Skip to content

v2.1.8

Choose a tag to compare

View all tags
@nokhodian nokhodian released this 17 Jul 12:16
v2.1.8
5744eb5

Deep-review round on the routing-feedback/stale-helpers fix chain, plus a full app-wide audit

My deep-review pass (adversarial re-review of everything shipped in 2.1.5–2.1.7), each finding verified live before being fixed:

  1. Cross-subagent contamination — capture-handler.cjs's SubagentStop handler diffed "new files in the directory" rather than scoping to the stopping subagent's own transcript. Under concurrent multi-agent swarms, a sibling subagent's transcript could get folded into this subagent's success/failure record — undermining the 2.1.5 routing-feedback fix in the exact topology this project defaults to. Fixed by reading the subagent's own transcript via transcript_path directly; added a permanent regression test proving the old code misattributed a sibling's failure and the new code doesn't.
  2. Dev-repo detection gap — opening Claude Code from a subdirectory of this monorepo could have let the session-start self-heal silently overwrite the repo's own source helpers with a stale published version. Now walks up from CWD.
  3. Windows compatibility — the background self-heal's npx spawn now uses shell:true on Windows (previously failed silently).
  4. Rate-limiter fail-open — a persistently unwritable heal-check marker used to make the background heal fire on every session instead of once per 6h. Now fails closed.
  5. Silent classification gap — an oversized bundled helper was invisibly excluded from doctor's staleness check.

A parallel session ran a full 7-agent app-wide audit and found/fixed a 4th independent hardcoded helper-file list (session-restore-handler.cjs) that the earlier registry consolidation missed, plus: unauthenticated dashboard reads (real security fix — GET routes now require the same auth as writes), a broken vi.mock('ws') that let CDP tests silently make real network connections, monograph staleness defaults, a SwarmCheckpointer O(n)-per-save bottleneck, stale/false claims in CLAUDE.md, and more. Full findings/remediation trail in docs/mastermind/plans/2026-07-17-app-audit-plan.md.

Verified before shipping: typecheck clean, full CLI suite 772/774 (1 pre-existing unrelated flaky fs-watcher timing test, confirmed passing 3/3 in isolation), memory package 93/93, npm pack --dry-run confirms no exFAT artifacts in the published tarball.

Packages published: monomind@2.1.8, @monoes/monomindcli@2.1.8

Assets 2
Loading