monomind 1.11.14 → 1.13.0

package/.claude/skills/mastermind/runorg.md

@@ -244,9 +244,10 @@ runId              = new Date().toISOString()
 
 Also validate that every role has non-empty `id`, `title`, `agent_type`, and `responsibilities` (array). Abort with `status: blocked` listing any malformed role — do this before Step 3 initializes infrastructure.
 
-After the conceptual derivations above, extract them as real shell variables so downstream bash blocks can reference `$orgName`, `$sessionId`, etc.:
+After the conceptual derivations above, **run the ENTIRE Step 2 + Step 3 setup as a SINGLE Bash tool call** so all variables persist through infrastructure creation. Copy the full script below into one Bash call — do NOT split it across multiple calls:
 
 ```bash
+# ── STEP 2+3 COMBINED (must run as one Bash call — variables must persist) ──
 orgFile=".monomind/orgs/${org_name}.json"
 orgName=$(jq -r '.name' "$orgFile")
 goal="${task:-$(jq -r '.goal' "$orgFile")}"
@@ -266,71 +267,73 @@ board_id=$(jq -r '.board_id // empty' "$orgFile")
 todo_col=$(jq -r '.todo_col_id // empty' "$orgFile")
 doing_col=$(jq -r '.doing_col_id // empty' "$orgFile")
 done_col=$(jq -r '.done_col_id // empty' "$orgFile")
-runId=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-```
-
----
-
-## Step 3 — Initialize Org Infrastructure
-
-**Validate board IDs from org config:**
-
-The board and column IDs were written into the org config by `createorg`. If missing, the org was not created correctly.
+runId="run-$(date -u +%Y%m%dT%H%M%S)"
 
-```bash
-[ -z "$board_id" ]  && { echo "ERROR: org config missing board_id — re-run /mastermind:createorg --name ${orgName} to rebuild the org."; exit 1; }
-[ -z "$todo_col" ]  && { echo "ERROR: org config missing todo_col_id — re-run /mastermind:createorg --name ${orgName}."; exit 1; }
-[ -z "$doing_col" ] && { echo "ERROR: org config missing doing_col_id — re-run /mastermind:createorg --name ${orgName}."; exit 1; }
-[ -z "$done_col" ]  && { echo "ERROR: org config missing done_col_id — re-run /mastermind:createorg --name ${orgName}."; exit 1; }
-```
+# Validate board IDs (warning only — boss can still scan/fix code without a board)
+[ -z "$board_id" ] && echo "WARN: board_id missing from org config — task board commands will be skipped by boss"
 
-**Create stop-file and state directories:**
-```bash
+# Remove any stale stop file (MUST happen before boss spawns)
 mkdir -p .monomind/orgs/.stops
-```
+rm -f "$stopFile"
 
-**Initialize org state file** (tracks per-agent status, heartbeat timestamps, token usage):
-```bash
+# Initialize org state file
 stateFile=".monomind/orgs/${orgName}-state.json"
 if [ ! -f "$stateFile" ]; then
-  jq -n \
-    --arg org "$orgName" \
-    --arg runId "$runId" \
-    '{org:$org,run_id:$runId,started_at:(now|todate),agents:{}}' \
-    > "$stateFile"
+  jq -n --arg org "$orgName" --arg runId "$runId" \
+    '{org:$org,run_id:$runId,started_at:(now|todate),agents:{}}' > "$stateFile"
 else
-  # Update run_id and started_at for this run
   tmp="${stateFile}.tmp"
-  jq --arg runId "$runId" \
-     '.run_id = $runId | .started_at = (now|todate)' \
-     "$stateFile" > "$tmp" && mv "$tmp" "$stateFile"
+  jq --arg runId "$runId" '.run_id = $runId | .started_at = (now|todate)' \
+    "$stateFile" > "$tmp" && mv "$tmp" "$stateFile"
 fi
-```
 
-**Remove any stale stop file:**
-```bash
-rm -f "$stopFile"
+# Resolve git-safe monomind directory
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+CTRL_URL=$(jq -r '.url // "http://localhost:4242"' "$REPO_ROOT/.monomind/control.json" 2>/dev/null || echo "http://localhost:4242")
+GIT_COMMON=$(git rev-parse --git-common-dir 2>/dev/null || echo ".git")
+if [[ "$GIT_COMMON" != /* ]]; then GIT_COMMON="$REPO_ROOT/$GIT_COMMON"; fi
+GIT_COMMON="${GIT_COMMON%/}"
+MONO_DIR="${GIT_COMMON}/monomind"
+
+# Create run file and write run:start
+runDir="${MONO_DIR}/orgs/${orgName}/runs"
+mkdir -p "$runDir"
+runFile="${runDir}/${runId}.jsonl"
+jq -cn \
+  --arg runId "$runId" --arg org "$orgName" --arg goal "$goal" \
+  --arg bossRole "$bossRole_id" --arg proj "$REPO_ROOT" \
+  '{type:"run:start",runId:$runId,org:$org,orgName:$org,goal:$goal,bossRole:$bossRole,project:$proj,ts:(now*1000|floor)}' \
+  >> "$runFile"
+
+# Print resolved values so Step 4 can embed them in the boss prompt
+echo "ORG_VARS: orgName=${orgName} runId=${runId} sessionId=${sessionId} goal=${goal} bossRole_id=${bossRole_id} bossRole_title=${bossRole_title} bossRole_agent_type=${bossRole_agent_type} board_id=${board_id} todo_col=${todo_col} doing_col=${doing_col} done_col=${done_col} checkpointMin=${checkpointMin} memNs=${memNs} CTRL_URL=${CTRL_URL} MONO_DIR=${MONO_DIR} runFile=${runFile} REPO_ROOT=${REPO_ROOT}"
 ```
 
-**Emit `org:start` to dashboard:**
+After running the script above, read the `ORG_VARS:` line from its output and hold those values for Step 4 (embed them into the boss prompt as literals — **do not re-run bash to look them up**).
+
+---
+
+## Step 3 — Emit org:start (separate Bash call, re-derives from output)
+
+After the combined Step 2+3 script runs, emit `org:start` using the values printed by `ORG_VARS:`. Replace each `<X>` with the literal value from that line:
+
 ```bash
-REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-CTRL_URL=$(jq -r '.url // "http://localhost:4242"' "$REPO_ROOT/.monomind/control.json" 2>/dev/null || echo "http://localhost:4242")
-curl -s -X POST "${CTRL_URL}/api/mastermind/event" \
+curl -s -X POST "<CTRL_URL>/api/mastermind/event" \
   -H "Content-Type: application/json" \
   -d "$(jq -cn \
-    --arg session "$sessionId" \
-    --arg org "$orgName" \
-    --arg goal "$goal" \
-    --arg proj "$(pwd)" \
-    '{type:"org:start",session:$session,org:$org,goal:$goal,project:$proj,ts:(now*1000|floor)}')" || true
+    --arg session "<sessionId>" \
+    --arg org "<orgName>" \
+    --arg runId "<runId>" \
+    --arg goal "<goal>" \
+    --arg proj "<REPO_ROOT>" \
+    '{type:"org:start",session:$session,org:$org,runId:$runId,goal:$goal,project:$proj,ts:(now*1000|floor)}')" || true
 ```
 
 ---
 
 ## Step 4 — Spawn Boss Agent
 
-Using the variables derived in Step 2, spawn the boss agent via Task tool:
+Using the literal values from the `ORG_VARS:` output (not shell variables — they don't persist), spawn the boss agent via Task tool:
 
 ```javascript
 Task({
@@ -351,9 +354,9 @@ FULL COMMUNICATION TOPOLOGY:
 ${orgConfig.communication.map(e => `${e.from} → ${e.to} (${e.type})`).join('\n')}
 
 SHARED INFRASTRUCTURE:
-- Task board (monotask): board_id=${board_id}
-  Columns: Todo=${todo_col}  Doing=${doing_col}  Done=${done_col}
-- Memory namespace: ${memNs} (use: npx monomind@latest memory store/search --namespace ${memNs})
+- Task board (monotask): board_id=<board_id>
+  Columns: Todo=<todo_col>  Doing=<doing_col>  Done=<done_col>
+- Memory namespace: <memNs> (use: npx monomind@latest memory store/search --namespace <memNs>)
 - Dashboard events: POST to mastermind control server via curl — see CTRL_URL resolution in DASHBOARD EVENTS section below
 - Session ID for all events: ${sessionId}
 
@@ -429,52 +432,117 @@ APPROVAL GATE (when governance.policy is "board" or "strict"):
     sleep 30
   done
 
+DASHBOARD EVENT HELPER — resolve once at startup, reuse in every step:
+  REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+  CTRL_URL=$(jq -r '.url // "http://localhost:4242"' "$REPO_ROOT/.monomind/control.json" 2>/dev/null || echo "http://localhost:4242")
+  # Git-safe monomind dir — shared across all worktrees, survives branch switches:
+  GIT_COMMON=$(git rev-parse --git-common-dir 2>/dev/null || echo ".git")
+  # Resolve to absolute path (git returns relative ".git" for main checkout)
+  if [[ "$GIT_COMMON" != /* ]]; then GIT_COMMON="$REPO_ROOT/$GIT_COMMON"; fi
+  GIT_COMMON="${GIT_COMMON%/}"  # strip trailing slash if any
+  MONO_DIR="${GIT_COMMON}/monomind"
+  runFile="${MONO_DIR}/orgs/${orgName}/runs/${runId}.jsonl"
+
+⚠️  DASHBOARD EVENTS ARE MANDATORY — run every curl below exactly as written.
+    Do NOT skip, defer, or summarize. These keep the human-visible dashboard current.
+    Use Bash tool for all curl calls. Never use WebFetch (it doesn't support POST).
+    EVERY event MUST include runId:"${runId}" and org:"${orgName}" so the server routes it to the run file.
+
 STOP DETECTION (check this FIRST in every loop iteration):
   [ -f "${stopFile}" ] && echo STOP_REQUESTED
-If the file exists: emit org:complete event, clean up with "rm -f ${stopFile}", then exit.
+If the file exists: write run:complete to run file, emit org:complete via curl, then "rm -f ${stopFile}", then exit.
+  # REQUIRED — write run:complete directly to run file:
+  jq -cn --arg runId "${runId}" --arg org "${orgName}" \
+    '{type:"run:complete",runId:$runId,org:$org,status:"stopped",ts:(now*1000|floor)}' >> "${runFile}" || true
+  # REQUIRED — emit org:complete via curl (includes runId so it also gets appended):
+  curl -s -X POST "${CTRL_URL}/api/mastermind/event" -H "Content-Type: application/json" \
+    -d "$(jq -cn --arg s "${sessionId}" --arg o "${orgName}" --arg rid "${runId}" --arg p "$REPO_ROOT" \
+      '{type:"org:complete",session:$s,org:$o,runId:$rid,project:$p,ts:(now*1000|floor)}')" || true
 
 OPERATING LOOP:
-1. Check for stop signal (see above). Exit if found.
-2. List unclaimed Todo cards: monotask card list ${board_id} --col ${todo_col} --json | jq '[.[] | select(.labels | index("claimed") | not)]'
-3. For each Todo card without a "claimed" label, assign to the appropriate role based on its "role:<id>" label. Skip cards whose prerequisites (monotask card prerequisite list) are not yet in the Done column.
-4. Spawn the assigned role agent via Task tool (run_in_background: true) with:
-   - Full role briefing (title, responsibilities, who they report to, memory namespace)
-   - The specific card title and card_id to work on
-   - Move the card to Doing before spawning: monotask card move ${board_id} $CARD_ID ${doing_col}
-   - Add label "claimed" to the card
-   - Report output via: npx monomind@latest memory store --key "${memNs}:report:<card_id>" --namespace "${memNs}"
-   - When complete, move card to Done: monotask card move ${board_id} $CARD_ID ${done_col}
-   - Emit org:agent:online event to dashboard before starting (use curl, see below)
+1. Check for stop signal (above). Exit with run:complete + org:complete events if found.
+
+2. List unclaimed Todo cards:
+   monotask card list ${board_id} --col ${todo_col} --json | jq '[.[] | select(.labels | index("claimed") | not)]'
+
+3. For each unclaimed Todo card, assign to the appropriate role based on its "role:<id>" label.
+   Skip cards whose prerequisites are not yet in the Done column.
+
+4. For EACH role agent you are about to spawn — do these steps in order:
+   a) Move card to Doing and mark claimed:
+      monotask card move ${board_id} $CARD_ID ${doing_col}
+      monotask card label add ${board_id} $CARD_ID "claimed"
+   b) REQUIRED — emit org:comms to dashboard (include runId):
+      curl -s -X POST "${CTRL_URL}/api/mastermind/event" -H "Content-Type: application/json" \
+        -d "$(jq -cn --arg s "${sessionId}" --arg o "${orgName}" --arg rid "${runId}" --arg p "$REPO_ROOT" \
+          --arg role "<role_id>" --arg task "<card title>" \
+          '{type:"org:comms",session:$s,org:$o,runId:$rid,from:"boss",to:$role,msg:("Assigning: "+$task),project:$p,ts:(now*1000|floor)}')" || true
+   c) REQUIRED — emit org:agent:online before spawning (include runId):
+      curl -s -X POST "${CTRL_URL}/api/mastermind/event" -H "Content-Type: application/json" \
+        -d "$(jq -cn --arg s "${sessionId}" --arg o "${orgName}" --arg rid "${runId}" --arg p "$REPO_ROOT" \
+          --arg role "<role_id>" --arg title "<role title>" --arg at "<agent_type>" \
+          '{type:"org:agent:online",session:$s,org:$o,runId:$rid,role:$role,title:$title,agent_type:$at,project:$p,ts:(now*1000|floor)}')" || true
+   d) Spawn the agent via Task tool (run_in_background: true) with:
+      - Full role briefing (title, responsibilities, who they report to, memory namespace)
+      - The specific card title and card_id to work on
+      - Report output via: npx monomind@latest memory store --key "${memNs}:report:<card_id>" --namespace "${memNs}"
+      - When complete, move card to Done: monotask card move ${board_id} $CARD_ID ${done_col}
+      - REQUIRED: Include the following DASHBOARD EVENTS block verbatim in every specialist prompt so
+        they can emit their own events to the dashboard:
+
+        DASHBOARD EVENTS — emit these at the start and end of your work (REQUIRED):
+          REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          CTRL_URL=$(jq -r '.url // "http://localhost:4242"' "$REPO_ROOT/.monomind/control.json" 2>/dev/null || echo "http://localhost:4242")
+          GIT_COMMON=$(git rev-parse --git-common-dir 2>/dev/null || echo ".git")
+          if [[ "$GIT_COMMON" != /* ]]; then GIT_COMMON="$REPO_ROOT/$GIT_COMMON"; fi
+          GIT_COMMON="${GIT_COMMON%/}"
+          MONO_DIR="${GIT_COMMON}/monomind"
+          runFile="${MONO_DIR}/orgs/${orgName}/runs/${runId}.jsonl"
+          # On start — announce you are working:
+          curl -s -X POST "${CTRL_URL}/api/mastermind/event" -H "Content-Type: application/json" \
+            -d "$(jq -cn --arg s "${sessionId}" --arg o "${orgName}" --arg rid "${runId}" \
+              --arg from "<role_id>" --arg msg "Starting: <card title>" \
+              '{type:"org:comms",session:$s,org:$o,runId:$rid,from:$from,to:"boss",msg:$msg,ts:(now*1000|floor)}')" || true
+          # On completion — report back:
+          curl -s -X POST "${CTRL_URL}/api/mastermind/event" -H "Content-Type: application/json" \
+            -d "$(jq -cn --arg s "${sessionId}" --arg o "${orgName}" --arg rid "${runId}" \
+              --arg from "<role_id>" --arg msg "Completed: <one-sentence summary of output>" \
+              '{type:"org:comms",session:$s,org:$o,runId:$rid,from:$from,to:"boss",msg:$msg,ts:(now*1000|floor)}')" || true
+
+        Fill in the literal values for orgName="${orgName}", runId="${runId}", sessionId="${sessionId}" — embed them
+        directly in the prompt string so the specialist doesn't need to resolve them.
+
 5. Collect completed results from memory (search "${memNs}:report:")
-6. Synthesize reports, make decisions, create new cards in Todo column based on progress toward goal
-7. Write a run-completion entry to the activity log (used by the health dashboard for 7-day success rate):
-   activityFile=".monomind/orgs/${orgName}-activity.jsonl"
-   # Count Todo cards not yet claimed as the pending_tasks metric
+
+6. Synthesize reports, make decisions, create new cards in Todo column based on progress toward goal.
+   REQUIRED — after each decision, emit org:comms (include runId):
+   curl -s -X POST "${CTRL_URL}/api/mastermind/event" -H "Content-Type: application/json" \
+     -d "$(jq -cn --arg s "${sessionId}" --arg o "${orgName}" --arg rid "${runId}" --arg p "$REPO_ROOT" \
+       --arg msg "<one-sentence summary of decision or finding>" \
+       '{type:"org:comms",session:$s,org:$o,runId:$rid,from:"boss",to:"all",msg:$msg,project:$p,ts:(now*1000|floor)}')" || true
+
+7. Write cycle-complete entry (directly to run file AND to activity log):
    pending_count=$(monotask card list ${board_id} --col ${todo_col} --json 2>/dev/null | jq '[.[] | select(.labels | index("claimed") | not)] | length' 2>/dev/null || echo 0)
-   echo "{\"type\":\"run:complete\",\"org\":\"${orgName}\",\"ts\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"pending\":${pending_count:-0}}" >> "$activityFile"
-   (On error/exception, write: {"type":"run:error","ts":"...", "org":"..."})
-8. Emit org:checkpoint event with progress summary
-9. Wait ${checkpointMin} minutes, then loop back to step 1
+   jq -cn --arg runId "${runId}" --arg org "${orgName}" --argjson pend "${pending_count:-0}" \
+     '{type:"run:cycle:complete",runId:$runId,org:$org,pending:$pend,ts:(now*1000|floor)}' >> "${runFile}" || true
+   activityFile=".monomind/orgs/${orgName}-activity.jsonl"
+   echo "{\"type\":\"run:cycle:complete\",\"org\":\"${orgName}\",\"runId\":\"${runId}\",\"ts\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"pending\":${pending_count:-0}}" >> "$activityFile" 2>/dev/null || true
+
+8. REQUIRED — emit org:checkpoint with a one-sentence progress summary (include runId):
+   curl -s -X POST "${CTRL_URL}/api/mastermind/event" -H "Content-Type: application/json" \
+     -d "$(jq -cn --arg s "${sessionId}" --arg o "${orgName}" --arg rid "${runId}" --arg p "$REPO_ROOT" \
+       --arg prog "<one sentence: what was done this cycle and what is next>" \
+       --argjson pend "${pending_count:-0}" \
+       '{type:"org:checkpoint",session:$s,org:$o,runId:$rid,progress:$prog,pending_tasks:$pend,project:$p,ts:(now*1000|floor)}')" || true
+
+9. Wait ${checkpointMin} minutes, then loop back to step 1.
 
 AGENT TYPES FOR YOUR TEAM:
 ${orgConfig.roles.filter(r => r.id !== bossRole.id).map(r =>
   `• ${r.title}: subagent_type="${r.agent_type}"`
 ).join('\n')}
 
-DASHBOARD EVENTS — emit via curl (NOT WebFetch — WebFetch does not support POST):
-  REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-  CTRL_URL=$(jq -r '.url // "http://localhost:4242"' "$REPO_ROOT/.monomind/control.json" 2>/dev/null || echo "http://localhost:4242")
-  curl -s -X POST "${CTRL_URL}/api/mastermind/event" \
-    -H "Content-Type: application/json" \
-    -d "$(jq -cn --arg type TYPE --arg session SESSION --arg org ORG --arg proj "$REPO_ROOT" '{type:$type,session:$session,org:$org,project:$proj,ts:(now*1000|floor)}')"
-Payloads:
-- org:agent:online → add fields: role, title, agent_type
-- org:comms → add fields: from, to, msg
-- org:checkpoint → add fields: progress, pending_tasks
-- org:complete → no additional fields
-Note: always include project:$REPO_ROOT in all event payloads for correct multi-project SSE filtering
-
-START NOW: check for stop signal, assess the board, create initial tasks if none exist, then begin the operating loop.`
+START NOW: resolve CTRL_URL, check for stop signal, assess the board, create initial tasks if none exist, then begin the operating loop.`
 })
 ```
 
@@ -485,21 +553,20 @@ START NOW: check for stop signal, assess the board, create initial tasks if none
 Emit `org:agent:online` for the boss role (team member events are emitted by the boss itself):
 
 ```bash
-REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-CTRL_URL=$(jq -r '.url // "http://localhost:4242"' "$REPO_ROOT/.monomind/control.json" 2>/dev/null || echo "http://localhost:4242")
 curl -s -X POST "${CTRL_URL}/api/mastermind/event" \
   -H "Content-Type: application/json" \
   -d "$(jq -cn \
     --arg session "$sessionId" \
     --arg org "$orgName" \
+    --arg runId "$runId" \
     --arg role "$bossRole_id" \
     --arg title "$bossRole_title" \
     --arg agent_type "$bossRole_agent_type" \
     --arg proj "$REPO_ROOT" \
-    '{type:"org:agent:online",session:$session,org:$org,role:$role,title:$title,agent_type:$agent_type,project:$proj,ts:(now*1000|floor)}')" || true
+    '{type:"org:agent:online",session:$session,org:$org,runId:$runId,role:$role,title:$title,agent_type:$agent_type,project:$proj,ts:(now*1000|floor)}')" || true
 ```
 
-(Use the scalar string variables `$bossRole_id`, `$bossRole_title`, `$bossRole_agent_type` derived by extracting fields from `bossRole` before constructing the curl call.)
+(Use the scalar string variables `$bossRole_id`, `$bossRole_title`, `$bossRole_agent_type` derived by extracting fields from `bossRole` before constructing the curl call. `CTRL_URL`, `MONO_DIR`, and `runId` were resolved in Step 3 — reuse those variables.)
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "monomind",
-  "version": "1.11.14",
+  "version": "1.13.0",
   "description": "Monomind - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",
@@ -56,12 +56,29 @@
   },
   "dependencies": {
     "semver": "^7.6.0",
-    "@monoes/monograph": "^1.2.0"
+    "@monoes/monograph": "^1.1.0"
   },
   "overrides": {
-    "hono": ">=4.11.4"
+    "hono": ">=4.12.21",
+    "ws": ">=8.20.1",
+    "axios": ">=1.16.0",
+    "qs": ">=6.15.2",
+    "esbuild": ">=0.28.1",
+    "protobufjs": ">=7.5.8",
+    "@protobufjs/utf8": ">=1.1.1",
+    "@grpc/grpc-js": ">=1.14.4"
   },
   "pnpm": {
+    "overrides": {
+      "hono": ">=4.12.21",
+      "ws": ">=8.20.1",
+      "axios": ">=1.16.0",
+      "qs": ">=6.15.2",
+      "esbuild": ">=0.28.1",
+      "protobufjs": ">=7.5.8",
+      "@protobufjs/utf8": ">=1.1.1",
+      "@grpc/grpc-js": ">=1.14.4"
+    },
     "peerDependencyRules": {
       "allowedVersions": {
         "tree-sitter": "0.22.4",

package/packages/@monomind/cli/dist/src/agents/registry-builder.js

@@ -160,6 +160,8 @@ export function buildUnifiedRegistry(roots, outputPath) {
         for (const file of files) {
             let content;
             try {
+                if (statSync(file).size > 512 * 1024)
+                    continue; // skip files > 512 KB
                 content = readFileSync(file, 'utf-8');
             }
             catch {

package/packages/@monomind/cli/dist/src/autopilot-state.js

@@ -19,6 +19,8 @@ export const LOG_FILE = `${STATE_DIR}/autopilot-log.json`;
 const MAX_HISTORY_ENTRIES = 50;
 /** Maximum entries kept in the event log */
 const MAX_LOG_ENTRIES = 1000;
+/** Maximum bytes before refusing to load a state/log JSON file (10 MB) */
+const MAX_STATE_FILE_BYTES = 10 * 1024 * 1024;
 /** Allowlist for valid task sources */
 export const VALID_TASK_SOURCES = new Set(['team-tasks', 'swarm-tasks', 'file-checklist']);
 /** Terminal task statuses */
@@ -91,7 +93,7 @@ export function loadState() {
     const filePath = path.resolve(STATE_FILE);
     const defaults = getDefaultState();
     try {
-        if (fs.existsSync(filePath)) {
+        if (fs.existsSync(filePath) && fs.statSync(filePath).size <= MAX_STATE_FILE_BYTES) {
             const raw = safeJsonParse(fs.readFileSync(filePath, 'utf-8'));
             const merged = { ...defaults, ...raw };
             // Re-validate fields that could be tampered with
@@ -190,7 +192,7 @@ function compactLog(filePath) {
 export function loadLog() {
     const filePath = path.resolve(LOG_FILE);
     try {
-        if (fs.existsSync(filePath)) {
+        if (fs.existsSync(filePath) && fs.statSync(filePath).size <= MAX_STATE_FILE_BYTES) {
             const raw = fs.readFileSync(filePath, 'utf-8');
             // Backward compatible: support both old JSON-array form and the new
             // append-only NDJSON form. Prefer NDJSON if the file looks line-based.
@@ -236,7 +238,10 @@ export function discoverTasks(sources) {
                         const files = fs.readdirSync(teamDir).filter((f) => f.endsWith('.json'));
                         for (const file of files) {
                             try {
-                                const data = safeJsonParse(fs.readFileSync(path.join(teamDir, file), 'utf-8'));
+                                const taskFilePath = path.join(teamDir, file);
+                                if (fs.statSync(taskFilePath).size > MAX_STATE_FILE_BYTES)
+                                    continue;
+                                const data = safeJsonParse(fs.readFileSync(taskFilePath, 'utf-8'));
                                 tasks.push({
                                     id: String(data.id || file.replace('.json', '')),
                                     subject: String(data.subject || data.title || file),
@@ -254,7 +259,7 @@ export function discoverTasks(sources) {
         if (source === 'swarm-tasks') {
             const swarmFile = path.resolve('.monomind/swarm-tasks.json');
             try {
-                if (fs.existsSync(swarmFile)) {
+                if (fs.existsSync(swarmFile) && fs.statSync(swarmFile).size <= MAX_STATE_FILE_BYTES) {
                     const data = safeJsonParse(fs.readFileSync(swarmFile, 'utf-8'));
                     const swarmTasks = Array.isArray(data) ? data : (data.tasks || []);
                     for (const t of swarmTasks) {
@@ -275,7 +280,7 @@ export function discoverTasks(sources) {
         if (source === 'file-checklist') {
             const checklistFile = path.resolve('.monomind/data/checklist.json');
             try {
-                if (fs.existsSync(checklistFile)) {
+                if (fs.existsSync(checklistFile) && fs.statSync(checklistFile).size <= MAX_STATE_FILE_BYTES) {
                     const data = safeJsonParse(fs.readFileSync(checklistFile, 'utf-8'));
                     const items = Array.isArray(data) ? data : (data.items || []);
                     for (const item of items) {

package/packages/@monomind/cli/dist/src/benchmarks/benchmark-runner.js

@@ -23,9 +23,22 @@ export class BenchmarkRunner {
         if (!fs.existsSync(resolved)) {
             return benchmarks;
         }
+        const MAX_BENCH_FILE_SIZE = 1 * 1024 * 1024; // 1 MB per benchmark file
         const files = fs.readdirSync(resolved).filter((f) => f.endsWith('.json'));
         for (const file of files) {
             const filePath = path.join(resolved, file);
+            // Guard against OOM: reject symlinks and oversized files before reading
+            let stat;
+            try {
+                stat = fs.lstatSync(filePath);
+            }
+            catch {
+                continue;
+            }
+            if (stat.isSymbolicLink())
+                continue;
+            if (stat.size > MAX_BENCH_FILE_SIZE)
+                continue;
             const raw = fs.readFileSync(filePath, 'utf-8');
             try {
                 const parsed = JSON.parse(raw);

package/packages/@monomind/cli/dist/src/benchmarks/metric-evaluators.js

@@ -6,15 +6,17 @@
  * Checks whether the output contains the expected substring.
  */
 export function containsExpected(output, config) {
-    const found = output.includes(config.expected);
+    // Cap expected to prevent huge strings from inflating returned objects
+    const expected = typeof config.expected === 'string' ? config.expected.slice(0, 200) : '';
+    const found = output.includes(expected);
     return {
         type: 'contains_expected',
         passed: found,
-        actual: found ? config.expected : null,
-        expected: config.expected,
+        actual: found ? expected : null,
+        expected,
         message: found
-            ? `Output contains expected string "${config.expected}"`
-            : `Output missing expected string "${config.expected}"`,
+            ? `Output contains expected string "${expected}"`
+            : `Output missing expected string "${expected}"`,
     };
 }
 /**
@@ -38,16 +40,20 @@ export function lengthRange(output, config) {
  */
 export function noHallucination(output, config) {
     const lowerOutput = output.toLowerCase();
-    const found = config.forbidden.filter((word) => lowerOutput.includes(word.toLowerCase()));
+    // Cap forbidden array to 200 entries to prevent unbounded O(n) scan
+    const forbidden = Array.isArray(config.forbidden) ? config.forbidden.slice(0, 200) : [];
+    const found = forbidden.filter((word) => typeof word === 'string' && lowerOutput.includes(word.toLowerCase()));
     const passed = found.length === 0;
+    // Truncate reflected words to avoid inflated messages
+    const truncatedFound = found.map((w) => w.slice(0, 50));
     return {
         type: 'no_hallucination',
         passed,
-        actual: found.length > 0 ? found : null,
+        actual: found.length > 0 ? truncatedFound : null,
         expected: null,
         message: passed
             ? 'No forbidden words found in output'
-            : `Forbidden words found: ${found.join(', ')}`,
+            : `Forbidden words found: ${truncatedFound.join(', ')}`,
     };
 }
 /**
@@ -56,8 +62,13 @@ export function noHallucination(output, config) {
 export function jsonValid(output) {
     let passed = false;
     let parsedType = null;
+    // Cap output before JSON.parse to prevent OOM on huge strings
+    const MAX_JSON_BYTES = 1 * 1024 * 1024; // 1 MB
+    const bounded = typeof output === 'string' && output.length > MAX_JSON_BYTES
+        ? output.slice(0, MAX_JSON_BYTES)
+        : output;
     try {
-        const parsed = JSON.parse(output);
+        const parsed = JSON.parse(bounded);
         passed = true;
         parsedType = typeof parsed;
     }

package/packages/@monomind/cli/dist/src/browser/actions.js

@@ -20,7 +20,8 @@ export async function clickElement(client, sessionId, ref, options = {}) {
 }
 export async function clickPoint(client, sessionId, x, y, options = {}) {
     const button = options.button ?? 'left';
-    const clickCount = options.clickCount ?? 1;
+    // Cap clickCount to prevent unbounded loop DoS
+    const clickCount = Math.min(Math.max(1, Math.floor(options.clickCount ?? 1)), 100);
     const modifiers = options.modifiers ?? 0;
     const shared = { x, y, button, modifiers };
     const buttonsMask = button === 'right' ? 2 : button === 'middle' ? 4 : 1;
@@ -69,7 +70,9 @@ export async function fillElement(client, sessionId, ref, value) {
     await typeText(client, sessionId, value);
 }
 export async function typeText(client, sessionId, text) {
-    await client.send('Input.insertText', { text }, sessionId);
+    // Cap to 100 KB to prevent OOM in CDP message serializer
+    const safeText = text.length > 102_400 ? text.slice(0, 102_400) : text;
+    await client.send('Input.insertText', { text: safeText }, sessionId);
 }
 export async function pressKeyCombo(client, sessionId, key, modifiers) {
     const { text: _text, ...keyInfo } = resolveKey(key);
@@ -184,6 +187,8 @@ function resolveKey(key) {
     return { key, code: key };
 }
 export async function scrollElement(client, sessionId, direction, amount = 300, ref) {
+    // Cap scroll amount to prevent extreme delta values
+    amount = Math.min(Math.max(1, Math.floor(amount)), 100_000);
     let x = 0;
     let y = 0;
     let deltaX = 0;
@@ -351,7 +356,9 @@ export async function readClipboard(client, sessionId) {
     return result;
 }
 export async function writeClipboard(client, sessionId, text) {
-    await evaluateJs(client, sessionId, `navigator.clipboard.writeText(${JSON.stringify(text)})`);
+    // Cap to 100 KB to prevent OOM when serializing the CDP expression
+    const safeText = text.length > 102_400 ? text.slice(0, 102_400) : text;
+    await evaluateJs(client, sessionId, `navigator.clipboard.writeText(${JSON.stringify(safeText)})`);
 }
 export async function pushState(client, sessionId, url) {
     // Try Next.js router first, then fallback to history.pushState

package/packages/@monomind/cli/dist/src/browser/browser.js

@@ -41,7 +41,12 @@ export async function isPortOpen(port) {
     }
 }
 export async function launchBrowser(config = {}) {
-    const port = config.port ?? DEFAULT_PORT;
+    const rawPort = config.port ?? DEFAULT_PORT;
+    // Validate port is in a safe range for localhost CDP debugging
+    if (!Number.isInteger(rawPort) || rawPort < 1024 || rawPort > 65535) {
+        throw new Error(`Invalid port: ${rawPort}. Must be an integer between 1024 and 65535.`);
+    }
+    const port = rawPort;
     if (await isPortOpen(port)) {
         return port;
     }
@@ -69,7 +74,9 @@ export async function launchBrowser(config = {}) {
     if (config.headless !== false) {
         defaultArgs.push('--headless=new');
     }
-    const args = [...defaultArgs, ...(config.args ?? [])];
+    // Cap caller-supplied args to prevent memory exhaustion via huge argument arrays
+    const callerArgs = (config.args ?? []).slice(0, 50);
+    const args = [...defaultArgs, ...callerArgs];
     const child = spawn(chromePath, args, {
         detached: true,
         stdio: 'ignore',
@@ -122,6 +129,9 @@ export async function connectToTarget(port, targetId) {
     return { client, target, sessionId };
 }
 export async function openUrl(client, sessionId, url) {
+    // Cap to 2 MB to prevent OOM in CDP message serializer (e.g. data: URI attacks)
+    if (url.length > 2_097_152)
+        throw new Error('URL exceeds 2 MB limit');
     await client.send('Page.navigate', { url }, sessionId);
     await waitForNetworkIdle(client, sessionId, 500, 30_000);
 }