moflo 4.10.0 → 4.10.2

package/dist/src/cli/memory/bridge-embedder.js

@@ -54,9 +54,14 @@ export const EMBEDDING_MODEL_LEGACY_DEFAULT = 'local';
  * - `epic-state`    — Epic progress (epic-N, story-M) written by commands/epic.ts
  * - `test-bridge-fix` — Single 2026-04-23 row left over from a one-off test
  *
+ * Membership is also extended by {@link EPHEMERAL_NAMESPACE_PREFIXES} for
+ * dynamic-name namespaces (e.g. `doctor-memprobe-<persona>`). Most callers
+ * should use {@link isEphemeralNamespace} which checks both sets.
+ *
  * See story #729 for the source-trace and rationale. The session-start
- * launcher only purges {@link PURGE_ON_SESSION_START_NAMESPACES} — a strict
- * subset that *excludes* `tasklist`, because the dashboard's Flo Runs tab
+ * launcher only purges {@link PURGE_ON_SESSION_START_NAMESPACES} +
+ * {@link PURGE_ON_SESSION_START_PREFIXES} — a strict subset that *excludes*
+ * `tasklist`, because the dashboard's Flo Runs tab
  * (`daemon-dashboard.ts handleSpells`) reads tasklist; purging it on every
  * session would empty the tab between sessions (#968).
  */
@@ -66,6 +71,26 @@ export const EPHEMERAL_NAMESPACES = new Set([
     'epic-state',
     'test-bridge-fix',
 ]);
+/**
+ * Prefix patterns that extend {@link EPHEMERAL_NAMESPACES} for namespaces
+ * whose suffix is generated at runtime. Any namespace beginning with one of
+ * these prefixes is treated as ephemeral (skips embedding).
+ *
+ * NOTE — design distinction from {@link PURGE_ON_SESSION_START_PREFIXES}:
+ * a namespace can be auto-purgeable WITHOUT being skip-embed. For example,
+ * `doctor-memprobe-<persona>` rows are intentionally purged on every
+ * session start (the cleanup is best-effort and accumulates across
+ * sessions) but MUST still get embeddings — the probe's whole purpose is
+ * to validate the embedder is wired (`Memory Access Functional` check
+ * asserts `hasEmbedding=true`). Skipping embedding for those rows breaks
+ * the doctor check. Put a prefix here only when both properties apply.
+ *
+ * Currently empty — there's no namespace today that needs both skip-embed
+ * AND prefix-match. Kept as an explicit export so the bridge embedder's
+ * call site is uniform and future skip-embed prefixes have an obvious
+ * home.
+ */
+export const EPHEMERAL_NAMESPACE_PREFIXES = new Set([]);
 /**
  * Subset of {@link EPHEMERAL_NAMESPACES} that the session-start launcher
  * hard-purges via `services/ephemeral-namespace-purge.ts`. Excludes
@@ -77,6 +102,62 @@ export const PURGE_ON_SESSION_START_NAMESPACES = new Set([
     'epic-state',
     'test-bridge-fix',
 ]);
+/**
+ * Prefix patterns purged alongside {@link PURGE_ON_SESSION_START_NAMESPACES}
+ * by the session-start launcher.
+ *
+ * Members:
+ * - `doctor-memprobe-` — `flo healer`'s `Memory Access` round-trip probe
+ *   writes a sentinel into `doctor-memprobe-<persona>` (persona is one of
+ *   `subagent`, `swarm-agent`, `hive-mind-worker`, plus test variants).
+ * - `doctor-neighbors-` — `flo healer`'s neighbor-traversal probe creates a
+ *   fresh `doctor-neighbors-<timestamp>` namespace for each run and seeds
+ *   three chunk rows. Unlike memprobe (fixed personas), every healer run
+ *   spawns a NEW namespace, so namespace pollution grows linearly with
+ *   healer-run count if cleanup races fail.
+ *
+ * Both probes register an explicit cleanup via `safeDelete`, but the
+ * cleanup is best-effort and silently swallows failures (e.g. daemon
+ * races, MCP transport errors) — so rows accumulate across consumer
+ * sessions. Auto-purging matches the pattern for
+ * `hive-mind`/`epic-state`/`test-bridge-fix`. These rows MUST still get
+ * embeddings (see {@link EPHEMERAL_NAMESPACE_PREFIXES} for why) — only
+ * their persistence across sessions is curtailed.
+ */
+export const PURGE_ON_SESSION_START_PREFIXES = new Set([
+    'doctor-memprobe-',
+    'doctor-neighbors-',
+]);
+/**
+ * Return `true` if a namespace is ephemeral — either an exact member of
+ * {@link EPHEMERAL_NAMESPACES} or one whose name begins with a prefix in
+ * {@link EPHEMERAL_NAMESPACE_PREFIXES}. Callers checking embedding-skip
+ * behavior should use this helper rather than `.has()` on the Set directly.
+ */
+export function isEphemeralNamespace(namespace) {
+    if (EPHEMERAL_NAMESPACES.has(namespace))
+        return true;
+    for (const prefix of EPHEMERAL_NAMESPACE_PREFIXES) {
+        if (namespace.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
+/**
+ * Return `true` if a namespace should be hard-purged on session start —
+ * either an exact member of {@link PURGE_ON_SESSION_START_NAMESPACES} or one
+ * whose name begins with a prefix in
+ * {@link PURGE_ON_SESSION_START_PREFIXES}.
+ */
+export function shouldPurgeOnSessionStart(namespace) {
+    if (PURGE_ON_SESSION_START_NAMESPACES.has(namespace))
+        return true;
+    for (const prefix of PURGE_ON_SESSION_START_PREFIXES) {
+        if (namespace.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
 /**
  * Maximum number of `tasklist` rows kept across session restarts. The
  * session-start retention pass deletes oldest rows beyond this cap, so the
@@ -140,7 +221,7 @@ export async function resolveBridgeEmbedding(value, precomputed, generateEmbeddi
     // Ephemeral namespaces (run-tracking, never user knowledge) skip embeddings
     // unconditionally — even precomputed vectors are dropped. Result row has
     // `embedding IS NULL` and `embedding_model IS NULL`. See #729.
-    if (namespace && EPHEMERAL_NAMESPACES.has(namespace)) {
+    if (namespace && isEphemeralNamespace(namespace)) {
         return { ok: true, json: null, dimensions: 0, model: null };
     }
     const wantsEmbedding = generateEmbeddingFlag !== false && value.length > 0;

package/dist/src/cli/memory/memory-initializer.js

@@ -20,7 +20,7 @@ import * as path from 'path';
 import { formatEmbeddingError } from './embedding-errors.js';
 import { HnswLite } from './hnsw-lite.js';
 import { tryLoadHnswSidecar } from './hnsw-persistence.js';
-import { EMBEDDING_MODEL_OPT_OUT, EPHEMERAL_NAMESPACES, getBridgeEmbedder } from './bridge-embedder.js';
+import { EMBEDDING_MODEL_OPT_OUT, getBridgeEmbedder, isEphemeralNamespace } from './bridge-embedder.js';
 import { parseEmbeddingJson, toFloat32 } from './controllers/_shared.js';
 import { writeVectorStatsJson } from './bridge-core.js';
 import { serialiseMetadata } from './bridge-entries.js';
@@ -1619,7 +1619,7 @@ export async function storeEntry(options) {
         let embeddingJson = null;
         let embeddingDimensions = null;
         let embeddingModel = EMBEDDING_MODEL_OPT_OUT;
-        const isEphemeralNs = EPHEMERAL_NAMESPACES.has(namespace);
+        const isEphemeralNs = isEphemeralNamespace(namespace);
         if (isEphemeralNs) {
             embeddingModel = null;
         }

package/dist/src/cli/services/ephemeral-namespace-purge.js

@@ -27,7 +27,7 @@
  * @module cli/services/ephemeral-namespace-purge
  */
 /* eslint-disable @typescript-eslint/no-explicit-any */
-import { PURGE_ON_SESSION_START_NAMESPACES, TASKLIST_RETENTION_CAP, } from '../memory/bridge-embedder.js';
+import { PURGE_ON_SESSION_START_NAMESPACES, PURGE_ON_SESSION_START_PREFIXES, TASKLIST_RETENTION_CAP, } from '../memory/bridge-embedder.js';
 import { memoryDbPath } from './moflo-paths.js';
 import { openDaemonDatabase } from '../memory/daemon-backend.js';
 /**
@@ -56,18 +56,28 @@ export async function purgeEphemeralNamespaces(options = {}) {
         // Single COUNT pass to gate both DELETEs — a clean DB is the steady
         // state and we don't want two no-op DELETEs (with their query-planner
         // overhead) on every session start.
+        //
+        // Match shape: exact namespace IN (...) OR namespace LIKE 'prefix-%'.
+        // The prefix clause covers runtime-suffixed namespaces like
+        // `doctor-memprobe-<persona>` whose set of suffixes isn't known upfront.
         const namespaces = Array.from(PURGE_ON_SESSION_START_NAMESPACES);
+        const prefixes = Array.from(PURGE_ON_SESSION_START_PREFIXES);
         const cap = options.tasklistRetentionCap ?? TASKLIST_RETENTION_CAP;
-        const placeholders = namespaces.map(() => '?').join(', ');
+        const exactClause = namespaces.length
+            ? `namespace IN (${namespaces.map(() => '?').join(', ')})`
+            : '0';
+        const prefixClause = prefixes.map(() => 'namespace LIKE ?').join(' OR ');
+        const purgeWhere = prefixClause ? `(${exactClause} OR ${prefixClause})` : exactClause;
+        const purgeBindings = [...namespaces, ...prefixes.map((p) => `${p}%`)];
         const countRows = db.exec(`SELECT
-         (SELECT COUNT(*) FROM memory_entries WHERE namespace IN (${placeholders})) AS purgeable,
-         (SELECT COUNT(*) FROM memory_entries WHERE namespace = 'tasklist') AS tasklistTotal`, namespaces);
+         (SELECT COUNT(*) FROM memory_entries WHERE ${purgeWhere}) AS purgeable,
+         (SELECT COUNT(*) FROM memory_entries WHERE namespace = 'tasklist') AS tasklistTotal`, purgeBindings);
         const counts = countRows[0]?.values?.[0] ?? [0, 0];
         const purgeable = Number(counts[0] ?? 0);
         const tasklistTotal = Number(counts[1] ?? 0);
         let purged = 0;
         if (purgeable > 0) {
-            db.run(`DELETE FROM memory_entries WHERE namespace IN (${placeholders})`, namespaces);
+            db.run(`DELETE FROM memory_entries WHERE ${purgeWhere}`, purgeBindings);
             purged = db.getRowsModified?.() ?? 0;
         }
         let trimmed = 0;

package/dist/src/cli/services/memory-db-integrity-repair.js

@@ -0,0 +1,119 @@
+/**
+ * TS bridge for `flo healer --fix -c memory-db-integrity` and any other
+ * caller that wants the tiered repair (REINDEX → VACUUM INTO → row-level
+ * salvage) implemented in {@link
+ * "../../../bin/lib/db-repair.mjs".repairMemoryDbIfCorrupt} but with the
+ * caller-side daemon coordination that the launcher path gets for free.
+ *
+ * The launcher (bin/session-start-launcher.mjs § 0c) runs the same repair
+ * at session start after the daemon is already stopped. A mid-session
+ * healer call needs to stop the daemon itself first — a live writer would
+ * race the atomic swap on Windows (EBUSY on `renameSync`) and leak
+ * corruption back through stale POSIX inodes elsewhere.
+ *
+ * Cross-platform notes:
+ *  - `process.kill(pid, 'SIGTERM')` maps to `TerminateProcess` on Windows
+ *    (Node maps every signal name to immediate termination on win32);
+ *    behaves like POSIX SIGTERM on Linux/macOS. Either way the daemon
+ *    exits before we touch the DB file.
+ *  - Path resolution uses `import.meta.url` so dist/ and bin/ stay
+ *    siblings whether moflo is running from a dogfood checkout or from a
+ *    consumer's `node_modules/moflo/` install.
+ *  - The MCP server (spawned by Claude Code per `.mcp.json`, not by moflo)
+ *    is out of our process tree and cannot be stopped here. We surface
+ *    explicit guidance to restart Claude Code in the caller's UX.
+ */
+import { existsSync, unlinkSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { getDaemonLockHolder, getDaemonLockPayload } from './daemon-lock.js';
+import { findMofloPackageRoot } from './moflo-require.js';
+async function loadJsDbRepairModule() {
+    // Resolve the JS module via the moflo package root walk so the path
+    // works identically in three contexts:
+    //   - Dogfood TS source (vitest): walks up from the .ts location to the
+    //     repo's package.json → joins `bin/lib/db-repair.mjs`
+    //   - Compiled dist (CLI runtime): walks up from dist/src/cli/services/
+    //     to package root → joins `bin/lib/db-repair.mjs`
+    //   - Consumer install: walks up from
+    //     node_modules/moflo/dist/src/cli/services/ to
+    //     node_modules/moflo/ → joins `bin/lib/db-repair.mjs`
+    // The previous `new URL('../../../../bin/lib/...', import.meta.url)` only
+    // worked in the dist context — source-tree depth is one level shallower
+    // so vitest hit "Cannot find module" on the wrong path.
+    const root = findMofloPackageRoot();
+    if (!root) {
+        throw new Error('moflo package root not found — cannot locate bin/lib/db-repair.mjs');
+    }
+    const repairPath = join(root, 'bin', 'lib', 'db-repair.mjs');
+    const repairUrl = pathToFileURL(repairPath).href;
+    return (await import(repairUrl));
+}
+/**
+ * Probe `.moflo/moflo.db` for corruption without WAL pragmas — the readonly
+ * raw-DatabaseSync open that bypasses the openBackend code path which itself
+ * throws on corrupt files (pre-#1090's silent-"healthy"-reporting bug).
+ *
+ * Single source of truth: delegates to {@link
+ * "../../../bin/lib/db-repair.mjs".probeIntegrityRaw}. Callers in the TS tree
+ * (currently `checkMemoryDbIntegrity` doctor check) should use this rather
+ * than re-deriving the readonly+no-PRAGMAs probe so the implementation
+ * stays in one place.
+ */
+export async function probeDbIntegrity(dbPath) {
+    const mod = await loadJsDbRepairModule();
+    return mod.probeIntegrityRaw(dbPath);
+}
+/**
+ * Send a SIGTERM-equivalent to the daemon PID and clear the lockfile.
+ * Returns true if a live daemon was actually stopped. Cross-platform:
+ * `process.kill` accepts the signal name on all platforms; Node treats it
+ * as an immediate terminate on Windows.
+ */
+function stopDaemon(projectRoot) {
+    const payload = getDaemonLockPayload(projectRoot);
+    if (!payload?.pid || payload.pid <= 0)
+        return false;
+    try {
+        process.kill(payload.pid, 'SIGTERM');
+    }
+    catch {
+        // ESRCH (already dead) or EPERM — treat both as "nothing to stop".
+        return false;
+    }
+    const lockFile = join(projectRoot, '.moflo', 'daemon.lock');
+    try {
+        if (existsSync(lockFile))
+            unlinkSync(lockFile);
+    }
+    catch { /* */ }
+    return true;
+}
+/**
+ * Run the tiered repair against the project's `.moflo/moflo.db`.
+ *
+ * Default behavior is to stop the daemon if alive (cross-platform via
+ * `process.kill('SIGTERM')`) so the atomic swap doesn't race a live writer.
+ * Pass `stopDaemonFirst: false` to suppress that — the launcher path uses
+ * this because its own daemon-stop already ran before § 0c.
+ *
+ * Never throws; any internal error surfaces as
+ * `{ repaired: false, errors: 0, persistent: true }`.
+ */
+export async function repairMemoryDbIntegrity(projectRoot = process.cwd(), options = {}) {
+    const root = resolve(projectRoot);
+    const stopFirst = options.stopDaemonFirst !== false;
+    let daemonStopped = false;
+    if (stopFirst && getDaemonLockHolder(root) !== null) {
+        daemonStopped = stopDaemon(root);
+    }
+    try {
+        const mod = await loadJsDbRepairModule();
+        const result = await mod.repairMemoryDbIfCorrupt(root);
+        return { ...result, daemonStopped };
+    }
+    catch {
+        return { repaired: false, errors: 0, persistent: true, daemonStopped };
+    }
+}
+//# sourceMappingURL=memory-db-integrity-repair.js.map

package/dist/src/cli/version.js

@@ -2,5 +2,5 @@
  * Auto-generated by build. Do not edit manually.
  * Source of truth: root package.json → scripts/sync-version.mjs
  */
-export const VERSION = '4.10.0';
+export const VERSION = '4.10.2';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.10.0",
+  "version": "4.10.2",
   "description": "MoFlo — AI agent orchestration for Claude Code. A standalone, opinionated toolkit with semantic memory, learned routing, gates, spells, and the /flo issue-execution skill.",
   "main": "dist/src/cli/index.js",
   "type": "module",
@@ -95,7 +95,7 @@
     "@typescript-eslint/eslint-plugin": "^7.18.0",
     "@typescript-eslint/parser": "^7.18.0",
     "eslint": "^8.0.0",
-    "moflo": "^4.9.37",
+    "moflo": "^4.10.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"