moflo 4.12.0 → 4.12.2

package/dist/src/cli/commands/sdd.js

@@ -16,12 +16,14 @@
  *   flo sdd path <slug> [spec|plan]  Print the artifact path (for skill shell-out)
  *   flo sdd embed <slug>             Print spec+plan as a PR-body block (#1297)
  *   flo sdd index                    Re-index specs into memory now (also runs at session start)
+ *   flo sdd mode --args "<flo args>" Resolve sdd/verify/merge for a /flo run as JSON
  */
 import { spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { atomicWriteFileSync } from '../shared/utils/atomic-file-write.js';
 import { findProjectRoot } from '../services/project-root.js';
+import { loadMofloConfig } from '../config/moflo-config.js';
 import { locateMofloRootPath } from '../services/moflo-require.js';
 import { artifactPath, assertReviewed, listSpecs, newArtifact, readArtifact, slugify, specExists, validateArtifact, writeArtifact, } from '../sdd/index.js';
 import { defaultPlanBody, defaultSpecBody } from '../sdd/templates.js';
@@ -226,6 +228,119 @@ function cmdList(ctx) {
     }
     return { success: true, data: specs };
 }
+/**
+ * Resolve the effective `/flo` run modifiers from an argument string + moflo.yaml
+ * and print them as JSON. This is the FALLBACK path for the authoritative
+ * announcement that `bin/gate.cjs prompt-reminder` normally injects on every
+ * `/flo` prompt — consumers with hooks disabled (or a gate.cjs predating this
+ * change) still get a deterministic answer by shelling out to this.
+ *
+ * Exists because the `/flo` skill used to carry `let sddMode = false` as a
+ * literal beside a comment saying "seed from moflo.yaml"; the model executed the
+ * literal and `sdd.default: true` was silently ignored. Config-derived run modes
+ * must be COMPUTED, never described in prose next to a contradicting default.
+ *
+ * Precedence per key: `--no-X` > `-x`/`--X` > moflo.yaml > built-in. Built-in
+ * defaults differ deliberately: sdd is opt-in (false), verify is opt-out (true,
+ * #1294), merge is opt-in (false, #1285).
+ *
+ * SYNC: mirrors `resolveFloRun` in bin/gate.cjs (and its copy in
+ * init/helpers-generator.ts). Any precedence change MUST land in all three.
+ */
+function cmdMode(ctx) {
+    // MUST be passed as `--args=<value>`, not `--args <value>`: the flag parser
+    // only consumes a following token as a value when it does not start with `-`,
+    // so `--args "-sd 42"` would silently degrade to `args=true` and resolve every
+    // run to the bare config default. The `=` form bypasses that lookahead.
+    // parseValue may coerce a bare numeric ("42") to a number — coerce back.
+    const flagArgs = ctx.flags?.args;
+    const raw = (typeof flagArgs === 'string' || typeof flagArgs === 'number')
+        ? String(flagArgs)
+        : (ctx.args ?? []).slice(1).join(' ');
+    // Tokenize on whitespace so `-sd` is matched as a whole token — it is NOT
+    // `-s` (swarm) + `d`.
+    const tokens = raw.trim().split(/\s+/).filter(Boolean);
+    const has = (...names) => names.some((n) => tokens.includes(n));
+    const cfg = loadMofloConfig(projectRoot(ctx));
+    let workflow = 'full';
+    if (has('-wf', '--workflow'))
+        workflow = 'spell-engine';
+    else if (has('-r', '--research'))
+        workflow = 'research';
+    else if (has('-t', '--ticket'))
+        workflow = 'ticket';
+    const epicBranch = has('--epic-branch');
+    let sdd = false;
+    let sddSrc = 'default';
+    if (has('--no-sdd')) {
+        sdd = false;
+        sddSrc = 'flag';
+    }
+    else if (has('-sd', '--sdd')) {
+        sdd = true;
+        sddSrc = 'flag';
+    }
+    else if (cfg.sdd.default) {
+        sdd = true;
+        sddSrc = 'moflo.yaml sdd.default';
+    }
+    let verify;
+    let verifySrc = 'default';
+    if (has('--no-verify')) {
+        verify = false;
+        verifySrc = 'flag';
+    }
+    else if (has('-v', '--verify')) {
+        verify = true;
+        verifySrc = 'flag';
+    }
+    else if (!cfg.gates.verify_before_done) {
+        verify = false;
+        verifySrc = 'moflo.yaml gates.verify_before_done';
+    }
+    else {
+        verify = true;
+    }
+    // --sdd implies --verify: a spec/plan without an enforced verify step drifts.
+    if (sdd && !verify && verifySrc !== 'flag')
+        verify = true;
+    let merge = false;
+    let mergeSrc = 'default';
+    if (has('--no-merge')) {
+        merge = false;
+        mergeSrc = 'flag';
+    }
+    else if (has('-m', '--merge')) {
+        merge = true;
+        mergeSrc = 'flag';
+    }
+    else if (cfg.merge.auto) {
+        merge = true;
+        mergeSrc = 'moflo.yaml merge.auto';
+    }
+    // Applicability: -t/-r never implement, so verify is a no-op there; -r and -wf
+    // produce no spec artifacts (in -t the spec/plan goes INTO the ticket, so sdd
+    // stays on). Only a full, non-epic-branch run opens a PR to merge.
+    // Re-attribute anything applicability turned off — a false must never carry the
+    // source of the value it no longer has. SYNC: mirrors bin/gate.cjs.
+    if (workflow === 'ticket' || workflow === 'research') {
+        if (verify)
+            verifySrc = `${workflow} mode does not implement`;
+        verify = false;
+    }
+    if (workflow === 'research' || workflow === 'spell-engine') {
+        if (sdd)
+            sddSrc = `${workflow} mode produces no spec artifacts`;
+        sdd = false;
+    }
+    if (workflow !== 'full' || epicBranch) {
+        if (merge)
+            mergeSrc = epicBranch ? '--epic-branch owns merging' : `${workflow} mode opens no PR`;
+        merge = false;
+    }
+    console.log(JSON.stringify({ workflow, sdd, verify, merge, sddSrc, verifySrc, mergeSrc }, null, 2));
+    return { success: true };
+}
 function cmdPath(ctx) {
     const root = projectRoot(ctx);
     const slug = slugify(ctx.args[1] || '');
@@ -294,7 +409,8 @@ Spec-Driven Development artifacts (.moflo/specs/<slug>/{spec,plan}.md):
   list                     List every spec slug
   path <slug> [spec|plan]  Print the artifact path
   embed <slug>             Print spec+plan as a collapsible block for the PR body
-  index                    Re-index specs into memory now`;
+  index                    Re-index specs into memory now
+  mode --args "<flo args>" Resolve sdd/verify/merge for a /flo run as JSON (moflo.yaml + flags)`;
 const sddCommand = {
     name: 'sdd',
     description: 'Spec-Driven Development artifacts (spec → plan → implement → verify)',
@@ -322,6 +438,8 @@ const sddCommand = {
                 return cmdStatus(ctx);
             case 'list':
                 return cmdList(ctx);
+            case 'mode':
+                return cmdMode(ctx);
             case 'path':
                 return cmdPath(ctx);
             case 'embed':

package/dist/src/cli/index.js

@@ -464,6 +464,21 @@ export class CLI {
      * Non-blocking — fires and forgets. Errors are silently swallowed.
      */
     async maybeAutoStartDaemon() {
+        // Test-only kill switch. A test that shells the CLI into a throwaway tmp
+        // project gets `daemon.auto_start: true` from DEFAULT_CONFIG (no moflo.yaml
+        // there to say otherwise), so EVERY such invocation spawned a detached,
+        // unref'd daemon. When the test then removed its tmp dir, the daemon
+        // survived holding a deleted cwd — no lockfile left to contend for, no
+        // project root to match, so nothing ever reclaimed it. One full suite run
+        // leaked several; they accumulated across runs into dozens of ~87MB
+        // processes that only `doctor --fix` could reap.
+        //
+        // Set in vitest.setup.ts alongside MOFLO_TEST_TRUST_DAEMON_PID and
+        // MOFLO_TEST_SKIP_ORPHAN_SCAN. Subprocesses inherit it, which is what makes
+        // it reach the spawned CLI. Production never sets it; a test that genuinely
+        // wants autostart can delete it in its own beforeEach, same as the others.
+        if (process.env.MOFLO_TEST_SKIP_DAEMON_AUTOSTART === '1')
+            return;
         const config = loadMofloConfig(process.cwd());
         if (!config.daemon.auto_start)
             return;

package/dist/src/cli/init/executor.js

@@ -11,7 +11,7 @@ import { dirname } from 'path';
 // ESM-compatible __dirname
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
-import { detectPlatform, DEFAULT_INIT_OPTIONS } from './types.js';
+import { detectPlatform, DEFAULT_INIT_OPTIONS, SKILL_CATEGORIES } from './types.js';
 import { generateSettingsJson, generateSettings } from './settings-generator.js';
 import { generateMCPJson } from './mcp-generator.js';
 import { generatePreCommitHook, generatePostCommitHook, generateAutoMemoryHook, generateGateScript, generateGateHookScript, generatePromptHookScript, generateHookHandlerScript, } from './helpers-generator.js';
@@ -31,6 +31,8 @@ import { readMofloEnv } from '../services/env-compat.js';
 // cruft). New additions MUST pass the same audit, otherwise the drift-guard
 // test (skills-classification-drift.test.ts) fails. See INTERNAL_SKILLS for
 // skills that ship in the tarball but are deliberately NOT installed.
+// Typed by SkillCategory (not `string`) so this map and `SkillsConfig` cannot
+// drift apart again — see SKILL_CATEGORIES in types.ts for what that drift cost.
 export const SKILLS_MAP = {
     core: [
         'commune',
@@ -915,9 +917,14 @@ async function copySkills(targetDir, options, result) {
         Object.values(SKILLS_MAP).forEach(skills => skillsToCopy.push(...skills));
     }
     else {
-        for (const [key, skills] of Object.entries(SKILLS_MAP)) {
-            if (skillsConfig[key])
-                skillsToCopy.push(...skills);
+        // Iterate SKILL_CATEGORIES rather than Object.entries + a cast. The cast
+        // was what let `SKILLS_MAP`'s keys drift away from `SkillsConfig`'s without
+        // a type error, silently disabling the `memory` and `spells` categories
+        // (#1308). Indexing a typed Record by the category union needs no cast, so
+        // the compiler now enforces that every category is selectable.
+        for (const category of SKILL_CATEGORIES) {
+            if (skillsConfig[category])
+                skillsToCopy.push(...SKILLS_MAP[category]);
         }
     }
     // Find source skills directory

package/dist/src/cli/init/helpers-generator.js

@@ -293,6 +293,18 @@ function loadSddConfig() {
   return out;
 }
 
+// #1285 — parse the top-level merge: block. Block-scoped like loadSddConfig.
+// SYNC: mirrors bin/gate.cjs loadMergeConfig.
+function loadMergeConfig() {
+  var out = { auto: false };
+  var content = MOFLO_YAML;
+  if (!content) return out;
+  var block = content.match(/^merge:[ \\t]*\\r?\\n((?:[ \\t]+.*(?:\\r?\\n|$))*)/m);
+  if (!block) return out;
+  if (/^\\s*auto:\\s*true\\b/im.test(block[1])) out.auto = true;
+  return out;
+}
+
 // #1297 — read moflo.yaml once (both loaders parse it; gate fires on every
 // Write/Edit). SYNC: mirrors bin/gate.cjs readMofloYaml.
 function readMofloYaml() {
@@ -303,9 +315,16 @@ var MOFLO_YAML = readMofloYaml();
 
 var config = loadGateConfig();
 var sddConf = loadSddConfig();
+var mergeConf = loadMergeConfig();
 var command = process.argv[2];
 
 var EXEMPT = ['.claude/', '.claude\\\\', 'CLAUDE.md', 'MEMORY.md', 'workflow-state', 'node_modules', 'moflo.yaml'];
+
+// Appended to every memory-first denial so a context audit doesn't read gate
+// enforcement as permission misconfiguration (#1307 finding 5). SYNC: mirrors
+// bin/gate.cjs GATE_ORIGIN_NOTE / GATE_DISABLE_NOTE.
+var GATE_ORIGIN_NOTE = 'This is a moflo hook, not a Claude Code permission rule — allow-rules cannot override it.';
+var GATE_DISABLE_NOTE = 'Disable per-gate via moflo.yaml: gates: memory_first: false';
 // #1294 Finding 3 — exempt ephemeral reads/scans under the OS temp dir
 // (background-task output, scratchpads) from the memory-first gate. Mirrors
 // bin/gate.cjs isEphemeralPath. Cross-platform via os.tmpdir(); normalizes a
@@ -388,13 +407,58 @@ function detectFlMode(promptText) {
   return null;
 }
 
-// #1297 — arm the SDD implement gate from a /flo prompt. SYNC: mirrors bin/gate.cjs.
-function detectSddMode(promptText) {
+// Resolve ALL /flo run modifiers from the prompt + moflo.yaml. Single source of
+// truth for gate arming AND the authoritative announcement below — a second
+// implementation is how sdd.default got silently ignored. Precedence per key:
+// --no-X > -x/--X > moflo.yaml > built-in (sdd opt-in, verify opt-out, merge
+// opt-in). SYNC: mirrors bin/gate.cjs resolveFloRun.
+function resolveFloRun(promptText) {
   var p = promptText || '';
-  if (!/^\\s*\\/(?:fl|flo)\\b/i.test(p)) return false;
-  if (/(?:^|\\s)--no-sdd\\b/.test(p)) return false;
-  if (/(?:^|\\s)(?:-sd|--sdd)\\b/.test(p)) return true;
-  return !!sddConf.default;
+  var out = { isFlo: false, workflow: 'full', sdd: false, verify: false, merge: false,
+              sddSrc: 'default', verifySrc: 'default', mergeSrc: 'default' };
+  if (!/^\\s*\\/(?:fl|flo)\\b/i.test(p)) return out;
+  out.isFlo = true;
+
+  if (/(?:^|\\s)(?:-wf|--workflow)\\b/.test(p)) out.workflow = 'spell-engine';
+  else if (/(?:^|\\s)(?:-r|--research)\\b/.test(p)) out.workflow = 'research';
+  else if (/(?:^|\\s)(?:-t|--ticket)\\b/.test(p)) out.workflow = 'ticket';
+  var epicBranch = /(?:^|\\s)--epic-branch\\b/.test(p);
+
+  if (/(?:^|\\s)--no-sdd\\b/.test(p)) { out.sdd = false; out.sddSrc = 'flag'; }
+  else if (/(?:^|\\s)(?:-sd|--sdd)\\b/.test(p)) { out.sdd = true; out.sddSrc = 'flag'; }
+  else if (sddConf.default) { out.sdd = true; out.sddSrc = 'moflo.yaml sdd.default'; }
+
+  if (/(?:^|\\s)--no-verify\\b/.test(p)) { out.verify = false; out.verifySrc = 'flag'; }
+  else if (/(?:^|\\s)(?:-v|--verify)\\b/.test(p)) { out.verify = true; out.verifySrc = 'flag'; }
+  else if (!config.verify_before_done) { out.verify = false; out.verifySrc = 'moflo.yaml gates.verify_before_done'; }
+  else { out.verify = true; out.verifySrc = 'default'; }
+  if (out.sdd && !out.verify && out.verifySrc !== 'flag') out.verify = true;
+
+  if (/(?:^|\\s)--no-merge\\b/.test(p)) { out.merge = false; out.mergeSrc = 'flag'; }
+  else if (/(?:^|\\s)(?:-m|--merge)\\b/.test(p)) { out.merge = true; out.mergeSrc = 'flag'; }
+  else if (mergeConf.auto) { out.merge = true; out.mergeSrc = 'moflo.yaml merge.auto'; }
+
+  // Re-attribute anything applicability turned off — a false must never carry
+  // the source of the value it no longer has. SYNC: mirrors bin/gate.cjs.
+  if (out.workflow === 'ticket' || out.workflow === 'research') {
+    if (out.verify) out.verifySrc = out.workflow + ' mode does not implement';
+    out.verify = false;
+  }
+  if (out.workflow === 'research' || out.workflow === 'spell-engine') {
+    if (out.sdd) out.sddSrc = out.workflow + ' mode produces no spec artifacts';
+    out.sdd = false;
+  }
+  if (out.workflow !== 'full' || epicBranch) {
+    if (out.merge) out.mergeSrc = epicBranch ? '--epic-branch owns merging' : out.workflow + ' mode opens no PR';
+    out.merge = false;
+  }
+  return out;
+}
+
+// #1297 — arm the SDD implement gate from a /flo prompt. Thin wrapper so the
+// armed decision and the announced decision can never disagree.
+function detectSddMode(promptText) {
+  return resolveFloRun(promptText).sdd;
 }
 
 // SDD specs-root resolution + artifact helpers for check-before-implement.
@@ -570,7 +634,7 @@ switch (command) {
     var target = (process.env.TOOL_INPUT_pattern || '') + ' ' + (process.env.TOOL_INPUT_path || '');
     if (isEphemeralPath(process.env.TOOL_INPUT_path)) break;
     if (EXEMPT.some(function(p) { return target.indexOf(p) >= 0; })) break;
-    process.stderr.write('BLOCKED: Search memory before exploring files. Use mcp__moflo__memory_search.\\n');
+    process.stderr.write('BLOCKED [moflo memory_first gate]: Search memory before exploring files. Use mcp__moflo__memory_search.\\n' + GATE_ORIGIN_NOTE + '\\n' + GATE_DISABLE_NOTE + '\\n');
     process.exit(2);
   }
   case 'check-before-read': {
@@ -580,7 +644,7 @@ switch (command) {
     var fp = process.env.TOOL_INPUT_file_path || '';
     if (isEphemeralPath(fp)) break;
     if (fp.indexOf('.claude/guidance/') < 0 && fp.indexOf('.claude\\\\guidance\\\\') < 0) break;
-    process.stderr.write('BLOCKED: Search memory before reading guidance files. Use mcp__moflo__memory_search.\\n');
+    process.stderr.write('BLOCKED [moflo memory_first gate]: Search memory before reading guidance files. Use mcp__moflo__memory_search.\\n' + GATE_ORIGIN_NOTE + '\\n' + GATE_DISABLE_NOTE + '\\n');
     process.exit(2);
   }
   case 'record-task-created': {
@@ -612,11 +676,12 @@ switch (command) {
     // See bin/gate.cjs check-bash-memory for full rationale.
     var hint = s2.lastNamespaceHint || classifyBashNamespaceHint(cmd) || '';
     process.stderr.write(
-      'BLOCKED: Search memory before reading files via Bash.\\n' +
+      'BLOCKED [moflo memory_first gate]: Search memory before reading files via Bash.\\n' +
       'Example: mcp__moflo__memory_search { query: "<topic>", namespace: "<one of: guidance | code-map | patterns | learnings | tests>" }\\n' +
       (hint ? hint + '\\n' : '') +
       'On chunk hits, traverse via mcp__moflo__memory_get_neighbors — see .claude/guidance/moflo-memory-protocol.md\\n' +
-      'Disable per-gate via moflo.yaml: gates: memory_first: false\\n'
+      GATE_ORIGIN_NOTE + '\\n' +
+      GATE_DISABLE_NOTE + '\\n'
     );
     process.exit(2);
     break;
@@ -779,6 +844,30 @@ switch (command) {
     applyPromptStateReset(s, prompt);
     s.interactionCount = (s.interactionCount || 0) + 1;
     writeState(s);
+    // Announce the resolved /flo run modifiers. moflo.yaml was already parsed in
+    // THIS process (fresh per prompt — a git pull or mid-session yaml edit is
+    // picked up automatically, no cache to invalidate), so this costs no extra
+    // read. SYNC: mirrors bin/gate.cjs prompt-reminder.
+    var floRun = resolveFloRun(prompt);
+    if (floRun.isFlo) {
+      console.log(
+        '[moflo] /flo run modes (AUTHORITATIVE — use verbatim; do NOT re-derive from the skill defaults): ' +
+        'sdd=' + (floRun.sdd ? 'ON' : 'off') +
+        ' verify=' + (floRun.verify ? 'ON' : 'off') +
+        ' merge=' + (floRun.merge ? 'ON' : 'off') +
+        ' [workflow=' + floRun.workflow + ']'
+      );
+      if (floRun.sdd && floRun.sddSrc !== 'flag') {
+        console.log(
+          '[moflo] sdd is ON via ' + floRun.sddSrc + ' — the spec→plan→implement→verify cycle is ' +
+          'MANDATORY this run. Author the spec before editing source (the sdd_gate blocks source ' +
+          'Write/Edit until a reviewed plan exists). One-off opt out: re-run with --no-sdd.'
+        );
+      }
+      if (floRun.merge && floRun.mergeSrc !== 'flag') {
+        console.log('[moflo] merge is ON via ' + floRun.mergeSrc + ' — the PR will be auto-merged. Opt out: --no-merge.');
+      }
+    }
     if (config.context_tracking) {
       var ic = s.interactionCount;
       if (ic > 30) console.log('Context: CRITICAL. Commit, store learnings, suggest new session.');

package/dist/src/cli/init/index.js

@@ -3,7 +3,7 @@
  * Comprehensive initialization system for Claude Code integration
  */
 // Types
-export { DEFAULT_INIT_OPTIONS, MINIMAL_INIT_OPTIONS, FULL_INIT_OPTIONS, detectPlatform, } from './types.js';
+export { SKILL_CATEGORIES, DEFAULT_INIT_OPTIONS, MINIMAL_INIT_OPTIONS, FULL_INIT_OPTIONS, detectPlatform, } from './types.js';
 // Generators
 export { generateSettings, generateSettingsJson, } from './settings-generator.js';
 export { generateMCPConfig, generateMCPJson, generateMCPCommands, } from './mcp-generator.js';

package/dist/src/cli/init/types.js

@@ -4,6 +4,21 @@
  */
 import os from 'os';
 import path from 'path';
+/**
+ * The skill categories `SKILLS_MAP` partitions shipped skills into.
+ *
+ * This list is the single source of truth (#1308). `SkillsConfig` is DERIVED
+ * from it and `SKILLS_MAP` is TYPED by it, so the two can never drift again.
+ *
+ * They did drift, silently, and it disabled the whole selection mechanism:
+ * `SkillsConfig` declared `core`/`github`/`browser` while `SKILLS_MAP` keyed on
+ * `core`/`memory`/`spells`. `copySkills` joins them by key, so `memory` and
+ * `spells` resolved to `undefined` → falsy → never installed, while
+ * `github`/`browser` selected nothing at all. An `as keyof typeof` cast in the
+ * lookup suppressed the type error that would otherwise have caught it. Adding
+ * a category to one side without the other is now a compile error.
+ */
+export const SKILL_CATEGORIES = ['core', 'memory', 'spells'];
 /**
  * Detect current platform
  */
@@ -69,10 +84,15 @@ export const DEFAULT_INIT_OPTIONS = {
         timeout: 5000,
         continueOnError: true,
     },
+    // Every category. This is not a behaviour change: the session-start launcher
+    // syncs all shipped skills on every run regardless of what init selected, so
+    // consumers already end up with all of them. Pre-#1308 this said
+    // `core/github/browser`, which resolved to core-only — meaning `flo init` and
+    // the launcher disagreed, and init's answer simply lost. Now they agree.
     skills: {
         core: true,
-        github: true,
-        browser: true,
+        memory: true,
+        spells: true,
         all: false,
     },
     commands: {
@@ -159,10 +179,11 @@ export const MINIMAL_INIT_OPTIONS = {
         stop: false,
         notification: false,
     },
+    // Minimal deliberately stays core-only — that is the point of the preset.
     skills: {
         core: true,
-        github: false,
-        browser: false,
+        memory: false,
+        spells: false,
         all: false,
     },
     agents: {
@@ -217,8 +238,8 @@ export const FULL_INIT_OPTIONS = {
     },
     skills: {
         core: true,
-        github: true,
-        browser: true,
+        memory: true,
+        spells: true,
         all: true,
     },
     commands: {

package/dist/src/cli/version.js

@@ -2,5 +2,5 @@
  * Auto-generated by build. Do not edit manually.
  * Source of truth: root package.json → scripts/sync-version.mjs
  */
-export const VERSION = '4.12.0';
+export const VERSION = '4.12.2';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.12.0",
+  "version": "4.12.2",
   "description": "MoFlo — AI agent orchestration for Claude Code. A standalone, opinionated toolkit with semantic memory, learned routing, gates, spells, and the /flo issue-execution skill.",
   "main": "dist/src/cli/index.js",
   "type": "module",
@@ -95,7 +95,7 @@
     "@typescript-eslint/eslint-plugin": "^7.18.0",
     "@typescript-eslint/parser": "^7.18.0",
     "eslint": "^8.0.0",
-    "moflo": "^4.11.10-rc.10",
+    "moflo": "^4.12.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"