moflo 4.12.4 → 4.12.5

package/dist/src/cli/production/monitoring.js

@@ -10,6 +10,7 @@
  *
  * @module moflo/production/monitoring
  */
+import { generateId } from '../shared/utils/id.js';
 // ============================================================================
 // Default Configuration
 // ============================================================================
@@ -308,7 +309,7 @@ export class MonitoringHooks {
                 Date.now() - a.timestamp < 60000);
             if (!recentAlert) {
                 this.alerts.push({
-                    id: `alert_${Date.now()}_${Math.random().toString(36).substring(7)}`,
+                    id: generateId('alert', { separator: '_' }),
                     level,
                     metric: name,
                     message: `${name} exceeded ${level} threshold: ${value} >= ${threshold}`,

package/dist/src/cli/services/daemon-service.js

@@ -10,11 +10,15 @@
  */
 import * as fs from 'fs';
 import { createHash } from 'crypto';
-import { dirname, join, resolve } from 'path';
+import { basename, dirname, join, resolve } from 'path';
 import { homedir } from 'os';
 import { execSync } from 'child_process';
 import { locateMofloCliBin } from './moflo-require.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
+/** Real process boundary. Kept thin so the stub and the default stay swappable. */
+const execSyncRunner = (command, options) => {
+    execSync(command, options);
+};
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -27,37 +31,39 @@ const SCHTASKS_NAME = 'MoFloDaemon';
 /**
  * Check if the daemon service is registered for the current platform.
  */
-export function isDaemonInstalled(projectRoot) {
+export function isDaemonInstalled(projectRoot, options = {}) {
     const resolvedRoot = resolve(projectRoot);
-    const platform = process.platform;
+    const platform = options.platform ?? process.platform;
+    const run = options.runCommand ?? execSyncRunner;
     if (platform === 'darwin') {
-        return isDaemonInstalledMacOS(resolvedRoot);
+        return isDaemonInstalledMacOS(resolvedRoot, options);
     }
     else if (platform === 'linux') {
-        return isDaemonInstalledLinux(resolvedRoot);
+        return isDaemonInstalledLinux(resolvedRoot, options);
     }
     else if (platform === 'win32') {
-        return isDaemonInstalledWindows(resolvedRoot);
+        return isDaemonInstalledWindows(resolvedRoot, run);
     }
     return false;
 }
 /**
  * Install the daemon as an OS-native login service.
  */
-export function installDaemonService(projectRoot) {
+export function installDaemonService(projectRoot, options = {}) {
     const resolvedRoot = resolve(projectRoot);
     validateProjectRoot(resolvedRoot);
-    const platform = process.platform;
+    const platform = options.platform ?? process.platform;
+    const run = options.runCommand ?? execSyncRunner;
     const nodePath = process.execPath;
     const cliPath = resolveCliPath();
     if (platform === 'darwin') {
-        return installMacOS(resolvedRoot, nodePath, cliPath);
+        return installMacOS(resolvedRoot, nodePath, cliPath, options);
     }
     else if (platform === 'linux') {
-        return installLinux(resolvedRoot, nodePath, cliPath);
+        return installLinux(resolvedRoot, nodePath, cliPath, run, options);
     }
     else if (platform === 'win32') {
-        return installWindows(resolvedRoot, nodePath, cliPath);
+        return installWindows(resolvedRoot, nodePath, cliPath, run);
     }
     return {
         success: false,
@@ -68,18 +74,19 @@ export function installDaemonService(projectRoot) {
 /**
  * Uninstall the daemon OS-native login service.
  */
-export function uninstallDaemonService(projectRoot) {
+export function uninstallDaemonService(projectRoot, options = {}) {
     const resolvedRoot = resolve(projectRoot);
     validateProjectRoot(resolvedRoot);
-    const platform = process.platform;
+    const platform = options.platform ?? process.platform;
+    const run = options.runCommand ?? execSyncRunner;
     if (platform === 'darwin') {
-        return uninstallMacOS(resolvedRoot);
+        return uninstallMacOS(resolvedRoot, run, options);
     }
     else if (platform === 'linux') {
-        return uninstallLinux(resolvedRoot);
+        return uninstallLinux(resolvedRoot, run, options);
     }
     else if (platform === 'win32') {
-        return uninstallWindows(resolvedRoot);
+        return uninstallWindows(resolvedRoot, run);
     }
     return {
         success: false,
@@ -89,9 +96,9 @@ export function uninstallDaemonService(projectRoot) {
 // ---------------------------------------------------------------------------
 // macOS — launchd
 // ---------------------------------------------------------------------------
-function plistPath(projectRoot) {
+function plistPath(projectRoot, options = {}) {
     const slug = projectRootSlug(projectRoot);
-    return join(homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.${slug}.plist`);
+    return join(options.homeDir ?? homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.${slug}.plist`);
 }
 function generatePlist(projectRoot, nodePath, cliPath) {
     const slug = projectRootSlug(projectRoot);
@@ -128,8 +135,8 @@ function generatePlist(projectRoot, nodePath, cliPath) {
         '',
     ].join('\n');
 }
-function installMacOS(projectRoot, nodePath, cliPath) {
-    const dest = plistPath(projectRoot);
+function installMacOS(projectRoot, nodePath, cliPath, options) {
+    const dest = plistPath(projectRoot, options);
     const dir = dirname(dest);
     fs.mkdirSync(dir, { recursive: true });
     const content = generatePlist(projectRoot, nodePath, cliPath);
@@ -140,28 +147,33 @@ function installMacOS(projectRoot, nodePath, cliPath) {
         message: `Daemon service installed at ${dest}. It will start automatically on login.`,
     };
 }
-function uninstallMacOS(projectRoot) {
-    const dest = plistPath(projectRoot);
+function uninstallMacOS(projectRoot, run, options) {
+    const dest = plistPath(projectRoot, options);
     if (!fs.existsSync(dest)) {
         return { success: true, message: 'Daemon service is not installed.' };
     }
     // Unload before removing (ignore errors — may not be loaded)
     try {
-        execSync(`launchctl unload "${dest}"`, { timeout: 5000, stdio: 'ignore' });
+        run(`launchctl unload "${dest}"`, { timeout: 5000, stdio: 'ignore' });
     }
     catch { /* not loaded — fine */ }
     fs.unlinkSync(dest);
     return { success: true, message: `Daemon service removed from ${dest}.` };
 }
-function isDaemonInstalledMacOS(projectRoot) {
-    return fs.existsSync(plistPath(projectRoot));
+function isDaemonInstalledMacOS(projectRoot, options) {
+    return fs.existsSync(plistPath(projectRoot, options));
 }
 // ---------------------------------------------------------------------------
 // Linux — systemd --user
 // ---------------------------------------------------------------------------
-function systemdUnitPath(projectRoot) {
+function systemdUnitPath(projectRoot, options = {}) {
     const slug = projectRootSlug(projectRoot);
-    const configDir = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+    // An injected homeDir is a sandbox boundary — XDG_CONFIG_HOME must not
+    // override it, or an ambient value would redirect the write back to the
+    // developer's real config tree.
+    const configDir = options.homeDir
+        ? join(options.homeDir, '.config')
+        : process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
     return join(configDir, 'systemd', 'user', `${SYSTEMD_UNIT.replace('.service', '')}-${slug}.service`);
 }
 function generateSystemdUnit(projectRoot, nodePath, cliPath) {
@@ -183,17 +195,16 @@ function generateSystemdUnit(projectRoot, nodePath, cliPath) {
         '',
     ].join('\n');
 }
-function installLinux(projectRoot, nodePath, cliPath) {
-    const dest = systemdUnitPath(projectRoot);
+function installLinux(projectRoot, nodePath, cliPath, run, options) {
+    const dest = systemdUnitPath(projectRoot, options);
     const dir = dirname(dest);
     fs.mkdirSync(dir, { recursive: true });
     const content = generateSystemdUnit(projectRoot, nodePath, cliPath);
     fs.writeFileSync(dest, content, 'utf-8');
     // Reload systemd and enable
     try {
-        execSync('systemctl --user daemon-reload', { timeout: 10000, stdio: 'ignore' });
-        const unitName = dest.split('/').pop();
-        execSync(`systemctl --user enable ${unitName}`, { timeout: 10000, stdio: 'ignore' });
+        run('systemctl --user daemon-reload', { timeout: 10000, stdio: 'ignore' });
+        run(`systemctl --user enable ${basename(dest)}`, { timeout: 10000, stdio: 'ignore' });
     }
     catch {
         // systemctl may not be available in all environments
@@ -204,28 +215,28 @@ function installLinux(projectRoot, nodePath, cliPath) {
         message: `Daemon service installed at ${dest}. It will start automatically on login.`,
     };
 }
-function uninstallLinux(projectRoot) {
-    const dest = systemdUnitPath(projectRoot);
+function uninstallLinux(projectRoot, run, options) {
+    const dest = systemdUnitPath(projectRoot, options);
     if (!fs.existsSync(dest)) {
         return { success: true, message: 'Daemon service is not installed.' };
     }
     // Disable and stop before removing
     try {
-        const unitName = dest.split('/').pop();
-        execSync(`systemctl --user disable ${unitName}`, { timeout: 10000, stdio: 'ignore' });
-        execSync(`systemctl --user stop ${unitName}`, { timeout: 10000, stdio: 'ignore' });
+        const unitName = basename(dest);
+        run(`systemctl --user disable ${unitName}`, { timeout: 10000, stdio: 'ignore' });
+        run(`systemctl --user stop ${unitName}`, { timeout: 10000, stdio: 'ignore' });
     }
     catch { /* may not be running */ }
     fs.unlinkSync(dest);
     // Reload systemd
     try {
-        execSync('systemctl --user daemon-reload', { timeout: 10000, stdio: 'ignore' });
+        run('systemctl --user daemon-reload', { timeout: 10000, stdio: 'ignore' });
     }
     catch { /* ignore */ }
     return { success: true, message: `Daemon service removed from ${dest}.` };
 }
-function isDaemonInstalledLinux(projectRoot) {
-    return fs.existsSync(systemdUnitPath(projectRoot));
+function isDaemonInstalledLinux(projectRoot, options) {
+    return fs.existsSync(systemdUnitPath(projectRoot, options));
 }
 // ---------------------------------------------------------------------------
 // Windows — Task Scheduler
@@ -234,12 +245,12 @@ function schtasksName(projectRoot) {
     const slug = projectRootSlug(projectRoot);
     return `${SCHTASKS_NAME}-${slug}`;
 }
-function installWindows(projectRoot, nodePath, cliPath) {
+function installWindows(projectRoot, nodePath, cliPath, run) {
     const taskName = schtasksName(projectRoot);
     // Build schtasks command — ONLOGON trigger, user-level
     // Use /F to force overwrite if already exists (idempotent)
     try {
-        execSync(`schtasks /Create /TN "${taskName}" /TR "\\"${nodePath}\\" \\"${cliPath}\\" daemon start --foreground --quiet" /SC ONLOGON /F`, { timeout: 15000, windowsHide: true, cwd: projectRoot, stdio: 'ignore' });
+        run(`schtasks /Create /TN "${taskName}" /TR "\\"${nodePath}\\" \\"${cliPath}\\" daemon start --foreground --quiet" /SC ONLOGON /F`, { timeout: 15000, windowsHide: true, cwd: projectRoot, stdio: 'ignore' });
     }
     catch (err) {
         return {
@@ -254,10 +265,10 @@ function installWindows(projectRoot, nodePath, cliPath) {
         message: `Daemon task "${taskName}" registered in Task Scheduler. It will start automatically on login.`,
     };
 }
-function uninstallWindows(projectRoot) {
+function uninstallWindows(projectRoot, run) {
     const taskName = schtasksName(projectRoot);
     try {
-        execSync(`schtasks /Delete /TN "${taskName}" /F`, { timeout: 15000, windowsHide: true, stdio: 'ignore' });
+        run(`schtasks /Delete /TN "${taskName}" /F`, { timeout: 15000, windowsHide: true, stdio: 'ignore' });
     }
     catch {
         // schtasks /Delete /F returns non-zero when task doesn't exist
@@ -265,10 +276,10 @@ function uninstallWindows(projectRoot) {
     }
     return { success: true, message: `Daemon task "${taskName}" removed from Task Scheduler.` };
 }
-function isDaemonInstalledWindows(projectRoot) {
+function isDaemonInstalledWindows(projectRoot, run) {
     const taskName = schtasksName(projectRoot);
     try {
-        execSync(`schtasks /Query /TN "${taskName}"`, {
+        run(`schtasks /Query /TN "${taskName}"`, {
             timeout: 10000,
             windowsHide: true,
             stdio: 'ignore',

package/dist/src/cli/services/daemon-spell-executor.js

@@ -8,6 +8,7 @@
  */
 import { errorDetail } from '../shared/utils/error-detail.js';
 import { loadSpellEngine, } from './engine-loader.js';
+import { generateId } from '../shared/utils/id.js';
 export class DaemonSpellExecutor {
     registry;
     projectRoot;
@@ -39,11 +40,11 @@ export class DaemonSpellExecutor {
         this.registry.invalidate();
         const loaded = this.registry.resolve(spellName);
         if (!loaded) {
-            return failedResult(`scheduled-${spellName}-${Date.now()}`, 'STEP_EXECUTION_FAILED', `Spell not found in grimoire: ${spellName}`);
+            return failedResult(generateId(`scheduled-${spellName}`), 'STEP_EXECUTION_FAILED', `Spell not found in grimoire: ${spellName}`);
         }
         const engine = await this.ensureEngine();
         const definition = this.applyMofloLevel(loaded.definition, mofloLevel);
-        const spellId = `scheduled-${loaded.definition.name}-${Date.now()}`;
+        const spellId = generateId(`scheduled-${loaded.definition.name}`);
         const onAbort = () => {
             try {
                 engine.bridgeCancelSpell(spellId);

package/dist/src/cli/services/headless-worker-executor.js

@@ -16,6 +16,8 @@ import { EventEmitter } from 'events';
 import { existsSync, readFileSync, readdirSync, mkdirSync, writeFileSync } from 'fs';
 import { join } from 'path';
 import { errorDetail } from '../shared/utils/error-detail.js';
+import { randomSuffix } from '../shared/utils/id.js';
+import { generateId } from '../shared/utils/id.js';
 // ============================================
 // Constants
 // ============================================
@@ -560,7 +562,7 @@ export class HeadlessWorkerExecutor extends EventEmitter {
         const baseConfig = HEADLESS_WORKER_CONFIGS[workerType];
         const headless = { ...baseConfig.headless, ...configOverrides };
         const startTime = Date.now();
-        const executionId = `${workerType}_${startTime}_${Math.random().toString(36).slice(2, 8)}`;
+        const executionId = `${workerType}_${startTime}_${randomSuffix()}`;
         this.emit('start', { executionId, workerType, config: headless });
         try {
             // Build context from file patterns
@@ -1023,7 +1025,7 @@ ${ioInstructions}`;
             sandboxMode: 'strict',
             workerType,
             timestamp: new Date(),
-            executionId: `error_${Date.now()}`,
+            executionId: generateId('error', { separator: '_' }),
             error,
         };
     }

package/dist/src/cli/services/learning-service.js

@@ -17,6 +17,7 @@ import { dirname } from 'path';
 import { memoryDbPath } from './moflo-paths.js';
 import { openDaemonDatabase } from '../memory/daemon-backend.js';
 import { createNeuralEmbeddingProvider, } from './neural-embedding-provider.js';
+import { generateId } from '../shared/utils/id.js';
 // ============================================================================
 // Configuration
 // ============================================================================
@@ -319,7 +320,7 @@ export class LearningService {
             this.dirty = true;
             return { id: existingId, action: 'updated', similarity: ltResults[0].similarity };
         }
-        const id = `pat_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
+        const id = generateId('pat', { separator: '_' });
         const embeddingJson = JSON.stringify(Array.from(embedding));
         dbRun(this.db, `
       INSERT INTO learned_patterns (id, pattern, domain, quality, uses, tier, embedding, created_at)

package/dist/src/cli/services/worker-daemon.js

@@ -36,6 +36,7 @@ import { CircuitBreaker } from '../production/circuit-breaker.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
 import { readLoadAverage } from '../shared/utils/load-average.js';
 import { readMofloEnv } from './env-compat.js';
+import { generateId } from '../shared/utils/id.js';
 /**
  * Runtime allow-list of known {@link WorkerType} values. Used by
  * `initializeWorkerStates` to silently drop entries from a stale
@@ -787,7 +788,7 @@ export class WorkerDaemon extends EventEmitter {
      */
     async executeWorker(workerConfig) {
         const state = this.workers.get(workerConfig.type);
-        const workerId = `${workerConfig.type}_${Date.now()}`;
+        const workerId = generateId(workerConfig.type, { separator: '_' });
         const startTime = Date.now();
         // The controller is parked on shared state so setWorkerEnabled(false) can
         // interrupt this in-flight run; runWithTimeout also aborts it on timeout

package/dist/src/cli/shared/hooks/example-usage.js

@@ -119,7 +119,7 @@ export function setupPerformanceHooks() {
         if (!toolName) {
             return { success: true };
         }
-        const metricId = `tool-${toolName}-${Date.now()}`;
+        const metricId = generateId(`tool-${toolName}`);
         performanceMetrics.set(metricId, { start: Date.now() });
         return {
             success: true,
@@ -216,7 +216,7 @@ export function setupSessionHooks() {
     let activeSession = null;
     // Initialize session
     registry.register(HookEvent.SessionStart, async (context) => {
-        const sessionId = context.session?.id || `session-${Date.now()}`;
+        const sessionId = context.session?.id || generateId('session');
         activeSession = {
             id: sessionId,
             startTime: new Date(),
@@ -346,6 +346,7 @@ export async function runDemo() {
 }
 // Run demo if executed directly
 import { pathToFileURL as _pfu_eu } from 'url';
+import { generateId } from '../utils/id.js';
 if (import.meta.url === _pfu_eu(process.argv[1]).href) {
     runDemo().catch(console.error);
 }

package/dist/src/cli/shared/hooks/safety/git-commit.js

@@ -8,6 +8,7 @@
  * @module v3/shared/hooks/safety/git-commit
  */
 import { HookEvent, HookPriority, } from '../types.js';
+import { escapeShellArg } from '../../utils/platform.js';
 const COMMIT_TYPE_PATTERNS = [
     {
         keywords: ['add', 'implement', 'create', 'introduce', 'new'],
@@ -137,9 +138,17 @@ export class GitCommitHook {
         const message = messageMatch[1];
         const branchName = context.metadata?.branchName;
         const result = await this.processCommitMessage(message, branchName);
-        // Modify the command with the new message
+        // Modify the command with the new message.
+        //
+        // `escapeShellArg` rather than a hand-rolled quote escape: this rewrites a
+        // command that then runs in the consumer's shell, and the Windows branch of
+        // the old escape left a trailing backslash escaping its own closing quote
+        // (#1419). The replacement is a FUNCTION so that a `$&` or `$1` occurring in
+        // the commit message is inserted literally instead of being expanded by
+        // String.replace's substitution syntax.
         if (result.success && result.modifiedMessage !== message) {
-            const modifiedCommand = command.replace(/-m\s+["'][^"']+["']/, `-m "${result.modifiedMessage.replace(/"/g, '\\"')}"`);
+            const replacement = `-m ${escapeShellArg(result.modifiedMessage ?? '')}`;
+            const modifiedCommand = command.replace(/-m\s+["'][^"']+["']/, () => replacement);
             return {
                 ...result,
                 data: {

package/dist/src/cli/shared/hooks/session-hooks.js

@@ -7,6 +7,7 @@
  * @module v3/shared/hooks/session-hooks
  */
 import { HookEvent, HookPriority, } from './types.js';
+import { generateId } from '../utils/id.js';
 /**
  * In-memory session storage (for testing and fallback)
  */
@@ -84,7 +85,7 @@ export class SessionHooksManager {
      * Handle session start
      */
     async handleSessionStart(context) {
-        this.currentSessionId = context.session?.id || `session-${Date.now()}`;
+        this.currentSessionId = context.session?.id || generateId('session');
         this.sessionStartTime = new Date();
         this.resetActivity();
         return {
@@ -189,7 +190,7 @@ export class SessionHooksManager {
             warnings.push(`${incompleteTasks.length} tasks were incomplete when session ended`);
         }
         // Update current session tracking
-        this.currentSessionId = `session-${Date.now()}-restored`;
+        this.currentSessionId = `${generateId('session')}-restored`;
         this.sessionStartTime = new Date();
         this.resetActivity();
         return {

package/dist/src/cli/shared/hooks/task-hooks.js

@@ -7,6 +7,7 @@
  * @module v3/shared/hooks/task-hooks
  */
 import { HookEvent, HookPriority, } from './types.js';
+import { generateId } from '../utils/id.js';
 /**
  * Task Hooks Manager
  *
@@ -107,7 +108,7 @@ export class TaskHooksManager {
             outcome,
             learningUpdates,
             patternId: learningUpdates.newPatterns > 0 ? `pattern-${task.id}` : undefined,
-            trajectoryId: `trajectory-${task.id}-${Date.now()}`,
+            trajectoryId: generateId(`trajectory-${task.id}`),
         };
     }
     /**

package/dist/src/cli/shared/mcp/session-manager.js

@@ -13,6 +13,7 @@
  * - Session cleanup: <10ms
  */
 import { EventEmitter } from 'events';
+import { randomBytes } from 'node:crypto';
 /**
  * Default session configuration
  */
@@ -283,7 +284,7 @@ export class SessionManager extends EventEmitter {
      * Generate a unique session ID
      */
     generateSessionId() {
-        return `session-${++this.sessionCounter}-${Date.now()}-${Math.random().toString(36).substring(2, 8)}`;
+        return `session-${++this.sessionCounter}-${Date.now()}-${randomBytes(6).toString('hex')}`;
     }
     /**
      * Clear all sessions

package/dist/src/cli/shared/plugins/official/hive-mind-plugin.js

@@ -7,6 +7,7 @@
  * @module v3/shared/plugins/official/hive-mind
  */
 import { HookEvent, HookPriority } from '../../hooks/index.js';
+import { generateId } from '../../utils/id.js';
 /**
  * HiveMind Plugin Implementation
  */
@@ -74,7 +75,7 @@ export class HiveMindPlugin {
      */
     async requestDecision(question, options) {
         const decision = {
-            id: `decision-${Date.now()}`,
+            id: generateId('decision'),
             question,
             votes: new Map(),
             consensusConfidence: 0,

package/dist/src/cli/shared/plugins/official/maestro-plugin.js

@@ -8,6 +8,7 @@
  */
 import { HookEvent, HookPriority } from '../../hooks/index.js';
 import { errorDetail } from '../../utils/error-detail.js';
+import { generateId } from '../../utils/id.js';
 /**
  * Maestro Plugin Implementation
  */
@@ -73,7 +74,7 @@ export class MaestroPlugin {
      */
     createSpell(name, description, steps) {
         const spell = {
-            id: `spell-${Date.now()}`,
+            id: generateId('spell'),
             name,
             description,
             steps: steps.map((step, index) => ({
@@ -340,7 +341,7 @@ export class MaestroPlugin {
         }
     }
     checkpointSpell(spell) {
-        spell.checkpoints.set(`checkpoint-${Date.now()}`, {
+        spell.checkpoints.set(generateId('checkpoint'), {
             progress: spell.progress,
             currentStep: spell.currentStep,
             stepStatuses: spell.steps.map((s) => ({ id: s.id, status: s.status })),

package/dist/src/cli/shared/security/index.js

@@ -5,8 +5,12 @@
  *
  * @module v3/shared/security
  */
-// Secure random generation
-export { generateSecureId, generateUUID, generateSecureToken, generateShortId, generateSessionId, generateAgentId, generateTaskId, generateMemoryId, generateEventId, generateSwarmId, generatePatternId, generateTrajectoryId, secureRandomInt, secureRandomChoice, secureShuffleArray, } from './secure-random.js';
+// Unique-ID minting lives in `shared/utils/id.ts`, not here. `secure-random.ts`
+// re-exported fifteen ID helpers from this barrel and not one of them ever had
+// an importer, while ~38 call sites went on minting IDs with `Math.random()`.
+// It was deleted in #1423 rather than adopted: its per-domain exports
+// (`generateAgentId`, `generateTaskId`, …) were the sprawl, and one of them
+// shadowed the live `generateMemoryId` in `memory/types.ts`.
 // Input validation
 export { validateInput, sanitizeString, validatePath, validateCommand, validateTags, isValidIdentifier, escapeForSql, } from './input-validation.js';
 //# sourceMappingURL=index.js.map

package/dist/src/cli/shared/utils/atomic-file-write.js

@@ -42,11 +42,19 @@
  * @module moflo/cli/shared/utils/atomic-file-write
  */
 import * as realFs from 'node:fs';
+// `randomBytes` inline rather than `randomSuffix` from './id.js' (#1423): the
+// session-start launcher dynamically imports this module out of a consumer's
+// `node_modules/moflo/dist/`, so every import edge added here widens a closure
+// that has to resolve before moflo.yaml can be written. `node:crypto` is a
+// builtin and adds no file to that closure; a sibling module would.
+// `tests/bin/launcher-visibility.test.ts` stages that closure by hand and fails
+// the moment it grows.
+import { randomBytes } from 'node:crypto';
 const IS_WIN32 = process.platform === 'win32';
 const VERIFY_DEADLINE_MS = 250;
 const VERIFY_STEP_MS = 10;
 export function atomicWriteFileSync(targetPath, data, fs = realFs) {
-    const tmpPath = `${targetPath}.tmp.${process.pid}.${Math.random().toString(36).slice(2, 8)}`;
+    const tmpPath = `${targetPath}.tmp.${process.pid}.${randomBytes(4).toString('hex')}`;
     try {
         fs.writeFileSync(tmpPath, data);
         fsyncFile(tmpPath, fs);

package/dist/src/cli/shared/utils/id.js

@@ -0,0 +1,54 @@
+/**
+ * Canonical unique-ID minting.
+ *
+ * ## Why this module exists
+ *
+ * Story #801 fixed `agent_spawn` after base-36 slicing of `Math.random()` was
+ * *observably* colliding under burst spawns — the comment recording that still
+ * sits in `mcp-tools/agent-tools.ts`. The fix was applied there and at a handful
+ * of neighbours and stopped; ~38 other sites kept minting IDs the same way, and
+ * four separate `generateId` helpers accumulated around them (three live and
+ * identically named, in `memory/controllers/_shared.ts`, `memory/bridge-core.ts`
+ * and `memory/persistent-sona.ts`, plus an unused `shared/security/secure-random.ts`).
+ * This module is the one they all now route through (#1423).
+ *
+ * A base-36 slice of `Math.random()` carries roughly 31 bits of entropy before
+ * slicing and far less after — two entities minted in the same
+ * millisecond can share an identity, which for a swarm or agent ID means two
+ * distinct actors silently occupying one slot.
+ *
+ * ## Severity
+ *
+ * This is a **correctness** fix, not a security one. These IDs are not secrets,
+ * capabilities, or session tokens; nothing here depends on unpredictability. The
+ * property being restored is uniqueness. (`Math.random()` remains entirely
+ * correct for neural weight init, epsilon-greedy exploration, HNSW level
+ * selection, and jitter — none of those are touched.)
+ */
+import { randomBytes } from 'node:crypto';
+/** Default CSPRNG entropy per ID: 6 bytes = 48 bits = 12 hex characters. */
+const DEFAULT_ENTROPY_BYTES = 6;
+/**
+ * Mint a unique ID of the form `<prefix><sep><timestamp><sep><random-hex>`.
+ *
+ * The timestamp segment is retained from the patterns this replaces: it keeps
+ * IDs roughly sortable by creation time and is useful when reading them in logs.
+ * Uniqueness rests on the random segment alone.
+ */
+export function generateId(prefix, options = {}) {
+    const { separator = '-', bytes = DEFAULT_ENTROPY_BYTES, base36Time = false, } = options;
+    const timestamp = base36Time ? Date.now().toString(36) : String(Date.now());
+    return `${prefix}${separator}${timestamp}${separator}${randomBytes(bytes).toString('hex')}`;
+}
+/**
+ * A bare random segment, for the ID shapes that are not
+ * `prefix + timestamp + random` — a temp-file suffix, a probe stamp, an ID whose
+ * middle segment is a loop index rather than a clock reading.
+ *
+ * Prefer {@link generateId} when the shape does fit; this exists so the odd ones
+ * out do not have to keep reaching for `Math.random()`.
+ */
+export function randomSuffix(bytes = DEFAULT_ENTROPY_BYTES) {
+    return randomBytes(bytes).toString('hex');
+}
+//# sourceMappingURL=id.js.map