@wooojin/forgen 0.4.6 → 0.4.8

package/dist/core/v1-bootstrap.js

@@ -15,10 +15,10 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
-import { FORGEN_HOME, ME_DIR, ME_RULES, ME_BEHAVIOR, V1_RECOMMENDATIONS_DIR, V1_SESSIONS_DIR, STATE_DIR, V1_RAW_LOGS_DIR, ME_SOLUTIONS } from './paths.js';
+import { FORGEN_HOME, ME_DIR, ME_RULES, ME_BEHAVIOR, V1_RECOMMENDATIONS_DIR, V1_SESSIONS_DIR, STATE_DIR, V1_RAW_LOGS_DIR, ME_SOLUTIONS, SESSIONS_DIR } from './paths.js';
 import { checkLegacyProfile, runLegacyCutover } from './legacy-detector.js';
 import { detectRuntimeCapability } from './runtime-detector.js';
-import { loadProfile, profileExists } from '../store/profile-store.js';
+import { backupCorruptProfile, loadProfile, profileExists } from '../store/profile-store.js';
 import { loadActiveRules, cleanupStaleSessionRules, markRulesInjected } from '../store/rule-store.js';
 import { composeSession } from '../preset/preset-manager.js';
 import { renderRules, DEFAULT_CONTEXT } from '../renderer/rule-renderer.js';
@@ -27,7 +27,14 @@ import { loadEvidenceBySession } from '../store/evidence-store.js';
 import { computeSessionSignals, detectMismatch } from '../forge/mismatch-detector.js';
 import { createRecommendation, saveRecommendation } from '../store/recommendation-store.js';
 // ── Directory Initialization ──
-const V1_DIRS = [FORGEN_HOME, ME_DIR, ME_RULES, ME_BEHAVIOR, V1_RECOMMENDATIONS_DIR, STATE_DIR, V1_SESSIONS_DIR, V1_RAW_LOGS_DIR, ME_SOLUTIONS];
+// v0.4.8 (A3): SESSIONS_DIR (~/.forgen/sessions/) 도 v1 bootstrap 보장 대상.
+// 이전엔 V1_DIRS 에 누락되어 있어, prepareHarness step 11 (startSessionLog)
+// 에 도달 못 하는 코드 경로 (예: forgen install 직접 실행) 에선 디렉토리가
+// 끝까지 생성되지 않았음. legacy session log 와 v1 effective state 는
+// 서로 다른 저장소 책임이라 두 dir 모두 명시 보장.
+//   - SESSIONS_DIR     = ~/.forgen/sessions/        ← legacy session log (transcript-like)
+//   - V1_SESSIONS_DIR  = ~/.forgen/state/sessions/  ← v1 effective state per session
+const V1_DIRS = [FORGEN_HOME, ME_DIR, ME_RULES, ME_BEHAVIOR, V1_RECOMMENDATIONS_DIR, STATE_DIR, V1_SESSIONS_DIR, V1_RAW_LOGS_DIR, ME_SOLUTIONS, SESSIONS_DIR];
 export function ensureV1Directories() {
     for (const dir of V1_DIRS) {
         fs.mkdirSync(dir, { recursive: true });
@@ -48,6 +55,7 @@ export function bootstrapV1Session() {
         return {
             needsOnboarding: true,
             legacyBackupPath,
+            corruptProfileBackupPath: null,
             session: null,
             renderedRules: null,
             profile: null,
@@ -56,7 +64,20 @@ export function bootstrapV1Session() {
     }
     const profile = loadProfile();
     if (!profile) {
-        return { needsOnboarding: true, legacyBackupPath, session: null, renderedRules: null, profile: null, mismatch: null };
+        // v0.4.8 — corrupt/invalid profile auto-repair.
+        // profileExists()=true && loadProfile()=null 은 parse 실패 또는 v1
+        // shape 위반. 그대로 두면 다음 실행에서도 같은 분기로 빠지므로
+        // backup 후 새 onboarding 흐름을 강제.
+        const corruptProfileBackupPath = backupCorruptProfile();
+        return {
+            needsOnboarding: true,
+            legacyBackupPath,
+            corruptProfileBackupPath,
+            session: null,
+            renderedRules: null,
+            profile: null,
+            mismatch: null,
+        };
     }
     // 3. Runtime capability 감지
     const runtime = detectRuntimeCapability();
@@ -133,7 +154,7 @@ export function bootstrapV1Session() {
     try {
         // 세션 시작 로그
         const rawLogPath = path.join(V1_RAW_LOGS_DIR, `${sessionId}.jsonl`);
-        fs.appendFileSync(rawLogPath, JSON.stringify({
+        fs.appendFileSync(rawLogPath, `${JSON.stringify({
             event: 'session-started',
             session_id: sessionId,
             timestamp: new Date().toISOString(),
@@ -142,7 +163,7 @@ export function bootstrapV1Session() {
             judgment_pack: profile.base_packs.judgment_pack,
             communication_pack: profile.base_packs.communication_pack,
             effective_trust: session.effective_trust_policy,
-        }) + '\n');
+        })}\n`);
         // TTL sweep: 7일 이상 된 raw log 파일 삭제
         const TTL_MS = 7 * 24 * 60 * 60 * 1000;
         const now = Date.now();
@@ -163,6 +184,7 @@ export function bootstrapV1Session() {
     return {
         needsOnboarding: false,
         legacyBackupPath,
+        corruptProfileBackupPath: null,
         session,
         renderedRules,
         profile,

package/dist/engine/compound-extractor.js

@@ -557,7 +557,7 @@ function findCommonPrefix(strings) {
     return prefix.replace(/-$/, '');
 }
 /** Save an extracted solution as experiment */
-function saveExtractedSolution(sol, sessionId) {
+function saveExtractedSolution(sol, _sessionId) {
     const today = new Date().toISOString().split('T')[0];
     const slugName = sol.name.toLowerCase()
         .replace(/[^a-z0-9가-힣\s-]/g, '')

package/dist/engine/learn-cli.js

@@ -136,7 +136,7 @@ function runFitness(args) {
     console.log(`    ${'name'.padEnd(48)} ${'state'.padEnd(14)} ${'inj'.padStart(4)}  ${'acc/cor/err'.padStart(11)}  ${'fit'.padStart(6)}`);
     console.log(`    ${'-'.repeat(48)} ${'-'.repeat(14)} ${'-'.repeat(4)}  ${'-'.repeat(11)}  ${'-'.repeat(6)}`);
     for (const r of records) {
-        const name = r.solution.length > 47 ? r.solution.slice(0, 45) + '..' : r.solution;
+        const name = r.solution.length > 47 ? `${r.solution.slice(0, 45)}..` : r.solution;
         const acr = `${r.accepted}/${r.corrected}/${r.errored}`;
         console.log(`    ${name.padEnd(48)} ${r.state.padEnd(14)} ${String(r.injected).padStart(4)}  ${acr.padStart(11)}  ${r.fitness.toFixed(2).padStart(6)}`);
     }
@@ -222,7 +222,7 @@ function runEvolvePromote(candidateNameOrList) {
     }
     const result = promoteCandidate(candidateNameOrList);
     if (result.ok) {
-        console.log(`\n  ✓ Promoted: ${path.basename(result.dest)}`);
+        console.log(`\n  ✓ Promoted: ${result.dest ? path.basename(result.dest) : '(unknown)'}`);
         console.log(`    from: ${result.source}`);
         console.log(`    to:   ${result.dest}`);
         console.log(`    Cold-start bonus active until 5 injections accumulate (auto-promotes to verified).\n`);

package/dist/engine/lifecycle/bypass-detector.js

@@ -51,9 +51,10 @@ function extractParenthesizedExamples(p) {
     const out = [];
     // Match (...) groups; multiple groups in policy are uncommon but supported
     const re = /\(([^)]+)\)/g;
-    let m;
-    while ((m = re.exec(p))) {
+    let m = re.exec(p);
+    while (m !== null) {
         const inside = m[1];
+        m = re.exec(p);
         // Skip if it looks like a path (contains "/" before any obvious separator commitment)
         if (/[a-zA-Z]+\/[a-zA-Z]/.test(inside))
             continue;

package/dist/engine/lifecycle/meta-reclassifier.js

@@ -294,7 +294,7 @@ export function appendLifecycleEvents(events, now = Date.now()) {
             }
         }
         catch { /* missing → no rotate */ }
-        const body = events.map((e) => JSON.stringify(e)).join('\n') + '\n';
+        const body = `${events.map((e) => JSON.stringify(e)).join('\n')}\n`;
         fs.appendFileSync(logPath, body);
     }
     catch (e) {

package/dist/engine/lifecycle/signals.js

@@ -62,7 +62,7 @@ export function recordViolation(entry) {
         fs.mkdirSync(ENFORCEMENT_DIR, { recursive: true });
         rotateIfBig(VIOLATIONS_PATH);
         const full = { at: new Date().toISOString(), ...entry };
-        fs.appendFileSync(VIOLATIONS_PATH, JSON.stringify(full) + '\n');
+        fs.appendFileSync(VIOLATIONS_PATH, `${JSON.stringify(full)}\n`);
     }
     catch (e) {
         // best-effort, 실패 시 debug 로그 (silent swallow 방지)
@@ -76,7 +76,7 @@ export function recordBypass(entry) {
         fs.mkdirSync(ENFORCEMENT_DIR, { recursive: true });
         rotateIfBig(BYPASS_PATH);
         const full = { at: new Date().toISOString(), ...entry };
-        fs.appendFileSync(BYPASS_PATH, JSON.stringify(full) + '\n');
+        fs.appendFileSync(BYPASS_PATH, `${JSON.stringify(full)}\n`);
     }
     catch (e) {
         if (process.env.FORGEN_DEBUG_SIGNALS === '1') {

package/dist/engine/lifecycle/trigger-t1-correction.js

@@ -39,7 +39,7 @@ function matchesRule(evidence, rule) {
         .toLowerCase();
     return keyTokens.some((t) => {
         const tokLower = t.toLowerCase();
-        return summaryLower.includes(tokLower) || (targetToken && targetToken.includes(tokLower));
+        return summaryLower.includes(tokLower) || (targetToken?.includes(tokLower));
     });
 }
 export function detect(input) {

package/dist/engine/solution-candidate.js

@@ -100,7 +100,7 @@ export function rollbackSince(epochMs) {
                 continue;
             try {
                 fs.mkdirSync(archiveDir, { recursive: true });
-                const destName = path.basename(dir) + '__' + file;
+                const destName = `${path.basename(dir)}__${file}`;
                 fs.renameSync(filePath, path.join(archiveDir, destName));
                 archived.push(filePath);
             }

package/dist/engine/solution-outcomes.js

@@ -30,7 +30,7 @@ function writePending(sessionId, state) {
 }
 function appendOutcome(event) {
     fs.mkdirSync(OUTCOMES_DIR, { recursive: true });
-    fs.appendFileSync(outcomesPath(event.session_id), JSON.stringify(event) + '\n');
+    fs.appendFileSync(outcomesPath(event.session_id), `${JSON.stringify(event)}\n`);
 }
 /**
  * Run a read-modify-write pending-state mutation under a file lock

package/dist/engine/solution-quarantine.js

@@ -49,7 +49,7 @@ export function recordQuarantine(filePath, errors) {
             at: new Date().toISOString(),
             errors,
         };
-        fs.appendFileSync(SOLUTION_QUARANTINE_PATH, JSON.stringify(entry) + '\n');
+        fs.appendFileSync(SOLUTION_QUARANTINE_PATH, `${JSON.stringify(entry)}\n`);
     }
     catch (e) {
         log.debug(`quarantine write failed: ${e instanceof Error ? e.message : String(e)}`);

package/dist/engine/solution-weakness.js

@@ -97,14 +97,20 @@ function findConflictClusters(rows, fitnessByName) {
     const underperformers = rows.filter((r) => fitnessByName.get(r.name)?.state === 'underperform');
     const clusters = [];
     for (const ch of champions) {
+        const chFitness = fitnessByName.get(ch.name)?.fitness;
+        if (chFitness === undefined)
+            continue;
         for (const up of underperformers) {
+            const upFitness = fitnessByName.get(up.name)?.fitness;
+            if (upFitness === undefined)
+                continue;
             const shared = ch.tags.filter((t) => up.tags.includes(t));
             if (shared.length < 2)
                 continue;
             clusters.push({
                 shared_tags: shared,
-                champion: { name: ch.name, fitness: fitnessByName.get(ch.name).fitness },
-                underperform: { name: up.name, fitness: fitnessByName.get(up.name).fitness },
+                champion: { name: ch.name, fitness: chFitness },
+                underperform: { name: up.name, fitness: upFitness },
             });
         }
     }

package/dist/fgx.js

@@ -11,9 +11,10 @@ const args = process.argv.slice(2);
 // 이미 포함되어 있으면 중복 추가하지 않음
 const launchContext = resolveLaunchContext(args);
 const runtime = launchContext.runtime;
+const skipFlag = getHostRuntime(runtime).dangerousSkipFlag;
 const launchArgs = [...launchContext.args];
-if (!launchArgs.includes('--dangerously-skip-permissions')) {
-    launchArgs.unshift('--dangerously-skip-permissions');
+if (!launchArgs.includes(skipFlag)) {
+    launchArgs.unshift(skipFlag);
 }
 async function main() {
     // Security warning — fgx bypasses all Claude Code permission checks.
@@ -23,8 +24,8 @@ async function main() {
     // alias `fgx` unknowingly run with zero guardrails. Users who rely on
     // the profile trust policy should NOT use `fgx`. Surface the mismatch
     // loudly (harness.ts also prints the Trust 상승 warning downstream).
-    console.warn('\n  ⚠  fgx: ALL permission checks are disabled (--dangerously-skip-permissions)');
-    console.warn('  ⚠  Claude Code will execute tools without asking for confirmation.');
+    console.warn(`\n  ⚠  fgx: ALL permission checks are disabled (${skipFlag})`);
+    console.warn(`  ⚠  ${getHostRuntime(runtime).displayName} will execute tools without asking for confirmation.`);
     console.warn('  ⚠  Use only in trusted environments. If your profile trust policy is');
     console.warn('  ⚠  "가드레일 우선" or "승인 완화", consider `forgen` (no flag) instead.\n');
     // fgx는 서브커맨드 없이 바로 Claude Code 실행 전용
@@ -43,7 +44,7 @@ async function main() {
     if (v1.session) {
         console.log(`[forgen] Trust: ${v1.session.effective_trust_policy}`);
     }
-    console.log('[forgen] Mode: dangerously-skip-permissions');
+    console.log(`[forgen] Mode: ${skipFlag.replace(/^--/, '')}`);
     const runtimeLabel = getHostRuntime(runtime).displayName;
     console.log(`[forgen] Starting ${runtimeLabel}...\n`);
     await spawnClaude(launchArgs, context, runtime);

package/dist/forge/cli.js

@@ -39,7 +39,7 @@ function handleShowProfile() {
         console.log('\n  No v1 profile found. Run `forgen forge` or `forgen onboarding`.\n');
         return;
     }
-    console.log('\n' + renderProfile(profile) + '\n');
+    console.log(`\n${renderProfile(profile)}\n`);
 }
 function handleExport() {
     const profile = loadProfile();

package/dist/hooks/keyword-detector.js

@@ -192,7 +192,7 @@ async function main() {
             return;
         }
         const match = detectKeyword(input.prompt);
-        const sessionId = input.session_id ?? 'unknown';
+        const _sessionId = input.session_id ?? 'unknown';
         // v1: regex 기반 prompt 학습 제거. Evidence 기반으로 전환됨.
         if (!match) {
             console.log(approve());

package/dist/hooks/secret-filter.js

@@ -34,10 +34,10 @@ export function redactSecrets(text) {
     let out = text;
     for (const sp of SECRET_PATTERNS) {
         // regex 복제 (global flag 없이 repeated test 되는 경우 lastIndex 안전)
-        const re = new RegExp(sp.pattern.source, (sp.pattern.flags.includes('g') ? sp.pattern.flags : sp.pattern.flags + 'g'));
+        const re = new RegExp(sp.pattern.source, (sp.pattern.flags.includes('g') ? sp.pattern.flags : `${sp.pattern.flags}g`));
         if (re.test(out)) {
             hits.push(sp);
-            const re2 = new RegExp(sp.pattern.source, (sp.pattern.flags.includes('g') ? sp.pattern.flags : sp.pattern.flags + 'g'));
+            const re2 = new RegExp(sp.pattern.source, (sp.pattern.flags.includes('g') ? sp.pattern.flags : `${sp.pattern.flags}g`));
             out = out.replace(re2, `[REDACTED:${sp.name}]`);
         }
     }

package/dist/hooks/shared/hook-response.js

@@ -146,7 +146,7 @@ export function failOpenWithTracking(hookName, err) {
             }
         }
         const entry = JSON.stringify(payload);
-        fs.appendFileSync(logPath, entry + '\n');
+        fs.appendFileSync(logPath, `${entry}\n`);
     }
     catch { /* fail-open: tracking itself must not throw */ }
     return JSON.stringify({ continue: true });

package/dist/hooks/shared/hook-timing.js

@@ -19,7 +19,7 @@ export function recordHookTiming(hookName, durationMs, event) {
     try {
         fs.mkdirSync(STATE_DIR, { recursive: true });
         const entry = JSON.stringify({ hook: hookName, ms: durationMs, event, at: Date.now() });
-        fs.appendFileSync(TIMING_LOG, entry + '\n');
+        fs.appendFileSync(TIMING_LOG, `${entry}\n`);
         // Rotate if too large — size-gated (statSync only, skip read/write 대부분의 호출)
         try {
             const size = fs.statSync(TIMING_LOG).size;
@@ -28,7 +28,7 @@ export function recordHookTiming(hookName, durationMs, event) {
             const content = fs.readFileSync(TIMING_LOG, 'utf-8');
             const lines = content.trim().split('\n');
             if (lines.length > MAX_LINES) {
-                fs.writeFileSync(TIMING_LOG, lines.slice(-MAX_LINES).join('\n') + '\n');
+                fs.writeFileSync(TIMING_LOG, `${lines.slice(-MAX_LINES).join('\n')}\n`);
             }
         }
         catch { /* skip rotation on error */ }
@@ -52,7 +52,7 @@ export function getTimingStats() {
         for (const e of entries) {
             if (!byHook.has(e.hook))
                 byHook.set(e.hook, []);
-            byHook.get(e.hook).push(e.ms);
+            byHook.get(e.hook)?.push(e.ms);
         }
         const stats = [];
         for (const [hook, times] of byHook) {

package/dist/hooks/solution-injector.js

@@ -409,7 +409,7 @@ async function main() {
                         .filter(l => l.length > 0);
                     contentSnippet = lines.slice(0, 3).join('\n');
                     if (contentSnippet.length > SUMMARY_MAX_CHARS) {
-                        contentSnippet = contentSnippet.slice(0, SUMMARY_MAX_CHARS - 3) + '...';
+                        contentSnippet = `${contentSnippet.slice(0, SUMMARY_MAX_CHARS - 3)}...`;
                     }
                 }
             }

package/dist/hooks/stop-guard.js

@@ -370,14 +370,14 @@ export function acknowledgeSessionBlocks(sessionId) {
             try {
                 fs.mkdirSync(path.dirname(ACK_LOG), { recursive: true });
                 rotateIfBig(ACK_LOG);
-                fs.appendFileSync(ACK_LOG, JSON.stringify({
+                fs.appendFileSync(ACK_LOG, `${JSON.stringify({
                     at: now,
                     session_id: state.sessionId,
                     rule_id: state.ruleId,
                     block_count: state.count,
                     first_block_at: state.firstBlockAt,
                     last_block_at: state.lastBlockAt,
-                }) + '\n');
+                })}\n`);
                 acked += 1;
             }
             catch { /* append failure: still try cleanup */ }
@@ -396,7 +396,7 @@ export function logDriftEvent(event) {
     try {
         fs.mkdirSync(path.dirname(DRIFT_LOG), { recursive: true });
         rotateIfBig(DRIFT_LOG);
-        fs.appendFileSync(DRIFT_LOG, JSON.stringify({ at: new Date().toISOString(), ...event }) + '\n');
+        fs.appendFileSync(DRIFT_LOG, `${JSON.stringify({ at: new Date().toISOString(), ...event })}\n`);
     }
     catch {
         // best-effort

package/dist/host/host-runtime.d.ts

@@ -33,5 +33,11 @@ export interface HostRuntime {
      *   - 'pre-baked-file': pkgRoot/hooks/hooks.json 읽고 ${CLAUDE_PLUGIN_ROOT} 치환 (Claude — 빌드 산출물 재사용)
      */
     readonly hookInjectionStrategy: 'generate' | 'pre-baked-file';
+    /**
+     * 권한 전수 우회용 CLI 플래그 (fgx 등 dangerously-skip 모드에서 사용).
+     * Claude: --dangerously-skip-permissions
+     * Codex:  --dangerously-bypass-approvals-and-sandbox
+     */
+    readonly dangerousSkipFlag: string;
 }
 export declare function getHostRuntime(runtime: RuntimeHost): HostRuntime;

package/dist/host/host-runtime.js

@@ -25,6 +25,7 @@ const claudeRuntime = {
         return args ? `node ${quoteArg(fullScript)} ${args}` : `node ${quoteArg(fullScript)}`;
     },
     hookInjectionStrategy: 'pre-baked-file',
+    dangerousSkipFlag: '--dangerously-skip-permissions',
 };
 const codexRuntime = {
     id: 'codex',
@@ -38,6 +39,7 @@ const codexRuntime = {
         return args ? `${base} ${args}` : base;
     },
     hookInjectionStrategy: 'generate',
+    dangerousSkipFlag: '--dangerously-bypass-approvals-and-sandbox',
 };
 const RUNTIMES = {
     claude: claudeRuntime,

package/dist/host/install-codex.js

@@ -202,7 +202,7 @@ function installCodexSkills(opts) {
     return { installed: count };
 }
 // ── P3-3: AGENTS.md inject ────────────────────────────────────────────
-function resolveAgentsMdPath(pkgRoot) {
+function resolveAgentsMdPath(_pkgRoot) {
     // Phase 3 critic fix: pkgRoot 기반 walk-up 은 `npm install -g` 시 시스템 디렉토리
     // (예: /usr/local/lib/node_modules/forgen) 에 fallback AGENTS.md 작성 위험.
     // *cwd 기반* 으로 변경 — 사용자 작업 디렉토리의 git root, 없으면 cwd 자체.

package/dist/host/install-orchestrator.js

@@ -12,6 +12,7 @@
  */
 import * as path from 'node:path';
 import * as readline from 'node:readline';
+import { fileURLToPath } from 'node:url';
 import { detectAvailableHosts } from '../core/host-detect.js';
 import { planClaudeInstall } from './install-claude.js';
 import { planCodexInstall } from './install-codex.js';
@@ -121,6 +122,6 @@ export function renderResult(result, dryRun) {
 }
 /** pkgRoot resolve from binary location (dist/cli.js → pkgRoot). */
 export function resolvePkgRootFromBinary(metaUrl) {
-    const here = path.dirname(new URL(metaUrl).pathname);
+    const here = path.dirname(fileURLToPath(metaUrl));
     return path.resolve(here, '..');
 }

package/dist/mcp/tools.js

@@ -239,7 +239,7 @@ export function registerTools(server) {
                     }],
             };
         }
-        catch (e) {
+        catch (_e) {
             return {
                 content: [{
                         type: 'text',

package/dist/preset/facet-catalog.js

@@ -29,8 +29,8 @@ export const COMMUNICATION_CENTROIDS = {
     '상세형': { verbosity: 0.85, structure: 0.80, teaching_bias: 0.80 },
 };
 // ── Defaults (backward compat) ──
-export const DEFAULT_JUDGMENT_FACETS = JUDGMENT_CENTROIDS['균형형'];
-export const DEFAULT_COMMUNICATION_FACETS = COMMUNICATION_CENTROIDS['균형형'];
+export const DEFAULT_JUDGMENT_FACETS = JUDGMENT_CENTROIDS.균형형;
+export const DEFAULT_COMMUNICATION_FACETS = COMMUNICATION_CENTROIDS.균형형;
 // ── Utilities ──
 export function qualityCentroid(pack) {
     return { ...QUALITY_CENTROIDS[pack] };

package/dist/renderer/rule-renderer.js

@@ -171,28 +171,28 @@ export function renderRules(rules, state, profile, ctx = DEFAULT_CONTEXT) {
     for (const name of SECTION_ORDER)
         sections.set(name, []);
     for (const rule of hardRules) {
-        sections.get('Must Not').push(ruleToText(rule));
+        sections.get('Must Not')?.push(ruleToText(rule));
     }
     for (const rule of otherRules) {
         const section = CATEGORY_TO_SECTION[rule.category] ?? 'Working Defaults';
-        sections.get(section).push(ruleToText(rule));
+        sections.get(section)?.push(ruleToText(rule));
     }
     // 5. trust policy + pack 기본 규칙 주입
     if (ctx.include_pack_summary) {
-        sections.get('Working Defaults').unshift(`Trust: ${trustPolicySummary(state.effective_trust_policy)}`);
+        sections.get('Working Defaults')?.unshift(`Trust: ${trustPolicySummary(state.effective_trust_policy)}`);
         // judgment pack 기본 규칙
         for (const rule of judgmentPackRules(state.judgment_pack)) {
-            sections.get('Working Defaults').push(rule);
+            sections.get('Working Defaults')?.push(rule);
         }
         // communication pack 기본 규칙
         for (const rule of communicationPackRules(state.communication_pack)) {
-            sections.get('How To Report').push(rule);
+            sections.get('How To Report')?.push(rule);
         }
         // 4축 facet 극단값 → 추가 규칙 (12-bucket pack 위에 연속 값 차별화).
         // 각 facet 0.5 default 이고 자동 갱신 ±0.1 단위이므로, 0.85/0.15 임계값은
         // 여러 세션에 걸친 강한 신호 누적 후에만 발화한다.
         for (const fr of facetDrivenRules(profile)) {
-            sections.get(fr.section).push(fr.rule);
+            sections.get(fr.section)?.push(fr.rule);
         }
     }
     // 6. 섹션 조립 (AI-optimized: 간결한 태그 형식)
@@ -200,7 +200,7 @@ export function renderRules(rules, state, profile, ctx = DEFAULT_CONTEXT) {
     let totalChars = 0;
     let totalRules = 0;
     for (const name of SECTION_ORDER) {
-        const items = sections.get(name);
+        const items = sections.get(name) ?? [];
         if (items.length === 0)
             continue;
         const header = `## ${name}`;

package/dist/store/compound-usage-store.js

@@ -27,7 +27,7 @@ export function recordUsage(name, via = 'mcp') {
     try {
         fs.mkdirSync(STATE_DIR, { recursive: true });
         const entry = { at: new Date().toISOString(), name, via };
-        fs.appendFileSync(COMPOUND_USAGE_LOG, JSON.stringify(entry) + '\n');
+        fs.appendFileSync(COMPOUND_USAGE_LOG, `${JSON.stringify(entry)}\n`);
     }
     catch {
         // fail-open: 신호 수집 실패가 사용자 경험을 방해하면 안 됨

package/dist/store/implicit-feedback-store.js

@@ -67,7 +67,7 @@ export function appendImplicitFeedback(entry) {
         return false;
     try {
         fs.mkdirSync(STATE_DIR, { recursive: true });
-        fs.appendFileSync(IMPLICIT_FEEDBACK_LOG, JSON.stringify(normalized) + '\n');
+        fs.appendFileSync(IMPLICIT_FEEDBACK_LOG, `${JSON.stringify(normalized)}\n`);
         return true;
     }
     catch {
@@ -147,7 +147,7 @@ export function migrateImplicitFeedbackLog() {
     }
     // atomic replace via temp file
     const tmp = `${IMPLICIT_FEEDBACK_LOG}.migrate.${process.pid}`;
-    fs.writeFileSync(tmp, out.length > 0 ? out.join('\n') + '\n' : '');
+    fs.writeFileSync(tmp, out.length > 0 ? `${out.join('\n')}\n` : '');
     fs.renameSync(tmp, IMPLICIT_FEEDBACK_LOG);
     return { migrated, dropped };
 }

package/dist/store/profile-store.d.ts

@@ -18,6 +18,17 @@ export declare function saveProfile(profile: Profile): void;
  * whether to run `runLegacyCutover`).
  */
 export declare function profileExists(): boolean;
+/**
+ * profile.json 이 존재하지만 parse 실패 / v1 shape 위반인 경우, 사용자가
+ * 다음 onboarding 으로 매끄럽게 복구되도록 corrupt 파일을 timestamp 백업
+ * 으로 옆에 치워둔다. 백업 경로를 반환.
+ *
+ * v0.4.8 — bootstrapV1Session 의 loadProfile()=null early-return 보강.
+ * 이전엔 needsOnboarding=true 만 반환했고 corrupt 파일이 그대로 남아
+ * 다음 실행 때도 동일 분기로 빠지면서 사용자가 정체 원인을 모른 채
+ * onboarding 안내만 반복 받는 패턴이었음.
+ */
+export declare function backupCorruptProfile(): string | null;
 export declare function isV1Profile(data: unknown): data is Profile;
 /**
  * D2 fix (2026-04-27): explicit_correction 누적 시 해당 축의 confidence 를 점진

package/dist/store/profile-store.js

@@ -66,6 +66,29 @@ export function saveProfile(profile) {
 export function profileExists() {
     return fs.existsSync(FORGE_PROFILE);
 }
+/**
+ * profile.json 이 존재하지만 parse 실패 / v1 shape 위반인 경우, 사용자가
+ * 다음 onboarding 으로 매끄럽게 복구되도록 corrupt 파일을 timestamp 백업
+ * 으로 옆에 치워둔다. 백업 경로를 반환.
+ *
+ * v0.4.8 — bootstrapV1Session 의 loadProfile()=null early-return 보강.
+ * 이전엔 needsOnboarding=true 만 반환했고 corrupt 파일이 그대로 남아
+ * 다음 실행 때도 동일 분기로 빠지면서 사용자가 정체 원인을 모른 채
+ * onboarding 안내만 반복 받는 패턴이었음.
+ */
+export function backupCorruptProfile() {
+    if (!fs.existsSync(FORGE_PROFILE))
+        return null;
+    const ts = new Date().toISOString().replace(/[:.]/g, '-');
+    const backupPath = `${FORGE_PROFILE}.corrupt-${ts}`;
+    try {
+        fs.renameSync(FORGE_PROFILE, backupPath);
+        return backupPath;
+    }
+    catch {
+        return null;
+    }
+}
 export function isV1Profile(data) {
     if (!data || typeof data !== 'object')
         return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wooojin/forgen",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "preferGlobal": true,
   "main": "dist/lib.js",
   "types": "./dist/lib.d.ts",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://claude.ai/schemas/claude-plugin.json",
   "name": "forgen",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "Claude Code harness — the more you use Claude, the better it gets",
   "author": {
     "name": "jang-ujin",