monomind 2.7.6 → 2.7.8

package/packages/@monomind/cli/dist/src/commands/security-scan.js

@@ -12,45 +12,97 @@ export const SECRET_PATTERNS = [
     { pattern: /['"]xox[baprs]-[a-zA-Z0-9-]+['"]/g, type: 'Slack Token' },
     { pattern: /password\s*[:=]\s*['"][^'"]{8,}['"]/gi, type: 'Hardcoded Password' },
 ];
-export function findSecretsInDir(dir, depthLimit, baseDir, findings) {
-    if (depthLimit <= 0)
+export function createScanCoverage() {
+    return {
+        unreadableDirs: [],
+        unreadableFiles: [],
+        depthTruncatedDirs: [],
+        oversizedFiles: [],
+        filesScanned: 0,
+        dirsScanned: 0,
+    };
+}
+/** True when some part of the tree was not examined, for any reason. */
+export function scanWasIncomplete(c) {
+    return (c.unreadableDirs.length > 0 ||
+        c.unreadableFiles.length > 0 ||
+        c.depthTruncatedDirs.length > 0 ||
+        c.oversizedFiles.length > 0);
+}
+/** True when the scanner hit a hard failure (not merely a configured limit). */
+export function scanHadErrors(c) {
+    return c.unreadableDirs.length > 0 || c.unreadableFiles.length > 0;
+}
+/** Human-readable lines describing every gap in coverage. Empty when complete. */
+export function describeScanGaps(c) {
+    const lines = [];
+    if (c.unreadableDirs.length > 0) {
+        lines.push(`${c.unreadableDirs.length} directory(ies) could not be read (e.g. ${c.unreadableDirs[0]})`);
+    }
+    if (c.unreadableFiles.length > 0) {
+        lines.push(`${c.unreadableFiles.length} file(s) could not be read (e.g. ${c.unreadableFiles[0]})`);
+    }
+    if (c.depthTruncatedDirs.length > 0) {
+        lines.push(`${c.depthTruncatedDirs.length} directory(ies) not scanned — depth limit reached (use --depth deep)`);
+    }
+    if (c.oversizedFiles.length > 0) {
+        lines.push(`${c.oversizedFiles.length} file(s) skipped — larger than 1MB`);
+    }
+    return lines;
+}
+export function findSecretsInDir(dir, depthLimit, baseDir, findings, coverage = createScanCoverage()) {
+    if (depthLimit <= 0) {
+        coverage.depthTruncatedDirs.push(relative(baseDir, dir) || dir);
         return;
+    }
+    let entries;
     try {
-        const entries = readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            const isDotEnv = /^\.env(\..+)?$/.test(entry.name);
-            if ((entry.name.startsWith('.') && !isDotEnv) || entry.name === 'node_modules' || entry.name === 'dist')
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        coverage.unreadableDirs.push(relative(baseDir, dir) || dir);
+        return;
+    }
+    coverage.dirsScanned++;
+    for (const entry of entries) {
+        const isDotEnv = /^\.env(\..+)?$/.test(entry.name);
+        if ((entry.name.startsWith('.') && !isDotEnv) || entry.name === 'node_modules' || entry.name === 'dist')
+            continue;
+        const fullPath = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            findSecretsInDir(fullPath, depthLimit - 1, baseDir, findings, coverage);
+        }
+        else if (entry.isFile() && (/\.(ts|js|json|yml|yaml)$/.test(entry.name) || isDotEnv) && !entry.name.endsWith('.d.ts')) {
+            let content;
+            try {
+                if (statSync(fullPath).size > 1024 * 1024) {
+                    coverage.oversizedFiles.push(relative(baseDir, fullPath));
+                    continue;
+                }
+                content = readFileSync(fullPath, 'utf-8');
+            }
+            catch {
+                coverage.unreadableFiles.push(relative(baseDir, fullPath));
                 continue;
-            const fullPath = join(dir, entry.name);
-            if (entry.isDirectory()) {
-                findSecretsInDir(fullPath, depthLimit - 1, baseDir, findings);
             }
-            else if (entry.isFile() && (/\.(ts|js|json|yml|yaml)$/.test(entry.name) || isDotEnv) && !entry.name.endsWith('.d.ts')) {
-                try {
-                    if (statSync(fullPath).size > 1024 * 1024)
-                        continue;
-                    const content = readFileSync(fullPath, 'utf-8');
-                    const lines = content.split('\n');
-                    for (let i = 0; i < lines.length; i++) {
-                        for (const { pattern, type } of SECRET_PATTERNS) {
-                            pattern.lastIndex = 0;
-                            let m;
-                            while ((m = pattern.exec(lines[i])) !== null) {
-                                findings.push({
-                                    severity: output.warning('HIGH'),
-                                    type: 'Hardcoded Secret',
-                                    location: `${relative(baseDir, fullPath)}:${i + 1}`,
-                                    description: type,
-                                });
-                            }
-                        }
+            coverage.filesScanned++;
+            const lines = content.split('\n');
+            for (let i = 0; i < lines.length; i++) {
+                for (const { pattern, type } of SECRET_PATTERNS) {
+                    pattern.lastIndex = 0;
+                    let m;
+                    while ((m = pattern.exec(lines[i])) !== null) {
+                        findings.push({
+                            severity: output.warning('HIGH'),
+                            type: 'Hardcoded Secret',
+                            location: `${relative(baseDir, fullPath)}:${i + 1}`,
+                            description: type,
+                        });
                     }
                 }
-                catch { /* file read error */ }
             }
         }
     }
-    catch { /* dir read error */ }
 }
 // ─── scan subcommand ─────────────────────────────────────────────────────────
 export const scanCommand = {
@@ -92,6 +144,7 @@ export const scanCommand = {
         const spinner = output.createSpinner({ text: `Scanning ${target}...`, spinner: 'dots' });
         spinner.start();
         const findings = [];
+        const coverage = createScanCoverage();
         let criticalCount = 0, highCount = 0, mediumCount = 0, lowCount = 0;
         try {
             const fs = await import('fs');
@@ -156,7 +209,7 @@ export const scanCommand = {
                 spinner.setText('Scanning for hardcoded secrets...');
                 const scanDepth = depth === 'deep' ? 10 : depth === 'standard' ? 5 : 3;
                 const prevCount = findings.length;
-                findSecretsInDir(path.resolve(target), scanDepth, path.resolve(target), findings);
+                findSecretsInDir(path.resolve(target), scanDepth, path.resolve(target), findings, coverage);
                 highCount += findings.length - prevCount;
             }
             if ((scanType === 'all' || scanType === 'code') && depth !== 'quick') {
@@ -168,53 +221,74 @@ export const scanCommand = {
                     { pattern: /child_process.*exec[^S]/g, type: 'Command Injection', severity: 'high', desc: 'Possible command injection' },
                     { pattern: /\$\{.*\}.*sql|sql.*\$\{/gi, type: 'SQL Injection', severity: 'high', desc: 'Possible SQL injection' },
                 ];
+                // Same coverage accounting as findSecretsInDir: gaps are recorded, never
+                // swallowed, so an unreadable tree cannot masquerade as a clean one.
+                const codeBase = path.resolve(target);
                 const scanCodeDir = (dir, depthLimit) => {
-                    if (depthLimit <= 0)
+                    if (depthLimit <= 0) {
+                        coverage.depthTruncatedDirs.push(path.relative(codeBase, dir) || dir);
                         return;
+                    }
+                    let entries;
                     try {
-                        const entries = fs.readdirSync(dir, { withFileTypes: true });
-                        for (const entry of entries) {
-                            if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.name === 'dist')
+                        entries = fs.readdirSync(dir, { withFileTypes: true });
+                    }
+                    catch {
+                        coverage.unreadableDirs.push(path.relative(codeBase, dir) || dir);
+                        return;
+                    }
+                    for (const entry of entries) {
+                        if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.name === 'dist')
+                            continue;
+                        const fullPath = path.join(dir, entry.name);
+                        if (entry.isDirectory()) {
+                            scanCodeDir(fullPath, depthLimit - 1);
+                        }
+                        else if (entry.isFile() && /\.(ts|js|tsx|jsx)$/.test(entry.name) && !entry.name.endsWith('.d.ts')) {
+                            let content;
+                            try {
+                                if (fs.statSync(fullPath).size > 1024 * 1024) {
+                                    coverage.oversizedFiles.push(path.relative(codeBase, fullPath));
+                                    continue;
+                                }
+                                content = fs.readFileSync(fullPath, 'utf-8');
+                            }
+                            catch {
+                                coverage.unreadableFiles.push(path.relative(codeBase, fullPath));
                                 continue;
-                            const fullPath = path.join(dir, entry.name);
-                            if (entry.isDirectory()) {
-                                scanCodeDir(fullPath, depthLimit - 1);
                             }
-                            else if (entry.isFile() && /\.(ts|js|tsx|jsx)$/.test(entry.name) && !entry.name.endsWith('.d.ts')) {
-                                try {
-                                    if (fs.statSync(fullPath).size > 1024 * 1024)
-                                        continue;
-                                    const content = fs.readFileSync(fullPath, 'utf-8');
-                                    const lines = content.split('\n');
-                                    for (let i = 0; i < lines.length; i++) {
-                                        for (const { pattern, type, severity, desc } of codePatterns) {
-                                            pattern.lastIndex = 0;
-                                            let m;
-                                            while ((m = pattern.exec(lines[i])) !== null) {
-                                                if (severity === 'high')
-                                                    highCount++;
-                                                else
-                                                    mediumCount++;
-                                                findings.push({
-                                                    severity: severity === 'high' ? output.warning('HIGH') : output.warning('MEDIUM'),
-                                                    type,
-                                                    location: `${path.relative(target, fullPath)}:${i + 1}`,
-                                                    description: desc,
-                                                });
-                                            }
-                                        }
+                            const lines = content.split('\n');
+                            for (let i = 0; i < lines.length; i++) {
+                                for (const { pattern, type, severity, desc } of codePatterns) {
+                                    pattern.lastIndex = 0;
+                                    let m;
+                                    while ((m = pattern.exec(lines[i])) !== null) {
+                                        if (severity === 'high')
+                                            highCount++;
+                                        else
+                                            mediumCount++;
+                                        findings.push({
+                                            severity: severity === 'high' ? output.warning('HIGH') : output.warning('MEDIUM'),
+                                            type,
+                                            location: `${path.relative(target, fullPath)}:${i + 1}`,
+                                            description: desc,
+                                        });
                                     }
                                 }
-                                catch { /* file read error */ }
                             }
                         }
                     }
-                    catch { /* dir read error */ }
                 };
                 const scanDepth = depth === 'deep' ? 10 : 5;
                 scanCodeDir(path.resolve(target), scanDepth);
             }
-            spinner.succeed('Scan complete');
+            const gaps = describeScanGaps(coverage);
+            if (gaps.length > 0) {
+                spinner.stop(output.warning('Scan finished with INCOMPLETE coverage'));
+            }
+            else {
+                spinner.succeed('Scan complete');
+            }
             output.writeln();
             if (findings.length > 0) {
                 output.printTable({
@@ -229,9 +303,19 @@ export const scanCommand = {
                 if (findings.length > 20)
                     output.writeln(output.dim(`... and ${findings.length - 20} more issues`));
             }
+            else if (gaps.length > 0) {
+                // Never present an incomplete scan as a clean bill of health.
+                output.writeln(output.warning('No security issues found in the parts that could be scanned — coverage was INCOMPLETE (see below).'));
+            }
             else {
                 output.writeln(output.success('No security issues found!'));
             }
+            if (gaps.length > 0) {
+                output.writeln();
+                output.writeln(output.warning('Incomplete coverage:'));
+                for (const g of gaps)
+                    output.writeln(output.warning(`  - ${g}`));
+            }
             output.writeln();
             output.printBox([
                 `Target: ${target}`,
@@ -240,6 +324,9 @@ export const scanCommand = {
                 ``,
                 `Critical: ${criticalCount}  High: ${highCount}  Medium: ${mediumCount}  Low: ${lowCount}`,
                 `Total Issues: ${findings.length}`,
+                ``,
+                `Coverage: ${coverage.filesScanned} file(s) in ${coverage.dirsScanned} dir(s) scanned`,
+                `Coverage status: ${gaps.length === 0 ? 'complete' : `INCOMPLETE (${gaps.length} gap type(s))`}`,
             ].join('\n'), 'Scan Summary');
             if (fix && criticalCount + highCount > 0) {
                 const resolvedTarget = realpathSync(path.resolve(target));
@@ -263,6 +350,11 @@ export const scanCommand = {
                     fixSpinner.fail('Some fixes could not be applied automatically');
                 }
             }
+            // A scan that hit real read errors cannot certify anything — fail loudly.
+            // Depth truncation is a configured limit, not an error, so it is reported
+            // above but does not by itself flip the exit status.
+            if (scanHadErrors(coverage))
+                return { success: false };
             return { success: findings.length === 0 || (criticalCount === 0 && highCount === 0) };
         }
         catch (error) {
@@ -307,11 +399,21 @@ export const secretsCommand = {
         const spinner = output.createSpinner({ text: `Scanning ${targetPath}...`, spinner: 'dots' });
         spinner.start();
         const findings = [];
+        const coverage = createScanCoverage();
         const scanDepth = depth === 'deep' ? 10 : depth === 'standard' ? 5 : 3;
-        findSecretsInDir(resolve(targetPath), scanDepth, resolve(targetPath), findings);
-        spinner.succeed('Scan complete');
+        findSecretsInDir(resolve(targetPath), scanDepth, resolve(targetPath), findings, coverage);
+        const gaps = describeScanGaps(coverage);
+        if (gaps.length > 0) {
+            spinner.stop(output.warning('Scan finished with INCOMPLETE coverage'));
+        }
+        else {
+            spinner.succeed('Scan complete');
+        }
         output.writeln();
-        if (findings.length === 0) {
+        if (findings.length === 0 && gaps.length > 0) {
+            output.writeln(output.warning('No secrets found in the parts that could be scanned — coverage was INCOMPLETE.'));
+        }
+        else if (findings.length === 0) {
             output.writeln(output.success('No secrets found.'));
         }
         else {
@@ -326,9 +428,20 @@ export const secretsCommand = {
             if (findings.length > 20)
                 output.writeln(output.dim(`... and ${findings.length - 20} more`));
         }
+        if (gaps.length > 0) {
+            output.writeln();
+            output.writeln(output.warning('Incomplete coverage:'));
+            for (const g of gaps)
+                output.writeln(output.warning(`  - ${g}`));
+        }
         output.writeln();
-        output.writeln(output.bold('Summary: ') + `${findings.length} secret(s) found in ${targetPath}`);
-        return { success: findings.length === 0 };
+        output.writeln(output.bold('Summary: ') +
+            `${findings.length} secret(s) found in ${targetPath} ` +
+            `(${coverage.filesScanned} file(s) in ${coverage.dirsScanned} dir(s) scanned, ` +
+            `coverage ${gaps.length === 0 ? 'complete' : 'INCOMPLETE'})`);
+        // Read errors mean the tree was not fully examined — "no secrets" is not
+        // a result we can stand behind, so do not exit 0 on it.
+        return { success: findings.length === 0 && !scanHadErrors(coverage) };
     },
 };
 //# sourceMappingURL=security-scan.js.map

package/packages/@monomind/cli/dist/src/commands/swarm.js

@@ -8,19 +8,45 @@ import { callMCPTool, MCPClientError } from '../mcp-client.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { writeJsonFileAtomic } from '../utils/json-file.js';
-// Canonical paths — shared with MCP tools so CLI and MCP see the same state
-const SWARM_STATE_DIR = '.monomind/swarm';
+import { getMonomindDataRoot, getProjectCwd, migrateLegacyStoreFile } from '../mcp-tools/types.js';
+// Canonical paths — resolved through getMonomindDataRoot() so the CLI and the MCP
+// tools (agent-tools.ts / swarm-tools.ts / task-tools.ts) read and write the SAME
+// physical files. These used to be `path.join(process.cwd(), '.monomind/...')`,
+// which only coincides with the canonical root when there is no `.git` directory;
+// inside a real repo the canonical root is `<repo>/.git/monomind`, so the CLI read
+// an empty parallel store ("0 agents" with agents on disk) and `swarm init` wrote a
+// second, divergent swarm-state.json no MCP tool ever read.
+const SWARM_STATE_SUBDIR = 'swarm';
 const SWARM_STATE_FILE = 'swarm-state.json';
-const AGENT_STORE_PATH = '.monomind/agents/store.json';
+const AGENT_STORE_SUBDIR = 'agents';
+const AGENT_STORE_FILE = 'store.json';
+function getSwarmDir() {
+    return path.join(getMonomindDataRoot(), SWARM_STATE_SUBDIR);
+}
+// Canonical swarm-state.json path. Also pulls a pre-existing legacy
+// `<cwd>/.monomind/swarm/swarm-state.json` into place (copy, never move; no-op once
+// the canonical file exists or when the two paths coincide) so state written by an
+// older CLI isn't silently orphaned — same helper the MCP tools use.
+function getSwarmStateFile() {
+    const file = path.join(getSwarmDir(), SWARM_STATE_FILE);
+    migrateLegacyStoreFile(file, path.join(SWARM_STATE_SUBDIR, SWARM_STATE_FILE));
+    return file;
+}
+function getAgentStoreFile() {
+    const file = path.join(getMonomindDataRoot(), AGENT_STORE_SUBDIR, AGENT_STORE_FILE);
+    migrateLegacyStoreFile(file, path.join(AGENT_STORE_SUBDIR, AGENT_STORE_FILE));
+    return file;
+}
 // Get dynamic swarm status from MCP-canonical state files
 function getSwarmStatus(swarmId) {
-    const sessionDir = path.join(process.cwd(), '.claude', 'sessions');
+    const projectCwd = getProjectCwd();
+    const sessionDir = path.join(projectCwd, '.claude', 'sessions');
     const memoryPaths = [
-        path.join(process.cwd(), '.monomind', 'memory.db'),
-        path.join(process.cwd(), '.claude', 'memory.db'),
+        path.join(projectCwd, '.monomind', 'memory.db'),
+        path.join(projectCwd, '.claude', 'memory.db'),
     ];
-    // Read swarm state from MCP-canonical path (.monomind/swarm/swarm-state.json)
-    const swarmStateFile = path.join(process.cwd(), SWARM_STATE_DIR, SWARM_STATE_FILE);
+    // Read swarm state from the MCP-canonical path
+    const swarmStateFile = getSwarmStateFile();
     let swarmState = null;
     if (fs.existsSync(swarmStateFile)) {
         try {
@@ -52,10 +78,11 @@ function getSwarmStatus(swarmId) {
             // Ignore parse errors
         }
     }
-    // Count agents from MCP-canonical agent store (.monomind/agents/store.json)
+    // Count agents from the MCP-canonical agent store (the same physical file
+    // agent_spawn writes to — see getAgentStoreFile()).
     let activeAgents = 0;
     let totalAgents = 0;
-    const agentStoreFile = path.join(process.cwd(), AGENT_STORE_PATH);
+    const agentStoreFile = getAgentStoreFile();
     if (fs.existsSync(agentStoreFile)) {
         try {
             const agentSz = fs.statSync(agentStoreFile).size;
@@ -102,7 +129,7 @@ function getSwarmStatus(swarmId) {
     let completedTasks = 0;
     let inProgressTasks = 0;
     let pendingTasks = 0;
-    const tasksDir = path.join(process.cwd(), SWARM_STATE_DIR, 'tasks');
+    const tasksDir = path.join(getSwarmDir(), 'tasks');
     if (fs.existsSync(tasksDir)) {
         try {
             const taskFiles = fs.readdirSync(tasksDir).filter(f => f.endsWith('.json'));
@@ -311,7 +338,7 @@ const initCommand = {
             output.printSuccess('Swarm initialized successfully');
             // Save swarm state to MCP-canonical path so CLI and MCP share state
             try {
-                const swarmDir2 = path.join(process.cwd(), SWARM_STATE_DIR);
+                const swarmDir2 = getSwarmDir();
                 if (!fs.existsSync(swarmDir2)) {
                     fs.mkdirSync(swarmDir2, { recursive: true });
                 }
@@ -466,7 +493,7 @@ const startCommand = {
             output.writeln(output.dim('  Run with -v/--verbose for more detail, or `monomind doctor` to check config/permission issues.'));
         }
         // Persist swarm state to MCP-canonical path so CLI and MCP share state
-        const swarmDir = path.join(process.cwd(), SWARM_STATE_DIR);
+        const swarmDir = getSwarmDir();
         if (!fs.existsSync(swarmDir))
             fs.mkdirSync(swarmDir, { recursive: true });
         // Read existing store to preserve other swarms
@@ -627,7 +654,7 @@ const stopCommand = {
         }
         // Only update persisted swarm state if the MCP call succeeded (#1423)
         if (mcpStopped) {
-            const stopStateFile = path.join(process.cwd(), SWARM_STATE_DIR, SWARM_STATE_FILE);
+            const stopStateFile = getSwarmStateFile();
             if (fs.existsSync(stopStateFile)) {
                 try {
                     const stopStatSz = fs.statSync(stopStateFile).size;

package/packages/@monomind/cli/dist/src/consensus/audit-writer.js

@@ -177,19 +177,20 @@ export class AuditWriter {
         appendFileSync(filePath, JSON.stringify(data) + '\n', 'utf-8');
     }
     readLines(filePath) {
+        // A missing log is a genuine empty trail. Everything else — an oversized
+        // log, a permissions error, an I/O failure — is an *unreadable* trail, and
+        // must not be reported as an empty one: this file is the tamper-evidence
+        // record, so "0 records" and "cannot read" have opposite meanings.
+        // Callers (hive-mind_audit_list / _verify) already surface a throw as
+        // `success: false` with the message.
         if (!existsSync(filePath))
             return [];
-        try {
-            const MAX_BYTES = 50 * 1024 * 1024;
-            if (statSync(filePath).size > MAX_BYTES) {
-                throw new Error(`Audit log ${filePath} exceeds 50MB — run rotation/cleanup`);
-            }
-            const content = readFileSync(filePath, 'utf-8');
-            return parseJsonl(content);
-        }
-        catch {
-            return [];
+        const MAX_BYTES = 50 * 1024 * 1024;
+        if (statSync(filePath).size > MAX_BYTES) {
+            throw new Error(`Audit log ${filePath} exceeds 50MB — run rotation/cleanup`);
         }
+        const content = readFileSync(filePath, 'utf-8');
+        return parseJsonl(content);
     }
 }
 //# sourceMappingURL=audit-writer.js.map