monomind 1.11.13 → 1.12.0

package/packages/@monomind/cli/dist/src/infrastructure/in-memory-repositories.js

@@ -0,0 +1,264 @@
+/**
+ * In-Memory Repositories - CLI Infrastructure
+ *
+ * Lightweight in-memory implementations for CLI use.
+ *
+ * @module v1/cli/infrastructure
+ */
+/**
+ * In-Memory Agent Repository
+ */
+export class InMemoryAgentRepository {
+    agents = new Map();
+    initialized = false;
+    async initialize() {
+        this.initialized = true;
+    }
+    async shutdown() {
+        this.agents.clear();
+        this.initialized = false;
+    }
+    async clear() {
+        this.agents.clear();
+    }
+    async save(agent) {
+        this.agents.set(agent.id, agent);
+    }
+    async findById(id) {
+        return this.agents.get(id) ?? null;
+    }
+    async findByName(name) {
+        for (const agent of this.agents.values()) {
+            if (agent.name === name)
+                return agent;
+        }
+        return null;
+    }
+    async delete(id) {
+        return this.agents.delete(id);
+    }
+    async exists(id) {
+        return this.agents.has(id);
+    }
+    async saveMany(agents) {
+        for (const agent of agents) {
+            this.agents.set(agent.id, agent);
+        }
+    }
+    async findByIds(ids) {
+        return ids.map((id) => this.agents.get(id)).filter((a) => a !== undefined);
+    }
+    async deleteMany(ids) {
+        let deleted = 0;
+        for (const id of ids) {
+            if (this.agents.delete(id))
+                deleted++;
+        }
+        return deleted;
+    }
+    async findAll(options) {
+        let result = Array.from(this.agents.values());
+        if (options?.status)
+            result = result.filter((a) => a.status === options.status);
+        if (options?.role)
+            result = result.filter((a) => a.role === options.role);
+        if (options?.domain)
+            result = result.filter((a) => a.domain === options.domain);
+        if (options?.limit)
+            result = result.slice(0, options.limit);
+        return result;
+    }
+    async findByStatus(status) {
+        return this.findAll({ status });
+    }
+    async findByRole(role) {
+        return this.findAll({ role });
+    }
+    async findByDomain(domain) {
+        return this.findAll({ domain });
+    }
+    async findByParent(parentId) {
+        return Array.from(this.agents.values()).filter((a) => a.parentId === parentId);
+    }
+    async findByCapability(capability) {
+        return Array.from(this.agents.values()).filter((a) => a.hasCapability(capability));
+    }
+    async findAvailable() {
+        return Array.from(this.agents.values()).filter((a) => a.isAvailable());
+    }
+    async getStatistics() {
+        const agents = Array.from(this.agents.values());
+        const byStatus = {
+            idle: 0,
+            active: 0,
+            busy: 0,
+            paused: 0,
+            terminated: 0,
+            error: 0,
+        };
+        const byRole = {};
+        const byDomain = {};
+        let totalCompleted = 0;
+        let totalUtilization = 0;
+        for (const agent of agents) {
+            byStatus[agent.status]++;
+            byRole[agent.role] = (byRole[agent.role] ?? 0) + 1;
+            byDomain[agent.domain] = (byDomain[agent.domain] ?? 0) + 1;
+            totalCompleted += agent.completedTaskCount;
+            totalUtilization += agent.getUtilization();
+        }
+        return {
+            total: agents.length,
+            byStatus,
+            byRole,
+            byDomain,
+            totalTasksCompleted: totalCompleted,
+            averageUtilization: agents.length > 0 ? totalUtilization / agents.length : 0,
+        };
+    }
+    async count(options) {
+        return (await this.findAll(options)).length;
+    }
+}
+/**
+ * In-Memory Task Repository
+ */
+export class InMemoryTaskRepository {
+    tasks = new Map();
+    initialized = false;
+    async initialize() {
+        this.initialized = true;
+    }
+    async shutdown() {
+        this.tasks.clear();
+        this.initialized = false;
+    }
+    async clear() {
+        this.tasks.clear();
+    }
+    async save(task) {
+        this.tasks.set(task.id, task);
+    }
+    async findById(id) {
+        return this.tasks.get(id) ?? null;
+    }
+    async delete(id) {
+        return this.tasks.delete(id);
+    }
+    async exists(id) {
+        return this.tasks.has(id);
+    }
+    async saveMany(tasks) {
+        for (const task of tasks) {
+            this.tasks.set(task.id, task);
+        }
+    }
+    async findByIds(ids) {
+        return ids.map((id) => this.tasks.get(id)).filter((t) => t !== undefined);
+    }
+    async deleteMany(ids) {
+        let deleted = 0;
+        for (const id of ids) {
+            if (this.tasks.delete(id))
+                deleted++;
+        }
+        return deleted;
+    }
+    async findAll(options) {
+        let result = Array.from(this.tasks.values());
+        if (options?.status)
+            result = result.filter((t) => t.status === options.status);
+        if (options?.priority)
+            result = result.filter((t) => t.priority === options.priority);
+        if (options?.type)
+            result = result.filter((t) => t.type === options.type);
+        if (options?.assignedAgentId)
+            result = result.filter((t) => t.assignedAgentId === options.assignedAgentId);
+        if (options?.limit)
+            result = result.slice(0, options.limit);
+        return result;
+    }
+    async findByStatus(status) {
+        return this.findAll({ status });
+    }
+    async findByPriority(priority) {
+        return this.findAll({ priority });
+    }
+    async findByAgent(agentId) {
+        return this.findAll({ assignedAgentId: agentId });
+    }
+    async findPending() {
+        return this.findByStatus('pending');
+    }
+    async findQueued() {
+        return this.findByStatus('queued');
+    }
+    async findRunning() {
+        return this.findByStatus('running');
+    }
+    async findTimedOut() {
+        return Array.from(this.tasks.values()).filter((t) => t.isTimedOut());
+    }
+    async getNextTask(agentCapabilities) {
+        const queued = await this.findQueued();
+        if (queued.length === 0)
+            return null;
+        queued.sort((a, b) => a.comparePriority(b));
+        return queued[0];
+    }
+    async getTaskQueue(limit = 10) {
+        const queued = await this.findQueued();
+        queued.sort((a, b) => a.comparePriority(b));
+        return queued.slice(0, limit);
+    }
+    async getStatistics() {
+        const tasks = Array.from(this.tasks.values());
+        const byStatus = {
+            pending: 0,
+            queued: 0,
+            assigned: 0,
+            running: 0,
+            completed: 0,
+            failed: 0,
+            cancelled: 0,
+        };
+        const byPriority = {
+            critical: 0,
+            high: 0,
+            normal: 0,
+            low: 0,
+        };
+        const byType = {};
+        let totalDuration = 0;
+        let completedCount = 0;
+        let failedCount = 0;
+        let retryTotal = 0;
+        for (const task of tasks) {
+            byStatus[task.status]++;
+            byPriority[task.priority]++;
+            byType[task.type] = (byType[task.type] ?? 0) + 1;
+            if (task.status === 'completed') {
+                completedCount++;
+                const duration = task.getExecutionDuration();
+                if (duration)
+                    totalDuration += duration;
+            }
+            if (task.status === 'failed')
+                failedCount++;
+            retryTotal += task.retryCount;
+        }
+        return {
+            total: tasks.length,
+            byStatus,
+            byPriority,
+            byType,
+            averageExecutionTime: completedCount > 0 ? totalDuration / completedCount : 0,
+            successRate: tasks.length > 0 ? completedCount / tasks.length : 0,
+            retryRate: tasks.length > 0 ? retryTotal / tasks.length : 0,
+        };
+    }
+    async count(options) {
+        return (await this.findAll(options)).length;
+    }
+}
+//# sourceMappingURL=in-memory-repositories.js.map

package/packages/@monomind/cli/dist/src/init/executor.js

@@ -10,6 +10,7 @@ import { dirname } from 'path';
 // ESM-compatible __dirname
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
+const MAX_EXEC_FILE_BYTES = 10 * 1024 * 1024; // 10 MB
 /**
  * Atomic write helper — writes to a sibling .tmp file then renames into place.
  * SIGINT or crash during a partial write would otherwise corrupt user-critical
@@ -205,7 +206,7 @@ function cleanupLegacyTools(targetDir) {
     }
     // Clean ruv-swarm from .mcp.json and fix old MCP package name
     const mcpJsonPath = path.join(targetDir, '.mcp.json');
-    if (fs.existsSync(mcpJsonPath)) {
+    if (fs.existsSync(mcpJsonPath) && fs.statSync(mcpJsonPath).size <= MAX_EXEC_FILE_BYTES) {
         try {
             const mcp = JSON.parse(fs.readFileSync(mcpJsonPath, 'utf-8'));
             let mcpChanged = false;
@@ -226,7 +227,7 @@ function cleanupLegacyTools(targetDir) {
     }
     // Clean ruv-swarm from .claude/settings.json hooks and fix MCP package name
     const settingsPath = path.join(targetDir, '.claude', 'settings.json');
-    if (fs.existsSync(settingsPath)) {
+    if (fs.existsSync(settingsPath) && fs.statSync(settingsPath).size <= MAX_EXEC_FILE_BYTES) {
         try {
             const raw = fs.readFileSync(settingsPath, 'utf-8');
             const settings = JSON.parse(raw);
@@ -449,8 +450,8 @@ async function startDaemonBackground(targetDir, result) {
         const { execSync } = await import('child_process');
         // Check if daemon is already running
         const pidFile = path.join(targetDir, '.monomind', 'daemon.pid');
-        const { existsSync, readFileSync } = await import('fs');
-        if (existsSync(pidFile)) {
+        const { existsSync, readFileSync, statSync: statSyncPid } = await import('fs');
+        if (existsSync(pidFile) && statSyncPid(pidFile).size <= 1024) {
             const pid = parseInt(readFileSync(pidFile, 'utf8').trim(), 10);
             try {
                 process.kill(pid, 0);
@@ -798,7 +799,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
         // 3. Merge settings if requested
         if (upgradeSettings) {
             const settingsPath = path.join(targetDir, '.claude', 'settings.json');
-            if (fs.existsSync(settingsPath)) {
+            if (fs.existsSync(settingsPath) && fs.statSync(settingsPath).size <= MAX_EXEC_FILE_BYTES) {
                 try {
                     const existingSettings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
                     const mergedSettings = mergeSettingsForUpgrade(existingSettings);
@@ -951,7 +952,7 @@ async function createDirectories(targetDir, options, result) {
 async function writeSettings(targetDir, options, result) {
     const settingsPath = path.join(targetDir, '.claude', 'settings.json');
     const generated = JSON.parse(generateSettingsJson(options));
-    if (fs.existsSync(settingsPath) && !options.force) {
+    if (fs.existsSync(settingsPath) && !options.force && fs.statSync(settingsPath).size <= MAX_EXEC_FILE_BYTES) {
         // Merge hooks/env/permissions into existing settings instead of skipping
         try {
             const existing = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
@@ -1493,7 +1494,7 @@ daemon.pid
     // A blanket ignore prevents config, metrics, and knowledge graph from being committed.
     // We remove any bare `.monomind/` or `**/.monomind/` lines and add specific excludes instead.
     const projectGitignorePath = path.join(targetDir, '.gitignore');
-    if (fs.existsSync(projectGitignorePath)) {
+    if (fs.existsSync(projectGitignorePath) && fs.statSync(projectGitignorePath).size <= MAX_EXEC_FILE_BYTES) {
         const existing = fs.readFileSync(projectGitignorePath, 'utf-8');
         const blanketPattern = /^(\*\*\/)?\.monomind\/?\s*$/gm;
         if (blanketPattern.test(existing)) {
@@ -2060,7 +2061,7 @@ async function writeClaudeMd(targetDir, options, result) {
             if (!fs.existsSync(globalClaudeDir)) {
                 fs.mkdirSync(globalClaudeDir, { recursive: true });
             }
-            if (fs.existsSync(globalClaudeMd)) {
+            if (fs.existsSync(globalClaudeMd) && fs.statSync(globalClaudeMd).size <= MAX_EXEC_FILE_BYTES) {
                 const existing = fs.readFileSync(globalClaudeMd, 'utf-8');
                 if (!existing.includes('Monomind Integration')) {
                     fs.appendFileSync(globalClaudeMd, monomindBlock);
@@ -2082,7 +2083,7 @@ async function writeClaudeMd(targetDir, options, result) {
                 fs.mkdirSync(globalClaudeDir, { recursive: true });
             }
             let globalSettings = {};
-            if (fs.existsSync(globalSettingsPath)) {
+            if (fs.existsSync(globalSettingsPath) && fs.statSync(globalSettingsPath).size <= MAX_EXEC_FILE_BYTES) {
                 try {
                     globalSettings = JSON.parse(fs.readFileSync(globalSettingsPath, 'utf-8'));
                 }
@@ -2227,7 +2228,9 @@ function _registerMonomindProject(dir) {
         const registryPath = path.join(os.homedir(), '.monomind-projects.json');
         let reg = { projects: [] };
         try {
-            reg = JSON.parse(fs.readFileSync(registryPath, 'utf-8'));
+            if (fs.existsSync(registryPath) && fs.statSync(registryPath).size <= MAX_EXEC_FILE_BYTES) {
+                reg = JSON.parse(fs.readFileSync(registryPath, 'utf-8'));
+            }
         }
         catch { }
         if (!Array.isArray(reg.projects))
@@ -2260,7 +2263,7 @@ export function findMonomindProjects(maxDepth = 3) {
     ].filter(r => fs.existsSync(r));
     // Also check known-projects registry if it exists
     const registryPath = path.join(home, '.monomind-projects.json');
-    if (fs.existsSync(registryPath)) {
+    if (fs.existsSync(registryPath) && fs.statSync(registryPath).size <= MAX_EXEC_FILE_BYTES) {
         try {
             const reg = JSON.parse(fs.readFileSync(registryPath, 'utf-8'));
             if (Array.isArray(reg.projects)) {

package/packages/@monomind/cli/dist/src/init/shared-instructions-generator.js

@@ -8,8 +8,12 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { execFileSync } from 'node:child_process';
+const MAX_JSON_READ_BYTES = 10 * 1024 * 1024; // 10 MB
+const MAX_TEXT_READ_BYTES = 2 * 1024 * 1024; // 2 MB for plain-text config files
 function readJSON(p) {
     try {
+        if (!fs.existsSync(p) || fs.statSync(p).size > MAX_JSON_READ_BYTES)
+            return null;
         return JSON.parse(fs.readFileSync(p, 'utf-8'));
     }
     catch {
@@ -166,7 +170,10 @@ export function detectProjectProfile(cwd) {
         profile.language = 'rust';
         profile.packageManager = 'cargo';
         try {
-            const cargo = fs.readFileSync(path.join(cwd, 'Cargo.toml'), 'utf-8');
+            const cargoPath = path.join(cwd, 'Cargo.toml');
+            if (fs.statSync(cargoPath).size > MAX_TEXT_READ_BYTES)
+                throw new Error('too large');
+            const cargo = fs.readFileSync(cargoPath, 'utf-8');
             const nameM = cargo.match(/^name\s*=\s*"([^"]+)"/m);
             if (nameM)
                 profile.name = nameM[1];
@@ -191,7 +198,10 @@ export function detectProjectProfile(cwd) {
         else
             profile.packageManager = 'pip';
         try {
-            const pp = fs.readFileSync(path.join(cwd, 'pyproject.toml'), 'utf-8');
+            const ppPath = path.join(cwd, 'pyproject.toml');
+            if (fs.existsSync(ppPath) && fs.statSync(ppPath).size > MAX_TEXT_READ_BYTES)
+                throw new Error('too large');
+            const pp = fs.readFileSync(ppPath, 'utf-8');
             if (pp.includes('fastapi') || pp.includes('FastAPI'))
                 profile.framework.push('fastapi');
             if (pp.includes('django'))
@@ -210,7 +220,10 @@ export function detectProjectProfile(cwd) {
         profile.language = 'go';
         profile.packageManager = 'unknown'; // go mod doesn't have a separate PM
         try {
-            const gomod = fs.readFileSync(path.join(cwd, 'go.mod'), 'utf-8');
+            const gomodPath = path.join(cwd, 'go.mod');
+            if (fs.statSync(gomodPath).size > MAX_TEXT_READ_BYTES)
+                throw new Error('too large');
+            const gomod = fs.readFileSync(gomodPath, 'utf-8');
             if (gomod.includes('gin-gonic/gin'))
                 profile.framework.push('gin');
             if (gomod.includes('labstack/echo'))
@@ -236,7 +249,10 @@ export function detectProjectProfile(cwd) {
     }
     // ── CLAUDE.md conventions extraction ──────────────────────────────────────
     try {
-        const claudeMd = fs.readFileSync(path.join(cwd, 'CLAUDE.md'), 'utf-8');
+        const claudeMdPath = path.join(cwd, 'CLAUDE.md');
+        if (fs.existsSync(claudeMdPath) && fs.statSync(claudeMdPath).size > MAX_TEXT_READ_BYTES)
+            throw new Error('too large');
+        const claudeMd = fs.readFileSync(claudeMdPath, 'utf-8');
         profile.maxFileLines = extractMaxFileLines(claudeMd);
     }
     catch { /* skip */ }

package/packages/@monomind/cli/dist/src/init/statusline-generator.js

@@ -62,6 +62,8 @@ function getVersion() {
   ];
   for (const p of walkCandidates) {
     try {
+      const pkgStat = safeStat(p);
+      if (!pkgStat || pkgStat.size > 1024 * 1024) continue;
       const pkg = JSON.parse(fs.readFileSync(p, 'utf-8'));
       if (pkg.version && (pkg.name === 'monomind' || pkg.name === '@monomind/cli' || (pkg.name || '').startsWith('@monomind'))) {
         return \`v\${pkg.version}\`;
@@ -72,7 +74,10 @@ function getVersion() {
   try {
     const { execSync } = require('child_process');
     const prefix = execSync('npm config get prefix', { encoding: 'utf-8', timeout: 2000 }).trim();
-    const pkg = JSON.parse(fs.readFileSync(path.join(prefix, 'lib', 'node_modules', 'monomind', 'package.json'), 'utf-8'));
+    const globalPkgPath = path.join(prefix, 'lib', 'node_modules', 'monomind', 'package.json');
+    const globalPkgStat = safeStat(globalPkgPath);
+    if (!globalPkgStat || globalPkgStat.size > 1024 * 1024) throw new Error('too large');
+    const pkg = JSON.parse(fs.readFileSync(globalPkgPath, 'utf-8'));
     if (pkg.version) return \`v\${pkg.version}\`;
   } catch { /* ignore */ }
   return 'v1.0.6';
@@ -113,9 +118,11 @@ function safeExec(cmd, timeoutMs = 2000) {
 }
 
 // Safe JSON file reader (returns null on failure)
+// Refuses to load files > 10 MB to prevent OOM on corrupted/oversized stores.
+const MAX_JSON_READ_BYTES = 10 * 1024 * 1024;
 function readJSON(filePath) {
   try {
-    if (fs.existsSync(filePath)) {
+    if (fs.existsSync(filePath) && fs.statSync(filePath).size <= MAX_JSON_READ_BYTES) {
       return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
     }
   } catch { /* ignore */ }
@@ -227,6 +234,8 @@ function getModelFromSessionJSONL() {
     if (files.length === 0) return null;
 
     const sessionFile = path.join(projectsDir, files[0].f);
+    const sessionStat = safeStat(sessionFile);
+    if (!sessionStat || sessionStat.size > 50 * 1024 * 1024) return null; // skip > 50 MB
     const raw = fs.readFileSync(sessionFile, 'utf-8');
     const lines = raw.split('\\n').filter(Boolean);
 
@@ -557,7 +566,8 @@ function getHooksStatus() {
 function getActiveAgent() {
   const routeFile = path.join(CWD, '.monomind', 'last-route.json');
   try {
-    if (!fs.existsSync(routeFile)) return null;
+    const routeStat = safeStat(routeFile);
+    if (!routeStat || routeStat.size > MAX_JSON_READ_BYTES) return null;
     const data = JSON.parse(fs.readFileSync(routeFile, 'utf-8'));
     if (!data || !data.agent) return null;
 
@@ -590,7 +600,7 @@ function getAgentDBStats() {
   // 1. Count real entries from auto-memory-store.json
   const storePath = path.join(CWD, '.monomind', 'data', 'auto-memory-store.json');
   const storeStat = safeStat(storePath);
-  if (storeStat) {
+  if (storeStat && storeStat.size <= MAX_JSON_READ_BYTES) {
     dbSizeKB += storeStat.size / 1024;
     try {
       const store = JSON.parse(fs.readFileSync(storePath, 'utf-8'));
@@ -804,12 +814,14 @@ function getKnowledgeStats() {
   const skillsPath = path.join(CWD, '.monomind', 'skills.jsonl');
   let chunks = 0, skills = 0;
   try {
-    if (fs.existsSync(chunksPath)) {
+    const chunksStat = safeStat(chunksPath);
+    if (chunksStat && chunksStat.size <= MAX_JSON_READ_BYTES) {
       chunks = fs.readFileSync(chunksPath, 'utf-8').split('\\n').filter(Boolean).length;
     }
   } catch { /* ignore */ }
   try {
-    if (fs.existsSync(skillsPath)) {
+    const skillsStat = safeStat(skillsPath);
+    if (skillsStat && skillsStat.size <= MAX_JSON_READ_BYTES) {
       skills = fs.readFileSync(skillsPath, 'utf-8').split('\\n').filter(Boolean).length;
     }
   } catch { /* ignore */ }
@@ -819,7 +831,8 @@ function getKnowledgeStats() {
 function getTriggerStats() {
   const indexPath = path.join(CWD, '.monomind', 'trigger-index.json');
   try {
-    if (!fs.existsSync(indexPath)) return { triggers: 0, agents: 0 };
+    const idxStat = safeStat(indexPath);
+    if (!idxStat || idxStat.size > MAX_JSON_READ_BYTES) return { triggers: 0, agents: 0 };
     const raw = JSON.parse(fs.readFileSync(indexPath, 'utf-8'));
     const idx = raw.index || raw;
     const triggers = Object.keys(idx).length;
@@ -832,7 +845,8 @@ function getTriggerStats() {
 function getHookLatency() {
   const p = path.join(CWD, '.monomind', 'metrics', 'hook-latency.json');
   try {
-    if (!fs.existsSync(p)) return null;
+    const latStat = safeStat(p);
+    if (!latStat || latStat.size > MAX_JSON_READ_BYTES) return null;
     const d = JSON.parse(fs.readFileSync(p, 'utf-8'));
     const perPrompt = ['route'];
     let totalMs = 0; let count = 0;
@@ -854,7 +868,8 @@ function getHookLatency() {
 function getGraphUsage() {
   const usagePath = path.join(CWD, '.monomind', 'metrics', 'graph-usage.json');
   try {
-    if (!fs.existsSync(usagePath)) return null;
+    const usageStat = safeStat(usagePath);
+    if (!usageStat || usageStat.size > MAX_JSON_READ_BYTES) return null;
     const d = JSON.parse(fs.readFileSync(usagePath, 'utf-8'));
     const graphWins = (d.monograph_call || 0) + (d.preresolve_hit || 0)
                     + (d.graph_assist_search || 0) + (d.graph_assist_neighbors || 0);
@@ -919,7 +934,10 @@ function getHILPending() {
     const files = fs.readdirSync(loopsDir).filter(f => f.endsWith('-hil.md'));
     for (const f of files) {
       try {
-        const txt = fs.readFileSync(path.join(loopsDir, f), 'utf-8');
+        const hilPath = path.join(loopsDir, f);
+        const hilStat = safeStat(hilPath);
+        if (!hilStat || hilStat.size > 512 * 1024) continue; // skip > 512 KB
+        const txt = fs.readFileSync(hilPath, 'utf-8');
         const answered = /^[ \\t]*>[ \\t]+\\S/m.test(txt);
         if (!answered) pending++;
       } catch { /* ignore */ }
@@ -969,7 +987,9 @@ function getSIBudget() {
   const SI_LIMIT = 1500;
   const siPath = path.join(CWD, '.agents', 'shared_instructions.md');
   try {
-    if (!fs.existsSync(siPath)) return null;
+    const siStat = safeStat(siPath);
+    if (!siStat) return null;
+    if (siStat.size > 2 * 1024 * 1024) return null; // skip > 2 MB
     const len = fs.readFileSync(siPath, 'utf-8').length;
     return { len, pct: Math.round((len / SI_LIMIT) * 100), limit: SI_LIMIT };
   } catch { return null; }
@@ -1180,7 +1200,8 @@ const MODE_FILE = path.join(CWD, '.monomind', 'statusline-mode.txt');
 
 function readMode() {
   try {
-    if (fs.existsSync(MODE_FILE)) {
+    const modeStat = safeStat(MODE_FILE);
+    if (modeStat && modeStat.size <= 1024) {
       return fs.readFileSync(MODE_FILE, 'utf-8').trim();
     }
   } catch { /* ignore */ }

package/packages/@monomind/cli/dist/src/interactive/interrupt.d.ts

@@ -0,0 +1,22 @@
+export type InterruptDecision = 'approved' | 'rejected' | 'edited';
+export interface InterruptPromptResult {
+    decision: InterruptDecision;
+    editedTask?: string;
+}
+export interface InterruptConfig {
+    interruptBefore: string[];
+    confidenceThreshold?: number;
+    autoApprove?: boolean;
+}
+export declare class InterruptRegistry {
+    private config;
+    load(config: InterruptConfig): void;
+    shouldInterrupt(agentSlug: string, confidence?: number): boolean;
+    getConfig(): InterruptConfig;
+}
+export declare const interruptRegistry: InterruptRegistry;
+export declare class InterruptController {
+    prompt(agentSlug: string, taskDescription: string, checkpointId: string): Promise<InterruptPromptResult>;
+}
+export declare const interruptController: InterruptController;
+//# sourceMappingURL=interrupt.d.ts.map

package/packages/@monomind/cli/dist/src/interactive/interrupt.js

@@ -0,0 +1,71 @@
+import * as readline from 'node:readline';
+export class InterruptRegistry {
+    config = { interruptBefore: [] };
+    load(config) {
+        this.config = config;
+    }
+    shouldInterrupt(agentSlug, confidence) {
+        if (this.config.autoApprove)
+            return false;
+        if (this.config.interruptBefore.includes(agentSlug))
+            return true;
+        if (confidence !== undefined &&
+            this.config.confidenceThreshold !== undefined &&
+            confidence < this.config.confidenceThreshold) {
+            return true;
+        }
+        return false;
+    }
+    getConfig() {
+        return { ...this.config };
+    }
+}
+export const interruptRegistry = new InterruptRegistry();
+export class InterruptController {
+    async prompt(agentSlug, taskDescription, checkpointId) {
+        // Non-TTY / CI mode
+        if (!process.stdin.isTTY || process.env.CI_AUTO_APPROVE === '1') {
+            return { decision: 'approved' };
+        }
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+        // Strip control characters from interpolated fields. ANSI escape sequences
+        // in any of these fields would let a malicious agent or LLM-generated task
+        // description redraw the screen and trick the user into approving an
+        // entirely different action than the one shown — defeating this very gate.
+        const safe = (s) => String(s ?? '').replace(/[\x00-\x1f\x7f-\x9f]/g, '?').slice(0, 500);
+        console.log('\n' + '='.repeat(60));
+        console.log('[MONOMIND] Interrupt — Human approval required');
+        console.log(`  Agent:      ${safe(agentSlug)}`);
+        console.log(`  Task:       ${safe(taskDescription)}`);
+        console.log(`  Checkpoint: ${safe(checkpointId)}`);
+        console.log('='.repeat(60));
+        console.log('  Options: [y] approve  [n] reject  [e] edit task');
+        return new Promise((resolve) => {
+            rl.question('  Choice (y/n/e): ', (answer) => {
+                rl.close();
+                const trimmed = answer.trim().toLowerCase();
+                if (trimmed === 'y' || trimmed === 'yes') {
+                    resolve({ decision: 'approved' });
+                }
+                else if (trimmed === 'e' || trimmed === 'edit') {
+                    const rl2 = readline.createInterface({
+                        input: process.stdin,
+                        output: process.stdout,
+                    });
+                    rl2.question('  New task description: ', (newTask) => {
+                        rl2.close();
+                        resolve({ decision: 'edited', editedTask: newTask });
+                    });
+                }
+                else {
+                    resolve({ decision: 'rejected' });
+                }
+            });
+        });
+    }
+}
+export const interruptController = new InterruptController();
+//# sourceMappingURL=interrupt.js.map

package/packages/@monomind/cli/dist/src/mcp/deprecation-injector.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Deprecation Injector (Task 31)
+ *
+ * Injects deprecation warnings into MCP tool responses when the
+ * invoked tool has been marked as deprecated in the ToolRegistry.
+ */
+import type { ToolRegistry } from './tool-registry.js';
+/**
+ * Injects deprecation metadata into MCP responses.
+ */
+export declare class DeprecationInjector {
+    private readonly registry;
+    constructor(registry: ToolRegistry);
+    /**
+     * If `toolName` is deprecated, augment the response with a warning.
+     *
+     * Returns the original response unmodified when the tool is not
+     * deprecated. When deprecated, adds `_deprecation` metadata.
+     *
+     * Warning format:
+     *   [DEPRECATED] Tool "<name>" is deprecated. <message>. Use "<successor>" instead.
+     */
+    inject(response: Record<string, unknown>, toolName: string): Record<string, unknown>;
+}
+//# sourceMappingURL=deprecation-injector.d.ts.map