moflo 4.12.8 → 4.12.9

package/.claude/helpers/gate-hook.mjs

@@ -41,6 +41,22 @@ if (typeof hookContext.session_id === 'string' && hookContext.session_id) {
 if (typeof hookContext.transcript_path === 'string' && hookContext.transcript_path) {
   env.HOOK_TRANSCRIPT_PATH = hookContext.transcript_path;
 }
+// #1447 — forward the user prompt. `gate.cjs` reads CLAUDE_USER_PROMPT to decide
+// whether a prompt needs a memory search, and this bridge never set it, so the
+// `prompt-state-reset` safety-net hook classified the EMPTY STRING on every
+// prompt, concluded "no memory required", and wrote that over the correct value
+// prompt-hook.mjs had just computed. A safety net that disarmed the gate it
+// exists to protect — intermittently, since the surviving value depended on
+// which of the two UserPromptSubmit hooks wrote last.
+//
+// Same field precedence as prompt-hook.mjs (`user_prompt` then `prompt`) so both
+// UserPromptSubmit paths classify identical text and the reset is genuinely
+// idempotent, which is the only thing that makes a safety-net hook safe.
+if (typeof hookContext.user_prompt === 'string' && hookContext.user_prompt) {
+  env.CLAUDE_USER_PROMPT = hookContext.user_prompt;
+} else if (typeof hookContext.prompt === 'string' && hookContext.prompt) {
+  env.CLAUDE_USER_PROMPT = hookContext.prompt;
+}
 // #1332: structured tool inputs are forwarded as JSON, not dropped.
 //
 // This previously forwarded ONLY string values, so any object-valued input was

package/.claude/helpers/gate.cjs

@@ -395,6 +395,60 @@ function bashCoordinationInit(rawCmd) {
   }
   return null;
 }
+// #1445 — read shapes whose LEADING command is one BASH_CARVE_OUT_RE carves out
+// wholesale (`node …`, `git …`). They are read-like because of what FOLLOWS the
+// leading token, so anchoring on that token alone can never see them: in one
+// real session 539 file-exploration calls went through `node -e` + readFileSync
+// and `git show <ref>:<path>` with the gate blind to every one of them. That is
+// the dominant exploration shape in repos whose own guidance steers away from
+// `grep` (e.g. where `grep` is `ugrep` and silently skips files, so any
+// inventory a decision rests on must go through `fs.readFileSync`).
+//
+// These sources are spliced into READ_LIKE_BASH_RE below AND kept addressable
+// on their own, because check-bash-memory has to let them override the
+// carve-out — extending READ_LIKE alone would change nothing, the `^\s*(node|
+// git)\s` carve-out arms swallow them one line later.
+var RUNNER_READ_SOURCES = [
+  // `node -e "...readFileSync(...)..."`, in every eval spelling (-e/--eval/-p/
+  // --print/--input-type=module -e). The eval FLAG is deliberately not required:
+  // a script-file invocation (`node scripts/build.mjs`) does not carry a read
+  // call in its command line, so the read call itself is the reliable signal and
+  // demanding the flag only adds spellings to miss.
+  //
+  // The negative lookahead is load-bearing, not caution: Rule #1 tells authors
+  // to do cross-platform file OPS through `node -e` with fs (`mkdir`/`rm`/`cp`
+  // do not exist on Windows), and a read-modify-write is an operation, not
+  // exploration. Only fs MUTATION calls carve out — matching a bare `write`
+  // would carve out `process.stdout.write`, which nearly every inline read
+  // script ends with, and that would hand back the whole gap.
+  //
+  // Every mutation name covers its sync, callback AND promise spelling: authors
+  // reach for `fs.promises.rm` as readily as `rmSync`, and listing only the
+  // `*Sync` form would block the delete op Rule #1 sent them to `node -e` for.
+  // `rm`/`rmdir`/`cp` carry `\b` because they are short enough to appear inside
+  // unrelated words — an unanchored `rm` matches "format" and "transform", and
+  // would carve out most of what this arm exists to catch.
+  '^\\s*(?:node|nodejs)(?:\\.(?:exe|cmd))?\\s'
+    + '(?=[\\s\\S]*(?:read(?:File|dir)|globSync))'
+    + '(?![\\s\\S]*(?:writeFile|appendFile|mkdir|mkdtemp|unlink|copyFile|rename'
+    + '|symlink|createWriteStream|\\brm(?:dir)?(?:Sync)?\\b|\\bcp(?:Sync)?\\b))',
+  // `git show <ref>:<path>` / `git cat-file -p <ref>:<path>` — the colon form
+  // reads a blob and is `cat` by another name. Leading `-`-prefixed tokens are
+  // consumed as flags first so `--pretty=format:%h` (a colon inside a FLAG)
+  // cannot masquerade as a ref:path, and the segment after the colon must carry
+  // a path character — same false-negative trade as the `type \S*[\\/.]` arm
+  // above (`git show HEAD:src`, a bare directory, passes; source files all have
+  // extensions). Bare `git show`, `git show --stat`, `git log` and `git diff`
+  // have no ref:path token and stay operational.
+  '^\\s*git\\s+(?:show|cat-file)\\s+(?:-{1,2}\\S+\\s+)*[^-\\s]\\S*:\\S*[\\\\/.]',
+  // Repo-wide content search and file inventory — the `git` spellings of
+  // `grep -r` and `find`. NOT `git log --grep`, which searches commit messages,
+  // is already in the passing set, and does not match `git\s+grep`.
+  '^\\s*git\\s+(?:grep|ls-files)\\b',
+];
+// Same sources as their own matcher — check-bash-memory tests this to let a
+// carved-out leading command still block when the rest of the command is a read.
+var RUNNER_READ_BASH_RE = new RegExp(RUNNER_READ_SOURCES.join('|'), 'i');
 // BLOCK: read-like Bash commands that bypass the existing check-before-read /
 // check-before-scan gates by going through the shell. Anchored to the start of
 // the line so subcommands inside pipelines or `npm install grep` don't trip.
@@ -427,7 +481,7 @@ var READ_LIKE_BASH_RE = new RegExp([
   '^\\s*dir\\b[^|]*\\s\\/[sS]\\b',
   // #1171 — PowerShell hex dump, parallel to POSIX `xxd`/`hexdump`.
   '^\\s*Format-Hex\\b',
-].join('|'), 'i');
+].concat(RUNNER_READ_SOURCES).join('|'), 'i');
 // CARVE-OUT: commands that LOOK read-like but are operational. Anchored to the
 // LEADING command — the pipe-filter case (`npm test | grep FAIL`) is already
 // handled by READ_LIKE's `^\s*` anchor never matching the leading `npm`, so
@@ -474,8 +528,73 @@ function stripQuotedAndHeredocs(cmd) {
   return out;
 }
 
-var DIRECTIVE_RE = /^(yes|no|yeah|yep|nope|sure|ok|okay|correct|right|exactly|perfect)\b/i;
-var TASK_RE = /\b(fix|bug|error|implement|add|create|build|write|refactor|debug|test|feature|issue|security|optimi)\b/i;
+// #1447 — words that carry no subject to search FOR: assent, acknowledgement,
+// "keep going", and conversational filler. A prompt built ONLY from these
+// continues work already under way, so the memory gate stays down; anything
+// that survives the strip is a subject, and the gate arms.
+//
+// Supersedes two things. `DIRECTIVE_RE` — a `^(yes|ok|sure|…)` prefix test that
+// had already been dead code for some time, unreferenced by the reset it was
+// written for. And the live rule, `TASK_RE.test(p) || p.length > 20`, whose
+// real work was skipping short replies: every prompt of 20 characters or fewer
+// without a task word was exempt. That caught trivia ("hmm", "got it") and
+// equally caught "check the daemon" — a genuine topic change — which is the
+// half this replaces. The list below has to carry the trivia half on its own,
+// so it covers considerably more ground than DIRECTIVE_RE ever did.
+//
+// Matching by SUBTRACTION, not by a leading-token test, is what lets
+// "yes, now fix the daemon" arm while "yes" does not — a `^(yes|ok)\b` test
+// sees the same first word in both. It is also why the list can safely hold
+// ordinary words like `do`/`it`/`work`/`the`: a word only exempts a prompt when
+// NOTHING else in that prompt survives, so each addition costs precision only
+// for prompts made entirely of listed words. Deliberately absent for that
+// reason: task words (`fix`, `test`, `build`) and any noun.
+var CONTINUATION_WORD_RE = new RegExp('\\b(?:' + [
+  // Assent / dissent / acknowledgement
+  'yes', 'yeah', 'yep', 'yup', 'no', 'nope', 'sure', 'ok', 'okay', 'k',
+  'correct', 'right', 'exactly', 'perfect', 'agreed', 'true', 'indeed',
+  'understood', 'gotcha', 'got', 'makes', 'sense', 'fine', 'alright',
+  // Continuation / assent to proceed
+  'continue', 'proceed', 'carry', 'keep', 'going', 'go', 'ahead', 'on', 'next',
+  'again', 'more', 'rest', 'both', 'all', 'them', 'those',
+  // Politeness and praise
+  'please', 'thanks', 'thank', 'ty', 'great', 'nice', 'cool', 'good', 'awesome',
+  'excellent', 'sounds', 'lgtm', 'love', 'well', 'work', 'job', 'wow', 'yay',
+  // Conversational filler / hesitation / greetings
+  'hmm', 'hm', 'huh', 'ah', 'oh', 'ha', 'haha', 'lol', 'wait', 'hold', 'hang',
+  'actually', 'anyway', 'whatever', 'nvm', 'nevermind', 'sorry', 'oops',
+  'hi', 'hello', 'hey', 'stop', 'pause', 'never', 'mind',
+  'think', 'know', 'see', 'guess', 'suppose', 'maybe', 'probably',
+  // Function words with no subject of their own
+  'do', 'it', 'that', 'this', 'the', 'a', 'an', 'and', 'is', 'are', 'was',
+  'you', 'your', 'i', 'we', 'lets', 'let', 'us', 'me', 'my', 'now', 'then',
+  'done', 'finish', 'finished', 'ready', 'too', 'also', 'just', 'still',
+].join('|') + ')\\b', 'gi');
+/**
+ * Does this prompt consist of nothing but continuation filler?
+ *
+ * An EMPTY prompt answers true — a prompt the gate cannot see is not evidence
+ * that a search is needed, and arming on it would block every read in a
+ * consumer whose host omits the field, with nothing on screen explaining why.
+ * Fail-open here; `prompt-state-reset` separately refuses to WRITE a verdict it
+ * derived from an empty prompt (#1447), so an unreadable prompt now leaves the
+ * gate exactly as prompt-reminder set it rather than silently disarming it.
+ */
+function isContinuationPrompt(promptText) {
+  var t = (promptText || '').trim();
+  if (!t) return true;
+  // Subtract continuation words, then every non-alphanumeric character. What
+  // remains is the prompt's actual subject matter; nothing remaining means the
+  // prompt introduced no new subject.
+  // `\p{L}\p{N}` with /u, NOT `A-Za-z0-9`: an ASCII-only class strips every
+  // character of a CJK, Cyrillic, Arabic, Hebrew, Greek or Thai prompt — and
+  // most of an accented French or Spanish one — leaving nothing, so a
+  // substantive non-English request would score as pure filler and silently
+  // disarm the gate. Stripping only what is neither letter nor number keeps
+  // every script's content intact and removes just punctuation and spacing.
+  var rest = t.replace(CONTINUATION_WORD_RE, ' ').replace(/[^\p{L}\p{N}]+/gu, ' ').trim();
+  return rest.length === 0;
+}
 
 // Namespace classification (#931). The hint used to be emitted on every prompt
 // by prompt-hook.mjs which cost ~40 tokens × every prompt × every consumer.
@@ -510,7 +629,9 @@ var NS_NAV_RES = [
 // explicitly opted in to the protected coordination surface, so falling back to
 // raw Agent dispatch silently regresses headline moflo product capability.
 //
-// SYNC: duplicated verbatim in src/cli/init/helpers-generator.ts.
+// This file is the single source; #1443 replaced helpers-generator.ts's
+// hand-maintained copy with a build-time embed of this exact file, so there is
+// no longer a second copy of this function to keep in step.
 function detectFlMode(promptText) {
   var p = promptText || '';
   if (!/^\s*\/(?:fl|flo)\b/i.test(p)) return null;
@@ -653,10 +774,14 @@ function classifyNamespaceHint(promptText) {
 // full sentence in the same shape as classifyNamespaceHint so the BLOCK arm
 // can write either source's hint without branching on format.
 //
-// SYNC: duplicated verbatim in src/cli/init/helpers-generator.ts.
+// This file is the single source — see the note on detectFlMode above (#1443).
 function classifyBashNamespaceHint(cmd) {
   // Search-like tools — the user is hunting for a symbol/file, code-map wins.
-  if (/^\s*(?:grep|rg|ag|fgrep|egrep|find|fd|Select-String|sls)\b/i.test(cmd)) {
+  // #1445 — `git grep` / `git ls-files` are the same hunt through a different
+  // binary, so they route to the same namespace rather than falling through to
+  // the hintless generic message.
+  if (/^\s*(?:grep|rg|ag|fgrep|egrep|find|fd|Select-String|sls)\b/i.test(cmd)
+   || /^\s*git\s+(?:grep|ls-files)\b/i.test(cmd)) {
     return 'Memory namespace hint: use "code-map" for codebase navigation.';
   }
   // Reading a .md / RST / TXT, or a well-known doc file — guidance/learnings win.
@@ -674,7 +799,7 @@ function classifyBashNamespaceHint(cmd) {
 // UserPromptSubmit hooks can run it without compounding any field. Caller
 // owns interactionCount and the user-visible REMINDER/Context emissions, so
 // this helper stays silent.
-function applyPromptStateReset(state, promptText) {
+function applyPromptStateReset(state, promptText, opts) {
   // #352/#1331 — this is the ONLY place the memory gate resets. Deliberately
   // NOT on task transitions: within a single prompt (e.g. a /flo workflow)
   // memory stays searched so Read/Grep aren't blocked mid-execution. A
@@ -688,9 +813,24 @@ function applyPromptStateReset(state, promptText) {
   state.memorySearchedBy = {};
   // learningsStored is session-scoped — once stored, it stays true until session reset.
   // Resetting per-prompt caused false blocks when PR creation was on a later prompt.
-  var DIRECTIVE_MAX_LEN = 20;
-  var escaped = /^@@\s*/.test(promptText || '');
-  state.memoryRequired = !escaped && (promptText || '').length >= 4 && (TASK_RE.test(promptText || '') || (promptText || '').length > DIRECTIVE_MAX_LEN);
+  // #1447 — arm by DEFAULT; exempt only prompts that carry no subject of their
+  // own. This replaces `TASK_RE.test(p) || p.length > 20`, whose length cliff
+  // was arbitrary and invisible: "now look at the daemon" (22) armed the gate
+  // and "check the daemon" (16) did not, which is most of why the gate felt
+  // like it fired at random. Memory-first is this project's first rule, so the
+  // default has to be "search", with continuations as the carve-out — not the
+  // reverse. The per-prompt latch bounds the cost at one search per new prompt.
+  //
+  // `opts.skipArming` splits the reset in two. Invalidating the credits above
+  // is prompt-INDEPENDENT and always correct; deciding whether this prompt
+  // needs a search is not, and a caller holding no prompt text must not decide
+  // it from nothing. Skipping the whole reset instead would be worse than
+  // either: `memorySearchedBy` would survive, and a stale per-actor credit from
+  // the previous prompt would satisfy the gate for a prompt it never saw.
+  if (!(opts && opts.skipArming)) {
+    var escaped = /^@@\s*/.test(promptText || '');
+    state.memoryRequired = !escaped && !isContinuationPrompt(promptText);
+  }
   // Stash namespace hint for check-before-agent to emit when Claude actually
   // spawns an Agent (#931). Empty string when nothing matched — overwriting
   // any stale value from the previous prompt.
@@ -1454,7 +1594,12 @@ switch (command) {
     // → state read → memory gate.
     if (!config.memory_first) break;
     if (!READ_LIKE_BASH_RE.test(cmd)) break;
-    if (BASH_CARVE_OUT_RE.test(cmd)) break;
+    // #1445 — the carve-out is anchored to the LEADING command, so its `node`
+    // and `git` arms swallow every shape RUNNER_READ_SOURCES exists to catch.
+    // Those shapes earn their read classification from what follows the leading
+    // token, so they override the carve-out; every other command keeps #1132's
+    // semantics exactly (`npm test | grep FAIL`, `git diff`, `node build.mjs`).
+    if (BASH_CARVE_OUT_RE.test(cmd) && !RUNNER_READ_BASH_RE.test(cmd)) break;
     var s2 = readState();
     if (!s2.memoryRequired || isMemorySearchedFor(s2)) break;
     // Hint precedence: prompt-derived classification (set by applyPromptStateReset
@@ -2037,10 +2182,22 @@ switch (command) {
     // already wrote the byte-identical post-reset state. Only writeState when
     // the reset actually changed something (i.e., prompt-reminder was skipped
     // because prompt-hook.mjs threw before invoking it).
-    var s = readState();
     var prompt = process.env.CLAUDE_USER_PROMPT || '';
+    // #1447 — a safety net that cannot see the prompt must do NOTHING, not
+    // decide. This bridge did not forward `prompt` until #1447, so this hook
+    // classified the empty string on every prompt, concluded "no memory
+    // required", and wrote that over the correct value prompt-reminder had just
+    // computed — disarming the memory gate it exists to protect, intermittently,
+    // depending on which UserPromptSubmit hook wrote last. The forwarding fix
+    // addresses the cause; this guard makes the failure mode survivable if the
+    // field ever goes missing again (a host that omits it, a payload change):
+    // still invalidate the credits — that is this hook's whole reason to exist
+    // and needs no prompt — but leave the arming verdict to prompt-reminder,
+    // which has the text. Deciding "not required" from a prompt it cannot see
+    // is exactly the bug.
+    var s = readState();
     var before = JSON.stringify(s);
-    applyPromptStateReset(s, prompt);
+    applyPromptStateReset(s, prompt, { skipArming: !prompt });
     if (JSON.stringify(s) !== before) writeState(s);
     break;
   }

package/.claude/skills/flfl/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: flfl
+description: Run /fl on a ticket with moflo's three standing considerations loaded first — cross-platform (Rule #1), consumer blast radius, and dogfooding. Use in the moflo repo itself instead of bare /fl. moflo-internal; never installed into consumer projects.
+arguments: "[options] <issue-number | title>"
+---
+
+```text
+$ARGUMENTS
+```
+
+# /flfl — /fl with moflo's standing considerations loaded first
+
+Purpose: run the normal `/fl` ticket workflow, but seat the three things that break moflo changes **before** any research, code, or review happens — not after a reviewer catches them.
+
+These are not a preamble to acknowledge and move past. Hold all three for the **whole** run: research, implementation, tests, `/flo-simplify`, `/verify`, and the PR body.
+
+## The three considerations
+
+| # | Consideration | What it changes about the work you are about to do |
+|---|---------------|----------------------------------------------------|
+| 1 | **Rule #1 — everything ships cross-platform** | Linux, macOS **and** Windows, identically. Audit every edit for: `path.join`/`path.sep` over hardcoded separators; `fs.realpathSync` on **both** sides of any path comparison; no `Foo.ts` beside `foo.ts`; platform EOL; no `bash`/`grep`/`sed`/`cat`/`find` shell-outs (use Node `fs`/`spawn`); `tasklist` vs `/proc` for process checks; `shell: true` on Windows vs `detached` on POSIX when spawning; `os.tmpdir()` and test ports in 40000–44999. Verify against CI's macOS **and** Ubuntu runs, not just your own OS. |
+| 2 | **moflo is installed into a destination project** | This is a library, not an app. Before writing code, name (a) the **consumer surface** touched — `bin/`, `src/cli/`, `.claude/scripts/`, hooks, `init/`, settings/CLAUDE.md generators, anything synced into `node_modules/moflo/`; (b) the **failure mode** for someone already on the current version who upgrades — does their `.moflo/` state still parse, do their hooks still wire, is a migration needed; (c) the **round-trip cost** — does this need publish-then-reinstall to take effect. If you cannot name all three, re-scope before writing code. |
+| 3 | **moflo dogfoods itself** | The daemon, hooks, statusline, MCP server and indexer all run from `node_modules/moflo/…`, **not** the source tree. A source edit changes nothing for those layers until publish + reinstall + Claude Code restart. Before diagnosing any "X is broken" symptom, establish **which copy is actually running** — diff `bin/` against `.claude/` against `node_modules/moflo/` first. Expect local flapping: the session-start launcher re-syncs `.claude/helpers/` from the **installed** package, so a local fix to a synced file reverts until published. |
+
+## How to run
+
+1. Restate the three considerations in one line each, mapped to **this specific ticket** — which surface it touches, which platform risks it carries, whether it needs a publish round-trip. Generic restatement is worthless; if a consideration genuinely does not apply, say so and why.
+2. Invoke the real workflow with the arguments above, unchanged and in full — including every flag (`-sd`, `-s`, `-w`, `-m`, …):
+
+   ```
+   Skill({ skill: "fl", args: "<the $ARGUMENTS block above, verbatim>" })
+   ```
+
+3. Follow `/fl` from there. `/flfl` adds nothing to the workflow itself — same phases, same gates, same run-mode resolution. Re-check the three at each gate: they most often fail at `/flo-simplify` (a cross-platform miss) and at the PR body (an unnamed consumer failure mode).
+
+## Anti-patterns
+
+| Don't | Do |
+|-------|-----|
+| Acknowledge the three, then run `/fl` and never revisit them | Re-check them at implementation, simplify, and PR |
+| Restate them verbatim from this file | Map each to the ticket's actual surface and risk |
+| Drop or reorder `$ARGUMENTS` when calling `/fl` | Pass the argument string through untouched |
+| Verify only on your own OS | Read the macOS and Ubuntu CI runs before claiming green |
+| Debug a runtime symptom against the source tree | Confirm which copy is running first |
+
+## See Also
+
+- `.claude/skills/fl/SKILL.md` — the workflow this wraps
+- `CLAUDE.md` — Rule #1, Rule #2, and the dogfooding section these three condense
+- `.claude/guidance/internal/dogfooding.md` — required reading before diagnosing runtime symptoms or adding files under `bin/`

package/bin/gate-hook.mjs

@@ -41,6 +41,22 @@ if (typeof hookContext.session_id === 'string' && hookContext.session_id) {
 if (typeof hookContext.transcript_path === 'string' && hookContext.transcript_path) {
   env.HOOK_TRANSCRIPT_PATH = hookContext.transcript_path;
 }
+// #1447 — forward the user prompt. `gate.cjs` reads CLAUDE_USER_PROMPT to decide
+// whether a prompt needs a memory search, and this bridge never set it, so the
+// `prompt-state-reset` safety-net hook classified the EMPTY STRING on every
+// prompt, concluded "no memory required", and wrote that over the correct value
+// prompt-hook.mjs had just computed. A safety net that disarmed the gate it
+// exists to protect — intermittently, since the surviving value depended on
+// which of the two UserPromptSubmit hooks wrote last.
+//
+// Same field precedence as prompt-hook.mjs (`user_prompt` then `prompt`) so both
+// UserPromptSubmit paths classify identical text and the reset is genuinely
+// idempotent, which is the only thing that makes a safety-net hook safe.
+if (typeof hookContext.user_prompt === 'string' && hookContext.user_prompt) {
+  env.CLAUDE_USER_PROMPT = hookContext.user_prompt;
+} else if (typeof hookContext.prompt === 'string' && hookContext.prompt) {
+  env.CLAUDE_USER_PROMPT = hookContext.prompt;
+}
 // #1332: structured tool inputs are forwarded as JSON, not dropped.
 //
 // This previously forwarded ONLY string values, so any object-valued input was

package/bin/gate.cjs

@@ -395,6 +395,60 @@ function bashCoordinationInit(rawCmd) {
   }
   return null;
 }
+// #1445 — read shapes whose LEADING command is one BASH_CARVE_OUT_RE carves out
+// wholesale (`node …`, `git …`). They are read-like because of what FOLLOWS the
+// leading token, so anchoring on that token alone can never see them: in one
+// real session 539 file-exploration calls went through `node -e` + readFileSync
+// and `git show <ref>:<path>` with the gate blind to every one of them. That is
+// the dominant exploration shape in repos whose own guidance steers away from
+// `grep` (e.g. where `grep` is `ugrep` and silently skips files, so any
+// inventory a decision rests on must go through `fs.readFileSync`).
+//
+// These sources are spliced into READ_LIKE_BASH_RE below AND kept addressable
+// on their own, because check-bash-memory has to let them override the
+// carve-out — extending READ_LIKE alone would change nothing, the `^\s*(node|
+// git)\s` carve-out arms swallow them one line later.
+var RUNNER_READ_SOURCES = [
+  // `node -e "...readFileSync(...)..."`, in every eval spelling (-e/--eval/-p/
+  // --print/--input-type=module -e). The eval FLAG is deliberately not required:
+  // a script-file invocation (`node scripts/build.mjs`) does not carry a read
+  // call in its command line, so the read call itself is the reliable signal and
+  // demanding the flag only adds spellings to miss.
+  //
+  // The negative lookahead is load-bearing, not caution: Rule #1 tells authors
+  // to do cross-platform file OPS through `node -e` with fs (`mkdir`/`rm`/`cp`
+  // do not exist on Windows), and a read-modify-write is an operation, not
+  // exploration. Only fs MUTATION calls carve out — matching a bare `write`
+  // would carve out `process.stdout.write`, which nearly every inline read
+  // script ends with, and that would hand back the whole gap.
+  //
+  // Every mutation name covers its sync, callback AND promise spelling: authors
+  // reach for `fs.promises.rm` as readily as `rmSync`, and listing only the
+  // `*Sync` form would block the delete op Rule #1 sent them to `node -e` for.
+  // `rm`/`rmdir`/`cp` carry `\b` because they are short enough to appear inside
+  // unrelated words — an unanchored `rm` matches "format" and "transform", and
+  // would carve out most of what this arm exists to catch.
+  '^\\s*(?:node|nodejs)(?:\\.(?:exe|cmd))?\\s'
+    + '(?=[\\s\\S]*(?:read(?:File|dir)|globSync))'
+    + '(?![\\s\\S]*(?:writeFile|appendFile|mkdir|mkdtemp|unlink|copyFile|rename'
+    + '|symlink|createWriteStream|\\brm(?:dir)?(?:Sync)?\\b|\\bcp(?:Sync)?\\b))',
+  // `git show <ref>:<path>` / `git cat-file -p <ref>:<path>` — the colon form
+  // reads a blob and is `cat` by another name. Leading `-`-prefixed tokens are
+  // consumed as flags first so `--pretty=format:%h` (a colon inside a FLAG)
+  // cannot masquerade as a ref:path, and the segment after the colon must carry
+  // a path character — same false-negative trade as the `type \S*[\\/.]` arm
+  // above (`git show HEAD:src`, a bare directory, passes; source files all have
+  // extensions). Bare `git show`, `git show --stat`, `git log` and `git diff`
+  // have no ref:path token and stay operational.
+  '^\\s*git\\s+(?:show|cat-file)\\s+(?:-{1,2}\\S+\\s+)*[^-\\s]\\S*:\\S*[\\\\/.]',
+  // Repo-wide content search and file inventory — the `git` spellings of
+  // `grep -r` and `find`. NOT `git log --grep`, which searches commit messages,
+  // is already in the passing set, and does not match `git\s+grep`.
+  '^\\s*git\\s+(?:grep|ls-files)\\b',
+];
+// Same sources as their own matcher — check-bash-memory tests this to let a
+// carved-out leading command still block when the rest of the command is a read.
+var RUNNER_READ_BASH_RE = new RegExp(RUNNER_READ_SOURCES.join('|'), 'i');
 // BLOCK: read-like Bash commands that bypass the existing check-before-read /
 // check-before-scan gates by going through the shell. Anchored to the start of
 // the line so subcommands inside pipelines or `npm install grep` don't trip.
@@ -427,7 +481,7 @@ var READ_LIKE_BASH_RE = new RegExp([
   '^\\s*dir\\b[^|]*\\s\\/[sS]\\b',
   // #1171 — PowerShell hex dump, parallel to POSIX `xxd`/`hexdump`.
   '^\\s*Format-Hex\\b',
-].join('|'), 'i');
+].concat(RUNNER_READ_SOURCES).join('|'), 'i');
 // CARVE-OUT: commands that LOOK read-like but are operational. Anchored to the
 // LEADING command — the pipe-filter case (`npm test | grep FAIL`) is already
 // handled by READ_LIKE's `^\s*` anchor never matching the leading `npm`, so
@@ -474,8 +528,73 @@ function stripQuotedAndHeredocs(cmd) {
   return out;
 }
 
-var DIRECTIVE_RE = /^(yes|no|yeah|yep|nope|sure|ok|okay|correct|right|exactly|perfect)\b/i;
-var TASK_RE = /\b(fix|bug|error|implement|add|create|build|write|refactor|debug|test|feature|issue|security|optimi)\b/i;
+// #1447 — words that carry no subject to search FOR: assent, acknowledgement,
+// "keep going", and conversational filler. A prompt built ONLY from these
+// continues work already under way, so the memory gate stays down; anything
+// that survives the strip is a subject, and the gate arms.
+//
+// Supersedes two things. `DIRECTIVE_RE` — a `^(yes|ok|sure|…)` prefix test that
+// had already been dead code for some time, unreferenced by the reset it was
+// written for. And the live rule, `TASK_RE.test(p) || p.length > 20`, whose
+// real work was skipping short replies: every prompt of 20 characters or fewer
+// without a task word was exempt. That caught trivia ("hmm", "got it") and
+// equally caught "check the daemon" — a genuine topic change — which is the
+// half this replaces. The list below has to carry the trivia half on its own,
+// so it covers considerably more ground than DIRECTIVE_RE ever did.
+//
+// Matching by SUBTRACTION, not by a leading-token test, is what lets
+// "yes, now fix the daemon" arm while "yes" does not — a `^(yes|ok)\b` test
+// sees the same first word in both. It is also why the list can safely hold
+// ordinary words like `do`/`it`/`work`/`the`: a word only exempts a prompt when
+// NOTHING else in that prompt survives, so each addition costs precision only
+// for prompts made entirely of listed words. Deliberately absent for that
+// reason: task words (`fix`, `test`, `build`) and any noun.
+var CONTINUATION_WORD_RE = new RegExp('\\b(?:' + [
+  // Assent / dissent / acknowledgement
+  'yes', 'yeah', 'yep', 'yup', 'no', 'nope', 'sure', 'ok', 'okay', 'k',
+  'correct', 'right', 'exactly', 'perfect', 'agreed', 'true', 'indeed',
+  'understood', 'gotcha', 'got', 'makes', 'sense', 'fine', 'alright',
+  // Continuation / assent to proceed
+  'continue', 'proceed', 'carry', 'keep', 'going', 'go', 'ahead', 'on', 'next',
+  'again', 'more', 'rest', 'both', 'all', 'them', 'those',
+  // Politeness and praise
+  'please', 'thanks', 'thank', 'ty', 'great', 'nice', 'cool', 'good', 'awesome',
+  'excellent', 'sounds', 'lgtm', 'love', 'well', 'work', 'job', 'wow', 'yay',
+  // Conversational filler / hesitation / greetings
+  'hmm', 'hm', 'huh', 'ah', 'oh', 'ha', 'haha', 'lol', 'wait', 'hold', 'hang',
+  'actually', 'anyway', 'whatever', 'nvm', 'nevermind', 'sorry', 'oops',
+  'hi', 'hello', 'hey', 'stop', 'pause', 'never', 'mind',
+  'think', 'know', 'see', 'guess', 'suppose', 'maybe', 'probably',
+  // Function words with no subject of their own
+  'do', 'it', 'that', 'this', 'the', 'a', 'an', 'and', 'is', 'are', 'was',
+  'you', 'your', 'i', 'we', 'lets', 'let', 'us', 'me', 'my', 'now', 'then',
+  'done', 'finish', 'finished', 'ready', 'too', 'also', 'just', 'still',
+].join('|') + ')\\b', 'gi');
+/**
+ * Does this prompt consist of nothing but continuation filler?
+ *
+ * An EMPTY prompt answers true — a prompt the gate cannot see is not evidence
+ * that a search is needed, and arming on it would block every read in a
+ * consumer whose host omits the field, with nothing on screen explaining why.
+ * Fail-open here; `prompt-state-reset` separately refuses to WRITE a verdict it
+ * derived from an empty prompt (#1447), so an unreadable prompt now leaves the
+ * gate exactly as prompt-reminder set it rather than silently disarming it.
+ */
+function isContinuationPrompt(promptText) {
+  var t = (promptText || '').trim();
+  if (!t) return true;
+  // Subtract continuation words, then every non-alphanumeric character. What
+  // remains is the prompt's actual subject matter; nothing remaining means the
+  // prompt introduced no new subject.
+  // `\p{L}\p{N}` with /u, NOT `A-Za-z0-9`: an ASCII-only class strips every
+  // character of a CJK, Cyrillic, Arabic, Hebrew, Greek or Thai prompt — and
+  // most of an accented French or Spanish one — leaving nothing, so a
+  // substantive non-English request would score as pure filler and silently
+  // disarm the gate. Stripping only what is neither letter nor number keeps
+  // every script's content intact and removes just punctuation and spacing.
+  var rest = t.replace(CONTINUATION_WORD_RE, ' ').replace(/[^\p{L}\p{N}]+/gu, ' ').trim();
+  return rest.length === 0;
+}
 
 // Namespace classification (#931). The hint used to be emitted on every prompt
 // by prompt-hook.mjs which cost ~40 tokens × every prompt × every consumer.
@@ -510,7 +629,9 @@ var NS_NAV_RES = [
 // explicitly opted in to the protected coordination surface, so falling back to
 // raw Agent dispatch silently regresses headline moflo product capability.
 //
-// SYNC: duplicated verbatim in src/cli/init/helpers-generator.ts.
+// This file is the single source; #1443 replaced helpers-generator.ts's
+// hand-maintained copy with a build-time embed of this exact file, so there is
+// no longer a second copy of this function to keep in step.
 function detectFlMode(promptText) {
   var p = promptText || '';
   if (!/^\s*\/(?:fl|flo)\b/i.test(p)) return null;
@@ -653,10 +774,14 @@ function classifyNamespaceHint(promptText) {
 // full sentence in the same shape as classifyNamespaceHint so the BLOCK arm
 // can write either source's hint without branching on format.
 //
-// SYNC: duplicated verbatim in src/cli/init/helpers-generator.ts.
+// This file is the single source — see the note on detectFlMode above (#1443).
 function classifyBashNamespaceHint(cmd) {
   // Search-like tools — the user is hunting for a symbol/file, code-map wins.
-  if (/^\s*(?:grep|rg|ag|fgrep|egrep|find|fd|Select-String|sls)\b/i.test(cmd)) {
+  // #1445 — `git grep` / `git ls-files` are the same hunt through a different
+  // binary, so they route to the same namespace rather than falling through to
+  // the hintless generic message.
+  if (/^\s*(?:grep|rg|ag|fgrep|egrep|find|fd|Select-String|sls)\b/i.test(cmd)
+   || /^\s*git\s+(?:grep|ls-files)\b/i.test(cmd)) {
     return 'Memory namespace hint: use "code-map" for codebase navigation.';
   }
   // Reading a .md / RST / TXT, or a well-known doc file — guidance/learnings win.
@@ -674,7 +799,7 @@ function classifyBashNamespaceHint(cmd) {
 // UserPromptSubmit hooks can run it without compounding any field. Caller
 // owns interactionCount and the user-visible REMINDER/Context emissions, so
 // this helper stays silent.
-function applyPromptStateReset(state, promptText) {
+function applyPromptStateReset(state, promptText, opts) {
   // #352/#1331 — this is the ONLY place the memory gate resets. Deliberately
   // NOT on task transitions: within a single prompt (e.g. a /flo workflow)
   // memory stays searched so Read/Grep aren't blocked mid-execution. A
@@ -688,9 +813,24 @@ function applyPromptStateReset(state, promptText) {
   state.memorySearchedBy = {};
   // learningsStored is session-scoped — once stored, it stays true until session reset.
   // Resetting per-prompt caused false blocks when PR creation was on a later prompt.
-  var DIRECTIVE_MAX_LEN = 20;
-  var escaped = /^@@\s*/.test(promptText || '');
-  state.memoryRequired = !escaped && (promptText || '').length >= 4 && (TASK_RE.test(promptText || '') || (promptText || '').length > DIRECTIVE_MAX_LEN);
+  // #1447 — arm by DEFAULT; exempt only prompts that carry no subject of their
+  // own. This replaces `TASK_RE.test(p) || p.length > 20`, whose length cliff
+  // was arbitrary and invisible: "now look at the daemon" (22) armed the gate
+  // and "check the daemon" (16) did not, which is most of why the gate felt
+  // like it fired at random. Memory-first is this project's first rule, so the
+  // default has to be "search", with continuations as the carve-out — not the
+  // reverse. The per-prompt latch bounds the cost at one search per new prompt.
+  //
+  // `opts.skipArming` splits the reset in two. Invalidating the credits above
+  // is prompt-INDEPENDENT and always correct; deciding whether this prompt
+  // needs a search is not, and a caller holding no prompt text must not decide
+  // it from nothing. Skipping the whole reset instead would be worse than
+  // either: `memorySearchedBy` would survive, and a stale per-actor credit from
+  // the previous prompt would satisfy the gate for a prompt it never saw.
+  if (!(opts && opts.skipArming)) {
+    var escaped = /^@@\s*/.test(promptText || '');
+    state.memoryRequired = !escaped && !isContinuationPrompt(promptText);
+  }
   // Stash namespace hint for check-before-agent to emit when Claude actually
   // spawns an Agent (#931). Empty string when nothing matched — overwriting
   // any stale value from the previous prompt.
@@ -1454,7 +1594,12 @@ switch (command) {
     // → state read → memory gate.
     if (!config.memory_first) break;
     if (!READ_LIKE_BASH_RE.test(cmd)) break;
-    if (BASH_CARVE_OUT_RE.test(cmd)) break;
+    // #1445 — the carve-out is anchored to the LEADING command, so its `node`
+    // and `git` arms swallow every shape RUNNER_READ_SOURCES exists to catch.
+    // Those shapes earn their read classification from what follows the leading
+    // token, so they override the carve-out; every other command keeps #1132's
+    // semantics exactly (`npm test | grep FAIL`, `git diff`, `node build.mjs`).
+    if (BASH_CARVE_OUT_RE.test(cmd) && !RUNNER_READ_BASH_RE.test(cmd)) break;
     var s2 = readState();
     if (!s2.memoryRequired || isMemorySearchedFor(s2)) break;
     // Hint precedence: prompt-derived classification (set by applyPromptStateReset
@@ -2037,10 +2182,22 @@ switch (command) {
     // already wrote the byte-identical post-reset state. Only writeState when
     // the reset actually changed something (i.e., prompt-reminder was skipped
     // because prompt-hook.mjs threw before invoking it).
-    var s = readState();
     var prompt = process.env.CLAUDE_USER_PROMPT || '';
+    // #1447 — a safety net that cannot see the prompt must do NOTHING, not
+    // decide. This bridge did not forward `prompt` until #1447, so this hook
+    // classified the empty string on every prompt, concluded "no memory
+    // required", and wrote that over the correct value prompt-reminder had just
+    // computed — disarming the memory gate it exists to protect, intermittently,
+    // depending on which UserPromptSubmit hook wrote last. The forwarding fix
+    // addresses the cause; this guard makes the failure mode survivable if the
+    // field ever goes missing again (a host that omits it, a payload change):
+    // still invalidate the credits — that is this hook's whole reason to exist
+    // and needs no prompt — but leave the arming verdict to prompt-reminder,
+    // which has the text. Deciding "not required" from a prompt it cannot see
+    // is exactly the bug.
+    var s = readState();
     var before = JSON.stringify(s);
-    applyPromptStateReset(s, prompt);
+    applyPromptStateReset(s, prompt, { skipArming: !prompt });
     if (JSON.stringify(s) !== before) writeState(s);
     break;
   }

package/bin/lib/internal-skills.mjs

@@ -2,8 +2,10 @@
  * Skills that ship in the npm tarball (under `node_modules/moflo/.claude/skills/`)
  * but must NEVER be installed into consumer projects — strictly moflo-internal
  * dev tooling. `/publish` bumps moflo's own version and publishes to npm;
- * `/reset-epic` torches epic test data. Both are meaningless or harmful in a
- * consumer repo.
+ * `/reset-epic` torches epic test data; `/flfl` runs `/fl` preloaded with the
+ * rules that govern developing MOFLO (cross-platform, consumer blast radius,
+ * dogfooding), which are not constraints on a consumer's own project. All three
+ * are meaningless, noisy, or harmful in a consumer repo.
  *
  * The session-start launcher's recursive skills sync (`syncDirRecursive` in
  * `file-sync.mjs`) copies every shipped skill into the consumer on each run, so
@@ -13,4 +15,4 @@
  * so this leaf mirrors it. `tests/bin/internal-skills-parity.test.ts` asserts
  * the two lists never drift.
  */
-export const INTERNAL_SKILLS = ['publish', 'reset-epic'];
+export const INTERNAL_SKILLS = ['publish', 'reset-epic', 'flfl'];