monomind 1.7.0 → 1.9.0

package/packages/@monomind/cli/dist/src/mcp-tools/neural-tools.js

@@ -4,17 +4,19 @@
  * V2 Compatibility - Neural network and ML tools
  *
  * ✅ HYBRID Implementation:
- * - Uses @monoes/embeddings for REAL ML embeddings when available
+ * - Uses @monomind/embeddings for REAL ML embeddings when available
  * - Falls back to deterministic hash-based embeddings when ML model not installed
  * - Pattern storage and search with cosine similarity (real math in all tiers)
  * - Training stores patterns as searchable embeddings (not simulated)
  *
- * Note: For production neural features, use @monoes/neural module
+ * Note: For production neural features, use @monomind/neural module
  */
 import { getProjectCwd } from './types.js';
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-// Try to import real embeddings — prefer agentic-flow v1 ReasoningBank, then @monoes/embeddings
+const MAX_NEURAL_STORE_BYTES = 50 * 1024 * 1024; // 50 MB
+const NEURAL_RESERVED_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+// Try to import real embeddings — prefer agentic-flow v1 ReasoningBank, then @monomind/embeddings
 let realEmbeddings = null;
 let embeddingServiceName = 'none';
 try {
@@ -24,9 +26,9 @@ try {
         realEmbeddings = { embed: (text) => rb.computeEmbedding(text) };
         embeddingServiceName = 'agentic-flow/reasoningbank';
     }
-    // Tier 2: @monoes/embeddings
+    // Tier 2: @monomind/embeddings
     if (!realEmbeddings) {
-        const embeddingsModule = await import('@monoes/embeddings').catch(() => null);
+        const embeddingsModule = await import('@monomind/embeddings').catch(() => null);
         if (embeddingsModule?.createEmbeddingService) {
             try {
                 const service = embeddingsModule.createEmbeddingService({ provider: 'agentic-flow' });
@@ -75,7 +77,26 @@ function loadNeuralStore() {
     try {
         const path = getNeuralPath();
         if (existsSync(path)) {
-            return JSON.parse(readFileSync(path, 'utf-8'));
+            if (statSync(path).size > MAX_NEURAL_STORE_BYTES) {
+                return { models: {}, patterns: {}, version: '3.0.0' };
+            }
+            const raw = JSON.parse(readFileSync(path, 'utf-8'));
+            // Strip proto-polluting keys from top-level containers
+            const models = {};
+            for (const [k, v] of Object.entries(raw.models ?? {})) {
+                if (!NEURAL_RESERVED_KEYS.has(k))
+                    models[k] = v;
+            }
+            const patterns = {};
+            for (const [k, v] of Object.entries(raw.patterns ?? {})) {
+                if (!NEURAL_RESERVED_KEYS.has(k))
+                    patterns[k] = v;
+            }
+            return {
+                models: models,
+                patterns: patterns,
+                version: typeof raw.version === 'string' ? raw.version : '3.0.0',
+            };
         }
     }
     catch {
@@ -85,7 +106,10 @@ function loadNeuralStore() {
 }
 function saveNeuralStore(store) {
     ensureNeuralDir();
-    writeFileSync(getNeuralPath(), JSON.stringify(store, null, 2), 'utf-8');
+    const dest = getNeuralPath();
+    const tmp = `${dest}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(tmp, JSON.stringify(store, null, 2), 'utf-8');
+    renameSync(tmp, dest);
 }
 // Generate embedding - uses real ML embeddings if available, falls back to deterministic hash
 async function generateEmbedding(text, dims = 384) {
@@ -118,8 +142,9 @@ async function generateEmbedding(text, dims = 384) {
 }
 // Cosine similarity for pattern search
 function cosineSimilarity(a, b) {
-    if (a.length !== b.length)
-        return 0;
+    if (a.length !== b.length) {
+        throw new Error(`Embedding dimension mismatch: ${a.length} vs ${b.length}. Ensure all embeddings use the same provider and dims.`);
+    }
     let dotProduct = 0;
     let normA = 0;
     let normB = 0;
@@ -149,6 +174,18 @@ export const neuralTools = [
         handler: async (input) => {
             const store = loadNeuralStore();
             const modelId = input.modelId || `model-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+            const RESERVED_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+            if (RESERVED_KEYS.has(modelId)) {
+                return { success: false, error: 'Invalid modelId' };
+            }
+            const MAX_PATTERNS = 10000;
+            if (Object.keys(store.patterns ?? {}).length >= MAX_PATTERNS) {
+                return { success: false, error: `Pattern store full (max ${MAX_PATTERNS}). Run neural_compress first.` };
+            }
+            const MAX_MODELS = 100;
+            if (Object.keys(store.models ?? {}).length >= MAX_MODELS) {
+                return { success: false, error: `Model store full (max ${MAX_MODELS}). Delete old models first.` };
+            }
             const modelType = input.modelType;
             const epochs = input.epochs || 10;
             const model = {
@@ -165,20 +202,30 @@ export const neuralTools = [
             };
             store.models[modelId] = model;
             saveNeuralStore(store);
-            // Real training: embed training data and store as searchable patterns
+            // Real training: embed training data and store as searchable patterns.
+            // Cap input array length and re-check the pattern cap inside the loop —
+            // the pre-loop check at line 199 alone allowed an attacker to bypass
+            // MAX_PATTERNS by passing a 100k-entry array.
+            const MAX_TRAINING_ENTRIES = 1000;
+            const MAX_TEXT_LENGTH = 64 * 1024;
             const trainingData = input.data;
             let patternsStored = 0;
             if (trainingData) {
-                const entries = Array.isArray(trainingData) ? trainingData : [trainingData];
+                const rawEntries = Array.isArray(trainingData) ? trainingData : [trainingData];
+                const entries = rawEntries.slice(0, MAX_TRAINING_ENTRIES);
                 for (let i = 0; i < entries.length; i++) {
+                    if (Object.keys(store.patterns ?? {}).length >= MAX_PATTERNS)
+                        break;
                     const entry = entries[i];
-                    const text = typeof entry === 'string' ? entry
+                    let text = typeof entry === 'string' ? entry
                         : entry?.text
                             || entry?.content
                             || entry?.label
                             || JSON.stringify(entry);
-                    if (!text)
+                    if (!text || typeof text !== 'string')
                         continue;
+                    if (text.length > MAX_TEXT_LENGTH)
+                        text = text.slice(0, MAX_TEXT_LENGTH);
                     const embedding = await generateEmbedding(text, 384);
                     const patternId = `${modelId}-train-${i}`;
                     store.patterns[patternId] = {
@@ -227,10 +274,16 @@ export const neuralTools = [
         handler: async (input) => {
             const store = loadNeuralStore();
             const modelId = input.modelId;
-            const inputText = input.input;
-            const topK = input.topK || 3;
+            const inputText = typeof input.input === 'string' ? input.input.slice(0, 16 * 1024) : '';
+            const topK = Math.max(1, Math.min(input.topK || 3, 50));
+            const RESERVED_KEYS_PRED = new Set(['__proto__', 'constructor', 'prototype']);
+            if (modelId && (RESERVED_KEYS_PRED.has(modelId) || typeof modelId !== 'string')) {
+                return { success: false, error: 'Invalid modelId' };
+            }
             // Find model or use default
-            const model = modelId ? store.models[modelId] : Object.values(store.models).find(m => m.status === 'ready');
+            const model = modelId
+                ? (Object.hasOwn(store.models, modelId) ? store.models[modelId] : undefined)
+                : Object.values(store.models).find(m => m.status === 'ready');
             if (model && model.status !== 'ready') {
                 return { success: false, error: 'Model not ready' };
             }
@@ -238,19 +291,25 @@ export const neuralTools = [
             const startTime = performance.now();
             const embedding = await generateEmbedding(inputText, 384);
             const latency = Math.round(performance.now() - startTime);
-            // Search stored patterns via real cosine similarity
-            const storedPatterns = Object.values(store.patterns);
+            // Search stored patterns via real cosine similarity.
+            // Cap at MAX_PATTERNS to prevent O(N) blowup if the store grew unbounded
+            // through some other path. Skip patterns below an early-exit threshold
+            // before sorting to avoid O(N log N) on irrelevant rows.
+            const MAX_SCAN = 10000;
+            const EARLY_EXIT_THRESHOLD = 0.1;
+            const storedPatterns = Object.values(store.patterns).slice(0, MAX_SCAN);
             let predictions;
             if (storedPatterns.length > 0) {
-                // Real nearest-neighbor prediction using stored pattern embeddings
-                predictions = storedPatterns
-                    .map(p => ({
-                    label: p.name || p.type || p.id,
-                    confidence: Math.max(0, cosineSimilarity(embedding, p.embedding)),
-                    patternId: p.id,
-                }))
-                    .sort((a, b) => b.confidence - a.confidence)
-                    .slice(0, topK);
+                const scored = [];
+                for (const p of storedPatterns) {
+                    if (!Array.isArray(p.embedding) || p.embedding.length !== embedding.length)
+                        continue;
+                    const conf = Math.max(0, cosineSimilarity(embedding, p.embedding));
+                    if (conf < EARLY_EXIT_THRESHOLD)
+                        continue;
+                    scored.push({ label: p.name || p.type || p.id, confidence: conf, patternId: p.id });
+                }
+                predictions = scored.sort((a, b) => b.confidence - a.confidence).slice(0, topK);
             }
             else {
                 // No patterns stored — no predictions possible
@@ -303,13 +362,21 @@ export const neuralTools = [
                 };
             }
             if (action === 'get') {
-                const pattern = store.patterns[input.patternId];
+                const patternId = input.patternId;
+                if (!patternId || NEURAL_RESERVED_KEYS.has(patternId)) {
+                    return { success: false, error: 'Invalid patternId' };
+                }
+                const pattern = Object.hasOwn(store.patterns, patternId) ? store.patterns[patternId] : undefined;
                 if (!pattern) {
                     return { success: false, error: 'Pattern not found' };
                 }
                 return { success: true, pattern };
             }
             if (action === 'store') {
+                const MAX_PATTERNS = 10000;
+                if (Object.keys(store.patterns ?? {}).length >= MAX_PATTERNS) {
+                    return { success: false, error: `Pattern store full (max ${MAX_PATTERNS}). Run neural_compress first.` };
+                }
                 const patternId = `pattern-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
                 const patternName = input.name || 'Unnamed pattern';
                 // Generate embedding from pattern name/content
@@ -347,6 +414,13 @@ export const neuralTools = [
                 }))
                     .sort((a, b) => b.similarity - a.similarity)
                     .slice(0, 10);
+                // Increment usageCount so prune can track retrieval frequency
+                for (const r of results) {
+                    if (Object.hasOwn(store.patterns, r.id)) {
+                        store.patterns[r.id].usageCount = (store.patterns[r.id].usageCount || 0) + 1;
+                    }
+                }
+                saveNeuralStore(store);
                 return {
                     _realSimilarity: true,
                     _realEmbedding: !!realEmbeddings,
@@ -362,7 +436,10 @@ export const neuralTools = [
             }
             if (action === 'delete') {
                 const patternId = input.patternId;
-                if (!store.patterns[patternId]) {
+                if (!patternId || NEURAL_RESERVED_KEYS.has(patternId)) {
+                    return { success: false, error: 'Invalid patternId' };
+                }
+                if (!Object.hasOwn(store.patterns, patternId)) {
                     return { success: false, error: 'Pattern not found' };
                 }
                 delete store.patterns[patternId];
@@ -415,9 +492,7 @@ export const neuralTools = [
                     return {
                         success: true, _real: true, method,
                         patternsCompressed: totalCompressed,
-                        compressionRatio: '3.92x (Int8)',
-                        beforeBytes: beforeSize,
-                        afterBytes: Math.round(beforeSize / 3.92),
+                        note: 'Quantization metadata stored; original embeddings retained for search accuracy.',
                     };
                 }
                 catch {
@@ -425,8 +500,13 @@ export const neuralTools = [
                 }
             }
             if (method === 'prune') {
-                // Prune patterns with low usage count below threshold (targetReduction as min usage)
-                const threshold = targetReduction;
+                // Prune the least-used fraction of patterns. targetReduction (0-1) is a percentile:
+                // 0.5 removes the bottom 50% by usageCount, 0.8 removes the bottom 80%, etc.
+                const counts = Object.values(store.patterns)
+                    .map(p => p.usageCount || 0)
+                    .sort((a, b) => a - b);
+                const cutoffIdx = Math.floor(targetReduction * counts.length);
+                const threshold = counts[cutoffIdx] ?? 0;
                 const toRemove = [];
                 for (const [id, pattern] of Object.entries(store.patterns)) {
                     if ((pattern.usageCount || 0) < threshold)
@@ -492,7 +572,11 @@ export const neuralTools = [
         handler: async (input) => {
             const store = loadNeuralStore();
             if (input.modelId) {
-                const model = store.models[input.modelId];
+                const modelId = input.modelId;
+                if (NEURAL_RESERVED_KEYS.has(modelId)) {
+                    return { success: false, error: 'Invalid modelId' };
+                }
+                const model = Object.hasOwn(store.models, modelId) ? store.models[modelId] : undefined;
                 if (!model) {
                     return { success: false, error: 'Model not found' };
                 }
@@ -502,7 +586,7 @@ export const neuralTools = [
             const patterns = Object.values(store.patterns);
             return {
                 _realEmbeddings: !!realEmbeddings,
-                embeddingProvider: realEmbeddings ? `@monoes/embeddings (${embeddingServiceName})` : 'hash-based (deterministic)',
+                embeddingProvider: realEmbeddings ? `@monomind/embeddings (${embeddingServiceName})` : 'hash-based (deterministic)',
                 models: {
                     total: models.length,
                     ready: models.filter(m => m.status === 'ready').length,

package/packages/@monomind/cli/dist/src/mcp-tools/performance-tools.js

@@ -12,7 +12,7 @@
  * Note: Some optimization suggestions are illustrative
  */
 import { getProjectCwd } from './types.js';
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, renameSync, unlinkSync, readdirSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import * as os from 'node:os';
 // Storage paths
@@ -46,7 +46,10 @@ function loadPerfStore() {
 }
 function savePerfStore(store) {
     ensurePerfDir();
-    writeFileSync(getPerfPath(), JSON.stringify(store, null, 2), 'utf-8');
+    const dest = getPerfPath();
+    const tmpPath = `${dest}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(store, null, 2), 'utf-8');
+    renameSync(tmpPath, dest);
 }
 export const performanceTools = [
     {
@@ -177,7 +180,6 @@ export const performanceTools = [
                 readFileSync(probeFile);
                 diskLatencyMs = Math.round((performance.now() - t0) * 100) / 100;
                 try {
-                    const { unlinkSync } = require('node:fs');
                     unlinkSync(probeFile);
                 }
                 catch { /* best-effort */ }
@@ -301,6 +303,13 @@ export const performanceTools = [
                         createdAt: new Date().toISOString(),
                     };
                     store.benchmarks[id] = result;
+                    // Evict oldest entries if over limit
+                    const MAX_BENCHMARKS = 200;
+                    const benchEntries = Object.entries(store.benchmarks)
+                        .sort(([, a], [, b]) => (a.createdAt < b.createdAt ? -1 : 1));
+                    if (benchEntries.length > MAX_BENCHMARKS) {
+                        store.benchmarks = Object.fromEntries(benchEntries.slice(-MAX_BENCHMARKS));
+                    }
                     results.push({
                         name: suiteName,
                         opsPerSec,
@@ -312,9 +321,10 @@ export const performanceTools = [
             }
             savePerfStore(store);
             // Calculate comparison vs previous benchmarks
+            const runStart = new Date().toISOString();
             const allBenchmarks = Object.values(store.benchmarks);
             const previousBenchmarks = allBenchmarks
-                .filter(b => suitesToRun.includes(b.name) && b.createdAt < results[0]?.name)
+                .filter(b => suitesToRun.includes(b.name) && b.createdAt < runStart)
                 .slice(-suitesToRun.length);
             const comparison = previousBenchmarks.length > 0
                 ? {
@@ -365,6 +375,9 @@ export const performanceTools = [
             };
             const targets = target === 'all' ? ['memory', 'io', 'cpu'] : [target];
             const deadline = wallStart + durationMs;
+            // Cap I/O operations to prevent the io target from saturating disk/event loop
+            const MAX_IO_OPS = 1000;
+            let ioOps = 0;
             while (performance.now() < deadline) {
                 for (const t of targets) {
                     if (performance.now() >= deadline)
@@ -375,11 +388,14 @@ export const performanceTools = [
                         runOp('array-sort', () => { const a = Array.from({ length: 500 }, () => Math.random()); a.sort(); });
                     }
                     else if (t === 'io') {
+                        if (ioOps >= MAX_IO_OPS)
+                            continue;
                         runOp('file-write', () => { ensurePerfDir(); writeFileSync(join(getPerfDir(), '.profile-probe'), 'x'.repeat(1024)); });
                         runOp('file-read', () => { try {
                             readFileSync(join(getPerfDir(), '.profile-probe'));
                         }
                         catch { /* ok */ } });
+                        ioOps += 2;
                     }
                     else if (t === 'cpu') {
                         runOp('matrix-mult', () => { const s = 32; const a = Array.from({ length: s }, () => Array.from({ length: s }, () => Math.random())); for (let i = 0; i < s; i++)
@@ -408,7 +424,6 @@ export const performanceTools = [
                 .sort((a, b) => b.percentOfTotal - a.percentOfTotal);
             // Cleanup probe file
             try {
-                const { unlinkSync } = require('node:fs');
                 unlinkSync(join(getPerfDir(), '.profile-probe'));
             }
             catch { /* ok */ }
@@ -459,7 +474,6 @@ export const performanceTools = [
                 readFileSync(probe);
                 diskLatencyBefore = Math.round((performance.now() - t0) * 100) / 100;
                 try {
-                    const { unlinkSync } = require('node:fs');
                     unlinkSync(probe);
                 }
                 catch { /* ok */ }
@@ -504,10 +518,9 @@ export const performanceTools = [
             if (aggressive) {
                 try {
                     const dir = getPerfDir();
-                    const { readdirSync, unlinkSync: ul } = require('node:fs');
                     const probes = readdirSync(dir).filter((f) => f.startsWith('.'));
                     probes.forEach((f) => { try {
-                        ul(join(dir, f));
+                        unlinkSync(join(dir, f));
                     }
                     catch { /* ok */ } });
                     if (probes.length > 0)

package/packages/@monomind/cli/dist/src/mcp-tools/progress-tools.js

@@ -3,16 +3,16 @@
  *
  * Provides MCP tools for checking and syncing V1 implementation progress.
  *
- * @module @monoes/cli/mcp-tools/progress
+ * @module @monomind/cli/mcp-tools/progress
  */
-import { existsSync, readdirSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { existsSync, readdirSync, readFileSync, writeFileSync, renameSync, mkdirSync } from 'fs';
 import { join, basename, dirname } from 'path';
 import { fileURLToPath } from 'url';
 // Get project root - handles both src and dist paths
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // From dist/src/mcp-tools or src/mcp-tools, navigate to v1 directory
-// CLI is at packages/@monoes/cli, so go up 2 levels from cli to get to v1
+// CLI is at packages/@monomind/cli, so go up 2 levels from cli to get to v1
 const CLI_ROOT = join(__dirname, '../../..');
 const MONOMIND_DIR = join(CLI_ROOT, '..'); // @monomind directory
 const PACKAGES_DIR = join(MONOMIND_DIR, '..'); // v1 directory
@@ -92,7 +92,7 @@ function calculateModuleProgress(moduleDir) {
 async function calculateProgress() {
     const now = new Date().toISOString();
     // Count V1 modules
-    const modulesDir = join(PACKAGES_DIR, '@monoes');
+    const modulesDir = join(PACKAGES_DIR, '@monomind');
     const modules = [];
     let totalProgress = 0;
     let explicitDDD = 0;
@@ -119,7 +119,7 @@ async function calculateProgress() {
     const totalStats = countFilesAndLines(PACKAGES_DIR);
     // Count CLI commands (from commands/index.ts)
     let cliCommands = 28; // Default to known count
-    const commandsIndexPath = join(PACKAGES_DIR, '@monoes/cli/src/commands/index.ts');
+    const commandsIndexPath = join(PACKAGES_DIR, '@monomind/cli/src/commands/index.ts');
     if (existsSync(commandsIndexPath)) {
         try {
             const content = readFileSync(commandsIndexPath, 'utf-8');
@@ -132,7 +132,7 @@ async function calculateProgress() {
     }
     // Count MCP tools
     let mcpTools = 100; // Approximate
-    const toolsIndexPath = join(PACKAGES_DIR, '@monoes/cli/src/mcp-tools/index.ts');
+    const toolsIndexPath = join(PACKAGES_DIR, '@monomind/cli/src/mcp-tools/index.ts');
     if (existsSync(toolsIndexPath)) {
         try {
             const content = readFileSync(toolsIndexPath, 'utf-8');
@@ -142,7 +142,7 @@ async function calculateProgress() {
     }
     // Count hooks subcommands (count const *Command definitions)
     let hooksSubcommands = 27; // Default to documented count
-    const hooksPath = join(PACKAGES_DIR, '@monoes/cli/src/commands/hooks.ts');
+    const hooksPath = join(PACKAGES_DIR, '@monomind/cli/src/commands/hooks.ts');
     if (existsSync(hooksPath)) {
         try {
             const content = readFileSync(hooksPath, 'utf-8');
@@ -191,7 +191,8 @@ async function syncProgress() {
         mkdirSync(metricsDir, { recursive: true });
     }
     const outputPath = join(metricsDir, 'v1-progress.json');
-    writeFileSync(outputPath, JSON.stringify({
+    const outputTmp = outputPath + '.tmp';
+    writeFileSync(outputTmp, JSON.stringify({
         domains: { completed: Math.floor(metrics.packages.withDDD / 3), total: 5 },
         ddd: {
             progress: metrics.ddd.progress,
@@ -203,6 +204,7 @@ async function syncProgress() {
         lastUpdated: metrics.lastUpdated,
         source: 'ProgressService',
     }, null, 2));
+    renameSync(outputTmp, outputPath);
     return metrics;
 }
 function getSummary(metrics) {

package/packages/@monomind/cli/dist/src/mcp-tools/request-tracker.js

@@ -3,6 +3,7 @@
  * Lightweight counter for tracking MCP tool invocations.
  * Used by system_metrics to report real request counts.
  */
+const MAX_TRACKED_TOOLS = 500;
 let counts = {
     total: 0,
     success: 0,
@@ -16,7 +17,9 @@ export function trackRequest(toolName, success) {
         counts.success++;
     else
         counts.errors++;
-    counts.byTool[toolName] = (counts.byTool[toolName] || 0) + 1;
+    if (Object.keys(counts.byTool).length < MAX_TRACKED_TOOLS || toolName in counts.byTool) {
+        counts.byTool[toolName] = (counts.byTool[toolName] || 0) + 1;
+    }
 }
 export function getRequestCounts() {
     return { ...counts };

package/packages/@monomind/cli/dist/src/mcp-tools/ruvllm-tools.js

@@ -7,6 +7,20 @@
 async function loadRuvllmWasm() {
     return import('../ruvector/ruvllm-wasm.js');
 }
+// ── Instance Registries ──────────────────────────────────────
+const hnswRouters = new Map();
+const sonaInstances = new Map();
+const loraInstances = new Map();
+// ── Map eviction (prevents WASM object leaks in long-running MCP servers) ────
+const MAX_MAP_SIZE = 50;
+function setWithEviction(map, key, value) {
+    if (map.size >= MAX_MAP_SIZE) {
+        // Evict the oldest entry (first inserted)
+        const firstKey = map.keys().next().value;
+        map.delete(firstKey);
+    }
+    map.set(key, value);
+}
 export const ruvllmWasmTools = [
     {
         name: 'ruvllm_status',
@@ -45,7 +59,7 @@ export const ruvllmWasmTools = [
                 });
                 // Store router in module-level registry
                 const id = `hnsw-${Date.now().toString(36)}`;
-                hnswRouters.set(id, router);
+                setWithEviction(hnswRouters, id, router);
                 return { content: [{ type: 'text', text: JSON.stringify({ success: true, routerId: id, dimensions: args.dimensions, maxPatterns: args.maxPatterns }) }] };
             }
             catch (err) {
@@ -102,7 +116,8 @@ export const ruvllmWasmTools = [
                 if (!router)
                     return { content: [{ type: 'text', text: JSON.stringify({ error: `Router not found: ${args.routerId}` }) }], isError: true };
                 const query = new Float32Array(args.query);
-                const results = router.route(query, args.k ?? 3);
+                const k = typeof args.k === 'number' && args.k > 0 ? Math.floor(args.k) : 3;
+                const results = router.route(query, k);
                 return { content: [{ type: 'text', text: JSON.stringify({ results }) }] };
             }
             catch (err) {
@@ -130,7 +145,7 @@ export const ruvllmWasmTools = [
                     patternCapacity: args.patternCapacity,
                 });
                 const id = `sona-${Date.now().toString(36)}`;
-                sonaInstances.set(id, sona);
+                setWithEviction(sonaInstances, id, sona);
                 return { content: [{ type: 'text', text: JSON.stringify({ success: true, sonaId: id }) }] };
             }
             catch (err) {
@@ -185,7 +200,7 @@ export const ruvllmWasmTools = [
                     alpha: args.alpha,
                 });
                 const id = `lora-${Date.now().toString(36)}`;
-                loraInstances.set(id, lora);
+                setWithEviction(loraInstances, id, lora);
                 return { content: [{ type: 'text', text: JSON.stringify({ success: true, loraId: id }) }] };
             }
             catch (err) {
@@ -277,8 +292,4 @@ export const ruvllmWasmTools = [
         },
     },
 ];
-// ── Instance Registries ──────────────────────────────────────
-const hnswRouters = new Map();
-const sonaInstances = new Map();
-const loraInstances = new Map();
 //# sourceMappingURL=ruvllm-tools.js.map