monomind 1.16.6 → 1.16.7

package/packages/@monomind/cli/.claude/skills/mastermind/env.md

@@ -0,0 +1,198 @@
+---
+name: mastermind-env
+description: Mastermind env — audit and configure the runtime environment for an org. Shows LLM provider config, memory backend, agent JWT settings, logging, and storage — highlighting missing or misconfigured values.
+type: domain-skill
+default_mode: auto
+---
+
+# Mastermind Env
+
+This skill is invoked by `mastermind:env` or directly via `/mastermind:env`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block
+- `org_name`: org to inspect env for
+- `action`: show | set | validate
+- `key`: env var key to set (for set action)
+- `value`: value to set (for set action — use env var reference, not inline secrets)
+- `section`: llm | memory | jwt | logging | storage | all (default: all)
+- `caller`: command | master
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Load Org Config
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+[ ! -f "$orgFile" ] && { echo "ERROR: Org '$org_name' not found."; exit 1; }
+
+memNs="org:${org_name}"
+```
+
+---
+
+## Step 2 — Execute Action
+
+### show (default)
+
+Collect and display environment configuration for this org's agents:
+
+```bash
+echo "╔══════════════════════════════════════════════════════╗"
+echo "║  ENV AUDIT — org: ${org_name}"
+echo "╚══════════════════════════════════════════════════════╝"
+echo ""
+
+# LLM / Adapter config
+echo "LLM PROVIDER"
+echo "────────────"
+ceo_model=$(jq -r '.run_config.ceo_adapter // "claude-sonnet-4-6"' "$orgFile")
+echo "  CEO adapter model:  $ceo_model"
+jq -r '(.roles // [])[] | "  \(.id): \(.adapter_config.model // "inherited from CEO")"' "$orgFile" 2>/dev/null
+echo ""
+
+# API key availability (check env vars, never print values)
+echo "API KEYS (present/missing)"
+echo "──────────────────────────"
+for key in ANTHROPIC_API_KEY OPENAI_API_KEY GOOGLE_API_KEY; do
+  if [ -n "${!key}" ]; then
+    echo "  $key: ✓ present (${!key:0:6}***)"
+  elif [ -f ".monomind/orgs/.secrets/${org_name}/${key}" ]; then
+    echo "  $key: ✓ in org secrets"
+  else
+    echo "  $key: ✗ MISSING"
+  fi
+done
+echo ""
+
+# Memory config
+echo "MEMORY"
+echo "──────"
+echo "  namespace: org:${org_name}"
+npx monomind@latest memory list --namespace "org:${org_name}" 2>/dev/null | wc -l | xargs echo "  stored entries:"
+echo ""
+
+# Board config
+echo "TASK BOARD"
+echo "──────────"
+board_id=$(jq -r '.board_id // "NOT CONFIGURED"' "$orgFile")
+echo "  board_id:    $board_id"
+echo "  todo_col:    $(jq -r '.todo_col_id // "NOT CONFIGURED"' "$orgFile")"
+echo "  doing_col:   $(jq -r '.doing_col_id // "NOT CONFIGURED"' "$orgFile")"
+echo "  done_col:    $(jq -r '.done_col_id // "NOT CONFIGURED"' "$orgFile")"
+echo ""
+
+# Run config
+echo "RUN CONFIG"
+echo "──────────"
+jq -r '.run_config | to_entries[] | "  \(.key): \(.value)"' "$orgFile" 2>/dev/null
+echo ""
+
+# Governance
+echo "GOVERNANCE"
+echo "──────────"
+jq -r '"  policy: \(.governance.policy // "auto")"' "$orgFile" 2>/dev/null
+echo ""
+
+# Dashboard
+echo "DASHBOARD"
+echo "─────────"
+CTRL_URL=$(jq -r '.url // "http://localhost:4242"' ".monomind/control.json" 2>/dev/null || echo "http://localhost:4242")
+echo "  url:    $CTRL_URL"
+curl -s "${CTRL_URL}/api/health" >/dev/null 2>&1 && echo "  status: ✓ reachable" || echo "  status: ✗ not reachable"
+```
+
+### validate
+
+Run a preflight check before starting an org run:
+
+```bash
+echo "PREFLIGHT CHECK — org: $org_name"
+errors=0
+
+# Check all required env vars
+for key in ANTHROPIC_API_KEY; do
+  if [ -z "${!key}" ] && [ ! -f ".monomind/orgs/.secrets/${org_name}/${key}" ]; then
+    echo "  ✗ MISSING: $key"
+    errors=$((errors + 1))
+  else
+    echo "  ✓ $key"
+  fi
+done
+
+# Check board IDs
+board_id=$(jq -r '.board_id // empty' "$orgFile")
+[ -z "$board_id" ] && { echo "  ✗ MISSING: board_id — run /mastermind:createorg to rebuild"; errors=$((errors + 1)); } || echo "  ✓ board_id"
+
+# Check roles
+role_count=$(jq '.roles | length' "$orgFile")
+[ "$role_count" -eq 0 ] && { echo "  ✗ MISSING: no roles defined"; errors=$((errors + 1)); } || echo "  ✓ $role_count roles"
+
+# Summary
+echo ""
+if [ "$errors" -eq 0 ]; then
+  echo "✓ All checks passed — org is ready to run."
+else
+  echo "✗ $errors issue(s) found — resolve before running."
+fi
+```
+
+### set
+
+Update a run_config key or governance field in the org JSON:
+
+```bash
+# Only allow safe keys — never set arbitrary JSON to prevent injection
+allowed_keys="checkpoint_interval_min max_concurrent_agents budget_tokens alert_threshold ceo_adapter"
+echo "$allowed_keys" | grep -qw "$key" || { echo "ERROR: Key '$key' not settable via this command. Edit $orgFile directly."; exit 1; }
+
+tmp="${orgFile}.tmp"
+jq --arg key "$key" --arg value "$value" \
+   '.run_config[$key] = ($value | if test("^[0-9]+$") then tonumber else . end)' \
+   "$orgFile" > "$tmp" && mv "$tmp" "$orgFile"
+echo "Set run_config.$key = $value"
+```
+
+---
+
+## Agent Environment Template
+
+When spawning agents, include this env block in their prompt:
+
+```bash
+# CEO/boss agent env block (prepend to all boss prompts):
+echo "ENVIRONMENT:
+  Memory namespace: org:${orgName}
+  Dashboard: ${CTRL_URL}
+  Budget: $(jq -r '.run_config.budget_tokens // "unlimited"' "$orgFile") tokens
+  Governance: $(jq -r '.governance.policy // "auto"' "$orgFile")
+  ANTHROPIC_API_KEY: $([ -n "$ANTHROPIC_API_KEY" ] && echo "present" || echo "missing — check org secrets")
+"
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name>
+validation_errors: <N>
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.

package/packages/@monomind/cli/.claude/skills/mastermind/environments.md

@@ -0,0 +1,250 @@
+---
+name: mastermind-environments
+description: Mastermind environments — manage execution environments (local, SSH, sandbox) for an org. Controls where agent workloads run, SSH connection details, and which environment is the default.
+type: domain-skill
+default_mode: confirm
+---
+
+# Mastermind Environments
+
+This skill is invoked by `mastermind:environments` or directly via `/mastermind:environments`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block (injected by command, or loaded below if standalone)
+- `org_name`: org to manage environments for (required)
+- `action`: list | create | edit | delete | probe | set-default
+- `env_id`: environment id (required for edit/delete/probe/set-default)
+- `kind`: local | ssh | sandbox (required for create)
+- `name`: display name (required for create)
+- `host`: SSH hostname or IP (required for ssh kind)
+- `port`: SSH port (default 22)
+- `user`: SSH username (required for ssh kind)
+- `secret_ref`: secret name holding the SSH private key (see mastermind:secrets — NEVER pass raw key values)
+- `work_dir`: remote working directory (default: /tmp/monomind)
+- `caller`: command | master
+
+---
+
+## Security Constraints
+
+- NEVER print SSH private key values
+- NEVER store key material in environment JSON files — store only the secret_ref name
+- SSH keys must be stored via `mastermind:secrets` and referenced by name only
+- Probe connection is read-only (runs `echo ok` over SSH)
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Load Environments File
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+[ ! -f "$orgFile" ] && { echo "ERROR: Org '${org_name}' not found."; exit 1; }
+
+envFile=".monomind/orgs/${org_name}-environments.json"
+[ ! -f "$envFile" ] && cat > "$envFile" <<'EOF'
+{"environments":[],"default_env":null}
+EOF
+```
+
+---
+
+## Step 2 — Execute Action
+
+### list (default)
+
+```bash
+echo "ENVIRONMENTS — org: $org_name"
+echo "────────────────────────────────────────────────────────"
+printf "%-20s %-10s %-28s %-8s %s\n" "ID" "KIND" "HOST / PATH" "DEFAULT" "SECRET REF"
+echo "────────────────────────────────────────────────────────"
+
+defaultEnv=$(jq -r '.default_env // "none"' "$envFile")
+count=$(jq '.environments | length' "$envFile")
+
+if [ "$count" -eq 0 ]; then
+  echo "  No environments. Use --action create to add one."
+else
+  jq -r --arg def "$defaultEnv" '(.environments // [])[] |
+    [
+      .id,
+      (.kind // "local"),
+      (if .kind == "ssh" then ((.user // "?") + "@" + (.host // "?") + ":" + ((.port // 22) | tostring)) else (.work_dir // "(local)") end),
+      (if .id == $def then "yes" else "-" end),
+      (.secret_ref // "-")
+    ] | @tsv' "$envFile" | while IFS=$'\t' read -r id kind loc def sref; do
+    printf "%-20s %-10s %-28s %-8s %s\n" "$id" "$kind" "$loc" "$def" "$sref"
+  done
+fi
+
+echo ""
+echo "Total: $count environment(s)  |  Default: $defaultEnv"
+```
+
+### create
+
+```bash
+[ -z "$kind" ] && { echo "ERROR: --kind required (local|ssh|sandbox)."; exit 1; }
+[ -z "$name" ] && { echo "ERROR: --name required."; exit 1; }
+case "$kind" in local|ssh|sandbox) : ;; *)
+  echo "ERROR: --kind must be local, ssh, or sandbox"; exit 1 ;;
+esac
+if [ "$kind" = "ssh" ]; then
+  [ -z "$host" ] && { echo "ERROR: --host required for ssh kind."; exit 1; }
+  [ -z "$user" ] && { echo "ERROR: --user required for ssh kind."; exit 1; }
+  [ -z "$secret_ref" ] && { echo "WARNING: No --secret-ref supplied. SSH key must be pre-configured on the agent."; }
+fi
+
+envId=$(echo "${name}" | tr '[:upper:]' '[:lower:]' | tr -cs 'a-z0-9' '-' | sed 's/^-//;s/-$//')
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+tmp="${envFile}.tmp"
+jq --arg id "$envId" \
+   --arg n "$name" \
+   --arg kind "$kind" \
+   --arg host "${host:-}" \
+   --argjson port "${port:-22}" \
+   --arg user "${user:-}" \
+   --arg sref "${secret_ref:-}" \
+   --arg wdir "${work_dir:-/tmp/monomind}" \
+   --arg ts "$ts" \
+  '.environments = [(.environments // [])[] | select(.id != $id)] +
+   [{"id":$id,"name":$n,"kind":$kind,
+     "host":(if $host != "" then $host else null end),
+     "port":(if $host != "" then $port else null end),
+     "user":(if $user != "" then $user else null end),
+     "secret_ref":(if $sref != "" then $sref else null end),
+     "work_dir":$wdir,
+     "createdAt":$ts,"lastProbe":null,"probeStatus":null}]' \
+  "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+
+echo "Created environment: $envId (kind: $kind)"
+[ "$kind" = "ssh" ] && echo "  SSH: ${user}@${host}:${port:-22}  key ref: ${secret_ref:-(none)}"
+echo "Run --action probe --env-id $envId to verify connectivity."
+```
+
+### edit
+
+```bash
+[ -z "$env_id" ] && { echo "ERROR: --env-id required."; exit 1; }
+exists=$(jq --arg id "$env_id" '[(.environments // [])[] | select(.id == $id)] | length' "$envFile")
+[ "$exists" -eq 0 ] && { echo "ERROR: Environment '$env_id' not found."; exit 1; }
+
+tmp="${envFile}.tmp"
+jq --arg id "$env_id" \
+   --arg host "${host:-}" \
+   --argjson port "${port:-0}" \
+   --arg user "${user:-}" \
+   --arg sref "${secret_ref:-}" \
+   --arg wdir "${work_dir:-}" \
+  '.environments = [(.environments // [])[] | if .id == $id then
+     . *
+     (if $host != "" then {"host":$host} else {} end) *
+     (if $port > 0 then {"port":$port} else {} end) *
+     (if $user != "" then {"user":$user} else {} end) *
+     (if $sref != "" then {"secret_ref":$sref} else {} end) *
+     (if $wdir != "" then {"work_dir":$wdir} else {} end)
+   else . end]' \
+  "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+
+echo "Updated environment: $env_id"
+```
+
+### delete
+
+```bash
+[ -z "$env_id" ] && { echo "ERROR: --env-id required."; exit 1; }
+tmp="${envFile}.tmp"
+jq --arg id "$env_id" \
+  '.environments = [(.environments // [])[] | select(.id != $id)] |
+   if .default_env == $id then .default_env = null else . end' \
+  "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+echo "Deleted environment: $env_id"
+```
+
+### probe
+
+```bash
+[ -z "$env_id" ] && { echo "ERROR: --env-id required."; exit 1; }
+envData=$(jq -r --arg id "$env_id" '(.environments // [])[] | select(.id == $id)' "$envFile")
+[ -z "$envData" ] && { echo "ERROR: Environment '$env_id' not found."; exit 1; }
+
+kind=$(echo "$envData" | jq -r '.kind')
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+case "$kind" in
+  local)
+    if [ -d "$(echo "$envData" | jq -r '.work_dir // "/tmp/monomind"')" ]; then
+      status="ok"
+    else
+      status="unreachable"
+    fi
+    ;;
+  ssh)
+    sshHost=$(echo "$envData" | jq -r '.host')
+    sshUser=$(echo "$envData" | jq -r '.user')
+    sshPort=$(echo "$envData" | jq -r '.port // 22')
+    sref=$(echo "$envData" | jq -r '.secret_ref // ""')
+    keyPath=""
+    [ -n "$sref" ] && keyPath=$(cat ".monomind/orgs/.secrets/${org_name}/${sref}" 2>/dev/null | jq -r '.path // ""' 2>/dev/null || echo "")
+    
+    if [ -n "$keyPath" ] && [ -f "$keyPath" ]; then
+      result=$(ssh -i "$keyPath" -p "$sshPort" -o ConnectTimeout=5 -o StrictHostKeyChecking=no \
+        "${sshUser}@${sshHost}" "echo ok" 2>&1)
+    else
+      result=$(ssh -p "$sshPort" -o ConnectTimeout=5 -o StrictHostKeyChecking=no \
+        "${sshUser}@${sshHost}" "echo ok" 2>&1)
+    fi
+    [ "$result" = "ok" ] && status="ok" || status="unreachable"
+    ;;
+  sandbox)
+    status="unknown"
+    ;;
+esac
+
+tmp="${envFile}.tmp"
+jq --arg id "$env_id" --arg st "$status" --arg ts "$ts" \
+  '.environments = [(.environments // [])[] | if .id == $id then .probeStatus = $st | .lastProbe = $ts else . end]' \
+  "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+
+echo "Probe [$env_id]: $status  (checked at $ts)"
+```
+
+### set-default
+
+```bash
+[ -z "$env_id" ] && { echo "ERROR: --env-id required."; exit 1; }
+exists=$(jq --arg id "$env_id" '[(.environments // [])[] | select(.id == $id)] | length' "$envFile")
+[ "$exists" -eq 0 ] && { echo "ERROR: Environment '$env_id' not found."; exit 1; }
+
+tmp="${envFile}.tmp"
+jq --arg id "$env_id" '.default_env = $id' "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+echo "Default environment → $env_id"
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name>
+environments_count: <N>
+default_env: <id or null>
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.

package/packages/@monomind/cli/.claude/skills/mastermind/execute.md

@@ -0,0 +1,104 @@
+---
+name: mastermind-execute
+description: Load a written implementation plan, review it critically, execute all tasks step by step, and hand off to mastermind:finish when complete.
+type: domain-skill
+default_mode: confirm
+---
+
+# Mastermind Execute
+
+Load plan, review critically, execute all tasks, report when complete.
+
+**Announce at start:** "I'm using the mastermind:execute skill to implement this plan."
+
+**Note:** This skill works best with subagent support (Claude Code). When subagents are available, prefer `Skill("mastermind:taskdev")` for parallel task execution.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block (injected by master, or loaded standalone via _protocol.md brain load)
+- `plan_path`: path to the plan file to execute
+- `project_name`: monotask space name
+- `board_id`: monotask board ID
+- `mode`: auto | confirm
+
+---
+
+## The Process
+
+### Step 1: Load and Review Plan
+
+1. Read the plan file at `plan_path`
+2. Review critically — identify any questions or concerns:
+   - Missing dependencies or prerequisites
+   - Ambiguous instructions
+   - Steps that contradict each other
+   - Verifications that cannot be run
+3. If concerns exist: raise them with the user before starting
+4. If no concerns: create a TodoWrite with each task and proceed
+
+### Step 2: Execute Tasks
+
+For each task in the plan:
+
+1. Mark as `in_progress`
+2. Follow each step exactly — the plan has bite-sized steps; do not skip or reorder
+3. Run verifications as specified in the plan
+4. Mark as `completed`
+
+When the plan references skills:
+- `mastermind:taskdev` → invoke `Skill("mastermind:taskdev")`
+- `mastermind:verify` → invoke `Skill("mastermind:verify")`
+- Any other `mastermind:*` skill → invoke `Skill("mastermind:<name>")`
+
+### Step 3: Complete Development
+
+After all tasks complete and are verified:
+
+- Announce: "All tasks complete. Handing off to mastermind:finish."
+- **REQUIRED SUB-SKILL:** invoke `Skill("mastermind:finish")`
+- Follow that skill to verify tests, present options, and execute the chosen finish action
+
+---
+
+## When to Stop and Ask for Help
+
+**STOP executing immediately when:**
+- A blocker is encountered (missing dependency, failing test, unclear instruction)
+- The plan has critical gaps preventing a task from starting
+- An instruction cannot be understood without guessing
+- A verification fails repeatedly (more than twice)
+
+**Ask for clarification rather than guessing.** Never invent steps not in the plan.
+
+---
+
+## When to Revisit Earlier Steps
+
+**Return to Step 1 (Review) when:**
+- The user updates the plan based on feedback
+- A fundamental approach needs rethinking due to new information
+
+**Do not force through blockers.** Stop and ask.
+
+---
+
+## Rules
+
+- Review the plan critically before touching any code
+- Follow plan steps exactly — do not improvise
+- Do not skip verifications
+- Reference skills when the plan says to invoke them
+- Stop when blocked; never guess
+- Never start implementation on `main` or `master` without explicit user consent
+
+---
+
+## Integration
+
+**Skills used by this skill:**
+- `Skill("mastermind:plan")` — creates the plan this skill executes
+- `Skill("mastermind:taskdev")` — subagent-driven parallel task execution (preferred for complex plans)
+- `Skill("mastermind:finish")` — complete the development branch after all tasks
+- `Skill("mastermind:verify")` — verification gate before finishing