hypomnema 1.8.0 → 1.8.2

package/scripts/lint.mjs

@@ -13,7 +13,9 @@
  *   --fix               Auto-add missing `updated` field (safe repairs only)
  *   --strict            Promote selected warnings (STRICT_PROMOTE_IDS) to errors
  *                       so they exit 1. Opt-in gate for release-checklist /
- *                       pre-commit; default mode stays byte-identical.
+ *                       pre-commit. Adding the flag did not change what default
+ *                       mode emits; a new warning class still adds warnings
+ *                       there, as every W9..W16 addition has.
  */
 
 import { existsSync, readFileSync, writeFileSync, readdirSync, statSync } from 'fs';
@@ -30,19 +32,45 @@ import {
 import { findDesignHistoryStale } from './lib/design-history-stale.mjs';
 import { FEEDBACK_SCOPE_RE } from './lib/feedback-scope.mjs';
 import { FAILURE_TYPE_ENUM } from './lib/failure-type.mjs';
-import { collectPagesLint, collectPagesLinkable } from './lib/wikilink.mjs';
+import { collectPagesLint, collectPagesLinkable, slugForms } from './lib/wikilink.mjs';
 import { parseFrontmatter, SEQUENCE_ENTRY_RE } from './lib/frontmatter.mjs';
 import { buildSlugMap } from './lib/slug-resolver.mjs';
 
 // ── arg parsing ──────────────────────────────────────────────────────────────
 
+const ALLOWED_FLAGS = ['--hypo-dir=<path>', '--json', '--fix', '--strict'];
+
 function parseArgs(argv) {
   const args = { hypoDir: null, json: false, fix: false, strict: false };
   for (const arg of argv.slice(2)) {
-    if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
-    else if (arg === '--json') args.json = true;
+    if (arg.startsWith('--hypo-dir=')) {
+      // A raw value of '' (either `--hypo-dir=` typed directly or a shell
+      // variable that expanded to nothing, e.g. --hypo-dir="$VAULT" with
+      // VAULT unset) must not fall through to expandHome('') → '' → the
+      // `!args.hypoDir` default-resolution branch below. That silent
+      // fallback is exactly the bug this flag exists to close: a caller who
+      // believes they pointed at a specific vault ends up reading/writing
+      // the default one instead.
+      const raw = arg.slice(11);
+      if (!raw) {
+        console.error(`lint.mjs: --hypo-dir requires a non-empty value (got '${arg}')`);
+        console.error(`lint.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+        process.exit(2);
+      }
+      args.hypoDir = expandHome(raw);
+    } else if (arg === '--json') args.json = true;
     else if (arg === '--fix') args.fix = true;
     else if (arg === '--strict') args.strict = true;
+    else {
+      // lint.mjs takes no positional arguments, so anything unmatched above
+      // (a typo'd flag, "--", a bare "-", a stray word) is a mistake, not a
+      // no-op. Silently dropping it let a wrong flag point at the wrong
+      // vault for months: docs told models to pass --wiki-dir, but no
+      // script here ever parsed that flag.
+      console.error(`lint.mjs: unrecognized argument '${arg}'`);
+      console.error(`lint.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+      process.exit(2);
+    }
   }
   if (!args.hypoDir) {
     const info = resolveHypoRootInfo();
@@ -277,16 +305,41 @@ const VALID_TYPES = [
 
 const issues = [];
 
+// W15 bookkeeping, filled inside lintPage as it already reads+parses every
+// page once. Reused after the main page loop instead of re-reading every file
+// a second time just to compare `updated` dates.
+//   bySlugForm maps every page's slug form (full/bare/dirRel, the same three
+//   forms buildSlugMap derives) to { updated, count }. `count` is how many
+//   pages claim that form, because a shared bare form is NOT the same
+//   ambiguity the wikilink checker lives with: W4 only asks whether a target
+//   exists, while this rule has to pick one page's date. Picking first-wins
+//   would make the verdict depend on directory walk order. A form claimed
+//   twice is treated as unresolvable instead.
+//   `updated` is null for a page that has none (W3's concern), which is
+//   recorded rather than skipped so the source is known to exist.
+//   synthesisPages holds the type:synthesis pages that declare
+//   sources_consulted, collected for the post-loop comparison below.
+// Dates are compared as strings, which is only the same as comparing time
+// when every value is zero-padded YYYY-MM-DD. `2026-3-1 > 2026-12-15` is true
+// lexically and false in fact, so anything off this shape is excluded from the
+// comparison and reported instead of silently deciding the verdict.
+const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+const bySlugForm = new Map();
+const synthesisPages = [];
+
 // Stable warning class IDs (W1..Wn). `--strict` promotes a frozen subset to
 // errors by ID — never by brittle message-text matching. W8 (design-history
-// stale) predates this scheme; hooks/hypo-personal-check.mjs filters `w.id ===
-// 'W8'`, so it must keep that number — the W5..W7 gap is honest history, not a
-// bug. (spec-v1.3.0 Track E)
+// stale) predates this scheme; the close gate in hooks/hypo-shared.mjs filters
+// `w.id === 'W8'`, so it must keep that number. The W5..W7 gap is honest
+// history, not a bug. (spec-v1.3.0 Track E)
 //
 // STRICT_PROMOTE_IDS (OQ-E1, frozen as a code constant): confirmed content
 // defects only.
 //   W1 no-frontmatter / W2 unknown-type / W4 broken-wikilink → promote.
 //   W9 invalid-YAML → promote (frontmatter a real YAML parser rejects).
+//   Exception: the closeRootTargets loop's own W1 findings (hot.md/log.md)
+//   are exempted from this promotion below, scoped by id and by that file
+//   set only; see the comment at that loop and at the promotion site.
 //   W3 missing-updated  → excluded (auto-repaired by --fix).
 //   W8 design-history-stale → excluded (hypo-personal-check handles it; would
 //                             double-gate).
@@ -298,10 +351,19 @@ const issues = [];
 //                             PreCompact hook no longer blocks /compact, so
 //                             that set is what --check-session-close and
 //                             --mark-session-closed read, not a compact stop.
-// NOTE: no gate currently passes --strict (npm run lint / CI / release.yml /
-// crystallize / the close-gate all run plain lint), so promotion is
-// forward-looking: these surface as warnings today. The deliverable is
-// "stop silently green-passing invalid YAML"; the W9 warning satisfies that.
+//   W15 synthesis-stale     → excluded, same reason as W8/W14 (a freshness
+//                             signal to triage, not a content defect), and
+//                             its own id for the same reason W14 has one: the
+//                             W8-only close-gate filter must not pick it up.
+//   W16 sources-unresolved  → excluded, same reasons as W15. It reports what
+//                             W15 could not read, so promoting one without the
+//                             other would block on the weaker signal.
+// NOTE: npm run lint / CI / release.yml / crystallize / the close-gate all
+// run plain lint, not --strict, so promotion is forward-looking there: these
+// still surface as warnings on those paths. But --strict is not unused —
+// init.mjs's --lint-strict wires `lint --strict` into a vault's own
+// pre-commit hook (scripts/init.mjs, pinned by tests/init.test.mjs), so a
+// vault that opts in does gate a commit on these IDs today.
 const STRICT_PROMOTE_IDS = new Set(['W1', 'W2', 'W4', 'W9']);
 
 function issue(severity, rel, msg, fullPath = null, id = null) {
@@ -387,6 +449,27 @@ function lintPage({ path, rel }, slugMap, tagVocab, pageDirs, validTypes) {
     issue('warn', rel, 'Missing frontmatter field: updated', path, 'W3');
   }
 
+  // W15 bookkeeping: record this page's slug forms → updated date, and, if it
+  // is itself a synthesis page citing sources, queue it for the post-loop
+  // check. Recorded here (not re-derived after the loop) because content and
+  // fm are already in hand from the reads above.
+  {
+    const noExt = rel.replace(/\.md$/, '').replace(/\\/g, '/');
+    // Deduplicate within one page first. slugForms collapses bare and dirRel
+    // to the same string for a page directly under pages/, so counting raw
+    // values would make every such page look like a two-page collision.
+    for (const form of new Set(Object.values(slugForms(noExt)))) {
+      if (!form) continue;
+      const prior = bySlugForm.get(form);
+      if (prior) prior.count += 1;
+      else bySlugForm.set(form, { updated: fm.updated || null, count: 1 });
+    }
+  }
+  if (fm.type === 'synthesis' && fm.sources_consulted) {
+    const sources = parseTagsField(fm.sources_consulted) || [];
+    if (sources.length > 0) synthesisPages.push({ rel, updated: fm.updated, sources });
+  }
+
   // type-conditional required fields
   if (fm.type && TYPE_CONDITIONAL_FIELDS[fm.type]) {
     for (const field of TYPE_CONDITIONAL_FIELDS[fm.type]) {
@@ -544,31 +627,55 @@ const validTypes = new Set([...VALID_TYPES, ...parseSchemaTypes(args.hypoDir)]);
 
 for (const page of pages) lintPage(page, slugMap, tagVocab, pageDirs, validTypes);
 
-// W4 (broken-wikilink only, NOT the full lintPage) for close's root-level
-// write targets that fall outside pages/projects/journal: hot.md and log.md
-// today. closeFileTargetsGlobal is the one list of what close writes
-// (hooks/hypo-shared.mjs), reused here instead of re-derived, so a future
-// close target is covered automatically. Only the entries NOT already under
-// a scanDir are new; closeFileTargetsGlobal's projects/<slug>/* entries are
-// already linted in full above.
+// W4 (broken-wikilink) plus a reduced W1 (closed frontmatter block presence)
+// and W9 (invalid YAML inside that block), NOT the full lintPage, for close's
+// root-level write targets that fall outside pages/projects/journal: hot.md
+// and log.md today. closeFileTargetsGlobal is the one list of what close
+// writes (hooks/hypo-shared.mjs), reused here instead of re-derived, so a
+// future close target is covered automatically. Only the entries NOT already
+// under a scanDir are new; closeFileTargetsGlobal's projects/<slug>/* entries
+// are already linted in full above.
 //
-// Why link-only and not the full lintPage: measured, not assumed. On the
-// packaged templates/ (hot.md type:reference, log.md type:log, both declared
-// in templates/SCHEMA.md's taxonomy), full lintPage on both files comes back
-// completely clean, so "these types trip W2" is not the reason to hold back.
-// The real reason is that live vaults do not all match the template. A vault
-// whose SCHEMA.md predates the `log` type row (or has none) gets a fresh
-// "Unknown type: log" W2 the moment log.md is run through lintPage, and a
-// vault whose root log.md predates the frontmatter convention entirely (no
-// leading `---` block at all, confirmed against a real maintainer vault)
-// gets a fresh "No frontmatter found" W1. Both W1 and W2 are in
-// STRICT_PROMOTE_IDS, so under --strict a vault that lint has always passed
-// would start failing on a file whose content this fix never touched. Full
-// lintPage stays reserved for pages/projects/journal, where every file was
-// already being linted before this change and there is no such newly-exposed
-// vault. W4 itself stays warn-only outside --strict, and postApply
-// (crystallize.mjs) gates only on errors, so this addition can add a new
-// warning to a close's lint output but can never fail one.
+// Why link-only (plus these two frontmatter checks) and not the full
+// lintPage: measured, not assumed. On the packaged templates/ (hot.md
+// type:reference, log.md type:log, both declared in templates/SCHEMA.md's
+// taxonomy), full lintPage on both files comes back completely clean, so
+// "these types trip W2" is not the reason to hold back. The real reason is
+// that live vaults do not all match the template. A vault whose SCHEMA.md
+// predates the `log` type row (or has none) gets a fresh "Unknown type: log"
+// W2 the moment log.md is run through lintPage. W2 (and the rest of
+// lintPage's field checks) stays out of this loop for exactly that reason:
+// it does not catch a close's whole-file overwrite any better than W4
+// already does, and it would trip on vault-local type taxonomy the write
+// never touched.
+//
+// W1 (no closed frontmatter block) and W9 (invalid YAML inside that block)
+// are the two lintPage checks pulled in on purpose: close's crystallize path
+// overwrites hot.md/log.md wholesale, and a write that drops the frontmatter
+// delimiters or leaves broken YAML behind is exactly the corruption this
+// scan exists to catch, one write earlier than doctor. The W1 predicate here
+// matches hooks/hypo-shared.mjs's frontmatterUpdated exactly (a *closed*
+// `---`...`---` block, not just an opening fence) so this scan and the
+// close-gate's own staleness check agree on what counts as "has frontmatter";
+// an unclosed fence fails both the same way, instead of lint calling it clean
+// while the close gate hard-fails on it. The same measurement above shows why
+// this stays narrow rather than becoming full lintPage: a vault whose root
+// log.md predates the frontmatter convention entirely (no leading `---`
+// block at all, confirmed against a real maintainer vault) would get a fresh
+// W1 the instant this check exists, on content this change never touched.
+// W1 is in STRICT_PROMOTE_IDS, so that vault would start failing `--strict`
+// for a file it always had. The strict-promotion loop below carries a narrow
+// exemption for exactly this case (W1 + this file set only, NOT W9), so a
+// shaped-like-legacy vault keeps passing `--strict` while W1 still fires as a
+// warning here and a genuinely broken close-time write still promotes under
+// `--strict` on pages/projects/journal, where it was always covered. W9 is
+// deliberately NOT exempted: a legacy vault with no frontmatter block at all
+// never reaches the YAML check (there is no block to inspect), so the
+// exemption never needed to cover it, and a root file whose block IS present
+// but broken is exactly the defect this loop exists to promote. W4 and W1
+// both stay warn-only outside `--strict`, and postApply (crystallize.mjs)
+// gates only on errors, so this loop can add a new warning to a close's lint
+// output but can never fail one on its own.
 const closeRootTargets = [...closeFileTargetsGlobal(args.hypoDir)].filter(
   (f) => !f.startsWith('pages/') && !f.startsWith('projects/') && !f.startsWith('journal/'),
 );
@@ -581,6 +688,14 @@ for (const rel of closeRootTargets) {
   } catch {
     continue;
   }
+  const fmBlock = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!fmBlock) {
+    issue('warn', rel, 'No closed frontmatter block found', null, 'W1');
+  } else {
+    for (const reason of checkYamlInvalid(fmBlock[1])) {
+      issue('warn', rel, `Invalid YAML frontmatter: ${reason}`, null, 'W9');
+    }
+  }
   for (const link of extractWikilinks(content)) {
     if (!slugMap.has(link)) {
       issue('warn', rel, `Broken wikilink: [[${link}]]`, null, 'W4');
@@ -623,6 +738,81 @@ for (const s of findDesignHistoryStale(args.hypoDir)) {
   );
 }
 
+// W15: synthesis page stale relative to its own sources_consulted. A
+// type:synthesis page absorbs and condenses what other pages already
+// learned; if a listed source has moved on (its `updated` is newer than the
+// synthesis's own `updated`), the synthesis has not caught up. Runs off the
+// bookkeeping lintPage already filled above, so no page is read twice.
+//
+// A source name absent from bySlugForm (a typo, a directory rather than a
+// page, or a path outside the vault) has no date to compare, so W15 cannot
+// judge it either way. W4 does not cover it: that rule reads `[[...]]` out of
+// page bodies and never looks at frontmatter, so an unresolved name here would
+// be reported nowhere. W16 below reports it instead, which is what keeps a
+// page that resolves 4 of its 11 sources from producing a confident-looking
+// W15 built on a third of the evidence.
+// The skip in the loop states that intent; it does not change the outcome. An
+// undefined date loses every comparison it enters, so dropping the guard
+// leaves the same warnings (measured: removing it keeps all four W15 tests
+// green). It stays because the alternative parks undefined in `newest`.
+//
+// Deliberately excluded from STRICT_PROMOTE_IDS, same reasoning as W8/W14: a
+// synthesis lagging its sources is a content-freshness signal for a human to
+// triage, not a defect `--strict` should hard-block a commit on. Given its
+// own id (not W8) so hypo-shared.mjs's `w.id === 'W8'` close-gate filter
+// never mistakes it for a design-history finding.
+for (const { rel, updated, sources } of synthesisPages) {
+  let newest = null;
+  const unresolved = [];
+  for (const source of sources) {
+    const hit = bySlugForm.get(source);
+    // Three ways a source yields no date, kept apart because they tell the
+    // author to do different things. Every one of them lands in W16 below;
+    // removing this branch is what would make W16 stop reporting.
+    if (!hit) {
+      unresolved.push(`${source} (없는 이름)`);
+      continue;
+    }
+    if (hit.count > 1) {
+      unresolved.push(`${source} (${hit.count}개 페이지가 같은 이름)`);
+      continue;
+    }
+    if (!ISO_DATE_RE.test(hit.updated || '')) {
+      unresolved.push(`${source} (updated 없음 또는 YYYY-MM-DD 아님)`);
+      continue;
+    }
+    if (!newest || hit.updated > newest) newest = hit.updated;
+  }
+  const ownDateUsable = ISO_DATE_RE.test(updated || '');
+  if (newest && ownDateUsable && newest > updated) {
+    issue(
+      'warn',
+      rel,
+      `synthesis stale: sources_consulted 최신=${newest} > synthesis updated=${updated}. 새로 쌓인 학습을 반영해 갱신하거나, 반영할 내용이 없으면 updated를 확인하세요`,
+      null,
+      'W15',
+    );
+  }
+  // W16: sources W15 could not compare, reported once per page with the reason
+  // for each. Without this the rule fails open, and silently: a page whose
+  // sources mostly do not resolve still gets a W15 (or no warning at all) with
+  // nothing saying how much of the evidence was actually read. The reasons are
+  // kept apart because the fix differs: a name that resolves to nothing is a
+  // typo or a value this field is not meant to hold, a name claimed by two
+  // pages needs the longer form, and a source with no usable `updated` is W3's
+  // problem on that page. Excluded from STRICT_PROMOTE_IDS and given its own id
+  // for the same reasons as W15.
+  if (unresolved.length > 0) {
+    issue(
+      'warn',
+      rel,
+      `sources_consulted 비교 불가 ${unresolved.length}/${sources.length}: ${unresolved.join(', ')}. 이 소스들은 staleness 비교에서 빠졌습니다`,
+      null,
+      'W16',
+    );
+  }
+}
+
 // W12: project directory missing index.md. SCHEMA.md declares project-index
 // at projects/*/index.md and templates/projects/_template/ ships one, so a
 // project without it is a tooling/vault drift, not a legitimate shape — but
@@ -699,9 +889,20 @@ if (args.fix) {
 // --strict: promote selected warnings (by stable ID) to errors *before* the
 // errors/warns split, so exit code, counts, plain-text icons, and --json `ok`
 // all derive from the post-promotion severities through the existing paths.
+//
+// Exemption for the closeRootTargets loop's own W1 (see the comment there):
+// a root hot.md/log.md that predates the frontmatter convention is a
+// pre-existing vault shape, not a defect this scan introduced, so promoting
+// it under --strict would fail vaults that lint has always passed. Scoped by
+// BOTH id (W1 only, not W2/W4/W9) AND file (closeRootTargets, the short
+// hot.md/log.md list, not the full closeFileTargetsGlobal) so a future close
+// target under pages/projects/journal stays fully promotable: it is already
+// linted through lintPage above, where this exemption does not apply.
+const closeRootTargetSet = new Set(closeRootTargets);
 if (args.strict) {
   for (const iss of issues) {
     if (iss.severity === 'warn' && iss.id && STRICT_PROMOTE_IDS.has(iss.id)) {
+      if (iss.id === 'W1' && closeRootTargetSet.has(iss.file)) continue;
       iss.severity = 'error';
     }
   }
@@ -711,10 +912,12 @@ const errors = issues.filter((i) => i.severity === 'error');
 const warns = issues.filter((i) => i.severity === 'warn');
 
 if (args.json) {
-  // Default mode is byte-identical: only W8 carries an `id` in the JSON payload
-  // (hooks/hypo-personal-check.mjs filters on it). All other IDs stay internal
-  // unless `--strict` is set, where the full ID set is exposed so promoted
-  // findings are traceable to their warning class.
+  // The `id` field, not the warning list, is what default mode holds stable:
+  // only W8 carries one (the close gate in hooks/hypo-shared.mjs filters on
+  // it). Every other id stays internal unless `--strict` is set, where the full
+  // set is exposed so promoted findings are traceable to their warning class.
+  // A new rule does add warnings to default output; that is what a new rule is
+  // for, and W9 through W16 all did it.
   const toOut = ({ severity, file, message, id }) =>
     id && (id === 'W8' || args.strict)
       ? { severity, file, message, id }

package/scripts/query.mjs

@@ -24,13 +24,33 @@ import { currentDevice, scopeVisible, readVisibilityScope } from '../hooks/hypo-
 
 // ── arg parsing ──────────────────────────────────────────────────────────────
 
+const ALLOWED_FLAGS = ['--hypo-dir=<path>', '--q=<query>', '--limit=<n>', '--json'];
+
 function parseArgs(argv) {
   const args = { hypoDir: null, query: null, limit: 10, json: false };
   for (const arg of argv.slice(2)) {
-    if (arg.startsWith('--hypo-dir=')) args.hypoDir = expandHome(arg.slice(11));
-    else if (arg.startsWith('--q=')) args.query = arg.slice(4);
+    if (arg.startsWith('--hypo-dir=')) {
+      // See lint.mjs's parseArgs for why an empty raw value (--hypo-dir=,
+      // or --hypo-dir="$VAULT" with VAULT unset) is rejected instead of
+      // falling through to the default-resolution branch below.
+      const raw = arg.slice(11);
+      if (!raw) {
+        console.error(`query.mjs: --hypo-dir requires a non-empty value (got '${arg}')`);
+        console.error(`query.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+        process.exit(2);
+      }
+      args.hypoDir = expandHome(raw);
+    } else if (arg.startsWith('--q=')) args.query = arg.slice(4);
     else if (arg.startsWith('--limit=')) args.limit = parseInt(arg.slice(8), 10) || 10;
     else if (arg === '--json') args.json = true;
+    else {
+      // No positional arguments here either, so an unmatched arg is rejected
+      // rather than dropped. See lint.mjs's parseArgs for the background
+      // this closes.
+      console.error(`query.mjs: unrecognized argument '${arg}'`);
+      console.error(`query.mjs accepts: ${ALLOWED_FLAGS.join(', ')}`);
+      process.exit(2);
+    }
   }
   if (!args.hypoDir) {
     const info = resolveHypoRootInfo();

package/scripts/resume.mjs

@@ -28,9 +28,15 @@
 
 import { existsSync, readFileSync, readdirSync, statSync, realpathSync } from 'fs';
 import { join } from 'path';
+import { spawnSync } from 'child_process';
 import { resolveHypoRoot, expandHome } from './lib/hypo-root.mjs';
 import { pickProjectByCwd, collectProjectWorkingDirs } from './lib/wd-match.mjs';
-import { currentDevice, scopeVisible, readVisibilityScope } from '../hooks/hypo-shared.mjs';
+import {
+  currentDevice,
+  scopeVisible,
+  readVisibilityScope,
+  sanitizeProjForPrompt,
+} from '../hooks/hypo-shared.mjs';
 
 // ── arg parsing ──────────────────────────────────────────────────────────────
 
@@ -188,6 +194,162 @@ function resolveActiveProject(hypoDir, cwd = null) {
   return latest;
 }
 
+// ── foreign-project uncommitted notice ──────────────────────────────────────
+// resume is a bare CLI script (invoked from a slash command via bash) and
+// never receives a session_id or transcript, so unlike the SessionStart hook
+// it has no accountable-scope to compare against. It always has a resolved
+// `project` by the time this runs (the caller exits earlier when none is
+// found), so that resolved project stands in as "own project" here.
+
+const FOREIGN_GIT_TIMEOUT_MS = 5000;
+// Cap on how many foreign project names the notice spells out. Past this the
+// rest collapse into a count, so one session cannot grow the prompt by however
+// many projects are dirty.
+const FOREIGN_NAME_CAP = 5;
+
+/** `projects/<slug>/...` → `<slug>`; everything else → null. `null` here does
+ * not mean "not one project's work": the caller below folds every non-null
+ * hit into a per-name foreign count and every null hit into a nameless
+ * "unattributed" count, and both feed the same notice. Local duplicate of
+ * hypo-shared.mjs's private (non-exported) `projectOfPath`. Not the same
+ * classification as hypo-auto-commit.mjs's commit-message counter (also in
+ * hypo-shared.mjs): that one folds a non-`projects/` path to its first path
+ * segment (`extensions`, `hot.md`, ...) for a "(N paths across M projects)"
+ * tally; this one folds it to `null` because attribution, not tallying, is
+ * the job here. A top-level segment is not a project name, and this notice
+ * must not present it as one.
+ */
+function projectOfPath(relPath) {
+  const parts = relPath.split('/');
+  return parts[0] === 'projects' && parts.length > 1 && parts[1] ? parts[1] : null;
+}
+
+/** Vault-relative dirty paths (tracked + untracked), normalized to be
+ * relative to `hypoDir` itself via `git rev-parse --show-prefix` (empty when
+ * `hypoDir` IS the repo top level), the same normalization
+ * hypo-shared.mjs's `gitDirtyFiles` applies for staging correctness: without
+ * it, a vault nested under a larger host repo reports paths relative to that
+ * repo's top level, and every one of them would fail to classify as this
+ * vault's own. NUL-separated porcelain so Korean project/page names survive
+ * intact. Local duplicate of hypo-shared.mjs's private `gitDirtyFiles`: this
+ * caller also re-attributes a rename/copy's `from` path (codex 3rd-round
+ * review follow-up), the same as that caller does for staging
+ * correctness, so a rename OUT of a foreign project is not silently lost
+ * just because its destination happens to land under `ownProject`.
+ *
+ * Returns `null`, not `[]`, on any git failure (repo missing, `rev-parse` or
+ * `status` non-zero, or a timeout): folding "cannot enumerate" into the same
+ * empty array a truly clean repo returns would render the two identically,
+ * which is the silent failure this notice exists to catch (mirrors
+ * `gitDirtyFiles`'s own contract: "an empty return here just means 'cannot
+ * attribute', not 'clean'"). A clean repo returns `[]`.
+ */
+function listDirtyPaths(hypoDir) {
+  const prefixRes = spawnSync('git', ['-C', hypoDir, 'rev-parse', '--show-prefix'], {
+    encoding: 'utf-8',
+    timeout: FOREIGN_GIT_TIMEOUT_MS,
+  });
+  if (prefixRes.status !== 0) return null;
+  // trimEnd(), not trim(): the prefix is a real path segment, and a leading
+  // space or control char in a directory name is valid there. trim() would
+  // strip it off the front, so the stripped prefix no longer matches the
+  // (untouched) start of every path `git status` reports, and every path
+  // under that directory would wrongly read as "outside the vault" (the
+  // notice going silent for exactly the same reason a missing rename `from`
+  // does below). Only the trailing `\n` `--show-prefix` always appends needs
+  // stripping.
+  const prefix = (prefixRes.stdout || '').trimEnd();
+
+  const r = spawnSync('git', ['-C', hypoDir, 'status', '--porcelain', '-uall', '-z'], {
+    encoding: 'utf-8',
+    timeout: FOREIGN_GIT_TIMEOUT_MS,
+  });
+  if (r.status !== 0) return null;
+  const out = [];
+  const records = (r.stdout || '').split('\0');
+  const toVaultRelative = (f) => {
+    if (!f) return null;
+    if (!prefix) return f; // hypoDir IS the repo top level, nothing to strip
+    return f.startsWith(prefix) ? f.slice(prefix.length) : null; // outside the vault
+  };
+  for (let i = 0; i < records.length; i++) {
+    const rec = records[i];
+    if (!rec) continue;
+    const xy = rec.slice(0, 2);
+    const file = rec.slice(3); // destination path for a rename/copy
+    const isRenameOrCopy = xy[0] === 'R' || xy[1] === 'R' || xy[0] === 'C' || xy[1] === 'C';
+    // A rename/copy emits a paired `to\0from` record. Attribute BOTH: the
+    // origin project lost a file just as surely as the destination gained
+    // one, and dropping `from` (as this used to) silently loses that origin
+    // whenever it differs from the destination's project (a rename INTO
+    // ownProject from a foreign one would otherwise vanish entirely). One
+    // rename/copy is therefore counted as up to 2 dirty paths, inflating
+    // foreignCount/unattributedCount by one per cross-project rename; the
+    // name Set below still de-dupes, so the project NAME list does not grow.
+    let fromFile = null;
+    if (isRenameOrCopy) {
+      i++;
+      fromFile = records[i] || null;
+    }
+    const rel = toVaultRelative(file);
+    if (rel) out.push(rel);
+    const relFrom = toVaultRelative(fromFile);
+    if (relFrom) out.push(relFrom);
+  }
+  return out;
+}
+
+/** One-line notice covering two counts: uncommitted paths under a named
+ * project other than `ownProject` (`projects/<slug>/...`), and uncommitted
+ * paths this classifier cannot attribute to any project at all (everything
+ * else, root vault infra, `extensions/`, `_specs/`, ...). This is
+ * attribution, not narrowing, so the unattributed bucket is surfaced with a
+ * count rather than silently dropped just because it has no project name to
+ * show. '' only when enumeration succeeded and both counts are zero, so the
+ * quiet path stays quiet exactly there. A `null` from `listDirtyPaths`
+ * (enumeration failed) gets its own distinct line instead: the caller must
+ * not read "could not tell" as "nothing foreign".
+ */
+function foreignUncommittedNotice(hypoDir, ownProject) {
+  const dirty = listDirtyPaths(hypoDir);
+  if (dirty === null) {
+    return '[WIKI: 미커밋 변경의 귀속을 확인하지 못했습니다. git 상태를 근거로 작업 범위를 정하지 마십시오.]';
+  }
+  const foreignProjects = new Set();
+  let foreignCount = 0;
+  let unattributedCount = 0;
+  for (const f of dirty) {
+    const slug = projectOfPath(f);
+    if (slug === ownProject) continue;
+    if (slug) {
+      foreignProjects.add(slug);
+      foreignCount++;
+    } else {
+      unattributedCount++;
+    }
+  }
+  if (foreignCount === 0 && unattributedCount === 0) return '';
+  const clauses = [];
+  if (foreignCount > 0) {
+    // The slug comes from a directory name in `git status` output, so it is
+    // untrusted text on its way into a prompt. sanitizeProjForPrompt is the same
+    // guard the hot-cache notices in this file already use; skipping it here would
+    // let a newline or a control char in a project directory name break the
+    // one-line notice apart and inject into the surrounding context. The name list
+    // is also capped, because an unbounded one grows the context by however many
+    // projects happen to be dirty.
+    const all = [...foreignProjects].sort();
+    const shown = all.slice(0, FOREIGN_NAME_CAP).map((s) => `projects/${sanitizeProjForPrompt(s)}`);
+    const names =
+      all.length > FOREIGN_NAME_CAP
+        ? `${shown.join(', ')} 외 ${all.length - FOREIGN_NAME_CAP}개`
+        : shown.join(', ');
+    clauses.push(`현재 프로젝트 외 ${names} 변경 ${foreignCount}건`);
+  }
+  if (unattributedCount > 0) clauses.push(`귀속 불명 변경 ${unattributedCount}건`);
+  return `[WIKI: ${clauses.join(', ')}이 있습니다. 사용자 명시 지시 없이는 이 세션 작업으로 편입하지 마십시오.]`;
+}
+
 // ── read session state ────────────────────────────────────────────────────────
 
 // Visibility guard: same contract as hypo-file-watch / hypo-session-start /
@@ -224,6 +386,7 @@ if (!project) {
   process.exit(1);
 }
 
+const foreignNotice = foreignUncommittedNotice(args.hypoDir, project);
 const device = currentDevice();
 
 const state = readSessionState(args.hypoDir, project, device);
@@ -243,10 +406,22 @@ const sessionState = state.content;
 const hotContent = readHot(args.hypoDir, project, device).content;
 
 if (args.json) {
-  console.log(JSON.stringify({ project, sessionState, hot: hotContent }, null, 2));
+  console.log(
+    JSON.stringify(
+      {
+        project,
+        sessionState,
+        hot: hotContent,
+        ...(foreignNotice ? { notice: foreignNotice } : {}),
+      },
+      null,
+      2,
+    ),
+  );
   process.exit(0);
 }
 
+if (foreignNotice) console.log(foreignNotice + '\n');
 console.log(`Project: ${project}`);
 console.log(`State: projects/${project}/session-state.md\n`);
 console.log('─'.repeat(60));

package/scripts/upgrade.mjs

@@ -924,7 +924,7 @@ function applyCommands(commandResults, force) {
     ...existing,
     pkgRoot: PKG_ROOT,
     pkgVersion,
-    schemaVersion: templateSchemaVersion(PKG_ROOT) ?? '2.1',
+    schemaVersion: templateSchemaVersion(PKG_ROOT) ?? '2.2',
     commands: newSHAs,
   });
   return applied;
@@ -950,7 +950,7 @@ function writePluginModeMetadata() {
     ...existing,
     pkgRoot: PKG_ROOT,
     pkgVersion,
-    schemaVersion: templateSchemaVersion(PKG_ROOT) ?? '2.1',
+    schemaVersion: templateSchemaVersion(PKG_ROOT) ?? '2.2',
   });
   return true;
 }