monomind 1.8.0 → 1.9.1

package/packages/@monomind/cli/dist/src/mcp-tools/transfer-tools.js

@@ -2,7 +2,7 @@
  * Transfer MCP Tools
  * Pattern and plugin sharing via IPFS-based decentralized registry
  *
- * @module @monoes/cli/mcp-tools/transfer-tools
+ * @module @monomind/cli/mcp-tools/transfer-tools
  * @version 3.0.0
  */
 /**
@@ -19,6 +19,21 @@ function createResult(data, isError = false) {
         isError,
     };
 }
+/**
+ * Cached PatternStore — initialize() may open IPFS connections, sql.js/WASM,
+ * or download registry data. Re-creating on every handler call wastes work
+ * and risks file-descriptor / socket-pool leaks on rapid invocations.
+ */
+let cachedPatternStore = null;
+async function getPatternStore() {
+    if (cachedPatternStore)
+        return cachedPatternStore;
+    const { PatternStore } = await import('../transfer/store/index.js');
+    const store = new PatternStore();
+    await store.initialize();
+    cachedPatternStore = store;
+    return cachedPatternStore;
+}
 /**
  * Transfer MCP tools for pattern export, import, anonymization, and sharing
  */
@@ -116,9 +131,7 @@ export const transferTools = [
         },
         handler: async (input) => {
             try {
-                const { PatternStore } = await import('../transfer/store/index.js');
-                const store = new PatternStore();
-                await store.initialize();
+                const store = await getPatternStore();
                 const results = store.search(input);
                 return createResult(results);
             }
@@ -144,9 +157,7 @@ export const transferTools = [
         },
         handler: async (input) => {
             try {
-                const { PatternStore } = await import('../transfer/store/index.js');
-                const store = new PatternStore();
-                await store.initialize();
+                const store = await getPatternStore();
                 const pattern = store.getPattern(input.id);
                 if (!pattern) {
                     return createResult({ error: 'Pattern not found' }, true);
@@ -179,9 +190,7 @@ export const transferTools = [
         },
         handler: async (input) => {
             try {
-                const { PatternStore } = await import('../transfer/store/index.js');
-                const store = new PatternStore();
-                await store.initialize();
+                const store = await getPatternStore();
                 const result = await store.download(input.id, { verify: input.verify });
                 return createResult(result);
             }
@@ -206,9 +215,7 @@ export const transferTools = [
         },
         handler: async (input) => {
             try {
-                const { PatternStore } = await import('../transfer/store/index.js');
-                const store = new PatternStore();
-                await store.initialize();
+                const store = await getPatternStore();
                 const featured = store.getFeatured();
                 const limit = input.limit || 10;
                 return createResult(featured.slice(0, limit));
@@ -234,9 +241,7 @@ export const transferTools = [
         },
         handler: async (input) => {
             try {
-                const { PatternStore } = await import('../transfer/store/index.js');
-                const store = new PatternStore();
-                await store.initialize();
+                const store = await getPatternStore();
                 const trending = store.getTrending();
                 const limit = input.limit || 10;
                 return createResult(trending.slice(0, limit));

package/packages/@monomind/cli/dist/src/mcp-tools/workflow-tools.js

@@ -3,9 +3,11 @@
  *
  * Tool definitions for workflow automation and orchestration.
  */
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
 import { getProjectCwd } from './types.js';
+const MAX_WORKFLOW_STORE_BYTES = 50 * 1024 * 1024; // 50 MB
 // Storage paths
 const STORAGE_DIR = '.monomind';
 const WORKFLOW_DIR = 'workflows';
@@ -26,6 +28,9 @@ function loadWorkflowStore() {
     try {
         const path = getWorkflowPath();
         if (existsSync(path)) {
+            if (statSync(path).size > MAX_WORKFLOW_STORE_BYTES) {
+                return { workflows: {}, templates: {}, version: '3.0.0' };
+            }
             const data = readFileSync(path, 'utf-8');
             return JSON.parse(data);
         }
@@ -36,9 +41,37 @@ function loadWorkflowStore() {
     return { workflows: {}, templates: {}, version: '3.0.0' };
 }
 function saveWorkflowStore(store) {
+    // Cap completed/failed/cancelled workflows so the file doesn't grow without
+    // bound. Each save serializes the entire store to disk; without eviction
+    // a long-running daemon would blow up to GBs of JSON.
+    const MAX_WORKFLOWS = 500;
+    const MAX_TEMPLATES = 200;
+    const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+    const finished = Object.entries(store.workflows ?? {})
+        .filter(([, w]) => TERMINAL.has(w.status ?? ''))
+        .sort(([, a], [, b]) => {
+        const aw = a;
+        const bw = b;
+        return (aw.completedAt ?? aw.createdAt ?? '').localeCompare(bw.completedAt ?? bw.createdAt ?? '');
+    });
+    if (finished.length > MAX_WORKFLOWS) {
+        for (const [id] of finished.slice(0, finished.length - MAX_WORKFLOWS)) {
+            delete store.workflows[id];
+        }
+    }
+    const templates = Object.keys(store.templates ?? {});
+    if (templates.length > MAX_TEMPLATES) {
+        for (const id of templates.slice(0, templates.length - MAX_TEMPLATES)) {
+            delete store.templates[id];
+        }
+    }
     ensureWorkflowDir();
-    writeFileSync(getWorkflowPath(), JSON.stringify(store, null, 2), 'utf-8');
+    const dest = getWorkflowPath();
+    const tmp = `${dest}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(tmp, JSON.stringify(store, null, 2), 'utf-8');
+    renameSync(tmp, dest);
 }
+const FORBIDDEN_WORKFLOW_IDS = new Set(['__proto__', 'constructor', 'prototype']);
 export const workflowTools = [
     {
         name: 'workflow_run',
@@ -69,7 +102,7 @@ export const workflowTools = [
             const options = input.options || {};
             const dryRun = options.dryRun;
             // Build workflow from template or inline
-            const workflowId = `workflow-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const workflowId = `workflow-${Date.now()}-${randomBytes(6).toString('hex')}`;
             const stages = [];
             // Generate stages based on template
             const templateName = template || 'custom';
@@ -158,7 +191,7 @@ export const workflowTools = [
         },
         handler: async (input) => {
             const store = loadWorkflowStore();
-            const workflowId = `workflow-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const workflowId = `workflow-${Date.now()}-${randomBytes(6).toString('hex')}`;
             const steps = (input.steps || []).map((s, i) => ({
                 stepId: `step-${i + 1}`,
                 name: s.name || `Step ${i + 1}`,
@@ -201,9 +234,17 @@ export const workflowTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
-            const store = loadWorkflowStore();
             const workflowId = input.workflowId;
-            const workflow = store.workflows[workflowId];
+            if (!workflowId || typeof workflowId !== 'string' || FORBIDDEN_WORKFLOW_IDS.has(workflowId)) {
+                return { workflowId, error: 'Workflow not found' };
+            }
+            const store = loadWorkflowStore();
+            // Object.hasOwn defends against bracket-access into Object.prototype
+            // members (toString, hasOwnProperty, etc.) — the FORBIDDEN_WORKFLOW_IDS
+            // blocklist alone misses these inherited names.
+            const workflow = Object.hasOwn(store.workflows, workflowId)
+                ? store.workflows[workflowId]
+                : undefined;
             if (!workflow) {
                 return { workflowId, error: 'Workflow not found' };
             }
@@ -252,9 +293,12 @@ export const workflowTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
-            const store = loadWorkflowStore();
             const workflowId = input.workflowId;
-            const workflow = store.workflows[workflowId];
+            if (!workflowId || typeof workflowId !== 'string' || FORBIDDEN_WORKFLOW_IDS.has(workflowId)) {
+                return { workflowId, error: 'Workflow not found' };
+            }
+            const store = loadWorkflowStore();
+            const workflow = Object.hasOwn(store.workflows, workflowId) ? store.workflows[workflowId] : undefined;
             if (!workflow) {
                 return { workflowId, error: 'Workflow not found' };
             }
@@ -313,6 +357,7 @@ export const workflowTools = [
             workflows.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
             // Apply limit
             const limit = input.limit || 20;
+            const totalCount = workflows.length;
             workflows = workflows.slice(0, limit);
             return {
                 workflows: workflows.map(w => ({
@@ -323,7 +368,7 @@ export const workflowTools = [
                     createdAt: w.createdAt,
                     completedAt: w.completedAt,
                 })),
-                total: workflows.length,
+                total: totalCount,
                 filters: { status: input.status },
             };
         },
@@ -340,9 +385,12 @@ export const workflowTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
-            const store = loadWorkflowStore();
             const workflowId = input.workflowId;
-            const workflow = store.workflows[workflowId];
+            if (!workflowId || typeof workflowId !== 'string' || FORBIDDEN_WORKFLOW_IDS.has(workflowId)) {
+                return { workflowId, error: 'Workflow not found' };
+            }
+            const store = loadWorkflowStore();
+            const workflow = Object.hasOwn(store.workflows, workflowId) ? store.workflows[workflowId] : undefined;
             if (!workflow) {
                 return { workflowId, error: 'Workflow not found' };
             }
@@ -371,9 +419,12 @@ export const workflowTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
-            const store = loadWorkflowStore();
             const workflowId = input.workflowId;
-            const workflow = store.workflows[workflowId];
+            if (!workflowId || typeof workflowId !== 'string' || FORBIDDEN_WORKFLOW_IDS.has(workflowId)) {
+                return { workflowId, error: 'Workflow not found' };
+            }
+            const store = loadWorkflowStore();
+            const workflow = Object.hasOwn(store.workflows, workflowId) ? store.workflows[workflowId] : undefined;
             if (!workflow) {
                 return { workflowId, error: 'Workflow not found' };
             }
@@ -413,16 +464,21 @@ export const workflowTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
-            const store = loadWorkflowStore();
             const workflowId = input.workflowId;
-            const workflow = store.workflows[workflowId];
+            if (!workflowId || typeof workflowId !== 'string' || FORBIDDEN_WORKFLOW_IDS.has(workflowId)) {
+                return { workflowId, error: 'Workflow not found' };
+            }
+            const store = loadWorkflowStore();
+            const workflow = Object.hasOwn(store.workflows, workflowId)
+                ? store.workflows[workflowId]
+                : undefined;
             if (!workflow) {
                 return { workflowId, error: 'Workflow not found' };
             }
-            if (workflow.status === 'completed' || workflow.status === 'failed') {
+            if (workflow.status === 'completed' || workflow.status === 'failed' || workflow.status === 'cancelled') {
                 return { workflowId, error: 'Workflow already finished' };
             }
-            workflow.status = 'failed';
+            workflow.status = 'cancelled';
             workflow.error = input.reason || 'Cancelled by user';
             workflow.completedAt = new Date().toISOString();
             // Mark remaining steps as skipped
@@ -451,9 +507,12 @@ export const workflowTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
-            const store = loadWorkflowStore();
             const workflowId = input.workflowId;
-            if (!store.workflows[workflowId]) {
+            if (!workflowId || typeof workflowId !== 'string' || FORBIDDEN_WORKFLOW_IDS.has(workflowId)) {
+                return { workflowId, error: 'Workflow not found' };
+            }
+            const store = loadWorkflowStore();
+            if (!Object.hasOwn(store.workflows, workflowId)) {
                 return { workflowId, error: 'Workflow not found' };
             }
             const workflow = store.workflows[workflowId];
@@ -488,11 +547,15 @@ export const workflowTools = [
             const store = loadWorkflowStore();
             const action = input.action;
             if (action === 'save') {
-                const workflow = store.workflows[input.workflowId];
+                const rawWorkflowId = input.workflowId;
+                if (!rawWorkflowId || typeof rawWorkflowId !== 'string' || FORBIDDEN_WORKFLOW_IDS.has(rawWorkflowId) || !Object.hasOwn(store.workflows, rawWorkflowId)) {
+                    return { action, error: 'Workflow not found' };
+                }
+                const workflow = store.workflows[rawWorkflowId];
                 if (!workflow) {
                     return { action, error: 'Workflow not found' };
                 }
-                const templateId = `template-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+                const templateId = `template-${Date.now()}-${randomBytes(6).toString('hex')}`;
                 const template = {
                     ...workflow,
                     workflowId: templateId,
@@ -521,17 +584,23 @@ export const workflowTools = [
                 };
             }
             if (action === 'create') {
-                const template = store.templates[input.templateId];
+                const rawTemplateId = input.templateId;
+                if (!rawTemplateId || typeof rawTemplateId !== 'string' || FORBIDDEN_WORKFLOW_IDS.has(rawTemplateId) || !Object.hasOwn(store.templates, rawTemplateId)) {
+                    return { action, error: 'Template not found' };
+                }
+                const template = store.templates[rawTemplateId];
                 if (!template) {
                     return { action, error: 'Template not found' };
                 }
-                const workflowId = `workflow-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+                const workflowId = `workflow-${Date.now()}-${randomBytes(6).toString('hex')}`;
                 const workflow = {
                     ...template,
                     workflowId,
                     name: input.newName || template.name.replace(' Template', ''),
                     status: 'ready',
                     createdAt: new Date().toISOString(),
+                    steps: template.steps.map(s => ({ ...s, status: 'pending', result: undefined })),
+                    variables: { ...template.variables },
                 };
                 store.workflows[workflowId] = workflow;
                 saveWorkflowStore(store);

package/packages/@monomind/cli/dist/src/memory/ewc-consolidation.js

@@ -199,6 +199,9 @@ export class EWCConsolidator {
                 penalty: result.totalPenalty,
                 patterns: result.patternsConsolidated
             });
+            if (this.consolidationHistory.length > 100) {
+                this.consolidationHistory = this.consolidationHistory.slice(-100);
+            }
             // Persist to disk
             this.saveToDisk();
             result.success = true;
@@ -495,7 +498,9 @@ export class EWCConsolidator {
                 consolidationHistory: this.consolidationHistory.slice(-100),
                 savedAt: Date.now()
             };
-            fs.writeFileSync(this.config.storagePath, JSON.stringify(state, null, 2));
+            const tmp = this.config.storagePath + '.tmp';
+            fs.writeFileSync(tmp, JSON.stringify(state, null, 2));
+            fs.renameSync(tmp, this.config.storagePath);
         }
         catch {
             // Silently fail - persistence is best-effort
@@ -514,20 +519,46 @@ export class EWCConsolidator {
         if (state.version !== '1.0.0') {
             throw new Error(`Unsupported state version: ${state.version}`);
         }
-        // Restore state
-        this.globalFisher = state.globalFisher || new Array(this.config.dimensions).fill(0);
-        // Restore patterns
+        // Validate globalFisher — must be a finite-numeric vector matching dim.
+        // An attacker who can write the persisted file could otherwise inject
+        // [Infinity, ...] (freezes learning via the penalty>lambda damping branch)
+        // or NaN values that poison ranking unpredictably.
+        if (Array.isArray(state.globalFisher)
+            && state.globalFisher.length === this.config.dimensions
+            && state.globalFisher.every((v) => typeof v === 'number' && Number.isFinite(v))) {
+            this.globalFisher = state.globalFisher;
+        }
+        else {
+            this.globalFisher = new Array(this.config.dimensions).fill(0);
+        }
+        // Restore patterns — drop any whose weights/fisherDiagonal are invalid.
         this.patterns.clear();
-        if (state.patterns) {
-            for (const [id, pattern] of state.patterns) {
+        if (Array.isArray(state.patterns)) {
+            const isFiniteNumberArray = (a, dim) => Array.isArray(a) && a.length === dim && a.every(v => typeof v === 'number' && Number.isFinite(v));
+            for (const entry of state.patterns) {
+                if (!Array.isArray(entry) || entry.length !== 2)
+                    continue;
+                const [id, pattern] = entry;
+                if (typeof id !== 'string' || id.length > 256)
+                    continue;
+                const p = pattern;
+                if (!p || typeof p !== 'object')
+                    continue;
+                if (p.weights !== undefined && !isFiniteNumberArray(p.weights, this.config.dimensions))
+                    continue;
+                if (p.fisherDiagonal !== undefined && !isFiniteNumberArray(p.fisherDiagonal, this.config.dimensions))
+                    continue;
                 this.patterns.set(id, pattern);
             }
         }
         // Restore history
-        this.consolidationHistory = state.consolidationHistory || [];
-        // Update config from persisted values
-        if (state.config) {
-            this.config.lambda = state.config.lambda ?? this.config.lambda;
+        this.consolidationHistory = Array.isArray(state.consolidationHistory) ? state.consolidationHistory : [];
+        // Update config from persisted values, clamped to a sensible range to
+        // prevent negative/NaN lambda from inverting the regularization sign.
+        if (state.config && typeof state.config.lambda === 'number'
+            && Number.isFinite(state.config.lambda)
+            && state.config.lambda >= 0 && state.config.lambda <= 1000) {
+            this.config.lambda = state.config.lambda;
         }
     }
 }

package/packages/@monomind/cli/dist/src/memory/intelligence.d.ts

@@ -212,8 +212,8 @@ declare class LocalReasoningBank {
     clear(): void;
 }
 /**
- * Initialize the intelligence system (SONA + ReasoningBank)
- * Uses optimized local implementations
+ * Initialize the intelligence system (SONA + ReasoningBank).
+ * Promise-based singleton: concurrent callers share a single init flight.
  */
 export declare function initializeIntelligence(config?: Partial<SonaConfig>): Promise<{
     success: boolean;

package/packages/@monomind/cli/dist/src/memory/intelligence.js

@@ -10,7 +10,7 @@
  *
  * @module v1/cli/intelligence
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 // ============================================================================
@@ -335,8 +335,26 @@ class LocalReasoningBank {
             if (existsSync(path)) {
                 const data = JSON.parse(readFileSync(path, 'utf-8'));
                 if (Array.isArray(data)) {
+                    // Validate each persisted pattern. The patterns file is part of the
+                    // IPFS-distributed pattern transfer flow — without bounds checks, a
+                    // malicious bundle can inject `confidence: 1e9` (deterministically wins
+                    // every routing decision) or `keywords: [10000 strings]` (DoS on every
+                    // findBestPatternMatch call).
                     for (const pattern of data) {
-                        this.patterns.set(pattern.id, pattern);
+                        if (!pattern || typeof pattern !== 'object')
+                            continue;
+                        const id = pattern.id;
+                        if (typeof id !== 'string' || id.length === 0 || id.length > 256)
+                            continue;
+                        const conf = pattern.confidence;
+                        if (conf !== undefined && (typeof conf !== 'number' || !Number.isFinite(conf) || conf < 0 || conf > 1)) {
+                            continue;
+                        }
+                        const keywords = pattern.keywords;
+                        if (keywords !== undefined && (!Array.isArray(keywords) || keywords.length > 64)) {
+                            continue;
+                        }
+                        this.patterns.set(id, pattern);
                         this.patternList.push(pattern);
                     }
                 }
@@ -370,7 +388,9 @@ class LocalReasoningBank {
         try {
             ensureDataDir();
             const path = getPatternsPath();
-            writeFileSync(path, JSON.stringify(this.patternList, null, 2), 'utf-8');
+            const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+            writeFileSync(tmp, JSON.stringify(this.patternList, null, 2), 'utf-8');
+            renameSync(tmp, path);
             this.dirty = false;
         }
         catch (error) {
@@ -514,6 +534,7 @@ class LocalReasoningBank {
 let sonaCoordinator = null;
 let reasoningBank = null;
 let intelligenceInitialized = false;
+let initPromise = null;
 let globalStats = {
     trajectoriesRecorded: 0,
     lastAdaptation: null
@@ -559,14 +580,7 @@ function savePersistedStats() {
  * Initialize the intelligence system (SONA + ReasoningBank)
  * Uses optimized local implementations
  */
-export async function initializeIntelligence(config) {
-    if (intelligenceInitialized) {
-        return {
-            success: true,
-            sonaEnabled: !!sonaCoordinator,
-            reasoningBankEnabled: !!reasoningBank
-        };
-    }
+async function _doInitializeIntelligence(config) {
     try {
         // Merge config with defaults
         const finalConfig = {
@@ -598,6 +612,19 @@ export async function initializeIntelligence(config) {
         };
     }
 }
+/**
+ * Initialize the intelligence system (SONA + ReasoningBank).
+ * Promise-based singleton: concurrent callers share a single init flight.
+ */
+export async function initializeIntelligence(config) {
+    if (intelligenceInitialized) {
+        return { success: true, sonaEnabled: !!sonaCoordinator, reasoningBankEnabled: !!reasoningBank };
+    }
+    if (!initPromise) {
+        initPromise = _doInitializeIntelligence(config);
+    }
+    return initPromise;
+}
 /**
  * Record a trajectory step for learning
  * Performance: <0.05ms without embedding generation
@@ -661,7 +688,6 @@ export async function recordStep(step) {
             globalStats.lastAdaptation = Date.now();
         }
         globalStats.trajectoriesRecorded++;
-        savePersistedStats();
         return true;
     }
     catch {
@@ -839,7 +865,7 @@ export function clearIntelligence() {
  */
 export function benchmarkAdaptation(iterations = 1000) {
     if (!sonaCoordinator) {
-        initializeIntelligence();
+        return { totalMs: 0, avgMs: 0, minMs: 0, maxMs: 0, targetMet: false };
     }
     const times = [];
     const testEmbedding = Array.from({ length: 384 }, () => Math.random());

package/packages/@monomind/cli/dist/src/memory/memory-bridge.d.ts

@@ -16,6 +16,7 @@
  *
  * @module v1/cli/memory-bridge
  */
+export declare function safeParseEmbedding(raw: string | null | undefined): number[] | null;
 /**
  * Store an entry via AgentDB v1.
  * Phase 2-5: Routes through MutationGuard → TieredCache → DB → AttestationLog.