v2.29.0

Added

• org_compact_role and org_clear_role: the coordinator can release a worker's context (#717). org_compact_role { roleId, reason } asks the role's session for a summary (goal, decisions, key facts and paths, what is still open), then replaces it with a fresh session that opens with that summary. org_clear_role { roleId, reason } replaces a role whose work is done with a fresh, empty session, and is rejected with the task ids while the role still owns open tasks. Both keep the role id, workspace, task ownership and queued messages, and are refused for the coordinator itself, for a role with a turn running, and when the call does not come from the coordinator. A failed or empty summary returns success: false and leaves the old session as it was. A reset does not use max_role_respawns and does not raise the org-wide token budget; its own cap is the new run_config.max_role_resets (per role per run). It is an integer from 0 to 100 and off unless set above 0, so existing orgs keep their tool lists byte for byte. What a role spent before a reset comes off its token ceiling. The summary is matched to its own request (exactly one begin and one end marker, each alone on its line), never inherited by a replacement if it times out, and handed to the new session as fenced, untrusted notes with every Unicode line separator normalised and control and zero-width characters removed. org reload keeps the token-cap reduction: a changed cap becomes the new cap minus what the role already spent. Both are audit-logged as role-reset with the reason and the new generation.

Changed

• The mesh tools are no longer in the default advertised MCP roster (back to 21 tools). 2.28.0 advertised mesh_who, mesh_join and mesh_leave by default and raised the schema byte budget from 16,000 to 18,000 to fit them. The lean roster of #410 is restored (16,000-byte budget, 21 tools): until sessions join the mesh by themselves, three more tools in every session cost more than they give. The tools still work exactly as before and are found with monomind_tool_search or called by name.
• A codex role's policy.sandbox.allowWrite directories are now writable. The codex runner never passed allowWrite to codex's sandbox, so a role on the codex runtime could write only its working directory and $TMPDIR even where its policy allowed more (for example {{home}}/release-checkout): the write failed with "Read-only file system". Below policy.git: 'push' the safe entries now become sandbox_workspace_write.writable_roots of codex exec --sandbox workspace-write, after the checks the claude sandbox applies: real directories only, no symlinks, never / or the home, nothing holding or inside a credential, authority or operator-protected path or a denyWrite entry. Dropped entries and their reasons are in the new audit event codex-write-roots. A role with no allowWrite gets the same command line as before. codex keeps .git read-only inside a writable root and cannot deny a path inside one, so denyWrite stays unenforced in the working directory on codex and org validate #24 now says so. No org config changed.

Fixed

• The nightly "Graph search eval" workflow runs again (#682). It had failed on every scheduled run since it was added with No pnpm version is specified: pnpm/action-setup was given no version and the root package.json has no packageManager field. It now pins pnpm 10 like the other workflows and builds the CLI itself (the build step only built its dependencies, so cli.js could not start).
• pnpm audit is clean: no advisories left (#711). The three high findings in shipped dependencies (zod, body-parser, undici) are bumped by #714. The fourth, zod 3.25.76, came from puppeteer → chromium-bidi in the development-only dependencies of @monoes/monodesign; puppeteer is now ^25.16.0, whose chromium-bidi uses zod 4. Nothing in the published packages changes (puppeteer is not a runtime dependency).
• Generated files no longer land in a user's real home directory (#712). The helper scripts that build the agent and skill registries (.claude/helpers/agent-registry.cjs, build-skill-registry.cjs) walked up from the working directory to the first .monomind/.claude and excluded only os.homedir(), which follows $HOME. A process run with a different HOME (a sandboxed org role, a QA drill) anywhere under the real home treated the real home as a project and wrote ~/.monomind/registry.json and ~/.claude/helpers/skill-registry.json there. The walk now also stops at $HOME and the passwd home, compared by canonical path so a symlinked alias is covered too.
• A failed temp-file rename no longer leaves the temp file behind. All six helper scripts that write a temp file and rename it (agent-registry, build-skill-registry, event-logger, intelligence, pick-stats, token-tracker) now remove it when the write or rename fails (for example EBUSY on a bind-mounted target in a sandbox). This was the source of the registry.json.<pid>.tmp files piling up in ~/.monomind; existing ones can be deleted by hand.
• Test runs no longer fail a whole file with ENOTEMPTY: directory not empty, rmdir '/tmp/mm-test-run-home-…'. The teardown that removes a file's temp home made one attempt, so a timer or daemon that was still writing into it failed the file (twice on main in one afternoon). It now retries for about 2.7 s, which is how long a stray last write takes to finish. CLAUDE.md also says that pnpm test covers only the root project and that CI runs pnpm run test:all:run.
• monobrowse headed switch closes Chrome on error and its profile dir is sweepable (3bd247a). A failed headed switch no longer leaks a Chrome process or its profile directory. @monoes/monobrowse bumped to 2.24.3.

Security

• vite is required at >=8.1.6 (dfaea27) so the Dependabot-flagged range cannot resolve.