monomind 2.1.9 → 2.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "monomind",
-  "version": "2.1.9",
+  "version": "2.2.0",
   "description": "Open-source CLI extension for Claude Code. Adds an MCP server with a codebase knowledge graph, persistent memory, multi-agent coordination, and reusable slash commands. MIT licensed, runs locally, no data leaves your machine.",
   "main": "dist/index.js",
   "type": "module",

package/packages/@monomind/cli/dist/src/commands/init-wizard.js

@@ -179,7 +179,7 @@ export const wizardCommand = {
                 }
                 const { execFileSync } = await import('child_process');
                 try {
-                    execFileSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['@monomind/cli@latest', 'embeddings', 'init', '--model', embeddingModel, '--no-download', '--force'], {
+                    execFileSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['monomind@latest', 'embeddings', 'init', '--model', embeddingModel, '--no-download', '--force'], {
                         stdio: 'pipe',
                         cwd: ctx.cwd,
                         timeout: 30000
@@ -199,7 +199,7 @@ export const wizardCommand = {
             if (enableGates) {
                 try {
                     const { execFileSync } = await import('child_process');
-                    execFileSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['@monomind/cli@latest', 'guidance', 'setup', '--project-dir', ctx.cwd], { stdio: 'pipe', cwd: ctx.cwd, timeout: 10000 });
+                    execFileSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['monomind@latest', 'guidance', 'setup', '--project-dir', ctx.cwd], { stdio: 'pipe', cwd: ctx.cwd, timeout: 10000 });
                     gatesEnabled = true;
                     output.writeln(output.success('  ✓ Enforcement gates wired'));
                 }

package/packages/@monomind/cli/dist/src/commands/init.js

@@ -10,6 +10,7 @@ import { executeInit, DEFAULT_INIT_OPTIONS, MINIMAL_INIT_OPTIONS, FULL_INIT_OPTI
 import { wizardCommand } from './init-wizard.js';
 import { upgradeCommand } from './init-upgrade.js';
 import { checkCommand, skillsCommand, hooksCommand } from './init-subcommands.js';
+import { initializeMemoryDatabase } from '../memory/memory-initializer.js';
 function isInitialized(cwd) {
     const claudePath = path.join(cwd, '.claude', 'settings.json');
     const monomindPath = path.join(cwd, '.monomind', 'config.yaml');
@@ -172,23 +173,30 @@ const initAction = async (ctx) => {
             output.printInfo('Starting services...');
             const { execSync } = await import('child_process');
             if (startAll) {
+                // In-process, not a subprocess: `npx @monomind/cli@latest memory init`
+                // (the previous approach) shelled out to a package name that has
+                // never been published — every fresh init silently 404'd here and
+                // fell into the catch block's "already exists" message even when no
+                // database existed at all. initializeMemoryDatabase() is the same
+                // function `monomind memory init` itself calls, run directly.
                 try {
                     output.writeln(output.dim('  Initializing memory database...'));
-                    execSync('npx @monomind/cli@latest memory init', {
-                        stdio: 'pipe',
-                        cwd: ctx.cwd,
-                        timeout: 30000
-                    });
-                    output.writeln(output.success('  ✓ Memory initialized'));
+                    const memResult = await initializeMemoryDatabase({ dbPath: path.join(ctx.cwd, '.swarm', 'memory.db') });
+                    if (memResult.success) {
+                        output.writeln(output.success('  ✓ Memory initialized'));
+                    }
+                    else {
+                        output.writeln(output.dim(`  Memory database init skipped (${memResult.error || 'unknown reason'})`));
+                    }
                 }
-                catch {
-                    output.writeln(output.dim('  Memory database already exists'));
+                catch (e) {
+                    output.writeln(output.dim(`  Memory database init skipped (${e instanceof Error ? e.message : String(e)})`));
                 }
             }
             if (startAll) {
                 try {
                     output.writeln(output.dim('  Initializing swarm...'));
-                    execSync('npx @monomind/cli@latest swarm init --topology hierarchical', {
+                    execSync('npx monomind@latest swarm init --topology hierarchical', {
                         stdio: 'pipe',
                         cwd: ctx.cwd,
                         timeout: 30000
@@ -199,6 +207,42 @@ const initAction = async (ctx) => {
                     output.writeln(output.dim('  Swarm initialization skipped'));
                 }
             }
+            if (startAll) {
+                // Seed .monomind/metrics/ immediately instead of waiting for the
+                // first Claude Code session-restore hook to run these workers —
+                // running `monomind doctor` right after `init` (before ever opening
+                // Claude Code) otherwise always shows "Worker Metrics"/"Security
+                // Audit" as unconfigured, even though nothing is actually broken.
+                try {
+                    output.writeln(output.dim('  Seeding worker metrics...'));
+                    const hooksMod = await import('@monomind/hooks').catch(() => null);
+                    if (hooksMod && hooksMod.createWorkerManager) {
+                        const manager = hooksMod.createWorkerManager(ctx.cwd);
+                        await manager.ensureMetricsDir();
+                        const seeded = [];
+                        for (const workerName of ['map', 'audit']) {
+                            try {
+                                const r = await manager.runWorker(workerName);
+                                if (r.success)
+                                    seeded.push(workerName);
+                            }
+                            catch { /* best-effort — doctor will report if this stays missing */ }
+                        }
+                        if (seeded.length > 0) {
+                            output.writeln(output.success(`  ✓ Worker metrics seeded (${seeded.join(', ')})`));
+                        }
+                        else {
+                            output.writeln(output.dim('  Worker metrics seeding skipped'));
+                        }
+                    }
+                    else {
+                        output.writeln(output.dim('  Worker metrics seeding skipped (@monomind/hooks unavailable)'));
+                    }
+                }
+                catch (e) {
+                    output.writeln(output.dim(`  Worker metrics seeding skipped (${e instanceof Error ? e.message : String(e)})`));
+                }
+            }
             output.writeln();
             output.printSuccess('All services started');
         }
@@ -216,7 +260,7 @@ const initAction = async (ctx) => {
             try {
                 output.writeln(output.dim(`  Model: ${embeddingModel}`));
                 output.writeln(output.dim('  Hyperbolic: Enabled (Poincaré ball)'));
-                execFileSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['@monomind/cli@latest', 'embeddings', 'init', '--model', embeddingModel, '--no-download', '--force'], {
+                execFileSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['monomind@latest', 'embeddings', 'init', '--model', embeddingModel, '--no-download', '--force'], {
                     stdio: 'pipe',
                     cwd: ctx.cwd,
                     timeout: 30000

package/packages/@monomind/cli/dist/src/commands/swarm.js

@@ -517,8 +517,8 @@ const statusCommand = {
             output.writeln(output.warning('No active swarm'));
             output.writeln();
             output.writeln(output.dim('Start a swarm with:'));
-            output.writeln(output.dim('  npx @monomind/cli@latest swarm init'));
-            output.writeln(output.dim('  npx @monomind/cli@latest swarm start'));
+            output.writeln(output.dim('  npx monomind@latest swarm init'));
+            output.writeln(output.dim('  npx monomind@latest swarm start'));
             output.writeln();
             return { success: true, data: status };
         }

package/packages/@monomind/cli/dist/src/init/settings-generator.js

@@ -229,8 +229,15 @@ function generateHooksConfig(config, graphify = true) {
                 matcher: 'Write|Edit|MultiEdit',
                 hooks: [
                     {
+                        // Was 'pre-edit' — not a registered hook-handler.cjs dispatch
+                        // command (only 'pre-write' is), so this silently no-op'd on
+                        // every default init: hook-handler.cjs's dispatcher falls through
+                        // to `else if (command) { console.log('[OK] Hook: ' + command); }`
+                        // for any unrecognized subcommand, meaning the secrets-detection
+                        // gate (gates-handler.cjs's handlePreWrite) never actually ran
+                        // for any project set up via a default `monomind init`.
                         type: 'command',
-                        command: hookHandlerCmd('pre-edit'),
+                        command: hookHandlerCmd('pre-write'),
                         timeout: config.timeout,
                     },
                 ],

package/packages/@monomind/cli/dist/src/mcp-tools/terminal-tools.js

@@ -8,6 +8,33 @@ import { randomBytes } from 'node:crypto';
 const STORAGE_DIR = '.monomind';
 const TERMINAL_DIR = 'terminals';
 const TERMINAL_FILE = 'store.json';
+// ── Secret-shaped env var filtering for terminal_execute ────────────────────
+// terminal_execute runs arbitrary (metacharacter-denylisted) shell commands
+// via execSync with `env: { ...process.env, ...session.env }` — the host
+// process's real environment, which commonly holds provider API keys
+// (ANTHROPIC_API_KEY, OPENAI_API_KEY, ...), CI/VCS tokens, and cloud
+// credentials. A single unpiped command (the metacharacter denylist blocks
+// piping/chaining, but not e.g. `curl` or `aws` invoked directly) can still
+// read and exfiltrate whatever env vars it inherits. Stripping variables
+// whose *names* match common secret conventions is defense-in-depth: it
+// doesn't change legitimate terminal usage (PATH/HOME/etc. stay intact) but
+// meaningfully shrinks what a malicious or hijacked command can read by
+// default. Callers that genuinely need a specific secret can pass it via
+// terminal_create's `env` option, which flows through untouched (session.env
+// is layered on *after* the filtered process.env below).
+const SECRET_ENV_NAME_PATTERN = /(KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|_AUTH$|^AUTH_|PRIVATE_KEY|ACCESS_KEY)/i;
+/** Returns a copy of `env` with secret-shaped variable names removed. */
+function filterSecretEnvVars(env) {
+    const filtered = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (v === undefined)
+            continue;
+        if (SECRET_ENV_NAME_PATTERN.test(k))
+            continue;
+        filtered[k] = v;
+    }
+    return filtered;
+}
 function getTerminalDir() {
     return join(getProjectCwd(), STORAGE_DIR, TERMINAL_DIR);
 }
@@ -200,7 +227,7 @@ export const terminalTools = [
                     timeout,
                     maxBuffer: 5 * 1024 * 1024,
                     stdio: ['pipe', 'pipe', 'pipe'],
-                    env: { ...process.env, ...session.env },
+                    env: { ...filterSecretEnvVars(process.env), ...session.env },
                 });
                 exitCode = 0;
             }

package/packages/@monomind/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monoes/monomindcli",
-  "version": "2.1.9",
+  "version": "2.2.0",
   "type": "module",
   "description": "CLI engine for Monomind — an open-source MCP server that extends Claude Code with a codebase knowledge graph (tree-sitter + SQLite), persistent memory, multi-agent task coordination, and session hooks. MIT licensed, fully local.",
   "main": "dist/src/index.js",