monomind 1.7.0 → 1.9.0

package/packages/@monomind/cli/dist/src/commands/session.js

@@ -7,6 +7,7 @@ import { confirm, input, select } from '../prompt.js';
 import { callMCPTool, MCPClientError } from '../mcp-client.js';
 import * as fs from 'fs';
 import * as path from 'path';
+import { gzipSync } from 'node:zlib';
 // Format date for display
 function formatDate(dateStr) {
     const date = new Date(dateStr);
@@ -472,11 +473,27 @@ const exportCommand = {
             else {
                 content = JSON.stringify(result.data, null, 2);
             }
-            // Write to file
+            // Path traversal protection: resolved path must stay within CWD
+            const effectiveCwd = ctx.cwd || process.cwd();
             const absolutePath = path.isAbsolute(outputPath)
                 ? outputPath
-                : path.join(ctx.cwd, outputPath);
-            fs.writeFileSync(absolutePath, content, 'utf-8');
+                : path.join(effectiveCwd, outputPath);
+            const resolvedOutputPath = path.resolve(absolutePath);
+            const resolvedCwd = path.resolve(effectiveCwd);
+            if (!resolvedOutputPath.startsWith(resolvedCwd + path.sep) && resolvedOutputPath !== resolvedCwd) {
+                output.printError(`Output path must be within the working directory.`);
+                return { success: false, exitCode: 1 };
+            }
+            // Write atomically (tmp + rename) to avoid partial writes — use resolvedOutputPath
+            const tmpPath = `${resolvedOutputPath}.${process.pid}.${Date.now()}.tmp`;
+            if (compress) {
+                const compressed = gzipSync(Buffer.from(content, 'utf-8'));
+                fs.writeFileSync(tmpPath, compressed);
+            }
+            else {
+                fs.writeFileSync(tmpPath, content, 'utf-8');
+            }
+            fs.renameSync(tmpPath, resolvedOutputPath);
             spinner.succeed('Session exported');
             output.writeln();
             output.printTable({
@@ -542,10 +559,27 @@ const importCommand = {
         const absolutePath = path.isAbsolute(filePath)
             ? filePath
             : path.join(ctx.cwd, filePath);
+        // Path traversal protection: resolved path must stay within cwd or home
+        const resolvedPath = path.resolve(absolutePath);
+        const cwd = process.cwd();
+        const home = process.env.HOME || '';
+        const underCwd = resolvedPath === cwd || resolvedPath.startsWith(cwd + path.sep);
+        const underHome = home && (resolvedPath === home || resolvedPath.startsWith(home + path.sep));
+        if (!underCwd && !underHome) {
+            output.printError(`Path '${filePath}' escapes the allowed directories.`);
+            return { success: false, exitCode: 1 };
+        }
         if (!fs.existsSync(absolutePath)) {
             output.printError(`File not found: ${absolutePath}`);
             return { success: false, exitCode: 1 };
         }
+        // Reject oversized files before reading into memory
+        const MAX_IMPORT_BYTES = 50 * 1024 * 1024; // 50 MB
+        const stat = fs.statSync(absolutePath);
+        if (stat.size > MAX_IMPORT_BYTES) {
+            output.printError(`File too large: ${absolutePath} (${(stat.size / 1024 / 1024).toFixed(1)} MB > 50 MB limit)`);
+            return { success: false, exitCode: 1 };
+        }
         const spinner = output.createSpinner({ text: 'Importing session...' });
         spinner.start();
         try {
@@ -553,11 +587,16 @@ const importCommand = {
             let data;
             // Parse based on extension
             if (absolutePath.endsWith('.yaml') || absolutePath.endsWith('.yml')) {
-                // Simple YAML parsing (basic implementation)
-                data = JSON.parse(content); // Would need proper YAML parser
+                output.printError('YAML import is not supported. Please convert to JSON first.');
+                spinner.fail('Import failed');
+                return { success: false, exitCode: 1 };
             }
             else {
-                data = JSON.parse(content);
+                data = JSON.parse(content, (key, value) => {
+                    if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+                        return undefined;
+                    return value;
+                });
             }
             const result = await callMCPTool('session_import', {
                 data,
@@ -678,8 +717,12 @@ function toSimpleYaml(obj, indent = 0) {
         return String(obj);
     if (typeof obj === 'number')
         return String(obj);
-    if (typeof obj === 'string')
-        return obj.includes(':') ? `"${obj}"` : obj;
+    if (typeof obj === 'string') {
+        const needsQuoting = /[:"'\n\r\\]|^(true|false|null|yes|no|on|off)$/i.test(obj) || /^\s|\s$/.test(obj) || /^[!&|>{\[]/.test(obj);
+        if (needsQuoting)
+            return `"${obj.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+        return obj;
+    }
     const spaces = '  '.repeat(indent);
     let result = '';
     if (Array.isArray(obj)) {

package/packages/@monomind/cli/dist/src/commands/start.js

@@ -83,8 +83,8 @@ function loadConfig(cwd) {
 // Main start action
 const startAction = async (ctx) => {
     const daemon = ctx.flags.daemon;
-    const port = ctx.flags.port || DEFAULT_PORT;
-    const topology = ctx.flags.topology || DEFAULT_TOPOLOGY;
+    const port = ctx.flags.port;
+    const topology = ctx.flags.topology;
     const skipMcp = ctx.flags['skip-mcp'];
     const cwd = ctx.cwd;
     // Check initialization
@@ -174,9 +174,23 @@ const startAction = async (ctx) => {
         if (daemon) {
             output.writeln();
             output.printInfo('Running in daemon mode. Use "monomind stop" to stop.');
-            // Store PID for daemon management
+            // Store PID for daemon management.
+            // wx flag refuses to follow a pre-staged symlink at the path; mode 0o600
+            // keeps the file from being world-readable on multi-user systems.
             const daemonPidPath = path.join(cwd, '.monomind', 'daemon.pid');
-            fs.writeFileSync(daemonPidPath, String(process.pid));
+            try {
+                fs.writeFileSync(daemonPidPath, String(process.pid), { flag: 'wx', mode: 0o600 });
+            }
+            catch (e) {
+                if (e.code === 'EEXIST') {
+                    // Stale PID file — caller should have verified the prior daemon is dead
+                    fs.unlinkSync(daemonPidPath);
+                    fs.writeFileSync(daemonPidPath, String(process.pid), { flag: 'wx', mode: 0o600 });
+                }
+                else {
+                    throw e;
+                }
+            }
             // Detach from parent process for true daemon behavior
             if (process.platform !== 'win32') {
                 // Unix-like systems: create new session

package/packages/@monomind/cli/dist/src/commands/swarm.js

@@ -221,7 +221,7 @@ const initCommand = {
     ],
     action: async (ctx) => {
         let topology = ctx.flags.topology;
-        const maxAgents = ctx.flags.maxAgents || 15;
+        const maxAgents = ctx.flags['max-agents'] || 15;
         const v1Mode = ctx.flags.v1Mode;
         // mode enables hierarchical-mesh hybrid
         if (v1Mode) {
@@ -248,7 +248,7 @@ const initCommand = {
                     consensusMechanism: 'majority',
                     failureHandling: 'retry',
                     loadBalancing: true,
-                    autoScaling: ctx.flags.autoScale ?? true,
+                    autoScaling: ctx.flags['auto-scale'] ?? true,
                 },
                 metadata: {
                     v1Mode,
@@ -288,7 +288,8 @@ const initCommand = {
                     fs.mkdirSync(swarmDir, { recursive: true });
                 }
                 const stateFile = path.join(swarmDir, 'state.json');
-                fs.writeFileSync(stateFile, JSON.stringify({
+                const tmpStateFile1 = stateFile + '.tmp';
+                fs.writeFileSync(tmpStateFile1, JSON.stringify({
                     id: result.swarmId,
                     topology: result.topology,
                     maxAgents: result.config.maxAgents,
@@ -297,6 +298,7 @@ const initCommand = {
                     initializedAt: result.initializedAt,
                     status: 'ready'
                 }, null, 2));
+                fs.renameSync(tmpStateFile1, stateFile);
             }
             catch {
                 // Ignore errors writing state file
@@ -402,6 +404,7 @@ const startCommand = {
         output.writeln();
         const spinner = output.createSpinner({ text: 'Initializing swarm via MCP...', spinner: 'dots' });
         spinner.start();
+        let resolvedSwarmId = swarmId;
         try {
             // Actually call MCP to initialize the swarm
             const initResult = await callMCPTool('swarm_init', {
@@ -409,6 +412,9 @@ const startCommand = {
                 maxAgents: totalAgents,
                 strategy: strategy === 'development' ? 'specialized' : strategy,
             });
+            const mcpData = typeof initResult === 'string' ? JSON.parse(initResult) : initResult;
+            // Prefer the canonical ID assigned by the MCP server over the locally generated one
+            resolvedSwarmId = mcpData?.swarmId ?? mcpData?.id ?? swarmId;
             spinner.succeed('Swarm initialized via MCP');
         }
         catch (err) {
@@ -421,7 +427,7 @@ const startCommand = {
         if (!fs.existsSync(swarmDir))
             fs.mkdirSync(swarmDir, { recursive: true });
         const executionState = {
-            swarmId,
+            swarmId: resolvedSwarmId,
             objective,
             strategy,
             status: 'initialized',
@@ -430,12 +436,15 @@ const startCommand = {
             startedAt: new Date().toISOString(),
             parallel: ctx.flags.parallel ?? true
         };
-        fs.writeFileSync(path.join(swarmDir, 'state.json'), JSON.stringify(executionState, null, 2));
+        const stateFile2 = path.join(swarmDir, 'state.json');
+        const tmpStateFile2 = stateFile2 + '.tmp';
+        fs.writeFileSync(tmpStateFile2, JSON.stringify(executionState, null, 2));
+        fs.renameSync(tmpStateFile2, stateFile2);
         output.writeln();
-        output.printSuccess(`Swarm ${swarmId} initialized with ${totalAgents} agent slots`);
+        output.printSuccess(`Swarm ${resolvedSwarmId} initialized with ${totalAgents} agent slots`);
         output.writeln(output.dim('  Note: Agents are registered but actual task execution requires'));
         output.writeln(output.dim('  Claude Code Task tool or hive-mind spawn --claude to drive work.'));
-        output.writeln(output.dim(`  Monitor: monomind swarm status ${swarmId}`));
+        output.writeln(output.dim(`  Monitor: monomind swarm status ${resolvedSwarmId}`));
         return { success: true, data: executionState };
     }
 };
@@ -457,8 +466,8 @@ const statusCommand = {
             output.writeln(output.warning('No active swarm'));
             output.writeln();
             output.writeln(output.dim('Start a swarm with:'));
-            output.writeln(output.dim('  npx @monoes/cli@latest swarm init'));
-            output.writeln(output.dim('  npx @monoes/cli@latest swarm start'));
+            output.writeln(output.dim('  npx @monomind/cli@latest swarm init'));
+            output.writeln(output.dim('  npx @monomind/cli@latest swarm start'));
             output.writeln();
             return { success: true, data: status };
         }
@@ -553,27 +562,34 @@ const stopCommand = {
             }
         }
         output.printInfo(`Stopping swarm ${swarmId}...`);
-        // Update persisted swarm state if it exists (#1423)
-        const swarmStateFile = path.join(process.cwd(), '.swarm', 'state.json');
-        if (fs.existsSync(swarmStateFile)) {
-            try {
-                const state = JSON.parse(fs.readFileSync(swarmStateFile, 'utf-8'));
-                state.status = 'stopped';
-                state.stoppedAt = new Date().toISOString();
-                fs.writeFileSync(swarmStateFile, JSON.stringify(state, null, 2));
-                output.writeln(output.dim('  Swarm state updated'));
-            }
-            catch {
-                output.writeln(output.dim('  Could not update swarm state file'));
-            }
-        }
-        // Attempt MCP cleanup
+        // Attempt MCP cleanup first — only persist 'stopped' state if it succeeds
+        let mcpStopped = false;
         try {
             await callMCPTool('swarm_stop', { swarmId, force });
             output.writeln(output.dim('  MCP swarm stopped'));
+            mcpStopped = true;
         }
-        catch {
-            // MCP may not be available
+        catch (err) {
+            output.printWarning(`MCP stop failed: ${String(err)}`);
+            return { success: false, message: `MCP stop failed: ${String(err)}`, exitCode: 1 };
+        }
+        // Only update persisted swarm state if the MCP call succeeded (#1423)
+        if (mcpStopped) {
+            const swarmStateFile = path.join(process.cwd(), '.swarm', 'state.json');
+            if (fs.existsSync(swarmStateFile)) {
+                try {
+                    const state = JSON.parse(fs.readFileSync(swarmStateFile, 'utf-8'));
+                    state.status = 'stopped';
+                    state.stoppedAt = new Date().toISOString();
+                    const tmpSwarmStop = swarmStateFile + '.tmp';
+                    fs.writeFileSync(tmpSwarmStop, JSON.stringify(state, null, 2));
+                    fs.renameSync(tmpSwarmStop, swarmStateFile);
+                    output.writeln(output.dim('  Swarm state updated'));
+                }
+                catch {
+                    output.writeln(output.dim('  Could not update swarm state file'));
+                }
+            }
         }
         output.printSuccess(`Swarm ${swarmId} stopped`);
         return { success: true, data: { swarmId, stopped: true, force } };
@@ -614,7 +630,7 @@ const scaleCommand = {
         // Calculate scaling delta — fetch actual count instead of hardcoded 8 (#1425)
         let currentAgents = 0;
         try {
-            const statusResult = await callMCPTool('swarm_status', {});
+            const statusResult = await callMCPTool('swarm_status', { swarmId });
             const statusData = typeof statusResult === 'string' ? JSON.parse(statusResult) : statusResult;
             currentAgents = statusData?.agentCount ?? statusData?.agents?.length ?? 0;
         }
@@ -623,18 +639,13 @@ const scaleCommand = {
             currentAgents = 0;
         }
         const delta = targetAgents - currentAgents;
-        if (delta > 0) {
-            output.writeln(output.dim(`  Spawning ${delta} new agents...`));
-        }
-        else if (delta < 0) {
-            output.writeln(output.dim(`  Gracefully stopping ${-delta} agents...`));
-        }
-        else {
+        if (delta === 0) {
             output.printInfo('Swarm already at target size');
             return { success: true };
         }
-        output.printSuccess(`Swarm scaled to ${targetAgents} agents`);
-        return { success: true, data: { swarmId, agents: targetAgents, delta } };
+        // No swarm_scale MCP tool is available — report the computed delta but do not pretend to act
+        output.printWarning('Swarm scaling is not yet implemented. The target count was computed but no agents were spawned or stopped.');
+        return { success: false, message: 'Scaling not implemented', exitCode: 1 };
     }
 };
 // Coordinate command (v1 specific)

package/packages/@monomind/cli/dist/src/commands/tokens.js

@@ -56,23 +56,23 @@ const summarySubcommand = {
             const range = tracker.getDateRange(period);
             const projects = tracker.parseAllSessions(range.start, range.end);
             if (asJson) {
-                output.log(JSON.stringify(projects, null, 2));
+                output.writeln(JSON.stringify(projects, null, 2));
                 return { success: true, data: projects };
             }
             const totalCost = projects.reduce((s, p) => s + p.totalCost, 0);
             const totalCalls = projects.reduce((s, p) => s + p.totalApiCalls, 0);
-            output.log('');
-            output.log(`Token Usage — ${period}`);
-            output.log('─'.repeat(50));
-            output.log(`Total Cost:  ${tracker.fmt$(totalCost)}`);
-            output.log(`API Calls:   ${totalCalls}`);
-            output.log(`Projects:    ${projects.length}`);
-            output.log('');
+            output.writeln('');
+            output.writeln(`Token Usage — ${period}`);
+            output.writeln('─'.repeat(50));
+            output.writeln(`Total Cost:  ${tracker.fmt$(totalCost)}`);
+            output.writeln(`API Calls:   ${totalCalls}`);
+            output.writeln(`Projects:    ${projects.length}`);
+            output.writeln('');
             for (const p of projects.slice(0, 10)) {
                 const name = p.projectPath.split('/').pop() || p.projectPath;
-                output.log(`  ${name.padEnd(30)} ${tracker.fmt$(p.totalCost).padStart(10)}  ${p.totalApiCalls} calls`);
+                output.writeln(`  ${name.padEnd(30)} ${tracker.fmt$(p.totalCost).padStart(10)}  ${p.totalApiCalls} calls`);
             }
-            output.log('');
+            output.writeln('');
             return { success: true, data: { totalCost, totalCalls, projects } };
         }
         catch (err) {
@@ -89,7 +89,7 @@ const todaySubcommand = {
         try {
             const tracker = loadTracker();
             const summary = tracker.quickSummary();
-            output.log(summary || 'No token data available for today.');
+            output.writeln(summary || 'No token data available for today.');
             return { success: true };
         }
         catch (err) {

package/packages/@monomind/cli/dist/src/commands/transfer-store.js

@@ -140,7 +140,7 @@ export const storeSearchCommand = {
                 language: ctx.flags.language,
                 framework: ctx.flags.framework,
                 tags: ctx.flags.tags ? ctx.flags.tags.split(',') : undefined,
-                minRating: ctx.flags.minRating,
+                minRating: ctx.flags['min-rating'],
                 verified: ctx.flags.verified,
                 limit: ctx.flags.limit || 20,
             };

package/packages/@monomind/cli/dist/src/commands/workflow.js

@@ -77,9 +77,9 @@ const runCommand = {
         const file = ctx.flags.file;
         const task = ctx.flags.task || ctx.args[0];
         const parallel = ctx.flags.parallel;
-        const maxAgents = ctx.flags.maxAgents;
+        const maxAgents = ctx.flags['max-agents'];
         const timeout = ctx.flags.timeout;
-        const dryRun = ctx.flags.dryRun;
+        const dryRun = ctx.flags['dry-run'];
         if (!template && !file && ctx.interactive) {
             template = await select({
                 message: 'Select workflow template:',
@@ -503,8 +503,35 @@ const templateCommand = {
                     output.printError('Template name is required');
                     return { success: false, exitCode: 1 };
                 }
-                output.printSuccess(`Template "${name}" created`);
-                output.writeln(output.dim('  Use with: monomind workflow run -t ' + name));
+                if (!/^[a-zA-Z0-9_-]{1,64}$/.test(name)) {
+                    output.printError('Template name must be 1-64 alphanumeric, underscore, or dash characters.');
+                    return { success: false, exitCode: 1 };
+                }
+                const { writeFileSync, renameSync: renameTemplate, mkdirSync, existsSync } = await import('fs');
+                const { join, resolve: resolvePath, sep } = await import('path');
+                const templatesDir = join(ctx.cwd, '.monomind', 'workflows', 'templates');
+                if (!existsSync(templatesDir)) {
+                    mkdirSync(templatesDir, { recursive: true });
+                }
+                const templatePath = join(templatesDir, `${name}.json`);
+                if (!resolvePath(templatePath).startsWith(resolvePath(templatesDir) + sep)) {
+                    output.printError('Template name attempts path traversal.');
+                    return { success: false, exitCode: 1 };
+                }
+                if (existsSync(templatePath) && !ctx.flags.force) {
+                    output.writeln(output.error(`Template "${name}" already exists. Use --force to overwrite.`));
+                    return { success: false, exitCode: 1 };
+                }
+                const template = {
+                    name,
+                    description: ctx.flags.description || '',
+                    steps: [],
+                    variables: {},
+                    createdAt: new Date().toISOString(),
+                };
+                writeFileSync(templatePath + '.tmp', JSON.stringify(template, null, 2));
+                renameTemplate(templatePath + '.tmp', templatePath);
+                output.writeln(output.success(`✓ Template "${name}" created at ${templatePath.replace(ctx.cwd, '.')}`));
                 return { success: true, data: { name, created: true } };
             }
         }

package/packages/@monomind/cli/dist/src/config-adapter.d.ts

@@ -2,7 +2,7 @@
  * Configuration Adapter
  * Converts between SystemConfig and MonomindConfig types
  */
-import type { SystemConfig } from '@monoes/shared';
+type SystemConfig = any;
 import type { MonomindConfig } from './types.js';
 /**
  * Convert SystemConfig to MonomindConfig (CLI-specific format)
@@ -12,4 +12,5 @@ export declare function systemConfigToMonomindConfig(systemConfig: SystemConfig)
  * Convert MonomindConfig to SystemConfig
  */
 export declare function configToSystemConfig(config: MonomindConfig): Partial<SystemConfig>;
+export {};
 //# sourceMappingURL=config-adapter.d.ts.map

package/packages/@monomind/cli/dist/src/consensus/audit-writer.js

@@ -3,18 +3,26 @@
  *
  * Append-only JSONL storage for consensus audit records and individual votes.
  */
-import { appendFileSync, readFileSync, existsSync, mkdirSync } from 'fs';
-import { dirname, join } from 'path';
+import { appendFileSync, readFileSync, existsSync, mkdirSync, statSync } from 'fs';
+import { createHmac, timingSafeEqual } from 'crypto';
+import { dirname, join, resolve, relative } from 'path';
+import { parseJsonl } from '../utils/parse-jsonl.js';
 import { deriveSigningKey, signVote, verifyVote } from './vote-signer.js';
 export class AuditWriter {
     auditPath;
     votesPath;
     constructor(dataDir) {
-        if (!existsSync(dataDir)) {
-            mkdirSync(dataDir, { recursive: true });
+        const resolved = resolve(dataDir);
+        const cwd = process.cwd();
+        const rel = relative(cwd, resolved);
+        if (rel.startsWith('..') || resolve(rel) === resolve('/')) {
+            throw new Error(`AuditWriter: dataDir must be within the working directory: ${dataDir}`);
         }
-        this.auditPath = join(dataDir, 'consensus-audit.jsonl');
-        this.votesPath = join(dataDir, 'consensus-votes.jsonl');
+        if (!existsSync(resolved)) {
+            mkdirSync(resolved, { recursive: true });
+        }
+        this.auditPath = join(resolved, 'consensus-audit.jsonl');
+        this.votesPath = join(resolved, 'consensus-votes.jsonl');
     }
     /**
      * Record a consensus decision: sign all votes, compute quorum proof,
@@ -38,9 +46,11 @@ export class AuditWriter {
             threshold: input.quorumThreshold,
             satisfied: achieved >= input.quorumRequired,
         };
-        // Compute duration
-        const durationMs = new Date(input.completedAt).getTime() - new Date(input.startedAt).getTime();
-        const record = {
+        // Compute duration (guard against invalid date strings)
+        const startMs = new Date(input.startedAt).getTime();
+        const endMs = new Date(input.completedAt).getTime();
+        const durationMs = isNaN(startMs) || isNaN(endMs) ? null : endMs - startMs;
+        const recordWithoutSig = {
             decisionId: input.decisionId,
             swarmId: input.swarmId,
             protocol: input.protocol,
@@ -54,6 +64,12 @@ export class AuditWriter {
             completedAt: input.completedAt,
             durationMs,
         };
+        // Sign the full outer record so decision, quorumProof, and metadata are tamper-evident.
+        // Previously only individual votes were signed; this extends coverage to all fields.
+        const recordSignature = createHmac('sha256', key)
+            .update(JSON.stringify(recordWithoutSig))
+            .digest('hex');
+        const record = { ...recordWithoutSig, recordSignature };
         // Persist audit record
         this.appendLine(this.auditPath, record);
         // Persist individual votes
@@ -87,10 +103,20 @@ export class AuditWriter {
                 invalidVotes.push(vote.agentId);
             }
         }
-        return { valid: invalidVotes.length === 0, invalidVotes };
+        // Verify the outer record signature for tamper-evidence
+        const { recordSignature, ...recordWithoutSig } = record;
+        const expectedSig = createHmac('sha256', key)
+            .update(JSON.stringify(recordWithoutSig))
+            .digest('hex');
+        const expBuf = Buffer.from(expectedSig, 'hex');
+        const gotBuf = Buffer.from(typeof recordSignature === 'string' ? recordSignature : '', 'hex');
+        const recordTampered = gotBuf.length !== expBuf.length || !timingSafeEqual(gotBuf, expBuf);
+        return { valid: invalidVotes.length === 0 && !recordTampered, invalidVotes };
     }
     // ── helpers ──
     appendLine(filePath, data) {
+        // Audit writes must be reliable — propagate errors so callers know the audit trail
+        // is incomplete (silent failure defeats tamper-evidence)
         const dir = dirname(filePath);
         if (!existsSync(dir)) {
             mkdirSync(dir, { recursive: true });
@@ -100,10 +126,17 @@ export class AuditWriter {
     readLines(filePath) {
         if (!existsSync(filePath))
             return [];
-        const content = readFileSync(filePath, 'utf-8').trim();
-        if (!content)
+        try {
+            const MAX_BYTES = 50 * 1024 * 1024;
+            if (statSync(filePath).size > MAX_BYTES) {
+                throw new Error(`Audit log ${filePath} exceeds 50MB — run rotation/cleanup`);
+            }
+            const content = readFileSync(filePath, 'utf-8');
+            return parseJsonl(content);
+        }
+        catch {
             return [];
-        return content.split('\n').map((line) => JSON.parse(line));
+        }
     }
 }
 //# sourceMappingURL=audit-writer.js.map

package/packages/@monomind/cli/dist/src/consensus/vote-signer.d.ts

@@ -7,9 +7,6 @@
  * Derive a signing key from a swarmId and session secret using HMAC-SHA256.
  */
 export declare function deriveSigningKey(swarmId: string, sessionSecret: string): Buffer;
-/**
- * Sign a vote, producing a hex-encoded HMAC-SHA256 signature.
- */
 export declare function signVote(agentId: string, vote: unknown, decisionId: string, key: Buffer): string;
 /**
  * CP-WBFT: Compute confidence-weighted vote tally.

package/packages/@monomind/cli/dist/src/consensus/vote-signer.js

@@ -13,8 +13,16 @@ export function deriveSigningKey(swarmId, sessionSecret) {
 /**
  * Sign a vote, producing a hex-encoded HMAC-SHA256 signature.
  */
+function canonicalize(val) {
+    if (val === null || typeof val !== 'object')
+        return JSON.stringify(val);
+    if (Array.isArray(val))
+        return '[' + val.map(canonicalize).join(',') + ']';
+    const sorted = Object.keys(val).sort().map(k => JSON.stringify(k) + ':' + canonicalize(val[k]));
+    return '{' + sorted.join(',') + '}';
+}
 export function signVote(agentId, vote, decisionId, key) {
-    const payload = JSON.stringify({ agentId, vote, decisionId });
+    const payload = JSON.stringify({ agentId, vote: canonicalize(vote), decisionId });
     return createHmac('sha256', key).update(payload).digest('hex');
 }
 /**

package/packages/@monomind/cli/dist/src/dlq/dlq-reader.d.ts

@@ -15,9 +15,11 @@ export interface DLQListOptions {
 export declare class DLQReader {
     private readonly filePath;
     constructor(filePath: string);
-    /** Read all entries from the JSONL file */
+    /** Read all entries from the JSONL file with a hard size cap.
+     * The DLQ is append-only with no rotation — without this guard a long-running
+     * process can grow the file to GBs and OOM on every list/get/purge call. */
     private readAll;
-    /** Write all entries back (used for purge) */
+    /** Write all entries back (used for purge) — uses unique tmp filename to avoid concurrent writer collisions */
     private writeAll;
     /** List entries with optional filters (defaults to status='pending') */
     list(opts?: DLQListOptions): DLQEntry[];

package/packages/@monomind/cli/dist/src/dlq/dlq-reader.js

@@ -3,25 +3,42 @@
  *
  * Reads, filters, and purges DLQ entries from JSONL storage.
  */
-import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { randomUUID } from 'crypto';
+import { existsSync, readFileSync, writeFileSync, renameSync, statSync, unlinkSync } from 'fs';
+import { parseJsonl } from '../utils/parse-jsonl.js';
 export class DLQReader {
     filePath;
     constructor(filePath) {
         this.filePath = filePath;
     }
-    /** Read all entries from the JSONL file */
+    /** Read all entries from the JSONL file with a hard size cap.
+     * The DLQ is append-only with no rotation — without this guard a long-running
+     * process can grow the file to GBs and OOM on every list/get/purge call. */
     readAll() {
         if (!existsSync(this.filePath))
             return [];
-        const raw = readFileSync(this.filePath, 'utf-8').trim();
-        if (!raw)
-            return [];
-        return raw.split('\n').map((line) => JSON.parse(line));
+        const stat = statSync(this.filePath);
+        if (stat.size > 256 * 1024 * 1024) {
+            throw new Error(`DLQ file exceeds 256MB (${stat.size} bytes). Run rotation/cleanup.`);
+        }
+        const raw = readFileSync(this.filePath, 'utf-8');
+        return parseJsonl(raw);
     }
-    /** Write all entries back (used for purge) */
+    /** Write all entries back (used for purge) — uses unique tmp filename to avoid concurrent writer collisions */
     writeAll(entries) {
         const content = entries.map((e) => JSON.stringify(e)).join('\n') + (entries.length ? '\n' : '');
-        writeFileSync(this.filePath, content, 'utf-8');
+        const tmp = `${this.filePath}.${randomUUID()}.tmp`;
+        try {
+            writeFileSync(tmp, content, 'utf-8');
+            renameSync(tmp, this.filePath);
+        }
+        catch (err) {
+            try {
+                unlinkSync(tmp);
+            }
+            catch { /* ignore cleanup failure */ }
+            throw err;
+        }
     }
     /** List entries with optional filters (defaults to status='pending') */
     list(opts = {}) {