monomind 2.0.3 → 2.1.3

package/packages/@monomind/cli/dist/src/output.js

@@ -77,9 +77,12 @@ export class OutputFormatter {
         // Check for NO_COLOR environment variable
         if (process.env.NO_COLOR !== undefined)
             return false;
-        // Check for FORCE_COLOR environment variable
-        if (process.env.FORCE_COLOR !== undefined)
-            return true;
+        // Check for FORCE_COLOR environment variable.
+        // Per the supports-color convention, FORCE_COLOR=0 (or "false") forces
+        // color OFF; any other defined, non-empty value forces color ON.
+        if (process.env.FORCE_COLOR !== undefined) {
+            return process.env.FORCE_COLOR !== '0' && process.env.FORCE_COLOR !== 'false';
+        }
         // Check if stdout is a TTY
         return process.stdout.isTTY ?? false;
     }
@@ -149,14 +152,18 @@ export class OutputFormatter {
         if (this.verbosity === 'quiet')
             return;
         const icon = this.color('[WARN]', 'yellow', 'bold');
-        this.writeln(`${icon} ${message}`);
+        // Write to stderr (not stdout) so it never interleaves with structured
+        // stdout output (e.g. --format json | jq .)
+        this.writeErrorln(`${icon} ${message}`);
     }
     printInfo(message) {
         // Info suppressed in quiet mode
         if (this.verbosity === 'quiet')
             return;
         const icon = this.color('[INFO]', 'blue', 'bold');
-        this.writeln(`${icon} ${message}`);
+        // Write to stderr (not stdout) so it never interleaves with structured
+        // stdout output (e.g. --format json | jq .)
+        this.writeErrorln(`${icon} ${message}`);
     }
     printDebug(message) {
         // Debug only shows in verbose/debug mode
@@ -477,6 +484,14 @@ export class Spinner {
     start() {
         if (this.interval)
             return;
+        // `\r`-based in-place redraw only works on a real TTY. Without one
+        // (piped output, CI logs, non-interactive terminals) each animation
+        // frame prints as its own line instead of overwriting the last —
+        // so print the text once and skip the animation entirely.
+        if (!process.stdout.isTTY) {
+            process.stdout.write(`${this.text}\n`);
+            return;
+        }
         this.interval = setInterval(() => {
             this.render();
             this.frameIndex = (this.frameIndex + 1) % this.frames.length;
@@ -488,9 +503,9 @@ export class Spinner {
         if (this.interval) {
             clearInterval(this.interval);
             this.interval = null;
+            // Clear the line (only meaningful when the animation actually ran on a TTY)
+            process.stdout.write('\r' + ' '.repeat(this.text.length + 10) + '\r');
         }
-        // Clear the line
-        process.stdout.write('\r' + ' '.repeat(this.text.length + 10) + '\r');
         if (message) {
             this.formatter.writeln(message);
         }

package/packages/@monomind/cli/dist/src/parser.d.ts

@@ -35,7 +35,35 @@ export declare class CommandParser {
      */
     private static readonly RESERVED_FLAG_KEYS;
     private setFlagSafe;
+    /**
+     * Merge a single parsed flag (or set of `_` positionals) into the
+     * accumulated result flags, collecting repeats into an array instead of
+     * overwriting. Declared `type: 'array'` options always end up as an array
+     * (even a single occurrence); any other repeated flag also becomes an
+     * array on its second occurrence rather than silently dropping the first
+     * value.
+     */
+    private mergeParsedFlags;
     parse(args: string[]): ParseResult;
+    /**
+     * Convert a camelCase key to kebab-case (inverse of normalizeKey).
+     */
+    private camelToKebab;
+    /**
+     * Ensure every flag is reachable under both its camelCase and
+     * kebab-case spelling. Runs once, after all flags (including
+     * defaults) have been merged into the result.
+     */
+    private mirrorFlagKeys;
+    /**
+     * True when `value` looks like a space-separated negative number
+     * (`-0.5`, `-42`) rather than a new flag. Scoped narrowly to "leading `-`
+     * immediately followed by a digit" — a legitimate flag name never starts
+     * with a digit, so this can't misfire on a genuine following flag while
+     * still letting `--threshold -0.5` consume `-0.5` as the value instead of
+     * being misparsed as a new (bogus) flag.
+     */
+    private looksLikeNegativeNumber;
     private parseFlag;
     private parseValue;
     private normalizeKey;
@@ -50,6 +78,10 @@ export declare class CommandParser {
      * Get boolean flags scoped to a specific command/subcommand.
      */
     private getScopedBooleanFlags;
+    /**
+     * Get flags declared `type: 'array'`, scoped to a specific command/subcommand.
+     */
+    private getScopedArrayFlags;
     private getBooleanFlags;
     private applyDefaults;
     validateFlags(flags: ParsedFlags, command?: Command): string[];

package/packages/@monomind/cli/dist/src/parser.js

@@ -72,6 +72,12 @@ export class CommandParser {
                 description: 'Enable interactive mode',
                 type: 'boolean',
                 default: true
+            },
+            {
+                name: 'update',
+                description: 'Check for updates on startup (use --no-update to disable)',
+                type: 'boolean',
+                default: true
             }
         ];
     }
@@ -111,6 +117,48 @@ export class CommandParser {
             return;
         flags[key] = value;
     }
+    /**
+     * Merge a single parsed flag (or set of `_` positionals) into the
+     * accumulated result flags, collecting repeats into an array instead of
+     * overwriting. Declared `type: 'array'` options always end up as an array
+     * (even a single occurrence); any other repeated flag also becomes an
+     * array on its second occurrence rather than silently dropping the first
+     * value.
+     */
+    mergeParsedFlags(into, from, arrayFlags, booleanFlags) {
+        for (const key of Object.keys(from)) {
+            if (key === '_') {
+                into._.push(...from._);
+                continue;
+            }
+            if (CommandParser.RESERVED_FLAG_KEYS.has(key))
+                continue;
+            const incoming = from[key];
+            if (Array.isArray(into[key])) {
+                into[key].push(...[].concat(incoming).map(String));
+            }
+            else if (into[key] !== undefined && booleanFlags?.has(key)) {
+                // Declared boolean flag repeated (e.g. `--dry-run --dry-run`) — last
+                // value wins instead of promoting to an array. Callers throughout the
+                // codebase check booleans with `flags['x'] === true`; an array value
+                // would silently fail that check (e.g. guidance.ts's --dry-run,
+                // which guards a destructive write).
+                into[key] = incoming;
+            }
+            else if (into[key] !== undefined) {
+                // Repeated flag not previously an array — promote to array so the
+                // earlier value isn't lost.
+                into[key] = [String(into[key]), String(incoming)];
+            }
+            else if (arrayFlags.has(key)) {
+                // First occurrence of a declared array flag — still wrap in an array.
+                into[key] = [String(incoming)];
+            }
+            else {
+                into[key] = incoming;
+            }
+        }
+    }
     parse(args) {
         const result = {
             command: [],
@@ -135,6 +183,7 @@ export class CommandParser {
         // Subcommand-specific aliases take priority over global ones
         const aliases = this.buildScopedAliases(resolvedSub || resolvedCmd);
         const booleanFlags = this.getScopedBooleanFlags(resolvedSub || resolvedCmd);
+        const arrayFlags = this.getScopedArrayFlags(resolvedSub || resolvedCmd);
         let i = 0;
         let parsingFlags = true;
         while (i < args.length) {
@@ -148,8 +197,13 @@ export class CommandParser {
             // Handle flags
             if (parsingFlags && arg.startsWith('-')) {
                 const parseResult = this.parseFlag(args, i, aliases, booleanFlags);
-                // Apply to result flags
-                Object.assign(result.flags, parseResult.flags);
+                // Merge into result flags. A plain Object.assign here would silently
+                // drop earlier values whenever the same flag is passed more than once
+                // (`-p a=1 -p b=2` kept only `b=2`) — options declared `type: 'array'`
+                // (e.g. browse-action.ts's --params/-p, swarm.ts) are meant to
+                // collect every occurrence, and even a flag NOT declared array
+                // shouldn't silently lose data on repetition.
+                this.mergeParsedFlags(result.flags, parseResult.flags, arrayFlags, booleanFlags);
                 i = parseResult.nextIndex;
                 continue;
             }
@@ -201,8 +255,55 @@ export class CommandParser {
         // shadow same-name global options (e.g. `browse screenshot --format` is an
         // image format, not the global text|json|table output format).
         this.applyDefaults(result.flags, resolvedCmd);
+        // Dual-write flag keys: every flag ends up stored under BOTH its
+        // camelCase form (`keepConfig`) and its original kebab-case form
+        // (`keep-config`). Historically only the camelCase key was ever set,
+        // but dozens of command action functions across the codebase read
+        // `ctx.flags['kebab-case']` directly — which was always `undefined`,
+        // silently disabling those flags (see AUDIT-BACKLOG P0-10). Running
+        // this as a single pass over the fully-merged flags object (long
+        // flags, `--no-x` negation, short-flag aliases, and defaults are all
+        // merged into `result.flags` by this point) covers every entry point
+        // in one place instead of touching each call site individually.
+        this.mirrorFlagKeys(result.flags);
         return result;
     }
+    /**
+     * Convert a camelCase key to kebab-case (inverse of normalizeKey).
+     */
+    camelToKebab(key) {
+        return key.replace(/[A-Z]/g, (letter) => '-' + letter.toLowerCase());
+    }
+    /**
+     * Ensure every flag is reachable under both its camelCase and
+     * kebab-case spelling. Runs once, after all flags (including
+     * defaults) have been merged into the result.
+     */
+    mirrorFlagKeys(flags) {
+        for (const key of Object.keys(flags)) {
+            if (key === '_' || CommandParser.RESERVED_FLAG_KEYS.has(key))
+                continue;
+            const camelKey = this.normalizeKey(key);
+            if (camelKey !== key && flags[camelKey] === undefined && !CommandParser.RESERVED_FLAG_KEYS.has(camelKey)) {
+                flags[camelKey] = flags[key];
+            }
+            const kebabKey = this.camelToKebab(key);
+            if (kebabKey !== key && flags[kebabKey] === undefined && !CommandParser.RESERVED_FLAG_KEYS.has(kebabKey)) {
+                flags[kebabKey] = flags[key];
+            }
+        }
+    }
+    /**
+     * True when `value` looks like a space-separated negative number
+     * (`-0.5`, `-42`) rather than a new flag. Scoped narrowly to "leading `-`
+     * immediately followed by a digit" — a legitimate flag name never starts
+     * with a digit, so this can't misfire on a genuine following flag while
+     * still letting `--threshold -0.5` consume `-0.5` as the value instead of
+     * being misparsed as a new (bogus) flag.
+     */
+    looksLikeNegativeNumber(value) {
+        return /^-\d/.test(value);
+    }
     parseFlag(args, index, aliases, booleanFlags) {
         const flags = { _: [] };
         const arg = args[index];
@@ -239,7 +340,8 @@ export class CommandParser {
                 if (booleanFlags.has(normalizedKey)) {
                     this.setFlagSafe(flags, normalizedKey, true);
                 }
-                else if (nextIndex < args.length && !args[nextIndex].startsWith('-')) {
+                else if (nextIndex < args.length &&
+                    (!args[nextIndex].startsWith('-') || this.looksLikeNegativeNumber(args[nextIndex]))) {
                     this.setFlagSafe(flags, normalizedKey, this.parseValue(args[nextIndex]));
                     nextIndex++;
                 }
@@ -258,7 +360,8 @@ export class CommandParser {
                 if (booleanFlags.has(normalizedKey)) {
                     this.setFlagSafe(flags, normalizedKey, true);
                 }
-                else if (nextIndex < args.length && !args[nextIndex].startsWith('-')) {
+                else if (nextIndex < args.length &&
+                    (!args[nextIndex].startsWith('-') || this.looksLikeNegativeNumber(args[nextIndex]))) {
                     this.setFlagSafe(flags, normalizedKey, this.parseValue(args[nextIndex]));
                     nextIndex++;
                 }
@@ -368,6 +471,20 @@ export class CommandParser {
         }
         return flags;
     }
+    /**
+     * Get flags declared `type: 'array'`, scoped to a specific command/subcommand.
+     */
+    getScopedArrayFlags(resolvedCmd) {
+        const flags = new Set();
+        if (resolvedCmd?.options) {
+            for (const opt of resolvedCmd.options) {
+                if (opt.type === 'array') {
+                    flags.add(this.normalizeKey(opt.name));
+                }
+            }
+        }
+        return flags;
+    }
     getBooleanFlags() {
         const flags = new Set();
         for (const opt of this.globalOptions) {
@@ -471,7 +588,15 @@ export class CommandParser {
         }
         // Check for unknown flags if not allowed
         if (!this.options.allowUnknownFlags) {
-            const knownFlags = new Set(allOptions.map(opt => this.normalizeKey(opt.name)));
+            // Include both the camelCase and original (kebab-case) spelling of
+            // each option name — parse() now mirrors flags under both forms, so
+            // validation must recognize both or the mirrored key would be
+            // flagged as an unknown option.
+            const knownFlags = new Set();
+            for (const opt of allOptions) {
+                knownFlags.add(this.normalizeKey(opt.name));
+                knownFlags.add(opt.name);
+            }
             knownFlags.add('_'); // Positional args
             for (const key of Object.keys(flags)) {
                 if (!knownFlags.has(key) && key !== '_') {

package/packages/@monomind/cli/dist/src/routing/embed-worker.js

@@ -50,7 +50,19 @@ async function main() {
     const result = await layer.route(task);
     // Emit on its own line, prefixed, so the parent can unambiguously locate the
     // result even if the model loader wrote stray bytes to stdout earlier.
-    process.stdout.write(`\n__ROUTE_RESULT__${JSON.stringify(result)}\n`);
+    //
+    // Fix (P1-3): onnxruntime's native thread pool keeps the event loop alive
+    // even after this function returns, so the process never exits on its own
+    // and the parent's `close` listener waits until it force-kills us at the
+    // timeout — discarding the result we already wrote. Force-exit once the
+    // write is flushed (same onnx-teardown class as memory.ts's #1428 fix).
+    const wroteSynchronously = process.stdout.write(`\n__ROUTE_RESULT__${JSON.stringify(result)}\n`);
+    if (wroteSynchronously) {
+        process.exit(0);
+    }
+    else {
+        process.stdout.once('drain', () => process.exit(0));
+    }
 }
 main().catch((err) => {
     process.stderr.write(`embed-worker: ${err instanceof Error ? err.message : String(err)}\n`);

package/packages/@monomind/cli/dist/src/routing/route-layer-factory.js

@@ -56,6 +56,35 @@ function runWorker(task) {
             reject(new Error('embed worker timed out'));
         }, WORKER_TIMEOUT_MS);
         timer.unref?.();
+        // Resolve as soon as the result marker is *seen*, rather than waiting for
+        // the child's `close` event. This is a robustness net: onnxruntime's
+        // native thread pool can keep the child's event loop alive after it has
+        // already written its result, so `close` may never fire (or only fires
+        // after a slow OS-level teardown). embed-worker.ts explicitly
+        // process.exit()s right after writing the marker, but resolving here too
+        // means a future regression in that exit call degrades to "resolves
+        // immediately, child lingers" instead of "silently discards a correct
+        // result after a 90s timeout".
+        const tryResolveFromMarker = () => {
+            if (settled)
+                return;
+            const markedLine = stdout
+                .split('\n')
+                .reverse()
+                .find((l) => l.startsWith(RESULT_MARKER));
+            if (!markedLine)
+                return;
+            try {
+                const parsed = JSON.parse(markedLine.slice(RESULT_MARKER.length));
+                settled = true;
+                clearTimeout(timer);
+                resolve(parsed);
+            }
+            catch {
+                // Marker line present but not yet valid JSON (unlikely — it's written
+                // in one shot) — fall through and let `close`/timeout handle it.
+            }
+        };
         child.stdout?.on('data', (d) => {
             stdout += d.toString();
             if (stdout.length > MAX_WORKER_OUTPUT) {
@@ -68,7 +97,9 @@ function runWorker(task) {
                 }
                 catch { /* already dead */ }
                 reject(new Error('embed worker produced excessive output'));
+                return;
             }
+            tryResolveFromMarker();
         });
         child.stderr?.on('data', (d) => { if (stderr.length < MAX_WORKER_OUTPUT)
             stderr += d.toString(); });

package/packages/@monomind/cli/dist/src/services/config-file-manager.d.ts

@@ -2,11 +2,32 @@
  * Config File Manager
  * Shared JSON config file persistence with atomic writes and Zod validation
  */
+/**
+ * Default config values.
+ *
+ * IMPORTANT: never hand this object (or a shallow `{ ...DEFAULT_CONFIG }`
+ * copy) out directly — its nested sections (`agents`, `swarm`, `memory`, ...)
+ * would be shared-by-reference with every caller, so one caller mutating
+ * `config.swarm.maxAgents` would silently corrupt this module-level constant
+ * for the rest of the process. Always hand out `cloneDefaultConfig()`.
+ */
+declare const DEFAULT_CONFIG: Record<string, unknown>;
+/** Exposed read-only for callers (e.g. config-adapter.ts) that need to
+ * agree with this module's defaults instead of hardcoding their own. */
+export { DEFAULT_CONFIG };
 export declare class ConfigFileManager {
     private configPath;
     private config;
     /** Find config file in search paths starting from cwd */
     findConfig(cwd: string): string | null;
+    /**
+     * Load config from an EXACT file path (used by `--config <file>` / `-c`).
+     * Unlike load()/findConfig(), this never falls back to directory search —
+     * an explicitly-named config file that doesn't exist or fails to parse is
+     * an error, not a silent fallback to defaults or an unrelated file in the
+     * same directory.
+     */
+    loadExact(filePath: string): Record<string, unknown>;
     /** Load config from file, returns null if not found */
     load(cwd: string): Record<string, unknown> | null;
     /** Get the current config, loading if needed */

package/packages/@monomind/cli/dist/src/services/config-file-manager.js

@@ -10,7 +10,15 @@ const CONFIG_FILENAMES = [
     'monomind.config.json',
     '.monomind/config.json',
 ];
-/** Default config values */
+/**
+ * Default config values.
+ *
+ * IMPORTANT: never hand this object (or a shallow `{ ...DEFAULT_CONFIG }`
+ * copy) out directly — its nested sections (`agents`, `swarm`, `memory`, ...)
+ * would be shared-by-reference with every caller, so one caller mutating
+ * `config.swarm.maxAgents` would silently corrupt this module-level constant
+ * for the rest of the process. Always hand out `cloneDefaultConfig()`.
+ */
 const DEFAULT_CONFIG = {
     version: '3.5',
     agents: {
@@ -61,6 +69,20 @@ const DEFAULT_CONFIG = {
         },
     },
 };
+/**
+ * Deep-clone the default config so every caller gets its own independent
+ * object graph. `{ ...DEFAULT_CONFIG }` is only a shallow copy — its nested
+ * sub-configs (`agents`, `swarm`, `memory`, ...) would remain the SAME
+ * object references as the module-level constant, so mutating a nested
+ * field on one caller's copy would corrupt the shared default for every
+ * subsequent caller in the process.
+ */
+function cloneDefaultConfig() {
+    return structuredClone(DEFAULT_CONFIG);
+}
+/** Exposed read-only for callers (e.g. config-adapter.ts) that need to
+ * agree with this module's defaults instead of hardcoding their own. */
+export { DEFAULT_CONFIG };
 export class ConfigFileManager {
     configPath = null;
     config = null;
@@ -83,6 +105,36 @@ export class ConfigFileManager {
         }
         return null;
     }
+    /**
+     * Load config from an EXACT file path (used by `--config <file>` / `-c`).
+     * Unlike load()/findConfig(), this never falls back to directory search —
+     * an explicitly-named config file that doesn't exist or fails to parse is
+     * an error, not a silent fallback to defaults or an unrelated file in the
+     * same directory.
+     */
+    loadExact(filePath) {
+        const resolved = path.resolve(filePath);
+        if (!fs.existsSync(resolved)) {
+            throw new Error(`Config file not found: ${resolved}`);
+        }
+        let content;
+        try {
+            content = fs.readFileSync(resolved, 'utf-8');
+        }
+        catch (err) {
+            throw new Error(`Failed to read config file ${resolved}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(content);
+        }
+        catch (err) {
+            throw new Error(`Failed to parse config file ${resolved}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        this.configPath = resolved;
+        this.config = sanitizeConfigObject(parsed);
+        return this.config;
+    }
     /** Load config from file, returns null if not found */
     load(cwd) {
         this.configPath = this.findConfig(cwd);
@@ -106,7 +158,7 @@ export class ConfigFileManager {
         if (this.config === null) {
             this.load(cwd);
         }
-        return this.config ?? { ...DEFAULT_CONFIG };
+        return this.config ?? cloneDefaultConfig();
     }
     /** Get a nested config value by dot-separated key */
     get(cwd, key) {
@@ -136,7 +188,7 @@ export class ConfigFileManager {
         // cross-process atomic without an OS-level flock, but combined with the
         // O_EXCL atomic rename it prevents the most common credential-clobber
         // window where two CLIs interleave their getConfig→set→write cycles.
-        let onDisk = { ...DEFAULT_CONFIG };
+        let onDisk = cloneDefaultConfig();
         if (fs.existsSync(targetPath)) {
             try {
                 const parsed = JSON.parse(fs.readFileSync(targetPath, 'utf-8'));
@@ -155,7 +207,7 @@ export class ConfigFileManager {
         if (fs.existsSync(targetPath) && !force) {
             throw new Error(`Config file already exists: ${targetPath}. Use --force to overwrite.`);
         }
-        const config = { ...DEFAULT_CONFIG, ...(overrides ? sanitizeConfigObject(overrides) : {}) };
+        const config = { ...cloneDefaultConfig(), ...(overrides ? sanitizeConfigObject(overrides) : {}) };
         this.writeAtomic(targetPath, config);
         this.config = config;
         this.configPath = targetPath;
@@ -164,8 +216,9 @@ export class ConfigFileManager {
     /** Reset config to defaults */
     reset(cwd) {
         const targetPath = this.configPath ?? path.resolve(cwd, CONFIG_FILENAMES[0]);
-        this.writeAtomic(targetPath, DEFAULT_CONFIG);
-        this.config = { ...DEFAULT_CONFIG };
+        const fresh = cloneDefaultConfig();
+        this.writeAtomic(targetPath, fresh);
+        this.config = fresh;
         this.configPath = targetPath;
         return targetPath;
     }
@@ -228,7 +281,7 @@ export class ConfigFileManager {
     }
     /** Get default config */
     getDefaults() {
-        return { ...DEFAULT_CONFIG };
+        return cloneDefaultConfig();
     }
     /** Atomic write with restrictive 0o600 mode.
      * SECURITY: this config file may contain API keys (per `commands/providers.ts`).

package/packages/@monomind/cli/dist/src/services/crash-reporter.js

@@ -84,7 +84,8 @@ export function redact(text) {
         /(?:secret|password|passwd|pwd)\s*[:=]\s*['"]?[^\s'"]{8,}['"]?/gi,
         /(?:token|bearer)\s*[:=]\s*['"]?[^\s'"]{10,}['"]?/gi,
         /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,
-        /sk-[a-zA-Z0-9]{20,}/g,
+        /sk-ant-[a-zA-Z0-9_-]{20,}/g,
+        /sk-[a-zA-Z0-9_-]{20,}/g,
         /ghp_[a-zA-Z0-9]{36}/g,
         /gho_[a-zA-Z0-9]{36}/g,
         /npm_[a-zA-Z0-9]{36}/g,

package/packages/@monomind/cli/dist/src/types.d.ts

@@ -184,7 +184,7 @@ export interface MultiSelectPromptOptions<T = string> {
 export declare class CLIError extends Error {
     code: string;
     exitCode: number;
-    details?: unknown | undefined;
-    constructor(message: string, code: string, exitCode?: number, details?: unknown | undefined);
+    details?: unknown;
+    constructor(message: string, code: string, exitCode?: number, details?: unknown);
 }
 //# sourceMappingURL=types.d.ts.map