npm - openwolf-enhanced - Versions diffs - 1.28.0 → 1.29.0 - Mend

openwolf-enhanced 1.28.0 → 1.29.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (61) hide show

package/dist/dashboard/index.html CHANGED Viewed

@@ -7,7 +7,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="./assets/index-C74qneS9.js"></script>
+    <script type="module" crossorigin src="./assets/index-D5e2y39w.js"></script>
     <link rel="stylesheet" crossorigin href="./assets/index-BNi8lsJE.css">
   </head>
   <body>

package/dist/hooks/post-write.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getWolfDir, ensureWolfDir, writeJSON, writeAtomic, parseAnatomy, serializeAnatomy, extractDescription, estimateFileTokens, getTokenRatios, appendMarkdown, timeShort, readStdin, normalizePath, getRetention, loadIgnore, readBugLog, isSecretFile, updateSession, isOutsideProject, tryWithLock, sessionFileFor } from "./shared.js";
+import { getWolfDir, ensureWolfDir, writeJSON, writeAtomic, parseAnatomy, serializeAnatomy, extractDescription, estimateFileTokens, getTokenRatios, appendMarkdown, timeShort, readStdin, normalizePath, getRetention, loadIgnore, readBugLog, isSecretFile, updateSession, isOutsideProject, tryWithLock, sessionFileFor, capBuglogWithArchive } from "./shared.js";
 async function main() {
     ensureWolfDir();
     const wolfDir = getWolfDir();
@@ -320,9 +320,13 @@ function autoDetectBugFix(wolfDir, absolutePath, projectRoot, oldStr, newStr) {
             last_seen: new Date().toISOString(),
         });
         // Keep buglog.json bounded — auto-detection can otherwise append on nearly every edit.
+        // Overflow is MOVED to buglog-archive.json, never dropped: the old slice(-max) deleted the
+        // oldest curated entries, which are the ones other files cite by id.
         const maxBugs = getRetention(wolfDir).buglog_max_entries;
-        if (bugLog.bugs.length > maxBugs) {
-            bugLog.bugs = bugLog.bugs.slice(-maxBugs);
+        const capped = capBuglogWithArchive(wolfDir, bugLog.bugs, maxBugs);
+        if (capped.archived.length) {
+            bugLog.bugs = capped.kept;
+            process.stderr.write(`[openwolf] buglog over ${maxBugs} entries — moved ${capped.archived.length} to buglog-archive.json\n`);
         }
         writeJSON(bugLogPath, bugLog);
     });

package/dist/hooks/pre-write.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getWolfDir, ensureWolfDir, readJSON, writeJSON, readMarkdown, readStdin, readBugLog, tryWithLock, sessionFileFor } from "./shared.js";
+import { getWolfDir, ensureWolfDir, readJSON, writeJSON, readMarkdown, readStdin, readBugLog, tryWithLock, sessionFileFor, extractMarkdownSection } from "./shared.js";
 async function main() {
     ensureWolfDir();
     const wolfDir = getWolfDir();
@@ -46,18 +46,23 @@ async function main() {
     }
     process.exit(0);
 }
+// One write should never produce a wall of warnings; the first few are the useful ones.
+const MAX_CEREBRUM_WARNINGS = 3;
 function checkCerebrum(wolfDir, content) {
     const cerebrumContent = readMarkdown(path.join(wolfDir, "cerebrum.md"));
-    const doNotRepeatSection = cerebrumContent.split("## Do-Not-Repeat")[1];
-    if (!doNotRepeatSection)
+    // Anchored heading lookup, not a substring: an entry that quotes "## Do-Not-Repeat" inside its
+    // own prose used to win the split and reduce this check to a handful of unrelated bullets.
+    const entries = extractMarkdownSection(cerebrumContent, /^#{2,3}\s*Do[-\s]?Not[-\s]?Repeat/i);
+    if (!entries)
         return 0;
-    const entries = doNotRepeatSection.split("## ")[0];
     const lines = entries.split("\n").filter((l) => l.trim().startsWith("[") || l.trim().startsWith("-"));
     let fired = 0;
     for (const line of lines) {
         const trimmed = line.trim().replace(/^[-*]\s*/, "").replace(/^\[[\d-]+\]\s*/, "");
         if (!trimmed)
             continue;
+        if (fired >= MAX_CEREBRUM_WARNINGS)
+            break;
         const patterns = [];
         const quotedMatches = trimmed.match(/"([^"]+)"/g) || trimmed.match(/'([^']+)'/g) || trimmed.match(/`([^`]+)`/g);
         if (quotedMatches) {
@@ -69,6 +74,10 @@ function checkCerebrum(wolfDir, content) {
         if (neverMatch)
             patterns.push(neverMatch[1]);
         for (const pattern of patterns) {
+            // Anything shorter than four characters ("id", "os", "npm") matches almost any file and
+            // would turn a correctly-scoped section into a warning machine.
+            if (pattern.trim().length < 4)
+                continue;
             try {
                 const regex = new RegExp(`\\b${pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`, "i");
                 if (regex.test(content)) {

package/dist/hooks/session-start.js CHANGED Viewed

@@ -97,7 +97,14 @@ async function main() {
         // starts must not clobber the read-modify-write.
         const ledgerPath = path.join(wolfDir, "token-ledger.json");
         tryWithLock(ledgerPath, () => {
-            const ledger = readJSON(ledgerPath, { version: 1, lifetime: { total_sessions: 0 } });
+            // The full shape, including `sessions: []`. Writing the stub without it used to poison the
+            // file: the stop hook reads it (it exists now, so no default applies) and died in
+            // `ledger.sessions.findIndex` on every turn of every session until someone fixed it by hand.
+            const ledger = readJSON(ledgerPath, { version: 1, sessions: [], lifetime: { total_sessions: 0 } });
+            if (!Array.isArray(ledger.sessions))
+                ledger.sessions = [];
+            if (!ledger.lifetime || typeof ledger.lifetime !== "object")
+                ledger.lifetime = { total_sessions: 0 };
             ledger.lifetime.total_sessions++;
             writeJSON(ledgerPath, ledger);
         });

package/dist/hooks/shared.js CHANGED Viewed

@@ -99,19 +99,51 @@ export class LockTimeoutError extends Error {
         this.name = "LockTimeoutError";
     }
 }
+/**
+ * The lock could not be taken for a reason that waiting will not fix — a missing directory we
+ * could not create, a read-only filesystem, no permission. Extends LockTimeoutError on purpose:
+ * every caller already treats that as "skip the update and say so", which is exactly right here
+ * too, and a hook must never die on it (see tryWithLock).
+ */
+export class LockUnavailableError extends LockTimeoutError {
+    code;
+    constructor(targetPath, code) {
+        super(targetPath, 0);
+        this.code = code;
+        this.message = `could not acquire the lock on ${path.basename(targetPath)} (${code}) — update skipped`;
+        this.name = "LockUnavailableError";
+    }
+}
 function sleepSync(ms) {
     try {
         Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
     }
     catch { /* no-op */ }
 }
+/**
+ * Is the lock file old enough to be considered abandoned?
+ *
+ * Age only. A pid liveness check was tried here and REMOVED on purpose: pids are recycled, so a
+ * lock left behind by a dead process whose number now belongs to an unrelated one would never be
+ * reclaimable again — a permanent lockout in exchange for a clock-skew problem nobody measured.
+ * Losing a lock occasionally beats never getting it back. The real defect was that reclaiming was
+ * not atomic; that is fixed at the call site.
+ */
+function isStaleLock(lockPath, staleMs) {
+    return Date.now() - fs.statSync(lockPath).mtimeMs > staleMs;
+}
 export function withLock(targetPath, fn) {
     const lockPath = targetPath + ".lock";
     const MAX_WAIT_MS = 1500; // well inside the tightest hook budget (5s)
     const STALE_MS = 5000;
+    // A lock that vanishes between our open and our stat is worth retrying at once — but only a few
+    // times. Without a bound, any error we did not anticipate turns the retry into a busy-loop that
+    // saturates a core for the whole budget and then fails anyway (bug-352).
+    const MAX_IMMEDIATE_RETRIES = 8;
     const start = Date.now();
     let held = false;
     let backoff = 2;
+    let immediateRetries = 0;
     while (Date.now() - start < MAX_WAIT_MS) {
         try {
             const fd = fs.openSync(lockPath, "wx");
@@ -123,16 +155,50 @@ export function withLock(targetPath, fn) {
             held = true;
             break;
         }
-        catch {
+        catch (openErr) {
+            const code = openErr?.code;
+            // EEXIST is the only failure that means "somebody else holds it" — the one case where
+            // waiting can help. Everything else is a property of the filesystem, not of a competitor,
+            // and will still be true in 1500ms, so spinning on it burns CPU to reach a certain failure.
+            if (code !== "EEXIST") {
+                // The one recoverable non-EEXIST case: the directory does not exist yet. The caller is
+                // about to write into it anyway, so create it and try once more.
+                if (code === "ENOENT" && immediateRetries < MAX_IMMEDIATE_RETRIES) {
+                    immediateRetries++;
+                    try {
+                        fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+                        continue;
+                    }
+                    catch { /* fall through */ }
+                }
+                throw new LockUnavailableError(targetPath, code ?? "UNKNOWN");
+            }
             try {
-                if (Date.now() - fs.statSync(lockPath).mtimeMs > STALE_MS) {
-                    fs.unlinkSync(lockPath);
+                if (isStaleLock(lockPath, STALE_MS)) {
+                    // Claim the stale lock ATOMICALLY. `unlink` + create is not: B stats the old lock, A
+                    // removes it and creates a fresh one, B then removes A's FRESH lock and creates its own
+                    // — and both run the critical section. Measured with 20 processes and one stale lock
+                    // left behind: 12 lost updates in 8 rounds, and 0 without it. Only the process whose
+                    // rename succeeds may remove the file; everyone else falls through and waits.
+                    const claim = `${lockPath}.stale-${process.pid}-${Date.now()}`;
+                    try {
+                        fs.renameSync(lockPath, claim);
+                        fs.unlinkSync(claim);
+                    }
+                    catch { /* somebody claimed it first */ }
                     continue;
                 }
             }
             catch {
+                // Lock vanished between open and stat — retry immediately, but never unboundedly.
+                if (immediateRetries < MAX_IMMEDIATE_RETRIES) {
+                    immediateRetries++;
+                    continue;
+                }
+                sleepSync(backoff);
+                backoff = Math.min(backoff * 2, 50);
                 continue;
-            } // lock vanished — retry immediately
+            }
             sleepSync(backoff);
             backoff = Math.min(backoff * 2, 50);
         }
@@ -559,7 +625,14 @@ export function compactMemoryIfLarge(wolfDir, maxBytes) {
     flush();
     if (!changed)
         return;
-    writeAtomic(p, () => out.join("\n"));
+    // Same lock as appendMarkdown: without it an append landing between the read above and this
+    // rename is written to the old inode and vanishes.
+    try {
+        withLock(p, () => writeAtomic(p, () => out.join("\n")));
+    }
+    catch {
+        writeAtomic(p, () => out.join("\n"));
+    }
 }
 export function readBugLog(wolfDir) {
     const raw = readJSON(path.join(wolfDir, "buglog.json"), { version: 1, bugs: [] });
@@ -568,6 +641,50 @@ export function readBugLog(wolfDir) {
     const o = (raw ?? {});
     return { version: o.version ?? 1, bugs: Array.isArray(o.bugs) ? o.bugs : [] };
 }
+/**
+ * Cap buglog.json WITHOUT losing anything.
+ *
+ * The old `bugs.slice(-max)` cut from the front, so it deleted the OLDEST hand-written entries —
+ * exactly the ones other knowledge files cite by id ("see bug-084"). On a real project that had
+ * grown to 295 curated entries against a cap of 200, a single auto-detected fix would have thrown
+ * away 95 of them with no message. A cross-referenced logbook must never lose an entry; it may
+ * only move it somewhere the citation can still be resolved.
+ *
+ * Overflow now goes to `.wolf/buglog-archive.json`. Auto-detected noise is spent first (it is
+ * regenerable), curated entries only once that is exhausted — and even those are archived, not
+ * dropped. The archive is append-only and deduplicated by id; it is meant to grow.
+ */
+export function capBuglogWithArchive(wolfDir, bugs, max) {
+    if (!Array.isArray(bugs) || bugs.length <= max || max < 0)
+        return { kept: bugs, archived: [] };
+    const isAuto = (b) => Array.isArray(b.tags) && b.tags.includes("auto-detected");
+    const overflow = bugs.length - max;
+    const drop = new Set();
+    for (let i = 0; i < bugs.length && drop.size < overflow; i++)
+        if (isAuto(bugs[i]))
+            drop.add(i);
+    for (let i = 0; i < bugs.length && drop.size < overflow; i++)
+        drop.add(i);
+    const kept = bugs.filter((_, i) => !drop.has(i));
+    const archived = bugs.filter((_, i) => drop.has(i));
+    appendBuglogArchive(wolfDir, archived);
+    return { kept, archived };
+}
+/** Append entries to `.wolf/buglog-archive.json`, skipping ids that are already in there. */
+export function appendBuglogArchive(wolfDir, entries) {
+    if (!entries.length)
+        return 0;
+    const p = path.join(wolfDir, "buglog-archive.json");
+    const raw = readJSON(p, { version: 1, bugs: [] });
+    const o = Array.isArray(raw) ? { version: 1, bugs: raw } : (raw ?? {});
+    const existing = Array.isArray(o.bugs) ? o.bugs : [];
+    const seen = new Set(existing.map((b) => String(b.id)));
+    const added = entries.filter((b) => !seen.has(String(b.id)));
+    if (!added.length)
+        return 0;
+    writeJSON(p, { version: o.version ?? 1, bugs: [...existing, ...added] });
+    return added.length;
+}
 export function readMarkdown(filePath) {
     try {
         return fs.readFileSync(filePath, "utf-8");
@@ -576,11 +693,64 @@ export function readMarkdown(filePath) {
         return "";
     }
 }
+/**
+ * Append a line, under the same lock the compactors take.
+ *
+ * A bare `appendFileSync` races the tmp+rename of `compactMemoryIfLarge` and `consolidateMemory`:
+ * an append that lands between their read and their rename goes to the old inode and disappears
+ * with it. Both sides "work", the line is simply gone. If the lock cannot be had we still append —
+ * a rare race beats losing the line outright, which is what happens if we give up here.
+ */
 export function appendMarkdown(filePath, line) {
     const dir = path.dirname(filePath);
     if (!fs.existsSync(dir))
         fs.mkdirSync(dir, { recursive: true });
-    fs.appendFileSync(filePath, line, "utf-8");
+    const write = () => fs.appendFileSync(filePath, line, "utf-8");
+    try {
+        withLock(filePath, write);
+    }
+    catch {
+        write();
+    }
+}
+/**
+ * Replace `previousLine` with `line`, or append if it is not there.
+ *
+ * The stop hook runs on EVERY turn and its numbers are cumulative for the whole session, so
+ * appending produced one near-identical "Session end" row per turn — 232 rows for 173 sessions in
+ * one real project, six of them consecutive and differing only in the timestamp. The ledger has
+ * replaced-by-id since 1.28.0; memory.md now does the same thing with the line itself as the key.
+ */
+export function replaceOrAppendMarkdown(filePath, previousLine, line) {
+    if (!previousLine) {
+        appendMarkdown(filePath, line);
+        return;
+    }
+    const swap = () => {
+        let content;
+        try {
+            content = fs.readFileSync(filePath, "utf-8");
+        }
+        catch {
+            fs.appendFileSync(filePath, line, "utf-8");
+            return;
+        }
+        const at = content.lastIndexOf(previousLine);
+        if (at === -1) {
+            fs.appendFileSync(filePath, line, "utf-8");
+            return;
+        }
+        writeAtomic(filePath, () => content.slice(0, at) + line + content.slice(at + previousLine.length));
+    };
+    try {
+        withLock(filePath, swap);
+    }
+    catch {
+        try {
+            swap();
+        }
+        catch { /* memory.md is a nicety */ }
+    }
 }
 export function parseAnatomy(content) {
     const sections = new Map();
@@ -1176,14 +1346,38 @@ export function timeShort() {
     const d = new Date();
     return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
 }
+/**
+ * Read the hook payload from stdin.
+ *
+ * Every hook starts here, so this function sets the floor for hook latency — and under Bun it was
+ * the whole story. Measured on this repo: Bun starts a trivial script in 9ms against Node's 23ms,
+ * but reading stdin through the Node stream shim costs Bun ~15ms and Node ~2ms, which cancelled
+ * the entire runtime advantage (Bun 23ms vs Node 24ms for start+stdin). Bun's own
+ * `Bun.stdin.text()` does the same job in ~1ms, taking the floor to 8ms.
+ *
+ * So: a Bun fast path, and the Node path left exactly as it was — switching Node to
+ * `readFileSync(0)` measured no better (26ms vs 25ms) and would risk the blocking-read edge cases
+ * for nothing.
+ *
+ * The 4s guard applies to both. It is not decoration: on Windows, stdin delivery from Claude Code
+ * hooks can lag, and a hook that never resolves takes the tool call with it.
+ */
+const STDIN_TIMEOUT_MS = 4000;
 export function readStdin() {
+    const bunStdin = globalThis.Bun?.stdin;
+    if (typeof bunStdin?.text === "function") {
+        return Promise.race([
+            bunStdin.text().then((t) => t || "{}").catch(() => "{}"),
+            new Promise((resolve) => setTimeout(() => resolve("{}"), STDIN_TIMEOUT_MS)),
+        ]);
+    }
     return new Promise((resolve) => {
         const chunks = [];
         process.stdin.on("data", (chunk) => chunks.push(chunk));
         process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
         // If no stdin data after 4s, resolve with whatever we have so far.
         // On Windows, stdin delivery from Claude Code hooks can be slow.
-        setTimeout(() => resolve(chunks.length ? Buffer.concat(chunks).toString("utf-8") : "{}"), 4000);
+        setTimeout(() => resolve(chunks.length ? Buffer.concat(chunks).toString("utf-8") : "{}"), STDIN_TIMEOUT_MS);
     });
 }
 export function normalizePath(p) {
@@ -1352,6 +1546,16 @@ export function stripPrivate(text) {
 export function blankPrivate(text) {
     return redact(text, (m) => m.replace(/[^\n]/g, ""));
 }
+/**
+ * Same redaction, but the block is replaced by a visible marker.
+ *
+ * For a reader — the dashboard, a file viewer — silently deleting the region is worse than saying
+ * that something is hidden: the reader cannot tell an empty section from a redacted one. Recall and
+ * every egress path keep using strip/blankPrivate; this one is for display.
+ */
+export function maskPrivate(text) {
+    return redact(text, () => "[private — hidden by OpenWolf]");
+}
 // Structured session-summary scaffold written under each new session header in memory.md.
 // An HTML comment → invisible in rendered markdown (no clutter), but a clear prompt for the
 // agent to replace at session end with a consistent, greppable one-liner (see OPENWOLF.md).
@@ -1371,7 +1575,14 @@ function isStatusStub(s) {
     return /\{\{PROJECT_NAME\}\}/.test(s) || (/_<[^>]*>_/.test(s) && /nothing yet/.test(s));
 }
 // Body of a markdown section identified by its heading, up to the next h1/h2 heading.
-function extractMarkdownSection(md, headingRe) {
+/**
+ * Body of the first section whose heading matches `headingRe`, up to the next heading of the same
+ * or a higher level. Exported because pre-write.ts needs the SAME anchored lookup: it used to find
+ * its section with `split("## Do-Not-Repeat")`, a plain substring, which on a large cerebrum.md
+ * matched a sentence that merely quoted the heading name — and then scanned 5 unrelated bullets
+ * instead of the 175 real entries, silently, for as long as the file had grown.
+ */
+export function extractMarkdownSection(md, headingRe) {
     const lines = md.split(/\r?\n/);
     let start = -1;
     for (let i = 0; i < lines.length; i++) {
@@ -1382,9 +1593,11 @@ function extractMarkdownSection(md, headingRe) {
     }
     if (start === -1)
         return "";
+    const level = (lines[start].match(/^#+/)?.[0].length) ?? 2;
     const body = [];
     for (let i = start + 1; i < lines.length; i++) {
-        if (/^#{1,2}\s/.test(lines[i]))
+        const m = lines[i].match(/^(#{1,6})\s/);
+        if (m && m[1].length <= level)
             break;
         body.push(lines[i]);
     }
@@ -1422,11 +1635,30 @@ function memoryHeadline(md) {
 const BULLET_RE = /^\s*[-*] /gm;
 // Index of knowledge files the model can pull on demand, with entry counts and token cost —
 // so it knows what's available without us pre-dumping it (progressive disclosure).
+/** `openwolf.cerebrum.max_tokens` from config.json, with the template's own default. */
+function cerebrumBudget(read) {
+    try {
+        const cfg = JSON.parse(read("config.json"));
+        const v = cfg.openwolf?.cerebrum?.max_tokens;
+        if (typeof v === "number" && v > 0)
+            return v;
+    }
+    catch { /* no config, or not JSON */ }
+    return 2000;
+}
 function availabilityIndex(read, cerebrum, nativeDir) {
     const items = [];
     if (cerebrum.trim()) {
         const entries = (cerebrum.match(BULLET_RE) || []).length;
-        items.push(`- cerebrum.md — ${entries} entries, ~${estimateTokens(cerebrum, "prose")} tok (preferences, learnings, decisions, do-not-repeat) → Read or \`openwolf recall\``);
+        const tok = estimateTokens(cerebrum, "prose");
+        // `cerebrum.max_tokens` existed in every generated config.json since forever and was read by
+        // nothing at all. Meanwhile OPENWOLF.md tells the model to read the whole file — which on a
+        // grown project is ~126k tokens, 63× the configured budget. Honour the budget here: past it,
+        // "Read" stops being offered and recall is the only route.
+        const budget = cerebrumBudget(read);
+        items.push(tok > budget
+            ? `- cerebrum.md — ${entries} entries, ~${tok} tok — TOO LARGE TO READ (budget ${budget}); use \`openwolf recall <query>\`, not Read`
+            : `- cerebrum.md — ${entries} entries, ~${tok} tok (preferences, learnings, decisions, do-not-repeat) → Read or \`openwolf recall\``);
     }
     const buglog = read("buglog.json");
     if (buglog.trim()) {

package/dist/hooks/stop.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getWolfDir, ensureWolfDir, readJSON, writeJSON, appendMarkdown, timeShort, getRetention, compactMemoryIfLarge, countSemanticEntries, tryWithLock, updateSession, sessionFileFor, readStdin, readTranscriptUsage, detectAgent, bookInjection } from "./shared.js";
+import { getWolfDir, ensureWolfDir, readJSON, writeJSON, replaceOrAppendMarkdown, timeShort, getRetention, compactMemoryIfLarge, countSemanticEntries, tryWithLock, updateSession, sessionFileFor, readStdin, readTranscriptUsage, detectAgent, bookInjection } from "./shared.js";
 import { estimateTokens, getTokenRatios } from "./token-estimator.js";
 const NOTHING_BOOKED = {
     reads: 0, writes: 0, tokens: 0, anatomy_hits: 0, anatomy_misses: 0, repeated_reads_blocked: 0,
@@ -28,7 +28,14 @@ async function main() {
     // session into the ledger, so reading a different session's file here would attribute one
     // session's whole turn to another.
     const sessionFile = sessionFileFor(hooksDir, hookInput.session_id);
-    const session = readJSON(sessionFile, {
+    // NORMALISE, do not assume. readJSON only applies these defaults when the file is MISSING —
+    // but post-bash, pre-write and post-read each create the file with their OWN partial shape when
+    // they run first (`{files_written:[], edit_counts:{}}`, `{}`), which happens whenever the
+    // session predates an `openwolf update` or session-start skipped its write under contention.
+    // `Object.keys(session.files_read)` then threw, main().catch() swallowed it, and the whole
+    // session produced no ledger entry, no memory.md line and no reminder — without one line of
+    // output. A real project carried such a file for days.
+    const SESSION_DEFAULTS = {
         session_id: "",
         started: "",
         files_read: {},
@@ -39,7 +46,15 @@ async function main() {
         repeated_reads_warned: 0,
         cerebrum_warnings: 0,
         stop_count: 0,
-    });
+    };
+    const stored = readJSON(sessionFile, {});
+    const session = { ...SESSION_DEFAULTS, ...stored };
+    if (!session.files_read || typeof session.files_read !== "object")
+        session.files_read = {};
+    if (!Array.isArray(session.files_written))
+        session.files_written = [];
+    if (!session.edit_counts || typeof session.edit_counts !== "object")
+        session.edit_counts = {};
     session.stop_count++;
     // Only write to ledger if there's been activity
     const readCount = Object.keys(session.files_read).length;
@@ -96,7 +111,10 @@ async function main() {
     // the ledger lock — it's a plain file read; only the accumulation below runs under the lock.
     const realUsage = hookInput.transcript_path ? readTranscriptUsage(hookInput.transcript_path) : null;
     const sessionEntry = {
-        id: session.session_id,
+        // The harness session id, not the minute-granular one from session-start: two sessions started
+        // in the same minute shared an id, and this hook REPLACES by id — so the second one's stop
+        // overwrote the first one's entry while total_sessions still counted both.
+        id: hookInput.session_id || session.session_id,
         agent: detectAgent(),
         started: session.started,
         ended: new Date().toISOString(),
@@ -151,6 +169,10 @@ async function main() {
         }
         // One entry per session, not per turn: the entry carries the session's cumulative state, so a
         // later stop REPLACES the earlier one instead of appending a near-duplicate under the same id.
+        // session-start writes a `{version, lifetime}` stub when the ledger is missing; without this
+        // guard every stop hook from then on died in findIndex — silently, for good.
+        if (!Array.isArray(ledger.sessions))
+            ledger.sessions = [];
         const existing = ledger.sessions.findIndex((s) => s.id === sessionEntry.id);
         if (existing === -1)
             ledger.sessions.push(sessionEntry);
@@ -164,12 +186,17 @@ async function main() {
         const booked = { ...NOTHING_BOOKED, ...(session.booked ?? {}) };
         const totalWritesNow = writeCount + unnamedWrites;
         const tokensNow = inputTokens + outputTokens;
-        // Estimate savings: anatomy hits save ~200 tokens each, repeated reads blocked save their token count
-        const savedFromAnatomy = session.anatomy_hits * 200;
-        const savedFromRepeats = Object.values(session.files_read)
-            .filter((r) => r.count > 1)
-            .reduce((sum, r) => sum + r.tokens * (r.count - 1), 0);
-        const savingsNow = savedFromAnatomy + savedFromRepeats;
+        // Savings, counted honestly.
+        //
+        // This used to credit ~200 tokens per anatomy hit and the FULL file size for every repeated read
+        // — as if both had been prevented. Neither is true: those hints go to stderr with exit 0, which
+        // the model never sees, and no read is ever blocked. A report that invents its own credit is
+        // worse than no report, so only genuinely avoided tokens are booked. `repeated_reads_warned`
+        // and `anatomy_hits` are still recorded; they are counters, not savings.
+        //
+        // What IS avoided: nothing measurable from the hooks today. The honest number is zero until a
+        // hint actually reaches the model (via additionalContext) or a read is actually prevented.
+        const savingsNow = 0;
         ledger.lifetime.total_reads += delta(readCount, booked.reads);
         // Unnamed writes (shell / other working dirs) count toward the lifetime total — they were real
         // work. They stay OUT of the session's named writes[] list (no path was recorded, by design).
@@ -227,6 +254,7 @@ async function main() {
     });
     // Write a session summary line to memory.md if there was meaningful activity
     const memoryPath = path.join(wolfDir, "memory.md");
+    let memoryLineNow = session.memory_line ?? "";
     // A session that wrote only through the shell, or only in another directory, still happened.
     // Without this, memory.md shows a gap exactly where the work was — which is how someone later
     // concludes the day was quiet.
@@ -236,7 +264,9 @@ async function main() {
                 externalWrites > 0 ? `${externalWrites} outside this project root` : "",
                 bashWrites > 0 ? `${bashWrites} through the shell` : "",
             ].filter(Boolean).join(", ");
-            appendMarkdown(memoryPath, `| ${timeShort()} | Session end: ${unnamedWrites} untracked writes (${via}) | ${readCount} reads | ~${inputTokens + outputTokens} tok |\n`);
+            const line = `| ${timeShort()} | Session end: ${unnamedWrites} untracked writes (${via}) | ${readCount} reads | ~${inputTokens + outputTokens} tok |\n`;
+            replaceOrAppendMarkdown(memoryPath, session.memory_line ?? "", line);
+            memoryLineNow = line;
         }
         catch { /* memory.md is a nicety, not a dependency */ }
     }
@@ -244,7 +274,16 @@ async function main() {
         try {
             const uniqueFiles = new Set(session.files_written.map(w => path.basename(w.file)));
             const fileList = [...uniqueFiles].slice(0, 5).join(", ");
-            appendMarkdown(memoryPath, `| ${timeShort()} | Session end: ${writeCount} writes across ${uniqueFiles.size} files (${fileList}) | ${readCount} reads | ~${inputTokens + outputTokens} tok |\n`);
+            const line = `| ${timeShort()} | Session end: ${writeCount} writes across ${uniqueFiles.size} files (${fileList}) | ${readCount} reads | ~${inputTokens + outputTokens} tok |\n`;
+            replaceOrAppendMarkdown(memoryPath, session.memory_line ?? "", line);
+            memoryLineNow = line;
+        }
+        catch { }
+    }
+    // Remember the row we just wrote so the next turn replaces it instead of adding another.
+    if (memoryLineNow !== (session.memory_line ?? "")) {
+        try {
+            updateSession(sessionFile, session, (t) => { t.memory_line = memoryLineNow; });
         }
         catch { }
     }
@@ -344,4 +383,12 @@ function checkSemanticSummaries(wolfDir, writeCount) {
         return null;
     return `${writeCount} files were changed this session but no meaningful summary was written to memory.md. Consider recording what you did and why.`;
 }
-main().catch(() => process.exit(0));
+// A hook must never fail the turn — but it must not disappear either. Swallowing the error is how
+// a broken session file cost a whole session's bookkeeping without a trace.
+main().catch((err) => {
+    try {
+        process.stderr.write(`[openwolf] stop hook failed: ${err?.stack || err?.message || String(err)}\n`);
+    }
+    catch { /* stderr gone too — nothing left to do */ }
+    process.exit(0);
+});

package/dist/src/cli/doctor-cmd.js CHANGED Viewed

@@ -133,8 +133,10 @@ export async function doctorCommand(opts) {
         if (nd) {
             const h = nativeMemoryHealth(nd);
             console.log("\nClaude native memory (~/.claude/…/memory):");
-            console.log(`  ${h.topicFiles} topic files, ${humanBytes(h.footprintBytes)}; MEMORY.md index ${h.indexLines} lines (${h.indexedCount} referenced)`);
-            if (h.indexCutoffExceeded)
+            console.log(`  ${h.topicFiles} topic files, ${humanBytes(h.footprintBytes)}; MEMORY.md index ${h.indexLines} lines / ${humanBytes(h.indexBytes)} (${h.indexedCount} referenced)`);
+            if (h.indexBytesExceeded)
+                console.log(`  ⚠ MEMORY.md is ${humanBytes(h.indexBytes)} — Claude Code stops loading it at ~24 KB, so the tail never reaches a session. Shorten the entries (one line, well under 200 chars each).`);
+            else if (h.indexCutoffExceeded)
                 console.log(`  ⚠ MEMORY.md > 200 lines — only the first 200 load at session start; the rest is invisible until you trim it.`);
             if (h.orphanCount)
                 console.log(`  ⚠ ${h.orphanCount} topic files not in the index → never surface on resume. Search them: \`openwolf recall <query>\``);