monomind 1.17.0 → 1.17.1

package/.claude/agents/engineering/engineering-security-engineer.md

@@ -24,7 +24,7 @@ capability:
   model_preference: opus
   termination: All identified vulnerabilities have remediation steps documented
   triggers:
-    - pattern: "\\b(auth|jwt|session|oauth|saml|oidc|csrf|xss|sql.injection|ssrf|rce|lfi)\\b"
+    - pattern: "\\b(jwt|oauth|saml|oidc|csrf|xss|sql.injection|ssrf|rce|lfi|session\\W{0,3}(hijack|fixation|token\\W{0,3}theft)\\w*|auth\\w*\\W{0,3}(bypass|bug|vuln|flaw|exploit)\\w*)\\b"
       mode: "inject"
     - pattern: "CVE-\\d{4}-\\d+"
       mode: "inject"

package/.claude/commands/mastermind/_repeat.md

@@ -325,6 +325,8 @@ RECENT_HIL=$(find . -maxdepth 3 \( -name "humaninloop*.md" -o -name "humaninloop
 
 **Skip this section if `tillend_mode` is not true.** Proceed to section 5.
 
+**`LOOP_ASYNC_PENDING` escape hatch:** If the calling skill set `LOOP_ASYNC_PENDING=true` before invoking the postamble (because it spawned background agents whose results have not yet arrived in this turn), skip the empty-round check entirely — treat this round as non-empty and go directly to section 6 to schedule the next run. The next scheduled run will evaluate results from the agents that are currently in-flight. Output: `[tillend] Async work in flight — deferring empty-round check to run <next_rep>.`
+
 After each run in tillend mode, evaluate whether this run produced **zero findings and zero actions**. The loop stops only when a complete round finds nothing new and makes no changes — not when the AI predicts there is nothing left.
 
 **You (the AI running the loop) must now assess your own output from this run.** Answer these two questions:
@@ -459,6 +461,8 @@ curl -s -X POST "${CTRL_URL}/api/mastermind/event" \
 
 ## Notes for Calling Commands
 
+- **Async agents in loop mode**: In `--repeat` or `--tillend` mode, all subagents MUST be synchronous (`run_in_background: false` or omitted). The postamble's empty-round check runs in the same turn as the command — background agents complete in a later turn and their output is invisible to the check. If a skill must go async (e.g. it needs to spawn a long-running agent), set `LOOP_ASYNC_PENDING=true` before invoking the postamble; section 4 will skip the empty-round check and schedule the next run unconditionally. The next run will then evaluate the results.
+- **Loop state is durable across turns**: The counter and all loop parameters survive across `ScheduleWakeup` fires via two mechanisms: (1) `--rep <N> --loop <ID>` is re-encoded in every ScheduleWakeup prompt, and (2) the `.monomind/loops/<ID>.json` file stores current state persistently. There is no in-memory counter — the counter is always re-read from the prompt flags or the file.
 - **`<command_slug>`**: lowercase command name without namespace (`build` for `/mastermind:build`, `mastermind-idea` for `/mastermind:idea`)
 - **Dashboard**: the monomind panel reads `.monomind/loops/*.json`; `type` field is `"repeat"` or `"tillend"`; HIL status shows as `"hil:pending"`
 - **Stopping a loop**: create `.monomind/loops/${LOOP_ID}.stop` or delete the `.json` file; the next wake-up detects it

package/.claude/commands/mastermind/master.md

@@ -347,6 +347,21 @@ curl -s -o /dev/null -X POST "${CTRL_URL}/api/mastermind/event" \
     '{type:"session:start",session:$sid,prompt:$prompt,mode:$mode,project:$proj,ts:(now*1000|floor)}')" || true
 ```
 
+### Step 3.5 — Design Gate
+
+<HARD-GATE>
+STOP before Step 4. If `domains_needed` includes `build` (or any code/feature/fix work):
+
+1. Invoke `Skill("mastermind:design")` NOW — pass `resolved_prompt` as the task description
+2. Do NOT write any code, do NOT spawn any domain managers, do NOT proceed to Step 4 until the design skill returns with an approved spec
+3. When design returns: save the approved spec as `build_spec` in `current.json`
+4. Only then continue to Step 4
+
+If `domains_needed` contains ONLY non-build domains (marketing, sales, research, content, ops, finance, idea): skip this gate and go directly to Step 4.
+
+Rationale: without a design gate, master spawns agents before the user has confirmed what to build. The design gate replicates the superpowers workflow: questions → approaches → spec approval → plan → execute.
+</HARD-GATE>
+
 ### Step 4 — Decompose
 
 For each domain in `domains_needed`, assess complexity:
@@ -423,7 +438,39 @@ If mode = confirm: show plan and wait for user response. Valid responses:
 - Any modification (e.g. "add sales domain", "remove marketing") — apply the change, re-show the plan, wait again
 - "cancel" or "stop" — emit `session:complete` with `status: blocked`, reason "cancelled by user", then STOP
 
-If mode = auto: proceed immediately.
+After the user says "go" (and `build` is in `domains_needed`), ask once:
+> "For the build work: **subagents** (recommended — fresh agent per task with 2-stage review, like mastermind:taskdev) or **inline** (direct execution, mastermind:execute)?"
+
+- "subagents" → `build_exec_mode = "taskdev"`
+- "inline" → `build_exec_mode = "execute"`
+- No answer / skipped → `build_exec_mode = "taskdev"` (default)
+
+If mode = auto: `build_exec_mode = "taskdev"` (default).
+
+**Persist `build_exec_mode` to `current.json`** (required — Phase C reads it from there):
+
+```bash
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+_get_mono_dir() {
+  local w="${1:-$(pwd)}"
+  if [ -d "$w/.git" ]; then echo "$w/.git/monomind"; return; fi
+  if [ -f "$w/.git" ]; then
+    local m; m=$(grep '^gitdir:' "$w/.git" | sed 's/gitdir: *//')
+    [ -z "$m" ] && { echo "$w/.monomind"; return; }
+    [[ "$m" != /* ]] && m="$w/$m"
+    echo "$(dirname "$(dirname "$m")")/monomind"; return
+  fi
+  echo "$w/.monomind"
+}
+MONO_DIR=$(_get_mono_dir "$REPO_ROOT")
+SESSION_STATE="$MONO_DIR/sessions/current.json"
+# LLM: replace EXEC_MODE_VALUE with the resolved value: taskdev or execute
+build_exec_mode="EXEC_MODE_VALUE"
+[ "$build_exec_mode" = "EXEC_MODE_VALUE" ] && build_exec_mode="taskdev"
+jq --arg m "$build_exec_mode" '. + {build_exec_mode: $m}' \
+  "$SESSION_STATE" > "$SESSION_STATE.tmp" && mv "$SESSION_STATE.tmp" "$SESSION_STATE"
+echo "build_exec_mode=$build_exec_mode written to current.json"
+```
 
 ### Step 6 — Monotask Setup
 
@@ -678,12 +725,15 @@ for domain in $(jq -r '.domains_needed[]? // empty' "$SESSION_STATE" | grep -v '
   if [ -z "$board_id" ]; then
     echo "WARN: DOMAIN=$domain has no board_id — Step 6 may not have run or monotask is missing. Task agent will run without board tracking."
   fi
+  exec_mode=""
+  [ "$domain" = "build" ] && exec_mode=$(jq -r '.build_exec_mode // "taskdev"' "$SESSION_STATE")
   echo "DOMAIN=$domain \
 MANAGER=$(jq -r --arg d "$domain" '.domain_managers[$d] // "coordinator"' "$SESSION_STATE") \
 BOARD=$board_id \
 TODO=$(jq -r --arg d "$domain" '.todo_cols[$d] // ""' "$SESSION_STATE") \
 DOING=$(jq -r --arg d "$domain" '.doing_cols[$d] // ""' "$SESSION_STATE") \
 DONE=$(jq -r --arg d "$domain" '.done_cols[$d] // ""' "$SESSION_STATE") \
+EXEC_MODE=$exec_mode \
 GOAL=$(jq -r --arg d "$domain" '.domain_goals[$d] // .prompt' "$SESSION_STATE" | tr -d '\n')"
 done
 ```
@@ -698,6 +748,7 @@ Each Task call must include a complete briefing following the Monotask Task Brie
 - Instruction to create monotask cards directly using `monotask card create $BOARD_ID $COL_TODO_ID "<title>" --json` for all sub-tasks
 - Instruction to use `Skill("mastermind:do")` to execute tasks (Task agents have Skill tool access — do NOT use slash command syntax)
 - Instruction to spawn specialized agents using the domain-appropriate swarm topology
+- **For the `build` domain only:** include `build_exec_mode` (value: `"taskdev"` or `"execute"`) and instruct the manager: "Use `Skill("mastermind:taskdev")` if build_exec_mode is `taskdev`, or `Skill("mastermind:execute")` if `execute`. This was chosen by the user in Step 5."
 - Instruction to return the unified output schema when done
 
 Example Task call for Development Manager. Substitute all **pre-known** `<…>` placeholders (project_name, SESSION_ID, board/col IDs, goals, manager name) before calling Task. Placeholders like `<status>`, `<path1>`, `<action1>` are filled at runtime by the spawned agent — do not attempt to substitute them. `subagent_type` is the **string value** of `$domain_manager_build` (e.g. `"Backend Architect"`), not a variable reference.

package/.claude/scheduled_tasks.lock

@@ -1 +1 @@
-{"sessionId":"db24c21a-e929-4aba-911b-4cdb7fc5c3d5","pid":2346,"procStart":"Wed Jun 24 16:31:36 2026","acquiredAt":1782380072591}
+{"sessionId":"361cc64c-bfbe-4774-a739-e3b982e26b21","pid":85888,"procStart":"Thu Jul  2 11:48:13 2026","acquiredAt":1782999721096}

package/.claude/skills/mastermind/_repeat.md

@@ -27,6 +27,8 @@ If the stop file exists:
 
 ## Step 2 — Tillend termination check (tillend mode only — skip for fixed-count)
 
+**`LOOP_ASYNC_PENDING` escape hatch:** If the calling skill set `LOOP_ASYNC_PENDING=true` before invoking this postamble (because it spawned background agents whose results have not yet arrived), skip the empty-round check and go directly to Step 4 to schedule the next run. Output: `[tillend] Async work in flight — deferring empty-round check to run <next_rep>.`
+
 Evaluate now whether this run produced **zero findings AND zero actions**:
 
 - **Findings**: issues found, problems detected, items flagged, security vulnerabilities, tasks discovered, errors reported

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "monomind",
-  "version": "1.17.0",
+  "version": "1.17.1",
   "description": "Monomind - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/packages/@monomind/cli/.claude/agents/engineering/engineering-security-engineer.md

@@ -24,7 +24,7 @@ capability:
   model_preference: opus
   termination: All identified vulnerabilities have remediation steps documented
   triggers:
-    - pattern: "\\b(auth|jwt|session|oauth|saml|oidc|csrf|xss|sql.injection|ssrf|rce|lfi)\\b"
+    - pattern: "\\b(jwt|oauth|saml|oidc|csrf|xss|sql.injection|ssrf|rce|lfi|session\\W{0,3}(hijack|fixation|token\\W{0,3}theft)\\w*|auth\\w*\\W{0,3}(bypass|bug|vuln|flaw|exploit)\\w*)\\b"
       mode: "inject"
     - pattern: "CVE-\\d{4}-\\d+"
       mode: "inject"

package/packages/@monomind/cli/.claude/commands/mastermind/_repeat.md

@@ -325,6 +325,8 @@ RECENT_HIL=$(find . -maxdepth 3 \( -name "humaninloop*.md" -o -name "humaninloop
 
 **Skip this section if `tillend_mode` is not true.** Proceed to section 5.
 
+**`LOOP_ASYNC_PENDING` escape hatch:** If the calling skill set `LOOP_ASYNC_PENDING=true` before invoking the postamble (because it spawned background agents whose results have not yet arrived in this turn), skip the empty-round check entirely — treat this round as non-empty and go directly to section 6 to schedule the next run. The next scheduled run will evaluate results from the agents that are currently in-flight. Output: `[tillend] Async work in flight — deferring empty-round check to run <next_rep>.`
+
 After each run in tillend mode, evaluate whether this run produced **zero findings and zero actions**. The loop stops only when a complete round finds nothing new and makes no changes — not when the AI predicts there is nothing left.
 
 **You (the AI running the loop) must now assess your own output from this run.** Answer these two questions:
@@ -459,6 +461,8 @@ curl -s -X POST "${CTRL_URL}/api/mastermind/event" \
 
 ## Notes for Calling Commands
 
+- **Async agents in loop mode**: In `--repeat` or `--tillend` mode, all subagents MUST be synchronous (`run_in_background: false` or omitted). The postamble's empty-round check runs in the same turn as the command — background agents complete in a later turn and their output is invisible to the check. If a skill must go async (e.g. it needs to spawn a long-running agent), set `LOOP_ASYNC_PENDING=true` before invoking the postamble; section 4 will skip the empty-round check and schedule the next run unconditionally. The next run will then evaluate the results.
+- **Loop state is durable across turns**: The counter and all loop parameters survive across `ScheduleWakeup` fires via two mechanisms: (1) `--rep <N> --loop <ID>` is re-encoded in every ScheduleWakeup prompt, and (2) the `.monomind/loops/<ID>.json` file stores current state persistently. There is no in-memory counter — the counter is always re-read from the prompt flags or the file.
 - **`<command_slug>`**: lowercase command name without namespace (`build` for `/mastermind:build`, `mastermind-idea` for `/mastermind:idea`)
 - **Dashboard**: the monomind panel reads `.monomind/loops/*.json`; `type` field is `"repeat"` or `"tillend"`; HIL status shows as `"hil:pending"`
 - **Stopping a loop**: create `.monomind/loops/${LOOP_ID}.stop` or delete the `.json` file; the next wake-up detects it

package/packages/@monomind/cli/.claude/commands/mastermind/master.md

@@ -347,6 +347,21 @@ curl -s -o /dev/null -X POST "${CTRL_URL}/api/mastermind/event" \
     '{type:"session:start",session:$sid,prompt:$prompt,mode:$mode,project:$proj,ts:(now*1000|floor)}')" || true
 ```
 
+### Step 3.5 — Design Gate
+
+<HARD-GATE>
+STOP before Step 4. If `domains_needed` includes `build` (or any code/feature/fix work):
+
+1. Invoke `Skill("mastermind:design")` NOW — pass `resolved_prompt` as the task description
+2. Do NOT write any code, do NOT spawn any domain managers, do NOT proceed to Step 4 until the design skill returns with an approved spec
+3. When design returns: save the approved spec as `build_spec` in `current.json`
+4. Only then continue to Step 4
+
+If `domains_needed` contains ONLY non-build domains (marketing, sales, research, content, ops, finance, idea): skip this gate and go directly to Step 4.
+
+Rationale: without a design gate, master spawns agents before the user has confirmed what to build. The design gate replicates the superpowers workflow: questions → approaches → spec approval → plan → execute.
+</HARD-GATE>
+
 ### Step 4 — Decompose
 
 For each domain in `domains_needed`, assess complexity:
@@ -423,7 +438,39 @@ If mode = confirm: show plan and wait for user response. Valid responses:
 - Any modification (e.g. "add sales domain", "remove marketing") — apply the change, re-show the plan, wait again
 - "cancel" or "stop" — emit `session:complete` with `status: blocked`, reason "cancelled by user", then STOP
 
-If mode = auto: proceed immediately.
+After the user says "go" (and `build` is in `domains_needed`), ask once:
+> "For the build work: **subagents** (recommended — fresh agent per task with 2-stage review, like mastermind:taskdev) or **inline** (direct execution, mastermind:execute)?"
+
+- "subagents" → `build_exec_mode = "taskdev"`
+- "inline" → `build_exec_mode = "execute"`
+- No answer / skipped → `build_exec_mode = "taskdev"` (default)
+
+If mode = auto: `build_exec_mode = "taskdev"` (default).
+
+**Persist `build_exec_mode` to `current.json`** (required — Phase C reads it from there):
+
+```bash
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+_get_mono_dir() {
+  local w="${1:-$(pwd)}"
+  if [ -d "$w/.git" ]; then echo "$w/.git/monomind"; return; fi
+  if [ -f "$w/.git" ]; then
+    local m; m=$(grep '^gitdir:' "$w/.git" | sed 's/gitdir: *//')
+    [ -z "$m" ] && { echo "$w/.monomind"; return; }
+    [[ "$m" != /* ]] && m="$w/$m"
+    echo "$(dirname "$(dirname "$m")")/monomind"; return
+  fi
+  echo "$w/.monomind"
+}
+MONO_DIR=$(_get_mono_dir "$REPO_ROOT")
+SESSION_STATE="$MONO_DIR/sessions/current.json"
+# LLM: replace EXEC_MODE_VALUE with the resolved value: taskdev or execute
+build_exec_mode="EXEC_MODE_VALUE"
+[ "$build_exec_mode" = "EXEC_MODE_VALUE" ] && build_exec_mode="taskdev"
+jq --arg m "$build_exec_mode" '. + {build_exec_mode: $m}' \
+  "$SESSION_STATE" > "$SESSION_STATE.tmp" && mv "$SESSION_STATE.tmp" "$SESSION_STATE"
+echo "build_exec_mode=$build_exec_mode written to current.json"
+```
 
 ### Step 6 — Monotask Setup
 
@@ -678,12 +725,15 @@ for domain in $(jq -r '.domains_needed[]? // empty' "$SESSION_STATE" | grep -v '
   if [ -z "$board_id" ]; then
     echo "WARN: DOMAIN=$domain has no board_id — Step 6 may not have run or monotask is missing. Task agent will run without board tracking."
   fi
+  exec_mode=""
+  [ "$domain" = "build" ] && exec_mode=$(jq -r '.build_exec_mode // "taskdev"' "$SESSION_STATE")
   echo "DOMAIN=$domain \
 MANAGER=$(jq -r --arg d "$domain" '.domain_managers[$d] // "coordinator"' "$SESSION_STATE") \
 BOARD=$board_id \
 TODO=$(jq -r --arg d "$domain" '.todo_cols[$d] // ""' "$SESSION_STATE") \
 DOING=$(jq -r --arg d "$domain" '.doing_cols[$d] // ""' "$SESSION_STATE") \
 DONE=$(jq -r --arg d "$domain" '.done_cols[$d] // ""' "$SESSION_STATE") \
+EXEC_MODE=$exec_mode \
 GOAL=$(jq -r --arg d "$domain" '.domain_goals[$d] // .prompt' "$SESSION_STATE" | tr -d '\n')"
 done
 ```
@@ -698,6 +748,7 @@ Each Task call must include a complete briefing following the Monotask Task Brie
 - Instruction to create monotask cards directly using `monotask card create $BOARD_ID $COL_TODO_ID "<title>" --json` for all sub-tasks
 - Instruction to use `Skill("mastermind:do")` to execute tasks (Task agents have Skill tool access — do NOT use slash command syntax)
 - Instruction to spawn specialized agents using the domain-appropriate swarm topology
+- **For the `build` domain only:** include `build_exec_mode` (value: `"taskdev"` or `"execute"`) and instruct the manager: "Use `Skill("mastermind:taskdev")` if build_exec_mode is `taskdev`, or `Skill("mastermind:execute")` if `execute`. This was chosen by the user in Step 5."
 - Instruction to return the unified output schema when done
 
 Example Task call for Development Manager. Substitute all **pre-known** `<…>` placeholders (project_name, SESSION_ID, board/col IDs, goals, manager name) before calling Task. Placeholders like `<status>`, `<path1>`, `<action1>` are filled at runtime by the spawned agent — do not attempt to substitute them. `subagent_type` is the **string value** of `$domain_manager_build` (e.g. `"Backend Architect"`), not a variable reference.

package/packages/@monomind/cli/.claude/skills/mastermind/_repeat.md

@@ -27,6 +27,8 @@ If the stop file exists:
 
 ## Step 2 — Tillend termination check (tillend mode only — skip for fixed-count)
 
+**`LOOP_ASYNC_PENDING` escape hatch:** If the calling skill set `LOOP_ASYNC_PENDING=true` before invoking this postamble (because it spawned background agents whose results have not yet arrived), skip the empty-round check and go directly to Step 4 to schedule the next run. Output: `[tillend] Async work in flight — deferring empty-round check to run <next_rep>.`
+
 Evaluate now whether this run produced **zero findings AND zero actions**:
 
 - **Findings**: issues found, problems detected, items flagged, security vulnerabilities, tasks discovered, errors reported

package/packages/@monomind/cli/dist/src/__tests__/browse-analyzer.test.js

@@ -1,85 +1,68 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
-// Shared mock instance so tests can override `create` per-test
-const mockCreate = vi.fn().mockResolvedValue({
-    content: [{
-            type: 'text',
-            text: JSON.stringify({
-                id: 'linkedin:comment_post',
-                platform: 'linkedin',
-                name: 'Comment on Post',
-                params: ['post_url', 'text'],
-                steps: [
-                    { type: 'navigate', url: '{{params.post_url}}' },
-                    { type: 'find', selectors: ['.comment-box'], as: 'box' },
-                    { type: 'click', target: '{{box}}' },
-                    { type: 'type', target: '{{box}}', text: '{{params.text}}', humanDelay: true },
-                    { type: 'wait', condition: 'network_idle', timeout: 3000 },
-                ],
-            }),
-        }],
+import { EventEmitter } from 'events';
+// Mock child_process.spawn so tests don't invoke the real claude CLI
+vi.mock('child_process', async (importOriginal) => {
+    const actual = await importOriginal();
+    return { ...actual, spawn: vi.fn() };
 });
-// Mock Anthropic SDK before importing analyzer
-vi.mock('@anthropic-ai/sdk', () => {
-    const MockAnthropic = vi.fn(function () {
-        this.messages = { create: mockCreate };
+async function makeSpawnMock(stdout, exitCode = 0) {
+    const { spawn } = vi.mocked(await import('child_process'));
+    spawn.mockImplementationOnce(() => {
+        const proc = new EventEmitter();
+        proc.stdout = new EventEmitter();
+        proc.stderr = new EventEmitter();
+        proc.kill = vi.fn();
+        setTimeout(() => {
+            proc.stdout.emit('data', Buffer.from(stdout));
+            proc.emit('close', exitCode);
+        }, 0);
+        return proc;
     });
-    return { default: MockAnthropic };
-});
+}
+const VALID_ACTION_DEF = {
+    id: 'linkedin:comment_post',
+    platform: 'linkedin',
+    name: 'Comment on Post',
+    params: ['post_url', 'text'],
+    steps: [
+        { type: 'navigate', url: '{{params.post_url}}' },
+        { type: 'find', selectors: ['.comment-box'], as: 'box' },
+        { type: 'click', target: '{{box}}' },
+        { type: 'type', target: '{{box}}', text: '{{params.text}}', humanDelay: true },
+        { type: 'wait', condition: 'network_idle', timeout: 3000 },
+    ],
+};
 function mockPage(url = 'https://linkedin.com/feed', title = 'LinkedIn') {
     return {
         url: vi.fn().mockResolvedValue(url),
         evaluate: vi.fn().mockImplementation((expr) => {
             if (expr === 'document.title')
                 return Promise.resolve(title);
-            return Promise.resolve('[]'); // empty elements for DOM capture
+            return Promise.resolve('[]');
         }),
     };
 }
 describe('analyzePageForAction', () => {
     let analyzePageForAction;
     beforeEach(async () => {
-        mockCreate.mockResolvedValue({
-            content: [{
-                    type: 'text',
-                    text: JSON.stringify({
-                        id: 'linkedin:comment_post',
-                        platform: 'linkedin',
-                        name: 'Comment on Post',
-                        params: ['post_url', 'text'],
-                        steps: [
-                            { type: 'navigate', url: '{{params.post_url}}' },
-                            { type: 'find', selectors: ['.comment-box'], as: 'box' },
-                            { type: 'click', target: '{{box}}' },
-                            { type: 'type', target: '{{box}}', text: '{{params.text}}', humanDelay: true },
-                            { type: 'wait', condition: 'network_idle', timeout: 3000 },
-                        ],
-                    }),
-                }],
-        });
+        vi.resetModules();
         const mod = await import('@monoes/monobrowse');
         analyzePageForAction = mod.analyzePageForAction;
-    });
-    it('returns a valid ActionDef from mocked Claude response', async () => {
-        const page = mockPage();
-        // Pass a dummy key via options (Anthropic SDK is mocked — no real call is made)
-        const result = await analyzePageForAction(page, 'comment on a LinkedIn post', { apiKey: 'sk-test' });
+    }, 20000); // monolean: re-importing the workspace package can exceed the 10s default under full-suite parallel load
+    it('returns a valid ActionDef from mocked claude --print response', async () => {
+        await makeSpawnMock(JSON.stringify(VALID_ACTION_DEF));
+        const result = await analyzePageForAction(mockPage(), 'comment on a LinkedIn post');
         expect(result.id).toBe('linkedin:comment_post');
         expect(result.steps).toHaveLength(5);
         expect(result.params).toContain('text');
     });
-    it('throws on invalid JSON from Claude', async () => {
-        mockCreate.mockResolvedValueOnce({
-            content: [{ type: 'text', text: 'not json at all' }],
-        });
-        const page = mockPage();
-        await expect(analyzePageForAction(page, 'test', { apiKey: 'sk-test' })).rejects.toThrow('invalid JSON');
+    it('throws on invalid JSON from claude', async () => {
+        await makeSpawnMock('not json at all');
+        await expect(analyzePageForAction(mockPage(), 'test')).rejects.toThrow('invalid JSON');
     });
     it('throws when ActionDef is missing id', async () => {
-        mockCreate.mockResolvedValueOnce({
-            content: [{ type: 'text', text: JSON.stringify({ steps: [] }) }],
-        });
-        const page = mockPage();
-        await expect(analyzePageForAction(page, 'test', { apiKey: 'sk-test' })).rejects.toThrow('invalid ActionDef');
+        await makeSpawnMock(JSON.stringify({ steps: [] }));
+        await expect(analyzePageForAction(mockPage(), 'test')).rejects.toThrow('invalid ActionDef');
     });
 });
 //# sourceMappingURL=browse-analyzer.test.js.map

package/packages/@monomind/cli/dist/src/browser/dashboard/server.js

@@ -30,6 +30,24 @@ export function getDashboardServer(port = DEFAULT_PORT) {
             res.end(JSON.stringify(recentRuns));
             return;
         }
+        if (req.method === 'POST' && req.url === '/api/mastermind/event') {
+            const chunks = [];
+            req.on('data', (chunk) => chunks.push(chunk));
+            req.on('end', () => {
+                try {
+                    const body = Buffer.concat(chunks).toString('utf8');
+                    JSON.parse(body); // validate before broadcast
+                    for (const client of clients) {
+                        if (client.readyState === client.OPEN)
+                            client.send(body);
+                    }
+                }
+                catch { }
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end('{"ok":true}');
+            });
+            return;
+        }
         res.writeHead(404);
         res.end();
     });