monomind 1.9.16 → 1.10.0

package/packages/@monomind/cli/dist/src/agents/version-store.js

@@ -1,235 +0,0 @@
-/**
- * Agent Version Store (Task 29)
- *
- * JSONL-based append-only storage for agent definition versions.
- * Supports save, list, get, rollback, and diff operations.
- */
-import { createHash, randomUUID, randomBytes } from 'crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, statSync } from 'fs';
-import { join } from 'path';
-import { computeUnifiedDiff } from './version-diff.js';
-import { parseJsonl } from '../utils/parse-jsonl.js';
-function toStored(r) {
-    return {
-        id: r.id,
-        slug: r.slug,
-        version: r.version,
-        changelog: r.changelog,
-        deprecated: r.deprecated,
-        deprecatedBy: r.deprecatedBy,
-        content: r.content,
-        contentHash: r.contentHash,
-        capturedAt: r.capturedAt instanceof Date
-            ? r.capturedAt.toISOString()
-            : String(r.capturedAt),
-        capturedBy: r.capturedBy,
-        isCurrent: r.isCurrent,
-    };
-}
-function fromStored(s) {
-    return {
-        id: s.id,
-        slug: s.slug,
-        version: s.version,
-        changelog: s.changelog,
-        deprecated: s.deprecated,
-        deprecatedBy: s.deprecatedBy,
-        content: s.content,
-        contentHash: s.contentHash,
-        capturedAt: new Date(s.capturedAt),
-        capturedBy: s.capturedBy,
-        isCurrent: s.isCurrent,
-    };
-}
-/**
- * JSONL-based agent version store.
- *
- * Each slug's versions are stored in `<dirPath>/versions.jsonl`, one JSON
- * object per line.  Rollback rewrites the file to update `isCurrent` flags.
- */
-export class AgentVersionStore {
-    dirPath;
-    filePath;
-    constructor(dirPath) {
-        this.dirPath = dirPath;
-        if (!existsSync(dirPath)) {
-            mkdirSync(dirPath, { recursive: true });
-        }
-        this.filePath = join(dirPath, 'versions.jsonl');
-    }
-    // ---------------------------------------------------------------------------
-    // Persistence helpers
-    // ---------------------------------------------------------------------------
-    readAll() {
-        if (!existsSync(this.filePath)) {
-            return [];
-        }
-        const stat = statSync(this.filePath);
-        if (stat.size > 10 * 1024 * 1024) {
-            throw new Error('Version store exceeds size limit; run compaction');
-        }
-        const raw = readFileSync(this.filePath, 'utf-8');
-        // Drop any record whose stored contentHash does not match the SHA-256 of
-        // its content. saveVersion advertises tamper-evidence by computing the
-        // hash; without this verification step, an attacker who can write the
-        // JSONL file can swap `content` with a poisoned agent prompt while
-        // leaving `contentHash` unchanged, and the next getCurrent() returns
-        // the tampered prompt verbatim into the LLM context.
-        const records = parseJsonl(raw);
-        const verified = [];
-        for (const r of records) {
-            if (typeof r?.content !== 'string' ||
-                typeof r?.contentHash !== 'string' ||
-                typeof r?.id !== 'string' ||
-                typeof r?.slug !== 'string' ||
-                typeof r?.version !== 'string' ||
-                typeof r?.changelog !== 'string' ||
-                typeof r?.capturedBy !== 'string' ||
-                typeof r?.capturedAt !== 'string')
-                continue;
-            const actual = createHash('sha256').update(r.content).digest('hex');
-            if (actual !== r.contentHash)
-                continue; // silently drop tampered record
-            verified.push(r);
-        }
-        return verified.map(fromStored);
-    }
-    writeAll(records) {
-        const lines = records.map((r) => JSON.stringify(toStored(r)));
-        const tmp = `${this.filePath}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
-        writeFileSync(tmp, lines.join('\n') + '\n', 'utf-8');
-        renameSync(tmp, this.filePath);
-    }
-    // ---------------------------------------------------------------------------
-    // Public API
-    // ---------------------------------------------------------------------------
-    /**
-     * Save a new version for the given agent slug.
-     *
-     * Computes a SHA-256 hash of the content, marks all previous versions for
-     * the same slug as non-current, and appends the new record.
-     */
-    saveVersion(slug, content, version, changelog, opts = {}) {
-        const MAX_CONTENT_BYTES = 512 * 1024;
-        if (Buffer.byteLength(content, 'utf-8') > MAX_CONTENT_BYTES) {
-            throw new Error(`content exceeds maximum allowed size (${MAX_CONTENT_BYTES} bytes)`);
-        }
-        const contentHash = createHash('sha256').update(content).digest('hex');
-        // SINGLE-WRITER CONTRACT: version-store is written only by the daemon process.
-        // Concurrent saveVersion() calls from multiple processes would race on readAll/writeAll.
-        // If multi-writer access is needed in future, introduce an advisory lock here.
-        const existing = this.readAll();
-        for (const rec of existing) {
-            if (rec.slug === slug && rec.isCurrent) {
-                rec.isCurrent = false;
-            }
-        }
-        const record = {
-            id: randomUUID(),
-            slug,
-            version,
-            changelog,
-            deprecated: opts.deprecated ?? false,
-            deprecatedBy: opts.deprecatedBy,
-            content,
-            contentHash,
-            capturedAt: new Date(),
-            capturedBy: opts.capturedBy ?? 'system',
-            isCurrent: true,
-        };
-        existing.push(record);
-        this.writeAll(existing);
-        return record;
-    }
-    /**
-     * List all versions for a slug, sorted by capturedAt DESC (newest first).
-     * Uses insertion order (line index) as a stable tiebreaker.
-     */
-    listVersions(slug) {
-        const all = this.readAll();
-        const indexed = all.map((r, i) => ({ r, i }));
-        return indexed
-            .filter(({ r }) => r.slug === slug)
-            .sort((a, b) => {
-            const timeDiff = new Date(b.r.capturedAt).getTime() -
-                new Date(a.r.capturedAt).getTime();
-            return timeDiff !== 0 ? timeDiff : b.i - a.i;
-        })
-            .map(({ r }) => r);
-    }
-    /**
-     * Get the current active version for a slug, or null.
-     */
-    getCurrent(slug) {
-        const all = this.readAll();
-        const indexed = all.map((r, i) => ({ r, i }));
-        const matching = indexed.filter(({ r }) => r.slug === slug && r.isCurrent);
-        if (matching.length === 0)
-            return null;
-        // Return the most recent current record (insertion order as tiebreaker)
-        return matching.sort((a, b) => {
-            const timeDiff = new Date(b.r.capturedAt).getTime() -
-                new Date(a.r.capturedAt).getTime();
-            return timeDiff !== 0 ? timeDiff : b.i - a.i;
-        })[0].r;
-    }
-    /**
-     * Get a specific version by slug and semver string, or null.
-     */
-    getVersion(slug, version) {
-        return (this.readAll().find((r) => r.slug === slug && r.version === version) ?? null);
-    }
-    /**
-     * Roll back to a specific version.
-     *
-     * Marks the target version as current and all others for that slug as
-     * non-current.  Rewrites the JSONL file.
-     *
-     * @throws Error if the target version does not exist.
-     */
-    rollback(slug, toVersion) {
-        const all = this.readAll();
-        let target;
-        for (const rec of all) {
-            if (rec.slug === slug) {
-                if (rec.version === toVersion) {
-                    rec.isCurrent = true;
-                    target = rec;
-                }
-                else {
-                    rec.isCurrent = false;
-                }
-            }
-        }
-        if (!target) {
-            throw new Error(`Version "${toVersion}" not found for agent "${slug}"`);
-        }
-        this.writeAll(all);
-        return target;
-    }
-    /**
-     * Compute a line-level diff between two versions of the same agent.
-     *
-     * @throws Error if either version does not exist.
-     */
-    diff(slug, fromVersion, toVersion) {
-        const from = this.getVersion(slug, fromVersion);
-        if (!from) {
-            throw new Error(`Version "${fromVersion}" not found for agent "${slug}"`);
-        }
-        const to = this.getVersion(slug, toVersion);
-        if (!to) {
-            throw new Error(`Version "${toVersion}" not found for agent "${slug}"`);
-        }
-        const { additions, deletions, hunks } = computeUnifiedDiff(from.content, to.content);
-        return {
-            slug,
-            fromVersion,
-            toVersion,
-            additions,
-            deletions,
-            hunks,
-        };
-    }
-}
-//# sourceMappingURL=version-store.js.map

package/packages/@monomind/cli/dist/src/autopilot-state.d.ts

@@ -1,77 +0,0 @@
-/**
- * Autopilot Shared State Module
- *
- * Centralizes state management, validation, and task discovery
- * for both CLI command and MCP tools. Eliminates code duplication.
- *
- * ADR-072: Autopilot Integration
- * Security: Addresses prototype pollution, NaN bypass, input validation
- */
-export declare const STATE_DIR = ".monomind/data";
-export declare const STATE_FILE = ".monomind/data/autopilot-state.json";
-export declare const LOG_FILE = ".monomind/data/autopilot-log.json";
-/** Allowlist for valid task sources */
-export declare const VALID_TASK_SOURCES: Set<string>;
-/** Terminal task statuses */
-export declare const TERMINAL_STATUSES: Set<string>;
-export interface AutopilotState {
-    sessionId: string;
-    enabled: boolean;
-    startTime: number;
-    iterations: number;
-    maxIterations: number;
-    timeoutMinutes: number;
-    taskSources: string[];
-    lastCheck: number | null;
-    history: Array<{
-        ts: number;
-        iteration: number;
-        completed: number;
-        total: number;
-    }>;
-}
-export interface AutopilotLogEntry {
-    ts: number;
-    event: string;
-    [key: string]: unknown;
-}
-export interface TaskInfo {
-    id: string;
-    subject: string;
-    status: string;
-    source: string;
-}
-export interface TaskProgress {
-    completed: number;
-    total: number;
-    percent: number;
-    incomplete: TaskInfo[];
-}
-/**
- * Safe JSON.parse that prevents prototype pollution.
- */
-export declare function safeJsonParse<T>(raw: string): T;
-/**
- * Validate and coerce a numeric parameter. Returns the default if
- * the input is NaN, undefined, or outside the allowed range.
- */
-export declare function validateNumber(value: unknown, min: number, max: number, defaultValue: number): number;
-/**
- * Validate task sources against the allowlist.
- * Returns only valid sources; falls back to defaults if none are valid.
- */
-export declare function validateTaskSources(sources: unknown): string[];
-export declare function getDefaultState(): AutopilotState;
-export declare function loadState(): AutopilotState;
-export declare function saveState(state: AutopilotState): void;
-export declare function appendLog(entry: AutopilotLogEntry): void;
-export declare function loadLog(): AutopilotLogEntry[];
-export declare function discoverTasks(sources: string[]): TaskInfo[];
-export declare function isTerminal(status: string): boolean;
-export declare function getProgress(tasks: TaskInfo[]): TaskProgress;
-export declare function calculateReward(iterations: number, durationMs: number): number;
-export declare function tryLoadLearning(): Promise<{
-    initialize: () => Promise<boolean>;
-    [key: string]: unknown;
-} | null>;
-//# sourceMappingURL=autopilot-state.d.ts.map

package/packages/@monomind/cli/dist/src/autopilot-state.js

@@ -1,330 +0,0 @@
-/**
- * Autopilot Shared State Module
- *
- * Centralizes state management, validation, and task discovery
- * for both CLI command and MCP tools. Eliminates code duplication.
- *
- * ADR-072: Autopilot Integration
- * Security: Addresses prototype pollution, NaN bypass, input validation
- */
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-import { randomUUID } from 'crypto';
-// ── Constants ─────────────────────────────────────────────────
-export const STATE_DIR = '.monomind/data';
-export const STATE_FILE = `${STATE_DIR}/autopilot-state.json`;
-export const LOG_FILE = `${STATE_DIR}/autopilot-log.json`;
-/** Maximum entries kept in state.history (prevents unbounded growth) */
-const MAX_HISTORY_ENTRIES = 50;
-/** Maximum entries kept in the event log */
-const MAX_LOG_ENTRIES = 1000;
-/** Allowlist for valid task sources */
-export const VALID_TASK_SOURCES = new Set(['team-tasks', 'swarm-tasks', 'file-checklist']);
-/** Terminal task statuses */
-export const TERMINAL_STATUSES = new Set(['completed', 'done', 'cancelled', 'skipped', 'failed']);
-// ── Validation Helpers ────────────────────────────────────────
-/**
- * Sanitize a parsed JSON object to prevent prototype pollution.
- * Removes __proto__, constructor, and prototype keys recursively.
- */
-function sanitizeObject(obj) {
-    if (obj === null || typeof obj !== 'object')
-        return obj;
-    if (Array.isArray(obj))
-        return obj.map(sanitizeObject);
-    const clean = {};
-    for (const key of Object.keys(obj)) {
-        if (key === '__proto__' || key === 'constructor' || key === 'prototype')
-            continue;
-        clean[key] = sanitizeObject(obj[key]);
-    }
-    return clean;
-}
-/**
- * Safe JSON.parse that prevents prototype pollution.
- */
-export function safeJsonParse(raw) {
-    return sanitizeObject(JSON.parse(raw));
-}
-/**
- * Validate and coerce a numeric parameter. Returns the default if
- * the input is NaN, undefined, or outside the allowed range.
- */
-export function validateNumber(value, min, max, defaultValue) {
-    if (value === undefined || value === null)
-        return defaultValue;
-    const num = Number(value);
-    if (!Number.isFinite(num))
-        return defaultValue;
-    return Math.min(Math.max(min, Math.round(num)), max);
-}
-/**
- * Validate task sources against the allowlist.
- * Returns only valid sources; falls back to defaults if none are valid.
- */
-export function validateTaskSources(sources) {
-    const defaults = ['team-tasks', 'swarm-tasks', 'file-checklist'];
-    if (!Array.isArray(sources))
-        return defaults;
-    const valid = sources
-        .filter((s) => typeof s === 'string')
-        .map(s => s.trim())
-        .filter(s => VALID_TASK_SOURCES.has(s));
-    return valid.length > 0 ? valid : defaults;
-}
-// ── State Management ──────────────────────────────────────────
-export function getDefaultState() {
-    return {
-        sessionId: randomUUID(),
-        enabled: false,
-        startTime: Date.now(),
-        iterations: 0,
-        maxIterations: 50,
-        timeoutMinutes: 240,
-        taskSources: ['team-tasks', 'swarm-tasks', 'file-checklist'],
-        lastCheck: null,
-        history: [],
-    };
-}
-export function loadState() {
-    const filePath = path.resolve(STATE_FILE);
-    const defaults = getDefaultState();
-    try {
-        if (fs.existsSync(filePath)) {
-            const raw = safeJsonParse(fs.readFileSync(filePath, 'utf-8'));
-            const merged = { ...defaults, ...raw };
-            // Re-validate fields that could be tampered with
-            merged.maxIterations = validateNumber(merged.maxIterations, 1, 1000, 50);
-            merged.timeoutMinutes = validateNumber(merged.timeoutMinutes, 1, 1440, 240);
-            merged.iterations = validateNumber(merged.iterations, 0, 1000, 0);
-            merged.taskSources = validateTaskSources(merged.taskSources);
-            // Cap history to prevent unbounded growth
-            if (Array.isArray(merged.history) && merged.history.length > MAX_HISTORY_ENTRIES) {
-                merged.history = merged.history.slice(-MAX_HISTORY_ENTRIES);
-            }
-            return merged;
-        }
-    }
-    catch {
-        // Corrupted state file — return defaults
-    }
-    return defaults;
-}
-export function saveState(state) {
-    const dir = path.resolve(STATE_DIR);
-    if (!fs.existsSync(dir))
-        fs.mkdirSync(dir, { recursive: true });
-    // Cap history before saving
-    if (state.history.length > MAX_HISTORY_ENTRIES) {
-        state.history = state.history.slice(-MAX_HISTORY_ENTRIES);
-    }
-    // Unique tmp filename — concurrent autopilot_enable/disable/reset calls
-    // must not collide on the same .tmp path.
-    const tmpFile = `${path.resolve(STATE_FILE)}.${process.pid}.${Date.now()}.tmp`;
-    fs.writeFileSync(tmpFile, JSON.stringify(state, null, 2));
-    fs.renameSync(tmpFile, path.resolve(STATE_FILE));
-}
-export function appendLog(entry) {
-    const filePath = path.resolve(LOG_FILE);
-    const dir = path.resolve(STATE_DIR);
-    if (!fs.existsSync(dir))
-        fs.mkdirSync(dir, { recursive: true });
-    // Append-only NDJSON: atomic at the OS level for individual lines, no
-    // read-modify-write race between concurrent MCP tool calls. Compaction is
-    // handled lazily by `compactLog()` which the daemon can call periodically.
-    // Previously this function did read → push → tmp-write → rename, which
-    // under concurrent autopilot_enable/disable/reset calls silently lost
-    // entries (last writer wins) and could truncate the log to a single entry
-    // if a peer crashed mid-write and the next caller's safeJsonParse threw.
-    try {
-        fs.appendFileSync(filePath, JSON.stringify(entry) + '\n', { flag: 'a' });
-    }
-    catch {
-        // Best-effort logging; do not throw from a non-critical observability path.
-    }
-    // Opportunistic compaction so the file doesn't grow without bound.
-    try {
-        const stat = fs.statSync(filePath);
-        if (stat.size > 4 * 1024 * 1024) {
-            compactLog(filePath);
-        }
-    }
-    catch { /* ignore */ }
-}
-/**
- * Compact NDJSON log down to MAX_LOG_ENTRIES. On parse failure for any line,
- * preserve the corrupt file aside (do not silently destroy data).
- */
-function compactLog(filePath) {
-    let lines;
-    try {
-        lines = fs.readFileSync(filePath, 'utf-8').split('\n').filter(l => l.trim().length > 0);
-    }
-    catch {
-        return;
-    }
-    const entries = [];
-    let corrupt = 0;
-    for (const line of lines) {
-        try {
-            const e = safeJsonParse(line);
-            if (e && typeof e === 'object')
-                entries.push(e);
-        }
-        catch {
-            corrupt++;
-        }
-    }
-    if (corrupt > 0) {
-        try {
-            fs.copyFileSync(filePath, `${filePath}.corrupt-${Date.now()}`);
-        }
-        catch { /* ignore */ }
-    }
-    const trimmed = entries.length > MAX_LOG_ENTRIES ? entries.slice(-MAX_LOG_ENTRIES) : entries;
-    const tmp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-    fs.writeFileSync(tmp, trimmed.map(e => JSON.stringify(e)).join('\n') + '\n');
-    fs.renameSync(tmp, filePath);
-}
-export function loadLog() {
-    const filePath = path.resolve(LOG_FILE);
-    try {
-        if (fs.existsSync(filePath)) {
-            const raw = fs.readFileSync(filePath, 'utf-8');
-            // Backward compatible: support both old JSON-array form and the new
-            // append-only NDJSON form. Prefer NDJSON if the file looks line-based.
-            const trimmed = raw.trim();
-            if (trimmed.startsWith('[')) {
-                const result = safeJsonParse(raw);
-                return Array.isArray(result) ? result : [];
-            }
-            const out = [];
-            for (const line of trimmed.split('\n')) {
-                if (!line)
-                    continue;
-                try {
-                    const entry = safeJsonParse(line);
-                    if (entry && typeof entry === 'object')
-                        out.push(entry);
-                }
-                catch { /* skip corrupt line */ }
-            }
-            return out;
-        }
-    }
-    catch {
-        // Corrupted log — return empty
-    }
-    return [];
-}
-// ── Task Discovery ────────────────────────────────────────────
-export function discoverTasks(sources) {
-    const tasks = [];
-    // Only process valid sources
-    const validSources = sources.filter(s => VALID_TASK_SOURCES.has(s));
-    for (const source of validSources) {
-        if (source === 'team-tasks') {
-            const tasksDir = path.join(os.homedir(), '.claude', 'tasks');
-            try {
-                if (fs.existsSync(tasksDir)) {
-                    const teams = fs.readdirSync(tasksDir, { withFileTypes: true });
-                    for (const team of teams) {
-                        if (!team.isDirectory())
-                            continue;
-                        const teamDir = path.join(tasksDir, team.name);
-                        const files = fs.readdirSync(teamDir).filter((f) => f.endsWith('.json'));
-                        for (const file of files) {
-                            try {
-                                const data = safeJsonParse(fs.readFileSync(path.join(teamDir, file), 'utf-8'));
-                                tasks.push({
-                                    id: String(data.id || file.replace('.json', '')),
-                                    subject: String(data.subject || data.title || file),
-                                    status: String(data.status || 'unknown'),
-                                    source: 'team-tasks',
-                                });
-                            }
-                            catch { /* skip individual file */ }
-                        }
-                    }
-                }
-            }
-            catch { /* skip source */ }
-        }
-        if (source === 'swarm-tasks') {
-            const swarmFile = path.resolve('.monomind/swarm-tasks.json');
-            try {
-                if (fs.existsSync(swarmFile)) {
-                    const data = safeJsonParse(fs.readFileSync(swarmFile, 'utf-8'));
-                    const swarmTasks = Array.isArray(data) ? data : (data.tasks || []);
-                    for (const t of swarmTasks) {
-                        if (t && typeof t === 'object') {
-                            const task = t;
-                            tasks.push({
-                                id: String(task.id || task.taskId || `swarm-${tasks.length}`),
-                                subject: String(task.subject || task.description || task.name || 'Unnamed task'),
-                                status: String(task.status || 'unknown'),
-                                source: 'swarm-tasks',
-                            });
-                        }
-                    }
-                }
-            }
-            catch { /* skip source */ }
-        }
-        if (source === 'file-checklist') {
-            const checklistFile = path.resolve('.monomind/data/checklist.json');
-            try {
-                if (fs.existsSync(checklistFile)) {
-                    const data = safeJsonParse(fs.readFileSync(checklistFile, 'utf-8'));
-                    const items = Array.isArray(data) ? data : (data.items || []);
-                    for (const item of items) {
-                        if (item && typeof item === 'object') {
-                            const i = item;
-                            tasks.push({
-                                id: String(i.id || `check-${tasks.length}`),
-                                subject: String(i.subject || i.text || i.description || 'Unnamed item'),
-                                status: String(i.status || (i.done ? 'completed' : 'pending')),
-                                source: 'file-checklist',
-                            });
-                        }
-                    }
-                }
-            }
-            catch { /* skip source */ }
-        }
-    }
-    return tasks;
-}
-// ── Progress Helpers ──────────────────────────────────────────
-export function isTerminal(status) {
-    return TERMINAL_STATUSES.has(status.toLowerCase());
-}
-export function getProgress(tasks) {
-    const completed = tasks.filter(t => isTerminal(t.status)).length;
-    const total = tasks.length;
-    const percent = total === 0 ? 100 : Math.round((completed / total) * 100);
-    const incomplete = tasks.filter(t => !isTerminal(t.status));
-    return { completed, total, percent, incomplete };
-}
-// ── Reward Calculation ────────────────────────────────────────
-export function calculateReward(iterations, durationMs) {
-    const iterFactor = (1 - iterations / (iterations + 10)) * 0.6;
-    const timeFactor = (1 - Math.min(durationMs / 3600000, 1)) * 0.4;
-    return Math.round((iterFactor + timeFactor) * 100) / 100;
-}
-// ── Learning Integration ──────────────────────────────────────
-export async function tryLoadLearning() {
-    try {
-        const modPath = 'agentic-flow/dist/coordination/autopilot-learning.js';
-        const mod = await import(/* webpackIgnore: true */ modPath).catch(() => null);
-        if (mod?.AutopilotLearning) {
-            const instance = new mod.AutopilotLearning();
-            if (await instance.initialize())
-                return instance;
-        }
-    }
-    catch { /* not available */ }
-    return null;
-}
-//# sourceMappingURL=autopilot-state.js.map