moflo 4.12.9 → 4.12.11

package/bin/gate.cjs

@@ -240,10 +240,11 @@ function isEphemeralPath(fp) {
 }
 // #1171 — DANGEROUS gained PowerShell additions to match the matcher widening
 // that now routes the dedicated `PowerShell` tool through check-dangerous-command.
-// POSIX entries still apply because PS will execute them when invoked. Substring
-// match (case-insensitive) inside the gate.
+// POSIX entries still apply because PS will execute them when invoked. Matched
+// case-insensitively by `matchesDangerous` below — substring for most entries,
+// root-anchored for the ones that end at a filesystem root.
 var DANGEROUS = [
-  'rm -rf /', 'format c:', 'del /s /q c:\\', ':(){:|:&};:', 'mkfs.', '> /dev/sda',
+  'rm -rf /', 'rm -rf ~', 'format c:', 'del /s /q c:\\', ':(){:|:&};:', 'mkfs.', '> /dev/sda',
   // PowerShell destructive patterns. Won't catch every adversarial spelling
   // (PS aliases let `ri -r -force C:\` mean the same thing) but covers the
   // common-typo destruction class — symmetric to the POSIX list's intent.
@@ -254,6 +255,74 @@ var DANGEROUS = [
   'clear-disk',
 ];
 
+// #1449 — the entries above that END at a filesystem root are also a PREFIX of
+// every absolute path beneath it, so plain substring matching blocked routine
+// cleanup: `rm -rf /tmp/scratch` reported as `rm -rf /`. Those entries must
+// match ON the root rather than at the head of a longer path.
+//
+// WHICH entries those are is derived, not listed: a pattern is root-shaped iff
+// it ends at a root — a separator or `~`. That selects `rm -rf /`, `rm -rf ~`,
+// `del /s /q c:\` and the three `remove-item` forms, and leaves `format c:`,
+// `mkfs.`, `> /dev/sda`, `format-volume` and `clear-disk` on plain substring
+// matching, where trailing text is still the same dangerous command. Deriving
+// it rather than keeping a parallel list means a future root-shaped addition to
+// DANGEROUS is anchored automatically instead of silently falling back to the
+// prefix bug this fixes.
+//
+// `rm -rf ~` joins DANGEROUS with this change: it was never listed, so wiping a
+// home directory was allowed outright while cleaning a subdirectory of one was
+// blocked. Anchoring is what makes the entry safe to add.
+function endsAtRoot(pat) {
+  var last = pat.charAt(pat.length - 1);
+  return last === '/' || last === '\\' || last === '~';
+}
+// What may legally follow a root target: nothing, whitespace, a glob (`rm -rf /*`
+// still blocks), a shell operator, or a closing quote/paren. A path character —
+// letter, digit, `-`, `_` — means another segment follows, i.e. routine cleanup
+// of something below root. Rule #1: pure string logic, no platform branch; both
+// separators are handled for every OS's spelling.
+var ROOT_BOUNDARY_RE = /[\s;&|)"'`*<>]/;
+function isRootBoundary(cmd, i) {
+  if (i >= cmd.length) return true;
+  var c = cmd.charAt(i);
+  return c === '/' || c === '\\' || ROOT_BOUNDARY_RE.test(c);
+}
+
+/**
+ * Advance past text that does not move OFF the root: repeated separators, and
+ * `.` / `..` segments, which resolve back to where they started. `rm -rf //`,
+ * `rm -rf /.` and `rm -rf /..` all still mean `rm -rf /` and must block, while
+ * `rm -rf //tmp/x` and `rm -rf /.config` are real paths below root and must not.
+ * Without the dot handling the anchoring would OPEN a hole the substring match
+ * did not have — `.` is not a boundary character, so `rm -rf /.` would read as
+ * "a longer path follows" and pass.
+ */
+function skipToRootEnd(cmd, i) {
+  for (;;) {
+    var start = i;
+    while (i < cmd.length && (cmd.charAt(i) === '/' || cmd.charAt(i) === '\\')) i++;
+    var dots = 0;
+    while (cmd.charAt(i + dots) === '.') dots++;
+    // Only a BARE `.` or `..` segment is a no-op; `.config` and `..foo` are names.
+    if ((dots === 1 || dots === 2) && isRootBoundary(cmd, i + dots)) i += dots;
+    if (i === start) return i;
+  }
+}
+
+/**
+ * True when `pat` occurs in `cmd` as a real dangerous command. Root-shaped
+ * patterns must land on the root; every occurrence is examined, so a safe
+ * leading match (`rm -rf /tmp/a && rm -rf /`) never masks a later real one.
+ */
+function matchesDangerous(cmd, pat) {
+  if (!endsAtRoot(pat)) return cmd.indexOf(pat) >= 0;
+  for (var at = cmd.indexOf(pat); at >= 0; at = cmd.indexOf(pat, at + 1)) {
+    var end = skipToRootEnd(cmd, at + pat.length);
+    if (end >= cmd.length || ROOT_BOUNDARY_RE.test(cmd.charAt(end))) return true;
+  }
+  return false;
+}
+
 // #1132 — Bash memory-first gate.
 //
 // CREDIT: marks the gate satisfied when Claude invokes a memory-search CLI
@@ -1191,11 +1260,32 @@ function isPrCreateCommand(cmd) {
 // Fail-safe: any error (no classifier, no git, no merge-base) returns null,
 // which forces /simplify to run as today.
 function classifyForGateSkip(state) {
-  var classify;
+  var mod;
   try {
-    classify = require('./simplify-classify.cjs').classifyDiff;
+    mod = require('./simplify-classify.cjs');
   } catch (e) { return null; }
-  if (typeof classify !== 'function') return null;
+  var classify = mod && mod.classifyDiff;
+  var readUntracked = mod && mod.readUntrackedDiff;
+  // EXEC_MAX_BUFFER is checked alongside the functions because falling back to
+  // Node's 1 MiB default would silently reinstate the very cliff #1451 removed.
+  if (typeof classify !== 'function' || typeof readUntracked !== 'function'
+      || typeof mod.EXEC_MAX_BUFFER !== 'number') return null;
+
+  // Untracked files show up in no `git diff` output, so without them the gate
+  // could auto-pass a branch of brand-new unstaged files as TRIVIAL (#1451).
+  // Reading every one of them is real work, so it is deferred until a path is
+  // actually about to classify. Returns null if the read failed — the caller
+  // must then fall through and force /simplify rather than classify a partial
+  // diff.
+  var untrackedText = null;
+  function untrackedSuffix() {
+    if (untrackedText !== null) return untrackedText;
+    var u;
+    try { u = readUntracked(PROJECT_DIR); } catch (e) { return null; }
+    if (!u || u.unreadable) return null;
+    untrackedText = u.text ? '\n' + u.text : '';
+    return untrackedText;
+  }
 
   function tryClassify(diffText, label, allowSmallReviewFix) {
     try {
@@ -1219,11 +1309,16 @@ function classifyForGateSkip(state) {
     return null;
   }
 
+  // maxBuffer comes FROM the classifier (#1451) rather than being a matching
+  // literal here, so the gate and the skill cannot drift on which diffs are
+  // readable at all. Past it execFileSync throws ENOBUFS and gitDiff returns
+  // null — which every caller below must treat as "unknown", never "empty".
+  var maxBuffer = mod.EXEC_MAX_BUFFER;
   function gitDiff(args) {
     try {
       return cp.execFileSync('git', args, {
         cwd: PROJECT_DIR, encoding: 'utf-8', timeout: 5000, windowsHide: true,
-        stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 8 * 1024 * 1024
+        stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: maxBuffer
       });
     } catch (e) { return null; }
   }
@@ -1231,9 +1326,14 @@ function classifyForGateSkip(state) {
   // Snapshot path: classify everything since /simplify last ran.
   if (state.simplifySnapshotSha) {
     var snapDiff = gitDiff(['diff', state.simplifySnapshotSha + '...HEAD']);
-    var workTreeA = gitDiff(['diff', 'HEAD']) || '';
-    if (snapDiff !== null) {
-      var combined = snapDiff + (workTreeA ? '\n' + workTreeA : '');
+    var workTreeA = gitDiff(['diff', 'HEAD']);
+    // BOTH reads must succeed. Coalescing a failed working-tree read to '' is
+    // how an over-buffer working tree used to read as "no working-tree changes"
+    // and let the gate skip review (#1451).
+    if (snapDiff !== null && workTreeA !== null) {
+      var suffixA = untrackedSuffix();
+      if (suffixA === null) return null;
+      var combined = snapDiff + (workTreeA ? '\n' + workTreeA : '') + suffixA;
       // Snapshot path: allow SMALL review-fix shape because the original /simplify
       // already covered the surface and only tiny no-decl-touching tweaks followed.
       var hit = tryClassify(combined, 'delta since last /simplify', true);
@@ -1253,9 +1353,11 @@ function classifyForGateSkip(state) {
     } catch (e) { continue; }
     if (!base) continue;
     var branchDiff = gitDiff(['diff', base + '...HEAD']);
-    var workTreeB = gitDiff(['diff', 'HEAD']) || '';
-    if (branchDiff !== null) {
-      return tryClassify(branchDiff + (workTreeB ? '\n' + workTreeB : ''), 'branch diff');
+    var workTreeB = gitDiff(['diff', 'HEAD']);
+    if (branchDiff !== null && workTreeB !== null) {
+      var suffixB = untrackedSuffix();
+      if (suffixB === null) return null;
+      return tryClassify(branchDiff + (workTreeB ? '\n' + workTreeB : '') + suffixB, 'branch diff');
     }
     break;
   }
@@ -2110,7 +2212,7 @@ switch (command) {
     var raw = process.env.TOOL_INPUT_command || '';
     var cmd = stripQuotedAndHeredocs(raw).toLowerCase();
     for (var i = 0; i < DANGEROUS.length; i++) {
-      if (cmd.indexOf(DANGEROUS[i]) >= 0) {
+      if (matchesDangerous(cmd, DANGEROUS[i])) {
         console.log('[BLOCKED] Dangerous command: ' + DANGEROUS[i]);
         process.exit(2);
       }

package/bin/lib/session-continuity.mjs

@@ -206,6 +206,115 @@ export function hasPrivateOptOut(text) {
   return typeof text === 'string' && /<private>/i.test(text);
 }
 
+// ── Session goal extraction (pure) ──────────────────────────────────────────
+
+/**
+ * Claude Code stamps `isMeta: true` on user-role transcript entries it injected
+ * itself rather than ones the human typed — expanded skill preambles, the
+ * local-command caveat, "skill is already loaded" notes. An audit of every
+ * transcript on a dogfooding box found this marker on boilerplate ONLY, never on
+ * a real goal, which makes it the structural signal to filter on. The literal
+ * prefixes below are belt-and-braces for a Claude Code build that stops emitting
+ * the flag — a missing `isMeta` must not silently restore the #1452 bug.
+ */
+const BOILERPLATE_OPENERS = [
+  /^Base directory for this skill:/i,
+  /^Skill \S+ is already loaded/i,
+  /^Caveat: The messages below were generated by the user/i,
+  /^\[Request interrupted by user/i,
+  /^This session is being continued from a previous conversation/i,
+];
+
+/** Slash commands that steer the SESSION rather than state a goal. `/clear` is
+ *  the near-universal opener in an agent-driven repo, so returning it as the
+ *  Goal would reintroduce the same "boilerplate as intent" failure. */
+const SESSION_CONTROL_COMMANDS = new Set(['clear', 'compact', 'resume', 'exit', 'quit', 'login', 'logout', 'help']);
+
+const COMMAND_NAME_RE = /<command-name>\s*\/?\s*([\w:.-]+)\s*<\/command-name>/i;
+const COMMAND_ARGS_RE = /<command-args>([\s\S]*?)<\/command-args>/i;
+const BARE_COMMAND_RE = /^\/([\w:.-]+)(?:\s+([\s\S]*))?$/;
+
+/**
+ * Render a slash-command invocation as a goal string, e.g. `/flo 1452`.
+ *
+ * Claude Code writes the invocation two ways: an XML envelope
+ * (`<command-name>/flo</command-name><command-args>1452</command-args>`) and,
+ * for some built-ins, the bare text the user typed (`/compact`). Both are
+ * handled — the ARGUMENTS carry the actual intent (the issue number), which is
+ * exactly what the old filter threw away.
+ *
+ * `name` is lower-cased for the session-control lookup only; `goal` preserves
+ * the case the user actually typed, since it is a record of their invocation.
+ *
+ * Text after the closing `</command-args>` tag is intentionally dropped — the
+ * command plus its arguments IS the goal, and the surrounding envelope carries
+ * a `<command-message>` label that is never part of the ask.
+ *
+ * @param {string} flat - message content flattened to a single line
+ * @returns {{ name: string, goal: string } | null} null if not a slash command
+ */
+function parseSlashCommand(flat) {
+  let name = null;
+  let args = '';
+  const envelope = COMMAND_NAME_RE.exec(flat);
+  if (envelope) {
+    name = envelope[1];
+    const a = COMMAND_ARGS_RE.exec(flat);
+    args = a ? a[1].trim() : '';
+  } else if (!flat.startsWith('<')) {
+    const bare = BARE_COMMAND_RE.exec(flat);
+    if (!bare) return null;
+    name = bare[1];
+    args = (bare[2] || '').trim();
+  }
+  if (!name) return null;
+  return { name: name.toLowerCase(), goal: args ? `/${name} ${args}` : `/${name}` };
+}
+
+/**
+ * First user message that actually states a goal, from a transcript JSONL head.
+ *
+ * Returns `null` rather than a boilerplate string when nothing qualifies: this
+ * value is re-injected at SessionStart after a compaction, to a model that has
+ * just lost its context and cannot tell a junk Goal from a real one. An absent
+ * Goal is strictly better than a misleading one. See issue #1452.
+ *
+ * @param {string} headText - raw JSONL text from the head of the transcript
+ * @returns {string|null} goal (≤200 chars), or null if none was stated
+ */
+export function extractFirstUserGoal(headText) {
+  if (typeof headText !== 'string') return null;
+  for (const line of headText.split('\n')) {
+    const t = line.trim();
+    if (!t) continue;
+    let obj;
+    try { obj = JSON.parse(t); } catch { continue; }
+    const role = obj?.message?.role ?? obj?.role;
+    if (role !== 'user') continue;
+    // Injected by Claude Code, not typed by the human — never a goal.
+    if (obj?.isMeta === true) continue;
+    let content = obj?.message?.content ?? obj?.content;
+    if (Array.isArray(content)) {
+      content = content.map((b) => (typeof b === 'string' ? b : b?.text || '')).join(' ');
+    }
+    if (typeof content !== 'string') continue;
+    const flat = content.replace(/\s+/g, ' ').trim();
+    if (!flat) continue;
+
+    const command = parseSlashCommand(flat);
+    if (command) {
+      // `/clear`, `/compact` — session plumbing; keep scanning for the real ask.
+      if (SESSION_CONTROL_COMMANDS.has(command.name)) continue;
+      return command.goal.slice(0, 200);
+    }
+    // Other hook/tool XML noise (`<system-reminder>`, `<task-notification>`, …).
+    if (flat.startsWith('<')) continue;
+    if (BOILERPLATE_OPENERS.some((re) => re.test(flat))) continue;
+    return flat.slice(0, 200);
+  }
+  return null;
+}
+
 // ── Digest assembly (pure) ──────────────────────────────────────────────────
 
 /** statSync mtime that never throws (file may vanish between readdir and stat). */

package/bin/session-continuity.mjs

@@ -35,6 +35,7 @@ import {
   readContinuityConfig,
   readGitState,
   hasPrivateOptOut,
+  extractFirstUserGoal,
   assembleDigestContent,
   buildDigestMetadata,
   writeDigest,
@@ -48,28 +49,6 @@ function warn(msg) {
   try { process.stderr.write(`moflo: session-continuity ${msg}\n`); } catch { /* never throw from a hook */ }
 }
 
-/** First user message (the session goal) from a transcript JSONL head. */
-function extractFirstUserGoal(headText) {
-  for (const line of headText.split('\n')) {
-    const t = line.trim();
-    if (!t) continue;
-    let obj;
-    try { obj = JSON.parse(t); } catch { continue; }
-    const role = obj?.message?.role ?? obj?.role;
-    if (role !== 'user') continue;
-    let content = obj?.message?.content ?? obj?.content;
-    if (Array.isArray(content)) {
-      content = content.map((b) => (typeof b === 'string' ? b : b?.text || '')).join(' ');
-    }
-    if (typeof content !== 'string') continue;
-    const firstLine = content.replace(/\s+/g, ' ').trim();
-    // Skip slash-command / hook-noise openers — they aren't a goal statement.
-    if (!firstLine || firstLine.startsWith('<')) continue;
-    return firstLine.slice(0, 200);
-  }
-  return null;
-}
-
 /** Bounded transcript read: goal from the head, `<private>` opt-out scan over
  *  head+tail. Large transcripts are read at the edges only. */
 function readTranscriptInfo(path) {

package/bin/simplify-classify.cjs

@@ -31,6 +31,14 @@
  *     "stats": { added, deleted, fileCount, declAdded, declRemoved, tsjsLOC, tsjsNetDecls, otherNetAdded, ... }
  *   }
  *
+ * The diff it measures spans committed-since-base, working-tree, AND untracked
+ * non-ignored files — an untracked file is a change the branch will carry, and
+ * omitting it undercounts the diff exactly as a swallowed read error does.
+ * When a read it needed did not happen, `stats.diffUnavailable` is set and the
+ * decision routes to a review tier: the classifier cannot distinguish "no
+ * changes" from "I could not read the changes", and only the first is safe to
+ * call TRIVIAL (#1451).
+ *
  * Usage:
  *   node bin/simplify-classify.cjs                  # auto-detects default branch
  *   node bin/simplify-classify.cjs --base develop   # explicit override
@@ -42,6 +50,27 @@
 'use strict';
 
 const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+// execSync defaults to a 1 MiB stdout buffer and a real branch diff clears that
+// routinely (#1451 measured 2,113,712 bytes). Overflow throws ENOBUFS, which
+// used to be swallowed into an empty diff — "TRIVIAL, nothing to review" on a
+// branch with plenty to review. 64 MiB puts the cliff well past any diff a
+// human opens a PR for; past it, the classifier now says so instead of
+// reporting zero.
+const EXEC_MAX_BUFFER = 64 * 1024 * 1024;
+
+// Cap on how much of an untracked file is slurped to synthesize its new-file
+// diff. Well past any hand-written source file; anything larger is treated like
+// a binary (counted as a new file with no added lines) rather than read.
+const UNTRACKED_MAX_BYTES = 8 * 1024 * 1024;
+
+// Total budget for synthesized untracked-file content. A repo with a huge
+// un-ignored directory must not be slurped into memory wholesale — past this
+// the remaining files are recorded as new files and the result is flagged
+// unmeasurable, which forces review rather than quietly undercounting.
+const UNTRACKED_TOTAL_BUDGET = 32 * 1024 * 1024;
 
 // Paths where new logic warrants the 3-agent fan-out.
 // Mechanical edits inside these paths are still SMALL; only adding/removing
@@ -98,14 +127,43 @@ function noEscalate() {
   return { suggested: false, target: null, reason: null };
 }
 
+/**
+ * Run a git command, returning its stdout — or `null` if the command failed.
+ *
+ * `null` rather than `''` is load-bearing: a caller that cannot tell "git said
+ * nothing" from "git never answered" will report an unreadable diff as an empty
+ * one, and an empty diff is the one thing it is safe to call TRIVIAL (#1451).
+ */
 function safeExec(cmd, opts) {
   try {
     return execSync(cmd, {
       encoding: 'utf-8',
       stdio: ['pipe', 'pipe', 'pipe'],
+      maxBuffer: EXEC_MAX_BUFFER,
       ...(opts && opts.cwd ? { cwd: opts.cwd } : {}),
     });
-  } catch { return ''; }
+  } catch { return null; }
+}
+
+/**
+ * Is there a repo with at least one commit here? A git failure only means
+ * "there was something we could not measure" when there is history to read —
+ * outside a repo, or in a fresh `git init` before the first commit, there is
+ * genuinely no diff to miss, and forcing a review fan-out over nothing would be
+ * its own defect.
+ */
+function hasGitHistory(cwd) {
+  return safeExec('git rev-parse --verify HEAD', cwd ? { cwd } : undefined) !== null;
+}
+
+/**
+ * One `git rev-parse` per classification, shared by both diff readers. They
+ * consult it only on their failure paths — and a directory that is not a repo
+ * makes every read fail, so without sharing, the cheapest case pays twice.
+ */
+function makeHistoryProbe(cwd) {
+  let answer;
+  return () => (answer === undefined ? (answer = hasGitHistory(cwd)) : answer);
 }
 
 // Detect the consumer's default branch. Hardcoding 'main' silently miscalibrates
@@ -119,7 +177,7 @@ function detectDefaultBranch(cwd) {
   const opts = cwd ? { cwd } : undefined;
 
   // Preferred: origin/HEAD points to whatever the remote considers default.
-  const symbolic = safeExec('git symbolic-ref --short refs/remotes/origin/HEAD', opts).trim();
+  const symbolic = (safeExec('git symbolic-ref --short refs/remotes/origin/HEAD', opts) || '').trim();
   if (symbolic.startsWith('origin/')) {
     const v = symbolic.slice('origin/'.length);
     if (cwd === undefined) _cachedDefaultBranch = v;
@@ -127,7 +185,7 @@ function detectDefaultBranch(cwd) {
   }
 
   // Fallback: local init.defaultBranch (set by `git init -b <name>` or config).
-  const configured = safeExec('git config --get init.defaultBranch', opts).trim();
+  const configured = (safeExec('git config --get init.defaultBranch', opts) || '').trim();
   if (configured) {
     if (cwd === undefined) _cachedDefaultBranch = configured;
     return configured;
@@ -142,12 +200,95 @@ function _resetCacheForTest() {
   _cachedDefaultBranch = null;
 }
 
-function readDiffFromGit(base, cwd) {
+/**
+ * Read the tracked half of the diff: committed-since-base + working-tree.
+ * Returns `{ text, unreadable, reason }` — `unreadable` means a read we needed
+ * did not happen, so `text` is an undercount and must not be trusted as zero.
+ */
+function readDiffFromGit(base, cwd, historyProbe) {
   const opts = cwd ? { cwd } : undefined;
-  // Combined diff: committed-since-base + working-tree
   const committed = safeExec(`git diff ${base}...HEAD`, opts);
   const working = safeExec('git diff HEAD', opts);
-  return committed + (working ? '\n' + working : '');
+  const text = (committed || '') + (working ? '\n' + working : '');
+
+  if (committed !== null && working !== null) return { text, unreadable: false };
+  if (!(historyProbe ? historyProbe() : hasGitHistory(cwd))) return { text, unreadable: false };
+
+  const failed = [];
+  if (committed === null) failed.push(`git diff ${base}...HEAD`);
+  if (working === null) failed.push('git diff HEAD');
+  return { text, unreadable: true, reason: `${failed.join(' and ')} failed` };
+}
+
+/**
+ * Read the untracked half of the diff.
+ *
+ * Untracked files appear in no `git diff` output at all, so a branch of
+ * brand-new files reads as a far smaller change than it is — 12 new CRUD files
+ * classified SMALL until someone staged them (#1451). Synthesize a new-file
+ * entry per untracked, non-ignored file so `parseDiff` counts it exactly as it
+ * would once staged.
+ *
+ * Built from Node file reads rather than `git diff --no-index` against a null
+ * device, which would need `/dev/null` vs `NUL` branching (Rule #1). The index
+ * is never touched.
+ */
+function readUntrackedDiff(cwd, historyProbe) {
+  const root = cwd || process.cwd();
+  const out = safeExec('git ls-files --others --exclude-standard -z', cwd ? { cwd } : undefined);
+  if (out === null) {
+    return (historyProbe ? historyProbe() : hasGitHistory(cwd))
+      ? { text: '', unreadable: true, reason: 'git ls-files --others failed' }
+      : { text: '', unreadable: false };
+  }
+
+  const parts = [];
+  let budgetSpent = 0;
+  let overBudget = false;
+  // -z keeps paths raw (no shell quoting of unusual characters). git emits them
+  // POSIX-separated on every platform, so they need no separator translation —
+  // only path.resolve to reach the file on disk.
+  for (const rel of out.split('\0')) {
+    if (!rel) continue;
+    const header = `diff --git a/${rel} b/${rel}\nnew file mode 100644\n`;
+
+    let body = null;
+    try {
+      const abs = path.resolve(root, rel);
+      // lstat, not stat: following an untracked symlink would read and count
+      // the TARGET's content — mismeasuring the diff, and pulling bytes from
+      // wherever the link points, which may be outside the working tree.
+      const stat = fs.lstatSync(abs);
+      if (stat.isFile() && stat.size <= UNTRACKED_MAX_BYTES && budgetSpent + stat.size <= UNTRACKED_TOTAL_BUDGET) {
+        const buf = fs.readFileSync(abs);
+        budgetSpent += stat.size;
+        if (!buf.includes(0)) body = buf.toString('utf-8');
+      } else if (stat.isFile()) {
+        overBudget = overBudget || budgetSpent + stat.size > UNTRACKED_TOTAL_BUDGET;
+      }
+    } catch { /* vanished or unreadable — header only */ }
+
+    if (body === null) {
+      // Binary, symlink, oversized, or unreadable. git emits no `+` lines for
+      // these either, so the file still counts toward fileCount/newFiles with
+      // zero added lines — the honest measurement, not a swallowed one.
+      parts.push(`${header}Binary files /dev/null and b/${rel} differ\n`);
+      continue;
+    }
+
+    // Split on \n and drop the trailing empty element from a final newline;
+    // CRLF files keep their \r on each line, which parseDiff trims before
+    // testing for declarations.
+    const lines = body.split('\n');
+    if (lines.length > 0 && lines[lines.length - 1] === '') lines.pop();
+    parts.push(`${header}--- /dev/null\n+++ b/${rel}\n@@ -0,0 +1,${lines.length} @@\n`);
+    for (const ln of lines) parts.push(`+${ln}\n`);
+  }
+
+  const text = parts.join('');
+  return overBudget
+    ? { text, unreadable: true, reason: 'untracked files exceeded the diff-synthesis budget' }
+    : { text, unreadable: false };
 }
 
 /**
@@ -240,14 +381,19 @@ function parseDiff(diff) {
 }
 
 /**
- * Pure decision function. Takes parsed stats, returns dispatch decision.
- * No I/O. Easy to unit-test with synthetic stats.
+ * Route a diff we actually managed to measure. Pure — no I/O. Callers reach
+ * this through `decide`, which first handles the case where the measurement
+ * itself failed.
  */
-function decide(stats) {
+function decideMeasured(stats) {
   const reasoning = [];
   const totalChange = stats.added + stats.deleted;
 
-  if (totalChange === 0) {
+  // Only a diff with no files at all is genuinely empty. A diff carrying files
+  // but no +/- lines — binary assets, pure renames, mode changes, an untracked
+  // binary — is a real change git simply does not express as lines, and calling
+  // it "nothing to review" is the same undercount as swallowing a read error.
+  if (totalChange === 0 && stats.fileCount === 0) {
     return { tier: 'TRIVIAL', model: 'sonnet', agentCount: 0, escalate: noEscalate(), reasoning: ['empty diff — nothing to review'], stats };
   }
 
@@ -345,13 +491,46 @@ function decide(stats) {
   return { tier: 'SMALL', model: 'sonnet', agentCount: 1, escalate: noEscalate(), reasoning, stats };
 }
 
+/**
+ * Pure decision function. Takes parsed stats, returns dispatch decision.
+ * No I/O. Easy to unit-test with synthetic stats.
+ *
+ * `stats.diffUnavailable` marks a diff the reader could not fully measure. The
+ * classifier cannot tell "no changes" from "I could not read the changes", and
+ * only the first is safe to call TRIVIAL — so an unmeasurable diff routes to a
+ * review tier and says why, rather than stamping the gate clean (#1451).
+ */
+function decide(stats) {
+  if (!stats.diffUnavailable) return decideMeasured(stats);
+
+  const note = `diff could not be fully read (${stats.diffUnavailableReason || 'git read failed'})`
+    + ' — a diff the classifier cannot measure is never TRIVIAL';
+  // Whatever DID parse may already warrant more than the forced NORMAL floor;
+  // an architectural diff whose working-tree half went missing stays DEEP.
+  const measured = decideMeasured(stats);
+  if (measured.agentCount >= 3) {
+    return { ...measured, reasoning: [note].concat(measured.reasoning) };
+  }
+  return { tier: 'NORMAL', model: 'sonnet', agentCount: 3, escalate: noEscalate(), reasoning: [note], stats };
+}
+
 function classifyDiff(diffText) {
   return decide(parseDiff(diffText));
 }
 
 function classifyFromGit(base, cwd) {
   const resolved = base || detectDefaultBranch(cwd);
-  return classifyDiff(readDiffFromGit(resolved, cwd));
+  const historyProbe = makeHistoryProbe(cwd);
+  const tracked = readDiffFromGit(resolved, cwd, historyProbe);
+  const untracked = readUntrackedDiff(cwd, historyProbe);
+  const stats = parseDiff(tracked.text + (untracked.text ? '\n' + untracked.text : ''));
+  if (tracked.unreadable || untracked.unreadable) {
+    stats.diffUnavailable = true;
+    // Both halves can fail independently; surface every reason, not just the
+    // first, so the printed decision explains the whole gap.
+    stats.diffUnavailableReason = [tracked.reason, untracked.reason].filter(Boolean).join('; ');
+  }
+  return decide(stats);
 }
 
 if (require.main === module) {
@@ -375,4 +554,7 @@ if (require.main === module) {
   }
 }
 
-module.exports = { parseDiff, decide, classifyDiff, classifyFromGit, detectDefaultBranch, _resetCacheForTest };
+module.exports = {
+  parseDiff, decide, classifyDiff, classifyFromGit,
+  readUntrackedDiff, detectDefaultBranch, EXEC_MAX_BUFFER, _resetCacheForTest,
+};

package/dist/src/cli/commands/hooks.js

@@ -2682,7 +2682,12 @@ const statuslineCommand = {
                     maturityScore += 10;
                 intelligencePct = Math.min(100, maturityScore);
             }
-            const contextPct = Math.min(100, Math.floor(learning.sessions * 5));
+            // Context-window usage is only knowable from the session payload Claude Code
+            // pipes to a statusline command; `flo hooks status` is a plain CLI invocation
+            // and never receives one. Report null rather than a stand-in (#1453) — this
+            // used to be `learning.sessions * 5`, an activity counter wearing a context
+            // gauge's label, which pinned at 100% after 20 stored sessions.
+            const contextPct = null;
             return { memoryMB, contextPct, intelligencePct, subAgents };
         }
         // Get user info
@@ -2729,7 +2734,8 @@ const statuslineCommand = {
         }
         // Compact output
         if (ctx.flags.compact) {
-            const line = `DDD:${progress.domainsCompleted}/${progress.totalDomains} CVE:${security.cvesFixed}/${security.totalCves} Swarm:${swarm.activeAgents}/${swarm.maxAgents} Ctx:${system.contextPct}% Int:${system.intelligencePct}%`;
+            const ctxDisplay = system.contextPct === null ? '--' : `${system.contextPct}%`;
+            const line = `DDD:${progress.domainsCompleted}/${progress.totalDomains} CVE:${security.cvesFixed}/${security.totalCves} Swarm:${swarm.activeAgents}/${swarm.maxAgents} Ctx:${ctxDisplay} Int:${system.intelligencePct}%`;
             output.writeln(line);
             return { success: true, data: statusData };
         }

package/dist/src/cli/config/moflo-config.js

@@ -121,6 +121,7 @@ const DEFAULT_CONFIG = {
         show_model: true,
         show_session: true,
         show_intelligence: true,
+        show_context: true,
         show_swarm: true,
         show_hooks: true,
         show_mcp: true,
@@ -361,6 +362,7 @@ function mergeConfig(raw, root) {
             show_model: raw.status_line?.show_model ?? raw.statusLine?.showModel ?? DEFAULT_CONFIG.status_line.show_model,
             show_session: raw.status_line?.show_session ?? raw.statusLine?.showSession ?? DEFAULT_CONFIG.status_line.show_session,
             show_intelligence: raw.status_line?.show_intelligence ?? raw.statusLine?.showIntelligence ?? DEFAULT_CONFIG.status_line.show_intelligence,
+            show_context: raw.status_line?.show_context ?? raw.statusLine?.showContext ?? DEFAULT_CONFIG.status_line.show_context,
             show_swarm: raw.status_line?.show_swarm ?? raw.statusLine?.showSwarm ?? DEFAULT_CONFIG.status_line.show_swarm,
             show_hooks: raw.status_line?.show_hooks ?? raw.statusLine?.showHooks ?? DEFAULT_CONFIG.status_line.show_hooks,
             show_mcp: raw.status_line?.show_mcp ?? raw.statusLine?.showMcp ?? DEFAULT_CONFIG.status_line.show_mcp,
@@ -608,6 +610,7 @@ status_line:
   show_model: true                # Current model name
   show_session: true              # Session duration
   show_intelligence: true         # Intelligence % indicator
+  show_context: true              # Context-window % used (from Claude Code's stdin payload)
   show_swarm: true                # Active swarm agents count
   show_hooks: true                # Enabled hooks count
   show_mcp: true                  # MCP server count