hypomnema 1.5.1 → 1.6.1

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "hypo",
       "source": "./",
       "description": "LLM-native personal wiki — session-aware knowledge base for Claude Code",
-      "version": "1.5.1",
+      "version": "1.6.1",
       "homepage": "https://github.com/sk-lim19f/Hypomnema"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "hypo",
-  "version": "1.5.1",
+  "version": "1.6.1",
   "description": "LLM-native personal wiki system — session-aware knowledge base for Claude Code",
   "author": {
     "name": "sk-lim19f",

package/README.ko.md

@@ -25,7 +25,7 @@ Andrej Karpathy의 "LLM 네이티브 위키" 스케치에서 출발했습니다.
 
 ### 지금 어디까지 자동인가
 
-현재 릴리스는 v1.5.1입니다. 위키가 자기 신선도를 알리는 방식을 다듬었습니다. `verify_by_date`가 지난 페이지는 주입되는 순간 `[STALE ...]`로 표시돼, 날짜 지난 답을 조용히 신뢰하는 대신 눈에 띄게 하고, lookup 사용을 로컬에서 추적해 링크됐지만 한 번도 주입되지 않은 페이지를 crystallize가 cold 후보로 표면화합니다. 같은 릴리스에서 표준 `session | project: title` 콜론 로그 포맷을 stale로 오진하던 세션 마무리도 견고해졌습니다. 그 앞 v1.5.0은 머신 간 안정성과 일상의 마찰에 집중했습니다. git 동기화 볼트의 `cwd`-first resume, 코드 레포 세션에 위키 위치 안내, 세션 마무리가 무관한 lint 부채를 다시 나열하지 않는 것이었습니다.
+현재 릴리스는 v1.6.1입니다. 조건부나 유예된 세션 마무리에서 미커밋이나 진행 중인 작업이 남아 문구가 모호할 때 조기 nag 대신 지금 닫을지 되묻고, `working_dir` provenance를 강화해 앵커가 없던 프로젝트도 `cwd`-first resume이 앵커하도록 고쳤습니다. 그 앞 v1.6.0은 역방향 확장 capture를 완성했습니다. `hypomnema capture`(그리고 `/hypo:capture` 슬래시 커맨드)가 `~/.claude/` 아래에 보통 방식으로 만든 command·agent·hook을 위키로 끌어와, forward-sync가 다른 머신에 원래 이름 그대로 전파합니다. 손으로 만든 확장의 "한 머신에서 등록, 다른 머신에서 동기화" 갭을 데몬 없이 메웁니다. 그 앞 v1.5.1은 위키가 자기 신선도를 알리는 방식을 다듬었습니다. `verify_by_date`가 지난 페이지는 주입되는 순간 `[STALE ...]`로 표시되고, lookup 사용을 로컬에서 추적해 링크됐지만 한 번도 주입되지 않은 페이지를 crystallize가 cold 후보로 표면화하며, 표준 `session | project: title` 콜론 로그 포맷을 stale로 오진하던 세션 마무리도 견고해졌습니다. 다시 그 앞 v1.5.0은 머신 간 안정성에 집중했습니다. git 동기화 볼트의 `cwd`-first resume와 코드 레포 세션에 위키 위치를 안내하는 것이었습니다.
 
 위키 작업(자료 정리·검색·세션 마무리)은 아직 `/hypo:*` 명령이나 자연어로 시작합니다. v2의 목표는 Claude가 시키지 않아도 위키를 읽고 쓰고 합성하는 완전 자율 동작이고, 지금 그쪽으로 가는 중입니다.
 
@@ -33,6 +33,7 @@ Andrej Karpathy의 "LLM 네이티브 위키" 스케치에서 출발했습니다.
 
 - 피드백 한 곳만 고치면 나머지는 따라옵니다. `pages/feedback/`에 한 번 적으면 위키가 `MEMORY.md`와 `~/.claude/CLAUDE.md`의 `<learned_behaviors>` 블록을 자동으로 갱신합니다(단방향 projection).
 - 확장 파일도 함께 동기화. 위키 안 `~/hypomnema/extensions/{agents,commands,hooks,skills}/`에 둔 파일을 `~/.claude/`에 자동 반영합니다. `--codex`를 붙이면 `hooks`·`commands`는 `~/.codex/`에도 반영하지만, `agents`와 `skills`는 Claude 전용이라 건너뜁니다.
+- 역방향 capture는 반대로 갑니다. `hypomnema capture`(또는 `/hypo:capture`)는 `~/.claude/{commands,agents}/`에 보통 방식으로 만든 command·agent나 `~/.claude/settings.json`에 등록한 정규형 hook을 위키로 끌어와, 이후 다른 머신에 원래 이름 그대로 동기화되게 합니다. hook은 정규형으로 무손실 라운드트립되는 것만 capture하고, 나머지는 이유와 함께 건너뜁니다. capture는 명시적이며 내용이 다른 위키 파일은 덮어쓰지 않습니다. skill은 아직 capture 대상이 아닙니다.
 - 프로젝트 자동 생성. 프로젝트 표식(`package.json`·`Cargo.toml` 등)이 있는 git 저장소로 `cd` 했는데 대응하는 위키 프로젝트가 없으면 만들지 물어봅니다.
 - 세션 종료 자동 정리와 `/clear` 복구. 의미 있는 세션이 끝나면 "마무리 메모를 짧게 남길까요?"가 자동으로 뜹니다. 마무리하지 않은 채 `/clear`를 입력해도 다음 세션 시작 때 이어서 정리할 수 있습니다.
 

package/README.md

@@ -25,7 +25,7 @@ New to the terms below? Keep the [Term decoder](#term-decoder) open in another t
 
 ### Where automation stands today
 
-The current release is v1.5.1. It sharpens how the wiki signals its own freshness: a page whose `verify_by_date` has passed is flagged `[STALE ...]` at the moment it is injected, so a dated answer is visible instead of trusted silently, and lookup usage is tracked locally so crystallize can surface a linked-but-never-injected page as a cold candidate. The same release makes session close robust to the standard `session | project: title` colon log format that had been misread as stale. The v1.5.0 line turned to cross-machine reliability and everyday friction before it: `cwd`-first resume on a git-synced vault, a code-repo session told where the wiki lives, and session close no longer re-listing unrelated lint debt.
+The current release is v1.6.1. It fixes session close so a conditional or deferred wrap-up ("once X is done, wrap up") that still has uncommitted or in-flight work asks you whether to close now instead of nagging prematurely, and it hardens `working_dir` provenance so `cwd`-first resume can anchor a project that was missing its anchor. The v1.6.0 release before it completed reverse extension capture: `hypomnema capture` (and the `/hypo:capture` slash command) pulls a command, agent, or hook you created the normal way under `~/.claude/` into the wiki, so forward-sync propagates it to your other machines under its original name. That closes the "register on one machine, sync on another" gap for extensions you author by hand, without a daemon. The v1.5.1 release before it sharpened how the wiki signals its own freshness: a page whose `verify_by_date` has passed is flagged `[STALE ...]` the moment it is injected, lookup usage is tracked locally so crystallize can surface a linked-but-never-injected page as a cold candidate, and session close was made robust to the standard `session | project: title` colon log format that had been misread as stale. The v1.5.0 line before that turned to cross-machine reliability: `cwd`-first resume on a git-synced vault and a code-repo session told where the wiki lives.
 
 Wiki work (ingest, query, session-close) still starts from an explicit `/hypo:*` command or plain language. The v2 goal is full autonomy: Claude reading, writing, and synthesizing the wiki without being asked, which is the direction this is heading.
 
@@ -33,6 +33,7 @@ The lanes that already run on their own: v1.1.0 shipped the observability score
 
 - Edit feedback in one place and the rest follows. `pages/feedback/` is the single source of truth for behavior corrections, and Hypomnema derives `MEMORY.md` and the `<learned_behaviors>` block inside `~/.claude/CLAUDE.md` from it automatically.
 - Extensions sync alongside. Anything under `~/hypomnema/extensions/{agents,commands,hooks,skills}/` is mirrored into `~/.claude/` automatically. The `--codex` flag also mirrors `hooks` and `commands` into `~/.codex/`; `agents` and `skills` are Claude-only and skipped on purpose.
+- Reverse capture goes the other way. `hypomnema capture` (or `/hypo:capture`) pulls a command or agent you made the normal way under `~/.claude/{commands,agents}/`, or a canonical hook you registered in `~/.claude/settings.json`, into the wiki, so it then syncs to your other machines under its original name. Hooks are captured only when they round-trip losslessly to the canonical form; others are skipped with a reason. Capture is explicit and never overwrites a differing wiki file. Skills are not captured yet.
 - Auto-project creation. When you `cd` into a git repo with a project marker (`package.json`, `Cargo.toml`, etc.) and no matching wiki project exists, Hypomnema offers to scaffold one.
 - Session-close cleanup and `/clear` recovery. After a non-trivial session, a "save a minimal session-close note?" prompt appears automatically; a `/clear` after a forgotten close is detected and recovered at the next session start.
 

package/commands/capture.md

@@ -0,0 +1,40 @@
+---
+description: Pull extensions you made the normal way under ~/.claude/{commands,agents}, or a canonical hook registered in ~/.claude/settings.json, into the wiki so they sync to your other machines. Use when the user wants to capture, adopt, or back up a locally-authored slash command, agent, or hook into Hypomnema.
+---
+
+You are running `/hypo:capture`. Bring a command or agent that the user created the normal way (directly under `~/.claude/commands/` or `~/.claude/agents/`), or a hook they registered in `~/.claude/settings.json`, into the wiki `extensions/` tree so the existing forward-sync propagates it to their other machines under its original name.
+
+Scope: commands, agents, and hooks. Commands and agents are enumerated from `~/.claude/{commands,agents}/`; hooks are read from the `~/.claude/settings.json` registration. A hook is captured only when its command is the canonical `node $HOME/.claude/hooks/<name>.mjs` form and it round-trips losslessly (original event, matcher, and timeout preserved); non-canonical or lossy registrations are skipped with a reason instead of being rewritten. Skills are not captured yet.
+
+## Step 1: Resolve the package root
+
+Bundled scripts here run via `${CLAUDE_PLUGIN_ROOT}/scripts/`. To resolve that package root: if `${CLAUDE_PLUGIN_ROOT}` is already an absolute path, use it; otherwise read `pkgRoot` from `~/.claude/hypo-pkg.json` (only when non-empty and the target script exists under it); otherwise use the `hypo@hypomnema` (or legacy `hypomnema@hypomnema`) installPath in `~/.claude/plugins/installed_plugins.json`; if none resolve, stop and tell the user to run `hypomnema capture` or reinstall instead of guessing the cache layout.
+
+If the user specified a Hypomnema directory, pass it as `--hypo-dir="<path>"`. Otherwise omit the flag.
+
+## Step 2: List what can be captured
+
+```bash
+node ${CLAUDE_PLUGIN_ROOT}/scripts/capture.mjs [--hypo-dir="<path>"]
+```
+
+With no names and no `--all`, the script lists capturable candidates and stops. Candidates come from two sources: commands and agents are the unowned regular `.md` files under `~/.claude/{commands,agents}/`, and hooks are the canonical `node $HOME/.claude/hooks/<name>.mjs` entries registered in `~/.claude/settings.json`. It excludes anything already managed by the wiki, the reserved `hypo-*` namespace, symlinks and other non-regular files, core hooks, and any hook whose registration would not round-trip losslessly. Skipped hook registrations are printed with the reason; unowned commands and agents that fail these filters are simply omitted from the list, without a per-item reason.
+
+Show the list. Note that these are unowned candidates, not a provenance check: explicit selection is the trust boundary. A third-party tool's command, agent, or hook could appear here, so let the user pick deliberately.
+
+## Step 3: Capture the user's selection
+
+Ask which ones to capture, then run with the chosen names (space-separated), or `--all` if the user wants everything listed:
+
+```bash
+node ${CLAUDE_PLUGIN_ROOT}/scripts/capture.mjs [--hypo-dir="<path>"] <name> [<name> ...]
+node ${CLAUDE_PLUGIN_ROOT}/scripts/capture.mjs [--hypo-dir="<path>"] --all
+```
+
+A name is the filename (`mycmd.md`, or `myhook.mjs` for a hook), its stem (`mycmd`), or the `type/file` form (`commands/mycmd.md`, `hooks/myhook.mjs`). Add `--dry-run` to preview without writing.
+
+Each capture stores the file in the wiki as `extensions/<type>/hypo-ext-<name>.<ext>` (`.md` for commands and agents, `.mjs` for hooks) with a sidecar `hypo-ext-<name>.manifest.json` that records the original install name (and, for a hook, its event, matcher, and timeout), then adopts it so the currently-installed copy is left in place and tracked. A wiki file that already exists with different content (or a mismatched manifest) is refused, not overwritten.
+
+## Step 4: Commit the wiki, then sync elsewhere
+
+Show the script output verbatim. When something was captured, remind the user to commit and push the wiki, then run `hypomnema upgrade --apply` on their other machine to install the captured extension under its original name.

package/docs/CONTRIBUTING.md

@@ -331,6 +331,17 @@ from being dropped.
 Prerequisite: the changelog collector in step 2 reads merged-PR data through the GitHub CLI, so have `gh` installed and authenticated (`gh auth status`) before you start. It is a maintainer-only release script and is not shipped to npm.
 
 ```bash
+# 0. (minor+ releases only) Ensure the wiki vault carries this release's version
+#    spec. Convention (version-plan lifecycle: born-at-stable-path, flip-in-place,
+#    recorded in the vault's decisions log): a minor-or-higher release has
+#    projects/hypomnema/specs/spec-v<version>.md with status: active and
+#    version: <version>. If it is missing, create it from the vault's minimal spec
+#    shape (omit patch-only fields for a minor/major). If you created or changed
+#    it, run the wiki lint and commit + push the vault before bumping, so the
+#    active pre-ship state is recorded remotely. Patch releases are exempt: the
+#    CHANGELOG section and PR body cover them, no spec doc required.
+$EDITOR ~/hypomnema/projects/hypomnema/specs/spec-v<version>.md
+
 # 1. Bump the version across package.json, plugin.json, marketplace.json,
 #    and templates/hypo-config.md. Takes a concrete semver (not patch/minor/major).
 node scripts/bump-version.mjs <new-semver>   # e.g. 1.2.2 or 1.3.0-rc.1
@@ -397,6 +408,13 @@ npm publish --dry-run --access public   # packs + prepublishOnly, NO registry PU
 # 8. Push the SPECIFIC tag alone — NOT --tags (that would push stale local tags
 #    and could trigger releases for versions you did not intend).
 git push origin v<version>
+
+# 9. (minor+ releases only) After the release workflow succeeds, close the spec
+#    lifecycle IN PLACE (no path move): set status: archived and
+#    archived_date: <release date> in the same spec, run the wiki lint, then
+#    commit and push the vault. Do this only after the release is green, never at
+#    tag time: a failed release must not leave an archived spec behind.
+$EDITOR ~/hypomnema/projects/hypomnema/specs/spec-v<version>.md
 ```
 
 The `release.yml` workflow then:

package/hooks/hypo-auto-minimal-crystallize.mjs

@@ -32,6 +32,19 @@
  * "오늘 여기까지", "wrap up", "session close"). last_assistant_message is NOT
  * used — "커밋했습니다"/"작업 완료" type phrases produce false positives.
  *
+ * Reconfirm branch (conditional-close-reconfirm, added after the close-intent
+ * gate above was found to be unable to distinguish "close now" from "close
+ * once X is done" by regex alone — same sentence shape either way). When the
+ * close-intent gate above fires AND the session has a work-incomplete signal
+ * (an uncommitted wiki, or an in-flight delegated subagent per
+ * hasInFlightSubagent), step 6's block reason is replaced with an
+ * AskUserQuestion instruction instead of a crystallize command — the model
+ * asks the user "close now?" rather than deciding for them. A correlated
+ * "아직"/"나중"/"not yet"/"later" answer (isCloseReconfirmDeclined) suppresses
+ * the NEXT such block via `continue`, until a new user close signal re-arms
+ * it. This does not touch step 4's isClosePattern gate itself, and does not
+ * change the marker-writer's own close-file-status gate.
+ *
  * The hook NEVER writes the marker — even in the loop-guard branch. Writer
  * authority lives in `scripts/crystallize.mjs` (`--apply-session-close
  * --session-id=X` or standalone `--mark-session-closed --session-id=X`),
@@ -52,13 +65,47 @@ import {
   isClosePattern,
   isGateSkipped,
   precompactGateStatus,
+  hasInFlightSubagent,
+  isCloseReconfirmDeclined,
+  CLOSE_RECONFIRM_MARK,
 } from './hypo-shared.mjs';
 
 function emitContinue() {
   console.log(JSON.stringify({ continue: true, suppressOutput: true }));
 }
 
-function emitBlock(sessionId, transcriptPath, gate = null) {
+function emitBlock(sessionId, transcriptPath, gate = null, opts = {}) {
+  // Reconfirm branch (work-incomplete + close-intent, ambiguous "now" vs
+  // "later"): the model must NOT decide unilaterally. Ask the user via
+  // AskUserQuestion instead of naming a marker/crystallize command — doing
+  // so here would let the model "resolve" the ambiguity by just running the
+  // close, which is exactly the silent-close-on-uncommitted-work failure
+  // mode this branch exists to stop. See spec/plan
+  // (specs/conditional-close-reconfirm/). The close-now option label below
+  // (CLOSE_RECONFIRM_MARK) must stay in sync with hypo-shared.mjs
+  // isCloseReconfirmDeclined's correlation check — that coupling is
+  // load-bearing (a differently-labeled option would leave the model's
+  // AskUserQuestion uncorrelated, so even an explicit user decline could not
+  // be recognized as such). Both sides import the same constant so a reworded
+  // label can't drift out of sync silently. The decline label ("아직, 계속")
+  // stays a literal here — it is matched by the tolerant DECLINE regex in
+  // isCloseReconfirmDeclined, not by an exact-mark check.
+  if (opts.reconfirm) {
+    console.log(
+      JSON.stringify({
+        decision: 'block',
+        reason:
+          `[WIKI_AUTOCLOSE] close 신호가 잡혔지만 아직 커밋되지 않은 변경(또는 진행 중인 ` +
+          `위임 작업)이 있어 지금 닫을지 뒤로 미룰지 모호합니다 (session_id=${sessionId}). ` +
+          `임의로 닫지 말고 AskUserQuestion으로 사용자에게 지금 세션을 닫을지 물어보세요. ` +
+          `선택지는 "${CLOSE_RECONFIRM_MARK}"와 "아직, 계속"으로 제시합니다. 사용자가 ` +
+          `"${CLOSE_RECONFIRM_MARK}"를 고른 뒤에만 세션 마무리를 진행하세요. 그전에는 ` +
+          `마커를 쓰거나 종료 명령을 실행하지 마세요.`,
+        stopReason: 'session-close incomplete (Layer 3, reconfirm)',
+      }),
+    );
+    return;
+  }
   // One-line recovery action. The gate-precise branches below name an EXACT
   // command so "only the marker is missing" stays a one-shot fix — but that
   // command must be a runnable `node <pkg>/scripts/crystallize.mjs` invocation,
@@ -199,7 +246,27 @@ process.stdin.on('end', () => {
       gate = null;
     }
 
-    emitBlock(sessionId, transcriptPath, gate);
+    // Reconfirm decision (conditional-close-reconfirm): "close" and
+    // "work-incomplete" together are exactly the case where the transcript's
+    // NL close phrase can't tell "close now" from "close once X is done" —
+    // regex can't disambiguate this (see spec background). Narrowed to the
+    // two work-incomplete signals only: an uncommitted wiki (`git` blocker;
+    // real unsaved work) OR an in-flight delegated subagent. `hot` / `lint` /
+    // `close` / `design-history` / `feedback` blockers are real close
+    // blockers but not evidence of "later" intent, so they keep the existing
+    // wording (unchanged from before this feature).
+    const workIncomplete =
+      (gate && gate.blockers && gate.blockers.some((b) => b.type === 'git')) ||
+      hasInFlightSubagent(payload);
+    if (workIncomplete && isCloseReconfirmDeclined(transcriptPath)) {
+      // The user already answered "아직" to the ambiguous close signal that
+      // triggered this Stop turn — suppressing is a continue, not a
+      // (differently-worded) block, so it cannot live inside emitBlock.
+      emitContinue();
+      return;
+    }
+
+    emitBlock(sessionId, transcriptPath, gate, { reconfirm: workIncomplete });
   } catch (err) {
     // Fail-open on any unexpected error.
     process.stderr.write(`[hypo-auto-minimal-crystallize] error: ${err?.message ?? String(err)}\n`);

package/hooks/hypo-cwd-change.mjs

@@ -16,6 +16,9 @@ import {
   sessionMarkerPath,
   shouldSuggestProjectCreation,
   buildProjectSuggestionLine,
+  shouldSuggestBackfill,
+  buildBackfillSuggestionLine,
+  findBackfillCandidate,
   recordSuggestionCooldown,
   sanitizeProjForPrompt,
   pickProjectByCwd,
@@ -127,10 +130,25 @@ process.stdin.on('end', () => {
       return;
     }
 
-    // MISS: cwd matches no project. Offer to create one
-    // when the trigger conditions hold. Same nudge-only model as session-start.
+    // MISS: cwd matches no project's working_dir. Two distinct causes surface
+    // two distinct offers:
+    //   - cwd's leaf directory name already IS an existing projects/<slug>/
+    //     with session artifacts but no working_dir anchor → offer to
+    //     BACKFILL the anchor (a duplicate new-project offer would be wrong).
+    //   - otherwise, the usual create-a-new-project nudge, same as before.
+    // Same nudge-only model as session-start either way.
     let suggestPrefix = '';
-    if (shouldSuggestProjectCreation(newCwd, HYPO_DIR)) {
+    const backfillCandidate = findBackfillCandidate(newCwd, HYPO_DIR);
+    if (backfillCandidate && shouldSuggestBackfill(newCwd, HYPO_DIR)) {
+      const suggestLine = buildBackfillSuggestionLine(
+        backfillCandidate.slug,
+        newCwd,
+        backfillCandidate.hasIndex,
+      );
+      suggestPrefix = `${suggestLine}\n\n`;
+      recordSuggestionCooldown(HYPO_DIR, newCwd);
+      process.stderr.write(`\n\x1b[33m${suggestLine}\x1b[0m\n`);
+    } else if (shouldSuggestProjectCreation(newCwd, HYPO_DIR)) {
       const suggestLine = buildProjectSuggestionLine(newCwd);
       suggestPrefix = `${suggestLine}\n\n`;
       recordSuggestionCooldown(HYPO_DIR, newCwd);

package/hooks/hypo-shared.mjs

@@ -624,6 +624,80 @@ export function collectProjectWorkingDirs(hypoDir) {
   return out;
 }
 
+// A project without a working_dir anchor (no index.md, or an index.md missing
+// the field) never enters collectProjectWorkingDirs' universe, so cwd-first
+// resume always MISSes for it — the SessionStart/CwdChanged MISS branch would
+// otherwise only ever offer to create a brand-new (duplicate) project. Match
+// the cwd's LEAF basename only (not every ancestor): the anchor being written
+// is `working_dir: <cwd>` itself, so matching an ancestor directory would
+// backfill the wrong (parent) path. Since projects/<slug>/ names are unique on
+// disk, a leaf-basename match identifies at most one project — no separate
+// uniqueness gate is needed here (unlike pickProjectByCwd's cross-machine tier
+// 2, which reasons over synced *paths* that can collide).
+//
+// Known bound: a session whose cwd is a SUBDIRECTORY of the anchorless
+// project's root (rather than the root itself) will not match — this is a
+// deliberate scope limit, not a bug: guessing the project from a mid-tree cwd
+// would risk writing an anchor to the wrong (non-root) path.
+//
+// @param {string} cwd
+// @param {string} [hypoDir=HYPO_DIR]
+// @returns {{slug: string, hasIndex: boolean}|null} the anchorless project
+//   this cwd's leaf basename names, or null when there is no match, no
+//   session artifacts, or the project already carries a working_dir.
+export function findBackfillCandidate(cwd, hypoDir = HYPO_DIR) {
+  const n = normalizeWorkingDir(cwd);
+  if (!n) return null;
+  const projectsDir = join(hypoDir, 'projects');
+  if (!existsSync(projectsDir)) return null;
+  const leaf = _lastSeg(n);
+  if (!leaf) return null;
+
+  const ci = isCaseInsensitiveFs();
+  let entries;
+  try {
+    entries = readdirSync(projectsDir);
+  } catch {
+    return null;
+  }
+  const slug = entries.find((e) => e !== '_template' && _fold(e, ci) === _fold(leaf, ci));
+  if (!slug) return null;
+
+  const dir = join(projectsDir, slug);
+  try {
+    if (!statSync(dir).isDirectory()) return null;
+  } catch {
+    return null;
+  }
+  const hasArtifacts =
+    existsSync(join(dir, 'session-state.md')) ||
+    existsSync(join(dir, 'hot.md')) ||
+    existsSync(join(dir, 'session-log'));
+  if (!hasArtifacts) return null;
+
+  const indexPath = join(dir, 'index.md');
+  const hasIndex = existsSync(indexPath);
+  let workingDir = null;
+  if (hasIndex) {
+    try {
+      const fmBlock = readFileSync(indexPath, 'utf-8').match(/^---\r?\n([\s\S]*?)\r?\n---/);
+      const line = fmBlock && fmBlock[1].split(/\r?\n/).find((l) => /^working_dir:/.test(l));
+      if (line) {
+        workingDir = line
+          .slice('working_dir:'.length)
+          .trim()
+          .replace(/\s+#.*$/, '')
+          .replace(/^['"]|['"]$/g, '');
+      }
+    } catch {
+      workingDir = null;
+    }
+  }
+  if (hasIndex && workingDir) return null; // already anchored — not a backfill case
+
+  return { slug, hasIndex };
+}
+
 /**
  * When the session cwd is a project working_dir distinct from the vault root,
  * the wiki/knowledge files live in the VAULT, not in this cwd. SessionStart and
@@ -1461,6 +1535,23 @@ export function cwdHasProjectMarker(cwd) {
   return PROJECT_MARKERS.some((m) => existsSync(join(cwd, m)));
 }
 
+// Shared cooldown/skip gate for BOTH the new-project offer and the backfill
+// offer below — same store (.cache/project-suggestions.json), same key (cwd),
+// so a user who just answered one kind of offer for a cwd doesn't immediately
+// get re-prompted with the other. A corrupt store stays silent (doctor
+// surfaces the malformation separately).
+function suggestionNotSuppressed(cwd, hypoDir, now) {
+  const { skips, cooldowns, parseError } = readProjectSuggestions(hypoDir);
+  if (parseError) return false;
+  if (skips.some((s) => s && s.cwd === cwd)) return false;
+  const ts = cooldowns[cwd];
+  if (ts) {
+    const t = Date.parse(ts);
+    if (Number.isFinite(t) && now - t < SUGGESTION_COOLDOWN_MS) return false;
+  }
+  return true;
+}
+
 /**
  * Decide whether SessionStart/CwdChanged should offer to create a project for
  * `cwd`. The caller MUST have already confirmed `cwd` matches no project's
@@ -1478,15 +1569,25 @@ export function shouldSuggestProjectCreation(cwd, hypoDir = HYPO_DIR, now = Date
   if (!cwd) return false;
   if (!existsSync(join(cwd, '.git'))) return false;
   if (!cwdHasProjectMarker(cwd)) return false;
-  const { skips, cooldowns, parseError } = readProjectSuggestions(hypoDir);
-  if (parseError) return false;
-  if (skips.some((s) => s && s.cwd === cwd)) return false;
-  const ts = cooldowns[cwd];
-  if (ts) {
-    const t = Date.parse(ts);
-    if (Number.isFinite(t) && now - t < SUGGESTION_COOLDOWN_MS) return false;
-  }
-  return true;
+  return suggestionNotSuppressed(cwd, hypoDir, now);
+}
+
+/**
+ * Decide whether SessionStart/CwdChanged should offer to BACKFILL a
+ * working_dir anchor for `cwd`. The caller MUST have already located a
+ * findBackfillCandidate() match; this only applies the same cooldown/skip
+ * gate shouldSuggestProjectCreation uses, so the two offers share one
+ * suppression store. No git/marker gate here — the project directory
+ * already existing is itself the trigger condition.
+ *
+ * @param {string} cwd
+ * @param {string} [hypoDir]
+ * @param {number} [now] epoch ms, injectable for tests
+ * @returns {boolean}
+ */
+export function shouldSuggestBackfill(cwd, hypoDir = HYPO_DIR, now = Date.now()) {
+  if (!cwd) return false;
+  return suggestionNotSuppressed(cwd, hypoDir, now);
 }
 
 /**
@@ -1509,6 +1610,64 @@ export function buildProjectSuggestionLine(cwd) {
   return `[WIKI: cwd '${safe}'에 매칭되는 프로젝트가 없습니다. 자동 생성할까요? (Y/n)]`;
 }
 
+// Neutralize a PATH value for additionalContext injection without truncating
+// it — unlike sanitizeProjForPrompt (built for a short display name), a path
+// must render in full or the backfilled working_dir would be wrong. Only
+// newline/control chars are stripped (the injection vector); everything else,
+// including shell metacharacters, passes through untouched because this value
+// is NEVER assembled into a runnable command (see buildBackfillSuggestionLine)
+// — it is purely descriptive text for the LLM/user to read.
+function stripControlCharsForPath(raw) {
+  // Per-codepoint (not a regex escape range) so no control byte is written
+  // literally into this source file (the source-corruption trap hit earlier
+  // in this same change). Mirrors sanitizeProjForPrompt's coverage EXACTLY —
+  // C0 (0x00-0x1F), DEL+C1 (0x7F-0x9F, which folds in U+0085 NEL), and the
+  // U+2028/U+2029 line separators. Deliberately does NOT strip bidi format
+  // controls: sanitizeProjForPrompt doesn't either, and matching its exact
+  // decision (rather than inventing a wider one here) is the principled
+  // choice so the two sanitizers never silently diverge in coverage.
+  return Array.from(String(raw == null ? '' : raw))
+    .map((ch) => {
+      const code = ch.codePointAt(0);
+      const isC0OrDelOrC1 = code < 0x20 || (code >= 0x7f && code <= 0x9f);
+      const isLineSep = code === 0x2028 || code === 0x2029;
+      return isC0OrDelOrC1 || isLineSep ? ' ' : ch;
+    })
+    .join('');
+}
+
+/**
+ * Build the working_dir-backfill offer line for a cwd that names an EXISTING
+ * `projects/<slug>/` directory (findBackfillCandidate already confirmed it
+ * carries session artifacts but no anchor). `slug` (short, display-only)
+ * routes through sanitizeProjForPrompt; `cwd` (a real path that must not be
+ * corrupted) routes through stripControlCharsForPath instead — truncating a
+ * path would silently backfill the WRONG working_dir. Neither branch
+ * assembles a runnable shell command from either value (codex pre-commit
+ * review: embedding untrusted path/slug text into a copy-paste `node ...`
+ * invocation is a shell-injection vector); both branches are purely
+ * descriptive guidance for the LLM/user to act on.
+ *
+ * The two cases still need different WORDING: a MISSING index.md has nothing
+ * to edit yet, so the offer describes creating a fresh one anchored to the
+ * current cwd (the agent constructs the actual project-create.mjs invocation
+ * itself, safely, outside this string). An index.md that already EXISTS but
+ * simply omits working_dir needs a direct frontmatter addition instead.
+ *
+ * @param {string} slug the matching projects/<slug>/ directory name
+ * @param {string} cwd the session cwd (the value that would become working_dir)
+ * @param {boolean} hasIndex whether projects/<slug>/index.md already exists
+ * @returns {string}
+ */
+export function buildBackfillSuggestionLine(slug, cwd, hasIndex) {
+  const safeSlug = sanitizeProjForPrompt(slug);
+  const safeCwd = stripControlCharsForPath(cwd);
+  const action = hasIndex
+    ? `projects/${safeSlug}/index.md의 frontmatter에 working_dir: ${safeCwd}를 추가할까요?`
+    : `projects/${safeSlug}/index.md가 없습니다. 현재 세션의 cwd(${safeCwd})를 working_dir로 삼아 index.md를 새로 만들까요?`;
+  return `[WIKI: cwd가 기존 프로젝트 'projects/${safeSlug}/'와 이름이 일치하지만 working_dir 앵커가 없습니다. ${action} (Y/n)]`;
+}
+
 // ── clear-marker (amendment 2026-05-14) ──────────────────────
 // `/clear` cannot be blocked (no UserPromptSubmit fire). The only intervention
 // point is the SessionEnd(reason='clear') → SessionStart(source='clear') pair:
@@ -2598,6 +2757,141 @@ export function hasUserCloseSignal(transcriptPath) {
   return false;
 }
 
+/**
+ * True iff the Stop payload's `background_tasks` names an in-flight (not yet
+ * terminal) delegated subagent. Read-only: used to widen the autoclose
+ * reconfirm trigger (see hypo-auto-minimal-crystallize.mjs) to "work is
+ * demonstrably still running", not just "the wiki has uncommitted changes".
+ *
+ * Defined as the NEGATION of a terminal status, not an enumeration of
+ * "running" states — this repo has no `background_tasks` type definition
+ * (grep turns up nothing), so the real status vocabulary is unverified. An
+ * unrecognized/absent status is treated as in-flight; only a recognized
+ * terminal status clears it.
+ *
+ * Fail-open: a missing or non-array `background_tasks` is treated as "no
+ * in-flight subagent" (the field may simply not be sent by this Stop event),
+ * so in-flight detection degrades gracefully to the git-uncommitted signal
+ * alone rather than spuriously blocking.
+ */
+export function hasInFlightSubagent(payload) {
+  const tasks = payload && payload.background_tasks;
+  if (!Array.isArray(tasks)) return false;
+  const TERMINAL = /^(completed|complete|done|finished|failed|error|errored|cancelled|canceled)$/i;
+  return tasks.some(
+    (t) => t && t.type === 'subagent' && (t.status == null || !TERMINAL.test(String(t.status))),
+  );
+}
+
+// The reconfirm reason (hypo-auto-minimal-crystallize.mjs emitBlock's
+// reconfirm branch) instructs the close-now option under this exact label —
+// used below to correlate an AskUserQuestion tool_use to OUR close-reconfirm
+// prompt specifically, not just any AskUserQuestion the model happens to ask.
+// Exported so the hook builds its reason text off this SAME literal instead
+// of a second hardcoded copy: two independent literals would let a reworded
+// reason silently break this correlation with no test to catch it.
+export const CLOSE_RECONFIRM_MARK = '지금 닫기';
+
+/**
+ * True iff the LATEST correlated AskUserQuestion answer in the transcript
+ * declined an autoclose reconfirm prompt ("아직" / "나중" / "not yet" /
+ * "later") — order-sensitive so a decline is suppressed again once the user
+ * signals a NEW close intent afterward (re-arm).
+ *
+ * Read-only, forward scan over the FULL transcript (no tail truncation — a
+ * decline can precede the next Stop by any number of turns). Reuses the same
+ * askIds + tool_use_id correlation `hasUserCloseSignal` (above) uses to bind
+ * an AskUserQuestion answer to its own tool_use, so an unrelated tool_result
+ * string can't forge a decline. Unlike `hasUserCloseSignal` (which is a
+ * "any evidence, ever" OR), this tracks a single latest-wins boolean as it
+ * scans: a decline answer sets it true, and any later GENUINE USER close
+ * signal resets it to false — the user asked to close again, so the prior
+ * decline no longer applies.
+ *
+ * Two correlation guards (the same input-boundary concern class as
+ * extractUserMessages' tool_result/injection exclusion above):
+ *
+ *  1. Re-arm is gated to a real user-typed close signal ONLY — mirrors
+ *     extractUserMessages' own boundary filter (isMeta / promptSource
+ *     system|sdk / tool_result exclusion, see extractUserMessages above)
+ *     instead of re-deriving a separate policy. Without this, the MODEL'S
+ *     OWN assistant reasoning text (which can itself contain "세션 마무리"),
+ *     or a tool_result (e.g. a Read of a file that happens to quote a close
+ *     phrase), could silently clear a recorded decline and re-nag the user
+ *     who already said "아직" — the opposite of what a decline means.
+ *  2. The AskUserQuestion tool_use is only added to `askIds` when its input
+ *     carries CLOSE_RECONFIRM_MARK — i.e. it IS the close-reconfirm prompt,
+ *     not some unrelated question the model asked around the same time. An
+ *     unrelated question whose answer happens to contain a decline word
+ *     ("나중"/"later") must not correlate.
+ *
+ * Fail-open: a missing/unreadable transcript → false (do not suppress; keep
+ * reconfirming) — the caller stays on the safe (nag, not silent-close) side.
+ */
+export function isCloseReconfirmDeclined(transcriptPath) {
+  if (!transcriptPath) return false;
+  let lines;
+  try {
+    lines = readFileSync(transcriptPath, 'utf-8').split('\n');
+  } catch {
+    return false;
+  }
+  const DECLINE = /(아직|나중|not\s?yet|later)/i;
+  const askIds = new Set();
+  let declined = false;
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const msg = obj.message ?? obj;
+    const content = msg.content ?? obj.content;
+
+    // Re-arm boundary (guard 1): only a genuine user-typed close signal may
+    // re-arm. Same exclusions as extractUserMessages — isMeta injection,
+    // system/sdk synthetic prompts, and (via the array-content branch below)
+    // tool_result blocks, which are role:'user' in the transcript but are NOT
+    // user-typed text.
+    const isInjected = obj.isMeta === true || obj.promptSource === 'system' || obj.promptSource === 'sdk';
+    const role = msg.role ?? obj.role ?? obj.type;
+    if (!isInjected && role === 'user') {
+      if (typeof content === 'string') {
+        if (!content.startsWith('Stop hook feedback') && isClosePattern(content)) declined = false;
+      } else if (Array.isArray(content)) {
+        for (const b of content) {
+          // Only type:'text' blocks are genuine user-typed text — a
+          // tool_result block (also role:'user') is tool output, not
+          // something the user typed, and must not re-arm.
+          if (b && b.type === 'text' && typeof b.text === 'string' && isClosePattern(b.text)) {
+            declined = false;
+          }
+        }
+      }
+    }
+
+    if (!Array.isArray(content)) continue;
+    for (const b of content) {
+      if (!b || typeof b !== 'object') continue;
+      if (b.type === 'tool_use' && b.name === 'AskUserQuestion' && b.id) {
+        // Correlation guard 2: only OUR close-reconfirm prompt counts.
+        const inputStr = JSON.stringify(b.input ?? null);
+        if (inputStr.includes(CLOSE_RECONFIRM_MARK)) askIds.add(b.id);
+        continue;
+      }
+      if (b.type === 'tool_result' && b.tool_use_id && askIds.has(b.tool_use_id)) {
+        const s = typeof b.content === 'string' ? b.content : JSON.stringify(b.content);
+        for (const m of s.matchAll(/="([^"]*)"/g)) {
+          if (DECLINE.test(m[1])) declined = true;
+        }
+      }
+    }
+  }
+  return declined;
+}
+
 /**
  * Build hook output for Claude Code (additionalContext channel).
  * Codex hooks write systemMessage directly in their own files.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hypomnema",
-  "version": "1.5.1",
+  "version": "1.6.1",
   "description": "LLM-native personal wiki system for Claude Code",
   "type": "module",
   "license": "MIT",