monomind 2.1.0 → 2.1.3

package/packages/@monomind/cli/dist/src/ui/server.mjs

@@ -9,6 +9,9 @@ import { collectAll, getWatchPaths, collectProject, collectSessions, collectSwar
 import { addSseClient, removeSseClient, broadcast, getSseClientCount, closeSseClients, addMmClient, removeMmClient, broadcastMm, getMmClientCount } from './sse-manager.mjs';
 
 const JSONL_SIZE_CAP = 10 * 1024 * 1024; // 10 MB — skip files larger than this in /api/graph
+// Session id format for data/sessions/<id>.jsonl persistence — no path traversal (".."), starts
+// with a word char, rest is word chars/dot/dash. Shared by every session-id-accepting endpoint.
+const SESSION_ID_RE = /^(?!.*\.\.)[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/;
 const buildDocsState = new Map();
 
 // Pricing per token (mirrors token-tracker.cjs FALLBACK_PRICING)
@@ -608,10 +611,26 @@ function bindServer(server, port) {
  * uses a greedy BFS over the real filesystem to find the correct path.
  * Falls back to cwd in session files, then to direct slug replacement.
  */
+const _slugPathCache = new Map();
+
 function resolveSlugToPath(slug, projDir) {
-  // 1. Try filesystem BFS (most reliable)
+  if (_slugPathCache.has(slug)) return _slugPathCache.get(slug);
+  const resolved = _resolveSlugToPathUncached(slug, projDir);
+  _slugPathCache.set(slug, resolved);
+  return resolved;
+}
+
+function _resolveSlugToPathUncached(slug, projDir) {
+  // 1. Try filesystem BFS (most reliable). Branching is O(2^hyphens) in the
+  // worst case (a slug with N hyphens can require exploring both "new path
+  // segment" and "hyphen is part of this segment's name" at each of the N
+  // positions) — bound total exploration so a slug with many hyphens (e.g.
+  // a UUID-embedded temp/scratchpad dir) can't hang the event loop.
   const parts = slug.replace(/^-/, '').split('-');
+  const MAX_CALLS = 20000;
+  let calls = 0;
   function tryPaths(idx, current) {
+    if (++calls > MAX_CALLS) return null;
     if (idx === parts.length) return fs.existsSync(current) ? current : null;
     // Option A: next part is a new path component
     const asDir = path.join(current, parts[idx]);
@@ -690,7 +709,7 @@ export async function startServer({ port = 4242, projectDir, openBrowser = true
   // Extracted from the request dispatcher to reduce cyclomatic complexity.
   // Handles POST /api/mastermind/event: parses body, enriches with runId/session,
   // persists to JSONL files, broadcasts to SSE clients, returns {ok:true}.
-  async function handleMastermindEvent(req, res) {
+  async function handleMastermindEvent(req, res, corsOrigin) {
     let body = '';
     for await (const chunk of req) { body += chunk; if (body.length > 2097152) { req.destroy(); break; } }
     let event = {};
@@ -887,7 +906,7 @@ export async function startServer({ port = 4242, projectDir, openBrowser = true
     // Format: data/sessions/<sessionId>.jsonl  +  data/sessions/_index.json
     try {
       const _sid = String(event.session || '').trim();
-      if (_sid.length > 0 && _sid.length <= 128 && /^(?!.*\.\.)[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/.test(_sid)) {
+      if (_sid.length > 0 && _sid.length <= 128 && SESSION_ID_RE.test(_sid)) {
         const sessDir = path.join(dataDir, 'sessions');
         fs.mkdirSync(sessDir, { recursive: true });
         // Append event to per-session JSONL (O(1), no read)
@@ -5397,7 +5416,7 @@ new Sigma(g,document.getElementById('g'),{renderEdgeLabels:false,labelColor:{col
     // ------------------------------------------------- Mastermind event system
     // POST /api/mastermind/event — ingest event from mastermind skill
     if (req.method === 'POST' && url === '/api/mastermind/event') {
-      return handleMastermindEvent(req, res);
+      return handleMastermindEvent(req, res, corsOrigin);
     }
 
     // GET /api/mastermind-stream — SSE for real-time events
@@ -5449,7 +5468,7 @@ new Sigma(g,document.getElementById('g'),{renderEdgeLabels:false,labelColor:{col
               const top = idx.slice(0, limitParam);
               for (const entry of top) {
                 const _sid = String(entry.id || '').trim();
-                if (!_sid || !/^(?!.*\.\.)[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/.test(_sid)) continue;
+                if (!_sid || !SESSION_ID_RE.test(_sid)) continue;
                 let events = [];
                 try {
                   const jl = fs.readFileSync(path.join(sessDir, `${_sid}.jsonl`), 'utf8');
@@ -5557,6 +5576,23 @@ new Sigma(g,document.getElementById('g'),{renderEdgeLabels:false,labelColor:{col
       return;
     }
 
+    // ------------------------------------------------ GET /orgs-files.js
+    // Files-tab + diff-view script, split out of orgs.html (see orgs.html's
+    // script-src comment). Not a generic static handler — this UI serves each
+    // sibling asset via its own hardcoded route, same as GET /orgs above.
+    if (req.method === 'GET' && url === '/orgs-files.js') {
+      try {
+        const jsPath = path.join(__dirname, 'orgs-files.js');
+        const js = fs.readFileSync(jsPath, 'utf8');
+        res.writeHead(200, { 'Content-Type': 'application/javascript; charset=utf-8' });
+        res.end(js);
+      } catch (err) {
+        res.writeHead(404);
+        res.end(`orgs-files.js not found: ${err.message}`);
+      }
+      return;
+    }
+
     // GET /api/mastermind/loops — list all active loop state files
     if (req.method === 'GET' && url === '/api/mastermind/loops') {
       try {
@@ -6193,7 +6229,7 @@ new Sigma(g,document.getElementById('g'),{renderEdgeLabels:false,labelColor:{col
         const _migIndex = [];
         for (const sess of (_migOld || [])) {
           const _msid = String(sess.id || '').trim();
-          if (!_msid || !/^(?!.*\.\.)[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/.test(_msid)) continue;
+          if (!_msid || !SESSION_ID_RE.test(_msid)) continue;
           // Write per-session JSONL
           const _mEvts = (sess.events || []);
           const _mLines = _mEvts.map(e => JSON.stringify(e)).join('\n');

package/packages/@monomind/cli/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@monoes/monomindcli",
-  "version": "2.1.0",
+  "version": "2.1.3",
   "type": "module",
-  "description": "Monomind CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
+  "description": "CLI engine for Monomind — an open-source MCP server that extends Claude Code with a codebase knowledge graph (tree-sitter + SQLite), persistent memory, multi-agent task coordination, and session hooks. MIT licensed, fully local.",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
   "sideEffects": false,
@@ -27,21 +27,17 @@
     "claude",
     "claude-code",
     "anthropic",
-    "ai-agents",
-    "multi-agent",
-    "swarm",
     "mcp",
     "model-context-protocol",
-    "llm",
+    "knowledge-graph",
+    "tree-sitter",
+    "code-analysis",
+    "ai-agents",
+    "multi-agent",
     "cli",
-    "orchestration",
-    "automation",
     "developer-tools",
-    "coding-assistant",
-    "vector-database",
-    "embeddings",
-    "self-learning",
-    "enterprise"
+    "open-source",
+    "local-first"
   ],
   "author": {
     "name": "nokhodian",
@@ -83,8 +79,8 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc && mkdir -p dist/src/browser/dashboard && cp src/browser/dashboard/ui.html dist/src/browser/dashboard/ui.html && mkdir -p dist/src/orgrt && cp src/orgrt/live.html dist/src/orgrt/",
-    "build:loose": "tsc --noEmitOnError false || true && mkdir -p dist/src/browser/dashboard && cp src/browser/dashboard/ui.html dist/src/browser/dashboard/ui.html && mkdir -p dist/src/orgrt && cp src/orgrt/live.html dist/src/orgrt/",
+    "build": "tsc && mkdir -p dist/src/browser/dashboard && cp src/browser/dashboard/ui.html dist/src/browser/dashboard/ui.html",
+    "build:loose": "tsc --noEmitOnError false || true && mkdir -p dist/src/browser/dashboard && cp src/browser/dashboard/ui.html dist/src/browser/dashboard/ui.html",
     "test": "vitest run",
     "test:pattern-store": "npx tsx src/transfer/store/tests/standalone-test.ts",
     "prepublishOnly": "cp ../../../README.md ./README.md",
@@ -92,7 +88,7 @@
     "publish:all": "./scripts/publish.sh"
   },
   "devDependencies": {
-    "typescript": "^5.3.0",
+    "typescript": "^7.0.2",
     "vitest": "^4.1.4"
   },
   "dependencies": {

package/packages/@monomind/cli/dist/src/orgrt/live.html

@@ -1,56 +0,0 @@
-<!-- packages/@monomind/cli/src/orgrt/live.html -->
-<!doctype html>
-<html><head><meta charset="utf-8"><title>org live</title>
-<style>
-  :root { color-scheme: dark; }
-  body { margin:0; font:13px/1.5 ui-monospace,monospace; background:#0d1117; color:#e6edf3;
-         display:grid; grid-template-columns:220px 1fr 1fr; grid-template-rows:auto 1fr 1fr; gap:1px; height:100vh; }
-  header { grid-column:1/4; padding:8px 14px; background:#161b22; font-weight:700; }
-  section { background:#161b22; overflow:auto; padding:10px; }
-  h2 { font-size:11px; text-transform:uppercase; letter-spacing:.1em; color:#7d8590; margin:0 0 8px; }
-  #agents { grid-row:2/4; }
-  .agent { padding:6px 8px; border-left:3px solid #2f81f7; margin-bottom:6px; background:#0d1117; }
-  .agent small { color:#7d8590; display:block; }
-  .row { padding:4px 6px; border-bottom:1px solid #21262d; word-break:break-word; }
-  .from { color:#2f81f7; font-weight:700; } .to { color:#a371f7; }
-  .deny { color:#f85149; } .allow { color:#3fb950; } .xorg { color:#d29922; font-weight:700; }
-  .ts { color:#484f58; font-size:11px; margin-right:6px; }
-</style></head>
-<body>
-<header>org live — <span id="conn">connecting…</span></header>
-<section id="agents"><h2>Agents</h2><div id="agents-list"></div></section>
-<section id="chat"><h2>Chats &amp; Messages</h2><div id="chat-list"></div></section>
-<section id="tools"><h2>Tool Activity &amp; Assets</h2><div id="tools-list"></div></section>
-<script>
-const $ = id => document.getElementById(id);
-const fmt = ts => new Date(ts).toLocaleTimeString();
-const add = (listId, html, cap = 500) => {
-  const el = document.createElement('div'); el.className = 'row'; el.innerHTML = html;
-  const list = $(listId); list.prepend(el);
-  while (list.children.length > cap) list.lastChild.remove();
-};
-const esc = s => String(s ?? '').replace(/[&<>]/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;'}[c]));
-const decisionClass = d => (d === 'allow' || d === 'deny') ? d : 'unknown';
-function render(e) {
-  const t = `<span class="ts">${fmt(e.ts)}</span>`;
-  if (e.type === 'chat') add('chat-list', `${t}<span class="from">${esc(e.org)}/${esc(e.from)}</span>: ${esc(e.msg)}`);
-  else if (e.type === 'message') add('chat-list', `${t}<span class="from">${esc(e.from)}</span> → <span class="to">${esc(e.to)}</span> [${esc(e.subject||'')}] ${esc(e.msg)}`);
-  else if (e.type === 'xorg') add('chat-list', `${t}<span class="xorg">⇄ ${esc(e.from)} → ${esc(e.to)}</span> [${esc(e.subject||'')}] ${esc(e.msg)}`);
-  else if (e.type === 'tool') add('tools-list', `${t}<span class="from">${esc(e.from)}</span> ${esc(e.tool)} <span class="${decisionClass(e.decision)}">${esc(e.decision)}</span>${e.reason ? ' — ' + esc(e.reason) : ''}`);
-  else if (e.type === 'asset') add('tools-list', `${t}<span class="from">${esc(e.from)}</span> 📄 <b>${esc(e.path)}</b>`);
-  else if (e.type === 'status' || e.type === 'usage') add('tools-list', `${t}<i>${esc(e.org)}/${esc(e.from ?? 'org')}: ${esc(e.msg ?? JSON.stringify(e.data))}</i>`);
-}
-async function refreshAgents() {
-  const orgs = await fetch('/api/orgs').then(r => r.json()).catch(() => []);
-  $('agents-list').innerHTML = orgs.map(o =>
-    `<div class="agent"><b>${esc(o.name)}</b><small>${esc(o.run)}</small>` +
-    o.agents.map(a => `<div>${a.closed ? '⚫' : '🟢'} ${esc(a.id)} <small>${esc(a.usage)} tok</small></div>`).join('') +
-    `</div>`).join('') || '<i>no running orgs</i>';
-}
-const ws = new WebSocket(`ws://${location.host}/ws`);
-ws.onopen = () => { $('conn').textContent = 'live'; refreshAgents(); };
-ws.onclose = () => { $('conn').textContent = 'disconnected'; };
-ws.onmessage = ev => { render(JSON.parse(ev.data)); };
-setInterval(refreshAgents, 5000);
-</script>
-</body></html>