moflo 4.9.21 → 4.9.23

package/bin/gate.cjs

@@ -7,7 +7,7 @@ var cp = require('child_process');
 var PROJECT_DIR = (process.env.CLAUDE_PROJECT_DIR || process.cwd()).replace(/^\/([a-z])\//i, '$1:/');
 var STATE_FILE = path.join(PROJECT_DIR, '.claude', 'workflow-state.json');
 
-var STATE_DEFAULTS = { tasksCreated: false, taskCount: 0, memorySearched: false, memorySearchedBy: {}, memoryRequired: true, learningsStored: false, testsRun: false, simplifyRun: false, simplifySnapshotSha: null, interactionCount: 0, sessionStart: null, lastBlockedAt: null, lastNamespaceHint: '', lastNamespaceHintEmittedBy: {} };
+var STATE_DEFAULTS = { tasksCreated: false, taskCount: 0, memorySearched: false, memorySearchedBy: {}, memoryRequired: true, learningsStored: false, testsRun: false, simplifyRun: false, simplifySnapshotSha: null, interactionCount: 0, sessionStart: null, lastBlockedAt: null, lastNamespaceHint: '', lastNamespaceHintEmittedBy: {}, flMode: null, swarmInitialized: false, hiveInitialized: false };
 
 // Per-actor memory-search tracking (#838). The legacy `memorySearched` boolean
 // is session-wide, so once the parent searches memory, every spawned subagent
@@ -60,7 +60,7 @@ function writeState(s) {
 
 // Load moflo.yaml gate config (defaults: all enabled)
 function loadGateConfig() {
-  var defaults = { memory_first: true, task_create_first: true, context_tracking: true, testing_gate: true, simplify_gate: true, learnings_gate: true };
+  var defaults = { memory_first: true, task_create_first: true, context_tracking: true, testing_gate: true, simplify_gate: true, learnings_gate: true, swarm_invocation_gate: true };
   try {
     var yamlPath = path.join(PROJECT_DIR, 'moflo.yaml');
     if (fs.existsSync(yamlPath)) {
@@ -71,6 +71,7 @@ function loadGateConfig() {
       if (/testing_gate:\s*false/i.test(content)) defaults.testing_gate = false;
       if (/simplify_gate:\s*false/i.test(content)) defaults.simplify_gate = false;
       if (/learnings_gate:\s*false/i.test(content)) defaults.learnings_gate = false;
+      if (/swarm_invocation_gate:\s*false/i.test(content)) defaults.swarm_invocation_gate = false;
     }
   } catch (e) { /* use defaults */ }
   return defaults;
@@ -111,6 +112,21 @@ var NS_NAV_RES = [
   /\b(class|function|method|component|service|entity|module)\b/,
 ];
 
+// Detect whether the current prompt invoked /fl or /flo with a swarm/hive flag (#952).
+// When set, check-before-agent BLOCKS the Agent spawn until the matching MCP init
+// (mcp__moflo__swarm_init or mcp__moflo__hive-mind_init) has been recorded — the user
+// explicitly opted in to the protected coordination surface, so falling back to
+// raw Agent dispatch silently regresses headline moflo product capability.
+//
+// SYNC: duplicated verbatim in src/cli/init/helpers-generator.ts.
+function detectFlMode(promptText) {
+  var p = promptText || '';
+  if (!/^\s*\/(?:fl|flo)\b/i.test(p)) return null;
+  if (/(?:^|\s)(?:-s|--swarm)\b/.test(p)) return 'swarm';
+  if (/(?:^|\s)(?:-h|--hive)\b/.test(p)) return 'hive';
+  return null;
+}
+
 function classifyNamespaceHint(promptText) {
   var lower = (promptText || '').toLowerCase();
   if (NS_TEST_RE.test(lower)) return 'Memory namespace hint: use "tests" for test inventory and coverage lookups.';
@@ -154,6 +170,12 @@ function applyPromptStateReset(state, promptText) {
   // subsequent agents (parent + subagents that spawn their own agents) all
   // see the new classification on their first check-before-agent.
   state.lastNamespaceHintEmittedBy = {};
+  // #952 — derive flMode from the user prompt, and reset the matching init
+  // flag. Each /fl invocation must call its protected MCP init; the previous
+  // prompt's swarm/hive registration does not satisfy this prompt's gate.
+  state.flMode = detectFlMode(promptText);
+  state.swarmInitialized = false;
+  state.hiveInitialized = false;
 }
 // Match npm/yarn/pnpm/bun test, npx vitest|jest|..., bare runners at command-start only,
 // and language-native test commands. The bare-runner arm is anchored so that
@@ -305,6 +327,47 @@ switch (command) {
         writeState(s);
       }
     }
+    // #952 — when /fl was invoked with -s/-h, the protected MCP init must run
+    // BEFORE any Agent spawn. Hard block: the user explicitly opted in to
+    // moflo's coordination surface, so silently dispatching `Agent` calls
+    // without `mcp__moflo__swarm_init` / `mcp__moflo__hive-mind_init` is the
+    // failure mode this gate exists to prevent (CLAUDE.md "⛔ Protected
+    // functionality — swarm + hive-mind"). Other Agent uses remain advisory.
+    if (config.swarm_invocation_gate) {
+      if (s.flMode === 'swarm' && !s.swarmInitialized) {
+        process.stderr.write('BLOCKED: /fl was invoked with -s/--swarm but mcp__moflo__swarm_init has not been called.\n');
+        process.stderr.write('Run mcp__moflo__swarm_init first, then mcp__moflo__agent_spawn for each role, then dispatch Agent.\n');
+        process.stderr.write('See .claude/skills/fl/execution-modes.md "SWARM mode" and CLAUDE.md "⛔ Protected functionality".\n');
+        process.stderr.write('Disable via moflo.yaml: gates: swarm_invocation_gate: false\n');
+        process.exit(2);
+      }
+      if (s.flMode === 'hive' && !s.hiveInitialized) {
+        process.stderr.write('BLOCKED: /fl was invoked with -h/--hive but mcp__moflo__hive-mind_init has not been called.\n');
+        process.stderr.write('Run mcp__moflo__hive-mind_init first, then dispatch Agent or hive-mind workers.\n');
+        process.stderr.write('See .claude/skills/fl/execution-modes.md "HIVE-MIND mode" and CLAUDE.md "⛔ Protected functionality".\n');
+        process.stderr.write('Disable via moflo.yaml: gates: swarm_invocation_gate: false\n');
+        process.exit(2);
+      }
+    }
+    break;
+  }
+  case 'record-swarm-init': {
+    // #952 — wired to mcp__moflo__swarm_init PostToolUse. Marks the gate
+    // satisfied so subsequent Agent spawns under /fl -s pass.
+    var s = readState();
+    if (!s.swarmInitialized) {
+      s.swarmInitialized = true;
+      writeState(s);
+    }
+    break;
+  }
+  case 'record-hive-init': {
+    // #952 — wired to mcp__moflo__hive-mind_init PostToolUse.
+    var s = readState();
+    if (!s.hiveInitialized) {
+      s.hiveInitialized = true;
+      writeState(s);
+    }
     break;
   }
   case 'check-before-scan': {
@@ -508,7 +571,11 @@ switch (command) {
     break;
   }
   case 'session-reset': {
-    writeState({ tasksCreated: false, taskCount: 0, memorySearched: false, memorySearchedBy: {}, memoryRequired: true, learningsStored: false, testsRun: false, simplifyRun: false, interactionCount: 0, sessionStart: new Date().toISOString(), lastBlockedAt: null, lastNamespaceHint: '', lastNamespaceHintEmittedBy: {} });
+    // Derive from STATE_DEFAULTS so adding a new state field requires only one
+    // edit (the defaults object) — the literal that used to live here drifted
+    // every time a field was added and is what motivated #952's audit of state
+    // shape consistency.
+    writeState(Object.assign({}, STATE_DEFAULTS, { sessionStart: new Date().toISOString() }));
     break;
   }
   default:

package/bin/index-guidance.mjs

@@ -131,6 +131,18 @@ function loadGuidanceDirs() {
   // 3. CLAUDE.md files are NOT indexed — Claude loads them into context automatically.
   //    Indexing them wastes vectors and creates duplicate keys across subprojects.
 
+  // 4. Project skills — index .claude/skills/<name>/SKILL.md
+  const projectSkillsDir = resolve(projectRoot, '.claude/skills');
+  if (existsSync(projectSkillsDir)) {
+    dirs.push({ path: '.claude/skills', prefix: 'skill', fileFilter: ['SKILL.md'], kind: 'skill' });
+  }
+
+  // 5. Bundled moflo skills — gated by isSelfRef to prevent double-indexing
+  const bundledSkillsDir = resolve(mofloRoot, '.claude/skills');
+  if (!isSelfRef && existsSync(bundledSkillsDir) && resolve(bundledSkillsDir) !== resolve(projectSkillsDir)) {
+    dirs.push({ path: bundledSkillsDir, prefix: 'skill-bundled', fileFilter: ['SKILL.md'], kind: 'skill', absolute: true });
+  }
+
   return dirs;
 }
 
@@ -513,10 +525,12 @@ function buildHierarchy(chunks, chunkPrefix) {
   return hierarchy;
 }
 
-function indexFile(db, filePath, keyPrefix) {
-  const fileName = basename(filePath, extname(filePath));
+function indexFile(db, filePath, keyPrefix, options = {}) {
+  const fileName = options.nameOverride || basename(filePath, extname(filePath));
   const docKey = `doc-${keyPrefix}-${fileName}`;
   const chunkPrefix = `chunk-${keyPrefix}-${fileName}`;
+  const extraMetadata = options.extraMetadata || {};
+  const extraTags = options.extraTags || [];
 
   try {
     const content = readFileSync(filePath, 'utf-8');
@@ -538,6 +552,7 @@ function indexFile(db, filePath, keyPrefix) {
 
     // 1. Store full document
     const docMetadata = {
+      ...extraMetadata,
       type: 'document',
       filePath: relativePath,
       fileSize: stats.size,
@@ -547,7 +562,7 @@ function indexFile(db, filePath, keyPrefix) {
       ragVersion: '2.0',  // Mark as full RAG indexed
     };
 
-    storeEntry(db, docKey, content, docMetadata, [keyPrefix, 'document']);
+    storeEntry(db, docKey, content, docMetadata, [keyPrefix, 'document', ...extraTags]);
     debug(`Stored document: ${docKey}`);
 
     // 2. Chunk and store semantic pieces with full RAG linking
@@ -567,7 +582,7 @@ function indexFile(db, filePath, keyPrefix) {
       children: siblings,
       chunkCount: chunks.length,
     };
-    storeEntry(db, docKey, content, docChildrenMeta, [keyPrefix, 'document']);
+    storeEntry(db, docKey, content, docChildrenMeta, [keyPrefix, 'document', ...extraTags]);
 
     for (let i = 0; i < chunks.length; i++) {
       const chunk = chunks[i];
@@ -589,6 +604,7 @@ function indexFile(db, filePath, keyPrefix) {
       const hierInfo = hierarchy[chunkKey];
 
       const chunkMetadata = {
+        ...extraMetadata,
         type: 'chunk',
         ragVersion: '2.0',
 
@@ -647,7 +663,7 @@ function indexFile(db, filePath, keyPrefix) {
         chunkKey,
         searchableContent,
         chunkMetadata,
-        [keyPrefix, 'chunk', `level-${chunk.level}`, chunk.title.toLowerCase().replace(/[^a-z0-9]+/g, '-')]
+        [keyPrefix, 'chunk', `level-${chunk.level}`, chunk.title.toLowerCase().replace(/[^a-z0-9]+/g, '-'), ...extraTags]
       );
 
       debug(`  Stored chunk ${i}: ${chunk.title} (${chunk.content.length} chars, prev=${!!prevChunk}, next=${!!nextChunk})`);
@@ -699,7 +715,17 @@ function indexDirectory(db, dirConfig) {
     : allMdFiles;
 
   for (const filePath of filtered) {
-    const result = indexFile(db, filePath, dirConfig.prefix);
+    let options = {};
+    if (dirConfig.kind === 'skill') {
+      // kind: 'skill' — key by parent dir name (skill folder), not SKILL.md
+      const skillName = basename(dirname(filePath));
+      options = {
+        nameOverride: skillName,
+        extraMetadata: { kind: 'skill', skill_name: skillName },
+        extraTags: ['skill', `skill-${skillName}`],
+      };
+    }
+    const result = indexFile(db, filePath, dirConfig.prefix, options);
     results.push(result);
   }
 

package/bin/lib/retired-files.mjs

@@ -0,0 +1,146 @@
+/**
+ * Retired-shipped-files prune helper (#948).
+ *
+ * Closes the gap that retired agents (#932) and retired skills (#945) leave
+ * in consumer projects: the manifest cleanup at section 3 of the launcher
+ * only knows about files moflo previously synced, but `.claude/agents/` and
+ * `.claude/skills/` were not in the manifest before #948. So files retired
+ * before #948 lands stay on disk forever — Claude Code keeps loading them as
+ * subagents on every prompt, paying the per-prompt roster tokens we just
+ * spent #932 fixing.
+ *
+ * This module reads `retired-files.json` (shipped at the moflo package
+ * root) and, for each entry, only prunes the consumer-side path when the
+ * file's sha256 matches one of `knownContentHashes` — i.e. the file matches
+ * a version moflo actually shipped, so the consumer didn't customize it.
+ * Customized files are preserved and a one-line notice is emitted so the
+ * user can act.
+ *
+ * Manifest format:
+ *
+ *   {
+ *     "version": 1,
+ *     "retired": [
+ *       {
+ *         "path": ".claude/agents/v3/performance-engineer.md",
+ *         "retiredIn": "4.9.22",
+ *         "retiredBy": "#932",
+ *         "knownContentHashes": ["sha256:abc...", "sha256:def..."]
+ *       }
+ *     ]
+ *   }
+ *
+ * @module bin/lib/retired-files
+ */
+
+import { existsSync, readFileSync, unlinkSync } from 'fs';
+import { resolve } from 'path';
+import { createHash } from 'crypto';
+
+/**
+ * Compute sha256 of file content. Returns null on read errors so the caller
+ * can decide what to do — we never want a transient stat/read failure to
+ * trigger a prune of a file we couldn't actually verify.
+ *
+ * @param {string} absPath
+ * @returns {string|null} `sha256:<hex>` or null
+ */
+export function fileSha256(absPath) {
+  try {
+    const buf = readFileSync(absPath);
+    return 'sha256:' + createHash('sha256').update(buf).digest('hex');
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Load + validate the retired-files manifest. Returns `{ entries: [] }` for
+ * any failure mode (missing file, invalid JSON, wrong shape) — the launcher
+ * must never block on a corrupt manifest.
+ *
+ * @param {string} manifestPath - absolute path to retired-files.json
+ * @returns {{ entries: Array<{path:string, retiredIn?:string, retiredBy?:string, knownContentHashes:string[]}> }}
+ */
+export function loadRetiredManifest(manifestPath) {
+  if (!existsSync(manifestPath)) return { entries: [] };
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+  } catch { return { entries: [] }; }
+  if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.retired)) {
+    return { entries: [] };
+  }
+  // Filter out malformed entries — guards against a hand-edited file
+  // dropping the wrong shape into a launcher that runs on N consumer
+  // machines. A skipped entry never auto-prunes (safest default).
+  const entries = parsed.retired.filter((entry) =>
+    entry &&
+    typeof entry.path === 'string' &&
+    entry.path.length > 0 &&
+    Array.isArray(entry.knownContentHashes) &&
+    entry.knownContentHashes.length > 0 &&
+    entry.knownContentHashes.every((h) => typeof h === 'string' && h.startsWith('sha256:'))
+  );
+  return { entries };
+}
+
+/**
+ * Decide what to do with a consumer-side path against a retirement entry:
+ *
+ *   - 'absent'     — path doesn't exist on disk; nothing to do
+ *   - 'prune'      — file exists and content hash matches a known-shipped
+ *                    value; safe to delete (consumer didn't customize)
+ *   - 'preserve'   — file exists but content differs from every known-shipped
+ *                    hash; consumer customized, leave alone
+ *   - 'unknown'    — file exists but its hash couldn't be read (transient
+ *                    error); leave alone, retry next session
+ *
+ * @param {string} projectRoot
+ * @param {{path:string, knownContentHashes:string[]}} entry
+ * @returns {{ action: 'absent'|'prune'|'preserve'|'unknown', actualHash: string|null }}
+ */
+export function classifyRetiredFile(projectRoot, entry) {
+  const abs = resolve(projectRoot, entry.path);
+  if (!existsSync(abs)) return { action: 'absent', actualHash: null };
+  const actualHash = fileSha256(abs);
+  if (!actualHash) return { action: 'unknown', actualHash: null };
+  if (entry.knownContentHashes.includes(actualHash)) {
+    return { action: 'prune', actualHash };
+  }
+  return { action: 'preserve', actualHash };
+}
+
+/**
+ * Walk the manifest and apply prune decisions. Returns a small report so
+ * the caller can emit one summary line (the launcher pattern) instead of
+ * forcing it to track per-entry state.
+ *
+ * Failures are non-fatal — a single un-deletable file (Windows AV hold,
+ * EBUSY) must not stop pruning the rest. The caller surfaces the report.
+ *
+ * @param {string} projectRoot
+ * @param {string} manifestPath
+ * @returns {{ pruned: string[], preserved: string[], unknown: string[], failed: Array<{path:string, message:string}> }}
+ */
+export function applyRetiredPrune(projectRoot, manifestPath) {
+  const { entries } = loadRetiredManifest(manifestPath);
+  const report = { pruned: [], preserved: [], unknown: [], failed: [] };
+  for (const entry of entries) {
+    const { action } = classifyRetiredFile(projectRoot, entry);
+    if (action === 'absent') continue;
+    if (action === 'preserve') { report.preserved.push(entry.path); continue; }
+    if (action === 'unknown') { report.unknown.push(entry.path); continue; }
+    // action === 'prune'
+    try {
+      unlinkSync(resolve(projectRoot, entry.path));
+      report.pruned.push(entry.path);
+    } catch (err) {
+      report.failed.push({
+        path: entry.path,
+        message: err && err.message ? err.message : String(err),
+      });
+    }
+  }
+  return report;
+}

package/bin/session-start-launcher.mjs

@@ -14,6 +14,7 @@ import { fileURLToPath, pathToFileURL } from 'url';
 import { mofloDir } from './lib/moflo-paths.mjs';
 import { repairMemoryDbIfCorrupt } from './lib/db-repair.mjs';
 import { resolveMofloBin } from './lib/resolve-bin.mjs';
+import { applyRetiredPrune } from './lib/retired-files.mjs';
 
 // Headless skip (#860). The daemon's headless workers spawn `claude --print`
 // with CLAUDE_CODE_HEADLESS=true (see src/cli/services/headless-worker-
@@ -681,6 +682,56 @@ try {
         }
       }
 
+      // ── Sync .claude/agents/ + .claude/skills/ recursively (#948) ──────
+      // Pre-#948, agents and skills weren't manifest-tracked at all, so any
+      // file moflo retired (e.g. the 49 ruflo-aspirational agents in #932 or
+      // skill-builder in #945) would linger forever in consumer projects —
+      // Claude Code kept loading them on every prompt, paying the per-prompt
+      // roster tokens we just spent #932 fixing. Walking these dirs through
+      // syncFile() puts every shipped file in `currentManifest`, which lets
+      // the cleanup loop below auto-prune retired files going forward.
+      //
+      // Limitation: this only catches retirements that happen AFTER #948.
+      // For files retired BEFORE #948 (#932 + #945), see the retired-files.json
+      // hash-gated prune block further down — it ships a static list with
+      // content hashes so we only delete files the consumer didn't customize.
+      //
+      // User-authored files at custom paths (.claude/agents/custom/foo.md,
+      // .claude/skills/<custom>/SKILL.md) are NEVER passed through syncFile()
+      // because they don't exist in node_modules/moflo/, so they never enter
+      // the manifest and never get pruned — same proven safety story as
+      // scripts/helpers above.
+      async function syncDirRecursive(srcDir, destPrefix) {
+        if (!existsSync(srcDir)) return;
+        let entries;
+        try {
+          entries = readdirSync(srcDir, { recursive: true, withFileTypes: true });
+        } catch (err) {
+          emitWarning(`${destPrefix} readdir failed (${errMessage(err)})`);
+          return;
+        }
+        for (const entry of entries) {
+          if (!entry.isFile()) continue;
+          if (!entry.name.toLowerCase().endsWith('.md')) continue;
+          const parent = entry.parentPath || entry.path || srcDir;
+          const absSrc = resolve(parent, entry.name);
+          const rel = absSrc.slice(srcDir.length + 1).split(/[\\/]/).join('/');
+          const absDest = resolve(projectRoot, destPrefix, rel);
+          try { mkdirSync(dirname(absDest), { recursive: true }); } catch (err) {
+            emitWarning(`${destPrefix} subdir mkdir failed for ${rel} (${errMessage(err)})`);
+          }
+          await syncFile(absSrc, absDest, `${destPrefix}/${rel}`);
+        }
+      }
+      await syncDirRecursive(
+        resolve(projectRoot, 'node_modules/moflo/.claude/agents'),
+        '.claude/agents',
+      );
+      await syncDirRecursive(
+        resolve(projectRoot, 'node_modules/moflo/.claude/skills'),
+        '.claude/skills',
+      );
+
       // Sync all shipped guidance files from node_modules/moflo/.claude/guidance/shipped/
       const guidanceDir = resolve(projectRoot, '.claude/guidance');
       const shippedDir = resolve(projectRoot, 'node_modules/moflo/.claude/guidance/shipped');
@@ -725,6 +776,56 @@ try {
         emitMutation('cleaned up retired files', `${removedFiles} removed`);
       }
 
+      // ── Hash-gated prune of pre-#948 retirements (Mechanism B) ─────────
+      // The manifest cleanup above only knows about files moflo previously
+      // synced. Agents and skills retired BEFORE #948 (#932's 49 agents and
+      // #945's skill-builder, plus older retirements) were never in any
+      // manifest — they exist on disk in consumer projects only because
+      // earlier moflo versions shipped them via the npm tarball + flo init.
+      // `retired-files.json` is the explicit, reviewable static list that
+      // closes that gap. Each entry pairs a path with the sha256 hashes of
+      // every content version moflo previously shipped, so we only auto-
+      // prune when the consumer's file matches a known-shipped hash —
+      // customized files (different hash) get preserved with a one-line
+      // notice the user can act on.
+      try {
+        const retiredManifestPath = resolve(
+          projectRoot,
+          'node_modules/moflo/retired-files.json',
+        );
+        const report = applyRetiredPrune(projectRoot, retiredManifestPath);
+        if (report.pruned.length > 0) {
+          emitMutation(
+            'pruned retired shipped files',
+            `${plural(report.pruned.length, 'file')} matching known-shipped content removed`,
+          );
+        }
+        if (report.preserved.length > 0) {
+          // stdout (not stderr) so Claude sees this in `additionalContext`
+          // and can surface to the user — these aren't failures, just
+          // consumer-customized files we deliberately left alone.
+          const sample = report.preserved.slice(0, 5).map((p) => `  - ${p}`).join('\n');
+          const more = report.preserved.length > 5
+            ? `\n  …and ${report.preserved.length - 5} more`
+            : '';
+          try {
+            process.stdout.write(
+              `moflo: retained ${plural(report.preserved.length, 'customized retired file')} (delete manually if unwanted):\n${sample}${more}\n`,
+            );
+          } catch { /* non-fatal */ }
+        }
+        if (report.failed.length > 0) {
+          const sample = report.failed.slice(0, 3)
+            .map((f) => `  - ${f.path}: ${f.message}`).join('\n');
+          emitWarning(`${plural(report.failed.length, 'retired file')} failed to prune:\n${sample}`);
+        }
+      } catch (err) {
+        // Non-fatal — the consumer just doesn't get the prune this session.
+        // Next session retries; manifest-cleanup above still works for
+        // future retirements regardless.
+        emitWarning(`retired-files prune skipped (${errMessage(err)})`);
+      }
+
       // The daemon was already stopped above so the lock file is gone and
       // there's no live PID to recycle here. Section 4's `hooks.mjs
       // session-start` will spawn a fresh daemon under the current moflo
@@ -1334,14 +1435,15 @@ try {
   } catch { /* writing the failure itself must not throw */ }
 }
 
-// ── 3e-729. Purge ephemeral-namespace rows (#729) ───────────────────────────
-// Four namespaces (hive-mind, tasklist, epic-state, test-bridge-fix) store
-// internal moflo run-tracking — never user knowledge — and were polluting the
-// embeddings index. Going forward, writes to those namespaces skip embedding
-// generation (see EPHEMERAL_NAMESPACES in memory/bridge-embedder.ts); existing
-// rows from prior versions get hard-deleted here. Idempotent — returns
-// `purged: 0` once the DB is clean. Runs BEFORE background MCP/daemon spawn
-// so the foreground sql.js write isn't overwritten by a concurrent flush.
+// ── 3e-729. Purge ephemeral-namespace rows + trim tasklist (#729, #968) ─────
+// Three namespaces (hive-mind, epic-state, test-bridge-fix) store internal
+// run-tracking and get hard-deleted on every session start. The fourth
+// embedding-skipped namespace, `tasklist`, backs the dashboard's Flo Runs
+// tab — it's *trimmed* to a retention cap instead of purged so prior runs
+// survive a session restart (#968). Idempotent: returns
+// `{ purged: 0, trimmed: 0 }` when nothing needs cleaning. Runs BEFORE the
+// background MCP/daemon spawn so the foreground sql.js write isn't
+// overwritten by a concurrent flush.
 try {
   const purgePaths = [
     resolve(projectRoot, 'node_modules/moflo/dist/src/cli/services/ephemeral-namespace-purge.js'),
@@ -1357,6 +1459,12 @@ try {
         `${plural(result.purged, 'row')} from internal run-tracking`,
       );
     }
+    if (result?.trimmed > 0) {
+      emitMutation(
+        'trimmed flo run history',
+        `${plural(result.trimmed, 'old row')} beyond retention cap`,
+      );
+    }
   }
 } catch (err) {
   // Non-fatal — leftover rows just sit until the next session retries.

package/dist/src/cli/appliance/rvfa-builder.js

@@ -20,7 +20,7 @@ const AES_TAG_LEN = 16;
 const AES_ALG = 'aes-256-gcm';
 // ── Catalog ──────────────────────────────────────────────────
 const RUFLO_COMMANDS = 'init agent swarm memory mcp task session config status start workflow hooks hive-mind daemon neural security performance providers plugins deployment embeddings claims migrate process doctor completions'.split(' ');
-const AGENT_TYPES = 'coder reviewer tester planner researcher security-architect security-auditor memory-specialist performance-engineer hierarchical-coordinator mesh-coordinator adaptive-coordinator collective-intelligence-coordinator swarm-memory-manager byzantine-coordinator raft-manager gossip-coordinator consensus-builder crdt-synchronizer quorum-manager security-manager perf-analyzer performance-benchmarker task-orchestrator memory-coordinator smart-agent github-modes pr-manager code-review-swarm issue-tracker release-manager workflow-automation project-board-sync repo-architect multi-repo-swarm sparc-coord sparc-coder specification pseudocode architecture refinement backend-dev mobile-dev ml-developer cicd-engineer api-docs system-architect code-analyzer base-template-generator tdd-london-swarm production-validator'.split(' ');
+const AGENT_TYPES = 'coder reviewer tester planner researcher security-auditor backend-dev frontend-dev database-dev cicd-engineer api-docs system-architect code-analyzer analyst base-template-generator test-long-runner'.split(' ');
 const HOOK_TYPES = 'pre-edit post-edit pre-command post-command pre-task post-task session-start session-end session-restore notify route explain pretrain build-agents transfer teammate-idle task-completed'.split(' ');
 const WORKER_TYPES = 'ultralearn optimize consolidate predict audit map preload deepdive document refactor benchmark testgaps'.split(' ');
 const OFFLINE_MODELS = [

package/dist/src/cli/commands/agent.js

@@ -68,13 +68,8 @@ const AGENT_TYPES = [
     { value: 'coordinator', label: 'Coordinator', hint: 'Multi-agent orchestration and spell management' },
     { value: 'analyst', label: 'Analyst', hint: 'Performance analysis and optimization' },
     { value: 'optimizer', label: 'Optimizer', hint: 'Performance optimization and bottleneck analysis' },
-    { value: 'security-architect', label: 'Security Architect', hint: 'Security architecture and threat modeling' },
     { value: 'security-auditor', label: 'Security Auditor', hint: 'CVE remediation and security testing' },
-    { value: 'memory-specialist', label: 'Memory Specialist', hint: 'AgentDB unification (150x-12,500x faster)' },
-    { value: 'swarm-specialist', label: 'Swarm Specialist', hint: 'Unified coordination engine' },
-    { value: 'performance-engineer', label: 'Performance Engineer', hint: '2.49x-7.47x optimization targets' },
-    { value: 'core-architect', label: 'Core Architect', hint: 'Domain-driven design restructure' },
-    { value: 'test-architect', label: 'Test Architect', hint: 'TDD London School methodology' }
+    { value: 'planner', label: 'Planner', hint: 'Task planning and breakdown' },
 ];
 // Agent spawn subcommand
 const spawnCommand = {
@@ -844,9 +839,8 @@ function getAgentCapabilities(type) {
         reviewer: ['code-review', 'security-audit', 'quality-check', 'documentation'],
         architect: ['system-design', 'pattern-analysis', 'scalability', 'documentation'],
         coordinator: ['task-orchestration', 'agent-management', 'spell-control'],
-        'security-architect': ['threat-modeling', 'security-patterns', 'compliance', 'audit'],
-        'memory-specialist': ['vector-search', 'agentdb', 'caching', 'optimization'],
-        'performance-engineer': ['benchmarking', 'profiling', 'optimization', 'monitoring']
+        'security-auditor': ['threat-modeling', 'security-patterns', 'compliance', 'audit', 'vulnerability-scan'],
+        planner: ['task-breakdown', 'sequencing', 'estimation'],
     };
     return capabilities[type] || ['general'];
 }