@ruvector/sona@0.1.6 published without build output → SONA routing silently dead (MODULE_NOT_FOUND)

[ronmikailov]

Summary

@ruvector/sona@0.1.6 is published to npm without its build output. The package
contains only README.md and package.json — no index.js and no dist/ — yet
package.json main points at index.js. As a result require('@ruvector/sona') throws
MODULE_NOT_FOUND, which silently disables all SONA-backed routing in ruvector@0.2.26.

Environment

• ruvector@0.2.26 (latest)
• @ruvector/sona@0.1.6
• Node v20.19.6, Linux

Reproduction

$ ls node_modules/@ruvector/sona
README.md   package.json                 # no index.js, no dist/

$ node -p "require('@ruvector/sona/package.json').main"
index.js                                  # main points at a non-existent file

$ node -e "require('@ruvector/sona')"
Error: Cannot find module '@ruvector/sona'  (MODULE_NOT_FOUND)

Impact

dist/core/intelligence-engine.js gates SONA on isSonaAvailable(), which does
require('@ruvector/sona') inside a try/catch. Because the require throws, the engine
sets this.sona = null, so:

• this.sona.findPatterns(embed, 5) never runs → patterns = []
• every hooks route / mcp__ruvector__hooks_route call returns sonaPatterns: 0
• the SONA confidence-boost branch in route() is permanently dead

So SONA-enhanced routing is non-functional end-to-end despite being fully wired, and there
is no surfaced error — it fails silently via the catch.

The same failure mode affects @ruvector/pi-brain@0.1.1 (also ships src/ only, no dist/),
which breaks all brain_* MCP tools (No "exports" main defined). Likely the same root
cause in the publish pipeline.

Suggested solution

1. Verify the tarball before publishing. npm pack --dry-run in npm/packages/sona
   should list the built entrypoint. Add it to CI as a gate.
2. Fix the files allowlist / build step. Either:
   • ensure dist/ (or index.js) is produced by a prepublishOnly (or prepack) build
     script, and
   • ensure package.json files includes the built output (a too-narrow files field is
     the most common cause of a src-only / build-less tarball).
3. Make main/exports match what actually ships (point at the real built file).
4. Apply the same fix to @ruvector/pi-brain — it exhibits the identical defect and
   gates the brain_* tools.
5. Optionally, surface a one-time console.warn when isSonaAvailable() returns false so the
   degraded mode is visible rather than silent.

A minimal post-publish smoke test (npm i @ruvector/sona@latest && node -e "require('@ruvector/sona')")
in CI would prevent regressions.