monomind 2.1.3 → 2.1.5

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="assets/banner.png" alt="Monomind" width="600" />
+  <img src="https://raw.githubusercontent.com/monoes/monomind/main/assets/banner.png" alt="Monomind" width="600" />
 </p>
 
 <h1 align="center">Monomind</h1>
@@ -38,9 +38,9 @@ Monomind is an **open-source CLI and MCP server** that plugs into Claude Code vi
 - **Reusable slash commands** — 30+ development workflows (build, review, debug, TDD, architecture) available as `/mastermind:*` commands inside Claude Code.
 
 ```bash
-npm install -g monomind        # MIT licensed, 0 external API calls
+npm install -g monomind        # MIT licensed, runs entirely on your machine
 cd your-project && monomind init
-claude mcp add monomind npx monomind mcp start
+claude mcp add monomind -- npx -y monomind@latest mcp start
 ```
 
 ### Trust & Security
@@ -48,8 +48,8 @@ claude mcp add monomind npx monomind mcp start
 | Concern | Answer |
 |---|---|
 | **License** | [MIT](LICENSE) — use it however you want |
-| **Data privacy** | Everything runs locally. No telemetry, no phone-home, no external API calls from Monomind itself. Your code stays on your machine. |
-| **Dependencies** | Standard npm packages (tree-sitter, sql.js, zod). No native binaries. No post-install scripts that download code. |
+| **Data privacy** | Everything runs locally — your code and memory store never leave your machine. The one exception: crash reporting is on by default (`monomind crash-reporting disable` to opt out) — a hard crash in monomind/mono-agent/monotask/mono-clip files a GitHub issue on that tool's own repo via the GitHub API. That's the only network call Monomind itself makes; it never phones a monoes-controlled server. |
+| **Dependencies** | Standard npm packages (tree-sitter, better-sqlite3, sql.js, zod). tree-sitter and better-sqlite3 are native (prebuilt) Node addons, not pure JS/WASM — sql.js is WASM. No post-install scripts that download code. |
 | **Permissions** | Registers as an MCP server — Claude Code controls what tools are available and prompts you before executing anything sensitive. |
 | **Source** | Fully open. Read every line at [github.com/monoes/monomind](https://github.com/monoes/monomind). |
 | **Maintenance** | Active development, regular releases on npm. |
@@ -62,7 +62,7 @@ claude mcp add monomind npx monomind mcp start
 
 ### The idea
 
-Every business function needs a team. Define the org once as a JSON file — goal, roles, who reports to whom, per-role tool/file/budget policy — then run it as a real background daemon backed by the Claude Agent SDK. It persists across sessions, serves a live WebSocket dashboard, and can discover and message other Monomind orgs running on the same machine.
+Every business function needs a team. Define the org once as a JSON file — goal, roles, who reports to whom, per-role tool/file/budget policy — then run it as a real background daemon backed by the Claude Agent SDK. It persists across sessions, streams live into the dashboard Claude Code auto-starts for the project, and can discover and message other Monomind orgs running on the same machine.
 
 ```mermaid
 flowchart TD
@@ -73,14 +73,14 @@ flowchart TD
     W["Writer"]
     S["SEO Specialist"]
     R["Reviewer"]
-    DASH[("Live Dashboard\n:4243")]
+    DASH[("Dashboard\n:4242\nauto-started by\nClaude Code hook")]
     XORG[("Other orgs\ncross-process")]
 
     U --> DEF --> RUN --> BOSS
     BOSS -->|spawns| W
     BOSS -->|spawns| S
     BOSS -->|spawns| R
-    RUN <-->|serves| DASH
+    RUN -->|forwards events| DASH
     RUN <-.->|--cross-process| XORG
 
     style BOSS fill:#00D2AA22,stroke:#00D2AA
@@ -93,13 +93,14 @@ flowchart TD
 ```bash
 # .monomind/orgs/<name>.json defines the org: goal, roles, policy.
 # See .monomind/orgs/sample-team.json in a fresh `monomind init` for a working example.
+# Open the project in Claude Code first — a SessionStart hook auto-launches
+# the dashboard at http://localhost:4242 if it isn't already running.
 
 monomind org run content-team --task "Build and publish 3 blog posts per week"
 
-# ✓ Live dashboard: http://localhost:4243
 # ✓ Boss agent (Claude Agent SDK session) spawns, reads the org goal,
 #   assigns work to role agents, coordinates until the task completes
-#   or you stop it.
+#   or you stop it. Every event streams into the dashboard above.
 
 monomind org status content-team    # runtime state
 monomind org stop content-team      # request a graceful stop
@@ -112,18 +113,18 @@ monomind org list                   # every org + status
 |---|---|
 | **OrgDaemon** | Hosts one or more orgs in a single process; real Claude Agent SDK sessions per role, not simulated |
 | **PolicyEngine** | Per-role gates on tool access, file read/write scope, web access, token budget — enforced, with a full audit trail |
-| **Live dashboard** | WebSocket-served at `:4243` by default (`--port` to change, `--serve=false` to disable) |
+| **Dashboard** | `org run` forwards every event to the control server on `:4242` (found via `.monomind/control.json`) — that server is auto-launched by a Claude Code SessionStart hook, not by any CLI command; there's no separate per-org dashboard process |
 | **Cross-process comms** | `--cross-process` (default on) lets orgs on different `monomind` processes/projects discover and message each other |
 | **Scheduling** | `monomind org serve` hosts orgs whose definition has a `schedule` field, running them on interval |
 
 ### Org management commands
 
 ```bash
-monomind org run <name> [--task "..."] [--port N] [--cross-process]  # start a daemon
+monomind org run <name> [--task "..."] [--cross-process]  # start a daemon
 monomind org stop <name>            # request a running org to stop
 monomind org status [name]          # runtime state for one or all orgs
 monomind org list                   # list every org + status
-monomind org serve [--port N]       # host-only mode, runs scheduled orgs
+monomind org serve [--cross-process]  # host-only mode, runs scheduled orgs
 monomind org delete <name>          # remove an org
 ```
 
@@ -179,13 +180,13 @@ cd your-project
 monomind init
 
 # 3. Wire into Claude Code as an MCP server
-claude mcp add monomind npx monomind mcp start
+claude mcp add monomind -- npx -y monomind@latest mcp start
 
 # 4. Health check
 monomind doctor --fix
 ```
 
-Open Claude Code. You now have 60+ slash commands available:
+Open Claude Code. You now have 49 `/mastermind:*` workflows available:
 
 ```bash
 /mastermind:autodev --tillend     # start autonomous code loop
@@ -275,7 +276,7 @@ const result = await fence.detect(userInput);
 
 ---
 
-## 📋 60+ Slash Commands
+## 📋 49 Mastermind Commands
 
 Everything runs from inside Claude Code via slash commands. Here's the highlight reel:
 
@@ -308,7 +309,7 @@ Everything runs from inside Claude Code via slash commands. Here's the highlight
 | `/mastermind:finance` | Budgets, invoicing, modeling |
 | `/mastermind:ops` | Operations and workflow automation |
 
-**[→ Full reference (60+ commands)](https://monoes.github.io/monomind/#slash)**
+**[→ Full reference (49 commands)](https://monoes.github.io/monomind/#slash)**
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "monomind",
-  "version": "2.1.3",
+  "version": "2.1.5",
   "description": "Open-source CLI extension for Claude Code. Adds an MCP server with a codebase knowledge graph, persistent memory, multi-agent coordination, and reusable slash commands. MIT licensed, runs locally, no data leaves your machine.",
   "main": "dist/index.js",
   "type": "module",

package/packages/@monomind/cli/.claude/commands/mastermind/createorg.md

@@ -1,4 +1,4 @@
-<!-- Define and save an autonomous agent organization — roles, hierarchy, and communication topology. Suggest or confirm roles, then persist the org for use with runorg. -->
+<!-- Define and save an autonomous agent organization (Org Runtime v2) — roles and hierarchy. Suggest or confirm roles, then persist the org config for `monomind org run`/`serve`. -->
 
 **If $ARGUMENTS is empty:** Output the following and wait.
 
@@ -6,7 +6,7 @@
 
 **MASTERMIND: CREATE ORG**
 
-An org is a named, persistent agent team — not a one-shot Mastermind run. Once created, the org runs autonomously across sessions: a boss agent coordinates specialists who pick up tasks from a shared board, execute them, and loop until stopped.
+An org is a named, persistent agent team, run by the Org Runtime v2 daemon — not a one-shot Mastermind run and not a Task-tool-spawned boss. Once created, every role in the config starts as its own live agent session the moment you run the org; roles message each other directly (no shared task board) and the org keeps running until stopped.
 
 Use orgs when the work is ongoing, not single-shot. A content team that ships 10 posts a month. A research squad that runs competitive scans weekly. A dev team with a permanent backlog.
 
@@ -25,16 +25,15 @@ Use orgs when the work is ongoing, not single-shot. A content team that ships 10
 ```
 
 **Options:**
-`--name <slug>` — org identifier used with `/mastermind:runorg` (derived from goal if omitted)
+`--name <slug>` — org identifier used with `monomind org run <name>` (derived from goal if omitted)
 `--roles <list>` — explicit role list (e.g. "boss, writer, reviewer, marketer")
-`--schedule <interval>` — make this a self-scheduling loop org (e.g. `"every 30 minutes"`, `"every hour"`, `"daily"`)
+`--schedule <interval>` — daemon schedule for `monomind org serve` to pick up, e.g. `"30m"`, `"2h"`, `"1440m"` for daily (omit for a manual, one-shot org)
 `--auto` — skip confirmation, create immediately
 `--confirm` — always ask before saving (default)
-`--delete <name>` — delete a saved org and all associated data files
-`--list` — list all saved orgs with their status
+`--delete <name>` — delete a saved org and all associated data files (`monomind org delete <name> --yes`)
+`--list` — list all saved orgs with their status (`monomind org list`)
 
-Once created, start the org with `/mastermind:runorg --org <name>`.
-For scheduled orgs: `runorg` activates the loop; `stoporg` stops it; `orgs` lists all.
+Once created, start the org with `monomind org run <name>` (foreground, one-shot) or let `monomind org serve` pick it up if `--schedule` was set. Check status with `monomind org status <name>`; stop with `monomind org stop <name>`.
 
 ---
 
@@ -47,7 +46,7 @@ Parse `$ARGUMENTS` for:
 - `--confirm` flag → mode = confirm
 - `--name <name>` → org_name = <name> (must match `^[a-z0-9][a-z0-9-]{0,63}$`; if omitted, derived from goal)
 - `--roles <desc>` → roles_desc = <desc> (explicit role list, e.g. "boss, writer, reviewer, marketer")
-- `--schedule <interval>` → schedule = <interval> (e.g. `"every 30 minutes"`, `"every hour"`, `"daily"`; triggers loop org generation)
+- `--schedule <interval>` → schedule = <interval>, daemon format only: `"<N>s"`, `"<N>m"`, or `"<N>h"` (e.g. `"30m"`, `"2h"`) — this is passed straight into `parseSchedule()` in `orgrt/scheduler.ts`, whose regex `^(\d+)\s*(s|m|h)$` rejects anything else (e.g. `"every 30 minutes"`, `"daily"`) and silently leaves the org unscheduled
 - `--delete <name>` → delete_mode = true, delete_name = <name>
 - `--list` flag → list_mode = true
 - Remaining text = prompt (goal description)

package/packages/@monomind/cli/.claude/helpers/handlers/capture-handler.cjs

@@ -41,10 +41,14 @@ function subagentKey(hookInput) {
   return crypto.createHash('md5').update(String(raw)).digest('hex').slice(0, 16);
 }
 
-// Determine subagent success from its result summary — errors/failures/
-// exceptions indicate failure. Shared by the Monograph `success` column and
-// the intelligence.feedback() call below, so both use one definition.
-function deriveSubagentSuccess(summary) {
+// Determine subagent success. `lastToolError` (was the transcript's final
+// tool_result an is_error block — a real signal parsed straight off the
+// transcript, not text sniffing) is authoritative when present; the summary
+// keyword check is a fallback for failures narrated without a tool error
+// (e.g. "I couldn't find X" with no failing tool call). Shared by the
+// Monograph `success` column and the intelligence.feedback() call below.
+function deriveSubagentSuccess(summary, lastToolError) {
+  if (lastToolError) return false;
   if (!summary) return true;
   var sumLower = summary.toLowerCase();
   if (sumLower.includes('error') || sumLower.includes('failed') || sumLower.includes('exception') || sumLower.includes('fatal')) {
@@ -100,6 +104,7 @@ function parseJSONLForData(filePath) {
   let tin = 0, tout = 0;
   let allMsgs = [];
   let toolCalls = [];
+  let lastToolError = false; // tracks the most recent tool_result seen, in file order
   try {
     const lines = fs.readFileSync(filePath, 'utf8').split('\n').filter(Boolean);
     for (const line of lines) {
@@ -119,6 +124,12 @@ function parseJSONLForData(filePath) {
           } else if (typeof content === 'string' && content) {
             allMsgs.push(content);
           }
+        } else if (d?.message?.role === 'user') {
+          const content = d?.message?.content;
+          if (Array.isArray(content)) {
+            const results = content.filter(b => b.type === 'tool_result');
+            if (results.length > 0) lastToolError = results.some(b => b.is_error === true);
+          }
         }
       } catch { /* skip malformed lines */ }
     }
@@ -129,7 +140,7 @@ function parseJSONLForData(filePath) {
   const summary = allMsgs.length > 1
     ? (firstMsg.slice(0, 300) + (allMsgs.length > 2 ? `\n…[${allMsgs.length - 2} more msgs]…\n` : '\n') + lastMsg.slice(0, 700))
     : lastMsg.slice(0, 1000);
-  return { tokens_in: tin, tokens_out: tout, summary, last_msg: lastMsg, toolCalls: [...new Set(toolCalls)] };
+  return { tokens_in: tin, tokens_out: tout, summary, last_msg: lastMsg, toolCalls: [...new Set(toolCalls)], lastToolError };
 }
 
 function getActiveRun() {
@@ -335,6 +346,7 @@ async function handleSubagentStop(hookInput) {
   let totalTin = 0, totalTout = 0;
   let summary = '';
   let toolCalls = [];
+  let lastToolError = false;
   const capturedFiles = [];
 
   for (const f of currentFiles) {
@@ -344,6 +356,7 @@ async function handleSubagentStop(hookInput) {
       totalTout += parsed.tokens_out;
       if (parsed.summary) summary = parsed.summary;
       toolCalls.push(...parsed.toolCalls);
+      lastToolError = parsed.lastToolError; // last new file wins, mirroring `summary`'s last-wins semantics
       capturedFiles.push(f.name);
     }
   }
@@ -365,7 +378,7 @@ async function handleSubagentStop(hookInput) {
   // (TeammateIdle/TaskCompleted) is dead code (those aren't valid Claude
   // Code hook events and are stripped from settings.json on init).
   try {
-    require('../intelligence.cjs').feedback(deriveSubagentSuccess(summary));
+    require('../intelligence.cjs').feedback(deriveSubagentSuccess(summary, lastToolError));
   } catch (e) { /* non-fatal — feedback recording must never block subagent-stop */ }
 
   if (!org && !session) {
@@ -509,7 +522,7 @@ async function handleSubagentStop(hookInput) {
             tokens_in: totalTin || 0,
             tokens_out: totalTout || 0,
             cost_usd: costUsd || 0,
-            success: deriveSubagentSuccess(summary) ? 1 : 0,
+            success: deriveSubagentSuccess(summary, lastToolError) ? 1 : 0,
             duration_ms: snap.ts ? (Date.now() - snap.ts) : 0,
             timestamp: Date.now(),
           });
@@ -643,12 +656,16 @@ async function handlePostTool(hookInput) {
 
 // ─── Dispatch ─────────────────────────────────────────────────────────────────
 
-const eventType = process.argv[2]; // 'subagent-start' | 'subagent-stop' | 'pretool' | 'posttool'
+if (require.main === module) {
+  const eventType = process.argv[2]; // 'subagent-start' | 'subagent-stop' | 'pretool' | 'posttool'
+
+  readStdin().then(hookInput => {
+    if (eventType === 'subagent-start') return handleSubagentStart(hookInput);
+    if (eventType === 'subagent-stop')  return handleSubagentStop(hookInput);
+    if (eventType === 'pretool')        return handlePreTool(hookInput);
+    if (eventType === 'posttool')       return handlePostTool(hookInput);
+    console.log('[CAPTURE] unknown event type: ' + eventType);
+  }).catch(() => process.exit(0));
+}
 
-readStdin().then(hookInput => {
-  if (eventType === 'subagent-start') return handleSubagentStart(hookInput);
-  if (eventType === 'subagent-stop')  return handleSubagentStop(hookInput);
-  if (eventType === 'pretool')        return handlePreTool(hookInput);
-  if (eventType === 'posttool')       return handlePostTool(hookInput);
-  console.log('[CAPTURE] unknown event type: ' + eventType);
-}).catch(() => process.exit(0));
+module.exports = { deriveSubagentSuccess, parseJSONLForData };

package/packages/@monomind/cli/.claude/helpers/handlers/gates-handler.cjs

@@ -1,9 +1,13 @@
 /**
  * Enforcement Gates Handler
  *
- * Inline gate logic for PreToolUse hooks — no ESM/package dependency.
- * This regex table is the canonical (and only) gate definition; the former
- * @monomind/guidance package it mirrored has been removed.
+ * Runs on every PreToolUse — must stay fast (no package import).
+ *
+ * The regex tables below are the canonical (and only) gate definition; the
+ * @monomind/guidance package that used to compile them was removed. An optional
+ * project override can still be supplied at `.monomind/guidance/active-gates.json`
+ * ({destructivePatterns, secretPatterns} as {source, flags} pairs) — if present
+ * and valid it replaces the built-in tables.
  *
  * Gates enforced at runtime:
  *   pre-bash  → destructive-ops  (hard block; no confirm-and-proceed path exists)
@@ -12,29 +16,150 @@
 
 'use strict';
 
-// ─── Patterns (superset of DEFAULT_GATE_CONFIG in gates.ts) ──────────────────
+const fs = require('fs');
+const path = require('path');
+
+// ─── monofence-ai integration (additional layer on top of regex gates) ───────
+//
+// monofence-ai (packages/monofence-ai) has real prompt-injection / evasion
+// detection but is never wired into the live Claude Code PreToolUse path —
+// it only registers hooks on @monomind/hooks' internal HookRegistry, which
+// this CJS dispatch path does not use. This loads it lazily (so a missing
+// or unbuilt package never breaks the existing regex gates), bounds it with
+// a hard timeout, and fails open on any error.
+
+const MONOFENCE_TIMEOUT_MS = 1500;
+const MONOFENCE_ABORT_THRESHOLD = 0.8;
+
+let _monofenceModulePromise = null;
+
+/**
+ * Resolve and import monofence-ai. Bare-specifier `import('monofence-ai')`
+ * only works when this file's ancestor node_modules chain contains the
+ * package (pnpm hoists it only into packages that declare it as a direct
+ * dependency, e.g. @monomind/cli) — so we also try resolving it explicitly
+ * from likely workspace locations before falling back to the bare import.
+ */
+/**
+ * Walk up from `startDir` looking for `<dir>/node_modules/monofence-ai/package.json`.
+ * Package "exports" maps intentionally omit "./package.json" as a subpath, so
+ * `require.resolve('monofence-ai/package.json', ...)` throws even when the
+ * package is present — a plain filesystem walk sidesteps that restriction.
+ */
+function _findMonofencePkgJson(startDir) {
+  var dir = startDir;
+  for (var depth = 0; depth < 20; depth++) {
+    var candidate = path.join(dir, 'node_modules', 'monofence-ai', 'package.json');
+    if (fs.existsSync(candidate)) return candidate;
+    var parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+
+function _loadMonofence() {
+  if (!_monofenceModulePromise) {
+    _monofenceModulePromise = (async () => {
+      var candidateDirs = [
+        __dirname,
+        process.env.CLAUDE_PROJECT_DIR || process.cwd(),
+        path.join(process.env.CLAUDE_PROJECT_DIR || process.cwd(), 'packages', '@monomind', 'cli'),
+        path.join(__dirname, '..', '..', '..', 'packages', '@monomind', 'cli'),
+      ];
+      var resolvedPkgJson = null;
+      for (var i = 0; i < candidateDirs.length; i++) {
+        resolvedPkgJson = _findMonofencePkgJson(candidateDirs[i]);
+        if (resolvedPkgJson) break;
+      }
+      var specifier = 'monofence-ai';
+      if (resolvedPkgJson) {
+        try {
+          var pkg = JSON.parse(fs.readFileSync(resolvedPkgJson, 'utf-8'));
+          var mainFile = (pkg.exports && pkg.exports['.'] && pkg.exports['.'].import) || pkg.main || 'dist/index.js';
+          specifier = 'file://' + path.join(path.dirname(resolvedPkgJson), mainFile);
+        } catch (e) { /* fall back to bare specifier below */ }
+      }
+      try {
+        return await import(specifier);
+      } catch (e) {
+        return null; // not installed / not built — fail open
+      }
+    })().catch(() => null);
+  }
+  return _monofenceModulePromise;
+}
+
+function _withTimeout(promise, ms) {
+  return new Promise((resolve) => {
+    var settled = false;
+    var timer = setTimeout(() => {
+      if (!settled) { settled = true; resolve(null); }
+    }, ms);
+    if (timer.unref) timer.unref();
+    Promise.resolve(promise).then(
+      (v) => { if (!settled) { settled = true; clearTimeout(timer); resolve(v); } },
+      () => { if (!settled) { settled = true; clearTimeout(timer); resolve(null); } }
+    );
+  });
+}
+
+/**
+ * Scan `input` with monofence-ai's threat detector, bounded by a timeout.
+ * Returns null (never throws) when monofence is unavailable, times out, or errors.
+ */
+async function monofenceScan(input) {
+  if (!input || typeof input !== 'string') return null;
+  var mod = await _withTimeout(_loadMonofence(), MONOFENCE_TIMEOUT_MS);
+  if (!mod || typeof mod.getMonoDefence !== 'function') return null;
+  try {
+    var defence = mod.getMonoDefence();
+    var result = await _withTimeout(defence.detect(input), MONOFENCE_TIMEOUT_MS);
+    return result || null;
+  } catch (e) {
+    return null;
+  }
+}
+
+/**
+ * Given a monofence ThreatDetectionResult, return the highest-confidence
+ * threat if it meets the abort threshold, else null.
+ */
+function monofenceWorstThreat(result) {
+  if (!result || result.safe || !Array.isArray(result.threats) || result.threats.length === 0) {
+    return null;
+  }
+  var worst = result.threats.reduce(
+    (max, t) => (t.confidence > max.confidence ? t : max),
+    result.threats[0]
+  );
+  return worst.confidence >= MONOFENCE_ABORT_THRESHOLD ? worst : null;
+}
 
-const DESTRUCTIVE_PATTERNS = [
+// ─── Fallback patterns (used only if the compiled config file is missing/unreadable) ──
+const FALLBACK_DESTRUCTIVE_PATTERNS = [
   /\brm\s+(?:-[a-z]*f[a-z]*r|-[a-z]*r[a-z]*f|--recursive.*--force|--force.*--recursive|-rf?)\b/i,
-  /\bdrop\s+(database|table|schema|index|view|function|procedure)\b/i,
+  /\bdrop\s+(database|table|schema|index)\b/i,
   /\btruncate\s+table\b/i,
-  /\bgit\s+push\s+(?:.*\s)?(?:--force(?:-with-lease)?|-[a-z]*f)\b/i,
+  /\bgit\s+push\s+.*--force\b/i,
   /\bgit\s+reset\s+--hard\b/i,
   /\bgit\s+clean\s+.*-f/i,
   /\bformat\s+[a-z]:/i,
   /\bdel\s+\/[sf]\b/i,
-  /\b(?:kubectl|helm)\s+delete\b.*\b(?:--all|namespace|all)\b/i,
+  /\b(?:kubectl|helm)\s+delete\s+(?:--all|namespace)\b/i,
+  /\bDROP\s+(?:DATABASE|TABLE|SCHEMA)\b/i,
   /\bDELETE\s+FROM\s+\w+/i,
   /\bALTER\s+TABLE\s+\w+\s+DROP\b/i,
 ];
 
-const SECRET_PATTERNS = [
+const FALLBACK_SECRET_PATTERNS = [
   /(?:api[_-]?key|apikey)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
   /(?:secret|password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
   /(?:token|bearer)\s*[:=]\s*['"][^'"]{10,}['"]/gi,
-  // Unquoted variants — env-style KEY equals value with no surrounding
-  // quotes (the single most common real leak pattern; the quoted patterns
-  // above never match a bare assignment in a shell export or .env file).
+  // Unquoted variants — env-style `KEY=value` / `key: value` with no quotes,
+  // e.g. `ANTHROPIC_API_KEY=sk-ant-...` in a .env file or shell export. The
+  // quoted patterns above never match these, which was the single most
+  // common real leak pattern (P1-25).
   /(?:api[_-]?key|apikey|token|secret|password|passwd|pwd)\s*[:=]\s*[^\s'"]{8,}/gi,
   /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g,
   /sk-ant-[a-zA-Z0-9_-]{20,}/g,
@@ -44,6 +169,54 @@ const SECRET_PATTERNS = [
   /AKIA[0-9A-Z]{16}/g,
 ];
 
+// ─── Compiled config loader ─────────────────────────────────────────────────
+
+var MAX_CONFIG_SIZE = 256 * 1024; // 256 KiB — compiled gate config is small
+
+function toRegExp(serialized) {
+  try {
+    return new RegExp(serialized.source, serialized.flags);
+  } catch (e) {
+    return null;
+  }
+}
+
+/**
+ * Load an optional project-level gate override from
+ * .monomind/guidance/active-gates.json. Returns the built-in tables when the
+ * file is absent (the normal case), oversized, or malformed.
+ * Not cached across invocations: each PreToolUse hook is its own subprocess.
+ */
+function loadCompiledConfig(cwd) {
+  try {
+    var configPath = path.join(cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd(), '.monomind', 'guidance', 'active-gates.json');
+    var stat = fs.statSync(configPath);
+    if (stat.size > MAX_CONFIG_SIZE) throw new Error('active-gates.json too large');
+    var raw = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+
+    var destructivePatterns = Array.isArray(raw.destructivePatterns)
+      ? raw.destructivePatterns.map(toRegExp).filter(Boolean)
+      : [];
+    var secretPatterns = Array.isArray(raw.secretPatterns)
+      ? raw.secretPatterns.map(toRegExp).filter(Boolean)
+      : [];
+
+    if (destructivePatterns.length === 0 && secretPatterns.length === 0) {
+      throw new Error('active-gates.json had no usable patterns');
+    }
+
+    return {
+      destructivePatterns: raw.destructiveOps === false ? [] : destructivePatterns,
+      secretPatterns: raw.secrets === false ? [] : secretPatterns,
+    };
+  } catch (e) {
+    return {
+      destructivePatterns: FALLBACK_DESTRUCTIVE_PATTERNS,
+      secretPatterns: FALLBACK_SECRET_PATTERNS,
+    };
+  }
+}
+
 // ─── Helpers ──────────────────────────────────────────────────────────────────
 
 function redact(match) {
@@ -52,8 +225,9 @@ function redact(match) {
     : '*'.repeat(match.length);
 }
 
-function checkDestructive(command) {
-  for (const pattern of DESTRUCTIVE_PATTERNS) {
+function checkDestructive(command, patterns) {
+  var list = patterns || FALLBACK_DESTRUCTIVE_PATTERNS;
+  for (const pattern of list) {
     pattern.lastIndex = 0;
     const match = pattern.exec(command);
     if (match) {
@@ -67,9 +241,10 @@ function checkDestructive(command) {
   return { triggered: false };
 }
 
-function checkSecrets(content) {
+function checkSecrets(content, patterns) {
+  var list = patterns || FALLBACK_SECRET_PATTERNS;
   const found = [];
-  for (const pattern of SECRET_PATTERNS) {
+  for (const pattern of list) {
     pattern.lastIndex = 0;
     const matches = content.match(pattern);
     if (matches) {
@@ -88,14 +263,16 @@ function checkSecrets(content) {
 // ─── Hook handlers ────────────────────────────────────────────────────────────
 
 /**
- * pre-bash: check for destructive shell commands.
+ * pre-bash: check for destructive shell commands, then (additionally)
+ * run monofence-ai's threat detector on the raw command string.
  * Outputs Claude Code block decision to stdout when triggered.
  */
-function handlePreBash(hCtx) {
+async function handlePreBash(hCtx) {
   var cmd = (hCtx.toolInput && (hCtx.toolInput.command || hCtx.toolInput.cmd)) || '';
   if (!cmd) return;
 
-  var result = checkDestructive(cmd);
+  var config = loadCompiledConfig(hCtx.CWD);
+  var result = checkDestructive(cmd, config.destructivePatterns);
   if (result.triggered) {
     // Set exit code 2 to block, and write the reason to STDERR — per Claude
     // Code's PreToolUse hook protocol, stdout JSON is only parsed when exit
@@ -106,14 +283,29 @@ function handlePreBash(hCtx) {
       reason: '[gates] ' + result.reason,
     }) + '\n');
     process.exitCode = 2;
+    return;
+  }
+
+  // Additional layer: monofence-ai threat detection (prompt injection, evasion, etc.)
+  // Fails open — never blocks a command just because monofence is unavailable/slow.
+  var mf = await monofenceScan(cmd);
+  var worst = monofenceWorstThreat(mf);
+  if (worst) {
+    process.stderr.write(JSON.stringify({
+      decision: 'block',
+      reason: '[monofence] Threat detected in command — ' + worst.type +
+        ' (confidence ' + Math.round(worst.confidence * 100) + '%): ' + worst.description,
+    }) + '\n');
+    process.exitCode = 2;
   }
 }
 
 /**
- * pre-write: check for secrets in Write / Edit / MultiEdit content before it lands on disk.
+ * pre-write: check for secrets in Write / Edit / MultiEdit content before it lands on disk,
+ * then (additionally) run monofence-ai's threat detector on the same content.
  * Outputs Claude Code block decision to stdout when triggered.
  */
-function handlePreWrite(hCtx) {
+async function handlePreWrite(hCtx) {
   var toolInput = hCtx.toolInput || {};
   // Write: toolInput.content — Edit: toolInput.new_string
   // MultiEdit: toolInput.edits is an array of { old_string, new_string }
@@ -126,7 +318,8 @@ function handlePreWrite(hCtx) {
   var MAX_SCAN = 524288;
   if (content.length > MAX_SCAN) content = content.slice(0, MAX_SCAN);
 
-  var result = checkSecrets(content);
+  var config = loadCompiledConfig(hCtx.CWD);
+  var result = checkSecrets(content, config.secretPatterns);
   if (result.triggered) {
     // Set exit code 2 to block, and write the reason to STDERR — see the
     // matching comment in handlePreBash for why stdout is the wrong stream.
@@ -135,7 +328,29 @@ function handlePreWrite(hCtx) {
       reason: '[gates] ' + result.reason,
     }) + '\n');
     process.exitCode = 2;
+    return;
+  }
+
+  // Additional layer: monofence-ai threat detection on the content being written.
+  // Fails open — never blocks a write just because monofence is unavailable/slow.
+  var mf = await monofenceScan(content);
+  var worst = monofenceWorstThreat(mf);
+  if (worst) {
+    process.stderr.write(JSON.stringify({
+      decision: 'block',
+      reason: '[monofence] Threat detected in written content — ' + worst.type +
+        ' (confidence ' + Math.round(worst.confidence * 100) + '%): ' + worst.description,
+    }) + '\n');
+    process.exitCode = 2;
   }
 }
 
-module.exports = { handlePreBash, handlePreWrite, checkDestructive, checkSecrets };
+module.exports = {
+  handlePreBash,
+  handlePreWrite,
+  checkDestructive,
+  checkSecrets,
+  loadCompiledConfig,
+  monofenceScan,
+  monofenceWorstThreat,
+};