monomind 1.11.14 → 1.13.0

package/packages/@monomind/cli/dist/src/production/circuit-breaker.js

@@ -105,6 +105,11 @@ export class CircuitBreaker {
         this.failures.push(now);
         // Clean old failures outside window
         this.failures = this.failures.filter(t => t > now - this.config.failureWindowMs);
+        // Hard cap: prevent unbounded growth under rapid-fire recordFailure() calls
+        // before the window filter prunes entries (e.g. clock skew or test hammering).
+        if (this.failures.length > 10_000) {
+            this.failures = this.failures.slice(-10_000);
+        }
         // Check if we should open the circuit
         if (this.state === 'closed' && this.failures.length >= this.config.failureThreshold) {
             this.transitionTo('open');
@@ -214,17 +219,26 @@ export class CircuitBreaker {
 // ============================================================================
 const circuitBreakers = new Map();
 const MAX_CIRCUIT_BREAKERS = 1000;
+const MAX_CIRCUIT_BREAKER_NAME_LEN = 256;
+const FORBIDDEN_CB_NAMES = new Set(['__proto__', 'constructor', 'prototype']);
 /**
  * Get or create a circuit breaker by name
  */
 export function getCircuitBreaker(name, config) {
-    if (!circuitBreakers.has(name)) {
+    // Sanitize name: cap length and block prototype-pollution keys
+    const safeName = typeof name === 'string'
+        ? name.slice(0, MAX_CIRCUIT_BREAKER_NAME_LEN)
+        : 'default';
+    if (FORBIDDEN_CB_NAMES.has(safeName)) {
+        throw new Error(`Invalid circuit breaker name: ${safeName}`);
+    }
+    if (!circuitBreakers.has(safeName)) {
         if (circuitBreakers.size >= MAX_CIRCUIT_BREAKERS) {
             throw new Error(`Circuit breaker registry full (max ${MAX_CIRCUIT_BREAKERS})`);
         }
-        circuitBreakers.set(name, new CircuitBreaker(config));
+        circuitBreakers.set(safeName, new CircuitBreaker(config));
     }
-    return circuitBreakers.get(name);
+    return circuitBreakers.get(safeName);
 }
 /**
  * Get all circuit breaker stats

package/packages/@monomind/cli/dist/src/production/error-handler.js

@@ -134,6 +134,9 @@ export class ErrorHandler {
             return input;
         if (_depth > 20)
             return { '[MAX_DEPTH]': true };
+        // Primitives and null cannot be stored in a WeakSet — return them as-is.
+        if (input === null || typeof input !== 'object')
+            return input;
         if (_seen.has(input))
             return { '[CIRCULAR]': true };
         _seen.add(input);

package/packages/@monomind/cli/dist/src/production/monitoring.js

@@ -78,11 +78,25 @@ export class MonitoringHooks {
         // Apply sampling
         if (Math.random() > this.config.samplingRate)
             return;
+        // Cap metric name and label keys/values to prevent DoS
+        const safeName = String(name).slice(0, 256);
+        const safeLabels = {};
+        let labelCount = 0;
+        for (const [k, v] of Object.entries(labels)) {
+            if (!Object.hasOwn(labels, k))
+                continue;
+            if (++labelCount > 20)
+                break;
+            // Block prototype pollution keys
+            if (k === '__proto__' || k === 'constructor' || k === 'prototype')
+                continue;
+            safeLabels[String(k).slice(0, 64)] = String(v).slice(0, 512);
+        }
         const event = {
-            name,
+            name: safeName,
             type,
             value,
-            labels: { ...this.config.globalLabels, ...labels },
+            labels: { ...this.config.globalLabels, ...safeLabels },
             timestamp: Date.now(),
         };
         this.metrics.push(event);
@@ -131,7 +145,8 @@ export class MonitoringHooks {
      * Register a health check
      */
     registerHealthCheck(name, check) {
-        this.healthChecks.set(name, check);
+        // Cap name length to prevent map-key inflation
+        this.healthChecks.set(String(name).slice(0, 128), check);
     }
     /**
      * Run all health checks
@@ -285,6 +300,8 @@ export class MonitoringHooks {
     // Private Methods
     // ============================================================================
     checkAlerts(name, value) {
+        if (!Object.hasOwn(this.config.alertThresholds, name))
+            return;
         const thresholds = this.config.alertThresholds[name];
         if (!thresholds)
             return;

package/packages/@monomind/cli/dist/src/production/rate-limiter.js

@@ -33,6 +33,11 @@ export class RateLimiter {
      * Check if a request is allowed
      */
     check(operation, userId) {
+        // Cap operation and userId lengths so bucket keys cannot inflate the Map
+        const safeOp = typeof operation === 'string' ? operation.slice(0, 256) : 'unknown';
+        const safeUserId = userId ? userId.slice(0, 256) : undefined;
+        operation = safeOp;
+        userId = safeUserId;
         // Check whitelist
         if (this.config.whitelist.includes(operation)) {
             return { allowed: true, remaining: Infinity, resetAt: 0 };
@@ -157,10 +162,14 @@ export class RateLimiter {
     // Private Methods
     // ============================================================================
     getLimits(operation) {
-        return (this.config.operationLimits[operation] || {
-            maxRequests: this.config.maxRequests,
-            windowMs: this.config.windowMs,
-        });
+        // Object.hasOwn guards against prototype-pollution: if someone passes
+        // '__proto__' as the operation name, falling through to the default is safe.
+        return (Object.hasOwn(this.config.operationLimits, operation)
+            ? this.config.operationLimits[operation]
+            : {
+                maxRequests: this.config.maxRequests,
+                windowMs: this.config.windowMs,
+            });
     }
     createBucket() {
         return {

package/packages/@monomind/cli/dist/src/production/retry.js

@@ -59,13 +59,15 @@ function calculateDelay(attempt, config, strategy = 'exponential') {
     return Math.round(Math.max(0, delay));
 }
 /**
- * Fibonacci helper for fibonacci backoff
+ * Fibonacci helper for fibonacci backoff — capped at n=40 to prevent
+ * excessively long loops when maxAttempts is set to a large value.
  */
 function fibonacci(n) {
-    if (n <= 1)
+    const capped = Math.min(n, 40);
+    if (capped <= 1)
         return 1;
     let a = 1, b = 1;
-    for (let i = 2; i <= n; i++) {
+    for (let i = 2; i <= capped; i++) {
         [a, b] = [b, a + b];
     }
     return b;
@@ -99,8 +101,12 @@ function sleep(ms) {
  */
 export async function withRetry(fn, config = {}, strategy = 'exponential') {
     const finalConfig = { ...DEFAULT_CONFIG, ...config };
+    // Clamp maxAttempts and maxDelayMs to safe ranges to prevent runaway retry loops
+    finalConfig.maxAttempts = Math.min(Math.max(1, finalConfig.maxAttempts), 100);
+    finalConfig.maxDelayMs = Math.min(Math.max(0, finalConfig.maxDelayMs), 300_000); // 5 min ceiling
     const startTime = Date.now();
     const retryHistory = [];
+    const MAX_RETRY_HISTORY = 100;
     let lastError;
     let attempt = 0;
     while (attempt < finalConfig.maxAttempts) {
@@ -129,12 +135,14 @@ export async function withRetry(fn, config = {}, strategy = 'exponential') {
             }
             // Calculate delay
             const delay = calculateDelay(attempt, finalConfig, strategy);
-            // Record retry
-            retryHistory.push({
-                attempt,
-                error: lastError.message,
-                delayMs: delay,
-            });
+            // Record retry (cap history size and error message length to prevent OOM)
+            if (retryHistory.length < MAX_RETRY_HISTORY) {
+                retryHistory.push({
+                    attempt,
+                    error: lastError.message.slice(0, 512),
+                    delayMs: delay,
+                });
+            }
             // Call retry callback
             if (finalConfig.onRetry) {
                 finalConfig.onRetry(lastError, attempt, delay);

package/packages/@monomind/cli/dist/src/routing/embed-worker.js

@@ -22,12 +22,16 @@ import { createSemanticRouting } from './embedder.js';
 // don't land on stdout and corrupt the single JSON result line the parent
 // parses. Must be set before the (lazy) transformers import in embedder.ts.
 process.env.TRANSFORMERS_VERBOSITY ??= 'error';
+/** Max task string length before it's silently truncated — prevents OOM in the embedding model. */
+const MAX_TASK_LENGTH = 2_000;
 async function main() {
-    const task = process.argv[2];
-    if (!task) {
+    const rawTask = process.argv[2];
+    if (!rawTask) {
         process.stderr.write('embed-worker: missing task argument\n');
         process.exit(2);
     }
+    // Cap the task to prevent OOM when an oversized string is passed to the embedding model.
+    const task = rawTask.length > MAX_TASK_LENGTH ? rawTask.slice(0, MAX_TASK_LENGTH) : rawTask;
     const { RouteLayer, ALL_ROUTES } = await import('@monomind/routing');
     const semantic = await createSemanticRouting(ALL_ROUTES);
     if (!semantic) {

package/packages/@monomind/cli/dist/src/routing/llm-caller.js

@@ -16,6 +16,8 @@ import { spawn, execSync } from 'child_process';
 import { tmpdir } from 'os';
 /** Default model for routing fallback — Haiku is fast and cheap for slug classification. */
 const DEFAULT_ROUTING_MODEL = 'haiku';
+/** Runtime-validated set of allowed model aliases. */
+const ALLOWED_MODELS = new Set(['haiku', 'sonnet', 'opus']);
 /**
  * Max time to wait for a single classification before giving up.
  * `claude --print` is a full headless session (cold start ~10s, can spike),
@@ -23,6 +25,8 @@ const DEFAULT_ROUTING_MODEL = 'haiku';
  * on timeout rather than blocking the caller.
  */
 const DEFAULT_TIMEOUT_MS = 45_000;
+/** Hard upper cap on caller-supplied timeoutMs — prevents disabling the SIGTERM/SIGKILL guard. */
+const MAX_TIMEOUT_MS = 120_000;
 /** Cap captured output so a runaway child can't grow parent memory unbounded. */
 const MAX_OUTPUT = 1024 * 1024; // 1 MB — a slug response is tiny
 let claudeAvailable = null;
@@ -49,8 +53,15 @@ export function isClaudeCodeAvailable() {
 export function createClaudeLLMCaller(options = {}) {
     if (!isClaudeCodeAvailable())
         return null;
-    const model = options.model ?? DEFAULT_ROUTING_MODEL;
-    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    // Runtime enum guard — TypeScript union is compile-time only; JS callers
+    // could otherwise inject an arbitrary string into the --model flag.
+    const rawModel = options.model ?? DEFAULT_ROUTING_MODEL;
+    const model = ALLOWED_MODELS.has(rawModel) ? rawModel : DEFAULT_ROUTING_MODEL;
+    // Cap caller-supplied timeout so a huge value can't disable the SIGTERM/SIGKILL guard.
+    const rawTimeout = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const timeoutMs = Math.min(typeof rawTimeout === 'number' && Number.isFinite(rawTimeout) && rawTimeout > 0
+        ? rawTimeout
+        : DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS);
     const cwd = options.cwd ?? tmpdir();
     return (prompt) => new Promise((resolve, reject) => {
         const env = { ...process.env };

package/packages/@monomind/cli/dist/src/routing/route-layer-factory.js

@@ -25,12 +25,20 @@ const WORKER_PATH = join(dirname(fileURLToPath(import.meta.url)), 'embed-worker.
 const WORKER_TIMEOUT_MS = 90_000;
 /** Cap worker stdout so a runaway child can't grow parent memory unbounded. */
 const MAX_WORKER_OUTPUT = 4 * 1024 * 1024; // 4 MB
+/** Cap the task string length to prevent OOM/DoS via oversized argv. */
+const MAX_TASK_LENGTH = 2_000;
+/** Cap stderr reflected in error messages to prevent log-inflation attacks. */
+const MAX_STDERR_IN_ERROR = 500;
+/** Cap allScores array passed to the LLM fallback to prevent downstream OOM. */
+const MAX_ALL_SCORES = 100;
 /** Marker the worker prefixes its result line with (see embed-worker.ts). */
 const RESULT_MARKER = '__ROUTE_RESULT__';
 /** Run the embedding worker for one task. Resolves the RouteResult, or rejects. */
 function runWorker(task) {
+    // Cap task length before passing as argv to prevent OOM/DoS via oversized args.
+    const safeTask = task.length > MAX_TASK_LENGTH ? task.slice(0, MAX_TASK_LENGTH) : task;
     return new Promise((resolve, reject) => {
-        const child = spawn(process.execPath, [WORKER_PATH, task], {
+        const child = spawn(process.execPath, [WORKER_PATH, safeTask], {
             stdio: ['ignore', 'pipe', 'pipe'],
             windowsHide: true,
         });
@@ -75,7 +83,10 @@ function runWorker(task) {
             settled = true;
             clearTimeout(timer);
             if (code !== 0) {
-                reject(new Error(stderr.trim() || `worker exited ${code}`));
+                // Truncate stderr before embedding in Error to prevent log-inflation via
+                // a malicious or runaway child writing oversized diagnostic output.
+                const stderrSnippet = stderr.trim().slice(0, MAX_STDERR_IN_ERROR);
+                reject(new Error(stderrSnippet || `worker exited ${code}`));
                 return;
             }
             // Extract the marked result line — model-loader output may have written
@@ -130,8 +141,12 @@ export async function createConfiguredRouteLayer(opts = {}) {
                 }
                 // 3. Below threshold → Claude fallback in the parent, reusing scores.
                 if (llmCaller && Array.isArray(semantic.allScores) && semantic.allScores.length) {
+                    // Cap allScores to prevent downstream OOM if the worker sends an oversized array.
+                    const scores = semantic.allScores.length > MAX_ALL_SCORES
+                        ? semantic.allScores.slice(0, MAX_ALL_SCORES)
+                        : semantic.allScores;
                     const fallback = new LLMFallbackRouter({ llmCaller, model: 'haiku' });
-                    return fallback.classify(taskDescription, ALL_ROUTES, semantic.allScores);
+                    return fallback.classify(taskDescription, ALL_ROUTES, scores);
                 }
                 if (!opts.debug)
                     delete semantic.allScores;

package/packages/@monomind/cli/dist/src/services/claim-service.d.ts

@@ -129,6 +129,7 @@ export declare class ClaimService extends EventEmitter {
     private eventLog;
     constructor(projectRoot: string, config?: Partial<ClaimServiceConfig>);
     initialize(): Promise<void>;
+    private static readonly MAX_CLAIMS_FILE_BYTES;
     private loadClaims;
     private _saveQueue;
     private saveClaims;

package/packages/@monomind/cli/dist/src/services/claim-service.js

@@ -57,10 +57,18 @@ export class ClaimService extends EventEmitter {
         // Load existing claims
         await this.loadClaims();
     }
+    // Hard cap on claims.json: a file larger than this is malformed or
+    // adversarially crafted (normal claim files are tiny).
+    static MAX_CLAIMS_FILE_BYTES = 10 * 1024 * 1024; // 10 MB
     async loadClaims() {
         const claimsFile = path.join(this.storagePath, 'claims.json');
         if (fs.existsSync(claimsFile)) {
             try {
+                const fileSize = fs.statSync(claimsFile).size;
+                if (fileSize > ClaimService.MAX_CLAIMS_FILE_BYTES) {
+                    // Oversized file — skip loading rather than OOM-ing the daemon
+                    return;
+                }
                 const data = JSON.parse(fs.readFileSync(claimsFile, 'utf-8'));
                 for (const claim of data.claims || []) {
                     claim.claimedAt = new Date(claim.claimedAt);

package/packages/@monomind/cli/dist/src/services/config-file-manager.js

@@ -3,6 +3,7 @@
  * Shared JSON config file persistence with atomic writes and Zod validation
  */
 import * as fs from 'fs';
+import * as os from 'os';
 import * as path from 'path';
 /** Config file search paths in priority order */
 const CONFIG_FILENAMES = [
@@ -123,7 +124,7 @@ export class ConfigFileManager {
      * drop the first writer's API key.
      */
     set(cwd, key, value) {
-        const KNOWN_SET_SECTIONS = new Set(['version', 'agents', 'swarm', 'memory', 'mcp', 'cli', 'hooks', 'neural']);
+        const KNOWN_SET_SECTIONS = new Set(['version', 'agents', 'swarm', 'memory', 'mcp', 'cli', 'hooks', 'neural', 'providers']);
         const topSection = String(key).split('.')[0];
         if (!KNOWN_SET_SECTIONS.has(topSection)) {
             throw new Error(`Unknown config section: "${topSection}". Allowed: ${[...KNOWN_SET_SECTIONS].join(', ')}`);
@@ -181,6 +182,17 @@ export class ConfigFileManager {
     /** Import config from a specific path */
     importFrom(cwd, importPath) {
         const resolved = path.resolve(cwd, importPath);
+        // Guard against path traversal: the resolved path must be within the
+        // project cwd or the user's home directory.  Without this check an
+        // automated script can pass "/etc/passwd" or "../../.env" and exfiltrate
+        // files outside the project tree.
+        const projectRoot = path.resolve(cwd);
+        const home = os.homedir();
+        const isUnderProject = resolved === projectRoot || resolved.startsWith(projectRoot + path.sep);
+        const isUnderHome = resolved === home || resolved.startsWith(home + path.sep);
+        if (!isUnderProject && !isUnderHome) {
+            throw new Error(`Import path must be within the project directory or home directory: ${resolved}`);
+        }
         if (!fs.existsSync(resolved)) {
             throw new Error(`Import file not found: ${resolved}`);
         }
@@ -199,7 +211,7 @@ export class ConfigFileManager {
         // KNOWN_SECTIONS only validates top-level keys, leaving nested
         // {agents:{providers:[{__proto__:{...}}]}} unsanitized.
         const imported = sanitizeConfigObject(importedRaw);
-        const KNOWN_SECTIONS = new Set(['version', 'agents', 'swarm', 'memory', 'mcp', 'cli', 'hooks']);
+        const KNOWN_SECTIONS = new Set(['version', 'agents', 'swarm', 'memory', 'mcp', 'cli', 'hooks', 'neural', 'providers']);
         for (const key of Object.keys(imported)) {
             if (!KNOWN_SECTIONS.has(key)) {
                 throw new Error(`Unknown config section: "${key}"`);

package/packages/@monomind/cli/dist/src/services/headless-worker-executor.js

@@ -1017,6 +1017,12 @@ Analyze the above codebase context and provide your response following the forma
             let stdout = '';
             let stderr = '';
             let resolved = false;
+            // Cap stdout + stderr to 10 MB each to prevent OOM if a spawned Claude
+            // Code process emits unexpectedly large output (e.g. a worker that dumps
+            // a large file listing).  Once the cap is reached we stop appending; the
+            // truncation marker lets callers detect that output was cut.
+            const MAX_HEADLESS_OUTPUT_BYTES = 10 * 1024 * 1024; // 10 MB
+            const TRUNCATION_MARKER = '\n[... output truncated at 10 MB ...]';
             const cleanup = () => {
                 clearTimeout(timeoutHandle);
                 clearTimeout(sigkillTimer);
@@ -1024,7 +1030,12 @@ Analyze the above codebase context and provide your response following the forma
             };
             child.stdout?.on('data', (data) => {
                 const chunk = data.toString();
-                stdout += chunk;
+                if (stdout.length < MAX_HEADLESS_OUTPUT_BYTES) {
+                    stdout += chunk;
+                    if (stdout.length >= MAX_HEADLESS_OUTPUT_BYTES) {
+                        stdout = stdout.slice(0, MAX_HEADLESS_OUTPUT_BYTES) + TRUNCATION_MARKER;
+                    }
+                }
                 this.emit('output', {
                     executionId: options.executionId,
                     type: 'stdout',
@@ -1033,7 +1044,12 @@ Analyze the above codebase context and provide your response following the forma
             });
             child.stderr?.on('data', (data) => {
                 const chunk = data.toString();
-                stderr += chunk;
+                if (stderr.length < MAX_HEADLESS_OUTPUT_BYTES) {
+                    stderr += chunk;
+                    if (stderr.length >= MAX_HEADLESS_OUTPUT_BYTES) {
+                        stderr = stderr.slice(0, MAX_HEADLESS_OUTPUT_BYTES) + TRUNCATION_MARKER;
+                    }
+                }
                 this.emit('output', {
                     executionId: options.executionId,
                     type: 'stderr',