moflo 4.12.2 → 4.12.3-rc.1

package/dist/src/cli/services/embeddings-migration.js

@@ -21,6 +21,7 @@ import { openDaemonDatabase } from '../memory/daemon-backend.js';
 // eagerly is cheap. The heavy imports (fastembed wrapper, upgrade renderer,
 // etc.) stay deferred behind the early returns so session-start stays fast.
 import { CANONICAL_EMBEDDING_MODEL, EMBEDDINGS_VERSION, } from '../embeddings/migration/types.js';
+import { resolveStateRoot } from './project-root.js';
 /**
  * Run the migration if and only if it's needed.
  *
@@ -33,7 +34,7 @@ import { CANONICAL_EMBEDDING_MODEL, EMBEDDINGS_VERSION, } from '../embeddings/mi
 export async function runEmbeddingsMigrationIfNeeded(options = {}) {
     const fs = await import('fs');
     const path = await import('path');
-    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(process.cwd()));
+    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(resolveStateRoot()));
     if (!fs.existsSync(dbPath))
         return false;
     // node:sqlite via the unified factory (Phase 5 / #1084). The migration

package/dist/src/cli/services/ephemeral-namespace-purge.js

@@ -30,6 +30,7 @@
 import { PURGE_ON_SESSION_START_NAMESPACES, PURGE_ON_SESSION_START_PREFIXES, TASKLIST_RETENTION_CAP, } from '../memory/bridge-embedder.js';
 import { memoryDbPath } from './moflo-paths.js';
 import { openDaemonDatabase } from '../memory/daemon-backend.js';
+import { resolveStateRoot } from './project-root.js';
 /**
  * Hard-delete rows in {@link PURGE_ON_SESSION_START_NAMESPACES} and trim the
  * `tasklist` namespace to its retention cap, then VACUUM. Returns
@@ -41,7 +42,7 @@ import { openDaemonDatabase } from '../memory/daemon-backend.js';
 export async function purgeEphemeralNamespaces(options = {}) {
     const fs = await import('fs');
     const path = await import('path');
-    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(process.cwd()));
+    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(resolveStateRoot()));
     if (!fs.existsSync(dbPath))
         return { purged: 0, trimmed: 0 };
     // node:sqlite via the unified factory (Phase 5 / #1084). WAL persists each
@@ -128,7 +129,7 @@ export async function purgeEphemeralNamespaces(options = {}) {
 export async function purgeMemoryProbeNamespaces(options = {}) {
     const fs = await import('fs');
     const path = await import('path');
-    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(process.cwd()));
+    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(resolveStateRoot()));
     if (!fs.existsSync(dbPath))
         return { purged: 0 };
     const prefixes = Array.from(PURGE_ON_SESSION_START_PREFIXES);

package/dist/src/cli/services/project-root.js

@@ -43,7 +43,7 @@
  * changed Pass A from nearest-wins to topmost-wins to fix monorepo daemon
  * fragmentation.
  */
-import { existsSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import { resolve, dirname, parse, join, basename } from 'node:path';
 /**
  * Walk strictly upward from `dir` (exclusive) and return the nearest ancestor
@@ -75,6 +75,113 @@ export function findAncestorMofloRoot(dir) {
     }
     return null;
 }
+/**
+ * Memo for {@link resolveStateRoot}, keyed on the two inputs that can change
+ * within a process: the starting directory and `CLAUDE_PROJECT_DIR`.
+ *
+ * Only MARKER-PROVEN results are cached — i.e. resolutions that landed on a
+ * directory actually holding `.moflo/moflo.db`. That distinction is what makes
+ * the cache safe: an existing `moflo.db` does not move during a process
+ * lifetime, whereas a fall-through result (Pass B/C, no moflo state anywhere)
+ * is exactly the case `flo init` is about to invalidate by creating one. So
+ * the un-cached path stays correct and the cached path stays stable.
+ *
+ * Motivation: a single `flo doctor` run resolves independently from ~6 check
+ * modules, each re-walking the ancestor chain.
+ */
+const stateRootCache = new Map();
+/** Clear the {@link resolveStateRoot} memo. Test seam only. */
+export function _resetStateRootCacheForTest() {
+    stateRootCache.clear();
+}
+/**
+ * Resolve the anchor that any code READING OR WRITING `.moflo/` state must use
+ * (#1315). Use this instead of `process.cwd()` anywhere a `.moflo/` path is
+ * built — the daemon, the healer, and any command that persists metrics,
+ * benchmarks, or reports.
+ *
+ * `findProjectRoot()` short-circuits on `CLAUDE_PROJECT_DIR` before Pass A.
+ * That is correct for most callers, but wrong for state anchoring: Claude Code
+ * sets the variable to the SESSION's directory, hooks inherit it, and a spawned
+ * daemon inherits it again via `daemonEnv` (`commands/daemon.ts`). In a
+ * monorepo session rooted at a sub-workspace the whole chain therefore agreed
+ * the project root was the sub-workspace, and `daemon start` minted a fresh
+ * `.moflo/` there — re-seeding the daemon islands #1174 was closed for.
+ *
+ * The rule here: an existing `CLAUDE_PROJECT_DIR` wins outright — it is what
+ * Claude Code says the project is, and the marker walk is never allowed to
+ * climb above it. Otherwise walk up from cwd and take the TOPMOST
+ * `.moflo/moflo.db`, which is the canonical root for a monorepo. That walk is
+ * the actual #1315 fix: the state sites previously used `process.cwd()` raw,
+ * so every sub-directory invocation minted an island where it stood.
+ *
+ * Why the env is not merely a starting point: the walk has no upper bound, so
+ * climbing past an explicit anchor lets any stray ancestor marker capture every
+ * project beneath it. See the note in `resolveStateRootUncached`.
+ *
+ * Deliberately a separate export rather than a change inside `findProjectRoot`
+ * itself: that resolver is shared with the MCP server, the memory bridge, and
+ * the gate hooks, whose env-override semantics are load-bearing elsewhere.
+ * Callers that merely need "which project am I in" should keep using
+ * `findProjectRoot`; callers that are about to CREATE something use this.
+ */
+export function resolveStateRoot(opts) {
+    const envDir = process.env.CLAUDE_PROJECT_DIR;
+    const cacheKey = `${opts?.cwd ?? process.cwd()}\0${envDir ?? ''}`;
+    const cached = stateRootCache.get(cacheKey);
+    if (cached !== undefined)
+        return cached;
+    const resolved = resolveStateRootUncached(opts, envDir);
+    // Cache only a marker-proven anchor — see the note on `stateRootCache`.
+    if (existsSync(join(resolved, '.moflo', 'moflo.db'))) {
+        stateRootCache.set(cacheKey, resolved);
+    }
+    return resolved;
+}
+function resolveStateRootUncached(opts, envDir) {
+    // An explicitly-set `CLAUDE_PROJECT_DIR` is AUTHORITATIVE and is never
+    // climbed above. Claude Code sets it to the project the user opened, and the
+    // marker walk has no upper bound — it runs to the filesystem root and takes
+    // the TOPMOST `.moflo/moflo.db`. Letting it climb past an explicit anchor
+    // means any stray ancestor marker captures every project beneath it: one
+    // accidental `flo init` in `$HOME` silently re-roots everything, and a
+    // scratch project created inside another checkout resolves to that checkout
+    // and mutates it. (Verified, not hypothetical: with the climb enabled the
+    // session-start launcher operated on this repo instead of its fixture.)
+    //
+    // A typo'd or stale value naming a directory that does not exist is ignored
+    // — callers mkdir what we return, so honoring it would materialize `.moflo/`
+    // at the typo path.
+    const envAbs = envDir ? resolve(envDir) : undefined;
+    if (envAbs && existsSync(envAbs)) {
+        return canonicalize(envAbs);
+    }
+    // No usable env anchor: walk up from cwd. This is the #1315 fix proper —
+    // the state-anchoring sites used to take `process.cwd()` raw, so any
+    // sub-directory invocation minted an island there. Pass A's topmost-wins
+    // walk lands on the canonical root instead.
+    const resolved = findProjectRoot({ honorEnv: false, cwd: opts?.cwd });
+    return canonicalize(resolved);
+}
+/**
+ * Absolutize + realpath a resolved root.
+ *
+ * The env value is caller-supplied and may be relative or carry a trailing
+ * separator, and on macOS `/var/folders/...` must collapse to
+ * `/private/var/folders/...` or this root won't compare equal to the realpath'd
+ * one `daemon-port.ts:normalizeProjectRoot` derives for same-project matching
+ * (CLAUDE.md Rule #1 §2). Falls back to the un-canonicalized path when it
+ * doesn't exist, which is the right degradation — never throw from a resolver.
+ */
+function canonicalize(p) {
+    const abs = resolve(p);
+    try {
+        return realpathSync(abs);
+    }
+    catch {
+        return abs;
+    }
+}
 export function findProjectRoot(opts) {
     const honorEnv = opts?.honorEnv !== false;
     if (honorEnv && process.env.CLAUDE_PROJECT_DIR) {

package/dist/src/cli/services/soft-delete-purge.js

@@ -19,6 +19,7 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 import { memoryDbPath } from './moflo-paths.js';
 import { openDaemonDatabase } from '../memory/daemon-backend.js';
+import { resolveStateRoot } from './project-root.js';
 /**
  * Hard-delete all `status='deleted'` rows from the memory DB and VACUUM.
  *
@@ -30,7 +31,7 @@ import { openDaemonDatabase } from '../memory/daemon-backend.js';
 export async function purgeSoftDeletedEntries(options = {}) {
     const fs = await import('fs');
     const path = await import('path');
-    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(process.cwd()));
+    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(resolveStateRoot()));
     if (!fs.existsSync(dbPath))
         return { purged: 0 };
     // node:sqlite via the unified factory (Phase 5 / #1084). WAL persists each

package/dist/src/cli/services/worker-daemon.js

@@ -23,7 +23,7 @@
  * findings UI, not a default-on background loop.
  */
 import { EventEmitter } from 'events';
-import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
+import { existsSync, mkdirSync, writeFileSync, readFileSync, statSync } from 'fs';
 import { atomicWriteFileSync } from './atomic-file-write.js';
 import { mofloDir } from './moflo-paths.js';
 import { cpus } from 'os';
@@ -34,6 +34,7 @@ import { attachSignalHandlers } from '../shared/resilience/signal-handlers.js';
 import { calculateDelay } from '../production/retry.js';
 import { CircuitBreaker } from '../production/circuit-breaker.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
+import { readMofloEnv } from './env-compat.js';
 /**
  * Runtime allow-list of known {@link WorkerType} values. Used by
  * `initializeWorkerStates` to silently drop entries from a stale
@@ -557,6 +558,68 @@ export class WorkerDaemon extends EventEmitter {
             config: this.config,
         };
     }
+    /**
+     * #1315 — exit when the project root has been deleted out from under us.
+     *
+     * A daemon started inside a git worktree outlived `git worktree remove`: the
+     * directory was gone, `git worktree list`/`prune` both reported clean, yet
+     * every tick the worker paths called `mkdirSync(stateDir, {recursive:true})`
+     * and RECREATED the deleted tree just to write `daemon-state.json` and
+     * `metrics/` into it. Deleting the husk by hand simply got it back on the
+     * next tick, because nothing ever asked whether the root still existed.
+     *
+     * Checked at the top of each tick, before any writer runs.
+     *
+     * Cross-platform (CLAUDE.md Rule #1): `existsSync` is platform-neutral, but
+     * the SCENARIO is mostly POSIX — Windows refuses to remove a directory that
+     * is a live process's cwd (sharing violation), and the daemon is spawned with
+     * `cwd: projectRoot`. So on Windows this check simply never fires, which is
+     * correct rather than a gap: the husk-recreation it guards against cannot
+     * happen there. No `process.platform` branch is warranted.
+     *
+     * @returns true when shutdown was initiated (caller must stop immediately).
+     */
+    async shutdownIfRootVanished() {
+        // `statSync`, NOT `existsSync`. `existsSync` swallows every error and
+        // returns false, so EACCES, EIO, a disconnected SMB share, or a sleeping
+        // network volume would be indistinguishable from "deleted" and would exit
+        // a perfectly healthy daemon on one bad sample. Only ENOENT means gone.
+        try {
+            statSync(this.projectRoot);
+            return false; // still there
+        }
+        catch (err) {
+            if (err?.code !== 'ENOENT') {
+                // Can't tell — assume present. A false positive kills a healthy
+                // daemon, which is far worse than one more tick of an orphan.
+                return false;
+            }
+        }
+        this.log('warn', `Project root ${this.projectRoot} no longer exists — shutting down instead of recreating it`);
+        try {
+            await this.stop();
+        }
+        catch {
+            /* best effort — we're leaving either way */
+        }
+        // Only a genuine daemon process may take the process down with it. A CLI
+        // command or a test that happens to hold a WorkerDaemon must not be
+        // exited out from under itself. `MOFLO_TEST_NO_DAEMON_SELF_EXIT` is the
+        // test-runner kill switch (vitest.setup.ts) — without it a vitest worker
+        // that inherited MOFLO_DAEMON would exit(0) mid-run and report every
+        // remaining test as passed.
+        // `readMofloEnv('DAEMON')`, not raw `process.env.MOFLO_DAEMON` — it also
+        // honors the legacy `CLAUDE_FLOW_DAEMON` prefix, which is what OS service
+        // units written by older moflo versions still set. Reading only the modern
+        // name left those daemons clearing their timers but never exiting: a live
+        // process still holding its dashboard port. Matches how `daemon.ts`
+        // identifies a daemon process.
+        const isDaemonProcess = readMofloEnv('DAEMON') === '1';
+        if (isDaemonProcess && process.env.MOFLO_TEST_NO_DAEMON_SELF_EXIT !== '1') {
+            process.exit(0);
+        }
+        return true;
+    }
     /**
      * Schedule a worker to run at intervals with staggered start
      */
@@ -574,6 +637,9 @@ export class WorkerDaemon extends EventEmitter {
         const runAndReschedule = async () => {
             if (!this.running)
                 return;
+            // #1315 — before any writer runs, confirm we still have a project.
+            if (await this.shutdownIfRootVanished())
+                return;
             // Use concurrency-controlled execution (P0 fix)
             await this.executeWorkerWithConcurrencyControl(workerConfig);
             if (this.running && workerConfig.enabled && !state.disabledByOverrun) {

package/dist/src/cli/version.js

@@ -2,5 +2,5 @@
  * Auto-generated by build. Do not edit manually.
  * Source of truth: root package.json → scripts/sync-version.mjs
  */
-export const VERSION = '4.12.2';
+export const VERSION = '4.12.3-rc.1';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.12.2",
+  "version": "4.12.3-rc.1",
   "description": "MoFlo — AI agent orchestration for Claude Code. A standalone, opinionated toolkit with semantic memory, learned routing, gates, spells, and the /flo issue-execution skill.",
   "main": "dist/src/cli/index.js",
   "type": "module",
@@ -56,7 +56,7 @@
     "test:smoke": "node harness/consumer-smoke/run.mjs",
     "test:smoke:populated": "node harness/consumer-smoke/run-populated.mjs",
     "bench": "vitest run --config vitest.bench.config.ts",
-    "lint": "eslint src/ bin/ .claude/scripts/ --ext .ts,.tsx,.mts,.cts,.js,.mjs,.cjs --max-warnings 0",
+    "lint": "eslint src/ bin/ .claude/scripts/ --max-warnings 0",
     "security:audit": "npm audit --omit=dev --audit-level high",
     "security:fix": "npm audit fix",
     "version": "node scripts/sync-version.mjs && git add src/cli/version.ts",
@@ -64,7 +64,7 @@
   },
   "dependencies": {
     "@anush008/tokenizers": "^0.6.0",
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "js-yaml": "^5.2.0",
     "lru-cache": "^11.3.5",
     "onnxruntime-node": "^1.27.0",
@@ -92,10 +92,11 @@
   },
   "devDependencies": {
     "@types/node": "^24.12.2",
-    "@typescript-eslint/eslint-plugin": "^7.18.0",
-    "@typescript-eslint/parser": "^7.18.0",
-    "eslint": "^8.0.0",
-    "moflo": "^4.12.1",
+    "@typescript-eslint/eslint-plugin": "^8.65.0",
+    "@typescript-eslint/parser": "^8.65.0",
+    "eslint": "^10.8.0",
+    "glob": "^11.1.0",
+    "moflo": "^4.12.2",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"