moflo 4.9.13 → 4.9.15

package/bin/simplify-classify.cjs

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+/**
+ * /simplify diff classifier — issue #908.
+ *
+ * Decides which review tier the current diff warrants and returns a JSON
+ * dispatch decision. The /simplify skill MUST call this first so routing is
+ * deterministic and unit-testable instead of a prose decision Claude makes
+ * over and over per run.
+ *
+ * Rule (per user direction): default to single-agent Sonnet review. Only
+ * escalate to a 3-agent fan-out when diff signals genuinely warrant it.
+ * Opus is never selected — the existing skill already documents that.
+ *
+ * Outputs JSON:
+ *   {
+ *     "tier": "TRIVIAL" | "SMALL" | "NORMAL",
+ *     "model": "sonnet",
+ *     "agentCount": 0 | 1 | 3,
+ *     "reasoning": [string, ...],
+ *     "stats": { added, deleted, fileCount, declAdded, declRemoved, ... }
+ *   }
+ *
+ * Usage:
+ *   node bin/simplify-classify.cjs [--base main]
+ *   node bin/simplify-classify.cjs --diff <unified-diff-on-stdin>
+ *
+ * The --diff stdin form exists so unit tests can drive the classifier
+ * with synthetic diffs (no git repo required).
+ */
+'use strict';
+
+const { execSync } = require('child_process');
+
+// Paths where new logic warrants the 3-agent fan-out (issue #908).
+// Mechanical edits inside these paths are still SMALL; only adding/removing
+// declarations triggers escalation.
+const SECURITY_PATHS = [
+  /(?:^|[\\\/])aidefence[\\\/]/i,
+  /(?:^|[\\\/])swarm[\\\/]consensus[\\\/]/i,
+  /(?:^|[\\\/])hooks?[\\\/](?:handlers?|gate|wiring)/i,
+  /(?:^|[\\\/])services[\\\/]daemon-lock\.ts$/i,
+  /(?:^|[\\\/])bin[\\\/]gate\./i,
+  /(?:^|[\\\/])bin[\\\/]session-start-launcher\./i,
+  /(?:^|[\\\/])\.claude[\\\/]helpers[\\\/]gate/i,
+];
+
+function safeExec(cmd) {
+  try { return execSync(cmd, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }); }
+  catch { return ''; }
+}
+
+function readDiffFromGit(base) {
+  // Combined diff: committed-since-base + working-tree
+  const committed = safeExec(`git diff ${base}...HEAD`);
+  const working = safeExec('git diff HEAD');
+  return committed + (working ? '\n' + working : '');
+}
+
+/**
+ * Parse a unified-diff string into per-file stats and aggregate signals.
+ * No git/I/O — pure function over the diff text. Test-friendly.
+ */
+function parseDiff(diff) {
+  const lines = diff.split('\n');
+  const files = new Map(); // filename → { added, deleted, declAdded, declRemoved, isNew, isRenamed }
+  let current = null;
+
+  // Match function/class/export-const-arrow/method declarations being
+  // added or removed. Conservative — biased toward false negatives so we
+  // don't over-escalate.
+  const DECL_RE = /^(?:export\s+)?(?:default\s+)?(?:async\s+)?(?:function|class|interface|type)\s+\w/;
+  const ARROW_DECL_RE = /^(?:export\s+)?(?:const|let|var)\s+\w+\s*[:=].*=>\s*\{?$/;
+
+  for (let i = 0; i < lines.length; i++) {
+    const ln = lines[i];
+
+    // File header: `diff --git a/path b/path`
+    let m = ln.match(/^diff --git (?:a\/)?(.+?) (?:b\/)?(.+)$/);
+    if (m) {
+      const filename = m[2];
+      current = { filename, added: 0, deleted: 0, declAdded: 0, declRemoved: 0, isNew: false, isRenamed: false };
+      files.set(filename, current);
+      continue;
+    }
+    if (!current) continue;
+
+    if (ln.startsWith('new file mode')) current.isNew = true;
+    if (ln.startsWith('rename from') || ln.startsWith('rename to') || ln.startsWith('similarity index')) current.isRenamed = true;
+
+    // Skip diff headers
+    if (ln.startsWith('+++') || ln.startsWith('---') || ln.startsWith('@@') || ln.startsWith('index ')) continue;
+
+    if (ln.startsWith('+') && !ln.startsWith('+++')) {
+      current.added++;
+      const body = ln.slice(1).trim();
+      if (DECL_RE.test(body) || ARROW_DECL_RE.test(body)) current.declAdded++;
+    } else if (ln.startsWith('-') && !ln.startsWith('---')) {
+      current.deleted++;
+      const body = ln.slice(1).trim();
+      if (DECL_RE.test(body) || ARROW_DECL_RE.test(body)) current.declRemoved++;
+    }
+  }
+
+  // Aggregate
+  let added = 0, deleted = 0, declAdded = 0, declRemoved = 0;
+  let newFiles = 0, renamedFiles = 0;
+  let securityHit = false;
+  for (const f of files.values()) {
+    added += f.added;
+    deleted += f.deleted;
+    declAdded += f.declAdded;
+    declRemoved += f.declRemoved;
+    if (f.isNew) newFiles++;
+    if (f.isRenamed) renamedFiles++;
+    if (SECURITY_PATHS.some(rx => rx.test(f.filename))) securityHit = true;
+  }
+
+  return {
+    added, deleted, declAdded, declRemoved,
+    netDecls: declAdded - declRemoved,
+    fileCount: files.size,
+    newFiles, renamedFiles,
+    securityHit,
+    files: [...files.keys()],
+  };
+}
+
+/**
+ * Pure decision function. Takes parsed stats, returns dispatch decision.
+ * No I/O. Easy to unit-test with synthetic stats.
+ */
+function decide(stats) {
+  const reasoning = [];
+  const totalChange = stats.added + stats.deleted;
+
+  if (totalChange === 0) {
+    return { tier: 'TRIVIAL', model: 'sonnet', agentCount: 0, reasoning: ['empty diff — nothing to review'], stats };
+  }
+
+  // TRIVIAL: tiny diff, no declarations changed
+  if (totalChange <= 10 && stats.fileCount <= 1 && stats.netDecls === 0 && stats.declAdded === 0 && stats.declRemoved === 0) {
+    reasoning.push(`≤10 LOC in 1 file with no declaration changes`);
+    return { tier: 'TRIVIAL', model: 'sonnet', agentCount: 0, reasoning, stats };
+  }
+
+  // Mechanical relocation detection — the #906 case.
+  // If declarations were both ADDED and REMOVED at roughly matching rates,
+  // it's a structural move, not net-new logic. Judge by declaration balance,
+  // not raw LOC balance — formatting/blank-line differences between source
+  // and destination files easily push raw LOC out of balance even when the
+  // semantic change is purely "moved 5 functions across 5 new files".
+  // Mechanical relocations are SMALL even when many files / many lines.
+  const declTouched = stats.declAdded + stats.declRemoved;
+  const isMostlyRelocation = stats.declAdded >= 2
+    && stats.declRemoved >= 2
+    && Math.abs(stats.netDecls) <= Math.max(2, Math.floor(declTouched * 0.30));
+
+  if (isMostlyRelocation) {
+    reasoning.push(
+      `mostly relocation: ${stats.declAdded} decls added, ${stats.declRemoved} removed, net ${stats.netDecls >= 0 ? '+' : ''}${stats.netDecls}`,
+    );
+    return { tier: 'SMALL', model: 'sonnet', agentCount: 1, reasoning, stats };
+  }
+
+  // Escalation triggers — any one trips NORMAL (3 agents).
+  // Always Sonnet — Opus is never the right model for /simplify per skill rule.
+  const triggers = [];
+  if (totalChange > 500) triggers.push(`>500 LOC changed (${totalChange})`);
+  if (stats.fileCount >= 5 && stats.netDecls >= 3) triggers.push(`${stats.fileCount} files with ${stats.netDecls} net new declarations`);
+  if (stats.securityHit && stats.netDecls > 0) triggers.push('security-sensitive path with new logic');
+  if (stats.newFiles >= 3 && stats.declAdded >= 5) triggers.push(`${stats.newFiles} new files with ${stats.declAdded} new declarations`);
+
+  if (triggers.length > 0) {
+    return { tier: 'NORMAL', model: 'sonnet', agentCount: 3, reasoning: triggers, stats };
+  }
+
+  // Default: SMALL — single sonnet agent
+  reasoning.push(`small/medium diff: ${totalChange} LOC across ${stats.fileCount} file(s), +${stats.declAdded}/-${stats.declRemoved} decls`);
+  return { tier: 'SMALL', model: 'sonnet', agentCount: 1, reasoning, stats };
+}
+
+function classifyDiff(diffText) {
+  return decide(parseDiff(diffText));
+}
+
+function classifyFromGit(base = 'main') {
+  return classifyDiff(readDiffFromGit(base));
+}
+
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  const baseIdx = args.indexOf('--base');
+  const base = baseIdx >= 0 ? args[baseIdx + 1] : 'main';
+  const stdinDiff = args.includes('--diff') || args.includes('--stdin');
+
+  let result;
+  if (stdinDiff) {
+    let buf = '';
+    process.stdin.setEncoding('utf-8');
+    process.stdin.on('data', (d) => { buf += d; });
+    process.stdin.on('end', () => {
+      result = classifyDiff(buf);
+      process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+    });
+  } else {
+    result = classifyFromGit(base);
+    process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+  }
+}
+
+module.exports = { parseDiff, decide, classifyDiff, classifyFromGit };

package/dist/src/cli/commands/doctor-checks-config.js

@@ -0,0 +1,246 @@
+/**
+ * Configuration & service-discovery checks for `flo doctor`:
+ * config files, statusLine, daemon, MCP servers, moflo.yaml compliance,
+ * test directories.
+ */
+import { existsSync, readFileSync, statSync } from 'fs';
+import { join } from 'path';
+import os from 'os';
+import { getDaemonLockHolder } from '../services/daemon-lock.js';
+import { legacyMemoryDbPath, memoryDbCandidatePaths, memoryDbPath, } from '../services/moflo-paths.js';
+import { errorDetail } from '../shared/utils/error-detail.js';
+export async function checkConfigFile() {
+    // JSON configs (parse-validated). LEGACY-CONFIG: `.claude-flow.json` and
+    // `claude-flow.config.json` filenames are still recognised so consumers
+    // upgrading from pre-#699 moflo builds (upstream Ruflo) keep working
+    // without manual rename. Drift guard exempts these via LEGACY-CONFIG marker.
+    const jsonPaths = [
+        '.moflo/config.json',
+        'moflo.config.json',
+        'claude-flow.config.json', // LEGACY-CONFIG: pre-#699 fallback
+        '.claude-flow.json', // LEGACY-CONFIG: pre-#699 fallback
+    ];
+    for (const configPath of jsonPaths) {
+        if (existsSync(configPath)) {
+            try {
+                const content = readFileSync(configPath, 'utf8');
+                JSON.parse(content);
+                return { name: 'Config File', status: 'pass', message: `Found: ${configPath}` };
+            }
+            catch {
+                return { name: 'Config File', status: 'fail', message: `Invalid JSON: ${configPath}`, fix: 'Fix JSON syntax in config file' };
+            }
+        }
+    }
+    // YAML configs (existence-checked only — no heavy yaml parser dependency).
+    const yamlPaths = [
+        '.moflo/config.yaml',
+        '.moflo/config.yml',
+        'moflo.config.yaml',
+        'claude-flow.config.yaml', // LEGACY-CONFIG: pre-#699 fallback
+    ];
+    for (const configPath of yamlPaths) {
+        if (existsSync(configPath)) {
+            return { name: 'Config File', status: 'pass', message: `Found: ${configPath}` };
+        }
+    }
+    return { name: 'Config File', status: 'warn', message: 'No config file (using defaults)', fix: 'claude-flow config init' };
+}
+export async function checkStatusLine() {
+    const settingsPath = join(process.cwd(), '.claude', 'settings.json');
+    if (!existsSync(settingsPath)) {
+        return { name: 'Status Line', status: 'warn', message: 'No .claude/settings.json found', fix: 'npx moflo init' };
+    }
+    try {
+        const settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
+        if (settings.statusLine && settings.statusLine.command) {
+            if (settings.statusLine.command.includes('statusline.cjs')) {
+                return { name: 'Status Line', status: 'pass', message: 'Wired in settings.json' };
+            }
+            return { name: 'Status Line', status: 'pass', message: 'Custom statusLine configured' };
+        }
+        return { name: 'Status Line', status: 'fail', message: 'statusLine not configured in settings.json', fix: 'Add statusLine config to .claude/settings.json' };
+    }
+    catch {
+        return { name: 'Status Line', status: 'fail', message: 'Failed to parse .claude/settings.json', fix: 'Fix JSON syntax in .claude/settings.json' };
+    }
+}
+// Delegates to daemon-lock module for proper PID + command-line verification
+// (avoids Windows PID-recycling false positives).
+export async function checkDaemonStatus() {
+    try {
+        // Retry up to 5 times with 1s delay — the daemon starts in the background
+        // during session-start and may not have acquired its lock file yet.
+        const MAX_RETRIES = 5;
+        const RETRY_DELAY_MS = 1000;
+        let holderPid = null;
+        for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+            holderPid = getDaemonLockHolder(process.cwd());
+            if (holderPid)
+                break;
+            if (attempt < MAX_RETRIES - 1) {
+                await new Promise(resolve => setTimeout(resolve, RETRY_DELAY_MS));
+            }
+        }
+        if (holderPid) {
+            return { name: 'Daemon Status', status: 'pass', message: `Running (PID: ${holderPid})` };
+        }
+        // getDaemonLockHolder auto-cleans stale locks, but check for legacy PID file
+        const lockFile = '.moflo/daemon.lock';
+        if (existsSync(lockFile)) {
+            return { name: 'Daemon Status', status: 'warn', message: 'Stale lock file', fix: 'rm .moflo/daemon.lock && claude-flow daemon start' };
+        }
+        const pidFile = '.moflo/daemon.pid';
+        if (existsSync(pidFile)) {
+            return { name: 'Daemon Status', status: 'warn', message: 'Legacy PID file found', fix: 'rm .moflo/daemon.pid && claude-flow daemon start' };
+        }
+        return { name: 'Daemon Status', status: 'warn', message: 'Not running', fix: 'claude-flow daemon start' };
+    }
+    catch (e) {
+        return { name: 'Daemon Status', status: 'warn', message: `Unable to check: ${errorDetail(e)}`, fix: 'claude-flow daemon status' };
+    }
+}
+export async function checkMemoryDatabase() {
+    const root = process.cwd();
+    const canonical = memoryDbPath(root);
+    for (const dbPath of memoryDbCandidatePaths(root)) {
+        let stats;
+        try {
+            stats = statSync(dbPath);
+        }
+        catch {
+            continue;
+        }
+        const sizeMB = (stats.size / 1024 / 1024).toFixed(2);
+        if (dbPath === canonical) {
+            let message = `.moflo/moflo.db (${sizeMB} MB)`;
+            // Unfinished migration tail: source still present means the launcher's
+            // rename-to-.bak step failed (Windows lock most often). Flag so the user
+            // knows to clear the stale source.
+            if (existsSync(legacyMemoryDbPath(root))) {
+                message += ' — legacy .swarm/memory.db still present (delete it after confirming canonical is healthy)';
+            }
+            return { name: 'Memory Database', status: 'pass', message };
+        }
+        return {
+            name: 'Memory Database',
+            status: 'warn',
+            message: `${dbPath} (${sizeMB} MB) — legacy location, will migrate to .moflo/moflo.db on next session start`,
+            fix: 'restart claude code session',
+        };
+    }
+    return { name: 'Memory Database', status: 'warn', message: 'Not initialized', fix: 'claude-flow memory configure --backend hybrid' };
+}
+export async function checkMcpServers() {
+    const mcpConfigPaths = [
+        join(os.homedir(), '.claude/claude_desktop_config.json'),
+        join(os.homedir(), '.config/claude/mcp.json'),
+        '.mcp.json',
+        // Windows: Claude Desktop stores config under %APPDATA%\Claude\
+        ...(process.platform === 'win32' && process.env.APPDATA
+            ? [join(process.env.APPDATA, 'Claude', 'claude_desktop_config.json')]
+            : []),
+    ];
+    for (const configPath of mcpConfigPaths) {
+        if (existsSync(configPath)) {
+            try {
+                const content = JSON.parse(readFileSync(configPath, 'utf8'));
+                const servers = content.mcpServers || content.servers || {};
+                const count = Object.keys(servers).length;
+                const hasClaudeFlow = 'moflo' in servers || 'claude-flow' in servers || 'claude-flow_alpha' in servers || 'ruflo' in servers || 'ruflo_alpha' in servers;
+                if (hasClaudeFlow) {
+                    return { name: 'MCP Servers', status: 'pass', message: `${count} servers (flo configured)` };
+                }
+                return { name: 'MCP Servers', status: 'warn', message: `${count} servers (flo not found)`, fix: 'claude mcp add ruflo -- npx -y ruflo@latest mcp start' };
+            }
+            catch {
+                // continue to next path
+            }
+        }
+    }
+    return { name: 'MCP Servers', status: 'warn', message: 'No MCP config found', fix: 'claude mcp add moflo npx moflo mcp start' };
+}
+// Catches three failure modes (#895):
+//   1. File missing — session-start should have created it; warn user that
+//      defaults are invisible/untunable.
+//   2. File empty / unreadable — corrupted by half-write or filesystem error.
+//   3. Top-level sections missing — partial yaml from manual edit or stale
+//      copy from a moflo version that didn't ship a section yet.
+//
+// Exported so tests can exercise it end-to-end against a temp project root
+// without mutating process.cwd() (which fights vitest's parallel test runner).
+export async function checkMofloYamlCompliance(cwd = process.cwd()) {
+    const yamlPath = join(cwd, 'moflo.yaml');
+    // Lazy-import the validator so doctor doesn't pull in fs walks on the
+    // happy path of unrelated checks.
+    const { validateMofloYaml } = await import('../init/moflo-yaml-template.js');
+    const result = validateMofloYaml(yamlPath);
+    if (!result.exists) {
+        return {
+            name: 'moflo.yaml',
+            status: 'warn',
+            message: 'moflo.yaml not found — defaults are in effect but not visible/tunable',
+            fix: 'Restart Claude Code (session-start auto-creates) or run `npx moflo init`',
+        };
+    }
+    if (result.valid) {
+        return { name: 'moflo.yaml', status: 'pass', message: `Compliant (${yamlPath})` };
+    }
+    const parseIssue = result.issues.find((i) => i.kind !== 'missing-section');
+    if (parseIssue) {
+        return {
+            name: 'moflo.yaml',
+            status: 'fail',
+            message: `${parseIssue.kind}: ${parseIssue.detail}`,
+            fix: 'Inspect/repair moflo.yaml, or `mv moflo.yaml moflo.yaml.bak && npx moflo init`',
+        };
+    }
+    return {
+        name: 'moflo.yaml',
+        status: 'warn',
+        message: `Missing sections: ${result.missingSections.join(', ')}`,
+        fix: 'Restart Claude Code (yaml-upgrader auto-appends) or `npx moflo init --force`',
+    };
+}
+export async function checkTestDirs() {
+    const yamlPath = join(process.cwd(), 'moflo.yaml');
+    if (!existsSync(yamlPath)) {
+        return { name: 'Test Directories', status: 'warn', message: 'No moflo.yaml — test indexing unconfigured', fix: 'npx moflo init' };
+    }
+    try {
+        const content = readFileSync(yamlPath, 'utf-8');
+        const testsBlock = content.match(/tests:\s*\n\s+directories:\s*\n((?:\s+-\s+.+\n?)+)/);
+        if (!testsBlock) {
+            return { name: 'Test Directories', status: 'warn', message: 'No tests section in moflo.yaml', fix: 'npx moflo init --force' };
+        }
+        const items = testsBlock[1].match(/-\s+(.+)/g);
+        if (!items || items.length === 0) {
+            return { name: 'Test Directories', status: 'warn', message: 'Empty test directories list' };
+        }
+        const dirs = items.map(item => item.replace(/^-\s+/, '').trim());
+        const existing = dirs.filter(d => existsSync(join(process.cwd(), d)));
+        const missing = dirs.filter(d => !existsSync(join(process.cwd(), d)));
+        const autoIndexMatch = content.match(/auto_index:\s*\n(?:.*\n)*?\s+tests:\s*(true|false)/);
+        const autoIndexEnabled = !autoIndexMatch || autoIndexMatch[1] !== 'false';
+        const indexLabel = autoIndexEnabled ? 'auto-index: on' : 'auto-index: off';
+        if (missing.length > 0 && existing.length === 0) {
+            return {
+                name: 'Test Directories',
+                status: 'warn',
+                message: `No configured test dirs exist: ${missing.join(', ')} (${indexLabel})`,
+            };
+        }
+        if (missing.length > 0) {
+            return {
+                name: 'Test Directories',
+                status: 'warn',
+                message: `${existing.length} OK, ${missing.length} missing: ${missing.join(', ')} (${indexLabel})`,
+            };
+        }
+        return { name: 'Test Directories', status: 'pass', message: `${existing.length} directories: ${existing.join(', ')} (${indexLabel})` };
+    }
+    catch (e) {
+        return { name: 'Test Directories', status: 'warn', message: `Unable to parse moflo.yaml: ${errorDetail(e)}` };
+    }
+}
+//# sourceMappingURL=doctor-checks-config.js.map

package/dist/src/cli/commands/doctor-checks-deep.js

@@ -432,6 +432,31 @@ const REQUIRED_GATE_CASES = [
 // session-start-launcher.mjs in consumer projects without transitive failures.
 import { REQUIRED_HOOK_WIRING } from '../services/hook-wiring.js';
 export { REQUIRED_HOOK_WIRING };
+/**
+ * Detect "expected pre-publish drift" — source `bin/gate.cjs` is ahead of the
+ * installed `node_modules/moflo/bin/gate.cjs`, but the deployed
+ * `.claude/helpers/gate.cjs` still matches the installed version. This is the
+ * steady state in the moflo dogfood repo while a PR has landed but no
+ * `npm install moflo@<new>` has rotated the package.
+ *
+ * Returns true only when both are true:
+ *   - helper content equals installed bin content (helper is correctly synced
+ *     to what's installed)
+ *   - installed bin content differs from source bin content (source is ahead)
+ *
+ * If `node_modules/moflo/bin/gate.cjs` is missing (consumer never installed
+ * moflo, or path is unusual) we conservatively return false so other drift
+ * detection still applies.
+ */
+export function isExpectedPrePublishDrift(installedBinGate, helperContent, sourceBinContent) {
+    try {
+        const installedContent = readFileSync(installedBinGate, 'utf8');
+        return installedContent === helperContent && installedContent !== sourceBinContent;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Verify gate infrastructure health:
  * 1. gate.cjs exists and contains all required cases
@@ -474,14 +499,27 @@ export async function checkGateHealth() {
         issues.push(`gate.cjs missing cases: ${missingCases.join(', ')}`);
     }
     // 2. Check bin/gate.cjs sync
+    //
+    // The launcher syncs `node_modules/moflo/bin/gate.cjs` → `.claude/helpers/gate.cjs`
+    // on version change. Source `bin/gate.cjs` is only present in the moflo dogfood
+    // repo. During the dogfood publish window — between a PR landing and the next
+    // `npm install moflo@<new>` — source bin/ legitimately moves ahead of the
+    // installed bin/, while the helper continues to mirror the installed version.
+    // That's the expected steady state, not a bug; downgrade it to `warn` and skip
+    // the `fix` field so `--fix` doesn't paint a false success (#913).
     const binGate = join(projectDir, 'bin', 'gate.cjs');
+    const installedBinGate = join(projectDir, 'node_modules', 'moflo', 'bin', 'gate.cjs');
     if (existsSync(binGate)) {
         try {
             const binContent = readFileSync(binGate, 'utf8');
             if (binContent !== gateContent) {
-                // Check if it's a size difference (likely out of sync) vs whitespace
                 const sizeDiff = Math.abs(binContent.length - gateContent.length);
-                if (sizeDiff > 10) {
+                const prePublishDrift = isExpectedPrePublishDrift(installedBinGate, gateContent, binContent);
+                if (prePublishDrift) {
+                    warnings.push(`source bin/gate.cjs is ${sizeDiff} chars ahead of node_modules/moflo/bin/gate.cjs ` +
+                        '(expected pre-publish drift; resolves on next `npm install moflo@<new>`)');
+                }
+                else if (sizeDiff > 10) {
                     issues.push(`bin/gate.cjs out of sync with .claude/helpers/gate.cjs (${sizeDiff} chars differ)`);
                 }
                 else {