monomind 1.11.13 → 1.12.0

package/packages/@monomind/cli/dist/src/commands/issues.js

@@ -106,9 +106,9 @@ const claimCommand = {
         },
     ],
     action: async (ctx) => {
-        const issueId = (ctx.flags.issue || ctx.args[0]);
-        const agentStr = ctx.flags.agent;
-        const userStr = ctx.flags.user;
+        const issueId = (ctx.flags.issue || ctx.args[0])?.slice(0, 256);
+        const agentStr = ctx.flags.agent?.slice(0, 256);
+        const userStr = ctx.flags.user?.slice(0, 256);
         if (!issueId) {
             output.printError('Issue ID is required');
             return { success: false, exitCode: 1 };
@@ -120,13 +120,13 @@ const claimCommand = {
         const claimant = agentStr
             ? {
                 type: 'agent',
-                agentType: agentStr.split(':')[0],
-                agentId: agentStr.split(':')[1] || `${agentStr.split(':')[0]}-1`,
+                agentType: agentStr.split(':')[0].slice(0, 64),
+                agentId: (agentStr.split(':')[1] || `${agentStr.split(':')[0]}-1`).slice(0, 128),
             }
             : {
                 type: 'human',
-                userId: userStr.split(':')[0],
-                name: userStr.split(':')[1] || userStr.split(':')[0],
+                userId: userStr.split(':')[0].slice(0, 128),
+                name: (userStr.split(':')[1] || userStr.split(':')[0]).slice(0, 128),
             };
         const service = getClaimService(ctx.cwd);
         await service.initialize();
@@ -165,9 +165,9 @@ const releaseCommand = {
         },
     ],
     action: async (ctx) => {
-        const issueId = (ctx.flags.issue || ctx.args[0]);
-        const agentStr = ctx.flags.agent;
-        const userStr = ctx.flags.user;
+        const issueId = (ctx.flags.issue || ctx.args[0])?.slice(0, 256);
+        const agentStr = ctx.flags.agent?.slice(0, 256);
+        const userStr = ctx.flags.user?.slice(0, 256);
         if (!issueId) {
             output.printError('Issue ID is required');
             return { success: false, exitCode: 1 };
@@ -179,13 +179,13 @@ const releaseCommand = {
         const claimant = agentStr
             ? {
                 type: 'agent',
-                agentType: agentStr.split(':')[0],
-                agentId: agentStr.split(':')[1] || `${agentStr.split(':')[0]}-1`,
+                agentType: agentStr.split(':')[0].slice(0, 64),
+                agentId: (agentStr.split(':')[1] || `${agentStr.split(':')[0]}-1`).slice(0, 128),
             }
             : {
                 type: 'human',
-                userId: userStr.split(':')[0],
-                name: userStr.split(':')[1] || userStr.split(':')[0],
+                userId: userStr.split(':')[0].slice(0, 128),
+                name: (userStr.split(':')[1] || userStr.split(':')[0]).slice(0, 128),
             };
         const service = getClaimService(ctx.cwd);
         await service.initialize();
@@ -210,10 +210,10 @@ const handoffCommand = {
         { name: 'reason', short: 'r', type: 'string', description: 'Handoff reason', default: 'Handoff requested' },
     ],
     action: async (ctx) => {
-        const issueId = (ctx.flags.issue || ctx.args[0]);
-        const toStr = ctx.flags.to;
-        const fromStr = ctx.flags.from;
-        const reason = ctx.flags.reason;
+        const issueId = (ctx.flags.issue || ctx.args[0])?.slice(0, 256);
+        const toStr = ctx.flags.to?.slice(0, 256);
+        const fromStr = ctx.flags.from?.slice(0, 256);
+        const reason = (ctx.flags.reason || 'Handoff requested').slice(0, 512);
         if (!issueId || !toStr) {
             output.printError('Issue ID and --to are required');
             return { success: false, exitCode: 1 };
@@ -257,7 +257,7 @@ const statusCommand = {
         { name: 'note', short: 'n', type: 'string', description: 'Status note' },
     ],
     action: async (ctx) => {
-        const issueId = (ctx.flags.issue || ctx.args[0]);
+        const issueId = (ctx.flags.issue || ctx.args[0])?.slice(0, 256);
         if (!issueId) {
             output.printError('Issue ID is required');
             return { success: false, exitCode: 1 };
@@ -265,8 +265,11 @@ const statusCommand = {
         const service = getClaimService(ctx.cwd);
         await service.initialize();
         const newStatus = ctx.flags.set;
-        const progress = ctx.flags.progress;
-        const note = ctx.flags.note;
+        const rawProgress = ctx.flags.progress;
+        const progress = rawProgress !== undefined
+            ? Math.max(0, Math.min(100, Math.floor(rawProgress)))
+            : undefined;
+        const note = ctx.flags.note?.slice(0, 512);
         try {
             if (newStatus) {
                 await service.updateStatus(issueId, newStatus, note);
@@ -301,7 +304,7 @@ const stealableCommand = {
         { name: 'type', short: 't', type: 'string', description: 'Filter by agent type' },
     ],
     action: async (ctx) => {
-        const agentType = ctx.flags.type;
+        const agentType = ctx.flags.type?.slice(0, 64);
         const service = getClaimService(ctx.cwd);
         await service.initialize();
         const stealable = await service.getStealable(agentType);
@@ -331,16 +334,16 @@ const stealCommand = {
         { name: 'agent', short: 'a', type: 'string', description: 'Steal as agent', required: true },
     ],
     action: async (ctx) => {
-        const issueId = (ctx.flags.issue || ctx.args[0]);
-        const agentStr = ctx.flags.agent;
+        const issueId = (ctx.flags.issue || ctx.args[0])?.slice(0, 256);
+        const agentStr = (ctx.flags.agent || '').slice(0, 256);
         if (!issueId) {
             output.printError('Issue ID is required');
             return { success: false, exitCode: 1 };
         }
         const stealer = {
             type: 'agent',
-            agentType: agentStr.split(':')[0],
-            agentId: agentStr.split(':')[1] || `${agentStr.split(':')[0]}-1`,
+            agentType: agentStr.split(':')[0].slice(0, 64),
+            agentId: (agentStr.split(':')[1] || `${agentStr.split(':')[0]}-1`).slice(0, 128),
         };
         const service = getClaimService(ctx.cwd);
         await service.initialize();

package/packages/@monomind/cli/dist/src/commands/mcp.js

@@ -88,10 +88,15 @@ const startCommand = {
         { command: 'monomind mcp start -f', description: 'Force restart (kill existing)' }
     ],
     action: async (ctx) => {
-        const port = ctx.flags.port ?? 3000;
-        const host = ctx.flags.host ?? 'localhost';
+        const rawPort = ctx.flags.port ?? 3000;
+        const port = Number.isFinite(rawPort) && rawPort >= 1 && rawPort <= 65535 ? Math.floor(rawPort) : 3000;
+        const rawHost = ctx.flags.host ?? 'localhost';
+        // Cap host length and reject control chars to prevent injection
+        const host = typeof rawHost === 'string' ? rawHost.slice(0, 253).replace(/[\x00-\x1f]/g, '') : 'localhost';
         const transport = ctx.flags.transport ?? 'stdio';
-        const tools = ctx.flags.tools || 'all';
+        const rawTools = ctx.flags.tools || 'all';
+        // Cap tools string to prevent DoS via oversized comma-separated lists
+        const tools = typeof rawTools === 'string' ? rawTools.slice(0, 2000) : 'all';
         const daemon = ctx.flags.daemon ?? false;
         const force = ctx.flags.force ?? false;
         output.writeln();
@@ -599,14 +604,15 @@ const logsCommand = {
     action: async (ctx) => {
         const lines = ctx.flags.lines || 50;
         // Try to find and read the actual log file
-        const { existsSync, readFileSync } = await import('fs');
+        const { existsSync, readFileSync, statSync } = await import('fs');
         const { join } = await import('path');
+        const MAX_MCP_LOG_BYTES = 10 * 1024 * 1024; // 10 MB
         const logPaths = [
             join(ctx.cwd, '.monomind', 'logs', 'mcp-server.log'),
             join(ctx.cwd, '.monomind', 'logs', 'daemon.log'),
             join(ctx.cwd, '.monomind', 'mcp.log'),
         ];
-        const logFile = logPaths.find(p => existsSync(p));
+        const logFile = logPaths.find(p => existsSync(p) && statSync(p).size <= MAX_MCP_LOG_BYTES);
         output.writeln();
         output.writeln(output.bold('MCP Server Logs'));
         output.writeln(output.dim('─'.repeat(50)));

package/packages/@monomind/cli/dist/src/commands/memory.js

@@ -511,6 +511,11 @@ const editCommand = {
             output.printError(`File not found: ${filePath}`);
             return { success: false, exitCode: 1 };
         }
+        const MAX_MEMORY_FILE_BYTES = 50 * 1024 * 1024; // 50 MB
+        if (fs.statSync(filePath).size > MAX_MEMORY_FILE_BYTES) {
+            output.printError(`Memory file too large (> 50 MB): ${filePath}`);
+            return { success: false, exitCode: 1 };
+        }
         let entries;
         try {
             const raw = fs.readFileSync(filePath, 'utf8');
@@ -763,6 +768,11 @@ const deleteCommand = {
             output.printError(`File not found: ${filePath}`);
             return { success: false, exitCode: 1 };
         }
+        const MAX_MEMORY_FILE_BYTES = 50 * 1024 * 1024; // 50 MB
+        if (fs.statSync(filePath).size > MAX_MEMORY_FILE_BYTES) {
+            output.printError(`Memory file too large (> 50 MB): ${filePath}`);
+            return { success: false, exitCode: 1 };
+        }
         let entries;
         try {
             const raw = fs.readFileSync(filePath, 'utf8');

package/packages/@monomind/cli/dist/src/commands/migrate.js

@@ -47,7 +47,7 @@ const statusCommand = {
         let hasV2Config = false;
         let hasv1Config = false;
         try {
-            if (fs.existsSync(v2ConfigPath)) {
+            if (fs.existsSync(v2ConfigPath) && fs.statSync(v2ConfigPath).size <= MAX_MIGRATE_FILE_BYTES) {
                 const raw = fs.readFileSync(v2ConfigPath, 'utf-8');
                 const parsed = JSON.parse(raw);
                 if (parsed.version === '2' || parsed.version === 2 || !parsed.version) {
@@ -110,7 +110,7 @@ const statusCommand = {
         const migrationStatePath = path.join(cwd, '.monomind', 'migration-state.json');
         let migrationState = null;
         try {
-            if (fs.existsSync(migrationStatePath)) {
+            if (fs.existsSync(migrationStatePath) && fs.statSync(migrationStatePath).size <= MAX_MIGRATE_FILE_BYTES) {
                 const raw = fs.readFileSync(migrationStatePath, 'utf-8');
                 const parsed = JSON.parse(raw);
                 migrationState = parsed.status || 'unknown';
@@ -214,7 +214,7 @@ const runCommand = {
         if (!target || target === 'config') {
             const v2ConfigPath = path.join(cwd, 'monomind.config.json');
             try {
-                if (fs.existsSync(v2ConfigPath)) {
+                if (fs.existsSync(v2ConfigPath) && fs.statSync(v2ConfigPath).size <= MAX_MIGRATE_FILE_BYTES) {
                     const raw = fs.readFileSync(v2ConfigPath, 'utf-8');
                     const parsed = JSON.parse(raw);
                     if (parsed.version === '2' || parsed.version === 2 || !parsed.version) {
@@ -415,7 +415,7 @@ const verifyCommand = {
         // Check 1: Migration state file exists
         let migrationState = null;
         try {
-            if (fs.existsSync(migrationStatePath)) {
+            if (fs.existsSync(migrationStatePath) && fs.statSync(migrationStatePath).size <= MAX_MIGRATE_FILE_BYTES) {
                 const raw = fs.readFileSync(migrationStatePath, 'utf-8');
                 migrationState = JSON.parse(raw);
                 checks.push({ check: 'Migration state file', result: 'passed' });
@@ -432,7 +432,7 @@ const verifyCommand = {
         // Check 2: v1 config exists and is valid JSON
         const v1ConfigPath = path.join(v1Dir, 'config.json');
         try {
-            if (fs.existsSync(v1ConfigPath)) {
+            if (fs.existsSync(v1ConfigPath) && fs.statSync(v1ConfigPath).size <= MAX_MIGRATE_FILE_BYTES) {
                 const raw = fs.readFileSync(v1ConfigPath, 'utf-8');
                 JSON.parse(raw); // validate JSON
                 checks.push({ check: 'v1 config (valid JSON)', result: 'passed' });

package/packages/@monomind/cli/dist/src/commands/monograph.js

@@ -255,16 +255,27 @@ const searchCommand = {
         { command: 'monomind monograph search -q "pipeline" --mode semantic', description: 'Semantic (embedding) search' },
     ],
     action: async (ctx) => {
-        const query = ctx.flags.query;
-        const limit = parseInt(ctx.flags.limit || '15', 10);
-        const label = ctx.flags.label;
-        const mode = ctx.flags.mode ?? 'hybrid';
+        const rawQuery = ctx.flags.query;
+        const rawLimit = parseInt(ctx.flags.limit || '15', 10);
+        const rawLabel = ctx.flags.label;
+        const rawMode = ctx.flags.mode ?? 'hybrid';
         const root = resolve(ctx.flags.path ?? process.cwd());
         const dbPath = getDbPath(root);
+        // Cap query to prevent SQLite FTS DoS from multi-MB query strings
+        const MAX_QUERY_LEN = 2048;
+        const query = typeof rawQuery === 'string' ? rawQuery.slice(0, MAX_QUERY_LEN) : '';
         if (!query) {
             output.printError('--query is required');
             return { success: false, exitCode: 1 };
         }
+        // Clamp limit to prevent huge result sets from causing OOM
+        const limit = isFinite(rawLimit) && rawLimit > 0 ? Math.min(rawLimit, 500) : 15;
+        // Validate mode to an explicit allowlist
+        const VALID_MODES = new Set(['bm25', 'semantic', 'hybrid']);
+        const mode = VALID_MODES.has(rawMode) ? rawMode : 'hybrid';
+        // Cap label to prevent oversized SQL filter values
+        const MAX_LABEL_LEN = 64;
+        const label = typeof rawLabel === 'string' ? rawLabel.slice(0, MAX_LABEL_LEN) : undefined;
         if (!existsSync(dbPath)) {
             output.printWarning('No knowledge graph found. Run: monomind monograph build');
             return { success: false, exitCode: 1 };
@@ -345,7 +356,9 @@ const statsCommand = {
     ],
     action: async (ctx) => {
         const root = resolve(ctx.flags.path ?? process.cwd());
-        const top = parseInt(ctx.flags.top || '10', 10);
+        const rawTop = parseInt(ctx.flags.top || '10', 10);
+        // Clamp top-N to prevent arbitrarily large SQL LIMIT values
+        const top = isFinite(rawTop) && rawTop > 0 ? Math.min(rawTop, 200) : 10;
         const dbPath = getDbPath(root);
         if (!existsSync(dbPath)) {
             output.printWarning('No knowledge graph found. Run: monomind monograph build');

package/packages/@monomind/cli/dist/src/commands/monovector/backup.js

@@ -461,7 +461,14 @@ const restoreSubcommand = {
                 output.printError(`File not found: ${inputPath}`);
                 return { success: false, exitCode: 1 };
             }
-            // Read file
+            // Read file — check size first to avoid OOM on a runaway or corrupt file.
+            const fileSize = fs.statSync(inputPath).size;
+            const MAX_BACKUP_BYTES = 500 * 1024 * 1024; // 500 MB
+            if (fileSize > MAX_BACKUP_BYTES) {
+                spinner.fail('Backup file too large');
+                output.printError(`Backup file exceeds size limit (${formatBytes(fileSize)} > ${formatBytes(MAX_BACKUP_BYTES)})`);
+                return { success: false, exitCode: 1 };
+            }
             let content;
             if (inputPath.endsWith('.gz')) {
                 const zlib = await import('zlib');
@@ -473,7 +480,6 @@ const restoreSubcommand = {
             else {
                 content = fs.readFileSync(inputPath, 'utf-8');
             }
-            const fileSize = fs.statSync(inputPath).size;
             spinner.succeed(`Read backup file (${formatBytes(fileSize)})`);
             // Determine format
             const isJson = content.trim().startsWith('{');

package/packages/@monomind/cli/dist/src/commands/monovector/benchmark.js

@@ -151,13 +151,26 @@ export const benchmarkCommand = {
     ],
     action: async (ctx) => {
         const config = getConnectionConfig(ctx);
-        const numVectors = parseInt(ctx.flags.vectors || '10000', 10);
-        const dimensions = parseInt(ctx.flags.dimensions || '1536', 10);
-        const numQueries = parseInt(ctx.flags.queries || '100', 10);
-        const topK = parseInt(ctx.flags.k || '10', 10);
-        const metric = ctx.flags.metric || 'cosine';
-        const indexType = ctx.flags.index || 'hnsw';
-        const batchSize = parseInt(ctx.flags['batch-size'] || '1000', 10);
+        // Clamp numeric inputs to safe ranges to prevent DoS via OOM
+        const numVectors = Math.min(Math.max(1, parseInt(ctx.flags.vectors || '10000', 10)), 1_000_000);
+        const dimensions = Math.min(Math.max(1, parseInt(ctx.flags.dimensions || '1536', 10)), 65536);
+        const numQueries = Math.min(Math.max(1, parseInt(ctx.flags.queries || '100', 10)), 10_000);
+        const topK = Math.min(Math.max(1, parseInt(ctx.flags.k || '10', 10)), 10_000);
+        // Validate metric and indexType against allowlists to prevent SQL injection
+        const VALID_METRICS = ['cosine', 'l2', 'inner'];
+        const VALID_INDEX_TYPES = ['hnsw', 'ivfflat', 'none'];
+        const rawMetric = ctx.flags.metric || 'cosine';
+        const rawIndexType = ctx.flags.index || 'hnsw';
+        const metric = VALID_METRICS.includes(rawMetric) ? rawMetric : 'cosine';
+        const indexType = VALID_INDEX_TYPES.includes(rawIndexType) ? rawIndexType : 'hnsw';
+        const batchSize = Math.min(Math.max(1, parseInt(ctx.flags['batch-size'] || '1000', 10)), 100_000);
+        // Validate schema identifier against safe pattern to prevent SQL injection
+        const rawSchema = config.schema || 'monomind';
+        if (!/^[a-zA-Z_][a-zA-Z0-9_]{0,62}$/.test(rawSchema)) {
+            output.printError('Invalid schema name. Only alphanumeric characters and underscores are allowed.');
+            return { success: false, exitCode: 1 };
+        }
+        config.schema = rawSchema;
         const cleanup = ctx.flags.cleanup !== false;
         output.writeln();
         output.writeln(output.bold('MonoVector Performance Benchmark'));

package/packages/@monomind/cli/dist/src/commands/monovector/import.js

@@ -184,6 +184,21 @@ export const importCommand = {
                 output.printError(`Input file not found: ${inputFile}`);
                 return { success: false, message: 'File not found' };
             }
+            // Symlink guard: a symlink could redirect to /etc/passwd or a huge file.
+            // lstatSync checks the link itself, not the target — so symlinks are rejected
+            // regardless of what they point to (TOCTOU-safe for the check + read pair).
+            const lstat = fs.lstatSync(inputFile);
+            if (lstat.isSymbolicLink()) {
+                output.printError(`Symlinks are not allowed as input files: ${inputFile}`);
+                return { success: false, message: 'Symlink not allowed' };
+            }
+            // Size guard: without this, a user can pass a multi-GB file and exhaust the
+            // Node heap before JSON.parse ever runs, crashing the CLI with an OOM.
+            const MAX_IMPORT_FILE_BYTES = 50 * 1024 * 1024; // 50 MB
+            if (lstat.size > MAX_IMPORT_FILE_BYTES) {
+                output.printError(`Input file too large: ${inputFile} (max 50 MB)`);
+                return { success: false, message: 'Input file too large' };
+            }
             try {
                 output.printInfo(`Reading: ${inputFile}`);
                 const content = fs.readFileSync(inputFile, 'utf-8');

package/packages/@monomind/cli/dist/src/commands/monovector/migrate.js

@@ -130,10 +130,13 @@ const MIGRATIONS = [
     `,
     },
 ];
+const IDENTIFIER_RE = /^[a-zA-Z_][a-zA-Z0-9_]{0,63}$/;
 /**
  * Get PostgreSQL connection config from context
  */
 function getConnectionConfig(ctx) {
+    const rawSchema = ctx.flags.schema || 'monomind';
+    const schema = IDENTIFIER_RE.test(rawSchema) ? rawSchema : 'monomind';
     return {
         host: ctx.flags.host || process.env.PGHOST || 'localhost',
         port: parseInt(ctx.flags.port || process.env.PGPORT || '5432', 10),
@@ -141,7 +144,7 @@ function getConnectionConfig(ctx) {
         user: ctx.flags.user || process.env.PGUSER || 'postgres',
         password: ctx.flags.password || process.env.PGPASSWORD || '',
         ssl: ctx.flags.ssl || process.env.PGSSLMODE === 'require',
-        schema: ctx.flags.schema || 'monomind',
+        schema,
     };
 }
 /**

package/packages/@monomind/cli/dist/src/commands/monovector/optimize.js

@@ -121,6 +121,17 @@ export const optimizeCommand = {
             output.printError('Database name is required. Use --database or -d flag, or set PGDATABASE env.');
             return { success: false, exitCode: 1 };
         }
+        // Validate schema identifier to prevent SQL injection
+        const IDENT_RE = /^[a-zA-Z_][a-zA-Z0-9_]{0,62}$/;
+        if (!IDENT_RE.test(config.schema)) {
+            output.printError('Invalid schema name. Only alphanumeric characters and underscores are allowed.');
+            return { success: false, exitCode: 1 };
+        }
+        // Validate --index flag if provided
+        if (specificIndex !== undefined && !IDENT_RE.test(specificIndex)) {
+            output.printError('Invalid index name. Only alphanumeric characters and underscores are allowed.');
+            return { success: false, exitCode: 1 };
+        }
         const spinner = output.createSpinner({ text: 'Connecting to PostgreSQL...', spinner: 'dots' });
         spinner.start();
         const recommendations = [];

package/packages/@monomind/cli/dist/src/commands/monovector/setup.js

@@ -685,13 +685,23 @@ export const setupCommand = {
         { command: 'monomind monovector setup --force', description: 'Overwrite existing files' },
     ],
     action: async (ctx) => {
-        const outputDir = ctx.flags.output || './monovector-postgres';
+        const rawOutputDir = ctx.flags.output || './monovector-postgres';
         const printOnly = ctx.flags.print;
         const force = ctx.flags.force;
         output.writeln();
         output.writeln(output.bold('MonoVector PostgreSQL Setup'));
         output.writeln(output.dim('='.repeat(50)));
         output.writeln();
+        // Guard against path traversal: resolve to absolute and ensure it stays within
+        // the current working directory or the user's home directory.
+        const resolvedOutput = path.resolve(rawOutputDir);
+        const safeBases = [process.cwd(), process.env.HOME || process.env.USERPROFILE || ''].filter(Boolean);
+        const withinSafeBase = safeBases.some(base => resolvedOutput.startsWith(base + path.sep) || resolvedOutput === base);
+        if (!withinSafeBase) {
+            output.printError(`Output path must be within the current directory or home directory: ${resolvedOutput}`);
+            return { success: false, exitCode: 1 };
+        }
+        const outputDir = resolvedOutput;
         if (printOnly) {
             // Print to stdout
             output.writeln(output.bold('=== docker-compose.yml ==='));

package/packages/@monomind/cli/dist/src/commands/neural.js

@@ -940,7 +940,7 @@ const importCommand = {
             }
             const patternsFile = path.join(memoryDir, 'patterns.json');
             let existingPatterns = [];
-            if (merge && fs.existsSync(patternsFile)) {
+            if (merge && fs.existsSync(patternsFile) && fs.statSync(patternsFile).size <= 50 * 1024 * 1024) {
                 existingPatterns = JSON.parse(fs.readFileSync(patternsFile, 'utf8'));
             }
             // Merge or replace

package/packages/@monomind/cli/dist/src/commands/performance.js

@@ -20,14 +20,18 @@ const benchmarkCommand = {
         { command: 'monomind performance benchmark -i 1000', description: 'Run with 1000 iterations' },
     ],
     action: async (ctx) => {
-        const suite = ctx.flags.suite || 'all';
+        const suiteRaw = ctx.flags.suite || 'all';
+        const VALID_SUITES = new Set(['all', 'wasm', 'neural', 'memory', 'search']);
+        const suite = VALID_SUITES.has(suiteRaw) ? suiteRaw : 'all';
         const MAX_ITERATIONS = 10_000;
         const MAX_WARMUP = 500;
         const iterationsRaw = parseInt(ctx.flags.iterations || '100', 10);
         const warmupRaw = parseInt(ctx.flags.warmup || '10', 10);
         const iterations = Number.isFinite(iterationsRaw) ? Math.min(Math.max(1, iterationsRaw), MAX_ITERATIONS) : 100;
         const warmup = Number.isFinite(warmupRaw) ? Math.min(Math.max(0, warmupRaw), MAX_WARMUP) : 10;
-        const outputFormat = ctx.flags.output || 'text';
+        const outputFormatRaw = ctx.flags.output || 'text';
+        const VALID_OUTPUT_FORMATS = new Set(['text', 'json', 'csv']);
+        const outputFormat = VALID_OUTPUT_FORMATS.has(outputFormatRaw) ? outputFormatRaw : 'text';
         output.writeln();
         output.writeln(output.bold('Performance Benchmark (Real Measurements)'));
         output.writeln(output.dim('─'.repeat(60)));
@@ -235,8 +239,11 @@ const profileCommand = {
         { command: 'monomind performance profile -d 60', description: 'Profile for 60 seconds' },
     ],
     action: async (ctx) => {
-        const type = ctx.flags.type || 'all';
-        const duration = parseInt(ctx.flags.duration || '30', 10);
+        const typeRaw = ctx.flags.type || 'all';
+        const VALID_PROFILE_TYPES = new Set(['cpu', 'memory', 'io', 'all']);
+        const type = VALID_PROFILE_TYPES.has(typeRaw) ? typeRaw : 'all';
+        const durationRaw = parseInt(ctx.flags.duration || '30', 10);
+        const duration = Number.isFinite(durationRaw) ? Math.min(Math.max(1, durationRaw), 300) : 30;
         output.writeln();
         output.writeln(output.bold('Performance Profiler'));
         output.writeln(output.dim('─'.repeat(50)));
@@ -308,8 +315,12 @@ const metricsCommand = {
         { command: 'monomind performance metrics -f prometheus', description: 'Export as Prometheus format' },
     ],
     action: async (ctx) => {
-        const timeframe = ctx.flags.timeframe || '24h';
-        const format = ctx.flags.format || 'text';
+        const timeframeRaw = ctx.flags.timeframe || '24h';
+        const VALID_TIMEFRAMES = new Set(['1h', '24h', '7d', '30d']);
+        const timeframe = VALID_TIMEFRAMES.has(timeframeRaw) ? timeframeRaw : '24h';
+        const formatRaw = ctx.flags.format || 'text';
+        const VALID_FORMATS = new Set(['text', 'json', 'prometheus']);
+        const format = VALID_FORMATS.has(formatRaw) ? formatRaw : 'text';
         output.writeln();
         output.writeln(output.bold(`Performance Metrics (${timeframe})`));
         output.writeln(output.dim('─'.repeat(50)));
@@ -491,7 +502,9 @@ const optimizeCommand = {
         { command: 'monomind performance optimize --apply', description: 'Apply all optimizations' },
     ],
     action: async (ctx) => {
-        const target = ctx.flags.target || 'all';
+        const targetRaw = ctx.flags.target || 'all';
+        const VALID_TARGETS = new Set(['memory', 'cpu', 'latency', 'all']);
+        const target = VALID_TARGETS.has(targetRaw) ? targetRaw : 'all';
         if (ctx.flags.apply) {
             output.printWarning('Optimization application is not yet implemented. Showing recommendations only.');
         }