monomind 2.7.11 → 2.7.13

package/packages/@monomind/cli/dist/src/ui/sse-manager.mjs

@@ -1,119 +0,0 @@
-/**
- * sse-manager.mjs — SSE client registries and broadcasting
- *
- * Owns the two SSE client Sets that were previously module-level state in
- * server.mjs:
- *   - sseClients    — general dashboard stream (/api/stream)
- *   - mmSseClients  — mastermind real-time event stream (/api/mastermind-stream)
- *
- * Extracted from server.mjs as Module 1 of the modularization plan.
- * See MODULARIZATION_PLAN.md for the full extraction sequence.
- */
-
-// ── SSE client registries ─────────────────────────────────────────────────────
-
-/** Connected clients for the general /api/stream SSE endpoint. */
-const sseClients = new Set();
-
-/** Connected clients for the /api/mastermind-stream SSE endpoint. */
-const mmSseClients = new Set();
-
-// ── General SSE (sseClients) ──────────────────────────────────────────────────
-
-/**
- * Register a response object as a general SSE client.
- * @param {import('http').ServerResponse} res
- */
-export function addSseClient(res) {
-  sseClients.add(res);
-}
-
-/**
- * Remove a response object from the general SSE client registry.
- * @param {import('http').ServerResponse} res
- */
-export function removeSseClient(res) {
-  sseClients.delete(res);
-}
-
-/**
- * Broadcast a data payload to all connected general SSE clients.
- * Silently removes clients that have disconnected.
- * @param {object} data
- */
-export function broadcast(data) {
-  const msg = `data: ${JSON.stringify(data)}\n\n`;
-  for (const client of sseClients) {
-    try {
-      client.write(msg);
-    } catch {
-      sseClients.delete(client);
-    }
-  }
-}
-
-/**
- * Return the number of connected general SSE clients.
- * @returns {number}
- */
-export function getSseClientCount() {
-  return sseClients.size;
-}
-
-/**
- * Close all general SSE connections (called on server shutdown).
- */
-export function closeSseClients() {
-  for (const client of sseClients) {
-    try {
-      client.end();
-    } catch {
-      // Already ended
-    }
-  }
-  sseClients.clear();
-}
-
-// ── Mastermind SSE (mmSseClients) ─────────────────────────────────────────────
-
-/**
- * Register a response object as a mastermind SSE client.
- * @param {import('http').ServerResponse} res
- */
-export function addMmClient(res) {
-  mmSseClients.add(res);
-}
-
-/**
- * Remove a response object from the mastermind SSE client registry.
- * @param {import('http').ServerResponse} res
- */
-export function removeMmClient(res) {
-  mmSseClients.delete(res);
-}
-
-/**
- * Broadcast a raw JSON-stringified event line to all mastermind SSE clients.
- * Accepts a pre-serialized string (to match the JSONL-replay path in server.mjs
- * which passes raw line strings) or a data object (auto-serialized).
- * @param {string|object} lineOrData
- */
-export function broadcastMm(lineOrData) {
-  const line = typeof lineOrData === 'string' ? lineOrData : JSON.stringify(lineOrData);
-  const msg = `data: ${line}\n\n`;
-  for (const c of mmSseClients) {
-    try {
-      c.write(msg);
-    } catch {
-      mmSseClients.delete(c);
-    }
-  }
-}
-
-/**
- * Return the number of connected mastermind SSE clients.
- * @returns {number}
- */
-export function getMmClientCount() {
-  return mmSseClients.size;
-}

package/packages/@monomind/cli/dist/src/update/checker.d.ts

@@ -1,34 +0,0 @@
-/**
- * Update checker for @monomind packages
- * Queries npm registry and compares versions
- */
-export interface UpdateCheckResult {
-    package: string;
-    currentVersion: string;
-    latestVersion: string;
-    updateType: 'major' | 'minor' | 'patch' | 'none';
-    shouldAutoUpdate: boolean;
-    priority: 'critical' | 'high' | 'normal' | 'low';
-    changelog?: string;
-}
-export interface UpdateConfig {
-    enabled: boolean;
-    checkIntervalHours: number;
-    autoUpdate: {
-        patch: boolean;
-        minor: boolean;
-        major: boolean;
-    };
-    priority: Record<string, 'critical' | 'high' | 'normal' | 'low'>;
-    exclude: string[];
-}
-declare const DEFAULT_CONFIG: UpdateConfig;
-export declare function getInstalledVersion(packageName: string): string | null;
-export declare function checkForUpdates(config?: UpdateConfig): Promise<{
-    results: UpdateCheckResult[];
-    skipped: boolean;
-    reason?: string;
-}>;
-export declare function checkSinglePackage(packageName: string, config?: UpdateConfig): Promise<UpdateCheckResult | null>;
-export { DEFAULT_CONFIG };
-//# sourceMappingURL=checker.d.ts.map

package/packages/@monomind/cli/dist/src/update/checker.js

@@ -1,278 +0,0 @@
-/**
- * Update checker for @monomind packages
- * Queries npm registry and compares versions
- */
-import { createRequire } from 'module';
-import { execFileSync } from 'child_process';
-// Inline semver shim — avoids external dependency
-const semver = {
-    valid: (v) => /^\d+\.\d+\.\d+/.test(v || '') ? v : null,
-    eq: (a, b) => a === b,
-    major: (v) => parseInt((v || '0').split('.')[0], 10),
-    minor: (v) => parseInt((v || '0').split('.')[1] || '0', 10),
-    patch: (v) => parseInt(((v || '0').split('.')[2] || '0').replace(/[^0-9].*/, ''), 10),
-    gt: (a, b) => {
-        const [aMaj, aMin, aPat] = (a || '0').split('.').map(n => parseInt(n, 10) || 0);
-        const [bMaj, bMin, bPat] = (b || '0').split('.').map(n => parseInt(n, 10) || 0);
-        return aMaj !== bMaj ? aMaj > bMaj : aMin !== bMin ? aMin > bMin : aPat > bPat;
-    },
-};
-import { reserveCheck, recordCheck, getCachedVersions } from './rate-limiter.js';
-const require = createRequire(import.meta.url);
-const DEFAULT_CONFIG = {
-    enabled: true,
-    checkIntervalHours: 24,
-    autoUpdate: {
-        patch: true,
-        minor: false,
-        major: false,
-    },
-    priority: {
-        'monofence-ai': 'critical',
-        '@monoes/monomindcli': 'high',
-        'monomind': 'high',
-        '@monoes/monograph': 'normal',
-        '@monoes/memory': 'normal',
-        '@monoes/monodesign': 'low',
-    },
-    exclude: [],
-};
-// All monomind-ecosystem packages to check for updates.
-// getInstalledVersion() returns null for uninstalled packages — they are silently skipped.
-const MONOMIND_PACKAGES = [
-    'monomind',
-    '@monoes/monomindcli',
-    'monofence-ai',
-    '@monoes/monograph',
-    '@monoes/memory',
-    '@monoes/monodesign',
-    '@monoes/hooks',
-    '@monoes/mcp',
-    '@monoes/routing',
-];
-// npm package name regex — covers plain names and @scope/name forms.
-// Validates before using the name in URLs or filesystem paths.
-const NPM_NAME_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i;
-function isValidNpmName(name) {
-    return NPM_NAME_RE.test(name) && !name.includes('..') && name.length <= 214;
-}
-// Cap registry response at 5 MB. The full npm registry payload for a package
-// can include the entire `versions` object (dozens of version entries with
-// dist/scripts/dependencies for each). A spoofed or compromised registry
-// endpoint could stream an arbitrarily large body; AbortSignal.timeout(5000)
-// only enforces a wall-clock deadline and does NOT cap bytes. Without this
-// cap, fetchPackageInfo will buffer an unbounded body into memory (OOM).
-const MAX_REGISTRY_RESPONSE_BYTES = 5 * 1024 * 1024; // 5 MB
-async function fetchPackageInfo(packageName) {
-    if (!isValidNpmName(packageName))
-        return null;
-    try {
-        const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
-            headers: { Accept: 'application/json' },
-            signal: AbortSignal.timeout(5000),
-        });
-        if (!response.ok) {
-            return null;
-        }
-        // Reject immediately if Content-Length header exceeds cap
-        const contentLength = response.headers.get('content-length');
-        if (contentLength) {
-            const declared = parseInt(contentLength, 10);
-            if (Number.isFinite(declared) && declared > MAX_REGISTRY_RESPONSE_BYTES) {
-                return null;
-            }
-        }
-        // Stream body and enforce byte cap — prevents OOM if the server streams
-        // a large body that evades the Content-Length check (missing/wrong header).
-        if (!response.body)
-            return null;
-        const reader = response.body.getReader();
-        const chunks = [];
-        let totalBytes = 0;
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            if (value) {
-                totalBytes += value.byteLength;
-                if (totalBytes > MAX_REGISTRY_RESPONSE_BYTES) {
-                    await reader.cancel();
-                    return null;
-                }
-                chunks.push(value);
-            }
-        }
-        const buf = new Uint8Array(totalBytes);
-        let offset = 0;
-        for (const chunk of chunks) {
-            buf.set(chunk, offset);
-            offset += chunk.byteLength;
-        }
-        const text = new TextDecoder('utf-8').decode(buf);
-        return JSON.parse(text);
-    }
-    catch {
-        return null;
-    }
-}
-function getUpdateType(current, latest) {
-    if (!semver.valid(current) || !semver.valid(latest)) {
-        return 'none';
-    }
-    // Not an upgrade (equal or downgrade)
-    if (!semver.gt(latest, current)) {
-        return 'none';
-    }
-    if (semver.major(latest) > semver.major(current)) {
-        return 'major';
-    }
-    if (semver.minor(latest) > semver.minor(current)) {
-        return 'minor';
-    }
-    return 'patch';
-}
-function shouldAutoUpdate(updateType, priority, config) {
-    if (updateType === 'none')
-        return false;
-    // Critical security packages always auto-update patches and minors
-    if (priority === 'critical' && (updateType === 'patch' || updateType === 'minor')) {
-        return true;
-    }
-    // Check config
-    if (updateType === 'major')
-        return config.autoUpdate.major;
-    if (updateType === 'minor')
-        return config.autoUpdate.minor;
-    if (updateType === 'patch')
-        return config.autoUpdate.patch;
-    return false;
-}
-export function getInstalledVersion(packageName) {
-    if (!isValidNpmName(packageName))
-        return null;
-    try {
-        // Attempt 1: let Node resolve from any search path (covers local and global installs)
-        try {
-            const resolved = require.resolve(`${packageName}/package.json`);
-            const pkg = require(resolved);
-            if (pkg.version)
-                return pkg.version;
-        }
-        catch { /* not on default paths */ }
-        // Attempt 2: resolve from cwd (monorepo / workspace installs)
-        const cwdPaths = [
-            `${packageName}/package.json`,
-            `../../node_modules/${packageName}/package.json`,
-            `../../../node_modules/${packageName}/package.json`,
-        ];
-        for (const modulePath of cwdPaths) {
-            try {
-                const resolved = require.resolve(modulePath, { paths: [process.cwd()] });
-                const pkg = require(resolved);
-                if (pkg.version)
-                    return pkg.version;
-            }
-            catch {
-                continue;
-            }
-        }
-        // Attempt 3: npm global prefix (covers `npm i -g monomind`)
-        try {
-            const prefix = execFileSync('npm', ['prefix', '-g'], { encoding: 'utf8', timeout: 3000 }).trim();
-            const globalPkg = require(require.resolve(`${packageName}/package.json`, { paths: [`${prefix}/lib/node_modules`] }));
-            if (globalPkg.version)
-                return globalPkg.version;
-        }
-        catch { /* no global install or npm unavailable */ }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-export async function checkForUpdates(config = DEFAULT_CONFIG) {
-    // Check rate limit and atomically reserve this check slot
-    const rateCheck = reserveCheck(config.checkIntervalHours);
-    if (!rateCheck.allowed) {
-        // Return cached results if available
-        const cached = getCachedVersions();
-        if (Object.keys(cached).length > 0) {
-            return {
-                results: [],
-                skipped: true,
-                reason: rateCheck.reason,
-            };
-        }
-        return { results: [], skipped: true, reason: rateCheck.reason };
-    }
-    const results = [];
-    const versionCache = {};
-    // Check each package
-    const packagesToCheck = MONOMIND_PACKAGES.filter((pkg) => !config.exclude.includes(pkg));
-    // Sort by priority (critical first)
-    const priorityOrder = { critical: 0, high: 1, normal: 2, low: 3 };
-    packagesToCheck.sort((a, b) => {
-        const pa = config.priority[a] || 'normal';
-        const pb = config.priority[b] || 'normal';
-        return priorityOrder[pa] - priorityOrder[pb];
-    });
-    await Promise.all(packagesToCheck.map(async (packageName) => {
-        const currentVersion = getInstalledVersion(packageName);
-        if (!currentVersion) {
-            // Package not installed, skip
-            return;
-        }
-        const info = await fetchPackageInfo(packageName);
-        if (!info) {
-            return;
-        }
-        const latestVersion = info['dist-tags']?.latest;
-        if (!latestVersion) {
-            return;
-        }
-        versionCache[packageName] = latestVersion;
-        const updateType = getUpdateType(currentVersion, latestVersion);
-        const priority = config.priority[packageName] || 'normal';
-        results.push({
-            package: packageName,
-            currentVersion,
-            latestVersion,
-            updateType,
-            priority,
-            shouldAutoUpdate: shouldAutoUpdate(updateType, priority, config),
-        });
-    }));
-    // Record this check
-    recordCheck(versionCache);
-    // Filter to only updates available
-    const updates = results.filter((r) => r.updateType !== 'none');
-    return { results: updates, skipped: false };
-}
-export async function checkSinglePackage(packageName, config = DEFAULT_CONFIG) {
-    if (!isValidNpmName(packageName))
-        return null;
-    const currentVersion = getInstalledVersion(packageName);
-    if (!currentVersion) {
-        return null;
-    }
-    const info = await fetchPackageInfo(packageName);
-    if (!info) {
-        return null;
-    }
-    const latestVersion = info['dist-tags']?.latest;
-    if (!latestVersion) {
-        return null;
-    }
-    const updateType = getUpdateType(currentVersion, latestVersion);
-    const priority = config.priority[packageName] || 'normal';
-    return {
-        package: packageName,
-        currentVersion,
-        latestVersion,
-        updateType,
-        priority,
-        shouldAutoUpdate: shouldAutoUpdate(updateType, priority, config),
-    };
-}
-export { DEFAULT_CONFIG };
-//# sourceMappingURL=checker.js.map

package/packages/@monomind/cli/dist/src/update/executor.d.ts

@@ -1,32 +0,0 @@
-/**
- * Update executor - performs actual package updates
- * Includes rollback capability
- */
-import { UpdateCheckResult } from './checker.js';
-import { ValidationResult } from './validator.js';
-export interface UpdateHistoryEntry {
-    timestamp: string;
-    package: string;
-    fromVersion: string;
-    toVersion: string;
-    success: boolean;
-    error?: string;
-    rollbackAvailable: boolean;
-}
-export interface UpdateExecutionResult {
-    success: boolean;
-    package: string;
-    version: string;
-    error?: string;
-    validation: ValidationResult;
-}
-export declare function loadHistory(): UpdateHistoryEntry[];
-export declare function executeUpdate(update: UpdateCheckResult, installedPackages: Record<string, string>, dryRun?: boolean): Promise<UpdateExecutionResult>;
-export declare function executeMultipleUpdates(updates: UpdateCheckResult[], installedPackages: Record<string, string>, dryRun?: boolean): Promise<UpdateExecutionResult[]>;
-export declare function rollbackUpdate(packageName?: string): Promise<{
-    success: boolean;
-    message: string;
-}>;
-export declare function getUpdateHistory(limit?: number): UpdateHistoryEntry[];
-export declare function clearHistory(): void;
-//# sourceMappingURL=executor.d.ts.map

package/packages/@monomind/cli/dist/src/update/executor.js

@@ -1,235 +0,0 @@
-/**
- * Update executor - performs actual package updates
- * Includes rollback capability
- */
-import { execFile } from 'child_process';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-import { validateUpdate } from './validator.js';
-// Inline semver shim — avoids external dependency (semver is not in package.json)
-const semver = {
-    valid: (v) => /^\d+\.\d+\.\d+/.test(v || '') ? v : null,
-};
-/**
- * Validate a npm package name.
- * Allows scoped (@scope/name) and unscoped names; rejects path-traversal,
- * shell metacharacters, and names that are too long to be legitimate.
- * See https://docs.npmjs.com/cli/v9/configuring-npm/package-json#name
- */
-function isValidPackageName(name) {
-    if (typeof name !== 'string' || name.length === 0 || name.length > 214)
-        return false;
-    // Scoped: @scope/name — both parts: lowercase alnum + hyphens + underscores + dots
-    if (name.startsWith('@')) {
-        return /^@[a-z0-9][a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*$/.test(name);
-    }
-    // Unscoped: must not start with . or _ (legacy rule)
-    return /^[a-z0-9][a-z0-9_.-]*$/.test(name);
-}
-/** Max bytes we will read from the on-disk update history file. */
-const MAX_HISTORY_FILE_BYTES = 1 * 1024 * 1024; // 1 MB
-function execFileAsync(cmd, args) {
-    return new Promise((resolve, reject) => execFile(cmd, args, (err) => (err ? reject(err) : resolve())));
-}
-const HISTORY_FILE = path.join(os.homedir(), '.monomind', 'update-history.json');
-const MAX_HISTORY_ENTRIES = 100;
-function ensureDir() {
-    const dir = path.dirname(HISTORY_FILE);
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true });
-    }
-}
-export function loadHistory() {
-    try {
-        if (fs.existsSync(HISTORY_FILE)) {
-            // Guard against a bloated or attacker-crafted history file causing OOM.
-            const stat = fs.statSync(HISTORY_FILE);
-            if (stat.size > MAX_HISTORY_FILE_BYTES) {
-                return [];
-            }
-            const content = fs.readFileSync(HISTORY_FILE, 'utf-8');
-            const raw = JSON.parse(content);
-            if (!Array.isArray(raw))
-                return [];
-            // Sanitize each entry: reject any entry whose package name or version
-            // fails validation so that a tampered history file cannot inject
-            // arbitrary arguments into a subsequent npm install via rollbackUpdate().
-            return raw.filter((e) => {
-                if (typeof e !== 'object' || e === null)
-                    return false;
-                if (typeof e.package !== 'string' || !isValidPackageName(e.package))
-                    return false;
-                if (typeof e.fromVersion !== 'string' || !semver.valid(e.fromVersion))
-                    return false;
-                if (typeof e.toVersion !== 'string' || !semver.valid(e.toVersion))
-                    return false;
-                return true;
-            });
-        }
-    }
-    catch (e) {
-        // Corrupted file
-        if (process.env.DEBUG || process.env.MONOMIND_DEBUG)
-            console.error('[update-executor] loadHistory failed:', e);
-    }
-    return [];
-}
-function saveHistory(history) {
-    ensureDir();
-    // Keep only last N entries
-    const trimmed = history.slice(-MAX_HISTORY_ENTRIES);
-    const tmp = HISTORY_FILE + '.tmp';
-    fs.writeFileSync(tmp, JSON.stringify(trimmed, null, 2));
-    fs.renameSync(tmp, HISTORY_FILE);
-}
-function recordUpdate(entry) {
-    const history = loadHistory();
-    history.push(entry);
-    saveHistory(history);
-}
-export async function executeUpdate(update, installedPackages, dryRun = false) {
-    // Validate first
-    const validation = validateUpdate(update.package, update.currentVersion, update.latestVersion, installedPackages);
-    if (!validation.valid) {
-        return {
-            success: false,
-            package: update.package,
-            version: update.latestVersion,
-            error: `Validation failed: ${validation.incompatibilities.join(', ')}`,
-            validation,
-        };
-    }
-    if (dryRun) {
-        return {
-            success: true,
-            package: update.package,
-            version: update.latestVersion,
-            validation,
-        };
-    }
-    try {
-        // Execute npm install — use execFile to avoid shell injection
-        const pkg = update.package;
-        const version = update.latestVersion;
-        // Validate both package name and version before constructing the npm arg
-        // to prevent argument injection via a crafted UpdateCheckResult.
-        if (!isValidPackageName(pkg)) {
-            throw new Error(`Invalid package name: ${pkg}`);
-        }
-        if (!semver.valid(version)) {
-            throw new Error(`Invalid version: ${version}`);
-        }
-        await execFileAsync('npm', ['install', `${pkg}@${version}`, '--save-exact']);
-        // Record successful update
-        recordUpdate({
-            timestamp: new Date().toISOString(),
-            package: update.package,
-            fromVersion: update.currentVersion,
-            toVersion: update.latestVersion,
-            success: true,
-            rollbackAvailable: true,
-        });
-        return {
-            success: true,
-            package: update.package,
-            version: update.latestVersion,
-            validation,
-        };
-    }
-    catch (error) {
-        const err = error;
-        // Record failed update
-        recordUpdate({
-            timestamp: new Date().toISOString(),
-            package: update.package,
-            fromVersion: update.currentVersion,
-            toVersion: update.latestVersion,
-            success: false,
-            error: err.message,
-            rollbackAvailable: false,
-        });
-        return {
-            success: false,
-            package: update.package,
-            version: update.latestVersion,
-            error: err.message,
-            validation,
-        };
-    }
-}
-export async function executeMultipleUpdates(updates, installedPackages, dryRun = false) {
-    const results = [];
-    // Execute updates sequentially to avoid conflicts
-    for (const update of updates) {
-        const result = await executeUpdate(update, installedPackages, dryRun);
-        results.push(result);
-        // Update installed packages for next validation
-        if (result.success) {
-            installedPackages[update.package] = update.latestVersion;
-        }
-        // Stop on critical failures
-        if (!result.success && update.priority === 'critical') {
-            break;
-        }
-    }
-    return results;
-}
-export async function rollbackUpdate(packageName) {
-    const history = loadHistory();
-    if (history.length === 0) {
-        return { success: false, message: 'No update history available' };
-    }
-    // Find the last successful update for this package (or any if not specified)
-    const reversed = [...history].reverse();
-    const lastUpdate = packageName
-        ? reversed.find((h) => h.package === packageName && h.success && h.rollbackAvailable)
-        : reversed.find((h) => h.success && h.rollbackAvailable);
-    if (!lastUpdate) {
-        return {
-            success: false,
-            message: packageName
-                ? `No rollback available for ${packageName}`
-                : 'No rollback available',
-        };
-    }
-    try {
-        // Install the previous version — use execFile to avoid shell injection
-        const pkg = lastUpdate.package;
-        const version = lastUpdate.fromVersion;
-        if (!semver.valid(version)) {
-            throw new Error(`Invalid version: ${version}`);
-        }
-        await execFileAsync('npm', ['install', `${pkg}@${version}`, '--save-exact']);
-        // Record the rollback
-        recordUpdate({
-            timestamp: new Date().toISOString(),
-            package: lastUpdate.package,
-            fromVersion: lastUpdate.toVersion,
-            toVersion: lastUpdate.fromVersion,
-            success: true,
-            rollbackAvailable: false, // Can't rollback a rollback
-        });
-        return {
-            success: true,
-            message: `Rolled back ${lastUpdate.package} from ${lastUpdate.toVersion} to ${lastUpdate.fromVersion}`,
-        };
-    }
-    catch (error) {
-        const err = error;
-        return {
-            success: false,
-            message: `Rollback failed: ${err.message}`,
-        };
-    }
-}
-export function getUpdateHistory(limit = 20) {
-    const history = loadHistory();
-    return history.slice(-limit).reverse();
-}
-export function clearHistory() {
-    if (fs.existsSync(HISTORY_FILE)) {
-        fs.unlinkSync(HISTORY_FILE);
-    }
-}
-//# sourceMappingURL=executor.js.map