monomind 2.1.4 → 2.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "monomind",
-  "version": "2.1.4",
+  "version": "2.1.5",
   "description": "Open-source CLI extension for Claude Code. Adds an MCP server with a codebase knowledge graph, persistent memory, multi-agent coordination, and reusable slash commands. MIT licensed, runs locally, no data leaves your machine.",
   "main": "dist/index.js",
   "type": "module",

package/packages/@monomind/cli/.claude/helpers/handlers/capture-handler.cjs

@@ -41,10 +41,14 @@ function subagentKey(hookInput) {
   return crypto.createHash('md5').update(String(raw)).digest('hex').slice(0, 16);
 }
 
-// Determine subagent success from its result summary — errors/failures/
-// exceptions indicate failure. Shared by the Monograph `success` column and
-// the intelligence.feedback() call below, so both use one definition.
-function deriveSubagentSuccess(summary) {
+// Determine subagent success. `lastToolError` (was the transcript's final
+// tool_result an is_error block — a real signal parsed straight off the
+// transcript, not text sniffing) is authoritative when present; the summary
+// keyword check is a fallback for failures narrated without a tool error
+// (e.g. "I couldn't find X" with no failing tool call). Shared by the
+// Monograph `success` column and the intelligence.feedback() call below.
+function deriveSubagentSuccess(summary, lastToolError) {
+  if (lastToolError) return false;
   if (!summary) return true;
   var sumLower = summary.toLowerCase();
   if (sumLower.includes('error') || sumLower.includes('failed') || sumLower.includes('exception') || sumLower.includes('fatal')) {
@@ -100,6 +104,7 @@ function parseJSONLForData(filePath) {
   let tin = 0, tout = 0;
   let allMsgs = [];
   let toolCalls = [];
+  let lastToolError = false; // tracks the most recent tool_result seen, in file order
   try {
     const lines = fs.readFileSync(filePath, 'utf8').split('\n').filter(Boolean);
     for (const line of lines) {
@@ -119,6 +124,12 @@ function parseJSONLForData(filePath) {
           } else if (typeof content === 'string' && content) {
             allMsgs.push(content);
           }
+        } else if (d?.message?.role === 'user') {
+          const content = d?.message?.content;
+          if (Array.isArray(content)) {
+            const results = content.filter(b => b.type === 'tool_result');
+            if (results.length > 0) lastToolError = results.some(b => b.is_error === true);
+          }
         }
       } catch { /* skip malformed lines */ }
     }
@@ -129,7 +140,7 @@ function parseJSONLForData(filePath) {
   const summary = allMsgs.length > 1
     ? (firstMsg.slice(0, 300) + (allMsgs.length > 2 ? `\n…[${allMsgs.length - 2} more msgs]…\n` : '\n') + lastMsg.slice(0, 700))
     : lastMsg.slice(0, 1000);
-  return { tokens_in: tin, tokens_out: tout, summary, last_msg: lastMsg, toolCalls: [...new Set(toolCalls)] };
+  return { tokens_in: tin, tokens_out: tout, summary, last_msg: lastMsg, toolCalls: [...new Set(toolCalls)], lastToolError };
 }
 
 function getActiveRun() {
@@ -335,6 +346,7 @@ async function handleSubagentStop(hookInput) {
   let totalTin = 0, totalTout = 0;
   let summary = '';
   let toolCalls = [];
+  let lastToolError = false;
   const capturedFiles = [];
 
   for (const f of currentFiles) {
@@ -344,6 +356,7 @@ async function handleSubagentStop(hookInput) {
       totalTout += parsed.tokens_out;
       if (parsed.summary) summary = parsed.summary;
       toolCalls.push(...parsed.toolCalls);
+      lastToolError = parsed.lastToolError; // last new file wins, mirroring `summary`'s last-wins semantics
       capturedFiles.push(f.name);
     }
   }
@@ -365,7 +378,7 @@ async function handleSubagentStop(hookInput) {
   // (TeammateIdle/TaskCompleted) is dead code (those aren't valid Claude
   // Code hook events and are stripped from settings.json on init).
   try {
-    require('../intelligence.cjs').feedback(deriveSubagentSuccess(summary));
+    require('../intelligence.cjs').feedback(deriveSubagentSuccess(summary, lastToolError));
   } catch (e) { /* non-fatal — feedback recording must never block subagent-stop */ }
 
   if (!org && !session) {
@@ -509,7 +522,7 @@ async function handleSubagentStop(hookInput) {
             tokens_in: totalTin || 0,
             tokens_out: totalTout || 0,
             cost_usd: costUsd || 0,
-            success: deriveSubagentSuccess(summary) ? 1 : 0,
+            success: deriveSubagentSuccess(summary, lastToolError) ? 1 : 0,
             duration_ms: snap.ts ? (Date.now() - snap.ts) : 0,
             timestamp: Date.now(),
           });
@@ -643,12 +656,16 @@ async function handlePostTool(hookInput) {
 
 // ─── Dispatch ─────────────────────────────────────────────────────────────────
 
-const eventType = process.argv[2]; // 'subagent-start' | 'subagent-stop' | 'pretool' | 'posttool'
+if (require.main === module) {
+  const eventType = process.argv[2]; // 'subagent-start' | 'subagent-stop' | 'pretool' | 'posttool'
+
+  readStdin().then(hookInput => {
+    if (eventType === 'subagent-start') return handleSubagentStart(hookInput);
+    if (eventType === 'subagent-stop')  return handleSubagentStop(hookInput);
+    if (eventType === 'pretool')        return handlePreTool(hookInput);
+    if (eventType === 'posttool')       return handlePostTool(hookInput);
+    console.log('[CAPTURE] unknown event type: ' + eventType);
+  }).catch(() => process.exit(0));
+}
 
-readStdin().then(hookInput => {
-  if (eventType === 'subagent-start') return handleSubagentStart(hookInput);
-  if (eventType === 'subagent-stop')  return handleSubagentStop(hookInput);
-  if (eventType === 'pretool')        return handlePreTool(hookInput);
-  if (eventType === 'posttool')       return handlePostTool(hookInput);
-  console.log('[CAPTURE] unknown event type: ' + eventType);
-}).catch(() => process.exit(0));
+module.exports = { deriveSubagentSuccess, parseJSONLForData };

package/packages/@monomind/cli/.claude/helpers/handlers/gates-handler.cjs

@@ -1,9 +1,13 @@
 /**
  * Enforcement Gates Handler
  *
- * Inline gate logic for PreToolUse hooks — no ESM/package dependency.
- * This regex table is the canonical (and only) gate definition; the former
- * @monomind/guidance package it mirrored has been removed.
+ * Runs on every PreToolUse — must stay fast (no package import).
+ *
+ * The regex tables below are the canonical (and only) gate definition; the
+ * @monomind/guidance package that used to compile them was removed. An optional
+ * project override can still be supplied at `.monomind/guidance/active-gates.json`
+ * ({destructivePatterns, secretPatterns} as {source, flags} pairs) — if present
+ * and valid it replaces the built-in tables.
  *
  * Gates enforced at runtime:
  *   pre-bash  → destructive-ops  (hard block; no confirm-and-proceed path exists)
@@ -12,29 +16,150 @@
 
 'use strict';
 
-// ─── Patterns (superset of DEFAULT_GATE_CONFIG in gates.ts) ──────────────────
+const fs = require('fs');
+const path = require('path');
+
+// ─── monofence-ai integration (additional layer on top of regex gates) ───────
+//
+// monofence-ai (packages/monofence-ai) has real prompt-injection / evasion
+// detection but is never wired into the live Claude Code PreToolUse path —
+// it only registers hooks on @monomind/hooks' internal HookRegistry, which
+// this CJS dispatch path does not use. This loads it lazily (so a missing
+// or unbuilt package never breaks the existing regex gates), bounds it with
+// a hard timeout, and fails open on any error.
+
+const MONOFENCE_TIMEOUT_MS = 1500;
+const MONOFENCE_ABORT_THRESHOLD = 0.8;
+
+let _monofenceModulePromise = null;
+
+/**
+ * Resolve and import monofence-ai. Bare-specifier `import('monofence-ai')`
+ * only works when this file's ancestor node_modules chain contains the
+ * package (pnpm hoists it only into packages that declare it as a direct
+ * dependency, e.g. @monomind/cli) — so we also try resolving it explicitly
+ * from likely workspace locations before falling back to the bare import.
+ */
+/**
+ * Walk up from `startDir` looking for `<dir>/node_modules/monofence-ai/package.json`.
+ * Package "exports" maps intentionally omit "./package.json" as a subpath, so
+ * `require.resolve('monofence-ai/package.json', ...)` throws even when the
+ * package is present — a plain filesystem walk sidesteps that restriction.
+ */
+function _findMonofencePkgJson(startDir) {
+  var dir = startDir;
+  for (var depth = 0; depth < 20; depth++) {
+    var candidate = path.join(dir, 'node_modules', 'monofence-ai', 'package.json');
+    if (fs.existsSync(candidate)) return candidate;
+    var parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+
+function _loadMonofence() {
+  if (!_monofenceModulePromise) {
+    _monofenceModulePromise = (async () => {
+      var candidateDirs = [
+        __dirname,
+        process.env.CLAUDE_PROJECT_DIR || process.cwd(),
+        path.join(process.env.CLAUDE_PROJECT_DIR || process.cwd(), 'packages', '@monomind', 'cli'),
+        path.join(__dirname, '..', '..', '..', 'packages', '@monomind', 'cli'),
+      ];
+      var resolvedPkgJson = null;
+      for (var i = 0; i < candidateDirs.length; i++) {
+        resolvedPkgJson = _findMonofencePkgJson(candidateDirs[i]);
+        if (resolvedPkgJson) break;
+      }
+      var specifier = 'monofence-ai';
+      if (resolvedPkgJson) {
+        try {
+          var pkg = JSON.parse(fs.readFileSync(resolvedPkgJson, 'utf-8'));
+          var mainFile = (pkg.exports && pkg.exports['.'] && pkg.exports['.'].import) || pkg.main || 'dist/index.js';
+          specifier = 'file://' + path.join(path.dirname(resolvedPkgJson), mainFile);
+        } catch (e) { /* fall back to bare specifier below */ }
+      }
+      try {
+        return await import(specifier);
+      } catch (e) {
+        return null; // not installed / not built — fail open
+      }
+    })().catch(() => null);
+  }
+  return _monofenceModulePromise;
+}
+
+function _withTimeout(promise, ms) {
+  return new Promise((resolve) => {
+    var settled = false;
+    var timer = setTimeout(() => {
+      if (!settled) { settled = true; resolve(null); }
+    }, ms);
+    if (timer.unref) timer.unref();
+    Promise.resolve(promise).then(
+      (v) => { if (!settled) { settled = true; clearTimeout(timer); resolve(v); } },
+      () => { if (!settled) { settled = true; clearTimeout(timer); resolve(null); } }
+    );
+  });
+}
+
+/**
+ * Scan `input` with monofence-ai's threat detector, bounded by a timeout.
+ * Returns null (never throws) when monofence is unavailable, times out, or errors.
+ */
+async function monofenceScan(input) {
+  if (!input || typeof input !== 'string') return null;
+  var mod = await _withTimeout(_loadMonofence(), MONOFENCE_TIMEOUT_MS);
+  if (!mod || typeof mod.getMonoDefence !== 'function') return null;
+  try {
+    var defence = mod.getMonoDefence();
+    var result = await _withTimeout(defence.detect(input), MONOFENCE_TIMEOUT_MS);
+    return result || null;
+  } catch (e) {
+    return null;
+  }
+}
+
+/**
+ * Given a monofence ThreatDetectionResult, return the highest-confidence
+ * threat if it meets the abort threshold, else null.
+ */
+function monofenceWorstThreat(result) {
+  if (!result || result.safe || !Array.isArray(result.threats) || result.threats.length === 0) {
+    return null;
+  }
+  var worst = result.threats.reduce(
+    (max, t) => (t.confidence > max.confidence ? t : max),
+    result.threats[0]
+  );
+  return worst.confidence >= MONOFENCE_ABORT_THRESHOLD ? worst : null;
+}
 
-const DESTRUCTIVE_PATTERNS = [
+// ─── Fallback patterns (used only if the compiled config file is missing/unreadable) ──
+const FALLBACK_DESTRUCTIVE_PATTERNS = [
   /\brm\s+(?:-[a-z]*f[a-z]*r|-[a-z]*r[a-z]*f|--recursive.*--force|--force.*--recursive|-rf?)\b/i,
-  /\bdrop\s+(database|table|schema|index|view|function|procedure)\b/i,
+  /\bdrop\s+(database|table|schema|index)\b/i,
   /\btruncate\s+table\b/i,
-  /\bgit\s+push\s+(?:.*\s)?(?:--force(?:-with-lease)?|-[a-z]*f)\b/i,
+  /\bgit\s+push\s+.*--force\b/i,
   /\bgit\s+reset\s+--hard\b/i,
   /\bgit\s+clean\s+.*-f/i,
   /\bformat\s+[a-z]:/i,
   /\bdel\s+\/[sf]\b/i,
-  /\b(?:kubectl|helm)\s+delete\b.*\b(?:--all|namespace|all)\b/i,
+  /\b(?:kubectl|helm)\s+delete\s+(?:--all|namespace)\b/i,
+  /\bDROP\s+(?:DATABASE|TABLE|SCHEMA)\b/i,
   /\bDELETE\s+FROM\s+\w+/i,
   /\bALTER\s+TABLE\s+\w+\s+DROP\b/i,
 ];
 
-const SECRET_PATTERNS = [
+const FALLBACK_SECRET_PATTERNS = [
   /(?:api[_-]?key|apikey)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
   /(?:secret|password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
   /(?:token|bearer)\s*[:=]\s*['"][^'"]{10,}['"]/gi,
-  // Unquoted variants — env-style KEY equals value with no surrounding
-  // quotes (the single most common real leak pattern; the quoted patterns
-  // above never match a bare assignment in a shell export or .env file).
+  // Unquoted variants — env-style `KEY=value` / `key: value` with no quotes,
+  // e.g. `ANTHROPIC_API_KEY=sk-ant-...` in a .env file or shell export. The
+  // quoted patterns above never match these, which was the single most
+  // common real leak pattern (P1-25).
   /(?:api[_-]?key|apikey|token|secret|password|passwd|pwd)\s*[:=]\s*[^\s'"]{8,}/gi,
   /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g,
   /sk-ant-[a-zA-Z0-9_-]{20,}/g,
@@ -44,6 +169,54 @@ const SECRET_PATTERNS = [
   /AKIA[0-9A-Z]{16}/g,
 ];
 
+// ─── Compiled config loader ─────────────────────────────────────────────────
+
+var MAX_CONFIG_SIZE = 256 * 1024; // 256 KiB — compiled gate config is small
+
+function toRegExp(serialized) {
+  try {
+    return new RegExp(serialized.source, serialized.flags);
+  } catch (e) {
+    return null;
+  }
+}
+
+/**
+ * Load an optional project-level gate override from
+ * .monomind/guidance/active-gates.json. Returns the built-in tables when the
+ * file is absent (the normal case), oversized, or malformed.
+ * Not cached across invocations: each PreToolUse hook is its own subprocess.
+ */
+function loadCompiledConfig(cwd) {
+  try {
+    var configPath = path.join(cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd(), '.monomind', 'guidance', 'active-gates.json');
+    var stat = fs.statSync(configPath);
+    if (stat.size > MAX_CONFIG_SIZE) throw new Error('active-gates.json too large');
+    var raw = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+
+    var destructivePatterns = Array.isArray(raw.destructivePatterns)
+      ? raw.destructivePatterns.map(toRegExp).filter(Boolean)
+      : [];
+    var secretPatterns = Array.isArray(raw.secretPatterns)
+      ? raw.secretPatterns.map(toRegExp).filter(Boolean)
+      : [];
+
+    if (destructivePatterns.length === 0 && secretPatterns.length === 0) {
+      throw new Error('active-gates.json had no usable patterns');
+    }
+
+    return {
+      destructivePatterns: raw.destructiveOps === false ? [] : destructivePatterns,
+      secretPatterns: raw.secrets === false ? [] : secretPatterns,
+    };
+  } catch (e) {
+    return {
+      destructivePatterns: FALLBACK_DESTRUCTIVE_PATTERNS,
+      secretPatterns: FALLBACK_SECRET_PATTERNS,
+    };
+  }
+}
+
 // ─── Helpers ──────────────────────────────────────────────────────────────────
 
 function redact(match) {
@@ -52,8 +225,9 @@ function redact(match) {
     : '*'.repeat(match.length);
 }
 
-function checkDestructive(command) {
-  for (const pattern of DESTRUCTIVE_PATTERNS) {
+function checkDestructive(command, patterns) {
+  var list = patterns || FALLBACK_DESTRUCTIVE_PATTERNS;
+  for (const pattern of list) {
     pattern.lastIndex = 0;
     const match = pattern.exec(command);
     if (match) {
@@ -67,9 +241,10 @@ function checkDestructive(command) {
   return { triggered: false };
 }
 
-function checkSecrets(content) {
+function checkSecrets(content, patterns) {
+  var list = patterns || FALLBACK_SECRET_PATTERNS;
   const found = [];
-  for (const pattern of SECRET_PATTERNS) {
+  for (const pattern of list) {
     pattern.lastIndex = 0;
     const matches = content.match(pattern);
     if (matches) {
@@ -88,14 +263,16 @@ function checkSecrets(content) {
 // ─── Hook handlers ────────────────────────────────────────────────────────────
 
 /**
- * pre-bash: check for destructive shell commands.
+ * pre-bash: check for destructive shell commands, then (additionally)
+ * run monofence-ai's threat detector on the raw command string.
  * Outputs Claude Code block decision to stdout when triggered.
  */
-function handlePreBash(hCtx) {
+async function handlePreBash(hCtx) {
   var cmd = (hCtx.toolInput && (hCtx.toolInput.command || hCtx.toolInput.cmd)) || '';
   if (!cmd) return;
 
-  var result = checkDestructive(cmd);
+  var config = loadCompiledConfig(hCtx.CWD);
+  var result = checkDestructive(cmd, config.destructivePatterns);
   if (result.triggered) {
     // Set exit code 2 to block, and write the reason to STDERR — per Claude
     // Code's PreToolUse hook protocol, stdout JSON is only parsed when exit
@@ -106,14 +283,29 @@ function handlePreBash(hCtx) {
       reason: '[gates] ' + result.reason,
     }) + '\n');
     process.exitCode = 2;
+    return;
+  }
+
+  // Additional layer: monofence-ai threat detection (prompt injection, evasion, etc.)
+  // Fails open — never blocks a command just because monofence is unavailable/slow.
+  var mf = await monofenceScan(cmd);
+  var worst = monofenceWorstThreat(mf);
+  if (worst) {
+    process.stderr.write(JSON.stringify({
+      decision: 'block',
+      reason: '[monofence] Threat detected in command — ' + worst.type +
+        ' (confidence ' + Math.round(worst.confidence * 100) + '%): ' + worst.description,
+    }) + '\n');
+    process.exitCode = 2;
   }
 }
 
 /**
- * pre-write: check for secrets in Write / Edit / MultiEdit content before it lands on disk.
+ * pre-write: check for secrets in Write / Edit / MultiEdit content before it lands on disk,
+ * then (additionally) run monofence-ai's threat detector on the same content.
  * Outputs Claude Code block decision to stdout when triggered.
  */
-function handlePreWrite(hCtx) {
+async function handlePreWrite(hCtx) {
   var toolInput = hCtx.toolInput || {};
   // Write: toolInput.content — Edit: toolInput.new_string
   // MultiEdit: toolInput.edits is an array of { old_string, new_string }
@@ -126,7 +318,8 @@ function handlePreWrite(hCtx) {
   var MAX_SCAN = 524288;
   if (content.length > MAX_SCAN) content = content.slice(0, MAX_SCAN);
 
-  var result = checkSecrets(content);
+  var config = loadCompiledConfig(hCtx.CWD);
+  var result = checkSecrets(content, config.secretPatterns);
   if (result.triggered) {
     // Set exit code 2 to block, and write the reason to STDERR — see the
     // matching comment in handlePreBash for why stdout is the wrong stream.
@@ -135,7 +328,29 @@ function handlePreWrite(hCtx) {
       reason: '[gates] ' + result.reason,
     }) + '\n');
     process.exitCode = 2;
+    return;
+  }
+
+  // Additional layer: monofence-ai threat detection on the content being written.
+  // Fails open — never blocks a write just because monofence is unavailable/slow.
+  var mf = await monofenceScan(content);
+  var worst = monofenceWorstThreat(mf);
+  if (worst) {
+    process.stderr.write(JSON.stringify({
+      decision: 'block',
+      reason: '[monofence] Threat detected in written content — ' + worst.type +
+        ' (confidence ' + Math.round(worst.confidence * 100) + '%): ' + worst.description,
+    }) + '\n');
+    process.exitCode = 2;
   }
 }
 
-module.exports = { handlePreBash, handlePreWrite, checkDestructive, checkSecrets };
+module.exports = {
+  handlePreBash,
+  handlePreWrite,
+  checkDestructive,
+  checkSecrets,
+  loadCompiledConfig,
+  monofenceScan,
+  monofenceWorstThreat,
+};

package/packages/@monomind/cli/.claude/helpers/handlers/route-handler.cjs

@@ -18,6 +18,38 @@
 const path = require('path');
 const fs = require('fs');
 
+// ── Intelligence read-path bridge ───────────────────────────────────────────
+// route-handler.cjs runs as a fresh node subprocess per invocation, but a
+// single process may call handle() more than once (e.g. tests, or a daemon
+// wrapper) — cache the dynamic import of the CLI's compiled intelligence
+// bridge (hooks-embedding.js -> suggestAgentsFromIntelligence) so repeat
+// calls within the same process don't re-resolve/re-import the module.
+// suggestAgentsFromIntelligence() reads the SONA/ReasoningBank embedding
+// store populated by recordMemoryDecision() on every post-task — this is
+// the module that makes stored embedding patterns affect live routing.
+var _intelligenceModPromise = null;
+function _loadIntelligenceModule(CWD) {
+  if (!_intelligenceModPromise) {
+    _intelligenceModPromise = (async function() {
+      var candidates = [
+        path.resolve(CWD, 'packages', '@monomind', 'cli', 'dist', 'src', 'mcp-tools', 'hooks-embedding.js'),
+        path.resolve(CWD, 'packages', '@monomind', 'cli', 'node_modules', '@monomind', 'cli', 'dist', 'src', 'mcp-tools', 'hooks-embedding.js'),
+      ];
+      for (var i = 0; i < candidates.length; i++) {
+        if (fs.existsSync(candidates[i])) {
+          try {
+            return await import(candidates[i]);
+          } catch (e) {
+            return null;
+          }
+        }
+      }
+      return null;
+    })();
+  }
+  return _intelligenceModPromise;
+}
+
 module.exports = {
   handle: async function(hCtx) {
     var prompt = hCtx.prompt;
@@ -104,7 +136,7 @@ module.exports = {
                 if (erRule.pattern && erRule.pattern.test(prompt)) {
                   result.agent = erRule.routeName || erRule.agentSlug;
                   result.agentSlug = erRule.agentSlug;
-                  result.confidence = 0.90;
+                  result.confidence = erRule.score != null ? Math.min(0.98, Math.max(0.70, erRule.score)) : 0.85;
                   result.reason = 'Enriched: ' + (erRule.description || erRule.routeName);
                   result.enrichedFrom = 'routing-keyword-pre-filter';
                   break;
@@ -115,6 +147,47 @@ module.exports = {
         } catch (e) { /* non-fatal — routing package may not be available */ }
       }
 
+      // ── Intelligence embedding suggestion (SONA/ReasoningBank read path) ──
+      // Wires the previously-write-only intelligence system into live routing:
+      // suggestAgentsFromIntelligence() runs an embedding similarity search
+      // over patterns stored by recordMemoryDecision() on every post-task.
+      // This ENHANCES the keyword route — it only overrides when the
+      // embedding match is meaningfully more confident, and never blocks or
+      // delays routing beyond a 2s budget (fails silently otherwise).
+      try {
+        var intelResult = await Promise.race([
+          (async function() {
+            var mod = await _loadIntelligenceModule(CWD);
+            if (!mod || !mod.suggestAgentsFromIntelligence) return null;
+            return await mod.suggestAgentsFromIntelligence(prompt);
+          })(),
+          new Promise(function(resolve) { setTimeout(function() { resolve(null); }, 2000); })
+        ]);
+        if (intelResult && intelResult.agents && intelResult.agents.length > 0) {
+          var topIntelAgent = intelResult.agents[0];
+          var intelConf = intelResult.confidence != null ? intelResult.confidence : 0;
+          result.intelligenceSuggestion = { agents: intelResult.agents, confidence: intelConf };
+
+          var curAgent = result.agentSlug || result.agent;
+          var curConf = result.confidence != null ? result.confidence : 0;
+          if (topIntelAgent !== curAgent) {
+            // Only override when the embedding match clearly beats the keyword
+            // route (0.1 margin) — otherwise just surface it as a signal.
+            if (intelConf > curConf + 0.1) {
+              console.log('[INTELLIGENCE] Embedding suggestion overrides keyword routing: ' + topIntelAgent + ' (confidence ' + intelConf.toFixed(2) + ') vs keyword ' + curAgent + ' (' + curConf.toFixed(2) + ')');
+              result.keywordAgent = curAgent;
+              result.agent = topIntelAgent;
+              result.agentSlug = topIntelAgent;
+              result.confidence = intelConf;
+              result.reason = 'Intelligence embedding match (SONA/ReasoningBank)' + (result.reason ? '; keyword route was: ' + result.reason : '');
+              result.enrichedFrom = 'intelligence-embedding';
+            } else {
+              console.log('[INTELLIGENCE] Embedding suggestion: ' + topIntelAgent + ' (confidence ' + intelConf.toFixed(2) + ') — kept keyword route ' + curAgent);
+            }
+          }
+        }
+      } catch (e) { /* non-fatal — intelligence system unavailable or timed out */ }
+
       // ── Agent success pattern lookup ──────────────────────────
       try {
         var patternDb = hCtx._openMonographDb();

package/packages/@monomind/cli/.claude/helpers/hook-handler.cjs

@@ -393,15 +393,16 @@ const handlers = {
   },
 
   'pre-bash': async () => {
-    // SECURITY GATE FIRST — destructive-ops enforcement must never be
-    // starved by the slower enrichment work below (monograph hint lookups).
-    // Previously this ran LAST, after up to 10 monograph SQLite strategies,
-    // AND was fired without awaiting its promise — meaning the block
-    // decision (process.exitCode) could still be unset when the process
-    // exited under the global 5s safety timer (see main()'s
-    // `process.exit(0)`), i.e. the gate could fail OPEN under time
-    // pressure. Awaiting it first guarantees the block/allow decision is
-    // computed and set before any enrichment work even starts.
+    // SECURITY GATE FIRST — destructive-ops + secrets enforcement must never
+    // be starved by the slower enrichment work below (monograph hint lookups,
+    // monofence-ai scan). Previously this ran LAST, after up to 10 monograph
+    // SQLite strategies and a 1.5s monofence budget; under load/slow disk the
+    // global 5s safety timer (see main()'s `process.exit(0)`) could fire
+    // before the gate ever printed its block decision — i.e. the gate could
+    // fail OPEN under time pressure. Computing it first guarantees the
+    // block/allow decision (process.exitCode) is set before any enrichment
+    // work even starts; enrichment output is still attached afterward if
+    // there's time left in the process's lifetime.
     var gates = require('./handlers/gates-handler.cjs');
     await gates.handlePreBash(hCtx);
     if (process.exitCode === 2) return; // blocked — skip enrichment entirely
@@ -661,10 +662,11 @@ const handlers = {
     }
   },
 
-  'pre-write': () => {
-    // Enforcement gate: secrets detection before Write/Edit/MultiEdit lands on disk
+  'pre-write': async () => {
+    // Enforcement gate: secrets detection + monofence-ai threat scan before
+    // Write/Edit/MultiEdit content lands on disk
     var gates = require('./handlers/gates-handler.cjs');
-    gates.handlePreWrite(hCtx);
+    await gates.handlePreWrite(hCtx);
   },
 
   'pre-search': () => {

package/packages/@monomind/cli/.claude/helpers/router.cjs

@@ -310,12 +310,22 @@ function routeTask(prompt) {
     if (slug === 'coder' && hasStrongSkill) continue;
     var pattern = _ROUTING_PATTERNS[slug];
     if (pattern && pattern.test(safePrompt)) {
-      var confidence = applyFeedbackWeight(slug, TASK_CONFIDENCES[slug] || 0.75);
+      // Count how many distinct keywords from the pattern actually matched
+      // so confidence reflects real match quality, not just a static constant.
+      var caps = AGENT_CAPABILITIES[slug] || [];
+      var promptLower = safePrompt.toLowerCase();
+      var matchedKw = 0;
+      for (var ki = 0; ki < caps.length; ki++) {
+        if (promptLower.indexOf(caps[ki].toLowerCase()) !== -1) matchedKw++;
+      }
+      var baseConf = TASK_CONFIDENCES[slug] || 0.75;
+      var matchBonus = Math.min(0.10, matchedKw * 0.02);
+      var confidence = Math.min(0.98, applyFeedbackWeight(slug, baseConf + matchBonus));
       return {
         agent: TASK_AGENTS[slug],
         agentSlug: slug,
         confidence: confidence,
-        reason: ('Keyword match: ' + slug).slice(0, 80),
+        reason: ('Keyword match: ' + slug + ' (' + matchedKw + ' kw)').slice(0, 80),
         semanticRouting: false,
         specificAgents: [{ slug: slug, name: TASK_AGENTS[slug], confidence: confidence }],
         skillMatches: skills,

package/packages/@monomind/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monoes/monomindcli",
-  "version": "2.1.4",
+  "version": "2.1.5",
   "type": "module",
   "description": "CLI engine for Monomind — an open-source MCP server that extends Claude Code with a codebase knowledge graph (tree-sitter + SQLite), persistent memory, multi-agent task coordination, and session hooks. MIT licensed, fully local.",
   "main": "dist/src/index.js",