monomind 1.11.13 → 1.12.0

package/packages/@monomind/cli/dist/src/memory/memory-initializer.js

@@ -11,6 +11,8 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { safeParseEmbedding } from './memory-bridge.js';
+/** Maximum SQLite database file size accepted before read (256 MB). */
+const MAX_DB_FILE_BYTES = 256 * 1024 * 1024;
 // ADR-053: Lazy import of AgentDB v1 bridge
 let _bridge;
 async function getBridge() {
@@ -733,6 +735,11 @@ export async function ensureSchemaColumns(dbPath) {
         }
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
+        // Guard against excessively large DB files to prevent OOM.
+        const ensureStat = fs.statSync(dbPath);
+        if (ensureStat.size > MAX_DB_FILE_BYTES) {
+            return { success: false, columnsAdded, error: `Database file too large: ${ensureStat.size} bytes` };
+        }
         const fileBuffer = fs.readFileSync(dbPath);
         const db = new SQL.Database(fileBuffer);
         // Get current columns in memory_entries
@@ -802,6 +809,14 @@ export async function checkAndMigrateLegacy(options) {
             try {
                 const initSqlJs = (await import('sql.js')).default;
                 const SQL = await initSqlJs();
+                // Guard against excessively large legacy DB files to prevent OOM.
+                const legacyStat = fs.statSync(legacyPath);
+                if (legacyStat.size > MAX_DB_FILE_BYTES) {
+                    if (verbose) {
+                        console.warn(`[memory] Skipping legacy DB at ${legacyPath}: file too large (${legacyStat.size} bytes)`);
+                    }
+                    continue;
+                }
                 const legacyBuffer = fs.readFileSync(legacyPath);
                 const legacyDb = new SQL.Database(legacyBuffer);
                 // Check if it has data
@@ -1080,6 +1095,11 @@ export async function checkMemoryInitialization(dbPath) {
         // Try to load with sql.js
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
+        // Guard against excessively large DB files to prevent OOM.
+        const checkStat = fs.statSync(path_);
+        if (checkStat.size > MAX_DB_FILE_BYTES) {
+            return { initialized: false };
+        }
         const fileBuffer = fs.readFileSync(path_);
         const db = new SQL.Database(fileBuffer);
         // Check for metadata table
@@ -1125,6 +1145,11 @@ export async function applyTemporalDecay(dbPath) {
     try {
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
+        // Guard against excessively large DB files to prevent OOM.
+        const decayStat = fs.statSync(path_);
+        if (decayStat.size > MAX_DB_FILE_BYTES) {
+            return { success: false, patternsDecayed: 0, error: `Database file too large: ${decayStat.size} bytes` };
+        }
         const fileBuffer = fs.readFileSync(path_);
         const db = new SQL.Database(fileBuffer);
         // Apply decay: confidence *= exp(-decay_rate * days_since_last_use)
@@ -1445,6 +1470,11 @@ export async function verifyMemoryInit(dbPath, options) {
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
         const fs = await import('fs');
+        // Guard against excessively large DB files to prevent OOM.
+        const verifyStat = fs.statSync(dbPath);
+        if (verifyStat.size > MAX_DB_FILE_BYTES) {
+            return { success: false, tests: [{ name: 'Database access', passed: false, details: `File too large: ${verifyStat.size} bytes` }], summary: { passed: 0, failed: 1, total: 1 } };
+        }
         // Load database
         const fileBuffer = fs.readFileSync(dbPath);
         const db = new SQL.Database(fileBuffer);
@@ -1631,6 +1661,11 @@ export async function storeEntry(options) {
         await ensureSchemaColumns(dbPath);
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
+        // Guard against excessively large DB files to prevent OOM.
+        const storeStat = fs.statSync(dbPath);
+        if (storeStat.size > MAX_DB_FILE_BYTES) {
+            return { success: false, id: '', error: `Database file too large: ${storeStat.size} bytes` };
+        }
         const fileBuffer = fs.readFileSync(dbPath);
         const db = new SQL.Database(fileBuffer);
         const id = `entry_${Date.now()}_${Math.random().toString(36).substring(7)}`;
@@ -1727,6 +1762,11 @@ export async function searchEntries(options) {
         }
         // Ensure schema has all required columns (migration for older DBs)
         await ensureSchemaColumns(dbPath);
+        // Guard against excessively large DB files to prevent OOM.
+        const searchStat = fs.statSync(dbPath);
+        if (searchStat.size > MAX_DB_FILE_BYTES) {
+            return { success: false, results: [], searchTime: 0, error: `Database file too large: ${searchStat.size} bytes` };
+        }
         // Generate query embedding
         const queryEmb = await generateEmbedding(query);
         const queryEmbedding = queryEmb.embedding;
@@ -1744,6 +1784,11 @@ export async function searchEntries(options) {
         // Fall back to brute-force SQLite search
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
+        // Guard against excessively large DB files to prevent OOM.
+        const searchFbStat = fs.statSync(dbPath);
+        if (searchFbStat.size > MAX_DB_FILE_BYTES) {
+            return { success: false, results: [], searchTime: Date.now() - startTime, error: `Database file too large: ${searchFbStat.size} bytes` };
+        }
         const fileBuffer = fs.readFileSync(dbPath);
         const db = new SQL.Database(fileBuffer);
         // Get entries with embeddings
@@ -1854,6 +1899,11 @@ export async function listEntries(options) {
         await ensureSchemaColumns(dbPath);
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
+        // Guard against excessively large DB files to prevent OOM.
+        const listStat = fs.statSync(dbPath);
+        if (listStat.size > MAX_DB_FILE_BYTES) {
+            return { success: false, entries: [], total: 0, error: `Database file too large: ${listStat.size} bytes` };
+        }
         const fileBuffer = fs.readFileSync(dbPath);
         const db = new SQL.Database(fileBuffer);
         // Get total count
@@ -1870,9 +1920,13 @@ export async function listEntries(options) {
         countStmt.free();
         const countResult = countRows.length > 0 ? [{ values: countRows }] : [];
         const total = countResult[0]?.values?.[0]?.[0] || 0;
-        // Get entries
-        const safeLimit = parseInt(String(limit), 10) || 100;
-        const safeOffset = parseInt(String(offset), 10) || 0;
+        // Get entries — cap limit to 10 000 to prevent full-table loads that OOM
+        // the sql.js in-memory database on large datasets.
+        const MAX_LIST_LIMIT = 10_000;
+        const rawLimit = parseInt(String(limit), 10);
+        const safeLimit = Number.isFinite(rawLimit) && rawLimit > 0 ? Math.min(rawLimit, MAX_LIST_LIMIT) : 100;
+        const rawOffset = parseInt(String(offset), 10);
+        const safeOffset = Number.isFinite(rawOffset) && rawOffset >= 0 ? rawOffset : 0;
         const listStmt = namespace
             ? db.prepare(`SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at FROM memory_entries WHERE status = 'active' AND namespace = ? ORDER BY updated_at DESC LIMIT ? OFFSET ?`)
             : db.prepare(`SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at FROM memory_entries WHERE status = 'active' ORDER BY updated_at DESC LIMIT ? OFFSET ?`);
@@ -1939,6 +1993,11 @@ export async function getEntry(options) {
         await ensureSchemaColumns(dbPath);
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
+        // Guard against excessively large DB files to prevent OOM.
+        const getStat = fs.statSync(dbPath);
+        if (getStat.size > MAX_DB_FILE_BYTES) {
+            return { success: false, found: false, error: `Database file too large: ${getStat.size} bytes` };
+        }
         const fileBuffer = fs.readFileSync(dbPath);
         const db = new SQL.Database(fileBuffer);
         // Find entry by key
@@ -2041,6 +2100,11 @@ export async function deleteEntry(options) {
         await ensureSchemaColumns(dbPath);
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
+        // Guard against excessively large DB files to prevent OOM.
+        const deleteStat = fs.statSync(dbPath);
+        if (deleteStat.size > MAX_DB_FILE_BYTES) {
+            return { success: false, deleted: false, key, namespace, remainingEntries: 0, error: `Database file too large: ${deleteStat.size} bytes` };
+        }
         const fileBuffer = fs.readFileSync(dbPath);
         const db = new SQL.Database(fileBuffer);
         // Check if entry exists first

package/packages/@monomind/cli/dist/src/memory/sona-optimizer.js

@@ -11,7 +11,7 @@
  * - Persists patterns to .swarm/sona-patterns.json
  * @module v1/cli/memory/sona-optimizer
  */
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'fs';
 import { dirname, join } from 'path';
 // ============================================================================
 // Constants
@@ -473,6 +473,8 @@ export class SONAOptimizer {
             if (!existsSync(fullPath)) {
                 return false;
             }
+            if (statSync(fullPath).size > 50 * 1024 * 1024)
+                return false;
             const data = readFileSync(fullPath, 'utf-8');
             const state = JSON.parse(data);
             // Validate version
@@ -480,9 +482,13 @@ export class SONAOptimizer {
                 console.error('[SONA] Incompatible state version, starting fresh');
                 return false;
             }
-            // Load patterns
+            // Load patterns — also cap key length so a crafted state file cannot
+            // store arbitrarily long keys that bloat the in-memory Map. The key is
+            // an agent:keyword string; 512 chars is ample for any real value.
             this.patterns.clear();
             for (const [key, pattern] of Object.entries(state.patterns)) {
+                if (typeof key !== 'string' || key.length > 512)
+                    continue;
                 if (this.validatePattern(pattern)) {
                     this.patterns.set(key, pattern);
                 }
@@ -497,7 +503,9 @@ export class SONAOptimizer {
             return true;
         }
         catch (err) {
-            console.error(`[SONA] Failed to load state: ${err}`);
+            // Strip filesystem paths from error before logging to prevent path disclosure
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`[SONA] Failed to load state: ${msg.replace(/\/[^\s:]+(\/|(?=\s|:|$))/g, '<path>/').slice(0, 200)}`);
             return false;
         }
     }
@@ -532,7 +540,9 @@ export class SONAOptimizer {
             return true;
         }
         catch (err) {
-            console.error(`[SONA] Failed to save state: ${err}`);
+            // Strip filesystem paths from error before logging to prevent path disclosure
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`[SONA] Failed to save state: ${msg.replace(/\/[^\s:]+(\/|(?=\s|:|$))/g, '<path>/').slice(0, 200)}`);
             return false;
         }
     }

package/packages/@monomind/cli/dist/src/model/complexity-scorer.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Heuristic complexity scorer for task descriptions.
+ *
+ * Returns a score in [0, 100] that drives automatic model-tier selection.
+ * Higher scores indicate tasks that benefit from more capable (and costly)
+ * models.
+ */
+/**
+ * Agent slugs that inherently deal with high-complexity work.
+ * When one of these agents is involved the score gets a +20 bonus.
+ */
+export declare const HIGH_COMPLEXITY_AGENTS: ReadonlySet<string>;
+/**
+ * Score the complexity of a task description.
+ *
+ * @param taskDescription - Free-text description of the task.
+ * @param agentSlug       - Optional agent identifier; certain agents boost the score.
+ * @returns A number in [0, 100].
+ */
+export declare function scoreComplexity(taskDescription: string, agentSlug?: string): number;
+//# sourceMappingURL=complexity-scorer.d.ts.map

package/packages/@monomind/cli/dist/src/model/complexity-scorer.js

@@ -0,0 +1,106 @@
+/**
+ * Heuristic complexity scorer for task descriptions.
+ *
+ * Returns a score in [0, 100] that drives automatic model-tier selection.
+ * Higher scores indicate tasks that benefit from more capable (and costly)
+ * models.
+ */
+// ---------------------------------------------------------------------------
+// Keyword sets
+// ---------------------------------------------------------------------------
+const HIGH_COMPLEXITY_KEYWORDS = [
+    'architecture',
+    'distributed',
+    'security audit',
+    'cve',
+    'consensus',
+    'fault-tolerant',
+    'migrate',
+    'refactor across',
+    'orchestrat',
+    'design system',
+    'database schema',
+    'performance optim',
+    'threat model',
+    'encryption',
+    'zero-knowledge',
+];
+const LOW_COMPLEXITY_KEYWORDS = [
+    'format',
+    'list',
+    'rename',
+    'sort',
+    'typo',
+    'lint',
+    'log',
+    'comment',
+    'print',
+    'echo',
+    'delete unused',
+    'remove import',
+];
+/**
+ * Agent slugs that inherently deal with high-complexity work.
+ * When one of these agents is involved the score gets a +20 bonus.
+ */
+export const HIGH_COMPLEXITY_AGENTS = new Set([
+    'engineering-software-architect',
+    'security-architect',
+    'security-auditor',
+    'system-architect',
+    'performance-engineer',
+    'byzantine-coordinator',
+    'collective-intelligence-coordinator',
+]);
+// ---------------------------------------------------------------------------
+// Patterns
+// ---------------------------------------------------------------------------
+const STEP_INDICATOR_RE = /(?:step\s*\d|first[\s,].*then[\s,]|phase\s*\d)/i;
+const CODE_BLOCK_RE = /```[\s\S]*?```/;
+const FILE_REF_RE = /\b[\w./-]+\.\w{1,5}\b/;
+// ---------------------------------------------------------------------------
+// Scorer
+// ---------------------------------------------------------------------------
+/**
+ * Score the complexity of a task description.
+ *
+ * @param taskDescription - Free-text description of the task.
+ * @param agentSlug       - Optional agent identifier; certain agents boost the score.
+ * @returns A number in [0, 100].
+ */
+export function scoreComplexity(taskDescription, agentSlug) {
+    let score = 50;
+    const lower = taskDescription.toLowerCase();
+    const wordCount = taskDescription.trim().split(/\s+/).length;
+    // -- Word-count adjustments ------------------------------------------------
+    if (wordCount < 20) {
+        score -= 20;
+    }
+    if (wordCount > 100) {
+        score += 20;
+    }
+    if (wordCount > 200) {
+        score += 10;
+    }
+    // -- Keyword adjustments (first match only) --------------------------------
+    if (HIGH_COMPLEXITY_KEYWORDS.some((kw) => lower.includes(kw))) {
+        score += 10;
+    }
+    if (LOW_COMPLEXITY_KEYWORDS.some((kw) => lower.includes(kw))) {
+        score -= 10;
+    }
+    // -- Structural indicators -------------------------------------------------
+    if (STEP_INDICATOR_RE.test(taskDescription)) {
+        score += 10;
+    }
+    if (CODE_BLOCK_RE.test(taskDescription) || FILE_REF_RE.test(taskDescription)) {
+        score += 5;
+    }
+    // -- Agent bonus -----------------------------------------------------------
+    if (agentSlug && HIGH_COMPLEXITY_AGENTS.has(agentSlug)) {
+        score += 20;
+    }
+    // -- Clamp -----------------------------------------------------------------
+    return Math.max(0, Math.min(100, score));
+}
+//# sourceMappingURL=complexity-scorer.js.map

package/packages/@monomind/cli/dist/src/model/index.d.ts

@@ -0,0 +1,4 @@
+export { type ModelTier, type ModelSettings, type ModelPreference, TIER_DEFAULTS, MODEL_IDS, } from './model-settings.js';
+export { scoreComplexity, HIGH_COMPLEXITY_AGENTS, } from './complexity-scorer.js';
+export { type ResolvedModelSettings, resolveModelTier, } from './model-tier-resolver.js';
+//# sourceMappingURL=index.d.ts.map

package/packages/@monomind/cli/dist/src/model/index.js

@@ -0,0 +1,4 @@
+export { TIER_DEFAULTS, MODEL_IDS, } from './model-settings.js';
+export { scoreComplexity, HIGH_COMPLEXITY_AGENTS, } from './complexity-scorer.js';
+export { resolveModelTier, } from './model-tier-resolver.js';
+//# sourceMappingURL=index.js.map

package/packages/@monomind/cli/dist/src/model/model-settings.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Per-run model tier selection — types and constants.
+ *
+ * Each tier maps to a concrete Claude model ID and carries sensible defaults
+ * for token budget, temperature, and extended-thinking.
+ */
+export type ModelTier = 'haiku' | 'sonnet' | 'opus';
+export interface ModelSettings {
+    model: ModelTier;
+    maxTokens?: number;
+    maxCostUsd?: number;
+    extendedThinking?: boolean;
+    temperature?: number;
+}
+export interface ModelPreference {
+    default: ModelTier;
+    maxCostUsd?: number;
+    extendedThinking?: boolean;
+}
+export declare const TIER_DEFAULTS: Record<ModelTier, ModelSettings>;
+export declare const MODEL_IDS: Record<ModelTier, string>;
+//# sourceMappingURL=model-settings.d.ts.map

package/packages/@monomind/cli/dist/src/model/model-settings.js

@@ -0,0 +1,33 @@
+/**
+ * Per-run model tier selection — types and constants.
+ *
+ * Each tier maps to a concrete Claude model ID and carries sensible defaults
+ * for token budget, temperature, and extended-thinking.
+ */
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+export const TIER_DEFAULTS = {
+    haiku: {
+        model: 'haiku',
+        maxTokens: 2048,
+        temperature: 0.3,
+    },
+    sonnet: {
+        model: 'sonnet',
+        maxTokens: 8192,
+        temperature: 0.5,
+    },
+    opus: {
+        model: 'opus',
+        maxTokens: 16384,
+        temperature: 0.7,
+        extendedThinking: true,
+    },
+};
+export const MODEL_IDS = {
+    haiku: 'claude-haiku-4-5',
+    sonnet: 'claude-sonnet-4-5',
+    opus: 'claude-opus-4-5',
+};
+//# sourceMappingURL=model-settings.js.map

package/packages/@monomind/cli/dist/src/model/model-tier-resolver.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Resolves the concrete model tier for a given agent + task combination.
+ *
+ * Resolution order:
+ *   1. Orchestrator override (explicit)
+ *   2. Complexity-based automatic selection
+ *   3. Agent preference default
+ *   4. Fallback to sonnet
+ */
+import type { ModelSettings, ModelPreference } from './model-settings.js';
+export interface ResolvedModelSettings extends ModelSettings {
+    complexityScore: number;
+    resolutionReason: string;
+}
+/**
+ * Determine the best model tier for a task.
+ *
+ * @param agentSlug            - The agent that will execute the task.
+ * @param taskDescription      - Free-text task description.
+ * @param agentPreference      - Optional per-agent preference.
+ * @param orchestratorOverride - Optional hard override from the orchestrator.
+ */
+export declare function resolveModelTier(agentSlug: string, taskDescription: string, agentPreference?: ModelPreference, orchestratorOverride?: Partial<ModelSettings>): ResolvedModelSettings;
+//# sourceMappingURL=model-tier-resolver.d.ts.map

package/packages/@monomind/cli/dist/src/model/model-tier-resolver.js

@@ -0,0 +1,65 @@
+/**
+ * Resolves the concrete model tier for a given agent + task combination.
+ *
+ * Resolution order:
+ *   1. Orchestrator override (explicit)
+ *   2. Complexity-based automatic selection
+ *   3. Agent preference default
+ *   4. Fallback to sonnet
+ */
+import { TIER_DEFAULTS } from './model-settings.js';
+import { scoreComplexity, HIGH_COMPLEXITY_AGENTS } from './complexity-scorer.js';
+// ---------------------------------------------------------------------------
+// Resolver
+// ---------------------------------------------------------------------------
+/**
+ * Determine the best model tier for a task.
+ *
+ * @param agentSlug            - The agent that will execute the task.
+ * @param taskDescription      - Free-text task description.
+ * @param agentPreference      - Optional per-agent preference.
+ * @param orchestratorOverride - Optional hard override from the orchestrator.
+ */
+export function resolveModelTier(agentSlug, taskDescription, agentPreference, orchestratorOverride) {
+    const complexity = scoreComplexity(taskDescription, agentSlug);
+    // ----- 1. Orchestrator override ------------------------------------------
+    if (orchestratorOverride?.model) {
+        return buildResult(orchestratorOverride.model, complexity, 'orchestrator_override', agentPreference);
+    }
+    // ----- 2. Complexity-based selection -------------------------------------
+    const preferredDefault = agentPreference?.default ?? 'sonnet';
+    let tier;
+    let reason;
+    if (complexity < 30 && preferredDefault !== 'opus') {
+        tier = 'haiku';
+        reason = 'low_complexity';
+    }
+    else if (complexity >= 70 || HIGH_COMPLEXITY_AGENTS.has(agentSlug)) {
+        tier = 'opus';
+        reason = complexity >= 70 ? 'high_complexity' : 'high_complexity_agent';
+    }
+    else {
+        tier = preferredDefault;
+        reason = 'default_preference';
+    }
+    return buildResult(tier, complexity, reason, agentPreference);
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function buildResult(tier, complexityScore, resolutionReason, preference) {
+    const base = { ...TIER_DEFAULTS[tier] };
+    // Propagate preference overrides
+    if (preference?.maxCostUsd !== undefined) {
+        base.maxCostUsd = preference.maxCostUsd;
+    }
+    if (preference?.extendedThinking !== undefined) {
+        base.extendedThinking = preference.extendedThinking;
+    }
+    return {
+        ...base,
+        complexityScore,
+        resolutionReason,
+    };
+}
+//# sourceMappingURL=model-tier-resolver.js.map

package/packages/@monomind/cli/dist/src/monovector/capabilities.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Capability surface for the (removed) @monoes/* native learning packages.
+ *
+ * Lean teardown: the SONA / native / WASM learning layer (@monoes/sona, router,
+ * attention, learning-wasm, core, and @monomind/monovector-upstream) has been
+ * removed. This module is now a stub that always reports "nothing native is
+ * available", so every caller takes the pure-JS / keyword-routing path. The
+ * function and type surface is preserved so importers (index.ts, hooks-tools.ts,
+ * doctor.ts, neural.ts) keep compiling without change.
+ */
+export interface MonoesCapabilities {
+    /** @monoes/sona SonaEngine available — always false after teardown */
+    sona: boolean;
+    /** @monoes/router backend — always 'none' after teardown */
+    router: 'native' | 'js' | 'none';
+    /** @monoes/attention FlashAttention available — always false after teardown */
+    attention: boolean;
+    /** @monoes/learning-wasm WasmMicroLoRA available — always false after teardown */
+    learningWasm: boolean;
+    /** @monomind/monovector-upstream plugin loaded — always false after teardown */
+    upstreamPlugin: boolean;
+}
+/**
+ * Returns the stubbed capability surface — all native backends report absent.
+ * Async to preserve the original signature; callers `await` this everywhere.
+ */
+export declare function getCapabilities(): Promise<MonoesCapabilities>;
+/** Synchronous read of the (constant) capability surface. */
+export declare function getCachedCapabilities(): MonoesCapabilities | null;
+/** No-op after teardown — there is nothing to re-probe. */
+export declare function resetCapabilitiesCache(): void;
+/** Returns the stubbed capability surface — kept for API compatibility. */
+export declare function refreshCapabilities(): Promise<MonoesCapabilities>;
+//# sourceMappingURL=capabilities.d.ts.map

package/packages/@monomind/cli/dist/src/monovector/capabilities.js

@@ -0,0 +1,37 @@
+/**
+ * Capability surface for the (removed) @monoes/* native learning packages.
+ *
+ * Lean teardown: the SONA / native / WASM learning layer (@monoes/sona, router,
+ * attention, learning-wasm, core, and @monomind/monovector-upstream) has been
+ * removed. This module is now a stub that always reports "nothing native is
+ * available", so every caller takes the pure-JS / keyword-routing path. The
+ * function and type surface is preserved so importers (index.ts, hooks-tools.ts,
+ * doctor.ts, neural.ts) keep compiling without change.
+ */
+const STUB_CAPABILITIES = {
+    sona: false,
+    router: 'none',
+    attention: false,
+    learningWasm: false,
+    upstreamPlugin: false,
+};
+/**
+ * Returns the stubbed capability surface — all native backends report absent.
+ * Async to preserve the original signature; callers `await` this everywhere.
+ */
+export async function getCapabilities() {
+    return STUB_CAPABILITIES;
+}
+/** Synchronous read of the (constant) capability surface. */
+export function getCachedCapabilities() {
+    return STUB_CAPABILITIES;
+}
+/** No-op after teardown — there is nothing to re-probe. */
+export function resetCapabilitiesCache() {
+    /* no-op */
+}
+/** Returns the stubbed capability surface — kept for API compatibility. */
+export async function refreshCapabilities() {
+    return STUB_CAPABILITIES;
+}
+//# sourceMappingURL=capabilities.js.map

package/packages/@monomind/cli/dist/src/monovector/command-outcomes.js

@@ -3,19 +3,43 @@
  * success signal from real command exit codes, instead of trusting a
  * caller-supplied --success flag.
  */
-import { promises as fs } from 'node:fs';
+import { promises as fs, statSync } from 'node:fs';
 import { join } from 'node:path';
+/** Refuse to read files larger than this to prevent OOM. */
+const MAX_FILE_BYTES = 50 * 1024 * 1024; // 50 MB
+/** Cap command string length to prevent file bloat. */
+const MAX_COMMAND_LEN = 500;
 function storePath(baseDir) {
     return join(baseDir, 'command-outcomes.jsonl');
 }
+/** Maximum number of command-outcome records to keep.
+ *  deriveRecentSuccess only uses records within a 5-minute window (typically < 50), so
+ *  anything older is dead weight. 500 gives a comfortable buffer. */
+const MAX_COMMAND_RECORDS = 500;
 /** Append a command outcome. Non-fatal on error. */
 export async function recordCommand(baseDir, cmd) {
     try {
         await fs.mkdir(baseDir, { recursive: true });
-        const rec = { ts: cmd.ts, command: cmd.command, exitCode: cmd.exitCode, success: cmd.exitCode === 0 };
-        await fs.appendFile(storePath(baseDir), JSON.stringify(rec) + '\n', 'utf8');
-        // Opportunistic trim: keep file bounded (last 500 lines) to avoid unbounded growth
-        // (cheap: only rewrite when it gets large)
+        const path = storePath(baseDir);
+        // Cap command length to prevent individual records from bloating the file.
+        const safeCommand = cmd.command.length > MAX_COMMAND_LEN ? cmd.command.slice(0, MAX_COMMAND_LEN) : cmd.command;
+        const rec = { ts: cmd.ts, command: safeCommand, exitCode: cmd.exitCode, success: cmd.exitCode === 0 };
+        await fs.appendFile(path, JSON.stringify(rec) + '\n', 'utf8');
+        // Opportunistic trim: rewrite only when the file exceeds the cap.
+        // Avoids an extra stat() on every call by catching the overcount lazily.
+        // Guard with size check first to prevent OOM on unexpectedly large files.
+        try {
+            if (statSync(path).size > MAX_FILE_BYTES)
+                return;
+        }
+        catch {
+            return;
+        }
+        const content = await fs.readFile(path, 'utf8').catch(() => '');
+        const lines = content.trim().split('\n').filter(Boolean);
+        if (lines.length > MAX_COMMAND_RECORDS) {
+            await fs.writeFile(path, lines.slice(-MAX_COMMAND_RECORDS).join('\n') + '\n', 'utf8');
+        }
     }
     catch { /* non-fatal */ }
 }
@@ -42,7 +66,13 @@ export async function recordCommand(baseDir, cmd) {
  */
 export async function deriveRecentSuccess(baseDir, windowMs = 300_000) {
     try {
-        const content = await fs.readFile(storePath(baseDir), 'utf8').catch(() => '');
+        const p = storePath(baseDir);
+        try {
+            if (statSync(p).size > MAX_FILE_BYTES)
+                return null;
+        }
+        catch { /* file absent */ }
+        const content = await fs.readFile(p, 'utf8').catch(() => '');
         if (!content)
             return null;
         const now = Date.now();
@@ -67,7 +97,13 @@ export async function deriveRecentSuccess(baseDir, windowMs = 300_000) {
 /** Read recent command outcomes (for diagnostics). */
 export async function readCommandOutcomes(baseDir, windowMs = 300_000) {
     try {
-        const content = await fs.readFile(storePath(baseDir), 'utf8').catch(() => '');
+        const p = storePath(baseDir);
+        try {
+            if (statSync(p).size > MAX_FILE_BYTES)
+                return [];
+        }
+        catch { /* file absent */ }
+        const content = await fs.readFile(p, 'utf8').catch(() => '');
         if (!content)
             return [];
         const now = Date.now();