monomind 2.1.8 → 2.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "monomind",
-  "version": "2.1.8",
+  "version": "2.2.0",
   "description": "Open-source CLI extension for Claude Code. Adds an MCP server with a codebase knowledge graph, persistent memory, multi-agent coordination, and reusable slash commands. MIT licensed, runs locally, no data leaves your machine.",
   "main": "dist/index.js",
   "type": "module",

package/packages/@monomind/cli/.claude/helpers/handlers/capture-handler.cjs

@@ -393,8 +393,49 @@ async function handleSubagentStop(hookInput) {
   // remaining event that carries a genuine failure signal, since post-task
   // (TeammateIdle/TaskCompleted) is dead code (those aren't valid Claude
   // Code hook events and are stripped from settings.json on init).
+  const _subagentSuccess = deriveSubagentSuccess(summary, lastToolError);
   try {
-    require('../intelligence.cjs').feedback(deriveSubagentSuccess(summary, lastToolError));
+    require('../intelligence.cjs').feedback(_subagentSuccess);
+  } catch (e) { /* non-fatal — feedback recording must never block subagent-stop */ }
+
+  // ── Routing Feedback Loop (per-subagent) ──────────────────────────────
+  // session-handler.cjs's SessionEnd writes one routing-feedback.jsonl entry
+  // per SESSION — but a session that never ends (e.g. a long-running
+  // `monomind org run` daemon session, observed running 2+ days without a
+  // SessionEnd in production) never contributes any entry at all, even
+  // though real subagent activity (and real success/failure signal) is
+  // happening continuously inside it. SubagentStop fires independently of
+  // session boundaries, so writing a routing-feedback entry HERE — one per
+  // actual routing decision (this subagent spawn), not one per session —
+  // keeps the "Routing Learning" signal live regardless of session length,
+  // instead of it going silently stale for anyone running persistent orgs.
+  try {
+    var _agentSlug = String(agentType || '').trim().toLowerCase().replace(/\s+/g, '-');
+    if (_agentSlug && _agentSlug !== 'ai-selecting' && _agentSlug !== 'unknown') {
+      var _rfEntry = {
+        timestamp: new Date().toISOString(),
+        suggestedAgent: _agentSlug,
+        sessionId: String(session || snap.session || hookInput.sessionId || hookInput.session_id || '').slice(0, 128),
+        intelligenceFeedback: _subagentSuccess,
+      };
+      // Best-effort confidence from the routing decision that led to this
+      // spawn — may not correspond exactly to THIS subagent if another
+      // routing decision overwrote last-route.json in between (same
+      // imprecision session-handler.cjs's session-level entries already had).
+      try {
+        var _lastRoutePath = path.join(CWD, '.monomind', 'last-route.json');
+        var _MAX_ROUTE = 64 * 1024;
+        if (fs.existsSync(_lastRoutePath) && fs.statSync(_lastRoutePath).size <= _MAX_ROUTE) {
+          var _lastRoute = JSON.parse(fs.readFileSync(_lastRoutePath, 'utf-8'));
+          if (typeof _lastRoute.confidence === 'number') _rfEntry.confidence = _lastRoute.confidence;
+        }
+      } catch (_) {}
+      appendJsonlWithRotation(
+        path.join(CWD, '.monomind', 'routing-feedback.jsonl'),
+        JSON.stringify(_rfEntry),
+        1000
+      );
+    }
   } catch (e) { /* non-fatal — feedback recording must never block subagent-stop */ }
 
   if (!org && !session) {

package/packages/@monomind/cli/dist/src/commands/init-wizard.js

@@ -179,7 +179,7 @@ export const wizardCommand = {
                 }
                 const { execFileSync } = await import('child_process');
                 try {
-                    execFileSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['@monomind/cli@latest', 'embeddings', 'init', '--model', embeddingModel, '--no-download', '--force'], {
+                    execFileSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['monomind@latest', 'embeddings', 'init', '--model', embeddingModel, '--no-download', '--force'], {
                         stdio: 'pipe',
                         cwd: ctx.cwd,
                         timeout: 30000
@@ -199,7 +199,7 @@ export const wizardCommand = {
             if (enableGates) {
                 try {
                     const { execFileSync } = await import('child_process');
-                    execFileSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['@monomind/cli@latest', 'guidance', 'setup', '--project-dir', ctx.cwd], { stdio: 'pipe', cwd: ctx.cwd, timeout: 10000 });
+                    execFileSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['monomind@latest', 'guidance', 'setup', '--project-dir', ctx.cwd], { stdio: 'pipe', cwd: ctx.cwd, timeout: 10000 });
                     gatesEnabled = true;
                     output.writeln(output.success('  ✓ Enforcement gates wired'));
                 }

package/packages/@monomind/cli/dist/src/commands/init.js

@@ -10,6 +10,7 @@ import { executeInit, DEFAULT_INIT_OPTIONS, MINIMAL_INIT_OPTIONS, FULL_INIT_OPTI
 import { wizardCommand } from './init-wizard.js';
 import { upgradeCommand } from './init-upgrade.js';
 import { checkCommand, skillsCommand, hooksCommand } from './init-subcommands.js';
+import { initializeMemoryDatabase } from '../memory/memory-initializer.js';
 function isInitialized(cwd) {
     const claudePath = path.join(cwd, '.claude', 'settings.json');
     const monomindPath = path.join(cwd, '.monomind', 'config.yaml');
@@ -172,23 +173,30 @@ const initAction = async (ctx) => {
             output.printInfo('Starting services...');
             const { execSync } = await import('child_process');
             if (startAll) {
+                // In-process, not a subprocess: `npx @monomind/cli@latest memory init`
+                // (the previous approach) shelled out to a package name that has
+                // never been published — every fresh init silently 404'd here and
+                // fell into the catch block's "already exists" message even when no
+                // database existed at all. initializeMemoryDatabase() is the same
+                // function `monomind memory init` itself calls, run directly.
                 try {
                     output.writeln(output.dim('  Initializing memory database...'));
-                    execSync('npx @monomind/cli@latest memory init', {
-                        stdio: 'pipe',
-                        cwd: ctx.cwd,
-                        timeout: 30000
-                    });
-                    output.writeln(output.success('  ✓ Memory initialized'));
+                    const memResult = await initializeMemoryDatabase({ dbPath: path.join(ctx.cwd, '.swarm', 'memory.db') });
+                    if (memResult.success) {
+                        output.writeln(output.success('  ✓ Memory initialized'));
+                    }
+                    else {
+                        output.writeln(output.dim(`  Memory database init skipped (${memResult.error || 'unknown reason'})`));
+                    }
                 }
-                catch {
-                    output.writeln(output.dim('  Memory database already exists'));
+                catch (e) {
+                    output.writeln(output.dim(`  Memory database init skipped (${e instanceof Error ? e.message : String(e)})`));
                 }
             }
             if (startAll) {
                 try {
                     output.writeln(output.dim('  Initializing swarm...'));
-                    execSync('npx @monomind/cli@latest swarm init --topology hierarchical', {
+                    execSync('npx monomind@latest swarm init --topology hierarchical', {
                         stdio: 'pipe',
                         cwd: ctx.cwd,
                         timeout: 30000
@@ -199,6 +207,42 @@ const initAction = async (ctx) => {
                     output.writeln(output.dim('  Swarm initialization skipped'));
                 }
             }
+            if (startAll) {
+                // Seed .monomind/metrics/ immediately instead of waiting for the
+                // first Claude Code session-restore hook to run these workers —
+                // running `monomind doctor` right after `init` (before ever opening
+                // Claude Code) otherwise always shows "Worker Metrics"/"Security
+                // Audit" as unconfigured, even though nothing is actually broken.
+                try {
+                    output.writeln(output.dim('  Seeding worker metrics...'));
+                    const hooksMod = await import('@monomind/hooks').catch(() => null);
+                    if (hooksMod && hooksMod.createWorkerManager) {
+                        const manager = hooksMod.createWorkerManager(ctx.cwd);
+                        await manager.ensureMetricsDir();
+                        const seeded = [];
+                        for (const workerName of ['map', 'audit']) {
+                            try {
+                                const r = await manager.runWorker(workerName);
+                                if (r.success)
+                                    seeded.push(workerName);
+                            }
+                            catch { /* best-effort — doctor will report if this stays missing */ }
+                        }
+                        if (seeded.length > 0) {
+                            output.writeln(output.success(`  ✓ Worker metrics seeded (${seeded.join(', ')})`));
+                        }
+                        else {
+                            output.writeln(output.dim('  Worker metrics seeding skipped'));
+                        }
+                    }
+                    else {
+                        output.writeln(output.dim('  Worker metrics seeding skipped (@monomind/hooks unavailable)'));
+                    }
+                }
+                catch (e) {
+                    output.writeln(output.dim(`  Worker metrics seeding skipped (${e instanceof Error ? e.message : String(e)})`));
+                }
+            }
             output.writeln();
             output.printSuccess('All services started');
         }
@@ -216,7 +260,7 @@ const initAction = async (ctx) => {
             try {
                 output.writeln(output.dim(`  Model: ${embeddingModel}`));
                 output.writeln(output.dim('  Hyperbolic: Enabled (Poincaré ball)'));
-                execFileSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['@monomind/cli@latest', 'embeddings', 'init', '--model', embeddingModel, '--no-download', '--force'], {
+                execFileSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['monomind@latest', 'embeddings', 'init', '--model', embeddingModel, '--no-download', '--force'], {
                     stdio: 'pipe',
                     cwd: ctx.cwd,
                     timeout: 30000

package/packages/@monomind/cli/dist/src/commands/swarm.js

@@ -517,8 +517,8 @@ const statusCommand = {
             output.writeln(output.warning('No active swarm'));
             output.writeln();
             output.writeln(output.dim('Start a swarm with:'));
-            output.writeln(output.dim('  npx @monomind/cli@latest swarm init'));
-            output.writeln(output.dim('  npx @monomind/cli@latest swarm start'));
+            output.writeln(output.dim('  npx monomind@latest swarm init'));
+            output.writeln(output.dim('  npx monomind@latest swarm start'));
             output.writeln();
             return { success: true, data: status };
         }

package/packages/@monomind/cli/dist/src/init/settings-generator.js

@@ -229,8 +229,15 @@ function generateHooksConfig(config, graphify = true) {
                 matcher: 'Write|Edit|MultiEdit',
                 hooks: [
                     {
+                        // Was 'pre-edit' — not a registered hook-handler.cjs dispatch
+                        // command (only 'pre-write' is), so this silently no-op'd on
+                        // every default init: hook-handler.cjs's dispatcher falls through
+                        // to `else if (command) { console.log('[OK] Hook: ' + command); }`
+                        // for any unrecognized subcommand, meaning the secrets-detection
+                        // gate (gates-handler.cjs's handlePreWrite) never actually ran
+                        // for any project set up via a default `monomind init`.
                         type: 'command',
-                        command: hookHandlerCmd('pre-edit'),
+                        command: hookHandlerCmd('pre-write'),
                         timeout: config.timeout,
                     },
                 ],

package/packages/@monomind/cli/dist/src/mcp-tools/terminal-tools.js

@@ -8,6 +8,33 @@ import { randomBytes } from 'node:crypto';
 const STORAGE_DIR = '.monomind';
 const TERMINAL_DIR = 'terminals';
 const TERMINAL_FILE = 'store.json';
+// ── Secret-shaped env var filtering for terminal_execute ────────────────────
+// terminal_execute runs arbitrary (metacharacter-denylisted) shell commands
+// via execSync with `env: { ...process.env, ...session.env }` — the host
+// process's real environment, which commonly holds provider API keys
+// (ANTHROPIC_API_KEY, OPENAI_API_KEY, ...), CI/VCS tokens, and cloud
+// credentials. A single unpiped command (the metacharacter denylist blocks
+// piping/chaining, but not e.g. `curl` or `aws` invoked directly) can still
+// read and exfiltrate whatever env vars it inherits. Stripping variables
+// whose *names* match common secret conventions is defense-in-depth: it
+// doesn't change legitimate terminal usage (PATH/HOME/etc. stay intact) but
+// meaningfully shrinks what a malicious or hijacked command can read by
+// default. Callers that genuinely need a specific secret can pass it via
+// terminal_create's `env` option, which flows through untouched (session.env
+// is layered on *after* the filtered process.env below).
+const SECRET_ENV_NAME_PATTERN = /(KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|_AUTH$|^AUTH_|PRIVATE_KEY|ACCESS_KEY)/i;
+/** Returns a copy of `env` with secret-shaped variable names removed. */
+function filterSecretEnvVars(env) {
+    const filtered = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (v === undefined)
+            continue;
+        if (SECRET_ENV_NAME_PATTERN.test(k))
+            continue;
+        filtered[k] = v;
+    }
+    return filtered;
+}
 function getTerminalDir() {
     return join(getProjectCwd(), STORAGE_DIR, TERMINAL_DIR);
 }
@@ -200,7 +227,7 @@ export const terminalTools = [
                     timeout,
                     maxBuffer: 5 * 1024 * 1024,
                     stdio: ['pipe', 'pipe', 'pipe'],
-                    env: { ...process.env, ...session.env },
+                    env: { ...filterSecretEnvVars(process.env), ...session.env },
                 });
                 exitCode = 0;
             }

package/packages/@monomind/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monoes/monomindcli",
-  "version": "2.1.8",
+  "version": "2.2.0",
   "type": "module",
   "description": "CLI engine for Monomind — an open-source MCP server that extends Claude Code with a codebase knowledge graph (tree-sitter + SQLite), persistent memory, multi-agent task coordination, and session hooks. MIT licensed, fully local.",
   "main": "dist/src/index.js",