@monoes/monomindcli 2.9.2 → 2.9.4

package/dist/src/mcp-tools/hooks-routing.js

@@ -4,9 +4,10 @@
  * build-agents, transfer, session, list, metrics, pre-task, post-task, intelligence.
  * Extracted from hooks-tools.ts.
  */
-import { mkdirSync, writeFileSync, renameSync, existsSync, readFileSync } from 'fs';
+import { mkdirSync, writeFileSync, renameSync, existsSync, readFileSync, } from 'fs';
 import { join, resolve, sep } from 'path';
 import { getProjectCwd } from './types.js';
+import { validateMcpString } from '../utils/input-guards.js';
 import { randomUUID } from 'node:crypto';
 import { recordRoute, joinOutcome, joinLatestUnresolved } from '../monovector/route-outcomes.js';
 import { recordCommand, deriveRecentSuccess } from '../monovector/command-outcomes.js';
@@ -19,7 +20,10 @@ export const hooksPreEdit = {
         type: 'object',
         properties: {
             filePath: { type: 'string', description: 'Path to the file being edited' },
-            operation: { type: 'string', description: 'Type of operation (create, update, delete, refactor)' },
+            operation: {
+                type: 'string',
+                description: 'Type of operation (create, update, delete, refactor)',
+            },
             context: { type: 'string', description: 'Additional context' },
         },
         required: ['filePath'],
@@ -29,14 +33,11 @@ export const hooksPreEdit = {
         // response.  Cap operation to prevent oversized strings in recommendations.
         const MAX_PRE_EDIT_PATH_LEN = 4 * 1024;
         const MAX_PRE_EDIT_OP_LEN = 64;
-        const rawFilePath = params.filePath;
-        const filePath = typeof rawFilePath === 'string' && rawFilePath.length > MAX_PRE_EDIT_PATH_LEN
-            ? rawFilePath.slice(0, MAX_PRE_EDIT_PATH_LEN)
-            : rawFilePath;
-        const rawOperation = params.operation || 'update';
-        const operation = typeof rawOperation === 'string' && rawOperation.length > MAX_PRE_EDIT_OP_LEN
-            ? rawOperation.slice(0, MAX_PRE_EDIT_OP_LEN)
-            : rawOperation;
+        const filePath = validateMcpString(params.filePath, 'filePath', MAX_PRE_EDIT_PATH_LEN);
+        if (!filePath) {
+            return { error: 'filePath is required (non-empty string, no control chars, max 4KB)' };
+        }
+        const operation = validateMcpString(params.operation, 'operation', MAX_PRE_EDIT_OP_LEN) ?? 'update';
         const suggestedAgents = suggestAgentsForFile(filePath);
         const ext = getFileExtension(filePath);
         return {
@@ -47,9 +48,7 @@ export const hooksPreEdit = {
                 fileType: ext || 'unknown',
                 relatedFiles: [],
                 suggestedAgents,
-                patterns: [
-                    { pattern: `${ext} file editing`, confidence: 0.85 },
-                ],
+                patterns: [{ pattern: `${ext} file editing`, confidence: 0.85 }],
                 risks: operation === 'delete' ? ['File deletion is irreversible'] : [],
             },
             recommendations: [
@@ -77,15 +76,12 @@ export const hooksPostEdit = {
         // Cap agent: stored in feedback record and forwarded to bridge.
         const MAX_POST_EDIT_PATH_LEN = 4 * 1024;
         const MAX_POST_EDIT_AGENT_LEN = 256;
-        const rawFilePath = params.filePath;
-        const filePath = typeof rawFilePath === 'string' && rawFilePath.length > MAX_POST_EDIT_PATH_LEN
-            ? rawFilePath.slice(0, MAX_POST_EDIT_PATH_LEN)
-            : rawFilePath;
+        const filePath = validateMcpString(params.filePath, 'filePath', MAX_POST_EDIT_PATH_LEN);
+        if (!filePath) {
+            return { error: 'filePath is required (non-empty string, no control chars, max 4KB)' };
+        }
         const success = params.success !== false;
-        const rawAgent = params.agent;
-        const agent = typeof rawAgent === 'string' && rawAgent.length > MAX_POST_EDIT_AGENT_LEN
-            ? rawAgent.slice(0, MAX_POST_EDIT_AGENT_LEN)
-            : rawAgent;
+        const agent = validateMcpString(params.agent, 'agent', MAX_POST_EDIT_AGENT_LEN) ?? undefined;
         // Wire recordFeedback through bridge (issue #1209)
         let feedbackResult = null;
         try {
@@ -108,11 +104,13 @@ export const hooksPostEdit = {
             success,
             timestamp: new Date().toISOString(),
             learningUpdate: success ? 'pattern_reinforced' : 'pattern_adjusted',
-            feedback: feedbackResult ? {
-                recorded: feedbackResult.success,
-                controller: feedbackResult.success ? 'lancedb' : 'unavailable',
-                updates: feedbackResult.success ? 1 : 0,
-            } : { recorded: false, controller: 'unavailable', updates: 0 },
+            feedback: feedbackResult
+                ? {
+                    recorded: feedbackResult.success,
+                    controller: feedbackResult.success ? 'sqlite' : 'unavailable',
+                    updates: feedbackResult.success ? 1 : 0,
+                }
+                : { recorded: false, controller: 'unavailable', updates: 0 },
         };
     },
 };
@@ -131,14 +129,17 @@ export const hooksPreCommand = {
         // raw command is reflected verbatim in the response.  Limit to 4 KB which
         // is far beyond any realistic shell command.
         const MAX_CMD_LEN = 4 * 1024;
-        const rawCommand = params.command;
-        const command = typeof rawCommand === 'string' && rawCommand.length > MAX_CMD_LEN
-            ? rawCommand.slice(0, MAX_CMD_LEN)
-            : rawCommand;
+        const command = validateMcpString(params.command, 'command', MAX_CMD_LEN);
+        if (!command) {
+            return { error: 'command is required (non-empty string, no control chars, max 4KB)' };
+        }
         const assessment = assessCommandRisk(command);
-        const riskLevel = assessment.level >= 0.8 ? 'critical'
-            : assessment.level >= 0.6 ? 'high'
-                : assessment.level >= 0.3 ? 'medium'
+        const riskLevel = assessment.level >= 0.8
+            ? 'critical'
+            : assessment.level >= 0.6
+                ? 'high'
+                : assessment.level >= 0.3
+                    ? 'medium'
                     : 'low';
         return {
             command,
@@ -174,11 +175,13 @@ export const hooksPostCommand = {
         // already caps to 200 chars; apply a consistent 4 KB cap here that still
         // covers any realistic shell command.
         const MAX_POST_CMD_LEN = 4 * 1024;
-        const rawPostCommand = params.command;
-        const command = typeof rawPostCommand === 'string' && rawPostCommand.length > MAX_POST_CMD_LEN
-            ? rawPostCommand.slice(0, MAX_POST_CMD_LEN)
-            : rawPostCommand;
-        const exitCode = params.exitCode || 0;
+        const command = validateMcpString(params.command, 'command', MAX_POST_CMD_LEN);
+        if (!command) {
+            return { error: 'command is required (non-empty string, no control chars, max 4KB)' };
+        }
+        const exitCode = typeof params.exitCode === 'number' && Number.isFinite(params.exitCode)
+            ? Math.floor(params.exitCode)
+            : 0;
         const success = exitCode === 0;
         // Record the real exit code in the time-windowed command-outcome store so
         // post-task can derive a MEASURED success signal (grounded in actual exit
@@ -198,14 +201,19 @@ export const hooksPostCommand = {
                 namespace: 'commands',
                 tags: [success ? 'success' : 'error'],
             });
-            _storedIn = 'lancedb';
+            _storedIn = 'sqlite';
         }
         catch {
             // memory backend unavailable — store in JSON
             try {
                 const store = loadMemoryStore();
                 const key = `cmd-${Date.now()}`;
-                store.entries[key] = { key, value: JSON.stringify({ command, exitCode, success }), namespace: 'commands', createdAt: new Date().toISOString() };
+                store.entries[key] = {
+                    key,
+                    value: JSON.stringify({ command, exitCode, success }),
+                    namespace: 'commands',
+                    createdAt: new Date().toISOString(),
+                };
                 const memDir = join(getProjectCwd(), MEMORY_DIR);
                 if (!existsSync(memDir))
                     mkdirSync(memDir, { recursive: true });
@@ -215,7 +223,9 @@ export const hooksPostCommand = {
                 renameSync(_mptmp, _mp);
                 _storedIn = 'json-store';
             }
-            catch { /* non-critical */ }
+            catch {
+                /* non-critical */
+            }
         }
         return {
             recorded: _storedIn !== 'none',
@@ -235,7 +245,10 @@ export const hooksRoute = {
         properties: {
             task: { type: 'string', description: 'Task description' },
             context: { type: 'string', description: 'Additional context' },
-            useSemanticRouter: { type: 'boolean', description: 'Use semantic similarity routing (default: true)' },
+            useSemanticRouter: {
+                type: 'boolean',
+                description: 'Use semantic similarity routing (default: true)',
+            },
         },
         required: ['task'],
     },
@@ -245,14 +258,11 @@ export const hooksRoute = {
         // route-outcomes.jsonl.  16 KB matches the cap in hooksPatternSearch.
         const MAX_ROUTE_TASK_LEN = 16 * 1024;
         const MAX_ROUTE_CTX_LEN = 4 * 1024;
-        const rawTask = params.task;
-        const task = typeof rawTask === 'string' && rawTask.length > MAX_ROUTE_TASK_LEN
-            ? rawTask.slice(0, MAX_ROUTE_TASK_LEN)
-            : rawTask;
-        const rawContext = params.context;
-        const context = typeof rawContext === 'string' && rawContext.length > MAX_ROUTE_CTX_LEN
-            ? rawContext.slice(0, MAX_ROUTE_CTX_LEN)
-            : rawContext;
+        const task = validateMcpString(params.task, 'task', MAX_ROUTE_TASK_LEN);
+        if (!task) {
+            return { error: 'task is required (non-empty string, no control chars, max 16KB)' };
+        }
+        const context = validateMcpString(params.context, 'context', MAX_ROUTE_CTX_LEN) ?? undefined;
         const useSemanticRouter = params.useSemanticRouter !== false;
         // Phase 5: Try memory backend SemanticRouter / LearningSystem first
         if (useSemanticRouter) {
@@ -265,7 +275,7 @@ export const hooksRoute = {
                     if (routeConfidence > 0.5) {
                         const agents = memoryRoute.routes.map((r) => r.agentType);
                         const complexity = task.length > 200 ? 'high' : task.length < 50 ? 'low' : 'medium';
-                        const memoryMethod = 'memory-lancedb';
+                        const memoryMethod = 'memory-sqlite';
                         const memoryConfidence = Math.round(routeConfidence * 100) / 100;
                         const matchedPattern = topRoute.pattern ?? task.slice(0, 60);
                         // Record the route recommendation so post-task can join the actual outcome
@@ -284,7 +294,7 @@ export const hooksRoute = {
                             task,
                             routing: {
                                 method: memoryMethod,
-                                backend: 'lancedb',
+                                backend: 'sqlite',
                                 latencyMs: 0,
                                 throughput: 'N/A',
                             },
@@ -293,19 +303,25 @@ export const hooksRoute = {
                             primaryAgent: {
                                 type: agents[0],
                                 confidence: memoryConfidence,
-                                reason: `memory:lancedb: "${matchedPattern}" (${Math.round(routeConfidence * 100)}%)`,
+                                reason: `memory:sqlite: "${matchedPattern}" (${Math.round(routeConfidence * 100)}%)`,
                             },
                             alternativeAgents: agents.slice(1).map((agent, i) => ({
                                 type: agent,
-                                confidence: Math.round((routeConfidence - (0.1 * (i + 1))) * 100) / 100,
-                                reason: 'Alternative from lancedb',
+                                confidence: Math.round((routeConfidence - 0.1 * (i + 1)) * 100) / 100,
+                                reason: 'Alternative from sqlite',
                             })),
                             estimatedMetrics: {
                                 successProbability: memoryConfidence,
-                                estimatedDuration: complexity === 'high' ? '2-4 hours' : complexity === 'medium' ? '30-60 min' : '10-30 min',
+                                estimatedDuration: complexity === 'high'
+                                    ? '2-4 hours'
+                                    : complexity === 'medium'
+                                        ? '30-60 min'
+                                        : '10-30 min',
                                 complexity,
                             },
-                            swarmRecommendation: agents.length > 2 ? { topology: 'hierarchical', agents, coordination: 'queen-led' } : null,
+                            swarmRecommendation: agents.length > 2
+                                ? { topology: 'hierarchical', agents, coordination: 'queen-led' }
+                                : null,
                         };
                     }
                 }
@@ -338,8 +354,11 @@ export const hooksRoute = {
             if (intelSuggestion && intelSuggestion.confidence > 0.5) {
                 // Prepend neural agents (deduped) and boost confidence
                 const existingSet = new Set(agents);
-                const neuralOnly = intelSuggestion.agents.filter(a => !existingSet.has(a));
-                agents = [...intelSuggestion.agents, ...agents.filter(a => !new Set(intelSuggestion.agents).has(a))];
+                const neuralOnly = intelSuggestion.agents.filter((a) => !existingSet.has(a));
+                agents = [
+                    ...intelSuggestion.agents,
+                    ...agents.filter((a) => !new Set(intelSuggestion.agents).has(a)),
+                ];
                 const neuralWeight = intelSuggestion.confidence > 0.7 ? 0.65 : 0.5;
                 const keywordWeight = 1 - neuralWeight;
                 confidence = Math.min(0.95, intelSuggestion.confidence * neuralWeight +
@@ -379,7 +398,7 @@ export const hooksRoute = {
                 throughput: routingLatencyMs > 0 ? `${Math.round(1000 / routingLatencyMs)} routes/s` : 'N/A',
             },
             matchedPattern,
-            semanticMatches: semanticResult.slice(0, 3).map(r => ({
+            semanticMatches: semanticResult.slice(0, 3).map((r) => ({
                 pattern: r.intent,
                 score: Math.round(r.score * 100) / 100,
             })),
@@ -392,7 +411,7 @@ export const hooksRoute = {
             },
             alternativeAgents: agents.slice(1).map((agent, i) => ({
                 type: agent,
-                confidence: Math.round((confidence - (0.1 * (i + 1))) * 100) / 100,
+                confidence: Math.round((confidence - 0.1 * (i + 1)) * 100) / 100,
                 reason: `Alternative agent for ${agent} capabilities`,
             })),
             estimatedMetrics: {
@@ -400,11 +419,13 @@ export const hooksRoute = {
                 estimatedDuration: complexity === 'high' ? '2-4 hours' : complexity === 'medium' ? '30-60 min' : '10-30 min',
                 complexity,
             },
-            swarmRecommendation: agents.length > 2 ? {
-                topology: 'hierarchical',
-                agents,
-                coordination: 'queen-led',
-            } : null,
+            swarmRecommendation: agents.length > 2
+                ? {
+                    topology: 'hierarchical',
+                    agents,
+                    coordination: 'queen-led',
+                }
+                : null,
         };
     },
 };
@@ -419,19 +440,19 @@ export const hooksRouteSemantic = {
         type: 'object',
         properties: {
             task: { type: 'string', description: 'Task description' },
-            debug: { type: 'boolean', description: 'Include all route scores in the response (default: false)' },
+            debug: {
+                type: 'boolean',
+                description: 'Include all route scores in the response (default: false)',
+            },
         },
         required: ['task'],
     },
     handler: async (params) => {
         const MAX_ROUTE_TASK_LEN = 2000; // matches route-layer-factory's MAX_TASK_LENGTH
-        const rawTask = params.task;
-        const task = typeof rawTask === 'string' && rawTask.length > MAX_ROUTE_TASK_LEN
-            ? rawTask.slice(0, MAX_ROUTE_TASK_LEN)
-            : rawTask;
+        const task = validateMcpString(params.task, 'task', MAX_ROUTE_TASK_LEN);
         const debug = params.debug === true;
-        if (!task || typeof task !== 'string') {
-            throw new Error('task is required');
+        if (!task) {
+            throw new Error('task is required (non-empty string, no control chars, max 2000 chars)');
         }
         const { createConfiguredRouteLayer } = await import('../routing/route-layer-factory.js');
         const layer = await createConfiguredRouteLayer({ debug });
@@ -445,7 +466,9 @@ export const hooksRouteSemantic = {
             routingMethod: `routing-pkg:${result.method}`,
             confidence: result.confidence,
             learningMode: 'js',
-        }).catch(() => { });
+        }).catch(() => {
+            /* non-fatal — outcome joining is best-effort */
+        });
         return { routeId, task, ...result };
     },
 };
@@ -460,14 +483,14 @@ export const hooksMetrics = {
         },
     },
     handler: async (params) => {
-        const period = params.period || '24h';
+        const period = validateMcpString(params.period, 'period', 32) ?? '24h';
         // Try to read real counts from memory store
         const store = loadMemoryStore();
         const entries = Object.values(store.entries);
         // Count patterns by looking at stored pattern entries
-        const patternEntries = entries.filter(e => e.key.includes('pattern'));
-        const routingEntries = entries.filter(e => e.key.includes('route') || e.key.includes('routing'));
-        const taskEntries = entries.filter(e => e.key.includes('task'));
+        const patternEntries = entries.filter((e) => e.key.includes('pattern'));
+        const routingEntries = entries.filter((e) => e.key.includes('route') || e.key.includes('routing'));
+        const taskEntries = entries.filter((e) => e.key.includes('task'));
         if (entries.length === 0) {
             return {
                 _real: true,
@@ -568,23 +591,25 @@ export const hooksPreTask = {
         // in causal-graph edges persisted to SQLite. An uncapped ID can inflate the DB key
         // column and every JSON payload that includes the ID.
         const MAX_TASK_ID_LEN = 256;
-        const rawTaskId = params.taskId;
-        const taskId = typeof rawTaskId === 'string' && rawTaskId.length > MAX_TASK_ID_LEN
-            ? rawTaskId.slice(0, MAX_TASK_ID_LEN)
-            : rawTaskId;
+        const taskId = validateMcpString(params.taskId, 'taskId', MAX_TASK_ID_LEN);
+        if (!taskId) {
+            return { error: 'taskId is required (non-empty string, no control chars, max 256 chars)' };
+        }
         // Cap description: it is forwarded to generateEmbedding twice (ERL heuristics
         // + TextGrad gradient queries) and used in O(n) keyword extraction.
         // 16 KB matches the cap applied in hooks_route and hooksPatternSearch.
         const MAX_PRE_TASK_DESC_LEN = 16 * 1024;
-        const rawDescription = params.description;
-        const description = typeof rawDescription === 'string' && rawDescription.length > MAX_PRE_TASK_DESC_LEN
-            ? rawDescription.slice(0, MAX_PRE_TASK_DESC_LEN)
-            : rawDescription;
-        const filePath = params.filePath;
+        const description = validateMcpString(params.description, 'description', MAX_PRE_TASK_DESC_LEN);
+        if (!description) {
+            return { error: 'description is required (non-empty string, no control chars, max 16KB)' };
+        }
+        const filePath = validateMcpString(params.filePath, 'filePath', 4 * 1024) ?? undefined;
         const suggestion = suggestAgentsForTask(description);
         // Determine complexity
         const descLower = description.toLowerCase();
-        const complexity = descLower.includes('complex') || descLower.includes('architecture') || description.length > 200
+        const complexity = descLower.includes('complex') ||
+            descLower.includes('architecture') ||
+            description.length > 200
             ? 'high'
             : descLower.includes('simple') || descLower.includes('fix') || description.length < 50
                 ? 'low'
@@ -603,14 +628,16 @@ export const hooksPreTask = {
                     limit: 3,
                     threshold: 0.6,
                 });
-                for (const r of (heuristicResults?.results ?? [])) {
+                for (const r of heuristicResults?.results ?? []) {
                     try {
                         const h = JSON.parse(r.content ?? '{}');
                         if (h.action && h.confidence !== undefined && h.confidence >= 0.6) {
                             erlHints.push(`ERL hint (conf=${h.confidence.toFixed(2)}): use "${h.action}" for tasks involving "${h.condition ?? 'similar context'}"`);
                         }
                     }
-                    catch { /* skip malformed */ }
+                    catch {
+                        /* skip malformed */
+                    }
                 }
                 // TextGrad: also inject relevant past failure gradients to guide away from known pitfalls
                 // Source: https://arxiv.org/abs/2406.07496
@@ -620,7 +647,7 @@ export const hooksPreTask = {
                     limit: 2,
                     threshold: 0.55,
                 });
-                for (const r of (gradientResults?.results ?? [])) {
+                for (const r of gradientResults?.results ?? []) {
                     const critique = r.content ?? '';
                     if (critique && critique.length > 10) {
                         erlHints.push(`TextGrad warning: ${critique.slice(0, 120)}`);
@@ -628,18 +655,36 @@ export const hooksPreTask = {
                 }
             }
         }
-        catch { /* non-critical */ }
+        catch {
+            /* non-critical */
+        }
         // NOTE: a LATS planning pass used to be attempted here via
         // `import('@monoes/hooks').buildLATSPlan` — that function never existed
         // in the package (the planning module was removed), so the import failed
         // silently on every call. The dead block was removed.
         let plan;
+        // P2-15: Retrieve Reflexion reflections for this task — past failures
+        // on similar tasks are injected as recommendations so the agent avoids
+        // repeating mistakes. This closes the self-learning loop.
+        let reflexionWarnings = [];
+        try {
+            const hooksPkg = await import('@monoes/hooks').catch(() => null);
+            const fn = hooksPkg?.getReflectionsForTask;
+            if (typeof fn === 'function') {
+                const cwd = process.cwd();
+                const reflections = await fn(cwd, description, 3);
+                reflexionWarnings = reflections.map(r => `⚠ Past failure: ${r.reflection.slice(0, 200)}`);
+            }
+        }
+        catch {
+            /* non-critical — reflexion store may not exist yet */
+        }
         return {
             taskId,
             description,
             suggestedAgents: suggestion.agents.map((agent, i) => ({
                 type: agent,
-                confidence: suggestion.confidence - (0.05 * i),
+                confidence: suggestion.confidence - 0.05 * i,
                 reason: i === 0
                     ? `Primary agent for ${agent} tasks based on learned patterns`
                     : `Alternative agent with ${agent} capabilities`,
@@ -649,8 +694,11 @@ export const hooksPreTask = {
             risks: complexity === 'high' ? ['Complex task may require multiple iterations'] : [],
             recommendations: [
                 `Use ${suggestion.agents[0]} as primary agent`,
-                suggestion.agents.length > 2 ? 'Consider using swarm coordination' : 'Single agent recommended',
+                suggestion.agents.length > 2
+                    ? 'Consider using swarm coordination'
+                    : 'Single agent recommended',
                 ...erlHints,
+                ...reflexionWarnings,
             ],
             modelRouting,
             plan,
@@ -668,9 +716,15 @@ export const hooksPostTask = {
             success: { type: 'boolean', description: 'Whether task was successful' },
             agent: { type: 'string', description: 'Agent that completed the task' },
             quality: { type: 'number', description: 'Quality score (0-1)' },
-            task: { type: 'string', description: 'Task description text (used for learning keyword extraction)' },
+            task: {
+                type: 'string',
+                description: 'Task description text (used for learning keyword extraction)',
+            },
             storeDecisions: { type: 'boolean', description: 'Also store routing decision in memory DB' },
-            routeId: { type: 'string', description: 'Route ID from a prior hooks_route call — joins the recommendation to this outcome' },
+            routeId: {
+                type: 'string',
+                description: 'Route ID from a prior hooks_route call — joins the recommendation to this outcome',
+            },
         },
         required: ['taskId'],
     },
@@ -680,10 +734,10 @@ export const hooksPostTask = {
         // into causal-graph edge IDs persisted to the DB.  Without a cap an attacker can
         // inflate every row that stores the raw ID.
         const MAX_POST_TASK_ID_LEN = 256;
-        const rawPostTaskId = params.taskId;
-        const taskId = typeof rawPostTaskId === 'string' && rawPostTaskId.length > MAX_POST_TASK_ID_LEN
-            ? rawPostTaskId.slice(0, MAX_POST_TASK_ID_LEN)
-            : rawPostTaskId;
+        const taskId = validateMcpString(params.taskId, 'taskId', MAX_POST_TASK_ID_LEN);
+        if (!taskId) {
+            return { error: 'taskId is required (non-empty string, no control chars, max 256 chars)' };
+        }
         // The success flag, when the caller asserts it (--success true), is taken as
         // ground truth. But callers usually do NOT pass it. Rather than treating every
         // unverified task as "unknown" (and thus excluding it from learning), we now
@@ -702,7 +756,9 @@ export const hooksPostTask = {
         const explicitSuccess = typeof params.success === 'boolean';
         let outcomeKnown = explicitSuccess;
         let success = params.success !== false;
-        let successSource = explicitSuccess ? 'explicit' : 'unknown';
+        let successSource = explicitSuccess
+            ? 'explicit'
+            : 'unknown';
         if (!explicitSuccess) {
             const derived = await deriveRecentSuccess(getRouteOutcomesBaseDir());
             if (derived !== null) {
@@ -715,19 +771,17 @@ export const hooksPostTask = {
         // feedback record and used as a tag string in the JSON store.  An uncapped
         // agent value inflates the on-disk store entry.
         const MAX_POST_TASK_AGENT_LEN = 256;
-        const rawPostTaskAgent = params.agent;
-        const agent = typeof rawPostTaskAgent === 'string' && rawPostTaskAgent.length > MAX_POST_TASK_AGENT_LEN
-            ? rawPostTaskAgent.slice(0, MAX_POST_TASK_AGENT_LEN)
-            : rawPostTaskAgent;
-        const quality = params.quality || (success ? 0.85 : 0.3);
+        const agent = validateMcpString(params.agent, 'agent', MAX_POST_TASK_AGENT_LEN) ?? undefined;
+        const quality = typeof params.quality === 'number' && Number.isFinite(params.quality)
+            ? Math.max(0, Math.min(1, params.quality))
+            : success
+                ? 0.85
+                : 0.3;
         const startTime = Date.now();
         // Cap task description: passed to generateEmbedding via bridgeRecordFeedback
         // and persisted to route-outcomes.jsonl.  16 KB matches hooks_route cap.
         const MAX_POST_TASK_LEN = 16 * 1024;
-        const rawPostTask = params.task;
-        const cappedPostTask = typeof rawPostTask === 'string' && rawPostTask.length > MAX_POST_TASK_LEN
-            ? rawPostTask.slice(0, MAX_POST_TASK_LEN)
-            : rawPostTask;
+        const cappedPostTask = validateMcpString(params.task, 'task', MAX_POST_TASK_LEN) ?? undefined;
         // Phase 3: Wire recordFeedback through bridge → LearningSystem + ReasoningBank
         let feedbackResult = null;
         try {
@@ -735,9 +789,19 @@ export const hooksPostTask = {
             feedbackResult = await bridge.bridgeRecordFeedback({
                 taskType: agent ?? 'task',
                 action: cappedPostTask?.slice(0, 80) ?? taskId,
-                outcome: success ? 'success' : (outcomeKnown ? 'failure' : 'partial'),
+                outcome: success ? 'success' : outcomeKnown ? 'failure' : 'partial',
                 confidence: quality,
-                metadata: { taskId, duration: params.duration || undefined, patterns: params.patterns || undefined },
+                metadata: {
+                    taskId,
+                    duration: typeof params.duration === 'number' && Number.isFinite(params.duration)
+                        ? params.duration
+                        : undefined,
+                    patterns: Array.isArray(params.patterns)
+                        ? params.patterns
+                            .filter((p) => typeof p === 'string' && p.length > 0 && p.length <= 200)
+                            .slice(0, 50)
+                        : undefined,
+                },
             });
         }
         catch (e) {
@@ -767,7 +831,11 @@ export const hooksPostTask = {
         const taskText = cappedPostTask || '';
         const outcomeKeywords = extractKeywords(taskText);
         let outcomePersisted = false;
-        if (outcomeKnown && taskText && agent && agent.length <= 100 && /^[a-zA-Z0-9_-]+$/.test(agent)) {
+        if (outcomeKnown &&
+            taskText &&
+            agent &&
+            agent.length <= 100 &&
+            /^[a-zA-Z0-9_-]+$/.test(agent)) {
             try {
                 const outcomes = loadRoutingOutcomes();
                 outcomes.push({
@@ -781,7 +849,9 @@ export const hooksPostTask = {
                 saveRoutingOutcomes(outcomes);
                 outcomePersisted = true;
             }
-            catch { /* non-critical */ }
+            catch {
+                /* non-critical */
+            }
         }
         // Join this outcome back onto the original route recommendation. This is the
         // recommendation→actual→success link that routing-accuracy metrics and SONA
@@ -797,7 +867,10 @@ export const hooksPostTask = {
                 quality: typeof params.quality === 'number' ? params.quality : undefined,
             };
             if (params.routeId) {
-                await joinOutcome(getRouteOutcomesBaseDir(), params.routeId, outcome);
+                const routeId = validateMcpString(params.routeId, 'routeId', 256);
+                if (routeId) {
+                    await joinOutcome(getRouteOutcomesBaseDir(), routeId, outcome);
+                }
             }
             else {
                 await joinLatestUnresolved(getRouteOutcomesBaseDir(), outcome);
@@ -822,7 +895,9 @@ export const hooksPostTask = {
                     });
                 }
             }
-            catch { /* non-critical */ }
+            catch {
+                /* non-critical */
+            }
         }
         // Optionally store in memory DB for cross-session vector retrieval
         if (params.storeDecisions && taskText && agent) {
@@ -832,12 +907,20 @@ export const hooksPostTask = {
                     await storeFn({
                         key: `routing-decision:${taskId}`,
                         namespace: 'patterns',
-                        value: JSON.stringify({ task: taskText, agent, success, quality, keywords: outcomeKeywords }),
+                        value: JSON.stringify({
+                            task: taskText,
+                            agent,
+                            success,
+                            quality,
+                            keywords: outcomeKeywords,
+                        }),
                         tags: ['routing-decision'],
                     });
                 }
             }
-            catch { /* non-critical */ }
+            catch {
+                /* non-critical */
+            }
         }
         const duration = Date.now() - startTime;
         // TextGrad: Store textual gradient critique for failed tasks
@@ -857,21 +940,28 @@ export const hooksPostTask = {
                     });
                 }
             }
-            catch { /* non-critical */ }
+            catch {
+                /* non-critical */
+            }
         }
         // MAR: Structured multi-agent reflection on failure
         // Source: https://arxiv.org/html/2512.20845 (MAR — December 2025)
-        const marReflection = !success ? {
-            needed: true,
-            suggestedAgents: [
-                { role: 'diagnoser', description: 'Analyze root cause of task failure' },
-                { role: 'critic-1', description: 'Critique from correctness angle (temperature 0.3)' },
-                { role: 'critic-2', description: 'Critique from efficiency angle (temperature 0.8)' },
-                { role: 'aggregator', description: 'Synthesize critiques into actionable reflection heuristic' },
-            ],
-            storeAs: 'heuristics',
-            note: 'Spawn agents sequentially: Diagnoser → Critics in parallel → Aggregator',
-        } : { needed: false };
+        const marReflection = !success
+            ? {
+                needed: true,
+                suggestedAgents: [
+                    { role: 'diagnoser', description: 'Analyze root cause of task failure' },
+                    { role: 'critic-1', description: 'Critique from correctness angle (temperature 0.3)' },
+                    { role: 'critic-2', description: 'Critique from efficiency angle (temperature 0.8)' },
+                    {
+                        role: 'aggregator',
+                        description: 'Synthesize critiques into actionable reflection heuristic',
+                    },
+                ],
+                storeAs: 'heuristics',
+                note: 'Spawn agents sequentially: Diagnoser → Critics in parallel → Aggregator',
+            }
+            : { needed: false };
         return {
             taskId,
             success,
@@ -882,15 +972,17 @@ export const hooksPostTask = {
                 patternsUpdated: feedbackResult?.success ? (success ? 2 : 1) : 0,
                 newPatterns: success ? 1 : 0,
                 trajectoryId: `traj-${Date.now()}`,
-                controller: feedbackResult?.success ? 'lancedb' : 'none',
+                controller: feedbackResult?.success ? 'sqlite' : 'none',
                 outcomePersisted,
             },
             quality,
-            feedback: feedbackResult ? {
-                recorded: feedbackResult.success,
-                controller: feedbackResult.success ? 'lancedb' : 'unavailable',
-                updates: feedbackResult.success ? 1 : 0,
-            } : { recorded: false, controller: 'unavailable', updates: 0 },
+            feedback: feedbackResult
+                ? {
+                    recorded: feedbackResult.success,
+                    controller: feedbackResult.success ? 'sqlite' : 'unavailable',
+                    updates: feedbackResult.success ? 1 : 0,
+                }
+                : { recorded: false, controller: 'unavailable', updates: 0 },
             marReflection,
             timestamp: new Date().toISOString(),
         };
@@ -913,10 +1005,10 @@ export const hooksExplain = {
         // Cap task: forwarded to suggestAgentsForTask (O(n) keyword loop + extractKeywords),
         // .toLowerCase() (O(n)), and reflected verbatim in the response.
         const MAX_EXPLAIN_TASK_LEN = 16 * 1024;
-        const rawExplainTask = params.task;
-        const task = typeof rawExplainTask === 'string' && rawExplainTask.length > MAX_EXPLAIN_TASK_LEN
-            ? rawExplainTask.slice(0, MAX_EXPLAIN_TASK_LEN)
-            : rawExplainTask;
+        const task = validateMcpString(params.task, 'task', MAX_EXPLAIN_TASK_LEN);
+        if (!task) {
+            return { error: 'task is required (non-empty string, no control chars, max 16KB)' };
+        }
         const suggestion = suggestAgentsForTask(task);
         const taskLower = task.toLowerCase();
         // Determine matched patterns
@@ -939,7 +1031,7 @@ export const hooksExplain = {
                 const data = JSON.parse(readFileSync(outcomesPath, 'utf-8'));
                 const outcomes = data.outcomes || [];
                 if (outcomes.length > 0) {
-                    historicalSuccess = outcomes.filter(o => o.success).length / outcomes.length;
+                    historicalSuccess = outcomes.filter((o) => o.success).length / outcomes.length;
                     historicalNote = `Calculated from ${outcomes.length} recorded outcomes`;
                 }
             }
@@ -954,14 +1046,40 @@ export const hooksExplain = {
             explanation: `The routing decision was made based on keyword analysis of the task description. ` +
                 `The task contains keywords that match the "${suggestion.agents[0]}" specialization with ${(suggestion.confidence * 100).toFixed(0)}% confidence.`,
             factors: [
-                { factor: 'Keyword Match', weight: 0.4, value: suggestion.confidence, impact: 'Primary routing signal' },
-                { factor: 'Historical Success', weight: 0.3, value: historicalSuccess, impact: historicalNote },
-                { factor: 'Agent Availability', weight: 0.2, value: null, impact: 'Agent availability tracking not implemented' },
-                { factor: 'Task Complexity', weight: 0.1, value: task.length > 100 ? 0.8 : 0.3, impact: 'Complexity assessment' },
-            ],
-            patterns: matchedPatterns.length > 0 ? matchedPatterns : [
-                { pattern: 'general-task', matchScore: 0.7, examples: ['Default pattern for unclassified tasks'] }
+                {
+                    factor: 'Keyword Match',
+                    weight: 0.4,
+                    value: suggestion.confidence,
+                    impact: 'Primary routing signal',
+                },
+                {
+                    factor: 'Historical Success',
+                    weight: 0.3,
+                    value: historicalSuccess,
+                    impact: historicalNote,
+                },
+                {
+                    factor: 'Agent Availability',
+                    weight: 0.2,
+                    value: null,
+                    impact: 'Agent availability tracking not implemented',
+                },
+                {
+                    factor: 'Task Complexity',
+                    weight: 0.1,
+                    value: task.length > 100 ? 0.8 : 0.3,
+                    impact: 'Complexity assessment',
+                },
             ],
+            patterns: matchedPatterns.length > 0
+                ? matchedPatterns
+                : [
+                    {
+                        pattern: 'general-task',
+                        matchScore: 0.7,
+                        examples: ['Default pattern for unclassified tasks'],
+                    },
+                ],
             decision: {
                 agent: suggestion.agents[0],
                 confidence: suggestion.confidence,
@@ -990,12 +1108,16 @@ export const hooksPretrain = {
         },
     },
     handler: async (params) => {
-        const repoPath = resolve(params.path || '.');
+        const repoPath = resolve(validateMcpString(params.path, 'path', 4 * 1024) ?? '.');
         const projectRoot = getProjectCwd();
         if (repoPath !== projectRoot && !repoPath.startsWith(projectRoot + sep)) {
             return { error: 'Invalid path: must be within the project directory.' };
         }
-        const depth = params.depth || 'medium';
+        const depth = validateMcpString(params.depth, 'depth', 16) ?? 'medium';
+        const allowedDepths = new Set(['shallow', 'medium', 'deep']);
+        if (!allowedDepths.has(depth)) {
+            return { error: 'Invalid depth: must be shallow, medium, or deep' };
+        }
         const startTime = performance.now();
         // Real file scanning — count files by extension, extract patterns
         const { readdirSync, statSync } = await import('node:fs');
@@ -1017,7 +1139,9 @@ export const hooksPretrain = {
                         scan(full, currentDepth + 1);
                     }
                     else if (entry.isFile()) {
-                        const ext = entry.name.includes('.') ? entry.name.slice(entry.name.lastIndexOf('.')) : '';
+                        const ext = entry.name.includes('.')
+                            ? entry.name.slice(entry.name.lastIndexOf('.'))
+                            : '';
                         if (ext)
                             extCounts[ext] = (extCounts[ext] || 0) + 1;
                         filesAnalyzed++;
@@ -1036,7 +1160,9 @@ export const hooksPretrain = {
                                 // Extract import patterns (first 50 files max for performance)
                                 if (filesAnalyzed <= 50) {
                                     for (const line of lines.slice(0, 30)) {
-                                        if (line.startsWith('import ') || line.startsWith('from ') || line.startsWith('const ') && line.includes('require(')) {
+                                        if (line.startsWith('import ') ||
+                                            line.startsWith('from ') ||
+                                            (line.startsWith('const ') && line.includes('require('))) {
                                             const trimmed = line.trim();
                                             if (trimmed.length < 120 && !patterns.includes(trimmed))
                                                 patterns.push(trimmed);
@@ -1046,12 +1172,16 @@ export const hooksPretrain = {
                                     }
                                 }
                             }
-                            catch { /* skip unreadable */ }
+                            catch {
+                                /* skip unreadable */
+                            }
                         }
                     }
                 }
             }
-            catch { /* skip inaccessible dirs */ }
+            catch {
+                /* skip inaccessible dirs */
+            }
         };
         scan(repoPath, 0);
         const elapsed = Math.round(performance.now() - startTime);
@@ -1061,7 +1191,14 @@ export const hooksPretrain = {
             const bridge = await import('../memory/memory-bridge.js');
             await bridge.bridgeStoreEntry({
                 key: `pretrain-${Date.now()}`,
-                value: JSON.stringify({ filesAnalyzed, totalLines, topExtensions: Object.entries(extCounts).sort((a, b) => b[1] - a[1]).slice(0, 10), importPatterns: patterns.slice(0, 20) }),
+                value: JSON.stringify({
+                    filesAnalyzed,
+                    totalLines,
+                    topExtensions: Object.entries(extCounts)
+                        .sort((a, b) => b[1] - a[1])
+                        .slice(0, 10),
+                    importPatterns: patterns.slice(0, 20),
+                }),
                 namespace: 'pretrain',
                 tags: ['pretrain', depth],
             });
@@ -1078,13 +1215,20 @@ export const hooksPretrain = {
         if (patterns.length > 0) {
             try {
                 const intel = await import('../memory/intelligence.js');
-                await intel.initializeIntelligence({ confidenceLearningRate: 0.002, maxTrajectorySize: patterns.length });
+                await intel.initializeIntelligence({
+                    confidenceLearningRate: 0.002,
+                    maxTrajectorySize: patterns.length,
+                });
                 // Record each extracted pattern as an action step
                 for (const pat of patterns.slice(0, 50)) {
-                    await intel.recordStep({ type: 'action', content: pat, metadata: { source: 'pretrain', depth } });
+                    await intel.recordStep({
+                        type: 'action',
+                        content: pat,
+                        metadata: { source: 'pretrain', depth },
+                    });
                 }
                 // Record the entire scan as a completed trajectory
-                const steps = patterns.slice(0, 50).map(p => ({ type: 'action', content: p }));
+                const steps = patterns.slice(0, 50).map((p) => ({ type: 'action', content: p }));
                 await intel.recordTrajectory(steps, 'success');
                 intel.flushPatterns();
                 neuralPatternsLearned = steps.length;
@@ -1107,7 +1251,10 @@ export const hooksPretrain = {
                 patternsExtracted: patterns.length,
                 patternsStored,
                 neuralPatternsLearned,
-                fileTypes: Object.entries(extCounts).sort((a, b) => b[1] - a[1]).slice(0, 15).map(([ext, count]) => ({ ext, count })),
+                fileTypes: Object.entries(extCounts)
+                    .sort((a, b) => b[1] - a[1])
+                    .slice(0, 15)
+                    .map(([ext, count]) => ({ ext, count })),
             },
         };
     },
@@ -1120,38 +1267,68 @@ export const hooksBuildAgents = {
         type: 'object',
         properties: {
             outputDir: { type: 'string', description: 'Output directory for configs' },
-            focus: { type: 'string', description: 'Focus area (v1-implementation, security, performance, all)' },
+            focus: {
+                type: 'string',
+                description: 'Focus area (v1-implementation, security, performance, all)',
+            },
             format: { type: 'string', description: 'Config format (yaml, json)' },
             persist: { type: 'boolean', description: 'Write configs to disk' },
         },
     },
     handler: async (params) => {
-        const rawOutputDir = resolve(params.outputDir || './agents');
+        const rawOutputDir = resolve(validateMcpString(params.outputDir, 'outputDir', 4 * 1024) ?? './agents');
         const outputDir = rawOutputDir;
         if (!outputDir.startsWith(getProjectCwd() + sep) && outputDir !== getProjectCwd()) {
             return { error: 'Invalid outputDir: must be within the project directory.' };
         }
-        const focus = params.focus || 'all';
+        const focus = validateMcpString(params.focus, 'focus', 64) ?? 'all';
         // Strict allowlist on `format` — without this, `format = "yaml/../../../etc/cron.d/x"`
         // collapses through `join` and lets writes escape the validated outputDir.
         const ALLOWED_FORMATS = new Set(['yaml', 'json']);
-        const formatRaw = params.format || 'yaml';
-        if (!ALLOWED_FORMATS.has(formatRaw)) {
+        const format = validateMcpString(params.format, 'format', 16) ?? 'yaml';
+        if (!ALLOWED_FORMATS.has(format)) {
             return { error: 'Invalid format: must be yaml or json' };
         }
-        const format = formatRaw;
         const persist = params.persist !== false; // Default to true
         const agents = [
-            { type: 'coder', configFile: join(outputDir, `coder.${format}`), capabilities: ['code-generation', 'refactoring', 'debugging'], optimizations: ['token-reduction', 'context-caching'] },
-            { type: 'architect', configFile: join(outputDir, `architect.${format}`), capabilities: ['system-design', 'api-design', 'documentation'], optimizations: ['context-caching', 'memory-persistence'] },
-            { type: 'tester', configFile: join(outputDir, `tester.${format}`), capabilities: ['unit-testing', 'integration-testing', 'coverage'], optimizations: ['parallel-execution'] },
-            { type: 'security-architect', configFile: join(outputDir, `security-architect.${format}`), capabilities: ['threat-modeling', 'vulnerability-analysis', 'security-review'], optimizations: ['pattern-matching'] },
-            { type: 'reviewer', configFile: join(outputDir, `reviewer.${format}`), capabilities: ['code-review', 'quality-analysis', 'best-practices'], optimizations: ['incremental-analysis'] },
+            {
+                type: 'coder',
+                configFile: join(outputDir, `coder.${format}`),
+                capabilities: ['code-generation', 'refactoring', 'debugging'],
+                optimizations: ['token-reduction', 'context-caching'],
+            },
+            {
+                type: 'architect',
+                configFile: join(outputDir, `architect.${format}`),
+                capabilities: ['system-design', 'api-design', 'documentation'],
+                optimizations: ['context-caching', 'memory-persistence'],
+            },
+            {
+                type: 'tester',
+                configFile: join(outputDir, `tester.${format}`),
+                capabilities: ['unit-testing', 'integration-testing', 'coverage'],
+                optimizations: ['parallel-execution'],
+            },
+            {
+                type: 'security-architect',
+                configFile: join(outputDir, `security-architect.${format}`),
+                capabilities: ['threat-modeling', 'vulnerability-analysis', 'security-review'],
+                optimizations: ['pattern-matching'],
+            },
+            {
+                type: 'reviewer',
+                configFile: join(outputDir, `reviewer.${format}`),
+                capabilities: ['code-review', 'quality-analysis', 'best-practices'],
+                optimizations: ['incremental-analysis'],
+            },
         ];
-        const filteredAgents = focus === 'all' ? agents :
-            focus === 'security' ? agents.filter(a => a.type.includes('security') || a.type === 'reviewer') :
-                focus === 'performance' ? agents.filter(a => ['coder', 'tester'].includes(a.type)) :
-                    agents;
+        const filteredAgents = focus === 'all'
+            ? agents
+            : focus === 'security'
+                ? agents.filter((a) => a.type.includes('security') || a.type === 'reviewer')
+                : focus === 'performance'
+                    ? agents.filter((a) => ['coder', 'tester'].includes(a.type))
+                    : agents;
         // Persist configs to disk if requested
         if (persist) {
             // Ensure output directory exists
@@ -1169,7 +1346,7 @@ export const hooksBuildAgents = {
                 };
                 const content = format === 'json'
                     ? JSON.stringify(config, null, 2)
-                    : `# ${agent.type} agent configuration\ntype: ${agent.type}\nversion: "3.0.0"\ncapabilities:\n${agent.capabilities.map(c => `  - ${c}`).join('\n')}\noptimizations:\n${agent.optimizations.map(o => `  - ${o}`).join('\n')}\ncreatedAt: "${config.createdAt}"\n`;
+                    : `# ${agent.type} agent configuration\ntype: ${agent.type}\nversion: "3.0.0"\ncapabilities:\n${agent.capabilities.map((c) => `  - ${c}`).join('\n')}\noptimizations:\n${agent.optimizations.map((o) => `  - ${o}`).join('\n')}\ncreatedAt: "${config.createdAt}"\n`;
                 const _cftmp = agent.configFile + '.tmp';
                 writeFileSync(_cftmp, content, 'utf-8');
                 renameSync(_cftmp, agent.configFile);
@@ -1202,9 +1379,14 @@ export const hooksTransfer = {
         required: ['sourcePath'],
     },
     handler: async (params) => {
-        const sourcePath = params.sourcePath;
-        const minConfidence = params.minConfidence || 0.7;
-        const filter = params.filter;
+        const sourcePath = validateMcpString(params.sourcePath, 'sourcePath', 4 * 1024);
+        if (!sourcePath) {
+            return { error: 'sourcePath is required (non-empty string, no control chars, max 4KB)' };
+        }
+        const minConfidence = typeof params.minConfidence === 'number' && Number.isFinite(params.minConfidence)
+            ? Math.max(0, Math.min(1, params.minConfidence))
+            : 0.7;
+        const filter = validateMcpString(params.filter, 'filter', 64) ?? undefined;
         // Validate sourcePath is an existing directory before reading from it
         const resolvedSource = resolve(sourcePath);
         const { statSync } = await import('fs');
@@ -1227,7 +1409,8 @@ export const hooksTransfer = {
         let sourceStore = { entries: {}, version: '3.0.0' };
         const MAX_SOURCE_STORE_BYTES = 50 * 1024 * 1024; // 50 MB — matches other store readers
         try {
-            if (existsSync(sourceMemoryPath) && statSync(sourceMemoryPath).size <= MAX_SOURCE_STORE_BYTES) {
+            if (existsSync(sourceMemoryPath) &&
+                statSync(sourceMemoryPath).size <= MAX_SOURCE_STORE_BYTES) {
                 sourceStore = JSON.parse(readFileSync(sourceMemoryPath, 'utf-8'));
             }
         }
@@ -1239,13 +1422,13 @@ export const hooksTransfer = {
         const sourceEntries = Object.values(sourceStore.entries);
         // Count patterns by type from source
         const byType = {
-            'file-patterns': sourceEntries.filter(e => e.key.includes('file') || e.metadata?.type === 'file-pattern').length,
-            'task-routing': sourceEntries.filter(e => e.key.includes('routing') || e.metadata?.type === 'routing').length,
-            'command-risk': sourceEntries.filter(e => e.key.includes('command') || e.metadata?.type === 'command-risk').length,
-            'agent-success': sourceEntries.filter(e => e.key.includes('agent') || e.metadata?.type === 'agent-success').length,
+            'file-patterns': sourceEntries.filter((e) => e.key.includes('file') || e.metadata?.type === 'file-pattern').length,
+            'task-routing': sourceEntries.filter((e) => e.key.includes('routing') || e.metadata?.type === 'routing').length,
+            'command-risk': sourceEntries.filter((e) => e.key.includes('command') || e.metadata?.type === 'command-risk').length,
+            'agent-success': sourceEntries.filter((e) => e.key.includes('agent') || e.metadata?.type === 'agent-success').length,
         };
         // If source has no patterns, report honestly instead of substituting demo data
-        if (Object.values(byType).every(v => v === 0)) {
+        if (Object.values(byType).every((v) => v === 0)) {
             return {
                 success: false,
                 message: 'No patterns found in source project',
@@ -1254,7 +1437,7 @@ export const hooksTransfer = {
             };
         }
         if (filter) {
-            Object.keys(byType).forEach(key => {
+            Object.keys(byType).forEach((key) => {
                 if (!key.includes(filter))
                     delete byType[key];
             });
@@ -1283,8 +1466,8 @@ export const hooksSessionStart = {
         },
     },
     handler: async (params) => {
-        const sessionId = params.sessionId || `session-${Date.now()}`;
-        const restoreLatest = params.restoreLatest;
+        const sessionId = validateMcpString(params.sessionId, 'sessionId', 256) ?? `session-${Date.now()}`;
+        const restoreLatest = params.restoreLatest === true;
         // Phase 5: Wire ReflexionMemory session start via bridge
         let sessionMemory = null;
         try {
@@ -1295,7 +1478,7 @@ export const hooksSessionStart = {
             });
             if (result) {
                 sessionMemory = {
-                    controller: result.success ? 'lancedb' : 'none',
+                    controller: result.success ? 'sqlite' : 'none',
                     restoredPatterns: 0,
                 };
             }
@@ -1315,11 +1498,13 @@ export const hooksSessionStart = {
                 memoryPersistence: true,
             },
             sessionMemory: sessionMemory || { controller: 'none', restoredPatterns: 0 },
-            previousSession: restoreLatest ? {
-                id: `session-${Date.now() - 86400000}`,
-                tasksRestored: sessionMemory?.restoredPatterns || 0,
-                memoryRestored: sessionMemory?.restoredPatterns || 0,
-            } : null,
+            previousSession: restoreLatest
+                ? {
+                    id: `session-${Date.now() - 86400000}`,
+                    tasksRestored: sessionMemory?.restoredPatterns || 0,
+                    memoryRestored: sessionMemory?.restoredPatterns || 0,
+                }
+                : null,
         };
     },
 };
@@ -1338,12 +1523,18 @@ export const hooksSessionRestore = {
         type: 'object',
         properties: {
             sessionId: { type: 'string', description: 'Session ID to restore, or "latest"' },
-            restoreAgents: { type: 'boolean', description: 'Include a count of currently-live agents (default true)' },
-            restoreTasks: { type: 'boolean', description: 'Include a count of currently-live tasks (default true)' },
+            restoreAgents: {
+                type: 'boolean',
+                description: 'Include a count of currently-live agents (default true)',
+            },
+            restoreTasks: {
+                type: 'boolean',
+                description: 'Include a count of currently-live tasks (default true)',
+            },
         },
     },
     handler: async (params) => {
-        const originalSessionId = params.sessionId || 'latest';
+        const originalSessionId = validateMcpString(params.sessionId, 'sessionId', 256) ?? 'latest';
         const newSessionId = `session-${Date.now()}`;
         const warnings = [];
         let agentsRestored = 0;
@@ -1424,9 +1615,9 @@ export const hooksSessionEnd = {
         // Read actual counts from stores
         const store = loadMemoryStore();
         const allEntries = Object.values(store.entries);
-        const taskCount = allEntries.filter(e => e.key.includes('task')).length;
-        const agentCount = allEntries.filter(e => e.key.includes('agent')).length;
-        const patternCount = allEntries.filter(e => e.key.includes('pattern')).length;
+        const taskCount = allEntries.filter((e) => e.key.includes('task')).length;
+        const agentCount = allEntries.filter((e) => e.key.includes('agent')).length;
+        const patternCount = allEntries.filter((e) => e.key.includes('pattern')).length;
         const trajectoryCount = activeTrajectories.size;
         // Check for pending-insights.jsonl
         let insightCount = 0;
@@ -1451,7 +1642,7 @@ export const hooksSessionEnd = {
             });
             if (result) {
                 sessionPersistence = {
-                    controller: result.success ? 'lancedb' : 'none',
+                    controller: result.success ? 'sqlite' : 'none',
                     persisted: result.success,
                 };
             }
@@ -1521,7 +1712,7 @@ export const hooksIntelligence = {
         },
     },
     handler: async (params) => {
-        const mode = params.mode || 'balanced';
+        const mode = validateMcpString(params.mode, 'mode', 32) ?? 'balanced';
         const enableSona = params.enableSona !== false;
         const enableMoe = params.enableMoe !== false;
         const enableHnsw = params.enableHnsw !== false;
@@ -1591,14 +1782,24 @@ export const hooksIntelligence = {
             },
             implementationStatus: {
                 working: [
-                    'memory-store', 'embeddings', 'trajectory-recording', 'claims', 'swarm-coordination',
-                    'hnsw-index', 'pattern-storage', 'keyword-routing'
+                    'memory-store',
+                    'embeddings',
+                    'trajectory-recording',
+                    'claims',
+                    'swarm-coordination',
+                    'hnsw-index',
+                    'pattern-storage',
+                    'keyword-routing',
                 ],
                 partial: [],
                 notImplemented: [],
                 removed: [
-                    'moe-routing', 'flash-attention', 'lora-adapter',
-                    'native-sona-engine', 'native-router', 'native-attention',
+                    'moe-routing',
+                    'flash-attention',
+                    'lora-adapter',
+                    'native-sona-engine',
+                    'native-router',
+                    'native-attention',
                 ],
             },
             version: '3.0.0-alpha.102',