monomind 2.7.11 → 2.7.12

package/packages/@monomind/cli/.claude/skills/monodesign/scripts/critique-storage.mjs

@@ -0,0 +1,416 @@
+#!/usr/bin/env node
+/**
+ * Critique persistence helper.
+ *
+ * Each critique run writes a per-target snapshot to
+ *   .monodesign/critique/<timestamp>__<slug>.md
+ * with a small YAML frontmatter carrying the score + P0/P1 counts.
+ *
+ * The polish workflow reads the latest matching snapshot at start as its
+ * fix backlog. No other skill auto-reads critique output.
+ *
+ * The slug is derived mechanically from the *resolved* primary artifact
+ * (file path or URL), never from the user's natural-language phrasing.
+ * Slug stability across runs is what lets the trend display work.
+ *
+ * CLI entry points (called from skill instructions):
+ *   node critique-storage.mjs slug <resolved-target>
+ *   node critique-storage.mjs write <slug> <snapshot-body-file>
+ *   node critique-storage.mjs latest <slug>
+ *   node critique-storage.mjs trend <slug> [limit]
+ *   node critique-storage.mjs recall <slug> [limit]
+ *
+ * `write` also best-effort mirrors a compact record of the snapshot into
+ * monomind's persistent memory (namespace `design-critique`) so design
+ * health survives across sessions. The mirror is fire-and-forget: if the
+ * monomind CLI is not installed it is skipped silently, and it can be
+ * disabled outright with MONODESIGN_NO_MEMORY=1.
+ *
+ * Note: there is intentionally no `ignore` subcommand. ignore.md is a plain
+ * markdown file; the model reads it directly with its file-read tool. This
+ * helper only exists for operations the model can't trivially do inline
+ * (normalizing paths, generating filenames, globbing + parsing frontmatter).
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { getCritiqueDir } from './lib/monodesign-paths.mjs';
+
+const SLUG_MAX = 50;
+
+/**
+ * Mechanically derive a slug from a resolved target. Returns null if the
+ * input doesn't look like a stable identifier (empty, project root, etc).
+ *
+ * Accepts file paths and URLs. The model resolves "the homepage" to a
+ * concrete artifact before calling this — we never slug a natural-language
+ * phrase.
+ */
+export function slugFromTarget(resolved, { cwd = process.cwd() } = {}) {
+  if (!resolved || typeof resolved !== 'string') return null;
+  const trimmed = resolved.trim();
+  if (!trimmed) return null;
+
+  // URL
+  if (/^https?:\/\//i.test(trimmed)) {
+    let url;
+    try { url = new URL(trimmed); } catch { return null; }
+    const hostPath = `${url.hostname}${url.pathname}`;
+    return kebab(hostPath);
+  }
+
+  // File path. Make it project-relative so two devs critiquing the same
+  // checkout get the same slug regardless of where their repo is cloned.
+  const abs = path.isAbsolute(trimmed) ? trimmed : path.resolve(cwd, trimmed);
+  let rel = path.relative(cwd, abs).split(path.sep).join('/');
+  // If the target is outside cwd, fall back to the basename so we still
+  // produce a stable slug (vs the absolute path, which would include
+  // home dirs / usernames).
+  if (rel.startsWith('..') || path.isAbsolute(rel)) {
+    rel = path.basename(abs);
+  }
+  if (!rel || rel === '.' || rel === '') return null;
+  return kebab(rel);
+}
+
+function kebab(s) {
+  const slug = s
+    .toLowerCase()
+    .replace(/[/\\.]+/g, '-')
+    .replace(/[^a-z0-9-]+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '');
+  if (!slug) return null;
+  // Cap from the tail — the tail (filename) is more identifying than the
+  // top-level directory.
+  return slug.length <= SLUG_MAX ? slug : slug.slice(slug.length - SLUG_MAX).replace(/^-/, '');
+}
+
+/**
+ * Filename-safe UTC ISO timestamp: hyphens for separators, trailing Z.
+ * Plain colons aren't allowed on Windows filesystems.
+ */
+export function nowFilenameStamp(date = new Date()) {
+  const iso = date.toISOString();           // 2026-05-12T18:30:00.123Z
+  return iso.replace(/[:.]/g, '-').replace(/-\d+Z$/, 'Z');
+}
+
+/**
+ * Write a snapshot for `slug`. `meta` carries the small structured frontmatter
+ * keys read back by readTrend(). `body` is the human-readable critique
+ * report (everything below the frontmatter).
+ *
+ * Returns the absolute path written.
+ */
+export function writeSnapshot({ slug, meta, body, cwd = process.cwd(), now = new Date() }) {
+  if (!slug) throw new Error('writeSnapshot requires a slug');
+  const dir = getCritiqueDir(cwd);
+  fs.mkdirSync(dir, { recursive: true });
+  const timestamp = nowFilenameStamp(now);
+  const filePath = path.join(dir, `${timestamp}__${slug}.md`);
+  // Spread `meta` first so internally computed `timestamp` and `slug`
+  // always win. Otherwise a caller-supplied meta blob (parsed from the
+  // MONODESIGN_CRITIQUE_META env var) could clobber them, leaving the
+  // filename in disagreement with its frontmatter and corrupting trends.
+  const front = serializeFrontmatter({ ...meta, timestamp, slug });
+  fs.writeFileSync(filePath, `${front}\n${body.trim()}\n`, 'utf-8');
+  return filePath;
+}
+
+function serializeFrontmatter(obj) {
+  const lines = ['---'];
+  for (const [key, value] of Object.entries(obj)) {
+    if (value === undefined || value === null) continue;
+    const str = typeof value === 'string' ? value : String(value);
+    // Quote strings that contain : or # to keep parsing simple.
+    const needsQuotes = typeof value === 'string' && /[:#]/.test(str);
+    lines.push(`${key}: ${needsQuotes ? JSON.stringify(str) : str}`);
+  }
+  lines.push('---');
+  return lines.join('\n');
+}
+
+function parseFrontmatter(text) {
+  const match = text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!match) return {};
+  const out = {};
+  for (const line of match[1].split(/\r?\n/)) {
+    const colon = line.indexOf(':');
+    if (colon < 0) continue;
+    const key = line.slice(0, colon).trim();
+    let value = line.slice(colon + 1).trim();
+    if (/^".*"$/.test(value)) {
+      try { value = JSON.parse(value); } catch { /* leave as-is */ }
+    } else if (/^-?\d+$/.test(value)) {
+      value = Number(value);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+/**
+ * Return all snapshot files for `slug`, sorted oldest → newest.
+ */
+function listSnapshotsForSlug(slug, cwd) {
+  const dir = getCritiqueDir(cwd);
+  if (!fs.existsSync(dir)) return [];
+  const suffix = `__${slug}.md`;
+  return fs.readdirSync(dir)
+    .filter((f) => f.endsWith(suffix))
+    .sort()
+    .map((f) => path.join(dir, f));
+}
+
+/**
+ * Return the most recent snapshot for `slug`, or null. Polish reads this
+ * to find its fix backlog when the slug matches.
+ */
+export function readLatestSnapshot(slug, { cwd = process.cwd() } = {}) {
+  const all = listSnapshotsForSlug(slug, cwd);
+  if (!all.length) return null;
+  const latest = all[all.length - 1];
+  const body = fs.readFileSync(latest, 'utf-8');
+  return { path: latest, body, meta: parseFrontmatter(body) };
+}
+
+/**
+ * Return the last `limit` snapshots' frontmatter, oldest → newest.
+ * Critique appends a one-line trend to its output using this.
+ */
+export function readTrend(slug, { limit = 5, cwd = process.cwd() } = {}) {
+  const all = listSnapshotsForSlug(slug, cwd);
+  const slice = all.slice(-limit);
+  return slice.map((file) => parseFrontmatter(fs.readFileSync(file, 'utf-8')));
+}
+
+// ---- Monomind memory mirror --------------------------------------------
+
+const asFiniteNumber = (v) => {
+  const n = Number(v);
+  return Number.isFinite(n) ? n : null;
+};
+
+/**
+ * Locate a locally installed monomind CLI bin by climbing from `cwd`.
+ * Returns null when none is installed — the caller then tries
+ * `npx --no-install`, which also fails fast (and silently) when absent.
+ */
+function resolveMonomindBin(cwd) {
+  const name = process.platform === 'win32' ? 'monomind.cmd' : 'monomind';
+  let dir = path.resolve(cwd);
+  for (;;) {
+    const bin = path.join(dir, 'node_modules', '.bin', name);
+    try {
+      fs.accessSync(bin, fs.constants.X_OK);
+      return bin;
+    } catch { /* keep climbing */ }
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+/**
+ * Best-effort mirror of a snapshot's structured metadata into monomind's
+ * persistent memory (namespace `design-critique`, key `<project>-<slug>`,
+ * upserted), so design health is queryable across sessions via
+ * `monomind memory search`. Never throws and never fails the critique flow:
+ * if the monomind CLI is unavailable the call is skipped silently.
+ * Kill-switch: MONODESIGN_NO_MEMORY=1.
+ */
+export function mirrorToMemory({ slug, meta = {}, filePath, cwd = process.cwd(), now = new Date(), env = process.env }) {
+  if (!slug) return { mirrored: false, reason: 'no-slug' };
+  if (env.MONODESIGN_NO_MEMORY === '1') return { mirrored: false, reason: 'disabled' };
+  try {
+    const record = {
+      score: asFiniteNumber(meta.total_score ?? meta.score),
+      p0: asFiniteNumber(meta.p0_count ?? meta.p0),
+      p1: asFiniteNumber(meta.p1_count ?? meta.p1),
+      date: now.toISOString(),
+      slug,
+      path: filePath ? path.relative(cwd, filePath).split(path.sep).join('/') : null,
+    };
+    const project = kebab(path.basename(path.resolve(cwd))) || 'project';
+    const key = `${project}-${slug}`;
+    const argv = [
+      'memory', 'store',
+      '--key', key,
+      '--value', JSON.stringify(record),
+      '--namespace', 'design-critique',
+      '--upsert',
+    ];
+    const bin = resolveMonomindBin(cwd);
+    const opts = { cwd, env, stdio: 'ignore', timeout: 15000 };
+    const run = bin
+      ? spawnSync(bin, argv, opts)
+      : spawnSync('npx', ['--no-install', 'monomind', ...argv], { ...opts, shell: process.platform === 'win32' });
+    if (run.error || run.status !== 0) return { mirrored: false, reason: 'cli-unavailable' };
+    return { mirrored: true, key };
+  } catch {
+    return { mirrored: false, reason: 'error' };
+  }
+}
+
+// ---- Recall (latest + trend + open items, one compact block) -----------
+
+/**
+ * Extract open issue titles tagged [P0] / [P1] from a snapshot body.
+ * Matches the critique report's "**[P?] What**: ..." lines, but tolerates
+ * loose formatting: any line containing `[P0]`/`[P1]` counts, with the
+ * title taken from the text after the tag (markdown emphasis stripped).
+ */
+export function extractIssueLines(body, { max = 8 } = {}) {
+  const issues = { p0: [], p1: [] };
+  if (!body || typeof body !== 'string') return issues;
+  // Drop frontmatter so metadata lines never masquerade as issues.
+  const text = body.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '');
+  for (const line of text.split(/\r?\n/)) {
+    const m = line.match(/\[(P0|P1)\]\s*(.*)/i);
+    if (!m) continue;
+    let title = m[2];
+    // "**[P0] Title**: explanation" → keep just the title.
+    const boldColon = title.indexOf('**:');
+    if (boldColon !== -1) title = title.slice(0, boldColon);
+    title = title.replace(/\*+/g, '').replace(/^[-–—\s]+/, '').replace(/[:\s]+$/, '').trim();
+    if (!title) continue;
+    const bucket = m[1].toUpperCase() === 'P0' ? issues.p0 : issues.p1;
+    if (bucket.length < max && !bucket.includes(title)) bucket.push(title);
+  }
+  return issues;
+}
+
+/**
+ * Direction of the last (up to) 3 finite scores: improving | declining |
+ * flat, or null when fewer than 2 scores exist.
+ */
+export function trendDirection(scores) {
+  const s = (scores || []).map(asFiniteNumber).filter((n) => n !== null).slice(-3);
+  if (s.length < 2) return null;
+  if (s[s.length - 1] > s[0]) return 'improving';
+  if (s[s.length - 1] < s[0]) return 'declining';
+  return 'flat';
+}
+
+/**
+ * Combined latest + trend + open-issue view for `slug`, or null when no
+ * snapshot exists. This backs the `recall` subcommand that polish/critique
+ * consume instead of separate latest+trend calls.
+ */
+export function readRecall(slug, { limit = 5, cwd = process.cwd() } = {}) {
+  const latest = readLatestSnapshot(slug, { cwd });
+  if (!latest) return null;
+  const trend = readTrend(slug, { limit, cwd });
+  const scores = trend.map((t) => asFiniteNumber(t.total_score ?? t.score));
+  return {
+    slug,
+    latest,
+    trend,
+    scores,
+    direction: trendDirection(scores),
+    issues: extractIssueLines(latest.body),
+  };
+}
+
+/** Render a recall result as a compact markdown block. */
+export function formatRecall(recall, { cwd = process.cwd() } = {}) {
+  const { slug, latest, trend, scores, direction, issues } = recall;
+  const meta = latest.meta;
+  const score = asFiniteNumber(meta.total_score ?? meta.score);
+  const p0 = asFiniteNumber(meta.p0_count ?? meta.p0);
+  const p1 = asFiniteNumber(meta.p1_count ?? meta.p1);
+  const lines = [`## Design health: \`${slug}\``];
+  lines.push(
+    `- Latest score: ${score !== null ? `${score}/40` : 'n/a'}`
+    + ` (P0: ${p0 ?? '?'}, P1: ${p1 ?? '?'})`
+    + (meta.timestamp ? ` — ${meta.timestamp}` : ''),
+  );
+  const arrows = scores.map((n) => (n === null ? '?' : n)).join(' → ');
+  lines.push(`- Trend (last ${trend.length}): ${arrows}${direction ? ` (${direction})` : ''}`);
+  if (issues.p0.length) {
+    lines.push('- Open P0:');
+    for (const t of issues.p0) lines.push(`  - ${t}`);
+  }
+  if (issues.p1.length) {
+    lines.push('- Open P1:');
+    for (const t of issues.p1) lines.push(`  - ${t}`);
+  }
+  if (!issues.p0.length && !issues.p1.length) {
+    lines.push('- No open P0/P1 lines found in the latest snapshot.');
+  }
+  lines.push(`- Snapshot: ${path.relative(cwd, latest.path).split(path.sep).join('/')}`);
+  return lines.join('\n');
+}
+
+// ---- CLI ---------------------------------------------------------------
+
+function main(argv) {
+  const [cmd, ...args] = argv;
+  switch (cmd) {
+    case 'slug': {
+      const slug = slugFromTarget(args[0]);
+      if (!slug) { process.stderr.write('no stable slug for input\n'); process.exit(1); }
+      process.stdout.write(`${slug}\n`);
+      return;
+    }
+    case 'write': {
+      const [slug, bodyFile] = args;
+      if (!slug || !bodyFile) { process.stderr.write('usage: write <slug> <body-file>\n'); process.exit(1); }
+      const raw = fs.readFileSync(bodyFile, 'utf-8');
+      // The body file may be a full report. The caller passes the meta as
+      // a JSON object on stdin if it wants structured frontmatter; otherwise
+      // we write with minimal metadata.
+      let meta = {};
+      const metaArg = process.env.MONODESIGN_CRITIQUE_META;
+      if (metaArg) {
+        try { meta = JSON.parse(metaArg); } catch { /* ignore */ }
+      }
+      const out = writeSnapshot({ slug, meta, body: raw });
+      // Best-effort cross-session mirror; must never break the critique flow.
+      mirrorToMemory({ slug, meta, filePath: out });
+      process.stdout.write(`${out}\n`);
+      return;
+    }
+    case 'latest': {
+      const latest = readLatestSnapshot(args[0]);
+      if (!latest) { process.exit(2); }
+      process.stdout.write(latest.body);
+      return;
+    }
+    case 'trend': {
+      const rows = readTrend(args[0], { limit: args[1] ? Number(args[1]) : 5 });
+      process.stdout.write(JSON.stringify(rows, null, 2) + '\n');
+      return;
+    }
+    case 'recall': {
+      const recall = readRecall(args[0], { limit: args[1] ? Number(args[1]) : 5 });
+      if (!recall) { process.exit(2); }
+      process.stdout.write(`${formatRecall(recall)}\n`);
+      return;
+    }
+    default:
+      process.stderr.write('usage: critique-storage.mjs <slug|write|latest|trend|recall> [args]\n');
+      process.exit(1);
+  }
+}
+
+function isMainModule() {
+  if (!process.argv[1]) return false;
+  try {
+    return fs.realpathSync(fileURLToPath(import.meta.url)) === fs.realpathSync(process.argv[1]);
+  } catch {
+    // pathToFileURL normalizes Windows paths; keep it as a fallback for any
+    // environment where realpath is unavailable.
+    return import.meta.url === pathToFileURL(process.argv[1]).href;
+  }
+}
+
+// Why the realpath check: generated skills are often reached through symlinked
+// harness directories (for example a demo repo's `.agents` -> source `.agents`).
+// Node resolves import.meta.url to the real file, while process.argv[1] keeps
+// the symlink path. Comparing canonical paths prevents a silent exit-0 no-op.
+if (isMainModule()) {
+  main(process.argv.slice(2));
+}

package/packages/@monomind/cli/.claude/skills/monodesign/scripts/detect-csp.mjs

@@ -0,0 +1,198 @@
+/**
+ * Scan a project tree for Content-Security-Policy signals and classify the
+ * shape so the agent knows which patch template to propose.
+ *
+ * Used at first-time `live.mjs` setup. Mechanical (grep-based) — no network,
+ * no dev server, no JS evaluation. The classification drives a user-facing
+ * consent prompt; the agent does the actual patch writing.
+ *
+ * Shapes are named by patch mechanism, not framework origin:
+ *   - "append-arrays":  CSP defined as structured directive arrays. Patch
+ *                       appends a dev-only localhost entry. Covers:
+ *                         - Monorepo helpers with additional*Src options
+ *                           (e.g. createBaseNextConfig for Next)
+ *                         - SvelteKit kit.csp.directives
+ *                         - nuxt-security module's contentSecurityPolicy
+ *   - "append-string":  CSP built as a literal value string. Patch splices
+ *                       a dev-only token into script-src and connect-src.
+ *                       Covers:
+ *                         - Inline Next.js headers() with CSP string
+ *                         - Nuxt routeRules / nitro.routeRules CSP headers
+ *   - "middleware":     CSP set dynamically in middleware.{ts,js}.
+ *                       Detected but not auto-patched in v1.
+ *   - "meta-tag":       <meta http-equiv="Content-Security-Policy"> in
+ *                       layout files. Detected but not auto-patched in v1.
+ *   - null:             no CSP signals found; no patch needed.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+const SKIP_DIRS = new Set([
+  'node_modules',
+  '.git',
+  '.next',
+  '.turbo',
+  '.svelte-kit',
+  '.nuxt',
+  '.astro',
+  'dist',
+  'build',
+  'out',
+  '.vercel',
+]);
+
+const SCAN_EXTS = new Set(['.js', '.mjs', '.cjs', '.ts', '.mts', '.cts', '.tsx', '.jsx']);
+const LAYOUT_EXTS = new Set(['.tsx', '.jsx', '.astro', '.vue', '.svelte', '.html']);
+const MAX_DEPTH = 6;
+const MAX_READ_BYTES = 64 * 1024;
+
+// append-arrays signals: CSP expressed as structured directive arrays
+const MONOREPO_HELPER_SIGNALS = [
+  /\bbuildCSPConfig\b/,
+  /\bbuildSecurityHeaders\b/,
+  /\badditionalScriptSrc\b/,
+  /\badditionalConnectSrc\b/,
+  /\bcreateBaseNextConfig\b/,
+];
+const SVELTEKIT_CSP_SIGNALS = [
+  /\bkit\s*:/,
+  /\bcsp\s*:/,
+  /\bdirectives\s*:/,
+];
+const NUXT_SECURITY_SIGNALS = [
+  /['"]nuxt-security['"]/,
+  /\bcontentSecurityPolicy\b/,
+];
+
+// append-string signals: CSP written as a literal value string
+const INLINE_HEADER_SIGNALS = [
+  /["']Content-Security-Policy["']/i,
+  /\bscript-src\b/,
+  /\bconnect-src\b/,
+];
+const NUXT_ROUTE_RULES_SIGNALS = [
+  /\brouteRules\b/,
+  /Content-Security-Policy/i,
+  /\bscript-src\b/,
+];
+
+const MIDDLEWARE_HINT = /headers\.set\(\s*["']Content-Security-Policy["']/i;
+const META_TAG_HINT = /http-equiv\s*=\s*["']Content-Security-Policy["']/i;
+
+/**
+ * @param {string} cwd Project root.
+ * @returns {{ shape: string|null, signals: string[] }}
+ */
+export function detectCsp(cwd = process.cwd()) {
+  const hits = { appendArrays: [], appendString: [], middleware: [], metaTag: [] };
+
+  walk(cwd, cwd, 0, (absPath, relPath, body) => {
+    const ext = path.extname(absPath);
+    const base = path.basename(absPath).toLowerCase();
+    const isConfig = (name) =>
+      new RegExp('(^|/)' + name + '\\.config\\.').test(relPath);
+
+    // === append-arrays candidates ===
+
+    // Monorepo CSP helper: packages/*/src/.../(config|security)/*
+    if (SCAN_EXTS.has(ext) &&
+        /packages\/[^/]+\/src\/.*(config|next-config|security)/.test(relPath) &&
+        MONOREPO_HELPER_SIGNALS.some((re) => re.test(body))) {
+      hits.appendArrays.push(relPath);
+      return;
+    }
+
+    // SvelteKit kit.csp.directives
+    if (SCAN_EXTS.has(ext) && isConfig('svelte') &&
+        SVELTEKIT_CSP_SIGNALS.every((re) => re.test(body))) {
+      hits.appendArrays.push(relPath);
+      return;
+    }
+
+    // Nuxt nuxt-security module
+    if (SCAN_EXTS.has(ext) && isConfig('nuxt') &&
+        NUXT_SECURITY_SIGNALS.every((re) => re.test(body))) {
+      hits.appendArrays.push(relPath);
+      return;
+    }
+
+    // === append-string candidates ===
+
+    // Inline headers in Next/Nuxt/SvelteKit/Astro/Vite config
+    if (SCAN_EXTS.has(ext) &&
+        /(^|\/)(next|nuxt|vite|astro|svelte)\.config\./.test(relPath) &&
+        INLINE_HEADER_SIGNALS.every((re) => re.test(body))) {
+      // Nuxt routeRules is a sub-shape of append-string; we already covered
+      // nuxt-security above via return, so any remaining Nuxt CSP match here
+      // is a route-rules / inline-headers case. Either way, same patch
+      // mechanism.
+      hits.appendString.push(relPath);
+      return;
+    }
+
+    // === detect-only shapes ===
+
+    if ((base === 'middleware.ts' || base === 'middleware.js' || base === 'middleware.mjs') &&
+        MIDDLEWARE_HINT.test(body)) {
+      hits.middleware.push(relPath);
+    }
+
+    if (LAYOUT_EXTS.has(ext) && META_TAG_HINT.test(body)) {
+      hits.metaTag.push(relPath);
+    }
+  });
+
+  // Priority: append-arrays > append-string > middleware > meta-tag.
+  // Structured patches are safer than string splices; runtime and HTML
+  // injection patches are less reliable and v1 doesn't auto-apply them.
+  if (hits.appendArrays.length > 0) {
+    return { shape: 'append-arrays', signals: hits.appendArrays };
+  }
+  if (hits.appendString.length > 0) {
+    return { shape: 'append-string', signals: hits.appendString };
+  }
+  if (hits.middleware.length > 0) {
+    return { shape: 'middleware', signals: hits.middleware };
+  }
+  if (hits.metaTag.length > 0) {
+    return { shape: 'meta-tag', signals: hits.metaTag };
+  }
+  return { shape: null, signals: [] };
+}
+
+function walk(root, dir, depth, visit) {
+  if (depth > MAX_DEPTH) return;
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
+  catch { return; }
+
+  for (const entry of entries) {
+    const abs = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue;
+      walk(root, abs, depth + 1, visit);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const ext = path.extname(entry.name);
+    if (!SCAN_EXTS.has(ext) && !LAYOUT_EXTS.has(ext)) continue;
+    let body;
+    try {
+      const fd = fs.openSync(abs, 'r');
+      try {
+        const buf = Buffer.alloc(MAX_READ_BYTES);
+        const n = fs.readSync(fd, buf, 0, MAX_READ_BYTES, 0);
+        body = buf.slice(0, n).toString('utf-8');
+      } finally { fs.closeSync(fd); }
+    } catch { continue; }
+    visit(abs, path.relative(root, abs).split(path.sep).join('/'), body);
+  }
+}
+
+// CLI mode
+const _running = process.argv[1];
+if (_running?.endsWith('detect-csp.mjs') || _running?.endsWith('detect-csp.mjs/')) {
+  const result = detectCsp(process.cwd());
+  console.log(JSON.stringify(result, null, 2));
+}

package/packages/@monomind/cli/.claude/skills/monodesign/scripts/detect.mjs

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { pathToFileURL, fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+// Packaged fallback: resolve the engine from an installed @monoes/monodesign.
+function packagedDetectorPath() {
+  try {
+    return createRequire(import.meta.url).resolve('@monoes/monodesign/engine');
+  } catch {
+    return null;
+  }
+}
+
+const candidates = [
+  path.join(__dirname, 'detector', 'detect-antipatterns.mjs'),
+  path.join(__dirname, '..', '..', 'cli', 'engine', 'detect-antipatterns.mjs'),
+  packagedDetectorPath(),
+].filter(Boolean);
+const detectorPath = candidates.find(p => fs.existsSync(p));
+
+if (!detectorPath) {
+  process.stderr.write('Error: bundled detector not found.\n');
+  process.exit(1);
+}
+
+const { detectCli } = await import(pathToFileURL(detectorPath));
+
+await detectCli();