monomind 1.8.0 → 1.9.0

package/packages/@monomind/cli/dist/src/init/executor.js

@@ -10,6 +10,26 @@ import { dirname } from 'path';
 // ESM-compatible __dirname
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
+/**
+ * Atomic write helper — writes to a sibling .tmp file then renames into place.
+ * SIGINT or crash during a partial write would otherwise corrupt user-critical
+ * files (.claude/settings.json, .mcp.json, helper scripts that Claude Code
+ * executes on every hook). Without atomicity a half-written settings.json or
+ * a zero-byte hook-handler.cjs disables Claude Code's protections silently.
+ */
+function atomicWriteFile(target, content, encoding) {
+    const tmp = `${target}.${process.pid}.tmp`;
+    if (encoding && typeof content === 'string') {
+        fs.writeFileSync(tmp, content, encoding);
+    }
+    else if (typeof content === 'string') {
+        fs.writeFileSync(tmp, content, 'utf-8');
+    }
+    else {
+        fs.writeFileSync(tmp, content);
+    }
+    fs.renameSync(tmp, target);
+}
 import { detectPlatform, DEFAULT_INIT_OPTIONS } from './types.js';
 import { writeSharedInstructions } from './shared-instructions-generator.js';
 import { generateSettingsJson, generateSettings } from './settings-generator.js';
@@ -24,6 +44,7 @@ const SKILLS_MAP = {
     core: [
         'swarm-orchestration',
         'swarm-advanced',
+        'swarm-coordination',
         'sparc-methodology',
         'hooks-automation',
         'pair-programming',
@@ -31,8 +52,12 @@ const SKILLS_MAP = {
         'stream-chain',
         'skill-builder',
         'specialagent',
+        'mastermind',
+        'monodesign',
+        'monomotion',
+        'hive-mind-advanced',
     ],
-    browser: ['browser', 'agent-browser-testing'], // agent-browser integration
+    browser: ['agent-browser-testing'],
     agentdb: [
         'agentdb-advanced',
         'agentdb-learning',
@@ -49,16 +74,17 @@ const SKILLS_MAP = {
         'github-release-management',
         'github-workflow-automation',
     ],
-    v1: [
-        'v1-cli-modernization',
-        'v1-core-implementation',
-        'v1-ddd-architecture',
-        'v1-integration-deep',
-        'v1-mcp-optimization',
-        'v1-memory-unification',
-        'v1-performance-optimization',
-        'v1-security-overhaul',
-        'v1-swarm-coordination',
+    advanced: [
+        'agentic-integration',
+        'agentic-jujutsu',
+        'cli-modernization',
+        'core-implementation',
+        'ddd-architecture',
+        'mcp-optimization',
+        'memory-unification',
+        'performance-analysis',
+        'performance-optimization',
+        'security-hardening',
     ],
 };
 /**
@@ -66,47 +92,69 @@ const SKILLS_MAP = {
  */
 const COMMANDS_MAP = {
     core: [
-        'monomind-help.md', 'monomind-swarm.md', 'monomind-memory.md',
-        'monomind-do.md', 'monomind-idea.md', 'monomind-improve.md', 'monomind-createtask.md', 'monomind-repeat.md',
-        'mastermind.md', 'list-agents.md', 'use-agent.md',
-        'metrics.md', 'tokens.md', 'browse.md', 'sparc.md', 'ts.md',
+        'mastermind.md', 'tokens.md', 'browse.md', 'sparc.md', 'ts.md',
     ],
+    agents: ['agents'],
     analysis: ['analysis'],
     automation: ['automation'],
+    coordination: ['coordination'],
     github: ['github'],
+    hiveMind: ['hive-mind'],
     hooks: ['hooks'],
+    mastermind: ['mastermind'],
+    memory: ['memory'],
     monitoring: ['monitoring'],
+    monograph: ['monograph'],
+    monomind: ['monomind'],
     optimization: ['optimization'],
+    pair: ['pair'],
     sparc: ['sparc'],
+    streamChain: ['stream-chain'],
+    swarm: ['swarm'],
+    training: ['training'],
+    truth: ['truth'],
+    verify: ['verify'],
+    workflows: ['workflows'],
 };
 /**
  * Agents to copy based on configuration
  */
 const AGENTS_MAP = {
-    core: ['core'],
-    consensus: ['consensus'],
-    github: ['github'],
-    hiveMind: ['hive-mind'],
-    sparc: ['sparc'],
-    swarm: ['swarm'],
-    browser: ['browser'], // agent-browser integration
-    // V1-specific agents
-    v1: ['v1'],
-    optimization: ['optimization'],
-    templates: ['templates'],
-    testing: ['testing'],
-    sublinear: ['sublinear'],
+    academic: ['academic'],
     analysis: ['analysis'],
     architecture: ['architecture'],
+    consensus: ['consensus'],
+    core: ['core'],
+    data: ['data'],
+    design: ['design'],
     development: ['development'],
     devops: ['devops'],
     documentation: ['documentation'],
-    specialized: ['specialized'],
+    engineering: ['engineering'],
+    gameDevelopment: ['game-development'],
+    github: ['github'],
     goal: ['goal'],
-    sona: ['sona'],
+    hiveMind: ['hive-mind'],
+    marketing: ['marketing'],
+    neural: ['neural'],
+    optimization: ['optimization'],
+    paidMedia: ['paid-media'],
     payments: ['payments'],
-    data: ['data'],
-    custom: ['custom'],
+    product: ['product'],
+    projectManagement: ['project-management'],
+    reasoning: ['reasoning'],
+    sales: ['sales'],
+    schemas: ['schemas'],
+    sona: ['sona'],
+    sparc: ['sparc'],
+    spatialComputing: ['spatial-computing'],
+    specialists: ['specialists'],
+    specialized: ['specialized'],
+    sublinear: ['sublinear'],
+    support: ['support'],
+    swarm: ['swarm'],
+    templates: ['templates'],
+    testing: ['testing'],
 };
 /**
  * Directory structure to create
@@ -171,7 +219,7 @@ function cleanupLegacyTools(targetDir) {
                 cleaned.push('.mcp.json: updated MCP package name to monomind@latest');
             }
             if (mcpChanged) {
-                fs.writeFileSync(mcpJsonPath, JSON.stringify(mcp, null, 2));
+                atomicWriteFile(mcpJsonPath, JSON.stringify(mcp, null, 2));
             }
         }
         catch { /* non-fatal */ }
@@ -207,7 +255,7 @@ function cleanupLegacyTools(targetDir) {
                 cleaned.push('.claude/settings.json: updated MCP package name to monomind@latest');
             }
             if (settingsChanged) {
-                fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2));
+                atomicWriteFile(settingsPath, JSON.stringify(settings, null, 2));
             }
         }
         catch { /* non-fatal */ }
@@ -537,11 +585,18 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                     else {
                         result.created.push(`.claude/helpers/${helperName}`);
                     }
-                    fs.copyFileSync(sourcePath, targetPath);
-                    try {
-                        fs.chmodSync(targetPath, '755');
+                    // Atomic copy-via-rename: a SIGINT/crash during copy would leave a
+                    // half-written hook-handler.cjs which Claude Code executes on every
+                    // hook event — partial JS could disable security checks silently.
+                    {
+                        const tmp = targetPath + '.tmp';
+                        fs.copyFileSync(sourcePath, tmp);
+                        try {
+                            fs.chmodSync(tmp, 0o755);
+                        }
+                        catch { }
+                        fs.renameSync(tmp, targetPath);
                     }
-                    catch { }
                 }
             }
         }
@@ -560,11 +615,16 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                 else {
                     result.created.push(`.claude/helpers/${helperName}`);
                 }
-                fs.writeFileSync(targetPath, content, 'utf-8');
+                // Atomic write (PID-suffixed) so a partial hook-handler.cjs cannot
+                // ship if init is interrupted, and concurrent inits don't collide on
+                // the same .tmp filename.
+                const tmp = `${targetPath}.${process.pid}.tmp`;
+                fs.writeFileSync(tmp, content, 'utf-8');
                 try {
-                    fs.chmodSync(targetPath, '755');
+                    fs.chmodSync(tmp, 0o755);
                 }
                 catch { }
+                fs.renameSync(tmp, targetPath);
             }
         }
         // 1. ALWAYS update statusline helper (force overwrite)
@@ -586,7 +646,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
         else {
             result.created.push('.claude/helpers/statusline.cjs');
         }
-        fs.writeFileSync(statuslinePath, statuslineContent, 'utf-8');
+        atomicWriteFile(statuslinePath, statuslineContent);
         // 2. Create MISSING metrics files only (preserve existing data)
         const metricsDir = path.join(targetDir, '.monomind', 'metrics');
         const securityDir = path.join(targetDir, '.monomind', 'security');
@@ -602,7 +662,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                 learning: { status: 'READY', patternsLearned: 0, sessionsCompleted: 0 },
                 _note: 'Metrics will update as you use Monomind'
             };
-            fs.writeFileSync(progressPath, JSON.stringify(progress, null, 2), 'utf-8');
+            atomicWriteFile(progressPath, JSON.stringify(progress, null, 2));
             result.created.push('.monomind/metrics/v1-progress.json');
         }
         else {
@@ -618,7 +678,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                 integration: { agentic_flow_active: false, mcp_active: false },
                 _initialized: true
             };
-            fs.writeFileSync(activityPath, JSON.stringify(activity, null, 2), 'utf-8');
+            atomicWriteFile(activityPath, JSON.stringify(activity, null, 2));
             result.created.push('.monomind/metrics/swarm-activity.json');
         }
         else {
@@ -634,7 +694,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                 sessions: { total: 0, current: null },
                 _note: 'Intelligence grows as you use Monomind'
             };
-            fs.writeFileSync(learningPath, JSON.stringify(learning, null, 2), 'utf-8');
+            atomicWriteFile(learningPath, JSON.stringify(learning, null, 2));
             result.created.push('.monomind/metrics/learning.json');
         }
         else {
@@ -651,7 +711,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                 lastScan: null,
                 _note: 'Run: npx monomind@latest security scan'
             };
-            fs.writeFileSync(auditPath, JSON.stringify(audit, null, 2), 'utf-8');
+            atomicWriteFile(auditPath, JSON.stringify(audit, null, 2));
             result.created.push('.monomind/security/audit-status.json');
         }
         else {
@@ -664,7 +724,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                 try {
                     const existingSettings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
                     const mergedSettings = mergeSettingsForUpgrade(existingSettings);
-                    fs.writeFileSync(settingsPath, JSON.stringify(mergedSettings, null, 2), 'utf-8');
+                    atomicWriteFile(settingsPath, JSON.stringify(mergedSettings, null, 2));
                     result.updated.push('.claude/settings.json');
                     result.settingsUpdated = [
                         'env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS',
@@ -683,7 +743,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
             else {
                 // Create new settings.json with defaults
                 const defaultSettings = generateSettings(DEFAULT_INIT_OPTIONS);
-                fs.writeFileSync(settingsPath, JSON.stringify(defaultSettings, null, 2), 'utf-8');
+                atomicWriteFile(settingsPath, JSON.stringify(defaultSettings, null, 2));
                 result.created.push('.claude/settings.json');
                 result.settingsUpdated = ['Created new settings.json with Agent Teams'];
             }
@@ -839,7 +899,7 @@ async function writeSettings(targetDir, options, result) {
                 }
             }
             if (merged) {
-                fs.writeFileSync(settingsPath, JSON.stringify(existing, null, 2), 'utf-8');
+                atomicWriteFile(settingsPath, JSON.stringify(existing, null, 2));
                 result.created.files.push('.claude/settings.json (merged hooks)');
             }
             else {
@@ -848,12 +908,12 @@ async function writeSettings(targetDir, options, result) {
         }
         catch {
             // Existing file is corrupt — overwrite
-            fs.writeFileSync(settingsPath, JSON.stringify(generated, null, 2), 'utf-8');
+            atomicWriteFile(settingsPath, JSON.stringify(generated, null, 2));
             result.created.files.push('.claude/settings.json');
         }
         return;
     }
-    fs.writeFileSync(settingsPath, JSON.stringify(generated, null, 2), 'utf-8');
+    atomicWriteFile(settingsPath, JSON.stringify(generated, null, 2));
     result.created.files.push('.claude/settings.json');
 }
 /**
@@ -866,7 +926,7 @@ async function writeMCPConfig(targetDir, options, result) {
         return;
     }
     const content = generateMCPJson(options);
-    fs.writeFileSync(mcpPath, content, 'utf-8');
+    atomicWriteFile(mcpPath, content);
     result.created.files.push('.mcp.json');
 }
 /**
@@ -890,8 +950,8 @@ async function copySkills(targetDir, options, result) {
             skillsToCopy.push(...SKILLS_MAP.github);
         if (skillsConfig.browser)
             skillsToCopy.push(...SKILLS_MAP.browser);
-        if (skillsConfig.v1)
-            skillsToCopy.push(...SKILLS_MAP.v1);
+        if (skillsConfig.advanced)
+            skillsToCopy.push(...SKILLS_MAP.advanced);
     }
     // Find source skills directory
     const sourceSkillsDir = findSourceDir('skills', options.sourceBaseDir);
@@ -929,20 +989,48 @@ async function copyCommands(targetDir, options, result) {
     else {
         if (commandsConfig.core)
             commandsToCopy.push(...COMMANDS_MAP.core);
+        if (commandsConfig.agents)
+            commandsToCopy.push(...(COMMANDS_MAP.agents || []));
         if (commandsConfig.analysis)
             commandsToCopy.push(...COMMANDS_MAP.analysis);
         if (commandsConfig.automation)
             commandsToCopy.push(...COMMANDS_MAP.automation);
+        if (commandsConfig.coordination)
+            commandsToCopy.push(...(COMMANDS_MAP.coordination || []));
         if (commandsConfig.github)
             commandsToCopy.push(...COMMANDS_MAP.github);
+        if (commandsConfig.hiveMind)
+            commandsToCopy.push(...(COMMANDS_MAP.hiveMind || []));
         if (commandsConfig.hooks)
             commandsToCopy.push(...COMMANDS_MAP.hooks);
+        if (commandsConfig.mastermind)
+            commandsToCopy.push(...(COMMANDS_MAP.mastermind || []));
+        if (commandsConfig.memory)
+            commandsToCopy.push(...(COMMANDS_MAP.memory || []));
         if (commandsConfig.monitoring)
             commandsToCopy.push(...COMMANDS_MAP.monitoring);
+        if (commandsConfig.monograph)
+            commandsToCopy.push(...(COMMANDS_MAP.monograph || []));
+        if (commandsConfig.monomind)
+            commandsToCopy.push(...(COMMANDS_MAP.monomind || []));
         if (commandsConfig.optimization)
             commandsToCopy.push(...COMMANDS_MAP.optimization);
+        if (commandsConfig.pair)
+            commandsToCopy.push(...(COMMANDS_MAP.pair || []));
         if (commandsConfig.sparc)
             commandsToCopy.push(...COMMANDS_MAP.sparc);
+        if (commandsConfig.streamChain)
+            commandsToCopy.push(...(COMMANDS_MAP.streamChain || []));
+        if (commandsConfig.swarm)
+            commandsToCopy.push(...(COMMANDS_MAP.swarm || []));
+        if (commandsConfig.training)
+            commandsToCopy.push(...(COMMANDS_MAP.training || []));
+        if (commandsConfig.truth)
+            commandsToCopy.push(...(COMMANDS_MAP.truth || []));
+        if (commandsConfig.verify)
+            commandsToCopy.push(...(COMMANDS_MAP.verify || []));
+        if (commandsConfig.workflows)
+            commandsToCopy.push(...(COMMANDS_MAP.workflows || []));
     }
     // Find source commands directory
     const sourceCommandsDir = findSourceDir('commands', options.sourceBaseDir);
@@ -995,11 +1083,6 @@ async function copyAgents(targetDir, options, result) {
             agentsToCopy.push(...AGENTS_MAP.sparc);
         if (agentsConfig.swarm)
             agentsToCopy.push(...AGENTS_MAP.swarm);
-        if (agentsConfig.browser)
-            agentsToCopy.push(...AGENTS_MAP.browser);
-        // V1-specific agent categories
-        if (agentsConfig.v1)
-            agentsToCopy.push(...(AGENTS_MAP.v1 || []));
         if (agentsConfig.optimization)
             agentsToCopy.push(...(AGENTS_MAP.optimization || []));
         if (agentsConfig.testing)
@@ -1128,7 +1211,7 @@ async function writeHelpers(targetDir, options, result) {
     for (const [name, content] of Object.entries(helpers)) {
         const filePath = path.join(helpersDir, name);
         if (!fs.existsSync(filePath) || options.force) {
-            fs.writeFileSync(filePath, content, 'utf-8');
+            atomicWriteFile(filePath, content);
             // Make shell scripts executable
             if (!name.endsWith('.js')) {
                 fs.chmodSync(filePath, '755');
@@ -1211,7 +1294,7 @@ async function writeStatusline(targetDir, options, result) {
     // This must overwrite any copy from writeHelpers() which copies the legacy file.
     const statuslineScript = generateStatuslineScript(options);
     const statuslinePath = path.join(helpersDir, 'statusline.cjs');
-    fs.writeFileSync(statuslinePath, statuslineScript, 'utf-8');
+    atomicWriteFile(statuslinePath, statuslineScript);
     result.created.files.push('.claude/helpers/statusline.cjs');
 }
 /**
@@ -1267,7 +1350,7 @@ mcp:
   autoStart: ${options.mcp.autoStart}
   port: ${options.mcp.port}
 `;
-    fs.writeFileSync(configPath, config, 'utf-8');
+    atomicWriteFile(configPath, config);
     result.created.files.push('.monomind/config.yaml');
     // Write .gitignore
     const gitignorePath = path.join(targetDir, '.monomind', '.gitignore');
@@ -1280,7 +1363,7 @@ neural/
 *.tmp
 `;
     if (!fs.existsSync(gitignorePath) || options.force) {
-        fs.writeFileSync(gitignorePath, gitignore, 'utf-8');
+        atomicWriteFile(gitignorePath, gitignore);
         result.created.files.push('.monomind/.gitignore');
     }
     // Write CAPABILITIES.md with full system overview
@@ -1329,7 +1412,7 @@ async function writeInitialMetrics(targetDir, options, result) {
             },
             _note: 'Metrics will update as you use Monomind. Run: npx monomind@latest daemon start'
         };
-        fs.writeFileSync(progressPath, JSON.stringify(progress, null, 2), 'utf-8');
+        atomicWriteFile(progressPath, JSON.stringify(progress, null, 2));
         result.created.files.push('.monomind/metrics/v1-progress.json');
     }
     // Create initial swarm-activity.json
@@ -1353,7 +1436,7 @@ async function writeInitialMetrics(targetDir, options, result) {
             },
             _initialized: true
         };
-        fs.writeFileSync(activityPath, JSON.stringify(activity, null, 2), 'utf-8');
+        atomicWriteFile(activityPath, JSON.stringify(activity, null, 2));
         result.created.files.push('.monomind/metrics/swarm-activity.json');
     }
     // Create initial learning.json
@@ -1376,7 +1459,7 @@ async function writeInitialMetrics(targetDir, options, result) {
             },
             _note: 'Intelligence grows as you use Monomind'
         };
-        fs.writeFileSync(learningPath, JSON.stringify(learning, null, 2), 'utf-8');
+        atomicWriteFile(learningPath, JSON.stringify(learning, null, 2));
         result.created.files.push('.monomind/metrics/learning.json');
     }
     // Create initial audit-status.json
@@ -1390,7 +1473,7 @@ async function writeInitialMetrics(targetDir, options, result) {
             lastScan: null,
             _note: 'Run: npx monomind@latest security scan'
         };
-        fs.writeFileSync(auditPath, JSON.stringify(audit, null, 2), 'utf-8');
+        atomicWriteFile(auditPath, JSON.stringify(audit, null, 2));
         result.created.files.push('.monomind/security/audit-status.json');
     }
 }
@@ -1801,7 +1884,7 @@ npx monomind@latest hooks worker dispatch --trigger optimize
 **Full Documentation**: https://github.com/nokhodian/monomind
 **Issues**: https://github.com/nokhodian/monomind/issues
 `;
-    fs.writeFileSync(capabilitiesPath, capabilities, 'utf-8');
+    atomicWriteFile(capabilitiesPath, capabilities);
     result.created.files.push('.monomind/CAPABILITIES.md');
 }
 /**
@@ -1816,7 +1899,7 @@ async function writeClaudeMd(targetDir, options, result) {
         // Determine template: explicit option > infer from components > 'standard'
         const inferredTemplate = (!options.components.commands && !options.components.agents) ? 'minimal' : undefined;
         const content = generateClaudeMd(options, inferredTemplate);
-        fs.writeFileSync(claudeMdPath, content, 'utf-8');
+        atomicWriteFile(claudeMdPath, content);
         result.created.files.push('CLAUDE.md');
     }
     // Also write/append global ~/.claude/CLAUDE.md so monomind tools are used automatically (#1497)
@@ -1844,7 +1927,7 @@ async function writeClaudeMd(targetDir, options, result) {
                 }
             }
             else {
-                fs.writeFileSync(globalClaudeMd, monomindBlock.trimStart(), 'utf-8');
+                atomicWriteFile(globalClaudeMd, monomindBlock.trimStart());
                 result.created.files.push('~/.claude/CLAUDE.md');
             }
         }
@@ -1875,7 +1958,7 @@ async function writeClaudeMd(targetDir, options, result) {
                 });
                 hooks['SessionStart'] = sessionStartHooks;
                 globalSettings.hooks = hooks;
-                fs.writeFileSync(globalSettingsPath, JSON.stringify(globalSettings, null, 2), 'utf-8');
+                atomicWriteFile(globalSettingsPath, JSON.stringify(globalSettings, null, 2));
                 result.created.files.push('~/.claude/settings.json (added token hook)');
             }
         }

package/packages/@monomind/cli/dist/src/init/helpers-generator.js

@@ -307,8 +307,14 @@ const commands = {
       console.error('Key required');
       return;
     }
+    // Reject prototype-pollution keys: \`memory[key] = value\` with key='__proto__'
+    // performs a prototype-set, polluting Object.prototype for the process.
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      console.error('Forbidden key');
+      process.exit(2);
+    }
     const memory = loadMemory();
-    memory[key] = value;
+    Object.defineProperty(memory, key, { value, enumerable: true, configurable: true, writable: true });
     memory._updated = new Date().toISOString();
     saveMemory(memory);
     console.log(\`Set: \${key}\`);
@@ -319,6 +325,10 @@ const commands = {
       console.error('Key required');
       return;
     }
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      console.error('Forbidden key');
+      process.exit(2);
+    }
     const memory = loadMemory();
     delete memory[key];
     saveMemory(memory);
@@ -477,15 +487,11 @@ export function generateHookHandler() {
         '  },',
         '',
         "  'pre-bash': () => {",
-        '    var cmd = prompt.toLowerCase();',
-        "    var dangerous = ['rm -rf /', 'format c:', 'del /s /q c:\\\\', ':(){:|:&};:'];",
-        '    for (var i = 0; i < dangerous.length; i++) {',
-        '      if (cmd.includes(dangerous[i])) {',
-        "        console.error('[BLOCKED] Dangerous command detected: ' + dangerous[i]);",
-        '        process.exit(1);',
-        '      }',
-        '    }',
-        "    console.log('[OK] Command validated');",
+        "    // NOTE: This hook is intentionally NOT a security filter. A 4-substring",
+        "    // check is trivially bypassed (extra spaces, find -delete, dd, bash -c, etc.)",
+        "    // and shipping a fake check creates false confidence. Real safety lives in",
+        "    // Claude Code's permission prompt and sandboxing. Hook is observability-only.",
+        "    console.log('[OK] Command validation delegated to Claude Code permissions');",
         '  },',
         '',
         "  'post-edit': () => {",
@@ -498,18 +504,19 @@ export function generateHookHandler() {
         '        intelligence.recordEdit(file);',
         '      } catch (e) { /* non-fatal */ }',
         '    }',
-        '    // Auto-rebuild graphify knowledge graph for code file changes',
+        '    // Auto-rebuild monograph knowledge graph for code file changes',
         '    try {',
         "      var editedFile = process.env.TOOL_INPUT_file_path || args[0] || '';",
         "      var isCode = /\\.(ts|js|tsx|jsx|py|go|rs|java|c|cpp|h|cs|rb|php|swift|kt|scala)$/.test(editedFile);",
-        "      var graphJson = require('path').join(process.cwd(), 'graphify-out', 'graph.json');",
-        "      if (isCode && require('fs').existsSync(graphJson)) {",
-        "        require('child_process').spawn('python', ['-m', 'graphify', '--update', process.cwd()], {",
-        "          detached: true, stdio: 'ignore', timeout: 30000",
+        "      var dbFile = require('path').join(process.cwd(), '.monomind', 'monograph.db');",
+        "      if (isCode && require('fs').existsSync(dbFile)) {",
+        "        var s = `import { buildAsync } from '@monoes/monograph'; buildAsync(${JSON.stringify(process.cwd())}).catch(()=>{});`;",
+        "        require('child_process').spawn(process.execPath, ['--input-type=module', '--eval', s], {",
+        "          detached: true, stdio: 'ignore'",
         '        }).unref();',
-        "        console.log('[GRAPHIFY] Queued graph rebuild for: ' + require('path').basename(editedFile));",
+        "        console.log('[MONOGRAPH] Queued graph rebuild for: ' + require('path').basename(editedFile));",
         '      }',
-        '    } catch (e) { /* non-fatal — graphify may not be installed */ }',
+        '    } catch (e) { /* non-fatal — monograph may not be installed */ }',
         "    console.log('[OK] Edit recorded');",
         '  },',
         '',
@@ -684,11 +691,13 @@ export function generateIntelligenceStub() {
         '  return text.toLowerCase().replace(/[^a-z0-9\\s]/g, " ").split(/\\s+/).filter(function(w) { return w.length > 2; });',
         '}',
         '',
-        '// Bootstrap entries from MEMORY.md files when store is empty',
+        '// Bootstrap entries from MEMORY.md files when store is empty.',
+        '// SECURITY: ONLY walk the current project. Walking ~/.claude/projects',
+        '// previously caused cross-project memory leakage — entries from project A',
+        '// (potentially containing secrets) would surface in prompts in project B.',
         'function bootstrapFromMemoryFiles() {',
         '  var entries = [];',
         '  var candidates = [',
-        '    path.join(os.homedir(), ".claude", "projects"),',
         '    path.join(process.cwd(), ".monomind", "memory"),',
         '    path.join(process.cwd(), ".claude", "memory"),',
         '  ];',
@@ -934,11 +943,15 @@ function doStatus() {
   console.log('');
 }
 
-// Suppress unhandled rejection warnings from optional dynamic import() failures only
+// Suppress unhandled rejection warnings ONLY for genuine module-not-found from
+// optional dynamic imports. Previously this swallowed any error whose message
+// contained "Cannot find" (e.g. "Cannot find user with id ..."), masking real
+// failures and security regressions.
 process.on('unhandledRejection', (reason) => {
-  // Re-throw anything that isn't a module-not-found error from optional imports
-  if (reason instanceof Error && reason.message.includes('Cannot find')) return;
+  const code = reason && typeof reason === 'object' ? reason.code : undefined;
+  if (code === 'ERR_MODULE_NOT_FOUND' || code === 'MODULE_NOT_FOUND') return;
   if (reason instanceof Error) throw reason;
+  throw new Error(String(reason));
 });
 
 const command = process.argv[2] || 'status';

package/packages/@monomind/cli/dist/src/init/mcp-generator.js

@@ -51,9 +51,9 @@ export function generateMCPConfig(options) {
             MONOMIND_MEMORY_BACKEND: options.runtime.memoryBackend,
         }, { autoStart: config.autoStart });
     }
-    // Graphify knowledge graph — built into monomind MCP server since v1.3.0.
-    // Available as mcp__monomind__graphify_build, graphify_report, graphify_suggest, graphify_health.
-    // No separate server needed — the monomind entry above provides all graphify tools.
+    // Monograph knowledge graph — built into monomind MCP server since v1.8.0.
+    // Available as mcp__monomind__monograph_build, monograph_query, monograph_suggest, monograph_health.
+    // No separate server needed — the monomind entry above provides all monograph tools.
     return { mcpServers };
 }
 /**

package/packages/@monomind/cli/dist/src/init/settings-generator.js

@@ -17,11 +17,18 @@ export function generateSettings(options) {
         settings.statusLine = generateStatusLineConfig(options);
     }
     // Add permissions
+    // SECURITY: tightened allowlist patterns.
+    //   `Bash(npx monomind*)` previously matched any package starting with
+    //   "monomind" (including a hypothetical future typosquat). Anchor to the
+    //   official scope/namespaces only, with an explicit space between command
+    //   tokens so partial-prefix matches are rejected.
     settings.permissions = {
         allow: [
-            'Bash(npx @monoes*)',
-            'Bash(npx monomind*)',
-            'Bash(node .claude/*)',
+            'Bash(npx @monomind/*)',
+            'Bash(npx monomind *)',
+            'Bash(npx -y monomind *)',
+            'Bash(npx monomind@*)',
+            'Bash(node .claude/helpers/*)',
             'mcp__monomind__:*',
         ],
         deny: [