monomind 2.1.0 → 2.1.4

package/packages/@monomind/cli/dist/src/ui/server.mjs

@@ -9,6 +9,9 @@ import { collectAll, getWatchPaths, collectProject, collectSessions, collectSwar
 import { addSseClient, removeSseClient, broadcast, getSseClientCount, closeSseClients, addMmClient, removeMmClient, broadcastMm, getMmClientCount } from './sse-manager.mjs';
 
 const JSONL_SIZE_CAP = 10 * 1024 * 1024; // 10 MB — skip files larger than this in /api/graph
+// Session id format for data/sessions/<id>.jsonl persistence — no path traversal (".."), starts
+// with a word char, rest is word chars/dot/dash. Shared by every session-id-accepting endpoint.
+const SESSION_ID_RE = /^(?!.*\.\.)[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/;
 const buildDocsState = new Map();
 
 // Pricing per token (mirrors token-tracker.cjs FALLBACK_PRICING)
@@ -478,7 +481,9 @@ function _detectMimeType(filePath) {
     '.json': 'application/json', '.md': 'text/markdown', '.txt': 'text/plain',
     '.html': 'text/html', '.css': 'text/css', '.py': 'text/x-python',
     '.sh': 'text/x-shellscript', '.yaml': 'text/yaml', '.yml': 'text/yaml',
-    '.toml': 'text/plain', '.env': 'text/plain', '.xml': 'text/xml' };
+    '.toml': 'text/plain', '.env': 'text/plain', '.xml': 'text/xml',
+    '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif', '.svg': 'image/svg+xml', '.webp': 'image/webp' };
   return map[ext] || 'application/octet-stream';
 }
 
@@ -608,10 +613,26 @@ function bindServer(server, port) {
  * uses a greedy BFS over the real filesystem to find the correct path.
  * Falls back to cwd in session files, then to direct slug replacement.
  */
+const _slugPathCache = new Map();
+
 function resolveSlugToPath(slug, projDir) {
-  // 1. Try filesystem BFS (most reliable)
+  if (_slugPathCache.has(slug)) return _slugPathCache.get(slug);
+  const resolved = _resolveSlugToPathUncached(slug, projDir);
+  _slugPathCache.set(slug, resolved);
+  return resolved;
+}
+
+function _resolveSlugToPathUncached(slug, projDir) {
+  // 1. Try filesystem BFS (most reliable). Branching is O(2^hyphens) in the
+  // worst case (a slug with N hyphens can require exploring both "new path
+  // segment" and "hyphen is part of this segment's name" at each of the N
+  // positions) — bound total exploration so a slug with many hyphens (e.g.
+  // a UUID-embedded temp/scratchpad dir) can't hang the event loop.
   const parts = slug.replace(/^-/, '').split('-');
+  const MAX_CALLS = 20000;
+  let calls = 0;
   function tryPaths(idx, current) {
+    if (++calls > MAX_CALLS) return null;
     if (idx === parts.length) return fs.existsSync(current) ? current : null;
     // Option A: next part is a new path component
     const asDir = path.join(current, parts[idx]);
@@ -690,7 +711,7 @@ export async function startServer({ port = 4242, projectDir, openBrowser = true
   // Extracted from the request dispatcher to reduce cyclomatic complexity.
   // Handles POST /api/mastermind/event: parses body, enriches with runId/session,
   // persists to JSONL files, broadcasts to SSE clients, returns {ok:true}.
-  async function handleMastermindEvent(req, res) {
+  async function handleMastermindEvent(req, res, corsOrigin) {
     let body = '';
     for await (const chunk of req) { body += chunk; if (body.length > 2097152) { req.destroy(); break; } }
     let event = {};
@@ -887,7 +908,7 @@ export async function startServer({ port = 4242, projectDir, openBrowser = true
     // Format: data/sessions/<sessionId>.jsonl  +  data/sessions/_index.json
     try {
       const _sid = String(event.session || '').trim();
-      if (_sid.length > 0 && _sid.length <= 128 && /^(?!.*\.\.)[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/.test(_sid)) {
+      if (_sid.length > 0 && _sid.length <= 128 && SESSION_ID_RE.test(_sid)) {
         const sessDir = path.join(dataDir, 'sessions');
         fs.mkdirSync(sessDir, { recursive: true });
         // Append event to per-session JSONL (O(1), no read)
@@ -1011,7 +1032,13 @@ export async function startServer({ port = 4242, projectDir, openBrowser = true
     if (req.method === 'GET' && url === '/') {
       const htmlPath = path.join(__dirname, 'dashboard.html');
       try {
-        const html = fs.readFileSync(htmlPath, 'utf8');
+        let html = fs.readFileSync(htmlPath, 'utf8');
+        // Inject this process's auth credential so the page's own fetch() calls can
+        // attach it (see the fetch-wrapper near the top of dashboard.html's <script>
+        // block) — every non-GET route above requires it, but the served HTML was
+        // previously never given a way to know it, so every write action 401'd from
+        // the actual browser UI.
+        html = html.replace('<head>', `<head>\n<meta name="mm-token" content="${dashboardAuthValue}">`);
         res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
         res.end(html);
       } catch (err) {
@@ -4721,6 +4748,122 @@ new Sigma(g,document.getElementById('g'),{renderEdgeLabels:false,labelColor:{col
       return;
     }
 
+    // GET /api/questions?dir=<projectDir> — list unanswered ask_human questions for
+    // every org in one project. Mirrors the existing -approvals.json sidecar convention,
+    // but reads this feature's .monomind/orgs/<org>/questions.json files (one per org dir).
+    if (req.method === 'GET' && url === '/api/questions') {
+      try {
+        const _qDir = new URL(req.url, 'http://localhost').searchParams.get('dir') || projectDir || process.cwd();
+        const base = path.join(path.resolve(_qDir), '.monomind', 'orgs');
+        const out = [];
+        if (fs.existsSync(base)) {
+          for (const orgName of fs.readdirSync(base)) {
+            const qFile = path.join(base, orgName, 'questions.json');
+            if (!fs.existsSync(qFile)) continue;
+            let data = { questions: [] };
+            try { data = JSON.parse(fs.readFileSync(qFile, 'utf8')); } catch (_) {}
+            for (const q of (data.questions || [])) {
+              if (q.answer === null || q.answer === undefined) out.push({ org: orgName, ...q });
+            }
+          }
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json', ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}) });
+        res.end(JSON.stringify({ questions: out }));
+      } catch (_e) { res.writeHead(500); res.end('{"questions":[]}'); }
+      return;
+    }
+
+    // POST /api/questions/answer — forward a human's answer to the org's live process
+    // (looked up via the same file-based broker registry orgrt's cross-process delivery
+    // already uses), or fail with a clear error if no process anywhere hosts it.
+    if (req.method === 'POST' && url === '/api/questions/answer') {
+      let body = '';
+      for await (const chunk of req) { body += chunk; if (body.length > 2097152) { req.destroy(); break; } }
+      try {
+        const parsed = JSON.parse(body);
+        const { dir, org, role, questionId, answer } = parsed;
+        if (!org || !role || !questionId || answer === undefined) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false, error: 'org, role, questionId, answer are required' }));
+          return;
+        }
+        if (String(org).length > 64 || !/^[a-z0-9][a-z0-9_-]*$/i.test(String(org))) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false, error: 'Invalid org name' }));
+          return;
+        }
+        const brokerDir = path.join(os.homedir(), '.monomind', 'orgrt-broker');
+        const entryPath = path.join(brokerDir, `${org}.json`);
+        let hostUrl = null;
+        try {
+          const entry = JSON.parse(fs.readFileSync(entryPath, 'utf8'));
+          if (Date.now() - entry.updatedAt < 90000) hostUrl = entry.url;
+        } catch (_) {}
+        if (!hostUrl) {
+          // No live process to forward to — the control server has no daemon instance of
+          // its own to call autoWake() on. If the org's definition still exists on disk,
+          // queue the answer the same way inbox.ts's queueMessage()/drainInbox() already
+          // do for offline cross-org messages, so it's delivered whenever the org next
+          // starts (manually or via its own schedule) — matching the offline-delivery goal
+          // for the dashboard path, not just the direct-daemon path Task 4 already covers.
+          const projDir = path.resolve(dir || projectDir || process.cwd());
+          const orgDefFile = path.join(projDir, '.monomind', 'orgs', `${org}.json`);
+          if (!fs.existsSync(orgDefFile)) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: false, error: `org "${org}" not found — no running process and no saved definition` }));
+            return;
+          }
+          const qFile = path.join(projDir, '.monomind', 'orgs', org, 'questions.json');
+          let qData = { questions: [] };
+          try { qData = JSON.parse(fs.readFileSync(qFile, 'utf8')); } catch (_) {}
+          const qIdx = (qData.questions || []).findIndex(q => q.questionId === questionId);
+          if (qIdx === -1) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: false, error: `question "${questionId}" not found for org "${org}"` }));
+            return;
+          }
+          if (qData.questions[qIdx].answer !== null && qData.questions[qIdx].answer !== undefined) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: true, alreadyAnswered: true }));
+            return;
+          }
+          const answeredQuestion = qData.questions[qIdx];
+          qData.questions[qIdx] = { ...answeredQuestion, answer, answeredAt: Date.now() };
+          const qTmp = `${qFile}.tmp`;
+          fs.writeFileSync(qTmp, JSON.stringify(qData, null, 2));
+          fs.renameSync(qTmp, qFile);
+          const inboxDir = path.join(projDir, '.monomind', 'orgs', org);
+          fs.mkdirSync(inboxDir, { recursive: true });
+          fs.appendFileSync(path.join(inboxDir, 'inbox.jsonl'), JSON.stringify({
+            fromQualified: 'human', toRole: role, subject: `answer:${questionId}`, body: `question: ${answeredQuestion.question}\n\nanswer: ${answer}`, ts: Date.now(),
+          }) + '\n');
+          const queuedEvent = { type: 'org:question-answered', org, role, questionId, ts: Date.now(), queued: true };
+          appendToFile(path.join(projDir, 'data', 'mastermind-events.jsonl'), JSON.stringify(queuedEvent) + '\n').catch(() => {});
+          broadcastMm(queuedEvent);
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: true, queued: true }));
+          return;
+        }
+        const fwd = await fetch(`${hostUrl}/api/answer-question`, {
+          method: 'POST', headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ org, role, questionId, answer }),
+          signal: AbortSignal.timeout(5000),
+        });
+        const fwdData = await fwd.json().catch(() => ({}));
+        if (fwd.ok && fwdData.ok) {
+          const event = { type: 'org:question-answered', org, role, questionId, ts: Date.now() };
+          appendToFile(path.join(path.resolve(dir || projectDir || process.cwd()), 'data', 'mastermind-events.jsonl'), JSON.stringify(event) + '\n').catch(() => {});
+          broadcastMm(event);
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: true }));
+        } else {
+          res.writeHead(fwd.status || 500, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false, error: fwdData.error || 'answer delivery failed' }));
+        }
+      } catch (_e) { res.writeHead(500); res.end('{"ok":false}'); }
+      return;
+    }
+
     // POST /api/org/:name/approvals/:id — approve or reject a pending approval request
     // Body: { action: "approve" | "reject" | "revision_requested" }
     if (req.method === 'POST' && url.match(/^\/api\/org\/[a-z0-9][a-z0-9_-]{0,63}\/approvals\/[^/]+$/i)) {
@@ -5113,6 +5256,12 @@ new Sigma(g,document.getElementById('g'),{renderEdgeLabels:false,labelColor:{col
         const stat = fs.statSync(resolved);
         if (!stat.isFile()) { res.writeHead(400); res.end('Not a file'); return; }
         if (stat.size > 524288) { res.writeHead(413); res.end('File too large'); return; }
+        const _fcMime = _detectMimeType(resolved);
+        if (_fcMime.startsWith('image/')) {
+          res.writeHead(200, { 'Content-Type': _fcMime, ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}) });
+          res.end(fs.readFileSync(resolved));
+          return;
+        }
         const content = fs.readFileSync(resolved, 'utf8');
         res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8', ...(corsOrigin ? { 'Access-Control-Allow-Origin': corsOrigin } : {}) });
         res.end(content);
@@ -5397,7 +5546,7 @@ new Sigma(g,document.getElementById('g'),{renderEdgeLabels:false,labelColor:{col
     // ------------------------------------------------- Mastermind event system
     // POST /api/mastermind/event — ingest event from mastermind skill
     if (req.method === 'POST' && url === '/api/mastermind/event') {
-      return handleMastermindEvent(req, res);
+      return handleMastermindEvent(req, res, corsOrigin);
     }
 
     // GET /api/mastermind-stream — SSE for real-time events
@@ -5449,7 +5598,7 @@ new Sigma(g,document.getElementById('g'),{renderEdgeLabels:false,labelColor:{col
               const top = idx.slice(0, limitParam);
               for (const entry of top) {
                 const _sid = String(entry.id || '').trim();
-                if (!_sid || !/^(?!.*\.\.)[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/.test(_sid)) continue;
+                if (!_sid || !SESSION_ID_RE.test(_sid)) continue;
                 let events = [];
                 try {
                   const jl = fs.readFileSync(path.join(sessDir, `${_sid}.jsonl`), 'utf8');
@@ -5557,6 +5706,23 @@ new Sigma(g,document.getElementById('g'),{renderEdgeLabels:false,labelColor:{col
       return;
     }
 
+    // ------------------------------------------------ GET /orgs-files.js
+    // Files-tab + diff-view script, split out of orgs.html (see orgs.html's
+    // script-src comment). Not a generic static handler — this UI serves each
+    // sibling asset via its own hardcoded route, same as GET /orgs above.
+    if (req.method === 'GET' && url === '/orgs-files.js') {
+      try {
+        const jsPath = path.join(__dirname, 'orgs-files.js');
+        const js = fs.readFileSync(jsPath, 'utf8');
+        res.writeHead(200, { 'Content-Type': 'application/javascript; charset=utf-8' });
+        res.end(js);
+      } catch (err) {
+        res.writeHead(404);
+        res.end(`orgs-files.js not found: ${err.message}`);
+      }
+      return;
+    }
+
     // GET /api/mastermind/loops — list all active loop state files
     if (req.method === 'GET' && url === '/api/mastermind/loops') {
       try {
@@ -5668,162 +5834,6 @@ new Sigma(g,document.getElementById('g'),{renderEdgeLabels:false,labelColor:{col
       return;
     }
 
-    // ----------------------------------------------- GET /api/monoagent/platforms
-    // Returns all supported platforms from `monoes connect list --all --json`
-    if (req.method === 'GET' && url === '/api/monoagent/platforms') {
-      try {
-        const { execFile } = await import('child_process');
-        const out = await new Promise((resolve, reject) => {
-          execFile('monoes', ['connect', 'list', '--all', '--json'], { timeout: 8000 }, (err, stdout) => {
-            if (err) reject(err); else resolve(stdout);
-          });
-        });
-        // Parse + re-serialize to ensure only valid JSON reaches the client
-        // (monoes may emit warning lines before the JSON array)
-        let parsed; try { parsed = JSON.parse(out); } catch (_) { parsed = []; }
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify(Array.isArray(parsed) ? parsed : []));
-      } catch (e) { res.writeHead(200); res.end('[]'); }
-      return;
-    }
-
-    // ----------------------------------------------- GET /api/monoagent/connections
-    // Returns active API/OAuth connections + browser sessions merged
-    if (req.method === 'GET' && url === '/api/monoagent/connections') {
-      try {
-        const { execFile } = await import('child_process');
-        const [connsOut, sessOut] = await Promise.all([
-          new Promise((resolve) => {
-            execFile('monoes', ['connect', 'list', '--json'], { timeout: 8000 }, (err, stdout) => resolve(err ? '[]' : stdout));
-          }),
-          new Promise((resolve) => {
-            execFile('monoes', ['--json', 'login', 'status'], { timeout: 8000 }, (err, stdout) => resolve(err ? '[]' : stdout));
-          }),
-        ]);
-        let connections = []; try { connections = JSON.parse(connsOut); } catch (_) {}
-        let sessions = []; try { sessions = JSON.parse(sessOut); } catch (_) {}
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ connections, sessions }));
-      } catch (e) { res.writeHead(200); res.end(JSON.stringify({ connections: [], sessions: [] })); }
-      return;
-    }
-
-    // ----------------------------------------------- POST /api/monoagent/login
-    // Launches browser login for social platforms via `monoes login <platform>`
-    if (req.method === 'POST' && url === '/api/monoagent/login') {
-      try {
-        let body = '';
-        await new Promise((resolve, reject) => { req.on('data', d => { body += d; if (body.length > 65536) { req.destroy(); reject(new Error('body too large')); } }); req.on('end', resolve); req.on('error', reject); });
-        const { id } = JSON.parse(body);
-        if (!id || !/^[a-z][a-z0-9_-]*$/.test(id)) { res.writeHead(400); res.end(JSON.stringify({ error: 'invalid id' })); return; }
-        const { spawn } = await import('child_process');
-        const child = spawn('monoes', ['login', id, '--timeout', '10m'], { detached: true, stdio: 'ignore' });
-        // Defer response until spawn confirms or errors — prevents race where error fires after res.end()
-        child.once('spawn', () => {
-          child.unref();
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ ok: true }));
-        });
-        child.once('error', (err) => {
-          res.writeHead(500, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ error: err.message }));
-        });
-      } catch (e) { res.writeHead(500); res.end(JSON.stringify({ error: e.message })); }
-      return;
-    }
-
-    // ----------------------------------------------- POST /api/monoagent/connect
-    if (req.method === 'POST' && url === '/api/monoagent/connect') {
-      try {
-        let body = '';
-        await new Promise((resolve, reject) => { req.on('data', d => { body += d; if (body.length > 65536) { req.destroy(); reject(new Error('body too large')); } }); req.on('end', resolve); req.on('error', reject); });
-        const { id, method, fields } = JSON.parse(body);
-        if (!id || !/^[a-z][a-z0-9_-]*$/.test(id)) { res.writeHead(400); res.end(JSON.stringify({ error: 'invalid id' })); return; }
-        if (method && !/^[a-z][a-z0-9_-]*$/.test(method)) { res.writeHead(400); res.end(JSON.stringify({ error: 'invalid method' })); return; }
-        const { execFile } = await import('child_process');
-        const args = ['connect', id];
-        if (method) args.push('--method', method);
-        if (fields && typeof fields === 'object') {
-          for (const [k, v] of Object.entries(fields)) {
-            // Only allow simple word keys — prevents --flag injection
-            if (!/^[a-z][a-z0-9_]*$/.test(k)) continue;
-            args.push(`--${k}`, String(v).slice(0, 2048));
-          }
-        }
-        await new Promise((resolve, reject) => {
-          execFile('monoes', args, { timeout: 30000 }, (err, stdout, stderr) => {
-            const ok = !err;
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ ok, stdout: (stdout || '').trim(), stderr: (stderr || '').trim() }));
-            resolve();
-          });
-        });
-      } catch (e) { res.writeHead(500); res.end(JSON.stringify({ error: e.message })); }
-      return;
-    }
-
-    // ----------------------------------------------- POST /api/monoagent/test
-    if (req.method === 'POST' && url === '/api/monoagent/test') {
-      try {
-        let body = '';
-        await new Promise((resolve, reject) => { req.on('data', d => { body += d; if (body.length > 65536) { req.destroy(); reject(new Error('body too large')); } }); req.on('end', resolve); req.on('error', reject); });
-        const { id } = JSON.parse(body);
-        if (!id || !/^[a-z0-9][a-z0-9_:-]*$/.test(id)) { res.writeHead(400); res.end(JSON.stringify({ error: 'id required' })); return; }
-        const { execFile } = await import('child_process');
-        await new Promise((resolve, reject) => {
-          execFile('monoes', ['connect', 'test', id], { timeout: 15000 }, (err, stdout, stderr) => {
-            if (err) reject(new Error(stderr || err.message)); else resolve(stdout);
-          });
-        });
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ ok: true }));
-      } catch (e) { res.writeHead(200); res.end(JSON.stringify({ ok: false, error: e.message })); }
-      return;
-    }
-
-    // ----------------------------------------------- POST /api/monoagent/disconnect
-    if (req.method === 'POST' && url === '/api/monoagent/disconnect') {
-      try {
-        let body = '';
-        await new Promise((resolve, reject) => { req.on('data', d => { body += d; if (body.length > 65536) { req.destroy(); reject(new Error('body too large')); } }); req.on('end', resolve); req.on('error', reject); });
-        const { id, type } = JSON.parse(body);
-        if (!id || !/^[a-z0-9][a-z0-9_:-]*$/.test(id)) { res.writeHead(400); res.end(JSON.stringify({ error: 'id required' })); return; }
-        if (type !== 'session' && type !== 'connection') { res.writeHead(400); res.end(JSON.stringify({ error: 'invalid type' })); return; }
-        const { execFile } = await import('child_process');
-        const cmd = type === 'session' ? ['logout', id] : ['connect', 'remove', id];
-        await new Promise((resolve, reject) => {
-          execFile('monoes', cmd, { timeout: 10000 }, (err, _stdout, stderr) => {
-            if (err) reject(new Error(stderr || err.message)); else resolve();
-          });
-        });
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ ok: true }));
-      } catch (e) { res.writeHead(200); res.end(JSON.stringify({ ok: false, error: e.message })); }
-      return;
-    }
-
-    // ----------------------------------------------- GET /api/monoagent/data
-    if (req.method === 'GET' && url === '/api/monoagent/data') {
-      try {
-        const { execFile } = await import('child_process');
-        const run = (args) => new Promise(resolve => {
-          execFile('monoagent', args, { timeout: 8000 }, (err, stdout) => resolve(err ? '[]' : stdout));
-        });
-        const [wfOut, actOut] = await Promise.all([
-          run(['workflow', 'list', '--json']),
-          run(['action', 'list', '--json']),
-        ]);
-        const workflows = JSON.parse(wfOut.trim() || '[]');
-        const actions = JSON.parse(actOut.trim() || '[]');
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ workflows, actions }));
-      } catch (e) {
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ workflows: [], actions: [], error: e.message }));
-      }
-      return;
-    }
-
     // ------------------------------------------------- GET /api/playbooks
     // List playbook definitions from <dir>/.monomind/playbooks/*.json.
     // (Previously only POST was registered, so GET /api/playbooks?dir=... fell
@@ -6193,7 +6203,7 @@ new Sigma(g,document.getElementById('g'),{renderEdgeLabels:false,labelColor:{col
         const _migIndex = [];
         for (const sess of (_migOld || [])) {
           const _msid = String(sess.id || '').trim();
-          if (!_msid || !/^(?!.*\.\.)[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/.test(_msid)) continue;
+          if (!_msid || !SESSION_ID_RE.test(_msid)) continue;
           // Write per-session JSONL
           const _mEvts = (sess.events || []);
           const _mLines = _mEvts.map(e => JSON.stringify(e)).join('\n');

package/packages/@monomind/cli/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@monoes/monomindcli",
-  "version": "2.1.0",
+  "version": "2.1.4",
   "type": "module",
-  "description": "Monomind CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
+  "description": "CLI engine for Monomind — an open-source MCP server that extends Claude Code with a codebase knowledge graph (tree-sitter + SQLite), persistent memory, multi-agent task coordination, and session hooks. MIT licensed, fully local.",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
   "sideEffects": false,
@@ -27,21 +27,17 @@
     "claude",
     "claude-code",
     "anthropic",
-    "ai-agents",
-    "multi-agent",
-    "swarm",
     "mcp",
     "model-context-protocol",
-    "llm",
+    "knowledge-graph",
+    "tree-sitter",
+    "code-analysis",
+    "ai-agents",
+    "multi-agent",
     "cli",
-    "orchestration",
-    "automation",
     "developer-tools",
-    "coding-assistant",
-    "vector-database",
-    "embeddings",
-    "self-learning",
-    "enterprise"
+    "open-source",
+    "local-first"
   ],
   "author": {
     "name": "nokhodian",
@@ -83,8 +79,8 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc && mkdir -p dist/src/browser/dashboard && cp src/browser/dashboard/ui.html dist/src/browser/dashboard/ui.html && mkdir -p dist/src/orgrt && cp src/orgrt/live.html dist/src/orgrt/",
-    "build:loose": "tsc --noEmitOnError false || true && mkdir -p dist/src/browser/dashboard && cp src/browser/dashboard/ui.html dist/src/browser/dashboard/ui.html && mkdir -p dist/src/orgrt && cp src/orgrt/live.html dist/src/orgrt/",
+    "build": "tsc && mkdir -p dist/src/browser/dashboard && cp src/browser/dashboard/ui.html dist/src/browser/dashboard/ui.html && mkdir -p dist/src/ui && cp src/ui/dashboard.html src/ui/server.mjs src/ui/collector.mjs src/ui/orgs.html src/ui/orgs-files.js src/ui/sse-manager.mjs dist/src/ui/ && rm -rf dist/src/ui/data && cp -r src/ui/data dist/src/ui/data",
+    "build:loose": "tsc --noEmitOnError false || true && mkdir -p dist/src/browser/dashboard && cp src/browser/dashboard/ui.html dist/src/browser/dashboard/ui.html && mkdir -p dist/src/ui && cp src/ui/dashboard.html src/ui/server.mjs src/ui/collector.mjs src/ui/orgs.html src/ui/orgs-files.js src/ui/sse-manager.mjs dist/src/ui/ && rm -rf dist/src/ui/data && cp -r src/ui/data dist/src/ui/data",
     "test": "vitest run",
     "test:pattern-store": "npx tsx src/transfer/store/tests/standalone-test.ts",
     "prepublishOnly": "cp ../../../README.md ./README.md",
@@ -92,7 +88,7 @@
     "publish:all": "./scripts/publish.sh"
   },
   "devDependencies": {
-    "typescript": "^5.3.0",
+    "typescript": "^7.0.2",
     "vitest": "^4.1.4"
   },
   "dependencies": {

package/packages/@monomind/cli/scripts/publish.sh

@@ -9,6 +9,12 @@ CLI_DIR="$(dirname "$SCRIPT_DIR")"
 
 cd "$CLI_DIR"
 
+# dist/src/ui/* (dashboard, server, etc.) is hand-authored source under src/ui/
+# copied into dist/ by the build step — it is no longer committed to git, so a
+# stale or missing dist/ here would silently ship a broken/absent dashboard.
+echo "=== Building ==="
+npm run build
+
 # Get current version
 VERSION=$(node -p "require('./package.json').version")
 echo "Publishing version: $VERSION"

package/scripts/generate-agent-avatars.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * Generates 120 unique SVG agent avatar files + a sprite-sheet HTML.
- * Output: packages/@monomind/cli/dist/src/ui/data/avatars/
+ * Output: packages/@monomind/cli/src/ui/data/avatars/
  * Run: node scripts/generate-agent-avatars.mjs
  */
 
@@ -10,7 +10,7 @@ import path from 'path';
 import { fileURLToPath } from 'url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const OUT_DIR = path.resolve(__dirname, '../packages/@monomind/cli/dist/src/ui/data/avatars');
+const OUT_DIR = path.resolve(__dirname, '../packages/@monomind/cli/src/ui/data/avatars');
 fs.mkdirSync(OUT_DIR, { recursive: true });
 
 // ─── Palettes ────────────────────────────────────────────────────────────────
@@ -489,4 +489,4 @@ const spritePath = path.join(OUT_DIR, '../agent-avatars.html');
 fs.writeFileSync(spritePath, spriteHtml, 'utf8');
 console.log(`✅ Sprite-sheet viewer: data/agent-avatars.html`);
 console.log(`\n🎉 Done! ${AGENTS120.length} avatars ready.`);
-console.log(`   Open: packages/@monomind/cli/dist/src/ui/data/agent-avatars.html`);
+console.log(`   Open: packages/@monomind/cli/src/ui/data/agent-avatars.html`);

package/packages/@monomind/cli/dist/src/orgrt/live.html

@@ -1,56 +0,0 @@
-<!-- packages/@monomind/cli/src/orgrt/live.html -->
-<!doctype html>
-<html><head><meta charset="utf-8"><title>org live</title>
-<style>
-  :root { color-scheme: dark; }
-  body { margin:0; font:13px/1.5 ui-monospace,monospace; background:#0d1117; color:#e6edf3;
-         display:grid; grid-template-columns:220px 1fr 1fr; grid-template-rows:auto 1fr 1fr; gap:1px; height:100vh; }
-  header { grid-column:1/4; padding:8px 14px; background:#161b22; font-weight:700; }
-  section { background:#161b22; overflow:auto; padding:10px; }
-  h2 { font-size:11px; text-transform:uppercase; letter-spacing:.1em; color:#7d8590; margin:0 0 8px; }
-  #agents { grid-row:2/4; }
-  .agent { padding:6px 8px; border-left:3px solid #2f81f7; margin-bottom:6px; background:#0d1117; }
-  .agent small { color:#7d8590; display:block; }
-  .row { padding:4px 6px; border-bottom:1px solid #21262d; word-break:break-word; }
-  .from { color:#2f81f7; font-weight:700; } .to { color:#a371f7; }
-  .deny { color:#f85149; } .allow { color:#3fb950; } .xorg { color:#d29922; font-weight:700; }
-  .ts { color:#484f58; font-size:11px; margin-right:6px; }
-</style></head>
-<body>
-<header>org live — <span id="conn">connecting…</span></header>
-<section id="agents"><h2>Agents</h2><div id="agents-list"></div></section>
-<section id="chat"><h2>Chats &amp; Messages</h2><div id="chat-list"></div></section>
-<section id="tools"><h2>Tool Activity &amp; Assets</h2><div id="tools-list"></div></section>
-<script>
-const $ = id => document.getElementById(id);
-const fmt = ts => new Date(ts).toLocaleTimeString();
-const add = (listId, html, cap = 500) => {
-  const el = document.createElement('div'); el.className = 'row'; el.innerHTML = html;
-  const list = $(listId); list.prepend(el);
-  while (list.children.length > cap) list.lastChild.remove();
-};
-const esc = s => String(s ?? '').replace(/[&<>]/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;'}[c]));
-const decisionClass = d => (d === 'allow' || d === 'deny') ? d : 'unknown';
-function render(e) {
-  const t = `<span class="ts">${fmt(e.ts)}</span>`;
-  if (e.type === 'chat') add('chat-list', `${t}<span class="from">${esc(e.org)}/${esc(e.from)}</span>: ${esc(e.msg)}`);
-  else if (e.type === 'message') add('chat-list', `${t}<span class="from">${esc(e.from)}</span> → <span class="to">${esc(e.to)}</span> [${esc(e.subject||'')}] ${esc(e.msg)}`);
-  else if (e.type === 'xorg') add('chat-list', `${t}<span class="xorg">⇄ ${esc(e.from)} → ${esc(e.to)}</span> [${esc(e.subject||'')}] ${esc(e.msg)}`);
-  else if (e.type === 'tool') add('tools-list', `${t}<span class="from">${esc(e.from)}</span> ${esc(e.tool)} <span class="${decisionClass(e.decision)}">${esc(e.decision)}</span>${e.reason ? ' — ' + esc(e.reason) : ''}`);
-  else if (e.type === 'asset') add('tools-list', `${t}<span class="from">${esc(e.from)}</span> 📄 <b>${esc(e.path)}</b>`);
-  else if (e.type === 'status' || e.type === 'usage') add('tools-list', `${t}<i>${esc(e.org)}/${esc(e.from ?? 'org')}: ${esc(e.msg ?? JSON.stringify(e.data))}</i>`);
-}
-async function refreshAgents() {
-  const orgs = await fetch('/api/orgs').then(r => r.json()).catch(() => []);
-  $('agents-list').innerHTML = orgs.map(o =>
-    `<div class="agent"><b>${esc(o.name)}</b><small>${esc(o.run)}</small>` +
-    o.agents.map(a => `<div>${a.closed ? '⚫' : '🟢'} ${esc(a.id)} <small>${esc(a.usage)} tok</small></div>`).join('') +
-    `</div>`).join('') || '<i>no running orgs</i>';
-}
-const ws = new WebSocket(`ws://${location.host}/ws`);
-ws.onopen = () => { $('conn').textContent = 'live'; refreshAgents(); };
-ws.onclose = () => { $('conn').textContent = 'disconnected'; };
-ws.onmessage = ev => { render(JSON.parse(ev.data)); };
-setInterval(refreshAgents, 5000);
-</script>
-</body></html>