moflo 4.8.83 → 4.8.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.8.83",
+  "version": "4.8.85",
   "description": "MoFlo — AI agent orchestration for Claude Code. Forked from ruflo/claude-flow with patches applied to source, plus feature-level orchestration.",
   "main": "dist/index.js",
   "type": "module",
@@ -117,7 +117,7 @@
     "@types/node": "^24.12.2",
     "@xenova/transformers": "^2.17.0",
     "eslint": "^8.0.0",
-    "moflo": "^4.8.82",
+    "moflo": "^4.8.84",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"

package/src/modules/cli/dist/src/epic/spells/single-branch.yaml

@@ -120,6 +120,18 @@ steps:
       # The github `comment` action only appends a comment — it does NOT
       # touch the task-list checkboxes. We read the body, substitute, and
       # write it back so the epic reflects progress at a glance.
+      #
+      # Cross-platform notes:
+      #   - Uses `node -e` instead of sed/awk/tr because coreutils are
+      #     not guaranteed on PATH (minimal containers, some Git-Bash
+      #     installs). Node is always available — moflo runs on it.
+      #   - Values reach node via env vars (not argv) so the script is
+      #     immune to Node's argv[1]-"[eval]" quirk across versions.
+      #   - The embedded JS contains ZERO backslashes. When Node spawns
+      #     `bash -c '<script>'` on Windows, Cygwin/MSYS bash strips one
+      #     layer of backslash escapes from the command line, which
+      #     silently broke regex escapes like `\[` and `\b`. Using
+      #     indexOf + a char-code `isWord` check avoids the trap entirely.
       - id: check-off-story
         type: bash
         permissionLevel: elevated
@@ -128,11 +140,42 @@ steps:
             set -e
             STORY={loop.story_number}
             EPIC={args.epic_number}
-            BODY=$(gh issue view "$EPIC" --json body -q .body)
-            UPDATED=$(printf '%s' "$BODY" | sed -E "s/- \[ \] #${STORY}\b/- [x] #${STORY}/")
-            if [ "$BODY" != "$UPDATED" ]; then
-              printf '%s' "$UPDATED" | gh issue edit "$EPIC" --body-file -
-            fi
+            export STORY EPIC
+            node -e '
+              const cp = require("node:child_process");
+              const epic = process.env.EPIC;
+              const story = process.env.STORY;
+              const view = cp.spawnSync("gh", ["issue", "view", epic, "--json", "body", "-q", ".body"], { encoding: "utf8" });
+              if (view.status !== 0) {
+                process.stderr.write(view.stderr || "gh issue view failed");
+                process.exit(view.status || 1);
+              }
+              const body = view.stdout;
+              const target = "- [ ] #" + story;
+              const replacement = "- [x] #" + story;
+              function isWord(c) {
+                if (!c) return false;
+                const n = c.charCodeAt(0);
+                return (n >= 48 && n <= 57) || (n >= 65 && n <= 90) || (n >= 97 && n <= 122) || n === 95;
+              }
+              let updated = "";
+              let i = 0;
+              while (i < body.length) {
+                const idx = body.indexOf(target, i);
+                if (idx < 0) { updated += body.slice(i); break; }
+                updated += body.slice(i, idx);
+                const end = idx + target.length;
+                if (isWord(body[end])) {
+                  updated += body.slice(idx, end);
+                } else {
+                  updated += replacement;
+                }
+                i = end;
+              }
+              if (updated === body) process.exit(0);
+              const edit = cp.spawnSync("gh", ["issue", "edit", epic, "--body-file", "-"], { input: updated, stdio: ["pipe", "inherit", "inherit"] });
+              if (edit.status !== 0) process.exit(edit.status || 1);
+            '
           timeout: 60000
           failOnError: true
 
@@ -178,11 +221,20 @@ steps:
   # merging the consolidated PR auto-closes each individual story issue,
   # not just the epic. Without this, only the epic would close on merge
   # and story issues would linger open indefinitely.
+  #
+  # Cross-platform: uses `node -e` instead of tr/awk (see check-off-story
+  # for rationale).
   - id: build-closes-list
     type: bash
     config:
       command: |
-        echo {args.stories} | tr ',' '\n' | awk 'NF {printf "Closes #%s ", $0}'
+        STORIES={args.stories}
+        export STORIES
+        node -e '
+          const raw = process.env.STORIES || "";
+          const stories = raw.split(",").map(s => s.trim()).filter(Boolean);
+          process.stdout.write(stories.map(s => "Closes #" + s).join(" "));
+        '
       timeout: 30000
       failOnError: true
 

package/src/modules/cli/dist/src/memory/bridge-core.js

@@ -87,7 +87,11 @@ export async function getRegistry(dbPath) {
     if (!registryPromise) {
         registryPromise = (async () => {
             try {
-                const { ControllerRegistry } = await importMofloMemory(import.meta.url);
+                const memoryModule = await importMofloMemory();
+                if (!memoryModule) {
+                    throw new Error('@moflo/memory not available (src/modules/memory/dist/index.js not found)');
+                }
+                const { ControllerRegistry } = memoryModule;
                 const registry = new ControllerRegistry();
                 // Suppress noisy init logs
                 const origLog = console.log;

package/src/modules/cli/dist/src/memory/memory-initializer.js

@@ -381,8 +381,8 @@ export async function getHNSWIndex(options) {
         // Use HnswLite pure TS implementation (no native dependencies). The
         // shared resolver handles the consumer case where @moflo/memory is not
         // a declared dep and must be loaded via a relative URL fallback.
-        const memoryModule = await importMofloMemory(import.meta.url);
-        if (!('HnswLite' in memoryModule) || memoryModule.HnswLite === undefined) {
+        const memoryModule = await importMofloMemory();
+        if (!memoryModule || !('HnswLite' in memoryModule) || memoryModule.HnswLite === undefined) {
             // Shape-check (issue #482): warn loudly and bail — the outer catch
             // would otherwise swallow a cryptic "undefined is not a constructor".
             console.warn('[getHNSWIndex] @moflo/memory missing expected export: HnswLite');

package/src/modules/cli/dist/src/services/moflo-require.js

@@ -13,6 +13,8 @@
  */
 import { createRequire } from 'module';
 import { fileURLToPath, pathToFileURL } from 'url';
+import { existsSync } from 'fs';
+import { dirname, join } from 'path';
 // createRequire anchored to this file — resolves from moflo's own node_modules
 const mofloRequire = createRequire(fileURLToPath(import.meta.url));
 /**
@@ -79,20 +81,63 @@ export function mofloResolve(specifier) {
     }
 }
 /**
- * Import `@moflo/memory` from within a moflo source module. The root `moflo`
- * package ships @moflo/memory as a source folder rather than a declared
- * dependency, so `mofloImport('@moflo/memory')` fails in consumer installs
- * (node_modules/@moflo/memory/ doesn't exist). Fall back to a URL resolved
- * relative to the caller's file — the same src/modules/memory/dist/index.js
- * layout holds in both dev and consumer.
+ * Locate `src/modules/memory/dist/index.js` by walking up from this file's
+ * directory until the path resolves. Layout-invariant across:
+ *   - dev source (cli/src/services/)
+ *   - built output (cli/dist/src/services/)
+ *   - installed package (node_modules/moflo/src/modules/cli/dist/src/services/)
+ *   - Windows and POSIX (path.join/dirname are platform-aware)
  *
- * @param callerUrl `import.meta.url` of the file that needs @moflo/memory
+ * Returns a file:// URL for ESM `import()`, or null if memory isn't built.
  */
-export async function importMofloMemory(callerUrl) {
+let cachedMemoryUrl;
+function locateMofloMemoryDist() {
+    if (cachedMemoryUrl !== undefined)
+        return cachedMemoryUrl;
+    let dir = dirname(fileURLToPath(import.meta.url));
+    const rel = join('src', 'modules', 'memory', 'dist', 'index.js');
+    // 12 levels is far more than any real moflo install depth
+    for (let i = 0; i < 12; i++) {
+        const candidate = join(dir, rel);
+        if (existsSync(candidate)) {
+            cachedMemoryUrl = pathToFileURL(candidate).href;
+            return cachedMemoryUrl;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break; // filesystem root
+        dir = parent;
+    }
+    cachedMemoryUrl = null;
+    return null;
+}
+/**
+ * Import `@moflo/memory` from within a moflo source module.
+ *
+ * The root `moflo` package ships @moflo/memory as a source folder rather than
+ * a declared dependency, so `mofloImport('@moflo/memory')` fails in consumer
+ * installs (node_modules/@moflo/memory/ doesn't exist). Fall back to a
+ * layout-invariant walk-up that finds `src/modules/memory/dist/index.js`
+ * regardless of whether the caller is running source, built, or installed.
+ *
+ * Returns null when memory isn't available — callers must handle that.
+ */
+export async function importMofloMemory() {
     const viaRequire = await mofloImport('@moflo/memory');
     if (viaRequire)
         return viaRequire;
-    const memoryUrl = new URL('../../../../memory/dist/index.js', callerUrl);
-    return import(memoryUrl.href);
+    const url = locateMofloMemoryDist();
+    if (!url)
+        return null;
+    try {
+        return await import(url);
+    }
+    catch {
+        return null;
+    }
+}
+// Test-only: reset the cache between unit tests that mutate the filesystem.
+export function _resetMofloMemoryCacheForTest() {
+    cachedMemoryUrl = undefined;
 }
 //# sourceMappingURL=moflo-require.js.map

package/src/modules/cli/dist/src/version.js

@@ -2,5 +2,5 @@
  * Auto-generated by build. Do not edit manually.
  * Source of truth: root package.json → scripts/sync-version.mjs
  */
-export const VERSION = '4.8.83';
+export const VERSION = '4.8.85';
 //# sourceMappingURL=version.js.map

package/src/modules/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moflo/cli",
-  "version": "4.8.83",
+  "version": "4.8.85",
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",

package/src/modules/spells/dist/core/interpolation.js

@@ -7,12 +7,19 @@
 /**
  * Matches `{path}` variable references in spell step configs.
  *
- * The `(?<!\$)` negative lookbehind skips `${VAR}` — that's bash parameter
- * expansion inside shell steps, not a spell template reference. Without it,
- * a bash command like `sed "s/#${STORY}/.../"` would try to resolve `STORY`
- * as a spell variable and fail.
+ * Content must be identifier-shape: letter/underscore followed by
+ * letters, digits, `_`, `.`, or `-`. This tight grammar accommodates
+ * every real spell ref (`{args.x}`, `{loop.x}`, `{step-id.out}`) while
+ * letting bash steps embed literal `{...}` blocks — JS destructuring
+ * `{ foo }` (whitespace), object literals `{ a: b }` (colon), shell
+ * expansions `${VAR}` (lookbehind), and so on — without tripping the
+ * interpolator. A greedy `[^}]+` class ate JS code inside `node -e`
+ * scripts and threw "Variable not found" at runtime.
+ *
+ * The `(?<!\$)` negative lookbehind also skips `${VAR}` — bash parameter
+ * expansion inside shell steps must pass through untouched.
  */
-export const VAR_REF_PATTERN = /(?<!\$)\{([^}]+)\}/g;
+export const VAR_REF_PATTERN = /(?<!\$)\{([A-Za-z_][A-Za-z0-9_.-]*)\}/g;
 /**
  * Resolve a dot-separated path against the context variables.
  * Returns undefined if any segment is missing.