oh-my-claude-sisyphus 3.8.16 → 3.9.0

package/skills/project-session-manager/lib/worktree.sh

@@ -1,6 +1,32 @@
 #!/bin/bash
 # PSM Worktree Management
 
+# Validate worktree path is under PSM worktree root before deletion
+# Returns 0 if valid, 1 if invalid
+# Usage: validate_worktree_path <path>
+validate_worktree_path() {
+    local path="$1"
+    local worktree_root
+    worktree_root=$(psm_get_worktree_root 2>/dev/null) || return 1
+
+    # Path must exist and be a directory
+    if [[ ! -d "$path" ]]; then
+        return 1
+    fi
+
+    # Resolve to absolute paths for comparison
+    local abs_path abs_root
+    abs_path=$(cd "$path" 2>/dev/null && pwd) || return 1
+    abs_root=$(cd "$worktree_root" 2>/dev/null && pwd) || return 1
+
+    # Check path is under root and doesn't contain ..
+    if [[ "$abs_path" != "$abs_root"/* ]] || [[ "$path" == *".."* ]]; then
+        echo "error|Invalid worktree path: not under PSM root" >&2
+        return 1
+    fi
+    return 0
+}
+
 # Create a worktree for PR review
 # Usage: psm_create_pr_worktree <local_repo> <alias> <pr_number> <pr_branch>
 psm_create_pr_worktree() {
@@ -146,10 +172,17 @@ psm_remove_worktree() {
     fi
 
     cd "$local_repo" || return 1
-    git worktree remove "$worktree_path" --force 2>/dev/null || {
-        # Force remove the directory if git worktree remove fails
-        rm -rf "$worktree_path"
-    }
+
+    # Validate path is under PSM worktree root before any deletion
+    if validate_worktree_path "$worktree_path"; then
+        git worktree remove "$worktree_path" --force 2>/dev/null || {
+            # Force remove the directory if git worktree remove fails
+            rm -rf "$worktree_path"
+        }
+    else
+        echo "error|Refusing to delete path outside worktree root: $worktree_path" >&2
+        return 1
+    fi
 
     echo "removed|$worktree_path"
     return 0

package/skills/project-session-manager/psm.sh

@@ -13,6 +13,11 @@ source "$SCRIPT_DIR/lib/worktree.sh"
 source "$SCRIPT_DIR/lib/tmux.sh"
 source "$SCRIPT_DIR/lib/session.sh"
 
+# Source provider files
+source "$SCRIPT_DIR/lib/providers/interface.sh"
+source "$SCRIPT_DIR/lib/providers/github.sh"
+source "$SCRIPT_DIR/lib/providers/jira.sh"
+
 # Colors for output
 RED='\033[0;31m'
 GREEN='\033[0;32m'
@@ -38,15 +43,14 @@ check_dependencies() {
         missing+=("jq")
     fi
 
-    if ! command -v gh &> /dev/null; then
-        missing+=("gh (GitHub CLI)")
-    fi
+    # Note: gh and jira are checked per-operation, not globally
+    # This allows users without gh to still use Jira, and vice versa
 
     if [[ ${#missing[@]} -gt 0 ]]; then
         log_error "Missing required dependencies: ${missing[*]}"
         log_info "Install with:"
-        log_info "  Ubuntu/Debian: sudo apt install git jq gh"
-        log_info "  macOS: brew install git jq gh"
+        log_info "  Ubuntu/Debian: sudo apt install git jq"
+        log_info "  macOS: brew install git jq"
         exit 1
     fi
 
@@ -106,7 +110,21 @@ cmd_review() {
         return 1
     fi
 
-    IFS='|' read -r type alias repo pr_number local_path base <<< "$parsed"
+    IFS='|' read -r type alias repo pr_number local_path base provider provider_ref <<< "$parsed"
+
+    # Provider guard: Jira doesn't have PRs
+    if [[ "$provider" == "jira" ]]; then
+        log_error "Jira issues cannot be 'reviewed' - Jira has no PR concept."
+        log_info "Use 'psm fix $ref' to work on a Jira issue instead."
+        log_info "Jira integration supports: fix, feature"
+        return 1
+    fi
+
+    # Check GitHub CLI availability
+    if ! provider_github_available; then
+        log_error "GitHub CLI (gh) not found. Install: brew install gh"
+        return 1
+    fi
 
     if [[ -z "$repo" ]]; then
         log_error "Could not determine repository"
@@ -117,7 +135,7 @@ cmd_review() {
 
     # Fetch PR info
     local pr_info
-    pr_info=$(gh pr view "$pr_number" --repo "$repo" --json number,title,author,headRefName,baseRefName,body,url 2>/dev/null) || {
+    pr_info=$(provider_call "github" fetch_pr "$pr_number" "$repo") || {
         log_error "Failed to fetch PR #${pr_number}. Check if the PR exists and you have access."
         return 1
     }
@@ -143,7 +161,9 @@ cmd_review() {
         local_path="${HOME}/Workspace/$(basename "$repo")"
         if [[ ! -d "$local_path" ]]; then
             log_info "Cloning repository to $local_path..."
-            git clone "https://github.com/${repo}.git" "$local_path" || {
+            local clone_url
+            clone_url=$(provider_call "github" clone_url "$repo")
+            git clone "$clone_url" "$local_path" || {
                 log_error "Failed to clone repository"
                 return 1
             }
@@ -198,18 +218,16 @@ cmd_review() {
     fi
 
     # Create session metadata
-    local metadata=$(cat << EOF
-{
-  "pr_number": $pr_number,
-  "pr_title": $(echo "$pr_title" | jq -R .),
-  "pr_author": "$pr_author",
-  "pr_url": "$pr_url"
-}
-EOF
-)
+    local metadata
+    metadata=$(jq -n \
+      --argjson pr_number "$pr_number" \
+      --arg pr_title "$pr_title" \
+      --arg pr_author "$pr_author" \
+      --arg pr_url "$pr_url" \
+      '{pr_number: $pr_number, pr_title: $pr_title, pr_author: $pr_author, pr_url: $pr_url}')
 
     # Add to registry
-    psm_add_session "$session_id" "review" "$alias" "pr-${pr_number}" "$head_branch" "$base_branch" "$session_name" "$worktree_path" "$local_path" "$metadata"
+    psm_add_session "$session_id" "review" "$alias" "pr-${pr_number}" "$head_branch" "$base_branch" "$session_name" "$worktree_path" "$local_path" "$metadata" "github" "${repo}#${pr_number}"
 
     # Output summary
     echo ""
@@ -242,24 +260,45 @@ cmd_fix() {
         return 1
     fi
 
-    IFS='|' read -r type alias repo issue_number local_path base <<< "$parsed"
+    IFS='|' read -r type alias repo issue_number local_path base provider provider_ref <<< "$parsed"
 
-    if [[ -z "$repo" ]]; then
+    # Check provider CLI availability
+    if [[ "$provider" == "jira" ]]; then
+        if ! provider_jira_available; then
+            log_error "Jira CLI not found. Install: brew install ankitpokhrel/jira-cli/jira-cli"
+            return 1
+        fi
+    else
+        if ! provider_github_available; then
+            log_error "GitHub CLI (gh) not found. Install: brew install gh"
+            return 1
+        fi
+    fi
+
+    if [[ -z "$repo" && "$provider" != "jira" ]]; then
         log_error "Could not determine repository"
         return 1
     fi
 
-    log_info "Fetching issue #${issue_number} from ${repo}..."
+    log_info "Fetching issue #${issue_number}..."
 
     # Fetch issue info
     local issue_info
-    issue_info=$(gh issue view "$issue_number" --repo "$repo" --json number,title,body,labels,url 2>/dev/null) || {
-        log_error "Failed to fetch issue #${issue_number}"
-        return 1
-    }
-
-    local issue_title=$(echo "$issue_info" | jq -r '.title')
-    local issue_url=$(echo "$issue_info" | jq -r '.url')
+    if [[ "$provider" == "jira" ]]; then
+        issue_info=$(provider_call "jira" fetch_issue "$provider_ref") || {
+            log_error "Failed to fetch Jira issue ${provider_ref}"
+            return 1
+        }
+        local issue_title=$(echo "$issue_info" | jq -r '.fields.summary')
+        local issue_url=$(echo "$issue_info" | jq -r '.self // empty')
+    else
+        issue_info=$(provider_call "github" fetch_issue "$issue_number" "$repo") || {
+            log_error "Failed to fetch issue #${issue_number}"
+            return 1
+        }
+        local issue_title=$(echo "$issue_info" | jq -r '.title')
+        local issue_url=$(echo "$issue_info" | jq -r '.url')
+    fi
     local slug=$(psm_slugify "$issue_title" 20)
 
     log_info "Issue: #${issue_number} - ${issue_title}"
@@ -271,10 +310,19 @@ cmd_fix() {
 
     # Determine local path
     if [[ -z "$local_path" || ! -d "$local_path" ]]; then
-        local_path="${HOME}/Workspace/$(basename "$repo")"
+        local_path="${HOME}/Workspace/$(basename "${repo:-$alias}")"
         if [[ ! -d "$local_path" ]]; then
             log_info "Cloning repository..."
-            git clone "https://github.com/${repo}.git" "$local_path" || return 1
+            local clone_url
+            if [[ "$provider" == "jira" ]]; then
+                clone_url=$(provider_call "jira" clone_url "$alias") || {
+                    log_error "Failed to get clone URL for '$alias'. Configure 'repo' or 'clone_url' in projects.json"
+                    return 1
+                }
+            else
+                clone_url=$(provider_call "github" clone_url "$repo")
+            fi
+            git clone "$clone_url" "$local_path" || return 1
         fi
     fi
 
@@ -309,16 +357,14 @@ cmd_fix() {
     fi
 
     # Create metadata
-    local metadata=$(cat << EOF
-{
-  "issue_number": $issue_number,
-  "issue_title": $(echo "$issue_title" | jq -R .),
-  "issue_url": "$issue_url"
-}
-EOF
-)
+    local metadata
+    metadata=$(jq -n \
+      --argjson issue_number "$issue_number" \
+      --arg issue_title "$issue_title" \
+      --arg issue_url "$issue_url" \
+      '{issue_number: $issue_number, issue_title: $issue_title, issue_url: $issue_url}')
 
-    psm_add_session "$session_id" "fix" "$alias" "issue-${issue_number}" "$branch_name" "$base" "$session_name" "$worktree_path" "$local_path" "$metadata"
+    psm_add_session "$session_id" "fix" "$alias" "issue-${issue_number}" "$branch_name" "$base" "$session_name" "$worktree_path" "$local_path" "$metadata" "$provider" "$provider_ref"
 
     echo ""
     log_success "Session ready!"
@@ -473,15 +519,20 @@ cmd_cleanup() {
 
     local cleaned=0
 
-    # Check PR sessions (use process substitution to avoid subshell)
+    # Check PR sessions (GitHub only)
     while IFS='|' read -r id pr_number project; do
         if [[ -z "$id" ]]; then continue; fi
 
+        local session_json=$(psm_get_session "$id")
+        local provider=$(echo "$session_json" | jq -r '.provider // "github"')
+
+        # Only GitHub has PRs
+        if [[ "$provider" != "github" ]]; then continue; fi
+
         local repo=$(psm_get_project "$project" | cut -d'|' -f1)
 
         if [[ -n "$repo" && -n "$pr_number" ]]; then
-            local pr_state=$(gh pr view "$pr_number" --repo "$repo" --json merged 2>/dev/null | jq -r '.merged')
-            if [[ "$pr_state" == "true" ]]; then
+            if provider_github_available && provider_call "github" pr_merged "$pr_number" "$repo"; then
                 log_info "PR #${pr_number} is merged - cleaning up $id"
                 cmd_kill "$id"
                 ((cleaned++))
@@ -489,18 +540,32 @@ cmd_cleanup() {
         fi
     done < <(psm_get_review_sessions)
 
-    # Check issue sessions (use process substitution to avoid subshell)
+    # Check issue sessions (GitHub and Jira)
     while IFS='|' read -r id issue_number project; do
         if [[ -z "$id" ]]; then continue; fi
 
-        local repo=$(psm_get_project "$project" | cut -d'|' -f1)
-
-        if [[ -n "$repo" && -n "$issue_number" ]]; then
-            local issue_state=$(gh issue view "$issue_number" --repo "$repo" --json closed 2>/dev/null | jq -r '.closed')
-            if [[ "$issue_state" == "true" ]]; then
-                log_info "Issue #${issue_number} is closed - cleaning up $id"
-                cmd_kill "$id"
-                ((cleaned++))
+        local session_json=$(psm_get_session "$id")
+        local provider=$(echo "$session_json" | jq -r '.provider // "github"')
+        local provider_ref=$(echo "$session_json" | jq -r '.provider_ref // empty')
+
+        if [[ "$provider" == "jira" ]]; then
+            # Jira cleanup
+            if provider_jira_available && [[ -n "$provider_ref" ]]; then
+                if provider_call "jira" issue_closed "$provider_ref"; then
+                    log_info "Jira issue ${provider_ref} is done - cleaning up $id"
+                    cmd_kill "$id"
+                    ((cleaned++))
+                fi
+            fi
+        else
+            # GitHub cleanup
+            local repo=$(psm_get_project "$project" | cut -d'|' -f1)
+            if provider_github_available && [[ -n "$repo" && -n "$issue_number" ]]; then
+                if provider_call "github" issue_closed "$issue_number" "$repo"; then
+                    log_info "Issue #${issue_number} is closed - cleaning up $id"
+                    cmd_kill "$id"
+                    ((cleaned++))
+                fi
             fi
         fi
     done < <(psm_get_fix_sessions)

package/skills/ralph/SKILL.md

@@ -76,7 +76,7 @@ Your workflow:
 
 ## ULTRAWORK MODE (AUTO-ACTIVATED)
 
-Ralph automatically activates Ultrawork for maximum parallel execution. You MUST follow these rules:
+Ralph is a **persistence wrapper** that includes Ultrawork as a component for maximum parallel execution. You MUST follow these rules:
 
 ### Parallel Execution Rules
 - **PARALLEL**: Fire independent calls simultaneously - NEVER wait sequentially
@@ -93,23 +93,11 @@ Ralph automatically activates Ultrawork for maximum parallel execution. You MUST
 
 ### Available Agents by Tier
 
-| Domain | LOW (Haiku) | MEDIUM (Sonnet) | HIGH (Opus) |
-|--------|-------------|-----------------|-------------|
-| **Analysis** | `architect-low` | `architect-medium` | `architect` |
-| **Execution** | `executor-low` | `executor` | `executor-high` |
-| **Search** | `explore` | `explore-medium` | - |
-| **Research** | `researcher-low` | `researcher` | - |
-| **Frontend** | `designer-low` | `designer` | `designer-high` |
-| **Docs** | `writer` | - | - |
-| **Visual** | - | `vision` | - |
-| **Planning** | - | - | `planner` |
-| **Critique** | - | - | `critic` |
-| **Pre-Planning** | - | - | `analyst` |
-| **Testing** | - | `qa-tester` | - |
-| **Security** | `security-reviewer-low` | - | `security-reviewer` |
-| **Build** | `build-fixer-low` | `build-fixer` | - |
-| **TDD** | `tdd-guide-low` | `tdd-guide` | - |
-| **Code Review** | `code-reviewer-low` | - | `code-reviewer` |
+**FIRST ACTION:** Before delegating any work, read the agent reference file:
+```
+Read file: docs/shared/agent-tiers.md
+```
+This provides the complete agent tier matrix, MCP tool assignments, and selection guidance.
 
 **CRITICAL: Always pass `model` parameter explicitly!**
 ```
@@ -166,20 +154,46 @@ Before outputting the completion promise:
 
 **Skipping verification = Task NOT complete**
 
-## ARCHITECT VERIFICATION (MANDATORY)
+## VERIFICATION PROTOCOL (TIERED)
 
-When you believe the task is complete:
-1. **First**, spawn Architect to verify your work (ALWAYS pass model explicitly!):
-   ```
-   Task(subagent_type="oh-my-claudecode:architect", model="opus", prompt="Verify this implementation is complete: [describe what you did]")
+Ralph uses tiered verification to save tokens while maintaining quality.
+
+### Verification Tier Selection
+
+Before spawning architect for verification, determine the appropriate tier:
+
+| Change Profile | Tier | Agent |
+|----------------|------|-------|
+| <5 files, <100 lines, full tests | LIGHT | architect-low (haiku) |
+| Standard changes | STANDARD | architect-medium (sonnet) |
+| >20 files, security/architectural | THOROUGH | architect (opus) |
+
+### Ralph Minimum Verification Tier
+
+**Floor: STANDARD (architect-medium / sonnet)**
+
+Even for small changes (<5 files), ralph requires at least STANDARD tier verification. The LIGHT tier (haiku) is insufficient for ralph's completion guarantee. When tier selection returns LIGHT, upgrade to STANDARD.
+
+### Verification Flow
+
+1. **Collect change metadata**: Count files, lines, detect security/architectural patterns
+2. **Select tier**: Apply rules from `/docs/shared/verification-tiers.md`
+3. **Spawn appropriate architect**:
    ```
+   // LIGHT - small, well-tested changes
+   Task(subagent_type="oh-my-claudecode:architect-low", model="haiku", prompt="Quick verification: [describe changes]")
 
-2. **Wait for Architect's assessment**
+   // STANDARD - most changes
+   Task(subagent_type="oh-my-claudecode:architect-medium", model="sonnet", prompt="Verify implementation: [describe changes]")
 
-3. **If Architect approves**: Run `/oh-my-claudecode:cancel` to cleanly exit ralph mode
-4. **If Architect finds issues**: Fix them, then repeat verification
+   // THOROUGH - large/security/architectural changes
+   Task(subagent_type="oh-my-claudecode:architect", model="opus", prompt="Full verification: [describe changes]")
+   ```
+4. **Wait for verdict**
+5. **If approved**: Run `/oh-my-claudecode:cancel` to cleanly exit
+6. **If rejected**: Fix issues and re-verify (same tier)
 
-DO NOT exit without Architect verification.
+For complete tier selection rules, read: `docs/shared/verification-tiers.md`
 
 ## ZERO TOLERANCE
 

package/skills/ultrawork/SKILL.md

@@ -1,71 +1,45 @@
 ---
 name: ultrawork
-description: Activate maximum performance mode with parallel agent orchestration for high-throughput task completion
+description: Parallel execution engine for high-throughput task completion
 ---
 
 # Ultrawork Skill
 
-Activates maximum performance mode with parallel agent orchestration.
+Parallel execution engine. This is a **COMPONENT**, not a standalone persistence mode.
 
-## When Activated
-
-This skill enhances Claude's capabilities by:
+## What Ultrawork Provides
 
 1. **Parallel Execution**: Running multiple agents simultaneously for independent tasks
-2. **Aggressive Delegation**: Routing tasks to specialist agents immediately
-3. **Background Operations**: Using `run_in_background: true` for long operations
-4. **Persistence Enforcement**: Never stopping until all tasks are verified complete
-5. **Smart Model Routing**: Using tiered agents to save tokens
-
-## Smart Model Routing (CRITICAL - SAVE TOKENS)
-
-**Choose tier based on task complexity: LOW (haiku) → MEDIUM (sonnet) → HIGH (opus)**
-
-### Available Agents by Tier
+2. **Background Operations**: Using `run_in_background: true` for long operations
+3. **Smart Model Routing**: Using tiered agents to save tokens
 
-| Domain | LOW (Haiku) | MEDIUM (Sonnet) | HIGH (Opus) |
-|--------|-------------|-----------------|-------------|
-| **Analysis** | `architect-low` | `architect-medium` | `architect` |
-| **Execution** | `executor-low` | `executor` | `executor-high` |
-| **Search** | `explore` | `explore-medium` | - |
-| **Research** | `researcher-low` | `researcher` | - |
-| **Frontend** | `designer-low` | `designer` | `designer-high` |
-| **Docs** | `writer` | - | - |
-| **Visual** | - | `vision` | - |
-| **Planning** | - | - | `planner`, `critic`, `analyst` |
-| **Testing** | - | `qa-tester` | - |
-| **Security** | `security-reviewer-low` | - | `security-reviewer` |
-| **Build** | `build-fixer-low` | `build-fixer` | - |
-| **TDD** | `tdd-guide-low` | `tdd-guide` | - |
-| **Code Review** | `code-reviewer-low` | - | `code-reviewer` |
+## What Ultrawork Does NOT Provide
 
-### Tier Selection Guide
+- **Persistence**: Use `ralph` for "don't stop until done" behavior
+- **Verification Loop**: Use `ralph` for mandatory architect verification
+- **State Management**: Use `ralph` or `autopilot` for session persistence
 
-| Task Complexity | Tier | Examples |
-|-----------------|------|----------|
-| Simple lookups | LOW | "What does this function return?", "Find where X is defined" |
-| Standard work | MEDIUM | "Add error handling", "Implement this feature" |
-| Complex analysis | HIGH | "Debug this race condition", "Refactor auth module across 5 files" |
+## Usage
 
-### Routing Examples
+Ultrawork is automatically activated by:
+- `ralph` (for persistent parallel work)
+- `autopilot` (for autonomous parallel work)
+- Direct invocation when you want parallel-only execution with manual oversight
 
-**CRITICAL: Always pass `model` parameter explicitly - Claude Code does NOT auto-apply models from agent definitions!**
+## Smart Model Routing
 
+**FIRST ACTION:** Before delegating any work, read the agent reference file:
 ```
-// Simple question → LOW tier (saves tokens!)
-Task(subagent_type="oh-my-claudecode:architect-low", model="haiku", prompt="What does this function return?")
-
-// Standard implementation → MEDIUM tier
-Task(subagent_type="oh-my-claudecode:executor", model="sonnet", prompt="Add error handling to login")
-
-// Complex refactoring → HIGH tier
-Task(subagent_type="oh-my-claudecode:executor-high", model="opus", prompt="Refactor auth module using JWT across 5 files")
+Read file: docs/shared/agent-tiers.md
+```
+This provides the complete agent tier matrix, MCP tool assignments, and selection guidance.
 
-// Quick file lookup → LOW tier
-Task(subagent_type="oh-my-claudecode:explore", model="haiku", prompt="Find where UserService is defined")
+**CRITICAL: Always pass `model` parameter explicitly!**
 
-// Thorough search → MEDIUM tier
-Task(subagent_type="oh-my-claudecode:explore-medium", model="sonnet", prompt="Find all authentication patterns in the codebase")
+```
+Task(subagent_type="oh-my-claudecode:architect-low", model="haiku", prompt="...")
+Task(subagent_type="oh-my-claudecode:executor", model="sonnet", prompt="...")
+Task(subagent_type="oh-my-claudecode:architect", model="opus", prompt="...")
 ```
 
 ## Background Execution Rules
@@ -74,32 +48,48 @@ Task(subagent_type="oh-my-claudecode:explore-medium", model="sonnet", prompt="Fi
 - Package installation: npm install, pip install, cargo build
 - Build processes: npm run build, make, tsc
 - Test suites: npm test, pytest, cargo test
-- Docker operations: docker build, docker pull
 
 **Run Blocking** (foreground):
 - Quick status checks: git status, ls, pwd
 - File reads, edits
 - Simple commands
 
-## Verification Checklist
+## Relationship to Other Modes
 
-Before stopping, verify:
-- [ ] TODO LIST: Zero pending/in_progress tasks
-- [ ] FUNCTIONALITY: All requested features work
-- [ ] TESTS: All tests pass (if applicable)
-- [ ] ERRORS: Zero unaddressed errors
+```
+ralph (persistence wrapper)
+└── includes: ultrawork (this skill)
+    └── provides: parallel execution only
+
+autopilot (autonomous execution)
+└── includes: ralph
+    └── includes: ultrawork (this skill)
 
-**If ANY checkbox is unchecked, CONTINUE WORKING.**
+ecomode (token efficiency)
+└── modifies: ultrawork's model selection
+```
 
-## STATE CLEANUP ON COMPLETION
+## When to Use Ultrawork Directly
 
-**IMPORTANT: Delete state files on completion - do NOT just set `active: false`**
+Use ultrawork directly when you want:
+- Parallel execution without persistence guarantees
+- Manual oversight over completion
+- Quick parallel tasks where you'll verify yourself
 
-When all verification passes and work is complete:
+Use `ralph` instead when you want:
+- Verified completion (architect check)
+- Automatic retry on failure
+- Session persistence for resume
 
-```bash
-# Delete ultrawork state files
-rm -f .omc/state/ultrawork-state.json
-```
+## Completion Verification (Direct Invocations)
+
+When ultrawork is invoked directly (not via ralph), apply lightweight verification before claiming completion:
+
+### Quick Verification Checklist
+- [ ] **BUILD:** `tsc --noEmit` or equivalent passes
+- [ ] **TESTS:** Run affected tests, all pass
+- [ ] **ERRORS:** No new errors introduced
+
+This is lighter than ralph's full verification but ensures basic quality for direct ultrawork usage.
 
-This ensures clean state for future sessions. Stale state files with `active: false` should not be left behind.
+For full persistence and comprehensive verification, use `ralph` mode instead.

package/templates/hooks/keyword-detector.mjs

@@ -24,8 +24,15 @@
  */
 
 import { writeFileSync, mkdirSync, existsSync, unlinkSync } from 'fs';
-import { join } from 'path';
+import { join, dirname } from 'path';
 import { homedir } from 'os';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+// Dynamic import for the shared stdin module
+const { readStdin } = await import(join(__dirname, 'lib', 'stdin.mjs'));
 
 const ULTRATHINK_MESSAGE = `<think-mode>
 
@@ -44,15 +51,6 @@ Use your extended thinking capabilities to provide the most thorough and well-re
 ---
 `;
 
-// Read all stdin
-async function readStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(chunk);
-  }
-  return Buffer.concat(chunks).toString('utf-8');
-}
-
 // Extract prompt from various JSON structures
 function extractPrompt(input) {
   try {
@@ -73,10 +71,20 @@ function extractPrompt(input) {
   }
 }
 
-// Remove code blocks to prevent false positives
-function removeCodeBlocks(text) {
+// Sanitize text to prevent false positives from code blocks, XML tags, URLs, and file paths
+function sanitizeForKeywordDetection(text) {
   return text
+    // 1. Strip XML-style tag blocks: <tag-name ...>...</tag-name> (multi-line, greedy on tag name)
+    .replace(/<(\w[\w-]*)[\s>][\s\S]*?<\/\1>/g, '')
+    // 2. Strip self-closing XML tags: <tag-name />, <tag-name attr="val" />
+    .replace(/<\w[\w-]*(?:\s[^>]*)?\s*\/>/g, '')
+    // 3. Strip URLs: http://... or https://... up to whitespace
+    .replace(/https?:\/\/[^\s)>\]]+/g, '')
+    // 4. Strip file paths: /foo/bar/baz or foo/bar/baz (using lookbehind to avoid consuming leading char)
+    .replace(/(?<=^|[\s"'`(])(?:\/)?(?:[\w.-]+\/)+[\w.-]+/gm, '')
+    // 5. Strip markdown code blocks (existing)
     .replace(/```[\s\S]*?```/g, '')
+    // 6. Strip inline code (existing)
     .replace(/`[^`]+`/g, '');
 }
 
@@ -225,7 +233,7 @@ async function main() {
       return;
     }
 
-    const cleanPrompt = removeCodeBlocks(prompt).toLowerCase();
+    const cleanPrompt = sanitizeForKeywordDetection(prompt).toLowerCase();
 
     // Collect all matching keywords
     const matches = [];