monomind 1.11.14 → 1.13.0

package/packages/@monomind/cli/dist/src/mcp-tools/task-tools.js

@@ -71,15 +71,36 @@ export const taskTools = [
         handler: async (input) => {
             const store = loadTaskStore();
             const taskId = `task-${Date.now()}-${randomBytes(4).toString('hex')}`;
+            // Cap all string fields: they are persisted verbatim to the task JSON store.
+            const MAX_TASK_TYPE_LEN = 128;
+            const MAX_TASK_DESC_LEN = 64 * 1024; // 64 KB — realistic task descriptions
+            const MAX_TASK_ASSIGNEE_LEN = 256;
+            const MAX_TASK_ASSIGNEES = 100;
+            const MAX_TASK_TAG_LEN = 128;
+            const MAX_TASK_TAGS = 50;
+            const rawTaskType = input.type;
+            const taskType = typeof rawTaskType === 'string' && rawTaskType.length > MAX_TASK_TYPE_LEN
+                ? rawTaskType.slice(0, MAX_TASK_TYPE_LEN) : rawTaskType;
+            const rawTaskDesc = input.description;
+            const taskDesc = typeof rawTaskDesc === 'string' && rawTaskDesc.length > MAX_TASK_DESC_LEN
+                ? rawTaskDesc.slice(0, MAX_TASK_DESC_LEN) : rawTaskDesc;
+            const rawAssignTo = input.assignTo || [];
+            const assignedTo = Array.isArray(rawAssignTo)
+                ? rawAssignTo.slice(0, MAX_TASK_ASSIGNEES).map(a => typeof a === 'string' && a.length > MAX_TASK_ASSIGNEE_LEN ? a.slice(0, MAX_TASK_ASSIGNEE_LEN) : a)
+                : [];
+            const rawTags = input.tags || [];
+            const tags = Array.isArray(rawTags)
+                ? rawTags.slice(0, MAX_TASK_TAGS).map(t => typeof t === 'string' && t.length > MAX_TASK_TAG_LEN ? t.slice(0, MAX_TASK_TAG_LEN) : t)
+                : [];
             const task = {
                 taskId,
-                type: input.type,
-                description: input.description,
+                type: taskType,
+                description: taskDesc,
                 priority: input.priority || 'normal',
                 status: 'pending',
                 progress: 0,
-                assignedTo: input.assignTo || [],
-                tags: input.tags || [],
+                assignedTo,
+                tags,
                 createdAt: new Date().toISOString(),
                 startedAt: null,
                 completedAt: null,
@@ -172,8 +193,13 @@ export const taskTools = [
             }
             // Sort by creation date (newest first)
             tasks.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
-            // Apply limit
-            const limit = input.limit || 50;
+            // Apply limit — cap to 1 000 to prevent returning the entire task store
+            // in one response, which could cause OOM on large deployments.
+            const MAX_TASK_LIMIT = 1_000;
+            const rawLimit = typeof input.limit === 'number' ? input.limit : 50;
+            const limit = Number.isFinite(rawLimit) && rawLimit > 0
+                ? Math.min(Math.floor(rawLimit), MAX_TASK_LIMIT)
+                : 50;
             tasks = tasks.slice(0, limit);
             return {
                 tasks: tasks.map(t => ({
@@ -225,7 +251,7 @@ export const taskTools = [
                     const agentStorePath = join(getProjectCwd(), STORAGE_DIR, 'agents', 'store.json');
                     try {
                         let agentStore = { agents: {} };
-                        if (existsSync(agentStorePath)) {
+                        if (existsSync(agentStorePath) && statSync(agentStorePath).size <= MAX_TASK_STORE_BYTES) {
                             const agentRaw = JSON.parse(readFileSync(agentStorePath, 'utf-8'));
                             if (agentRaw && typeof agentRaw === 'object' && !Object.prototype.hasOwnProperty.call(agentRaw, '__proto__')) {
                                 agentStore = agentRaw;
@@ -298,7 +324,15 @@ export const taskTools = [
                     task.progress = Math.min(100, Math.max(0, input.progress));
                 }
                 if (input.assignTo) {
-                    task.assignedTo = input.assignTo;
+                    // Cap array and element lengths — task_create already does this;
+                    // task_update must apply the same guards so the on-disk store
+                    // cannot be inflated via the update path.
+                    const MAX_TASK_ASSIGNEE_LEN = 256;
+                    const MAX_TASK_ASSIGNEES = 100;
+                    const rawAssignTo = input.assignTo;
+                    task.assignedTo = Array.isArray(rawAssignTo)
+                        ? rawAssignTo.slice(0, MAX_TASK_ASSIGNEES).map(a => typeof a === 'string' && a.length > MAX_TASK_ASSIGNEE_LEN ? a.slice(0, MAX_TASK_ASSIGNEE_LEN) : a)
+                        : task.assignedTo;
                 }
                 saveTaskStore(store);
                 return {
@@ -343,7 +377,7 @@ export const taskTools = [
             const agentStorePath = join(getProjectCwd(), STORAGE_DIR, 'agents', 'store.json');
             let agentStore = { agents: {} };
             try {
-                if (existsSync(agentStorePath)) {
+                if (existsSync(agentStorePath) && statSync(agentStorePath).size <= MAX_TASK_STORE_BYTES) {
                     agentStore = JSON.parse(readFileSync(agentStorePath, 'utf-8'));
                 }
             }
@@ -426,7 +460,15 @@ export const taskTools = [
             if (task) {
                 task.status = 'cancelled';
                 task.completedAt = new Date().toISOString();
-                task.result = { cancelReason: input.reason || 'Cancelled by user' };
+                // Cap reason: persisted verbatim to the task store on disk.
+                // Without a cap an attacker can inflate the store with an arbitrarily
+                // large cancellation reason string.
+                const MAX_CANCEL_REASON_LEN = 1024;
+                const rawReason = input.reason;
+                const cancelReason = typeof rawReason === 'string' && rawReason.length > MAX_CANCEL_REASON_LEN
+                    ? rawReason.slice(0, MAX_CANCEL_REASON_LEN)
+                    : (rawReason || 'Cancelled by user');
+                task.result = { cancelReason };
                 saveTaskStore(store);
                 return {
                     success: true,

package/packages/@monomind/cli/dist/src/mcp-tools/terminal-tools.js

@@ -1,6 +1,7 @@
 import { getProjectCwd } from './types.js';
-import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, readFileSync, statSync, writeFileSync, renameSync, mkdirSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { homedir } from 'node:os';
 import { execSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 // Storage paths
@@ -19,10 +20,11 @@ function ensureTerminalDir() {
         mkdirSync(dir, { recursive: true });
     }
 }
+const MAX_TERMINAL_STORE_BYTES = 10 * 1024 * 1024; // 10 MB
 function loadTerminalStore() {
     try {
         const path = getTerminalPath();
-        if (existsSync(path)) {
+        if (existsSync(path) && statSync(path).size <= MAX_TERMINAL_STORE_BYTES) {
             return JSON.parse(readFileSync(path, 'utf-8'));
         }
     }
@@ -74,14 +76,40 @@ export const terminalTools = [
                     safeEnv[k] = String(v);
                 }
             }
+            // Validate workingDir: must exist, be a directory, and not escape to
+            // system-sensitive paths. Fall back to project cwd if invalid.
+            let resolvedWorkingDir = getProjectCwd();
+            if (input.workingDir && typeof input.workingDir === 'string') {
+                const candidate = resolve(input.workingDir);
+                const projectCwd = getProjectCwd();
+                const home = homedir();
+                // Allow paths under project cwd or user home directory only.
+                const isUnderProject = candidate === projectCwd || candidate.startsWith(projectCwd + '/') || candidate.startsWith(projectCwd + '\\');
+                const isUnderHome = candidate === home || candidate.startsWith(home + '/') || candidate.startsWith(home + '\\');
+                if ((isUnderProject || isUnderHome) && existsSync(candidate)) {
+                    try {
+                        if (statSync(candidate).isDirectory()) {
+                            resolvedWorkingDir = candidate;
+                        }
+                    }
+                    catch {
+                        // Leave resolvedWorkingDir as default
+                    }
+                }
+            }
             const id = `term-${Date.now()}-${randomBytes(4).toString('hex')}`;
+            // Cap session name: stored in terminal JSON store on disk.
+            const MAX_TERMINAL_NAME_LEN = 256;
+            const rawTerminalName = input.name || `Terminal ${Object.keys(store.sessions).length + 1}`;
+            const terminalName = typeof rawTerminalName === 'string' && rawTerminalName.length > MAX_TERMINAL_NAME_LEN
+                ? rawTerminalName.slice(0, MAX_TERMINAL_NAME_LEN) : rawTerminalName;
             const session = {
                 id,
-                name: input.name || `Terminal ${Object.keys(store.sessions).length + 1}`,
+                name: terminalName,
                 status: 'active',
                 createdAt: new Date().toISOString(),
                 lastActivity: new Date().toISOString(),
-                workingDir: input.workingDir || getProjectCwd(),
+                workingDir: resolvedWorkingDir,
                 history: [],
                 env: safeEnv,
             };
@@ -114,7 +142,13 @@ export const terminalTools = [
         handler: async (input) => {
             const store = loadTerminalStore();
             const sessionId = input.sessionId;
-            const command = input.command;
+            // Cap command: the metacharacter regex check at line 220 is O(n), and the
+            // raw command is stored verbatim in session history (up to 200 entries).
+            // A realistic shell command is well under 64 KB; cap there.
+            const MAX_TERMINAL_COMMAND_LEN = 64 * 1024;
+            const rawCommand = input.command;
+            const command = typeof rawCommand === 'string' && rawCommand.length > MAX_TERMINAL_COMMAND_LEN
+                ? rawCommand.slice(0, MAX_TERMINAL_COMMAND_LEN) : rawCommand;
             const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
             // Reject inherited keys (incl. toString/hasOwnProperty/etc.) so a tampered
             // store.json can't redirect bracket access into Object.prototype.

package/packages/@monomind/cli/dist/src/mcp-tools/transfer-tools.js

@@ -59,7 +59,13 @@ export const transferTools = [
         handler: async (input) => {
             try {
                 const { detectPII } = await import('../transfer/anonymization/index.js');
-                const result = detectPII(input.content);
+                // detectPII runs multiple PII regexes over the entire string — O(n × patterns).
+                // Cap to 1 MB to prevent ReDoS-style DoS from oversized content.
+                const MAX_PII_CONTENT_LEN = 1024 * 1024; // 1 MB
+                const rawContent = input.content;
+                const content = typeof rawContent === 'string' && rawContent.length > MAX_PII_CONTENT_LEN
+                    ? rawContent.slice(0, MAX_PII_CONTENT_LEN) : rawContent;
+                const result = detectPII(content);
                 return createResult(result);
             }
             catch (error) {
@@ -88,7 +94,13 @@ export const transferTools = [
         handler: async (input) => {
             try {
                 const { resolveIPNS } = await import('../transfer/ipfs/client.js');
-                const result = await resolveIPNS(input.name);
+                // Cap IPNS name length — uncapped strings may trigger O(n) path parsing
+                // inside the IPFS client or be reflected in error messages.
+                const MAX_IPNS_NAME_LEN = 512;
+                const rawName = input.name;
+                const name = typeof rawName === 'string' && rawName.length > MAX_IPNS_NAME_LEN
+                    ? rawName.slice(0, MAX_IPNS_NAME_LEN) : rawName;
+                const result = await resolveIPNS(name);
                 return createResult({ success: true, cid: result });
             }
             catch (error) {
@@ -132,7 +144,18 @@ export const transferTools = [
         handler: async (input) => {
             try {
                 const store = await getPatternStore();
-                const results = store.search(input);
+                // Cap query and limit to prevent DoS via large string or result set.
+                const MAX_TRANSFER_QUERY_LEN = 4 * 1024;
+                const MAX_TRANSFER_LIMIT = 500;
+                const inp = input;
+                const cappedInput = {
+                    ...inp,
+                    query: typeof inp.query === 'string' && inp.query.length > MAX_TRANSFER_QUERY_LEN
+                        ? inp.query.slice(0, MAX_TRANSFER_QUERY_LEN) : inp.query,
+                    limit: typeof inp.limit === 'number' && Number.isFinite(inp.limit)
+                        ? Math.min(Math.floor(Math.max(inp.limit, 1)), MAX_TRANSFER_LIMIT) : inp.limit,
+                };
+                const results = store.search(cappedInput);
                 return createResult(results);
             }
             catch (error) {
@@ -296,7 +319,17 @@ export const transferTools = [
                 if (!result.success || !result.registry) {
                     return createResult({ error: result.error || 'Failed to discover registry' }, true);
                 }
-                const opts = input;
+                // Cap query and limit before forwarding to searchPlugins.
+                const MAX_PLUGIN_QUERY_LEN = 4 * 1024;
+                const MAX_PLUGIN_LIMIT = 500;
+                const rawOpts = input;
+                const opts = {
+                    ...rawOpts,
+                    query: typeof rawOpts.query === 'string' && rawOpts.query.length > MAX_PLUGIN_QUERY_LEN
+                        ? rawOpts.query.slice(0, MAX_PLUGIN_QUERY_LEN) : rawOpts.query,
+                    limit: typeof rawOpts.limit === 'number' && Number.isFinite(rawOpts.limit)
+                        ? Math.min(Math.floor(Math.max(rawOpts.limit, 1)), MAX_PLUGIN_LIMIT) : rawOpts.limit,
+                };
                 const searchResult = searchPlugins(result.registry, opts);
                 return createResult(searchResult);
             }

package/packages/@monomind/cli/dist/src/mcp-tools/workflow-tools.js

@@ -98,7 +98,12 @@ export const workflowTools = [
         handler: async (input) => {
             const store = loadWorkflowStore();
             const template = input.template;
-            const task = input.task;
+            // Cap task description to prevent DoS via unbounded string stored in
+            // workflow record and serialised to disk.
+            const MAX_WORKFLOW_TASK_LEN = 16 * 1024;
+            const rawTask = input.task;
+            const task = typeof rawTask === 'string' && rawTask.length > MAX_WORKFLOW_TASK_LEN
+                ? rawTask.slice(0, MAX_WORKFLOW_TASK_LEN) : rawTask;
             const options = input.options || {};
             const dryRun = options.dryRun;
             // Build workflow from template or inline
@@ -192,7 +197,19 @@ export const workflowTools = [
         handler: async (input) => {
             const store = loadWorkflowStore();
             const workflowId = `workflow-${Date.now()}-${randomBytes(6).toString('hex')}`;
-            const steps = (input.steps || []).map((s, i) => ({
+            // Cap string fields before storing to disk.
+            const MAX_WF_NAME_LEN = 512;
+            const MAX_WF_DESC_LEN = 16 * 1024;
+            const MAX_WF_STEPS = 500;
+            const rawWfName = input.name;
+            const wfName = typeof rawWfName === 'string' && rawWfName.length > MAX_WF_NAME_LEN
+                ? rawWfName.slice(0, MAX_WF_NAME_LEN) : rawWfName;
+            const rawWfDesc = input.description;
+            const wfDesc = typeof rawWfDesc === 'string' && rawWfDesc.length > MAX_WF_DESC_LEN
+                ? rawWfDesc.slice(0, MAX_WF_DESC_LEN) : rawWfDesc;
+            const rawSteps = input.steps || [];
+            const cappedSteps = rawSteps.slice(0, MAX_WF_STEPS);
+            const steps = cappedSteps.map((s, i) => ({
                 stepId: `step-${i + 1}`,
                 name: s.name || `Step ${i + 1}`,
                 type: s.type || 'task',
@@ -201,8 +218,8 @@ export const workflowTools = [
             }));
             const workflow = {
                 workflowId,
-                name: input.name,
-                description: input.description,
+                name: wfName,
+                description: wfDesc,
                 steps,
                 status: steps.length > 0 ? 'ready' : 'draft',
                 currentStep: 0,
@@ -355,8 +372,14 @@ export const workflowTools = [
             }
             // Sort by creation date (newest first)
             workflows.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
-            // Apply limit
-            const limit = input.limit || 20;
+            // Apply limit — cap to 1 000 to prevent returning the full (potentially
+            // large) in-memory workflow store in one response, which could cause OOM
+            // or excessive serialisation latency.
+            const MAX_WORKFLOW_LIMIT = 1_000;
+            const rawLimit = typeof input.limit === 'number' ? input.limit : 20;
+            const limit = Number.isFinite(rawLimit) && rawLimit > 0
+                ? Math.min(Math.floor(rawLimit), MAX_WORKFLOW_LIMIT)
+                : 20;
             const totalCount = workflows.length;
             workflows = workflows.slice(0, limit);
             return {

package/packages/@monomind/cli/dist/src/memory/ewc-consolidation.js

@@ -145,7 +145,12 @@ export class EWCConsolidator {
             for (const newPattern of newPatterns) {
                 if (!newPattern.embedding || newPattern.embedding.length === 0)
                     continue;
-                const existingPattern = this.patterns.get(newPattern.id);
+                // Cap pattern ID length: unbounded IDs fill both the Map key and the
+                // modifiedPatterns/protectedPatterns result arrays without any limit.
+                const patternId = typeof newPattern.id === 'string'
+                    ? newPattern.id.slice(0, 256)
+                    : String(newPattern.id).slice(0, 256);
+                const existingPattern = this.patterns.get(patternId);
                 if (existingPattern) {
                     // Calculate EWC penalty for updating existing pattern
                     const penalty = this.getPenalty(existingPattern.weights, newPattern.embedding, fisher);
@@ -153,19 +158,19 @@ export class EWCConsolidator {
                     const importanceScore = this.calculateImportance(existingPattern);
                     if (importanceScore > this.config.importanceThreshold && penalty > this.config.lambda) {
                         // Protect high-importance patterns with high penalty
-                        result.protectedPatterns.push(newPattern.id);
+                        result.protectedPatterns.push(patternId);
                         // Apply constrained update: blend old and new based on importance
                         const blendFactor = 1 - importanceScore;
                         const blendedWeights = this.blendWeights(existingPattern.weights, newPattern.embedding, blendFactor, fisher);
                         existingPattern.weights = blendedWeights;
                         existingPattern.lastUpdated = Date.now();
-                        result.modifiedPatterns.push(newPattern.id);
+                        result.modifiedPatterns.push(patternId);
                     }
                     else {
                         // Low importance or low penalty: allow full update
                         existingPattern.weights = newPattern.embedding.slice(0, this.config.dimensions);
                         existingPattern.lastUpdated = Date.now();
-                        result.modifiedPatterns.push(newPattern.id);
+                        result.modifiedPatterns.push(patternId);
                     }
                     // Update Fisher diagonal for this pattern
                     existingPattern.fisherDiagonal = fisher;
@@ -174,7 +179,7 @@ export class EWCConsolidator {
                 else {
                     // New pattern: add directly
                     const weights = {
-                        id: newPattern.id,
+                        id: patternId,
                         weights: newPattern.embedding.slice(0, this.config.dimensions),
                         fisherDiagonal: fisher,
                         importance: 0.5,
@@ -184,8 +189,8 @@ export class EWCConsolidator {
                         type: newPattern.type,
                         description: newPattern.description
                     };
-                    this.patterns.set(newPattern.id, weights);
-                    result.modifiedPatterns.push(newPattern.id);
+                    this.patterns.set(patternId, weights);
+                    result.modifiedPatterns.push(patternId);
                 }
                 result.patternsConsolidated++;
             }
@@ -209,7 +214,10 @@ export class EWCConsolidator {
             return result;
         }
         catch (error) {
-            result.error = error instanceof Error ? error.message : String(error);
+            // Sanitize: strip filesystem paths and cap length so internal error
+            // messages are not reflected verbatim into CallerResult.error.
+            const rawMsg = error instanceof Error ? error.message : String(error);
+            result.error = rawMsg.replace(/\/[^\s:]+(\/|(?=\s|:|$))/g, '<path>/').slice(0, 500);
             result.duration = performance.now() - startTime;
             return result;
         }
@@ -513,6 +521,10 @@ export class EWCConsolidator {
         if (!fs.existsSync(this.config.storagePath)) {
             throw new Error('No persisted state found');
         }
+        const fileSize = fs.statSync(this.config.storagePath).size;
+        if (fileSize > 50 * 1024 * 1024) {
+            throw new Error(`EWC state file too large (${fileSize} bytes); refusing to load`);
+        }
         const content = fs.readFileSync(this.config.storagePath, 'utf-8');
         const state = JSON.parse(content);
         // Validate version
@@ -551,8 +563,12 @@ export class EWCConsolidator {
                 this.patterns.set(id, pattern);
             }
         }
-        // Restore history
-        this.consolidationHistory = Array.isArray(state.consolidationHistory) ? state.consolidationHistory : [];
+        // Restore history — cap to last 100 entries so a crafted state file cannot
+        // bloat the in-memory array (each entry is a small object, but the array is
+        // summed on every getConsolidationStats() call which is O(n)).
+        this.consolidationHistory = Array.isArray(state.consolidationHistory)
+            ? state.consolidationHistory.slice(-100)
+            : [];
         // Update config from persisted values, clamped to a sensible range to
         // prevent negative/NaN lambda from inverting the regularization sign.
         if (state.config && typeof state.config.lambda === 'number'

package/packages/@monomind/cli/dist/src/memory/intelligence.js

@@ -10,7 +10,7 @@
  *
  * @module v1/cli/intelligence
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, renameSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 // ============================================================================
@@ -332,7 +332,7 @@ class LocalReasoningBank {
     loadFromDisk() {
         try {
             const path = getPatternsPath();
-            if (existsSync(path)) {
+            if (existsSync(path) && statSync(path).size <= 50 * 1024 * 1024) {
                 const data = JSON.parse(readFileSync(path, 'utf-8'));
                 if (Array.isArray(data)) {
                     // Validate each persisted pattern. The patterns file is part of the
@@ -393,9 +393,10 @@ class LocalReasoningBank {
             renameSync(tmp, path);
             this.dirty = false;
         }
-        catch (error) {
+        catch {
             // Log but don't throw - persistence failures shouldn't break training
-            console.error('Failed to persist patterns:', error);
+            // Do not reflect raw error to avoid leaking internal paths
+            console.error('Failed to persist patterns');
         }
     }
     /**
@@ -548,7 +549,7 @@ let globalStats = {
 function loadPersistedStats() {
     try {
         const path = getStatsPath();
-        if (existsSync(path)) {
+        if (existsSync(path) && statSync(path).size <= 10 * 1024 * 1024) {
             const data = JSON.parse(readFileSync(path, 'utf-8'));
             if (data && typeof data === 'object') {
                 globalStats.trajectoriesRecorded = data.trajectoriesRecorded ?? 0;
@@ -599,7 +600,7 @@ async function _doInitializeIntelligence(config) {
         // Seed neural learned patterns from @monomind/neural's LearningBridge flush.
         // This is the A→B bridge reader: connects the automatic learning loop to routing.
         const neuralPatternsPath = join(getDataDir(), 'patterns.json');
-        if (existsSync(neuralPatternsPath)) {
+        if (existsSync(neuralPatternsPath) && statSync(neuralPatternsPath).size <= 50 * 1024 * 1024) {
             try {
                 const { generateEmbedding: genEmb } = await import('./memory-initializer.js').catch(() => ({ generateEmbedding: null }));
                 const raw = readFileSync(neuralPatternsPath, 'utf-8');
@@ -804,6 +805,10 @@ export async function recordTrajectory(steps, verdict) {
     }
 }
 export async function findSimilarPatterns(query, options) {
+    // Cap query length to prevent OOM via embedding generation on unbounded input
+    if (typeof query === 'string' && query.length > 2000) {
+        query = query.slice(0, 2000);
+    }
     if (!reasoningBank) {
         const init = await initializeIntelligence();
         if (!init.success)
@@ -943,9 +948,11 @@ export function benchmarkAdaptation(iterations = 1000) {
     if (!sonaCoordinator) {
         return { totalMs: 0, avgMs: 0, minMs: 0, maxMs: 0, targetMet: false };
     }
+    // Cap iterations to prevent OOM/CPU exhaustion from unbounded caller input
+    const safeIterations = Math.min(Math.max(1, iterations >>> 0), 100_000);
     const times = [];
     const testEmbedding = Array.from({ length: 384 }, () => Math.random());
-    for (let i = 0; i < iterations; i++) {
+    for (let i = 0; i < safeIterations; i++) {
         const start = performance.now();
         sonaCoordinator.recordSignal({
             type: 'test',
@@ -956,7 +963,7 @@ export function benchmarkAdaptation(iterations = 1000) {
         times.push(performance.now() - start);
     }
     const totalMs = times.reduce((a, b) => a + b, 0);
-    const avgMs = totalMs / iterations;
+    const avgMs = totalMs / safeIterations;
     const minMs = Math.min(...times);
     const maxMs = Math.max(...times);
     return {
@@ -980,21 +987,75 @@ function loadSonaRoutingPatterns() {
         const sonaPath = join(process.cwd(), '.swarm', 'sona-patterns.json');
         if (!existsSync(sonaPath))
             return [];
+        if (statSync(sonaPath).size > 10 * 1024 * 1024)
+            return [];
         const raw = JSON.parse(readFileSync(sonaPath, 'utf-8'));
         const persisted = raw;
-        if (!persisted.patterns || typeof persisted.patterns !== 'object')
+        if (!persisted.patterns || typeof persisted.patterns !== 'object' || Array.isArray(persisted.patterns))
             return [];
         const now = Date.now();
-        return Object.entries(persisted.patterns).map(([key, p]) => ({
-            id: `sona:${key}`,
-            type: p.agent ?? 'routing',
-            content: (p.keywords ?? [key]).join(' '),
-            confidence: p.confidence ?? 0.5,
-            usageCount: (p.successCount ?? 0) + (p.failureCount ?? 0),
-            embedding: [],
-            createdAt: p.createdAt ?? now,
-            lastUsedAt: now,
-        }));
+        const results = [];
+        // Cap total entries to prevent DoS via an unbounded patterns map.
+        // sona-patterns.json is written by the SONA optimizer but could be
+        // replaced by a malicious IPFS bundle — validate every field before use.
+        const MAX_SONA_ENTRIES = 500;
+        let entryCount = 0;
+        for (const [key, p] of Object.entries(persisted.patterns)) {
+            // Prototype pollution guard — skip __proto__ / constructor / prototype keys.
+            if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+                continue;
+            if (typeof key !== 'string' || key.length === 0 || key.length > 256)
+                continue;
+            if (entryCount++ >= MAX_SONA_ENTRIES)
+                break;
+            if (!p || typeof p !== 'object')
+                continue;
+            // Validate keywords: must be a bounded array of short strings.
+            const rawKw = p.keywords;
+            let keywords;
+            if (rawKw === undefined) {
+                keywords = [key];
+            }
+            else if (Array.isArray(rawKw) && rawKw.length <= 64
+                && rawKw.every(k => typeof k === 'string' && k.length > 0 && k.length <= 128)) {
+                keywords = rawKw;
+            }
+            else {
+                continue; // malformed keywords — skip entry
+            }
+            // Validate agent string.
+            const agent = p.agent;
+            if (agent !== undefined && (typeof agent !== 'string' || agent.length === 0 || agent.length > 128))
+                continue;
+            // Validate confidence is a finite number in [0, 1].
+            const rawConf = p.confidence;
+            const confidence = rawConf !== undefined ? rawConf : 0.5;
+            if (typeof confidence !== 'number' || !Number.isFinite(confidence) || confidence < 0 || confidence > 1)
+                continue;
+            // Validate usage counts are safe integers.
+            const sc = p.successCount ?? 0;
+            const fc = p.failureCount ?? 0;
+            if (typeof sc !== 'number' || !Number.isFinite(sc) || sc < 0 || sc > 1e9)
+                continue;
+            if (typeof fc !== 'number' || !Number.isFinite(fc) || fc < 0 || fc > 1e9)
+                continue;
+            // Validate createdAt is a reasonable epoch ms value.
+            const rawTs = p.createdAt;
+            const createdAt = (rawTs !== undefined && typeof rawTs === 'number' && Number.isFinite(rawTs) && rawTs >= 0 && rawTs <= 9.9e12)
+                ? rawTs
+                : now;
+            results.push({
+                id: `sona:${key}`,
+                type: agent ?? 'routing',
+                content: keywords.join(' '),
+                confidence,
+                usageCount: sc + fc,
+                embedding: [],
+                createdAt,
+                lastUsedAt: now,
+            });
+        }
+        return results;
     }
     catch {
         return [];

package/packages/@monomind/cli/dist/src/memory/memory-bridge.js

@@ -404,8 +404,12 @@ async function getOrBuildHnswIndex(db) {
     _hnswIndexBuilt = true; // Lock prevents concurrent re-build
     try {
         const memPkg = await import('@monoes/memory');
-        if (!memPkg?.HNSWIndex)
+        if (!memPkg?.HNSWIndex) {
+            // Release the lock so a later retry can succeed if the package becomes available.
+            _hnswIndexBuilt = false;
+            _hnswBuildFailedAt = Date.now();
             return null;
+        }
         const rows = db.prepare(`SELECT id, embedding FROM memory_entries WHERE status = 'active' AND (expires_at IS NULL OR expires_at > ?) AND embedding IS NOT NULL`).all(Date.now());
         const valid = [];
         for (const row of rows) {
@@ -447,7 +451,22 @@ export async function bridgeStoreEntry(options) {
     if (!ctx)
         return null;
     try {
-        const { key, value, namespace = 'default', tags: rawTags = [], ttl } = options;
+        const rawKey = options.key;
+        const rawValue = options.value;
+        // SECURITY: defensive caps so no caller — current or future — can pass an
+        // unbounded string directly into embedder.embed (hash fallback is O(n)) or
+        // inflate the AgentDB row beyond practical limits.
+        // Memory-tools already validates to 1 MB; these caps are a last-resort
+        // backstop for any internal caller that forgets to pre-truncate.
+        const BRIDGE_MAX_KEY_LEN = 4 * 1024; // 4 KB — generous for any realistic key
+        const BRIDGE_MAX_VALUE_LEN = 1024 * 1024; // 1 MB — matches memory-tools validator
+        const key = typeof rawKey === 'string' && rawKey.length > BRIDGE_MAX_KEY_LEN
+            ? rawKey.slice(0, BRIDGE_MAX_KEY_LEN) : rawKey;
+        const value = typeof rawValue === 'string' && rawValue.length > BRIDGE_MAX_VALUE_LEN
+            ? rawValue.slice(0, BRIDGE_MAX_VALUE_LEN) : rawValue;
+        const namespace = options.namespace ?? 'default';
+        const rawTags = options.tags ?? [];
+        const ttl = options.ttl;
         // SECURITY: cap tags array length and per-tag length. Without these, any
         // memory_store caller (every spawned agent) could submit
         // tags: new Array(1e5).fill("x".repeat(1e4)) → ~1GB persisted blob,