monomind 1.8.0 → 1.9.1

package/packages/@monomind/cli/dist/src/mcp-tools/hooks-tools.js

@@ -2,17 +2,9 @@
  * Hooks MCP Tools
  * Provides intelligent hooks functionality via MCP protocol
  */
-import { mkdirSync, writeFileSync, existsSync, readFileSync, statSync, unlinkSync, readdirSync, appendFileSync } from 'fs';
-import { dirname, join, resolve } from 'path';
+import { mkdirSync, writeFileSync, renameSync, existsSync, readFileSync, statSync, unlinkSync, readdirSync } from 'fs';
+import { dirname, join, resolve, sep } from 'path';
 import { getProjectCwd } from './types.js';
-function logEvent(kind, data) {
-    try {
-        const dir = join(getProjectCwd(), '.monomind', 'swarm');
-        if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-        const event = { ts: new Date().toISOString(), source: 'hook', kind, ...data };
-        appendFileSync(join(dir, 'events.jsonl'), JSON.stringify(event) + '\n');
-    } catch { }
-}
 // Real vector search functions - lazy loaded to avoid circular imports
 let searchEntriesFn = null;
 async function getRealSearchFunction() {
@@ -92,7 +84,8 @@ let semanticRouter = null;
 let nativeVectorDb = null;
 let semanticRouterInitialized = false;
 let routerBackend = 'none';
-// Pre-computed embeddings for common task patterns (cached)
+// Pre-computed embeddings for common task patterns (cached, capped to prevent unbounded growth)
+const MAX_PATTERN_EMBEDDINGS = 2000;
 const TASK_PATTERN_EMBEDDINGS = new Map();
 function generateSimpleEmbedding(text, dimension = 384) {
     // Simple deterministic embedding based on character codes
@@ -168,7 +161,9 @@ function saveRoutingOutcomes(outcomes) {
             mkdirSync(dir, { recursive: true });
         // Cap at 500 entries to bound file size
         const capped = outcomes.slice(-500);
-        writeFileSync(ROUTING_OUTCOMES_PATH, JSON.stringify({ outcomes: capped }, null, 2));
+        const tmp = ROUTING_OUTCOMES_PATH + '.tmp';
+        writeFileSync(tmp, JSON.stringify({ outcomes: capped }, null, 2));
+        renameSync(tmp, ROUTING_OUTCOMES_PATH);
     }
     catch { /* non-critical */ }
 }
@@ -293,7 +288,9 @@ async function getSemanticRouter() {
                 for (const keyword of keywords) {
                     const embedding = generateSimpleEmbedding(keyword);
                     db.insert(`${patternName}:${keyword}`, embedding);
-                    TASK_PATTERN_EMBEDDINGS.set(`${patternName}:${keyword}`, embedding);
+                    if (TASK_PATTERN_EMBEDDINGS.size < MAX_PATTERN_EMBEDDINGS) {
+                        TASK_PATTERN_EMBEDDINGS.set(`${patternName}:${keyword}`, embedding);
+                    }
                 }
             }
             nativeVectorDb = db;
@@ -313,9 +310,11 @@ async function getSemanticRouter() {
         for (const [patternName, { keywords, agents }] of Object.entries(getMergedTaskPatterns())) {
             const embeddings = keywords.map(kw => generateSimpleEmbedding(kw));
             semanticRouter.addIntentWithEmbeddings(patternName, embeddings, { agents, keywords });
-            // Cache embeddings for keywords
+            // Cache embeddings for keywords (capped)
             keywords.forEach((kw, i) => {
-                TASK_PATTERN_EMBEDDINGS.set(kw, embeddings[i]);
+                if (TASK_PATTERN_EMBEDDINGS.size < MAX_PATTERN_EMBEDDINGS) {
+                    TASK_PATTERN_EMBEDDINGS.set(kw, embeddings[i]);
+                }
             });
         }
         routerBackend = 'pure-js';
@@ -353,18 +352,10 @@ async function getFlashAttention() {
     }
     return flashAttention;
 }
-// LoRA Adapter - lazy loaded
+// LoRA Adapter removed — superseded by SONA instant adaptation
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
 let loraAdapter = null;
 async function getLoRAAdapter() {
-    if (!loraAdapter) {
-        try {
-            const { getLoRAAdapter: getLora } = await import('../ruvector/lora-adapter.js');
-            loraAdapter = await getLora();
-        }
-        catch {
-            loraAdapter = null;
-        }
-    }
     return loraAdapter;
 }
 // In-memory trajectory tracking (persisted on end)
@@ -372,7 +363,7 @@ const activeTrajectories = new Map();
 const MEMORY_DIR = '.monomind/memory';
 const MEMORY_FILE = 'store.json';
 function getMemoryPath() {
-    return resolve(join(MEMORY_DIR, MEMORY_FILE));
+    return join(getProjectCwd(), MEMORY_DIR, MEMORY_FILE);
 }
 function loadMemoryStore() {
     try {
@@ -718,10 +709,13 @@ export const hooksPostCommand = {
                 const store = loadMemoryStore();
                 const key = `cmd-${Date.now()}`;
                 store.entries[key] = { key, value: JSON.stringify({ command, exitCode, success }), namespace: 'commands', createdAt: new Date().toISOString() };
-                const memDir = resolve(MEMORY_DIR);
+                const memDir = join(getProjectCwd(), MEMORY_DIR);
                 if (!existsSync(memDir))
                     mkdirSync(memDir, { recursive: true });
-                writeFileSync(getMemoryPath(), JSON.stringify(store, null, 2), 'utf-8');
+                const _mp = getMemoryPath();
+                const _mptmp = _mp + '.tmp';
+                writeFileSync(_mptmp, JSON.stringify(store, null, 2), 'utf-8');
+                renameSync(_mptmp, _mp);
                 _storedIn = 'json-store';
             }
             catch { /* non-critical */ }
@@ -1078,7 +1072,7 @@ export const hooksPreTask = {
                 });
                 for (const r of (heuristicResults?.results ?? [])) {
                     try {
-                        const h = JSON.parse(r.content ?? r.value ?? '{}');
+                        const h = JSON.parse(r.content ?? '{}');
                         if (h.action && h.confidence !== undefined && h.confidence >= 0.6) {
                             erlHints.push(`ERL hint (conf=${h.confidence.toFixed(2)}): use "${h.action}" for tasks involving "${h.condition ?? 'similar context'}"`);
                         }
@@ -1094,7 +1088,7 @@ export const hooksPreTask = {
                     threshold: 0.55,
                 });
                 for (const r of (gradientResults?.results ?? [])) {
-                    const critique = r.content ?? r.value ?? '';
+                    const critique = r.content ?? '';
                     if (critique && critique.length > 10) {
                         erlHints.push(`TextGrad warning: ${critique.slice(0, 120)}`);
                     }
@@ -1102,7 +1096,6 @@ export const hooksPreTask = {
             }
         }
         catch { /* non-critical */ }
-        logEvent('task.start', { taskId, description: description?.slice(0, 200), complexity, suggestedAgent: suggestion.agents[0], modelTier: modelRouting?.tier });
         return {
             taskId,
             description,
@@ -1246,7 +1239,7 @@ export const hooksPostTask = {
                         key: `textual_gradient:${taskId}`,
                         value: critique,
                         namespace: 'gradients',
-                        tags: ['textual_gradient', agent, 'failure'],
+                        tags: ['textual_gradient', agent ?? 'unknown', 'failure'],
                     });
                 }
             }
@@ -1265,7 +1258,6 @@ export const hooksPostTask = {
             storeAs: 'heuristics',
             note: 'Spawn agents sequentially: Diagnoser → Critics in parallel → Aggregator',
         } : { needed: false };
-        logEvent('task.end', { taskId, success, duration, agent, quality, task: taskText?.slice(0, 200) });
         return {
             taskId,
             success,
@@ -1375,6 +1367,10 @@ export const hooksPretrain = {
     },
     handler: async (params) => {
         const repoPath = resolve(params.path || '.');
+        const projectRoot = getProjectCwd();
+        if (repoPath !== projectRoot && !repoPath.startsWith(projectRoot + sep)) {
+            return { error: 'Invalid path: must be within the project directory.' };
+        }
         const depth = params.depth || 'medium';
         const startTime = performance.now();
         // Real file scanning — count files by extension, extract patterns
@@ -1472,9 +1468,20 @@ export const hooksBuildAgents = {
         },
     },
     handler: async (params) => {
-        const outputDir = resolve(params.outputDir || './agents');
+        const rawOutputDir = resolve(params.outputDir || './agents');
+        const outputDir = rawOutputDir;
+        if (!outputDir.startsWith(getProjectCwd() + sep) && outputDir !== getProjectCwd()) {
+            return { error: 'Invalid outputDir: must be within the project directory.' };
+        }
         const focus = params.focus || 'all';
-        const format = params.format || 'yaml';
+        // Strict allowlist on `format` — without this, `format = "yaml/../../../etc/cron.d/x"`
+        // collapses through `join` and lets writes escape the validated outputDir.
+        const ALLOWED_FORMATS = new Set(['yaml', 'json']);
+        const formatRaw = params.format || 'yaml';
+        if (!ALLOWED_FORMATS.has(formatRaw)) {
+            return { error: 'Invalid format: must be yaml or json' };
+        }
+        const format = formatRaw;
         const persist = params.persist !== false; // Default to true
         const agents = [
             { type: 'coder', configFile: join(outputDir, `coder.${format}`), capabilities: ['code-generation', 'refactoring', 'debugging'], optimizations: ['flash-attention', 'token-reduction'] },
@@ -1505,7 +1512,9 @@ export const hooksBuildAgents = {
                 const content = format === 'json'
                     ? JSON.stringify(config, null, 2)
                     : `# ${agent.type} agent configuration\ntype: ${agent.type}\nversion: "3.0.0"\ncapabilities:\n${agent.capabilities.map(c => `  - ${c}`).join('\n')}\noptimizations:\n${agent.optimizations.map(o => `  - ${o}`).join('\n')}\ncreatedAt: "${config.createdAt}"\n`;
-                writeFileSync(agent.configFile, content, 'utf-8');
+                const _cftmp = agent.configFile + '.tmp';
+                writeFileSync(_cftmp, content, 'utf-8');
+                renameSync(_cftmp, agent.configFile);
             }
         }
         return {
@@ -1538,8 +1547,25 @@ export const hooksTransfer = {
         const sourcePath = params.sourcePath;
         const minConfidence = params.minConfidence || 0.7;
         const filter = params.filter;
+        // Validate sourcePath is an existing directory before reading from it
+        const resolvedSource = resolve(sourcePath);
+        const { statSync } = await import('fs');
+        const { homedir } = await import('os');
+        const home = homedir();
+        if (resolvedSource !== home && !resolvedSource.startsWith(home + sep)) {
+            return { error: 'sourcePath must be within the home directory.' };
+        }
+        try {
+            const st = statSync(resolvedSource);
+            if (!st.isDirectory()) {
+                return { error: 'sourcePath must be a directory' };
+            }
+        }
+        catch {
+            return { error: 'sourcePath does not exist' };
+        }
         // Try to load patterns from source project's memory store
-        const sourceMemoryPath = join(resolve(sourcePath), MEMORY_DIR, MEMORY_FILE);
+        const sourceMemoryPath = join(resolvedSource, MEMORY_DIR, MEMORY_FILE);
         let sourceStore = { entries: {}, version: '3.0.0' };
         try {
             if (existsSync(sourceMemoryPath)) {
@@ -2051,6 +2077,13 @@ export const hooksTrajectoryStart = {
             steps: [],
             startedAt,
         };
+        const MAX_TRAJECTORIES = 10000;
+        if (activeTrajectories.size >= MAX_TRAJECTORIES) {
+            // Evict the oldest trajectory
+            const oldest = activeTrajectories.keys().next().value;
+            if (oldest)
+                activeTrajectories.delete(oldest);
+        }
         activeTrajectories.set(trajectoryId, trajectory);
         return {
             trajectoryId,

package/packages/@monomind/cli/dist/src/mcp-tools/memory-tools.js

@@ -9,20 +9,21 @@
  *
  * @module v1/cli/mcp-tools/memory-tools
  */
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
-import { join, resolve } from 'path';
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { getProjectCwd } from './types.js';
 // Paths
 const MEMORY_DIR = '.monomind/memory';
 const LEGACY_MEMORY_FILE = 'store.json';
 const MIGRATION_MARKER = '.migrated-to-sqlite';
 function getMemoryDir() {
-    return resolve(MEMORY_DIR);
+    return join(getProjectCwd(), MEMORY_DIR);
 }
 function getLegacyPath() {
-    return resolve(join(MEMORY_DIR, LEGACY_MEMORY_FILE));
+    return join(getProjectCwd(), MEMORY_DIR, LEGACY_MEMORY_FILE);
 }
 function getMigrationMarkerPath() {
-    return resolve(join(MEMORY_DIR, MIGRATION_MARKER));
+    return join(getProjectCwd(), MEMORY_DIR, MIGRATION_MARKER);
 }
 function ensureMemoryDir() {
     const dir = getMemoryDir();
@@ -56,12 +57,18 @@ function hasLegacyStore() {
 /**
  * Load legacy JSON store for migration
  */
+const MAX_LEGACY_STORE_BYTES = 50 * 1024 * 1024;
 function loadLegacyStore() {
     try {
         const path = getLegacyPath();
         if (existsSync(path)) {
+            if (statSync(path).size > MAX_LEGACY_STORE_BYTES)
+                return null;
             const data = readFileSync(path, 'utf-8');
-            return JSON.parse(data);
+            const parsed = JSON.parse(data);
+            if (parsed && typeof parsed === 'object' && Object.prototype.hasOwnProperty.call(parsed, '__proto__'))
+                return null;
+            return parsed;
         }
     }
     catch {
@@ -74,10 +81,13 @@ function loadLegacyStore() {
  */
 function markMigrationComplete() {
     ensureMemoryDir();
-    writeFileSync(getMigrationMarkerPath(), JSON.stringify({
+    const dest = getMigrationMarkerPath();
+    const tmp = dest + '.tmp';
+    writeFileSync(tmp, JSON.stringify({
         migratedAt: new Date().toISOString(),
         version: '3.0.0',
     }), 'utf-8');
+    renameSync(tmp, dest);
 }
 /**
  * Lazy-load memory initializer functions to avoid circular deps
@@ -287,7 +297,7 @@ export const memoryTools = [
             const { searchEntries } = await getMemoryFunctions();
             const query = input.query;
             const namespace = input.namespace || 'default';
-            const limit = input.limit || 10;
+            const limit = Math.min(Math.max(input.limit || 10, 1), 1000);
             const threshold = input.threshold || 0.3;
             validateMemoryInput(undefined, undefined, query);
             const startTime = performance.now();
@@ -389,7 +399,7 @@ export const memoryTools = [
             await ensureInitialized();
             const { listEntries } = await getMemoryFunctions();
             const namespace = input.namespace;
-            const limit = input.limit || 50;
+            const limit = Math.min(Math.max(input.limit || 50, 1), 1000);
             const offset = input.offset || 0;
             try {
                 const result = await listEntries({
@@ -438,8 +448,12 @@ export const memoryTools = [
             const { checkMemoryInitialization, listEntries } = await getMemoryFunctions();
             try {
                 const status = await checkMemoryInitialization();
-                const allEntries = await listEntries({ limit: 100000 });
-                // Count by namespace
+                // Cap stats sample at 1000 entries — the previous 100000 limit could
+                // load up to 100 GB of resident memory (each entry value capped at 1 MB)
+                // just to compute aggregate counts. Counts above 1000 are reported as
+                // approximate via the dedicated `total` field.
+                const allEntries = await listEntries({ limit: 1000 });
+                // Count by namespace (sample-based for large stores)
                 const namespaces = {};
                 let withEmbeddings = 0;
                 for (const entry of allEntries.entries) {
@@ -491,6 +505,8 @@ export const memoryTools = [
                     unlinkSync(markerPath);
                 }
             }
+            // Check if migration was already completed before running it
+            const alreadyMigrated = existsSync(getMigrationMarkerPath());
             // Check for legacy data
             const legacyStore = loadLegacyStore();
             if (!legacyStore || Object.keys(legacyStore.entries).length === 0) {
@@ -504,8 +520,8 @@ export const memoryTools = [
             await ensureInitialized();
             return {
                 success: true,
-                message: 'Migration completed',
-                migrated: Object.keys(legacyStore.entries).length,
+                message: alreadyMigrated ? 'Already migrated — use force=true to re-run' : 'Migration completed',
+                migrated: alreadyMigrated ? 0 : Object.keys(legacyStore.entries).length,
                 backend: 'sql.js + HNSW',
             };
         },