@monoes/monomindcli 2.9.21 → 2.9.23

package/.claude/commands/{swarm → monoswarm}/research.md

@@ -55,14 +55,14 @@ mcp__monomind__agent_spawn({ type: "documenter", capabilities: ["synthesis", "te
 
 ```javascript
 // Store research findings for future sessions
-mcp__monomind__memory_store({
+mcp__monomind__memory_pattern-store({
   key: "research-findings",
   value: "summary of findings",
   namespace: "research"
 })
 
 // Search existing research
-mcp__monomind__memory_search({
+mcp__monomind__memory_pattern-search({
   query: "topic X",
   namespace: "research",
   limit: 20

package/.claude/commands/monoswarm/spawn.md

@@ -0,0 +1,49 @@
+---
+name: monoswarm:spawn
+---
+
+# monoswarm spawn
+
+Write worker agent records into the agent store and register their ids on
+the monoswarm state file (combines `agent_spawn` + `monoswarm_join`).
+
+There is no `npx monomind monoswarm spawn` CLI command, and no `--claude`
+flag that launches Claude Code as a lead process — this tool creates
+bookkeeping entries only. No process, thread, or agent is started; real
+concurrency comes from Claude Code's Task tool.
+
+## MCP Tool
+
+```javascript
+mcp__monomind__monoswarm_agent_add({
+  count: 5,
+  role: "specialist",
+  agentType: "coder",
+  prefix: "monoswarm-worker"
+})
+```
+
+## Parameters
+
+| Param | Type | Default | Description |
+|---|---|---|---|
+| `count` | number | `1` | Number of workers to add (capped at 20 per call) |
+| `role` | string | `worker` | Worker role: `worker`, `specialist`, `scout` |
+| `agentType` | string | `worker` | Agent type for spawned workers (matches agent registry types) |
+| `prefix` | string | `monoswarm-worker` | Prefix for generated worker IDs |
+
+## Examples
+
+```javascript
+// Add 5 default workers
+mcp__monomind__monoswarm_agent_add({ count: 5 })
+
+// Add 3 specialists
+mcp__monomind__monoswarm_agent_add({ count: 3, role: "specialist" })
+
+// Add a coder-type worker with a custom ID prefix
+mcp__monomind__monoswarm_agent_add({ agentType: "coder", prefix: "my-coder" })
+```
+
+Requires the run to already be initialized via `monoswarm_init` — the
+handler returns `{ success: false }` otherwise.

package/.claude/commands/monoswarm/status.md

@@ -0,0 +1,48 @@
+---
+name: monoswarm:status
+---
+
+# monoswarm status
+
+Show monoswarm status: agent roster, task metrics, and (if voting is in
+use) pending/history proposals.
+
+```bash
+npx monomind@latest swarm status
+```
+
+Or, for the fuller vote/consensus view, as an MCP tool call:
+
+```javascript
+mcp__monomind__monoswarm_status({ verbose: true })
+```
+
+## Parameters
+
+| Param | Type | Default | Description |
+|---|---|---|---|
+| `verbose` | boolean | `false` | Include worker id list, recent vote history, and full shared-memory contents |
+
+## Examples
+
+```javascript
+// Basic status
+mcp__monomind__monoswarm_status({})
+
+// Verbose: adds workerDetails, voteHistory, sharedMemory
+mcp__monomind__monoswarm_status({ verbose: true })
+```
+
+## Output
+
+Basic status includes:
+- `runId`, `status` (`active` / `offline`), `topology`, `voteStrategy`
+- `lead`: id, status, load, queued task count, elected-at, term
+- `workers`: array of `{ id, type, status, tasksCompleted }` (`currentTask` is always `null` — the agent store has no such field)
+- `metrics`: total/completed/active/pending task counts (real, sourced from the task store), `voteRounds`, `memoryUsage`
+- `health`: overall/lead/workers/votes/memory status labels
+
+`verbose: true` adds:
+- `workerDetails` — raw worker id list
+- `voteHistory` — last 10 vote decisions
+- `sharedMemory` — full shared-memory object

package/.claude/commands/monoswarm/stop.md

@@ -0,0 +1,46 @@
+---
+name: monoswarm:stop
+---
+
+# monoswarm shutdown
+
+Clear monoswarm workers from the shared agent store and reset run state.
+
+```bash
+npx monomind@latest swarm stop
+```
+
+Or, as a direct MCP tool call (needed to also clear vote/consensus state):
+
+```javascript
+mcp__monomind__monoswarm_shutdown({ graceful: true, force: false })
+```
+
+## Parameters
+
+| Param | Type | Default | Description |
+|---|---|---|---|
+| `graceful` | boolean | `true` | If pending vote items exist, refuse to shut down unless `force: true` |
+| `force` | boolean | `false` | Override the graceful refusal above |
+
+There is no interactive confirmation prompt (this is a direct tool call, not
+a CLI), and no `saveState` option — vote history is always kept, shared
+memory is always cleared.
+
+## Examples
+
+```javascript
+// Graceful shutdown — fails if there are pending vote items
+mcp__monomind__monoswarm_shutdown({})
+
+// Force shutdown even with pending vote items
+mcp__monomind__monoswarm_shutdown({ force: true })
+```
+
+## Behavior
+
+Removes all worker ids from the agent store, then resets run state:
+`initialized: false`, no lead, empty worker list, cleared pending votes
+and shared memory. Vote history is retained on the state file. The
+response includes `workersTerminated`, `previousLead`, `votesCleared`,
+and a summary `message`.

package/.claude/commands/optimization/auto-topology.md

@@ -1,11 +1,11 @@
 ---
 name: optimization:auto-topology
-description: Automatically select the optimal swarm topology based on task complexity — use pre-task hook recommendations, swarm init flags, and performance optimize CLI
+description: Automatically select the optimal monoswarm topology based on task complexity — use pre-task hook recommendations, monoswarm init flags, and performance optimize CLI
 ---
 
 # Auto Topology Selection
 
-Automatically select the optimal swarm topology based on task complexity so you don't have to configure it manually.
+Automatically select the optimal monoswarm topology based on task complexity so you don't have to configure it manually.
 
 ## How It Works
 
@@ -19,29 +19,29 @@ npx monomind hooks pre-task -d "Refactor authentication system with JWT, add tes
 
 Output includes agent and topology suggestions.
 
-### 2. Initialize the Swarm With the Recommended Topology
+### 2. Initialize the Monoswarm With the Recommended Topology
 
 ```bash
 # Simple/medium tasks — hierarchical (anti-drift, tight control)
-npx monomind swarm init --topology hierarchical --max-agents 6 --strategy specialized
+npx monomind monoswarm init --topology hierarchical --max-agents 6 --strategy specialized
 
 # Complex multi-domain tasks — hierarchical-mesh (peer communication + queen)
-npx monomind swarm init --topology hierarchical-mesh --max-agents 12 --strategy specialized
+npx monomind monoswarm init --topology hierarchical-mesh --max-agents 12 --strategy specialized
 ```
 
 ### Topology Selection Guide
 
 | Complexity | Agents Needed | Recommended Topology |
 |---|---|---|
-| Simple (single file) | 1–2 | `star` — skip swarm, use Edit tool directly |
+| Simple (single file) | 1–2 | `star` — skip monoswarm, use Edit tool directly |
 | Medium | 3–5 | `hierarchical` |
 | Complex (multi-module) | 6–8 | `hierarchical` |
 | Large (10+ agents) | 10–15 | `hierarchical-mesh` |
 | Sequential pipeline | any | `ring` |
 
-## Optimize Existing Swarm Topology
+## Optimize Existing Monoswarm Topology
 
-If a swarm is already running, optimize its topology via the coordination MCP tool:
+If a monoswarm is already running, optimize its topology via the coordination MCP tool:
 
 ```javascript
 mcp__monomind__coordination_topology({
@@ -80,6 +80,6 @@ npx monomind performance optimize --target all --apply
 
 ## See Also
 
-- `swarm init` — initialize swarm with explicit topology
+- `monoswarm init` — initialize monoswarm with explicit topology
 - `performance optimize` — system-level performance tuning
 - `hooks pre-task` — get routing and topology recommendations

package/.claude/commands/stream-chain/run.md

@@ -142,7 +142,7 @@ Then direct the stream chain:
 Use memory tools to persist chain results for future sessions:
 
 ```javascript
-mcp__monomind__memory_store({
+mcp__monomind__memory_pattern-store({
   key: "stream-chain-result",
   value: "summary of findings",
   namespace: "stream-chain"

package/.claude/commands/workflows/development.md

@@ -62,7 +62,7 @@ mcp__monomind__workflow_run({
 mcp__monomind__workflow_status({ workflowId: "wf-123" })
 
 // Store findings for future sessions
-mcp__monomind__memory_store({
+mcp__monomind__memory_pattern-store({
   key: "dev-pattern-rest-api",
   value: "JWT auth + Express + Zod validation worked well",
   namespace: "patterns"

package/.claude/commands/workflows/research.md

@@ -58,14 +58,14 @@ mcp__monomind__workflow_run({
 })
 
 // Store research findings in memory
-mcp__monomind__memory_store({
+mcp__monomind__memory_pattern-store({
   key: "research-web-frameworks-2026",
   value: "React/Next.js leads for SSR; Astro for static; Svelte for performance",
   namespace: "research"
 })
 
 // Search past research before starting
-mcp__monomind__memory_search({
+mcp__monomind__memory_pattern-search({
   query: "web framework performance analysis",
   namespace: "research",
   limit: 5

package/.claude/helpers/audit-log-writer.cjs

@@ -0,0 +1,72 @@
+/**
+ * Security audit log writer — shared by gates-handler.cjs (plain CJS hook
+ * code, no package import) and any other hook-tree script that needs to
+ * persist a security decision.
+ *
+ * Writes JSONL to <monomind-data-root>/security/audit-events.jsonl. The data
+ * root resolution mirrors getMonomindDataRoot() in
+ * packages/@monomind/cli/src/utils/paths.ts (and _getGitMonomindDir() in
+ * server.mjs) so this lands in the same branch-agnostic, worktree-shared
+ * location as every other monomind data file — deliberately duplicated here
+ * rather than imported, since this file must stay dependency-free and fast
+ * on every PreToolUse invocation.
+ *
+ * Separate from event-logger.cjs's high-volume general event log (5-9MB/day
+ * of debug telemetry) so `security audit --action clear` can truncate this
+ * log without collaterally wiping unrelated data.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const MAX_AUDIT_LOG_BYTES = 25 * 1024 * 1024;
+
+function getMonoDir(workDir) {
+  try {
+    const gitEntry = path.join(workDir, '.git');
+    const st = fs.statSync(gitEntry);
+    if (st.isDirectory()) return path.join(gitEntry, 'monomind');
+    if (st.isFile()) {
+      const m = fs.readFileSync(gitEntry, 'utf8').match(/^gitdir:\s*(.+)/m);
+      if (m) {
+        const worktreeDir = path.resolve(workDir, m[1].trim());
+        return path.join(path.dirname(path.dirname(worktreeDir)), 'monomind');
+      }
+    }
+  } catch { /* fall through to default below */ }
+  return path.join(workDir, '.monomind');
+}
+
+/** Resolve the audit log's directory + file path for a given cwd. */
+function resolveAuditLogPaths(cwd) {
+  const workDir = cwd || process.env.MONOMIND_CWD || process.cwd();
+  const monoDir = process.env.MONOMIND_DATA_DIR || getMonoDir(workDir);
+  const dir = path.join(monoDir, 'security');
+  return { dir, file: path.join(dir, 'audit-events.jsonl') };
+}
+
+/**
+ * Append one audit event. Never throws — a logging failure must not break
+ * the gate it's recording. Rotates (archive + truncate) when the log grows
+ * past MAX_AUDIT_LOG_BYTES rather than growing unbounded.
+ *
+ * event: { source, decision, tool?, reason?, path? }
+ */
+function appendAuditEvent(event, cwd) {
+  try {
+    const { dir, file } = resolveAuditLogPaths(cwd);
+    fs.mkdirSync(dir, { recursive: true });
+    try {
+      const st = fs.statSync(file);
+      if (st.size > MAX_AUDIT_LOG_BYTES) {
+        fs.renameSync(file, `${file}.${Date.now()}.bak`);
+      }
+    } catch { /* file doesn't exist yet — nothing to rotate */ }
+    const entry = Object.assign({ timestamp: new Date().toISOString() }, event);
+    fs.appendFileSync(file, `${JSON.stringify(entry)}\n`);
+  } catch { /* never let audit logging break the caller */ }
+}
+
+module.exports = { appendAuditEvent, resolveAuditLogPaths, getMonoDir };

package/.claude/helpers/control-start.cjs

@@ -154,6 +154,42 @@ function probePort(p) {
   });
 }
 
+// Resolves a foreign dashboard server's real pid + project directory without
+// shelling out to `lsof` (Unix-only — unavailable on Windows, which left the
+// pairing step below permanently broken there: control.json stuck at pid:0
+// forever, dashboard-token never refreshed after the shared server restarts).
+// GET / is an intentionally-open route that embeds the live auth token in a
+// <meta name="mm-token"> tag for exactly this same-machine, loopback-trusted
+// purpose; re-using it here to authenticate a follow-up GET /api/status call
+// gets both the pid and the project `dir` in one portable HTTP round trip —
+// no OS-specific process inspection needed on any platform.
+function fetchForeignServerInfo(p) {
+  const http = require('http');
+  const getBody = (reqPath, headers) => new Promise((resolve) => {
+    const req = http.get({ hostname: 'localhost', port: p, path: reqPath, timeout: 1500, headers }, (res) => {
+      let body = '';
+      res.on('data', (c) => { if (body.length < 65536) body += c; });
+      res.on('end', () => resolve({ statusCode: res.statusCode, body }));
+    });
+    req.on('error', () => resolve(null));
+    req.on('timeout', () => { req.destroy(); resolve(null); });
+  });
+  return (async () => {
+    const home = await getBody('/');
+    if (!home) return null;
+    const m = home.body.match(/name="mm-token" content="([^"]*)"/);
+    const token = m ? m[1] : null;
+    if (!token) return null;
+    const status = await getBody('/api/status', { 'x-monomind-token': token });
+    if (!status) return null;
+    try {
+      const parsed = JSON.parse(status.body);
+      if (typeof parsed.pid !== 'number' || typeof parsed.dir !== 'string') return null;
+      return { pid: parsed.pid, dir: parsed.dir, token };
+    } catch { return null; }
+  })();
+}
+
 const LOCK_FILE = path.join(CWD, '.monomind', 'control.lock');
 
 /**
@@ -252,8 +288,14 @@ async function runConfirm({ childPid, port: defaultPort, boundReportPath, isNpxF
     // and kill our redundant child.
     try { process.kill(childPid, 'SIGTERM'); } catch { /* already gone */ }
     if (String(process.env.MONOMIND_HOOK_QUIET || "") !== "1") process.stdout.write(`[control] port ${defaultPort} is served by another project's control server — reusing it (killed redundant child)\n`);
-    let foreignPid = await probePort(defaultPort);
+    // Primary: authenticate via the foreign server's own open "/" route (see
+    // fetchForeignServerInfo doc comment) to get its real pid + project dir
+    // in one portable HTTP round trip — works on every platform, no `lsof`.
+    const foreignInfo = await fetchForeignServerInfo(defaultPort);
+    let foreignPid = foreignInfo ? foreignInfo.pid : await probePort(defaultPort);
     if (typeof foreignPid !== 'number' || foreignPid <= 0) {
+      // Last-resort fallback for exotic setups where the HTTP path above
+      // failed (e.g. a pre-token-route legacy server) — Unix-only.
       try {
         const { execFileSync } = require('child_process');
         const lsofOut = execFileSync('lsof', ['-ti', `:${defaultPort}`, '-sTCP:LISTEN'], { encoding: 'utf8', timeout: 3000 }).trim();
@@ -262,34 +304,50 @@ async function runConfirm({ childPid, port: defaultPort, boundReportPath, isNpxF
       } catch { /* ignore */ }
     }
     writeStatus(typeof foreignPid === 'number' ? foreignPid : 0, defaultPort);
-    // Pair with the foreign server: resolve its project dir from its pid,
-    // copy its dashboard-token beside OUR control.json (ingest is
-    // default-deny — without this every event from this project 401s
-    // silently), and self-register in its known-projects so future token
-    // rotations propagate back here on server restart.
+    // Pair with the foreign server: copy its dashboard-token beside OUR
+    // control.json (ingest is default-deny — without this every event from
+    // this project 401s silently), and self-register in its known-projects
+    // so future token rotations propagate back here on server restart.
     try {
-      if (typeof foreignPid === 'number' && foreignPid > 0) {
-        const { execFileSync } = require('child_process');
-        const out = execFileSync('lsof', ['-a', '-p', String(foreignPid), '-d', 'cwd', '-Fn'], { encoding: 'utf8', timeout: 3000 });
-        const nLine = out.split('\n').find((l) => l.startsWith('n'));
-        const serverHome = nLine ? nLine.slice(1) : null;
-        if (serverHome) {
-          const srcTok = path.join(serverHome, '.monomind', 'dashboard-token');
-          const dstTok = path.join(CWD, '.monomind', 'dashboard-token');
-          if (fs.existsSync(srcTok)) {
-            fs.copyFileSync(srcTok, dstTok);
-            fs.chmodSync(dstTok, 0o600);
+      if (foreignInfo) {
+        const dstTok = path.join(CWD, '.monomind', 'dashboard-token');
+        fs.mkdirSync(path.dirname(dstTok), { recursive: true });
+        fs.writeFileSync(dstTok, foreignInfo.token, { mode: 0o600 });
+        const kpFile = path.join(foreignInfo.dir, 'data', 'known-projects.json');
+        try {
+          const kp = fs.existsSync(kpFile) ? JSON.parse(fs.readFileSync(kpFile, 'utf8')) : [];
+          if (Array.isArray(kp) && !kp.includes(CWD)) {
+            kp.push(CWD);
+            fs.writeFileSync(kpFile, JSON.stringify(kp));
           }
-          const kpFile = path.join(serverHome, 'data', 'known-projects.json');
-          try {
-            const kp = fs.existsSync(kpFile) ? JSON.parse(fs.readFileSync(kpFile, 'utf8')) : [];
-            if (Array.isArray(kp) && !kp.includes(CWD)) {
-              kp.push(CWD);
-              fs.writeFileSync(kpFile, JSON.stringify(kp));
+        } catch { /* registry unreadable — token copy alone still unblocks events */ }
+        process.stdout.write('[control] paired dashboard token and registered this project with the shared server\n');
+      } else if (typeof foreignPid === 'number' && foreignPid > 0) {
+        // lsof gave us a pid but not a dir (it only resolves TCP listeners,
+        // not cwd) — fall back to its cwd resolution for the dir we need.
+        try {
+          const { execFileSync } = require('child_process');
+          const out = execFileSync('lsof', ['-a', '-p', String(foreignPid), '-d', 'cwd', '-Fn'], { encoding: 'utf8', timeout: 3000 });
+          const nLine = out.split('\n').find((l) => l.startsWith('n'));
+          const serverHome = nLine ? nLine.slice(1) : null;
+          if (serverHome) {
+            const srcTok = path.join(serverHome, '.monomind', 'dashboard-token');
+            const dstTok = path.join(CWD, '.monomind', 'dashboard-token');
+            if (fs.existsSync(srcTok)) {
+              fs.copyFileSync(srcTok, dstTok);
+              fs.chmodSync(dstTok, 0o600);
             }
-          } catch { /* registry unreadable — token copy alone still unblocks events */ }
-          process.stdout.write('[control] paired dashboard token and registered this project with the shared server\n');
-        }
+            const kpFile = path.join(serverHome, 'data', 'known-projects.json');
+            try {
+              const kp = fs.existsSync(kpFile) ? JSON.parse(fs.readFileSync(kpFile, 'utf8')) : [];
+              if (Array.isArray(kp) && !kp.includes(CWD)) {
+                kp.push(CWD);
+                fs.writeFileSync(kpFile, JSON.stringify(kp));
+              }
+            } catch { /* registry unreadable — token copy alone still unblocks events */ }
+            process.stdout.write('[control] paired dashboard token and registered this project with the shared server\n');
+          }
+        } catch { /* pairing is best-effort; propagation-on-restart is the fallback */ }
       }
     } catch { /* pairing is best-effort; propagation-on-restart is the fallback */ }
     return;

package/.claude/helpers/handlers/agent-start-handler.cjs

@@ -38,16 +38,16 @@ module.exports = {
       // on TeammateIdle/TaskCompleted (task-handler.cjs) — since sessions that
       // never emit those events would otherwise leak registrations forever.
       const activeAfterPurge = purgeStaleRegistrations(regDir);
-      // Refresh swarm-activity.json within the 5-min staleness window.
+      // Refresh monoswarm-activity.json within the 5-min staleness window.
       const activityDir = path.join(CWD, '.monomind', 'metrics');
       fs.mkdirSync(activityDir, { recursive: true });
-      const activityPath = path.join(activityDir, 'swarm-activity.json');
+      const activityPath = path.join(activityDir, 'monoswarm-activity.json');
       const MAX_AGENTS = 1000;
       const active = Math.min(
         activeAfterPurge != null ? activeAfterPurge : cleanEntries(regDir, f => f.endsWith('.json')).length,
         MAX_AGENTS
       );
-      // P2-21: swarm-activity.json is written by both this handler and
+      // P2-21: monoswarm-activity.json is written by both this handler and
       // task-handler.cjs's handlePostTask, concurrently (Claude Code fires
       // hook events for parallel tool calls in one message). The old
       // read-prevLastActive-then-write was a lost-update race — two
@@ -62,12 +62,12 @@ module.exports = {
           const MAX_ACTIVITY = 64 * 1024; // 64 KiB
           var actStat = fs.statSync(activityPath);
           if (actStat.size <= MAX_ACTIVITY) {
-            prevLastActive = (JSON.parse(fs.readFileSync(activityPath, 'utf-8'))?.swarm?.lastActive) || 0;
+            prevLastActive = (JSON.parse(fs.readFileSync(activityPath, 'utf-8'))?.monoswarm?.lastActive) || 0;
           }
         } catch { /* ignore */ }
         atomicWriteFileSync(activityPath, JSON.stringify({
           timestamp: new Date().toISOString(),
-          swarm: {
+          monoswarm: {
             active: active > 0,
             agent_count: active,
             coordination_active: active > 0,

package/.claude/helpers/handlers/gates-handler.cjs

@@ -18,6 +18,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { appendAuditEvent } = require('../audit-log-writer.cjs');
 
 // ─── monofence-ai integration (additional layer on top of regex gates) ───────
 //
@@ -343,10 +344,26 @@ function checkSecrets(content, patterns) {
  * a diagnostic printed on stdout can be mistaken for hook output (and, worse,
  * read as an *allow*). Keeping every gate message on stderr removes that
  * ambiguity entirely.
+ *
+ * Also persists the decision to the security audit log (audit-log-writer.cjs)
+ * so `monomind security audit` reflects real block decisions instead of
+ * inferring synthetic events from unrelated file mtimes. Logging never blocks
+ * or throws — a failure here must not affect the actual gate decision.
+ *
+ * meta: { source, tool?, cwd?, path? } — source names which gate fired
+ * (destructive-ops / secrets / monofence-command / monofence-write / <gate>).
  */
-function emitBlock(reason) {
+function emitBlock(reason, meta) {
   process.stderr.write(JSON.stringify({ decision: 'block', reason: reason }) + '\n');
   process.exitCode = 2;
+  meta = meta || {};
+  appendAuditEvent({
+    source: meta.source || 'gates',
+    decision: 'block',
+    tool: meta.tool,
+    reason: reason,
+    path: meta.path,
+  }, meta.cwd);
 }
 
 /**
@@ -371,12 +388,13 @@ function emitBlock(reason) {
  *   hints, telemetry) stays fail-open: it has no security value and its
  *   failure must never stop the user from working.
  */
-function failClosed(gateName, err) {
+function failClosed(gateName, err, meta) {
   var msg = (err && err.message) ? err.message : String(err);
   emitBlock(
     '[gates] ' + gateName + ' gate failed to evaluate (' + msg + '). Failing CLOSED: a security ' +
     'gate that cannot run must not silently allow the operation. Fix the gate (or the project ' +
-    'override at .monomind/guidance/active-gates.json) and retry.'
+    'override at .monomind/guidance/active-gates.json) and retry.',
+    Object.assign({ source: gateName }, meta)
   );
 }
 
@@ -396,11 +414,11 @@ async function handlePreBash(hCtx) {
     var config = loadCompiledConfig(hCtx.CWD);
     result = checkDestructive(cmd, config.destructivePatterns);
   } catch (e) {
-    failClosed('destructive-ops', e);
+    failClosed('destructive-ops', e, { tool: hCtx.toolName, cwd: hCtx.CWD });
     return;
   }
   if (result.triggered) {
-    emitBlock('[gates] ' + result.reason);
+    emitBlock('[gates] ' + result.reason, { source: 'destructive-ops', tool: hCtx.toolName, cwd: hCtx.CWD });
     return;
   }
 
@@ -410,7 +428,8 @@ async function handlePreBash(hCtx) {
   var worst = monofenceWorstThreat(mf, cmd);
   if (worst) {
     emitBlock('[monofence] Threat detected in command — ' + worst.type +
-      ' (confidence ' + Math.round(worst.confidence * 100) + '%): ' + worst.description);
+      ' (confidence ' + Math.round(worst.confidence * 100) + '%): ' + worst.description,
+      { source: 'monofence-command', tool: hCtx.toolName, cwd: hCtx.CWD });
   }
 }
 
@@ -444,11 +463,12 @@ function extractWriteContent(toolInput) {
  */
 async function handlePreWrite(hCtx) {
   var toolInput = hCtx.toolInput || {};
+  var writePath = toolInput.file_path || toolInput.path;
   var content;
   try {
     content = extractWriteContent(toolInput);
   } catch (e) {
-    failClosed('secrets', e);
+    failClosed('secrets', e, { tool: hCtx.toolName, cwd: hCtx.CWD, path: writePath });
     return;
   }
   if (!content) return;
@@ -461,11 +481,11 @@ async function handlePreWrite(hCtx) {
     var config = loadCompiledConfig(hCtx.CWD);
     result = checkSecrets(content, config.secretPatterns);
   } catch (e) {
-    failClosed('secrets', e);
+    failClosed('secrets', e, { tool: hCtx.toolName, cwd: hCtx.CWD, path: writePath });
     return;
   }
   if (result.triggered) {
-    emitBlock('[gates] ' + result.reason);
+    emitBlock('[gates] ' + result.reason, { source: 'secrets', tool: hCtx.toolName, cwd: hCtx.CWD, path: writePath });
     return;
   }
 
@@ -475,7 +495,8 @@ async function handlePreWrite(hCtx) {
   var worst = monofenceWorstThreat(mf, content);
   if (worst) {
     emitBlock('[monofence] Threat detected in written content — ' + worst.type +
-      ' (confidence ' + Math.round(worst.confidence * 100) + '%): ' + worst.description);
+      ' (confidence ' + Math.round(worst.confidence * 100) + '%): ' + worst.description,
+      { source: 'monofence-write', tool: hCtx.toolName, cwd: hCtx.CWD, path: writePath });
   }
 }
 

package/.claude/helpers/handlers/session-restore-handler.cjs

@@ -353,7 +353,7 @@ module.exports = {
         : 'project context general';
 
       var memoryMod = null;
-      try { memoryMod = await import('@monomind/memory'); } catch (e) {}
+      try { memoryMod = await import('@monoes/memory'); } catch (e) {}
 
       if (memoryMod && memoryMod.KnowledgeStore && memoryMod.KnowledgeRetriever) {
         var kStore = new memoryMod.KnowledgeStore(knowledgeDir);

package/.claude/helpers/handlers/task-handler.cjs

@@ -93,17 +93,17 @@ module.exports = {
         }
         // Also purge any stragglers older than 30 min (shared with agent-start-handler.cjs)
         const remaining = purgeStaleRegistrations(regDir) || 0;
-        // P2-21: shares a lock with agent-start-handler.cjs's swarm-activity.json
+        // P2-21: shares a lock with agent-start-handler.cjs's monoswarm-activity.json
         // writer (same path + '.lock') so the read-prevLastActive-then-write
         // cycle can't race with that handler's concurrent write and silently
         // drop whichever one wrote last — see that file for full rationale.
-        const _actPath = path.join(CWD, '.monomind', 'metrics', 'swarm-activity.json');
+        const _actPath = path.join(CWD, '.monomind', 'metrics', 'monoswarm-activity.json');
         withLock(_actPath + '.lock', function() {
           let _prevLastActive = 0;
-          try { var _actSt = fs.statSync(_actPath); if (_actSt.size < 65536) { _prevLastActive = (JSON.parse(fs.readFileSync(_actPath, 'utf-8'))?.swarm?.lastActive) || 0; } } catch { /* ignore */ }
+          try { var _actSt = fs.statSync(_actPath); if (_actSt.size < 65536) { _prevLastActive = (JSON.parse(fs.readFileSync(_actPath, 'utf-8'))?.monoswarm?.lastActive) || 0; } } catch { /* ignore */ }
           atomicWriteFileSync(_actPath, JSON.stringify({
             timestamp: new Date().toISOString(),
-            swarm: {
+            monoswarm: {
               active: remaining > 0,
               agent_count: remaining,
               coordination_active: remaining > 0,