monomind 2.7.3 → 2.7.5

package/packages/@monomind/cli/.claude/skills/monodesign/scripts/critique-storage.mjs

@@ -1,416 +0,0 @@
-#!/usr/bin/env node
-/**
- * Critique persistence helper.
- *
- * Each critique run writes a per-target snapshot to
- *   .monodesign/critique/<timestamp>__<slug>.md
- * with a small YAML frontmatter carrying the score + P0/P1 counts.
- *
- * The polish workflow reads the latest matching snapshot at start as its
- * fix backlog. No other skill auto-reads critique output.
- *
- * The slug is derived mechanically from the *resolved* primary artifact
- * (file path or URL), never from the user's natural-language phrasing.
- * Slug stability across runs is what lets the trend display work.
- *
- * CLI entry points (called from skill instructions):
- *   node critique-storage.mjs slug <resolved-target>
- *   node critique-storage.mjs write <slug> <snapshot-body-file>
- *   node critique-storage.mjs latest <slug>
- *   node critique-storage.mjs trend <slug> [limit]
- *   node critique-storage.mjs recall <slug> [limit]
- *
- * `write` also best-effort mirrors a compact record of the snapshot into
- * monomind's persistent memory (namespace `design-critique`) so design
- * health survives across sessions. The mirror is fire-and-forget: if the
- * monomind CLI is not installed it is skipped silently, and it can be
- * disabled outright with MONODESIGN_NO_MEMORY=1.
- *
- * Note: there is intentionally no `ignore` subcommand. ignore.md is a plain
- * markdown file; the model reads it directly with its file-read tool. This
- * helper only exists for operations the model can't trivially do inline
- * (normalizing paths, generating filenames, globbing + parsing frontmatter).
- */
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { getCritiqueDir } from './lib/monodesign-paths.mjs';
-
-const SLUG_MAX = 50;
-
-/**
- * Mechanically derive a slug from a resolved target. Returns null if the
- * input doesn't look like a stable identifier (empty, project root, etc).
- *
- * Accepts file paths and URLs. The model resolves "the homepage" to a
- * concrete artifact before calling this — we never slug a natural-language
- * phrase.
- */
-export function slugFromTarget(resolved, { cwd = process.cwd() } = {}) {
-  if (!resolved || typeof resolved !== 'string') return null;
-  const trimmed = resolved.trim();
-  if (!trimmed) return null;
-
-  // URL
-  if (/^https?:\/\//i.test(trimmed)) {
-    let url;
-    try { url = new URL(trimmed); } catch { return null; }
-    const hostPath = `${url.hostname}${url.pathname}`;
-    return kebab(hostPath);
-  }
-
-  // File path. Make it project-relative so two devs critiquing the same
-  // checkout get the same slug regardless of where their repo is cloned.
-  const abs = path.isAbsolute(trimmed) ? trimmed : path.resolve(cwd, trimmed);
-  let rel = path.relative(cwd, abs);
-  // If the target is outside cwd, fall back to the basename so we still
-  // produce a stable slug (vs the absolute path, which would include
-  // home dirs / usernames).
-  if (rel.startsWith('..') || path.isAbsolute(rel)) {
-    rel = path.basename(abs);
-  }
-  if (!rel || rel === '.' || rel === '') return null;
-  return kebab(rel);
-}
-
-function kebab(s) {
-  const slug = s
-    .toLowerCase()
-    .replace(/[/\\.]+/g, '-')
-    .replace(/[^a-z0-9-]+/g, '-')
-    .replace(/-+/g, '-')
-    .replace(/^-|-$/g, '');
-  if (!slug) return null;
-  // Cap from the tail — the tail (filename) is more identifying than the
-  // top-level directory.
-  return slug.length <= SLUG_MAX ? slug : slug.slice(slug.length - SLUG_MAX).replace(/^-/, '');
-}
-
-/**
- * Filename-safe UTC ISO timestamp: hyphens for separators, trailing Z.
- * Plain colons aren't allowed on Windows filesystems.
- */
-export function nowFilenameStamp(date = new Date()) {
-  const iso = date.toISOString();           // 2026-05-12T18:30:00.123Z
-  return iso.replace(/[:.]/g, '-').replace(/-\d+Z$/, 'Z');
-}
-
-/**
- * Write a snapshot for `slug`. `meta` carries the small structured frontmatter
- * keys read back by readTrend(). `body` is the human-readable critique
- * report (everything below the frontmatter).
- *
- * Returns the absolute path written.
- */
-export function writeSnapshot({ slug, meta, body, cwd = process.cwd(), now = new Date() }) {
-  if (!slug) throw new Error('writeSnapshot requires a slug');
-  const dir = getCritiqueDir(cwd);
-  fs.mkdirSync(dir, { recursive: true });
-  const timestamp = nowFilenameStamp(now);
-  const filePath = path.join(dir, `${timestamp}__${slug}.md`);
-  // Spread `meta` first so internally computed `timestamp` and `slug`
-  // always win. Otherwise a caller-supplied meta blob (parsed from the
-  // MONODESIGN_CRITIQUE_META env var) could clobber them, leaving the
-  // filename in disagreement with its frontmatter and corrupting trends.
-  const front = serializeFrontmatter({ ...meta, timestamp, slug });
-  fs.writeFileSync(filePath, `${front}\n${body.trim()}\n`, 'utf-8');
-  return filePath;
-}
-
-function serializeFrontmatter(obj) {
-  const lines = ['---'];
-  for (const [key, value] of Object.entries(obj)) {
-    if (value === undefined || value === null) continue;
-    const str = typeof value === 'string' ? value : String(value);
-    // Quote strings that contain : or # to keep parsing simple.
-    const needsQuotes = typeof value === 'string' && /[:#]/.test(str);
-    lines.push(`${key}: ${needsQuotes ? JSON.stringify(str) : str}`);
-  }
-  lines.push('---');
-  return lines.join('\n');
-}
-
-function parseFrontmatter(text) {
-  const match = text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-  if (!match) return {};
-  const out = {};
-  for (const line of match[1].split(/\r?\n/)) {
-    const colon = line.indexOf(':');
-    if (colon < 0) continue;
-    const key = line.slice(0, colon).trim();
-    let value = line.slice(colon + 1).trim();
-    if (/^".*"$/.test(value)) {
-      try { value = JSON.parse(value); } catch { /* leave as-is */ }
-    } else if (/^-?\d+$/.test(value)) {
-      value = Number(value);
-    }
-    out[key] = value;
-  }
-  return out;
-}
-
-/**
- * Return all snapshot files for `slug`, sorted oldest → newest.
- */
-function listSnapshotsForSlug(slug, cwd) {
-  const dir = getCritiqueDir(cwd);
-  if (!fs.existsSync(dir)) return [];
-  const suffix = `__${slug}.md`;
-  return fs.readdirSync(dir)
-    .filter((f) => f.endsWith(suffix))
-    .sort()
-    .map((f) => path.join(dir, f));
-}
-
-/**
- * Return the most recent snapshot for `slug`, or null. Polish reads this
- * to find its fix backlog when the slug matches.
- */
-export function readLatestSnapshot(slug, { cwd = process.cwd() } = {}) {
-  const all = listSnapshotsForSlug(slug, cwd);
-  if (!all.length) return null;
-  const latest = all[all.length - 1];
-  const body = fs.readFileSync(latest, 'utf-8');
-  return { path: latest, body, meta: parseFrontmatter(body) };
-}
-
-/**
- * Return the last `limit` snapshots' frontmatter, oldest → newest.
- * Critique appends a one-line trend to its output using this.
- */
-export function readTrend(slug, { limit = 5, cwd = process.cwd() } = {}) {
-  const all = listSnapshotsForSlug(slug, cwd);
-  const slice = all.slice(-limit);
-  return slice.map((file) => parseFrontmatter(fs.readFileSync(file, 'utf-8')));
-}
-
-// ---- Monomind memory mirror --------------------------------------------
-
-const asFiniteNumber = (v) => {
-  const n = Number(v);
-  return Number.isFinite(n) ? n : null;
-};
-
-/**
- * Locate a locally installed monomind CLI bin by climbing from `cwd`.
- * Returns null when none is installed — the caller then tries
- * `npx --no-install`, which also fails fast (and silently) when absent.
- */
-function resolveMonomindBin(cwd) {
-  const name = process.platform === 'win32' ? 'monomind.cmd' : 'monomind';
-  let dir = path.resolve(cwd);
-  for (;;) {
-    const bin = path.join(dir, 'node_modules', '.bin', name);
-    try {
-      fs.accessSync(bin, fs.constants.X_OK);
-      return bin;
-    } catch { /* keep climbing */ }
-    const parent = path.dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-
-/**
- * Best-effort mirror of a snapshot's structured metadata into monomind's
- * persistent memory (namespace `design-critique`, key `<project>-<slug>`,
- * upserted), so design health is queryable across sessions via
- * `monomind memory search`. Never throws and never fails the critique flow:
- * if the monomind CLI is unavailable the call is skipped silently.
- * Kill-switch: MONODESIGN_NO_MEMORY=1.
- */
-export function mirrorToMemory({ slug, meta = {}, filePath, cwd = process.cwd(), now = new Date(), env = process.env }) {
-  if (!slug) return { mirrored: false, reason: 'no-slug' };
-  if (env.MONODESIGN_NO_MEMORY === '1') return { mirrored: false, reason: 'disabled' };
-  try {
-    const record = {
-      score: asFiniteNumber(meta.total_score ?? meta.score),
-      p0: asFiniteNumber(meta.p0_count ?? meta.p0),
-      p1: asFiniteNumber(meta.p1_count ?? meta.p1),
-      date: now.toISOString(),
-      slug,
-      path: filePath ? path.relative(cwd, filePath) : null,
-    };
-    const project = kebab(path.basename(path.resolve(cwd))) || 'project';
-    const key = `${project}-${slug}`;
-    const argv = [
-      'memory', 'store',
-      '--key', key,
-      '--value', JSON.stringify(record),
-      '--namespace', 'design-critique',
-      '--upsert',
-    ];
-    const bin = resolveMonomindBin(cwd);
-    const opts = { cwd, env, stdio: 'ignore', timeout: 15000 };
-    const run = bin
-      ? spawnSync(bin, argv, opts)
-      : spawnSync('npx', ['--no-install', 'monomind', ...argv], { ...opts, shell: process.platform === 'win32' });
-    if (run.error || run.status !== 0) return { mirrored: false, reason: 'cli-unavailable' };
-    return { mirrored: true, key };
-  } catch {
-    return { mirrored: false, reason: 'error' };
-  }
-}
-
-// ---- Recall (latest + trend + open items, one compact block) -----------
-
-/**
- * Extract open issue titles tagged [P0] / [P1] from a snapshot body.
- * Matches the critique report's "**[P?] What**: ..." lines, but tolerates
- * loose formatting: any line containing `[P0]`/`[P1]` counts, with the
- * title taken from the text after the tag (markdown emphasis stripped).
- */
-export function extractIssueLines(body, { max = 8 } = {}) {
-  const issues = { p0: [], p1: [] };
-  if (!body || typeof body !== 'string') return issues;
-  // Drop frontmatter so metadata lines never masquerade as issues.
-  const text = body.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '');
-  for (const line of text.split(/\r?\n/)) {
-    const m = line.match(/\[(P0|P1)\]\s*(.*)/i);
-    if (!m) continue;
-    let title = m[2];
-    // "**[P0] Title**: explanation" → keep just the title.
-    const boldColon = title.indexOf('**:');
-    if (boldColon !== -1) title = title.slice(0, boldColon);
-    title = title.replace(/\*+/g, '').replace(/^[-–—\s]+/, '').replace(/[:\s]+$/, '').trim();
-    if (!title) continue;
-    const bucket = m[1].toUpperCase() === 'P0' ? issues.p0 : issues.p1;
-    if (bucket.length < max && !bucket.includes(title)) bucket.push(title);
-  }
-  return issues;
-}
-
-/**
- * Direction of the last (up to) 3 finite scores: improving | declining |
- * flat, or null when fewer than 2 scores exist.
- */
-export function trendDirection(scores) {
-  const s = (scores || []).map(asFiniteNumber).filter((n) => n !== null).slice(-3);
-  if (s.length < 2) return null;
-  if (s[s.length - 1] > s[0]) return 'improving';
-  if (s[s.length - 1] < s[0]) return 'declining';
-  return 'flat';
-}
-
-/**
- * Combined latest + trend + open-issue view for `slug`, or null when no
- * snapshot exists. This backs the `recall` subcommand that polish/critique
- * consume instead of separate latest+trend calls.
- */
-export function readRecall(slug, { limit = 5, cwd = process.cwd() } = {}) {
-  const latest = readLatestSnapshot(slug, { cwd });
-  if (!latest) return null;
-  const trend = readTrend(slug, { limit, cwd });
-  const scores = trend.map((t) => asFiniteNumber(t.total_score ?? t.score));
-  return {
-    slug,
-    latest,
-    trend,
-    scores,
-    direction: trendDirection(scores),
-    issues: extractIssueLines(latest.body),
-  };
-}
-
-/** Render a recall result as a compact markdown block. */
-export function formatRecall(recall, { cwd = process.cwd() } = {}) {
-  const { slug, latest, trend, scores, direction, issues } = recall;
-  const meta = latest.meta;
-  const score = asFiniteNumber(meta.total_score ?? meta.score);
-  const p0 = asFiniteNumber(meta.p0_count ?? meta.p0);
-  const p1 = asFiniteNumber(meta.p1_count ?? meta.p1);
-  const lines = [`## Design health: \`${slug}\``];
-  lines.push(
-    `- Latest score: ${score !== null ? `${score}/40` : 'n/a'}`
-    + ` (P0: ${p0 ?? '?'}, P1: ${p1 ?? '?'})`
-    + (meta.timestamp ? ` — ${meta.timestamp}` : ''),
-  );
-  const arrows = scores.map((n) => (n === null ? '?' : n)).join(' → ');
-  lines.push(`- Trend (last ${trend.length}): ${arrows}${direction ? ` (${direction})` : ''}`);
-  if (issues.p0.length) {
-    lines.push('- Open P0:');
-    for (const t of issues.p0) lines.push(`  - ${t}`);
-  }
-  if (issues.p1.length) {
-    lines.push('- Open P1:');
-    for (const t of issues.p1) lines.push(`  - ${t}`);
-  }
-  if (!issues.p0.length && !issues.p1.length) {
-    lines.push('- No open P0/P1 lines found in the latest snapshot.');
-  }
-  lines.push(`- Snapshot: ${path.relative(cwd, latest.path)}`);
-  return lines.join('\n');
-}
-
-// ---- CLI ---------------------------------------------------------------
-
-function main(argv) {
-  const [cmd, ...args] = argv;
-  switch (cmd) {
-    case 'slug': {
-      const slug = slugFromTarget(args[0]);
-      if (!slug) { process.stderr.write('no stable slug for input\n'); process.exit(1); }
-      process.stdout.write(`${slug}\n`);
-      return;
-    }
-    case 'write': {
-      const [slug, bodyFile] = args;
-      if (!slug || !bodyFile) { process.stderr.write('usage: write <slug> <body-file>\n'); process.exit(1); }
-      const raw = fs.readFileSync(bodyFile, 'utf-8');
-      // The body file may be a full report. The caller passes the meta as
-      // a JSON object on stdin if it wants structured frontmatter; otherwise
-      // we write with minimal metadata.
-      let meta = {};
-      const metaArg = process.env.MONODESIGN_CRITIQUE_META;
-      if (metaArg) {
-        try { meta = JSON.parse(metaArg); } catch { /* ignore */ }
-      }
-      const out = writeSnapshot({ slug, meta, body: raw });
-      // Best-effort cross-session mirror; must never break the critique flow.
-      mirrorToMemory({ slug, meta, filePath: out });
-      process.stdout.write(`${out}\n`);
-      return;
-    }
-    case 'latest': {
-      const latest = readLatestSnapshot(args[0]);
-      if (!latest) { process.exit(2); }
-      process.stdout.write(latest.body);
-      return;
-    }
-    case 'trend': {
-      const rows = readTrend(args[0], { limit: args[1] ? Number(args[1]) : 5 });
-      process.stdout.write(JSON.stringify(rows, null, 2) + '\n');
-      return;
-    }
-    case 'recall': {
-      const recall = readRecall(args[0], { limit: args[1] ? Number(args[1]) : 5 });
-      if (!recall) { process.exit(2); }
-      process.stdout.write(`${formatRecall(recall)}\n`);
-      return;
-    }
-    default:
-      process.stderr.write('usage: critique-storage.mjs <slug|write|latest|trend|recall> [args]\n');
-      process.exit(1);
-  }
-}
-
-function isMainModule() {
-  if (!process.argv[1]) return false;
-  try {
-    return fs.realpathSync(fileURLToPath(import.meta.url)) === fs.realpathSync(process.argv[1]);
-  } catch {
-    // pathToFileURL normalizes Windows paths; keep it as a fallback for any
-    // environment where realpath is unavailable.
-    return import.meta.url === pathToFileURL(process.argv[1]).href;
-  }
-}
-
-// Why the realpath check: generated skills are often reached through symlinked
-// harness directories (for example a demo repo's `.agents` -> source `.agents`).
-// Node resolves import.meta.url to the real file, while process.argv[1] keeps
-// the symlink path. Comparing canonical paths prevents a silent exit-0 no-op.
-if (isMainModule()) {
-  main(process.argv.slice(2));
-}

package/packages/@monomind/cli/.claude/skills/monodesign/scripts/detect-csp.mjs

@@ -1,198 +0,0 @@
-/**
- * Scan a project tree for Content-Security-Policy signals and classify the
- * shape so the agent knows which patch template to propose.
- *
- * Used at first-time `live.mjs` setup. Mechanical (grep-based) — no network,
- * no dev server, no JS evaluation. The classification drives a user-facing
- * consent prompt; the agent does the actual patch writing.
- *
- * Shapes are named by patch mechanism, not framework origin:
- *   - "append-arrays":  CSP defined as structured directive arrays. Patch
- *                       appends a dev-only localhost entry. Covers:
- *                         - Monorepo helpers with additional*Src options
- *                           (e.g. createBaseNextConfig for Next)
- *                         - SvelteKit kit.csp.directives
- *                         - nuxt-security module's contentSecurityPolicy
- *   - "append-string":  CSP built as a literal value string. Patch splices
- *                       a dev-only token into script-src and connect-src.
- *                       Covers:
- *                         - Inline Next.js headers() with CSP string
- *                         - Nuxt routeRules / nitro.routeRules CSP headers
- *   - "middleware":     CSP set dynamically in middleware.{ts,js}.
- *                       Detected but not auto-patched in v1.
- *   - "meta-tag":       <meta http-equiv="Content-Security-Policy"> in
- *                       layout files. Detected but not auto-patched in v1.
- *   - null:             no CSP signals found; no patch needed.
- */
-
-import fs from 'node:fs';
-import path from 'node:path';
-
-const SKIP_DIRS = new Set([
-  'node_modules',
-  '.git',
-  '.next',
-  '.turbo',
-  '.svelte-kit',
-  '.nuxt',
-  '.astro',
-  'dist',
-  'build',
-  'out',
-  '.vercel',
-]);
-
-const SCAN_EXTS = new Set(['.js', '.mjs', '.cjs', '.ts', '.mts', '.cts', '.tsx', '.jsx']);
-const LAYOUT_EXTS = new Set(['.tsx', '.jsx', '.astro', '.vue', '.svelte', '.html']);
-const MAX_DEPTH = 6;
-const MAX_READ_BYTES = 64 * 1024;
-
-// append-arrays signals: CSP expressed as structured directive arrays
-const MONOREPO_HELPER_SIGNALS = [
-  /\bbuildCSPConfig\b/,
-  /\bbuildSecurityHeaders\b/,
-  /\badditionalScriptSrc\b/,
-  /\badditionalConnectSrc\b/,
-  /\bcreateBaseNextConfig\b/,
-];
-const SVELTEKIT_CSP_SIGNALS = [
-  /\bkit\s*:/,
-  /\bcsp\s*:/,
-  /\bdirectives\s*:/,
-];
-const NUXT_SECURITY_SIGNALS = [
-  /['"]nuxt-security['"]/,
-  /\bcontentSecurityPolicy\b/,
-];
-
-// append-string signals: CSP written as a literal value string
-const INLINE_HEADER_SIGNALS = [
-  /["']Content-Security-Policy["']/i,
-  /\bscript-src\b/,
-  /\bconnect-src\b/,
-];
-const NUXT_ROUTE_RULES_SIGNALS = [
-  /\brouteRules\b/,
-  /Content-Security-Policy/i,
-  /\bscript-src\b/,
-];
-
-const MIDDLEWARE_HINT = /headers\.set\(\s*["']Content-Security-Policy["']/i;
-const META_TAG_HINT = /http-equiv\s*=\s*["']Content-Security-Policy["']/i;
-
-/**
- * @param {string} cwd Project root.
- * @returns {{ shape: string|null, signals: string[] }}
- */
-export function detectCsp(cwd = process.cwd()) {
-  const hits = { appendArrays: [], appendString: [], middleware: [], metaTag: [] };
-
-  walk(cwd, cwd, 0, (absPath, relPath, body) => {
-    const ext = path.extname(absPath);
-    const base = path.basename(absPath).toLowerCase();
-    const isConfig = (name) =>
-      new RegExp('(^|/)' + name + '\\.config\\.').test(relPath);
-
-    // === append-arrays candidates ===
-
-    // Monorepo CSP helper: packages/*/src/.../(config|security)/*
-    if (SCAN_EXTS.has(ext) &&
-        /packages\/[^/]+\/src\/.*(config|next-config|security)/.test(relPath) &&
-        MONOREPO_HELPER_SIGNALS.some((re) => re.test(body))) {
-      hits.appendArrays.push(relPath);
-      return;
-    }
-
-    // SvelteKit kit.csp.directives
-    if (SCAN_EXTS.has(ext) && isConfig('svelte') &&
-        SVELTEKIT_CSP_SIGNALS.every((re) => re.test(body))) {
-      hits.appendArrays.push(relPath);
-      return;
-    }
-
-    // Nuxt nuxt-security module
-    if (SCAN_EXTS.has(ext) && isConfig('nuxt') &&
-        NUXT_SECURITY_SIGNALS.every((re) => re.test(body))) {
-      hits.appendArrays.push(relPath);
-      return;
-    }
-
-    // === append-string candidates ===
-
-    // Inline headers in Next/Nuxt/SvelteKit/Astro/Vite config
-    if (SCAN_EXTS.has(ext) &&
-        /(^|\/)(next|nuxt|vite|astro|svelte)\.config\./.test(relPath) &&
-        INLINE_HEADER_SIGNALS.every((re) => re.test(body))) {
-      // Nuxt routeRules is a sub-shape of append-string; we already covered
-      // nuxt-security above via return, so any remaining Nuxt CSP match here
-      // is a route-rules / inline-headers case. Either way, same patch
-      // mechanism.
-      hits.appendString.push(relPath);
-      return;
-    }
-
-    // === detect-only shapes ===
-
-    if ((base === 'middleware.ts' || base === 'middleware.js' || base === 'middleware.mjs') &&
-        MIDDLEWARE_HINT.test(body)) {
-      hits.middleware.push(relPath);
-    }
-
-    if (LAYOUT_EXTS.has(ext) && META_TAG_HINT.test(body)) {
-      hits.metaTag.push(relPath);
-    }
-  });
-
-  // Priority: append-arrays > append-string > middleware > meta-tag.
-  // Structured patches are safer than string splices; runtime and HTML
-  // injection patches are less reliable and v1 doesn't auto-apply them.
-  if (hits.appendArrays.length > 0) {
-    return { shape: 'append-arrays', signals: hits.appendArrays };
-  }
-  if (hits.appendString.length > 0) {
-    return { shape: 'append-string', signals: hits.appendString };
-  }
-  if (hits.middleware.length > 0) {
-    return { shape: 'middleware', signals: hits.middleware };
-  }
-  if (hits.metaTag.length > 0) {
-    return { shape: 'meta-tag', signals: hits.metaTag };
-  }
-  return { shape: null, signals: [] };
-}
-
-function walk(root, dir, depth, visit) {
-  if (depth > MAX_DEPTH) return;
-  let entries;
-  try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
-  catch { return; }
-
-  for (const entry of entries) {
-    const abs = path.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (SKIP_DIRS.has(entry.name)) continue;
-      walk(root, abs, depth + 1, visit);
-      continue;
-    }
-    if (!entry.isFile()) continue;
-    const ext = path.extname(entry.name);
-    if (!SCAN_EXTS.has(ext) && !LAYOUT_EXTS.has(ext)) continue;
-    let body;
-    try {
-      const fd = fs.openSync(abs, 'r');
-      try {
-        const buf = Buffer.alloc(MAX_READ_BYTES);
-        const n = fs.readSync(fd, buf, 0, MAX_READ_BYTES, 0);
-        body = buf.slice(0, n).toString('utf-8');
-      } finally { fs.closeSync(fd); }
-    } catch { continue; }
-    visit(abs, path.relative(root, abs), body);
-  }
-}
-
-// CLI mode
-const _running = process.argv[1];
-if (_running?.endsWith('detect-csp.mjs') || _running?.endsWith('detect-csp.mjs/')) {
-  const result = detectCsp(process.cwd());
-  console.log(JSON.stringify(result, null, 2));
-}

package/packages/@monomind/cli/.claude/skills/monodesign/scripts/detect.mjs

@@ -1,33 +0,0 @@
-#!/usr/bin/env node
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { createRequire } from 'node:module';
-import { pathToFileURL, fileURLToPath } from 'node:url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-// Packaged fallback: resolve the engine from an installed @monoes/monodesign.
-function packagedDetectorPath() {
-  try {
-    return createRequire(import.meta.url).resolve('@monoes/monodesign/engine');
-  } catch {
-    return null;
-  }
-}
-
-const candidates = [
-  path.join(__dirname, 'detector', 'detect-antipatterns.mjs'),
-  path.join(__dirname, '..', '..', 'cli', 'engine', 'detect-antipatterns.mjs'),
-  packagedDetectorPath(),
-].filter(Boolean);
-const detectorPath = candidates.find(p => fs.existsSync(p));
-
-if (!detectorPath) {
-  process.stderr.write('Error: bundled detector not found.\n');
-  process.exit(1);
-}
-
-const { detectCli } = await import(pathToFileURL(detectorPath));
-
-await detectCli();