monomind 1.7.0 → 1.9.0

package/packages/@monomind/cli/dist/src/commands/claims.js

@@ -5,27 +5,39 @@
  * github.com/nokhodian/monomind
  */
 import { output } from '../output.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import { homedir } from 'os';
 const CLAIMS_CONFIG_PATHS = [
     '.monomind/claims.json',
     'monomind.claims.json',
 ];
 function getClaimsConfigPaths() {
-    // Lazy import to keep top-level synchronous
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
-    const path = require('path');
     return [
         path.resolve(CLAIMS_CONFIG_PATHS[0]),
         path.resolve(CLAIMS_CONFIG_PATHS[1]),
-        path.resolve(process.env.HOME || '~', '.config/monomind/claims.json'),
+        path.resolve(homedir(), '.config/monomind/claims.json'),
     ];
 }
+function safeParseJson(content) {
+    const parsed = JSON.parse(content);
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('Claims config must be a JSON object');
+    }
+    const safe = Object.create(null);
+    for (const key of Object.keys(parsed)) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+            continue;
+        safe[key] = parsed[key];
+    }
+    return safe;
+}
 function loadClaimsConfig() {
-    const fs = require('fs');
     const configPaths = getClaimsConfigPaths();
     for (const configPath of configPaths) {
         if (fs.existsSync(configPath)) {
             const content = fs.readFileSync(configPath, 'utf-8');
-            return { config: JSON.parse(content), path: configPath };
+            return { config: safeParseJson(content), path: configPath };
         }
     }
     // Return default config with the first path as the default write location
@@ -41,8 +53,6 @@ function loadClaimsConfig() {
     return { config: defaultConfig, path: configPaths[0] };
 }
 function saveClaimsConfig(config, configPath) {
-    const fs = require('fs');
-    const path = require('path');
     const dir = path.dirname(configPath);
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
@@ -166,7 +176,7 @@ const checkCommand = {
             const claimsConfigPaths = [
                 path.resolve('.monomind/claims.json'),
                 path.resolve('monomind.claims.json'),
-                path.resolve(process.env.HOME || '~', '.config/monomind/claims.json'),
+                path.resolve(homedir(), '.config/monomind/claims.json'),
             ];
             let claimsConfig = {
                 // Default policy - allows basic operations
@@ -181,7 +191,7 @@ const checkCommand = {
             for (const configPath of claimsConfigPaths) {
                 if (fs.existsSync(configPath)) {
                     const content = fs.readFileSync(configPath, 'utf-8');
-                    claimsConfig = { ...claimsConfig, ...JSON.parse(content) };
+                    claimsConfig = { ...claimsConfig, ...safeParseJson(content) };
                     policySource = configPath;
                     break;
                 }
@@ -235,10 +245,8 @@ const checkCommand = {
         }
         catch (error) {
             spinner.stop();
-            // On error, fall back to permissive default
-            isGranted = !claim.startsWith('admin:');
-            reason = isGranted ? 'Granted (default permissive policy)' : 'Admin claims require explicit grant';
-            policySource = 'fallback';
+            output.printError(`Failed to evaluate claim: ${error instanceof Error ? error.message : String(error)}`);
+            return { success: false, exitCode: 1 };
         }
         if (isGranted) {
             output.writeln(output.success('✓ Claim granted'));

package/packages/@monomind/cli/dist/src/commands/config.js

@@ -3,6 +3,7 @@
  * Configuration management
  */
 import { output } from '../output.js';
+import { confirm } from '../prompt.js';
 import { configManager, parseConfigValue } from '../services/config-file-manager.js';
 import * as path from 'path';
 // Init configuration
@@ -146,6 +147,13 @@ const setCommand = {
             output.printError('Both key and value are required');
             return { success: false, exitCode: 1 };
         }
+        const FORBIDDEN_KEY_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+        for (const seg of key.split('.')) {
+            if (FORBIDDEN_KEY_SEGMENTS.has(seg)) {
+                output.printError(`Forbidden config key segment: "${seg}"`);
+                return { success: false, exitCode: 1 };
+            }
+        }
         try {
             const parsedValue = parseConfigValue(value);
             configManager.set(ctx.cwd, key, parsedValue);
@@ -311,6 +319,25 @@ const resetCommand = {
     ],
     action: async (ctx) => {
         try {
+            if (!ctx.flags.force && ctx.interactive) {
+                const confirmed = await confirm({ message: 'This will reset all configuration to defaults. Continue?', default: false });
+                if (!confirmed)
+                    return { success: true, message: 'Reset cancelled' };
+            }
+            const section = ctx.flags.section;
+            if (section && section !== 'all') {
+                // Scoped reset: remove only the specified section key from the config.
+                // Setting to undefined causes JSON serialization to omit the key, effectively removing it.
+                const current = configManager.getConfig(ctx.cwd);
+                if (section in current) {
+                    configManager.set(ctx.cwd, section, configManager.getDefaults()[section]);
+                    output.writeln(`Section "${section}" reset to defaults`);
+                }
+                else {
+                    output.printWarning(`Section "${section}" not found in configuration`);
+                }
+                return { success: true };
+            }
             const configPath = configManager.reset(ctx.cwd);
             output.writeln(`Configuration reset to defaults: ${configPath}`);
             return { success: true };
@@ -344,6 +371,11 @@ const exportCommand = {
     ],
     action: async (ctx) => {
         try {
+            const format = ctx.flags.format || 'json';
+            if (format === 'yaml') {
+                // configManager.exportTo does not support YAML serialization; export as JSON instead
+                output.printWarning('YAML export is not supported. Exporting as JSON.');
+            }
             const exportPath = ctx.flags.output || ctx.args[0] || 'monomind.config.export.json';
             configManager.exportTo(ctx.cwd, exportPath);
             const resolved = path.resolve(ctx.cwd, exportPath);

package/packages/@monomind/cli/dist/src/commands/daemon.js

@@ -6,7 +6,7 @@ import { output } from '../output.js';
 import { getDaemon, startDaemon, stopDaemon } from '../services/worker-daemon.js';
 import { spawn } from 'child_process';
 import { fileURLToPath } from 'url';
-import { dirname, join, resolve } from 'path';
+import { dirname, join, resolve, sep } from 'path';
 import * as fs from 'fs';
 // Start daemon subcommand
 const startCommand = {
@@ -185,12 +185,9 @@ function validatePath(path, label) {
         throw new Error(`${label} contains shell metacharacters`);
     }
     // Prevent path traversal outside expected directories
-    if (!resolved.includes('.monomind') && !resolved.includes('bin')) {
-        // Allow only paths within project structure
-        const cwd = process.cwd();
-        if (!resolved.startsWith(cwd)) {
-            throw new Error(`${label} escapes project directory`);
-        }
+    const cwd = process.cwd();
+    if (!resolved.startsWith(cwd + sep) && !resolved.startsWith(cwd + '/') && resolved !== cwd) {
+        throw new Error(`${label} escapes project directory`);
     }
 }
 /**
@@ -237,7 +234,7 @@ async function startBackgroundDaemon(projectRoot, quiet, maxCpuLoad, minFreeMemo
             // Prevent macOS SIGHUP kill when terminal closes
             ...(process.platform === 'darwin' ? { NOHUP: '1' } : {}),
         },
-        ...(isWin ? { shell: true, windowsHide: true } : {}),
+        ...(isWin ? { windowsHide: true } : {}),
     };
     // Use spawn with explicit arguments instead of shell string interpolation
     // This prevents command injection via paths
@@ -271,12 +268,17 @@ async function startBackgroundDaemon(projectRoot, quiet, maxCpuLoad, minFreeMemo
     // Write PID file only if the child hasn't already written its own.
     // The foreground child calls writePidFile() internally, but on some platforms
     // it may not have started yet, so we write as a fallback.
-    if (!fs.existsSync(pidFile)) {
-        fs.writeFileSync(pidFile, String(pid));
+    // Use 'wx' flag for atomic exclusive create — avoids TOCTOU race.
+    try {
+        fs.writeFileSync(pidFile, String(pid), { flag: 'wx' });
+    }
+    catch {
+        // File already exists (child wrote it first) — that's expected, ignore
     }
     if (!quiet) {
+        const actualLogPath = join(resolvedRoot, '.monomind', 'logs', 'daemon.log');
         output.printSuccess(`Daemon started in background (PID: ${pid})`);
-        output.printInfo(`Logs: ${logFile}`);
+        output.printInfo(`Logs: ${actualLogPath}`);
         output.printInfo(`Stop with: monomind daemon stop`);
     }
     return { success: true };

package/packages/@monomind/cli/dist/src/commands/deployment.js

@@ -26,13 +26,27 @@ function loadDeploymentState(cwd) {
     }
     try {
         const raw = fs.readFileSync(filePath, 'utf-8');
-        return JSON.parse(raw);
+        const parsed = JSON.parse(raw);
+        // Strip proto-pollution keys before casting
+        const DANGEROUS = new Set(['__proto__', 'constructor', 'prototype']);
+        if (parsed !== null && typeof parsed === 'object') {
+            for (const k of DANGEROUS) {
+                if (Object.prototype.hasOwnProperty.call(parsed, k))
+                    delete parsed[k];
+            }
+        }
+        return parsed;
     }
     catch {
         return emptyState();
     }
 }
+const MAX_DEPLOYMENT_HISTORY = 1000;
 function saveDeploymentState(cwd, state) {
+    // Cap history to prevent unbounded file growth
+    if (state.history.length > MAX_DEPLOYMENT_HISTORY) {
+        state.history = state.history.slice(-MAX_DEPLOYMENT_HISTORY);
+    }
     const dir = getStateDir(cwd);
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
@@ -218,10 +232,11 @@ const statusCommand = {
                 output.writeln(output.dim('No environments configured'));
             }
             // Recent history (last 5)
-            let recent = [...state.history].reverse().slice(0, 5);
+            let recent = [...state.history].reverse();
             if (filterEnv) {
                 recent = recent.filter(r => r.environment === filterEnv);
             }
+            recent = recent.slice(0, 5);
             if (recent.length > 0) {
                 output.writeln();
                 output.writeln(output.bold('Recent Deployments'));
@@ -268,6 +283,10 @@ const rollbackCommand = {
                 return { success: false, exitCode: 1 };
             }
             const targetVersion = ctx.flags['version'] ? String(ctx.flags['version']) : null;
+            const steps = parseInt(ctx.flags.steps || '1', 10);
+            if (steps > 1) {
+                output.printWarning(`Multi-step rollback (--steps ${steps}) is not yet implemented. Rolling back 1 step only.`);
+            }
             const state = loadDeploymentState(ctx.cwd);
             // Find deployments for this environment in reverse chronological order
             const envHistory = state.history

package/packages/@monomind/cli/dist/src/commands/doctor.js

@@ -9,6 +9,7 @@ import { existsSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { execSync, exec } from 'child_process';
+import { homedir } from 'os';
 import { promisify } from 'util';
 // Promisified exec with proper shell and env inheritance for cross-platform support
 const execAsync = promisify(exec);
@@ -178,8 +179,8 @@ async function checkGitRepo() {
 // Check MCP servers
 async function checkMcpServers() {
     const mcpConfigPaths = [
-        join(process.env.HOME || '', '.claude/claude_desktop_config.json'),
-        join(process.env.HOME || '', '.config/claude/mcp.json'),
+        join(homedir(), '.claude/claude_desktop_config.json'),
+        join(homedir(), '.config/claude/mcp.json'),
         '.mcp.json'
     ];
     for (const configPath of mcpConfigPaths) {
@@ -188,7 +189,7 @@ async function checkMcpServers() {
                 const content = JSON.parse(readFileSync(configPath, 'utf8'));
                 const servers = content.mcpServers || content.servers || {};
                 const count = Object.keys(servers).length;
-                const hasMonomind = 'monomind' in servers || 'monomind_alpha' in servers || 'monomind' in servers || 'monomind_alpha' in servers;
+                const hasMonomind = 'monomind' in servers || 'monomind_alpha' in servers;
                 if (hasMonomind) {
                     return { name: 'MCP Servers', status: 'pass', message: `${count} servers (monomind configured)` };
                 }
@@ -263,7 +264,7 @@ async function checkVersionFreshness() {
                         const pkg = JSON.parse(readFileSync(candidate, 'utf8'));
                         if (pkg.version &&
                             typeof pkg.name === 'string' &&
-                            (pkg.name === '@monomind/cli' || pkg.name === 'monomind' || pkg.name === 'monomind')) {
+                            (pkg.name === '@monomind/cli' || pkg.name === 'monomind')) {
                             currentVersion = pkg.version;
                             break;
                         }
@@ -382,50 +383,31 @@ async function installClaudeCode() {
         return false;
     }
 }
-// Check graphify (Python knowledge graph engine)
-async function checkGraphify() {
+// Check monograph (TypeScript knowledge graph engine, bundled with CLI)
+async function checkMonograph() {
     try {
-        await runCommand('graphify --help');
-        return { name: 'Graphify', status: 'pass', message: 'installed (knowledge graph engine)' };
-    }
-    catch {
-        // Check if Python/uv are available for the fix suggestion
-        let fix = 'pip install graphifyy';
-        try {
-            await runCommand('uv --version');
-            fix = 'uv tool install graphifyy';
+        const __filename = fileURLToPath(import.meta.url);
+        const candidates = [
+            join(dirname(__filename), '..', '..', 'node_modules', '@monomind', 'monograph', 'package.json'),
+            join(dirname(__filename), '..', '..', '..', '..', 'node_modules', '@monomind', 'monograph', 'package.json'),
+        ];
+        if (candidates.some(p => existsSync(p))) {
+            return { name: 'Monograph', status: 'pass', message: 'available (knowledge graph engine)' };
         }
-        catch { }
         return {
-            name: 'Graphify',
+            name: 'Monograph',
             status: 'warn',
-            message: 'Not installed (knowledge graph disabled)',
-            fix
+            message: 'Package not found (knowledge graph disabled)',
+            fix: 'npm install in project root'
         };
     }
-}
-// Install graphify Python package
-async function installGraphify() {
-    try {
-        output.writeln();
-        output.writeln(output.bold('Installing Graphify knowledge graph engine...'));
-        // Prefer uv (fast, isolated), fall back to pip
-        let cmd = 'pip install graphifyy';
-        try {
-            await runCommand('uv --version');
-            cmd = 'uv tool install graphifyy';
-        }
-        catch { }
-        execSync(cmd, { encoding: 'utf8', stdio: 'inherit', timeout: 120000 });
-        output.writeln(output.success('Graphify installed successfully!'));
-        return true;
-    }
-    catch (error) {
-        output.writeln(output.error('Failed to install Graphify'));
-        if (error instanceof Error) {
-            output.writeln(output.dim(error.message));
-        }
-        return false;
+    catch {
+        return {
+            name: 'Monograph',
+            status: 'warn',
+            message: 'Package check failed (knowledge graph may be unavailable)',
+            fix: 'npm install in project root'
+        };
     }
 }
 // Check agentic-flow v1 integration (filesystem-based to avoid slow WASM/DB init)
@@ -491,14 +473,14 @@ export const doctorCommand = {
         {
             name: 'install',
             short: 'i',
-            description: 'Auto-install missing dependencies (Claude Code CLI, Graphify)',
+            description: 'Auto-install missing dependencies (Claude Code CLI)',
             type: 'boolean',
             default: false
         },
         {
             name: 'component',
             short: 'c',
-            description: 'Check specific component (version, node, npm, config, daemon, memory, api, git, mcp, claude, disk, typescript, graphify)',
+            description: 'Check specific component (version, node, npm, config, daemon, memory, api, git, mcp, claude, disk, typescript, monograph)',
             type: 'string'
         },
         {
@@ -540,7 +522,7 @@ export const doctorCommand = {
             checkMcpServers,
             checkDiskSpace,
             checkBuildTools,
-            checkGraphify,
+            checkMonograph,
             checkAgenticFlow
         ];
         const componentMap = {
@@ -557,7 +539,7 @@ export const doctorCommand = {
             'mcp': checkMcpServers,
             'disk': checkDiskSpace,
             'typescript': checkBuildTools,
-            'graphify': checkGraphify,
+            'monograph': checkMonograph,
             'agentic-flow': checkAgenticFlow
         };
         let checksToRun = allChecks;
@@ -616,22 +598,6 @@ export const doctorCommand = {
                     output.writeln(formatCheck(newCheck));
                 }
             }
-            const graphifyResult = results.find(r => r.name === 'Graphify');
-            if (graphifyResult && graphifyResult.status !== 'pass') {
-                const installed = await installGraphify();
-                if (installed) {
-                    const newCheck = await checkGraphify();
-                    const idx = results.findIndex(r => r.name === 'Graphify');
-                    if (idx !== -1) {
-                        results[idx] = newCheck;
-                        const fixIdx = fixes.findIndex(f => f.startsWith('Graphify:'));
-                        if (fixIdx !== -1 && newCheck.status === 'pass') {
-                            fixes.splice(fixIdx, 1);
-                        }
-                    }
-                    output.writeln(formatCheck(newCheck));
-                }
-            }
         }
         // Summary
         const passed = results.filter(r => r.status === 'pass').length;