monomind 1.11.14 → 1.12.0

package/packages/@monomind/cli/dist/src/index.js

@@ -4,7 +4,7 @@
  *
  * github.com/monoes/monomind
  */
-import { readFileSync } from 'fs';
+import { readFileSync, statSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import { commandParser } from './parser.js';
@@ -19,6 +19,9 @@ function getPackageVersion() {
         const __dirname = dirname(__filename);
         // Navigate from dist/src to package root
         const pkgPath = join(__dirname, '..', '..', 'package.json');
+        // Guard: skip if package.json is unexpectedly large (> 1 MB)
+        if (statSync(pkgPath).size > 1024 * 1024)
+            return '3.0.0';
         const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
         return pkg.version || '3.0.0';
     }
@@ -458,10 +461,11 @@ export class CLI {
         catch { /* optional — registry build failures must never block startup */ }
         // Task 04: CapabilityMetadata — validate agent registry at startup
         try {
-            const { readFileSync, existsSync } = await import('fs');
+            const { readFileSync, existsSync, statSync: statSyncReg } = await import('fs');
             const { join: pathJoin } = await import('path');
             const registryPath = pathJoin(process.cwd(), '.monomind', 'registry.json');
-            if (existsSync(registryPath)) {
+            const MAX_REGISTRY_BYTES = 10 * 1024 * 1024; // 10 MB
+            if (existsSync(registryPath) && statSyncReg(registryPath).size <= MAX_REGISTRY_BYTES) {
                 const registry = JSON.parse(readFileSync(registryPath, 'utf-8'));
                 const entries = registry.agents ?? [];
                 const issues = [];

package/packages/@monomind/cli/dist/src/init/executor.js

@@ -10,6 +10,7 @@ import { dirname } from 'path';
 // ESM-compatible __dirname
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
+const MAX_EXEC_FILE_BYTES = 10 * 1024 * 1024; // 10 MB
 /**
  * Atomic write helper — writes to a sibling .tmp file then renames into place.
  * SIGINT or crash during a partial write would otherwise corrupt user-critical
@@ -205,7 +206,7 @@ function cleanupLegacyTools(targetDir) {
     }
     // Clean ruv-swarm from .mcp.json and fix old MCP package name
     const mcpJsonPath = path.join(targetDir, '.mcp.json');
-    if (fs.existsSync(mcpJsonPath)) {
+    if (fs.existsSync(mcpJsonPath) && fs.statSync(mcpJsonPath).size <= MAX_EXEC_FILE_BYTES) {
         try {
             const mcp = JSON.parse(fs.readFileSync(mcpJsonPath, 'utf-8'));
             let mcpChanged = false;
@@ -226,7 +227,7 @@ function cleanupLegacyTools(targetDir) {
     }
     // Clean ruv-swarm from .claude/settings.json hooks and fix MCP package name
     const settingsPath = path.join(targetDir, '.claude', 'settings.json');
-    if (fs.existsSync(settingsPath)) {
+    if (fs.existsSync(settingsPath) && fs.statSync(settingsPath).size <= MAX_EXEC_FILE_BYTES) {
         try {
             const raw = fs.readFileSync(settingsPath, 'utf-8');
             const settings = JSON.parse(raw);
@@ -449,8 +450,8 @@ async function startDaemonBackground(targetDir, result) {
         const { execSync } = await import('child_process');
         // Check if daemon is already running
         const pidFile = path.join(targetDir, '.monomind', 'daemon.pid');
-        const { existsSync, readFileSync } = await import('fs');
-        if (existsSync(pidFile)) {
+        const { existsSync, readFileSync, statSync: statSyncPid } = await import('fs');
+        if (existsSync(pidFile) && statSyncPid(pidFile).size <= 1024) {
             const pid = parseInt(readFileSync(pidFile, 'utf8').trim(), 10);
             try {
                 process.kill(pid, 0);
@@ -798,7 +799,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
         // 3. Merge settings if requested
         if (upgradeSettings) {
             const settingsPath = path.join(targetDir, '.claude', 'settings.json');
-            if (fs.existsSync(settingsPath)) {
+            if (fs.existsSync(settingsPath) && fs.statSync(settingsPath).size <= MAX_EXEC_FILE_BYTES) {
                 try {
                     const existingSettings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
                     const mergedSettings = mergeSettingsForUpgrade(existingSettings);
@@ -951,7 +952,7 @@ async function createDirectories(targetDir, options, result) {
 async function writeSettings(targetDir, options, result) {
     const settingsPath = path.join(targetDir, '.claude', 'settings.json');
     const generated = JSON.parse(generateSettingsJson(options));
-    if (fs.existsSync(settingsPath) && !options.force) {
+    if (fs.existsSync(settingsPath) && !options.force && fs.statSync(settingsPath).size <= MAX_EXEC_FILE_BYTES) {
         // Merge hooks/env/permissions into existing settings instead of skipping
         try {
             const existing = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
@@ -1493,7 +1494,7 @@ daemon.pid
     // A blanket ignore prevents config, metrics, and knowledge graph from being committed.
     // We remove any bare `.monomind/` or `**/.monomind/` lines and add specific excludes instead.
     const projectGitignorePath = path.join(targetDir, '.gitignore');
-    if (fs.existsSync(projectGitignorePath)) {
+    if (fs.existsSync(projectGitignorePath) && fs.statSync(projectGitignorePath).size <= MAX_EXEC_FILE_BYTES) {
         const existing = fs.readFileSync(projectGitignorePath, 'utf-8');
         const blanketPattern = /^(\*\*\/)?\.monomind\/?\s*$/gm;
         if (blanketPattern.test(existing)) {
@@ -2060,7 +2061,7 @@ async function writeClaudeMd(targetDir, options, result) {
             if (!fs.existsSync(globalClaudeDir)) {
                 fs.mkdirSync(globalClaudeDir, { recursive: true });
             }
-            if (fs.existsSync(globalClaudeMd)) {
+            if (fs.existsSync(globalClaudeMd) && fs.statSync(globalClaudeMd).size <= MAX_EXEC_FILE_BYTES) {
                 const existing = fs.readFileSync(globalClaudeMd, 'utf-8');
                 if (!existing.includes('Monomind Integration')) {
                     fs.appendFileSync(globalClaudeMd, monomindBlock);
@@ -2082,7 +2083,7 @@ async function writeClaudeMd(targetDir, options, result) {
                 fs.mkdirSync(globalClaudeDir, { recursive: true });
             }
             let globalSettings = {};
-            if (fs.existsSync(globalSettingsPath)) {
+            if (fs.existsSync(globalSettingsPath) && fs.statSync(globalSettingsPath).size <= MAX_EXEC_FILE_BYTES) {
                 try {
                     globalSettings = JSON.parse(fs.readFileSync(globalSettingsPath, 'utf-8'));
                 }
@@ -2227,7 +2228,9 @@ function _registerMonomindProject(dir) {
         const registryPath = path.join(os.homedir(), '.monomind-projects.json');
         let reg = { projects: [] };
         try {
-            reg = JSON.parse(fs.readFileSync(registryPath, 'utf-8'));
+            if (fs.existsSync(registryPath) && fs.statSync(registryPath).size <= MAX_EXEC_FILE_BYTES) {
+                reg = JSON.parse(fs.readFileSync(registryPath, 'utf-8'));
+            }
         }
         catch { }
         if (!Array.isArray(reg.projects))
@@ -2260,7 +2263,7 @@ export function findMonomindProjects(maxDepth = 3) {
     ].filter(r => fs.existsSync(r));
     // Also check known-projects registry if it exists
     const registryPath = path.join(home, '.monomind-projects.json');
-    if (fs.existsSync(registryPath)) {
+    if (fs.existsSync(registryPath) && fs.statSync(registryPath).size <= MAX_EXEC_FILE_BYTES) {
         try {
             const reg = JSON.parse(fs.readFileSync(registryPath, 'utf-8'));
             if (Array.isArray(reg.projects)) {

package/packages/@monomind/cli/dist/src/init/shared-instructions-generator.js

@@ -8,8 +8,12 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { execFileSync } from 'node:child_process';
+const MAX_JSON_READ_BYTES = 10 * 1024 * 1024; // 10 MB
+const MAX_TEXT_READ_BYTES = 2 * 1024 * 1024; // 2 MB for plain-text config files
 function readJSON(p) {
     try {
+        if (!fs.existsSync(p) || fs.statSync(p).size > MAX_JSON_READ_BYTES)
+            return null;
         return JSON.parse(fs.readFileSync(p, 'utf-8'));
     }
     catch {
@@ -166,7 +170,10 @@ export function detectProjectProfile(cwd) {
         profile.language = 'rust';
         profile.packageManager = 'cargo';
         try {
-            const cargo = fs.readFileSync(path.join(cwd, 'Cargo.toml'), 'utf-8');
+            const cargoPath = path.join(cwd, 'Cargo.toml');
+            if (fs.statSync(cargoPath).size > MAX_TEXT_READ_BYTES)
+                throw new Error('too large');
+            const cargo = fs.readFileSync(cargoPath, 'utf-8');
             const nameM = cargo.match(/^name\s*=\s*"([^"]+)"/m);
             if (nameM)
                 profile.name = nameM[1];
@@ -191,7 +198,10 @@ export function detectProjectProfile(cwd) {
         else
             profile.packageManager = 'pip';
         try {
-            const pp = fs.readFileSync(path.join(cwd, 'pyproject.toml'), 'utf-8');
+            const ppPath = path.join(cwd, 'pyproject.toml');
+            if (fs.existsSync(ppPath) && fs.statSync(ppPath).size > MAX_TEXT_READ_BYTES)
+                throw new Error('too large');
+            const pp = fs.readFileSync(ppPath, 'utf-8');
             if (pp.includes('fastapi') || pp.includes('FastAPI'))
                 profile.framework.push('fastapi');
             if (pp.includes('django'))
@@ -210,7 +220,10 @@ export function detectProjectProfile(cwd) {
         profile.language = 'go';
         profile.packageManager = 'unknown'; // go mod doesn't have a separate PM
         try {
-            const gomod = fs.readFileSync(path.join(cwd, 'go.mod'), 'utf-8');
+            const gomodPath = path.join(cwd, 'go.mod');
+            if (fs.statSync(gomodPath).size > MAX_TEXT_READ_BYTES)
+                throw new Error('too large');
+            const gomod = fs.readFileSync(gomodPath, 'utf-8');
             if (gomod.includes('gin-gonic/gin'))
                 profile.framework.push('gin');
             if (gomod.includes('labstack/echo'))
@@ -236,7 +249,10 @@ export function detectProjectProfile(cwd) {
     }
     // ── CLAUDE.md conventions extraction ──────────────────────────────────────
     try {
-        const claudeMd = fs.readFileSync(path.join(cwd, 'CLAUDE.md'), 'utf-8');
+        const claudeMdPath = path.join(cwd, 'CLAUDE.md');
+        if (fs.existsSync(claudeMdPath) && fs.statSync(claudeMdPath).size > MAX_TEXT_READ_BYTES)
+            throw new Error('too large');
+        const claudeMd = fs.readFileSync(claudeMdPath, 'utf-8');
         profile.maxFileLines = extractMaxFileLines(claudeMd);
     }
     catch { /* skip */ }

package/packages/@monomind/cli/dist/src/init/statusline-generator.js

@@ -62,6 +62,8 @@ function getVersion() {
   ];
   for (const p of walkCandidates) {
     try {
+      const pkgStat = safeStat(p);
+      if (!pkgStat || pkgStat.size > 1024 * 1024) continue;
       const pkg = JSON.parse(fs.readFileSync(p, 'utf-8'));
       if (pkg.version && (pkg.name === 'monomind' || pkg.name === '@monomind/cli' || (pkg.name || '').startsWith('@monomind'))) {
         return \`v\${pkg.version}\`;
@@ -72,7 +74,10 @@ function getVersion() {
   try {
     const { execSync } = require('child_process');
     const prefix = execSync('npm config get prefix', { encoding: 'utf-8', timeout: 2000 }).trim();
-    const pkg = JSON.parse(fs.readFileSync(path.join(prefix, 'lib', 'node_modules', 'monomind', 'package.json'), 'utf-8'));
+    const globalPkgPath = path.join(prefix, 'lib', 'node_modules', 'monomind', 'package.json');
+    const globalPkgStat = safeStat(globalPkgPath);
+    if (!globalPkgStat || globalPkgStat.size > 1024 * 1024) throw new Error('too large');
+    const pkg = JSON.parse(fs.readFileSync(globalPkgPath, 'utf-8'));
     if (pkg.version) return \`v\${pkg.version}\`;
   } catch { /* ignore */ }
   return 'v1.0.6';
@@ -113,9 +118,11 @@ function safeExec(cmd, timeoutMs = 2000) {
 }
 
 // Safe JSON file reader (returns null on failure)
+// Refuses to load files > 10 MB to prevent OOM on corrupted/oversized stores.
+const MAX_JSON_READ_BYTES = 10 * 1024 * 1024;
 function readJSON(filePath) {
   try {
-    if (fs.existsSync(filePath)) {
+    if (fs.existsSync(filePath) && fs.statSync(filePath).size <= MAX_JSON_READ_BYTES) {
       return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
     }
   } catch { /* ignore */ }
@@ -227,6 +234,8 @@ function getModelFromSessionJSONL() {
     if (files.length === 0) return null;
 
     const sessionFile = path.join(projectsDir, files[0].f);
+    const sessionStat = safeStat(sessionFile);
+    if (!sessionStat || sessionStat.size > 50 * 1024 * 1024) return null; // skip > 50 MB
     const raw = fs.readFileSync(sessionFile, 'utf-8');
     const lines = raw.split('\\n').filter(Boolean);
 
@@ -557,7 +566,8 @@ function getHooksStatus() {
 function getActiveAgent() {
   const routeFile = path.join(CWD, '.monomind', 'last-route.json');
   try {
-    if (!fs.existsSync(routeFile)) return null;
+    const routeStat = safeStat(routeFile);
+    if (!routeStat || routeStat.size > MAX_JSON_READ_BYTES) return null;
     const data = JSON.parse(fs.readFileSync(routeFile, 'utf-8'));
     if (!data || !data.agent) return null;
 
@@ -590,7 +600,7 @@ function getAgentDBStats() {
   // 1. Count real entries from auto-memory-store.json
   const storePath = path.join(CWD, '.monomind', 'data', 'auto-memory-store.json');
   const storeStat = safeStat(storePath);
-  if (storeStat) {
+  if (storeStat && storeStat.size <= MAX_JSON_READ_BYTES) {
     dbSizeKB += storeStat.size / 1024;
     try {
       const store = JSON.parse(fs.readFileSync(storePath, 'utf-8'));
@@ -804,12 +814,14 @@ function getKnowledgeStats() {
   const skillsPath = path.join(CWD, '.monomind', 'skills.jsonl');
   let chunks = 0, skills = 0;
   try {
-    if (fs.existsSync(chunksPath)) {
+    const chunksStat = safeStat(chunksPath);
+    if (chunksStat && chunksStat.size <= MAX_JSON_READ_BYTES) {
       chunks = fs.readFileSync(chunksPath, 'utf-8').split('\\n').filter(Boolean).length;
     }
   } catch { /* ignore */ }
   try {
-    if (fs.existsSync(skillsPath)) {
+    const skillsStat = safeStat(skillsPath);
+    if (skillsStat && skillsStat.size <= MAX_JSON_READ_BYTES) {
       skills = fs.readFileSync(skillsPath, 'utf-8').split('\\n').filter(Boolean).length;
     }
   } catch { /* ignore */ }
@@ -819,7 +831,8 @@ function getKnowledgeStats() {
 function getTriggerStats() {
   const indexPath = path.join(CWD, '.monomind', 'trigger-index.json');
   try {
-    if (!fs.existsSync(indexPath)) return { triggers: 0, agents: 0 };
+    const idxStat = safeStat(indexPath);
+    if (!idxStat || idxStat.size > MAX_JSON_READ_BYTES) return { triggers: 0, agents: 0 };
     const raw = JSON.parse(fs.readFileSync(indexPath, 'utf-8'));
     const idx = raw.index || raw;
     const triggers = Object.keys(idx).length;
@@ -832,7 +845,8 @@ function getTriggerStats() {
 function getHookLatency() {
   const p = path.join(CWD, '.monomind', 'metrics', 'hook-latency.json');
   try {
-    if (!fs.existsSync(p)) return null;
+    const latStat = safeStat(p);
+    if (!latStat || latStat.size > MAX_JSON_READ_BYTES) return null;
     const d = JSON.parse(fs.readFileSync(p, 'utf-8'));
     const perPrompt = ['route'];
     let totalMs = 0; let count = 0;
@@ -854,7 +868,8 @@ function getHookLatency() {
 function getGraphUsage() {
   const usagePath = path.join(CWD, '.monomind', 'metrics', 'graph-usage.json');
   try {
-    if (!fs.existsSync(usagePath)) return null;
+    const usageStat = safeStat(usagePath);
+    if (!usageStat || usageStat.size > MAX_JSON_READ_BYTES) return null;
     const d = JSON.parse(fs.readFileSync(usagePath, 'utf-8'));
     const graphWins = (d.monograph_call || 0) + (d.preresolve_hit || 0)
                     + (d.graph_assist_search || 0) + (d.graph_assist_neighbors || 0);
@@ -919,7 +934,10 @@ function getHILPending() {
     const files = fs.readdirSync(loopsDir).filter(f => f.endsWith('-hil.md'));
     for (const f of files) {
       try {
-        const txt = fs.readFileSync(path.join(loopsDir, f), 'utf-8');
+        const hilPath = path.join(loopsDir, f);
+        const hilStat = safeStat(hilPath);
+        if (!hilStat || hilStat.size > 512 * 1024) continue; // skip > 512 KB
+        const txt = fs.readFileSync(hilPath, 'utf-8');
         const answered = /^[ \\t]*>[ \\t]+\\S/m.test(txt);
         if (!answered) pending++;
       } catch { /* ignore */ }
@@ -969,7 +987,9 @@ function getSIBudget() {
   const SI_LIMIT = 1500;
   const siPath = path.join(CWD, '.agents', 'shared_instructions.md');
   try {
-    if (!fs.existsSync(siPath)) return null;
+    const siStat = safeStat(siPath);
+    if (!siStat) return null;
+    if (siStat.size > 2 * 1024 * 1024) return null; // skip > 2 MB
     const len = fs.readFileSync(siPath, 'utf-8').length;
     return { len, pct: Math.round((len / SI_LIMIT) * 100), limit: SI_LIMIT };
   } catch { return null; }
@@ -1149,10 +1169,10 @@ function generateDashboard() {
 
   const hil = getHILPending();
   const hilStr = hil.pending > 0
-    ? \`\${x.coral}✨ \${x.bold}\${hil.pending}\${x.reset}\${x.coral} HIL pending\${x.reset}\`
-    : \`\${x.slate}✨ no pending HIL\${x.reset}\`;
+    ? \`   \${DIV}   \${x.coral}✨ \${x.bold}\${hil.pending}\${x.reset}\${x.coral} HIL pending\${x.reset}\`
+    : \`\`;
 
-  lines.push(\`\${x.teal}🧠  CONTEXT\${x.reset}  \${graphStr}   \${DIV}   \${hilStr}\`);
+  lines.push(\`\${x.teal}🧠  CONTEXT\${x.reset}  \${graphStr}\${hilStr}\`);
 
   return lines.join('\\n');
 }
@@ -1180,7 +1200,8 @@ const MODE_FILE = path.join(CWD, '.monomind', 'statusline-mode.txt');
 
 function readMode() {
   try {
-    if (fs.existsSync(MODE_FILE)) {
+    const modeStat = safeStat(MODE_FILE);
+    if (modeStat && modeStat.size <= 1024) {
       return fs.readFileSync(MODE_FILE, 'utf-8').trim();
     }
   } catch { /* ignore */ }

package/packages/@monomind/cli/dist/src/mcp-tools/a2a-tools.js

@@ -9,6 +9,57 @@
  *
  * @module v1/cli/mcp-tools/a2a-tools
  */
+// ===== Input validation helpers =====
+const MAX_AGENT_TYPE_LEN = 64; // slug length — catalogue keys are all < 30 chars
+const MAX_BASE_URL_LEN = 2048; // typical browser URL limit
+const MAX_TASK_ID_LEN = 256;
+const MAX_SESSION_ID_LEN = 256;
+// Allowlist of URL schemes that are safe to embed in returned Agent Card urls.
+// Prevents javascript:, data:, file:// etc. from being reflected back to callers.
+const ALLOWED_URL_SCHEMES = new Set(['http:', 'https:']);
+/**
+ * Validate and return an agent type slug.
+ * Returns null when the value is not a string or exceeds the max length.
+ */
+function validateAgentType(value) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > MAX_AGENT_TYPE_LEN)
+        return null;
+    return value;
+}
+/**
+ * Validate and return a base URL.
+ * Accepts only http/https schemes and caps length to prevent oversized reflected values.
+ * Falls back to the default localhost URL on failure.
+ */
+function validateBaseUrl(value, fallback = 'http://localhost:3000') {
+    if (typeof value !== 'string' || value.length === 0)
+        return fallback;
+    if (value.length > MAX_BASE_URL_LEN)
+        return fallback;
+    try {
+        const parsed = new URL(value);
+        if (!ALLOWED_URL_SCHEMES.has(parsed.protocol))
+            return fallback;
+        // Reject URLs with credentials — they should never appear in Agent Card endpoints
+        if (parsed.username || parsed.password)
+            return fallback;
+    }
+    catch {
+        return fallback;
+    }
+    return value;
+}
+/**
+ * Validate an optional string ID (taskId / sessionId).
+ * Returns undefined when the value is absent; null when it is present but invalid.
+ */
+function validateOptionalId(value, maxLen) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'string' || value.length === 0 || value.length > maxLen)
+        return null;
+    return value;
+}
 // ===== Agent type catalogue =====
 /** Well-known agent types and their A2A card metadata */
 const AGENT_CARD_CATALOGUE = {
@@ -116,13 +167,16 @@ export const a2aTools = [
             required: ['agentType'],
         },
         handler: async (input) => {
-            const agentType = input.agentType;
-            const baseUrl = input.baseUrl || 'http://localhost:3000';
+            const agentType = validateAgentType(input.agentType);
+            if (!agentType) {
+                return { success: false, error: 'agentType is required (non-empty string, max 64 chars)' };
+            }
+            const baseUrl = validateBaseUrl(input.baseUrl);
             const card = buildAgentCard(agentType, baseUrl);
             if (!card) {
                 return {
                     success: false,
-                    error: `Unknown agent type: "${agentType}". Available: ${Object.keys(AGENT_CARD_CATALOGUE).join(', ')}`,
+                    error: `Unknown agent type. Available: ${Object.keys(AGENT_CARD_CATALOGUE).join(', ')}`,
                 };
             }
             return { success: true, agentCard: card, protocol: 'a2a', source: 'https://a2a-protocol.org' };
@@ -146,8 +200,19 @@ export const a2aTools = [
             },
         },
         handler: async (input) => {
-            const baseUrl = input.baseUrl || 'http://localhost:3000';
-            const capabilityFilter = input.capabilities;
+            const baseUrl = validateBaseUrl(input.baseUrl);
+            // Only accept a plain object capability filter to prevent prototype pollution.
+            // Object.create(null) maps and class instances are intentionally rejected.
+            const rawCap = input.capabilities;
+            const capabilityFilter = rawCap !== null &&
+                typeof rawCap === 'object' &&
+                !Array.isArray(rawCap) &&
+                Object.getPrototypeOf(rawCap) === Object.prototype
+                ? rawCap
+                : undefined;
+            const KNOWN_CAPABILITY_KEYS = new Set([
+                'streaming', 'pushNotifications', 'stateTransitionHistory',
+            ]);
             const cards = Object.keys(AGENT_CARD_CATALOGUE)
                 .map(type => buildAgentCard(type, baseUrl))
                 .filter((card) => {
@@ -155,9 +220,12 @@ export const a2aTools = [
                     return false;
                 if (!capabilityFilter)
                     return true;
-                // Apply capability filter
-                for (const [key, value] of Object.entries(capabilityFilter)) {
-                    if (card.capabilities[key] !== value)
+                // Apply capability filter — only iterate known keys to prevent
+                // prototype-chain access via attacker-controlled property names.
+                for (const key of KNOWN_CAPABILITY_KEYS) {
+                    if (!(key in capabilityFilter))
+                        continue;
+                    if (card.capabilities[key] !== capabilityFilter[key])
                         return false;
                 }
                 return true;
@@ -203,15 +271,32 @@ export const a2aTools = [
             required: ['agentType', 'message'],
         },
         handler: async (input) => {
-            const agentType = input.agentType;
+            const agentType = validateAgentType(input.agentType);
+            if (!agentType) {
+                return { success: false, error: 'agentType is required (non-empty string, max 64 chars)' };
+            }
             const message = input.message;
-            const taskId = input.taskId || `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-            const sessionId = input.sessionId;
-            const metadata = input.metadata || {};
+            const rawTaskId = validateOptionalId(input.taskId, MAX_TASK_ID_LEN);
+            if (rawTaskId === null) {
+                return { success: false, error: `taskId must be a non-empty string up to ${MAX_TASK_ID_LEN} chars` };
+            }
+            const taskId = rawTaskId ?? `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const rawSessionId = validateOptionalId(input.sessionId, MAX_SESSION_ID_LEN);
+            if (rawSessionId === null) {
+                return { success: false, error: `sessionId must be a non-empty string up to ${MAX_SESSION_ID_LEN} chars` };
+            }
+            const sessionId = rawSessionId;
+            // Only accept plain objects for metadata to prevent prototype pollution
+            const metadata = input.metadata !== null &&
+                typeof input.metadata === 'object' &&
+                !Array.isArray(input.metadata) &&
+                Object.getPrototypeOf(input.metadata) === Object.prototype
+                ? input.metadata
+                : {};
             if (!AGENT_CARD_CATALOGUE[agentType]) {
                 return {
                     success: false,
-                    error: `Unknown agent type: "${agentType}". Run a2a_discover to see available agents.`,
+                    error: `Unknown agent type. Run a2a_discover to see available agents.`,
                 };
             }
             // Return the A2A-compliant task submission envelope

package/packages/@monomind/cli/dist/src/mcp-tools/agent-tools.js

@@ -122,8 +122,18 @@ export const agentTools = [
         },
         handler: async (input) => {
             const store = loadAgentStore();
-            const agentId = input.agentId || `agent-${Date.now()}-${randomBytes(4).toString('hex')}`;
-            const agentType = input.agentType;
+            // Cap agentId: used as the JSON object key in store.agents[agentId].
+            // An oversized key inflates the on-disk store for every spawned agent.
+            // Cap agentType/domain: persisted as AgentRecord field values.
+            const MAX_AGENT_ID_LEN = 256;
+            const MAX_AGENT_TYPE_LEN = 128;
+            const MAX_AGENT_DOMAIN_LEN = 256;
+            const rawAgentId = input.agentId || `agent-${Date.now()}-${randomBytes(4).toString('hex')}`;
+            const agentId = typeof rawAgentId === 'string' && rawAgentId.length > MAX_AGENT_ID_LEN
+                ? rawAgentId.slice(0, MAX_AGENT_ID_LEN) : rawAgentId;
+            const rawAgentType = input.agentType;
+            const agentType = typeof rawAgentType === 'string' && rawAgentType.length > MAX_AGENT_TYPE_LEN
+                ? rawAgentType.slice(0, MAX_AGENT_TYPE_LEN) : rawAgentType;
             if (['__proto__', 'constructor', 'prototype'].includes(agentId)) {
                 return { success: false, agentId, error: 'Forbidden agent ID' };
             }
@@ -141,6 +151,9 @@ export const agentTools = [
             }
             // Get task from either top-level or config (CLI passes it in config.task)
             const task = input.task || config.task || undefined;
+            const rawDomain = input.domain;
+            const domain = typeof rawDomain === 'string' && rawDomain.length > MAX_AGENT_DOMAIN_LEN
+                ? rawDomain.slice(0, MAX_AGENT_DOMAIN_LEN) : rawDomain;
             // Determine model using ADR-026 3-tier routing logic
             const routingResult = await determineAgentModel(agentType, config, task);
             const agent = {
@@ -151,7 +164,7 @@ export const agentTools = [
                 taskCount: 0,
                 config,
                 createdAt: new Date().toISOString(),
-                domain: input.domain,
+                domain,
                 model: routingResult.model,
                 modelRoutedBy: routingResult.routedBy,
             };