monomind 1.11.13 → 1.12.0

package/packages/@monomind/cli/dist/src/services/claim-service.d.ts

@@ -129,6 +129,7 @@ export declare class ClaimService extends EventEmitter {
     private eventLog;
     constructor(projectRoot: string, config?: Partial<ClaimServiceConfig>);
     initialize(): Promise<void>;
+    private static readonly MAX_CLAIMS_FILE_BYTES;
     private loadClaims;
     private _saveQueue;
     private saveClaims;

package/packages/@monomind/cli/dist/src/services/claim-service.js

@@ -57,10 +57,18 @@ export class ClaimService extends EventEmitter {
         // Load existing claims
         await this.loadClaims();
     }
+    // Hard cap on claims.json: a file larger than this is malformed or
+    // adversarially crafted (normal claim files are tiny).
+    static MAX_CLAIMS_FILE_BYTES = 10 * 1024 * 1024; // 10 MB
     async loadClaims() {
         const claimsFile = path.join(this.storagePath, 'claims.json');
         if (fs.existsSync(claimsFile)) {
             try {
+                const fileSize = fs.statSync(claimsFile).size;
+                if (fileSize > ClaimService.MAX_CLAIMS_FILE_BYTES) {
+                    // Oversized file — skip loading rather than OOM-ing the daemon
+                    return;
+                }
                 const data = JSON.parse(fs.readFileSync(claimsFile, 'utf-8'));
                 for (const claim of data.claims || []) {
                     claim.claimedAt = new Date(claim.claimedAt);

package/packages/@monomind/cli/dist/src/services/config-file-manager.js

@@ -3,6 +3,7 @@
  * Shared JSON config file persistence with atomic writes and Zod validation
  */
 import * as fs from 'fs';
+import * as os from 'os';
 import * as path from 'path';
 /** Config file search paths in priority order */
 const CONFIG_FILENAMES = [
@@ -123,7 +124,7 @@ export class ConfigFileManager {
      * drop the first writer's API key.
      */
     set(cwd, key, value) {
-        const KNOWN_SET_SECTIONS = new Set(['version', 'agents', 'swarm', 'memory', 'mcp', 'cli', 'hooks', 'neural']);
+        const KNOWN_SET_SECTIONS = new Set(['version', 'agents', 'swarm', 'memory', 'mcp', 'cli', 'hooks', 'neural', 'providers']);
         const topSection = String(key).split('.')[0];
         if (!KNOWN_SET_SECTIONS.has(topSection)) {
             throw new Error(`Unknown config section: "${topSection}". Allowed: ${[...KNOWN_SET_SECTIONS].join(', ')}`);
@@ -181,6 +182,17 @@ export class ConfigFileManager {
     /** Import config from a specific path */
     importFrom(cwd, importPath) {
         const resolved = path.resolve(cwd, importPath);
+        // Guard against path traversal: the resolved path must be within the
+        // project cwd or the user's home directory.  Without this check an
+        // automated script can pass "/etc/passwd" or "../../.env" and exfiltrate
+        // files outside the project tree.
+        const projectRoot = path.resolve(cwd);
+        const home = os.homedir();
+        const isUnderProject = resolved === projectRoot || resolved.startsWith(projectRoot + path.sep);
+        const isUnderHome = resolved === home || resolved.startsWith(home + path.sep);
+        if (!isUnderProject && !isUnderHome) {
+            throw new Error(`Import path must be within the project directory or home directory: ${resolved}`);
+        }
         if (!fs.existsSync(resolved)) {
             throw new Error(`Import file not found: ${resolved}`);
         }
@@ -199,7 +211,7 @@ export class ConfigFileManager {
         // KNOWN_SECTIONS only validates top-level keys, leaving nested
         // {agents:{providers:[{__proto__:{...}}]}} unsanitized.
         const imported = sanitizeConfigObject(importedRaw);
-        const KNOWN_SECTIONS = new Set(['version', 'agents', 'swarm', 'memory', 'mcp', 'cli', 'hooks']);
+        const KNOWN_SECTIONS = new Set(['version', 'agents', 'swarm', 'memory', 'mcp', 'cli', 'hooks', 'neural', 'providers']);
         for (const key of Object.keys(imported)) {
             if (!KNOWN_SECTIONS.has(key)) {
                 throw new Error(`Unknown config section: "${key}"`);

package/packages/@monomind/cli/dist/src/services/container-worker-pool.d.ts

@@ -0,0 +1,197 @@
+/**
+ * Container Worker Pool
+ * Docker-based worker pool for high-throughput headless execution.
+ *
+ * ADR-020: Headless Worker Integration Architecture - Phase 3
+ * - Manages pool of Docker containers for isolated worker execution
+ * - Supports dynamic scaling based on workload
+ * - Provides container lifecycle management
+ * - Integrates with WorkerQueue for task distribution
+ *
+ * Key Features:
+ * - Container pooling with configurable size
+ * - Health checking and auto-recovery
+ * - Resource limits (CPU, memory)
+ * - Volume mounting for workspace access
+ * - Network isolation per worker type
+ */
+import { EventEmitter } from 'events';
+import type { HeadlessWorkerType, HeadlessExecutionResult, SandboxMode } from './headless-worker-executor.js';
+/**
+ * Container state
+ */
+export type ContainerState = 'creating' | 'ready' | 'busy' | 'unhealthy' | 'terminated';
+/**
+ * Container info
+ */
+export interface ContainerInfo {
+    id: string;
+    name: string;
+    state: ContainerState;
+    createdAt: Date;
+    lastUsedAt?: Date;
+    workerType?: HeadlessWorkerType;
+    executionCount: number;
+    healthCheckFailures: number;
+    pid?: number;
+}
+/**
+ * Container pool configuration
+ */
+export interface ContainerPoolConfig {
+    /** Maximum number of containers in the pool */
+    maxContainers: number;
+    /** Minimum number of containers to keep warm */
+    minContainers: number;
+    /** Docker image to use */
+    image: string;
+    /** Container resource limits */
+    resources: {
+        cpus: string;
+        memory: string;
+    };
+    /** Health check interval in ms */
+    healthCheckIntervalMs: number;
+    /** Container idle timeout in ms */
+    idleTimeoutMs: number;
+    /** Workspace volume mount path */
+    workspacePath: string;
+    /** State persistence path */
+    statePath: string;
+    /** Network name for container isolation */
+    network?: string;
+    /** Environment variables for containers */
+    env?: Record<string, string>;
+    /** Default sandbox mode */
+    defaultSandbox: SandboxMode;
+}
+/**
+ * Container execution options
+ */
+export interface ContainerExecutionOptions {
+    workerType: HeadlessWorkerType;
+    prompt: string;
+    contextPatterns?: string[];
+    sandbox?: SandboxMode;
+    model?: string;
+    timeoutMs?: number;
+}
+/**
+ * Pool status
+ */
+export interface ContainerPoolStatus {
+    totalContainers: number;
+    readyContainers: number;
+    busyContainers: number;
+    unhealthyContainers: number;
+    queuedTasks: number;
+    containers: ContainerInfo[];
+    dockerAvailable: boolean;
+    lastHealthCheck?: Date;
+}
+/**
+ * ContainerWorkerPool - Manages Docker containers for headless worker execution
+ */
+export declare class ContainerWorkerPool extends EventEmitter {
+    private config;
+    private projectRoot;
+    private containers;
+    private taskQueue;
+    private healthCheckTimer?;
+    private idleCheckTimer?;
+    private dockerAvailable;
+    private initialized;
+    private isShuttingDown;
+    private exitHandlersRegistered;
+    constructor(projectRoot: string, config?: Partial<ContainerPoolConfig>);
+    /**
+     * Initialize the container pool
+     */
+    initialize(): Promise<boolean>;
+    /**
+     * Register process exit handlers to clean up containers
+     */
+    private registerExitHandlers;
+    /**
+     * Execute a worker in a container
+     */
+    execute(options: ContainerExecutionOptions): Promise<HeadlessExecutionResult>;
+    /**
+     * Scale pool for batch execution
+     */
+    scaleForBatch(workerCount: number): Promise<void>;
+    /**
+     * Get pool status
+     */
+    getStatus(): ContainerPoolStatus;
+    /**
+     * Shutdown the pool
+     */
+    shutdown(): Promise<void>;
+    /**
+     * Check if Docker is available (async)
+     */
+    private checkDockerAvailable;
+    /**
+     * Ensure the container image exists (async)
+     */
+    private ensureImage;
+    /**
+     * Create a new container
+     */
+    private createContainer;
+    /**
+     * Terminate a container (async)
+     */
+    private terminateContainer;
+    /**
+     * Get a ready container
+     */
+    private getReadyContainer;
+    /**
+     * Scale to minimum containers
+     */
+    private scaleToMinimum;
+    /**
+     * Execute worker in a specific container
+     */
+    private executeInContainer;
+    /**
+     * Execute command in container
+     */
+    private execInContainer;
+    /**
+     * Build worker command for container execution
+     */
+    private buildWorkerCommand;
+    /**
+     * Process queued tasks
+     */
+    private processQueue;
+    /**
+     * Start health check timer
+     */
+    private startHealthChecks;
+    /**
+     * Run health checks on all containers
+     */
+    private runHealthChecks;
+    /**
+     * Start idle check timer
+     */
+    private startIdleChecks;
+    /**
+     * Terminate idle containers above minimum
+     */
+    private runIdleChecks;
+    /**
+     * Try to parse JSON from output
+     */
+    private tryParseJson;
+    /**
+     * Create an error result
+     */
+    private createErrorResult;
+}
+export default ContainerWorkerPool;
+//# sourceMappingURL=container-worker-pool.d.ts.map