moflo 4.12.4 → 4.12.6

package/dist/src/cli/hooks/swarm/index.js

@@ -10,8 +10,9 @@
 import { EventEmitter } from 'node:events';
 import { reasoningBank } from '../reasoningbank/index.js';
 import { MessageBus } from '../../swarm/message-bus/message-bus.js';
+import { generateId } from '../../shared/utils/id.js';
 const DEFAULT_CONFIG = {
-    agentId: `agent_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`,
+    agentId: generateId('agent', { separator: '_' }),
     agentName: 'anonymous',
     messageRetention: 3600000, // 1 hour
     consensusTimeout: 30000, // 30 seconds
@@ -256,7 +257,7 @@ export class SwarmCommunication extends EventEmitter {
     async broadcastPattern(pattern, targetAgents) {
         await this.ensureInitialized();
         const broadcast = {
-            id: `bc_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            id: generateId('bc', { separator: '_' }),
             sourceAgent: this.config.agentId,
             pattern,
             broadcastTime: Date.now(),
@@ -348,7 +349,7 @@ export class SwarmCommunication extends EventEmitter {
     async initiateConsensus(question, options, timeout) {
         await this.ensureInitialized();
         const request = {
-            id: `cons_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            id: generateId('cons', { separator: '_' }),
             initiator: this.config.agentId,
             question,
             options,
@@ -477,8 +478,8 @@ export class SwarmCommunication extends EventEmitter {
     async initiateHandoff(toAgent, taskDescription, context) {
         await this.ensureInitialized();
         const handoff = {
-            id: `ho_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
-            taskId: `task_${Date.now()}`,
+            id: generateId('ho', { separator: '_' }),
+            taskId: generateId('task', { separator: '_' }),
             description: taskDescription,
             fromAgent: this.config.agentId,
             toAgent,

package/dist/src/cli/init/claudemd-generator.js

@@ -50,11 +50,12 @@ After \`npm install\` touches moflo, check \`.moflo/restart-pending.json\` — i
 
 ### Monorepos
 
-Moflo state lives at the monorepo root \`.moflo/\` — never run \`flo init\` inside a sub-workspace of an existing moflo project, or the MCP server and CLI silently bind to different daemons (issue #1174).
+Moflo state lives at the monorepo root \`.moflo/\` — never run \`flo init\` inside a sub-workspace of an existing moflo project, or the MCP server and CLI silently bind to different daemons.
 
 ### Full Reference
 
 - Universal agent rules (memory protocol, git/PR conventions, file org, build/test): \`.claude/guidance/moflo-agent-rules.md\`
+- Fix small defects in the PR you are already in — don't file them: \`.claude/guidance/moflo-inline-fixes.md\`
 - Subagent spawn protocol: \`.claude/guidance/moflo-subagents.md\`
 - Task + swarm coordination: \`.claude/guidance/moflo-claude-swarm-cohesion.md\`
 - CLI, hooks, swarm, memory, moflo.yaml: \`.claude/guidance/moflo-core-guidance.md\`

package/dist/src/cli/init/helpers-generator.js

@@ -983,7 +983,7 @@ switch (command) {
     if (!/(?:^|&&\\s*|\\|\\|\\s*|;\\s*)\\s*(?:[A-Z_][A-Z0-9_]*=\\S+\\s+)*gh\\s+pr\\s+create\\b/.test(cmd)) break;
     var s = readState();
     var missing = [];
-    if (config.testing_gate && !s.testsRun) missing.push('tests have not run green since the last code edit (run npm test, vitest, jest, pytest, or similar — a run whose output reports failures does not count, #1322)');
+    if (config.testing_gate && !s.testsRun) missing.push('tests have not run green since the last code edit (run npm test, vitest, jest, pytest, or similar — a run whose output reports failures does not count)');
     if (config.simplify_gate && !s.simplifyRun) missing.push('/flo-simplify (or /distill) has not run since the last code edit');
     if (config.learnings_gate && !s.learningsStored) missing.push('learnings have not been stored (call mcp__moflo__memory_store)');
     if (missing.length === 0) break;

package/dist/src/cli/init/moflo-yaml-template.js

@@ -214,7 +214,7 @@ gates:
   memory_first: ${gates}
   task_create_first: ${gates}
   context_tracking: ${gates}
-  verify_before_done: true    # Epic #1269/#1294: run /verify before 'gh pr create'. On by default; opt out with false or per-run --no-verify
+  verify_before_done: true    # Run /verify before 'gh pr create'. On by default; opt out with false or per-run --no-verify
 
 # Auto-index on session start
 auto_index:
@@ -233,7 +233,7 @@ session_continuity:
   inject: true
   max_age_hours: 72            # ignore digests older than this when injecting
 
-# Auto-meditate (#1198) — the automatic counterpart to /meditate. When enabled,
+# Auto-meditate — the automatic counterpart to /meditate. When enabled,
 # moflo recognizes durable lessons in the LIVE session (a tiny answer-first note
 # on course-corrections / errors / decisions) and distills them into long-term
 # memory at the next session-start via a cheap headless Haiku pass — deduped.
@@ -241,12 +241,12 @@ session_continuity:
 auto_meditate:
   enabled: true
 
-# Spec-Driven Development (Epic #1269) — spec -> plan -> implement -> verify.
+# Spec-Driven Development — spec -> plan -> implement -> verify.
 # When default is true, every /flo run uses the SDD cycle unless --no-sdd.
 sdd:
   default: false
 
-# Auto-merge the PR at the end of a full /flo run once preconditions are met (#1285).
+# Auto-merge the PR at the end of a full /flo run once preconditions are met.
 # When auto is true, a full /flo run awaits required checks + MERGEABLE state then
 # merges and deletes the branch, instead of stopping at "PR opened". Opt-in;
 # override per-run with --merge / --no-merge.

package/dist/src/cli/mcp-client.js

@@ -23,7 +23,11 @@ import { performanceTools } from './mcp-tools/performance-tools.js';
 // #1353 — `github-tools.ts` is gone. Its four tools made no GitHub API call;
 // they wrote local JSON and returned `Math.random()` counts, so a `merged: true`
 // described nothing that happened. Use the `gh` CLI or a GitHub MCP server.
-import { coordinationTools } from './mcp-tools/coordination-tools.js';
+// #1428 — `coordination-tools.ts` is gone. Its single tool, `coordination_sync`,
+// incremented a counter, slept 50ms under `// Simulate sync`, wrote a local JSON
+// store and returned `synchronized` — it never touched UnifiedSwarmCoordinator.
+// Its agent-side callers were retired by #932; nothing in the tree invoked it.
+// Same disposition as the `github_*` tools in #1353.
 import { moflodbTools } from './mcp-tools/moflodb-tools.js';
 // #1349 — handlers for tool names shipped CLI commands were already calling.
 import { progressTools } from './mcp-tools/progress-tools.js';
@@ -56,7 +60,6 @@ registerTools([
     ...systemTools,
     ...neuralTools,
     ...performanceTools,
-    ...coordinationTools,
     ...moflodbTools,
     ...progressTools,
     ...coverageTools,

package/dist/src/cli/mcp-tools/agent-tools.js

@@ -187,7 +187,10 @@ export const agentTools = [
             }
             const task = input.task || config.task || undefined;
             const routingResult = await determineAgentModel(agentType, config, task);
-            // Math.random().toString(36) was observably colliding under burst spawns.
+            // Base-36 slicing of Math.random() was observably colliding under burst
+            // spawns (Story #801). Kept inline rather than routed through
+            // shared/utils/id.ts because this ID interpolates the agent type in place
+            // of a timestamp; every other site now uses the shared minter (#1423).
             const agentId = `agent-${agentType}-${randomBytes(12).toString('hex')}`;
             const capabilities = Array.isArray(config.capabilities)
                 ? config.capabilities.filter((c) => typeof c === 'string')

package/dist/src/cli/mcp-tools/hive-mind-tools.js

@@ -14,6 +14,7 @@ import { getSwarmCoordinator } from './swarm-coordinator-singleton.js';
 import { SUBAGENT_BOOTSTRAP_DIRECTIVE } from '../services/subagent-bootstrap.js';
 import { validateAgentType } from './agent-tools.js';
 import { SWARM_CONSTANTS } from '../swarm/types.js';
+import { generateId } from '../shared/utils/id.js';
 // Namespace constants — avoids hardcoded strings scattered across handlers
 const HIVE_NS = 'hive-mind';
 const HIVE_MEMORY_NS = 'hive-mind-memory';
@@ -308,8 +309,8 @@ export const hiveMindTools = [
             const bus = await getMessageBus();
             // Initialize write-through adapter (configures hive-mind namespace)
             await getWriteThroughAdapter();
-            const hiveId = `hive-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-            const queenId = input.queenId || `queen-${Date.now()}`;
+            const hiveId = generateId('hive');
+            const queenId = input.queenId || generateId('queen');
             const config = {
                 consensus: resolveConsensus(input.consensus),
                 maxAgents: resolveMaxAgents(input.maxAgents),
@@ -535,7 +536,7 @@ export const hiveMindTools = [
             const action = input.action;
             const bus = await getMessageBus();
             if (action === 'propose') {
-                const proposalId = `proposal-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+                const proposalId = generateId('proposal');
                 const proposal = {
                     proposalId,
                     type: input.type || 'general',

package/dist/src/cli/mcp-tools/hooks-tools.js

@@ -8,6 +8,7 @@ import { errorDetail } from '../shared/utils/error-detail.js';
 import { findProjectRoot } from '../services/project-root.js';
 import { withSyntheticNotice } from './synthetic.js';
 import { getMofloVersion } from '../services/moflo-version.js';
+import { generateId } from '../shared/utils/id.js';
 // Real vector search functions - lazy loaded to avoid circular imports
 let searchEntriesFn = null;
 async function getRealSearchFunction() {
@@ -583,7 +584,7 @@ export const hooksPostEdit = {
         try {
             const bridge = await import('../memory/memory-bridge.js');
             feedbackResult = await bridge.bridgeRecordFeedback({
-                taskId: `edit-${filePath}-${Date.now()}`,
+                taskId: generateId(`edit-${filePath}`),
                 success,
                 quality: success ? 0.85 : 0.3,
                 agent,
@@ -1060,7 +1061,7 @@ export const hooksPostTask = {
             learningUpdates: {
                 patternsUpdated: feedbackResult?.updated || (success ? 2 : 1),
                 newPatterns: success ? 1 : 0,
-                trajectoryId: `traj-${Date.now()}`,
+                trajectoryId: generateId('traj'),
                 controller: feedbackResult?.controller || 'none',
                 outcomePersisted,
             },
@@ -1803,7 +1804,7 @@ export const hooksSessionStart = {
         },
     },
     handler: async (params) => {
-        const sessionId = params.sessionId || `session-${Date.now()}`;
+        const sessionId = params.sessionId || generateId('session');
         const restoreLatest = params.restoreLatest;
         const shouldStartDaemon = params.startDaemon !== false;
         // Auto-start daemon if enabled
@@ -1968,7 +1969,7 @@ export const hooksSessionRestore = {
         const restoreAgents = params.restoreAgents !== false;
         const restoreTasks = params.restoreTasks !== false;
         const originalSessionId = requestedId === 'latest' ? `session-${Date.now() - 86400000}` : requestedId;
-        const newSessionId = `session-${Date.now()}`;
+        const newSessionId = generateId('session');
         // Get real memory entry count
         const store = loadMemoryStore();
         const memoryEntryCount = Object.keys(store.entries).length;
@@ -2141,7 +2142,7 @@ export const hooksPatternStore = {
         const confidence = params.confidence || 0.8;
         const metadata = params.metadata;
         const timestamp = new Date().toISOString();
-        const patternId = `pattern-${Date.now()}-${Math.random().toString(36).substring(7)}`;
+        const patternId = generateId('pattern');
         // Try pattern bridge first (HNSW-indexed raw SQL)
         let bridgeResult = null;
         try {

package/dist/src/cli/mcp-tools/json-store.js

@@ -1,6 +1,7 @@
 /**
- * Tiny JSON-on-disk store shared by the trimmed MCP-tool surfaces
- * (`coordination-tools`, `system-tools`, `performance-tools`).
+ * Tiny JSON-on-disk store backing the trimmed MCP-tool surfaces. `performance-tools`
+ * is the sole remaining consumer — `coordination-tools` and `system-tools` were the
+ * others until their stores were removed.
  *
  * Anchors files at `<projectRoot>/.moflo/<subdir>/<file>` via {@link mofloDir},
  * with the root resolved by {@link findProjectRoot} so an MCP server launched

package/dist/src/cli/mcp-tools/neural-tools.js

@@ -16,6 +16,7 @@ import { join } from 'node:path';
 import { MOFLO_DIR as STORAGE_DIR } from '../services/moflo-paths.js';
 import { findProjectRoot } from '../services/project-root.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
+import { generateId } from '../shared/utils/id.js';
 let realEmbeddings = undefined;
 let embeddingServiceName = 'none';
 let embeddingsInitPromise = null;
@@ -212,7 +213,7 @@ const rawNeuralTools = [
                 return { success: true, pattern };
             }
             if (action === 'store') {
-                const patternId = `pattern-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+                const patternId = generateId('pattern');
                 const patternName = input.name || 'Unnamed pattern';
                 // Generate embedding from pattern name/content
                 const embedding = await generateEmbedding(patternName, 384);

package/dist/src/cli/mcp-tools/performance-tools.js

@@ -16,6 +16,7 @@
 import * as os from 'node:os';
 import { createJsonStore } from './json-store.js';
 import { readCpuUsagePercent, readLoadAverage, NOT_MEASURED } from '../shared/utils/load-average.js';
+import { generateId } from '../shared/utils/id.js';
 /**
  * Cross-platform CPU usage, or null where it cannot be measured (Rule #1).
  *
@@ -212,7 +213,7 @@ const rawPerformanceTools = [
                     const opsPerSec = Math.round((iterations / durationMs) * 1000);
                     const avgLatencyMs = durationMs / iterations;
                     const memoryDelta = Math.round((memAfter - memBefore) / 1024);
-                    const id = `bench-${suiteName}-${Date.now()}`;
+                    const id = generateId(`bench-${suiteName}`);
                     const result = {
                         id,
                         name: suiteName,

package/dist/src/cli/mcp-tools/session-tools.js

@@ -4,9 +4,11 @@
  * Tool definitions for session management with file persistence.
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
 import { join } from 'node:path';
 import { MOFLO_DIR as STORAGE_DIR } from '../services/moflo-paths.js';
 import { findProjectRoot } from '../services/project-root.js';
+import { generateId } from '../shared/utils/id.js';
 // Storage paths
 const SESSION_DIR = 'sessions';
 function storeDir(...parts) {
@@ -112,7 +114,7 @@ export const sessionTools = [
             required: ['name'],
         },
         handler: async (input) => {
-            const sessionId = `session-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const sessionId = `session-${Date.now()}-${randomBytes(6).toString('hex')}`;
             // Load related data based on options
             const data = loadRelatedStores({
                 includeMemory: input.includeMemory,
@@ -364,7 +366,7 @@ export const sessionTools = [
             const importedAt = new Date().toISOString();
             // A fresh ID keeps an import from silently overwriting a local session
             // that happens to share the source's ID.
-            const sessionId = `imported-${Date.now()}`;
+            const sessionId = generateId('imported');
             const agentsImported = incoming.stats?.agents ?? countOf(incoming.data?.agents);
             const tasksImported = incoming.stats?.tasks ?? countOf(incoming.data?.tasks);
             const memoryEntriesImported = incoming.stats?.memoryEntries ?? countOf(incoming.data?.memory);

package/dist/src/cli/mcp-tools/spell-tools.js

@@ -13,6 +13,7 @@ import { buildGrimoire } from '../services/grimoire-builder.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
 import { inferSpellTier } from '../spells/core/spell-tier.js';
 import { getSharedMemoryAccessor } from '../services/daemon-dashboard.js';
+import { generateId } from '../shared/utils/id.js';
 // ============================================================================
 // Constants
 // ============================================================================
@@ -61,7 +62,7 @@ function trackResult(tracked, result) {
 // (one cold init per process — see #1020).
 /** Execute a definition via the engine with tracking and error handling. */
 async function executeAndTrack(engine, definition, args, options = {}) {
-    const spellId = `sp-${Date.now()}`;
+    const spellId = generateId('sp');
     const tracked = trackStart(spellId, definition.name, definition.description);
     try {
         const projectRoot = findProjectRoot();

package/dist/src/cli/memory/bridge-core.js

@@ -6,7 +6,6 @@
  */
 import * as path from 'path';
 import * as fs from 'fs';
-import * as crypto from 'crypto';
 import { atomicWriteFileSync } from '../services/atomic-file-write.js';
 import { legacyMemoryDbPath, memoryDbPath, MOFLO_DIR, } from '../services/moflo-paths.js';
 import { resolveStateRoot } from '../services/project-root.js';
@@ -77,6 +76,7 @@ function getProjectRoot() {
 }
 import { ControllerRegistry } from './controller-registry.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
+import { generateId as mintId } from '../shared/utils/id.js';
 let registryPromise = null;
 // Sync handle populated once the promise resolves. Lets sync callers
 // (refreshVectorStatsCache) read the registry without awaiting.
@@ -233,8 +233,14 @@ export function resolveBridgeDbPath(root, customPath) {
 function getDbPath(customPath) {
     return resolveBridgeDbPath(getProjectRoot(), customPath);
 }
+/**
+ * Delegates to the canonical minter, preserving this module's exact ID format
+ * (`_` separator, 8 bytes of entropy). The format is pinned rather than
+ * normalised because these IDs are persisted to `.moflo/moflo.db` — reshaping
+ * them would churn consumer state for no benefit (#1423, Rule #2).
+ */
 export function generateId(prefix) {
-    return `${prefix}_${Date.now()}_${crypto.randomBytes(8).toString('hex')}`;
+    return mintId(prefix, { separator: '_', bytes: 8 });
 }
 /**
  * Returns null if the memory module cannot be loaded or sql.js fails to open —

package/dist/src/cli/memory/controllers/_shared.js

@@ -4,7 +4,7 @@
  * Vector-store utilities kept in one place so reflexion / skills /
  * hierarchical-memory don't each reinvent cosine and BLOB serialization.
  */
-import { randomBytes } from 'node:crypto';
+import { generateId as mintId } from '../../shared/utils/id.js';
 export function toFloat32(vec) {
     return vec instanceof Float32Array ? vec : Float32Array.from(vec);
 }
@@ -118,8 +118,14 @@ function keywordOverlap(lowerQuery, lowerContent) {
             hits++;
     return hits / tokens.size;
 }
+/**
+ * Delegates to the canonical minter, preserving this module's exact ID format
+ * (`-` separator, base36 timestamp, 6 bytes of entropy). The format is pinned
+ * rather than normalised because these IDs are persisted to `.moflo/moflo.db` —
+ * reshaping them would churn consumer state for no benefit (#1423, Rule #2).
+ */
 export function generateId(prefix) {
-    return `${prefix}-${Date.now().toString(36)}-${randomBytes(6).toString('hex')}`;
+    return mintId(prefix, { base36Time: true });
 }
 /**
  * Bounded-value helpers shared by controllers. `clamp01` is the common

package/dist/src/cli/memory/controllers/nightly-learner.js

@@ -15,6 +15,7 @@
  */
 import { hasMethod } from './_shared.js';
 import { errorDetail } from '../../shared/utils/error-detail.js';
+import { generateId } from '../../shared/utils/id.js';
 export class NightlyLearner {
     consolidation;
     reflexion;
@@ -91,7 +92,7 @@ export class NightlyLearner {
         const self = this;
         this.timer = setInterval(() => {
             // Fire-and-forget; consolidate swallows its own errors.
-            void self.consolidate({ sessionId: `cron-${Date.now()}` });
+            void self.consolidate({ sessionId: generateId('cron') });
         }, intervalMs);
         if (typeof this.timer.unref === 'function') {
             this.timer.unref();

package/dist/src/cli/memory/domain/services/memory-domain-service.js

@@ -7,6 +7,7 @@
  * @module v3/memory/domain/services
  */
 import { MemoryEntry } from '../entities/memory-entry.js';
+import { generateId } from '../../../shared/utils/id.js';
 /**
  * Memory Domain Service
  *
@@ -246,7 +247,7 @@ export class MemoryDomainService {
         // Create merged entry
         return MemoryEntry.create({
             namespace: primary.namespace,
-            key: `merged_${Date.now()}`,
+            key: generateId('merged', { separator: '_' }),
             value: {
                 primary: primary.value,
                 related: sorted.slice(1).map((e) => e.value),

package/dist/src/cli/memory/entries-write.js

@@ -26,6 +26,7 @@ import { serialiseMetadata } from './bridge-entries.js';
 import { logRoutingFault, writeVectorStatsCache } from './entries-shared.js';
 import { writeThroughDurable } from '../services/durable-sync.js';
 import { resolveStateRoot } from '../services/project-root.js';
+import { generateId } from '../shared/utils/id.js';
 /**
  * Propagate a just-persisted durable write to the shared store (#1232). The
  * caller passes the project root the row actually landed under so the flush
@@ -148,7 +149,7 @@ export async function storeEntry(options) {
         // Ensure schema has all required columns (migration for older DBs)
         await ensureSchemaColumns(dbPath);
         const db = openDaemonDatabase(dbPath);
-        const id = `entry_${Date.now()}_${Math.random().toString(36).substring(7)}`;
+        const id = generateId('entry', { separator: '_' });
         const now = Date.now();
         // generateEmbedding() throws on embed failure; the outer try/catch returns
         // success:false rather than inserting a null-embedded row. Opt-out rows

package/dist/src/cli/memory/intelligence.js

@@ -15,6 +15,7 @@ import { join } from 'node:path';
 import { errorDetail } from '../shared/utils/error-detail.js';
 import { findProjectRoot } from '../services/project-root.js';
 import { MOFLO_DIR, mofloHomeDir } from '../services/moflo-paths.js';
+import { generateId } from '../shared/utils/id.js';
 // ============================================================================
 // Persistence Configuration
 // ============================================================================
@@ -509,7 +510,7 @@ export async function recordStep(step) {
         // Store in ReasoningBank for retrieval
         if (reasoningBank) {
             reasoningBank.store({
-                id: `step_${Date.now()}_${Math.random().toString(36).substring(7)}`,
+                id: generateId('step', { separator: '_' }),
                 type: step.type,
                 embedding,
                 content: step.content,

package/dist/src/cli/memory/persistent-sona.js

@@ -12,6 +12,7 @@
  * @module cli/memory/persistent-sona
  */
 import { RvfLearningStore, } from './rvf-learning-store.js';
+import { generateId } from '../shared/utils/id.js';
 // ===== Constants =====
 const DEFAULT_PATTERN_THRESHOLD = 0.85;
 const DEFAULT_MAX_TRAJECTORY_BUFFER = 1000;
@@ -41,9 +42,6 @@ function cosineSimilarity(a, b) {
     const denom = Math.sqrt(normA) * Math.sqrt(normB);
     return denom > 0 ? dot / denom : 0;
 }
-function generateId(prefix) {
-    return `${prefix}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-}
 // ===== PersistentSonaCoordinator =====
 /**
  * Coordinates SONA learning with persistent storage.

package/dist/src/cli/memory/types.js

@@ -6,13 +6,12 @@
  *
  * @module v3/memory/types
  */
+import { generateId } from '../shared/utils/id.js';
 /**
  * Generates a unique memory ID
  */
 export function generateMemoryId() {
-    const timestamp = Date.now().toString(36);
-    const random = Math.random().toString(36).substring(2, 10);
-    return `mem_${timestamp}_${random}`;
+    return generateId('mem', { separator: '_', base36Time: true });
 }
 /**
  * Creates a default memory entry

package/dist/src/cli/memory/verify.js

@@ -10,6 +10,7 @@
  */
 import { openDaemonDatabase } from './daemon-backend.js';
 import { generateEmbedding } from './embedding-model.js';
+import { generateId } from '../shared/utils/id.js';
 /**
  * Verify memory initialization works correctly
  * Tests: write, read, search, patterns
@@ -33,7 +34,7 @@ export async function verifyMemoryInit(dbPath, options) {
         });
         // Test 2: Write entry
         const writeStart = Date.now();
-        const testId = `test_${Date.now()}`;
+        const testId = generateId('test', { separator: '_' });
         const testKey = 'verification_test';
         const testValue = 'This is a verification test entry for memory initialization';
         try {
@@ -104,7 +105,7 @@ export async function verifyMemoryInit(dbPath, options) {
         // Test 5: Pattern storage
         const patternStart = Date.now();
         try {
-            const patternId = `pattern_${Date.now()}`;
+            const patternId = generateId('pattern', { separator: '_' });
             db.run(`
         INSERT INTO patterns (id, name, pattern_type, condition, action, confidence, created_at, updated_at)
         VALUES (?, 'test-pattern', 'task-routing', 'test condition', 'test action', 0.5, ?, ?)

package/dist/src/cli/movector/graph-analyzer.js

@@ -62,8 +62,15 @@ async function loadMovector() {
  */
 function extractImports(content, _filePath) {
     const imports = [];
-    // ES6 import statements
-    const esImportRegex = /import\s+(?:(?:\{[^}]*\}|\*\s+as\s+\w+|\w+)\s*,?\s*)*\s*from\s*['"]([^'"]+)['"]/g;
+    // ES6 import statements. Clause items are separated by a REQUIRED comma
+    // rather than the old optional `\s*,?\s*`: with the separator optional, the
+    // outer `*` could split a run of word characters many ways, and the regex
+    // backtracked exponentially on a pathological source file during indexing
+    // (#1418).
+    // `(?:type\s+)?` is explicit because the old optional separator absorbed the
+    // `type` modifier by accident; without it `import type { T } from 'x'` — the
+    // dominant form in this codebase — would stop producing a graph edge.
+    const esImportRegex = /import\s+(?:type\s+)?(?:\{[^}]*\}|\*\s+as\s+\w+|\w+)(?:\s*,\s*(?:\{[^}]*\}|\*\s+as\s+\w+|\w+))*\s*from\s*['"]([^'"]+)['"]/g;
     let match;
     while ((match = esImportRegex.exec(content)) !== null) {
         imports.push({ path: match[1], type: 'import' });
@@ -892,5 +899,9 @@ export function exportToDot(result, options = {}) {
 // ============================================================================
 // Exports
 // ============================================================================
-export { loadMovector, fallbackMinCut, fallbackLouvain, };
+export { loadMovector, fallbackMinCut, fallbackLouvain, 
+// Exported for the #1418 ReDoS regression test: the import regex is only
+// reachable through file I/O otherwise, and a timing assertion needs to call
+// it directly.
+extractImports, };
 //# sourceMappingURL=graph-analyzer.js.map

package/dist/src/cli/neural/pattern-learner.js

@@ -4,6 +4,8 @@
  * Implements pattern extraction, matching, and evolution for
  * continuous learning from agent experiences.
  */
+import { generateId } from '../shared/utils/id.js';
+import { randomSuffix } from '../shared/utils/id.js';
 /**
  * Default Pattern Learner configuration
  */
@@ -106,7 +108,7 @@ export class PatternLearner {
         }
         // Create new pattern
         const pattern = {
-            patternId: `pat_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`,
+            patternId: generateId('pat', { separator: '_' }),
             name: this.generatePatternName(trajectory),
             domain: trajectory.domain,
             embedding,
@@ -247,7 +249,7 @@ export class PatternLearner {
                 newEmbedding[j] = pattern.embedding[j] + noise;
             }
             const newPattern = {
-                patternId: `pat_${Date.now()}_${i}_${Math.random().toString(36).slice(2, 6)}`,
+                patternId: `pat_${Date.now()}_${i}_${randomSuffix()}`,
                 name: `${pattern.name}_split_${i}`,
                 domain: pattern.domain,
                 embedding: newEmbedding,

package/dist/src/cli/neural/reasoning-bank.js

@@ -14,6 +14,7 @@
 // neural/index → here would leave MofloDbAdapter undefined at module load.
 import { MofloDbAdapter } from '../memory/moflo-db-adapter.js';
 import { createDefaultEntry } from '../memory/types.js';
+import { generateId } from '../shared/utils/id.js';
 /**
  * Default ReasoningBank configuration
  */
@@ -284,7 +285,7 @@ export class ReasoningBank {
         // Compute aggregated embedding
         const embedding = this.computeAggregateEmbedding(trajectory);
         const memory = {
-            memoryId: `mem_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`,
+            memoryId: generateId('mem', { separator: '_' }),
             trajectoryId: trajectory.trajectoryId,
             strategy,
             keyLearnings,

package/dist/src/cli/neural/reasoningbank-adapter.js

@@ -11,6 +11,7 @@
  */
 import { createSONAManager } from './sona-manager.js';
 import { createPatternLearner } from './pattern-learner.js';
+import { generateId } from '../shared/utils/id.js';
 // ============================================================================
 // ReasoningBank Adapter Implementation
 // ============================================================================
@@ -149,7 +150,7 @@ export class ReasoningBankAdapter {
         const patterns = this.extractPatternsFromTrajectory(trajectory, verdict);
         for (let i = 0; i < Math.min(patterns.length, maxItems); i++) {
             const pattern = patterns[i];
-            const id = `mem_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
+            const id = generateId('mem', { separator: '_' });
             const rbPattern = {
                 id,
                 type: 'reasoning_memory',

package/dist/src/cli/neural/sona-manager.js

@@ -15,6 +15,7 @@ import { BalancedMode } from './modes/balanced.js';
 import { ResearchMode } from './modes/research.js';
 import { EdgeMode } from './modes/edge.js';
 import { BatchMode } from './modes/batch.js';
+import { generateId } from '../shared/utils/id.js';
 /**
  * Default mode configurations
  */
@@ -210,7 +211,7 @@ export class SONAManager {
      */
     beginTrajectory(context, domain = 'general') {
         const startTime = performance.now();
-        const trajectoryId = `traj_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
+        const trajectoryId = generateId('traj', { separator: '_' });
         const trajectory = {
             trajectoryId,
             context,
@@ -313,7 +314,7 @@ export class SONAManager {
         const startTime = performance.now();
         const fullPattern = {
             ...pattern,
-            patternId: `pat_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`,
+            patternId: generateId('pat', { separator: '_' }),
             createdAt: Date.now(),
             updatedAt: Date.now(),
         };
@@ -399,7 +400,7 @@ export class SONAManager {
     initializeLoRAWeights(domain = 'default') {
         const config = this.getLoRAConfig();
         const weights = {
-            adapterId: `lora_${domain}_${Date.now()}`,
+            adapterId: generateId(`lora_${domain}`, { separator: '_' }),
             A: new Map(),
             B: new Map(),
             createdAt: Date.now(),