moflo 4.8.81 → 4.8.83

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.8.81",
+  "version": "4.8.83",
   "description": "MoFlo — AI agent orchestration for Claude Code. Forked from ruflo/claude-flow with patches applied to source, plus feature-level orchestration.",
   "main": "dist/index.js",
   "type": "module",
@@ -117,7 +117,7 @@
     "@types/node": "^24.12.2",
     "@xenova/transformers": "^2.17.0",
     "eslint": "^8.0.0",
-    "moflo": "^4.8.80",
+    "moflo": "^4.8.82",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"

package/src/modules/cli/dist/src/epic/spells/single-branch.yaml

@@ -116,15 +116,40 @@ steps:
           timeout: 600000
           failOnError: true
 
-      # 2b: Check off story in epic body
+      # 2b: Flip `- [ ] #<story>` to `- [x] #<story>` on the epic body.
+      # The github `comment` action only appends a comment — it does NOT
+      # touch the task-list checkboxes. We read the body, substitute, and
+      # write it back so the epic reflects progress at a glance.
       - id: check-off-story
-        type: github
+        type: bash
+        permissionLevel: elevated
+        config:
+          command: |
+            set -e
+            STORY={loop.story_number}
+            EPIC={args.epic_number}
+            BODY=$(gh issue view "$EPIC" --json body -q .body)
+            UPDATED=$(printf '%s' "$BODY" | sed -E "s/- \[ \] #${STORY}\b/- [x] #${STORY}/")
+            if [ "$BODY" != "$UPDATED" ]; then
+              printf '%s' "$UPDATED" | gh issue edit "$EPIC" --body-file -
+            fi
+          timeout: 60000
+          failOnError: true
+
+      # 2c: Close the story issue explicitly. Single-branch defers to the
+      # consolidated PR's Closes-keywords on merge; if the PR never lands,
+      # stories would stay OPEN forever. Closing here makes the issue state
+      # track the commit, not the eventual merge.
+      - id: close-story
+        type: bash
+        permissionLevel: elevated
         config:
-          action: "comment"
-          issue: "{args.epic_number}"
-          body: "Story #{loop.story_number} committed to epic branch"
+          command: |
+            gh issue close {loop.story_number} --reason completed --comment "Closed by epic #{args.epic_number}: commits landed on epic branch."
+          timeout: 60000
+          failOnError: true
 
-      # 2c: Record completion in memory
+      # 2d: Record completion in memory
       - id: record-completion
         type: memory
         config:
@@ -149,17 +174,29 @@ steps:
       timeout: 120000
       failOnError: true
 
-  # Step 4: Create consolidated PR
+  # Step 4: Build the 'Closes #<story>' fragment for the PR body so that
+  # merging the consolidated PR auto-closes each individual story issue,
+  # not just the epic. Without this, only the epic would close on merge
+  # and story issues would linger open indefinitely.
+  - id: build-closes-list
+    type: bash
+    config:
+      command: |
+        echo {args.stories} | tr ',' '\n' | awk 'NF {printf "Closes #%s ", $0}'
+      timeout: 30000
+      failOnError: true
+
+  # Step 5: Create consolidated PR
   - id: create-pr
     type: github
     config:
       action: "pr-create"
       title: "epic(#{args.epic_number}): consolidated epic PR"
-      body: "## Epic #{args.epic_number}\n\nConsolidated PR for all stories.\n\nCloses #{args.epic_number}"
+      body: "## Epic #{args.epic_number}\n\nConsolidated PR for all stories.\n\n{build-closes-list.stdout} Closes #{args.epic_number}"
       base: "{args.base_branch}"
       head: "epic/{args.epic_number}-{args.epic_slug}"
 
-  # Step 5: Mark epic as completed in memory
+  # Step 6: Mark epic as completed in memory
   - id: finalize-state
     type: memory
     config:

package/src/modules/cli/dist/src/version.js

@@ -2,5 +2,5 @@
  * Auto-generated by build. Do not edit manually.
  * Source of truth: root package.json → scripts/sync-version.mjs
  */
-export const VERSION = '4.8.81';
+export const VERSION = '4.8.83';
 //# sourceMappingURL=version.js.map

package/src/modules/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moflo/cli",
-  "version": "4.8.81",
+  "version": "4.8.83",
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",

package/src/modules/spells/dist/core/interpolation.js

@@ -4,8 +4,15 @@
  * Resolves `{stepId.outputKey}` placeholders in spell step configs.
  * Nested property access is supported: `{step1.data.nested.value}`.
  */
-/** Matches `{path}` variable references in spell step configs. */
-export const VAR_REF_PATTERN = /\{([^}]+)\}/g;
+/**
+ * Matches `{path}` variable references in spell step configs.
+ *
+ * The `(?<!\$)` negative lookbehind skips `${VAR}` — that's bash parameter
+ * expansion inside shell steps, not a spell template reference. Without it,
+ * a bash command like `sed "s/#${STORY}/.../"` would try to resolve `STORY`
+ * as a spell variable and fail.
+ */
+export const VAR_REF_PATTERN = /(?<!\$)\{([^}]+)\}/g;
 /**
  * Resolve a dot-separated path against the context variables.
  * Returns undefined if any segment is missing.

package/src/modules/spells/dist/core/runner.js

@@ -74,25 +74,27 @@ export class SpellCaster {
                 }
                 else {
                     const reason = acceptance.reason === 'hash-mismatch'
-                        ? 'Spell permissions have changed since last acceptance'
-                        : 'First run — reviewing spell permissions';
+                        ? 'Spell permissions have changed — please re-review'
+                        : 'First run — please review permissions before running this spell';
                     const report = formatSpellPermissionReport(permReport);
                     console.log(`[spell] ${reason}`);
-                    console.log(`[spell] Running automatic dry-run validation...\n`);
+                    console.log('');
                     console.log(report);
-                    // Run dry-run validation so the user also sees structural issues
+                    // Also run dry-run validation so genuine definition issues surface
+                    // alongside the permission review — but keep them cleanly separated
+                    // from the acceptance prompt (not having accepted is not an error).
                     const dryResult = await dryRunValidate(definition, resolvedArgs, defValidation, options, this.registry, (variables, wfId, stepIndex) => this.buildContext(variables, resolvedArgs, wfId, stepIndex, options.signal));
                     if (!dryResult.valid) {
-                        console.log('\n[spell] Dry-run validation found errors:');
+                        console.log('\n[spell] Issues found while validating the spell definition:');
                         for (const err of [...dryResult.definitionErrors, ...dryResult.argumentErrors]) {
                             console.log(`  - ${err.message}`);
                         }
                     }
                     // Block — user must explicitly accept
-                    console.log(`\n[spell] To accept these permissions, run: spell_accept({ name: "${definition.name}" })`);
+                    console.log(`\n[spell] To run this spell, ask Claude to accept it, or call the spell_accept tool with name "${definition.name}".`);
                     return this.failureResult(spellId, startTime, [{
                             code: 'ACCEPTANCE_REQUIRED',
-                            message: `${reason}. Review the risk analysis above and accept with spell_accept({ name: "${definition.name}" }).`,
+                            message: `${reason}. Review the permissions above, then accept the spell "${definition.name}" to continue.`,
                         }], definition.name);
                 }
             }