monomind 1.11.13 → 1.12.0

package/packages/@monomind/cli/dist/src/commands/platforms.js

@@ -4,8 +4,8 @@
  *
  * github.com/monoes/monomind
  */
-import { existsSync, writeFileSync, mkdirSync, readFileSync } from 'fs';
-import { join, dirname } from 'path';
+import { existsSync, writeFileSync, mkdirSync, readFileSync, statSync } from 'fs';
+import { join, dirname, resolve } from 'path';
 import { output } from '../output.js';
 export const SUPPORTED_PLATFORMS = [
     'claude', 'gemini', 'cursor', 'vscode', 'copilot',
@@ -43,15 +43,63 @@ Graph is at \`.monomind/monograph.db\`. Rebuild with: \`npx monograph build\`
 ${MONOMIND_BLOCK_END}
 `;
 }
+/**
+ * Maximum size for a platform config file we will read or append to.
+ * Platform config files (CLAUDE.md, .cursorrules, etc.) are never legitimately
+ * larger than a few hundred KB — a 1 MB cap prevents OOM when the flag points
+ * at an enormous file such as a binary or a DB dump.
+ */
+const MAX_CONFIG_FILE_BYTES = 1 * 1024 * 1024; // 1 MB
+/**
+ * Resolve and validate the user-supplied --path flag.
+ *
+ * SECURITY: the flag is attacker-controlled. Without validation an adversary can
+ *   pass --path /etc to overwrite system files, or --path "../../.." to escape
+ *   the project. We resolve to an absolute path and reject anything that isn't
+ *   a directory (or doesn't exist yet under a parent that does exist).
+ *   We do NOT further restrict the path to cwd because a legitimate use case is
+ *   "install into another repo at an absolute path", but we do require the
+ *   resolved path to be a directory (or the parent to exist) so that the caller
+ *   cannot aim the flag at a file.
+ */
+function resolveRepoPath(rawPath) {
+    // Prevent shell-injection via null bytes or unusual separators
+    if (rawPath.includes('\0'))
+        throw new Error('Invalid path: contains null byte');
+    const resolved = resolve(rawPath);
+    // If the path exists it must be a directory
+    if (existsSync(resolved)) {
+        const st = statSync(resolved);
+        if (!st.isDirectory())
+            throw new Error(`--path must be a directory, got a file: ${resolved}`);
+    }
+    return resolved;
+}
+/**
+ * Validate that fullPath is contained within repoRoot (path traversal defence).
+ * relPath comes from our own PLATFORM_CONFIG_FILES map, but we validate anyway
+ * to guard against future changes that introduce dynamic paths.
+ */
+function assertWithinRoot(fullPath, repoRoot) {
+    if (!fullPath.startsWith(repoRoot + '/') && fullPath !== repoRoot) {
+        throw new Error(`Path escapes repository root: ${fullPath}`);
+    }
+}
 function installPlatform(platform, repoPath) {
     const files = PLATFORM_CONFIG_FILES[platform];
     const instructions = getMonomindInstructions();
     const written = [];
     for (const relPath of files) {
-        const fullPath = join(repoPath, relPath);
+        const fullPath = resolve(join(repoPath, relPath));
+        assertWithinRoot(fullPath, repoPath);
         const dir = dirname(fullPath);
         mkdirSync(dir, { recursive: true });
         if (existsSync(fullPath)) {
+            // Guard against reading oversized files (e.g. the flag points at a data file)
+            const fileStat = statSync(fullPath);
+            if (fileStat.size > MAX_CONFIG_FILE_BYTES) {
+                throw new Error(`Config file too large to read (${fileStat.size} bytes): ${relPath}`);
+            }
             const existing = readFileSync(fullPath, 'utf8');
             if (existing.includes(MONOMIND_BLOCK_START))
                 continue;
@@ -69,9 +117,15 @@ function uninstallPlatform(platform, repoPath) {
     const blockRe = new RegExp(`\\n?${MONOMIND_BLOCK_START}[\\s\\S]*?${MONOMIND_BLOCK_END}\\n?`, 'g');
     const cleaned = [];
     for (const relPath of files) {
-        const fullPath = join(repoPath, relPath);
+        const fullPath = resolve(join(repoPath, relPath));
+        assertWithinRoot(fullPath, repoPath);
         if (!existsSync(fullPath))
             continue;
+        // Guard against reading oversized files
+        const fileStat = statSync(fullPath);
+        if (fileStat.size > MAX_CONFIG_FILE_BYTES) {
+            throw new Error(`Config file too large to read (${fileStat.size} bytes): ${relPath}`);
+        }
         const content = readFileSync(fullPath, 'utf8');
         writeFileSync(fullPath, content.replace(blockRe, ''), 'utf8');
         cleaned.push(relPath);
@@ -81,7 +135,14 @@ function uninstallPlatform(platform, repoPath) {
 async function handleInstall(ctx) {
     const platform = ctx.flags['platform'];
     const all = ctx.flags['all'];
-    const repoPath = ctx.flags['path'] ?? '.';
+    let repoPath;
+    try {
+        repoPath = resolveRepoPath(ctx.flags['path'] ?? '.');
+    }
+    catch (err) {
+        output.error(`Invalid --path: ${err instanceof Error ? err.message : String(err)}`);
+        return { success: false, exitCode: 1 };
+    }
     if (!platform && !all) {
         output.error('Specify --platform <name> or --all');
         output.info(`Supported platforms: ${SUPPORTED_PLATFORMS.join(', ')}`);
@@ -98,7 +159,14 @@ async function handleInstall(ctx) {
     }
     let totalFiles = 0;
     for (const p of targets) {
-        const written = installPlatform(p, repoPath);
+        let written;
+        try {
+            written = installPlatform(p, repoPath);
+        }
+        catch (err) {
+            output.error(`[${p}] Install failed: ${err instanceof Error ? err.message : String(err)}`);
+            continue;
+        }
         if (written.length > 0) {
             output.success(`[${p}] Installed Monograph context → ${written.join(', ')}`);
             totalFiles += written.length;
@@ -113,7 +181,14 @@ async function handleInstall(ctx) {
 async function handleUninstall(ctx) {
     const platform = ctx.flags['platform'];
     const all = ctx.flags['all'];
-    const repoPath = ctx.flags['path'] ?? '.';
+    let repoPath;
+    try {
+        repoPath = resolveRepoPath(ctx.flags['path'] ?? '.');
+    }
+    catch (err) {
+        output.error(`Invalid --path: ${err instanceof Error ? err.message : String(err)}`);
+        return { success: false, exitCode: 1 };
+    }
     if (!platform && !all) {
         output.error('Specify --platform <name> or --all');
         output.info(`Supported platforms: ${SUPPORTED_PLATFORMS.join(', ')}`);
@@ -130,7 +205,14 @@ async function handleUninstall(ctx) {
     }
     let totalFiles = 0;
     for (const p of targets) {
-        const cleaned = uninstallPlatform(p, repoPath);
+        let cleaned;
+        try {
+            cleaned = uninstallPlatform(p, repoPath);
+        }
+        catch (err) {
+            output.error(`[${p}] Uninstall failed: ${err instanceof Error ? err.message : String(err)}`);
+            continue;
+        }
         if (cleaned.length > 0) {
             output.success(`[${p}] Removed Monograph context from ${cleaned.join(', ')}`);
             totalFiles += cleaned.length;

package/packages/@monomind/cli/dist/src/commands/plugins.js

@@ -187,14 +187,16 @@ const installCommand = {
         { command: 'monomind plugins install -n ./my-plugin --dev', description: 'Install local plugin' },
     ],
     action: async (ctx) => {
-        const name = ctx.flags.name;
+        const rawName = ctx.flags.name;
         const version = ctx.flags.version || 'latest';
         const registryName = ctx.flags.registry;
         const verify = ctx.flags.verify !== false;
-        if (!name) {
+        if (!rawName) {
             output.printError('Plugin name is required');
             return { success: false, exitCode: 1 };
         }
+        // Cap plugin name and version to prevent DoS/injection
+        const name = typeof rawName === 'string' ? rawName.slice(0, 214) : '';
         // Check if it's a local path
         const isLocalPath = name.startsWith('./') || name.startsWith('/') || name.startsWith('../');
         output.writeln();
@@ -620,16 +622,21 @@ const searchCommand = {
         { command: 'monomind plugins search -q security --verified', description: 'Search verified security plugins' },
     ],
     action: async (ctx) => {
-        const query = ctx.flags.query;
+        const rawQuery = ctx.flags.query;
         const category = ctx.flags.category;
         const type = ctx.flags.type;
         const verified = ctx.flags.verified;
-        const limit = ctx.flags.limit || 20;
+        const rawLimit = ctx.flags.limit;
         const registryName = ctx.flags.registry;
-        if (!query) {
+        if (!rawQuery) {
             output.printError('Search query is required');
             return { success: false, exitCode: 1 };
         }
+        // Cap query length and limit to prevent DoS
+        const query = typeof rawQuery === 'string' ? rawQuery.slice(0, 200) : '';
+        const limit = typeof rawLimit === 'number' && Number.isFinite(rawLimit)
+            ? Math.max(1, Math.min(Math.floor(rawLimit), 100))
+            : 20;
         const spinner = output.createSpinner({ text: 'Searching plugin registry...', spinner: 'dots' });
         spinner.start();
         try {

package/packages/@monomind/cli/dist/src/commands/process.js

@@ -2,7 +2,7 @@
  * CLI Process Management Command
  * Background process management, daemon mode, and monitoring
  */
-import { writeFileSync, readFileSync, unlinkSync, existsSync, mkdirSync } from 'node:fs';
+import { writeFileSync, readFileSync, statSync, unlinkSync, existsSync, mkdirSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 // Helper functions for PID file management
 function writePidFile(pidFile, pid, port) {
@@ -35,13 +35,22 @@ function writePidFile(pidFile, pid, port) {
         }
     }
 }
+const MAX_PID_FILE_BYTES = 4 * 1024; // 4 KB — a PID file should never be this large
 function readPidFile(pidFile) {
     try {
         const path = resolve(pidFile);
         if (!existsSync(path))
             return null;
+        // Guard against oversized PID files before reading into memory
+        if (statSync(path).size > MAX_PID_FILE_BYTES)
+            return null;
         const data = readFileSync(path, 'utf-8');
-        return JSON.parse(data);
+        return JSON.parse(data, (key, value) => {
+            // Prototype pollution guard
+            if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+                return undefined;
+            return value;
+        });
     }
     catch {
         return null;
@@ -270,9 +279,10 @@ const monitorCommand = {
         // Try to read agent and task counts from local store files
         let agentCount = 0;
         const taskCounts = { running: 0, queued: 0, completed: 0, failed: 0 };
+        const MAX_PROCESS_STORE_BYTES = 50 * 1024 * 1024; // 50 MB
         try {
             const agentStorePath = resolve('.monomind/agents/store.json');
-            if (existsSync(agentStorePath)) {
+            if (existsSync(agentStorePath) && statSync(agentStorePath).size <= MAX_PROCESS_STORE_BYTES) {
                 const agentStore = JSON.parse(readFileSync(agentStorePath, 'utf-8'));
                 const agents = Array.isArray(agentStore) ? agentStore : Object.values(agentStore.agents || agentStore || {});
                 agentCount = agents.length;
@@ -281,7 +291,7 @@ const monitorCommand = {
         catch { /* no agent store */ }
         try {
             const taskStorePath = resolve('.monomind/tasks/store.json');
-            if (existsSync(taskStorePath)) {
+            if (existsSync(taskStorePath) && statSync(taskStorePath).size <= MAX_PROCESS_STORE_BYTES) {
                 const taskStore = JSON.parse(readFileSync(taskStorePath, 'utf-8'));
                 const tasks = Array.isArray(taskStore) ? taskStore : Object.values(taskStore.tasks || taskStore || {});
                 for (const t of tasks) {
@@ -607,12 +617,22 @@ const logsCommand = {
         { command: 'monomind process logs --since 1h --grep "error"', description: 'Search logs' },
     ],
     action: async (ctx) => {
-        const source = ctx.flags?.source || 'all';
-        const tail = ctx.flags?.tail || 50;
+        const VALID_SOURCES = new Set(['daemon', 'workers', 'tasks', 'all']);
+        const VALID_LEVELS = new Set(['debug', 'info', 'warn', 'error']);
+        const MAX_TAIL = 10_000; // cap to prevent huge in-memory slice
+        const MAX_GREP_LEN = 256; // cap regex/pattern length
+        const MAX_SINCE_LEN = 64; // cap timestamp/duration string
+        const rawSource = ctx.flags?.source || 'all';
+        const source = VALID_SOURCES.has(rawSource) ? rawSource : 'all';
+        const rawTail = Number(ctx.flags?.tail ?? 50);
+        const tail = Number.isFinite(rawTail) && rawTail > 0 ? Math.min(rawTail, MAX_TAIL) : 50;
         const follow = ctx.flags?.follow === true;
-        const level = ctx.flags?.level || 'info';
-        const since = ctx.flags?.since;
-        const grep = ctx.flags?.grep;
+        const rawLevel = ctx.flags?.level || 'info';
+        const level = VALID_LEVELS.has(rawLevel) ? rawLevel : 'info';
+        const rawSince = ctx.flags?.since;
+        const since = rawSince ? String(rawSince).slice(0, MAX_SINCE_LEN) : undefined;
+        const rawGrep = ctx.flags?.grep;
+        const grep = rawGrep ? String(rawGrep).slice(0, MAX_GREP_LEN) : undefined;
         console.log(`\n📜 Process Logs (${source})\n`);
         console.log(`  Level: ${level}+ | Lines: ${tail}${since ? ` | Since: ${since}` : ''}${grep ? ` | Filter: ${grep}` : ''}`);
         console.log('─'.repeat(70));
@@ -629,7 +649,10 @@ const logsCommand = {
                     .filter(f => source === 'all' || f.includes(source));
                 for (const file of logFiles) {
                     try {
-                        const content = readFileSync(resolve(logsDir, file), 'utf-8');
+                        const logFilePath = resolve(logsDir, file);
+                        if (statSync(logFilePath).size > 10 * 1024 * 1024)
+                            continue; // skip files > 10 MB
+                        const content = readFileSync(logFilePath, 'utf-8');
                         const lines = content.split('\n').filter(l => l.trim());
                         for (const line of lines) {
                             // Filter by log level if detectable

package/packages/@monomind/cli/dist/src/commands/progress.js

@@ -158,7 +158,8 @@ const watchCommand = {
         },
     ],
     action: async (ctx) => {
-        const interval = ctx.flags.interval || 5000;
+        const rawInterval = ctx.flags.interval || 5000;
+        const interval = Number.isFinite(rawInterval) ? Math.max(500, Math.min(rawInterval, 3_600_000)) : 5000; // min 500ms, max 1h
         output.writeln(output.highlight(`Watching progress (interval: ${interval}ms). Press Ctrl+C to stop.`));
         output.writeln();
         let lastProgress = 0;
@@ -180,8 +181,9 @@ const watchCommand = {
         };
         await check();
         const timer = setInterval(check, interval);
-        // Handle Ctrl+C
-        process.on('SIGINT', () => {
+        // Handle Ctrl+C — use once so repeated calls don't accumulate SIGINT handlers
+        // (which would trigger MaxListenersExceededWarning and a memory leak).
+        process.once('SIGINT', () => {
             clearInterval(timer);
             output.writeln();
             output.writeln(output.dim('Stopped watching.'));

package/packages/@monomind/cli/dist/src/commands/providers.js

@@ -59,10 +59,10 @@ const configureCommand = {
     ],
     action: async (ctx) => {
         try {
-            const provider = ctx.flags.provider || (ctx.args && ctx.args[0]) || '';
-            const apiKey = ctx.flags.key;
-            const model = ctx.flags.model;
-            const endpoint = ctx.flags.endpoint;
+            const provider = (ctx.flags.provider || (ctx.args && ctx.args[0]) || '').slice(0, 64);
+            const apiKey = ctx.flags.key?.slice(0, 256);
+            const model = ctx.flags.model?.slice(0, 128);
+            const endpoint = ctx.flags.endpoint?.slice(0, 512);
             if (!provider) {
                 output.printError('Provider name is required. Use -p <name> or pass as first argument.');
                 return { success: false, exitCode: 1 };
@@ -127,7 +127,7 @@ const testCommand = {
     ],
     action: async (ctx) => {
         try {
-            const provider = ctx.flags.provider || (ctx.args && ctx.args[0]) || '';
+            const provider = (ctx.flags.provider || (ctx.args && ctx.args[0]) || '').slice(0, 64);
             const testAll = ctx.flags.all;
             output.writeln();
             output.writeln(output.bold('Provider Connectivity Test'));

package/packages/@monomind/cli/dist/src/commands/replay.js

@@ -10,7 +10,8 @@ const showSubcommand = {
         { name: 'json', type: 'boolean', description: 'Output as JSON', default: false },
     ],
     action: async (ctx) => {
-        const sessionId = ctx.args[0];
+        // Cap session ID to prevent DoS via oversized string and unbounded output reflection.
+        const sessionId = (ctx.args[0] || '').slice(0, 128);
         if (!sessionId) {
             output.error('Session ID is required: replay show <sessionId>');
             return { success: false, message: 'Missing session ID' };
@@ -40,7 +41,12 @@ const listSubcommand = {
         try {
             const { ReplayReader } = await import('../observability/replay-reader.js');
             const reader = new ReplayReader();
-            const data = await reader.list(ctx.flags['limit']);
+            const rawLimit = ctx.flags['limit'];
+            // Cap limit to prevent DoS
+            const limit = typeof rawLimit === 'number' && Number.isFinite(rawLimit)
+                ? Math.max(1, Math.min(Math.floor(rawLimit), 500))
+                : 20;
+            const data = await reader.list(limit);
             const asJson = ctx.flags['json'];
             output.writeln(asJson ? JSON.stringify(data, null, 2) : 'Available replays listed');
             return { success: true, data };

package/packages/@monomind/cli/dist/src/commands/route.js

@@ -90,15 +90,20 @@ const routeTaskCommand = {
         { command: 'monomind route task "review code" --agent reviewer', description: 'Force specific agent' },
     ],
     action: async (ctx) => {
-        const taskDescription = ctx.args[0];
+        const rawTask = ctx.args[0];
         const forceAgent = ctx.flags.agent;
         const useExploration = ctx.flags.explore;
         const jsonOutput = ctx.flags.json;
-        if (!taskDescription) {
+        if (!rawTask) {
             output.printError('Task description is required');
             output.writeln(output.dim('Usage: monomind route task "task description"'));
             return { success: false, exitCode: 1 };
         }
+        if (rawTask.length > 4096) {
+            output.printError('Task description too long (max 4096 characters)');
+            return { success: false, exitCode: 1 };
+        }
+        const taskDescription = rawTask;
         const spinner = output.createSpinner({ text: 'Analyzing task...', spinner: 'dots' });
         spinner.start();
         try {
@@ -349,14 +354,24 @@ const feedbackCommand = {
         { command: 'monomind route feedback -t "write tests" -a tester -r -0.5', description: 'Negative feedback' },
     ],
     action: async (ctx) => {
-        const taskDescription = ctx.flags.task;
+        const rawFeedbackTask = ctx.flags.task;
         const agentId = ctx.flags.agent;
         const reward = ctx.flags.reward;
-        const nextTask = ctx.flags['next-task'];
-        if (!taskDescription || !agentId) {
+        const rawNextTask = ctx.flags['next-task'];
+        if (!rawFeedbackTask || !agentId) {
             output.printError('Task description and agent are required');
             return { success: false, exitCode: 1 };
         }
+        if (rawFeedbackTask.length > 4096) {
+            output.printError('Task description too long (max 4096 characters)');
+            return { success: false, exitCode: 1 };
+        }
+        if (agentId.length > 128) {
+            output.printError('Agent ID too long (max 128 characters)');
+            return { success: false, exitCode: 1 };
+        }
+        const taskDescription = rawFeedbackTask;
+        const nextTask = rawNextTask && rawNextTask.length > 4096 ? undefined : rawNextTask;
         // Validate agent
         const agent = getAgentType(agentId);
         if (!agent) {
@@ -776,13 +791,18 @@ const semanticRouteCommand = {
         { command: 'monomind route semantic -t "write unit tests" --debug', description: 'Show all route scores' },
     ],
     action: async (ctx) => {
-        const taskDescription = ctx.flags.task;
+        const rawSemanticTask = ctx.flags.task;
         const debug = ctx.flags.debug;
         const jsonOutput = ctx.flags.json;
-        if (!taskDescription) {
+        if (!rawSemanticTask) {
             output.printError('Task description is required. Use --task or -t flag.');
             return { success: false, exitCode: 1 };
         }
+        if (rawSemanticTask.length > 4096) {
+            output.printError('Task description too long (max 4096 characters)');
+            return { success: false, exitCode: 1 };
+        }
+        const taskDescription = rawSemanticTask;
         const spinner = output.createSpinner({ text: 'Computing semantic route...', spinner: 'dots' });
         spinner.start();
         try {

package/packages/@monomind/cli/dist/src/commands/security.js

@@ -33,6 +33,8 @@ function findSecretsInDir(dir, depthLimit, baseDir, findings) {
             }
             else if (entry.isFile() && (/\.(ts|js|json|yml|yaml)$/.test(entry.name) || isDotEnv) && !entry.name.endsWith('.d.ts')) {
                 try {
+                    if (statSync(fullPath).size > 1024 * 1024)
+                        continue; // skip files > 1 MB
                     const content = readFileSync(fullPath, 'utf-8');
                     const lines = content.split('\n');
                     for (let i = 0; i < lines.length; i++) {
@@ -185,6 +187,8 @@ const scanCommand = {
                             }
                             else if (entry.isFile() && /\.(ts|js|tsx|jsx)$/.test(entry.name) && !entry.name.endsWith('.d.ts')) {
                                 try {
+                                    if (fs.statSync(fullPath).size > 1024 * 1024)
+                                        continue; // skip files > 1 MB
                                     const content = fs.readFileSync(fullPath, 'utf-8');
                                     const lines = content.split('\n');
                                     for (let i = 0; i < lines.length; i++) {

package/packages/@monomind/cli/dist/src/commands/session.js

@@ -68,7 +68,11 @@ const listCommand = {
     action: async (ctx) => {
         const activeOnly = ctx.flags.active;
         const includeArchived = ctx.flags.all;
-        const limit = ctx.flags.limit;
+        const rawLimit = ctx.flags.limit;
+        // Cap limit to prevent unbounded MCP calls
+        const limit = typeof rawLimit === 'number' && Number.isFinite(rawLimit)
+            ? Math.max(1, Math.min(Math.floor(rawLimit), 200))
+            : 20;
         try {
             const result = await callMCPTool('session_list', {
                 status: activeOnly ? 'active' : includeArchived ? 'all' : 'active,saved',
@@ -173,6 +177,13 @@ const saveCommand = {
                 default: ''
             });
         }
+        // Cap name and description lengths to prevent DoS / oversized storage
+        if (typeof sessionName === 'string' && sessionName.length > 200) {
+            sessionName = sessionName.slice(0, 200);
+        }
+        if (typeof description === 'string' && description.length > 2000) {
+            description = description.slice(0, 2000);
+        }
         const spinner = output.createSpinner({ text: 'Saving session...' });
         spinner.start();
         try {

package/packages/@monomind/cli/dist/src/commands/start.js

@@ -72,6 +72,8 @@ function loadConfig(cwd) {
     const configPath = path.join(cwd, '.monomind', 'config.yaml');
     if (!fs.existsSync(configPath))
         return null;
+    if (fs.statSync(configPath).size > 1024 * 1024)
+        return null; // skip files > 1 MB
     try {
         const content = fs.readFileSync(configPath, 'utf-8');
         return parseSimpleYaml(content);
@@ -97,10 +99,14 @@ const startAction = async (ctx) => {
     const config = loadConfig(cwd);
     const swarmConfig = config?.swarm || {};
     const mcpConfig = config?.mcp || {};
-    const finalTopology = topology || swarmConfig.topology || DEFAULT_TOPOLOGY;
-    const maxAgents = swarmConfig.maxAgents || DEFAULT_MAX_AGENTS;
+    const VALID_TOPOLOGIES = new Set(['hierarchical-mesh', 'mesh', 'hierarchical', 'ring', 'star']);
+    const rawTopology = topology || swarmConfig.topology || DEFAULT_TOPOLOGY;
+    const finalTopology = VALID_TOPOLOGIES.has(rawTopology) ? rawTopology : DEFAULT_TOPOLOGY;
+    const rawMaxAgents = Number(swarmConfig.maxAgents || DEFAULT_MAX_AGENTS);
+    const maxAgents = Number.isFinite(rawMaxAgents) ? Math.max(1, Math.min(rawMaxAgents, 100)) : DEFAULT_MAX_AGENTS;
     const autoStartMcp = mcpConfig.autoStart !== false && !skipMcp;
-    const mcpPort = port || mcpConfig.serverPort || DEFAULT_PORT;
+    const rawMcpPort = port || Number(mcpConfig.serverPort) || DEFAULT_PORT;
+    const mcpPort = Number.isFinite(rawMcpPort) ? Math.max(1, Math.min(rawMcpPort, 65535)) : DEFAULT_PORT;
     output.writeln();
     output.writeln(output.bold('Starting Monomind'));
     output.writeln();
@@ -262,7 +268,8 @@ const stopCommand = {
     ],
     action: async (ctx) => {
         const force = ctx.flags.force;
-        const timeout = ctx.flags.timeout;
+        const rawTimeout = ctx.flags.timeout;
+        const timeout = Number.isFinite(rawTimeout) ? Math.max(1, Math.min(rawTimeout, 300)) : 30;
         output.writeln();
         output.writeln(output.bold('Stopping MonoMind'));
         output.writeln();

package/packages/@monomind/cli/dist/src/commands/status.js

@@ -259,7 +259,8 @@ function formatHealth(health) {
 // Main status action
 const statusAction = async (ctx) => {
     const watch = ctx.flags.watch;
-    const interval = ctx.flags.interval || DEFAULT_WATCH_INTERVAL / 1000;
+    const rawInterval = ctx.flags.interval || DEFAULT_WATCH_INTERVAL / 1000;
+    const interval = Number.isFinite(rawInterval) ? Math.max(1, Math.min(rawInterval, 3600)) : DEFAULT_WATCH_INTERVAL / 1000;
     const healthCheck = ctx.flags['health-check'];
     const cwd = ctx.cwd;
     // Check initialization
@@ -379,14 +380,16 @@ async function watchStatus(intervalSeconds) {
     await refresh();
     // Set up interval
     const intervalId = setInterval(refresh, intervalSeconds * 1000);
-    // Handle exit
+    // Handle exit — use once so repeated calls to watchStatus don't accumulate
+    // SIGINT handlers (which would trigger a MaxListenersExceededWarning).
     return new Promise((resolve) => {
-        process.on('SIGINT', () => {
+        const onSigint = () => {
             clearInterval(intervalId);
             output.writeln();
             output.printInfo('Watch mode stopped');
             resolve({ success: true });
-        });
+        };
+        process.once('SIGINT', onSigint);
     });
 }
 // Agents subcommand

package/packages/@monomind/cli/dist/src/commands/swarm.js

@@ -20,7 +20,10 @@ function getSwarmStatus(swarmId) {
     let swarmState = null;
     if (fs.existsSync(swarmStateFile)) {
         try {
-            swarmState = JSON.parse(fs.readFileSync(swarmStateFile, 'utf-8'));
+            const swarmStatSz = fs.statSync(swarmStateFile).size;
+            if (swarmStatSz <= 1_048_576) {
+                swarmState = JSON.parse(fs.readFileSync(swarmStateFile, 'utf-8'));
+            }
         }
         catch {
             // Ignore parse errors
@@ -36,9 +39,13 @@ function getSwarmStatus(swarmId) {
             totalAgents = agentFiles.length;
             for (const file of agentFiles) {
                 try {
-                    const agent = JSON.parse(fs.readFileSync(path.join(agentsDir, file), 'utf-8'));
-                    if (agent.status === 'active' || agent.status === 'running') {
-                        activeAgents++;
+                    const agentFilePath = path.join(agentsDir, file);
+                    const agentSz = fs.statSync(agentFilePath).size;
+                    if (agentSz <= 524_288) {
+                        const agent = JSON.parse(fs.readFileSync(agentFilePath, 'utf-8'));
+                        if (agent.status === 'active' || agent.status === 'running') {
+                            activeAgents++;
+                        }
                     }
                 }
                 catch {
@@ -83,15 +90,19 @@ function getSwarmStatus(swarmId) {
             const taskFiles = fs.readdirSync(tasksDir).filter(f => f.endsWith('.json'));
             for (const file of taskFiles) {
                 try {
-                    const task = JSON.parse(fs.readFileSync(path.join(tasksDir, file), 'utf-8'));
-                    if (task.status === 'completed' || task.status === 'done') {
-                        completedTasks++;
-                    }
-                    else if (task.status === 'in_progress' || task.status === 'running') {
-                        inProgressTasks++;
-                    }
-                    else {
-                        pendingTasks++;
+                    const taskFilePath = path.join(tasksDir, file);
+                    const taskSz = fs.statSync(taskFilePath).size;
+                    if (taskSz <= 524_288) {
+                        const task = JSON.parse(fs.readFileSync(taskFilePath, 'utf-8'));
+                        if (task.status === 'completed' || task.status === 'done') {
+                            completedTasks++;
+                        }
+                        else if (task.status === 'in_progress' || task.status === 'running') {
+                            inProgressTasks++;
+                        }
+                        else {
+                            pendingTasks++;
+                        }
                     }
                 }
                 catch {
@@ -577,6 +588,9 @@ const stopCommand = {
             const swarmStateFile = path.join(process.cwd(), '.swarm', 'state.json');
             if (fs.existsSync(swarmStateFile)) {
                 try {
+                    const stopStatSz = fs.statSync(swarmStateFile).size;
+                    if (stopStatSz > 1_048_576)
+                        throw new Error('swarm state file too large');
                     const state = JSON.parse(fs.readFileSync(swarmStateFile, 'utf-8'));
                     state.status = 'stopped';
                     state.stoppedAt = new Date().toISOString();