wogiflow 2.17.0 → 2.18.0

package/scripts/flow-migrate-igr.js

@@ -50,7 +50,7 @@ const REQUIRED_IGR_SCRIPTS = [
 ];
 
 const REQUIRED_PERSONAS = ['logic-adversary.md', 'architect.md'];
-const REQUIRED_RUBRICS = ['logic-constitution-v1.md', 'logic-constitution-v2.md'];
+const REQUIRED_RUBRICS = ['logic-constitution-v1.md', 'logic-constitution-v2.md', 'logic-constitution-v3.md'];
 
 // ARCH-002 fix (2026-04-13): use shared parseArgs from flow-cli-utils
 const { parseArgs } = require('./flow-cli-utils');

package/scripts/flow-migrate.js

@@ -23,7 +23,8 @@ const {
   parseFlags,
   outputJson,
   checkSpecMigration,
-  SPEC_FILE_MAP
+  SPEC_FILE_MAP,
+  getTodayDate
 } = require('./flow-utils')
 const { printHeader, printSection, color, success, warn, error, info } = require('./flow-output');;
 

package/scripts/flow-model-adapter.js

@@ -27,7 +27,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { getProjectRoot, getConfig, PATHS, colors, readJson } = require('./flow-utils');
+const { getProjectRoot, getConfig, PATHS, colors, readJson, getTodayDate } = require('./flow-utils');
 
 const ADAPTERS_DIR = PATHS.modelAdapters;
 const MODEL_STATS_PATH = PATHS.modelStatsLegacy;

package/scripts/flow-model-config.js

@@ -113,7 +113,11 @@ function writeConfig(config) {
  * @returns {Object} Models config or empty structure
  */
 function getModelsConfig() {
-  const config = readConfig();
+  // Use canonical getConfig() for reads — readConfig() is kept only for
+  // read-modify-write paths (updateModelsConfig, migrateOldConfig) where a
+  // cached reference would cause mutation bugs. (wf-7072d3ac / dup-006)
+  const { getConfig } = require('./flow-config-loader');
+  const config = getConfig();
   return config.models || { providers: {}, defaults: {} };
 }
 

package/scripts/flow-model-profile.js

@@ -39,7 +39,8 @@ const {
   error,
   parseFlags,
   outputJson,
-  safeJsonParse
+  safeJsonParse,
+  getTodayDate
 } = require('./flow-utils');
 
 const { getSectionsByPins, readIndex } = require('./flow-section-index');

package/scripts/flow-orchestrate.js

@@ -587,7 +587,7 @@ function logTokenMetrics(plan, executionResult, complexity) {
   const metricsPath = path.join(PATHS.state, 'hybrid-metrics.json');
 
   // Load existing metrics or create new array
-  const metrics = readJson(metricsPath, []);
+  let metrics = readJson(metricsPath, []);
 
   // Add new metric entry
   const entry = {
@@ -1436,7 +1436,7 @@ class Orchestrator {
               taskType: result.taskType || taskType,
               success: true
             });
-          } catch (profileErr) {
+          } catch (_err) {
             // Non-critical, continue
           }
 
@@ -1510,7 +1510,7 @@ class Orchestrator {
               log('dim', `   📚 Applied learning from failure: ${failureLearning.learning?.category || 'unknown'}`);
               continue; // Skip default refinement, use learning-based enhancement
             }
-          } catch (learnErr) {
+          } catch (_err) {
             // Non-critical, fall back to standard refinement
           }
 

package/scripts/flow-output.js

@@ -182,6 +182,34 @@ function escapeRegex(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
+/**
+ * Canonical slugify — consolidates 4 duplicate impls across scripts/ per audit
+ * dup-003 (wf-7072d3ac, 2026-04-15).
+ *
+ * @param {string} str
+ * @param {Object} [opts]
+ * @param {'alnum'|'word'} [opts.mode='alnum']
+ *   'alnum' — strips everything except [a-z0-9]+ (2026 matches old auto-learn/session-learning/rules-sync behavior).
+ *   'word'  — preserves word chars incl. underscores (old flow-story behavior).
+ * @param {number} [opts.maxLength] — truncate to this many chars (unset = unbounded).
+ * @returns {string}
+ */
+function slugify(str, opts = {}) {
+  const { mode = 'alnum', maxLength } = opts;
+  if (!str || typeof str !== 'string') return '';
+  let s = str.toLowerCase().trim();
+  if (mode === 'word') {
+    s = s
+      .replace(/[^\w\s-]/g, '')       // strip non-word chars except space/hyphen
+      .replace(/[\s_]+/g, '-');        // space/underscore → hyphen
+  } else {
+    s = s.replace(/[^a-z0-9]+/g, '-'); // single pass: anything non-alnum → hyphen
+  }
+  s = s.replace(/-+/g, '-').replace(/^-+|-+$/g, '');
+  if (Number.isFinite(maxLength) && maxLength > 0) s = s.slice(0, maxLength);
+  return s;
+}
+
 module.exports = {
   colors,
   color,
@@ -195,4 +223,5 @@ module.exports = {
   showHelp,
   escapeRegex,
   getTodayDate,
+  slugify,
 };

package/scripts/flow-parallel.js

@@ -281,9 +281,9 @@ async function executeParallel(tasks, executor, options = {}) {
       try {
         if (tracker) tracker.start(task.id);
         if (onStart) onStart(task);
-      } catch (callbackError) {
+      } catch (err) {
         // Don't let callback errors prevent task execution
-        console.warn(`Callback error for ${task.id}: ${callbackError.message}`);
+        console.warn(`Callback error for ${task.id}: ${err.message}`);
       }
 
       try {
@@ -294,22 +294,23 @@ async function executeParallel(tasks, executor, options = {}) {
         try {
           if (tracker) tracker.complete(task.id, result);
           if (onComplete) onComplete(task, result);
-        } catch (callbackError) {
-          console.warn(`Completion callback error for ${task.id}: ${callbackError.message}`);
+        } catch (err) {
+          console.warn(`Completion callback error for ${task.id}: ${err.message}`);
         }
 
         return { taskId: task.id, success: true, result };
       } catch (err) {
         finished.add(task.id); // Mark as finished but NOT succeeded
 
+        const outerErr = err;
         try {
-          if (tracker) tracker.fail(task.id, err);
-          if (onError) onError(task, err);
-        } catch (callbackError) {
-          console.warn(`Error callback error for ${task.id}: ${callbackError.message}`);
+          if (tracker) tracker.fail(task.id, outerErr);
+          if (onError) onError(task, outerErr);
+        } catch (err) {
+          console.warn(`Error callback error for ${task.id}: ${err.message}`);
         }
 
-        return { taskId: task.id, success: false, error: err.message };
+        return { taskId: task.id, success: false, error: outerErr.message };
       }
     });
 

package/scripts/flow-pattern-enforcer.js

@@ -32,7 +32,8 @@ const {
   info,
   success,
   warn,
-  error
+  error,
+  getTodayDate
 } = require('./flow-utils');
 
 // ============================================================

package/scripts/flow-permissions-audit.js

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+
+/**
+ * Wogi Flow - Permission Rule Audit (Claude Code settings.local.json)
+ *
+ * Analyzes Claude Code permission rules (e.g., 'Bash(git:*)') for duplicates,
+ * overly broad wildcards, and redundant specific rules covered by wildcards.
+ * Extracted from flow-utils.js (wf-94cc3b72 epic — decomposition pass).
+ *
+ * Separate from flow-permissions.js (which manages user permission grants
+ * for WogiFlow operations) — these audit the upstream Claude Code config.
+ *
+ * Pure functions with no filesystem side effects. Zero external deps.
+ */
+
+'use strict';
+
+/**
+ * Analyze permission rules for issues
+ * @param {string[]} permissions - Array of permission rule strings
+ * @returns {Object} Analysis result with duplicates, overbroad, shadowed, total
+ */
+function analyzePermissions(permissions) {
+  const result = {
+    duplicates: [],
+    overbroad: [],
+    shadowed: [],
+    total: permissions.length
+  };
+
+  // Check for duplicates
+  const seen = new Set();
+  for (const perm of permissions) {
+    if (seen.has(perm)) {
+      result.duplicates.push(perm);
+    }
+    seen.add(perm);
+  }
+
+  // Check for overly broad patterns (wildcards on core tools)
+  const overbroadPatterns = ['Bash(*)', 'Edit(*)', 'Write(*)', 'Read(*)'];
+  for (const perm of permissions) {
+    if (overbroadPatterns.includes(perm)) {
+      result.overbroad.push(perm);
+    }
+  }
+
+  // Check for shadowed rules (specific rules covered by wildcards)
+  const wildcards = permissions.filter(p => p.includes('*'));
+  const specific = permissions.filter(p => !p.includes('*'));
+
+  for (const spec of specific) {
+    const match = spec.match(/^(\w+)\((.+)\)$/);
+    if (match) {
+      const [, tool, pattern] = match;
+      for (const wild of wildcards) {
+        const wildMatch = wild.match(/^(\w+)\((.+)\)$/);
+        if (wildMatch && wildMatch[1] === tool) {
+          const wildPattern = wildMatch[2].replace(/\*/g, '.*');
+          try {
+            const regex = new RegExp(`^${wildPattern}$`);
+            if (regex.test(pattern)) {
+              result.shadowed.push({ specific: spec, wildcard: wild });
+              break;
+            }
+          } catch (_err) {
+            // Invalid regex, skip
+          }
+        }
+      }
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Validate permission rules and return classified issues + warnings.
+ * @param {string[]} permissions - Array of permission rules
+ * @returns {Object} { valid, issues, warnings, analysis }
+ */
+function validatePermissions(permissions) {
+  const analysis = analyzePermissions(permissions);
+
+  const issues = [];
+  const warnings = [];
+
+  if (analysis.duplicates.length > 0) {
+    warnings.push({
+      type: 'duplicate',
+      message: `${analysis.duplicates.length} duplicate rule(s) found`,
+      items: analysis.duplicates
+    });
+  }
+
+  if (analysis.overbroad.length > 0) {
+    issues.push({
+      type: 'overbroad',
+      severity: 'critical',
+      message: `${analysis.overbroad.length} overly broad rule(s) found`,
+      items: analysis.overbroad
+    });
+  }
+
+  if (analysis.shadowed.length > 0) {
+    warnings.push({
+      type: 'shadowed',
+      message: `${analysis.shadowed.length} rule(s) shadowed by wildcards (redundant)`,
+      items: analysis.shadowed.map(s => s.specific)
+    });
+  }
+
+  return {
+    valid: issues.length === 0,
+    issues,
+    warnings,
+    analysis
+  };
+}
+
+module.exports = {
+  analyzePermissions,
+  validatePermissions,
+};

package/scripts/flow-plugin-registry.js

@@ -29,8 +29,8 @@ const {
   printHeader, PATHS
 } = require('./flow-utils');
 
-// Dangerous keys that must never be used as plugin names or metadata keys
-const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+// Local DANGEROUS_KEYS consolidated to flow-io canonical (wf-2f6fbb12 / dup-002).
+const { DANGEROUS_KEYS } = require('./flow-io');
 
 // Allowlists for capability fields
 const VALID_MODES = new Set(['standalone', 'flow-integrated', 'trigger']);

package/scripts/flow-progress.js

@@ -7,7 +7,11 @@
  */
 
 const readline = require('node:readline/promises');
-const { colors } = require('./flow-utils');
+const { colors, getTodayDate } = require('./flow-utils');
+
+// ANSI escape prefix (was referenced as ESC without definition — latent
+// no-undef bug caught by eslint upgrade; wf-5a6df88a)
+const ESC = '\x1b';
 
 const symbols = {
   success: '✅',

package/scripts/flow-project-analyzer.js

@@ -12,7 +12,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { getProjectRoot, safeJsonParse, getConfig } = require('./flow-utils');
+const { getProjectRoot, safeJsonParse, getConfig, getTodayDate } = require('./flow-utils');
 
 const PROJECT_ROOT = process.argv[2] || getProjectRoot();