monomind 1.11.13 → 1.12.0

package/packages/@monomind/cli/dist/src/commands/agent-wasm.js

@@ -0,0 +1,333 @@
+/**
+ * WASM Agent CLI Subcommands
+ *
+ * Exposes @monoes/rvagent-wasm operations via the `agent` CLI command.
+ * Wraps functions from monovector/agent-wasm.ts for CLI usage.
+ */
+import { output } from '../output.js';
+const WASM_NOT_AVAILABLE_MSG = '@monoes/rvagent-wasm is not installed.\n' +
+    'Install it with: npm install @monoes/rvagent-wasm';
+async function loadWasm() {
+    const mod = await import('../monovector/agent-wasm.js');
+    return mod;
+}
+// agent wasm-status
+export const wasmStatusCommand = {
+    name: 'wasm-status',
+    description: 'Check rvagent-wasm availability, version, and capabilities',
+    options: [],
+    examples: [
+        { command: 'monomind agent wasm-status', description: 'Check WASM agent runtime status' },
+    ],
+    action: async (ctx) => {
+        try {
+            const wasm = await loadWasm();
+            const available = await wasm.isAgentWasmAvailable();
+            if (!available) {
+                output.writeln();
+                output.printWarning(WASM_NOT_AVAILABLE_MSG);
+                if (ctx.flags.format === 'json') {
+                    output.printJson({ available: false });
+                }
+                return { success: true, data: { available: false } };
+            }
+            // Init to get full status
+            await wasm.initAgentWasm();
+            const agents = wasm.listWasmAgents();
+            let galleryCount = 0;
+            let categories = {};
+            try {
+                galleryCount = await wasm.getGalleryCount();
+                categories = await wasm.getGalleryCategories();
+            }
+            catch {
+                // Gallery may not be available in all builds
+            }
+            const statusData = {
+                available: true,
+                activeAgents: agents.length,
+                gallery: {
+                    templates: galleryCount,
+                    categories,
+                },
+                tools: ['read_file', 'write_file', 'edit_file', 'write_todos', 'list_files'],
+                features: ['sandboxed-execution', 'virtual-filesystem', 'gallery-templates', 'rvf-containers', 'mcp-bridge'],
+            };
+            if (ctx.flags.format === 'json') {
+                output.printJson(statusData);
+                return { success: true, data: statusData };
+            }
+            output.writeln();
+            output.writeln(output.bold('WASM Agent Runtime'));
+            output.writeln();
+            output.printTable({
+                columns: [
+                    { key: 'property', header: 'Property', width: 20 },
+                    { key: 'value', header: 'Value', width: 40 },
+                ],
+                data: [
+                    { property: 'Available', value: output.success('yes') },
+                    { property: 'Active Agents', value: String(agents.length) },
+                    { property: 'Gallery Templates', value: String(galleryCount) },
+                    { property: 'Sandbox Tools', value: statusData.tools.join(', ') },
+                    { property: 'Features', value: statusData.features.join(', ') },
+                ],
+            });
+            if (Object.keys(categories).length > 0) {
+                output.writeln();
+                output.writeln(output.bold('Gallery Categories'));
+                output.printTable({
+                    columns: [
+                        { key: 'category', header: 'Category', width: 20 },
+                        { key: 'count', header: 'Templates', width: 10, align: 'right' },
+                    ],
+                    data: Object.entries(categories).map(([category, count]) => ({ category, count })),
+                });
+            }
+            return { success: true, data: statusData };
+        }
+        catch (error) {
+            output.printError(`WASM status check failed: ${String(error)}`);
+            return { success: false, exitCode: 1 };
+        }
+    },
+};
+// agent wasm-create
+export const wasmCreateCommand = {
+    name: 'wasm-create',
+    description: 'Create a WASM-sandboxed agent',
+    options: [
+        {
+            name: 'template',
+            short: 't',
+            description: 'Gallery template (coder, researcher, tester, reviewer, security, swarm)',
+            type: 'string',
+        },
+        {
+            name: 'model',
+            short: 'm',
+            description: 'Model identifier (default: anthropic:claude-sonnet-4-20250514)',
+            type: 'string',
+        },
+        {
+            name: 'instructions',
+            short: 'i',
+            description: 'System instructions for the agent',
+            type: 'string',
+        },
+        {
+            name: 'max-turns',
+            description: 'Maximum conversation turns (default: 50)',
+            type: 'number',
+            default: 50,
+        },
+    ],
+    examples: [
+        { command: 'monomind agent wasm-create', description: 'Create a default WASM agent' },
+        { command: 'monomind agent wasm-create -t coder', description: 'Create from gallery template' },
+        { command: 'monomind agent wasm-create -m "anthropic:claude-sonnet-4-20250514" -i "You are a security auditor"', description: 'Create with custom config' },
+    ],
+    action: async (ctx) => {
+        try {
+            const wasm = await loadWasm();
+            const available = await wasm.isAgentWasmAvailable();
+            if (!available) {
+                output.printError(WASM_NOT_AVAILABLE_MSG);
+                return { success: false, exitCode: 1 };
+            }
+            const template = ctx.flags.template;
+            let info;
+            if (template) {
+                output.printInfo(`Creating WASM agent from template: ${output.highlight(template)}`);
+                info = await wasm.createAgentFromTemplate(template);
+            }
+            else {
+                output.printInfo('Creating WASM agent...');
+                info = await wasm.createWasmAgent({
+                    model: ctx.flags.model,
+                    instructions: ctx.flags.instructions,
+                    maxTurns: ctx.flags['max-turns'],
+                });
+            }
+            if (ctx.flags.format === 'json') {
+                output.printJson({ success: true, agent: info, source: template ? 'gallery' : 'custom' });
+                return { success: true, data: info };
+            }
+            output.writeln();
+            output.printTable({
+                columns: [
+                    { key: 'property', header: 'Property', width: 15 },
+                    { key: 'value', header: 'Value', width: 45 },
+                ],
+                data: [
+                    { property: 'ID', value: info.id },
+                    { property: 'State', value: info.state },
+                    { property: 'Model', value: info.model },
+                    { property: 'Turn Count', value: String(info.turnCount) },
+                    { property: 'File Count', value: String(info.fileCount) },
+                    { property: 'Created', value: info.createdAt },
+                    ...(template ? [{ property: 'Template', value: template }] : []),
+                ],
+            });
+            output.writeln();
+            output.printSuccess(`WASM agent created: ${info.id}`);
+            return { success: true, data: info };
+        }
+        catch (error) {
+            output.printError(`Failed to create WASM agent: ${String(error)}`);
+            return { success: false, exitCode: 1 };
+        }
+    },
+};
+// agent wasm-prompt
+export const wasmPromptCommand = {
+    name: 'wasm-prompt',
+    description: 'Send a prompt to a WASM agent',
+    options: [
+        {
+            name: 'agent-id',
+            short: 'a',
+            description: 'WASM agent ID (required)',
+            type: 'string',
+        },
+        {
+            name: 'input',
+            short: 'i',
+            description: 'Prompt text to send',
+            type: 'string',
+        },
+    ],
+    examples: [
+        { command: 'monomind agent wasm-prompt -a wasm-agent-1-abc -i "Write a hello world"', description: 'Send prompt to WASM agent' },
+    ],
+    action: async (ctx) => {
+        const agentId = ctx.flags['agent-id'] || ctx.args[0];
+        const promptInput = ctx.flags.input || ctx.args[1];
+        if (!agentId) {
+            output.printError('Agent ID is required. Use --agent-id or -a');
+            return { success: false, exitCode: 1 };
+        }
+        if (!promptInput) {
+            output.printError('Prompt input is required. Use --input or -i');
+            return { success: false, exitCode: 1 };
+        }
+        try {
+            const wasm = await loadWasm();
+            const available = await wasm.isAgentWasmAvailable();
+            if (!available) {
+                output.printError(WASM_NOT_AVAILABLE_MSG);
+                return { success: false, exitCode: 1 };
+            }
+            output.printInfo(`Sending prompt to ${output.highlight(agentId)}...`);
+            const result = await wasm.promptWasmAgent(agentId, promptInput);
+            if (ctx.flags.format === 'json') {
+                output.printJson({ agentId, response: result });
+                return { success: true, data: { agentId, response: result } };
+            }
+            output.writeln();
+            output.writeln(output.bold('Response'));
+            output.writeln();
+            output.writeln(result);
+            // Show updated agent info
+            const info = wasm.getWasmAgent(agentId);
+            if (info) {
+                output.writeln();
+                output.writeln(output.dim(`[turns: ${info.turnCount}, files: ${info.fileCount}, state: ${info.state}]`));
+            }
+            return { success: true, data: { agentId, response: result } };
+        }
+        catch (error) {
+            output.printError(`Prompt failed: ${String(error)}`);
+            return { success: false, exitCode: 1 };
+        }
+    },
+};
+// agent wasm-gallery
+export const wasmGalleryCommand = {
+    name: 'wasm-gallery',
+    description: 'List available WASM agent gallery templates',
+    options: [
+        {
+            name: 'search',
+            short: 's',
+            description: 'Search templates by query',
+            type: 'string',
+        },
+        {
+            name: 'category',
+            short: 'c',
+            description: 'Filter by category',
+            type: 'string',
+        },
+    ],
+    examples: [
+        { command: 'monomind agent wasm-gallery', description: 'List all gallery templates' },
+        { command: 'monomind agent wasm-gallery -s coder', description: 'Search gallery templates' },
+    ],
+    action: async (ctx) => {
+        try {
+            const wasm = await loadWasm();
+            const available = await wasm.isAgentWasmAvailable();
+            if (!available) {
+                output.printError(WASM_NOT_AVAILABLE_MSG);
+                return { success: false, exitCode: 1 };
+            }
+            const searchQuery = ctx.flags.search;
+            const category = ctx.flags.category;
+            let templates;
+            if (searchQuery) {
+                output.printInfo(`Searching gallery for: ${output.highlight(searchQuery)}`);
+                templates = await wasm.searchGalleryTemplates(searchQuery);
+            }
+            else {
+                templates = await wasm.listGalleryTemplates();
+            }
+            // Filter by category if specified
+            if (category) {
+                templates = templates.filter((t) => t.category.toLowerCase() === category.toLowerCase());
+            }
+            if (ctx.flags.format === 'json') {
+                output.printJson({ templates, count: templates.length });
+                return { success: true, data: { templates, count: templates.length } };
+            }
+            output.writeln();
+            output.writeln(output.bold('WASM Agent Gallery'));
+            output.writeln();
+            if (templates.length === 0) {
+                output.printInfo('No templates found matching criteria');
+                return { success: true, data: { templates: [], count: 0 } };
+            }
+            output.printTable({
+                columns: [
+                    { key: 'id', header: 'ID', width: 20 },
+                    { key: 'name', header: 'Name', width: 18 },
+                    { key: 'category', header: 'Category', width: 12 },
+                    { key: 'description', header: 'Description', width: 35 },
+                    { key: 'version', header: 'Version', width: 10 },
+                ],
+                data: templates.map((t) => ({
+                    id: t.id,
+                    name: t.name,
+                    category: t.category,
+                    description: t.description.length > 35 ? t.description.slice(0, 32) + '...' : t.description,
+                    version: t.version,
+                })),
+            });
+            output.writeln();
+            output.printInfo(`${templates.length} template(s) found. Create with: agent wasm-create -t <id>`);
+            return { success: true, data: { templates, count: templates.length } };
+        }
+        catch (error) {
+            output.printError(`Gallery listing failed: ${String(error)}`);
+            return { success: false, exitCode: 1 };
+        }
+    },
+};
+/** All WASM subcommands for the agent command */
+export const wasmSubcommands = [
+    wasmStatusCommand,
+    wasmCreateCommand,
+    wasmPromptCommand,
+    wasmGalleryCommand,
+];
+//# sourceMappingURL=agent-wasm.js.map

package/packages/@monomind/cli/dist/src/commands/agent.js

@@ -19,7 +19,7 @@ function updateSwarmActivityMetrics(agentCountDelta) {
             timestamp: new Date().toISOString(),
             swarm: { active: false, agent_count: 0, coordination_active: false },
         };
-        if (fs.existsSync(activityPath)) {
+        if (fs.existsSync(activityPath) && fs.statSync(activityPath).size <= 10 * 1024 * 1024) {
             data = JSON.parse(fs.readFileSync(activityPath, 'utf-8'));
         }
         else {
@@ -113,8 +113,8 @@ const spawnCommand = {
         { command: 'monomind agent spawn -t researcher --task "Research React 19"', description: 'Spawn researcher with task' }
     ],
     action: async (ctx) => {
-        let agentType = ctx.flags.type;
-        let agentName = ctx.flags.name;
+        let agentType = ctx.flags.type?.slice(0, 64) ?? '';
+        let agentName = ctx.flags.name?.slice(0, 128) ?? '';
         // Interactive mode if type not specified
         if (!agentType && ctx.interactive) {
             agentType = await select({
@@ -123,7 +123,7 @@ const spawnCommand = {
             });
         }
         // Semantic routing: if --type absent but --task provided, use RouteLayer
-        const taskDescription = ctx.flags.task;
+        const taskDescription = ctx.flags.task?.slice(0, 2048);
         if (!agentType && taskDescription) {
             try {
                 // Builds a RouteLayer with a real local embedding model + headless
@@ -453,7 +453,10 @@ const metricsCommand = {
                 const files = readdirSync(agentsDir).filter(f => f.endsWith('.json'));
                 for (const file of files) {
                     try {
-                        const data = JSON.parse(readFileSync(join(agentsDir, file), 'utf-8'));
+                        const agentFilePath = join(agentsDir, file);
+                        if (statSync(agentFilePath).size > 512 * 1024)
+                            continue; // skip files > 512 KB
+                        const data = JSON.parse(readFileSync(agentFilePath, 'utf-8'));
                         totalAgents++;
                         const agType = data.type || 'unknown';
                         if (!typeCounts[agType])
@@ -475,7 +478,7 @@ const metricsCommand = {
         }
         // Read swarm activity for additional state
         const activityFile = join(swarmDir, 'swarm-activity.json');
-        if (existsSync(activityFile)) {
+        if (existsSync(activityFile) && statSync(activityFile).size <= 10 * 1024 * 1024) {
             try {
                 const activity = JSON.parse(readFileSync(activityFile, 'utf-8'));
                 if (activity.totalAgents && totalAgents === 0)
@@ -801,9 +804,9 @@ const logsCommand = {
         { command: 'monomind agent logs -l error --since 1h', description: 'Show errors from last hour' }
     ],
     action: async (ctx) => {
-        const agentId = ctx.args[0] || ctx.flags.id;
+        const agentId = ((ctx.args[0] || ctx.flags.id) ?? '').slice(0, 128);
         const tail = ctx.flags.tail;
-        const level = ctx.flags.level;
+        const level = ctx.flags.level?.slice(0, 32);
         if (!agentId) {
             output.printError('Agent ID is required. Use --id or -i');
             return { success: false, exitCode: 1 };

package/packages/@monomind/cli/dist/src/commands/analyze.js

@@ -28,6 +28,19 @@ async function getASTAnalyzer() {
 async function getGraphAnalyzer() {
     return null;
 }
+/**
+ * Write analysis output to a file, constraining the path to the current working
+ * directory to prevent path traversal attacks via --output /etc/cron.d/x or
+ * similar. Throws if the resolved path escapes cwd.
+ */
+async function safeWriteOutputFile(outputFile, data) {
+    const projectRoot = path.resolve(process.cwd());
+    const fullPath = path.resolve(process.cwd(), outputFile);
+    if (!fullPath.startsWith(projectRoot + path.sep) && fullPath !== projectRoot) {
+        throw new Error(`Output path must resolve within the project directory: ${projectRoot}`);
+    }
+    await writeFile(fullPath, data);
+}
 // Diff subcommand
 const diffCommand = {
     name: 'diff',
@@ -557,7 +570,7 @@ const astCommand = {
             if (formatType === 'json') {
                 const jsonOutput = { files: results, totals };
                 if (outputFile) {
-                    await writeFile(outputFile, JSON.stringify(jsonOutput, null, 2));
+                    await safeWriteOutputFile(outputFile, JSON.stringify(jsonOutput, null, 2));
                     output.printSuccess(`Results written to ${outputFile}`);
                 }
                 else {
@@ -649,7 +662,7 @@ const astCommand = {
                 }
             }
             if (outputFile) {
-                await writeFile(outputFile, JSON.stringify({ files: results, totals }, null, 2));
+                await safeWriteOutputFile(outputFile, JSON.stringify({ files: results, totals }, null, 2));
                 output.printSuccess(`Results written to ${outputFile}`);
             }
             return { success: true, data: { files: results, totals } };
@@ -750,7 +763,7 @@ const complexityAstCommand = {
             if (formatType === 'json') {
                 const jsonOutput = { files: results, summary: { total: results.length, flagged: flaggedCount, avgComplexity, threshold } };
                 if (outputFile) {
-                    await writeFile(outputFile, JSON.stringify(jsonOutput, null, 2));
+                    await safeWriteOutputFile(outputFile, JSON.stringify(jsonOutput, null, 2));
                     output.printSuccess(`Results written to ${outputFile}`);
                 }
                 else {
@@ -800,7 +813,7 @@ const complexityAstCommand = {
                 output.writeln(output.dim(`  ... and ${results.length - 15} more files`));
             }
             if (outputFile) {
-                await writeFile(outputFile, JSON.stringify({ files: results, summary: { total: results.length, flagged: flaggedCount, avgComplexity, threshold } }, null, 2));
+                await safeWriteOutputFile(outputFile, JSON.stringify({ files: results, summary: { total: results.length, flagged: flaggedCount, avgComplexity, threshold } }, null, 2));
                 output.printSuccess(`Results written to ${outputFile}`);
             }
             return { success: true, data: { files: results, flaggedCount } };
@@ -907,7 +920,7 @@ const symbolsCommand = {
             symbols.sort((a, b) => a.file.localeCompare(b.file) || a.name.localeCompare(b.name));
             if (formatType === 'json') {
                 if (outputFile) {
-                    await writeFile(outputFile, JSON.stringify(symbols, null, 2));
+                    await safeWriteOutputFile(outputFile, JSON.stringify(symbols, null, 2));
                     output.printSuccess(`Results written to ${outputFile}`);
                 }
                 else {
@@ -941,7 +954,7 @@ const symbolsCommand = {
                 output.writeln(output.dim(`  ... and ${symbols.length - 30} more symbols`));
             }
             if (outputFile) {
-                await writeFile(outputFile, JSON.stringify(symbols, null, 2));
+                await safeWriteOutputFile(outputFile, JSON.stringify(symbols, null, 2));
                 output.printSuccess(`Results written to ${outputFile}`);
             }
             return { success: true, data: symbols };
@@ -1043,7 +1056,7 @@ const importsCommand = {
                     fileImports: Object.fromEntries(fileImports),
                 };
                 if (outputFile) {
-                    await writeFile(outputFile, JSON.stringify(jsonOutput, null, 2));
+                    await safeWriteOutputFile(outputFile, JSON.stringify(jsonOutput, null, 2));
                     output.printSuccess(`Results written to ${outputFile}`);
                 }
                 else {
@@ -1081,7 +1094,7 @@ const importsCommand = {
                 output.writeln(output.dim(`  ... and ${sortedImports.length - 20} more imports`));
             }
             if (outputFile) {
-                await writeFile(outputFile, JSON.stringify({
+                await safeWriteOutputFile(outputFile, JSON.stringify({
                     imports: Object.fromEntries(sortedImports),
                     fileImports: Object.fromEntries(fileImports),
                 }, null, 2));
@@ -1378,7 +1391,8 @@ const boundariesCommand = {
     ],
     action: async (ctx) => {
         const targetDir = ctx.args[0] || ctx.cwd;
-        const numPartitions = ctx.flags.partitions || 2;
+        const rawPartitions = ctx.flags.partitions || 2;
+        const numPartitions = Number.isFinite(rawPartitions) ? Math.max(1, Math.min(rawPartitions, 100)) : 2;
         const outputFile = ctx.flags.output;
         const format = ctx.flags.format || 'text';
         output.printInfo(`Analyzing code boundaries in: ${output.highlight(targetDir)}`);
@@ -1406,7 +1420,7 @@ const boundariesCommand = {
                     circularDependencies: result.circularDependencies,
                 };
                 if (outputFile) {
-                    await writeFile(outputFile, JSON.stringify(jsonOutput, null, 2));
+                    await safeWriteOutputFile(outputFile, JSON.stringify(jsonOutput, null, 2));
                     output.printSuccess(`Results written to ${outputFile}`);
                 }
                 else {
@@ -1420,7 +1434,7 @@ const boundariesCommand = {
                     highlightCycles: true,
                 });
                 if (outputFile) {
-                    await writeFile(outputFile, dotOutput);
+                    await safeWriteOutputFile(outputFile, dotOutput);
                     output.printSuccess(`DOT graph written to ${outputFile}`);
                     output.writeln(output.dim('Visualize with: dot -Tpng -o graph.png ' + outputFile));
                 }
@@ -1480,7 +1494,7 @@ const boundariesCommand = {
                 }
             }
             if (outputFile) {
-                await writeFile(outputFile, JSON.stringify(result, null, 2));
+                await safeWriteOutputFile(outputFile, JSON.stringify(result, null, 2));
                 output.printSuccess(`Full results written to ${outputFile}`);
             }
             return { success: true, data: result };
@@ -1558,7 +1572,7 @@ const modulesCommand = {
                     statistics: result.statistics,
                 };
                 if (outputFile) {
-                    await writeFile(outputFile, JSON.stringify(jsonOutput, null, 2));
+                    await safeWriteOutputFile(outputFile, JSON.stringify(jsonOutput, null, 2));
                     output.printSuccess(`Results written to ${outputFile}`);
                 }
                 else {
@@ -1573,7 +1587,7 @@ const modulesCommand = {
                     highlightCycles: true,
                 });
                 if (outputFile) {
-                    await writeFile(outputFile, dotOutput);
+                    await safeWriteOutputFile(outputFile, dotOutput);
                     output.printSuccess(`DOT graph written to ${outputFile}`);
                     output.writeln(output.dim('Visualize with: dot -Tpng -o modules.png ' + outputFile));
                 }
@@ -1614,7 +1628,7 @@ const modulesCommand = {
                 }
             }
             if (outputFile) {
-                await writeFile(outputFile, JSON.stringify(result, null, 2));
+                await safeWriteOutputFile(outputFile, JSON.stringify(result, null, 2));
                 output.printSuccess(`Full results written to ${outputFile}`);
             }
             return { success: true, data: result };
@@ -1682,7 +1696,8 @@ const dependenciesCommand = {
         const format = ctx.flags.format || 'text';
         const include = (ctx.flags.include || '.ts,.tsx,.js,.jsx,.mjs,.cjs').split(',');
         const exclude = (ctx.flags.exclude || 'node_modules,dist,build,.git').split(',');
-        const maxDepth = ctx.flags.depth || 10;
+        const rawDepth = ctx.flags.depth || 10;
+        const maxDepth = Number.isFinite(rawDepth) ? Math.max(1, Math.min(rawDepth, 50)) : 10;
         output.printInfo(`Building dependency graph for: ${output.highlight(targetDir)}`);
         output.writeln();
         const spinner = output.createSpinner({ text: 'Scanning files...', spinner: 'dots' });
@@ -1711,7 +1726,7 @@ const dependenciesCommand = {
                     circularDependencies: circularDeps,
                 };
                 if (outputFile) {
-                    await writeFile(outputFile, JSON.stringify(jsonOutput, null, 2));
+                    await safeWriteOutputFile(outputFile, JSON.stringify(jsonOutput, null, 2));
                     output.printSuccess(`Graph written to ${outputFile}`);
                 }
                 else {
@@ -1733,7 +1748,7 @@ const dependenciesCommand = {
                     highlightCycles: true,
                 });
                 if (outputFile) {
-                    await writeFile(outputFile, dotOutput);
+                    await safeWriteOutputFile(outputFile, dotOutput);
                     output.printSuccess(`DOT graph written to ${outputFile}`);
                     output.writeln(output.dim('Visualize with: dot -Tpng -o deps.png ' + outputFile));
                 }
@@ -1791,7 +1806,7 @@ const dependenciesCommand = {
                     metadata: graph.metadata,
                     circularDependencies: circularDeps,
                 };
-                await writeFile(outputFile, JSON.stringify(fullOutput, null, 2));
+                await safeWriteOutputFile(outputFile, JSON.stringify(fullOutput, null, 2));
                 output.printSuccess(`Full results written to ${outputFile}`);
             }
             return { success: true };
@@ -1865,7 +1880,7 @@ const circularCommand = {
             if (format === 'json') {
                 const jsonOutput = { cycles: filtered, total: cycles.length, filtered: filtered.length };
                 if (outputFile) {
-                    await writeFile(outputFile, JSON.stringify(jsonOutput, null, 2));
+                    await safeWriteOutputFile(outputFile, JSON.stringify(jsonOutput, null, 2));
                     output.printSuccess(`Results written to ${outputFile}`);
                 }
                 else {
@@ -1909,7 +1924,7 @@ const circularCommand = {
                 }
             }
             if (outputFile) {
-                await writeFile(outputFile, JSON.stringify({ cycles: filtered }, null, 2));
+                await safeWriteOutputFile(outputFile, JSON.stringify({ cycles: filtered }, null, 2));
                 output.printSuccess(`Results written to ${outputFile}`);
             }
             return { success: true, data: { cycles: filtered } };

package/packages/@monomind/cli/dist/src/commands/autopilot.js

@@ -151,8 +151,11 @@ const configCommand = {
             state.maxIterations = validateNumber(maxIter, 1, 1000, state.maxIterations);
         if (timeout)
             state.timeoutMinutes = validateNumber(timeout, 1, 1440, state.timeoutMinutes);
-        if (sources)
-            state.taskSources = validateTaskSources(sources.split(',').map(s => s.trim()).filter(Boolean));
+        if (sources) {
+            // Cap total sources string length before splitting to prevent O(n) split on huge input
+            const cappedSources = sources.length > 512 ? sources.slice(0, 512) : sources;
+            state.taskSources = validateTaskSources(cappedSources.split(',').map(s => s.trim()).filter(Boolean));
+        }
         saveState(state);
         appendLog({ ts: Date.now(), event: 'config-updated', maxIterations: state.maxIterations, timeoutMinutes: state.timeoutMinutes, taskSources: state.taskSources });
         output.writeln(`Config updated: maxIterations=${state.maxIterations}, timeout=${state.timeoutMinutes}min, sources=${state.taskSources.join(',')}`);
@@ -248,12 +251,17 @@ const historyCommand = {
         { name: 'json', type: 'boolean', description: 'Output as JSON' },
     ],
     action: async (ctx) => {
-        const query = (ctx.flags?.query || '');
+        const rawQuery = (ctx.flags?.query || '');
         const limit = validateNumber(ctx.flags?.limit, 1, 100, 10);
-        if (!query) {
+        if (!rawQuery) {
             output.writeln('Usage: autopilot history --query "search terms" [--limit N]');
             return { success: false, message: 'Missing --query' };
         }
+        if (rawQuery.length > 1024) {
+            output.writeln('Error: --query too long (max 1024 characters)');
+            return { success: false, message: 'Query too long' };
+        }
+        const query = rawQuery;
         const learning = await tryLoadLearning();
         if (!learning) {
             output.writeln('Learning not available. No history to search.');