@lumenflow/cli 2.6.0 → 2.8.0

package/dist/wu-block.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * WU Block Helper
  *
@@ -29,7 +28,7 @@ import { readWU, writeWU, appendNote } from '@lumenflow/core/dist/wu-yaml.js';
 import { BRANCHES, REMOTES, WU_STATUS, STATUS_SECTIONS, PATTERNS, LOG_PREFIX, FILE_SYSTEM, EXIT_CODES, STRING_LITERALS, MICRO_WORKTREE_OPERATIONS, } from '@lumenflow/core/dist/wu-constants.js';
 import { ensureOnMain } from '@lumenflow/core/dist/wu-helpers.js';
 import { ensureStaged } from '@lumenflow/core/dist/git-staged-validator.js';
-import { withMicroWorktree } from '@lumenflow/core/dist/micro-worktree.js';
+import { withMicroWorktree, LUMENFLOW_WU_TOOL_ENV } from '@lumenflow/core/dist/micro-worktree.js';
 import { WUStateStore } from '@lumenflow/core/dist/wu-state-store.js';
 // WU-1603: Atomic lane locking - release lock when WU is blocked
 import { releaseLaneLock } from '@lumenflow/core/dist/lane-lock.js';
@@ -38,6 +37,30 @@ import { getLockPolicyForLane } from '@lumenflow/core/dist/lane-checker.js';
 // ensureOnMain() moved to wu-helpers.ts (WU-1256)
 // ensureStaged() moved to git-staged-validator.ts (WU-1341)
 // defaultWorktreeFrom() moved to wu-paths.ts (WU-1341)
+/**
+ * WU-1365: Execute a function with LUMENFLOW_WU_TOOL set, restoring afterwards
+ *
+ * Sets the LUMENFLOW_WU_TOOL env var to allow pre-push hook bypass, then
+ * restores the original value (or deletes it) after execution completes.
+ *
+ * @param toolName - Value to set for LUMENFLOW_WU_TOOL
+ * @param fn - Async function to execute
+ */
+async function withWuToolEnv(toolName, fn) {
+    const previousWuTool = process.env[LUMENFLOW_WU_TOOL_ENV];
+    process.env[LUMENFLOW_WU_TOOL_ENV] = toolName;
+    try {
+        return await fn();
+    }
+    finally {
+        if (previousWuTool === undefined) {
+            Reflect.deleteProperty(process.env, LUMENFLOW_WU_TOOL_ENV);
+        }
+        else {
+            process.env[LUMENFLOW_WU_TOOL_ENV] = previousWuTool;
+        }
+    }
+}
 /**
  * Remove WU entry from in-progress section of lines array
  */
@@ -47,7 +70,6 @@ function removeFromInProgressSection(lines, inProgIdx, rel, id) {
     let endIdx = lines.slice(inProgIdx + 1).findIndex((l) => l.startsWith('## '));
     endIdx = endIdx === -1 ? lines.length : inProgIdx + 1 + endIdx;
     for (let i = inProgIdx + 1; i < endIdx; i++) {
-        // eslint-disable-next-line security/detect-object-injection -- array index loop
         if (lines[i] && (lines[i].includes(rel) || lines[i].includes(`[${id}`))) {
             lines.splice(i, 1);
             endIdx--;
@@ -58,6 +80,31 @@ function removeFromInProgressSection(lines, inProgIdx, rel, id) {
     if (section.length === 0)
         lines.splice(endIdx, 0, '', '(No items currently in progress)', '');
 }
+/**
+ * WU-1365: Create missing blocked section in status.md
+ *
+ * Extracts this logic to reduce cognitive complexity of moveFromInProgressToBlocked.
+ *
+ * @param lines - Array of lines from status.md
+ * @param inProgIdx - Index of "## In Progress" header (-1 if not found)
+ * @returns Index of the blocked section header after creation
+ */
+function createMissingBlockedSection(lines, inProgIdx) {
+    console.log(`${LOG_PREFIX.BLOCK} Creating missing "${STATUS_SECTIONS.BLOCKED}" section in status.md`);
+    // Find a good insertion point - after in_progress section or at end
+    const insertIdx = inProgIdx !== -1 ? inProgIdx + 1 : lines.length;
+    // Skip to end of in_progress section content if it exists
+    let insertPoint = insertIdx;
+    if (inProgIdx !== -1) {
+        // Find where the next section starts
+        const nextSectionIdx = lines.slice(inProgIdx + 1).findIndex((l) => l.startsWith('## '));
+        insertPoint = nextSectionIdx === -1 ? lines.length : inProgIdx + 1 + nextSectionIdx;
+    }
+    // Insert the blocked section
+    lines.splice(insertPoint, 0, '', STATUS_SECTIONS.BLOCKED, '');
+    // Return the index of the newly created section header
+    return insertPoint + 1;
+}
 async function moveFromInProgressToBlocked(statusPath, id, title, reason) {
     // Check file exists
     const fileExists = await access(statusPath)
@@ -66,23 +113,25 @@ async function moveFromInProgressToBlocked(statusPath, id, title, reason) {
     if (!fileExists)
         die(`Missing ${statusPath}`);
     const rel = `wu/${id}.yaml`;
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates status file
     const content = await readFile(statusPath, { encoding: FILE_SYSTEM.UTF8 });
     const lines = content.split(/\r?\n/);
     const findHeader = (h) => lines.findIndex((l) => l.trim().toLowerCase() === h.toLowerCase());
     const inProgIdx = findHeader(STATUS_SECTIONS.IN_PROGRESS);
-    const blockedIdx = findHeader(STATUS_SECTIONS.BLOCKED);
-    if (blockedIdx === -1)
-        die(`Could not find "${STATUS_SECTIONS.BLOCKED}" in status.md`);
+    let blockedIdx = findHeader(STATUS_SECTIONS.BLOCKED);
+    // WU-1365: Handle missing blocked section gracefully by creating it
+    if (blockedIdx === -1) {
+        blockedIdx = createMissingBlockedSection(lines, inProgIdx);
+    }
     removeFromInProgressSection(lines, inProgIdx, rel, id);
     // Add bullet to blocked
     const reasonSuffix = reason ? ` — ${reason}` : '';
     const bullet = `- [${id} — ${title}](${rel})${reasonSuffix}`;
+    // Recalculate blockedIdx after removeFromInProgressSection may have changed line positions
+    blockedIdx = findHeader(STATUS_SECTIONS.BLOCKED);
     const sectionStart = blockedIdx + 1;
     if (lines.slice(sectionStart).some((l) => l.includes(rel)))
         return; // already listed
     lines.splice(sectionStart, 0, '', bullet);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes status file
     await writeFile(statusPath, lines.join(STRING_LITERALS.NEWLINE), {
         encoding: FILE_SYSTEM.UTF8,
     });
@@ -169,47 +218,50 @@ async function main() {
     const baseMsg = `wu(${id.toLowerCase()}): block`;
     const commitMsg = args.reason ? `${baseMsg} — ${args.reason}` : baseMsg;
     if (!args.noAuto) {
-        // Use micro-worktree pattern to avoid pre-commit hook blocking commits to main
-        await withMicroWorktree({
-            operation: MICRO_WORKTREE_OPERATIONS.WU_BLOCK,
-            id,
-            logPrefix: LOG_PREFIX.BLOCK,
-            pushOnly: true, // Push directly to origin/main without touching local main
-            execute: async ({ worktreePath }) => {
-                // Build paths relative to micro-worktree
-                const microWUPath = path.join(worktreePath, WU_PATHS.WU(id));
-                const microStatusPath = path.join(worktreePath, WU_PATHS.STATUS());
-                const microBacklogPath = path.join(worktreePath, WU_PATHS.BACKLOG());
-                // Update WU YAML in micro-worktree
-                const microDoc = readWU(microWUPath, id);
-                microDoc.status = WU_STATUS.BLOCKED;
-                const noteLine = args.reason
-                    ? `Blocked (${todayISO()}): ${args.reason}`
-                    : `Blocked (${todayISO()})`;
-                appendNote(microDoc, noteLine);
-                writeWU(microWUPath, microDoc);
-                // Update status.md in micro-worktree
-                await moveFromInProgressToBlocked(microStatusPath, id, title, args.reason);
-                // Update backlog.md in micro-worktree (WU-1574: regenerate from state store)
-                await regenerateBacklogFromState(microBacklogPath);
-                // Append block event to WUStateStore (WU-1573)
-                const stateDir = path.join(worktreePath, '.lumenflow', 'state');
-                const store = new WUStateStore(stateDir);
-                await store.load();
-                await store.block(id, args.reason || 'No reason provided');
-                return {
-                    commitMessage: commitMsg,
-                    files: [
-                        WU_PATHS.WU(id),
-                        WU_PATHS.STATUS(),
-                        WU_PATHS.BACKLOG(),
-                        '.lumenflow/state/wu-events.jsonl',
-                    ],
-                };
-            },
+        // WU-1365: Set LUMENFLOW_WU_TOOL to allow pre-push hook bypass for micro-worktree pushes
+        await withWuToolEnv(MICRO_WORKTREE_OPERATIONS.WU_BLOCK, async () => {
+            // Use micro-worktree pattern to avoid pre-commit hook blocking commits to main
+            await withMicroWorktree({
+                operation: MICRO_WORKTREE_OPERATIONS.WU_BLOCK,
+                id,
+                logPrefix: LOG_PREFIX.BLOCK,
+                pushOnly: true, // Push directly to origin/main without touching local main
+                execute: async ({ worktreePath }) => {
+                    // Build paths relative to micro-worktree
+                    const microWUPath = path.join(worktreePath, WU_PATHS.WU(id));
+                    const microStatusPath = path.join(worktreePath, WU_PATHS.STATUS());
+                    const microBacklogPath = path.join(worktreePath, WU_PATHS.BACKLOG());
+                    // Update WU YAML in micro-worktree
+                    const microDoc = readWU(microWUPath, id);
+                    microDoc.status = WU_STATUS.BLOCKED;
+                    const noteLine = args.reason
+                        ? `Blocked (${todayISO()}): ${args.reason}`
+                        : `Blocked (${todayISO()})`;
+                    appendNote(microDoc, noteLine);
+                    writeWU(microWUPath, microDoc);
+                    // Update status.md in micro-worktree
+                    await moveFromInProgressToBlocked(microStatusPath, id, title, args.reason);
+                    // Update backlog.md in micro-worktree (WU-1574: regenerate from state store)
+                    await regenerateBacklogFromState(microBacklogPath);
+                    // Append block event to WUStateStore (WU-1573)
+                    const stateDir = path.join(worktreePath, '.lumenflow', 'state');
+                    const store = new WUStateStore(stateDir);
+                    await store.load();
+                    await store.block(id, args.reason || 'No reason provided');
+                    return {
+                        commitMessage: commitMsg,
+                        files: [
+                            WU_PATHS.WU(id),
+                            WU_PATHS.STATUS(),
+                            WU_PATHS.BACKLOG(),
+                            '.lumenflow/state/wu-events.jsonl',
+                        ],
+                    };
+                },
+            });
+            // Fetch to update local main tracking
+            await getGitForCwd().fetch(REMOTES.ORIGIN, BRANCHES.MAIN);
         });
-        // Fetch to update local main tracking
-        await getGitForCwd().fetch(REMOTES.ORIGIN, BRANCHES.MAIN);
     }
     else {
         // Manual mode: expect files already staged

package/dist/wu-claim.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * WU Claim Helper
  *
@@ -27,9 +26,7 @@ import { checkLaneFree, validateLaneFormat, checkWipJustification, } from '@lume
 import { acquireLaneLock, releaseLaneLock, checkLaneLock, forceRemoveStaleLock, } from '@lumenflow/core/dist/lane-lock.js';
 // WU-1825: Import from unified code-path-validator (consolidates 3 validators)
 // WU-1213: Using deprecated sync API - async validate() requires larger refactor (separate WU)
-import { 
-// eslint-disable-next-line sonarjs/deprecation -- sync API required for current architecture
-validateLaneCodePaths, logLaneValidationWarnings, } from '@lumenflow/core/dist/code-path-validator.js';
+import { validateLaneCodePaths, logLaneValidationWarnings, } from '@lumenflow/core/dist/code-path-validator.js';
 // WU-1574: parseBacklogFrontmatter/getSectionHeadings removed - state store replaces backlog parsing
 import { detectConflicts } from '@lumenflow/core/dist/code-paths-overlap.js';
 import { getGitForCwd, createGitForPath } from '@lumenflow/core/dist/git-adapter.js';
@@ -86,7 +83,6 @@ const PREFIX = LOG_PREFIX.CLAIM;
  */
 function preflightValidateWU(WU_PATH, id) {
     // Check file exists
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates WU files
     if (!existsSync(WU_PATH)) {
         die(`WU file not found: ${WU_PATH}\n\n` +
             `Cannot claim a WU that doesn't exist.\n\n` +
@@ -96,7 +92,6 @@ function preflightValidateWU(WU_PATH, id) {
             `  3. Check if the WU file was moved or deleted`);
     }
     // Parse and validate YAML structure
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates WU files
     const text = readFileSync(WU_PATH, { encoding: FILE_SYSTEM.UTF8 });
     let doc;
     try {
@@ -189,7 +184,6 @@ async function updateWUYaml(WU_PATH, id, lane, claimedMode = 'worktree', worktre
     // Read file
     let text;
     try {
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates WU files
         text = await readFile(WU_PATH, { encoding: FILE_SYSTEM.UTF8 });
     }
     catch (e) {
@@ -266,7 +260,6 @@ async function updateWUYaml(WU_PATH, id, lane, claimedMode = 'worktree', worktre
     // WU-1352: Use centralized stringify for consistent output
     const out = stringifyYAML(doc);
     // Write file
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes WU files
     await writeFile(WU_PATH, out, { encoding: FILE_SYSTEM.UTF8 });
     // WU-1211: Return both title and initiative for status progression check
     return { title: doc.title || '', initiative: doc.initiative || null };
@@ -326,7 +319,6 @@ async function addOrReplaceInProgressStatus(statusPath, id, title) {
     const rel = `wu/${id}.yaml`;
     const bullet = `- [${id} — ${title}](${rel})`;
     // Read file
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates status file
     const content = await readFile(statusPath, { encoding: FILE_SYSTEM.UTF8 });
     const lines = content.split(STRING_LITERALS.NEWLINE);
     const findHeader = (h) => lines.findIndex((l) => l.trim().toLowerCase() === h.toLowerCase());
@@ -344,7 +336,6 @@ async function addOrReplaceInProgressStatus(statusPath, id, title) {
         return; // already listed
     // Remove "No items" marker if present
     for (let i = startIdx + 1; i < endIdx; i++) {
-        // eslint-disable-next-line security/detect-object-injection -- array index loop
         if (lines[i] && lines[i].includes('No items currently in progress')) {
             lines.splice(i, 1);
             endIdx--;
@@ -354,7 +345,6 @@ async function addOrReplaceInProgressStatus(statusPath, id, title) {
     // Insert bullet right after header
     lines.splice(startIdx + 1, 0, '', bullet);
     // Write file
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes status file
     await writeFile(statusPath, lines.join(STRING_LITERALS.NEWLINE), {
         encoding: FILE_SYSTEM.UTF8,
     });
@@ -444,10 +434,8 @@ async function applyStagedChangesToMicroWorktree(worktreePath, stagedChanges) {
             continue;
         }
         const sourcePath = path.join(process.cwd(), filePath);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool applies staged files
         const contents = await readFile(sourcePath, { encoding: FILE_SYSTEM.UTF8 });
         await mkdir(path.dirname(targetPath), { recursive: true });
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool applies staged files
         await writeFile(targetPath, contents, { encoding: FILE_SYSTEM.UTF8 });
     }
 }
@@ -520,11 +508,9 @@ async function readWUTitle(id) {
         return null;
     }
     // Read file
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates WU files
     const text = await readFile(p, { encoding: FILE_SYSTEM.UTF8 });
     // Match title field - use RegExp.exec for sonarjs/prefer-regexp-exec compliance
     // Regex is safe: runs on trusted WU YAML files with bounded input
-    // eslint-disable-next-line sonarjs/slow-regex -- Bounded input from WU YAML files
     const titlePattern = /^title:\s*"?([^"\n]+)"?$/m;
     const m = titlePattern.exec(text);
     return m ? m[1] : null;
@@ -546,7 +532,6 @@ async function checkExistingBranchOnlyWU(statusPath, currentWU) {
         return { hasBranchOnly: false, existingWU: null };
     }
     // Read file
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates status file
     const content = await readFile(statusPath, { encoding: FILE_SYSTEM.UTF8 });
     const lines = content.split(STRING_LITERALS.NEWLINE);
     // Find "In Progress" section
@@ -581,7 +566,6 @@ async function checkExistingBranchOnlyWU(statusPath, currentWU) {
         }
         try {
             // Read file
-            // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates WU files
             const text = await readFile(wuPath, { encoding: FILE_SYSTEM.UTF8 });
             const doc = parseYAML(text);
             if (doc && doc.claimed_mode === CLAIMED_MODES.BRANCH_ONLY) {
@@ -705,10 +689,8 @@ function handleLaneOccupancy(laneCheck, lane, id, force) {
  * Handle code path overlap detection (WU-901)
  */
 function handleCodePathOverlap(WU_PATH, STATUS_PATH, id, args) {
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates WU files
     if (!existsSync(WU_PATH))
         return;
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates WU files
     const wuContent = readFileSync(WU_PATH, { encoding: FILE_SYSTEM.UTF8 });
     const wuDoc = parseYAML(wuContent);
     const codePaths = wuDoc.code_paths || [];
@@ -846,7 +828,6 @@ async function claimBranchOnlyMode(ctx) {
     console.log(`\n${PREFIX} For sub-agent execution:`);
     console.log(`  /wu-prompt ${id}  (generates full context prompt)`);
     // Emit mandatory agent advisory based on code_paths (WU-1324)
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates WU files
     const wuContent = await readFile(WU_PATH, { encoding: FILE_SYSTEM.UTF8 });
     const wuDoc = parseYAML(wuContent);
     const codePaths = wuDoc.code_paths || [];
@@ -1008,7 +989,6 @@ async function claimWorktreeMode(ctx) {
     // Emit mandatory agent advisory based on code_paths (WU-1324)
     // Read from worktree since that's where the updated YAML is
     const wtWUPathForAdvisory = path.join(worktreePath, WU_PATH);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates WU files
     const wuContent = await readFile(wtWUPathForAdvisory, {
         encoding: FILE_SYSTEM.UTF8,
     });
@@ -1226,7 +1206,6 @@ async function main() {
         console.warn(`${PREFIX} ${wipJustificationCheck.warning}`);
     }
     // WU-1372: Lane-to-code_paths consistency check (advisory only, never blocks)
-    // eslint-disable-next-line sonarjs/deprecation -- sync API required for current architecture
     const laneValidation = validateLaneCodePaths(doc, args.lane);
     logLaneValidationWarnings(laneValidation, PREFIX);
     // WU-1361: YAML schema validation at claim time

package/dist/wu-cleanup.js

@@ -29,7 +29,6 @@ import { isGhCliAvailable } from '@lumenflow/core/dist/wu-done-pr.js';
 import { BOX, CLEANUP_GUARD, EXIT_CODES, FILE_SYSTEM, LOG_PREFIX, REMOTES, STRING_LITERALS, WU_STATUS, } from '@lumenflow/core/dist/wu-constants.js';
 // WU-2278: Import ownership validation for cross-agent protection
 import { validateWorktreeOwnership } from '@lumenflow/core/dist/worktree-ownership.js';
-/* eslint-disable security/detect-non-literal-fs-filename */
 const CLEANUP_OPTIONS = {
     artifacts: {
         name: 'artifacts',

package/dist/wu-create.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * WU Create Helper (WU-1262, WU-1439)
  *
@@ -491,7 +490,6 @@ async function getDefaultAssignedTo() {
         return '';
     }
 }
-// eslint-disable-next-line sonarjs/cognitive-complexity -- main() orchestrates multi-step WU creation workflow
 async function main() {
     const args = createWUParser({
         name: 'wu-create',

package/dist/wu-done-auto-cleanup.js

@@ -0,0 +1,139 @@
+/**
+ * WU-1366: Auto cleanup after wu:done success
+ *
+ * Provides functions to run state cleanup automatically after successful wu:done.
+ * Cleanup is non-fatal: errors are logged but do not block completion.
+ *
+ * The cleanup.trigger config option controls when cleanup runs:
+ * - 'on_done': Run after wu:done success (default)
+ * - 'on_init': Run during lumenflow init
+ * - 'manual': Only run via pnpm state:cleanup
+ *
+ * @see {@link packages/@lumenflow/core/src/state-cleanup-core.ts} - Core cleanup orchestration
+ * @see {@link packages/@lumenflow/core/src/lumenflow-config-schema.ts} - CleanupConfigSchema
+ */
+import { getConfig } from '@lumenflow/core/dist/lumenflow-config.js';
+import { cleanupState } from '@lumenflow/core/dist/state-cleanup-core.js';
+import { cleanupSignals } from '@lumenflow/memory/dist/signal-cleanup-core.js';
+import { cleanupMemory } from '@lumenflow/memory/dist/mem-cleanup-core.js';
+import { archiveWuEvents } from '@lumenflow/core/dist/wu-events-cleanup.js';
+import fg from 'fast-glob';
+import { readFile } from 'node:fs/promises';
+import { parse as parseYaml } from 'yaml';
+import path from 'node:path';
+import { LOG_PREFIX, EMOJI } from '@lumenflow/core/dist/wu-constants.js';
+/**
+ * Active WU statuses that should protect signals
+ */
+const ACTIVE_WU_STATUSES = ['in_progress', 'blocked'];
+/**
+ * Get active WU IDs (in_progress or blocked) by scanning WU YAML files.
+ *
+ * @param baseDir - Base directory
+ * @returns Set of active WU IDs
+ */
+async function getActiveWuIds(baseDir) {
+    const activeIds = new Set();
+    try {
+        const config = getConfig({ projectRoot: baseDir });
+        const wuDir = path.join(baseDir, config.directories.wuDir);
+        // Find all WU YAML files
+        const wuFiles = await fg('WU-*.yaml', { cwd: wuDir });
+        for (const file of wuFiles) {
+            try {
+                const filePath = path.join(wuDir, file);
+                const content = await readFile(filePath, 'utf-8');
+                const wu = parseYaml(content);
+                if (wu.id && wu.status && ACTIVE_WU_STATUSES.includes(wu.status)) {
+                    activeIds.add(wu.id);
+                }
+            }
+            catch {
+                // Skip files that fail to parse
+                continue;
+            }
+        }
+    }
+    catch {
+        // If we can't read WU files, return empty set (safer to remove nothing)
+    }
+    return activeIds;
+}
+/**
+ * Check if auto cleanup should run based on config.
+ *
+ * @returns true if cleanup.trigger is 'on_done' or not set (default)
+ */
+export function shouldRunAutoCleanup() {
+    try {
+        const config = getConfig();
+        const trigger = config.cleanup?.trigger;
+        // Default to 'on_done' if not set
+        if (!trigger) {
+            return true;
+        }
+        return trigger === 'on_done';
+    }
+    catch {
+        // If config can't be loaded, default to running cleanup
+        return true;
+    }
+}
+/**
+ * Run state cleanup automatically after wu:done success.
+ *
+ * This function is non-fatal: errors are logged as warnings but do not throw.
+ * Cleanup respects the config.cleanup.trigger setting.
+ *
+ * @param baseDir - Base directory for cleanup operations
+ * @returns Promise that resolves when cleanup completes (or is skipped)
+ */
+export async function runAutoCleanupAfterDone(baseDir) {
+    // Check if cleanup should run
+    if (!shouldRunAutoCleanup()) {
+        return;
+    }
+    try {
+        console.log(`${LOG_PREFIX.DONE} ${EMOJI.INFO} Running auto state cleanup...`);
+        const result = await cleanupState(baseDir, {
+            dryRun: false,
+            // Inject real cleanup functions
+            cleanupSignals: async (dir, opts) => cleanupSignals(dir, {
+                dryRun: opts.dryRun,
+                getActiveWuIds: () => getActiveWuIds(dir),
+            }),
+            cleanupMemory: async (dir, opts) => cleanupMemory(dir, {
+                dryRun: opts.dryRun,
+            }),
+            archiveEvents: async (dir, opts) => archiveWuEvents(dir, {
+                dryRun: opts.dryRun,
+            }),
+        });
+        if (result.success) {
+            const typesStr = result.summary.typesExecuted.join(', ');
+            console.log(`${LOG_PREFIX.DONE} ${EMOJI.SUCCESS} State cleanup complete: ` +
+                `${formatBytes(result.summary.totalBytesFreed)} freed [${typesStr}]`);
+        }
+        else {
+            // Partial success - some cleanups failed
+            const errorMsgs = result.errors.map((e) => `${e.type}: ${e.message}`).join(', ');
+            console.warn(`${LOG_PREFIX.DONE} ${EMOJI.WARNING} State cleanup partial: ${errorMsgs}`);
+        }
+    }
+    catch (err) {
+        // Non-fatal: log warning but don't throw
+        const message = err instanceof Error ? err.message : String(err);
+        console.warn(`${LOG_PREFIX.DONE} ${EMOJI.WARNING} Could not run auto state cleanup: ${message}`);
+    }
+}
+/**
+ * Format bytes as human-readable string
+ */
+function formatBytes(bytes) {
+    const BYTES_PER_KB = 1024;
+    if (bytes < BYTES_PER_KB) {
+        return `${bytes} B`;
+    }
+    const kb = (bytes / BYTES_PER_KB).toFixed(1);
+    return `${kb} KB`;
+}

package/dist/wu-done.js

@@ -95,6 +95,8 @@ import { SpawnStatus } from '@lumenflow/core/dist/spawn-registry-schema.js';
 // WU-2022: Feature accessibility validation (blocking)
 import { validateExposure, validateFeatureAccessibility, } from '@lumenflow/core/dist/wu-validation.js';
 import { ensureCleanWorktree } from './wu-done-check.js';
+// WU-1366: Auto cleanup after wu:done success
+import { runAutoCleanupAfterDone } from './wu-done-auto-cleanup.js';
 // WU-1588: Memory layer constants
 const MEMORY_SIGNAL_TYPES = {
     WU_COMPLETION: 'wu_completion',
@@ -1091,7 +1093,6 @@ function recordTransactionState(id, wuPath, stampPath, backlogPath, statusPath)
  * @param {string} backlogPath - Path to backlog.md (WU-1230)
  * @param {string} statusPath - Path to status.md (WU-1230)
  */
-// eslint-disable-next-line sonarjs/cognitive-complexity -- Pre-existing complexity, refactor tracked separately
 async function rollbackTransaction(txState, wuPath, stampPath, backlogPath, statusPath) {
     console.error(`\n${LOG_PREFIX.DONE} ${EMOJI.WARNING} ROLLING BACK TRANSACTION (WU-755 + WU-1230 + WU-1255 + WU-1280)...`);
     // WU-1280: ATOMIC ROLLBACK - Clean git state FIRST, then restore files
@@ -1272,7 +1273,6 @@ function runWUValidator(doc, id, allowTodo = false, worktreePath = null) {
  * @param {string|null} overrideReason - Reason for override
  * @returns {{valid: boolean, error: string|null, auditEntry: object|null}}
  */
-// eslint-disable-next-line sonarjs/cognitive-complexity -- Pre-existing complexity, refactor tracked separately
 async function checkOwnership(id, doc, worktreePath, overrideOwner = false, overrideReason = null) {
     // Missing worktree means WU was not claimed properly (unless escape hatch applies)
     if (!worktreePath || !existsSync(worktreePath)) {
@@ -2085,7 +2085,9 @@ async function main() {
                     if (lane)
                         releaseLaneLock(lane, { wuId: id });
                 }
-                catch { }
+                catch {
+                    // Intentionally ignore lock release errors during cleanup
+                }
                 process.exit(EXIT_CODES.SUCCESS);
             }
         }
@@ -2096,7 +2098,9 @@ async function main() {
                 if (lane)
                     releaseLaneLock(lane, { wuId: id });
             }
-            catch { }
+            catch {
+                // Intentionally ignore lock release errors during error handling
+            }
             // WU-1811: Check if cleanup is safe before removing worktree
             // If cleanupSafe is false (or undefined), preserve worktree for recovery
             if (err.cleanupSafe === false) {
@@ -2180,6 +2184,9 @@ async function main() {
     // WU-1983: Migration deployment nudge - only if supabase paths in code_paths
     const codePaths = docMain.code_paths || [];
     await printMigrationDeploymentNudge(codePaths, mainCheckoutPath);
+    // WU-1366: Auto state cleanup after successful completion
+    // Non-fatal: errors are logged but do not block completion
+    await runAutoCleanupAfterDone(mainCheckoutPath);
 }
 /**
  * WU-1983: Print migration deployment nudge when WU includes supabase changes.

package/dist/wu-edit.js

@@ -59,7 +59,6 @@ import { normalizeWUSchema } from '@lumenflow/core/dist/wu-schema-normalization.
 import { lintWUSpec, formatLintErrors } from '@lumenflow/core/dist/wu-lint.js';
 // WU-1329: Import path existence validators for strict validation
 import { validateCodePathsExistence, validateTestPathsExistence, } from '@lumenflow/core/dist/wu-preflight-validators.js';
-/* eslint-disable security/detect-object-injection */
 const PREFIX = LOG_PREFIX.EDIT;
 /**
  * WU-1039: Validate which edits are allowed on done WUs
@@ -271,13 +270,11 @@ const EDIT_OPTIONS = {
  * @param {string} newInitId - New initiative ID
  * @returns {Array<string>} Array of relative file paths that were modified
  */
-// eslint-disable-next-line sonarjs/cognitive-complexity -- Pre-existing complexity, refactor tracked separately
 function updateInitiativeWusArrays(worktreePath, wuId, oldInitId, newInitId) {
     const modifiedFiles = [];
     // Remove from old initiative if it exists and is different from new
     if (oldInitId && oldInitId !== newInitId) {
         const oldInitPath = join(worktreePath, INIT_PATHS.INITIATIVE(oldInitId));
-        // eslint-disable-next-line security/detect-non-literal-fs-filename
         if (existsSync(oldInitPath)) {
             try {
                 const oldInit = readInitiative(oldInitPath, oldInitId);
@@ -296,7 +293,6 @@ function updateInitiativeWusArrays(worktreePath, wuId, oldInitId, newInitId) {
     }
     // Add to new initiative
     const newInitPath = join(worktreePath, INIT_PATHS.INITIATIVE(newInitId));
-    // eslint-disable-next-line security/detect-non-literal-fs-filename
     if (existsSync(newInitPath)) {
         try {
             const newInit = readInitiative(newInitPath, newInitId);
@@ -333,7 +329,6 @@ function validateInitiativeFormat(initId) {
  */
 function validateInitiativeExists(initId) {
     const initPath = INIT_PATHS.INITIATIVE(initId);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename
     if (!existsSync(initPath)) {
         die(`Initiative not found: ${initId}\n\nFile does not exist: ${initPath}`);
     }
@@ -464,11 +459,9 @@ function normalizeWUDates(wu) {
  */
 function validateWUEditable(id) {
     const wuPath = WU_PATHS.WU(id);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates WU files
     if (!existsSync(wuPath)) {
         die(`WU ${id} not found at ${wuPath}\n\nEnsure the WU exists and you're in the repo root.`);
     }
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates WU files
     const content = readFileSync(wuPath, { encoding: FILE_SYSTEM.ENCODING });
     const wu = parseYAML(content);
     // WU-1929: Done WUs allow initiative/phase edits only (metadata reassignment)
@@ -505,7 +498,6 @@ function validateWUEditable(id) {
  * @param {string} id - WU ID (for error messages)
  */
 function validateWorktreeExists(worktreePath, id) {
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates worktree paths
     if (!existsSync(worktreePath)) {
         die(`Cannot edit WU ${id}: worktree path missing from disk.\n\n` +
             `Expected worktree at: ${worktreePath}\n\n` +
@@ -580,7 +572,6 @@ async function applyEditsInWorktree({ worktreePath, id, updatedWU }) {
     normalizeWUDates(updatedWU);
     // Emergency fix Session 2: Use centralized stringifyYAML helper
     const yamlContent = stringifyYAML(updatedWU);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes WU files
     writeFileSync(wuPath, yamlContent, { encoding: FILE_SYSTEM.ENCODING });
     console.log(`${PREFIX} ✅ Updated ${id}.yaml in worktree`);
     // Format the file
@@ -660,11 +651,9 @@ export function mergeStringField(existing, newValue, shouldReplace) {
  */
 function loadSpecFile(specPath, originalWU) {
     const resolvedPath = resolve(specPath);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates spec files
     if (!existsSync(resolvedPath)) {
         die(`Spec file not found: ${resolvedPath}`);
     }
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool validates spec files
     const specContent = readFileSync(resolvedPath, {
         encoding: FILE_SYSTEM.ENCODING,
     });
@@ -1040,7 +1029,6 @@ async function main() {
                     normalizeWUDates(normalizedWU);
                     // Emergency fix Session 2: Use centralized stringifyYAML helper
                     const yamlContent = stringifyYAML(normalizedWU);
-                    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool writes WU files
                     writeFileSync(wuPath, yamlContent, { encoding: FILE_SYSTEM.ENCODING });
                     console.log(`${PREFIX} ✅ Updated ${id}.yaml in micro-worktree`);
                     // WU-1929: Handle bidirectional initiative updates