monomind 1.10.0 → 1.10.2

package/packages/@monomind/cli/dist/src/agents/version-store.js

@@ -0,0 +1,235 @@
+/**
+ * Agent Version Store (Task 29)
+ *
+ * JSONL-based append-only storage for agent definition versions.
+ * Supports save, list, get, rollback, and diff operations.
+ */
+import { createHash, randomUUID, randomBytes } from 'crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, statSync } from 'fs';
+import { join } from 'path';
+import { computeUnifiedDiff } from './version-diff.js';
+import { parseJsonl } from '../utils/parse-jsonl.js';
+function toStored(r) {
+    return {
+        id: r.id,
+        slug: r.slug,
+        version: r.version,
+        changelog: r.changelog,
+        deprecated: r.deprecated,
+        deprecatedBy: r.deprecatedBy,
+        content: r.content,
+        contentHash: r.contentHash,
+        capturedAt: r.capturedAt instanceof Date
+            ? r.capturedAt.toISOString()
+            : String(r.capturedAt),
+        capturedBy: r.capturedBy,
+        isCurrent: r.isCurrent,
+    };
+}
+function fromStored(s) {
+    return {
+        id: s.id,
+        slug: s.slug,
+        version: s.version,
+        changelog: s.changelog,
+        deprecated: s.deprecated,
+        deprecatedBy: s.deprecatedBy,
+        content: s.content,
+        contentHash: s.contentHash,
+        capturedAt: new Date(s.capturedAt),
+        capturedBy: s.capturedBy,
+        isCurrent: s.isCurrent,
+    };
+}
+/**
+ * JSONL-based agent version store.
+ *
+ * Each slug's versions are stored in `<dirPath>/versions.jsonl`, one JSON
+ * object per line.  Rollback rewrites the file to update `isCurrent` flags.
+ */
+export class AgentVersionStore {
+    dirPath;
+    filePath;
+    constructor(dirPath) {
+        this.dirPath = dirPath;
+        if (!existsSync(dirPath)) {
+            mkdirSync(dirPath, { recursive: true });
+        }
+        this.filePath = join(dirPath, 'versions.jsonl');
+    }
+    // ---------------------------------------------------------------------------
+    // Persistence helpers
+    // ---------------------------------------------------------------------------
+    readAll() {
+        if (!existsSync(this.filePath)) {
+            return [];
+        }
+        const stat = statSync(this.filePath);
+        if (stat.size > 10 * 1024 * 1024) {
+            throw new Error('Version store exceeds size limit; run compaction');
+        }
+        const raw = readFileSync(this.filePath, 'utf-8');
+        // Drop any record whose stored contentHash does not match the SHA-256 of
+        // its content. saveVersion advertises tamper-evidence by computing the
+        // hash; without this verification step, an attacker who can write the
+        // JSONL file can swap `content` with a poisoned agent prompt while
+        // leaving `contentHash` unchanged, and the next getCurrent() returns
+        // the tampered prompt verbatim into the LLM context.
+        const records = parseJsonl(raw);
+        const verified = [];
+        for (const r of records) {
+            if (typeof r?.content !== 'string' ||
+                typeof r?.contentHash !== 'string' ||
+                typeof r?.id !== 'string' ||
+                typeof r?.slug !== 'string' ||
+                typeof r?.version !== 'string' ||
+                typeof r?.changelog !== 'string' ||
+                typeof r?.capturedBy !== 'string' ||
+                typeof r?.capturedAt !== 'string')
+                continue;
+            const actual = createHash('sha256').update(r.content).digest('hex');
+            if (actual !== r.contentHash)
+                continue; // silently drop tampered record
+            verified.push(r);
+        }
+        return verified.map(fromStored);
+    }
+    writeAll(records) {
+        const lines = records.map((r) => JSON.stringify(toStored(r)));
+        const tmp = `${this.filePath}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
+        writeFileSync(tmp, lines.join('\n') + '\n', 'utf-8');
+        renameSync(tmp, this.filePath);
+    }
+    // ---------------------------------------------------------------------------
+    // Public API
+    // ---------------------------------------------------------------------------
+    /**
+     * Save a new version for the given agent slug.
+     *
+     * Computes a SHA-256 hash of the content, marks all previous versions for
+     * the same slug as non-current, and appends the new record.
+     */
+    saveVersion(slug, content, version, changelog, opts = {}) {
+        const MAX_CONTENT_BYTES = 512 * 1024;
+        if (Buffer.byteLength(content, 'utf-8') > MAX_CONTENT_BYTES) {
+            throw new Error(`content exceeds maximum allowed size (${MAX_CONTENT_BYTES} bytes)`);
+        }
+        const contentHash = createHash('sha256').update(content).digest('hex');
+        // SINGLE-WRITER CONTRACT: version-store is written only by the daemon process.
+        // Concurrent saveVersion() calls from multiple processes would race on readAll/writeAll.
+        // If multi-writer access is needed in future, introduce an advisory lock here.
+        const existing = this.readAll();
+        for (const rec of existing) {
+            if (rec.slug === slug && rec.isCurrent) {
+                rec.isCurrent = false;
+            }
+        }
+        const record = {
+            id: randomUUID(),
+            slug,
+            version,
+            changelog,
+            deprecated: opts.deprecated ?? false,
+            deprecatedBy: opts.deprecatedBy,
+            content,
+            contentHash,
+            capturedAt: new Date(),
+            capturedBy: opts.capturedBy ?? 'system',
+            isCurrent: true,
+        };
+        existing.push(record);
+        this.writeAll(existing);
+        return record;
+    }
+    /**
+     * List all versions for a slug, sorted by capturedAt DESC (newest first).
+     * Uses insertion order (line index) as a stable tiebreaker.
+     */
+    listVersions(slug) {
+        const all = this.readAll();
+        const indexed = all.map((r, i) => ({ r, i }));
+        return indexed
+            .filter(({ r }) => r.slug === slug)
+            .sort((a, b) => {
+            const timeDiff = new Date(b.r.capturedAt).getTime() -
+                new Date(a.r.capturedAt).getTime();
+            return timeDiff !== 0 ? timeDiff : b.i - a.i;
+        })
+            .map(({ r }) => r);
+    }
+    /**
+     * Get the current active version for a slug, or null.
+     */
+    getCurrent(slug) {
+        const all = this.readAll();
+        const indexed = all.map((r, i) => ({ r, i }));
+        const matching = indexed.filter(({ r }) => r.slug === slug && r.isCurrent);
+        if (matching.length === 0)
+            return null;
+        // Return the most recent current record (insertion order as tiebreaker)
+        return matching.sort((a, b) => {
+            const timeDiff = new Date(b.r.capturedAt).getTime() -
+                new Date(a.r.capturedAt).getTime();
+            return timeDiff !== 0 ? timeDiff : b.i - a.i;
+        })[0].r;
+    }
+    /**
+     * Get a specific version by slug and semver string, or null.
+     */
+    getVersion(slug, version) {
+        return (this.readAll().find((r) => r.slug === slug && r.version === version) ?? null);
+    }
+    /**
+     * Roll back to a specific version.
+     *
+     * Marks the target version as current and all others for that slug as
+     * non-current.  Rewrites the JSONL file.
+     *
+     * @throws Error if the target version does not exist.
+     */
+    rollback(slug, toVersion) {
+        const all = this.readAll();
+        let target;
+        for (const rec of all) {
+            if (rec.slug === slug) {
+                if (rec.version === toVersion) {
+                    rec.isCurrent = true;
+                    target = rec;
+                }
+                else {
+                    rec.isCurrent = false;
+                }
+            }
+        }
+        if (!target) {
+            throw new Error(`Version "${toVersion}" not found for agent "${slug}"`);
+        }
+        this.writeAll(all);
+        return target;
+    }
+    /**
+     * Compute a line-level diff between two versions of the same agent.
+     *
+     * @throws Error if either version does not exist.
+     */
+    diff(slug, fromVersion, toVersion) {
+        const from = this.getVersion(slug, fromVersion);
+        if (!from) {
+            throw new Error(`Version "${fromVersion}" not found for agent "${slug}"`);
+        }
+        const to = this.getVersion(slug, toVersion);
+        if (!to) {
+            throw new Error(`Version "${toVersion}" not found for agent "${slug}"`);
+        }
+        const { additions, deletions, hunks } = computeUnifiedDiff(from.content, to.content);
+        return {
+            slug,
+            fromVersion,
+            toVersion,
+            additions,
+            deletions,
+            hunks,
+        };
+    }
+}
+//# sourceMappingURL=version-store.js.map

package/packages/@monomind/cli/dist/src/autopilot-state.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Autopilot Shared State Module
+ *
+ * Centralizes state management, validation, and task discovery
+ * for both CLI command and MCP tools. Eliminates code duplication.
+ *
+ * ADR-072: Autopilot Integration
+ * Security: Addresses prototype pollution, NaN bypass, input validation
+ */
+export declare const STATE_DIR = ".monomind/data";
+export declare const STATE_FILE = ".monomind/data/autopilot-state.json";
+export declare const LOG_FILE = ".monomind/data/autopilot-log.json";
+/** Allowlist for valid task sources */
+export declare const VALID_TASK_SOURCES: Set<string>;
+/** Terminal task statuses */
+export declare const TERMINAL_STATUSES: Set<string>;
+export interface AutopilotState {
+    sessionId: string;
+    enabled: boolean;
+    startTime: number;
+    iterations: number;
+    maxIterations: number;
+    timeoutMinutes: number;
+    taskSources: string[];
+    lastCheck: number | null;
+    history: Array<{
+        ts: number;
+        iteration: number;
+        completed: number;
+        total: number;
+    }>;
+}
+export interface AutopilotLogEntry {
+    ts: number;
+    event: string;
+    [key: string]: unknown;
+}
+export interface TaskInfo {
+    id: string;
+    subject: string;
+    status: string;
+    source: string;
+}
+export interface TaskProgress {
+    completed: number;
+    total: number;
+    percent: number;
+    incomplete: TaskInfo[];
+}
+/**
+ * Safe JSON.parse that prevents prototype pollution.
+ */
+export declare function safeJsonParse<T>(raw: string): T;
+/**
+ * Validate and coerce a numeric parameter. Returns the default if
+ * the input is NaN, undefined, or outside the allowed range.
+ */
+export declare function validateNumber(value: unknown, min: number, max: number, defaultValue: number): number;
+/**
+ * Validate task sources against the allowlist.
+ * Returns only valid sources; falls back to defaults if none are valid.
+ */
+export declare function validateTaskSources(sources: unknown): string[];
+export declare function getDefaultState(): AutopilotState;
+export declare function loadState(): AutopilotState;
+export declare function saveState(state: AutopilotState): void;
+export declare function appendLog(entry: AutopilotLogEntry): void;
+export declare function loadLog(): AutopilotLogEntry[];
+export declare function discoverTasks(sources: string[]): TaskInfo[];
+export declare function isTerminal(status: string): boolean;
+export declare function getProgress(tasks: TaskInfo[]): TaskProgress;
+export declare function calculateReward(iterations: number, durationMs: number): number;
+export declare function tryLoadLearning(): Promise<{
+    initialize: () => Promise<boolean>;
+    [key: string]: unknown;
+} | null>;
+//# sourceMappingURL=autopilot-state.d.ts.map

package/packages/@monomind/cli/dist/src/autopilot-state.js

@@ -0,0 +1,330 @@
+/**
+ * Autopilot Shared State Module
+ *
+ * Centralizes state management, validation, and task discovery
+ * for both CLI command and MCP tools. Eliminates code duplication.
+ *
+ * ADR-072: Autopilot Integration
+ * Security: Addresses prototype pollution, NaN bypass, input validation
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import { randomUUID } from 'crypto';
+// ── Constants ─────────────────────────────────────────────────
+export const STATE_DIR = '.monomind/data';
+export const STATE_FILE = `${STATE_DIR}/autopilot-state.json`;
+export const LOG_FILE = `${STATE_DIR}/autopilot-log.json`;
+/** Maximum entries kept in state.history (prevents unbounded growth) */
+const MAX_HISTORY_ENTRIES = 50;
+/** Maximum entries kept in the event log */
+const MAX_LOG_ENTRIES = 1000;
+/** Allowlist for valid task sources */
+export const VALID_TASK_SOURCES = new Set(['team-tasks', 'swarm-tasks', 'file-checklist']);
+/** Terminal task statuses */
+export const TERMINAL_STATUSES = new Set(['completed', 'done', 'cancelled', 'skipped', 'failed']);
+// ── Validation Helpers ────────────────────────────────────────
+/**
+ * Sanitize a parsed JSON object to prevent prototype pollution.
+ * Removes __proto__, constructor, and prototype keys recursively.
+ */
+function sanitizeObject(obj) {
+    if (obj === null || typeof obj !== 'object')
+        return obj;
+    if (Array.isArray(obj))
+        return obj.map(sanitizeObject);
+    const clean = {};
+    for (const key of Object.keys(obj)) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+            continue;
+        clean[key] = sanitizeObject(obj[key]);
+    }
+    return clean;
+}
+/**
+ * Safe JSON.parse that prevents prototype pollution.
+ */
+export function safeJsonParse(raw) {
+    return sanitizeObject(JSON.parse(raw));
+}
+/**
+ * Validate and coerce a numeric parameter. Returns the default if
+ * the input is NaN, undefined, or outside the allowed range.
+ */
+export function validateNumber(value, min, max, defaultValue) {
+    if (value === undefined || value === null)
+        return defaultValue;
+    const num = Number(value);
+    if (!Number.isFinite(num))
+        return defaultValue;
+    return Math.min(Math.max(min, Math.round(num)), max);
+}
+/**
+ * Validate task sources against the allowlist.
+ * Returns only valid sources; falls back to defaults if none are valid.
+ */
+export function validateTaskSources(sources) {
+    const defaults = ['team-tasks', 'swarm-tasks', 'file-checklist'];
+    if (!Array.isArray(sources))
+        return defaults;
+    const valid = sources
+        .filter((s) => typeof s === 'string')
+        .map(s => s.trim())
+        .filter(s => VALID_TASK_SOURCES.has(s));
+    return valid.length > 0 ? valid : defaults;
+}
+// ── State Management ──────────────────────────────────────────
+export function getDefaultState() {
+    return {
+        sessionId: randomUUID(),
+        enabled: false,
+        startTime: Date.now(),
+        iterations: 0,
+        maxIterations: 50,
+        timeoutMinutes: 240,
+        taskSources: ['team-tasks', 'swarm-tasks', 'file-checklist'],
+        lastCheck: null,
+        history: [],
+    };
+}
+export function loadState() {
+    const filePath = path.resolve(STATE_FILE);
+    const defaults = getDefaultState();
+    try {
+        if (fs.existsSync(filePath)) {
+            const raw = safeJsonParse(fs.readFileSync(filePath, 'utf-8'));
+            const merged = { ...defaults, ...raw };
+            // Re-validate fields that could be tampered with
+            merged.maxIterations = validateNumber(merged.maxIterations, 1, 1000, 50);
+            merged.timeoutMinutes = validateNumber(merged.timeoutMinutes, 1, 1440, 240);
+            merged.iterations = validateNumber(merged.iterations, 0, 1000, 0);
+            merged.taskSources = validateTaskSources(merged.taskSources);
+            // Cap history to prevent unbounded growth
+            if (Array.isArray(merged.history) && merged.history.length > MAX_HISTORY_ENTRIES) {
+                merged.history = merged.history.slice(-MAX_HISTORY_ENTRIES);
+            }
+            return merged;
+        }
+    }
+    catch {
+        // Corrupted state file — return defaults
+    }
+    return defaults;
+}
+export function saveState(state) {
+    const dir = path.resolve(STATE_DIR);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    // Cap history before saving
+    if (state.history.length > MAX_HISTORY_ENTRIES) {
+        state.history = state.history.slice(-MAX_HISTORY_ENTRIES);
+    }
+    // Unique tmp filename — concurrent autopilot_enable/disable/reset calls
+    // must not collide on the same .tmp path.
+    const tmpFile = `${path.resolve(STATE_FILE)}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmpFile, JSON.stringify(state, null, 2));
+    fs.renameSync(tmpFile, path.resolve(STATE_FILE));
+}
+export function appendLog(entry) {
+    const filePath = path.resolve(LOG_FILE);
+    const dir = path.resolve(STATE_DIR);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    // Append-only NDJSON: atomic at the OS level for individual lines, no
+    // read-modify-write race between concurrent MCP tool calls. Compaction is
+    // handled lazily by `compactLog()` which the daemon can call periodically.
+    // Previously this function did read → push → tmp-write → rename, which
+    // under concurrent autopilot_enable/disable/reset calls silently lost
+    // entries (last writer wins) and could truncate the log to a single entry
+    // if a peer crashed mid-write and the next caller's safeJsonParse threw.
+    try {
+        fs.appendFileSync(filePath, JSON.stringify(entry) + '\n', { flag: 'a' });
+    }
+    catch {
+        // Best-effort logging; do not throw from a non-critical observability path.
+    }
+    // Opportunistic compaction so the file doesn't grow without bound.
+    try {
+        const stat = fs.statSync(filePath);
+        if (stat.size > 4 * 1024 * 1024) {
+            compactLog(filePath);
+        }
+    }
+    catch { /* ignore */ }
+}
+/**
+ * Compact NDJSON log down to MAX_LOG_ENTRIES. On parse failure for any line,
+ * preserve the corrupt file aside (do not silently destroy data).
+ */
+function compactLog(filePath) {
+    let lines;
+    try {
+        lines = fs.readFileSync(filePath, 'utf-8').split('\n').filter(l => l.trim().length > 0);
+    }
+    catch {
+        return;
+    }
+    const entries = [];
+    let corrupt = 0;
+    for (const line of lines) {
+        try {
+            const e = safeJsonParse(line);
+            if (e && typeof e === 'object')
+                entries.push(e);
+        }
+        catch {
+            corrupt++;
+        }
+    }
+    if (corrupt > 0) {
+        try {
+            fs.copyFileSync(filePath, `${filePath}.corrupt-${Date.now()}`);
+        }
+        catch { /* ignore */ }
+    }
+    const trimmed = entries.length > MAX_LOG_ENTRIES ? entries.slice(-MAX_LOG_ENTRIES) : entries;
+    const tmp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmp, trimmed.map(e => JSON.stringify(e)).join('\n') + '\n');
+    fs.renameSync(tmp, filePath);
+}
+export function loadLog() {
+    const filePath = path.resolve(LOG_FILE);
+    try {
+        if (fs.existsSync(filePath)) {
+            const raw = fs.readFileSync(filePath, 'utf-8');
+            // Backward compatible: support both old JSON-array form and the new
+            // append-only NDJSON form. Prefer NDJSON if the file looks line-based.
+            const trimmed = raw.trim();
+            if (trimmed.startsWith('[')) {
+                const result = safeJsonParse(raw);
+                return Array.isArray(result) ? result : [];
+            }
+            const out = [];
+            for (const line of trimmed.split('\n')) {
+                if (!line)
+                    continue;
+                try {
+                    const entry = safeJsonParse(line);
+                    if (entry && typeof entry === 'object')
+                        out.push(entry);
+                }
+                catch { /* skip corrupt line */ }
+            }
+            return out;
+        }
+    }
+    catch {
+        // Corrupted log — return empty
+    }
+    return [];
+}
+// ── Task Discovery ────────────────────────────────────────────
+export function discoverTasks(sources) {
+    const tasks = [];
+    // Only process valid sources
+    const validSources = sources.filter(s => VALID_TASK_SOURCES.has(s));
+    for (const source of validSources) {
+        if (source === 'team-tasks') {
+            const tasksDir = path.join(os.homedir(), '.claude', 'tasks');
+            try {
+                if (fs.existsSync(tasksDir)) {
+                    const teams = fs.readdirSync(tasksDir, { withFileTypes: true });
+                    for (const team of teams) {
+                        if (!team.isDirectory())
+                            continue;
+                        const teamDir = path.join(tasksDir, team.name);
+                        const files = fs.readdirSync(teamDir).filter((f) => f.endsWith('.json'));
+                        for (const file of files) {
+                            try {
+                                const data = safeJsonParse(fs.readFileSync(path.join(teamDir, file), 'utf-8'));
+                                tasks.push({
+                                    id: String(data.id || file.replace('.json', '')),
+                                    subject: String(data.subject || data.title || file),
+                                    status: String(data.status || 'unknown'),
+                                    source: 'team-tasks',
+                                });
+                            }
+                            catch { /* skip individual file */ }
+                        }
+                    }
+                }
+            }
+            catch { /* skip source */ }
+        }
+        if (source === 'swarm-tasks') {
+            const swarmFile = path.resolve('.monomind/swarm-tasks.json');
+            try {
+                if (fs.existsSync(swarmFile)) {
+                    const data = safeJsonParse(fs.readFileSync(swarmFile, 'utf-8'));
+                    const swarmTasks = Array.isArray(data) ? data : (data.tasks || []);
+                    for (const t of swarmTasks) {
+                        if (t && typeof t === 'object') {
+                            const task = t;
+                            tasks.push({
+                                id: String(task.id || task.taskId || `swarm-${tasks.length}`),
+                                subject: String(task.subject || task.description || task.name || 'Unnamed task'),
+                                status: String(task.status || 'unknown'),
+                                source: 'swarm-tasks',
+                            });
+                        }
+                    }
+                }
+            }
+            catch { /* skip source */ }
+        }
+        if (source === 'file-checklist') {
+            const checklistFile = path.resolve('.monomind/data/checklist.json');
+            try {
+                if (fs.existsSync(checklistFile)) {
+                    const data = safeJsonParse(fs.readFileSync(checklistFile, 'utf-8'));
+                    const items = Array.isArray(data) ? data : (data.items || []);
+                    for (const item of items) {
+                        if (item && typeof item === 'object') {
+                            const i = item;
+                            tasks.push({
+                                id: String(i.id || `check-${tasks.length}`),
+                                subject: String(i.subject || i.text || i.description || 'Unnamed item'),
+                                status: String(i.status || (i.done ? 'completed' : 'pending')),
+                                source: 'file-checklist',
+                            });
+                        }
+                    }
+                }
+            }
+            catch { /* skip source */ }
+        }
+    }
+    return tasks;
+}
+// ── Progress Helpers ──────────────────────────────────────────
+export function isTerminal(status) {
+    return TERMINAL_STATUSES.has(status.toLowerCase());
+}
+export function getProgress(tasks) {
+    const completed = tasks.filter(t => isTerminal(t.status)).length;
+    const total = tasks.length;
+    const percent = total === 0 ? 100 : Math.round((completed / total) * 100);
+    const incomplete = tasks.filter(t => !isTerminal(t.status));
+    return { completed, total, percent, incomplete };
+}
+// ── Reward Calculation ────────────────────────────────────────
+export function calculateReward(iterations, durationMs) {
+    const iterFactor = (1 - iterations / (iterations + 10)) * 0.6;
+    const timeFactor = (1 - Math.min(durationMs / 3600000, 1)) * 0.4;
+    return Math.round((iterFactor + timeFactor) * 100) / 100;
+}
+// ── Learning Integration ──────────────────────────────────────
+export async function tryLoadLearning() {
+    try {
+        const modPath = 'agentic-flow/dist/coordination/autopilot-learning.js';
+        const mod = await import(/* webpackIgnore: true */ modPath).catch(() => null);
+        if (mod?.AutopilotLearning) {
+            const instance = new mod.AutopilotLearning();
+            if (await instance.initialize())
+                return instance;
+        }
+    }
+    catch { /* not available */ }
+    return null;
+}
+//# sourceMappingURL=autopilot-state.js.map