hypomnema 1.8.0 → 1.8.2

package/hooks/hypo-compact-guard.mjs

@@ -9,20 +9,47 @@
  * PreCompact event at all, so this hook is the only chat-side gate that can
  * prompt session-close before a context wipe.
  *
- * Behavior: if session close is incomplete → instruct Claude to run session close
- * immediately before /compact or /clear.
+ * Behavior: if session close is incomplete, tell Claude so (a description, not
+ * an instruction — session-close-scope-boundary spec §5) before /compact or
+ * /clear runs.
+ *
+ * This hook never calls precompactGateStatus: its own hooks.json timeout is
+ * 10s and the gate's lint spawn alone budgets 30s, three times over. Instead
+ * it re-checks only the cheap axes (session log, git, hot.md) directly, and
+ * narrows the git axis with the SAME project-vs-foreign path rule the gate
+ * uses (isForeignProjectFile / classifyForeignOnlyDirty in hypo-shared.mjs), so
+ * a different project's dangling close file does not fire a false alarm here
+ * either. Unlike the gate, this hook never passes transcriptTouched into that
+ * rule: parsing the transcript is exactly the evidence spec §5 excludes to
+ * stay inside the 10s budget, so only the cheap path-prefix axis runs here.
  */
 
 import {
   lastSubstantialOpIsSession,
   hypoIsClean,
+  gitDirtyFiles,
   hotMdIsClean,
   readChecklist,
   isClearCommand,
   isCompactOrClearCommand,
   isGateSkipped,
+  resolveGateProjectOverride,
+  classifyForeignOnlyDirty,
+  buildOutput,
+  HYPO_DIR,
 } from './hypo-shared.mjs';
 
+// A fixed slice of this hook's own 10s hooks.json budget (hooks.json:60),
+// shared as ONE deadline across every git spawn hypoIsClean and
+// gitDirtyFiles make below (up to four): each call re-checks the time left
+// and skips its own spawn once the shared budget is spent, so no NEW spawn
+// starts once this budget is gone. That bounds the git-spawn total, not the
+// hook's wall-clock time end to end: measured 145ms on a normal run and
+// 6273ms with a slow fsmonitor in the mix, both inside the 10s hooks.json
+// timeout, but a spawnSync child that outlives a SIGTERM has no coded upper
+// bound here.
+const GIT_DEADLINE_BUDGET_MS = 6000;
+
 let input = '';
 process.stdin.setEncoding('utf-8');
 process.stdin.on('data', (chunk) => {
@@ -40,24 +67,98 @@ process.stdin.on('end', () => {
 
     const detected = isClearCommand(prompt) ? '/clear' : '/compact';
 
-    const hasSession = lastSubstantialOpIsSession();
-    const gitStatus = hypoIsClean();
-    const hotStatus = hotMdIsClean();
+    // These two run on EVERY /compact or /clear, unlike resolveGateProjectOverride
+    // below (which only runs when gitStatus.uncommitted is already true). A
+    // throw here would reach the outermost catch on every single prompt, not
+    // just the git-dirty ones, so the exposure is wider than the resolveGate
+    // case: fail closed locally instead ("reason present"), never fail open
+    // ("looks clean"). A read failure on either file is not the same fact as
+    // that file being genuinely absent or well-formed, so the fallback reason
+    // says "unreadable", not "missing" or "invalid", to keep the two causes
+    // tellable apart from the additionalContext text alone.
+    // lastSubstantialOpIsSession() now reads a MISSING log.md (ENOENT) as
+    // `false`, and reads only via a single readFileSync call (no separate
+    // existsSync precheck), so there is no check-then-read window where the
+    // file is deleted between the two and falls back to the old fail-open
+    // `true`. That keeps state-table row 1 (spec §5, "session log entry
+    // missing") surfaced: a brand-new vault with an all-foreign dirty tree
+    // and a clean hot.md still reports the missing log instead of going
+    // fully silent. Any OTHER read failure (EISDIR, EACCES, ...) is a real
+    // problem, so the function rethrows it, and the try/catch below turns
+    // that into the same fail-closed `hasSession = false` plus a stderr line.
+    let hasSession;
+    try {
+      hasSession = lastSubstantialOpIsSession();
+    } catch (err) {
+      process.stderr.write(
+        `[hypo-compact-guard] error: lastSubstantialOpIsSession failed, treating as session log entry missing: ${err?.message ?? String(err)}\n`,
+      );
+      hasSession = false;
+    }
+    const deadline = { end: performance.now() + GIT_DEADLINE_BUDGET_MS };
+    const gitStatus = hypoIsClean(undefined, { deadline });
+    let hotStatus;
+    try {
+      hotStatus = hotMdIsClean();
+    } catch (err) {
+      process.stderr.write(
+        `[hypo-compact-guard] error: hotMdIsClean failed, treating as hot.md unreadable: ${err?.message ?? String(err)}\n`,
+      );
+      hotStatus = { clean: false, reason: `hot.md unreadable: ${err?.message ?? String(err)}` };
+    }
 
-    // Block on uncommitted (real unsaved work); unpushed commits (ahead)
-    // are a soft, auto-synced state and must not block /compact or /clear — mirrors
-    // the precompactGateStatus demote so the chat-side gate stays consistent.
-    if (hasSession && !gitStatus.uncommitted && hotStatus.clean) {
-      console.log(JSON.stringify({ continue: true, suppressOutput: true }));
-      return;
+    // Uncommitted (real unsaved work) blocks; unpushed commits (ahead) are a
+    // soft, auto-synced state and never reach `gitStatus.reason` here, since
+    // `uncommitted` is what gates it — mirrors the precompactGateStatus
+    // demote so the chat-side gate stays consistent.
+    let gitReason = gitStatus.uncommitted ? gitStatus.reason : '';
+    if (gitStatus.uncommitted) {
+      // resolveGateProjectOverride (session-close-scope-boundary spec §2):
+      // the same cwd-to-project resolution PreCompact and Stop already use.
+      // null just means "no project this cwd unambiguously owns" — that
+      // keeps the git axis judged globally, exactly like today. Scoped
+      // inside `uncommitted` on purpose: it only narrows the git notice, so
+      // a clean /compact has no reason to pay for a projects/ scan.
+      //
+      // Unlike classifyForeignOnlyDirty, this call is NOT contract-bound to
+      // stay silent: it walks through collectProjectWorkingDirs' own
+      // readdirSync, which sits outside that function's try/catch. Left
+      // uncaught here, that throw would escape past this hook's git-axis
+      // logic into the outermost catch and come back as a FULLY suppressed
+      // {suppressOutput:true} — silently dropping the session-log and
+      // hot.md reasons too, not just this one. Catch it locally and demote
+      // to null (its own "no project" sentinel) so a broken vault still
+      // gets every reason it is due.
+      let attributionScope = null;
+      try {
+        attributionScope = resolveGateProjectOverride(HYPO_DIR, {
+          sessionCwd: data.cwd ?? null,
+        });
+      } catch (err) {
+        process.stderr.write(
+          `[hypo-compact-guard] error: resolveGateProjectOverride failed, treating as no override: ${err?.message ?? String(err)}\n`,
+        );
+      }
+      if (attributionScope) {
+        const dirty = gitDirtyFiles(HYPO_DIR, { deadline });
+        const classification = classifyForeignOnlyDirty(HYPO_DIR, dirty, {
+          effectiveOverride: attributionScope,
+        });
+        if (classification === 'foreign-only') gitReason = '';
+      }
     }
 
     const reasons = [
       !hasSession ? 'session log entry missing' : '',
-      gitStatus.uncommitted ? gitStatus.reason : '',
+      gitReason,
       !hotStatus.clean ? hotStatus.reason : '',
     ].filter(Boolean);
 
+    if (reasons.length === 0) {
+      console.log(JSON.stringify({ continue: true, suppressOutput: true }));
+      return;
+    }
+
     const today = new Date().toISOString().slice(0, 10);
     const checklist = readChecklist(today);
     const body = checklist
@@ -65,17 +166,19 @@ process.stdin.on('end', () => {
       : 'See hypo-guide.md for the session-close checklist.';
 
     console.log(
-      JSON.stringify({
-        continue: true,
-        additionalContext: [
-          `[WIKI_AUTOCLOSE] ${detected} detected — session close incomplete (${reasons.join(', ')}).`,
-          `Do NOT wait for user input. Run wiki session close NOW, then retry ${detected}.`,
-          ``,
-          body,
-          ``,
-          `To bypass: set HYPO_SKIP_GATE=1`,
-        ].join('\n'),
-      }),
+      JSON.stringify(
+        buildOutput(
+          'UserPromptSubmit',
+          [
+            `[WIKI_AUTOCLOSE] ${detected} detected: session close incomplete (${reasons.join(', ')}).`,
+            ``,
+            body,
+            ``,
+            `To bypass: set HYPO_SKIP_GATE=1`,
+          ].join('\n'),
+          { continue: true },
+        ),
+      ),
     );
   } catch (err) {
     // Fail-open: any parse/runtime error must not block the user's prompt.

package/hooks/hypo-cwd-change.mjs

@@ -10,7 +10,6 @@ import { readFileSync, writeFileSync, existsSync, realpathSync } from 'fs';
 import { join } from 'path';
 import {
   HYPO_DIR,
-  buildOutput,
   loadHypoIgnore,
   isIgnored,
   sessionMarkerPath,
@@ -153,16 +152,17 @@ process.stdin.on('end', () => {
       // working_dir distinct from the vault, surface where wiki files live.
       const vaultOrientation = buildVaultOrientation(newCwd);
       const orientPrefix = vaultOrientation ? `${vaultOrientation}\n\n` : '';
+      // Built inline rather than through buildOutput(): CwdChanged has no
+      // documented context-injection path, so the nested hookSpecificOutput
+      // shape buildOutput() now emits would be wrong for this event. The
+      // follow-up that moves this hook to systemMessage removes these three
+      // literals; until then they keep today's behaviour unchanged.
       console.log(
-        JSON.stringify(
-          buildOutput(
-            `${orientPrefix}[WIKI: cwd changed → project=${sanitizeProjForPrompt(newHit.proj)}]\n\n${content}`,
-            {
-              continue: true,
-              suppressOutput: true,
-            },
-          ),
-        ),
+        JSON.stringify({
+          continue: true,
+          suppressOutput: true,
+          additionalContext: `${orientPrefix}[WIKI: cwd changed → project=${sanitizeProjForPrompt(newHit.proj)}]\n\n${content}`,
+        }),
       );
       return;
     }
@@ -199,9 +199,11 @@ process.stdin.on('end', () => {
     if (!globalContent) {
       if (suggestPrefix) {
         console.log(
-          JSON.stringify(
-            buildOutput(suggestPrefix.trimEnd(), { continue: true, suppressOutput: true }),
-          ),
+          JSON.stringify({
+            continue: true,
+            suppressOutput: true,
+            additionalContext: suggestPrefix.trimEnd(),
+          }),
         );
       } else {
         console.log(JSON.stringify({ continue: true, suppressOutput: true }));
@@ -209,12 +211,11 @@ process.stdin.on('end', () => {
       return;
     }
     console.log(
-      JSON.stringify(
-        buildOutput(
-          `${suggestPrefix}[WIKI: cwd changed → no project match, injecting global hot]\n\n${globalContent}`,
-          { continue: true, suppressOutput: true },
-        ),
-      ),
+      JSON.stringify({
+        continue: true,
+        suppressOutput: true,
+        additionalContext: `${suggestPrefix}[WIKI: cwd changed → no project match, injecting global hot]\n\n${globalContent}`,
+      }),
     );
   } catch (err) {
     process.stderr.write(`[hypo-cwd-change] error: ${err?.message ?? String(err)}\n`);

package/hooks/hypo-first-prompt.mjs

@@ -8,9 +8,12 @@
  * resume summary into the reply (the old "answer only if related"
  * conditional is removed; the line is injected unconditionally).
  *
- * hot.md / session-state.md content is NOT re-injected here — the upstream
- * hook already placed it in additionalContext. This hook only forces the LLM
- * to lead with the summary line drawn from that context.
+ * hot.md / session-state.md content is NOT re-injected here. On the SessionStart
+ * path the upstream hook already put it in the model's context, and this hook
+ * only forces the LLM to lead with a summary line drawn from it. On the
+ * cwd-change path nothing was injected at all (CwdChanged has no documented
+ * injection path), so that branch asks for a verbatim line instead of a
+ * summary.
  * Marker expires after 10 minutes.
  */
 
@@ -71,23 +74,35 @@ process.stdin.on('end', () => {
     // for the model to fill the placeholders with. Provide a concrete fallback
     // line so the model doesn't leak literal `[one-line summary]` text on a
     // first-ever session (codex v2 review 2026-05-26).
-    const exampleLine = hasSnapshot
-      ? `${verb} ${projSafe}: [one-line summary]. Continue with [next task]?`
-      : scopedOut
-        ? `${projSafe}: this project has a prior snapshot, but it is scoped to another machine and is not visible here. What would you like to work on?`
-        : `${verb} ${projSafe}: no prior snapshot yet — first session. What would you like to start with?`;
-    const fillNote = hasSnapshot
-      ? `Replace the bracketed placeholders using the [HOT] / [SESSION STATE] ` +
-        `context already injected this session — do NOT emit the literal brackets.`
-      : scopedOut
-        ? `Use the line above verbatim. The project has prior work; its snapshot ` +
-          `simply belongs to another machine, so treat it as an existing project ` +
-          `whose history you cannot see from here.`
-        : `Use the line above verbatim — there is no prior snapshot to summarize.`;
+    // A cwd-change marker arms this hook, but CwdChanged has no documented
+    // context-injection path, so no [HOT] / [SESSION STATE] ever reached the
+    // model for that move. Asking for a summary would make the model invent
+    // one, or emit the literal brackets. This is not a temporary branch: the
+    // follow-up that moves the hook to systemMessage sends that text to the
+    // user, not the model, so the model still gets nothing for a cwd move.
+    const cwdMove = marker.source === 'cwd-change';
+    const exampleLine = cwdMove
+      ? `${verb} ${projSafe}. What would you like to work on here?`
+      : hasSnapshot
+        ? `${verb} ${projSafe}: [one-line summary]. Continue with [next task]?`
+        : scopedOut
+          ? `${projSafe}: this project has a prior snapshot, but it is scoped to another machine and is not visible here. What would you like to work on?`
+          : `${verb} ${projSafe}: no prior snapshot yet — first session. What would you like to start with?`;
+    const fillNote = cwdMove
+      ? `Use the line above verbatim. No prior context was injected for this move.`
+      : hasSnapshot
+        ? `Replace the bracketed placeholders using the [HOT] / [SESSION STATE] ` +
+          `context already injected this session — do NOT emit the literal brackets.`
+        : scopedOut
+          ? `Use the line above verbatim. The project has prior work; its snapshot ` +
+            `simply belongs to another machine, so treat it as an existing project ` +
+            `whose history you cannot see from here.`
+          : `Use the line above verbatim — there is no prior snapshot to summarize.`;
 
     console.log(
       JSON.stringify(
         buildOutput(
+          'UserPromptSubmit',
           `<hypomnema-session-resume>\n` +
             `[WIKI SESSION START: project=${projSafe}${snapshotNote}]\n` +
             `\n` +

package/hooks/hypo-lookup.mjs

@@ -293,10 +293,14 @@ process.stdin.on('end', () => {
         .join(', ');
       console.log(
         JSON.stringify(
-          buildOutput(`[WIKI LOOKUP: miss] "${topic}" — no match. Closest: ${closest || 'none'}`, {
-            continue: true,
-            suppressOutput: true,
-          }),
+          buildOutput(
+            'UserPromptSubmit',
+            `[WIKI LOOKUP: miss] "${topic}" — no match. Closest: ${closest || 'none'}`,
+            {
+              continue: true,
+              suppressOutput: true,
+            },
+          ),
         ),
       );
       return;
@@ -336,7 +340,7 @@ process.stdin.on('end', () => {
         .join(', ');
       console.log(
         JSON.stringify(
-          buildOutput(`[WIKI LOOKUP: index hit but files missing] ${slugs}`, {
+          buildOutput('UserPromptSubmit', `[WIKI LOOKUP: index hit but files missing] ${slugs}`, {
             continue: true,
             suppressOutput: true,
           }),
@@ -362,6 +366,7 @@ process.stdin.on('end', () => {
     console.log(
       JSON.stringify(
         buildOutput(
+          'UserPromptSubmit',
           `[WIKI LOOKUP: ${injected.length} page(s) matched]\n\n` +
             injected.join('\n\n') +
             overflow,

package/hooks/hypo-session-start.mjs

@@ -484,6 +484,170 @@ function pendingProposalNotice() {
     return '';
   }
 }
+// ── foreign-project uncommitted notice ──────────────────────────────────────
+// Same signal precompactGateStatus already computes for its own gate
+// (closeAccountableScope / sessionTouchTrusted, hypo-shared.mjs), surfaced
+// here instead for the AGENT reading additionalContext: a project this
+// session isn't scoped to may still have uncommitted changes sitting in the
+// shared vault, and without this line the agent has no way to tell those
+// apart from its own unfinished work. Cannot import hypo-shared.mjs's
+// `projectOfPath` / `gitDirtyFiles` here, not a technical constraint (both
+// are simply not exported), but an ownership decision: hypo-shared.mjs
+// belongs to a different lane, so this hook keeps a local, self-contained
+// duplicate rather than adding an export for it. The cost is real: a future
+// fix to gitDirtyFiles (e.g. its rename re-attribution) does not propagate
+// here automatically.
+
+const FOREIGN_GIT_TIMEOUT_MS = 3000;
+// Cap on how many foreign project names the notice spells out. Past this the
+// rest collapse into a count, so one session cannot grow the prompt by however
+// many projects are dirty.
+const FOREIGN_NAME_CAP = 5;
+
+/** `projects/<slug>/...` → `<slug>`; everything else → null. `null` here does
+ * not mean "not one project's work": the caller below folds every non-null
+ * hit into a per-name foreign count and every null hit into a nameless
+ * "unattributed" count, and both feed the same notice. Not the same
+ * classification hypo-auto-commit.mjs's commit message uses for its own
+ * "(N paths across M projects)" count (hypo-shared.mjs's private
+ * `projectOfPath`): that one folds a non-`projects/` path to its first path
+ * segment (`extensions`, `hot.md`, ...) for a tally; this one folds it to
+ * `null` because attribution, not tallying, is the job here. A top-level
+ * segment is not a project name, and this notice must not present it as
+ * one.
+ */
+function projectOfPath(relPath) {
+  const parts = relPath.split('/');
+  return parts[0] === 'projects' && parts.length > 1 && parts[1] ? parts[1] : null;
+}
+
+/** Vault-relative dirty paths (tracked + untracked), normalized to be
+ * relative to `hypoDir` itself via `git rev-parse --show-prefix` (empty when
+ * `hypoDir` IS the repo top level), the same normalization
+ * hypo-shared.mjs's `gitDirtyFiles` applies for staging correctness: without
+ * it, a vault nested under a larger host repo reports paths relative to that
+ * repo's top level, and every one of them would fail to classify as this
+ * vault's own. NUL-separated porcelain so Korean project/page names survive
+ * intact. This also re-attributes a rename/copy's `from` path (codex
+ * 3rd-round review follow-up), the same as gitDirtyFiles does for
+ * staging correctness, so a rename OUT of a foreign project is not silently
+ * lost just because its destination happens to land under `ownProject`.
+ *
+ * Returns `null`, not `[]`, on any git failure (repo missing, `rev-parse` or
+ * `status` non-zero, or a timeout): folding "cannot enumerate" into the same
+ * empty array a truly clean repo returns would render the two identically,
+ * which is the silent failure this notice exists to catch (mirrors
+ * `gitDirtyFiles`'s own contract: "an empty return here just means 'cannot
+ * attribute', not 'clean'"). A clean repo returns `[]`.
+ */
+function listDirtyPaths(hypoDir) {
+  const prefixRes = spawnSync('git', ['-C', hypoDir, 'rev-parse', '--show-prefix'], {
+    encoding: 'utf-8',
+    timeout: FOREIGN_GIT_TIMEOUT_MS,
+  });
+  if (prefixRes.status !== 0) return null;
+  // trimEnd(), not trim(): the prefix is a real path segment, and a leading
+  // space or control char in a directory name is valid there. trim() would
+  // strip it off the front, so the stripped prefix no longer matches the
+  // (untouched) start of every path `git status` reports, and every path
+  // under that directory would wrongly read as "outside the vault" (the
+  // notice going silent for exactly the same reason a missing rename `from`
+  // does below). Only the trailing `\n` `--show-prefix` always appends needs
+  // stripping.
+  const prefix = (prefixRes.stdout || '').trimEnd();
+
+  const r = spawnSync('git', ['-C', hypoDir, 'status', '--porcelain', '-uall', '-z'], {
+    encoding: 'utf-8',
+    timeout: FOREIGN_GIT_TIMEOUT_MS,
+  });
+  if (r.status !== 0) return null;
+  const out = [];
+  const records = (r.stdout || '').split('\0');
+  const toVaultRelative = (f) => {
+    if (!f) return null;
+    if (!prefix) return f; // hypoDir IS the repo top level, nothing to strip
+    return f.startsWith(prefix) ? f.slice(prefix.length) : null; // outside the vault
+  };
+  for (let i = 0; i < records.length; i++) {
+    const rec = records[i];
+    if (!rec) continue;
+    const xy = rec.slice(0, 2);
+    const file = rec.slice(3); // destination path for a rename/copy
+    const isRenameOrCopy = xy[0] === 'R' || xy[1] === 'R' || xy[0] === 'C' || xy[1] === 'C';
+    // A rename/copy emits a paired `to\0from` record. Attribute BOTH: the
+    // origin project lost a file just as surely as the destination gained
+    // one, and dropping `from` (as this used to) silently loses that origin
+    // whenever it differs from the destination's project (a rename INTO
+    // ownProject from a foreign one would otherwise vanish entirely). One
+    // rename/copy is therefore counted as up to 2 dirty paths, inflating
+    // foreignCount/unattributedCount by one per cross-project rename; the
+    // name Set below still de-dupes, so the project NAME list does not grow.
+    let fromFile = null;
+    if (isRenameOrCopy) {
+      i++;
+      fromFile = records[i] || null;
+    }
+    const rel = toVaultRelative(file);
+    if (rel) out.push(rel);
+    const relFrom = toVaultRelative(fromFile);
+    if (relFrom) out.push(relFrom);
+  }
+  return out;
+}
+
+/** One-line notice covering two counts: uncommitted paths under a named
+ * project other than `ownProject` (`projects/<slug>/...`, or, when
+ * `ownProject` is null, no cwd-matched project this session, so ANY named
+ * project counts), and uncommitted paths this classifier cannot attribute to
+ * any project at all (everything else, root vault infra, `extensions/`,
+ * `_specs/`, ...). This is attribution, not narrowing, so the
+ * unattributed bucket is surfaced with a count rather than silently dropped
+ * just because it has no project name to show. '' only when enumeration
+ * succeeded and both counts are zero, so the quiet path stays quiet exactly
+ * there. A `null` from `listDirtyPaths` (enumeration failed) gets its own
+ * distinct line instead: the caller must not read "could not tell" as
+ * "nothing foreign".
+ */
+function foreignUncommittedNotice(hypoDir, ownProject) {
+  const dirty = listDirtyPaths(hypoDir);
+  if (dirty === null) {
+    return '[WIKI: 미커밋 변경의 귀속을 확인하지 못했습니다. git 상태를 근거로 작업 범위를 정하지 마십시오.]';
+  }
+  const foreignProjects = new Set();
+  let foreignCount = 0;
+  let unattributedCount = 0;
+  for (const f of dirty) {
+    const slug = projectOfPath(f);
+    if (slug === ownProject) continue;
+    if (slug) {
+      foreignProjects.add(slug);
+      foreignCount++;
+    } else {
+      unattributedCount++;
+    }
+  }
+  if (foreignCount === 0 && unattributedCount === 0) return '';
+  const clauses = [];
+  if (foreignCount > 0) {
+    // The slug comes from a directory name in `git status` output, so it is
+    // untrusted text on its way into a prompt. sanitizeProjForPrompt is the same
+    // guard the hot-cache notices in this file already use; skipping it here would
+    // let a newline or a control char in a project directory name break the
+    // one-line notice apart and inject into the surrounding context. The name list
+    // is also capped, because an unbounded one grows the context by however many
+    // projects happen to be dirty.
+    const all = [...foreignProjects].sort();
+    const shown = all.slice(0, FOREIGN_NAME_CAP).map((s) => `projects/${sanitizeProjForPrompt(s)}`);
+    const names =
+      all.length > FOREIGN_NAME_CAP
+        ? `${shown.join(', ')} 외 ${all.length - FOREIGN_NAME_CAP}개`
+        : shown.join(', ');
+    clauses.push(`현재 프로젝트 외 ${names} 변경 ${foreignCount}건`);
+  }
+  if (unattributedCount > 0) clauses.push(`귀속 불명 변경 ${unattributedCount}건`);
+  return `[WIKI: ${clauses.join(', ')}이 있습니다. 사용자 명시 지시 없이는 이 세션 작업으로 편입하지 마십시오.]`;
+}
+
 const GLOBAL_HOT = join(HYPO_DIR, 'hot.md');
 const HOT_CHARS = 2000;
 const STATE_CHARS = 2000;
@@ -613,6 +777,17 @@ process.stdin.on('end', () => {
     const MARKER_FILE = sessionMarkerPath(sessionId);
     const hit = findProjectFiles(cwd);
 
+    // ownProject = the cwd-matched project (or null on a MISS, per
+    // foreignUncommittedNotice's docstring). Late-appended into `notices` /
+    // `noticePrefix`, same pattern the MISS branch's suggestLine uses below —
+    // both need `hit` first, which isn't resolved until this line.
+    const foreignNotice = foreignUncommittedNotice(HYPO_DIR, hit ? hit.proj : null);
+    if (foreignNotice) {
+      notices.push(foreignNotice);
+      noticePrefix = notices.length ? `${notices.join('\n\n')}\n\n` : '';
+      process.stderr.write(`\n\x1b[33m${foreignNotice}\x1b[0m\n`);
+    }
+
     // Observed-base snapshot for the write=proposal gate. Deliberately AFTER gitPull: the base must
     // describe the tree this session actually starts from, remote merges
     // included, or the first close would raise a proposal against content the
@@ -673,6 +848,7 @@ process.stdin.on('end', () => {
         console.log(
           JSON.stringify(
             buildOutput(
+              'SessionStart',
               `${noticePrefix}${hitPrefix}[WIKI HOT CACHE: project=${sanitizeProjForPrompt(hit.proj)}]\n\n${parts.join('\n\n')}`,
               outExtra,
             ),
@@ -736,6 +912,7 @@ process.stdin.on('end', () => {
         console.log(
           JSON.stringify(
             buildOutput(
+              'SessionStart',
               `${noticePrefix}${hitPrefix}[WIKI HOT CACHE: project=${sanitizeProjForPrompt(hit.proj)}, ${reason}]`,
               outExtra,
             ),
@@ -760,7 +937,7 @@ process.stdin.on('end', () => {
     if (!existsSync(GLOBAL_HOT)) {
       const notice = notices.join('\n\n');
       if (notice) {
-        console.log(JSON.stringify(buildOutput(notice, outExtra)));
+        console.log(JSON.stringify(buildOutput('SessionStart', notice, outExtra)));
       } else {
         console.log(JSON.stringify(outExtra));
       }
@@ -775,7 +952,7 @@ process.stdin.on('end', () => {
       // would otherwise be silently dropped here.
       const notice = notices.join('\n\n');
       if (notice) {
-        console.log(JSON.stringify(buildOutput(notice, outExtra)));
+        console.log(JSON.stringify(buildOutput('SessionStart', notice, outExtra)));
       } else {
         console.log(JSON.stringify(outExtra));
       }
@@ -784,6 +961,7 @@ process.stdin.on('end', () => {
     console.log(
       JSON.stringify(
         buildOutput(
+          'SessionStart',
           `${noticePrefix}[WIKI HOT CACHE: global — no project matched cwd=${cwd}]\n\n${globalContent}`,
           outExtra,
         ),