monomind 1.16.6 → 1.16.8

package/packages/@monomind/cli/.claude/helpers/handlers/gates-handler.cjs

@@ -0,0 +1,138 @@
+/**
+ * Enforcement Gates Handler
+ *
+ * Inline gate logic for PreToolUse hooks — no ESM/package dependency.
+ *
+ * Patterns are an INTENTIONAL SUPERSET of @monomind/guidance/src/gates.ts defaults:
+ *   - All categories from DEFAULT_GATE_CONFIG are covered here
+ *   - Many patterns are enhanced (e.g. --force-with-lease, -fr reversed flags, broader kubectl)
+ *   - Key thresholds MUST stay aligned: password/secret min length = 8 chars (both files)
+ *
+ * When updating patterns in gates.ts, check whether the corresponding pattern here
+ * also needs updating — and vice versa.
+ *
+ * Gates enforced at runtime:
+ *   pre-bash  → destructive-ops  (require-confirmation → block)
+ *   pre-write → secrets          (block)
+ */
+
+'use strict';
+
+// ─── Patterns (superset of DEFAULT_GATE_CONFIG in gates.ts) ──────────────────
+
+const DESTRUCTIVE_PATTERNS = [
+  /\brm\s+(?:-[a-z]*f[a-z]*r|-[a-z]*r[a-z]*f|--recursive.*--force|--force.*--recursive|-rf?)\b/i,
+  /\bdrop\s+(database|table|schema|index|view|function|procedure)\b/i,
+  /\btruncate\s+table\b/i,
+  /\bgit\s+push\s+(?:.*\s)?(?:--force(?:-with-lease)?|-[a-z]*f)\b/i,
+  /\bgit\s+reset\s+--hard\b/i,
+  /\bgit\s+clean\s+.*-f/i,
+  /\bformat\s+[a-z]:/i,
+  /\bdel\s+\/[sf]\b/i,
+  /\b(?:kubectl|helm)\s+delete\b.*\b(?:--all|namespace|all)\b/i,
+  /\bDELETE\s+FROM\s+\w+/i,
+  /\bALTER\s+TABLE\s+\w+\s+DROP\b/i,
+];
+
+const SECRET_PATTERNS = [
+  /(?:api[_-]?key|apikey)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
+  /(?:secret|password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
+  /(?:token|bearer)\s*[:=]\s*['"][^'"]{10,}['"]/gi,
+  /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g,
+  /sk-[a-zA-Z0-9]{20,}/g,
+  /ghp_[a-zA-Z0-9]{36}/g,
+  /npm_[a-zA-Z0-9]{36}/g,
+  /AKIA[0-9A-Z]{16}/g,
+];
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+function redact(match) {
+  return match.length > 12
+    ? match.slice(0, 4) + '*'.repeat(match.length - 8) + match.slice(-4)
+    : '*'.repeat(match.length);
+}
+
+function checkDestructive(command) {
+  for (const pattern of DESTRUCTIVE_PATTERNS) {
+    pattern.lastIndex = 0;
+    const match = pattern.exec(command);
+    if (match) {
+      return {
+        triggered: true,
+        matched: match[0],
+        reason: `Destructive operation detected: "${match[0]}". Confirm this is intentional and document a rollback plan before proceeding.`,
+      };
+    }
+  }
+  return { triggered: false };
+}
+
+function checkSecrets(content) {
+  const found = [];
+  for (const pattern of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    const matches = content.match(pattern);
+    if (matches) {
+      for (const m of matches) found.push(redact(m));
+    }
+  }
+  if (found.length === 0) return { triggered: false };
+  return {
+    triggered: true,
+    count: found.length,
+    redacted: found,
+    reason: `Potential secret(s) detected in file content (${found.length} match${found.length > 1 ? 'es' : ''}): ${found.join(', ')}. Move secrets to environment variables or a .env file (add to .gitignore).`,
+  };
+}
+
+// ─── Hook handlers ────────────────────────────────────────────────────────────
+
+/**
+ * pre-bash: check for destructive shell commands.
+ * Outputs Claude Code block decision to stdout when triggered.
+ */
+function handlePreBash(hCtx) {
+  var cmd = (hCtx.toolInput && (hCtx.toolInput.command || hCtx.toolInput.cmd)) || '';
+  if (!cmd) return;
+
+  var result = checkDestructive(cmd);
+  if (result.triggered) {
+    // Output block decision and set exit code 2 — both required by Claude Code PreToolUse protocol
+    console.log(JSON.stringify({
+      decision: 'block',
+      reason: '[gates] ' + result.reason,
+    }));
+    process.exitCode = 2;
+  }
+}
+
+/**
+ * pre-write: check for secrets in Write / Edit / MultiEdit content before it lands on disk.
+ * Outputs Claude Code block decision to stdout when triggered.
+ */
+function handlePreWrite(hCtx) {
+  var toolInput = hCtx.toolInput || {};
+  // Write: toolInput.content — Edit: toolInput.new_string
+  // MultiEdit: toolInput.edits is an array of { old_string, new_string }
+  var content = toolInput.content || toolInput.new_string || '';
+  if (!content && Array.isArray(toolInput.edits)) {
+    content = toolInput.edits.map(function(e) { return e.new_string || ''; }).join('\n');
+  }
+  if (!content || typeof content !== 'string') return;
+  // Cap content at 512 KiB before regex scanning to prevent DoS
+  var MAX_SCAN = 524288;
+  if (content.length > MAX_SCAN) content = content.slice(0, MAX_SCAN);
+
+  var result = checkSecrets(content);
+  if (result.triggered) {
+    // Output block decision and set exit code 2 — both required by Claude Code PreToolUse protocol
+    console.log(JSON.stringify({
+      decision: 'block',
+      reason: '[gates] ' + result.reason,
+    }));
+    process.exitCode = 2;
+  }
+}
+
+module.exports = { handlePreBash, handlePreWrite, checkDestructive, checkSecrets };

package/packages/@monomind/cli/.claude/helpers/handlers/graph-status-handler.cjs

@@ -0,0 +1,45 @@
+'use strict';
+// Extracted from hook-handler.cjs — handles 'graph-status' command.
+// Shows monograph node/edge counts and graph-vs-grep usage ratio.
+// Receives hCtx from dispatcher. See route-handler.cjs for hCtx field docs.
+
+const path = require('path');
+const fs = require('fs');
+
+module.exports = {
+  handle: function(hCtx) {
+    var CWD = hCtx.CWD;
+    var _openMonographDb = hCtx._openMonographDb;
+
+    var db = _openMonographDb();
+    if (!db) {
+      console.log('No monograph.db found. Run /mastermind:understand to build.');
+      return;
+    }
+    try {
+      var n = db.prepare("SELECT COUNT(*) AS c FROM nodes").get().c;
+      var e = db.prepare("SELECT COUNT(*) AS c FROM edges").get().c;
+      var usage = (function() {
+        try {
+          var gup = path.join(CWD, '.monomind', 'metrics', 'graph-usage.json');
+          var MAX_USAGE = 64 * 1024; // 64 KiB
+          if (fs.statSync(gup).size > MAX_USAGE) return {};
+          return JSON.parse(fs.readFileSync(gup, 'utf-8'));
+        }
+        catch (_) { return {}; }
+      })();
+      function safeNum(v) { var n = Number(v); return isFinite(n) ? n : 0; }
+      var wins = safeNum(usage.monograph_call) + safeNum(usage.preresolve_hit)
+               + safeNum(usage.graph_assist_search) + safeNum(usage.graph_assist_neighbors);
+      var search = safeNum(usage.grep_call) + safeNum(usage.glob_call)
+                 + safeNum(usage.bash_grep_call) + safeNum(usage.bash_find_call);
+      var total = wins + search + safeNum(usage.preresolve_miss);
+      var pct = total > 0 ? Math.round((wins / total) * 100) : 0;
+      var saved = safeNum(usage.dollars_saved);
+      console.log('Monograph: ' + n.toLocaleString() + ' nodes · ' + e.toLocaleString() + ' edges');
+      console.log('Usage: ' + pct + '% graph · ' + (100 - pct) + '% grep · ' +
+                  'wins=' + wins + ' search=' + search +
+                  (saved > 0 ? ' · saved $' + saved.toFixed(2) : ''));
+    } catch (err) { console.log('Error: ' + String(err.message || err).slice(0, 200)); }
+  },
+};

package/packages/@monomind/cli/.claude/helpers/handlers/loops-status-handler.cjs

@@ -0,0 +1,48 @@
+'use strict';
+// Extracted from hook-handler.cjs — handles 'loops-status' command.
+
+const path = require('path');
+const fs = require('fs');
+
+module.exports = {
+  handle: function(hCtx) {
+    var CWD = hCtx.CWD;
+    var loopsDir = path.join(CWD, '.monomind', 'loops');
+    if (!fs.existsSync(loopsDir)) { console.log('No loops directory.'); return; }
+    var files = fs.readdirSync(loopsDir).filter(function(f) {
+      return f.endsWith('.json') && !f.includes('-hil') && !f.endsWith('.stop');
+    }).slice(0, 200); // cap to prevent DoS via many files
+    var STALE_MS = 6 * 60 * 60 * 1000;
+    var now = Date.now();
+    var active = [], stale = [];
+    files.forEach(function(f) {
+      try {
+        var fPath = path.join(loopsDir, f);
+        var fSt = fs.statSync(fPath);
+        if (fSt.size > 65536) { return; } // skip oversized loop files
+        var d = JSON.parse(fs.readFileSync(fPath, 'utf-8'));
+        var last = d.lastRunAt || d.startedAt || 0;
+        var ageMs = last ? (now - last) : Infinity;
+        if (ageMs > STALE_MS) stale.push({ d: d, ageH: Math.round(ageMs / 3600000) });
+        else active.push(d);
+      } catch (_) {}
+    });
+    if (active.length === 0 && stale.length === 0) {
+      console.log('No loops.'); return;
+    }
+    if (active.length > 0) {
+      console.log('Active (' + active.length + '):');
+      active.forEach(function(d) {
+        console.log('  · ' + (d.command || '?') + ' [' + (d.type || '?') + '] run ' + (d.currentRep || 0) +
+                    (d.maxReps ? '/' + d.maxReps : '') + ' · ' + (d.status || '?'));
+      });
+    }
+    if (stale.length > 0) {
+      console.log('Stale (' + stale.length + ' >6h):');
+      stale.forEach(function(s) {
+        console.log('  · ' + (s.d.command || '?') + ' run ' + (s.d.currentRep || 0) +
+                    ' · ' + s.ageH + 'h ago · ' + (s.d.status || '?'));
+      });
+    }
+  },
+};