monomind 1.11.14 → 1.12.0

package/packages/@monomind/cli/dist/src/commands/cleanup.js

@@ -5,7 +5,7 @@
  * github.com/monoes/monomind
  */
 import { output } from '../output.js';
-import { existsSync, statSync, rmSync, readdirSync } from 'fs';
+import { existsSync, lstatSync, rmSync, readdirSync } from 'fs';
 import { join } from 'path';
 /**
  * Artifact directories and files that monomind/monomind may create
@@ -30,11 +30,27 @@ const KEEP_CONFIG_PATHS = [
     join('.claude', 'settings.json'),
 ];
 /**
- * Calculate the total size of a path (file or directory) in bytes
+ * Maximum directory recursion depth for size calculation.
+ * Prevents stack overflow on deeply-nested or circular-symlink trees.
  */
-function getSize(fullPath) {
+const MAX_SIZE_DEPTH = 20;
+/**
+ * Calculate the total size of a path (file or directory) in bytes.
+ *
+ * Uses lstatSync (not statSync) so that symlinks are never followed:
+ * a symlink counts only the size of the link itself, not its target.
+ * This prevents a crafted symlink (e.g. .claude -> /) from causing
+ * the cleanup command to recursively traverse the entire filesystem.
+ */
+function getSize(fullPath, depth = 0) {
+    if (depth > MAX_SIZE_DEPTH)
+        return 0;
     try {
-        const stat = statSync(fullPath);
+        const stat = lstatSync(fullPath);
+        if (stat.isSymbolicLink()) {
+            // Count only the symlink entry itself; never traverse the target.
+            return stat.size;
+        }
         if (stat.isFile()) {
             return stat.size;
         }
@@ -42,7 +58,11 @@ function getSize(fullPath) {
             let total = 0;
             const entries = readdirSync(fullPath, { withFileTypes: true });
             for (const entry of entries) {
-                total += getSize(join(fullPath, entry.name));
+                // Skip symlinks at the entry level too — lstatSync below will still
+                // catch them, but checking here avoids unnecessary path joins.
+                if (!entry.isSymbolicLink()) {
+                    total += getSize(join(fullPath, entry.name), depth + 1);
+                }
             }
             return total;
         }

package/packages/@monomind/cli/dist/src/commands/config.js

@@ -69,7 +69,7 @@ const getCommand = {
         { command: 'monomind config get -k memory.backend', description: 'Get memory backend' }
     ],
     action: async (ctx) => {
-        const key = ctx.flags.key || ctx.args[0];
+        const key = (ctx.flags.key || ctx.args[0] || '').slice(0, 256);
         if (!key) {
             // Show all config from actual config file (fall back to defaults)
             const config = configManager.getConfig(ctx.cwd);
@@ -102,6 +102,14 @@ const getCommand = {
             });
             return { success: true, data: flatEntries };
         }
+        // Prototype pollution guard — mirrors the same check in setCommand.
+        const FORBIDDEN_KEY_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+        for (const seg of key.split('.')) {
+            if (FORBIDDEN_KEY_SEGMENTS.has(seg)) {
+                output.printError(`Forbidden config key segment: "${seg}"`);
+                return { success: false, exitCode: 1 };
+            }
+        }
         const value = configManager.get(ctx.cwd, key);
         if (value === undefined) {
             output.printError(`Configuration key not found: ${key}`);
@@ -141,8 +149,8 @@ const setCommand = {
         { command: 'monomind config set -k memory.backend -v agentdb', description: 'Set memory backend' }
     ],
     action: async (ctx) => {
-        const key = ctx.flags.key || ctx.args[0];
-        const value = ctx.flags.value || ctx.args[1];
+        const key = (ctx.flags.key || ctx.args[0] || '').slice(0, 256);
+        const value = (ctx.flags.value ?? ctx.args[1] ?? '');
         if (!key || value === undefined) {
             output.printError('Both key and value are required');
             return { success: false, exitCode: 1 };
@@ -203,10 +211,10 @@ const providersCommand = {
             { name: 'gemini', model: 'gemini-2.0-flash', priority: 4, enabled: false, status: 'Disabled' }
         ];
         // Handle mutation flags
-        const addProvider = ctx.flags.add;
-        const removeProvider = ctx.flags.remove;
-        const enableProvider = ctx.flags.enable;
-        const disableProvider = ctx.flags.disable;
+        const addProvider = ctx.flags.add?.slice(0, 64);
+        const removeProvider = ctx.flags.remove?.slice(0, 64);
+        const enableProvider = ctx.flags.enable?.slice(0, 64);
+        const disableProvider = ctx.flags.disable?.slice(0, 64);
         if (addProvider || removeProvider || enableProvider || disableProvider) {
             // Read current providers from config
             let currentProviders = configManager.get(ctx.cwd, 'providers') || [];

package/packages/@monomind/cli/dist/src/commands/daemon.js

@@ -327,6 +327,10 @@ async function killBackgroundDaemon(projectRoot) {
         return false;
     }
     try {
+        if (fs.statSync(pidFile).size > 32) {
+            fs.unlinkSync(pidFile);
+            return false;
+        }
         const pid = parseInt(fs.readFileSync(pidFile, 'utf-8').trim(), 10);
         if (isNaN(pid)) {
             fs.unlinkSync(pidFile);
@@ -376,6 +380,8 @@ function getBackgroundDaemonPid(projectRoot) {
         return null;
     }
     try {
+        if (fs.statSync(pidFile).size > 32)
+            return null;
         const pid = parseInt(fs.readFileSync(pidFile, 'utf-8').trim(), 10);
         return isNaN(pid) ? null : pid;
     }

package/packages/@monomind/cli/dist/src/commands/deployment.js

@@ -19,11 +19,23 @@ function getStatePath(cwd) {
 function emptyState() {
     return { environments: {}, history: [], activeDeployment: undefined };
 }
+const MAX_DEPLOYMENT_STATE_BYTES = 10 * 1024 * 1024; // 10 MB
+// Input length caps to prevent DoS via unbounded strings stored to disk
+const MAX_ENV_NAME_LEN = 128;
+const MAX_VERSION_LEN = 64;
+const MAX_DESCRIPTION_LEN = 1024;
+const MAX_URL_LEN = 2048;
+const MAX_ENV_TYPE_LEN = 64;
+const MAX_HISTORY_LIMIT = 1000;
+const MAX_LOGS_LIMIT = 1000;
 function loadDeploymentState(cwd) {
     const filePath = getStatePath(cwd);
     if (!fs.existsSync(filePath)) {
         return emptyState();
     }
+    if (fs.statSync(filePath).size > MAX_DEPLOYMENT_STATE_BYTES) {
+        return emptyState();
+    }
     try {
         const raw = fs.readFileSync(filePath, 'utf-8');
         const parsed = JSON.parse(raw);
@@ -66,6 +78,9 @@ function readProjectVersion(cwd) {
     if (!fs.existsSync(pkgPath)) {
         return null;
     }
+    if (fs.statSync(pkgPath).size > 1024 * 1024) {
+        return null;
+    }
     try {
         const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
         return pkg.version ?? null;
@@ -92,10 +107,10 @@ const deployCommand = {
     ],
     action: async (ctx) => {
         try {
-            const envName = String(ctx.flags['env'] || 'staging');
+            const envName = String(ctx.flags['env'] || 'staging').slice(0, MAX_ENV_NAME_LEN);
             const dryRun = Boolean(ctx.flags['dry-run']);
-            const description = ctx.flags['description'] ? String(ctx.flags['description']) : undefined;
-            let version = ctx.flags['version'] ? String(ctx.flags['version']) : null;
+            const description = ctx.flags['description'] ? String(ctx.flags['description']).slice(0, MAX_DESCRIPTION_LEN) : undefined;
+            let version = ctx.flags['version'] ? String(ctx.flags['version']).slice(0, MAX_VERSION_LEN) : null;
             if (!version) {
                 version = readProjectVersion(ctx.cwd) || '0.0.0';
             }
@@ -181,7 +196,7 @@ const statusCommand = {
     action: async (ctx) => {
         try {
             const state = loadDeploymentState(ctx.cwd);
-            const filterEnv = ctx.flags['env'] ? String(ctx.flags['env']) : null;
+            const filterEnv = ctx.flags['env'] ? String(ctx.flags['env']).slice(0, MAX_ENV_NAME_LEN) : null;
             output.writeln();
             output.writeln(output.bold('Deployment Status'));
             output.writeln();
@@ -277,13 +292,13 @@ const rollbackCommand = {
     ],
     action: async (ctx) => {
         try {
-            const envName = String(ctx.flags['env'] || '');
+            const envName = String(ctx.flags['env'] || '').slice(0, MAX_ENV_NAME_LEN);
             if (!envName) {
                 output.printError('Environment is required', 'Use --env or -e to specify');
                 return { success: false, exitCode: 1 };
             }
-            const targetVersion = ctx.flags['version'] ? String(ctx.flags['version']) : null;
-            const steps = parseInt(ctx.flags.steps || '1', 10);
+            const targetVersion = ctx.flags['version'] ? String(ctx.flags['version']).slice(0, MAX_VERSION_LEN) : null;
+            const steps = Math.min(Math.max(parseInt(ctx.flags.steps || '1', 10), 1), 100);
             if (steps > 1) {
                 output.printWarning(`Multi-step rollback (--steps ${steps}) is not yet implemented. Rolling back 1 step only.`);
             }
@@ -370,8 +385,8 @@ const historyCommand = {
     action: async (ctx) => {
         try {
             const state = loadDeploymentState(ctx.cwd);
-            const filterEnv = ctx.flags['env'] ? String(ctx.flags['env']) : null;
-            const limit = Number(ctx.flags['limit']) || 10;
+            const filterEnv = ctx.flags['env'] ? String(ctx.flags['env']).slice(0, MAX_ENV_NAME_LEN) : null;
+            const limit = Math.min(Math.max(Number(ctx.flags['limit']) || 10, 1), MAX_HISTORY_LIMIT);
             let records = [...state.history].reverse();
             if (filterEnv) {
                 records = records.filter(r => r.environment === filterEnv);
@@ -455,7 +470,7 @@ const environmentsCommand = {
                 return { success: true };
             }
             if (action === 'add') {
-                const name = ctx.flags['name'] ? String(ctx.flags['name']) : null;
+                const name = ctx.flags['name'] ? String(ctx.flags['name']).slice(0, MAX_ENV_NAME_LEN) : null;
                 if (!name) {
                     output.printError('Environment name is required', 'Use --name or -n to specify');
                     return { success: false, exitCode: 1 };
@@ -464,8 +479,8 @@ const environmentsCommand = {
                     output.printWarning(`Environment '${name}' already exists`);
                     return { success: false, exitCode: 1 };
                 }
-                const envType = String(ctx.flags['type'] || 'local');
-                const url = ctx.flags['url'] ? String(ctx.flags['url']) : undefined;
+                const envType = String(ctx.flags['type'] || 'local').slice(0, MAX_ENV_TYPE_LEN);
+                const url = ctx.flags['url'] ? String(ctx.flags['url']).slice(0, MAX_URL_LEN) : undefined;
                 state.environments[name] = {
                     name,
                     type: envType,
@@ -481,7 +496,7 @@ const environmentsCommand = {
                 return { success: true };
             }
             if (action === 'remove') {
-                const name = ctx.flags['name'] ? String(ctx.flags['name']) : null;
+                const name = ctx.flags['name'] ? String(ctx.flags['name']).slice(0, MAX_ENV_NAME_LEN) : null;
                 if (!name) {
                     output.printError('Environment name is required', 'Use --name or -n to specify');
                     return { success: false, exitCode: 1 };
@@ -524,9 +539,9 @@ const logsCommand = {
     action: async (ctx) => {
         try {
             const state = loadDeploymentState(ctx.cwd);
-            const filterEnv = ctx.flags['env'] ? String(ctx.flags['env']) : null;
-            const deploymentId = ctx.flags['deployment'] ? String(ctx.flags['deployment']) : null;
-            const limit = Number(ctx.flags['lines']) || 50;
+            const filterEnv = ctx.flags['env'] ? String(ctx.flags['env']).slice(0, MAX_ENV_NAME_LEN) : null;
+            const deploymentId = ctx.flags['deployment'] ? String(ctx.flags['deployment']).slice(0, 64) : null;
+            const limit = Math.min(Math.max(Number(ctx.flags['lines']) || 50, 1), MAX_LOGS_LIMIT);
             output.writeln();
             output.writeln(output.bold('Deployment Logs'));
             output.writeln();
@@ -588,9 +603,9 @@ const releaseCommand = {
     ],
     action: async (ctx) => {
         try {
-            const envName = String(ctx.flags['env'] || 'production');
-            const description = ctx.flags['description'] ? String(ctx.flags['description']) : undefined;
-            let version = ctx.flags['version'] ? String(ctx.flags['version']) : null;
+            const envName = String(ctx.flags['env'] || 'production').slice(0, MAX_ENV_NAME_LEN);
+            const description = ctx.flags['description'] ? String(ctx.flags['description']).slice(0, MAX_DESCRIPTION_LEN) : undefined;
+            let version = ctx.flags['version'] ? String(ctx.flags['version']).slice(0, MAX_VERSION_LEN) : null;
             if (!version) {
                 const pkgVersion = readProjectVersion(ctx.cwd);
                 if (!pkgVersion) {

package/packages/@monomind/cli/dist/src/commands/doctor.js

@@ -7,6 +7,11 @@
 import { output } from '../output.js';
 import { existsSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';
+const MAX_DOCTOR_PKG_BYTES = 1024 * 1024; // 1 MB — package.json / settings.json
+const MAX_DOCTOR_CONFIG_BYTES = 10 * 1024 * 1024; // 10 MB — monomind.config.json / MCP configs
+const MAX_DOCTOR_GITIGNORE_BYTES = 512 * 1024; // 512 KB — .gitignore
+const MAX_DOCTOR_PID_BYTES = 64; // 64 bytes — daemon PID file
+const MAX_DOCTOR_HELPER_BYTES = 2 * 1024 * 1024; // 2 MB — hook helper .cjs bundles
 import { fileURLToPath } from 'url';
 import { execSync, exec } from 'child_process';
 import { homedir } from 'os';
@@ -67,7 +72,7 @@ async function checkConfigFile() {
         '.monomind.json'
     ];
     for (const configPath of jsonPaths) {
-        if (existsSync(configPath)) {
+        if (existsSync(configPath) && statSync(configPath).size <= MAX_DOCTOR_CONFIG_BYTES) {
             try {
                 const content = readFileSync(configPath, 'utf8');
                 JSON.parse(content);
@@ -95,7 +100,7 @@ async function checkConfigFile() {
 async function checkDaemonStatus() {
     try {
         const pidFile = '.monomind/daemon.pid';
-        if (existsSync(pidFile)) {
+        if (existsSync(pidFile) && statSync(pidFile).size <= MAX_DOCTOR_PID_BYTES) {
             const pid = readFileSync(pidFile, 'utf8').trim();
             try {
                 process.kill(parseInt(pid, 10), 0); // Check if process exists
@@ -184,7 +189,7 @@ async function checkMcpServers() {
         '.mcp.json'
     ];
     for (const configPath of mcpConfigPaths) {
-        if (existsSync(configPath)) {
+        if (existsSync(configPath) && statSync(configPath).size <= MAX_DOCTOR_CONFIG_BYTES) {
             try {
                 const content = JSON.parse(readFileSync(configPath, 'utf8'));
                 const servers = content.mcpServers || content.servers || {};
@@ -202,7 +207,7 @@ async function checkMcpServers() {
             }
         }
     }
-    return { name: 'MCP Servers', status: 'warn', message: 'No MCP config found', fix: 'claude mcp add monomind npx @monomind/cli@v1alpha mcp start' };
+    return { name: 'MCP Servers', status: 'warn', message: 'No MCP config found', fix: 'claude mcp add monomind -- npx -y monomind@latest mcp start' };
 }
 // Check disk space (async with proper env inheritance)
 async function checkDiskSpace() {
@@ -260,11 +265,11 @@ async function checkVersionFreshness() {
             for (;;) {
                 const candidate = join(dir, 'package.json');
                 try {
-                    if (existsSync(candidate)) {
+                    if (existsSync(candidate) && statSync(candidate).size <= MAX_DOCTOR_PKG_BYTES) {
                         const pkg = JSON.parse(readFileSync(candidate, 'utf8'));
                         if (pkg.version &&
                             typeof pkg.name === 'string' &&
-                            (pkg.name === '@monomind/cli' || pkg.name === 'monomind')) {
+                            (pkg.name === '@monomind/cli' || pkg.name === 'monomind' || pkg.name === '@monoes/monomindcli')) {
                             currentVersion = pkg.version;
                             break;
                         }
@@ -287,10 +292,10 @@ async function checkVersionFreshness() {
         const isNpx = process.argv[1]?.includes('_npx') ||
             process.env.npm_execpath?.includes('npx') ||
             process.cwd().includes('_npx');
-        // Query npm for latest version (using alpha tag since that's what we publish to)
+        // Query npm for latest version of the published umbrella package
         let latestVersion = currentVersion;
         try {
-            const npmInfo = await runCommand('npm view @monomind/cli@alpha version', 5000);
+            const npmInfo = await runCommand('npm view monomind version', 5000);
             latestVersion = npmInfo.trim();
         }
         catch {
@@ -322,8 +327,8 @@ async function checkVersionFreshness() {
             (latest.major === current.major && latest.minor === current.minor && latest.patch === current.patch && latest.prerelease > current.prerelease));
         if (isOutdated) {
             const fix = isNpx
-                ? 'rm -rf ~/.npm/_npx/* && npx -y @monomind/cli@latest'
-                : 'npm update @monomind/cli';
+                ? 'rm -rf ~/.npm/_npx/* && npx -y monomind@latest doctor'
+                : 'npm update -g monomind';
             return {
                 name: 'Version Freshness',
                 status: 'warn',
@@ -387,18 +392,39 @@ async function installClaudeCode() {
 async function checkMonograph() {
     try {
         const __filename = fileURLToPath(import.meta.url);
+        const _base = dirname(__filename);
+        let _globalRoot = '';
+        try {
+            _globalRoot = execSync('npm root -g', { encoding: 'utf8', timeout: 3000 }).trim();
+        }
+        catch { /* no npm */ }
         const candidates = [
-            join(dirname(__filename), '..', '..', 'node_modules', '@monomind', 'monograph', 'package.json'),
-            join(dirname(__filename), '..', '..', '..', '..', 'node_modules', '@monomind', 'monograph', 'package.json'),
+            // local dev monorepo paths (both old @monomind and published @monoes scope)
+            join(_base, '..', '..', 'node_modules', '@monomind', 'monograph', 'package.json'),
+            join(_base, '..', '..', '..', '..', 'node_modules', '@monomind', 'monograph', 'package.json'),
+            join(_base, '..', '..', 'node_modules', '@monoes', 'monograph', 'package.json'),
+            join(_base, '..', '..', '..', '..', 'node_modules', '@monoes', 'monograph', 'package.json'),
+            // global install paths
+            ...(_globalRoot ? [
+                join(_globalRoot, '@monomind', 'monograph', 'package.json'),
+                join(_globalRoot, '@monoes', 'monograph', 'package.json'),
+            ] : []),
         ];
-        if (candidates.some(p => existsSync(p))) {
-            return { name: 'Monograph', status: 'pass', message: 'available (knowledge graph engine)' };
+        const found = candidates.find(p => existsSync(p) && statSync(p).size <= MAX_DOCTOR_PKG_BYTES);
+        if (found) {
+            try {
+                const pkg = JSON.parse(readFileSync(found, 'utf-8'));
+                return { name: 'Monograph', status: 'pass', message: `v${pkg.version || '?'} available (knowledge graph engine)` };
+            }
+            catch {
+                return { name: 'Monograph', status: 'pass', message: 'available (knowledge graph engine)' };
+            }
         }
         return {
             name: 'Monograph',
             status: 'warn',
             message: 'Package not found (knowledge graph disabled)',
-            fix: 'npm install in project root'
+            fix: 'npm install -g monomind@latest  # reinstall to get @monoes/monograph'
         };
     }
     catch {
@@ -406,10 +432,46 @@ async function checkMonograph() {
             name: 'Monograph',
             status: 'warn',
             message: 'Package check failed (knowledge graph may be unavailable)',
-            fix: 'npm install in project root'
+            fix: 'npm install -g monomind@latest'
         };
     }
 }
+// Check @monoes/memory (optional HNSW vector search package)
+async function checkMonoesMemory() {
+    try {
+        const __filename = fileURLToPath(import.meta.url);
+        const _base = dirname(__filename);
+        let _globalRoot = '';
+        try {
+            _globalRoot = execSync('npm root -g', { encoding: 'utf8', timeout: 3000 }).trim();
+        }
+        catch { /* no npm */ }
+        const candidates = [
+            join(_base, '..', '..', 'node_modules', '@monoes', 'memory', 'package.json'),
+            join(_base, '..', '..', '..', '..', 'node_modules', '@monoes', 'memory', 'package.json'),
+            ...(_globalRoot ? [join(_globalRoot, '@monoes', 'memory', 'package.json')] : []),
+        ];
+        const found = candidates.find(p => existsSync(p) && statSync(p).size <= MAX_DOCTOR_PKG_BYTES);
+        if (found) {
+            try {
+                const pkg = JSON.parse(readFileSync(found, 'utf-8'));
+                return { name: 'Vector Memory', status: 'pass', message: `@monoes/memory v${pkg.version || '?'} (HNSW search enabled)` };
+            }
+            catch {
+                return { name: 'Vector Memory', status: 'pass', message: '@monoes/memory available (HNSW search enabled)' };
+            }
+        }
+        return {
+            name: 'Vector Memory',
+            status: 'warn',
+            message: '@monoes/memory not installed (vector search disabled — using fallback)',
+            fix: 'npm install @monoes/memory'
+        };
+    }
+    catch {
+        return { name: 'Vector Memory', status: 'warn', message: 'Vector memory check failed' };
+    }
+}
 // Check agentic-flow v1 integration (filesystem-based to avoid slow WASM/DB init)
 // Resolve the path to the bundled (npm-installed) copy of a helper file.
 // Walks up from this module's location to find the package root, then joins
@@ -420,10 +482,10 @@ function _resolveBundledHelper(relativePath) {
         let dir = dirname(thisFile);
         for (;;) {
             const candidate = join(dir, 'package.json');
-            if (existsSync(candidate)) {
+            if (existsSync(candidate) && statSync(candidate).size <= MAX_DOCTOR_PKG_BYTES) {
                 try {
                     const pkg = JSON.parse(readFileSync(candidate, 'utf8'));
-                    if (pkg.name === '@monomind/cli' || pkg.name === 'monomind') {
+                    if (pkg.name === '@monomind/cli' || pkg.name === 'monomind' || pkg.name === '@monoes/monomindcli') {
                         const helperPath = join(dir, relativePath);
                         return existsSync(helperPath) ? helperPath : null;
                     }
@@ -451,11 +513,15 @@ async function _detectStaleHelpers() {
         const local = join(process.cwd(), '.claude', 'helpers', name);
         if (!existsSync(local))
             continue;
+        if (statSync(local).size > MAX_DOCTOR_HELPER_BYTES)
+            continue; // skip oversized helper
         const bundled = _resolveBundledHelper(join('.claude', 'helpers', name));
         if (!bundled) {
             missing.push(name);
             continue;
         }
+        if (statSync(bundled).size > MAX_DOCTOR_HELPER_BYTES)
+            continue; // skip oversized bundled
         try {
             const hashLocal = crypto.createHash('sha256').update(readFileSync(local)).digest('hex');
             const hashBundled = crypto.createHash('sha256').update(readFileSync(bundled)).digest('hex');
@@ -513,6 +579,9 @@ async function checkAgenticFlow() {
                 fix: 'npm install agentic-flow@latest'
             };
         }
+        if (statSync(pkgJsonPath).size > MAX_DOCTOR_PKG_BYTES) {
+            return { name: 'agentic-flow', status: 'warn', message: 'package.json too large to parse' };
+        }
         const pkg = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'));
         const version = pkg.version || 'unknown';
         const exports = pkg.exports || {};
@@ -524,7 +593,7 @@ async function checkAgenticFlow() {
         return {
             name: 'agentic-flow',
             status: 'pass',
-            message: `v${version} (${features.join(', ')})`
+            message: `v${version}${features.length ? ' (' + features.join(', ') + ')' : ' (installed)'}`
         };
     }
     catch {
@@ -609,6 +678,9 @@ async function checkGitignoreCoverage() {
             fix: 'echo ".monomind/\\n**/.monomind/" >> .gitignore',
         };
     }
+    if (statSync(gitignorePath).size > MAX_DOCTOR_GITIGNORE_BYTES) {
+        return { name: 'Gitignore Coverage', status: 'warn', message: '.gitignore too large to parse' };
+    }
     const content = readFileSync(gitignorePath, 'utf-8');
     const lines = content.split('\n').map(l => l.trim()).filter(l => l && !l.startsWith('#'));
     const missing = REQUIRED_GITIGNORE_PATTERNS.filter(({ pattern }) => {
@@ -651,6 +723,9 @@ async function checkGuidanceGates() {
         };
     }
     try {
+        if (statSync(settingsPath).size > MAX_DOCTOR_CONFIG_BYTES) {
+            return { name: 'Guidance Gates', status: 'warn', message: 'settings.json too large to parse' };
+        }
         const settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));
         const preToolUse = settings?.hooks?.PreToolUse ?? [];
         const hasPreWrite = preToolUse.some(e => e.matcher === 'Write|Edit|MultiEdit' && e.hooks.some(h => h.command?.includes('pre-write')));
@@ -723,7 +798,7 @@ export const doctorCommand = {
         {
             name: 'component',
             short: 'c',
-            description: 'Check specific component (version, node, npm, config, daemon, memory, api, git, mcp, claude, disk, typescript, monograph, helpers, monoes, gates, gitignore)',
+            description: 'Check specific component (version, node, npm, config, daemon, memory, api, git, mcp, claude, disk, typescript, monograph, memory-pkg, helpers, agentic-flow, monoes, gates, gitignore)',
             type: 'string'
         },
         {
@@ -766,6 +841,7 @@ export const doctorCommand = {
             checkDiskSpace,
             checkBuildTools,
             checkMonograph,
+            checkMonoesMemory,
             checkHelpersFresh,
             checkAgenticFlow,
             checkMonoesIntegration,
@@ -787,6 +863,7 @@ export const doctorCommand = {
             'disk': checkDiskSpace,
             'typescript': checkBuildTools,
             'monograph': checkMonograph,
+            'memory-pkg': checkMonoesMemory,
             'helpers': checkHelpersFresh,
             'agentic-flow': checkAgenticFlow,
             'monoes': checkMonoesIntegration,

package/packages/@monomind/cli/dist/src/commands/guidance.js

@@ -461,6 +461,19 @@ const abTestCommand = {
                     output.writeln(output.error(`Tasks file not found: ${tasksPath}`));
                     return { success: false, message: `File not found: ${tasksPath}` };
                 }
+                // Size guard: a multi-MB tasks file would be buffered in full before
+                // JSON.parse runs. Cap at 10 MB — any legitimate task list is far smaller.
+                const { statSync, lstatSync } = await import('node:fs');
+                const tasksLstat = lstatSync(tasksPath);
+                if (tasksLstat.isSymbolicLink()) {
+                    output.writeln(output.error(`Symlinks are not allowed as task files: ${tasksPath}`));
+                    return { success: false, message: 'Symlink not allowed as tasks file' };
+                }
+                const MAX_TASKS_FILE_BYTES = 10 * 1024 * 1024; // 10 MB
+                if (tasksLstat.size > MAX_TASKS_FILE_BYTES) {
+                    output.writeln(output.error(`Tasks file too large (max 10 MB): ${tasksPath}`));
+                    return { success: false, message: 'Tasks file too large' };
+                }
                 const tasksJson = await readFile(tasksPath, 'utf-8');
                 customTasks = JSON.parse(tasksJson);
                 output.writeln(`  Custom tasks: ${output.bold(String(customTasks.length))} loaded from ${tasksPath}`);
@@ -542,7 +555,7 @@ const setupCommand = {
         output.writeln(output.bold('Guidance Gates Setup'));
         output.writeln(output.dim('─'.repeat(50)));
         output.writeln();
-        const { readFileSync, writeFileSync, existsSync } = await import('node:fs');
+        const { readFileSync, writeFileSync, existsSync, statSync } = await import('node:fs');
         const { join } = await import('node:path');
         const settingsPath = join(projectDir, '.claude', 'settings.json');
         const gatesHandlerPath = join(projectDir, '.claude', 'helpers', 'handlers', 'gates-handler.cjs');
@@ -553,7 +566,7 @@ const setupCommand = {
         }
         // Load or create settings.json
         let settings = {};
-        if (existsSync(settingsPath)) {
+        if (existsSync(settingsPath) && statSync(settingsPath).size <= 1024 * 1024) {
             try {
                 settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));
             }