moflo 4.8.71 → 4.8.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.8.71",
+  "version": "4.8.73",
   "description": "MoFlo — AI agent orchestration for Claude Code. Forked from ruflo/claude-flow with patches applied to source, plus feature-level orchestration.",
   "main": "dist/index.js",
   "type": "module",
@@ -112,7 +112,7 @@
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.19.37",
     "eslint": "^8.0.0",
-    "moflo": "^4.8.70",
+    "moflo": "^4.8.72",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"

package/src/modules/cli/dist/src/version.js

@@ -2,5 +2,5 @@
  * Auto-generated by build. Do not edit manually.
  * Source of truth: root package.json → scripts/sync-version.mjs
  */
-export const VERSION = '4.8.71';
+export const VERSION = '4.8.73';
 //# sourceMappingURL=version.js.map

package/src/modules/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moflo/cli",
-  "version": "4.8.71",
+  "version": "4.8.73",
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",

package/src/modules/spells/dist/core/platform-sandbox.js

@@ -15,12 +15,13 @@ import { execSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { platform } from 'node:os';
 import { join } from 'node:path';
+import { escapeShellArg } from './shell.js';
 export const DEFAULT_SANDBOX_CONFIG = {
     enabled: false,
     tier: 'auto',
 };
 /** Recommended image for first-time Windows Docker sandbox setup. */
-export const RECOMMENDED_DOCKER_IMAGE = 'node:20-bookworm-slim';
+export const RECOMMENDED_DOCKER_IMAGE = 'node:20-bookworm';
 // ============================================================================
 // Detection (cached)
 // ============================================================================
@@ -40,6 +41,7 @@ export function detectSandboxCapability() {
 /** Reset the cached result (for testing). */
 export function resetSandboxCache() {
     _cached = undefined;
+    _imageExistsCache.clear();
 }
 function detectUncached() {
     const os = platform();
@@ -165,32 +167,33 @@ export async function loadSandboxConfigFromProject(projectRoot) {
  * @throws Error if tier is 'full' but no OS sandbox is available.
  */
 export function resolveEffectiveSandbox(config, capability = detectSandboxCapability()) {
+    let resolved = config;
     // Config disabled or tier is denylist-only => no OS sandbox
-    if (!config.enabled || config.tier === 'denylist-only') {
+    if (!resolved.enabled || resolved.tier === 'denylist-only') {
         return {
             useOsSandbox: false,
             capability,
-            config,
+            config: resolved,
             displayStatus: `OS sandbox: disabled (denylist active)`,
         };
     }
-    // Windows: give beginner-friendly setup instructions when sandboxing is
-    // enabled but Docker isn't ready. Runs before the generic "not available"
-    // branch so Windows users see actionable guidance instead of a terse
-    // "not available (win32)" message.
+    // Windows: Docker is required for OS sandboxing. If Docker is available,
+    // auto-default the image and auto-pull it on first use so the user doesn't
+    // have to do manual setup. Only throw if Docker itself isn't installed/running.
     if (capability.platform === 'win32') {
         if (!capability.available) {
             throw new Error(formatWindowsDockerNotReadyMessage());
         }
-        if (!config.dockerImage) {
-            throw new Error(formatWindowsDockerImageMissingMessage());
+        const image = resolved.dockerImage || RECOMMENDED_DOCKER_IMAGE;
+        if (!resolved.dockerImage) {
+            resolved = { ...resolved, dockerImage: image };
         }
-        if (!dockerImageExists(config.dockerImage)) {
-            throw new Error(formatWindowsDockerImageNotPulledMessage(config.dockerImage));
+        if (!dockerImageExists(image)) {
+            dockerPullImage(image);
         }
     }
     // tier: full — require OS sandbox on non-Windows platforms
-    if (config.tier === 'full' && !capability.available) {
+    if (resolved.tier === 'full' && !capability.available) {
         throw new Error(`Sandbox tier "full" requires an OS sandbox but none was detected on ${capability.platform}. ` +
             `Install bubblewrap (Linux) or set sandbox.tier to "auto".`);
     }
@@ -198,33 +201,51 @@ export function resolveEffectiveSandbox(config, capability = detectSandboxCapabi
         return {
             useOsSandbox: false,
             capability,
-            config,
+            config: resolved,
             displayStatus: `OS sandbox: not available (${capability.platform})`,
         };
     }
     return {
         useOsSandbox: true,
         capability,
-        config,
+        config: resolved,
         displayStatus: `OS sandbox: ${capability.tool} (${capability.platform})`,
     };
 }
+const _imageExistsCache = new Map();
 /**
  * Check whether a Docker image is available locally (already pulled).
- * Returns false on any error (daemon down, image missing, docker not in PATH).
+ * Result is cached per image name for the process lifetime.
  */
 function dockerImageExists(image) {
+    const cached = _imageExistsCache.get(image);
+    if (cached !== undefined)
+        return cached;
     try {
-        execSync(`docker image inspect ${shellQuote(image)}`, { stdio: 'ignore', timeout: 5000 });
+        execSync(`docker image inspect ${escapeShellArg(image)}`, { stdio: 'ignore', timeout: 5000 });
+        _imageExistsCache.set(image, true);
         return true;
     }
     catch {
         return false;
     }
 }
-/** Minimal shell quoting for image names — keeps the execSync call safe. */
-function shellQuote(value) {
-    return `"${value.replace(/"/g, '\\"')}"`;
+/**
+ * Pull a Docker image, printing a one-time setup banner so the user knows
+ * what's happening and why. Throws if the pull fails.
+ */
+function dockerPullImage(image) {
+    console.log(`[spell] One-time setup: pulling Docker image ${image} for sandboxing...\n` +
+        `        This only happens once — Docker caches the image afterwards.`);
+    try {
+        execSync(`docker pull ${escapeShellArg(image)}`, { stdio: 'inherit', timeout: 300_000 });
+        _imageExistsCache.set(image, true);
+        console.log(`[spell] Docker image ${image} is ready.`);
+    }
+    catch {
+        throw new Error(`Failed to pull Docker image "${image}".\n\n` +
+            'Make sure Docker Desktop is running and you have internet access, then try again.');
+    }
 }
 // ── Beginner-friendly setup messages (Windows) ──────────────────────────
 function formatWindowsDockerNotReadyMessage() {
@@ -241,51 +262,13 @@ function formatWindowsDockerNotReadyMessage() {
         '     Wait for the whale icon in your system tray to stop animating —',
         '     that means Docker is ready.',
         '',
-        '  3. Open PowerShell (or any terminal) and pull the recommended image:',
-        `       docker pull ${RECOMMENDED_DOCKER_IMAGE}`,
-        '',
-        '  4. Add this to your moflo.yaml:',
-        '       sandbox:',
-        '         enabled: true',
-        `         dockerImage: ${RECOMMENDED_DOCKER_IMAGE}`,
+        `MoFlo will auto-pull the default image (${RECOMMENDED_DOCKER_IMAGE}) on`,
+        'the first spell run.',
         '',
-        'Not ready to set this up? You can turn sandboxing off instead by setting',
+        'Not ready to set this up? Turn sandboxing off by setting',
         '`sandbox.enabled: false` in moflo.yaml.',
     ].join('\n');
 }
-function formatWindowsDockerImageMissingMessage() {
-    return [
-        'Sandboxing is enabled, but no Docker image is configured.',
-        '',
-        'Docker is ready on this machine — it just needs to know which image to',
-        'run your spell steps inside. This is a one-time setup:',
-        '',
-        '  1. Open PowerShell (or any terminal) and pull the recommended image:',
-        `       docker pull ${RECOMMENDED_DOCKER_IMAGE}`,
-        '',
-        '  2. Add this to your moflo.yaml:',
-        '       sandbox:',
-        '         enabled: true',
-        `         dockerImage: ${RECOMMENDED_DOCKER_IMAGE}`,
-        '',
-        `The recommended image (${RECOMMENDED_DOCKER_IMAGE}) includes node, npm,`,
-        'bash, git, and curl. Any image with bash will work.',
-    ].join('\n');
-}
-function formatWindowsDockerImageNotPulledMessage(image) {
-    return [
-        `Sandboxing is enabled, but the Docker image "${image}" is not available`,
-        'on this machine yet.',
-        '',
-        'To fix this, open PowerShell (or any terminal) and run:',
-        `       docker pull ${image}`,
-        '',
-        'This only needs to happen once — Docker caches the image afterwards.',
-        '',
-        'If Docker Desktop is not running, start it from the Start menu first',
-        'and wait for the whale icon in your system tray to stop animating.',
-    ].join('\n');
-}
 /**
  * Format a one-line log message for spell startup.
  */