moflo 4.8.87-rc.2 → 4.8.87-rc.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.8.87-rc.2",
+  "version": "4.8.87-rc.3",
   "description": "MoFlo — AI agent orchestration for Claude Code. Forked from ruflo/claude-flow with patches applied to source, plus feature-level orchestration.",
   "main": "dist/index.js",
   "type": "module",
@@ -114,7 +114,7 @@
     "@typescript-eslint/eslint-plugin": "^7.18.0",
     "@typescript-eslint/parser": "^7.18.0",
     "eslint": "^8.0.0",
-    "moflo": "^4.8.87-rc.1",
+    "moflo": "^4.8.87-rc.2",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"

package/src/modules/cli/dist/src/mcp-tools/hooks-tools.js

@@ -4,6 +4,7 @@
  */
 import { mkdirSync, writeFileSync, existsSync, readFileSync, statSync, readdirSync } from 'fs';
 import { dirname, join, resolve, extname } from 'path';
+import { requireMofloOrWarn } from '../services/moflo-require.js';
 // Real vector search functions - lazy loaded to avoid circular imports
 let searchEntriesFn = null;
 async function getRealSearchFunction() {
@@ -94,8 +95,12 @@ let embeddingService = null;
 async function getEmbeddingService() {
     if (embeddingService)
         return embeddingService;
-    const { createEmbeddingService } = await import('@moflo/embeddings');
-    embeddingService = createEmbeddingService({ provider: 'fastembed' });
+    const mod = await requireMofloOrWarn('@moflo/embeddings', ['createEmbeddingService'], {
+        tag: 'hooks-tools',
+        consequence: 'routing/attention require fastembed and have nothing to fall back to.',
+        throwIfMissing: true,
+    });
+    embeddingService = mod.createEmbeddingService({ provider: 'fastembed' });
     return embeddingService;
 }
 async function embedTexts(texts) {

package/src/modules/cli/dist/src/mcp-tools/neural-tools.js

@@ -13,12 +13,16 @@
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
-// Try to import real embeddings from @moflo/embeddings (auto-selects best provider)
+import { requireMofloOrWarn } from '../services/moflo-require.js';
 let realEmbeddings = null;
 let embeddingServiceName = 'none';
 try {
-    const embeddingsModule = await import('@moflo/embeddings').catch(() => null);
-    if (embeddingsModule?.createEmbeddingServiceAsync) {
+    const embeddingsModule = await requireMofloOrWarn('@moflo/embeddings', ['createEmbeddingServiceAsync'], {
+        tag: 'neural-tools',
+        consequence: 'neural_predict / neural_patterns will fall back to deterministic-hash embeddings, ' +
+            'which is not allowed in production.',
+    });
+    if (embeddingsModule) {
         const service = await embeddingsModule.createEmbeddingServiceAsync({
             provider: 'auto',
             autoInstall: false,
@@ -32,8 +36,8 @@ try {
         embeddingServiceName = `@moflo/embeddings (${service.provider})`;
     }
 }
-catch {
-    // No embedding provider available, will use fallback
+catch (err) {
+    process.stderr.write(`[neural-tools] @moflo/embeddings load failed: ${err instanceof Error ? err.message : String(err)}\n`);
 }
 // Storage paths
 const STORAGE_DIR = '.claude-flow';

package/src/modules/cli/dist/src/mcp-tools/security-tools.js

@@ -378,8 +378,13 @@ const aidefenceIsSafeTool = {
     handler: async (args) => {
         const input = args.input;
         try {
-            const { isSafe } = await import('@moflo/aidefence');
-            const safe = isSafe(input);
+            // Route through getAIDefence() so this tool inherits the same auto-install
+            // fallback as every other aidefence handler in this file. A bare
+            // `import('@moflo/aidefence')` skips that path and surfaces a hard
+            // ERR_MODULE_NOT_FOUND when the package isn't resolvable.
+            const defender = await getAIDefence();
+            const result = defender.quickScan(input);
+            const safe = !result.threat;
             return {
                 content: [{
                         type: 'text',

package/src/modules/cli/dist/src/services/embeddings-migration.js

@@ -14,7 +14,7 @@
  * @module @moflo/cli/services/embeddings-migration
  */
 /* eslint-disable @typescript-eslint/no-explicit-any */
-import { mofloImport } from './moflo-require.js';
+import { mofloImport, requireMofloOrWarn } from './moflo-require.js';
 import { atomicWriteFileSync } from './atomic-file-write.js';
 /**
  * Run the migration if and only if it's needed.
@@ -31,13 +31,12 @@ export async function runEmbeddingsMigrationIfNeeded(options = {}) {
     const dbPath = path.resolve(options.dbPath ?? path.join(process.cwd(), '.swarm', 'memory.db'));
     if (!fs.existsSync(dbPath))
         return false;
-    let embeddings;
-    try {
-        embeddings = await import('@moflo/embeddings');
-    }
-    catch {
+    const embeddings = await requireMofloOrWarn('@moflo/embeddings', ['EMBEDDINGS_VERSION', 'createEmbeddingService', 'runUpgrade'], {
+        tag: 'embeddings-migration',
+        consequence: 'migration skipped; memory.db will keep its current embeddings_version.',
+    });
+    if (!embeddings)
         return false;
-    }
     const initSqlJs = (await mofloImport('sql.js'))?.default;
     if (!initSqlJs)
         return false;

package/src/modules/cli/dist/src/services/moflo-require.js

@@ -68,6 +68,39 @@ export async function mofloImportRequired(specifier) {
     }
     return mod;
 }
+/**
+ * Import a moflo-bundled package and loud-fail when it isn't resolvable.
+ *
+ * `mofloImport` returns null silently on resolution failure so probe-style
+ * callers (e.g. `mofloImport('sql.js')` for an optional dep) work cleanly.
+ * Packages bundled in the moflo tarball must be louder: an unresolved
+ * `@moflo/*` means a broken install, and silent skip leaves consumers stuck
+ * on stale state with no signal in their logs. Wrap with this helper at any
+ * call site where missing == broken.
+ *
+ * Behaviour:
+ *   - Resolves: returns the module.
+ *   - Unresolvable + `throwIfMissing: true`: throws Error with the same
+ *     message that would otherwise be written to stderr (caller catches
+ *     and surfaces a typed response — used by MCP handlers).
+ *   - Unresolvable + `throwIfMissing: false` (default): writes one stderr
+ *     line and returns null. Caller continues with a fallback path.
+ *
+ * The stderr line shape is `[<tag>] <specifier> not resolvable — <consequence>`,
+ * so log-grep and the consumer-smoke harness's stderr scan both pick it up.
+ */
+export async function requireMofloOrWarn(specifier, expectedExports, opts) {
+    const mod = await mofloImport(specifier, expectedExports);
+    if (mod)
+        return mod;
+    const message = `[${opts.tag}] ${specifier} not resolvable — ${opts.consequence} ` +
+        `Indicates a broken moflo install (missing from tarball or hoisting failure).`;
+    if (opts.throwIfMissing) {
+        throw new Error(message);
+    }
+    process.stderr.write(message + '\n');
+    return null;
+}
 /**
  * Resolve a package path without importing (useful for WASM file paths etc).
  * Returns the resolved path, or null if not found.

package/src/modules/cli/dist/src/version.js

@@ -2,5 +2,5 @@
  * Auto-generated by build. Do not edit manually.
  * Source of truth: root package.json → scripts/sync-version.mjs
  */
-export const VERSION = '4.8.87-rc.2';
+export const VERSION = '4.8.87-rc.3';
 //# sourceMappingURL=version.js.map

package/src/modules/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moflo/cli",
-  "version": "4.8.87-rc.2",
+  "version": "4.8.87-rc.3",
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",