hypomnema 1.6.2 → 1.7.1

package/hooks/hypo-session-start.mjs

@@ -19,6 +19,8 @@ import {
   formatGrowthMetrics,
   readSyncState,
   clearSyncState,
+  recordSyncSuccess,
+  classifySyncOp,
   readClearMarker,
   clearClearMarker,
   loadHypoIgnore,
@@ -32,6 +34,10 @@ import {
   collectProjectWorkingDirs,
   buildVaultOrientation,
   staleMarkerFor,
+  currentDevice,
+  scopeVisible,
+  readVisibilityScope,
+  pkgRootDriftStatus,
 } from './hypo-shared.mjs';
 import {
   defaultCachePath,
@@ -45,16 +51,49 @@ import {
   computeSiblingNotice,
   siblingAlreadyNotified,
   markSiblingNotified,
+  pkgRootDriftAlreadyNotified,
+  markPkgRootDriftNotified,
+  clearPkgRootDriftNotified,
 } from './version-check.mjs';
+import { snapshotBase, overwriteTargets } from './base-store.mjs';
+import { listProposals } from './proposal-store.mjs';
 
 // Privacy guard: refuse to read+inject .hypoignore-matched
 // wiki files into additionalContext. Without this, a user who lists
 // `projects/private/hot.md` in .hypoignore would still see SECRET emit because
 // session-start reads hot/state paths directly.
+//
+// Visibility guard: a machine-scoped page (visibility_scope: machine:<owner>)
+// must not be injected on a machine other than its owner. hypo-file-watch
+// already filters these very files, so leaving session start unfiltered made the
+// SAME file behave differently depending on which path opened it: the user sets
+// the field, sees it honored on edit, and never learns that session start still
+// ships the body. Read the scope from the RAW content before the maxChars slice:
+// slicing first could cut the frontmatter off and silently fail open.
+// The root hot.md is a frontmatter-less pointer table, so it reads as '' and
+// passes (shared) unchanged.
 function readIfNotIgnored(path, maxChars, patterns) {
   if (!path) return null;
   if (patterns.length > 0 && isIgnored(path, HYPO_DIR, patterns)) return null;
-  return readFileSync(path, 'utf-8').slice(0, maxChars);
+  const raw = readFileSync(path, 'utf-8');
+  if (!scopeVisible(readVisibilityScope(raw), currentDevice())) return null;
+  return raw.slice(0, maxChars);
+}
+
+// Scoped-out is not the same as absent. Both make readIfNotIgnored return null,
+// but telling the model "no snapshot yet / first session" when the snapshot merely
+// belongs to another machine is a lie it will act on. Returns false for an ignored
+// or missing file so only a real machine-scope hide reports true.
+// The caller may name the project and the fact, never the withheld body: a message
+// explaining the hide must not re-leak what it hid.
+function isScopedOut(path, patterns) {
+  try {
+    if (!path || !existsSync(path)) return false;
+    if (patterns.length > 0 && isIgnored(path, HYPO_DIR, patterns)) return false;
+    return !scopeVisible(readVisibilityScope(readFileSync(path, 'utf-8')), currentDevice());
+  } catch {
+    return false;
+  }
 }
 
 // Compute the STALE marker for a hot/state file from its RAW content (readIfNotIgnored
@@ -181,6 +220,52 @@ function buildSiblingNotice() {
   }
 }
 
+/**
+ * pkgRoot drift notice. hypo-shared.mjs's resolvePkgRoot() already
+ * self-corrects PKG_ROOT in memory whenever the code's own resolved location
+ * disagrees with the cached hypo-pkg.json — but silent self-correction is the
+ * exact failure this closes: the user's own `upgrade` habit stops mattering
+ * and nothing ever tells them hypo-pkg.json fell behind. Surfaced once per
+ * (cached → self-location) pair via the same notify-once cache the sibling
+ * notice above uses — a fresh drift (new self-location) re-notifies, but
+ * staying on the same drifted state doesn't nag every session.
+ *
+ * Tri-state (pkgRootDriftStatus): 'match' CLEARS any earlier mark (checked
+ * FIRST, unconditionally — even under opt-out, so a drift that resolves while
+ * opted out doesn't leave a stale mark that then suppresses a genuine
+ * recurrence once opt-out is lifted); 'unknown' touches nothing (self-location
+ * could not be resolved this session — the permanent steady state for the
+ * npm/manual channel, not evidence either way); only 'drift' can produce a
+ * banner, and opt-out is checked there so an opted-out session never marks a
+ * pair as notified it never actually showed.
+ */
+function buildPkgRootDriftNotice() {
+  try {
+    const status = pkgRootDriftStatus();
+    const cachePath = defaultCachePath();
+    if (status.status === 'match') {
+      clearPkgRootDriftNotified(cachePath);
+      return '';
+    }
+    if (status.status === 'unknown') return '';
+    if (isOptedOut()) return '';
+    const key = `${status.cached || '(none)'}->${status.self}`;
+    const cache = readCache(cachePath);
+    if (pkgRootDriftAlreadyNotified(cache, key)) return '';
+    markPkgRootDriftNotified(cachePath, key);
+    return (
+      `[Hypomnema] Package metadata drift: hypo-pkg.json still points at ` +
+      `\`${status.cached || '(none)'}\`, but the code actually running resolves to ` +
+      `\`${status.self}\`.\n` +
+      `  Hooks already resolved the correct root for this session — this is a ` +
+      `heads-up, not a blocker.\n` +
+      `  → run \`/hypo:upgrade --apply\` to bring hypo-pkg.json back in sync.`
+    );
+  } catch {
+    return '';
+  }
+}
+
 const PROJECTS_DIR = join(HYPO_DIR, 'projects');
 const GROWTH_CACHE = join(HYPO_DIR, '.cache', 'last-session-growth.json');
 
@@ -220,14 +305,22 @@ function buildClearRecoveryLine(source) {
   );
 }
 
-/** Pull the wiki repo. Returns true only when the pull actually succeeded. */
+/**
+ * Pull the wiki repo. Returns true only when the pull actually succeeded. On
+ * success, also records the last-success timestamp (silently — no notice; the
+ * existing failure notice below is unchanged) so doctor never reports "never
+ * synced" right after a healthy startup pull, even when no auto-commit Stop
+ * hook has run yet this session.
+ */
 function gitPull(dir) {
   if (!existsSync(join(dir, '.git'))) return false;
   const r = spawnSync('git', ['-C', dir, 'pull', '--ff-only', '--quiet'], {
     stdio: 'pipe',
     timeout: 10000,
   });
-  return r.status === 0;
+  const ok = r.status === 0;
+  if (ok) recordSyncSuccess(dir, 'pull');
+  return ok;
 }
 
 /**
@@ -241,7 +334,9 @@ function gitPull(dir) {
  * fresh `hypo init` wiki does not git-ignore `.cache/`, so a broader cleanliness
  * check would see the sync-state file itself and never clear.
  *
- * @returns {string} a `[WIKI: last sync failed: ...]` line, or '' when clear.
+ * @returns {string} a `[WIKI: last sync failed: ...]` (or, for a conflict/
+ *   conflict-unresolved entry, dedicated manual-merge guidance) line, or ''
+ *   when clear.
  */
 function syncStateNotice(pullOk) {
   const { entries, parseError } = readSyncState(HYPO_DIR);
@@ -262,15 +357,64 @@ function syncStateNotice(pullOk) {
     return '';
   }
   const last = entries[entries.length - 1];
-  if (last.op === 'conflict') {
+  // classifySyncOp (hypo-shared.mjs) is the single judgment both this hook
+  // and doctor.mjs's checkSyncState branch on, so the two surfaces cannot
+  // silently diverge on WHICH op gets which treatment: this exact check used
+  // to be an exact `=== 'conflict'` comparison here that missed
+  // 'conflict-unresolved' — the MORE dangerous op, since the abort itself
+  // failed and the tree may still be half-merged — while doctor already
+  // caught it via startsWith('conflict').
+  const cls = classifySyncOp(last.op);
+  if (cls === 'conflict-unresolved') {
+    return (
+      `[WIKI: remote diverged AND the automatic merge-abort failed — the working ` +
+      `tree may still be half-merged (unmerged paths or an in-progress merge). ` +
+      `Do NOT commit or push yet. Inspect \`git -C ${HYPO_DIR} status\` first: if a ` +
+      `merge is in progress, resolve the conflicts, then \`git -C ${HYPO_DIR} add <resolved paths>\` ` +
+      `and \`git -C ${HYPO_DIR} commit\` (git refuses a commit while unmerged entries remain staged) ` +
+      `— or run \`git -C ${HYPO_DIR} merge --abort\` to discard it instead, before continuing.]`
+    );
+  }
+  if (cls === 'conflict') {
     return (
       `[WIKI: remote diverged — auto-merge was aborted to protect your edits ` +
       `(your local work is committed and safe; the other machine's version is on the remote). ` +
       `Resolve manually: \`git -C ${HYPO_DIR} pull --no-rebase\`, fix conflicts, then push.]`
     );
   }
+  // An unrecognized `conflict*` op — some future syncRemote failure mode this
+  // hook has no dedicated branch for. Neither the clean-conflict claim above
+  // ("committed and safe") nor the conflict-unresolved claim ("the abort
+  // failed") is known to be true here, so assert neither: say plainly that
+  // the state is unknown and treat it as unresolved until a human checks.
+  if (cls === 'unknown-conflict') {
+    return (
+      `[WIKI: remote diverged — an unrecognized conflict-related sync failure was recorded ` +
+      `(op='${last.op}'). Its resolution state cannot be confirmed automatically, so treat it ` +
+      `as unresolved: do NOT commit or push yet. Inspect \`git -C ${HYPO_DIR} status\` first for ` +
+      `unmerged paths or an in-progress merge before continuing.]`
+    );
+  }
   return `[WIKI: last sync failed: ${last.op || '?'} — ${last.error || 'unknown'}]`;
 }
+/**
+ * Surface the vault-wide count of parked write-proposals (T8). Routed
+ * exactly like syncStateNotice: the line joins the `notices` array (→
+ * additionalContext) and is also written to stderr, so both the model and the
+ * user's transcript see it. NOT a systemMessage banner (that channel is
+ * reserved for the update/sibling notices). Pure read (listProposals never
+ * mutates); best-effort so a store read failure never breaks SessionStart. '' when
+ * there are no pending proposals, so nothing surfaces on the empty path.
+ */
+function pendingProposalNotice() {
+  try {
+    const n = listProposals(HYPO_DIR).length;
+    if (n === 0) return '';
+    return `[WIKI: 대기 proposal ${n}건 (검토: hypomnema proposal list)]`;
+  } catch {
+    return '';
+  }
+}
 const GLOBAL_HOT = join(HYPO_DIR, 'hot.md');
 const HOT_CHARS = 2000;
 const STATE_CHARS = 2000;
@@ -346,6 +490,7 @@ process.stdin.on('end', () => {
 
     const pullOk = gitPull(HYPO_DIR);
     const syncLine = syncStateNotice(pullOk);
+    const proposalLine = pendingProposalNotice();
     const growthLine = readLastGrowthLine();
     // On source='clear', surface the dying
     // session's identity that hypo-session-end stashed so Claude can recover
@@ -354,31 +499,53 @@ process.stdin.on('end', () => {
     const clearRecoveryLine = buildClearRecoveryLine(data.source);
     const updateLine = buildUpdateNotice();
     const siblingLine = buildSiblingNotice();
-    // The update + stale-sibling banners must reach the USER. On a
-    // SessionStart hook that exits 0, stderr is invisible in the normal TUI
-    // (only shown on exit 2 / --verbose) and additionalContext is model-only —
-    // `systemMessage` is the documented user-visible channel. Route those two
-    // banners there. They ALSO stay in noticePrefix → additionalContext below,
-    // so the model and the user start the session looking at the same state.
-    // (The other stderr notices — sync/growth/clear/suggest — are intentionally
-    // transcript/--verbose only and out of this banner's scope.)
-    const userMessage = [updateLine, siblingLine].filter(Boolean).join('\n\n');
+    const pkgDriftLine = buildPkgRootDriftNotice();
+    // The update + stale-sibling + pkgRoot-drift banners must reach the USER.
+    // On a SessionStart hook that exits 0, stderr is invisible in the normal
+    // TUI (only shown on exit 2 / --verbose) and additionalContext is
+    // model-only — `systemMessage` is the documented user-visible channel.
+    // Route those banners there. They ALSO stay in noticePrefix →
+    // additionalContext below, so the model and the user start the session
+    // looking at the same state. (The other stderr notices —
+    // sync/growth/clear/suggest — are intentionally transcript/--verbose only
+    // and out of this banner's scope.)
+    const userMessage = [updateLine, siblingLine, pkgDriftLine].filter(Boolean).join('\n\n');
     if (userMessage) outExtra = { ...outExtra, systemMessage: userMessage };
-    const notices = [syncLine, growthLine, clearRecoveryLine, updateLine, siblingLine].filter(
-      Boolean,
-    );
+    const notices = [
+      syncLine,
+      proposalLine,
+      growthLine,
+      clearRecoveryLine,
+      updateLine,
+      siblingLine,
+      pkgDriftLine,
+    ].filter(Boolean);
     let noticePrefix = notices.length ? `${notices.join('\n\n')}\n\n` : '';
     if (syncLine) process.stderr.write(`\n\x1b[33m${syncLine}\x1b[0m\n`);
+    if (proposalLine) process.stderr.write(`\n\x1b[33m${proposalLine}\x1b[0m\n`);
     if (growthLine) process.stderr.write(`\n\x1b[36m${growthLine}\x1b[0m\n`);
     if (clearRecoveryLine)
       process.stderr.write(`\n\x1b[33m${clearRecoveryLine.split('\n')[0]}\x1b[0m\n`);
     if (updateLine) process.stderr.write(`\n\x1b[33m${updateLine}\x1b[0m\n`);
     if (siblingLine) process.stderr.write(`\n\x1b[33m${siblingLine}\x1b[0m\n`);
+    if (pkgDriftLine) process.stderr.write(`\n\x1b[33m${pkgDriftLine}\x1b[0m\n`);
     const cwd = data.cwd || data.directory || process.cwd();
     const sessionId = data.session_id || 'default';
     const MARKER_FILE = sessionMarkerPath(sessionId);
     const hit = findProjectFiles(cwd);
 
+    // Observed-base snapshot for the write=proposal gate. Deliberately AFTER gitPull: the base must
+    // describe the tree this session actually starts from, remote merges
+    // included, or the first close would raise a proposal against content the
+    // session never had a chance to conflict with. Once per session
+    // (existence-check inside snapshotBase), so resume and compact leave it
+    // alone. `data.session_id` is used raw rather than the 'default' fallback
+    // above. A session with no id has no base and closes down the legacy
+    // direct-write path.
+    if (data.session_id) {
+      snapshotBase(HYPO_DIR, data.session_id, overwriteTargets(hit ? hit.proj : null));
+    }
+
     const ignorePatterns = loadHypoIgnore(HYPO_DIR);
 
     // When cwd is a project working_dir that is NOT the vault itself, tell the
@@ -425,17 +592,29 @@ process.stdin.on('end', () => {
           ),
         );
       } else {
+        // A snapshot that exists but is scoped to another machine must not be
+        // reported as "no snapshot yet": the model would treat a resumed project
+        // as a first session. Say which it is, and say nothing of the contents.
+        const scopedOut =
+          isScopedOut(hit.hotPath, ignorePatterns) || isScopedOut(hit.statePath, ignorePatterns);
+        const reason = scopedOut ? 'snapshot scoped to another machine' : 'no snapshot yet';
         process.stderr.write(
-          `\n\x1b[36m[Hypomnema]\x1b[0m project: \x1b[1m${hit.proj}\x1b[0m (no snapshot yet)\n\n`,
+          `\n\x1b[36m[Hypomnema]\x1b[0m project: \x1b[1m${hit.proj}\x1b[0m (${reason})\n\n`,
         );
+        // Carry the reason into the marker, not just this hook's output.
+        // hypo-first-prompt derives its resume line from the marker alone, so a
+        // marker that says only `hotPath: null` makes the NEXT prompt announce
+        // "first session" for a project that merely belongs to another machine.
+        // That lie is what invites the model to author a fresh hot.md over one
+        // that already exists elsewhere.
         writeFileSync(
           MARKER_FILE,
-          JSON.stringify({ proj: hit.proj, hotPath: null, ts: Date.now() }),
+          JSON.stringify({ proj: hit.proj, hotPath: null, scopedOut, ts: Date.now() }),
         );
         console.log(
           JSON.stringify(
             buildOutput(
-              `${noticePrefix}${hitPrefix}[WIKI HOT CACHE: project=${sanitizeProjForPrompt(hit.proj)}, no snapshot yet]`,
+              `${noticePrefix}${hitPrefix}[WIKI HOT CACHE: project=${sanitizeProjForPrompt(hit.proj)}, ${reason}]`,
               outExtra,
             ),
           ),