monomind 1.11.14 → 1.13.0

package/packages/@monomind/cli/dist/src/commands/monovector/benchmark.js

@@ -151,13 +151,26 @@ export const benchmarkCommand = {
     ],
     action: async (ctx) => {
         const config = getConnectionConfig(ctx);
-        const numVectors = parseInt(ctx.flags.vectors || '10000', 10);
-        const dimensions = parseInt(ctx.flags.dimensions || '1536', 10);
-        const numQueries = parseInt(ctx.flags.queries || '100', 10);
-        const topK = parseInt(ctx.flags.k || '10', 10);
-        const metric = ctx.flags.metric || 'cosine';
-        const indexType = ctx.flags.index || 'hnsw';
-        const batchSize = parseInt(ctx.flags['batch-size'] || '1000', 10);
+        // Clamp numeric inputs to safe ranges to prevent DoS via OOM
+        const numVectors = Math.min(Math.max(1, parseInt(ctx.flags.vectors || '10000', 10)), 1_000_000);
+        const dimensions = Math.min(Math.max(1, parseInt(ctx.flags.dimensions || '1536', 10)), 65536);
+        const numQueries = Math.min(Math.max(1, parseInt(ctx.flags.queries || '100', 10)), 10_000);
+        const topK = Math.min(Math.max(1, parseInt(ctx.flags.k || '10', 10)), 10_000);
+        // Validate metric and indexType against allowlists to prevent SQL injection
+        const VALID_METRICS = ['cosine', 'l2', 'inner'];
+        const VALID_INDEX_TYPES = ['hnsw', 'ivfflat', 'none'];
+        const rawMetric = ctx.flags.metric || 'cosine';
+        const rawIndexType = ctx.flags.index || 'hnsw';
+        const metric = VALID_METRICS.includes(rawMetric) ? rawMetric : 'cosine';
+        const indexType = VALID_INDEX_TYPES.includes(rawIndexType) ? rawIndexType : 'hnsw';
+        const batchSize = Math.min(Math.max(1, parseInt(ctx.flags['batch-size'] || '1000', 10)), 100_000);
+        // Validate schema identifier against safe pattern to prevent SQL injection
+        const rawSchema = config.schema || 'monomind';
+        if (!/^[a-zA-Z_][a-zA-Z0-9_]{0,62}$/.test(rawSchema)) {
+            output.printError('Invalid schema name. Only alphanumeric characters and underscores are allowed.');
+            return { success: false, exitCode: 1 };
+        }
+        config.schema = rawSchema;
         const cleanup = ctx.flags.cleanup !== false;
         output.writeln();
         output.writeln(output.bold('MonoVector Performance Benchmark'));

package/packages/@monomind/cli/dist/src/commands/monovector/import.js

@@ -184,6 +184,21 @@ export const importCommand = {
                 output.printError(`Input file not found: ${inputFile}`);
                 return { success: false, message: 'File not found' };
             }
+            // Symlink guard: a symlink could redirect to /etc/passwd or a huge file.
+            // lstatSync checks the link itself, not the target — so symlinks are rejected
+            // regardless of what they point to (TOCTOU-safe for the check + read pair).
+            const lstat = fs.lstatSync(inputFile);
+            if (lstat.isSymbolicLink()) {
+                output.printError(`Symlinks are not allowed as input files: ${inputFile}`);
+                return { success: false, message: 'Symlink not allowed' };
+            }
+            // Size guard: without this, a user can pass a multi-GB file and exhaust the
+            // Node heap before JSON.parse ever runs, crashing the CLI with an OOM.
+            const MAX_IMPORT_FILE_BYTES = 50 * 1024 * 1024; // 50 MB
+            if (lstat.size > MAX_IMPORT_FILE_BYTES) {
+                output.printError(`Input file too large: ${inputFile} (max 50 MB)`);
+                return { success: false, message: 'Input file too large' };
+            }
             try {
                 output.printInfo(`Reading: ${inputFile}`);
                 const content = fs.readFileSync(inputFile, 'utf-8');

package/packages/@monomind/cli/dist/src/commands/monovector/migrate.js

@@ -130,10 +130,13 @@ const MIGRATIONS = [
     `,
     },
 ];
+const IDENTIFIER_RE = /^[a-zA-Z_][a-zA-Z0-9_]{0,63}$/;
 /**
  * Get PostgreSQL connection config from context
  */
 function getConnectionConfig(ctx) {
+    const rawSchema = ctx.flags.schema || 'monomind';
+    const schema = IDENTIFIER_RE.test(rawSchema) ? rawSchema : 'monomind';
     return {
         host: ctx.flags.host || process.env.PGHOST || 'localhost',
         port: parseInt(ctx.flags.port || process.env.PGPORT || '5432', 10),
@@ -141,7 +144,7 @@ function getConnectionConfig(ctx) {
         user: ctx.flags.user || process.env.PGUSER || 'postgres',
         password: ctx.flags.password || process.env.PGPASSWORD || '',
         ssl: ctx.flags.ssl || process.env.PGSSLMODE === 'require',
-        schema: ctx.flags.schema || 'monomind',
+        schema,
     };
 }
 /**

package/packages/@monomind/cli/dist/src/commands/monovector/optimize.js

@@ -121,6 +121,17 @@ export const optimizeCommand = {
             output.printError('Database name is required. Use --database or -d flag, or set PGDATABASE env.');
             return { success: false, exitCode: 1 };
         }
+        // Validate schema identifier to prevent SQL injection
+        const IDENT_RE = /^[a-zA-Z_][a-zA-Z0-9_]{0,62}$/;
+        if (!IDENT_RE.test(config.schema)) {
+            output.printError('Invalid schema name. Only alphanumeric characters and underscores are allowed.');
+            return { success: false, exitCode: 1 };
+        }
+        // Validate --index flag if provided
+        if (specificIndex !== undefined && !IDENT_RE.test(specificIndex)) {
+            output.printError('Invalid index name. Only alphanumeric characters and underscores are allowed.');
+            return { success: false, exitCode: 1 };
+        }
         const spinner = output.createSpinner({ text: 'Connecting to PostgreSQL...', spinner: 'dots' });
         spinner.start();
         const recommendations = [];

package/packages/@monomind/cli/dist/src/commands/monovector/setup.js

@@ -685,13 +685,23 @@ export const setupCommand = {
         { command: 'monomind monovector setup --force', description: 'Overwrite existing files' },
     ],
     action: async (ctx) => {
-        const outputDir = ctx.flags.output || './monovector-postgres';
+        const rawOutputDir = ctx.flags.output || './monovector-postgres';
         const printOnly = ctx.flags.print;
         const force = ctx.flags.force;
         output.writeln();
         output.writeln(output.bold('MonoVector PostgreSQL Setup'));
         output.writeln(output.dim('='.repeat(50)));
         output.writeln();
+        // Guard against path traversal: resolve to absolute and ensure it stays within
+        // the current working directory or the user's home directory.
+        const resolvedOutput = path.resolve(rawOutputDir);
+        const safeBases = [process.cwd(), process.env.HOME || process.env.USERPROFILE || ''].filter(Boolean);
+        const withinSafeBase = safeBases.some(base => resolvedOutput.startsWith(base + path.sep) || resolvedOutput === base);
+        if (!withinSafeBase) {
+            output.printError(`Output path must be within the current directory or home directory: ${resolvedOutput}`);
+            return { success: false, exitCode: 1 };
+        }
+        const outputDir = resolvedOutput;
         if (printOnly) {
             // Print to stdout
             output.writeln(output.bold('=== docker-compose.yml ==='));

package/packages/@monomind/cli/dist/src/commands/neural.js

@@ -940,7 +940,7 @@ const importCommand = {
             }
             const patternsFile = path.join(memoryDir, 'patterns.json');
             let existingPatterns = [];
-            if (merge && fs.existsSync(patternsFile)) {
+            if (merge && fs.existsSync(patternsFile) && fs.statSync(patternsFile).size <= 50 * 1024 * 1024) {
                 existingPatterns = JSON.parse(fs.readFileSync(patternsFile, 'utf8'));
             }
             // Merge or replace

package/packages/@monomind/cli/dist/src/commands/performance.js

@@ -20,14 +20,18 @@ const benchmarkCommand = {
         { command: 'monomind performance benchmark -i 1000', description: 'Run with 1000 iterations' },
     ],
     action: async (ctx) => {
-        const suite = ctx.flags.suite || 'all';
+        const suiteRaw = ctx.flags.suite || 'all';
+        const VALID_SUITES = new Set(['all', 'wasm', 'neural', 'memory', 'search']);
+        const suite = VALID_SUITES.has(suiteRaw) ? suiteRaw : 'all';
         const MAX_ITERATIONS = 10_000;
         const MAX_WARMUP = 500;
         const iterationsRaw = parseInt(ctx.flags.iterations || '100', 10);
         const warmupRaw = parseInt(ctx.flags.warmup || '10', 10);
         const iterations = Number.isFinite(iterationsRaw) ? Math.min(Math.max(1, iterationsRaw), MAX_ITERATIONS) : 100;
         const warmup = Number.isFinite(warmupRaw) ? Math.min(Math.max(0, warmupRaw), MAX_WARMUP) : 10;
-        const outputFormat = ctx.flags.output || 'text';
+        const outputFormatRaw = ctx.flags.output || 'text';
+        const VALID_OUTPUT_FORMATS = new Set(['text', 'json', 'csv']);
+        const outputFormat = VALID_OUTPUT_FORMATS.has(outputFormatRaw) ? outputFormatRaw : 'text';
         output.writeln();
         output.writeln(output.bold('Performance Benchmark (Real Measurements)'));
         output.writeln(output.dim('─'.repeat(60)));
@@ -235,8 +239,11 @@ const profileCommand = {
         { command: 'monomind performance profile -d 60', description: 'Profile for 60 seconds' },
     ],
     action: async (ctx) => {
-        const type = ctx.flags.type || 'all';
-        const duration = parseInt(ctx.flags.duration || '30', 10);
+        const typeRaw = ctx.flags.type || 'all';
+        const VALID_PROFILE_TYPES = new Set(['cpu', 'memory', 'io', 'all']);
+        const type = VALID_PROFILE_TYPES.has(typeRaw) ? typeRaw : 'all';
+        const durationRaw = parseInt(ctx.flags.duration || '30', 10);
+        const duration = Number.isFinite(durationRaw) ? Math.min(Math.max(1, durationRaw), 300) : 30;
         output.writeln();
         output.writeln(output.bold('Performance Profiler'));
         output.writeln(output.dim('─'.repeat(50)));
@@ -308,8 +315,12 @@ const metricsCommand = {
         { command: 'monomind performance metrics -f prometheus', description: 'Export as Prometheus format' },
     ],
     action: async (ctx) => {
-        const timeframe = ctx.flags.timeframe || '24h';
-        const format = ctx.flags.format || 'text';
+        const timeframeRaw = ctx.flags.timeframe || '24h';
+        const VALID_TIMEFRAMES = new Set(['1h', '24h', '7d', '30d']);
+        const timeframe = VALID_TIMEFRAMES.has(timeframeRaw) ? timeframeRaw : '24h';
+        const formatRaw = ctx.flags.format || 'text';
+        const VALID_FORMATS = new Set(['text', 'json', 'prometheus']);
+        const format = VALID_FORMATS.has(formatRaw) ? formatRaw : 'text';
         output.writeln();
         output.writeln(output.bold(`Performance Metrics (${timeframe})`));
         output.writeln(output.dim('─'.repeat(50)));
@@ -491,7 +502,9 @@ const optimizeCommand = {
         { command: 'monomind performance optimize --apply', description: 'Apply all optimizations' },
     ],
     action: async (ctx) => {
-        const target = ctx.flags.target || 'all';
+        const targetRaw = ctx.flags.target || 'all';
+        const VALID_TARGETS = new Set(['memory', 'cpu', 'latency', 'all']);
+        const target = VALID_TARGETS.has(targetRaw) ? targetRaw : 'all';
         if (ctx.flags.apply) {
             output.printWarning('Optimization application is not yet implemented. Showing recommendations only.');
         }

package/packages/@monomind/cli/dist/src/commands/platforms.js

@@ -4,8 +4,8 @@
  *
  * github.com/monoes/monomind
  */
-import { existsSync, writeFileSync, mkdirSync, readFileSync } from 'fs';
-import { join, dirname } from 'path';
+import { existsSync, writeFileSync, mkdirSync, readFileSync, statSync } from 'fs';
+import { join, dirname, resolve } from 'path';
 import { output } from '../output.js';
 export const SUPPORTED_PLATFORMS = [
     'claude', 'gemini', 'cursor', 'vscode', 'copilot',
@@ -43,15 +43,63 @@ Graph is at \`.monomind/monograph.db\`. Rebuild with: \`npx monograph build\`
 ${MONOMIND_BLOCK_END}
 `;
 }
+/**
+ * Maximum size for a platform config file we will read or append to.
+ * Platform config files (CLAUDE.md, .cursorrules, etc.) are never legitimately
+ * larger than a few hundred KB — a 1 MB cap prevents OOM when the flag points
+ * at an enormous file such as a binary or a DB dump.
+ */
+const MAX_CONFIG_FILE_BYTES = 1 * 1024 * 1024; // 1 MB
+/**
+ * Resolve and validate the user-supplied --path flag.
+ *
+ * SECURITY: the flag is attacker-controlled. Without validation an adversary can
+ *   pass --path /etc to overwrite system files, or --path "../../.." to escape
+ *   the project. We resolve to an absolute path and reject anything that isn't
+ *   a directory (or doesn't exist yet under a parent that does exist).
+ *   We do NOT further restrict the path to cwd because a legitimate use case is
+ *   "install into another repo at an absolute path", but we do require the
+ *   resolved path to be a directory (or the parent to exist) so that the caller
+ *   cannot aim the flag at a file.
+ */
+function resolveRepoPath(rawPath) {
+    // Prevent shell-injection via null bytes or unusual separators
+    if (rawPath.includes('\0'))
+        throw new Error('Invalid path: contains null byte');
+    const resolved = resolve(rawPath);
+    // If the path exists it must be a directory
+    if (existsSync(resolved)) {
+        const st = statSync(resolved);
+        if (!st.isDirectory())
+            throw new Error(`--path must be a directory, got a file: ${resolved}`);
+    }
+    return resolved;
+}
+/**
+ * Validate that fullPath is contained within repoRoot (path traversal defence).
+ * relPath comes from our own PLATFORM_CONFIG_FILES map, but we validate anyway
+ * to guard against future changes that introduce dynamic paths.
+ */
+function assertWithinRoot(fullPath, repoRoot) {
+    if (!fullPath.startsWith(repoRoot + '/') && fullPath !== repoRoot) {
+        throw new Error(`Path escapes repository root: ${fullPath}`);
+    }
+}
 function installPlatform(platform, repoPath) {
     const files = PLATFORM_CONFIG_FILES[platform];
     const instructions = getMonomindInstructions();
     const written = [];
     for (const relPath of files) {
-        const fullPath = join(repoPath, relPath);
+        const fullPath = resolve(join(repoPath, relPath));
+        assertWithinRoot(fullPath, repoPath);
         const dir = dirname(fullPath);
         mkdirSync(dir, { recursive: true });
         if (existsSync(fullPath)) {
+            // Guard against reading oversized files (e.g. the flag points at a data file)
+            const fileStat = statSync(fullPath);
+            if (fileStat.size > MAX_CONFIG_FILE_BYTES) {
+                throw new Error(`Config file too large to read (${fileStat.size} bytes): ${relPath}`);
+            }
             const existing = readFileSync(fullPath, 'utf8');
             if (existing.includes(MONOMIND_BLOCK_START))
                 continue;
@@ -69,9 +117,15 @@ function uninstallPlatform(platform, repoPath) {
     const blockRe = new RegExp(`\\n?${MONOMIND_BLOCK_START}[\\s\\S]*?${MONOMIND_BLOCK_END}\\n?`, 'g');
     const cleaned = [];
     for (const relPath of files) {
-        const fullPath = join(repoPath, relPath);
+        const fullPath = resolve(join(repoPath, relPath));
+        assertWithinRoot(fullPath, repoPath);
         if (!existsSync(fullPath))
             continue;
+        // Guard against reading oversized files
+        const fileStat = statSync(fullPath);
+        if (fileStat.size > MAX_CONFIG_FILE_BYTES) {
+            throw new Error(`Config file too large to read (${fileStat.size} bytes): ${relPath}`);
+        }
         const content = readFileSync(fullPath, 'utf8');
         writeFileSync(fullPath, content.replace(blockRe, ''), 'utf8');
         cleaned.push(relPath);
@@ -81,7 +135,14 @@ function uninstallPlatform(platform, repoPath) {
 async function handleInstall(ctx) {
     const platform = ctx.flags['platform'];
     const all = ctx.flags['all'];
-    const repoPath = ctx.flags['path'] ?? '.';
+    let repoPath;
+    try {
+        repoPath = resolveRepoPath(ctx.flags['path'] ?? '.');
+    }
+    catch (err) {
+        output.error(`Invalid --path: ${err instanceof Error ? err.message : String(err)}`);
+        return { success: false, exitCode: 1 };
+    }
     if (!platform && !all) {
         output.error('Specify --platform <name> or --all');
         output.info(`Supported platforms: ${SUPPORTED_PLATFORMS.join(', ')}`);
@@ -98,7 +159,14 @@ async function handleInstall(ctx) {
     }
     let totalFiles = 0;
     for (const p of targets) {
-        const written = installPlatform(p, repoPath);
+        let written;
+        try {
+            written = installPlatform(p, repoPath);
+        }
+        catch (err) {
+            output.error(`[${p}] Install failed: ${err instanceof Error ? err.message : String(err)}`);
+            continue;
+        }
         if (written.length > 0) {
             output.success(`[${p}] Installed Monograph context → ${written.join(', ')}`);
             totalFiles += written.length;
@@ -113,7 +181,14 @@ async function handleInstall(ctx) {
 async function handleUninstall(ctx) {
     const platform = ctx.flags['platform'];
     const all = ctx.flags['all'];
-    const repoPath = ctx.flags['path'] ?? '.';
+    let repoPath;
+    try {
+        repoPath = resolveRepoPath(ctx.flags['path'] ?? '.');
+    }
+    catch (err) {
+        output.error(`Invalid --path: ${err instanceof Error ? err.message : String(err)}`);
+        return { success: false, exitCode: 1 };
+    }
     if (!platform && !all) {
         output.error('Specify --platform <name> or --all');
         output.info(`Supported platforms: ${SUPPORTED_PLATFORMS.join(', ')}`);
@@ -130,7 +205,14 @@ async function handleUninstall(ctx) {
     }
     let totalFiles = 0;
     for (const p of targets) {
-        const cleaned = uninstallPlatform(p, repoPath);
+        let cleaned;
+        try {
+            cleaned = uninstallPlatform(p, repoPath);
+        }
+        catch (err) {
+            output.error(`[${p}] Uninstall failed: ${err instanceof Error ? err.message : String(err)}`);
+            continue;
+        }
         if (cleaned.length > 0) {
             output.success(`[${p}] Removed Monograph context from ${cleaned.join(', ')}`);
             totalFiles += cleaned.length;

package/packages/@monomind/cli/dist/src/commands/plugins.js

@@ -187,14 +187,16 @@ const installCommand = {
         { command: 'monomind plugins install -n ./my-plugin --dev', description: 'Install local plugin' },
     ],
     action: async (ctx) => {
-        const name = ctx.flags.name;
+        const rawName = ctx.flags.name;
         const version = ctx.flags.version || 'latest';
         const registryName = ctx.flags.registry;
         const verify = ctx.flags.verify !== false;
-        if (!name) {
+        if (!rawName) {
             output.printError('Plugin name is required');
             return { success: false, exitCode: 1 };
         }
+        // Cap plugin name and version to prevent DoS/injection
+        const name = typeof rawName === 'string' ? rawName.slice(0, 214) : '';
         // Check if it's a local path
         const isLocalPath = name.startsWith('./') || name.startsWith('/') || name.startsWith('../');
         output.writeln();
@@ -620,16 +622,21 @@ const searchCommand = {
         { command: 'monomind plugins search -q security --verified', description: 'Search verified security plugins' },
     ],
     action: async (ctx) => {
-        const query = ctx.flags.query;
+        const rawQuery = ctx.flags.query;
         const category = ctx.flags.category;
         const type = ctx.flags.type;
         const verified = ctx.flags.verified;
-        const limit = ctx.flags.limit || 20;
+        const rawLimit = ctx.flags.limit;
         const registryName = ctx.flags.registry;
-        if (!query) {
+        if (!rawQuery) {
             output.printError('Search query is required');
             return { success: false, exitCode: 1 };
         }
+        // Cap query length and limit to prevent DoS
+        const query = typeof rawQuery === 'string' ? rawQuery.slice(0, 200) : '';
+        const limit = typeof rawLimit === 'number' && Number.isFinite(rawLimit)
+            ? Math.max(1, Math.min(Math.floor(rawLimit), 100))
+            : 20;
         const spinner = output.createSpinner({ text: 'Searching plugin registry...', spinner: 'dots' });
         spinner.start();
         try {

package/packages/@monomind/cli/dist/src/commands/process.js

@@ -2,7 +2,7 @@
  * CLI Process Management Command
  * Background process management, daemon mode, and monitoring
  */
-import { writeFileSync, readFileSync, unlinkSync, existsSync, mkdirSync } from 'node:fs';
+import { writeFileSync, readFileSync, statSync, unlinkSync, existsSync, mkdirSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 // Helper functions for PID file management
 function writePidFile(pidFile, pid, port) {
@@ -35,13 +35,22 @@ function writePidFile(pidFile, pid, port) {
         }
     }
 }
+const MAX_PID_FILE_BYTES = 4 * 1024; // 4 KB — a PID file should never be this large
 function readPidFile(pidFile) {
     try {
         const path = resolve(pidFile);
         if (!existsSync(path))
             return null;
+        // Guard against oversized PID files before reading into memory
+        if (statSync(path).size > MAX_PID_FILE_BYTES)
+            return null;
         const data = readFileSync(path, 'utf-8');
-        return JSON.parse(data);
+        return JSON.parse(data, (key, value) => {
+            // Prototype pollution guard
+            if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+                return undefined;
+            return value;
+        });
     }
     catch {
         return null;
@@ -270,9 +279,10 @@ const monitorCommand = {
         // Try to read agent and task counts from local store files
         let agentCount = 0;
         const taskCounts = { running: 0, queued: 0, completed: 0, failed: 0 };
+        const MAX_PROCESS_STORE_BYTES = 50 * 1024 * 1024; // 50 MB
         try {
             const agentStorePath = resolve('.monomind/agents/store.json');
-            if (existsSync(agentStorePath)) {
+            if (existsSync(agentStorePath) && statSync(agentStorePath).size <= MAX_PROCESS_STORE_BYTES) {
                 const agentStore = JSON.parse(readFileSync(agentStorePath, 'utf-8'));
                 const agents = Array.isArray(agentStore) ? agentStore : Object.values(agentStore.agents || agentStore || {});
                 agentCount = agents.length;
@@ -281,7 +291,7 @@ const monitorCommand = {
         catch { /* no agent store */ }
         try {
             const taskStorePath = resolve('.monomind/tasks/store.json');
-            if (existsSync(taskStorePath)) {
+            if (existsSync(taskStorePath) && statSync(taskStorePath).size <= MAX_PROCESS_STORE_BYTES) {
                 const taskStore = JSON.parse(readFileSync(taskStorePath, 'utf-8'));
                 const tasks = Array.isArray(taskStore) ? taskStore : Object.values(taskStore.tasks || taskStore || {});
                 for (const t of tasks) {
@@ -607,12 +617,22 @@ const logsCommand = {
         { command: 'monomind process logs --since 1h --grep "error"', description: 'Search logs' },
     ],
     action: async (ctx) => {
-        const source = ctx.flags?.source || 'all';
-        const tail = ctx.flags?.tail || 50;
+        const VALID_SOURCES = new Set(['daemon', 'workers', 'tasks', 'all']);
+        const VALID_LEVELS = new Set(['debug', 'info', 'warn', 'error']);
+        const MAX_TAIL = 10_000; // cap to prevent huge in-memory slice
+        const MAX_GREP_LEN = 256; // cap regex/pattern length
+        const MAX_SINCE_LEN = 64; // cap timestamp/duration string
+        const rawSource = ctx.flags?.source || 'all';
+        const source = VALID_SOURCES.has(rawSource) ? rawSource : 'all';
+        const rawTail = Number(ctx.flags?.tail ?? 50);
+        const tail = Number.isFinite(rawTail) && rawTail > 0 ? Math.min(rawTail, MAX_TAIL) : 50;
         const follow = ctx.flags?.follow === true;
-        const level = ctx.flags?.level || 'info';
-        const since = ctx.flags?.since;
-        const grep = ctx.flags?.grep;
+        const rawLevel = ctx.flags?.level || 'info';
+        const level = VALID_LEVELS.has(rawLevel) ? rawLevel : 'info';
+        const rawSince = ctx.flags?.since;
+        const since = rawSince ? String(rawSince).slice(0, MAX_SINCE_LEN) : undefined;
+        const rawGrep = ctx.flags?.grep;
+        const grep = rawGrep ? String(rawGrep).slice(0, MAX_GREP_LEN) : undefined;
         console.log(`\n📜 Process Logs (${source})\n`);
         console.log(`  Level: ${level}+ | Lines: ${tail}${since ? ` | Since: ${since}` : ''}${grep ? ` | Filter: ${grep}` : ''}`);
         console.log('─'.repeat(70));
@@ -629,7 +649,10 @@ const logsCommand = {
                     .filter(f => source === 'all' || f.includes(source));
                 for (const file of logFiles) {
                     try {
-                        const content = readFileSync(resolve(logsDir, file), 'utf-8');
+                        const logFilePath = resolve(logsDir, file);
+                        if (statSync(logFilePath).size > 10 * 1024 * 1024)
+                            continue; // skip files > 10 MB
+                        const content = readFileSync(logFilePath, 'utf-8');
                         const lines = content.split('\n').filter(l => l.trim());
                         for (const line of lines) {
                             // Filter by log level if detectable

package/packages/@monomind/cli/dist/src/commands/progress.js

@@ -158,7 +158,8 @@ const watchCommand = {
         },
     ],
     action: async (ctx) => {
-        const interval = ctx.flags.interval || 5000;
+        const rawInterval = ctx.flags.interval || 5000;
+        const interval = Number.isFinite(rawInterval) ? Math.max(500, Math.min(rawInterval, 3_600_000)) : 5000; // min 500ms, max 1h
         output.writeln(output.highlight(`Watching progress (interval: ${interval}ms). Press Ctrl+C to stop.`));
         output.writeln();
         let lastProgress = 0;
@@ -180,8 +181,9 @@ const watchCommand = {
         };
         await check();
         const timer = setInterval(check, interval);
-        // Handle Ctrl+C
-        process.on('SIGINT', () => {
+        // Handle Ctrl+C — use once so repeated calls don't accumulate SIGINT handlers
+        // (which would trigger MaxListenersExceededWarning and a memory leak).
+        process.once('SIGINT', () => {
             clearInterval(timer);
             output.writeln();
             output.writeln(output.dim('Stopped watching.'));

package/packages/@monomind/cli/dist/src/commands/providers.js

@@ -59,10 +59,10 @@ const configureCommand = {
     ],
     action: async (ctx) => {
         try {
-            const provider = ctx.flags.provider || (ctx.args && ctx.args[0]) || '';
-            const apiKey = ctx.flags.key;
-            const model = ctx.flags.model;
-            const endpoint = ctx.flags.endpoint;
+            const provider = (ctx.flags.provider || (ctx.args && ctx.args[0]) || '').slice(0, 64);
+            const apiKey = ctx.flags.key?.slice(0, 256);
+            const model = ctx.flags.model?.slice(0, 128);
+            const endpoint = ctx.flags.endpoint?.slice(0, 512);
             if (!provider) {
                 output.printError('Provider name is required. Use -p <name> or pass as first argument.');
                 return { success: false, exitCode: 1 };
@@ -127,7 +127,7 @@ const testCommand = {
     ],
     action: async (ctx) => {
         try {
-            const provider = ctx.flags.provider || (ctx.args && ctx.args[0]) || '';
+            const provider = (ctx.flags.provider || (ctx.args && ctx.args[0]) || '').slice(0, 64);
             const testAll = ctx.flags.all;
             output.writeln();
             output.writeln(output.bold('Provider Connectivity Test'));

package/packages/@monomind/cli/dist/src/commands/replay.js

@@ -10,7 +10,8 @@ const showSubcommand = {
         { name: 'json', type: 'boolean', description: 'Output as JSON', default: false },
     ],
     action: async (ctx) => {
-        const sessionId = ctx.args[0];
+        // Cap session ID to prevent DoS via oversized string and unbounded output reflection.
+        const sessionId = (ctx.args[0] || '').slice(0, 128);
         if (!sessionId) {
             output.error('Session ID is required: replay show <sessionId>');
             return { success: false, message: 'Missing session ID' };
@@ -40,7 +41,12 @@ const listSubcommand = {
         try {
             const { ReplayReader } = await import('../observability/replay-reader.js');
             const reader = new ReplayReader();
-            const data = await reader.list(ctx.flags['limit']);
+            const rawLimit = ctx.flags['limit'];
+            // Cap limit to prevent DoS
+            const limit = typeof rawLimit === 'number' && Number.isFinite(rawLimit)
+                ? Math.max(1, Math.min(Math.floor(rawLimit), 500))
+                : 20;
+            const data = await reader.list(limit);
             const asJson = ctx.flags['json'];
             output.writeln(asJson ? JSON.stringify(data, null, 2) : 'Available replays listed');
             return { success: true, data };

package/packages/@monomind/cli/dist/src/commands/route.js

@@ -90,15 +90,20 @@ const routeTaskCommand = {
         { command: 'monomind route task "review code" --agent reviewer', description: 'Force specific agent' },
     ],
     action: async (ctx) => {
-        const taskDescription = ctx.args[0];
+        const rawTask = ctx.args[0];
         const forceAgent = ctx.flags.agent;
         const useExploration = ctx.flags.explore;
         const jsonOutput = ctx.flags.json;
-        if (!taskDescription) {
+        if (!rawTask) {
             output.printError('Task description is required');
             output.writeln(output.dim('Usage: monomind route task "task description"'));
             return { success: false, exitCode: 1 };
         }
+        if (rawTask.length > 4096) {
+            output.printError('Task description too long (max 4096 characters)');
+            return { success: false, exitCode: 1 };
+        }
+        const taskDescription = rawTask;
         const spinner = output.createSpinner({ text: 'Analyzing task...', spinner: 'dots' });
         spinner.start();
         try {
@@ -349,14 +354,24 @@ const feedbackCommand = {
         { command: 'monomind route feedback -t "write tests" -a tester -r -0.5', description: 'Negative feedback' },
     ],
     action: async (ctx) => {
-        const taskDescription = ctx.flags.task;
+        const rawFeedbackTask = ctx.flags.task;
         const agentId = ctx.flags.agent;
         const reward = ctx.flags.reward;
-        const nextTask = ctx.flags['next-task'];
-        if (!taskDescription || !agentId) {
+        const rawNextTask = ctx.flags['next-task'];
+        if (!rawFeedbackTask || !agentId) {
             output.printError('Task description and agent are required');
             return { success: false, exitCode: 1 };
         }
+        if (rawFeedbackTask.length > 4096) {
+            output.printError('Task description too long (max 4096 characters)');
+            return { success: false, exitCode: 1 };
+        }
+        if (agentId.length > 128) {
+            output.printError('Agent ID too long (max 128 characters)');
+            return { success: false, exitCode: 1 };
+        }
+        const taskDescription = rawFeedbackTask;
+        const nextTask = rawNextTask && rawNextTask.length > 4096 ? undefined : rawNextTask;
         // Validate agent
         const agent = getAgentType(agentId);
         if (!agent) {
@@ -776,13 +791,18 @@ const semanticRouteCommand = {
         { command: 'monomind route semantic -t "write unit tests" --debug', description: 'Show all route scores' },
     ],
     action: async (ctx) => {
-        const taskDescription = ctx.flags.task;
+        const rawSemanticTask = ctx.flags.task;
         const debug = ctx.flags.debug;
         const jsonOutput = ctx.flags.json;
-        if (!taskDescription) {
+        if (!rawSemanticTask) {
             output.printError('Task description is required. Use --task or -t flag.');
             return { success: false, exitCode: 1 };
         }
+        if (rawSemanticTask.length > 4096) {
+            output.printError('Task description too long (max 4096 characters)');
+            return { success: false, exitCode: 1 };
+        }
+        const taskDescription = rawSemanticTask;
         const spinner = output.createSpinner({ text: 'Computing semantic route...', spinner: 'dots' });
         spinner.start();
         try {