moflo 4.12.7 → 4.12.9

package/bin/lib/internal-skills.mjs

@@ -2,8 +2,10 @@
  * Skills that ship in the npm tarball (under `node_modules/moflo/.claude/skills/`)
  * but must NEVER be installed into consumer projects — strictly moflo-internal
  * dev tooling. `/publish` bumps moflo's own version and publishes to npm;
- * `/reset-epic` torches epic test data. Both are meaningless or harmful in a
- * consumer repo.
+ * `/reset-epic` torches epic test data; `/flfl` runs `/fl` preloaded with the
+ * rules that govern developing MOFLO (cross-platform, consumer blast radius,
+ * dogfooding), which are not constraints on a consumer's own project. All three
+ * are meaningless, noisy, or harmful in a consumer repo.
  *
  * The session-start launcher's recursive skills sync (`syncDirRecursive` in
  * `file-sync.mjs`) copies every shipped skill into the consumer on each run, so
@@ -13,4 +15,4 @@
  * so this leaf mirrors it. `tests/bin/internal-skills-parity.test.ts` asserts
  * the two lists never drift.
  */
-export const INTERNAL_SKILLS = ['publish', 'reset-epic'];
+export const INTERNAL_SKILLS = ['publish', 'reset-epic', 'flfl'];

package/bin/session-start-launcher.mjs

@@ -19,6 +19,7 @@ import { makeSyncer, contentEqual, syncDirRecursive } from './lib/file-sync.mjs'
 import { INTERNAL_SKILLS } from './lib/internal-skills.mjs';
 import { parseSkillCategories, computeExcludedSkills } from './lib/skill-categories.mjs';
 import { loadShippedScripts } from './lib/shipped-scripts.mjs';
+import { readHookStdin } from './lib/hook-io.mjs';
 import {
   readContinuityConfig,
   readGitState,
@@ -651,7 +652,7 @@ function stopDaemon(lockFile) {
     // error 'process can only be terminated forcefully'. The prior
     // implementation invoked it anyway, swallowed the error, then polled
     // alive for 3s before escalating — exactly the time-waste that pushed
-    // §3's stopDaemon past the 3000ms SessionStart hook timeout. Go
+    // §3's stopDaemon past the SessionStart hook timeout. Go
     // straight to /F /T (tree-kill, in case a worker child outlived its
     // parent) on Win.
     if (process.platform === 'win32') {
@@ -753,23 +754,155 @@ function resolveDaemonRecyclerPath() {
 }
 
 // ── 2. Reset workflow state for new session ──────────────────────────────────
-const stateDir = resolve(projectRoot, '.claude');
-const stateFile = resolve(stateDir, 'workflow-state.json');
-try {
-  if (!existsSync(stateDir)) mkdirSync(stateDir, { recursive: true });
-  writeFileSync(stateFile, JSON.stringify({
+//
+// #1441 — reset on a NEW session only. Claude Code fires SessionStart with a
+// `source` of `startup`, `resume`, `clear` or `compact`, and moflo's settings
+// entry carries no matcher, so this launcher runs for all four. A compaction
+// is the SAME session continuing with a shorter context; a resume is the same
+// session reopened. Resetting there wiped gate state mid-run, two ways:
+//
+//   1. `flMode` and `sddMode` are derived ONLY from the user's prompt text
+//      (gate.cjs applyPromptStateReset). Clearing them turned the #952
+//      swarm/hive invocation gate and the #1297 SDD gate OFF for the rest of
+//      the run — the user's next prompt is ordinary prose, so nothing ever
+//      re-armed them. A `/fl -s` run that compacted stopped enforcing
+//      swarm_init before Agent spawns, silently.
+//   2. testsRun / simplifyRun / verifyRun / learningsStored and their
+//      fingerprints were discarded, so a compaction forced a full re-run of
+//      tests, /flo-simplify and /verify before `gh pr create`.
+//
+// Unknown, absent, or unparseable source resets — byte-identical to the old
+// behaviour on a host that doesn't send the field, and the safe direction
+// (gates armed rather than silently off).
+const CONTINUING_SESSION_SOURCES = new Set(['compact', 'resume']);
+const KNOWN_SESSION_SOURCES = new Set(['startup', 'clear', 'compact', 'resume']);
+
+// …but a compaction is NOT a pure "keep everything" either. The credits above
+// describe work that still stands — tests ran, /verify passed, the diff is
+// unchanged. The memory-search credit is the one thing compaction genuinely
+// invalidates: `memorySearched` says "this actor has the search results in
+// context", and after a compaction it does not. Preserving it would hand the
+// post-compaction model a satisfied memory gate over a context that no longer
+// holds a single result — the exact "moflo isn't being used" symptom, arrived
+// at from the opposite direction.
+//
+// `memoryRequired` is re-armed for the same reason, and it also closes a second
+// hole reported against #1441: gate.cjs derives `memoryRequired` from the user's
+// prompt TEXT, and `/compact` is an 8-character non-task string, so submitting it
+// set `memoryRequired: false` and the scan/read gates went quiet until some later
+// prompt happened to qualify. SessionStart fires AFTER that UserPromptSubmit, so
+// re-arming here corrects it — and unlike a prompt-text rule it also covers AUTO
+// compaction, where no `/compact` is ever typed.
+//
+// Resume is untouched by this: it reloads the conversation, so a prior search is
+// still in context.
+//
+// Forcing `memoryRequired` on is deliberate even when the pre-compaction prompt
+// was genuinely trivial and scored false on its own merits. One memory search is
+// cheap; a context-blind model exploring files with the gate disarmed is the
+// thing this whole issue is about.
+const MEMORY_CREDIT_KEYS = ['memorySearched', 'memorySearchedBy', 'memoryRequired'];
+
+// Full shape, not the 4-field literal this used to write. gate.cjs readState()
+// merges STATE_DEFAULTS over whatever it parses, so the short shape behaved
+// identically THERE — but it left a half-populated file for every other reader
+// of workflow-state.json, and it silently drifted from STATE_DEFAULTS each time
+// a gate field was added. tests/bin/launcher-1441-compact-preserves-state.test.ts
+// pins these keys to gate.cjs's STATE_DEFAULTS so they cannot drift apart again.
+function freshWorkflowState() {
+  return {
     tasksCreated: false,
     taskCount: 0,
+    tasksAcknowledged: false,
     memorySearched: false,
-    sessionStart: new Date().toISOString()
-  }, null, 2));
-} catch {
-  // Non-fatal - workflow gate will use defaults
+    memorySearchedBy: {},
+    memoryRequired: true,
+    learningsStored: false,
+    testsRun: false,
+    testsFingerprint: null,
+    simplifyRun: false,
+    simplifySnapshotSha: null,
+    simplifyFingerprint: null,
+    verifyRun: false,
+    verifyOutcome: null,
+    verifyFingerprint: null,
+    interactionCount: 0,
+    sessionStart: new Date().toISOString(),
+    lastBlockedAt: null,
+    lastNamespaceHint: '',
+    lastNamespaceHintEmittedBy: {},
+    flMode: null,
+    swarmInitialized: false,
+    hiveInitialized: false,
+    sddMode: false,
+    activeSddSlug: null,
+  };
+}
+
+// Derived from freshWorkflowState(), not a second literal: a re-armed memory
+// gate is by definition the fresh-session value of those keys, and one place to
+// change beats two that agree only by inspection.
+function rearmedMemoryState() {
+  const fresh = freshWorkflowState();
+  return Object.fromEntries(MEMORY_CREDIT_KEYS.map((key) => [key, fresh[key]]));
+}
+
+// Bounded at 500ms by readHookStdin and short-circuited on a TTY, so a withheld
+// stdin cannot eat the 5000ms SessionStart budget (hook-block-hash.ts). Read
+// here rather than at the top of the file so the cost lands next to its only
+// consumer.
+const hookPayload = await readHookStdin();
+const sessionSource = typeof hookPayload?.source === 'string' ? hookPayload.source : '';
+// A source we don't recognise still resets — but say so. Falling through in
+// silence is how a renamed or newly-added "continuing" source would re-open
+// this bug with nothing to notice it by; the reset is only the safe default
+// while the set above is accurate.
+if (sessionSource && !KNOWN_SESSION_SOURCES.has(sessionSource)) {
+  emitWarning(
+    `unrecognized SessionStart source "${sessionSource}" — resetting workflow state. ` +
+    'If this source continues an existing session, it belongs in §2\'s skip list (#1441).',
+  );
+}
+const stateDir = resolve(projectRoot, '.claude');
+const stateFile = resolve(stateDir, 'workflow-state.json');
+if (!CONTINUING_SESSION_SOURCES.has(sessionSource)) {
+  try {
+    if (!existsSync(stateDir)) mkdirSync(stateDir, { recursive: true });
+    writeFileSync(stateFile, JSON.stringify(freshWorkflowState(), null, 2));
+  } catch {
+    // Non-fatal - workflow gate will use defaults
+  }
+} else if (sessionSource === 'compact') {
+  // Merge, never rewrite: everything the run has earned stays, only the memory
+  // credit is re-armed. Skipped entirely when there is no state file yet — a
+  // compaction before any prompt has nothing to re-arm, and writing a partial
+  // file here would defeat freshWorkflowState()'s shape guarantee.
+  //
+  // Read-modify-write, unsynchronised, like gate.cjs's own writeState. Safe
+  // here because a compaction quiesces the session: no tool hook is mid-flight
+  // to race with, and the next UserPromptSubmit is strictly after this hook.
+  // Leaving an unparseable file alone is also correct rather than merely
+  // tolerable — gate.cjs readState() falls back to STATE_DEFAULTS on a parse
+  // failure, which arms the memory gate. Repairing it here would only convert a
+  // fail-safe into an equivalent write.
+  try {
+    if (existsSync(stateFile)) {
+      const parsed = JSON.parse(readFileSync(stateFile, 'utf-8'));
+      writeFileSync(
+        stateFile,
+        JSON.stringify({ ...parsed, ...rearmedMemoryState() }, null, 2),
+      );
+    }
+  } catch (err) {
+    // Non-fatal, but not silent (#854): a failure here leaves the memory gate
+    // credited over a context that no longer holds the results.
+    emitWarning(`could not re-arm the memory gate after compaction (${errMessage(err)})`);
+  }
 }
 
 // ── 2a. Recycle daemon when behind installed version (#1054 follow-up) ──────
 // Promoted from §3a-pre to run BEFORE §3's file-sync work. The launcher has
-// a 3000ms SessionStart hook timeout (src/cli/services/hook-block-hash.ts);
+// a 5000ms SessionStart hook timeout (src/cli/services/hook-block-hash.ts);
 // §0c (DB repair) + §3 (file-sync, manifest, cherry-pick) + stopDaemon's
 // up-to-4s graceful poll routinely exceeds it on upgrade sessions, killing
 // the launcher mid-§3. Result: §3a-pre never ran on the very sessions that
@@ -1470,7 +1603,7 @@ try {
 
 // ── 3a-pre. (removed) Daemon-version-skew recycle moved to §2a. ─────────────
 // The previous version of this block ran AFTER §3's heavy file-sync work,
-// which routinely exceeded the 3000ms SessionStart hook timeout and was
+// which routinely exceeded the then-3000ms SessionStart hook timeout and was
 // killed before reaching this point. §2a now runs early and force-kills the
 // stale daemon before §3 can starve out. Don't restore §3a-pre — keep the
 // recycle in one place so the two paths can't drift.

package/dist/src/cli/init/claudemd-generator.js

@@ -21,15 +21,19 @@ const LEGACY_MARKER_ENDS = [
 ];
 /**
  * The single moflo section injected into CLAUDE.md.
- * ~22 lines. Points to moflo-core-guidance.md for everything else.
+ *
+ * This lands in EVERY consumer's CLAUDE.md and is read on every prompt, so it
+ * is a running token cost, not a doc. Keep it terse: state the rule, then point
+ * at moflo-core-guidance.md for the detail. Prefer cutting words over adding a
+ * line — anything needing a paragraph belongs in guidance, not here.
  */
 function mofloSection() {
     return `${MARKER_START}
 ## MoFlo — AI Agent Orchestration
 
-### FIRST ACTION ON EVERY PROMPT: Search Memory
+### FIRST ACTION ON EVERY PROMPT — AND EVERY TOPIC CHANGE: Search Memory
 
-Your first tool call MUST be \`mcp__moflo__memory_search\` — before any Glob/Grep/Read. Pick the namespace by question shape: \`code-map\` for "where is symbol X defined", \`tests\` for "what tests cover Y", \`patterns\` for "what's our pattern for Z", \`guidance\` for project rules, \`learnings\` for "did we hit this before". Pivot on the bare symbol/keyword (not a natural-language question), and trust similarity ≥ 0.80 as a confident hit. When the user says "remember this", call \`mcp__moflo__memory_store\` with namespace \`learnings\`.
+Your first tool call MUST be \`mcp__moflo__memory_search\` — before any Glob/Grep/Read or read-like Bash (\`cat\`, \`grep\`, \`node -e\`). **Search again on every new subject, mid-prompt** — new symbol, area, subsystem, or sub-question. A long task is many searches, not one. Pick the namespace by question shape: \`code-map\` for "where is symbol X defined", \`tests\` for "what tests cover Y", \`patterns\` for "what's our pattern for Z", \`guidance\` for project rules, \`learnings\` for "did we hit this before". Pivot on the bare symbol/keyword (not a natural-language question), and trust similarity ≥ 0.80 as a confident hit. When the user says "remember this", call \`mcp__moflo__memory_store\` with namespace \`learnings\`.
 
 ### Traverse chunks, don't bulk-retrieve
 
@@ -37,8 +41,9 @@ Search results carry a compact \`navigation\` crumb (parentDoc, prev/next, chunk
 
 ### Gates
 
-- **Blocking** (hook exits non-zero): memory search before Glob/Grep/guidance Read; tests + \`/flo-simplify\` + learnings + \`/verify\` before \`gh pr create\`; \`swarm_init\`/\`hive-mind_init\` before Agent under \`/fl -s|-h\`.
+- **Blocking** (hook exits non-zero): memory search before Glob/Grep/guidance Read and before read-like Bash/PowerShell commands; tests + \`/flo-simplify\` + learnings + \`/verify\` before \`gh pr create\`; \`swarm_init\`/\`hive-mind_init\` before Agent under \`/fl -s|-h\`.
 - **Advisory** (reminder only): \`TaskCreate\` before spawning the Agent tool, entries in ICON+[Role] format — see \`.claude/guidance/moflo-task-icons.md\`.
+- **Not enforced**: re-searching after a mid-prompt topic change — no hook sees the pivot. Do it anyway.
 
 ### Tools