moflo 4.12.5 → 4.12.6

package/dist/src/cli/commands/doctor-fixes.js

@@ -5,14 +5,14 @@
  * shell-out where possible). Falls back to running the check's `fix` string
  * if it looks like an `npx`/`npm`/`claude` command.
  */
-import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmdirSync, unlinkSync, writeFileSync, readdirSync } from 'fs';
-import { join } from 'path';
+import { appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmdirSync, unlinkSync, writeFileSync, readdirSync } from 'fs';
+import { basename, dirname, isAbsolute, join, parse, relative, resolve } from 'path';
 import { output } from '../output.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
 import { atomicWriteFileSync } from '../shared/utils/atomic-file-write.js';
 import { repairHookWiring } from '../services/hook-wiring.js';
 import { findProjectDaemonPids, getDaemonLockHolder } from '../services/daemon-lock.js';
-import { findProjectRoot, resolveStateRoot } from '../services/project-root.js';
+import { findProjectRoot, hasMofloStateMarker, resolveStateRoot } from '../services/project-root.js';
 import { legacyMemoryDbPath, legacyMemoryDbBakPath, memoryDbPath, mofloDir } from '../services/moflo-paths.js';
 import { findZombieProcesses } from './doctor-zombies.js';
 import { loadToolArrays, getTool } from './doctor-checks-functional-shared.js';
@@ -29,6 +29,86 @@ async function runFixCommand(cmd) {
         return false;
     }
 }
+/** `realpathSync` if the path exists, else the absolutized string. */
+function canonical(p) {
+    const abs = resolve(p);
+    try {
+        return realpathSync(abs);
+    }
+    catch {
+        return abs;
+    }
+}
+/**
+ * Nearest moflo root at or above `from` (inclusive), or null.
+ *
+ * Shares `hasMofloStateMarker` with `findProjectRoot`'s Pass A rather than
+ * restating the marker set: a guard that tests a narrower signal than the
+ * resolver it guards is blind exactly where it matters, which is #1431's
+ * fourth defect. `findAncestorMofloRoot` is deliberately not reused — it tests
+ * only `.moflo/moflo.db`, and it is exclusive of its starting directory.
+ */
+function nearestMofloRoot(from) {
+    const start = resolve(from);
+    const fsRoot = parse(start).root;
+    let dir = start;
+    while (dir !== fsRoot) {
+        // Same skip as Pass A — a marker inside `node_modules` is a vendored
+        // package's state, not a project root.
+        if (basename(dir) === 'node_modules') {
+            dir = dirname(dir);
+            continue;
+        }
+        if (hasMofloStateMarker(dir))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+/**
+ * Resolve the project root the daemon auto-fixes may act on, or null to refuse.
+ *
+ * The fixes SIGTERM processes and unlink lock files, so an over-broad root is
+ * not a cosmetic error. `findProjectRoot()` Pass A deliberately returns the
+ * TOPMOST ancestor carrying `.moflo/moflo.db` (#1174, so a monorepo's root
+ * daemon is canonical). For a checkout nested inside an unrelated project that
+ * walk climbs past our own root and lands on the parent's — whose daemons are
+ * not ours to kill. These handlers were previously rooted at `process.cwd()`,
+ * where that case degraded to a harmless no-op (`pids` came back empty), so
+ * aligning them with `checkDaemonOrphan` must not convert a no-op into a kill.
+ *
+ * Refuse whenever a NEARER moflo root sits at or above the cwd and differs
+ * from the resolved root: that is the nested-checkout signature. Both sides are
+ * realpath'd before comparison (Rule #1 §2) — `findProjectRoot` may hand back a
+ * raw `CLAUDE_PROJECT_DIR` while the walk yields a resolved path, and on macOS
+ * `/var/folders` vs `/private/var/folders` would otherwise compare unequal.
+ */
+function daemonFixRoot() {
+    const root = findProjectRoot();
+    const rootC = canonical(root);
+    const cwdC = canonical(process.cwd());
+    // Containment first: the cwd must live inside the root we are about to reap
+    // in. `findProjectRoot` returns `CLAUDE_PROJECT_DIR` verbatim when set, and
+    // that variable is inherited by hooks, test runners, and spawned tools whose
+    // cwd may be somewhere else entirely — a temp fixture, `/`, another repo.
+    // Without this check the handler happily reaps the daemons of whatever
+    // project the environment names, from a cwd with no relationship to it.
+    // `relative` + `isAbsolute` rather than string prefixing: on Windows two
+    // different drive letters yield an absolute result, which must count as
+    // "outside" (Rule #1).
+    const rel = relative(rootC, cwdC);
+    if (rel !== '' && (rel.startsWith('..') || isAbsolute(rel)))
+        return null;
+    const nearest = nearestMofloRoot(cwdC);
+    // No moflo state anywhere at or above cwd: nothing to disambiguate, and the
+    // scan will find no same-project daemons anyway.
+    if (nearest === null)
+        return root;
+    return canonical(nearest) === rootC ? root : null;
+}
 /**
  * Fix the `Config File` check by creating the project's JSON config.
  *
@@ -601,9 +681,13 @@ export async function autoFixCheck(check) {
         // Also reaps any same-project orphans whose PIDs aren't recorded in the
         // lock — those are the daemons that survived prior buggy fixes.
         'Daemon Status': async () => {
-            const cwd = process.cwd();
+            // #1431 — same subdirectory-mismatch class as `Daemon Orphan`; this one
+            // also reaps and unlinks, so it takes the same guarded root.
+            const root = daemonFixRoot();
+            if (root === null)
+                return false;
             const { getDaemonLockPayload, reapSameProjectOrphans } = await import('../services/daemon-lock.js');
-            const payload = getDaemonLockPayload(cwd);
+            const payload = getDaemonLockPayload(root);
             if (payload?.pid && payload.pid > 0) {
                 try {
                     process.kill(payload.pid, 'SIGTERM');
@@ -611,9 +695,9 @@ export async function autoFixCheck(check) {
                 catch { /* already dead */ }
             }
             // Wipe other same-project daemons that the lock doesn't account for.
-            reapSameProjectOrphans(cwd);
-            const lockFile = join(cwd, '.moflo', 'daemon.lock');
-            const pidFile = join(cwd, '.moflo', 'daemon.pid');
+            reapSameProjectOrphans(root);
+            const lockFile = join(root, '.moflo', 'daemon.lock');
+            const pidFile = join(root, '.moflo', 'daemon.pid');
             try {
                 if (existsSync(lockFile))
                     unlinkSync(lockFile);
@@ -629,16 +713,19 @@ export async function autoFixCheck(check) {
         // bin/session-start-launcher.mjs so the auto-fix matches the launcher's
         // behavior exactly.
         'Daemon Version Skew': async () => {
-            const cwd = process.cwd();
+            // #1431 — same subdirectory-mismatch class as `Daemon Orphan`.
+            const root = daemonFixRoot();
+            if (root === null)
+                return false;
             const { getDaemonLockPayload } = await import('../services/daemon-lock.js');
-            const payload = getDaemonLockPayload(cwd);
+            const payload = getDaemonLockPayload(root);
             if (payload?.pid && payload.pid > 0) {
                 try {
                     process.kill(payload.pid, 'SIGTERM');
                 }
                 catch { /* already dead */ }
             }
-            const lockFile = join(cwd, '.moflo', 'daemon.lock');
+            const lockFile = join(root, '.moflo', 'daemon.lock');
             try {
                 if (existsSync(lockFile))
                     unlinkSync(lockFile);
@@ -653,20 +740,27 @@ export async function autoFixCheck(check) {
         // threaded into `reapSameProjectOrphans` so we don't re-run the
         // OS process scan inside it.
         'Daemon Orphan': async () => {
-            const cwd = process.cwd();
+            // #1431 — resolve the root the way `checkDaemonOrphan` does, not with
+            // `process.cwd()`. The check walks up to the project root; the fix used
+            // the raw cwd, so `flo doctor --fix` from a subdirectory scanned a root
+            // with no daemons, fell through `pids.length <= 1`, and reported
+            // "Fixed: Daemon Orphan" without reaping anything.
+            const root = daemonFixRoot();
+            if (root === null)
+                return false;
             const { findProjectDaemonPids, getDaemonLockHolder, reapSameProjectOrphans } = await import('../services/daemon-lock.js');
-            const pids = findProjectDaemonPids(cwd);
+            const pids = findProjectDaemonPids(root);
             if (pids.length <= 1)
                 return true; // already healthy
-            const lockHolder = getDaemonLockHolder(cwd);
+            const lockHolder = getDaemonLockHolder(root);
             if (lockHolder != null && pids.includes(lockHolder)) {
-                const { survived } = reapSameProjectOrphans(cwd, process.pid, lockHolder, pids);
+                const { survived } = reapSameProjectOrphans(root, process.pid, lockHolder, pids);
                 return survived.length === 0;
             }
             // No identifiable canonical daemon — kill them all, clear the lock,
             // respawn fresh.
-            const { survived } = reapSameProjectOrphans(cwd, process.pid, undefined, pids);
-            const lockFile = join(cwd, '.moflo', 'daemon.lock');
+            const { survived } = reapSameProjectOrphans(root, process.pid, undefined, pids);
+            const lockFile = join(root, '.moflo', 'daemon.lock');
             try {
                 if (existsSync(lockFile))
                     unlinkSync(lockFile);
@@ -682,16 +776,21 @@ export async function autoFixCheck(check) {
         // daemon binds the per-project deterministic port and stamps it into
         // the lock — clients can discover it without guessing.
         'Daemon Identity Match': async () => {
-            const cwd = process.cwd();
+            // #1431 — same resolver as `checkDaemonIdentityMatch`; see the note on
+            // the `Daemon Orphan` handler above. Reading the lock from a raw cwd
+            // would SIGTERM nothing and unlink a path the daemon never wrote.
+            const root = daemonFixRoot();
+            if (root === null)
+                return false;
             const { getDaemonLockPayload } = await import('../services/daemon-lock.js');
-            const payload = getDaemonLockPayload(cwd);
+            const payload = getDaemonLockPayload(root);
             if (payload?.pid && payload.pid > 0) {
                 try {
                     process.kill(payload.pid, 'SIGTERM');
                 }
                 catch { /* already dead */ }
             }
-            const lockFile = join(cwd, '.moflo', 'daemon.lock');
+            const lockFile = join(root, '.moflo', 'daemon.lock');
             try {
                 if (existsSync(lockFile))
                     unlinkSync(lockFile);

package/dist/src/cli/services/project-root.js

@@ -60,6 +60,22 @@ import { resolve, dirname, parse, join, basename } from 'node:path';
  *
  * Algorithmic twin of `bin/lib/moflo-paths.mjs:findAncestorMofloRoot()`.
  */
+/**
+ * Does `dir` carry moflo state that makes it a project root?
+ *
+ * The single source of truth for Pass A's marker set, exported so callers that
+ * must agree with the resolver cannot drift from it. #1431 is exactly that
+ * drift: `doctor-fixes.ts` guarded its daemon reaps by looking for
+ * `.moflo/moflo.db` alone, went blind to a nested checkout carrying only the
+ * legacy `.swarm/memory.db`, and allowed the parent project's daemons to be
+ * killed. Any new marker belongs here and nowhere else.
+ *
+ * (`bin/lib/moflo-paths.mjs` holds a plain-JS twin for the launcher, which
+ * cannot import TypeScript — keep the two in step.)
+ */
+export function hasMofloStateMarker(dir) {
+    return existsSync(join(dir, '.moflo', 'moflo.db')) || existsSync(join(dir, '.swarm', 'memory.db'));
+}
 export function findAncestorMofloRoot(dir) {
     const start = resolve(dir);
     const fsRoot = parse(start).root;
@@ -201,7 +217,7 @@ export function findProjectRoot(opts) {
             dir = dirname(dir);
             continue;
         }
-        if (existsSync(join(dir, '.moflo', 'moflo.db')) || existsSync(join(dir, '.swarm', 'memory.db'))) {
+        if (hasMofloStateMarker(dir)) {
             topmostMemoryMarker = dir;
         }
         const parent = dirname(dir);

package/dist/src/cli/version.js

@@ -2,5 +2,5 @@
  * Auto-generated by build. Do not edit manually.
  * Source of truth: root package.json → scripts/sync-version.mjs
  */
-export const VERSION = '4.12.5';
+export const VERSION = '4.12.6';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.12.5",
+  "version": "4.12.6",
   "description": "MoFlo — AI agent orchestration for Claude Code. A standalone, opinionated toolkit with semantic memory, learned routing, gates, spells, and the /flo issue-execution skill.",
   "main": "dist/src/cli/index.js",
   "type": "module",
@@ -98,7 +98,7 @@
     "@typescript-eslint/parser": "^8.65.0",
     "eslint": "^10.8.0",
     "glob": "^11.1.0",
-    "moflo": "^4.12.4",
+    "moflo": "^4.12.5",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"