monomind 1.8.0 → 1.9.0

package/packages/@monomind/cli/dist/src/benchmarks/metric-evaluators.js

@@ -76,12 +76,35 @@ export function jsonValid(output) {
  * Checks whether the output matches a custom regex pattern.
  */
 export function customRegex(output, config) {
+    // Reject overly long patterns and those with nested/repeated quantifiers
+    // (catastrophic backtracking — a malicious benchmark definition could
+    // pin CI runners with `^(a+)+$` against a long output string).
+    if (typeof config.pattern !== 'string' || config.pattern.length > 200) {
+        return {
+            type: 'custom_regex',
+            passed: false,
+            actual: null,
+            expected: config.pattern,
+            message: 'Pattern rejected: too long or invalid',
+        };
+    }
+    if (/(\(.*[+*?].*\)|[+*?]){2,}|\{[0-9,]+\}.*[+*?]|\([^)]*\|[^)]*\)[+*?{]/.test(config.pattern)) {
+        return {
+            type: 'custom_regex',
+            passed: false,
+            actual: null,
+            expected: config.pattern,
+            message: 'Pattern rejected: nested quantifiers risk catastrophic backtracking',
+        };
+    }
+    // Cap output length so even slow patterns can't burn unlimited CPU
+    const boundedOutput = output.length > 1024 * 1024 ? output.slice(0, 1024 * 1024) : output;
     const regex = new RegExp(config.pattern);
-    const match = regex.test(output);
+    const match = regex.test(boundedOutput);
     return {
         type: 'custom_regex',
         passed: match,
-        actual: match ? output.match(regex)?.[0] ?? null : null,
+        actual: match ? boundedOutput.match(regex)?.[0] ?? null : null,
         expected: config.pattern,
         message: match
             ? `Output matches pattern /${config.pattern}/`

package/packages/@monomind/cli/dist/src/commands/agent.js

@@ -34,7 +34,9 @@ function updateSwarmActivityMetrics(agentCountDelta) {
         swarm.coordination_active = newCount > 0;
         data.swarm = swarm;
         data.timestamp = new Date().toISOString();
-        fs.writeFileSync(activityPath, JSON.stringify(data, null, 2));
+        const tmpPath = activityPath + '.tmp';
+        fs.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
+        fs.renameSync(tmpPath, activityPath);
     }
     catch {
         // Non-critical — don't fail the command if metrics update fails
@@ -125,7 +127,7 @@ const spawnCommand = {
         const taskDescription = ctx.flags.task;
         if (!agentType && taskDescription) {
             try {
-                const { RouteLayer, ALL_ROUTES } = await import('@monoes/routing');
+                const { RouteLayer, ALL_ROUTES } = await import('@monomind/routing');
                 const layer = new RouteLayer({ routes: ALL_ROUTES });
                 const routeResult = await layer.route(taskDescription);
                 agentType = routeResult.agentSlug;
@@ -154,7 +156,7 @@ const spawnCommand = {
                     model: ctx.flags.model,
                     task: ctx.flags.task,
                     timeout: ctx.flags.timeout,
-                    autoTools: ctx.flags.autoTools,
+                    autoTools: ctx.flags['auto-tools'],
                 },
                 priority: 'normal',
                 metadata: {
@@ -602,7 +604,7 @@ const poolCommand = {
                 size: ctx.flags.size,
                 min: ctx.flags.min,
                 max: ctx.flags.max,
-                autoScale: ctx.flags.autoScale ?? true,
+                autoScale: ctx.flags['auto-scale'] ?? true,
             });
             if (ctx.flags.format === 'json') {
                 output.printJson(result);

package/packages/@monomind/cli/dist/src/commands/appliance-advanced.js

@@ -3,6 +3,7 @@
  * Sign, publish, and hot-patch RVFA appliances.
  */
 import { output } from '../output.js';
+import * as path from 'node:path';
 function fmtSize(bytes) {
     if (bytes < 1024)
         return `${bytes} B`;
@@ -15,6 +16,16 @@ function fmtSize(bytes) {
 function errMsg(err) {
     return err instanceof Error ? err.message : String(err);
 }
+function checkRelativePath(userPath) {
+    if (!path.isAbsolute(userPath)) {
+        const resolved = path.resolve(userPath);
+        const rel = path.relative(process.cwd(), resolved);
+        if (rel.startsWith('..')) {
+            return `Relative path '${userPath}' escapes the working directory.`;
+        }
+    }
+    return null;
+}
 const fail = (msg, detail) => {
     output.printError(msg, detail);
     return { success: false, exitCode: 1 };
@@ -69,6 +80,9 @@ export const signCommand = {
             hdr('Signing RVFA Appliance');
             let privateKey;
             if (keyPath) {
+                const pathErr = checkRelativePath(keyPath);
+                if (pathErr)
+                    return fail(pathErr);
                 const fs = await import('fs');
                 privateKey = fs.readFileSync(keyPath);
             }
@@ -162,12 +176,18 @@ export const updateAppCommand = {
             output.writeln();
             let patchBuf;
             if (patchPath) {
+                const patchPathErr = checkRelativePath(patchPath);
+                if (patchPathErr)
+                    return fail(patchPathErr);
                 if (!(await requireFile(patchPath)))
                     return { success: false, exitCode: 1 };
                 patchBuf = fs.readFileSync(patchPath);
                 output.printInfo(`Patch file: ${patchPath} (${fmtSize(patchBuf.length)})`);
             }
             else {
+                const dataPathErr = checkRelativePath(dataPath);
+                if (dataPathErr)
+                    return fail(dataPathErr);
                 if (!(await requireFile(dataPath)))
                     return { success: false, exitCode: 1 };
                 const newData = fs.readFileSync(dataPath);
@@ -186,6 +206,9 @@ export const updateAppCommand = {
             let pubKey;
             if (ctx.flags['public-key']) {
                 const pkPath = ctx.flags['public-key'];
+                const pkPathErr = checkRelativePath(pkPath);
+                if (pkPathErr)
+                    return fail(pkPathErr);
                 if (!(await requireFile(pkPath)))
                     return { success: false, exitCode: 1 };
                 pubKey = fs.readFileSync(pkPath);

package/packages/@monomind/cli/dist/src/commands/autopilot.js

@@ -6,6 +6,8 @@
  */
 import { output } from '../output.js';
 import { loadState, saveState, appendLog, loadLog, discoverTasks, getProgress, calculateReward, tryLoadLearning, validateNumber, validateTaskSources, LOG_FILE, } from '../autopilot-state.js';
+import { writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
 // ── Check Handler (for Stop hook) ─────────────────────────────
 export async function autopilotCheck() {
     const state = loadState();
@@ -182,10 +184,8 @@ const logCommand = {
     ],
     action: async (ctx) => {
         if (ctx.flags?.clear) {
-            const fs = require('fs');
-            const path = require('path');
             try {
-                fs.writeFileSync(path.resolve(LOG_FILE), '[]');
+                writeFileSync(resolve(LOG_FILE), '[]');
             }
             catch { /* ignore */ }
             output.writeln('Autopilot log cleared');

package/packages/@monomind/cli/dist/src/commands/benchmark.js

@@ -5,8 +5,9 @@
  * @module v1/cli/commands/benchmark
  */
 import { output } from '../output.js';
-import { writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { writeFileSync, renameSync, readFileSync, existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
+import { BenchmarkRunner } from '../benchmarks/benchmark-runner.js';
 // ============================================================================
 // Pretrain Benchmark Subcommand
 // ============================================================================
@@ -50,7 +51,9 @@ const pretrainCommand = {
                     mkdirSync(resultsDir, { recursive: true });
                 }
                 const savePath = saveFile.startsWith('/') ? saveFile : join(resultsDir, saveFile);
-                writeFileSync(savePath, JSON.stringify(results, null, 2));
+                const saveTmp = savePath + '.tmp';
+                writeFileSync(saveTmp, JSON.stringify(results, null, 2));
+                renameSync(saveTmp, savePath);
                 output.writeln(output.success(`Results saved to ${savePath}`));
             }
             const allPassed = results.results.every(r => r.targetMet);
@@ -276,7 +279,7 @@ const memoryCommand = {
                 searchEntries = memory.searchEntries;
             }
             catch {
-                // @monoes/memory not available — return null metrics instead of fake numbers
+                // @monomind/memory not available — return null metrics instead of fake numbers
                 storeEntry = async () => ({ success: true });
                 searchEntries = async () => ({ results: [], searchTime: 0 }); // 0 = no-op fallback, not a real benchmark
             }
@@ -410,17 +413,121 @@ const allCommand = {
                 mkdirSync(resultsDir, { recursive: true });
             }
             const savePath = saveFile.startsWith('/') ? saveFile : join(resultsDir, saveFile);
-            writeFileSync(savePath, JSON.stringify({
+            const saveTmp2 = savePath + '.tmp';
+            writeFileSync(saveTmp2, JSON.stringify({
                 timestamp: new Date().toISOString(),
                 duration: totalDuration,
                 results: allResults,
             }, null, 2));
+            renameSync(saveTmp2, savePath);
             output.writeln(output.success(`Results saved to ${savePath}`));
         }
         return { success: true, message: 'All benchmarks complete' };
     },
 };
 // ============================================================================
+// Regression Benchmark Subcommand
+// ============================================================================
+const regressionCommand = {
+    name: 'regression',
+    description: 'Quality regression testing using benchmark definitions and baselines',
+    options: [
+        { name: 'suite', short: 's', type: 'string', description: 'Path to benchmark definitions directory', default: '.monomind/benchmarks/definitions' },
+        { name: 'benchmark-id', short: 'b', type: 'string', description: 'Run a specific benchmark by ID' },
+        { name: 'agent-output', short: 'a', type: 'string', description: 'Path to file containing agent output to evaluate' },
+        { name: 'pin-baseline', type: 'boolean', description: 'Save current results as the new baseline', default: 'false' },
+        { name: 'output', short: 'o', type: 'string', description: 'Output format: text, json', default: 'text' },
+    ],
+    examples: [
+        { command: 'monomind benchmark regression', description: 'List all benchmark definitions' },
+        { command: 'monomind benchmark regression -b agent-spawn -a output.txt', description: 'Evaluate agent output against a benchmark' },
+        { command: 'monomind benchmark regression -b agent-spawn -a output.txt --pin-baseline', description: 'Evaluate and pin results as new baseline' },
+    ],
+    action: async (ctx) => {
+        const suiteDir = ctx.flags.suite || '.monomind/benchmarks/definitions';
+        const benchmarkId = ctx.flags['benchmark-id'];
+        const agentOutputFile = ctx.flags['agent-output'];
+        const pinBaseline = ctx.flags['pin-baseline'] === true;
+        const outputFormat = ctx.flags.output || 'text';
+        const runner = new BenchmarkRunner();
+        const baselinesDir = join(process.cwd(), '.monomind', 'benchmarks', 'baselines');
+        const definitions = runner.loadBenchmarks(join(process.cwd(), suiteDir));
+        if (definitions.length === 0) {
+            output.writeln(output.dim(`No benchmark definitions found in ${suiteDir}`));
+            output.writeln(output.dim('Create JSON files there to define quality benchmarks.'));
+            return { success: true, message: 'No benchmarks defined' };
+        }
+        // List mode — no agent output provided
+        if (!agentOutputFile) {
+            output.writeln();
+            output.writeln(output.bold('Benchmark Definitions'));
+            output.writeln(output.dim('─'.repeat(50)));
+            for (const def of definitions) {
+                output.writeln(`  ${output.highlight(def.benchmarkId)}  ${output.dim(def.agentSlug)}  — ${def.qualityMetrics?.length ?? 0} metrics`);
+            }
+            output.writeln();
+            output.writeln(output.dim('Use --agent-output <file> to evaluate against a benchmark.'));
+            return { success: true, message: `${definitions.length} benchmarks loaded` };
+        }
+        // Evaluation mode
+        if (!existsSync(agentOutputFile)) {
+            output.writeln(output.error(`Agent output file not found: ${agentOutputFile}`));
+            return { success: false, message: 'Agent output file not found' };
+        }
+        const agentOutput = readFileSync(agentOutputFile, 'utf-8');
+        const targetDefs = benchmarkId
+            ? definitions.filter((d) => d.benchmarkId === benchmarkId)
+            : definitions;
+        if (targetDefs.length === 0) {
+            output.writeln(output.error(`No benchmark found with id: ${benchmarkId}`));
+            return { success: false, message: 'Benchmark not found' };
+        }
+        const results = targetDefs.map((def) => runner.runBenchmark(def, agentOutput));
+        if (outputFormat === 'json') {
+            output.writeln(JSON.stringify(results, null, 2));
+        }
+        else {
+            output.writeln();
+            output.writeln(output.bold('Regression Results'));
+            output.writeln(output.dim('─'.repeat(50)));
+            for (const result of results) {
+                const status = result.passed ? output.success('PASS') : output.error('FAIL');
+                output.writeln(`  ${status}  ${result.benchmarkId}  ${output.dim(`${result.durationMs}ms`)}`);
+                for (const m of result.metricResults) {
+                    const mStatus = m.passed ? '  ✓' : '  ✗';
+                    output.writeln(`    ${mStatus}  ${m.type}`);
+                }
+            }
+            output.writeln();
+        }
+        // Baseline comparison
+        const baselinePath = join(baselinesDir, `${benchmarkId ?? 'all'}.json`);
+        if (existsSync(baselinePath)) {
+            const baseline = JSON.parse(readFileSync(baselinePath, 'utf-8'));
+            const hasRegression = runner.detectRegression(results, baseline);
+            if (hasRegression) {
+                output.writeln(output.error(`Regression detected — pass rate dropped below baseline (${(baseline.passRate * 100).toFixed(0)}%)`));
+            }
+            else {
+                output.writeln(output.success('No regression detected vs baseline'));
+            }
+        }
+        // Pin baseline
+        if (pinBaseline) {
+            if (!existsSync(baselinesDir))
+                mkdirSync(baselinesDir, { recursive: true });
+            const id = benchmarkId ?? 'all';
+            const baseline = runner.pinBaseline(id, results);
+            const baselineTmp = baselinePath + '.tmp';
+            writeFileSync(baselineTmp, JSON.stringify(baseline, null, 2));
+            renameSync(baselineTmp, baselinePath);
+            output.writeln(output.success(`Baseline pinned: ${(baseline.passRate * 100).toFixed(0)}% pass rate`));
+        }
+        const allPassed = results.every((r) => r.passed);
+        return { success: allPassed, message: allPassed ? 'All metrics passed' : 'Some metrics failed' };
+    },
+};
+// ============================================================================
 // Main Benchmark Command
 // ============================================================================
 export const benchmarkCommand = {
@@ -431,12 +538,15 @@ export const benchmarkCommand = {
         neuralCommand,
         memoryCommand,
         allCommand,
+        regressionCommand,
     ],
     examples: [
         { command: 'monomind benchmark pretrain', description: 'Benchmark pre-training system' },
         { command: 'monomind benchmark neural', description: 'Benchmark neural operations' },
         { command: 'monomind benchmark memory', description: 'Benchmark memory operations' },
         { command: 'monomind benchmark all', description: 'Run all benchmarks' },
+        { command: 'monomind benchmark regression', description: 'List quality regression benchmarks' },
+        { command: 'monomind benchmark regression -b my-bench -a output.txt', description: 'Evaluate agent output against a benchmark' },
     ],
     action: async (_ctx) => {
         output.writeln();
@@ -444,10 +554,11 @@ export const benchmarkCommand = {
         output.writeln(output.dim('─'.repeat(50)));
         output.writeln();
         output.writeln('Available subcommands:');
-        output.writeln(`  ${output.highlight('pretrain')}  - Benchmark self-learning pre-training (SONA, EWC++, MoE)`);
-        output.writeln(`  ${output.highlight('neural')}    - Benchmark neural operations (embeddings, WASM)`);
-        output.writeln(`  ${output.highlight('memory')}    - Benchmark memory operations (HNSW, store, search)`);
-        output.writeln(`  ${output.highlight('all')}       - Run all benchmark suites`);
+        output.writeln(`  ${output.highlight('pretrain')}    - Benchmark self-learning pre-training (SONA, EWC++, MoE)`);
+        output.writeln(`  ${output.highlight('neural')}      - Benchmark neural operations (embeddings, WASM)`);
+        output.writeln(`  ${output.highlight('memory')}      - Benchmark memory operations (HNSW, store, search)`);
+        output.writeln(`  ${output.highlight('all')}         - Run all benchmark suites`);
+        output.writeln(`  ${output.highlight('regression')}  - Quality regression testing with baselines`);
         output.writeln();
         output.writeln('Examples:');
         output.writeln('  monomind benchmark pretrain -i 200');

package/packages/@monomind/cli/dist/src/commands/claims.js

@@ -5,27 +5,39 @@
  * github.com/nokhodian/monomind
  */
 import { output } from '../output.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import { homedir } from 'os';
 const CLAIMS_CONFIG_PATHS = [
     '.monomind/claims.json',
     'monomind.claims.json',
 ];
 function getClaimsConfigPaths() {
-    // Lazy import to keep top-level synchronous
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
-    const path = require('path');
     return [
         path.resolve(CLAIMS_CONFIG_PATHS[0]),
         path.resolve(CLAIMS_CONFIG_PATHS[1]),
-        path.resolve(process.env.HOME || '~', '.config/monomind/claims.json'),
+        path.resolve(homedir(), '.config/monomind/claims.json'),
     ];
 }
+function safeParseJson(content) {
+    const parsed = JSON.parse(content);
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('Claims config must be a JSON object');
+    }
+    const safe = Object.create(null);
+    for (const key of Object.keys(parsed)) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+            continue;
+        safe[key] = parsed[key];
+    }
+    return safe;
+}
 function loadClaimsConfig() {
-    const fs = require('fs');
     const configPaths = getClaimsConfigPaths();
     for (const configPath of configPaths) {
         if (fs.existsSync(configPath)) {
             const content = fs.readFileSync(configPath, 'utf-8');
-            return { config: JSON.parse(content), path: configPath };
+            return { config: safeParseJson(content), path: configPath };
         }
     }
     // Return default config with the first path as the default write location
@@ -41,8 +53,6 @@ function loadClaimsConfig() {
     return { config: defaultConfig, path: configPaths[0] };
 }
 function saveClaimsConfig(config, configPath) {
-    const fs = require('fs');
-    const path = require('path');
     const dir = path.dirname(configPath);
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
@@ -166,7 +176,7 @@ const checkCommand = {
             const claimsConfigPaths = [
                 path.resolve('.monomind/claims.json'),
                 path.resolve('monomind.claims.json'),
-                path.resolve(process.env.HOME || '~', '.config/monomind/claims.json'),
+                path.resolve(homedir(), '.config/monomind/claims.json'),
             ];
             let claimsConfig = {
                 // Default policy - allows basic operations
@@ -181,7 +191,7 @@ const checkCommand = {
             for (const configPath of claimsConfigPaths) {
                 if (fs.existsSync(configPath)) {
                     const content = fs.readFileSync(configPath, 'utf-8');
-                    claimsConfig = { ...claimsConfig, ...JSON.parse(content) };
+                    claimsConfig = { ...claimsConfig, ...safeParseJson(content) };
                     policySource = configPath;
                     break;
                 }
@@ -235,10 +245,8 @@ const checkCommand = {
         }
         catch (error) {
             spinner.stop();
-            // On error, fall back to permissive default
-            isGranted = !claim.startsWith('admin:');
-            reason = isGranted ? 'Granted (default permissive policy)' : 'Admin claims require explicit grant';
-            policySource = 'fallback';
+            output.printError(`Failed to evaluate claim: ${error instanceof Error ? error.message : String(error)}`);
+            return { success: false, exitCode: 1 };
         }
         if (isGranted) {
             output.writeln(output.success('✓ Claim granted'));

package/packages/@monomind/cli/dist/src/commands/config.js

@@ -3,6 +3,7 @@
  * Configuration management
  */
 import { output } from '../output.js';
+import { confirm } from '../prompt.js';
 import { configManager, parseConfigValue } from '../services/config-file-manager.js';
 import * as path from 'path';
 // Init configuration
@@ -146,6 +147,13 @@ const setCommand = {
             output.printError('Both key and value are required');
             return { success: false, exitCode: 1 };
         }
+        const FORBIDDEN_KEY_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+        for (const seg of key.split('.')) {
+            if (FORBIDDEN_KEY_SEGMENTS.has(seg)) {
+                output.printError(`Forbidden config key segment: "${seg}"`);
+                return { success: false, exitCode: 1 };
+            }
+        }
         try {
             const parsedValue = parseConfigValue(value);
             configManager.set(ctx.cwd, key, parsedValue);
@@ -311,6 +319,25 @@ const resetCommand = {
     ],
     action: async (ctx) => {
         try {
+            if (!ctx.flags.force && ctx.interactive) {
+                const confirmed = await confirm({ message: 'This will reset all configuration to defaults. Continue?', default: false });
+                if (!confirmed)
+                    return { success: true, message: 'Reset cancelled' };
+            }
+            const section = ctx.flags.section;
+            if (section && section !== 'all') {
+                // Scoped reset: remove only the specified section key from the config.
+                // Setting to undefined causes JSON serialization to omit the key, effectively removing it.
+                const current = configManager.getConfig(ctx.cwd);
+                if (section in current) {
+                    configManager.set(ctx.cwd, section, configManager.getDefaults()[section]);
+                    output.writeln(`Section "${section}" reset to defaults`);
+                }
+                else {
+                    output.printWarning(`Section "${section}" not found in configuration`);
+                }
+                return { success: true };
+            }
             const configPath = configManager.reset(ctx.cwd);
             output.writeln(`Configuration reset to defaults: ${configPath}`);
             return { success: true };
@@ -344,6 +371,11 @@ const exportCommand = {
     ],
     action: async (ctx) => {
         try {
+            const format = ctx.flags.format || 'json';
+            if (format === 'yaml') {
+                // configManager.exportTo does not support YAML serialization; export as JSON instead
+                output.printWarning('YAML export is not supported. Exporting as JSON.');
+            }
             const exportPath = ctx.flags.output || ctx.args[0] || 'monomind.config.export.json';
             configManager.exportTo(ctx.cwd, exportPath);
             const resolved = path.resolve(ctx.cwd, exportPath);

package/packages/@monomind/cli/dist/src/commands/daemon.js

@@ -6,7 +6,7 @@ import { output } from '../output.js';
 import { getDaemon, startDaemon, stopDaemon } from '../services/worker-daemon.js';
 import { spawn } from 'child_process';
 import { fileURLToPath } from 'url';
-import { dirname, join, resolve } from 'path';
+import { dirname, join, resolve, sep } from 'path';
 import * as fs from 'fs';
 // Start daemon subcommand
 const startCommand = {
@@ -185,12 +185,9 @@ function validatePath(path, label) {
         throw new Error(`${label} contains shell metacharacters`);
     }
     // Prevent path traversal outside expected directories
-    if (!resolved.includes('.monomind') && !resolved.includes('bin')) {
-        // Allow only paths within project structure
-        const cwd = process.cwd();
-        if (!resolved.startsWith(cwd)) {
-            throw new Error(`${label} escapes project directory`);
-        }
+    const cwd = process.cwd();
+    if (!resolved.startsWith(cwd + sep) && !resolved.startsWith(cwd + '/') && resolved !== cwd) {
+        throw new Error(`${label} escapes project directory`);
     }
 }
 /**
@@ -237,7 +234,7 @@ async function startBackgroundDaemon(projectRoot, quiet, maxCpuLoad, minFreeMemo
             // Prevent macOS SIGHUP kill when terminal closes
             ...(process.platform === 'darwin' ? { NOHUP: '1' } : {}),
         },
-        ...(isWin ? { shell: true, windowsHide: true } : {}),
+        ...(isWin ? { windowsHide: true } : {}),
     };
     // Use spawn with explicit arguments instead of shell string interpolation
     // This prevents command injection via paths
@@ -271,12 +268,17 @@ async function startBackgroundDaemon(projectRoot, quiet, maxCpuLoad, minFreeMemo
     // Write PID file only if the child hasn't already written its own.
     // The foreground child calls writePidFile() internally, but on some platforms
     // it may not have started yet, so we write as a fallback.
-    if (!fs.existsSync(pidFile)) {
-        fs.writeFileSync(pidFile, String(pid));
+    // Use 'wx' flag for atomic exclusive create — avoids TOCTOU race.
+    try {
+        fs.writeFileSync(pidFile, String(pid), { flag: 'wx' });
+    }
+    catch {
+        // File already exists (child wrote it first) — that's expected, ignore
     }
     if (!quiet) {
+        const actualLogPath = join(resolvedRoot, '.monomind', 'logs', 'daemon.log');
         output.printSuccess(`Daemon started in background (PID: ${pid})`);
-        output.printInfo(`Logs: ${logFile}`);
+        output.printInfo(`Logs: ${actualLogPath}`);
         output.printInfo(`Stop with: monomind daemon stop`);
     }
     return { success: true };

package/packages/@monomind/cli/dist/src/commands/deployment.js

@@ -26,13 +26,27 @@ function loadDeploymentState(cwd) {
     }
     try {
         const raw = fs.readFileSync(filePath, 'utf-8');
-        return JSON.parse(raw);
+        const parsed = JSON.parse(raw);
+        // Strip proto-pollution keys before casting
+        const DANGEROUS = new Set(['__proto__', 'constructor', 'prototype']);
+        if (parsed !== null && typeof parsed === 'object') {
+            for (const k of DANGEROUS) {
+                if (Object.prototype.hasOwnProperty.call(parsed, k))
+                    delete parsed[k];
+            }
+        }
+        return parsed;
     }
     catch {
         return emptyState();
     }
 }
+const MAX_DEPLOYMENT_HISTORY = 1000;
 function saveDeploymentState(cwd, state) {
+    // Cap history to prevent unbounded file growth
+    if (state.history.length > MAX_DEPLOYMENT_HISTORY) {
+        state.history = state.history.slice(-MAX_DEPLOYMENT_HISTORY);
+    }
     const dir = getStateDir(cwd);
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
@@ -218,10 +232,11 @@ const statusCommand = {
                 output.writeln(output.dim('No environments configured'));
             }
             // Recent history (last 5)
-            let recent = [...state.history].reverse().slice(0, 5);
+            let recent = [...state.history].reverse();
             if (filterEnv) {
                 recent = recent.filter(r => r.environment === filterEnv);
             }
+            recent = recent.slice(0, 5);
             if (recent.length > 0) {
                 output.writeln();
                 output.writeln(output.bold('Recent Deployments'));
@@ -268,6 +283,10 @@ const rollbackCommand = {
                 return { success: false, exitCode: 1 };
             }
             const targetVersion = ctx.flags['version'] ? String(ctx.flags['version']) : null;
+            const steps = parseInt(ctx.flags.steps || '1', 10);
+            if (steps > 1) {
+                output.printWarning(`Multi-step rollback (--steps ${steps}) is not yet implemented. Rolling back 1 step only.`);
+            }
             const state = loadDeploymentState(ctx.cwd);
             // Find deployments for this environment in reverse chronological order
             const envHistory = state.history

package/packages/@monomind/cli/dist/src/commands/doctor.js

@@ -9,6 +9,7 @@ import { existsSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { execSync, exec } from 'child_process';
+import { homedir } from 'os';
 import { promisify } from 'util';
 // Promisified exec with proper shell and env inheritance for cross-platform support
 const execAsync = promisify(exec);
@@ -178,8 +179,8 @@ async function checkGitRepo() {
 // Check MCP servers
 async function checkMcpServers() {
     const mcpConfigPaths = [
-        join(process.env.HOME || '', '.claude/claude_desktop_config.json'),
-        join(process.env.HOME || '', '.config/claude/mcp.json'),
+        join(homedir(), '.claude/claude_desktop_config.json'),
+        join(homedir(), '.config/claude/mcp.json'),
         '.mcp.json'
     ];
     for (const configPath of mcpConfigPaths) {
@@ -188,7 +189,7 @@ async function checkMcpServers() {
                 const content = JSON.parse(readFileSync(configPath, 'utf8'));
                 const servers = content.mcpServers || content.servers || {};
                 const count = Object.keys(servers).length;
-                const hasMonomind = 'monomind' in servers || 'monomind_alpha' in servers || 'monomind' in servers || 'monomind_alpha' in servers;
+                const hasMonomind = 'monomind' in servers || 'monomind_alpha' in servers;
                 if (hasMonomind) {
                     return { name: 'MCP Servers', status: 'pass', message: `${count} servers (monomind configured)` };
                 }
@@ -263,7 +264,7 @@ async function checkVersionFreshness() {
                         const pkg = JSON.parse(readFileSync(candidate, 'utf8'));
                         if (pkg.version &&
                             typeof pkg.name === 'string' &&
-                            (pkg.name === '@monomind/cli' || pkg.name === 'monomind' || pkg.name === 'monomind')) {
+                            (pkg.name === '@monomind/cli' || pkg.name === 'monomind')) {
                             currentVersion = pkg.version;
                             break;
                         }