moflo 4.9.13 → 4.9.15

package/dist/src/cli/commands/doctor-version.js

@@ -0,0 +1,134 @@
+/**
+ * Version freshness check for `flo doctor`.
+ *
+ * Uses fetch() against the npm registry rather than `npm view` because the
+ * latter shells out to npm-cli.js, which is briefly orphaned on Windows after
+ * its parent chain reaps and gets flagged by findZombieProcesses' "moflo"
+ * regex.
+ */
+import { existsSync, readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+import { errorDetail } from '../shared/utils/error-detail.js';
+// Cold-connect TLS+DNS can eat most of npm's old 5s budget when doctor's
+// parallel checks saturate the event loop, hence 10s.
+const REGISTRY_FETCH_TIMEOUT_MS = 10_000;
+function readCurrentVersion() {
+    // Walk up from the current file's directory until we find the moflo
+    // package.json (or a tolerated legacy upstream name during migration).
+    // Walk until dirname(dir) === dir (filesystem root on any platform).
+    try {
+        const thisFile = fileURLToPath(import.meta.url);
+        let dir = dirname(thisFile);
+        for (;;) {
+            const candidate = join(dir, 'package.json');
+            try {
+                if (existsSync(candidate)) {
+                    const pkg = JSON.parse(readFileSync(candidate, 'utf8'));
+                    if (pkg.version &&
+                        typeof pkg.name === 'string' &&
+                        (pkg.name === 'moflo' || pkg.name === 'claude-flow' || pkg.name === 'ruflo')) {
+                        return pkg.version;
+                    }
+                }
+            }
+            catch {
+                // Unreadable/invalid JSON -- skip and keep walking up
+            }
+            const parent = dirname(dir);
+            if (parent === dir)
+                break; // reached root
+            dir = parent;
+        }
+    }
+    catch {
+        // Fall back to a default
+    }
+    return '0.0.0';
+}
+function parseVersion(v) {
+    const match = v.match(/^(\d+)\.(\d+)\.(\d+)(?:-[a-zA-Z]+\.(\d+))?/);
+    if (!match)
+        return { major: 0, minor: 0, patch: 0, prerelease: 0 };
+    return {
+        major: parseInt(match[1], 10) || 0,
+        minor: parseInt(match[2], 10) || 0,
+        patch: parseInt(match[3], 10) || 0,
+        prerelease: parseInt(match[4], 10) || 0,
+    };
+}
+function isOutdated(current, latest) {
+    return (latest.major > current.major ||
+        (latest.major === current.major && latest.minor > current.minor) ||
+        (latest.major === current.major && latest.minor === current.minor && latest.patch > current.patch) ||
+        (latest.major === current.major && latest.minor === current.minor && latest.patch === current.patch && latest.prerelease > current.prerelease));
+}
+// Manual AbortController (NOT AbortSignal.timeout): the latter leaves
+// a libuv timer alive past process exit on Node 24 / Windows and trips
+// an `!(handle->flags & UV_HANDLE_CLOSING)` assertion in src/win/async.c.
+async function fetchLatestVersion() {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), REGISTRY_FETCH_TIMEOUT_MS);
+    try {
+        const response = await fetch('https://registry.npmjs.org/moflo/latest', {
+            headers: { Accept: 'application/json' },
+            signal: ac.signal,
+        });
+        if (!response.ok)
+            throw new Error(`registry HTTP ${response.status}`);
+        const info = (await response.json());
+        if (typeof info.version !== 'string' || !info.version) {
+            throw new Error('registry response missing version');
+        }
+        return info.version;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export async function checkVersionFreshness() {
+    try {
+        const currentVersion = readCurrentVersion();
+        // Check if running via npx (look for _npx in process path or argv)
+        const isNpx = process.argv[1]?.includes('_npx') ||
+            process.env.npm_execpath?.includes('npx') ||
+            process.cwd().includes('_npx');
+        let latestVersion;
+        try {
+            latestVersion = await fetchLatestVersion();
+        }
+        catch (e) {
+            return {
+                name: 'Version Freshness',
+                status: 'warn',
+                message: `v${currentVersion} (cannot check registry: ${errorDetail(e, { firstLineOnly: true })})`,
+            };
+        }
+        if (isOutdated(parseVersion(currentVersion), parseVersion(latestVersion))) {
+            const fix = isNpx
+                ? (process.platform === 'win32'
+                    ? 'npx -y moflo (or clear %LocalAppData%\\npm-cache\\_npx manually)'
+                    : 'rm -rf ~/.npm/_npx/* && npx -y moflo')
+                : 'npm update moflo';
+            return {
+                name: 'Version Freshness',
+                status: 'warn',
+                message: `v${currentVersion} (latest: v${latestVersion})${isNpx ? ' [npx cache stale]' : ''}`,
+                fix,
+            };
+        }
+        return {
+            name: 'Version Freshness',
+            status: 'pass',
+            message: `v${currentVersion} (up to date)`,
+        };
+    }
+    catch (error) {
+        return {
+            name: 'Version Freshness',
+            status: 'warn',
+            message: `Unable to check version freshness: ${errorDetail(error)}`,
+        };
+    }
+}
+//# sourceMappingURL=doctor-version.js.map

package/dist/src/cli/commands/doctor-zombies.js

@@ -0,0 +1,201 @@
+/**
+ * Zombie process detection + cleanup for `flo doctor`.
+ *
+ * "Orphaned" means the parent is no longer alive — nothing will clean it up.
+ * MCP servers spawned by a live Claude Code session have a live parent
+ * (claude.exe) and must NOT be flagged. The shared ProcessManager registry
+ * (.moflo/background-pids.json) is treated as an allowlist for legitimate
+ * detached background tasks (sequential indexer chain, daemon, MCP servers).
+ */
+import { execSync } from 'child_process';
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { getDaemonLockHolder, isDaemonProcess, releaseDaemonLock } from '../services/daemon-lock.js';
+// Cmdline capture/display caps + scan timeouts. Hoisted so the values
+// used to size buffers and format messages are visible in one place.
+const ZOMBIE_CMDLINE_CAPTURE_LEN = 200;
+const ZOMBIE_CMDLINE_DISPLAY_LEN = 100;
+const ZOMBIE_SCAN_TIMEOUT_MS_WIN = 10_000;
+const ZOMBIE_SCAN_TIMEOUT_MS_POSIX = 5_000;
+const ZOMBIE_KILL_TIMEOUT_MS = 5_000;
+const NODE_PREFIX_RE = /^"?[^"\s]*node(?:\.exe)?"?\s+/i;
+export function formatCmdline(raw) {
+    const cleaned = raw.replace(NODE_PREFIX_RE, '').trim();
+    return cleaned.length > ZOMBIE_CMDLINE_DISPLAY_LEN
+        ? cleaned.slice(0, ZOMBIE_CMDLINE_DISPLAY_LEN - 1) + '…'
+        : cleaned;
+}
+export function formatZombieDetail(d) {
+    return `pid=${d.pid} ppid=${d.ppid} cmd=${formatCmdline(d.cmdline)}`;
+}
+// Cross-platform liveness probe via signal 0 — Node abstracts the platform.
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// Fast path: kill processes tracked in the shared ProcessManager registry.
+// This avoids the expensive OS-level process scan for known background tasks.
+export function killTrackedProcesses() {
+    const registryFile = join(process.cwd(), '.moflo', 'background-pids.json');
+    const lockFile = join(process.cwd(), '.moflo', 'spawn.lock');
+    let killed = 0;
+    try {
+        if (existsSync(registryFile)) {
+            const entries = JSON.parse(readFileSync(registryFile, 'utf-8'));
+            for (const entry of entries) {
+                if (!isProcessAlive(entry.pid))
+                    continue;
+                try {
+                    if (process.platform === 'win32') {
+                        execSync(`taskkill /F /PID ${entry.pid}`, { timeout: 5000, windowsHide: true });
+                    }
+                    else {
+                        process.kill(entry.pid, 'SIGKILL');
+                    }
+                    killed++;
+                }
+                catch { /* already gone */ }
+            }
+            writeFileSync(registryFile, '[]');
+        }
+    }
+    catch { /* non-fatal */ }
+    try {
+        if (existsSync(lockFile))
+            unlinkSync(lockFile);
+    }
+    catch { /* ok */ }
+    return killed;
+}
+// Read the set of moflo background PIDs registered with the shared
+// ProcessManager (.moflo/background-pids.json). These are legitimate tracked
+// background tasks (sequential indexer chain, daemon, MCP servers spawned by
+// session-start) — they are detached:true by design so their parents have
+// already exited, but they are NOT orphans. Without this allow-set,
+// findZombieProcesses() flags every running indexer step as a zombie.
+function readTrackedBackgroundPids() {
+    const result = new Set();
+    const registryFile = join(process.cwd(), '.moflo', 'background-pids.json');
+    try {
+        if (!existsSync(registryFile))
+            return result;
+        const entries = JSON.parse(readFileSync(registryFile, 'utf-8'));
+        if (!Array.isArray(entries))
+            return result;
+        for (const entry of entries) {
+            if (entry && typeof entry.pid === 'number' && entry.pid > 0) {
+                result.add(entry.pid);
+            }
+        }
+    }
+    catch { /* malformed or unreadable — treat as empty */ }
+    return result;
+}
+// Find and optionally kill orphaned moflo/claude-flow node processes.
+export async function findZombieProcesses(kill = false) {
+    const legitimatePid = getDaemonLockHolder(process.cwd());
+    const trackedPids = readTrackedBackgroundPids();
+    const currentPid = process.pid;
+    const parentPid = process.ppid;
+    const details = [];
+    let killed = 0;
+    const candidates = [];
+    try {
+        if (process.platform === 'win32') {
+            // CSV output preserves full CommandLine; Format-Table truncates to console width.
+            const result = execSync('powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \\"Name=\'node.exe\'\\" | Select-Object ProcessId,ParentProcessId,CommandLine | ConvertTo-Csv -NoTypeInformation"', { encoding: 'utf-8', timeout: ZOMBIE_SCAN_TIMEOUT_MS_WIN, windowsHide: true });
+            const lines = result.split(/\r?\n/);
+            for (const line of lines) {
+                if (!/moflo|claude-flow|flo\s+(hooks|gate|mcp|daemon)/i.test(line))
+                    continue;
+                const m = line.match(/^"(\d+)","(\d+)","?(.*?)"?$/);
+                if (m) {
+                    candidates.push({
+                        pid: parseInt(m[1], 10),
+                        ppid: parseInt(m[2], 10),
+                        cmdline: m[3].replace(/""/g, '"').slice(0, ZOMBIE_CMDLINE_CAPTURE_LEN),
+                    });
+                }
+            }
+        }
+        else {
+            // ps -ww disables width truncation so cmdline is captured intact.
+            const result = execSync('ps -ww -eo pid,ppid,command | grep -E "node.*(moflo|claude-flow)" | grep -v grep', { encoding: 'utf-8', timeout: ZOMBIE_SCAN_TIMEOUT_MS_POSIX });
+            const lines = result.trim().split(/\r?\n/);
+            for (const line of lines) {
+                const m = line.trim().match(/^(\d+)\s+(\d+)\s+(.*)$/);
+                if (m) {
+                    candidates.push({
+                        pid: parseInt(m[1], 10),
+                        ppid: parseInt(m[2], 10),
+                        cmdline: m[3].slice(0, ZOMBIE_CMDLINE_CAPTURE_LEN),
+                    });
+                }
+            }
+        }
+    }
+    catch {
+        // No matches (grep exits non-zero) or scan command failed.
+    }
+    for (const cand of candidates) {
+        const { pid, ppid } = cand;
+        if (pid === currentPid || pid === parentPid || pid === legitimatePid)
+            continue;
+        if (trackedPids.has(pid))
+            continue;
+        if (isProcessAlive(ppid))
+            continue;
+        // Defense-in-depth: detached daemons have dead parents by design even
+        // when the lock file is missing/corrupted.
+        if (isDaemonProcess(pid))
+            continue;
+        details.push(cand);
+    }
+    if (kill && details.length > 0) {
+        for (const { pid } of details) {
+            try {
+                if (process.platform === 'win32') {
+                    execSync(`taskkill /F /PID ${pid}`, { timeout: ZOMBIE_KILL_TIMEOUT_MS, windowsHide: true });
+                }
+                else {
+                    process.kill(pid, 'SIGKILL');
+                }
+                killed++;
+            }
+            catch {
+                // Already exited.
+            }
+        }
+        if (legitimatePid && details.some(d => d.pid === legitimatePid)) {
+            releaseDaemonLock(process.cwd(), legitimatePid, true);
+        }
+    }
+    return { killed, details };
+}
+// HealthCheck wrapper around findZombieProcesses for the orchestrated check list.
+// Surfaces each orphan's cmdline so spawn-discipline regressions are diagnosable
+// from a single doctor run.
+export async function checkZombieProcesses() {
+    try {
+        const scan = await findZombieProcesses(false);
+        if (scan.details.length === 0) {
+            return { name: 'Zombie Processes', status: 'pass', message: 'No orphaned processes' };
+        }
+        const detail = scan.details.map(formatZombieDetail).join(' | ');
+        return {
+            name: 'Zombie Processes',
+            status: 'warn',
+            message: `${scan.details.length} orphaned process(es): ${detail}`,
+            fix: 'moflo doctor --kill-zombies',
+        };
+    }
+    catch {
+        return { name: 'Zombie Processes', status: 'pass', message: 'Check skipped' };
+    }
+}
+//# sourceMappingURL=doctor-zombies.js.map