moflo 4.8.2 → 4.8.3

package/bin/hooks.mjs

@@ -20,7 +20,7 @@
  */
 
 import { spawn } from 'child_process';
-import { existsSync, appendFileSync, readFileSync } from 'fs';
+import { existsSync, appendFileSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'fs';
 import { resolve, dirname } from 'path';
 import { fileURLToPath } from 'url';
 
@@ -306,10 +306,13 @@ async function main() {
       }
 
       case 'daemon-start': {
-        if (!isDaemonLockHeld()) {
-          await runClaudeFlow('daemon', ['start', '--quiet']);
-        } else {
+        if (isDaemonLockHeld()) {
           log('info', 'Daemon already running (lock held), skipping start');
+        } else if (isDaemonSpawnRecent()) {
+          log('info', 'Daemon spawn debounced (recent attempt), skipping');
+        } else {
+          touchSpawnStamp();
+          await runClaudeFlow('daemon', ['start', '--quiet']);
         }
         break;
       }
@@ -479,17 +482,30 @@ function runBackgroundTraining() {
   spawnWindowless('node', [localCli, 'neural', 'optimize'], 'neural optimize');
 }
 
-// Check if daemon lock exists — fast pre-check to avoid spawning a Node process
-// just to have it bail out via the atomic lock in daemon.ts.
-// Uses daemon.lock (atomic wx-based) instead of the old daemon.pid (TOCTOU-vulnerable).
+// Delegate to daemon-lock.js for proper PID + command-line verification.
+// Falls back to a naive kill(0) check if the import fails (e.g. dist not built).
+let _getDaemonLockHolder = null;
+try {
+  const daemonLockPath = resolve(__dirname, '..', 'src', '@claude-flow', 'cli', 'dist', 'src', 'services', 'daemon-lock.js');
+  if (existsSync(daemonLockPath)) {
+    const mod = await import('file://' + daemonLockPath.replace(/\\/g, '/'));
+    _getDaemonLockHolder = mod.getDaemonLockHolder;
+  }
+} catch { /* fallback below */ }
+
 function isDaemonLockHeld() {
+  // Prefer the real daemon-lock module (PID + command-line verification)
+  if (_getDaemonLockHolder) {
+    return _getDaemonLockHolder(projectRoot) !== null;
+  }
+
+  // Fallback: naive PID check (only if daemon-lock.js unavailable)
   const lockFile = resolve(projectRoot, '.claude-flow', 'daemon.lock');
   if (!existsSync(lockFile)) return false;
-
   try {
     const data = JSON.parse(readFileSync(lockFile, 'utf-8'));
     if (typeof data.pid === 'number' && data.pid > 0) {
-      process.kill(data.pid, 0); // check if alive
+      process.kill(data.pid, 0);
       return true;
     }
   } catch {
@@ -498,21 +514,52 @@ function isDaemonLockHeld() {
   return false;
 }
 
+// Debounce file — prevents thundering-herd spawns when multiple hooks fire
+// within the same second (e.g. subagents each triggering SessionStart).
+const SPAWN_DEBOUNCE_MS = 30_000;
+const SPAWN_STAMP_FILE = resolve(projectRoot, '.claude-flow', 'daemon-spawn.stamp');
+
+function isDaemonSpawnRecent() {
+  try {
+    if (existsSync(SPAWN_STAMP_FILE)) {
+      const age = Date.now() - statSync(SPAWN_STAMP_FILE).mtimeMs;
+      return age < SPAWN_DEBOUNCE_MS;
+    }
+  } catch { /* non-fatal */ }
+  return false;
+}
+
+function touchSpawnStamp() {
+  try {
+    const dir = resolve(projectRoot, '.claude-flow');
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    writeFileSync(SPAWN_STAMP_FILE, String(Date.now()));
+  } catch { /* non-fatal */ }
+}
+
 // Run daemon start in background (non-blocking) — skip if already running
 function runDaemonStartBackground() {
-  // Fast check: if daemon lock is held by a live process, skip spawning entirely.
-  // This avoids zombie Node processes from subagents that all fire SessionStart.
+  // 1. Check if a live daemon already holds the lock
   if (isDaemonLockHeld()) {
     log('info', 'Daemon already running (lock held), skipping start');
     return;
   }
 
+  // 2. Debounce: skip if we spawned recently (prevents thundering herd)
+  if (isDaemonSpawnRecent()) {
+    log('info', 'Daemon spawn debounced (recent attempt), skipping');
+    return;
+  }
+
   const localCli = getLocalCliPath();
   if (!localCli) {
     log('warn', 'Local CLI not found, skipping daemon start');
     return;
   }
 
+  // 3. Write stamp BEFORE spawning so concurrent callers see it immediately
+  touchSpawnStamp();
+
   spawnWindowless('node', [localCli, 'daemon', 'start', '--quiet'], 'daemon');
 }
 

package/bin/index-guidance.mjs

@@ -635,6 +635,29 @@ function indexFile(db, filePath, keyPrefix) {
   }
 }
 
+/**
+ * Recursively collect all .md files under a directory.
+ * Skips node_modules, .git, and other non-content directories.
+ */
+function walkMdFiles(dir) {
+  const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', '.next']);
+  const files = [];
+
+  function walk(current) {
+    if (!existsSync(current)) return;
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) walk(resolve(current, entry.name));
+      } else if (entry.isFile() && entry.name.endsWith('.md')) {
+        files.push(resolve(current, entry.name));
+      }
+    }
+  }
+
+  walk(dir);
+  return files;
+}
+
 function indexDirectory(db, dirConfig) {
   const dirPath = dirConfig.absolute ? dirConfig.path : resolve(projectRoot, dirConfig.path);
   const results = [];
@@ -644,13 +667,12 @@ function indexDirectory(db, dirConfig) {
     return results;
   }
 
-  const allMdFiles = readdirSync(dirPath).filter(f => f.endsWith('.md'));
-  const files = dirConfig.fileFilter
-    ? allMdFiles.filter(f => dirConfig.fileFilter.includes(f))
+  const allMdFiles = walkMdFiles(dirPath);
+  const filtered = dirConfig.fileFilter
+    ? allMdFiles.filter(f => dirConfig.fileFilter.includes(basename(f)))
     : allMdFiles;
 
-  for (const file of files) {
-    const filePath = resolve(dirPath, file);
+  for (const filePath of filtered) {
     const result = indexFile(db, filePath, dirConfig.prefix);
     results.push(result);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.8.2",
+  "version": "4.8.3",
   "description": "MoFlo — AI agent orchestration for Claude Code. Forked from ruflo/claude-flow with patches applied to source, plus feature-level orchestration.",
   "main": "dist/index.js",
   "type": "module",
@@ -83,7 +83,7 @@
     "@types/bcrypt": "^5.0.2",
     "@types/node": "^20.19.37",
     "eslint": "^8.0.0",
-    "moflo": "^4.8.1",
+    "moflo": "^4.8.2",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"

package/src/@claude-flow/cli/dist/src/commands/daemon.js

@@ -4,7 +4,7 @@
  */
 import { output } from '../output.js';
 import { getDaemon, startDaemon, stopDaemon } from '../services/worker-daemon.js';
-import { acquireDaemonLock, releaseDaemonLock, getDaemonLockHolder } from '../services/daemon-lock.js';
+import { acquireDaemonLock, releaseDaemonLock, getDaemonLockHolder, transferDaemonLock } from '../services/daemon-lock.js';
 import { spawn } from 'child_process';
 import { fileURLToPath } from 'url';
 import { dirname, join, resolve } from 'path';
@@ -71,16 +71,16 @@ const startCommand = {
         }
         // Foreground mode: run in current process (blocks terminal)
         try {
-            // Acquire atomic daemon lock (prevents duplicate daemons)
-            // Skip lock acquisition if we're the spawned child — parent already holds it
-            if (!isDaemonProcess) {
-                const lockResult = acquireDaemonLock(projectRoot);
-                if (!lockResult.acquired) {
-                    if (!quiet) {
-                        output.printWarning(`Daemon already running (PID: ${lockResult.holder})`);
-                    }
-                    return { success: true };
+            // Acquire atomic daemon lock (prevents duplicate daemons).
+            // Always acquire here — even when spawned as a child (CLAUDE_FLOW_DAEMON=1)
+            // because on Windows the parent's child.pid is the shell PID (cmd.exe),
+            // not the actual node process. The child must write its own real PID.
+            const lockResult = acquireDaemonLock(projectRoot);
+            if (!lockResult.acquired) {
+                if (!quiet) {
+                    output.printWarning(`Daemon already running (PID: ${lockResult.holder})`);
                 }
+                return { success: true };
             }
             // Clean up lock file on exit
             const cleanup = () => {
@@ -256,11 +256,21 @@ async function startBackgroundDaemon(projectRoot, quiet, maxCpuLoad, minFreeMemo
     child.unref();
     // Small delay to let the child process fully detach on macOS
     await new Promise(resolve => setTimeout(resolve, 100));
-    // Update the lock file with the child's PID (parent acquired it, child owns it)
-    // We force-release our lock and re-acquire with the child PID so the lock
-    // accurately reflects the running daemon process.
-    releaseDaemonLock(resolvedRoot, process.pid, true);
-    acquireDaemonLock(resolvedRoot, pid);
+    // On Windows with shell: true, child.pid is the cmd.exe shell PID, not the
+    // actual node daemon. The child will acquire the lock itself with its real PID
+    // (see foreground start path). Release the parent's lock so the child can take it.
+    //
+    // On POSIX (no shell), child.pid IS the real daemon PID, so we can transfer
+    // atomically to avoid any gap where the lock is absent.
+    if (isWin) {
+        releaseDaemonLock(resolvedRoot, process.pid, true);
+    }
+    else {
+        if (!transferDaemonLock(resolvedRoot, pid)) {
+            releaseDaemonLock(resolvedRoot, process.pid, true);
+            acquireDaemonLock(resolvedRoot, pid);
+        }
+    }
     if (!quiet) {
         output.printSuccess(`Daemon started in background (PID: ${pid})`);
         output.printInfo(`Logs: ${logFile}`);

package/src/@claude-flow/cli/dist/src/commands/doctor.js

@@ -91,20 +91,20 @@ async function checkConfigFile() {
     }
     return { name: 'Config File', status: 'warn', message: 'No config file (using defaults)', fix: 'claude-flow config init' };
 }
-// Check daemon status
+// Check daemon status — delegates to daemon-lock module for proper
+// PID + command-line verification (avoids Windows PID-recycling false positives).
 async function checkDaemonStatus() {
     try {
+        const holderPid = getDaemonLockHolder(process.cwd());
+        if (holderPid) {
+            return { name: 'Daemon Status', status: 'pass', message: `Running (PID: ${holderPid})` };
+        }
+        // getDaemonLockHolder auto-cleans stale locks, but check for legacy PID file
         const lockFile = '.claude-flow/daemon.lock';
         if (existsSync(lockFile)) {
-            try {
-                const data = JSON.parse(readFileSync(lockFile, 'utf8'));
-                const pid = data.pid;
-                process.kill(pid, 0); // Check if process exists
-                return { name: 'Daemon Status', status: 'pass', message: `Running (PID: ${pid})` };
-            }
-            catch {
-                return { name: 'Daemon Status', status: 'warn', message: 'Stale lock file', fix: 'rm .claude-flow/daemon.lock && claude-flow daemon start' };
-            }
+            // Lock exists but holder is null — getDaemonLockHolder already cleaned it,
+            // but if it persists it means cleanup failed (permissions, etc.)
+            return { name: 'Daemon Status', status: 'warn', message: 'Stale lock file', fix: 'rm .claude-flow/daemon.lock && claude-flow daemon start' };
         }
         // Also check legacy PID file
         const pidFile = '.claude-flow/daemon.pid';

package/src/@claude-flow/cli/dist/src/services/daemon-lock.d.ts

@@ -31,6 +31,13 @@ export declare function acquireDaemonLock(projectRoot: string, pid?: number): {
  * Release the daemon lock. Only removes if we own it (or force = true).
  */
 export declare function releaseDaemonLock(projectRoot: string, pid?: number, force?: boolean): void;
+/**
+ * Atomically transfer the daemon lock to a new PID (e.g. parent → child).
+ *
+ * Overwrites the lock file in-place so there is no window where the lock
+ * is absent.  Only succeeds if the lock is currently held by `fromPid`.
+ */
+export declare function transferDaemonLock(projectRoot: string, newPid: number, fromPid?: number): boolean;
 /**
  * Check if the daemon lock is currently held by a live daemon.
  * Returns the holder PID or null.

package/src/@claude-flow/cli/dist/src/services/daemon-lock.js

@@ -79,6 +79,32 @@ export function releaseDaemonLock(projectRoot, pid = process.pid, force = false)
         safeUnlink(lock);
     }
 }
+/**
+ * Atomically transfer the daemon lock to a new PID (e.g. parent → child).
+ *
+ * Overwrites the lock file in-place so there is no window where the lock
+ * is absent.  Only succeeds if the lock is currently held by `fromPid`.
+ */
+export function transferDaemonLock(projectRoot, newPid, fromPid = process.pid) {
+    const lock = lockPath(projectRoot);
+    const existing = readLockPayload(lock);
+    if (!existing || existing.pid !== fromPid) {
+        return false; // We don't own the lock — can't transfer
+    }
+    const payload = {
+        pid: newPid,
+        startedAt: Date.now(),
+        label: LOCK_LABEL,
+    };
+    try {
+        // Atomic overwrite — no unlink/recreate gap
+        fs.writeFileSync(lock, JSON.stringify(payload));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Check if the daemon lock is currently held by a live daemon.
  * Returns the holder PID or null.

package/src/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moflo/cli",
-  "version": "4.8.2",
+  "version": "4.8.3",
   "type": "module",
   "description": "MoFlo CLI — AI agent orchestration with specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

package/.claude/workflow-state.json

@@ -1,5 +0,0 @@
-{
-  "tasksCreated": true,
-  "taskCount": 1,
-  "memorySearched": true
-}