moflo 4.8.72 → 4.8.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.8.72",
+  "version": "4.8.73",
   "description": "MoFlo — AI agent orchestration for Claude Code. Forked from ruflo/claude-flow with patches applied to source, plus feature-level orchestration.",
   "main": "dist/index.js",
   "type": "module",
@@ -112,7 +112,7 @@
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.19.37",
     "eslint": "^8.0.0",
-    "moflo": "^4.8.71",
+    "moflo": "^4.8.72",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"

package/src/modules/cli/dist/src/version.js

@@ -2,5 +2,5 @@
  * Auto-generated by build. Do not edit manually.
  * Source of truth: root package.json → scripts/sync-version.mjs
  */
-export const VERSION = '4.8.72';
+export const VERSION = '4.8.73';
 //# sourceMappingURL=version.js.map

package/src/modules/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moflo/cli",
-  "version": "4.8.72",
+  "version": "4.8.73",
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",

package/src/modules/spells/dist/core/platform-sandbox.js

@@ -15,6 +15,7 @@ import { execSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { platform } from 'node:os';
 import { join } from 'node:path';
+import { escapeShellArg } from './shell.js';
 export const DEFAULT_SANDBOX_CONFIG = {
     enabled: false,
     tier: 'auto',
@@ -40,6 +41,7 @@ export function detectSandboxCapability() {
 /** Reset the cached result (for testing). */
 export function resetSandboxCache() {
     _cached = undefined;
+    _imageExistsCache.clear();
 }
 function detectUncached() {
     const os = platform();
@@ -165,12 +167,13 @@ export async function loadSandboxConfigFromProject(projectRoot) {
  * @throws Error if tier is 'full' but no OS sandbox is available.
  */
 export function resolveEffectiveSandbox(config, capability = detectSandboxCapability()) {
+    let resolved = config;
     // Config disabled or tier is denylist-only => no OS sandbox
-    if (!config.enabled || config.tier === 'denylist-only') {
+    if (!resolved.enabled || resolved.tier === 'denylist-only') {
         return {
             useOsSandbox: false,
             capability,
-            config,
+            config: resolved,
             displayStatus: `OS sandbox: disabled (denylist active)`,
         };
     }
@@ -181,17 +184,16 @@ export function resolveEffectiveSandbox(config, capability = detectSandboxCapabi
         if (!capability.available) {
             throw new Error(formatWindowsDockerNotReadyMessage());
         }
-        const image = config.dockerImage || RECOMMENDED_DOCKER_IMAGE;
-        if (!config.dockerImage) {
-            // Mutate config to carry the defaulted image through the rest of the pipeline
-            config = { ...config, dockerImage: image };
+        const image = resolved.dockerImage || RECOMMENDED_DOCKER_IMAGE;
+        if (!resolved.dockerImage) {
+            resolved = { ...resolved, dockerImage: image };
         }
         if (!dockerImageExists(image)) {
             dockerPullImage(image);
         }
     }
     // tier: full — require OS sandbox on non-Windows platforms
-    if (config.tier === 'full' && !capability.available) {
+    if (resolved.tier === 'full' && !capability.available) {
         throw new Error(`Sandbox tier "full" requires an OS sandbox but none was detected on ${capability.platform}. ` +
             `Install bubblewrap (Linux) or set sandbox.tier to "auto".`);
     }
@@ -199,24 +201,29 @@ export function resolveEffectiveSandbox(config, capability = detectSandboxCapabi
         return {
             useOsSandbox: false,
             capability,
-            config,
+            config: resolved,
             displayStatus: `OS sandbox: not available (${capability.platform})`,
         };
     }
     return {
         useOsSandbox: true,
         capability,
-        config,
+        config: resolved,
         displayStatus: `OS sandbox: ${capability.tool} (${capability.platform})`,
     };
 }
+const _imageExistsCache = new Map();
 /**
  * Check whether a Docker image is available locally (already pulled).
- * Returns false on any error (daemon down, image missing, docker not in PATH).
+ * Result is cached per image name for the process lifetime.
  */
 function dockerImageExists(image) {
+    const cached = _imageExistsCache.get(image);
+    if (cached !== undefined)
+        return cached;
     try {
-        execSync(`docker image inspect ${shellQuote(image)}`, { stdio: 'ignore', timeout: 5000 });
+        execSync(`docker image inspect ${escapeShellArg(image)}`, { stdio: 'ignore', timeout: 5000 });
+        _imageExistsCache.set(image, true);
         return true;
     }
     catch {
@@ -231,7 +238,8 @@ function dockerPullImage(image) {
     console.log(`[spell] One-time setup: pulling Docker image ${image} for sandboxing...\n` +
         `        This only happens once — Docker caches the image afterwards.`);
     try {
-        execSync(`docker pull ${shellQuote(image)}`, { stdio: 'inherit', timeout: 300_000 });
+        execSync(`docker pull ${escapeShellArg(image)}`, { stdio: 'inherit', timeout: 300_000 });
+        _imageExistsCache.set(image, true);
         console.log(`[spell] Docker image ${image} is ready.`);
     }
     catch {
@@ -239,10 +247,6 @@ function dockerPullImage(image) {
             'Make sure Docker Desktop is running and you have internet access, then try again.');
     }
 }
-/** Minimal shell quoting for image names — keeps the execSync call safe. */
-function shellQuote(value) {
-    return `"${value.replace(/"/g, '\\"')}"`;
-}
 // ── Beginner-friendly setup messages (Windows) ──────────────────────────
 function formatWindowsDockerNotReadyMessage() {
     return [