moflo 4.12.8 → 4.12.10

package/bin/gate.cjs

@@ -240,10 +240,11 @@ function isEphemeralPath(fp) {
 }
 // #1171 — DANGEROUS gained PowerShell additions to match the matcher widening
 // that now routes the dedicated `PowerShell` tool through check-dangerous-command.
-// POSIX entries still apply because PS will execute them when invoked. Substring
-// match (case-insensitive) inside the gate.
+// POSIX entries still apply because PS will execute them when invoked. Matched
+// case-insensitively by `matchesDangerous` below — substring for most entries,
+// root-anchored for the ones that end at a filesystem root.
 var DANGEROUS = [
-  'rm -rf /', 'format c:', 'del /s /q c:\\', ':(){:|:&};:', 'mkfs.', '> /dev/sda',
+  'rm -rf /', 'rm -rf ~', 'format c:', 'del /s /q c:\\', ':(){:|:&};:', 'mkfs.', '> /dev/sda',
   // PowerShell destructive patterns. Won't catch every adversarial spelling
   // (PS aliases let `ri -r -force C:\` mean the same thing) but covers the
   // common-typo destruction class — symmetric to the POSIX list's intent.
@@ -254,6 +255,74 @@ var DANGEROUS = [
   'clear-disk',
 ];
 
+// #1449 — the entries above that END at a filesystem root are also a PREFIX of
+// every absolute path beneath it, so plain substring matching blocked routine
+// cleanup: `rm -rf /tmp/scratch` reported as `rm -rf /`. Those entries must
+// match ON the root rather than at the head of a longer path.
+//
+// WHICH entries those are is derived, not listed: a pattern is root-shaped iff
+// it ends at a root — a separator or `~`. That selects `rm -rf /`, `rm -rf ~`,
+// `del /s /q c:\` and the three `remove-item` forms, and leaves `format c:`,
+// `mkfs.`, `> /dev/sda`, `format-volume` and `clear-disk` on plain substring
+// matching, where trailing text is still the same dangerous command. Deriving
+// it rather than keeping a parallel list means a future root-shaped addition to
+// DANGEROUS is anchored automatically instead of silently falling back to the
+// prefix bug this fixes.
+//
+// `rm -rf ~` joins DANGEROUS with this change: it was never listed, so wiping a
+// home directory was allowed outright while cleaning a subdirectory of one was
+// blocked. Anchoring is what makes the entry safe to add.
+function endsAtRoot(pat) {
+  var last = pat.charAt(pat.length - 1);
+  return last === '/' || last === '\\' || last === '~';
+}
+// What may legally follow a root target: nothing, whitespace, a glob (`rm -rf /*`
+// still blocks), a shell operator, or a closing quote/paren. A path character —
+// letter, digit, `-`, `_` — means another segment follows, i.e. routine cleanup
+// of something below root. Rule #1: pure string logic, no platform branch; both
+// separators are handled for every OS's spelling.
+var ROOT_BOUNDARY_RE = /[\s;&|)"'`*<>]/;
+function isRootBoundary(cmd, i) {
+  if (i >= cmd.length) return true;
+  var c = cmd.charAt(i);
+  return c === '/' || c === '\\' || ROOT_BOUNDARY_RE.test(c);
+}
+
+/**
+ * Advance past text that does not move OFF the root: repeated separators, and
+ * `.` / `..` segments, which resolve back to where they started. `rm -rf //`,
+ * `rm -rf /.` and `rm -rf /..` all still mean `rm -rf /` and must block, while
+ * `rm -rf //tmp/x` and `rm -rf /.config` are real paths below root and must not.
+ * Without the dot handling the anchoring would OPEN a hole the substring match
+ * did not have — `.` is not a boundary character, so `rm -rf /.` would read as
+ * "a longer path follows" and pass.
+ */
+function skipToRootEnd(cmd, i) {
+  for (;;) {
+    var start = i;
+    while (i < cmd.length && (cmd.charAt(i) === '/' || cmd.charAt(i) === '\\')) i++;
+    var dots = 0;
+    while (cmd.charAt(i + dots) === '.') dots++;
+    // Only a BARE `.` or `..` segment is a no-op; `.config` and `..foo` are names.
+    if ((dots === 1 || dots === 2) && isRootBoundary(cmd, i + dots)) i += dots;
+    if (i === start) return i;
+  }
+}
+
+/**
+ * True when `pat` occurs in `cmd` as a real dangerous command. Root-shaped
+ * patterns must land on the root; every occurrence is examined, so a safe
+ * leading match (`rm -rf /tmp/a && rm -rf /`) never masks a later real one.
+ */
+function matchesDangerous(cmd, pat) {
+  if (!endsAtRoot(pat)) return cmd.indexOf(pat) >= 0;
+  for (var at = cmd.indexOf(pat); at >= 0; at = cmd.indexOf(pat, at + 1)) {
+    var end = skipToRootEnd(cmd, at + pat.length);
+    if (end >= cmd.length || ROOT_BOUNDARY_RE.test(cmd.charAt(end))) return true;
+  }
+  return false;
+}
+
 // #1132 — Bash memory-first gate.
 //
 // CREDIT: marks the gate satisfied when Claude invokes a memory-search CLI
@@ -395,6 +464,60 @@ function bashCoordinationInit(rawCmd) {
   }
   return null;
 }
+// #1445 — read shapes whose LEADING command is one BASH_CARVE_OUT_RE carves out
+// wholesale (`node …`, `git …`). They are read-like because of what FOLLOWS the
+// leading token, so anchoring on that token alone can never see them: in one
+// real session 539 file-exploration calls went through `node -e` + readFileSync
+// and `git show <ref>:<path>` with the gate blind to every one of them. That is
+// the dominant exploration shape in repos whose own guidance steers away from
+// `grep` (e.g. where `grep` is `ugrep` and silently skips files, so any
+// inventory a decision rests on must go through `fs.readFileSync`).
+//
+// These sources are spliced into READ_LIKE_BASH_RE below AND kept addressable
+// on their own, because check-bash-memory has to let them override the
+// carve-out — extending READ_LIKE alone would change nothing, the `^\s*(node|
+// git)\s` carve-out arms swallow them one line later.
+var RUNNER_READ_SOURCES = [
+  // `node -e "...readFileSync(...)..."`, in every eval spelling (-e/--eval/-p/
+  // --print/--input-type=module -e). The eval FLAG is deliberately not required:
+  // a script-file invocation (`node scripts/build.mjs`) does not carry a read
+  // call in its command line, so the read call itself is the reliable signal and
+  // demanding the flag only adds spellings to miss.
+  //
+  // The negative lookahead is load-bearing, not caution: Rule #1 tells authors
+  // to do cross-platform file OPS through `node -e` with fs (`mkdir`/`rm`/`cp`
+  // do not exist on Windows), and a read-modify-write is an operation, not
+  // exploration. Only fs MUTATION calls carve out — matching a bare `write`
+  // would carve out `process.stdout.write`, which nearly every inline read
+  // script ends with, and that would hand back the whole gap.
+  //
+  // Every mutation name covers its sync, callback AND promise spelling: authors
+  // reach for `fs.promises.rm` as readily as `rmSync`, and listing only the
+  // `*Sync` form would block the delete op Rule #1 sent them to `node -e` for.
+  // `rm`/`rmdir`/`cp` carry `\b` because they are short enough to appear inside
+  // unrelated words — an unanchored `rm` matches "format" and "transform", and
+  // would carve out most of what this arm exists to catch.
+  '^\\s*(?:node|nodejs)(?:\\.(?:exe|cmd))?\\s'
+    + '(?=[\\s\\S]*(?:read(?:File|dir)|globSync))'
+    + '(?![\\s\\S]*(?:writeFile|appendFile|mkdir|mkdtemp|unlink|copyFile|rename'
+    + '|symlink|createWriteStream|\\brm(?:dir)?(?:Sync)?\\b|\\bcp(?:Sync)?\\b))',
+  // `git show <ref>:<path>` / `git cat-file -p <ref>:<path>` — the colon form
+  // reads a blob and is `cat` by another name. Leading `-`-prefixed tokens are
+  // consumed as flags first so `--pretty=format:%h` (a colon inside a FLAG)
+  // cannot masquerade as a ref:path, and the segment after the colon must carry
+  // a path character — same false-negative trade as the `type \S*[\\/.]` arm
+  // above (`git show HEAD:src`, a bare directory, passes; source files all have
+  // extensions). Bare `git show`, `git show --stat`, `git log` and `git diff`
+  // have no ref:path token and stay operational.
+  '^\\s*git\\s+(?:show|cat-file)\\s+(?:-{1,2}\\S+\\s+)*[^-\\s]\\S*:\\S*[\\\\/.]',
+  // Repo-wide content search and file inventory — the `git` spellings of
+  // `grep -r` and `find`. NOT `git log --grep`, which searches commit messages,
+  // is already in the passing set, and does not match `git\s+grep`.
+  '^\\s*git\\s+(?:grep|ls-files)\\b',
+];
+// Same sources as their own matcher — check-bash-memory tests this to let a
+// carved-out leading command still block when the rest of the command is a read.
+var RUNNER_READ_BASH_RE = new RegExp(RUNNER_READ_SOURCES.join('|'), 'i');
 // BLOCK: read-like Bash commands that bypass the existing check-before-read /
 // check-before-scan gates by going through the shell. Anchored to the start of
 // the line so subcommands inside pipelines or `npm install grep` don't trip.
@@ -427,7 +550,7 @@ var READ_LIKE_BASH_RE = new RegExp([
   '^\\s*dir\\b[^|]*\\s\\/[sS]\\b',
   // #1171 — PowerShell hex dump, parallel to POSIX `xxd`/`hexdump`.
   '^\\s*Format-Hex\\b',
-].join('|'), 'i');
+].concat(RUNNER_READ_SOURCES).join('|'), 'i');
 // CARVE-OUT: commands that LOOK read-like but are operational. Anchored to the
 // LEADING command — the pipe-filter case (`npm test | grep FAIL`) is already
 // handled by READ_LIKE's `^\s*` anchor never matching the leading `npm`, so
@@ -474,8 +597,73 @@ function stripQuotedAndHeredocs(cmd) {
   return out;
 }
 
-var DIRECTIVE_RE = /^(yes|no|yeah|yep|nope|sure|ok|okay|correct|right|exactly|perfect)\b/i;
-var TASK_RE = /\b(fix|bug|error|implement|add|create|build|write|refactor|debug|test|feature|issue|security|optimi)\b/i;
+// #1447 — words that carry no subject to search FOR: assent, acknowledgement,
+// "keep going", and conversational filler. A prompt built ONLY from these
+// continues work already under way, so the memory gate stays down; anything
+// that survives the strip is a subject, and the gate arms.
+//
+// Supersedes two things. `DIRECTIVE_RE` — a `^(yes|ok|sure|…)` prefix test that
+// had already been dead code for some time, unreferenced by the reset it was
+// written for. And the live rule, `TASK_RE.test(p) || p.length > 20`, whose
+// real work was skipping short replies: every prompt of 20 characters or fewer
+// without a task word was exempt. That caught trivia ("hmm", "got it") and
+// equally caught "check the daemon" — a genuine topic change — which is the
+// half this replaces. The list below has to carry the trivia half on its own,
+// so it covers considerably more ground than DIRECTIVE_RE ever did.
+//
+// Matching by SUBTRACTION, not by a leading-token test, is what lets
+// "yes, now fix the daemon" arm while "yes" does not — a `^(yes|ok)\b` test
+// sees the same first word in both. It is also why the list can safely hold
+// ordinary words like `do`/`it`/`work`/`the`: a word only exempts a prompt when
+// NOTHING else in that prompt survives, so each addition costs precision only
+// for prompts made entirely of listed words. Deliberately absent for that
+// reason: task words (`fix`, `test`, `build`) and any noun.
+var CONTINUATION_WORD_RE = new RegExp('\\b(?:' + [
+  // Assent / dissent / acknowledgement
+  'yes', 'yeah', 'yep', 'yup', 'no', 'nope', 'sure', 'ok', 'okay', 'k',
+  'correct', 'right', 'exactly', 'perfect', 'agreed', 'true', 'indeed',
+  'understood', 'gotcha', 'got', 'makes', 'sense', 'fine', 'alright',
+  // Continuation / assent to proceed
+  'continue', 'proceed', 'carry', 'keep', 'going', 'go', 'ahead', 'on', 'next',
+  'again', 'more', 'rest', 'both', 'all', 'them', 'those',
+  // Politeness and praise
+  'please', 'thanks', 'thank', 'ty', 'great', 'nice', 'cool', 'good', 'awesome',
+  'excellent', 'sounds', 'lgtm', 'love', 'well', 'work', 'job', 'wow', 'yay',
+  // Conversational filler / hesitation / greetings
+  'hmm', 'hm', 'huh', 'ah', 'oh', 'ha', 'haha', 'lol', 'wait', 'hold', 'hang',
+  'actually', 'anyway', 'whatever', 'nvm', 'nevermind', 'sorry', 'oops',
+  'hi', 'hello', 'hey', 'stop', 'pause', 'never', 'mind',
+  'think', 'know', 'see', 'guess', 'suppose', 'maybe', 'probably',
+  // Function words with no subject of their own
+  'do', 'it', 'that', 'this', 'the', 'a', 'an', 'and', 'is', 'are', 'was',
+  'you', 'your', 'i', 'we', 'lets', 'let', 'us', 'me', 'my', 'now', 'then',
+  'done', 'finish', 'finished', 'ready', 'too', 'also', 'just', 'still',
+].join('|') + ')\\b', 'gi');
+/**
+ * Does this prompt consist of nothing but continuation filler?
+ *
+ * An EMPTY prompt answers true — a prompt the gate cannot see is not evidence
+ * that a search is needed, and arming on it would block every read in a
+ * consumer whose host omits the field, with nothing on screen explaining why.
+ * Fail-open here; `prompt-state-reset` separately refuses to WRITE a verdict it
+ * derived from an empty prompt (#1447), so an unreadable prompt now leaves the
+ * gate exactly as prompt-reminder set it rather than silently disarming it.
+ */
+function isContinuationPrompt(promptText) {
+  var t = (promptText || '').trim();
+  if (!t) return true;
+  // Subtract continuation words, then every non-alphanumeric character. What
+  // remains is the prompt's actual subject matter; nothing remaining means the
+  // prompt introduced no new subject.
+  // `\p{L}\p{N}` with /u, NOT `A-Za-z0-9`: an ASCII-only class strips every
+  // character of a CJK, Cyrillic, Arabic, Hebrew, Greek or Thai prompt — and
+  // most of an accented French or Spanish one — leaving nothing, so a
+  // substantive non-English request would score as pure filler and silently
+  // disarm the gate. Stripping only what is neither letter nor number keeps
+  // every script's content intact and removes just punctuation and spacing.
+  var rest = t.replace(CONTINUATION_WORD_RE, ' ').replace(/[^\p{L}\p{N}]+/gu, ' ').trim();
+  return rest.length === 0;
+}
 
 // Namespace classification (#931). The hint used to be emitted on every prompt
 // by prompt-hook.mjs which cost ~40 tokens × every prompt × every consumer.
@@ -510,7 +698,9 @@ var NS_NAV_RES = [
 // explicitly opted in to the protected coordination surface, so falling back to
 // raw Agent dispatch silently regresses headline moflo product capability.
 //
-// SYNC: duplicated verbatim in src/cli/init/helpers-generator.ts.
+// This file is the single source; #1443 replaced helpers-generator.ts's
+// hand-maintained copy with a build-time embed of this exact file, so there is
+// no longer a second copy of this function to keep in step.
 function detectFlMode(promptText) {
   var p = promptText || '';
   if (!/^\s*\/(?:fl|flo)\b/i.test(p)) return null;
@@ -653,10 +843,14 @@ function classifyNamespaceHint(promptText) {
 // full sentence in the same shape as classifyNamespaceHint so the BLOCK arm
 // can write either source's hint without branching on format.
 //
-// SYNC: duplicated verbatim in src/cli/init/helpers-generator.ts.
+// This file is the single source — see the note on detectFlMode above (#1443).
 function classifyBashNamespaceHint(cmd) {
   // Search-like tools — the user is hunting for a symbol/file, code-map wins.
-  if (/^\s*(?:grep|rg|ag|fgrep|egrep|find|fd|Select-String|sls)\b/i.test(cmd)) {
+  // #1445 — `git grep` / `git ls-files` are the same hunt through a different
+  // binary, so they route to the same namespace rather than falling through to
+  // the hintless generic message.
+  if (/^\s*(?:grep|rg|ag|fgrep|egrep|find|fd|Select-String|sls)\b/i.test(cmd)
+   || /^\s*git\s+(?:grep|ls-files)\b/i.test(cmd)) {
     return 'Memory namespace hint: use "code-map" for codebase navigation.';
   }
   // Reading a .md / RST / TXT, or a well-known doc file — guidance/learnings win.
@@ -674,7 +868,7 @@ function classifyBashNamespaceHint(cmd) {
 // UserPromptSubmit hooks can run it without compounding any field. Caller
 // owns interactionCount and the user-visible REMINDER/Context emissions, so
 // this helper stays silent.
-function applyPromptStateReset(state, promptText) {
+function applyPromptStateReset(state, promptText, opts) {
   // #352/#1331 — this is the ONLY place the memory gate resets. Deliberately
   // NOT on task transitions: within a single prompt (e.g. a /flo workflow)
   // memory stays searched so Read/Grep aren't blocked mid-execution. A
@@ -688,9 +882,24 @@ function applyPromptStateReset(state, promptText) {
   state.memorySearchedBy = {};
   // learningsStored is session-scoped — once stored, it stays true until session reset.
   // Resetting per-prompt caused false blocks when PR creation was on a later prompt.
-  var DIRECTIVE_MAX_LEN = 20;
-  var escaped = /^@@\s*/.test(promptText || '');
-  state.memoryRequired = !escaped && (promptText || '').length >= 4 && (TASK_RE.test(promptText || '') || (promptText || '').length > DIRECTIVE_MAX_LEN);
+  // #1447 — arm by DEFAULT; exempt only prompts that carry no subject of their
+  // own. This replaces `TASK_RE.test(p) || p.length > 20`, whose length cliff
+  // was arbitrary and invisible: "now look at the daemon" (22) armed the gate
+  // and "check the daemon" (16) did not, which is most of why the gate felt
+  // like it fired at random. Memory-first is this project's first rule, so the
+  // default has to be "search", with continuations as the carve-out — not the
+  // reverse. The per-prompt latch bounds the cost at one search per new prompt.
+  //
+  // `opts.skipArming` splits the reset in two. Invalidating the credits above
+  // is prompt-INDEPENDENT and always correct; deciding whether this prompt
+  // needs a search is not, and a caller holding no prompt text must not decide
+  // it from nothing. Skipping the whole reset instead would be worse than
+  // either: `memorySearchedBy` would survive, and a stale per-actor credit from
+  // the previous prompt would satisfy the gate for a prompt it never saw.
+  if (!(opts && opts.skipArming)) {
+    var escaped = /^@@\s*/.test(promptText || '');
+    state.memoryRequired = !escaped && !isContinuationPrompt(promptText);
+  }
   // Stash namespace hint for check-before-agent to emit when Claude actually
   // spawns an Agent (#931). Empty string when nothing matched — overwriting
   // any stale value from the previous prompt.
@@ -1051,11 +1260,32 @@ function isPrCreateCommand(cmd) {
 // Fail-safe: any error (no classifier, no git, no merge-base) returns null,
 // which forces /simplify to run as today.
 function classifyForGateSkip(state) {
-  var classify;
+  var mod;
   try {
-    classify = require('./simplify-classify.cjs').classifyDiff;
+    mod = require('./simplify-classify.cjs');
   } catch (e) { return null; }
-  if (typeof classify !== 'function') return null;
+  var classify = mod && mod.classifyDiff;
+  var readUntracked = mod && mod.readUntrackedDiff;
+  // EXEC_MAX_BUFFER is checked alongside the functions because falling back to
+  // Node's 1 MiB default would silently reinstate the very cliff #1451 removed.
+  if (typeof classify !== 'function' || typeof readUntracked !== 'function'
+      || typeof mod.EXEC_MAX_BUFFER !== 'number') return null;
+
+  // Untracked files show up in no `git diff` output, so without them the gate
+  // could auto-pass a branch of brand-new unstaged files as TRIVIAL (#1451).
+  // Reading every one of them is real work, so it is deferred until a path is
+  // actually about to classify. Returns null if the read failed — the caller
+  // must then fall through and force /simplify rather than classify a partial
+  // diff.
+  var untrackedText = null;
+  function untrackedSuffix() {
+    if (untrackedText !== null) return untrackedText;
+    var u;
+    try { u = readUntracked(PROJECT_DIR); } catch (e) { return null; }
+    if (!u || u.unreadable) return null;
+    untrackedText = u.text ? '\n' + u.text : '';
+    return untrackedText;
+  }
 
   function tryClassify(diffText, label, allowSmallReviewFix) {
     try {
@@ -1079,11 +1309,16 @@ function classifyForGateSkip(state) {
     return null;
   }
 
+  // maxBuffer comes FROM the classifier (#1451) rather than being a matching
+  // literal here, so the gate and the skill cannot drift on which diffs are
+  // readable at all. Past it execFileSync throws ENOBUFS and gitDiff returns
+  // null — which every caller below must treat as "unknown", never "empty".
+  var maxBuffer = mod.EXEC_MAX_BUFFER;
   function gitDiff(args) {
     try {
       return cp.execFileSync('git', args, {
         cwd: PROJECT_DIR, encoding: 'utf-8', timeout: 5000, windowsHide: true,
-        stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 8 * 1024 * 1024
+        stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: maxBuffer
       });
     } catch (e) { return null; }
   }
@@ -1091,9 +1326,14 @@ function classifyForGateSkip(state) {
   // Snapshot path: classify everything since /simplify last ran.
   if (state.simplifySnapshotSha) {
     var snapDiff = gitDiff(['diff', state.simplifySnapshotSha + '...HEAD']);
-    var workTreeA = gitDiff(['diff', 'HEAD']) || '';
-    if (snapDiff !== null) {
-      var combined = snapDiff + (workTreeA ? '\n' + workTreeA : '');
+    var workTreeA = gitDiff(['diff', 'HEAD']);
+    // BOTH reads must succeed. Coalescing a failed working-tree read to '' is
+    // how an over-buffer working tree used to read as "no working-tree changes"
+    // and let the gate skip review (#1451).
+    if (snapDiff !== null && workTreeA !== null) {
+      var suffixA = untrackedSuffix();
+      if (suffixA === null) return null;
+      var combined = snapDiff + (workTreeA ? '\n' + workTreeA : '') + suffixA;
       // Snapshot path: allow SMALL review-fix shape because the original /simplify
       // already covered the surface and only tiny no-decl-touching tweaks followed.
       var hit = tryClassify(combined, 'delta since last /simplify', true);
@@ -1113,9 +1353,11 @@ function classifyForGateSkip(state) {
     } catch (e) { continue; }
     if (!base) continue;
     var branchDiff = gitDiff(['diff', base + '...HEAD']);
-    var workTreeB = gitDiff(['diff', 'HEAD']) || '';
-    if (branchDiff !== null) {
-      return tryClassify(branchDiff + (workTreeB ? '\n' + workTreeB : ''), 'branch diff');
+    var workTreeB = gitDiff(['diff', 'HEAD']);
+    if (branchDiff !== null && workTreeB !== null) {
+      var suffixB = untrackedSuffix();
+      if (suffixB === null) return null;
+      return tryClassify(branchDiff + (workTreeB ? '\n' + workTreeB : '') + suffixB, 'branch diff');
     }
     break;
   }
@@ -1454,7 +1696,12 @@ switch (command) {
     // → state read → memory gate.
     if (!config.memory_first) break;
     if (!READ_LIKE_BASH_RE.test(cmd)) break;
-    if (BASH_CARVE_OUT_RE.test(cmd)) break;
+    // #1445 — the carve-out is anchored to the LEADING command, so its `node`
+    // and `git` arms swallow every shape RUNNER_READ_SOURCES exists to catch.
+    // Those shapes earn their read classification from what follows the leading
+    // token, so they override the carve-out; every other command keeps #1132's
+    // semantics exactly (`npm test | grep FAIL`, `git diff`, `node build.mjs`).
+    if (BASH_CARVE_OUT_RE.test(cmd) && !RUNNER_READ_BASH_RE.test(cmd)) break;
     var s2 = readState();
     if (!s2.memoryRequired || isMemorySearchedFor(s2)) break;
     // Hint precedence: prompt-derived classification (set by applyPromptStateReset
@@ -1965,7 +2212,7 @@ switch (command) {
     var raw = process.env.TOOL_INPUT_command || '';
     var cmd = stripQuotedAndHeredocs(raw).toLowerCase();
     for (var i = 0; i < DANGEROUS.length; i++) {
-      if (cmd.indexOf(DANGEROUS[i]) >= 0) {
+      if (matchesDangerous(cmd, DANGEROUS[i])) {
         console.log('[BLOCKED] Dangerous command: ' + DANGEROUS[i]);
         process.exit(2);
       }
@@ -2037,10 +2284,22 @@ switch (command) {
     // already wrote the byte-identical post-reset state. Only writeState when
     // the reset actually changed something (i.e., prompt-reminder was skipped
     // because prompt-hook.mjs threw before invoking it).
-    var s = readState();
     var prompt = process.env.CLAUDE_USER_PROMPT || '';
+    // #1447 — a safety net that cannot see the prompt must do NOTHING, not
+    // decide. This bridge did not forward `prompt` until #1447, so this hook
+    // classified the empty string on every prompt, concluded "no memory
+    // required", and wrote that over the correct value prompt-reminder had just
+    // computed — disarming the memory gate it exists to protect, intermittently,
+    // depending on which UserPromptSubmit hook wrote last. The forwarding fix
+    // addresses the cause; this guard makes the failure mode survivable if the
+    // field ever goes missing again (a host that omits it, a payload change):
+    // still invalidate the credits — that is this hook's whole reason to exist
+    // and needs no prompt — but leave the arming verdict to prompt-reminder,
+    // which has the text. Deciding "not required" from a prompt it cannot see
+    // is exactly the bug.
+    var s = readState();
     var before = JSON.stringify(s);
-    applyPromptStateReset(s, prompt);
+    applyPromptStateReset(s, prompt, { skipArming: !prompt });
     if (JSON.stringify(s) !== before) writeState(s);
     break;
   }

package/bin/lib/internal-skills.mjs

@@ -2,8 +2,10 @@
  * Skills that ship in the npm tarball (under `node_modules/moflo/.claude/skills/`)
  * but must NEVER be installed into consumer projects — strictly moflo-internal
  * dev tooling. `/publish` bumps moflo's own version and publishes to npm;
- * `/reset-epic` torches epic test data. Both are meaningless or harmful in a
- * consumer repo.
+ * `/reset-epic` torches epic test data; `/flfl` runs `/fl` preloaded with the
+ * rules that govern developing MOFLO (cross-platform, consumer blast radius,
+ * dogfooding), which are not constraints on a consumer's own project. All three
+ * are meaningless, noisy, or harmful in a consumer repo.
  *
  * The session-start launcher's recursive skills sync (`syncDirRecursive` in
  * `file-sync.mjs`) copies every shipped skill into the consumer on each run, so
@@ -13,4 +15,4 @@
  * so this leaf mirrors it. `tests/bin/internal-skills-parity.test.ts` asserts
  * the two lists never drift.
  */
-export const INTERNAL_SKILLS = ['publish', 'reset-epic'];
+export const INTERNAL_SKILLS = ['publish', 'reset-epic', 'flfl'];

package/bin/lib/session-continuity.mjs

@@ -206,6 +206,115 @@ export function hasPrivateOptOut(text) {
   return typeof text === 'string' && /<private>/i.test(text);
 }
 
+// ── Session goal extraction (pure) ──────────────────────────────────────────
+
+/**
+ * Claude Code stamps `isMeta: true` on user-role transcript entries it injected
+ * itself rather than ones the human typed — expanded skill preambles, the
+ * local-command caveat, "skill is already loaded" notes. An audit of every
+ * transcript on a dogfooding box found this marker on boilerplate ONLY, never on
+ * a real goal, which makes it the structural signal to filter on. The literal
+ * prefixes below are belt-and-braces for a Claude Code build that stops emitting
+ * the flag — a missing `isMeta` must not silently restore the #1452 bug.
+ */
+const BOILERPLATE_OPENERS = [
+  /^Base directory for this skill:/i,
+  /^Skill \S+ is already loaded/i,
+  /^Caveat: The messages below were generated by the user/i,
+  /^\[Request interrupted by user/i,
+  /^This session is being continued from a previous conversation/i,
+];
+
+/** Slash commands that steer the SESSION rather than state a goal. `/clear` is
+ *  the near-universal opener in an agent-driven repo, so returning it as the
+ *  Goal would reintroduce the same "boilerplate as intent" failure. */
+const SESSION_CONTROL_COMMANDS = new Set(['clear', 'compact', 'resume', 'exit', 'quit', 'login', 'logout', 'help']);
+
+const COMMAND_NAME_RE = /<command-name>\s*\/?\s*([\w:.-]+)\s*<\/command-name>/i;
+const COMMAND_ARGS_RE = /<command-args>([\s\S]*?)<\/command-args>/i;
+const BARE_COMMAND_RE = /^\/([\w:.-]+)(?:\s+([\s\S]*))?$/;
+
+/**
+ * Render a slash-command invocation as a goal string, e.g. `/flo 1452`.
+ *
+ * Claude Code writes the invocation two ways: an XML envelope
+ * (`<command-name>/flo</command-name><command-args>1452</command-args>`) and,
+ * for some built-ins, the bare text the user typed (`/compact`). Both are
+ * handled — the ARGUMENTS carry the actual intent (the issue number), which is
+ * exactly what the old filter threw away.
+ *
+ * `name` is lower-cased for the session-control lookup only; `goal` preserves
+ * the case the user actually typed, since it is a record of their invocation.
+ *
+ * Text after the closing `</command-args>` tag is intentionally dropped — the
+ * command plus its arguments IS the goal, and the surrounding envelope carries
+ * a `<command-message>` label that is never part of the ask.
+ *
+ * @param {string} flat - message content flattened to a single line
+ * @returns {{ name: string, goal: string } | null} null if not a slash command
+ */
+function parseSlashCommand(flat) {
+  let name = null;
+  let args = '';
+  const envelope = COMMAND_NAME_RE.exec(flat);
+  if (envelope) {
+    name = envelope[1];
+    const a = COMMAND_ARGS_RE.exec(flat);
+    args = a ? a[1].trim() : '';
+  } else if (!flat.startsWith('<')) {
+    const bare = BARE_COMMAND_RE.exec(flat);
+    if (!bare) return null;
+    name = bare[1];
+    args = (bare[2] || '').trim();
+  }
+  if (!name) return null;
+  return { name: name.toLowerCase(), goal: args ? `/${name} ${args}` : `/${name}` };
+}
+
+/**
+ * First user message that actually states a goal, from a transcript JSONL head.
+ *
+ * Returns `null` rather than a boilerplate string when nothing qualifies: this
+ * value is re-injected at SessionStart after a compaction, to a model that has
+ * just lost its context and cannot tell a junk Goal from a real one. An absent
+ * Goal is strictly better than a misleading one. See issue #1452.
+ *
+ * @param {string} headText - raw JSONL text from the head of the transcript
+ * @returns {string|null} goal (≤200 chars), or null if none was stated
+ */
+export function extractFirstUserGoal(headText) {
+  if (typeof headText !== 'string') return null;
+  for (const line of headText.split('\n')) {
+    const t = line.trim();
+    if (!t) continue;
+    let obj;
+    try { obj = JSON.parse(t); } catch { continue; }
+    const role = obj?.message?.role ?? obj?.role;
+    if (role !== 'user') continue;
+    // Injected by Claude Code, not typed by the human — never a goal.
+    if (obj?.isMeta === true) continue;
+    let content = obj?.message?.content ?? obj?.content;
+    if (Array.isArray(content)) {
+      content = content.map((b) => (typeof b === 'string' ? b : b?.text || '')).join(' ');
+    }
+    if (typeof content !== 'string') continue;
+    const flat = content.replace(/\s+/g, ' ').trim();
+    if (!flat) continue;
+
+    const command = parseSlashCommand(flat);
+    if (command) {
+      // `/clear`, `/compact` — session plumbing; keep scanning for the real ask.
+      if (SESSION_CONTROL_COMMANDS.has(command.name)) continue;
+      return command.goal.slice(0, 200);
+    }
+    // Other hook/tool XML noise (`<system-reminder>`, `<task-notification>`, …).
+    if (flat.startsWith('<')) continue;
+    if (BOILERPLATE_OPENERS.some((re) => re.test(flat))) continue;
+    return flat.slice(0, 200);
+  }
+  return null;
+}
+
 // ── Digest assembly (pure) ──────────────────────────────────────────────────
 
 /** statSync mtime that never throws (file may vanish between readdir and stat). */

package/bin/session-continuity.mjs

@@ -35,6 +35,7 @@ import {
   readContinuityConfig,
   readGitState,
   hasPrivateOptOut,
+  extractFirstUserGoal,
   assembleDigestContent,
   buildDigestMetadata,
   writeDigest,
@@ -48,28 +49,6 @@ function warn(msg) {
   try { process.stderr.write(`moflo: session-continuity ${msg}\n`); } catch { /* never throw from a hook */ }
 }
 
-/** First user message (the session goal) from a transcript JSONL head. */
-function extractFirstUserGoal(headText) {
-  for (const line of headText.split('\n')) {
-    const t = line.trim();
-    if (!t) continue;
-    let obj;
-    try { obj = JSON.parse(t); } catch { continue; }
-    const role = obj?.message?.role ?? obj?.role;
-    if (role !== 'user') continue;
-    let content = obj?.message?.content ?? obj?.content;
-    if (Array.isArray(content)) {
-      content = content.map((b) => (typeof b === 'string' ? b : b?.text || '')).join(' ');
-    }
-    if (typeof content !== 'string') continue;
-    const firstLine = content.replace(/\s+/g, ' ').trim();
-    // Skip slash-command / hook-noise openers — they aren't a goal statement.
-    if (!firstLine || firstLine.startsWith('<')) continue;
-    return firstLine.slice(0, 200);
-  }
-  return null;
-}
-
 /** Bounded transcript read: goal from the head, `<private>` opt-out scan over
  *  head+tail. Large transcripts are read at the edges only. */
 function readTranscriptInfo(path) {