hypomnema 1.6.0 → 1.6.1

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "hypo",
       "source": "./",
       "description": "LLM-native personal wiki — session-aware knowledge base for Claude Code",
-      "version": "1.6.0",
+      "version": "1.6.1",
       "homepage": "https://github.com/sk-lim19f/Hypomnema"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "hypo",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "LLM-native personal wiki system — session-aware knowledge base for Claude Code",
   "author": {
     "name": "sk-lim19f",

package/README.ko.md

@@ -25,7 +25,7 @@ Andrej Karpathy의 "LLM 네이티브 위키" 스케치에서 출발했습니다.
 
 ### 지금 어디까지 자동인가
 
-현재 릴리스는 v1.6.0입니다. 역방향 확장 capture를 완성했습니다. `hypomnema capture`(그리고 `/hypo:capture` 슬래시 커맨드)가 `~/.claude/` 아래에 보통 방식으로 만든 command·agent·hook을 위키로 끌어와, forward-sync가 다른 머신에 원래 이름 그대로 전파합니다. 손으로 만든 확장의 "한 머신에서 등록, 다른 머신에서 동기화" 갭을 데몬 없이 메웁니다. 그 앞 v1.5.1은 위키가 자기 신선도를 알리는 방식을 다듬었습니다. `verify_by_date`가 지난 페이지는 주입되는 순간 `[STALE ...]`로 표시되고, lookup 사용을 로컬에서 추적해 링크됐지만 한 번도 주입되지 않은 페이지를 crystallize가 cold 후보로 표면화하며, 표준 `session | project: title` 콜론 로그 포맷을 stale로 오진하던 세션 마무리도 견고해졌습니다. 다시 그 앞 v1.5.0은 머신 간 안정성에 집중했습니다. git 동기화 볼트의 `cwd`-first resume와 코드 레포 세션에 위키 위치를 안내하는 것이었습니다.
+현재 릴리스는 v1.6.1입니다. 조건부나 유예된 세션 마무리에서 미커밋이나 진행 중인 작업이 남아 문구가 모호할 때 조기 nag 대신 지금 닫을지 되묻고, `working_dir` provenance를 강화해 앵커가 없던 프로젝트도 `cwd`-first resume이 앵커하도록 고쳤습니다. 그 앞 v1.6.0은 역방향 확장 capture를 완성했습니다. `hypomnema capture`(그리고 `/hypo:capture` 슬래시 커맨드)가 `~/.claude/` 아래에 보통 방식으로 만든 command·agent·hook을 위키로 끌어와, forward-sync가 다른 머신에 원래 이름 그대로 전파합니다. 손으로 만든 확장의 "한 머신에서 등록, 다른 머신에서 동기화" 갭을 데몬 없이 메웁니다. 그 앞 v1.5.1은 위키가 자기 신선도를 알리는 방식을 다듬었습니다. `verify_by_date`가 지난 페이지는 주입되는 순간 `[STALE ...]`로 표시되고, lookup 사용을 로컬에서 추적해 링크됐지만 한 번도 주입되지 않은 페이지를 crystallize가 cold 후보로 표면화하며, 표준 `session | project: title` 콜론 로그 포맷을 stale로 오진하던 세션 마무리도 견고해졌습니다. 다시 그 앞 v1.5.0은 머신 간 안정성에 집중했습니다. git 동기화 볼트의 `cwd`-first resume와 코드 레포 세션에 위키 위치를 안내하는 것이었습니다.
 
 위키 작업(자료 정리·검색·세션 마무리)은 아직 `/hypo:*` 명령이나 자연어로 시작합니다. v2의 목표는 Claude가 시키지 않아도 위키를 읽고 쓰고 합성하는 완전 자율 동작이고, 지금 그쪽으로 가는 중입니다.
 

package/README.md

@@ -25,7 +25,7 @@ New to the terms below? Keep the [Term decoder](#term-decoder) open in another t
 
 ### Where automation stands today
 
-The current release is v1.6.0. It completes reverse extension capture: `hypomnema capture` (and the `/hypo:capture` slash command) pulls a command, agent, or hook you created the normal way under `~/.claude/` into the wiki, so forward-sync propagates it to your other machines under its original name. That closes the "register on one machine, sync on another" gap for extensions you author by hand, without a daemon. The v1.5.1 release before it sharpened how the wiki signals its own freshness: a page whose `verify_by_date` has passed is flagged `[STALE ...]` the moment it is injected, lookup usage is tracked locally so crystallize can surface a linked-but-never-injected page as a cold candidate, and session close was made robust to the standard `session | project: title` colon log format that had been misread as stale. The v1.5.0 line before that turned to cross-machine reliability: `cwd`-first resume on a git-synced vault and a code-repo session told where the wiki lives.
+The current release is v1.6.1. It fixes session close so a conditional or deferred wrap-up ("once X is done, wrap up") that still has uncommitted or in-flight work asks you whether to close now instead of nagging prematurely, and it hardens `working_dir` provenance so `cwd`-first resume can anchor a project that was missing its anchor. The v1.6.0 release before it completed reverse extension capture: `hypomnema capture` (and the `/hypo:capture` slash command) pulls a command, agent, or hook you created the normal way under `~/.claude/` into the wiki, so forward-sync propagates it to your other machines under its original name. That closes the "register on one machine, sync on another" gap for extensions you author by hand, without a daemon. The v1.5.1 release before it sharpened how the wiki signals its own freshness: a page whose `verify_by_date` has passed is flagged `[STALE ...]` the moment it is injected, lookup usage is tracked locally so crystallize can surface a linked-but-never-injected page as a cold candidate, and session close was made robust to the standard `session | project: title` colon log format that had been misread as stale. The v1.5.0 line before that turned to cross-machine reliability: `cwd`-first resume on a git-synced vault and a code-repo session told where the wiki lives.
 
 Wiki work (ingest, query, session-close) still starts from an explicit `/hypo:*` command or plain language. The v2 goal is full autonomy: Claude reading, writing, and synthesizing the wiki without being asked, which is the direction this is heading.
 

package/hooks/hypo-auto-minimal-crystallize.mjs

@@ -32,6 +32,19 @@
  * "오늘 여기까지", "wrap up", "session close"). last_assistant_message is NOT
  * used — "커밋했습니다"/"작업 완료" type phrases produce false positives.
  *
+ * Reconfirm branch (conditional-close-reconfirm, added after the close-intent
+ * gate above was found to be unable to distinguish "close now" from "close
+ * once X is done" by regex alone — same sentence shape either way). When the
+ * close-intent gate above fires AND the session has a work-incomplete signal
+ * (an uncommitted wiki, or an in-flight delegated subagent per
+ * hasInFlightSubagent), step 6's block reason is replaced with an
+ * AskUserQuestion instruction instead of a crystallize command — the model
+ * asks the user "close now?" rather than deciding for them. A correlated
+ * "아직"/"나중"/"not yet"/"later" answer (isCloseReconfirmDeclined) suppresses
+ * the NEXT such block via `continue`, until a new user close signal re-arms
+ * it. This does not touch step 4's isClosePattern gate itself, and does not
+ * change the marker-writer's own close-file-status gate.
+ *
  * The hook NEVER writes the marker — even in the loop-guard branch. Writer
  * authority lives in `scripts/crystallize.mjs` (`--apply-session-close
  * --session-id=X` or standalone `--mark-session-closed --session-id=X`),
@@ -52,13 +65,47 @@ import {
   isClosePattern,
   isGateSkipped,
   precompactGateStatus,
+  hasInFlightSubagent,
+  isCloseReconfirmDeclined,
+  CLOSE_RECONFIRM_MARK,
 } from './hypo-shared.mjs';
 
 function emitContinue() {
   console.log(JSON.stringify({ continue: true, suppressOutput: true }));
 }
 
-function emitBlock(sessionId, transcriptPath, gate = null) {
+function emitBlock(sessionId, transcriptPath, gate = null, opts = {}) {
+  // Reconfirm branch (work-incomplete + close-intent, ambiguous "now" vs
+  // "later"): the model must NOT decide unilaterally. Ask the user via
+  // AskUserQuestion instead of naming a marker/crystallize command — doing
+  // so here would let the model "resolve" the ambiguity by just running the
+  // close, which is exactly the silent-close-on-uncommitted-work failure
+  // mode this branch exists to stop. See spec/plan
+  // (specs/conditional-close-reconfirm/). The close-now option label below
+  // (CLOSE_RECONFIRM_MARK) must stay in sync with hypo-shared.mjs
+  // isCloseReconfirmDeclined's correlation check — that coupling is
+  // load-bearing (a differently-labeled option would leave the model's
+  // AskUserQuestion uncorrelated, so even an explicit user decline could not
+  // be recognized as such). Both sides import the same constant so a reworded
+  // label can't drift out of sync silently. The decline label ("아직, 계속")
+  // stays a literal here — it is matched by the tolerant DECLINE regex in
+  // isCloseReconfirmDeclined, not by an exact-mark check.
+  if (opts.reconfirm) {
+    console.log(
+      JSON.stringify({
+        decision: 'block',
+        reason:
+          `[WIKI_AUTOCLOSE] close 신호가 잡혔지만 아직 커밋되지 않은 변경(또는 진행 중인 ` +
+          `위임 작업)이 있어 지금 닫을지 뒤로 미룰지 모호합니다 (session_id=${sessionId}). ` +
+          `임의로 닫지 말고 AskUserQuestion으로 사용자에게 지금 세션을 닫을지 물어보세요. ` +
+          `선택지는 "${CLOSE_RECONFIRM_MARK}"와 "아직, 계속"으로 제시합니다. 사용자가 ` +
+          `"${CLOSE_RECONFIRM_MARK}"를 고른 뒤에만 세션 마무리를 진행하세요. 그전에는 ` +
+          `마커를 쓰거나 종료 명령을 실행하지 마세요.`,
+        stopReason: 'session-close incomplete (Layer 3, reconfirm)',
+      }),
+    );
+    return;
+  }
   // One-line recovery action. The gate-precise branches below name an EXACT
   // command so "only the marker is missing" stays a one-shot fix — but that
   // command must be a runnable `node <pkg>/scripts/crystallize.mjs` invocation,
@@ -199,7 +246,27 @@ process.stdin.on('end', () => {
       gate = null;
     }
 
-    emitBlock(sessionId, transcriptPath, gate);
+    // Reconfirm decision (conditional-close-reconfirm): "close" and
+    // "work-incomplete" together are exactly the case where the transcript's
+    // NL close phrase can't tell "close now" from "close once X is done" —
+    // regex can't disambiguate this (see spec background). Narrowed to the
+    // two work-incomplete signals only: an uncommitted wiki (`git` blocker;
+    // real unsaved work) OR an in-flight delegated subagent. `hot` / `lint` /
+    // `close` / `design-history` / `feedback` blockers are real close
+    // blockers but not evidence of "later" intent, so they keep the existing
+    // wording (unchanged from before this feature).
+    const workIncomplete =
+      (gate && gate.blockers && gate.blockers.some((b) => b.type === 'git')) ||
+      hasInFlightSubagent(payload);
+    if (workIncomplete && isCloseReconfirmDeclined(transcriptPath)) {
+      // The user already answered "아직" to the ambiguous close signal that
+      // triggered this Stop turn — suppressing is a continue, not a
+      // (differently-worded) block, so it cannot live inside emitBlock.
+      emitContinue();
+      return;
+    }
+
+    emitBlock(sessionId, transcriptPath, gate, { reconfirm: workIncomplete });
   } catch (err) {
     // Fail-open on any unexpected error.
     process.stderr.write(`[hypo-auto-minimal-crystallize] error: ${err?.message ?? String(err)}\n`);

package/hooks/hypo-cwd-change.mjs

@@ -16,6 +16,9 @@ import {
   sessionMarkerPath,
   shouldSuggestProjectCreation,
   buildProjectSuggestionLine,
+  shouldSuggestBackfill,
+  buildBackfillSuggestionLine,
+  findBackfillCandidate,
   recordSuggestionCooldown,
   sanitizeProjForPrompt,
   pickProjectByCwd,
@@ -127,10 +130,25 @@ process.stdin.on('end', () => {
       return;
     }
 
-    // MISS: cwd matches no project. Offer to create one
-    // when the trigger conditions hold. Same nudge-only model as session-start.
+    // MISS: cwd matches no project's working_dir. Two distinct causes surface
+    // two distinct offers:
+    //   - cwd's leaf directory name already IS an existing projects/<slug>/
+    //     with session artifacts but no working_dir anchor → offer to
+    //     BACKFILL the anchor (a duplicate new-project offer would be wrong).
+    //   - otherwise, the usual create-a-new-project nudge, same as before.
+    // Same nudge-only model as session-start either way.
     let suggestPrefix = '';
-    if (shouldSuggestProjectCreation(newCwd, HYPO_DIR)) {
+    const backfillCandidate = findBackfillCandidate(newCwd, HYPO_DIR);
+    if (backfillCandidate && shouldSuggestBackfill(newCwd, HYPO_DIR)) {
+      const suggestLine = buildBackfillSuggestionLine(
+        backfillCandidate.slug,
+        newCwd,
+        backfillCandidate.hasIndex,
+      );
+      suggestPrefix = `${suggestLine}\n\n`;
+      recordSuggestionCooldown(HYPO_DIR, newCwd);
+      process.stderr.write(`\n\x1b[33m${suggestLine}\x1b[0m\n`);
+    } else if (shouldSuggestProjectCreation(newCwd, HYPO_DIR)) {
       const suggestLine = buildProjectSuggestionLine(newCwd);
       suggestPrefix = `${suggestLine}\n\n`;
       recordSuggestionCooldown(HYPO_DIR, newCwd);

package/hooks/hypo-shared.mjs

@@ -624,6 +624,80 @@ export function collectProjectWorkingDirs(hypoDir) {
   return out;
 }
 
+// A project without a working_dir anchor (no index.md, or an index.md missing
+// the field) never enters collectProjectWorkingDirs' universe, so cwd-first
+// resume always MISSes for it — the SessionStart/CwdChanged MISS branch would
+// otherwise only ever offer to create a brand-new (duplicate) project. Match
+// the cwd's LEAF basename only (not every ancestor): the anchor being written
+// is `working_dir: <cwd>` itself, so matching an ancestor directory would
+// backfill the wrong (parent) path. Since projects/<slug>/ names are unique on
+// disk, a leaf-basename match identifies at most one project — no separate
+// uniqueness gate is needed here (unlike pickProjectByCwd's cross-machine tier
+// 2, which reasons over synced *paths* that can collide).
+//
+// Known bound: a session whose cwd is a SUBDIRECTORY of the anchorless
+// project's root (rather than the root itself) will not match — this is a
+// deliberate scope limit, not a bug: guessing the project from a mid-tree cwd
+// would risk writing an anchor to the wrong (non-root) path.
+//
+// @param {string} cwd
+// @param {string} [hypoDir=HYPO_DIR]
+// @returns {{slug: string, hasIndex: boolean}|null} the anchorless project
+//   this cwd's leaf basename names, or null when there is no match, no
+//   session artifacts, or the project already carries a working_dir.
+export function findBackfillCandidate(cwd, hypoDir = HYPO_DIR) {
+  const n = normalizeWorkingDir(cwd);
+  if (!n) return null;
+  const projectsDir = join(hypoDir, 'projects');
+  if (!existsSync(projectsDir)) return null;
+  const leaf = _lastSeg(n);
+  if (!leaf) return null;
+
+  const ci = isCaseInsensitiveFs();
+  let entries;
+  try {
+    entries = readdirSync(projectsDir);
+  } catch {
+    return null;
+  }
+  const slug = entries.find((e) => e !== '_template' && _fold(e, ci) === _fold(leaf, ci));
+  if (!slug) return null;
+
+  const dir = join(projectsDir, slug);
+  try {
+    if (!statSync(dir).isDirectory()) return null;
+  } catch {
+    return null;
+  }
+  const hasArtifacts =
+    existsSync(join(dir, 'session-state.md')) ||
+    existsSync(join(dir, 'hot.md')) ||
+    existsSync(join(dir, 'session-log'));
+  if (!hasArtifacts) return null;
+
+  const indexPath = join(dir, 'index.md');
+  const hasIndex = existsSync(indexPath);
+  let workingDir = null;
+  if (hasIndex) {
+    try {
+      const fmBlock = readFileSync(indexPath, 'utf-8').match(/^---\r?\n([\s\S]*?)\r?\n---/);
+      const line = fmBlock && fmBlock[1].split(/\r?\n/).find((l) => /^working_dir:/.test(l));
+      if (line) {
+        workingDir = line
+          .slice('working_dir:'.length)
+          .trim()
+          .replace(/\s+#.*$/, '')
+          .replace(/^['"]|['"]$/g, '');
+      }
+    } catch {
+      workingDir = null;
+    }
+  }
+  if (hasIndex && workingDir) return null; // already anchored — not a backfill case
+
+  return { slug, hasIndex };
+}
+
 /**
  * When the session cwd is a project working_dir distinct from the vault root,
  * the wiki/knowledge files live in the VAULT, not in this cwd. SessionStart and
@@ -1461,6 +1535,23 @@ export function cwdHasProjectMarker(cwd) {
   return PROJECT_MARKERS.some((m) => existsSync(join(cwd, m)));
 }
 
+// Shared cooldown/skip gate for BOTH the new-project offer and the backfill
+// offer below — same store (.cache/project-suggestions.json), same key (cwd),
+// so a user who just answered one kind of offer for a cwd doesn't immediately
+// get re-prompted with the other. A corrupt store stays silent (doctor
+// surfaces the malformation separately).
+function suggestionNotSuppressed(cwd, hypoDir, now) {
+  const { skips, cooldowns, parseError } = readProjectSuggestions(hypoDir);
+  if (parseError) return false;
+  if (skips.some((s) => s && s.cwd === cwd)) return false;
+  const ts = cooldowns[cwd];
+  if (ts) {
+    const t = Date.parse(ts);
+    if (Number.isFinite(t) && now - t < SUGGESTION_COOLDOWN_MS) return false;
+  }
+  return true;
+}
+
 /**
  * Decide whether SessionStart/CwdChanged should offer to create a project for
  * `cwd`. The caller MUST have already confirmed `cwd` matches no project's
@@ -1478,15 +1569,25 @@ export function shouldSuggestProjectCreation(cwd, hypoDir = HYPO_DIR, now = Date
   if (!cwd) return false;
   if (!existsSync(join(cwd, '.git'))) return false;
   if (!cwdHasProjectMarker(cwd)) return false;
-  const { skips, cooldowns, parseError } = readProjectSuggestions(hypoDir);
-  if (parseError) return false;
-  if (skips.some((s) => s && s.cwd === cwd)) return false;
-  const ts = cooldowns[cwd];
-  if (ts) {
-    const t = Date.parse(ts);
-    if (Number.isFinite(t) && now - t < SUGGESTION_COOLDOWN_MS) return false;
-  }
-  return true;
+  return suggestionNotSuppressed(cwd, hypoDir, now);
+}
+
+/**
+ * Decide whether SessionStart/CwdChanged should offer to BACKFILL a
+ * working_dir anchor for `cwd`. The caller MUST have already located a
+ * findBackfillCandidate() match; this only applies the same cooldown/skip
+ * gate shouldSuggestProjectCreation uses, so the two offers share one
+ * suppression store. No git/marker gate here — the project directory
+ * already existing is itself the trigger condition.
+ *
+ * @param {string} cwd
+ * @param {string} [hypoDir]
+ * @param {number} [now] epoch ms, injectable for tests
+ * @returns {boolean}
+ */
+export function shouldSuggestBackfill(cwd, hypoDir = HYPO_DIR, now = Date.now()) {
+  if (!cwd) return false;
+  return suggestionNotSuppressed(cwd, hypoDir, now);
 }
 
 /**
@@ -1509,6 +1610,64 @@ export function buildProjectSuggestionLine(cwd) {
   return `[WIKI: cwd '${safe}'에 매칭되는 프로젝트가 없습니다. 자동 생성할까요? (Y/n)]`;
 }
 
+// Neutralize a PATH value for additionalContext injection without truncating
+// it — unlike sanitizeProjForPrompt (built for a short display name), a path
+// must render in full or the backfilled working_dir would be wrong. Only
+// newline/control chars are stripped (the injection vector); everything else,
+// including shell metacharacters, passes through untouched because this value
+// is NEVER assembled into a runnable command (see buildBackfillSuggestionLine)
+// — it is purely descriptive text for the LLM/user to read.
+function stripControlCharsForPath(raw) {
+  // Per-codepoint (not a regex escape range) so no control byte is written
+  // literally into this source file (the source-corruption trap hit earlier
+  // in this same change). Mirrors sanitizeProjForPrompt's coverage EXACTLY —
+  // C0 (0x00-0x1F), DEL+C1 (0x7F-0x9F, which folds in U+0085 NEL), and the
+  // U+2028/U+2029 line separators. Deliberately does NOT strip bidi format
+  // controls: sanitizeProjForPrompt doesn't either, and matching its exact
+  // decision (rather than inventing a wider one here) is the principled
+  // choice so the two sanitizers never silently diverge in coverage.
+  return Array.from(String(raw == null ? '' : raw))
+    .map((ch) => {
+      const code = ch.codePointAt(0);
+      const isC0OrDelOrC1 = code < 0x20 || (code >= 0x7f && code <= 0x9f);
+      const isLineSep = code === 0x2028 || code === 0x2029;
+      return isC0OrDelOrC1 || isLineSep ? ' ' : ch;
+    })
+    .join('');
+}
+
+/**
+ * Build the working_dir-backfill offer line for a cwd that names an EXISTING
+ * `projects/<slug>/` directory (findBackfillCandidate already confirmed it
+ * carries session artifacts but no anchor). `slug` (short, display-only)
+ * routes through sanitizeProjForPrompt; `cwd` (a real path that must not be
+ * corrupted) routes through stripControlCharsForPath instead — truncating a
+ * path would silently backfill the WRONG working_dir. Neither branch
+ * assembles a runnable shell command from either value (codex pre-commit
+ * review: embedding untrusted path/slug text into a copy-paste `node ...`
+ * invocation is a shell-injection vector); both branches are purely
+ * descriptive guidance for the LLM/user to act on.
+ *
+ * The two cases still need different WORDING: a MISSING index.md has nothing
+ * to edit yet, so the offer describes creating a fresh one anchored to the
+ * current cwd (the agent constructs the actual project-create.mjs invocation
+ * itself, safely, outside this string). An index.md that already EXISTS but
+ * simply omits working_dir needs a direct frontmatter addition instead.
+ *
+ * @param {string} slug the matching projects/<slug>/ directory name
+ * @param {string} cwd the session cwd (the value that would become working_dir)
+ * @param {boolean} hasIndex whether projects/<slug>/index.md already exists
+ * @returns {string}
+ */
+export function buildBackfillSuggestionLine(slug, cwd, hasIndex) {
+  const safeSlug = sanitizeProjForPrompt(slug);
+  const safeCwd = stripControlCharsForPath(cwd);
+  const action = hasIndex
+    ? `projects/${safeSlug}/index.md의 frontmatter에 working_dir: ${safeCwd}를 추가할까요?`
+    : `projects/${safeSlug}/index.md가 없습니다. 현재 세션의 cwd(${safeCwd})를 working_dir로 삼아 index.md를 새로 만들까요?`;
+  return `[WIKI: cwd가 기존 프로젝트 'projects/${safeSlug}/'와 이름이 일치하지만 working_dir 앵커가 없습니다. ${action} (Y/n)]`;
+}
+
 // ── clear-marker (amendment 2026-05-14) ──────────────────────
 // `/clear` cannot be blocked (no UserPromptSubmit fire). The only intervention
 // point is the SessionEnd(reason='clear') → SessionStart(source='clear') pair:
@@ -2598,6 +2757,141 @@ export function hasUserCloseSignal(transcriptPath) {
   return false;
 }
 
+/**
+ * True iff the Stop payload's `background_tasks` names an in-flight (not yet
+ * terminal) delegated subagent. Read-only: used to widen the autoclose
+ * reconfirm trigger (see hypo-auto-minimal-crystallize.mjs) to "work is
+ * demonstrably still running", not just "the wiki has uncommitted changes".
+ *
+ * Defined as the NEGATION of a terminal status, not an enumeration of
+ * "running" states — this repo has no `background_tasks` type definition
+ * (grep turns up nothing), so the real status vocabulary is unverified. An
+ * unrecognized/absent status is treated as in-flight; only a recognized
+ * terminal status clears it.
+ *
+ * Fail-open: a missing or non-array `background_tasks` is treated as "no
+ * in-flight subagent" (the field may simply not be sent by this Stop event),
+ * so in-flight detection degrades gracefully to the git-uncommitted signal
+ * alone rather than spuriously blocking.
+ */
+export function hasInFlightSubagent(payload) {
+  const tasks = payload && payload.background_tasks;
+  if (!Array.isArray(tasks)) return false;
+  const TERMINAL = /^(completed|complete|done|finished|failed|error|errored|cancelled|canceled)$/i;
+  return tasks.some(
+    (t) => t && t.type === 'subagent' && (t.status == null || !TERMINAL.test(String(t.status))),
+  );
+}
+
+// The reconfirm reason (hypo-auto-minimal-crystallize.mjs emitBlock's
+// reconfirm branch) instructs the close-now option under this exact label —
+// used below to correlate an AskUserQuestion tool_use to OUR close-reconfirm
+// prompt specifically, not just any AskUserQuestion the model happens to ask.
+// Exported so the hook builds its reason text off this SAME literal instead
+// of a second hardcoded copy: two independent literals would let a reworded
+// reason silently break this correlation with no test to catch it.
+export const CLOSE_RECONFIRM_MARK = '지금 닫기';
+
+/**
+ * True iff the LATEST correlated AskUserQuestion answer in the transcript
+ * declined an autoclose reconfirm prompt ("아직" / "나중" / "not yet" /
+ * "later") — order-sensitive so a decline is suppressed again once the user
+ * signals a NEW close intent afterward (re-arm).
+ *
+ * Read-only, forward scan over the FULL transcript (no tail truncation — a
+ * decline can precede the next Stop by any number of turns). Reuses the same
+ * askIds + tool_use_id correlation `hasUserCloseSignal` (above) uses to bind
+ * an AskUserQuestion answer to its own tool_use, so an unrelated tool_result
+ * string can't forge a decline. Unlike `hasUserCloseSignal` (which is a
+ * "any evidence, ever" OR), this tracks a single latest-wins boolean as it
+ * scans: a decline answer sets it true, and any later GENUINE USER close
+ * signal resets it to false — the user asked to close again, so the prior
+ * decline no longer applies.
+ *
+ * Two correlation guards (the same input-boundary concern class as
+ * extractUserMessages' tool_result/injection exclusion above):
+ *
+ *  1. Re-arm is gated to a real user-typed close signal ONLY — mirrors
+ *     extractUserMessages' own boundary filter (isMeta / promptSource
+ *     system|sdk / tool_result exclusion, see extractUserMessages above)
+ *     instead of re-deriving a separate policy. Without this, the MODEL'S
+ *     OWN assistant reasoning text (which can itself contain "세션 마무리"),
+ *     or a tool_result (e.g. a Read of a file that happens to quote a close
+ *     phrase), could silently clear a recorded decline and re-nag the user
+ *     who already said "아직" — the opposite of what a decline means.
+ *  2. The AskUserQuestion tool_use is only added to `askIds` when its input
+ *     carries CLOSE_RECONFIRM_MARK — i.e. it IS the close-reconfirm prompt,
+ *     not some unrelated question the model asked around the same time. An
+ *     unrelated question whose answer happens to contain a decline word
+ *     ("나중"/"later") must not correlate.
+ *
+ * Fail-open: a missing/unreadable transcript → false (do not suppress; keep
+ * reconfirming) — the caller stays on the safe (nag, not silent-close) side.
+ */
+export function isCloseReconfirmDeclined(transcriptPath) {
+  if (!transcriptPath) return false;
+  let lines;
+  try {
+    lines = readFileSync(transcriptPath, 'utf-8').split('\n');
+  } catch {
+    return false;
+  }
+  const DECLINE = /(아직|나중|not\s?yet|later)/i;
+  const askIds = new Set();
+  let declined = false;
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const msg = obj.message ?? obj;
+    const content = msg.content ?? obj.content;
+
+    // Re-arm boundary (guard 1): only a genuine user-typed close signal may
+    // re-arm. Same exclusions as extractUserMessages — isMeta injection,
+    // system/sdk synthetic prompts, and (via the array-content branch below)
+    // tool_result blocks, which are role:'user' in the transcript but are NOT
+    // user-typed text.
+    const isInjected = obj.isMeta === true || obj.promptSource === 'system' || obj.promptSource === 'sdk';
+    const role = msg.role ?? obj.role ?? obj.type;
+    if (!isInjected && role === 'user') {
+      if (typeof content === 'string') {
+        if (!content.startsWith('Stop hook feedback') && isClosePattern(content)) declined = false;
+      } else if (Array.isArray(content)) {
+        for (const b of content) {
+          // Only type:'text' blocks are genuine user-typed text — a
+          // tool_result block (also role:'user') is tool output, not
+          // something the user typed, and must not re-arm.
+          if (b && b.type === 'text' && typeof b.text === 'string' && isClosePattern(b.text)) {
+            declined = false;
+          }
+        }
+      }
+    }
+
+    if (!Array.isArray(content)) continue;
+    for (const b of content) {
+      if (!b || typeof b !== 'object') continue;
+      if (b.type === 'tool_use' && b.name === 'AskUserQuestion' && b.id) {
+        // Correlation guard 2: only OUR close-reconfirm prompt counts.
+        const inputStr = JSON.stringify(b.input ?? null);
+        if (inputStr.includes(CLOSE_RECONFIRM_MARK)) askIds.add(b.id);
+        continue;
+      }
+      if (b.type === 'tool_result' && b.tool_use_id && askIds.has(b.tool_use_id)) {
+        const s = typeof b.content === 'string' ? b.content : JSON.stringify(b.content);
+        for (const m of s.matchAll(/="([^"]*)"/g)) {
+          if (DECLINE.test(m[1])) declined = true;
+        }
+      }
+    }
+  }
+  return declined;
+}
+
 /**
  * Build hook output for Claude Code (additionalContext channel).
  * Codex hooks write systemMessage directly in their own files.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hypomnema",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "LLM-native personal wiki system for Claude Code",
   "type": "module",
   "license": "MIT",

package/scripts/doctor.mjs

@@ -20,7 +20,11 @@ import { fileURLToPath } from 'url';
 import { resolveHypoRoot, expandHome } from './lib/hypo-root.mjs';
 import { loadHypoIgnore, isScanIgnored } from './lib/hypo-ignore.mjs';
 import { parseFrontmatter } from './lib/frontmatter.mjs';
-import { readSyncState, projectSuggestionsPath } from '../hooks/hypo-shared.mjs';
+import {
+  readSyncState,
+  projectSuggestionsPath,
+  collectProjectWorkingDirs,
+} from '../hooks/hypo-shared.mjs';
 import {
   discoverExtensions,
   parseManifest,
@@ -517,6 +521,73 @@ function checkVerifyBy(hypoDir, ignorePatterns = []) {
   }
 }
 
+// ── per-project index.md working_dir anchor coverage ─────────────────────────
+//
+// cwd-first resume (scripts/lib/wd-match.mjs + hooks/hypo-shared.mjs
+// collectProjectWorkingDirs) anchors each project to a cwd via the
+// `working_dir` field in projects/<slug>/index.md. A project born before an
+// index.md was filled in (or one whose index.md never got the field) carries
+// no anchor, so cwd matching silently degrades to recency for it. This is
+// hygiene reporting, never a hard-fail: recency fallback still resolves
+// something, just less precisely.
+//
+// Anchor status is read via hooks/hypo-shared.mjs collectProjectWorkingDirs —
+// the SAME function the deployed CwdChanged/SessionStart hooks use at
+// runtime — rather than the generic (lenient) parseFrontmatter. That matters:
+// parseFrontmatter accepts `working_dir : /repo` (space before the colon),
+// but the runtime hook matcher only recognizes the exact `working_dir:` form
+// (no space). Using parseFrontmatter here would report a project as anchored
+// when cwd-first resume still can't actually match it — a false pass this
+// check exists specifically to prevent.
+function checkProjectIndexAnchors(hypoDir) {
+  const projectsDir = join(hypoDir, 'projects');
+  if (!existsSync(projectsDir)) return;
+
+  const anchoredWorkingDir = new Map(
+    collectProjectWorkingDirs(hypoDir).map((p) => [p.slug, p.workingDir]),
+  );
+
+  const unanchored = [];
+  for (const slug of readdirSync(projectsDir)) {
+    if (slug === '_template') continue;
+    const dir = join(projectsDir, slug);
+    try {
+      if (!statSync(dir).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+
+    // Only a project that actually HAS session activity is worth anchoring —
+    // a bare scaffold (e.g. mid-creation) has nothing yet for cwd-first
+    // resume to lose.
+    const hasArtifacts =
+      existsSync(join(dir, 'session-state.md')) ||
+      existsSync(join(dir, 'hot.md')) ||
+      existsSync(join(dir, 'session-log'));
+    if (!hasArtifacts) continue;
+
+    const indexPath = join(dir, 'index.md');
+    if (!existsSync(indexPath)) {
+      unanchored.push(`${slug} (no index.md)`);
+      continue;
+    }
+    if (!anchoredWorkingDir.get(slug)) {
+      unanchored.push(`${slug} (index.md missing working_dir)`);
+    }
+  }
+
+  if (unanchored.length === 0) {
+    pass('Project index anchors', 'All session-bearing projects carry a working_dir anchor');
+  } else {
+    const sample = unanchored.slice(0, 5).join(', ');
+    const extra = unanchored.length > 5 ? ` (+${unanchored.length - 5} more)` : '';
+    warn(
+      'Project index anchors',
+      `${unanchored.length} project(s) cwd-first resume can't anchor: ${sample}${extra}`,
+    );
+  }
+}
+
 function checkSyncState(hypoDir) {
   // "open" = file exists with ≥1 entries; session-start clears once
   // sync is healthy again. Schema + parsing live in hooks/hypo-shared.mjs.
@@ -1135,6 +1206,7 @@ checkStaleSibling();
 if (args.codex) checkCodexPaths();
 if (rootOk) checkExtensions(args.hypoDir, args.claudeHome, 'claude');
 if (rootOk && args.codex) checkExtensions(args.hypoDir, args.claudeHome, 'codex');
+if (rootOk) checkProjectIndexAnchors(args.hypoDir);
 if (rootOk) checkSyncState(args.hypoDir);
 if (rootOk) checkProjectSuggestions(args.hypoDir);
 if (rootOk) checkFeedbackProjection(args.hypoDir, args.claudeHome, args.projectId);

package/scripts/lint.mjs

@@ -132,6 +132,20 @@ const TYPE_CONDITIONAL_FIELDS = {
   'weekly-journal': ['week'],
 };
 
+// type-conditional FORBIDDEN fields: a field that is legitimate on one type
+// only, but has been observed leaking into another via an unvalidated writer.
+// `working_dir` (and its companion `project`) belong solely on
+// `project-index` (index.md) — TYPE_CONDITIONAL_FIELDS above requires it
+// there. Unvalidated crystallize output has planted a stray `working_dir` /
+// `project` key on session-state.md instead, silently pointing injected
+// context at a wrong or stale path. Warn-only (not promoted via
+// STRICT_PROMOTE_IDS): this guards against a writer bug, not confirmed-bad
+// content a real YAML/type check would reject, so an existing vault carrying
+// the stray field is not hard-blocked.
+const TYPE_FORBIDDEN_FIELDS = {
+  'session-state': ['working_dir', 'project'],
+};
+
 const TYPE_ENUM_FIELDS = {
   prd: { status: ['draft', 'active', 'completed', 'cancelled', 'archived'] },
   adr: { status: ['proposed', 'accepted', 'deprecated', 'superseded'] },
@@ -379,6 +393,24 @@ function lintPage({ path, rel }, slugMap, tagVocab, pageDirs, validTypes) {
     }
   }
 
+  // type-conditional forbidden fields (W11): a field valid only on a
+  // DIFFERENT type planted here by an unvalidated writer. Object.hasOwn
+  // (not `fm[field]`) so a present-but-empty `working_dir:` still flags —
+  // the bug is the key's presence, not its value.
+  if (fm.type && TYPE_FORBIDDEN_FIELDS[fm.type]) {
+    for (const field of TYPE_FORBIDDEN_FIELDS[fm.type]) {
+      if (Object.hasOwn(fm, field)) {
+        issue(
+          'warn',
+          rel,
+          `Forbidden frontmatter field for type "${fm.type}": "${field}" (only valid on project-index)`,
+          null,
+          'W11',
+        );
+      }
+    }
+  }
+
   // type-specific enum validation
   if (fm.type && TYPE_ENUM_FIELDS[fm.type]) {
     for (const [field, allowed] of Object.entries(TYPE_ENUM_FIELDS[fm.type])) {

package/templates/hypo-config.md

@@ -1,7 +1,7 @@
 ---
 title: Hypomnema Config
 type: config
-version: "1.6.0"
+version: "1.6.1"
 created: YYYY-MM-DD
 ---