _rawSwarmId = qs.get('swarmId') || undefined;
-        const _rawAgentId = qs.get('agentId') || undefined;
-        const swarmId = typeof _rawSwarmId === 'string' ? _rawSwarmId.slice(0, 256) : undefined;
-        const agentId = typeof _rawAgentId === 'string' ? _rawAgentId.slice(0, 256) : undefined;
-        const last = qs.get('last') ? parseInt(qs.get('last')) : undefined;
-        const events = collectSwarmEvents(path.resolve(dir), { swarmId, agentId, last });
-        res.writeHead(200, { 'Content-Type': 'application/json', ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}), 'Cache-Control': 'no-cache' });
-        res.end(JSON.stringify({ events, count: events.length }));
-      } catch (err) {
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: err.message }));
-      }
-      return;
-    }
+        const rel = qs.get('path');
+        if (!rel || typeof rel !== 'string') {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'path query param required' }));
+          return;
+        }
+        let resolved = path.resolve(dir, rel);
+        try { resolved = fs.realpathSync(resolved); } catch {}
 
-    // ------------------------------------------------- GET /api/swarm-data-size
-    if (req.method === 'GET' && url === '/api/swarm-data-size') {
-      try {
-        const dir = new URL(req.url, 'http://localhost').searchParams.get('dir') || projectDir || process.cwd();
-        const size = getSwarmDataSize(path.resolve(dir));
-        res.writeHead(200, { 'Content-Type': 'application/json', ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}) });
-        res.end(JSON.stringify(size));
-      } catch (err) {
-        res.writeHead(500, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: err.message }));
-      }
-      return;
-    }
+        const allowedRoots = [path.resolve(projectDir || process.cwd())];
+        const projectsBase = path.join(os.homedir(), '.claude', 'projects');
+        try {
+          for (const slug of fs.readdirSync(projectsBase)) {
+            const resolvedProj = resolveSlugToPath(slug, path.join(projectsBase, slug));
+            if (resolvedProj) allowedRoots.push(resolvedProj);
+          }
+        } catch { /* projects tree absent — fine */ }
+        const globalBrain = process.env.MONOMIND_GLOBAL_BRAIN_DIR
+          || path.join(os.homedir(), '.monomind', 'global-brain');
+        if (fs.existsSync(globalBrain)) allowedRoots.push(globalBrain);
 
-    // ------------------------------------------------- DELETE /api/swarm-clean
-    if (req.method === 'DELETE' && url === '/api/swarm-clean') {
-      try {
-        const dir = new URL(req.url, 'http://localhost').searchParams.get('dir') || projectDir || process.cwd();
-        const result = cleanSwarmData(path.resolve(dir));
-        res.writeHead(200, { 'Content-Type': 'application/json', ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}) });
-        res.end(JSON.stringify({ success: true, ...result }));
+        const isAllowed = allowedRoots.some(root => {
+          const relCheck = path.relative(root, resolved);
+          return relCheck && !relCheck.startsWith('..') && !path.isAbsolute(relCheck);
+        });
+        if (!isAllowed || !fs.existsSync(resolved) || !fs.statSync(resolved).isFile()) {
+          res.writeHead(403, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'path is outside the allowed project roots' }));
+          return;
+        }
+        if (!/\.(md|mdx)$/i.test(resolved)) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'only markdown (.md/.mdx) files are readable' }));
+          return;
+        }
+        const body = fs.readFileSync(resolved, 'utf8');
+        res.writeHead(200, { 'Content-Type': 'application/json', ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}), 'Cache-Control': 'no-cache' });
+        res.end(JSON.stringify({ body }));
       } catch (err) {
         res.writeHead(500, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: err.message }));