devflow-kit 1.8.2 → 2.0.0

package/src/assets/scripts/hooks/background-memory-update

@@ -0,0 +1,460 @@
+#!/bin/bash
+
+# background-memory-update — Eager working-memory refresh worker
+# Spawned as a detached background process by memory-worker (Stop hook) after the
+# 120s throttle expires. Drains .pending-turns.jsonl → calls `claude -p` (sonnet 4.6) →
+# rewrites WORKING-MEMORY.md with a git-reconciliation stamp on line 1.
+#
+# Applies ADR-008 (LLM-vs-plumbing): artifact content (WORKING-MEMORY.md) is
+# authored by the LLM; this script only does plumbing (lock, queue drain, spawn).
+# Avoids PF-006 (does NOT parse Stop hook JSON), PF-007 (edit source only).
+#
+# Usage: background-memory-update <CWD>
+#
+# Success:      removes .pending-turns.processing; touches .last-refresh-ok
+# Failure:      leaves .pending-turns.processing; this worker is the PRIMARY recovery owner —
+#               on its next spawn it merges leftover .processing back into the queue (lines ~141-156).
+#               session-start-memory's own cold-path recovery is the fallback for when this
+#               worker never re-spawns (e.g. memory disabled mid-flight, host offline); it applies a
+#               300s age gate before acting on .processing. No action needed here — the two paths
+#               are correctly separated by the lock boundary.
+# User-only:    truncates queue without LLM run (no fabrication)
+
+set -e
+
+# Re-entrancy guard: a nested memory-worker claude -p session (DEVFLOW_BG_UPDATER=1
+# in its env) fires Stop hooks on its own turns. If those hooks ever chain into
+# spawning this worker, bail out immediately rather than cascading a memory
+# refresh out of a nested worker session (belt-and-suspenders alongside the
+# equivalent guard in memory-worker, which is the intended sole spawn site).
+if [ "${DEVFLOW_BG_UPDATER:-}" = "1" ]; then
+  echo "background-memory-update: EXIT: bg_updater" >&2
+  exit 0
+fi
+
+CWD="$1"
+if [ -z "$CWD" ] || [ ! -d "$CWD" ]; then
+  echo "background-memory-update: CWD missing or not a directory: '$CWD'" >&2
+  exit 1
+fi
+
+# Resolve SCRIPT_DIR early — needed for sourcing helpers
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+# Source JSON parsing helpers (jq with node fallback)
+source "$SCRIPT_DIR/json-parse" || { echo "background-memory-update: failed to source json-parse" >&2; exit 1; }
+
+# Source hook-log-init for log() and size guard (requires $SCRIPT_DIR and $CWD, both set above;
+# does NOT pull in hook-bootstrap so the detached-worker invariant is preserved)
+source "$SCRIPT_DIR/hook-log-init" "background-memory-update" \
+  || { echo "background-memory-update: failed to source hook-log-init" >&2; exit 1; }
+
+# Source get-mtime for mtime comparisons
+source "$SCRIPT_DIR/get-mtime" || { echo "background-memory-update: failed to source get-mtime" >&2; exit 1; }
+
+log "Starting (CWD=$CWD)"
+
+# --- Resolve paths ---
+# Anchor .devflow/ to the project root (prevents a stray nested .devflow/ when the
+# worker is spawned with a CWD inside .devflow/...). Empty → fall back to CWD.
+source "$SCRIPT_DIR/resolve-project-root" 2>/dev/null || true
+PROJECT_ROOT="$(df_resolve_root "$CWD" 2>/dev/null || true)"
+[ -n "$PROJECT_ROOT" ] || PROJECT_ROOT="$CWD"
+DEVFLOW_DIR="$PROJECT_ROOT/.devflow"
+MEMORY_DIR="$DEVFLOW_DIR/memory"
+QUEUE_FILE="$MEMORY_DIR/.pending-turns.jsonl"
+PROCESSING_FILE="$MEMORY_DIR/.pending-turns.processing"
+MEMORY_FILE="$MEMORY_DIR/WORKING-MEMORY.md"
+LOCK_DIR="$MEMORY_DIR/.working-memory.lock"
+TRIGGER_FILE="$MEMORY_DIR/.working-memory-last-trigger"
+OK_FILE="$MEMORY_DIR/.last-refresh-ok"
+FEATURE_CONFIG="$DEVFLOW_DIR/config.json"
+
+# --- Re-check memory:false at runtime (defense-in-depth: feature may be disabled since spawn) ---
+if [ -f "$FEATURE_CONFIG" ]; then
+  _MEM_ENABLED=$(json_field_file "$FEATURE_CONFIG" "memory" "true")
+  if [ "$_MEM_ENABLED" = "false" ]; then
+    log "ABORT: memory disabled in feature config (disabled after spawn)"
+    exit 0
+  fi
+fi
+
+# --- Resolve claude binary ---
+CLAUDE_BIN=$(command -v claude 2>/dev/null || true)
+if [ -z "$CLAUDE_BIN" ]; then
+  log "SKIP: claude binary not found on PATH"
+  exit 0
+fi
+
+# --- Worker-level lock (300s stale-break — much longer than learning-lock's 30s) ---
+# This prevents a second worker (spawned 121s later) from double-writing WORKING-MEMORY.md
+# while the first worker's claude -p call (up to 120s) is still in flight.
+#
+# INVARIANT: STALE_THRESHOLD (300s) must always exceed the watchdog total in-flight time
+# (WATCHDOG_SECS + WATCHDOG_KILL_GRACE_SECS = 120+5 = 125s, plus margin).
+# A live worker holding the lock will have been watchdog-killed within ~125s, so a
+# 300s stale-break is safe-by-construction. If either bound is raised, this invariant
+# MUST be re-verified: STALE_THRESHOLD > WATCHDOG_SECS + WATCHDOG_KILL_GRACE_SECS + margin.
+
+STALE_THRESHOLD=300  # 5 minutes
+
+break_stale_lock() {
+  if [ ! -d "$LOCK_DIR" ]; then return; fi
+  local _lock_mtime _now _age
+  _lock_mtime=$(get_mtime "$LOCK_DIR")
+  _now=$(date +%s)
+  _age=$(( _now - _lock_mtime ))
+  if [ "$_age" -gt "$STALE_THRESHOLD" ]; then
+    log "Breaking stale worker lock (age: ${_age}s, threshold: ${STALE_THRESHOLD}s)"
+    rmdir "$LOCK_DIR" 2>/dev/null || true
+  fi
+}
+
+acquire_lock() {
+  local _timeout=90  # < WATCHDOG_SECS (120): waiter gives up before the holder's own watchdog fires; queue is preserved for next spawn
+  local _waited=0
+  while ! mkdir "$LOCK_DIR" 2>/dev/null; do
+    if [ "$_waited" -ge "$_timeout" ]; then
+      return 1
+    fi
+    sleep 1
+    _waited=$(( _waited + 1 ))
+  done
+  return 0
+}
+
+cleanup_lock() {
+  rmdir "$LOCK_DIR" 2>/dev/null || true
+}
+trap cleanup_lock EXIT
+
+break_stale_lock
+
+if ! acquire_lock; then
+  log "SKIP: lock timeout after 90s — another worker is running"
+  trap - EXIT
+  exit 0
+fi
+
+# --- Orphan-only auto-clean: if queue has no assistant/qa turn, truncate and exit ---
+# This prevents fabrication-prone LLM runs with only user turns in the queue.
+# A qa row (captured Q&A pair) counts as content-bearing here too — it carries
+# the same synthesis-worthy signal as an assistant turn (AC-F10). This check
+# and the TURNS_TEXT extraction loop below must agree on that.
+# When neither jq nor node is available (_JSON_AVAILABLE=false) we skip the check
+# and allow the run to proceed — conservative: better to attempt than to truncate blindly.
+if [ -f "$QUEUE_FILE" ] && [ -s "$QUEUE_FILE" ] && [ "$_JSON_AVAILABLE" = "true" ]; then
+  if [ "$_HAS_JQ" = "true" ]; then
+    _HAS_CONTENT=$(jq -r 'select(.role=="assistant" or .role=="qa") | .role' "$QUEUE_FILE" 2>/dev/null | head -1 || echo "")
+  else
+    # SECURITY: pass path via argv, never interpolate into node -e source (avoids shell injection
+    # for repo paths containing quotes or special characters — applies ADR-008 plumbing principle)
+    _HAS_CONTENT=$(node -e '
+      const f = process.argv[1];
+      const lines = require("fs").readFileSync(f, "utf8").split("\n");
+      for (const l of lines) {
+        try { const o = JSON.parse(l); if (o.role === "assistant" || o.role === "qa") { process.stdout.write(o.role); break; } } catch {}
+      }
+    ' "$QUEUE_FILE" 2>/dev/null || echo "")
+  fi
+  if [ -z "$_HAS_CONTENT" ]; then
+    log "User-only queue (no assistant/qa turn) — truncating without LLM run"
+    rm -f "$QUEUE_FILE" 2>/dev/null || true
+    exit 0
+  fi
+fi
+
+# --- Claim queue atomically (D56c contract: .pending-turns.processing recovered at SessionStart) ---
+# If a leftover .processing exists from a previous crash, merge new queue entries into it.
+if [ -f "$PROCESSING_FILE" ]; then
+  log "Found leftover .processing from previous crash — merging"
+  if [ -f "$QUEUE_FILE" ]; then
+    cat "$QUEUE_FILE" >> "$PROCESSING_FILE" 2>/dev/null || true
+    rm -f "$QUEUE_FILE" 2>/dev/null || true
+    log "Merged new queue entries into recovery batch"
+  fi
+  # Cap to prevent unbounded growth
+  PROC_OVERFLOW_CAP=200    # truncate when processing file exceeds this many lines
+  PROC_OVERFLOW_TARGET=100 # keep only the newest N lines after truncation
+  _PROC_LINES=$(wc -l < "$PROCESSING_FILE" | tr -d ' ')
+  if [ "$_PROC_LINES" -gt "$PROC_OVERFLOW_CAP" ]; then
+    _PROC_TMP="$PROCESSING_FILE.tmp.$$"
+    tail -"$PROC_OVERFLOW_TARGET" "$PROCESSING_FILE" > "$_PROC_TMP" && mv "$_PROC_TMP" "$PROCESSING_FILE" || rm -f "$_PROC_TMP" 2>/dev/null || true
+    log "Processing overflow: truncated from $_PROC_LINES to $PROC_OVERFLOW_TARGET lines"
+  fi
+elif [ -f "$QUEUE_FILE" ]; then
+  mv "$QUEUE_FILE" "$PROCESSING_FILE" 2>/dev/null || { log "SKIP: failed to claim queue (race condition — another worker got it)"; exit 0; }
+else
+  log "SKIP: no queue file to process"
+  exit 0
+fi
+
+TOTAL_LINES=$(wc -l < "$PROCESSING_FILE" | tr -d ' ')
+log "Processing $TOTAL_LINES queued entries"
+
+if [ "$TOTAL_LINES" -eq 0 ]; then
+  rm -f "$PROCESSING_FILE" 2>/dev/null || true
+  log "Processing file empty — skipping"
+  exit 0
+fi
+
+# --- Build last-10 turns from queue ---
+MAX_TURNS=10
+MAX_LINES=$(( MAX_TURNS * 2 ))
+if [ "$TOTAL_LINES" -gt "$MAX_LINES" ]; then
+  ENTRIES=$(tail -"$MAX_LINES" "$PROCESSING_FILE")
+  log "Capped to last $MAX_LINES entries (from $TOTAL_LINES)"
+else
+  ENTRIES=$(cat "$PROCESSING_FILE")
+fi
+
+# Single-pass extraction: role + content as TSV (newlines collapsed)
+# When neither jq nor node is available, EXTRACTED stays empty and TURN_COUNT will be 0 → early exit.
+if [ "$_HAS_JQ" = "true" ]; then
+  EXTRACTED=$(printf '%s\n' "$ENTRIES" | jq -r '(.role // "") + "\t" + ((.content // "") | gsub("\n"; " "))' 2>/dev/null || echo "")
+elif [ "$_HAS_NODE" = "true" ]; then
+  EXTRACTED=$(printf '%s\n' "$ENTRIES" | node -e '
+    const lines = require("fs").readFileSync("/dev/stdin","utf8").split("\n");
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      try {
+        const obj = JSON.parse(line);
+        const role = obj.role || "";
+        const content = (obj.content || "").replace(/\n/g, " ");
+        process.stdout.write(role + "\t" + content + "\n");
+      } catch {}
+    }
+  ' 2>/dev/null || echo "")
+else
+  EXTRACTED=""
+fi
+
+TURNS_TEXT=""
+TURN_COUNT=0
+CURRENT_USER=""
+
+# FLUSH INVARIANT: a pending user turn (buffered in CURRENT_USER) is flushed in three cases:
+# (1) the next user row arrives — emit user-only stanza, replace buffer; (2) an assistant row
+# arrives — emit paired user+assistant stanza, clear buffer; (3) EOF — trailing flush block below.
+while IFS=$'\t' read -r ROLE CONTENT; do
+  [ -z "$ROLE" ] && continue
+  if [ "$ROLE" = "user" ]; then
+    if [ -n "$CURRENT_USER" ]; then
+      TURN_COUNT=$(( TURN_COUNT + 1 ))
+      TURNS_TEXT="${TURNS_TEXT}
+Turn ${TURN_COUNT}:
+User: ${CURRENT_USER}
+"
+    fi
+    CURRENT_USER="$CONTENT"
+  elif [ "$ROLE" = "assistant" ]; then
+    TURN_COUNT=$(( TURN_COUNT + 1 ))
+    if [ -n "$CURRENT_USER" ]; then
+      TURNS_TEXT="${TURNS_TEXT}
+Turn ${TURN_COUNT}:
+User: ${CURRENT_USER}
+Assistant: ${CONTENT}
+"
+      CURRENT_USER=""
+    else
+      TURNS_TEXT="${TURNS_TEXT}
+Turn ${TURN_COUNT}:
+Assistant: ${CONTENT}
+"
+    fi
+  elif [ "$ROLE" = "qa" ]; then
+    # Captured AskUserQuestion Q&A pair — a self-contained stanza, not paired
+    # with CURRENT_USER (a qa row can arrive mid-turn, between a user prompt
+    # and its eventual assistant reply; leave CURRENT_USER buffered untouched).
+    TURN_COUNT=$(( TURN_COUNT + 1 ))
+    TURNS_TEXT="${TURNS_TEXT}
+Turn ${TURN_COUNT}:
+Q&A: ${CONTENT}
+"
+  fi
+done <<EOF
+$EXTRACTED
+EOF
+
+if [ -n "$CURRENT_USER" ]; then
+  TURN_COUNT=$(( TURN_COUNT + 1 ))
+  TURNS_TEXT="${TURNS_TEXT}
+Turn ${TURN_COUNT}:
+User: ${CURRENT_USER}
+"
+fi
+
+if [ "$TURN_COUNT" -eq 0 ]; then
+  rm -f "$PROCESSING_FILE" 2>/dev/null || true
+  log "No parseable turns — skipping"
+  exit 0
+fi
+
+log "Built $TURN_COUNT turns from queue"
+
+# --- Read existing memory ---
+EXISTING_MEMORY=""
+PRE_UPDATE_MTIME=0
+MEMORY_READ_LIMIT=65536  # bytes — keep prompt under context limit
+if [ -f "$MEMORY_FILE" ]; then
+  EXISTING_MEMORY=$(head -c "$MEMORY_READ_LIMIT" "$MEMORY_FILE")
+  PRE_UPDATE_MTIME=$(get_mtime "$MEMORY_FILE")
+fi
+
+# --- Gather git state + HEAD SHA for stamp ---
+HEAD_SHA=""
+BRANCH=""
+GIT_STATE=""
+if cd "$CWD" 2>/dev/null && git rev-parse --git-dir >/dev/null 2>&1; then
+  HEAD_SHA=$(git rev-parse HEAD 2>/dev/null || echo "")
+  BRANCH=$(git branch --show-current 2>/dev/null || echo "")
+  GIT_STATUS=$(git status --short 2>/dev/null | head -20)
+  GIT_LOG=$(git log --oneline -5 2>/dev/null || echo "")
+  GIT_DIFF=$(git diff --stat HEAD 2>/dev/null | tail -10)
+  GIT_STATE="Branch: ${BRANCH}
+HEAD: ${HEAD_SHA}
+Recent commits:
+${GIT_LOG}
+Changed files:
+${GIT_STATUS}
+Diff summary:
+${GIT_DIFF}"
+fi
+
+# --- Build prompt (passed via STDIN, not argv — turn content may hold secrets) ---
+# SECURITY: argv is visible to ps(1); all user/assistant content goes via stdin.
+PROMPT="You are a working memory updater. Your ONLY job is to update the file at ${MEMORY_FILE} using the Write tool. Do it immediately — do not ask questions or explain.
+
+CRITICAL: Write EXACTLY this as line 1 of the file (verbatim substituting the values):
+<!-- memory-head: ${HEAD_SHA:-unknown} branch: ${BRANCH:-unknown} -->
+
+Current working memory (existing content — integrate, don't discard):
+${EXISTING_MEMORY:-"(no existing content)"}
+
+Recent session turns to synthesize:
+${TURNS_TEXT}
+
+Git state:
+${GIT_STATE:-"(not a git repo or no git state)"}
+
+Instructions:
+- Write the file ${MEMORY_FILE} NOW using the Write tool
+- Line 1 MUST be: <!-- memory-head: ${HEAD_SHA:-unknown} branch: ${BRANCH:-unknown} -->
+- Keep under 120 lines total
+- Required sections: ## Now, ## Progress, ## Decisions, ## Context, ## Session Log
+- Synthesize from the queue turns — NEVER fabricate or invent context
+- Integrate new information with existing content; deduplicate overlapping information
+- ## Progress tracks Done (fully completed — see the strict definition below), Remaining (next steps / in-progress work), Blockers (if any)
+- DEFINITION OF DONE — mark a task \"Done\" ONLY when its work has landed on the main/default branch AND been published/released to production. Writing code, committing, opening a PR, or passing CI is NOT done. Even a merged PR is NOT done until it is on main AND shipped to production.
+- A feature being implemented does NOT make it done — testing, code review, resolving review feedback, release prep, and publishing are still Remaining work. Until a task is truly done, keep it under Remaining with its real current stage (e.g. \"implemented — awaiting review\", \"merged to main — not yet released\").
+- Only record a completed state (PR merged, CI passed, released, task done) when the session turns or git state actually evidence it. Never assume, predict, or upgrade a status; when unsure, describe the last confirmed state rather than an optimistic one.
+- ## Decisions entries: format as - **[Decision]** — [rationale] (YYYY-MM-DD) [ACTIVE|SUPERSEDED]
+- If queue is empty, preserve existing content as-is (still write line 1 stamp)"
+
+log "Spawning claude -p (model claude-sonnet-4-6, ${TURN_COUNT} turns)"
+# SECURITY: never log PROMPT — it contains turn content which may include secrets
+
+# --- Watchdog timeout (overridable for tests: DEVFLOW_BG_WATCHDOG_SECS=2) ---
+WATCHDOG_SECS="${DEVFLOW_BG_WATCHDOG_SECS:-120}"
+WATCHDOG_KILL_GRACE_SECS=5  # grace period between SIGTERM and SIGKILL
+
+# NASA/JPL Rule 5 — runtime assertion: STALE_THRESHOLD must exceed the watchdog's
+# total in-flight time so that break_stale_lock and session-start-memory's cold-path
+# recovery can never evict a still-live worker.  If DEVFLOW_BG_WATCHDOG_SECS is raised above
+# 294 (leaving < 1s margin), this will fail loudly rather than silently corrupt the
+# safety guarantee.  Checked before spawning claude so a bad override is caught early.
+# avoids PF-011
+_WATCHDOG_TOTAL=$(( WATCHDOG_SECS + WATCHDOG_KILL_GRACE_SECS ))
+if [ "$STALE_THRESHOLD" -le "$_WATCHDOG_TOTAL" ]; then
+  echo "[background-memory-update] FATAL: STALE_THRESHOLD ($STALE_THRESHOLD) must exceed watchdog total (${WATCHDOG_SECS}+${WATCHDOG_KILL_GRACE_SECS}=${_WATCHDOG_TOTAL})" >&2
+  exit 1
+fi
+
+# --- Run claude -p with watchdog ---
+# D37: Enable job control (set -m) only around the spawn so bash gives claude its OWN
+# process group (PGID == CLAUDE_PID) even in this non-interactive script.  Without
+# set -m the background child inherits the worker's process group and the watchdog
+# kill -TERM -"$CLAUDE_PID" would also kill the worker itself (self-kill bug).
+# Restore set +m immediately after capturing CLAUDE_PID so the watchdog subshell and
+# other subsequent background operations stay in the worker's group.
+# Job-control notifications go to stderr which is redirected to the log — suppress them.
+set -m
+DEVFLOW_BG_UPDATER=1 "$CLAUDE_BIN" -p \
+  --model claude-sonnet-4-6 \
+  --dangerously-skip-permissions \
+  --allowedTools 'Read,Write' \
+  --output-format text \
+  <<< "$PROMPT" \
+  >> "$LOG_FILE" 2>&1 &
+CLAUDE_PID=$!
+set +m
+
+# Watchdog: after WATCHDOG_SECS send SIGTERM to claude's process group (PGID == CLAUDE_PID
+# because set -m made it a group leader), then SIGKILL after WATCHDOG_KILL_GRACE_SECS.
+# Using -PGID (negative PID) kills claude's entire subtree so children it spawned
+# are also terminated — the worker itself is NOT in that group (set +m restored above).
+# Cancel watchdog immediately after claude exits to avoid hitting a recycled PID.
+(
+  sleep "$WATCHDOG_SECS"
+  kill -TERM -"$CLAUDE_PID" 2>/dev/null || true
+  sleep "$WATCHDOG_KILL_GRACE_SECS"
+  kill -KILL -"$CLAUDE_PID" 2>/dev/null || true
+) &
+WD_PID=$!
+
+if wait "$CLAUDE_PID" 2>/dev/null; then
+  CLAUDE_EXIT=0
+else
+  CLAUDE_EXIT=$?
+fi
+
+# Cancel watchdog (avoids stray kill hitting a recycled PID after this process exits)
+kill "$WD_PID" 2>/dev/null || true
+wait "$WD_PID" 2>/dev/null || true
+
+if [ "$CLAUDE_EXIT" -gt 128 ]; then
+  log "FAIL: claude -p killed by watchdog after ${WATCHDOG_SECS}s"
+  # Leave .processing for crash recovery (session-start-memory's D56c cold path).
+  # Retry-count ceiling: this worker is rate-bounded to one spawn per 120s by memory-worker's
+  # throttle (.working-memory-last-trigger mtime). Persistent failure is surfaced to the user
+  # via session-start-memory State C (stale .last-refresh-ok) rather than a retry counter here,
+  # keeping this plumbing script simple (applies ADR-008).
+  exit 0
+elif [ "$CLAUDE_EXIT" -ne 0 ]; then
+  log "FAIL: claude -p exited with code $CLAUDE_EXIT"
+  # Leave .processing for crash recovery (see same rate-bound note above)
+  exit 0
+fi
+
+# --- Verify success: mtime changed AND first-line stamp present ---
+UPDATED="false"
+if [ -f "$MEMORY_FILE" ]; then
+  NEW_MTIME=$(get_mtime "$MEMORY_FILE")
+  if [ "$NEW_MTIME" -gt "$PRE_UPDATE_MTIME" ]; then
+    FIRST_LINE=$(head -1 "$MEMORY_FILE" 2>/dev/null || echo "")
+    case "$FIRST_LINE" in
+      "<!-- memory-head:"*)
+        UPDATED="true"
+        log "Update verified (mtime changed, stamp present)"
+        ;;
+      *)
+        log "WARN: mtime changed but stamp missing on line 1 — treating as failure"
+        ;;
+    esac
+  else
+    log "WARN: memory file not modified (Write tool may have failed)"
+  fi
+else
+  log "WARN: memory file does not exist after claude -p run"
+fi
+
+if [ "$UPDATED" = "true" ]; then
+  rm -f "$PROCESSING_FILE" 2>/dev/null || true
+  touch "$OK_FILE" 2>/dev/null || true
+  log "SUCCESS: queue drained, .last-refresh-ok touched"
+else
+  # Leave .processing for session-start-memory's D56c cold path; do NOT touch .last-refresh-ok
+  log "FAIL: verification failed — leaving .processing for recovery"
+fi
+
+exit 0

package/src/assets/scripts/hooks/capture-prompt

@@ -0,0 +1,87 @@
+#!/bin/bash
+
+# Learning System: capture-prompt (UserPromptSubmit Hook)
+# Dual-append: writes the user turn to BOTH the memory queue and the learning
+# queue, each independently gated by its own feature flag (AC-F4). Delegates
+# the actual JSONL-write logic to the shared queue-append helper rather than
+# duplicating it inline.
+
+# Safe no-op fallback: must exist before set -e and before hook-bootstrap is sourced.
+dbg() { :; }
+
+set -e
+
+# Feedback-loop guard -- before hook-bootstrap to minimize background session
+# overhead. The memory worker's own claude -p session fires
+# UserPromptSubmit-adjacent hooks on its nested turns; bail out immediately
+# rather than double-capturing a background session's own prompts.
+if [ "${DEVFLOW_BG_UPDATER:-}" = "1" ]; then dbg "EXIT: bg_updater"; exit 0; fi
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+source "$SCRIPT_DIR/hook-bootstrap" "capture-prompt"
+
+source "$SCRIPT_DIR/json-parse" || { echo "capture-prompt: failed to source json-parse" >&2; exit 1; }
+if [ "$_JSON_AVAILABLE" = "false" ]; then dbg "EXIT: no json"; exit 0; fi
+
+INPUT=$(cat)
+
+FIELDS=$(printf '%s' "$INPUT" | json_extract_cwd_prompt)
+CWD="${FIELDS%%$'\001'*}"
+PROMPT="${FIELDS#*$'\001'}"
+
+dbg "CWD=$CWD PROMPT_LENGTH=${#PROMPT}"
+
+if [ -z "$CWD" ] || [ ! -d "$CWD" ]; then dbg "EXIT: bad CWD"; exit 0; fi
+
+devflow_debug_set_cwd "$CWD"
+
+# Anchor .devflow/ to the project root (prevents a stray nested .devflow/ when this
+# hook runs with a CWD inside .devflow/...). Empty → fall back to CWD.
+source "$SCRIPT_DIR/resolve-project-root" 2>/dev/null || true
+PROJECT_ROOT="$(df_resolve_root "$CWD" 2>/dev/null || true)"
+[ -n "$PROJECT_ROOT" ] || PROJECT_ROOT="$CWD"
+
+DEVFLOW_DIR="$PROJECT_ROOT/.devflow"
+MEMORY_DIR="$DEVFLOW_DIR/memory"
+LEARNING_DIR="$DEVFLOW_DIR/learning"
+
+if [ -z "$PROMPT" ]; then
+  dbg "EXIT: empty PROMPT"
+  exit 0
+fi
+
+source "$SCRIPT_DIR/queue-append" || { echo "capture-prompt: failed to source queue-append" >&2; exit 1; }
+
+# --- AC-P1: exactly ONE config-read fork, fetching both memory + learning fields ---
+queue_read_gates "$DEVFLOW_DIR/config.json"
+MEMORY_ENABLED="$_QG_MEMORY"
+LEARNING_ENABLED="$_QG_LEARNING"
+
+dbg "MEMORY_ENABLED=$MEMORY_ENABLED LEARNING_ENABLED=$LEARNING_ENABLED"
+
+if [ "$MEMORY_ENABLED" != "true" ] && [ "$LEARNING_ENABLED" != "true" ]; then
+  dbg "EXIT: both features disabled"
+  exit 0
+fi
+
+# Normal logging (only paid for once we know at least one feature is enabled)
+source "$SCRIPT_DIR/hook-log-init" "capture-prompt"
+
+# Auto-create .devflow/ and ensure .gitignore entries
+source "$SCRIPT_DIR/ensure-devflow-init" "$CWD" || exit 0
+
+source "$SCRIPT_DIR/get-mtime" || { echo "capture-prompt: failed to source get-mtime" >&2; exit 1; }
+source "$SCRIPT_DIR/learning-lock" || { echo "capture-prompt: failed to source learning-lock" >&2; exit 1; }
+
+mkdir -p "$MEMORY_DIR" "$LEARNING_DIR" 2>/dev/null || true
+
+TS=$(date +%s)
+queue_append_both \
+  "$MEMORY_DIR/.pending-turns.jsonl" "$LEARNING_DIR/.pending-turns.jsonl" \
+  "$MEMORY_ENABLED" "$LEARNING_ENABLED" \
+  "user" "$PROMPT" "$TS"
+
+log "Captured user turn (${#PROMPT} chars)"
+dbg "=== HOOK COMPLETE ==="
+exit 0