moflo 4.10.20 → 4.10.21

package/bin/session-start-launcher.mjs

@@ -15,7 +15,22 @@ import { mofloDir, findProjectRoot, findAncestorMofloRoot, COMMON_WALK_SKIP_NAME
 import { repairMemoryDbIfCorrupt } from './lib/db-repair.mjs';
 import { resolveMofloBin } from './lib/resolve-bin.mjs';
 import { applyRetiredPrune } from './lib/retired-files.mjs';
-import { makeSyncer, contentEqual } from './lib/file-sync.mjs';
+import { makeSyncer, contentEqual, syncDirRecursive } from './lib/file-sync.mjs';
+import { INTERNAL_SKILLS } from './lib/internal-skills.mjs';
+import { loadShippedScripts } from './lib/shipped-scripts.mjs';
+import {
+  readContinuityConfig,
+  readGitState,
+  readDigests,
+  selectBestDigest,
+  formatInjection,
+} from './lib/session-continuity.mjs';
+import {
+  readMeditateConfig,
+  readLedger as readMeditateLedger,
+  pendingEntries as pendingMeditateEntries,
+  purgeLegacyFiles as purgeLegacyMeditateFiles,
+} from './lib/meditate.mjs';
 
 // Headless skip (#860). The daemon's headless workers spawn `claude --print`
 // with CLAUDE_CODE_HEADLESS=true (see src/cli/services/headless-worker-
@@ -238,10 +253,24 @@ const plural = (n, word) => `${n} ${word}${n === 1 ? '' : 's'}`;
 // can persist `.moflo/upgrade-notice.json` for the statusline (#636).
 let upgradeNoticeContext = null;
 
-// Deferred so we commit it AFTER every upgrade-work block (see 3g). The stamp
-// is the "launcher fully completed" signal — writing it mid-flight lets an
-// aborted launcher strand consumers on a half-applied upgrade (#730).
-let pendingVersionStampWrite = null;
+// Commit the version stamp = "this version's files are in place". Written the
+// moment sync + manifest succeed (dogfood has no sync to do), NOT deferred to
+// the end of §3 — so a launcher killed by the 5s SessionStart hook-timeout
+// during later best-effort §3 work (hook-drift, CLAUDE.md injection drift,
+// embeddings migration, …) still records the upgrade, and the next session
+// stops re-detecting it. That end-of-§3 deferral was the root of the indefinite
+// "updating…" re-detect loop. #730 is still honored: the stamp commits only
+// after the sync that installs this version's files succeeds; every section
+// after the §3 sync block runs unconditionally + idempotently each session, so
+// an abort past this point strands no upgrade work.
+function commitVersionStamp(stampPath, version) {
+  try {
+    mkdirSync(dirname(stampPath), { recursive: true });
+    writeFileSync(stampPath, version);
+  } catch (err) {
+    emitWarning(`version stamp write failed (${errMessage(err)}) — next launcher will re-detect the upgrade`);
+  }
+}
 
 // 5-min TTL is a safety net for zombie launchers (statusline ignores past-TTL
 // files). The 2-min "completed" TTL lets the user see the post-upgrade badge
@@ -309,6 +338,15 @@ if (existsSync(UPGRADE_NOTICE_PATH())) {
   } catch { /* deleted between stat and unlink — fine */ }
 }
 
+// ── 0-pre.b Purge orphaned pre-rebrand reflect-*.json (auto-meditate rebrand) ─
+// auto-reflect → auto-meditate renamed the ledger/state files. The old pair is
+// never read again by the new code, so on a consumer's first session after
+// upgrade we delete them here — self-healing, same posture as the upgrade-notice
+// and hook-command migrations. Idempotent: a no-op once the files are gone.
+try {
+  purgeLegacyMeditateFiles(projectRoot);
+} catch { /* cleanup is best-effort; never block session start on it */ }
+
 // #1173 Option D: defensive cleanup of in-progress upgrade notice if the
 // launcher aborts before §3f writes 'completed'. Without this, a mid-flight
 // abort leaves the (updating…) badge on the statusline until the 5-min TTL
@@ -915,7 +953,7 @@ try {
       // memory; a concurrent sql.js flush would clobber the cherry-picked
       // rows below, and old-path writes would resurrect ghost files in legacy
       // dirs. Section 4's `hooks.mjs session-start` spawns a fresh daemon
-      // under the current code once 3g writes the version stamp.
+      // under the current code after the version stamp is committed (below).
       const upgradeDaemonLock = resolve(projectRoot, '.moflo', 'daemon.lock');
       if (stopDaemon(upgradeDaemonLock)) {
         emitMutation('stopped daemon for upgrade', 'will restart fresh after upgrade work');
@@ -978,7 +1016,7 @@ try {
       // (the stopDaemon call earlier handled this) and 3a-pre will spawn a
       // fresh daemon under the new code.
       if (isMofloDogfood) {
-        pendingVersionStampWrite = { path: versionStampPath, version: installedVersion };
+        commitVersionStamp(versionStampPath, installedVersion);
         emitMutation('skipped file-sync', 'moflo dogfood — committed dogfood copies preserved');
       } else {
 
@@ -1025,6 +1063,24 @@ try {
         onSuccess: (key, dest) => recordManifestEntry(key, dest),
       });
 
+      // Single source of truth for what we sync into the consumer's .claude/ —
+      // bin/lib/shipped-scripts.json (#1191). Read from the freshly-installed
+      // package's binDir so an upgrade picks up newly-added scripts, not our
+      // own (older) synced copy. Degrade to no-op on a broken/unreadable
+      // manifest — the postinstall bootstrap already deployed the critical set,
+      // and crashing session-start would be worse than skipping one sync.
+      let scriptFiles = [];
+      let binHelperFiles = [];
+      let sourceHelperFiles = [];
+      try {
+        const shipped = loadShippedScripts(resolve(binDir, 'lib'));
+        scriptFiles = shipped.scriptFiles;
+        binHelperFiles = shipped.binHelperFiles;
+        sourceHelperFiles = shipped.sourceHelperFiles;
+      } catch (err) {
+        emitWarning(`shipped-scripts manifest unreadable (${errMessage(err)}) — skipping script/helper sync this session`);
+      }
+
       // Version changed — sync scripts from bin/
       if (autoUpdateConfig.scripts) {
         const scriptsDir = resolve(projectRoot, '.claude/scripts');
@@ -1032,12 +1088,6 @@ try {
         // not have it yet, in which case every copyFileSync below would
         // silently ENOENT (#854).
         if (!existsSync(scriptsDir)) mkdirSync(scriptsDir, { recursive: true });
-        const scriptFiles = [
-          'hooks.mjs', 'session-start-launcher.mjs', 'index-guidance.mjs',
-          'build-embeddings.mjs', 'generate-code-map.mjs', 'semantic-search.mjs',
-          'index-tests.mjs', 'index-patterns.mjs', 'index-all.mjs',
-          'setup-project.mjs', 'run-migrations.mjs',
-        ];
         for (const file of scriptFiles) {
           await syncFile(resolve(binDir, file), resolve(scriptsDir, file), `.claude/scripts/${file}`);
         }
@@ -1087,10 +1137,8 @@ try {
         const helpersDir = resolve(projectRoot, '.claude/helpers');
         if (!existsSync(helpersDir)) mkdirSync(helpersDir, { recursive: true });
 
-        // Gate and hook helpers — shipped as static files in bin/
-        const binHelperFiles = [
-          'gate.cjs', 'gate-hook.mjs', 'prompt-hook.mjs', 'hook-handler.cjs', 'simplify-classify.cjs',
-        ];
+        // Gate and hook helpers — shipped as static files in bin/.
+        // List comes from the canonical manifest loaded above (#1191).
         for (const file of binHelperFiles) {
           await syncFile(resolve(binDir, file), resolve(helpersDir, file), `.claude/helpers/${file}`);
         }
@@ -1100,11 +1148,6 @@ try {
           resolve(projectRoot, 'node_modules/moflo/.claude/helpers'),
           resolve(projectRoot, 'node_modules/moflo/src/cli/.claude/helpers'),
         ];
-        const sourceHelperFiles = [
-          'auto-memory-hook.mjs', 'statusline.cjs', 'intelligence.cjs',
-          'subagent-start.cjs', 'subagent-bootstrap.json',
-          'pre-commit', 'post-commit',
-        ];
         for (const file of sourceHelperFiles) {
           const dest = resolve(helpersDir, file);
           for (const srcDir of helperSources) {
@@ -1139,35 +1182,20 @@ try {
       // because they don't exist in node_modules/moflo/, so they never enter
       // the manifest and never get pruned — same proven safety story as
       // scripts/helpers above.
-      async function syncDirRecursive(srcDir, destPrefix) {
-        if (!existsSync(srcDir)) return;
-        let entries;
-        try {
-          entries = readdirSync(srcDir, { recursive: true, withFileTypes: true });
-        } catch (err) {
-          emitWarning(`${destPrefix} readdir failed (${errMessage(err)})`);
-          return;
-        }
-        for (const entry of entries) {
-          if (!entry.isFile()) continue;
-          if (!entry.name.toLowerCase().endsWith('.md')) continue;
-          const parent = entry.parentPath || entry.path || srcDir;
-          const absSrc = resolve(parent, entry.name);
-          const rel = absSrc.slice(srcDir.length + 1).split(/[\\/]/).join('/');
-          const absDest = resolve(projectRoot, destPrefix, rel);
-          try { mkdirSync(dirname(absDest), { recursive: true }); } catch (err) {
-            emitWarning(`${destPrefix} subdir mkdir failed for ${rel} (${errMessage(err)})`);
-          }
-          await syncFile(absSrc, absDest, `${destPrefix}/${rel}`);
-        }
-      }
+      //
+      // syncDirRecursive lives in bin/lib/file-sync.mjs so the exclusion logic
+      // is unit-testable (tests/bin/file-sync-dir.test.ts). Skills pass
+      // INTERNAL_SKILLS as excludeTopLevel so moflo-internal skills (`/publish`,
+      // `/reset-epic`) ship in the tarball but never land in a consumer project.
       await syncDirRecursive(
         resolve(projectRoot, 'node_modules/moflo/.claude/agents'),
         '.claude/agents',
+        { projectRoot, syncFile, onWarn: emitWarning },
       );
       await syncDirRecursive(
         resolve(projectRoot, 'node_modules/moflo/.claude/skills'),
         '.claude/skills',
+        { projectRoot, syncFile, excludeTopLevel: new Set(INTERNAL_SKILLS), onWarn: emitWarning },
       );
 
       // Sync all shipped guidance files from node_modules/moflo/.claude/guidance/shipped/
@@ -1269,7 +1297,7 @@ try {
       // The daemon was already stopped above so the lock file is gone and
       // there's no live PID to recycle here. Section 4's `hooks.mjs
       // session-start` will spawn a fresh daemon under the current moflo
-      // image once 3g writes the version stamp.
+      // image after the version stamp is committed (below, on sync success).
 
       // Surface per-file copy failures so the user / Claude can see what
       // didn't sync (#854). The file isn't in the manifest either, so the
@@ -1283,8 +1311,10 @@ try {
         );
       }
 
-      // Manifest reflects synced files immediately; version stamp is deferred
-      // to 3g so an aborted launcher re-runs upgrade detection (#730).
+      // Manifest reflects synced files immediately; the version stamp is
+      // committed right after the manifest write (below), gated on it succeeding
+      // — so an abort BEFORE sync still re-runs upgrade detection (#730), while
+      // an abort AFTER sync no longer strands the stamp in a re-detect loop.
       //
       // Exclude paths that `applyRetiredPrune` just deleted from disk —
       // recording a non-existent file in `installed-files.json` triggers
@@ -1302,7 +1332,7 @@ try {
         const cfDir = resolve(projectRoot, '.moflo');
         if (!existsSync(cfDir)) mkdirSync(cfDir, { recursive: true });
         writeFileSync(manifestPath, JSON.stringify(persistedManifest, null, 2));
-        pendingVersionStampWrite = { path: versionStampPath, version: installedVersion };
+        commitVersionStamp(versionStampPath, installedVersion);
       } catch (err) {
         // #854: manifest write must surface — without it the next launcher
         // can't tell what was installed and the version stamp never gets
@@ -2145,18 +2175,15 @@ if (upgradeNoticeContext) {
   upgradeNoticeFinalized = true;
 }
 
-// ── 3g. Commit deferred version stamp (#730) ────────────────────────────────
-// Written LAST so an abort above leaves the stamp unchanged and the next
-// launcher re-detects the upgrade. Failure here is surfaced (#854) so a
-// permanently-broken stamp write (filesystem permissions, AV holds) doesn't
-// silently strand consumers in re-detect-on-every-session loops.
-if (pendingVersionStampWrite) {
-  try {
-    writeFileSync(pendingVersionStampWrite.path, pendingVersionStampWrite.version);
-  } catch (err) {
-    emitWarning(`version stamp write failed (${errMessage(err)}) — next launcher will re-detect the upgrade`);
-  }
-}
+// ── 3g. (removed) Version stamp now commits eagerly on sync success ──────────
+// The stamp used to be deferred to here ("written LAST", #730). That made it
+// vulnerable to the 5s SessionStart hook-timeout kill: a launcher killed during
+// the best-effort §3 stages above never reached this point, so the stamp stayed
+// stale and every subsequent session re-detected the same upgrade — the
+// indefinite "updating…" loop. The stamp now commits inside §3's sync block the
+// moment this version's files are in place (see commitVersionStamp). #730 is
+// preserved because that commit is gated on sync success; every stage after the
+// sync block runs unconditionally + idempotently each session.
 
 // ── 3h. Clear bootstrap sentinel if section-3 sync resolved it (#975) ───────
 // Section 3 above re-attempts the same file copies the bootstrap was supposed
@@ -2193,6 +2220,59 @@ if (bootstrapSentinelData?.failures?.length > 0) {
   }
 }
 
+// Passive session-continuity injection (#1185). Relevance-gated: read recent
+// digests, score them against the current branch/changed-files/recency, and
+// emit ONLY the single best one if it clears the threshold. A fresh, unrelated
+// session injects nothing — that's what keeps it from going context-negative.
+// Framed as a verifiable lead, never ground truth. Wrapped so it can never
+// block or break session start. NOT routed through emitMutation: it's context,
+// not a mutation, so it must not inflate the count or trigger the spawn notice.
+function maybeInjectContinuity() {
+  const cfg = readContinuityConfig(projectRoot);
+  if (!cfg.inject) return;
+
+  const rows = readDigests(projectRoot, { limit: 12 });
+  if (rows.length === 0) return; // first-ever session — nothing to inject, no git calls
+
+  const git = readGitState(projectRoot);
+  const best = selectBestDigest(
+    rows,
+    { branch: git.branch, changedFiles: git.changedFiles },
+    { maxAgeHours: cfg.maxAgeHours, now: Date.now() },
+  );
+  if (!best) return;
+
+  const block = formatInjection(best, Date.now());
+  if (block) {
+    try { process.stdout.write(block + '\n'); } catch { /* broken stdout must not throw */ }
+  }
+}
+try {
+  maybeInjectContinuity();
+} catch (err) {
+  emitWarning(`continuity injection skipped (${errMessage(err)})`);
+}
+
+// Auto-meditate Stage 2 — DISTILL (#1198). Default-off. When enabled AND the
+// capture ledger holds un-distilled lessons, fire-and-forget the DETACHED
+// distill orchestrator — it runs ONE bounded headless Haiku /meditate over the
+// ledger one-liners and writes `learnings` via memory_store (daemon-routed,
+// writer-safe). The gate here is cheap (a config read + a ledger read); the
+// spawn + model call live entirely in the detached child, so the launcher's
+// spawn-and-exit contract holds. CLAUDE_CODE_HEADLESS is guarded at the top of
+// this file, so a headless session never reaches here (no infinite spawn).
+function maybeFireMeditateDistill() {
+  if (!readMeditateConfig(projectRoot).enabled) return;
+  if (pendingMeditateEntries(readMeditateLedger(projectRoot)).length === 0) return;
+  const distillScript = resolveMofloBin(projectRoot, null, 'meditate-distill.mjs');
+  if (distillScript) fireAndForget('node', [distillScript], 'meditate-distill');
+}
+try {
+  maybeFireMeditateDistill();
+} catch (err) {
+  emitWarning(`meditate distill spawn skipped (${errMessage(err)})`);
+}
+
 // Bypasses emitMutation — framing, not a mutation, so it must not inflate the count.
 if (mutationCount > 0) {
   try {

package/dist/src/cli/config/moflo-config.js

@@ -40,6 +40,14 @@ const DEFAULT_CONFIG = {
         guidance: true,
         code_map: true,
     },
+    session_continuity: {
+        capture: true,
+        inject: true,
+        max_age_hours: 72,
+    },
+    auto_meditate: {
+        enabled: true,
+    },
     memory: {
         backend: 'node-sqlite',
         embedding_model: 'Xenova/all-MiniLM-L6-v2',
@@ -198,6 +206,16 @@ function mergeConfig(raw, root) {
             guidance: raw.auto_index?.guidance ?? raw.autoIndex?.guidance ?? DEFAULT_CONFIG.auto_index.guidance,
             code_map: raw.auto_index?.code_map ?? raw.autoIndex?.code_map ?? DEFAULT_CONFIG.auto_index.code_map,
         },
+        session_continuity: {
+            capture: raw.session_continuity?.capture ?? raw.sessionContinuity?.capture ?? DEFAULT_CONFIG.session_continuity.capture,
+            inject: raw.session_continuity?.inject ?? raw.sessionContinuity?.inject ?? DEFAULT_CONFIG.session_continuity.inject,
+            max_age_hours: raw.session_continuity?.max_age_hours ?? raw.sessionContinuity?.maxAgeHours ?? DEFAULT_CONFIG.session_continuity.max_age_hours,
+        },
+        auto_meditate: {
+            // Back-compat: honour the legacy auto_reflect / autoReflect keys (pre-rebrand)
+            // so an existing opt-out survives until the yaml-upgrader renames the key.
+            enabled: raw.auto_meditate?.enabled ?? raw.autoMeditate?.enabled ?? raw.auto_reflect?.enabled ?? raw.autoReflect?.enabled ?? DEFAULT_CONFIG.auto_meditate.enabled,
+        },
         memory: {
             backend: coerceMemoryBackend(raw.memory?.backend),
             embedding_model: raw.memory?.embedding_model || raw.memory?.embeddingModel || DEFAULT_CONFIG.memory.embedding_model,

package/dist/src/cli/init/executor.js

@@ -16,6 +16,7 @@ import { generateSettingsJson, generateSettings } from './settings-generator.js'
 import { generateMCPJson } from './mcp-generator.js';
 import { generatePreCommitHook, generatePostCommitHook, generateAutoMemoryHook, generateGateScript, generateGateHookScript, generatePromptHookScript, generateHookHandlerScript, } from './helpers-generator.js';
 import { generateClaudeMd } from './claudemd-generator.js';
+import { loadShippedScripts } from './shipped-scripts.js';
 import { writeEnvrc } from './envrc-generator.js';
 import { repairHookWiring } from '../services/hook-wiring.js';
 import { locateMofloRootPath } from '../services/moflo-require.js';
@@ -31,12 +32,15 @@ import { errorDetail } from '../shared/utils/error-detail.js';
 // skills that ship in the tarball but are deliberately NOT installed.
 export const SKILLS_MAP = {
     core: [
+        'commune',
         'eldar',
         'guidance',
         'healer',
         'flo-simplify',
         'luminarium',
         'reasoningbank-intelligence',
+        'meditate',
+        'divine',
     ],
     memory: [
         'memory-patterns',
@@ -401,25 +405,15 @@ export async function executeUpgrade(targetDir, _upgradeSettings = false) {
         if (!fs.existsSync(scriptsDir)) {
             fs.mkdirSync(scriptsDir, { recursive: true });
         }
-        // Must mirror the list in bin/session-start-launcher.mjs — divergence
-        // here means the launcher's drift-repair will delete files this upgrade
-        // didn't track, even though they ship in the package (#777).
-        const UPGRADE_SCRIPT_MAP = [
-            'hooks.mjs',
-            'session-start-launcher.mjs',
-            'index-guidance.mjs',
-            'build-embeddings.mjs',
-            'generate-code-map.mjs',
-            'semantic-search.mjs',
-            'index-tests.mjs',
-            'index-patterns.mjs',
-            'index-all.mjs',
-            'setup-project.mjs',
-            'run-migrations.mjs',
-        ];
         const binDir = findMofloBinDir();
         if (binDir) {
-            for (const name of UPGRADE_SCRIPT_MAP) {
+            // Canonical sync list — single source of truth in bin/lib/shipped-scripts.json
+            // (#1191). Read from the SAME binDir we copy from so the list and the files
+            // can't diverge (in dogfood, findMofloPackageRoot and findMofloBinDir can
+            // resolve to different installs). Drift across launcher / bootstrap / init
+            // is now impossible — there's one list.
+            const scriptFiles = loadShippedScripts(path.join(binDir, 'lib')).scriptFiles;
+            for (const name of scriptFiles) {
                 const srcPath = path.join(binDir, name);
                 const destPath = path.join(scriptsDir, name);
                 if (!fs.existsSync(srcPath))

package/dist/src/cli/init/moflo-init.js

@@ -17,6 +17,7 @@ import { errorDetail } from '../shared/utils/error-detail.js';
 import { discoverGuidanceDirs, discoverSrcDirs, discoverTestDirs, detectExtensions, renderMofloYaml, } from './moflo-yaml-template.js';
 import { generateClaudeMd as generateMofloSection } from './claudemd-generator.js';
 import { applyInjectionReplacement } from '../services/claudemd-injection.js';
+import { loadShippedScripts } from './shipped-scripts.js';
 import { DEFAULT_INIT_OPTIONS } from './types.js';
 export { discoverTestDirs };
 // ============================================================================
@@ -425,23 +426,10 @@ function generateClaudeMd(root, _force) {
 // These scripts are used by session-start hooks for indexing, code map, etc.
 // Always overwrite to keep them in sync with the installed moflo version.
 // ============================================================================
-// Must mirror UPGRADE_SCRIPT_MAP in src/cli/init/executor.ts and the
-// scriptFiles array in bin/session-start-launcher.mjs — first-init drops any
-// script missing here, and the launcher's manifest cleanup later treats it as
-// orphan residue and deletes it (#777, feedback_scriptfiles_sync.md).
-export const SCRIPT_MAP = [
-    'hooks.mjs',
-    'session-start-launcher.mjs',
-    'index-guidance.mjs',
-    'build-embeddings.mjs',
-    'generate-code-map.mjs',
-    'semantic-search.mjs',
-    'index-tests.mjs',
-    'index-patterns.mjs',
-    'index-all.mjs',
-    'setup-project.mjs',
-    'run-migrations.mjs',
-];
+// The script sync list is read from the canonical manifest
+// bin/lib/shipped-scripts.json (#1191) — single source of truth shared with the
+// launcher, the post-install bootstrap, and executor.ts. No more hand-mirrored
+// arrays that drift (which #1184 hit across all four sites).
 function syncScripts(root, force) {
     const scriptsDir = path.join(root, '.claude', 'scripts');
     if (!fs.existsSync(scriptsDir)) {
@@ -462,8 +450,15 @@ function syncScripts(root, force) {
     if (!binDir) {
         return { name: '.claude/scripts/', status: 'skipped', detail: 'moflo bin/ not found' };
     }
+    let scriptFiles;
+    try {
+        scriptFiles = loadShippedScripts(path.join(binDir, 'lib')).scriptFiles;
+    }
+    catch (err) {
+        return { name: '.claude/scripts/', status: 'skipped', detail: `shipped-scripts manifest unreadable: ${errorDetail(err)}` };
+    }
     let copied = 0;
-    for (const name of SCRIPT_MAP) {
+    for (const name of scriptFiles) {
         const srcPath = path.join(binDir, name);
         const destPath = path.join(scriptsDir, name);
         if (!fs.existsSync(srcPath))
@@ -532,6 +527,13 @@ function isStale(srcPath, destPath) {
 // ============================================================================
 export function updateGitignore(root) {
     const gitignorePath = path.join(root, '.gitignore');
+    // Script ignore patterns from the canonical manifest (#1191); a broken/absent
+    // manifest just omits them — gitignore is non-critical (scripts are derived).
+    let scriptIgnorePatterns = [];
+    try {
+        scriptIgnorePatterns = loadShippedScripts().scriptFiles.map(name => `/.claude/scripts/${name}`);
+    }
+    catch { /* manifest unreadable — omit (non-critical) */ }
     const entries = [
         '.claude-epic/',
         '.moflo/',
@@ -543,7 +545,7 @@ export function updateGitignore(root) {
         // swallowed shipped/internal subdirs and broke `npm pack`
         // (guidance-gitignore-shipped-trap).
         '/.claude/guidance/moflo-*.md',
-        ...SCRIPT_MAP.map(name => `/.claude/scripts/${name}`),
+        ...scriptIgnorePatterns,
     ];
     // Treat `/.foo` and `.foo` as the same rule when checking for prior presence
     // — both forms anchor at gitignore root, so a consumer who wrote either

package/dist/src/cli/init/moflo-yaml-template.js

@@ -213,6 +213,25 @@ auto_index:
   code_map: ${codeMap}
   tests: ${tests}
 
+# Passive session-continuity — pick up where you left off across sessions.
+# capture: silently record a compact "where you left off" digest at turn-end.
+# inject:  surface the single most-relevant recent digest at session-start
+#          (relevance-gated by branch / changed files / recency, so an unrelated
+#          session shows nothing). Add "<private>" to a message to skip capturing
+#          that session. Set either to false to opt out.
+session_continuity:
+  capture: true
+  inject: true
+  max_age_hours: 72            # ignore digests older than this when injecting
+
+# Auto-meditate (#1198) — the automatic counterpart to /meditate. When enabled,
+# moflo recognizes durable lessons in the LIVE session (a tiny answer-first note
+# on course-corrections / errors / decisions) and distills them into long-term
+# memory at the next session-start via a cheap headless Haiku pass — deduped.
+# Ships ON; set false to opt out.
+auto_meditate:
+  enabled: true
+
 # Memory backend
 memory:
   backend: node-sqlite
@@ -312,6 +331,8 @@ export const REQUIRED_TOP_LEVEL_SECTIONS = [
     'tests',
     'gates',
     'auto_index',
+    'session_continuity',
+    'auto_meditate',
     'memory',
     'hooks',
     'mcp',

package/dist/src/cli/init/settings-generator.js

@@ -178,6 +178,17 @@ function hookHandlerCmd(subcommand) {
 function autoMemoryCmd(subcommand) {
     return hookCmdEsm('"$CLAUDE_PROJECT_DIR/.claude/helpers/auto-memory-hook.mjs"', subcommand);
 }
+/** Shorthand for the ESM session-continuity capture command (#1185). Lives in
+ *  .claude/scripts/ (a synced scriptFile), beside its ./lib/ helpers. */
+function continuityCmd(subcommand) {
+    return hookCmdEsm('"$CLAUDE_PROJECT_DIR/.claude/scripts/session-continuity.mjs"', subcommand);
+}
+/** Shorthand for the ESM auto-meditate capture command (#1198). Default-ON
+ *  (the script no-ops only when auto_meditate.enabled is false). Lives in
+ *  .claude/scripts/ beside its ./lib/ helpers. */
+function meditateCaptureCmd(subcommand) {
+    return hookCmdEsm('"$CLAUDE_PROJECT_DIR/.claude/scripts/meditate-capture.mjs"', subcommand);
+}
 /** Shorthand for gate commands (lightweight JSON state checks) */
 function gateCmd(subcommand) {
     return hookCmd('"$CLAUDE_PROJECT_DIR/.claude/helpers/gate.cjs"', subcommand);
@@ -345,6 +356,13 @@ function generateHooksConfig(config) {
                     { type: 'command', command: gateHookCmd('prompt-state-reset'), timeout: 3000 },
                 ],
             },
+            // #1198 — auto-meditate Stage 1 (detect). Default-ON; injects an
+            // answer-first capture directive only on a strong signal + within limits.
+            {
+                hooks: [
+                    { type: 'command', command: meditateCaptureCmd('meditate-detect'), timeout: 3000 },
+                ],
+            },
         ];
     }
     // SubagentStart — inject directive for subagents to read guidance protocol
@@ -378,13 +396,17 @@ function generateHooksConfig(config) {
             },
         ];
     }
-    // Stop — persist session + sync auto memory
+    // Stop — persist session + sync auto memory + capture continuity digest (#1185)
     if (config.stop) {
         hooks.Stop = [
             {
                 hooks: [
                     { type: 'command', command: hookHandlerCmd('session-end'), timeout: 5000 },
                     { type: 'command', command: autoMemoryCmd('sync'), timeout: 10000 },
+                    { type: 'command', command: continuityCmd('capture'), timeout: 5000 },
+                    // #1198 — auto-meditate Stage 1 (scrape). Default-ON; harvests
+                    // <meditate-capture> tags from the assistant turn into the ledger.
+                    { type: 'command', command: meditateCaptureCmd('meditate-scrape'), timeout: 5000 },
                 ],
             },
         ];

package/dist/src/cli/init/shipped-scripts.js

@@ -0,0 +1,39 @@
+/**
+ * TS reader for the canonical shipped-scripts manifest
+ * (`bin/lib/shipped-scripts.json`) — the single source of truth for the scripts
+ * + helpers moflo syncs into a consumer's `.claude/` (issue #1191).
+ *
+ * The `.mjs` twin is `bin/lib/shipped-scripts.mjs`; both read the same JSON.
+ * This module resolves it through `findMofloPackageRoot()` — the sanctioned
+ * dist→bin resolver (see `.claude/guidance/internal/dogfooding.md` §2) that
+ * works in dogfood TS, compiled dist, and consumer installs alike. NEVER a
+ * hardcoded `../../../../bin/...` path (the depth differs between src and dist).
+ */
+import { readFileSync } from 'fs';
+import { join } from 'path';
+import { findMofloPackageRoot } from '../services/moflo-require.js';
+/**
+ * Read the canonical shipped-scripts manifest. Pass the resolved `bin/lib`
+ * directory to read a specific install's copy (callers that already resolved a
+ * binDir — e.g. init's syncScripts — pass it so the list matches the exact dir
+ * they copy from); omit it to resolve via `findMofloPackageRoot()`. Throws if
+ * the manifest can't be located — that signals a broken install, which init and
+ * upgrade can't proceed past anyway.
+ */
+export function loadShippedScripts(binLibDir) {
+    let dir = binLibDir;
+    if (!dir) {
+        const root = findMofloPackageRoot();
+        if (!root) {
+            throw new Error('moflo package root not found — cannot read shipped-scripts manifest');
+        }
+        dir = join(root, 'bin', 'lib');
+    }
+    const manifest = JSON.parse(readFileSync(join(dir, 'shipped-scripts.json'), 'utf-8'));
+    return {
+        scriptFiles: manifest.scriptFiles ?? [],
+        binHelperFiles: manifest.binHelperFiles ?? [],
+        sourceHelperFiles: manifest.sourceHelperFiles ?? [],
+    };
+}
+//# sourceMappingURL=shipped-scripts.js.map

package/dist/src/cli/memory/bridge-core.js

@@ -32,6 +32,26 @@ export function _resetProjectRootForTest() {
 export function _getBridgeCoherenceCursorForTest() {
     return lastSeenMtimeMs;
 }
+/**
+ * Candidate-pool ceiling for the brute-force search path (#1201).
+ *
+ * The bridge search scores candidates one-by-one (cosine + BM25), so it must
+ * cap how many rows it pulls. The old `LIMIT 1000` with NO `ORDER BY` truncated
+ * by rowid (insertion order): on a populated DB the first 1000 rows are all
+ * bulk-indexed `code-map`, so a no-namespace search silently scored ZERO
+ * `learnings`/`patterns`/etc. — they were invisible to default recall.
+ *
+ * The fix pairs this cap with `ORDER BY created_at DESC`, so when truncation
+ * does happen (DB larger than the cap) it keeps the most RECENT entries — where
+ * curated learnings and recent work live — instead of the oldest rowids.
+ * Realistic DBs (thousands–low tens of thousands) fall under the cap and are
+ * scored in full; measured ~13ms per 1000 rows. Env-overridable for ops tuning
+ * and tests. Beyond the cap, a true HNSW candidate path is the scale answer.
+ */
+export function searchCandidateCap() {
+    const raw = Number(process.env.MOFLO_SEARCH_CANDIDATE_CAP);
+    return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : 25000;
+}
 /**
  * Resolve the bridge's project root.
  *