monomind 1.11.13 → 1.12.0

package/packages/@monomind/cli/dist/src/agents/version-store.js

@@ -0,0 +1,235 @@
+/**
+ * Agent Version Store (Task 29)
+ *
+ * JSONL-based append-only storage for agent definition versions.
+ * Supports save, list, get, rollback, and diff operations.
+ */
+import { createHash, randomUUID, randomBytes } from 'crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, statSync } from 'fs';
+import { join } from 'path';
+import { computeUnifiedDiff } from './version-diff.js';
+import { parseJsonl } from '../utils/parse-jsonl.js';
+function toStored(r) {
+    return {
+        id: r.id,
+        slug: r.slug,
+        version: r.version,
+        changelog: r.changelog,
+        deprecated: r.deprecated,
+        deprecatedBy: r.deprecatedBy,
+        content: r.content,
+        contentHash: r.contentHash,
+        capturedAt: r.capturedAt instanceof Date
+            ? r.capturedAt.toISOString()
+            : String(r.capturedAt),
+        capturedBy: r.capturedBy,
+        isCurrent: r.isCurrent,
+    };
+}
+function fromStored(s) {
+    return {
+        id: s.id,
+        slug: s.slug,
+        version: s.version,
+        changelog: s.changelog,
+        deprecated: s.deprecated,
+        deprecatedBy: s.deprecatedBy,
+        content: s.content,
+        contentHash: s.contentHash,
+        capturedAt: new Date(s.capturedAt),
+        capturedBy: s.capturedBy,
+        isCurrent: s.isCurrent,
+    };
+}
+/**
+ * JSONL-based agent version store.
+ *
+ * Each slug's versions are stored in `<dirPath>/versions.jsonl`, one JSON
+ * object per line.  Rollback rewrites the file to update `isCurrent` flags.
+ */
+export class AgentVersionStore {
+    dirPath;
+    filePath;
+    constructor(dirPath) {
+        this.dirPath = dirPath;
+        if (!existsSync(dirPath)) {
+            mkdirSync(dirPath, { recursive: true });
+        }
+        this.filePath = join(dirPath, 'versions.jsonl');
+    }
+    // ---------------------------------------------------------------------------
+    // Persistence helpers
+    // ---------------------------------------------------------------------------
+    readAll() {
+        if (!existsSync(this.filePath)) {
+            return [];
+        }
+        const stat = statSync(this.filePath);
+        if (stat.size > 10 * 1024 * 1024) {
+            throw new Error('Version store exceeds size limit; run compaction');
+        }
+        const raw = readFileSync(this.filePath, 'utf-8');
+        // Drop any record whose stored contentHash does not match the SHA-256 of
+        // its content. saveVersion advertises tamper-evidence by computing the
+        // hash; without this verification step, an attacker who can write the
+        // JSONL file can swap `content` with a poisoned agent prompt while
+        // leaving `contentHash` unchanged, and the next getCurrent() returns
+        // the tampered prompt verbatim into the LLM context.
+        const records = parseJsonl(raw);
+        const verified = [];
+        for (const r of records) {
+            if (typeof r?.content !== 'string' ||
+                typeof r?.contentHash !== 'string' ||
+                typeof r?.id !== 'string' ||
+                typeof r?.slug !== 'string' ||
+                typeof r?.version !== 'string' ||
+                typeof r?.changelog !== 'string' ||
+                typeof r?.capturedBy !== 'string' ||
+                typeof r?.capturedAt !== 'string')
+                continue;
+            const actual = createHash('sha256').update(r.content).digest('hex');
+            if (actual !== r.contentHash)
+                continue; // silently drop tampered record
+            verified.push(r);
+        }
+        return verified.map(fromStored);
+    }
+    writeAll(records) {
+        const lines = records.map((r) => JSON.stringify(toStored(r)));
+        const tmp = `${this.filePath}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
+        writeFileSync(tmp, lines.join('\n') + '\n', 'utf-8');
+        renameSync(tmp, this.filePath);
+    }
+    // ---------------------------------------------------------------------------
+    // Public API
+    // ---------------------------------------------------------------------------
+    /**
+     * Save a new version for the given agent slug.
+     *
+     * Computes a SHA-256 hash of the content, marks all previous versions for
+     * the same slug as non-current, and appends the new record.
+     */
+    saveVersion(slug, content, version, changelog, opts = {}) {
+        const MAX_CONTENT_BYTES = 512 * 1024;
+        if (Buffer.byteLength(content, 'utf-8') > MAX_CONTENT_BYTES) {
+            throw new Error(`content exceeds maximum allowed size (${MAX_CONTENT_BYTES} bytes)`);
+        }
+        const contentHash = createHash('sha256').update(content).digest('hex');
+        // SINGLE-WRITER CONTRACT: version-store is written only by the daemon process.
+        // Concurrent saveVersion() calls from multiple processes would race on readAll/writeAll.
+        // If multi-writer access is needed in future, introduce an advisory lock here.
+        const existing = this.readAll();
+        for (const rec of existing) {
+            if (rec.slug === slug && rec.isCurrent) {
+                rec.isCurrent = false;
+            }
+        }
+        const record = {
+            id: randomUUID(),
+            slug,
+            version,
+            changelog,
+            deprecated: opts.deprecated ?? false,
+            deprecatedBy: opts.deprecatedBy,
+            content,
+            contentHash,
+            capturedAt: new Date(),
+            capturedBy: opts.capturedBy ?? 'system',
+            isCurrent: true,
+        };
+        existing.push(record);
+        this.writeAll(existing);
+        return record;
+    }
+    /**
+     * List all versions for a slug, sorted by capturedAt DESC (newest first).
+     * Uses insertion order (line index) as a stable tiebreaker.
+     */
+    listVersions(slug) {
+        const all = this.readAll();
+        const indexed = all.map((r, i) => ({ r, i }));
+        return indexed
+            .filter(({ r }) => r.slug === slug)
+            .sort((a, b) => {
+            const timeDiff = new Date(b.r.capturedAt).getTime() -
+                new Date(a.r.capturedAt).getTime();
+            return timeDiff !== 0 ? timeDiff : b.i - a.i;
+        })
+            .map(({ r }) => r);
+    }
+    /**
+     * Get the current active version for a slug, or null.
+     */
+    getCurrent(slug) {
+        const all = this.readAll();
+        const indexed = all.map((r, i) => ({ r, i }));
+        const matching = indexed.filter(({ r }) => r.slug === slug && r.isCurrent);
+        if (matching.length === 0)
+            return null;
+        // Return the most recent current record (insertion order as tiebreaker)
+        return matching.sort((a, b) => {
+            const timeDiff = new Date(b.r.capturedAt).getTime() -
+                new Date(a.r.capturedAt).getTime();
+            return timeDiff !== 0 ? timeDiff : b.i - a.i;
+        })[0].r;
+    }
+    /**
+     * Get a specific version by slug and semver string, or null.
+     */
+    getVersion(slug, version) {
+        return (this.readAll().find((r) => r.slug === slug && r.version === version) ?? null);
+    }
+    /**
+     * Roll back to a specific version.
+     *
+     * Marks the target version as current and all others for that slug as
+     * non-current.  Rewrites the JSONL file.
+     *
+     * @throws Error if the target version does not exist.
+     */
+    rollback(slug, toVersion) {
+        const all = this.readAll();
+        let target;
+        for (const rec of all) {
+            if (rec.slug === slug) {
+                if (rec.version === toVersion) {
+                    rec.isCurrent = true;
+                    target = rec;
+                }
+                else {
+                    rec.isCurrent = false;
+                }
+            }
+        }
+        if (!target) {
+            throw new Error(`Version "${toVersion}" not found for agent "${slug}"`);
+        }
+        this.writeAll(all);
+        return target;
+    }
+    /**
+     * Compute a line-level diff between two versions of the same agent.
+     *
+     * @throws Error if either version does not exist.
+     */
+    diff(slug, fromVersion, toVersion) {
+        const from = this.getVersion(slug, fromVersion);
+        if (!from) {
+            throw new Error(`Version "${fromVersion}" not found for agent "${slug}"`);
+        }
+        const to = this.getVersion(slug, toVersion);
+        if (!to) {
+            throw new Error(`Version "${toVersion}" not found for agent "${slug}"`);
+        }
+        const { additions, deletions, hunks } = computeUnifiedDiff(from.content, to.content);
+        return {
+            slug,
+            fromVersion,
+            toVersion,
+            additions,
+            deletions,
+            hunks,
+        };
+    }
+}
+//# sourceMappingURL=version-store.js.map

package/packages/@monomind/cli/dist/src/autopilot-state.js

@@ -19,6 +19,8 @@ export const LOG_FILE = `${STATE_DIR}/autopilot-log.json`;
 const MAX_HISTORY_ENTRIES = 50;
 /** Maximum entries kept in the event log */
 const MAX_LOG_ENTRIES = 1000;
+/** Maximum bytes before refusing to load a state/log JSON file (10 MB) */
+const MAX_STATE_FILE_BYTES = 10 * 1024 * 1024;
 /** Allowlist for valid task sources */
 export const VALID_TASK_SOURCES = new Set(['team-tasks', 'swarm-tasks', 'file-checklist']);
 /** Terminal task statuses */
@@ -91,7 +93,7 @@ export function loadState() {
     const filePath = path.resolve(STATE_FILE);
     const defaults = getDefaultState();
     try {
-        if (fs.existsSync(filePath)) {
+        if (fs.existsSync(filePath) && fs.statSync(filePath).size <= MAX_STATE_FILE_BYTES) {
             const raw = safeJsonParse(fs.readFileSync(filePath, 'utf-8'));
             const merged = { ...defaults, ...raw };
             // Re-validate fields that could be tampered with
@@ -190,7 +192,7 @@ function compactLog(filePath) {
 export function loadLog() {
     const filePath = path.resolve(LOG_FILE);
     try {
-        if (fs.existsSync(filePath)) {
+        if (fs.existsSync(filePath) && fs.statSync(filePath).size <= MAX_STATE_FILE_BYTES) {
             const raw = fs.readFileSync(filePath, 'utf-8');
             // Backward compatible: support both old JSON-array form and the new
             // append-only NDJSON form. Prefer NDJSON if the file looks line-based.
@@ -236,7 +238,10 @@ export function discoverTasks(sources) {
                         const files = fs.readdirSync(teamDir).filter((f) => f.endsWith('.json'));
                         for (const file of files) {
                             try {
-                                const data = safeJsonParse(fs.readFileSync(path.join(teamDir, file), 'utf-8'));
+                                const taskFilePath = path.join(teamDir, file);
+                                if (fs.statSync(taskFilePath).size > MAX_STATE_FILE_BYTES)
+                                    continue;
+                                const data = safeJsonParse(fs.readFileSync(taskFilePath, 'utf-8'));
                                 tasks.push({
                                     id: String(data.id || file.replace('.json', '')),
                                     subject: String(data.subject || data.title || file),
@@ -254,7 +259,7 @@ export function discoverTasks(sources) {
         if (source === 'swarm-tasks') {
             const swarmFile = path.resolve('.monomind/swarm-tasks.json');
             try {
-                if (fs.existsSync(swarmFile)) {
+                if (fs.existsSync(swarmFile) && fs.statSync(swarmFile).size <= MAX_STATE_FILE_BYTES) {
                     const data = safeJsonParse(fs.readFileSync(swarmFile, 'utf-8'));
                     const swarmTasks = Array.isArray(data) ? data : (data.tasks || []);
                     for (const t of swarmTasks) {
@@ -275,7 +280,7 @@ export function discoverTasks(sources) {
         if (source === 'file-checklist') {
             const checklistFile = path.resolve('.monomind/data/checklist.json');
             try {
-                if (fs.existsSync(checklistFile)) {
+                if (fs.existsSync(checklistFile) && fs.statSync(checklistFile).size <= MAX_STATE_FILE_BYTES) {
                     const data = safeJsonParse(fs.readFileSync(checklistFile, 'utf-8'));
                     const items = Array.isArray(data) ? data : (data.items || []);
                     for (const item of items) {

package/packages/@monomind/cli/dist/src/benchmarks/benchmark-runner.js

@@ -23,9 +23,22 @@ export class BenchmarkRunner {
         if (!fs.existsSync(resolved)) {
             return benchmarks;
         }
+        const MAX_BENCH_FILE_SIZE = 1 * 1024 * 1024; // 1 MB per benchmark file
         const files = fs.readdirSync(resolved).filter((f) => f.endsWith('.json'));
         for (const file of files) {
             const filePath = path.join(resolved, file);
+            // Guard against OOM: reject symlinks and oversized files before reading
+            let stat;
+            try {
+                stat = fs.lstatSync(filePath);
+            }
+            catch {
+                continue;
+            }
+            if (stat.isSymbolicLink())
+                continue;
+            if (stat.size > MAX_BENCH_FILE_SIZE)
+                continue;
             const raw = fs.readFileSync(filePath, 'utf-8');
             try {
                 const parsed = JSON.parse(raw);

package/packages/@monomind/cli/dist/src/benchmarks/metric-evaluators.js

@@ -6,15 +6,17 @@
  * Checks whether the output contains the expected substring.
  */
 export function containsExpected(output, config) {
-    const found = output.includes(config.expected);
+    // Cap expected to prevent huge strings from inflating returned objects
+    const expected = typeof config.expected === 'string' ? config.expected.slice(0, 200) : '';
+    const found = output.includes(expected);
     return {
         type: 'contains_expected',
         passed: found,
-        actual: found ? config.expected : null,
-        expected: config.expected,
+        actual: found ? expected : null,
+        expected,
         message: found
-            ? `Output contains expected string "${config.expected}"`
-            : `Output missing expected string "${config.expected}"`,
+            ? `Output contains expected string "${expected}"`
+            : `Output missing expected string "${expected}"`,
     };
 }
 /**
@@ -38,16 +40,20 @@ export function lengthRange(output, config) {
  */
 export function noHallucination(output, config) {
     const lowerOutput = output.toLowerCase();
-    const found = config.forbidden.filter((word) => lowerOutput.includes(word.toLowerCase()));
+    // Cap forbidden array to 200 entries to prevent unbounded O(n) scan
+    const forbidden = Array.isArray(config.forbidden) ? config.forbidden.slice(0, 200) : [];
+    const found = forbidden.filter((word) => typeof word === 'string' && lowerOutput.includes(word.toLowerCase()));
     const passed = found.length === 0;
+    // Truncate reflected words to avoid inflated messages
+    const truncatedFound = found.map((w) => w.slice(0, 50));
     return {
         type: 'no_hallucination',
         passed,
-        actual: found.length > 0 ? found : null,
+        actual: found.length > 0 ? truncatedFound : null,
         expected: null,
         message: passed
             ? 'No forbidden words found in output'
-            : `Forbidden words found: ${found.join(', ')}`,
+            : `Forbidden words found: ${truncatedFound.join(', ')}`,
     };
 }
 /**
@@ -56,8 +62,13 @@ export function noHallucination(output, config) {
 export function jsonValid(output) {
     let passed = false;
     let parsedType = null;
+    // Cap output before JSON.parse to prevent OOM on huge strings
+    const MAX_JSON_BYTES = 1 * 1024 * 1024; // 1 MB
+    const bounded = typeof output === 'string' && output.length > MAX_JSON_BYTES
+        ? output.slice(0, MAX_JSON_BYTES)
+        : output;
     try {
-        const parsed = JSON.parse(output);
+        const parsed = JSON.parse(bounded);
         passed = true;
         parsedType = typeof parsed;
     }

package/packages/@monomind/cli/dist/src/benchmarks/pretrain/index.d.ts

@@ -0,0 +1,45 @@
+export interface BenchmarkResult {
+    name: string;
+    iterations: number;
+    meanMs: number;
+    medianMs: number;
+    p95Ms: number;
+    p99Ms: number;
+    minMs: number;
+    maxMs: number;
+    stdDev: number;
+    opsPerSecond: number;
+    targetMet: boolean;
+    targetMs?: number;
+}
+export interface BenchmarkSuite {
+    name: string;
+    results: BenchmarkResult[];
+    totalDurationMs: number;
+    timestamp: string;
+    environment: {
+        nodeVersion: string;
+        platform: string;
+        arch: string;
+        cpuCount: number;
+    };
+}
+export interface BenchmarkConfig {
+    iterations: number;
+    warmupIterations: number;
+    targetMs?: number;
+    verbose?: boolean;
+}
+export declare function formatBenchmarkResult(result: BenchmarkResult): string;
+export declare function runBenchmark(name: string, fn: () => Promise<void> | void, config: BenchmarkConfig): Promise<BenchmarkResult>;
+export declare function benchmarkSONAAdaptation(config: BenchmarkConfig): Promise<BenchmarkResult>;
+export declare function benchmarkPatternLearning(config: BenchmarkConfig): Promise<BenchmarkResult>;
+export declare function benchmarkEWCConsolidation(config: BenchmarkConfig): Promise<BenchmarkResult>;
+export declare function benchmarkMemoryRetrieval(config: BenchmarkConfig): Promise<BenchmarkResult>;
+export declare function benchmarkEmbeddingGeneration(config: BenchmarkConfig): Promise<BenchmarkResult>;
+export declare function benchmarkMoERouting(config: BenchmarkConfig): Promise<BenchmarkResult>;
+export declare function benchmarkBatchCosine(config: BenchmarkConfig): Promise<BenchmarkResult>;
+export declare function benchmarkPretrainPipeline(config: BenchmarkConfig): Promise<BenchmarkResult>;
+export declare function runPretrainBenchmarkSuite(config?: Partial<BenchmarkConfig>): Promise<BenchmarkSuite>;
+export default runPretrainBenchmarkSuite;
+//# sourceMappingURL=index.d.ts.map