devflow-kit 2.2.0 → 2.3.0

package/src/assets/scripts/hooks/pre-compact-memory

@@ -23,6 +23,7 @@ source "$SCRIPT_DIR/hook-bootstrap" "pre-compact-memory"
 
 # JSON parsing (jq with node fallback) — silently no-op if neither available
 source "$SCRIPT_DIR/json-parse" || { echo "pre-compact-memory: failed to source json-parse" >&2; exit 1; }
+source "$SCRIPT_DIR/is-hex-sha" || { echo "pre-compact-memory: failed to source is-hex-sha" >&2; exit 1; }
 if [ "$_JSON_AVAILABLE" = "false" ]; then exit 0; fi
 
 INPUT=$(cat)
@@ -64,6 +65,7 @@ source "$SCRIPT_DIR/ensure-devflow-init" "$CWD" || exit 0
 BACKUP_FILE="$MEMORY_DIR/backup.json"
 
 # Capture git state
+GIT_HEAD_SHA=""
 GIT_BRANCH=""
 GIT_STATUS=""
 GIT_LOG=""
@@ -71,11 +73,12 @@ GIT_DIFF_STAT=""
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
 if cd "$CWD" 2>/dev/null && git rev-parse --git-dir >/dev/null 2>&1; then
+  GIT_HEAD_SHA=$(git rev-parse HEAD 2>/dev/null || echo "")
   GIT_BRANCH=$(git branch --show-current 2>/dev/null || echo "unknown")
   GIT_STATUS=$(git status --porcelain 2>/dev/null | head -30 || echo "")
   GIT_LOG=$(git log --oneline -10 2>/dev/null || echo "")
   GIT_DIFF_STAT=$(git diff --stat HEAD 2>/dev/null || echo "")
-  dbg "GIT_BRANCH=$GIT_BRANCH"
+  dbg "GIT_BRANCH=$GIT_BRANCH HEAD=$GIT_HEAD_SHA"
 fi
 
 # Snapshot current WORKING-MEMORY.md (preserves session context through compaction)
@@ -98,28 +101,43 @@ json_backup_construct \
 log "Wrote backup: $BACKUP_FILE"
 dbg "Wrote backup: $BACKUP_FILE"
 
-# Bootstrap minimal WORKING-MEMORY.md if none exists yet
-# This ensures SessionStart has context to inject after compaction
+# Bootstrap minimal WORKING-MEMORY.md if absent; skip on detached HEAD, unborn branch,
+# or malformed SHA. is_hex_sha 40 40: exactly 40 lowercase hex chars required.
+# avoids REL-5: O_EXCL-style atomic create via noclobber so the existence test and the
+# create are one operation — if the worker's CAS mv lands in the window, noclobber fails
+# (file already exists) and we skip the bootstrap rather than truncating fresh memory.
 MEMORY_FILE="$MEMORY_DIR/WORKING-MEMORY.md"
-if [ ! -f "$MEMORY_FILE" ] && [ -n "$GIT_BRANCH" ]; then
-  {
-    echo "# Working Memory"
-    echo ""
-    echo "## Now"
-    echo "- Session compacted before working memory was established"
-    echo ""
-    echo "## Context"
-    echo "- Branch: $GIT_BRANCH"
-    echo "$GIT_LOG" | head -3 | while IFS= read -r line; do
-      [ -n "$line" ] && echo "- $line"
-    done
-    echo ""
-    echo "## Modified Files"
-    echo "$GIT_STATUS" | head -10 | while IFS= read -r line; do
-      [ -n "$line" ] && echo "- $(echo "$line" | awk '{print $2}')"
-    done
-  } > "$MEMORY_FILE"
-  dbg "Bootstrapped minimal WORKING-MEMORY.md"
+if [ -n "$GIT_BRANCH" ] && is_hex_sha "$GIT_HEAD_SHA" 40 40; then
+  if (set -o noclobber; : > "$MEMORY_FILE") 2>/dev/null; then
+    {
+      echo "<!-- memory-head: $GIT_HEAD_SHA branch: $GIT_BRANCH -->"
+      echo ""
+      echo "## Now"
+      echo "- Session compacted before working memory was established"
+      echo ""
+      echo "## Progress"
+      echo "- (no history yet)"
+      echo ""
+      echo "## Decisions"
+      echo "- (none recorded)"
+      echo ""
+      echo "## Context"
+      echo "- Branch: $GIT_BRANCH"
+      echo "$GIT_LOG" | head -3 | while IFS= read -r line; do
+        [ -n "$line" ] && echo "- $line"
+      done
+      if [ -n "$GIT_STATUS" ]; then
+        echo "- Modified files:"
+        echo "$GIT_STATUS" | head -10 | while IFS= read -r line; do
+          [ -n "$line" ] && echo "  - $(echo "$line" | awk '{print $2}')"
+        done
+      fi
+      echo ""
+      echo "## Session Log"
+      echo "- (no entries)"
+    } >> "$MEMORY_FILE"
+    dbg "Bootstrapped minimal WORKING-MEMORY.md with stamp and canonical sections"
+  fi
 fi
 
 log "PreCompact complete"

package/src/assets/scripts/hooks/session-start-memory

@@ -68,6 +68,7 @@ fi
 # Non-clobber: only recovers when .pending-turns.jsonl does NOT already exist,
 # so a concurrent session's fresh queue is never overwritten.
 source "$SCRIPT_DIR/get-mtime" || { echo "session-start-memory: failed to source get-mtime" >&2; exit 1; }
+source "$SCRIPT_DIR/is-hex-sha" || { echo "session-start-memory: failed to source is-hex-sha" >&2; exit 1; }
 _SSM_PT_PROC="$MEMORY_DIR/.pending-turns.processing"
 _SSM_PT_JSONL="$MEMORY_DIR/.pending-turns.jsonl"
 if [ -f "$_SSM_PT_PROC" ]; then
@@ -112,26 +113,11 @@ parse_and_validate_stamp() {
       STAMP_BRANCH=$(echo "$FIRST_LINE" | sed -n 's/<!-- memory-head: [^ ]* branch: \([^ ]*\) -->/\1/p')
       ;;
   esac
-  # Hex-validation security gate — must stay before any git use of STAMP_SHA
-  if [ -n "$STAMP_SHA" ]; then
-    case "$STAMP_SHA" in
-      [0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]*)
-        # Looks like a hex string; verify length ≤ 40 and only hex chars via sed
-        local _SHA_CLEAN
-        _SHA_CLEAN=$(echo "$STAMP_SHA" | sed 's/[^0-9a-f]//g')
-        local _SHA_LEN=${#STAMP_SHA}
-        if [ "$_SHA_CLEAN" != "$STAMP_SHA" ] || [ "$_SHA_LEN" -gt 40 ]; then
-          dbg "STAMP_SHA rejected (non-hex chars or >40): $STAMP_SHA"
-          STAMP_SHA=""
-          STAMP_BRANCH=""
-        fi
-        ;;
-      *)
-        dbg "STAMP_SHA rejected (bad prefix): $STAMP_SHA"
-        STAMP_SHA=""
-        STAMP_BRANCH=""
-        ;;
-    esac
+  # Hex-validation security gate — must stay before any git use of STAMP_SHA.
+  if [ -n "$STAMP_SHA" ] && ! is_hex_sha "$STAMP_SHA"; then
+    dbg "STAMP_SHA rejected (non-hex or out of range): $STAMP_SHA"
+    STAMP_SHA=""
+    STAMP_BRANCH=""
   fi
   dbg "STAMP_SHA=$STAMP_SHA STAMP_BRANCH=$STAMP_BRANCH"
   # Strip stamp line from injected body
@@ -147,16 +133,29 @@ parse_and_validate_stamp() {
 
 # --- detect_refresh_failing: sets REFRESH_FAILING in caller's scope.
 # Condition: queue non-empty AND (.last-refresh-ok missing OR >600s old)
+# orphaned-processing depth fix: count both .pending-turns.jsonl AND
+# .pending-turns.processing toward _queue_depth. Before this fix, an orphaned
+# .processing (whose mtime is between 0s and the D56c 300s cold-path gate)
+# was invisible to State-C — a crashed worker's batch would sit silently with
+# no user-visible warning.
 detect_refresh_failing() {
   local _now="$1"
   local _memory_dir="$2"
   local _log_dir="$3"
   local _queue_file="$_memory_dir/.pending-turns.jsonl"
+  local _proc_file="$_memory_dir/.pending-turns.processing"
   local _ok_file="$_memory_dir/.last-refresh-ok"
   local _queue_depth=0
   if [ -f "$_queue_file" ] && [ -s "$_queue_file" ]; then
     _queue_depth=$(wc -l < "$_queue_file" | tr -d ' ')
   fi
+  # Also count lines in .processing — an orphaned batch left by a crashed worker
+  # is unprocessed content even if .jsonl is empty (applies B4 blind-spot fix)
+  if [ -f "$_proc_file" ] && [ -s "$_proc_file" ]; then
+    local _proc_depth
+    _proc_depth=$(wc -l < "$_proc_file" | tr -d ' ')
+    _queue_depth=$(( _queue_depth + _proc_depth ))
+  fi
   local _ok_age=9999999
   if [ -f "$_ok_file" ]; then
     local _ok_mtime