monomind 1.10.0 → 1.10.2

package/packages/@monomind/cli/dist/src/services/config-file-manager.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Config File Manager
+ * Shared JSON config file persistence with atomic writes and Zod validation
+ */
+export declare class ConfigFileManager {
+    private configPath;
+    private config;
+    /** Find config file in search paths starting from cwd */
+    findConfig(cwd: string): string | null;
+    /** Load config from file, returns null if not found */
+    load(cwd: string): Record<string, unknown> | null;
+    /** Get the current config, loading if needed */
+    getConfig(cwd: string): Record<string, unknown>;
+    /** Get a nested config value by dot-separated key */
+    get(cwd: string, key: string): unknown;
+    /** Set a nested config value by dot-separated key.
+     * Enforces top-level section allowlist (mirroring importFrom) and recursively
+     * sanitises the value to strip prototype-pollution keys before persistence.
+     *
+     * Re-reads the file from disk inside the write to guard against the
+     * read-modify-write credential-clobber race. Without the re-read, two
+     * concurrent `monomind providers configure` calls would each see the
+     * original config, mutate locally, and the second writer would silently
+     * drop the first writer's API key.
+     */
+    set(cwd: string, key: string, value: unknown): void;
+    /** Create a new config file with defaults */
+    create(cwd: string, overrides?: Record<string, unknown>, force?: boolean): string;
+    /** Reset config to defaults */
+    reset(cwd: string): string;
+    /** Export config to a specific path */
+    exportTo(cwd: string, exportPath: string): void;
+    /** Import config from a specific path */
+    importFrom(cwd: string, importPath: string): void;
+    /** Get the path to the current config file */
+    getConfigPath(): string | null;
+    /** Get default config */
+    getDefaults(): Record<string, unknown>;
+    /** Atomic write with restrictive 0o600 mode.
+     * SECURITY: this config file may contain API keys (per `commands/providers.ts`).
+     * Without explicit mode the file inherits the umask (typically 0o644 →
+     * world-readable). Set 0o600 on tmp file BEFORE rename, then re-chmod after
+     * rename in case the rename target had a more permissive mode.
+     */
+    private writeAtomic;
+}
+/** Parse a string value to the appropriate type */
+export declare function parseConfigValue(value: string): unknown;
+/** Singleton instance */
+export declare const configManager: ConfigFileManager;
+//# sourceMappingURL=config-file-manager.d.ts.map

package/packages/@monomind/cli/dist/src/services/config-file-manager.js

@@ -0,0 +1,312 @@
+/**
+ * Config File Manager
+ * Shared JSON config file persistence with atomic writes and Zod validation
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/** Config file search paths in priority order */
+const CONFIG_FILENAMES = [
+    'monomind.config.json',
+    '.monomind/config.json',
+];
+/** Default config values */
+const DEFAULT_CONFIG = {
+    version: '3.5',
+    agents: {
+        defaultType: 'coder',
+        autoSpawn: false,
+        maxConcurrent: 8,
+        timeout: 300000,
+        providers: [],
+    },
+    swarm: {
+        topology: 'hierarchical',
+        maxAgents: 8,
+        autoScale: false,
+        coordinationStrategy: 'leader',
+        healthCheckInterval: 30000,
+    },
+    memory: {
+        backend: 'hybrid',
+        persistPath: './data/memory',
+        cacheSize: 1000,
+        enableHNSW: true,
+        vectorDimension: 384,
+    },
+    mcp: {
+        serverHost: 'localhost',
+        serverPort: 3000,
+        autoStart: false,
+        transportType: 'stdio',
+        tools: [],
+    },
+    cli: {
+        colorOutput: true,
+        interactive: true,
+        verbosity: 'normal',
+        outputFormat: 'text',
+        progressStyle: 'spinner',
+    },
+    hooks: {
+        enabled: true,
+        autoExecute: true,
+        hooks: [],
+    },
+};
+export class ConfigFileManager {
+    configPath = null;
+    config = null;
+    /** Find config file in search paths starting from cwd */
+    findConfig(cwd) {
+        for (const filename of CONFIG_FILENAMES) {
+            const candidate = path.resolve(cwd, filename);
+            if (fs.existsSync(candidate)) {
+                return candidate;
+            }
+        }
+        // Check env var — must resolve within project root
+        const envPath = process.env.MONOMIND_CONFIG;
+        if (envPath) {
+            const resolved = path.resolve(envPath);
+            const projectRoot = path.resolve(cwd);
+            if ((resolved.startsWith(projectRoot + path.sep) || resolved === projectRoot) && fs.existsSync(resolved)) {
+                return resolved;
+            }
+        }
+        return null;
+    }
+    /** Load config from file, returns null if not found */
+    load(cwd) {
+        this.configPath = this.findConfig(cwd);
+        if (!this.configPath) {
+            this.config = null;
+            return null;
+        }
+        try {
+            const content = fs.readFileSync(this.configPath, 'utf-8');
+            const parsed = JSON.parse(content);
+            this.config = sanitizeConfigObject(parsed);
+            return this.config;
+        }
+        catch {
+            this.config = null;
+            return null;
+        }
+    }
+    /** Get the current config, loading if needed */
+    getConfig(cwd) {
+        if (this.config === null) {
+            this.load(cwd);
+        }
+        return this.config ?? { ...DEFAULT_CONFIG };
+    }
+    /** Get a nested config value by dot-separated key */
+    get(cwd, key) {
+        const config = this.getConfig(cwd);
+        return getNestedValue(config, key);
+    }
+    /** Set a nested config value by dot-separated key.
+     * Enforces top-level section allowlist (mirroring importFrom) and recursively
+     * sanitises the value to strip prototype-pollution keys before persistence.
+     *
+     * Re-reads the file from disk inside the write to guard against the
+     * read-modify-write credential-clobber race. Without the re-read, two
+     * concurrent `monomind providers configure` calls would each see the
+     * original config, mutate locally, and the second writer would silently
+     * drop the first writer's API key.
+     */
+    set(cwd, key, value) {
+        const KNOWN_SET_SECTIONS = new Set(['version', 'agents', 'swarm', 'memory', 'mcp', 'cli', 'hooks']);
+        const topSection = String(key).split('.')[0];
+        if (!KNOWN_SET_SECTIONS.has(topSection)) {
+            throw new Error(`Unknown config section: "${topSection}". Allowed: ${[...KNOWN_SET_SECTIONS].join(', ')}`);
+        }
+        const sanitisedValue = sanitizeConfigObject(value);
+        const targetPath = this.configPath ?? this.findConfig(cwd) ?? path.resolve(cwd, CONFIG_FILENAMES[0]);
+        // Re-read from disk inside the write window so we operate on the latest
+        // bytes, not on a possibly-stale this.config cache. This still isn't
+        // cross-process atomic without an OS-level flock, but combined with the
+        // O_EXCL atomic rename it prevents the most common credential-clobber
+        // window where two CLIs interleave their getConfig→set→write cycles.
+        let onDisk = { ...DEFAULT_CONFIG };
+        if (fs.existsSync(targetPath)) {
+            try {
+                const parsed = JSON.parse(fs.readFileSync(targetPath, 'utf-8'));
+                onDisk = sanitizeConfigObject(parsed);
+            }
+            catch { /* fall through to defaults */ }
+        }
+        setNestedValue(onDisk, key, sanitisedValue);
+        this.writeAtomic(targetPath, onDisk);
+        this.config = onDisk;
+        this.configPath = targetPath;
+    }
+    /** Create a new config file with defaults */
+    create(cwd, overrides, force) {
+        const targetPath = path.resolve(cwd, CONFIG_FILENAMES[0]);
+        if (fs.existsSync(targetPath) && !force) {
+            throw new Error(`Config file already exists: ${targetPath}. Use --force to overwrite.`);
+        }
+        const config = { ...DEFAULT_CONFIG, ...(overrides ? sanitizeConfigObject(overrides) : {}) };
+        this.writeAtomic(targetPath, config);
+        this.config = config;
+        this.configPath = targetPath;
+        return targetPath;
+    }
+    /** Reset config to defaults */
+    reset(cwd) {
+        const targetPath = this.configPath ?? path.resolve(cwd, CONFIG_FILENAMES[0]);
+        this.writeAtomic(targetPath, DEFAULT_CONFIG);
+        this.config = { ...DEFAULT_CONFIG };
+        this.configPath = targetPath;
+        return targetPath;
+    }
+    /** Export config to a specific path */
+    exportTo(cwd, exportPath) {
+        const config = this.getConfig(cwd);
+        const resolved = path.resolve(cwd, exportPath);
+        const projectRoot = path.resolve(cwd);
+        if (!resolved.startsWith(projectRoot + path.sep) && resolved !== projectRoot) {
+            throw new Error('Export path must be within the project directory');
+        }
+        this.writeAtomic(resolved, config);
+    }
+    /** Import config from a specific path */
+    importFrom(cwd, importPath) {
+        const resolved = path.resolve(cwd, importPath);
+        if (!fs.existsSync(resolved)) {
+            throw new Error(`Import file not found: ${resolved}`);
+        }
+        const content = fs.readFileSync(resolved, 'utf-8');
+        let importedRaw;
+        try {
+            importedRaw = JSON.parse(content);
+        }
+        catch {
+            throw new Error(`Invalid JSON in import file: ${resolved}`);
+        }
+        if (typeof importedRaw !== 'object' || importedRaw === null || Array.isArray(importedRaw)) {
+            throw new Error('Import file must contain a JSON object');
+        }
+        // Recursively strip prototype-pollution keys at every nesting level —
+        // KNOWN_SECTIONS only validates top-level keys, leaving nested
+        // {agents:{providers:[{__proto__:{...}}]}} unsanitized.
+        const imported = sanitizeConfigObject(importedRaw);
+        const KNOWN_SECTIONS = new Set(['version', 'agents', 'swarm', 'memory', 'mcp', 'cli', 'hooks']);
+        for (const key of Object.keys(imported)) {
+            if (!KNOWN_SECTIONS.has(key)) {
+                throw new Error(`Unknown config section: "${key}"`);
+            }
+        }
+        const targetPath = this.configPath ?? path.resolve(cwd, CONFIG_FILENAMES[0]);
+        this.writeAtomic(targetPath, imported);
+        this.config = imported;
+        this.configPath = targetPath;
+    }
+    /** Get the path to the current config file */
+    getConfigPath() {
+        return this.configPath;
+    }
+    /** Get default config */
+    getDefaults() {
+        return { ...DEFAULT_CONFIG };
+    }
+    /** Atomic write with restrictive 0o600 mode.
+     * SECURITY: this config file may contain API keys (per `commands/providers.ts`).
+     * Without explicit mode the file inherits the umask (typically 0o644 →
+     * world-readable). Set 0o600 on tmp file BEFORE rename, then re-chmod after
+     * rename in case the rename target had a more permissive mode.
+     */
+    writeAtomic(filePath, data) {
+        const dir = path.dirname(filePath);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        const tmpPath = `${filePath}.${process.pid}.tmp`;
+        fs.writeFileSync(tmpPath, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 });
+        fs.renameSync(tmpPath, filePath);
+        try {
+            fs.chmodSync(filePath, 0o600);
+        }
+        catch { /* best effort */ }
+    }
+}
+const FORBIDDEN_KEY_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+/**
+ * Recursively strip prototype-pollution keys from a parsed JSON object before
+ * it lands in this.config or is persisted back to disk. JSON.parse alone does
+ * not pollute, but downstream consumers that shallow-merge config values
+ * (Object.assign, spread) would propagate poisoned keys; persisting them back
+ * to disk also makes the pollution survive restarts.
+ */
+function sanitizeConfigObject(value, depth = 0) {
+    if (depth > 32)
+        return null;
+    if (Array.isArray(value))
+        return value.map(v => sanitizeConfigObject(v, depth + 1));
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (FORBIDDEN_KEY_SEGMENTS.has(k))
+                continue;
+            out[k] = sanitizeConfigObject(v, depth + 1);
+        }
+        return out;
+    }
+    return value;
+}
+/** Get a nested value by dot-separated key */
+function getNestedValue(obj, key) {
+    const parts = key.split('.');
+    for (const part of parts) {
+        if (FORBIDDEN_KEY_SEGMENTS.has(part))
+            return undefined;
+    }
+    let current = obj;
+    for (const part of parts) {
+        if (current === null || current === undefined || typeof current !== 'object') {
+            return undefined;
+        }
+        current = current[part];
+    }
+    return current;
+}
+/** Set a nested value by dot-separated key */
+function setNestedValue(obj, key, value) {
+    const parts = key.split('.');
+    for (const part of parts) {
+        if (FORBIDDEN_KEY_SEGMENTS.has(part)) {
+            throw new Error(`Forbidden config key segment: "${part}"`);
+        }
+    }
+    let current = obj;
+    for (let i = 0; i < parts.length - 1; i++) {
+        const part = parts[i];
+        if (!(part in current) || typeof current[part] !== 'object' || current[part] === null) {
+            current[part] = {};
+        }
+        current = current[part];
+    }
+    current[parts[parts.length - 1]] = value;
+}
+/** Parse a string value to the appropriate type */
+export function parseConfigValue(value) {
+    if (value === 'true')
+        return true;
+    if (value === 'false')
+        return false;
+    if (/^\d+$/.test(value))
+        return parseInt(value, 10);
+    if (/^\d+\.\d+$/.test(value))
+        return parseFloat(value);
+    try {
+        const parsed = JSON.parse(value);
+        if (typeof parsed === 'object')
+            return parsed;
+    }
+    catch { /* not JSON, use as string */ }
+    return value;
+}
+/** Singleton instance */
+export const configManager = new ConfigFileManager();
+//# sourceMappingURL=config-file-manager.js.map

package/packages/@monomind/cli/dist/src/services/container-worker-pool.d.ts

@@ -0,0 +1,197 @@
+/**
+ * Container Worker Pool
+ * Docker-based worker pool for high-throughput headless execution.
+ *
+ * ADR-020: Headless Worker Integration Architecture - Phase 3
+ * - Manages pool of Docker containers for isolated worker execution
+ * - Supports dynamic scaling based on workload
+ * - Provides container lifecycle management
+ * - Integrates with WorkerQueue for task distribution
+ *
+ * Key Features:
+ * - Container pooling with configurable size
+ * - Health checking and auto-recovery
+ * - Resource limits (CPU, memory)
+ * - Volume mounting for workspace access
+ * - Network isolation per worker type
+ */
+import { EventEmitter } from 'events';
+import type { HeadlessWorkerType, HeadlessExecutionResult, SandboxMode } from './headless-worker-executor.js';
+/**
+ * Container state
+ */
+export type ContainerState = 'creating' | 'ready' | 'busy' | 'unhealthy' | 'terminated';
+/**
+ * Container info
+ */
+export interface ContainerInfo {
+    id: string;
+    name: string;
+    state: ContainerState;
+    createdAt: Date;
+    lastUsedAt?: Date;
+    workerType?: HeadlessWorkerType;
+    executionCount: number;
+    healthCheckFailures: number;
+    pid?: number;
+}
+/**
+ * Container pool configuration
+ */
+export interface ContainerPoolConfig {
+    /** Maximum number of containers in the pool */
+    maxContainers: number;
+    /** Minimum number of containers to keep warm */
+    minContainers: number;
+    /** Docker image to use */
+    image: string;
+    /** Container resource limits */
+    resources: {
+        cpus: string;
+        memory: string;
+    };
+    /** Health check interval in ms */
+    healthCheckIntervalMs: number;
+    /** Container idle timeout in ms */
+    idleTimeoutMs: number;
+    /** Workspace volume mount path */
+    workspacePath: string;
+    /** State persistence path */
+    statePath: string;
+    /** Network name for container isolation */
+    network?: string;
+    /** Environment variables for containers */
+    env?: Record<string, string>;
+    /** Default sandbox mode */
+    defaultSandbox: SandboxMode;
+}
+/**
+ * Container execution options
+ */
+export interface ContainerExecutionOptions {
+    workerType: HeadlessWorkerType;
+    prompt: string;
+    contextPatterns?: string[];
+    sandbox?: SandboxMode;
+    model?: string;
+    timeoutMs?: number;
+}
+/**
+ * Pool status
+ */
+export interface ContainerPoolStatus {
+    totalContainers: number;
+    readyContainers: number;
+    busyContainers: number;
+    unhealthyContainers: number;
+    queuedTasks: number;
+    containers: ContainerInfo[];
+    dockerAvailable: boolean;
+    lastHealthCheck?: Date;
+}
+/**
+ * ContainerWorkerPool - Manages Docker containers for headless worker execution
+ */
+export declare class ContainerWorkerPool extends EventEmitter {
+    private config;
+    private projectRoot;
+    private containers;
+    private taskQueue;
+    private healthCheckTimer?;
+    private idleCheckTimer?;
+    private dockerAvailable;
+    private initialized;
+    private isShuttingDown;
+    private exitHandlersRegistered;
+    constructor(projectRoot: string, config?: Partial<ContainerPoolConfig>);
+    /**
+     * Initialize the container pool
+     */
+    initialize(): Promise<boolean>;
+    /**
+     * Register process exit handlers to clean up containers
+     */
+    private registerExitHandlers;
+    /**
+     * Execute a worker in a container
+     */
+    execute(options: ContainerExecutionOptions): Promise<HeadlessExecutionResult>;
+    /**
+     * Scale pool for batch execution
+     */
+    scaleForBatch(workerCount: number): Promise<void>;
+    /**
+     * Get pool status
+     */
+    getStatus(): ContainerPoolStatus;
+    /**
+     * Shutdown the pool
+     */
+    shutdown(): Promise<void>;
+    /**
+     * Check if Docker is available (async)
+     */
+    private checkDockerAvailable;
+    /**
+     * Ensure the container image exists (async)
+     */
+    private ensureImage;
+    /**
+     * Create a new container
+     */
+    private createContainer;
+    /**
+     * Terminate a container (async)
+     */
+    private terminateContainer;
+    /**
+     * Get a ready container
+     */
+    private getReadyContainer;
+    /**
+     * Scale to minimum containers
+     */
+    private scaleToMinimum;
+    /**
+     * Execute worker in a specific container
+     */
+    private executeInContainer;
+    /**
+     * Execute command in container
+     */
+    private execInContainer;
+    /**
+     * Build worker command for container execution
+     */
+    private buildWorkerCommand;
+    /**
+     * Process queued tasks
+     */
+    private processQueue;
+    /**
+     * Start health check timer
+     */
+    private startHealthChecks;
+    /**
+     * Run health checks on all containers
+     */
+    private runHealthChecks;
+    /**
+     * Start idle check timer
+     */
+    private startIdleChecks;
+    /**
+     * Terminate idle containers above minimum
+     */
+    private runIdleChecks;
+    /**
+     * Try to parse JSON from output
+     */
+    private tryParseJson;
+    /**
+     * Create an error result
+     */
+    private createErrorResult;
+}
+export default ContainerWorkerPool;
+//# sourceMappingURL=container-worker-pool.d.ts.map