moflo 4.8.80 → 4.8.82

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.8.80",
+  "version": "4.8.82",
   "description": "MoFlo — AI agent orchestration for Claude Code. Forked from ruflo/claude-flow with patches applied to source, plus feature-level orchestration.",
   "main": "dist/index.js",
   "type": "module",
@@ -117,6 +117,7 @@
     "@types/node": "^24.12.2",
     "@xenova/transformers": "^2.17.0",
     "eslint": "^8.0.0",
+    "moflo": "^4.8.81",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"

package/src/modules/cli/dist/src/commands/doctor-checks-deep.js

@@ -409,6 +409,54 @@ export async function checkMcpSpellIntegration() {
     }
 }
 // ============================================================================
+// MofloDb Bridge Check
+// ============================================================================
+/**
+ * Verify the moflodb bridge (v3 ControllerRegistry) actually loads and
+ * returns real controllers. If it fails, every moflodb_* MCP tool degrades
+ * to a stub response.
+ */
+export async function checkMofloDbBridge() {
+    try {
+        const modulePath = findModule('src/modules/cli/dist/src/memory/memory-bridge.js');
+        if (!modulePath) {
+            return { name: 'MofloDb Bridge', status: 'warn', message: 'memory-bridge module not found', fix: 'npm run build' };
+        }
+        const bridge = await import(toImportUrl(modulePath));
+        const health = await bridge.bridgeHealthCheck?.();
+        if (!health) {
+            const err = bridge.getBridgeLastError?.();
+            const reason = err?.message ? err.message.slice(0, 200) : 'bridge unavailable';
+            return {
+                name: 'MofloDb Bridge',
+                status: 'fail',
+                message: `init failed: ${reason}`,
+                fix: 'Check that sql.js and @moflo/memory are installed; rebuild: npm run build',
+            };
+        }
+        const controllers = Array.isArray(health.controllers) ? health.controllers : [];
+        const required = bridge.REQUIRED_BRIDGE_CONTROLLERS ?? [];
+        const present = new Set(controllers.map((c) => c.name));
+        const missing = required.filter(r => !present.has(r));
+        if (missing.length > 0) {
+            return {
+                name: 'MofloDb Bridge',
+                status: 'warn',
+                message: `loaded but missing controllers: ${missing.join(', ')}`,
+            };
+        }
+        return {
+            name: 'MofloDb Bridge',
+            status: 'pass',
+            message: `${controllers.length} controllers loaded`,
+        };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message.split(/\r?\n/)[0] : String(err);
+        return { name: 'MofloDb Bridge', status: 'fail', message: `check error: ${msg}`, fix: 'npm run build' };
+    }
+}
+// ============================================================================
 // Gate Health Check
 // ============================================================================
 /** Required gate cases that must exist in gate.cjs for full enforcement. */

package/src/modules/cli/dist/src/commands/doctor.js

@@ -13,7 +13,7 @@ import { execSync, exec } from 'child_process';
 import { promisify } from 'util';
 import os from 'os';
 import { getDaemonLockHolder, releaseDaemonLock, isDaemonProcess } from '../services/daemon-lock.js';
-import { checkSubagentHealth, checkSpellExecution, checkMcpToolInvocation, checkHookExecution, checkMcpSpellIntegration, checkGateHealth, getMofloRoot, } from './doctor-checks-deep.js';
+import { checkSubagentHealth, checkSpellExecution, checkMcpToolInvocation, checkHookExecution, checkMcpSpellIntegration, checkGateHealth, checkMofloDbBridge, getMofloRoot, } from './doctor-checks-deep.js';
 import { repairHookWiring } from '../services/hook-wiring.js';
 // Promisified exec with proper shell and env inheritance for cross-platform support
 const execAsync = promisify(exec);
@@ -1394,6 +1394,7 @@ export const doctorCommand = {
             checkMcpSpellIntegration,
             checkHookExecution,
             checkGateHealth,
+            checkMofloDbBridge,
             checkSandboxTier,
         ];
         const componentMap = {
@@ -1429,6 +1430,8 @@ export const doctorCommand = {
             'gate': checkGateHealth,
             'sandbox': checkSandboxTier,
             'sandbox-tier': checkSandboxTier,
+            'moflodb': checkMofloDbBridge,
+            'bridge': checkMofloDbBridge,
         };
         let checksToRun = allChecks;
         if (component && componentMap[component]) {

package/src/modules/cli/dist/src/epic/spells/single-branch.yaml

@@ -116,15 +116,40 @@ steps:
           timeout: 600000
           failOnError: true
 
-      # 2b: Check off story in epic body
+      # 2b: Flip `- [ ] #<story>` to `- [x] #<story>` on the epic body.
+      # The github `comment` action only appends a comment — it does NOT
+      # touch the task-list checkboxes. We read the body, substitute, and
+      # write it back so the epic reflects progress at a glance.
       - id: check-off-story
-        type: github
+        type: bash
+        permissionLevel: elevated
+        config:
+          command: |
+            set -e
+            STORY={loop.story_number}
+            EPIC={args.epic_number}
+            BODY=$(gh issue view "$EPIC" --json body -q .body)
+            UPDATED=$(printf '%s' "$BODY" | sed -E "s/- \[ \] #${STORY}\b/- [x] #${STORY}/")
+            if [ "$BODY" != "$UPDATED" ]; then
+              printf '%s' "$UPDATED" | gh issue edit "$EPIC" --body-file -
+            fi
+          timeout: 60000
+          failOnError: true
+
+      # 2c: Close the story issue explicitly. Single-branch defers to the
+      # consolidated PR's Closes-keywords on merge; if the PR never lands,
+      # stories would stay OPEN forever. Closing here makes the issue state
+      # track the commit, not the eventual merge.
+      - id: close-story
+        type: bash
+        permissionLevel: elevated
         config:
-          action: "comment"
-          issue: "{args.epic_number}"
-          body: "Story #{loop.story_number} committed to epic branch"
+          command: |
+            gh issue close {loop.story_number} --reason completed --comment "Closed by epic #{args.epic_number}: commits landed on epic branch."
+          timeout: 60000
+          failOnError: true
 
-      # 2c: Record completion in memory
+      # 2d: Record completion in memory
       - id: record-completion
         type: memory
         config:
@@ -149,17 +174,29 @@ steps:
       timeout: 120000
       failOnError: true
 
-  # Step 4: Create consolidated PR
+  # Step 4: Build the 'Closes #<story>' fragment for the PR body so that
+  # merging the consolidated PR auto-closes each individual story issue,
+  # not just the epic. Without this, only the epic would close on merge
+  # and story issues would linger open indefinitely.
+  - id: build-closes-list
+    type: bash
+    config:
+      command: |
+        echo {args.stories} | tr ',' '\n' | awk 'NF {printf "Closes #%s ", $0}'
+      timeout: 30000
+      failOnError: true
+
+  # Step 5: Create consolidated PR
   - id: create-pr
     type: github
     config:
       action: "pr-create"
       title: "epic(#{args.epic_number}): consolidated epic PR"
-      body: "## Epic #{args.epic_number}\n\nConsolidated PR for all stories.\n\nCloses #{args.epic_number}"
+      body: "## Epic #{args.epic_number}\n\nConsolidated PR for all stories.\n\n{build-closes-list.stdout} Closes #{args.epic_number}"
       base: "{args.base_branch}"
       head: "epic/{args.epic_number}-{args.epic_slug}"
 
-  # Step 5: Mark epic as completed in memory
+  # Step 6: Mark epic as completed in memory
   - id: finalize-state
     type: memory
     config:

package/src/modules/cli/dist/src/mcp-tools/moflodb-tools.js

@@ -47,6 +47,17 @@ async function getBridge() {
     }
     return bridgeModule;
 }
+/**
+ * When the bridge returns null, surface the underlying init error instead of
+ * the generic "bridge not available" stub.
+ */
+async function bridgeUnavailableReason(fallback) {
+    const bridge = await getBridge();
+    const err = bridge.getBridgeLastError?.();
+    if (err)
+        return `MofloDb bridge init failed: ${sanitizeError(err)}`;
+    return fallback;
+}
 // ===== moflodb_health — Controller health check =====
 export const moflodbHealth = {
     name: 'moflodb_health',
@@ -59,8 +70,9 @@ export const moflodbHealth = {
         try {
             const bridge = await getBridge();
             const health = await bridge.bridgeHealthCheck();
-            if (!health)
-                return { available: false, error: 'MofloDb bridge not available' };
+            if (!health) {
+                return { available: false, error: await bridgeUnavailableReason('MofloDb bridge not available') };
+            }
             return health;
         }
         catch (error) {
@@ -80,8 +92,13 @@ export const moflodbControllers = {
         try {
             const bridge = await getBridge();
             const controllers = await bridge.bridgeListControllers();
-            if (!controllers)
-                return { available: false, controllers: [], error: 'MofloDb bridge not available — @moflo/memory not installed or missing controller-registry. Use memory_store/memory_search tools instead.' };
+            if (!controllers) {
+                return {
+                    available: false,
+                    controllers: [],
+                    error: await bridgeUnavailableReason('MofloDb bridge not available — controllers could not be listed. Use memory_store/memory_search tools instead.'),
+                };
+            }
             return {
                 available: true,
                 controllers,

package/src/modules/cli/dist/src/memory/bridge-core.js

@@ -36,11 +36,30 @@ function getProjectRoot() {
     _projectRoot = process.cwd();
     return _projectRoot;
 }
+import { importMofloMemory } from '../services/moflo-require.js';
 let registryPromise = null;
 // Sync handle populated once the promise resolves. Lets sync callers
 // (refreshVectorStatsCache) read the registry without awaiting.
 let resolvedRegistry = null;
+let lastBridgeError = null;
 const schemaInitialized = new WeakSet();
+/** Controllers every moflodb_* MCP tool assumes are present when the bridge is available. */
+export const REQUIRED_BRIDGE_CONTROLLERS = Object.freeze([
+    'hierarchicalMemory',
+    'tieredCache',
+    'memoryConsolidation',
+    'memoryGraph',
+]);
+/** Last error thrown during bridge init, or null after a successful init. */
+export function getBridgeLastError() {
+    return lastBridgeError;
+}
+function logBridgeError(context, err) {
+    if (process.env.MOFLO_BRIDGE_QUIET)
+        return;
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`[moflo] ${context}: ${msg}`);
+}
 function getDbPath(customPath) {
     const swarmDir = path.resolve(getProjectRoot(), '.swarm');
     if (!customPath)
@@ -68,7 +87,7 @@ export async function getRegistry(dbPath) {
     if (!registryPromise) {
         registryPromise = (async () => {
             try {
-                const { ControllerRegistry } = await import('@moflo/memory');
+                const { ControllerRegistry } = await importMofloMemory(import.meta.url);
                 const registry = new ControllerRegistry();
                 // Suppress noisy init logs
                 const origLog = console.log;
@@ -98,9 +117,12 @@ export async function getRegistry(dbPath) {
                     console.log = origLog;
                 }
                 resolvedRegistry = registry;
+                lastBridgeError = null;
                 return registry;
             }
-            catch {
+            catch (err) {
+                lastBridgeError = err instanceof Error ? err : new Error(String(err));
+                logBridgeError('MofloDb bridge init failed', lastBridgeError);
                 registryPromise = null;
                 return null;
             }
@@ -108,6 +130,45 @@ export async function getRegistry(dbPath) {
     }
     return registryPromise;
 }
+/**
+ * Read rows from sql.js as an array of column-keyed objects. sql.js doesn't
+ * have a `.all()` / `.get()` → object API — the native `Statement.get()`
+ * returns a positional array, and `.all()` doesn't exist at all. This is a
+ * thin wrapper around `db.exec(sql, bindings)` that converts the
+ * `{ columns, values }` shape into objects.
+ */
+export function execRows(db, sql, params) {
+    const result = params && params.length > 0 ? db.exec(sql, params) : db.exec(sql);
+    if (!result || result.length === 0)
+        return [];
+    const { columns, values } = result[0];
+    return values.map((row) => {
+        const obj = {};
+        for (let i = 0; i < columns.length; i++)
+            obj[columns[i]] = row[i];
+        return obj;
+    });
+}
+/**
+ * Persist the in-memory sql.js DB back to disk. sql.js is purely in-memory —
+ * without an explicit export+writeFileSync after each mutation, writes vanish
+ * when the process exits, which breaks store→retrieve across CLI commands.
+ */
+export function persistBridgeDb(db, dbPath) {
+    const target = dbPath
+        ? path.resolve(dbPath)
+        : path.join(getProjectRoot(), '.swarm', 'memory.db');
+    if (target === ':memory:')
+        return;
+    try {
+        const data = db.export();
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.writeFileSync(target, Buffer.from(data));
+    }
+    catch (err) {
+        logBridgeError('bridge persist failed', err);
+    }
+}
 // Kept in sync with MEMORY_SCHEMA_V3.memory_entries in memory-initializer.ts.
 // Running `CREATE TABLE IF NOT EXISTS` is a no-op if the initializer already
 // ran; when the bridge runs first, matching CHECKs here prevents drift.
@@ -152,7 +213,8 @@ export function getDb(registry) {
 }
 /**
  * Resolve registry + db, run fn, return null on any unexpected failure so
- * the caller falls back to raw sql.js.
+ * the caller falls back to raw sql.js. Errors are logged to stderr —
+ * silently swallowing them previously masked real bugs in bridge-entries.ts.
  */
 export async function withDb(dbPath, fn) {
     const registry = await getRegistry(dbPath);
@@ -164,7 +226,8 @@ export async function withDb(dbPath, fn) {
     try {
         return await fn(ctx, registry);
     }
-    catch {
+    catch (err) {
+        logBridgeError('bridge operation failed', err);
         return null;
     }
 }

package/src/modules/cli/dist/src/memory/bridge-entries.js

@@ -7,7 +7,7 @@
  *
  * @module v3/cli/bridge-entries
  */
-import { cosineSim, generateId, refreshVectorStatsCache, withDb } from './bridge-core.js';
+import { cosineSim, execRows, generateId, persistBridgeDb, refreshVectorStatsCache, withDb } from './bridge-core.js';
 function makeEntryCacheKey(namespace, key) {
     const safeNs = String(namespace).replace(/:/g, '_');
     const safeKey = String(key).replace(/:/g, '_');
@@ -34,7 +34,7 @@ function computeTermDocFreqs(queryTerms, rows) {
     const termDocFreqs = new Map();
     let totalLength = 0;
     for (const row of rows) {
-        const content = (row.content || '').toLowerCase();
+        const content = String(row.content || '').toLowerCase();
         const words = content.split(/\s+/);
         totalLength += words.length;
         for (const term of queryTerms) {
@@ -123,8 +123,17 @@ export async function bridgeStoreEntry(options) {
           embedding, embedding_dimensions, embedding_model,
           tags, metadata, created_at, updated_at, expires_at, status
         ) VALUES (?, ?, ?, ?, 'semantic', ?, ?, ?, ?, ?, ?, ?, ?, 'active')`;
+        // sql.js Statement.run takes an array of bindings — not varargs.
         const stmt = ctx.db.prepare(insertSql);
-        stmt.run(id, key, namespace, value, embeddingJson, dimensions || null, model, tags.length > 0 ? JSON.stringify(tags) : null, '{}', now, now, ttl ? now + (ttl * 1000) : null);
+        stmt.run([
+            id, key, namespace, value,
+            embeddingJson, dimensions || null, model,
+            tags.length > 0 ? JSON.stringify(tags) : null,
+            '{}',
+            now, now,
+            ttl ? now + (ttl * 1000) : null,
+        ]);
+        persistBridgeDb(ctx.db, options.dbPath);
         const cacheKey = makeEntryCacheKey(namespace, key);
         await cacheSet(registry, cacheKey, { id, key, namespace, content: value, embedding: embeddingJson });
         await logAttestation(registry, 'store', id, { key, namespace, hasEmbedding: !!embeddingJson });
@@ -161,13 +170,13 @@ export async function bridgeSearchEntries(options) {
         const nsFilter = namespace !== 'all' ? `AND namespace = ?` : '';
         let rows;
         try {
-            const stmt = ctx.db.prepare(`
+            const sql = `
         SELECT id, key, namespace, content, embedding
         FROM memory_entries
         WHERE status = 'active' ${nsFilter}
         LIMIT 1000
-      `);
-            rows = namespace !== 'all' ? stmt.all(namespace) : stmt.all();
+      `;
+            rows = namespace !== 'all' ? execRows(ctx.db, sql, [namespace]) : execRows(ctx.db, sql);
         }
         catch {
             return null;
@@ -179,17 +188,18 @@ export async function bridgeSearchEntries(options) {
         for (const row of rows) {
             let semanticScore = 0;
             let bm25ScoreVal = 0;
+            const rowContent = String(row.content || '');
             if (queryEmbedding && row.embedding) {
                 try {
-                    const embedding = JSON.parse(row.embedding);
+                    const embedding = JSON.parse(String(row.embedding));
                     semanticScore = cosineSim(queryEmbedding, embedding);
                 }
                 catch {
                     // Invalid embedding
                 }
             }
-            if (queryTerms.length > 0 && row.content) {
-                bm25ScoreVal = bm25Score(queryTerms, row.content, avgDocLength, docCount, termDocFreqs);
+            if (queryTerms.length > 0 && rowContent) {
+                bm25ScoreVal = bm25Score(queryTerms, rowContent, avgDocLength, docCount, termDocFreqs);
                 bm25ScoreVal = Math.min(bm25ScoreVal / 10, 1.0);
             }
             const usedSemantic = queryEmbedding != null;
@@ -200,10 +210,10 @@ export async function bridgeSearchEntries(options) {
                     : `bm25:${bm25ScoreVal.toFixed(3)}`;
                 results.push({
                     id: String(row.id).substring(0, 12),
-                    key: row.key || String(row.id).substring(0, 15),
-                    content: (row.content || '').substring(0, 60) + ((row.content || '').length > 60 ? '...' : ''),
+                    key: String(row.key || row.id).substring(0, 15),
+                    content: rowContent.substring(0, 60) + (rowContent.length > 60 ? '...' : ''),
                     score,
-                    namespace: row.namespace || 'default',
+                    namespace: String(row.namespace || 'default'),
                     provenance,
                 });
             }
@@ -224,30 +234,26 @@ export async function bridgeListEntries(options) {
         const nsParams = namespace ? [namespace] : [];
         let total = 0;
         try {
-            const countStmt = ctx.db.prepare(`SELECT COUNT(*) as cnt FROM memory_entries WHERE status = 'active' ${nsFilter}`);
-            const countRow = countStmt.get(...nsParams);
-            total = countRow?.cnt ?? 0;
+            const countRows = execRows(ctx.db, `SELECT COUNT(*) as cnt FROM memory_entries WHERE status = 'active' ${nsFilter}`, nsParams);
+            total = Number(countRows[0]?.cnt ?? 0);
         }
         catch {
             return null;
         }
         const entries = [];
         try {
-            const stmt = ctx.db.prepare(`
-        SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at
-        FROM memory_entries
-        WHERE status = 'active' ${nsFilter}
-        ORDER BY updated_at DESC
-        LIMIT ? OFFSET ?
-      `);
-            const rows = stmt.all(...nsParams, limit, offset);
+            const rows = execRows(ctx.db, `SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at
+         FROM memory_entries
+         WHERE status = 'active' ${nsFilter}
+         ORDER BY updated_at DESC
+         LIMIT ? OFFSET ?`, [...nsParams, limit, offset]);
             for (const row of rows) {
                 entries.push({
                     id: String(row.id).substring(0, 20),
                     key: row.key || String(row.id).substring(0, 15),
                     namespace: row.namespace || 'default',
-                    size: (row.content || '').length,
-                    accessCount: row.access_count ?? 0,
+                    size: String(row.content || '').length,
+                    accessCount: Number(row.access_count ?? 0),
                     createdAt: row.created_at || new Date().toISOString(),
                     updatedAt: row.updated_at || new Date().toISOString(),
                     hasEmbedding: !!(row.embedding && String(row.embedding).length > 10),
@@ -294,7 +300,13 @@ export async function bridgeGetEntry(options) {
         WHERE status = 'active' AND key = ? AND namespace = ?
         LIMIT 1
       `);
-            row = stmt.get(key, namespace);
+            // sql.js: Statement.get returns a positional array, not an object.
+            // Use getAsObject to read columns by name downstream. Bindings are
+            // passed as a single array — varargs are silently ignored.
+            row = stmt.getAsObject([key, namespace]);
+            // getAsObject returns {} when no row matches; treat as null.
+            if (!row || Object.keys(row).length === 0)
+                row = null;
         }
         catch {
             return null;
@@ -302,7 +314,7 @@ export async function bridgeGetEntry(options) {
         if (!row)
             return { success: true, found: false };
         try {
-            ctx.db.prepare(`UPDATE memory_entries SET access_count = access_count + 1, last_accessed_at = ? WHERE id = ?`).run(Date.now(), row.id);
+            ctx.db.prepare(`UPDATE memory_entries SET access_count = access_count + 1, last_accessed_at = ? WHERE id = ?`).run([Date.now(), row.id]);
         }
         catch {
             // Non-fatal
@@ -341,24 +353,28 @@ export async function bridgeDeleteEntry(options) {
         }
         let changes = 0;
         try {
-            const result = ctx.db.prepare(`
+            ctx.db.prepare(`
         UPDATE memory_entries
         SET status = 'deleted', updated_at = ?
         WHERE key = ? AND namespace = ? AND status = 'active'
-      `).run(Date.now(), key, namespace);
-            changes = result?.changes ?? 0;
+      `).run([Date.now(), key, namespace]);
+            // sql.js Statement.run returns true/false, not { changes }. Use
+            // db.getRowsModified() to read the row count from the last statement.
+            changes = ctx.db.getRowsModified?.() ?? 0;
         }
         catch {
             return null;
         }
+        if (changes > 0)
+            persistBridgeDb(ctx.db, options.dbPath);
         await cacheInvalidate(registry, makeEntryCacheKey(namespace, key));
         if (changes > 0) {
             await logAttestation(registry, 'delete', key, { namespace });
         }
         let remaining = 0;
         try {
-            const row = ctx.db.prepare(`SELECT COUNT(*) as cnt FROM memory_entries WHERE status = 'active'`).get();
-            remaining = row?.cnt ?? 0;
+            const result = ctx.db.exec(`SELECT COUNT(*) as cnt FROM memory_entries WHERE status = 'active'`);
+            remaining = result[0]?.values?.[0]?.[0] ?? 0;
         }
         catch {
             // Non-fatal

package/src/modules/cli/dist/src/memory/memory-bridge.js

@@ -9,10 +9,10 @@
  *
  * @module v3/cli/memory-bridge
  */
-import { cosineSim, generateId, getRegistry, withDb, } from './bridge-core.js';
+import { cosineSim, execRows, generateId, getRegistry, persistBridgeDb, withDb, } from './bridge-core.js';
 import { bridgeSearchEntries, bridgeStoreEntry, } from './bridge-entries.js';
 // ===== Re-exports: primitives =====
-export { getControllerRegistry, isBridgeAvailable, refreshVectorStatsCache, shutdownBridge, } from './bridge-core.js';
+export { REQUIRED_BRIDGE_CONTROLLERS, getBridgeLastError, getControllerRegistry, isBridgeAvailable, refreshVectorStatsCache, shutdownBridge, } from './bridge-core.js';
 // ===== Re-exports: entries store =====
 export { bridgeDeleteEntry, bridgeGetEntry, bridgeListEntries, bridgeSearchEntries, bridgeStoreEntry, } from './bridge-entries.js';
 // ===== Embedding bridge =====
@@ -67,8 +67,8 @@ export async function bridgeGetHNSWStatus(dbPath) {
     return withDb(dbPath, async (ctx) => {
         let entryCount = 0;
         try {
-            const row = ctx.db.prepare(`SELECT COUNT(*) as cnt FROM memory_entries WHERE status = 'active' AND embedding IS NOT NULL`).get();
-            entryCount = row?.cnt ?? 0;
+            const rows = execRows(ctx.db, `SELECT COUNT(*) as cnt FROM memory_entries WHERE status = 'active' AND embedding IS NOT NULL`);
+            entryCount = Number(rows[0]?.cnt ?? 0);
         }
         catch {
             // Table might not exist
@@ -85,13 +85,13 @@ export async function bridgeSearchHNSW(queryEmbedding, options, dbPath) {
             : '';
         let rows;
         try {
-            const stmt = ctx.db.prepare(`
+            const sql = `
         SELECT id, key, namespace, content, embedding
         FROM memory_entries
         WHERE status = 'active' AND embedding IS NOT NULL ${nsFilter}
         LIMIT 10000
-      `);
-            rows = nsFilter ? stmt.all(options.namespace) : stmt.all();
+      `;
+            rows = nsFilter ? execRows(ctx.db, sql, [options.namespace]) : execRows(ctx.db, sql);
         }
         catch {
             return null;
@@ -101,16 +101,16 @@ export async function bridgeSearchHNSW(queryEmbedding, options, dbPath) {
             if (!row.embedding)
                 continue;
             try {
-                const emb = JSON.parse(row.embedding);
+                const emb = JSON.parse(String(row.embedding));
                 const score = cosineSim(queryEmbedding, emb);
                 if (score >= threshold) {
+                    const content = String(row.content || '');
                     results.push({
                         id: String(row.id).substring(0, 12),
-                        key: row.key || String(row.id).substring(0, 15),
-                        content: (row.content || '').substring(0, 60) +
-                            ((row.content || '').length > 60 ? '...' : ''),
+                        key: String(row.key || row.id).substring(0, 15),
+                        content: content.substring(0, 60) + (content.length > 60 ? '...' : ''),
                         score,
-                        namespace: row.namespace || 'default',
+                        namespace: String(row.namespace || 'default'),
                     });
                 }
             }
@@ -132,7 +132,12 @@ export async function bridgeAddToHNSW(id, embedding, entry, dbPath) {
         embedding, embedding_dimensions, embedding_model,
         created_at, updated_at, status
       ) VALUES (?, ?, ?, ?, 'semantic', ?, ?, 'Xenova/all-MiniLM-L6-v2', ?, ?, 'active')
-    `).run(id, entry.key, entry.namespace, entry.content, embeddingJson, embedding.length, now, now);
+    `).run([
+            id, entry.key, entry.namespace, entry.content,
+            embeddingJson, embedding.length,
+            now, now,
+        ]);
+        persistBridgeDb(ctx.db, dbPath);
         return true;
     });
 }

package/src/modules/cli/dist/src/memory/memory-initializer.js

@@ -10,7 +10,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { mofloImport } from '../services/moflo-require.js';
+import { mofloImport, importMofloMemory } from '../services/moflo-require.js';
 /**
  * Write vector-stats.json cache for the statusline (no subprocess needed).
  * Called after memory store/delete to keep the cache fresh.
@@ -378,8 +378,10 @@ export async function getHNSWIndex(options) {
     }
     hnswInitializing = true;
     try {
-        // Use HnswLite pure TS implementation (no native dependencies)
-        const memoryModule = await import('@moflo/memory');
+        // Use HnswLite pure TS implementation (no native dependencies). The
+        // shared resolver handles the consumer case where @moflo/memory is not
+        // a declared dep and must be loaded via a relative URL fallback.
+        const memoryModule = await importMofloMemory(import.meta.url);
         if (!('HnswLite' in memoryModule) || memoryModule.HnswLite === undefined) {
             // Shape-check (issue #482): warn loudly and bail — the outer catch
             // would otherwise swallow a cryptic "undefined is not a constructor".

package/src/modules/cli/dist/src/services/moflo-require.js

@@ -78,4 +78,21 @@ export function mofloResolve(specifier) {
         return null;
     }
 }
+/**
+ * Import `@moflo/memory` from within a moflo source module. The root `moflo`
+ * package ships @moflo/memory as a source folder rather than a declared
+ * dependency, so `mofloImport('@moflo/memory')` fails in consumer installs
+ * (node_modules/@moflo/memory/ doesn't exist). Fall back to a URL resolved
+ * relative to the caller's file — the same src/modules/memory/dist/index.js
+ * layout holds in both dev and consumer.
+ *
+ * @param callerUrl `import.meta.url` of the file that needs @moflo/memory
+ */
+export async function importMofloMemory(callerUrl) {
+    const viaRequire = await mofloImport('@moflo/memory');
+    if (viaRequire)
+        return viaRequire;
+    const memoryUrl = new URL('../../../../memory/dist/index.js', callerUrl);
+    return import(memoryUrl.href);
+}
 //# sourceMappingURL=moflo-require.js.map

package/src/modules/cli/dist/src/version.js

@@ -2,5 +2,5 @@
  * Auto-generated by build. Do not edit manually.
  * Source of truth: root package.json → scripts/sync-version.mjs
  */
-export const VERSION = '4.8.80';
+export const VERSION = '4.8.82';
 //# sourceMappingURL=version.js.map

package/src/modules/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moflo/cli",
-  "version": "4.8.80",
+  "version": "4.8.82",
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",

package/src/modules/memory/dist/database-provider.js

@@ -41,8 +41,8 @@ async function testRvf() {
  */
 async function testSqlJs() {
     try {
-        const initSqlJs = (await import('sql.js')).default;
-        const SQL = await initSqlJs();
+        const { initSqlJsForNode } = await import('./sqljs-backend.js');
+        const SQL = await initSqlJsForNode();
         const testDb = new SQL.Database();
         testDb.close();
         return true;

package/src/modules/memory/dist/rvf-migration.js

@@ -92,8 +92,8 @@ function normalizeSqliteRow(row) {
 async function readSqliteRows(dbPath) {
     // Use sql.js (WASM) for SQLite reading
     try {
-        const initSqlJs = (await import('sql.js')).default;
-        const SQL = await initSqlJs();
+        const { initSqlJsForNode } = await import('./sqljs-backend.js');
+        const SQL = await initSqlJsForNode();
         const fs = await import('node:fs');
         const buf = fs.readFileSync(dbPath);
         const db = new SQL.Database(buf);

package/src/modules/memory/dist/sqljs-backend.js

@@ -8,17 +8,57 @@
  */
 import { EventEmitter } from 'node:events';
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join as joinPath } from 'node:path';
 import initSqlJs from 'sql.js';
+/**
+ * Resolve the directory that bundles sql-wasm.wasm alongside sql.js. In Node
+ * the default `locateFile` (sql.js.org CDN) is treated as a file path and
+ * fails with ENOENT — sql.js then crashes on WASM cleanup. Walk to the
+ * installed sql.js package and point at its local dist/ instead.
+ */
+let cachedSqlJsWasmDir = null;
+function resolveSqlJsWasmDir() {
+    if (cachedSqlJsWasmDir !== null)
+        return cachedSqlJsWasmDir;
+    try {
+        // Resolve sql.js's main entry (sql-wasm.js lives next to it in dist/).
+        // Can't use require.resolve('sql.js/package.json') because sql.js's
+        // `exports` field doesn't expose it. `require.resolve` returns an OS-
+        // native absolute path — works on Windows (backslashes) and POSIX.
+        const require = createRequire(import.meta.url);
+        const mainEntry = require.resolve('sql.js');
+        cachedSqlJsWasmDir = dirname(mainEntry);
+    }
+    catch {
+        cachedSqlJsWasmDir = null;
+    }
+    return cachedSqlJsWasmDir;
+}
+/**
+ * Initialize sql.js with a Node-aware `locateFile` that points at the
+ * installed sql.js package's own dist/ directory. Prefer this over bare
+ * `initSqlJs()` anywhere sql.js is used in Node.
+ */
+export async function initSqlJsForNode(wasmPath) {
+    return initSqlJs({ locateFile: buildLocateFile(wasmPath) });
+}
+function buildLocateFile(wasmPath) {
+    if (wasmPath)
+        return () => wasmPath;
+    const localWasmDir = resolveSqlJsWasmDir();
+    if (localWasmDir)
+        return (file) => joinPath(localWasmDir, file);
+    // Browser/unbundled fallback — sql.js can fetch over HTTP when running in
+    // environments where require.resolve('sql.js') can't find the package.
+    return (file) => `https://sql.js.org/dist/${file}`;
+}
 /**
  * Load sql.js WASM and open a Database — from disk if `dbPath` exists,
  * otherwise in-memory. Shared between `SqlJsBackend` and `ControllerRegistry`.
  */
 export async function openSqlJsDatabase(dbPath, wasmPath) {
-    const SQL = await initSqlJs({
-        locateFile: wasmPath
-            ? () => wasmPath
-            : (file) => `https://sql.js.org/dist/${file}`,
-    });
+    const SQL = await initSqlJsForNode(wasmPath);
     if (dbPath !== ':memory:' && existsSync(dbPath)) {
         return new SQL.Database(new Uint8Array(readFileSync(dbPath)));
     }