wogiflow 2.17.0 → 2.18.0

package/scripts/flow-health.js

@@ -82,6 +82,123 @@ function checkClaudeCodeVersion() {
   }
 }
 
+/**
+ * Normalize an MCP server config so two equivalent objects compare equal
+ * after JSON.stringify. Recursively sorts object keys and stringifies arrays
+ * in their original order (order is meaningful for args).
+ *
+ * @param {*} cfg - An MCP server config value (typically an object, but may be primitive)
+ * @returns {string} Canonical JSON representation suitable for equality comparison
+ */
+function normalizeMcpConfig(cfg) {
+  const sortKeys = (v) => {
+    if (Array.isArray(v)) return v.map(sortKeys);
+    if (v && typeof v === 'object') {
+      const out = {};
+      for (const k of Object.keys(v).sort()) {
+        out[k] = sortKeys(v[k]);
+      }
+      return out;
+    }
+    return v;
+  };
+  return JSON.stringify(sortKeys(cfg));
+}
+
+/**
+ * Check MCP server definitions across the three Claude Code settings scopes:
+ *   - user:    ~/.claude/settings.json
+ *   - project: <project>/.claude/settings.json
+ *   - local:   <project>/.claude/settings.local.json
+ *
+ * Mirrors the /doctor warning added in Claude Code 2.1.110: a server defined
+ * in multiple scopes with divergent config is almost always a mistake — the
+ * lowest-priority scope silently loses, and users debug ghost endpoints.
+ *
+ * Identical duplicate definitions are intentionally NOT flagged — some teams
+ * duplicate for portability. Only divergent configs surface.
+ *
+ * @param {Object} [opts]
+ * @param {string} [opts.userSettingsPath] - Override path to user scope (for tests)
+ * @param {string} [opts.projectSettingsPath] - Override path to project scope (for tests)
+ * @param {string} [opts.localSettingsPath] - Override path to local scope (for tests)
+ * @returns {{
+ *   duplicates: Array<{name: string, scopes: string[]}>,
+ *   uniqueServers: number,
+ *   parseErrors: Array<{file: string, error: string}>,
+ *   scopesChecked: number
+ * }}
+ */
+function checkMcpScopes(opts = {}) {
+  const os = require('node:os');
+  const scopes = [
+    { file: opts.userSettingsPath || path.join(os.homedir(), '.claude', 'settings.json'), label: 'user' },
+    { file: opts.projectSettingsPath || path.join(PROJECT_ROOT, '.claude', 'settings.json'), label: 'project' },
+    { file: opts.localSettingsPath || path.join(PROJECT_ROOT, '.claude', 'settings.local.json'), label: 'local' }
+  ];
+
+  const parseErrors = [];
+  const serverByName = new Map();
+  let scopesChecked = 0;
+
+  // Sentinel object for safeJsonParse so we can distinguish "file failed to
+  // parse" (returned sentinel) from "file parsed but had no mcpServers" (returned
+  // object without the key). safeJsonParse is mandated by security-patterns.md §2
+  // (prototype-pollution guard + non-object validation) — we layer a raw-read
+  // fallback on top to categorize the failure cause for health output.
+  const PARSE_SENTINEL = Object.create(null);
+
+  for (const scope of scopes) {
+    if (!fileExists(scope.file)) continue;
+    scopesChecked++;
+    const json = safeJsonParse(scope.file, PARSE_SENTINEL);
+    if (json === PARSE_SENTINEL) {
+      // safeJsonParse returned the sentinel — categorize: read failure vs JSON
+      // parse failure vs non-object vs prototype-pollution rejection.
+      let raw;
+      try {
+        raw = fs.readFileSync(scope.file, 'utf-8');
+      } catch (err) {
+        parseErrors.push({ file: scope.file, error: `read failed: ${err.message}` });
+        continue;
+      }
+      try {
+        JSON.parse(raw);
+        // Raw parse succeeded — safeJsonParse rejected for structural reason
+        // (non-object top level, or dangerous __proto__/constructor keys).
+        parseErrors.push({ file: scope.file, error: 'rejected by safeJsonParse (non-object or prototype-pollution guard)' });
+      } catch (err) {
+        parseErrors.push({ file: scope.file, error: `invalid JSON: ${err.message}` });
+      }
+      continue;
+    }
+    const mcp = json.mcpServers;
+    if (!mcp || typeof mcp !== 'object' || Array.isArray(mcp)) continue;
+
+    for (const name of Object.keys(mcp)) {
+      if (!serverByName.has(name)) serverByName.set(name, []);
+      serverByName.get(name).push({ scope: scope.label, config: mcp[name] });
+    }
+  }
+
+  const duplicates = [];
+  for (const [name, entries] of serverByName.entries()) {
+    if (entries.length < 2) continue;
+    const canonical = normalizeMcpConfig(entries[0].config);
+    const allSame = entries.every(e => normalizeMcpConfig(e.config) === canonical);
+    if (!allSame) {
+      duplicates.push({ name, scopes: entries.map(e => e.scope) });
+    }
+  }
+
+  return {
+    duplicates,
+    uniqueServers: serverByName.size,
+    parseErrors,
+    scopesChecked
+  };
+}
+
 function main() {
   console.log(color('cyan', 'Wogi Flow Health Check'));
   console.log('========================');
@@ -661,6 +778,29 @@ function main() {
     }
   }
 
+  // Check MCP server definitions across scopes (mirrors Claude Code 2.1.110 /doctor)
+  console.log('');
+  printSection('Checking MCP server scopes...');
+
+  const mcp = checkMcpScopes();
+  if (mcp.parseErrors.length > 0) {
+    for (const e of mcp.parseErrors) {
+      warn(`Could not parse ${e.file}: ${e.error}`);
+    }
+    warnings += mcp.parseErrors.length;
+  }
+  if (mcp.uniqueServers === 0) {
+    console.log(`  ${color('dim', '○')} No MCP servers defined in user / project / local scopes`);
+  } else if (mcp.duplicates.length === 0) {
+    success(`No conflicting MCP server definitions across ${mcp.scopesChecked} scope(s)`);
+  } else {
+    for (const f of mcp.duplicates) {
+      warn(`MCP server "${f.name}" has divergent config in scopes: ${f.scopes.join(' + ')}`);
+      console.log(`    ${color('dim', '→ Consolidate into a single scope; /doctor will flag this too')}`);
+    }
+    warnings += mcp.duplicates.length;
+  }
+
   // Check .gitignore sync
   console.log('');
   printSection('Checking .gitignore sync...');
@@ -1159,4 +1299,8 @@ function run() {
   }
 }
 
-run();
+if (require.main === module) {
+  run();
+}
+
+module.exports = { checkMcpScopes, normalizeMcpConfig };

package/scripts/flow-id.js

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+
+/**
+ * Wogi Flow - Hash-Based ID Generation & Validation
+ *
+ * Generates collision-resistant 8-char hex IDs for work items:
+ *   wf-XXXXXXXX  (task), ep-XXXXXXXX (epic), ft-XXXXXXXX (feature), pl-XXXXXXXX (plan)
+ *
+ * Extracted from flow-utils.js (wf-94cc3b72 epic — flow-utils decomposition).
+ * Zero external deps beyond node:crypto — pure helpers.
+ */
+
+'use strict';
+
+const crypto = require('node:crypto');
+
+/**
+ * Generate a hash-based ID with a given prefix.
+ * Uses SHA256 of (seed + title + timestamp + randomBytes) for collision resistance.
+ *
+ * @param {string} prefix - ID prefix (e.g., 'wf', 'ep', 'ft', 'pl')
+ * @param {string} seed - Seed string for the hash (e.g., '', 'epic-', 'feature-')
+ * @param {string} title - Title to include in hash input
+ * @returns {string} ID in format prefix-XXXXXXXX
+ */
+function generateHashId(prefix, seed, title) {
+  const randomHex = crypto.randomBytes(8).toString('hex');
+  const input = `${seed}${title}${Date.now()}${randomHex}`;
+  const hash = crypto.createHash('sha256').update(input).digest('hex').slice(0, 8);
+  return `${prefix}-${hash}`;
+}
+
+/**
+ * Generate a hash-based task ID
+ * Format: wf-XXXXXXXX (8-char hex hash)
+ * @example generateTaskId('Fix login bug') // => 'wf-a1b2c3d4'
+ */
+function generateTaskId(title) {
+  return generateHashId('wf', '', title);
+}
+
+/** Generate a hash-based epic ID (ep-XXXXXXXX) */
+function generateEpicId(title) {
+  return generateHashId('ep', 'epic-', title);
+}
+
+/** Generate a hash-based feature ID (ft-XXXXXXXX) */
+function generateFeatureId(title) {
+  return generateHashId('ft', 'feature-', title);
+}
+
+/** Generate a hash-based plan ID (pl-XXXXXXXX) */
+function generatePlanId(title) {
+  return generateHashId('pl', 'plan-', title);
+}
+
+/**
+ * Check if a string is a valid task ID (old or new format)
+ * @returns {{ valid: boolean, format: 'hash' | 'legacy' | null }}
+ */
+function validateTaskId(id) {
+  if (!id || typeof id !== 'string') {
+    return { valid: false, format: null };
+  }
+
+  // New hash-based format: wf-XXXXXXXX
+  if (/^wf-[a-f0-9]{8}$/i.test(id)) {
+    return { valid: true, format: 'hash' };
+  }
+
+  // Legacy formats: TASK-XXX, BUG-XXX
+  if (/^(TASK|BUG)-\d{3,}$/i.test(id)) {
+    return { valid: true, format: 'legacy' };
+  }
+
+  return { valid: false, format: null };
+}
+
+/** Check if ID is in legacy format (for migration warnings) */
+function isLegacyTaskId(id) {
+  return /^(TASK|BUG)-\d{3,}$/i.test(id);
+}
+
+module.exports = {
+  generateHashId,
+  generateTaskId,
+  generateEpicId,
+  generateFeatureId,
+  generatePlanId,
+  validateTaskId,
+  isLegacyTaskId,
+};

package/scripts/flow-io.js

@@ -16,6 +16,15 @@ const { PROJECT_ROOT } = require('./flow-paths');
 // Constants - Named values for magic numbers
 // ============================================================
 
+/**
+ * Canonical DANGEROUS_KEYS — prototype-pollution guard constant used by
+ * JSON parse safety checks, plugin-name validation, frontmatter parsers.
+ * Consolidated 2026-04-15 per audit dup-002 (wf-2f6fbb12). All scripts/
+ * consumers should import from here; lib/ has its own local copy to avoid
+ * lib→scripts dependency per dual-repo-management.md.
+ */
+const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
 /** Default lock stale threshold (60 seconds) */
 const LOCK_STALE_THRESHOLD_MS = 60000;
 
@@ -607,9 +616,9 @@ function cleanupStaleLocks(dirPath, staleMs = CLEANUP_LOCK_STALE_MS) {
               try {
                 fs.rmSync(lockDir, { recursive: true, force: true });
                 cleaned++;
-              } catch (err2) {
+              } catch (err) {
                 if (process.env.DEBUG) {
-                  console.warn(`[DEBUG] cleanupStaleLocks: Could not force delete ${lockDir}: ${err2.message}`);
+                  console.warn(`[DEBUG] cleanupStaleLocks: Could not force delete ${lockDir}: ${err.message}`);
                 }
               }
             }
@@ -626,10 +635,10 @@ function cleanupStaleLocks(dirPath, staleMs = CLEANUP_LOCK_STALE_MS) {
             fs.rmSync(lockDir, { recursive: true, force: true });
             cleaned++;
           }
-        } catch (err2) {
+        } catch (err) {
           // Directory gone or inaccessible - skip
-          if (err2.code !== 'ENOENT' && process.env.DEBUG) {
-            console.warn(`[DEBUG] cleanupStaleLocks: Could not stat ${lockDir}: ${err2.message}`);
+          if (err.code !== 'ENOENT' && process.env.DEBUG) {
+            console.warn(`[DEBUG] cleanupStaleLocks: Could not stat ${lockDir}: ${err.message}`);
           }
         }
       }
@@ -666,6 +675,7 @@ function sanitizeForContext(value, maxLen = 200) {
 
 module.exports = {
   // Constants
+  DANGEROUS_KEYS,
   LOCK_STALE_THRESHOLD_MS,
   CLEANUP_LOCK_STALE_MS,
   LOCK_RETRY_DELAY_MS,

package/scripts/flow-knowledge-router.js

@@ -33,7 +33,8 @@ const {
   readFile,
   writeFile,
   fileExists,
-  printHeader
+  printHeader,
+  getTodayDate
 } = require('./flow-utils');
 
 // Import from skill-learn and model-adapter to avoid duplication

package/scripts/flow-links.js

@@ -25,7 +25,7 @@ const path = require('node:path');
 const https = require('node:https');
 const http = require('node:http');
 const dns = require('dns');
-const { getProjectRoot, colors: c, readJson, PATHS } = require('./flow-utils');
+const { getProjectRoot, colors: c, readJson, PATHS, getTodayDate } = require('./flow-utils');
 const { success: printSuccess } = require('./flow-output');
 
 const LINKS_PATH = path.join(PATHS.workflow, 'links.yaml');

package/scripts/flow-log-manager.js

@@ -30,7 +30,8 @@ const {
   fileExists,
   dirExists,
   countRequestLogEntries,
-  printHeader
+  printHeader,
+  getTodayDate
 } = require('./flow-utils');
 
 // v9.0: Memory database for queryable log storage

package/scripts/flow-logic-adversary.js

@@ -53,7 +53,7 @@ const gateTelemetry = require('./flow-gate-telemetry');
 // ============================================================
 
 const RUBRIC_DIR = path.join(PATHS.workflow, 'rubrics');
-const DEFAULT_RUBRIC = 'logic-constitution-v2';
+const DEFAULT_RUBRIC = 'logic-constitution-v3';
 const CALIBRATION_PATH = path.join(PATHS.state, 'adversary-calibration.json');
 
 const VALID_OVERALL_VERDICTS = new Set([
@@ -84,7 +84,7 @@ const INTENT_ARTIFACTS = {
 
 /**
  * Load the Logic Constitution rubric by version identifier.
- * @param {string} [version='logic-constitution-v2']
+ * @param {string} [version='logic-constitution-v3']
  * @returns {{ content: string, version: string, path: string }}
  */
 function loadRubric(version = DEFAULT_RUBRIC) {
@@ -149,7 +149,7 @@ function readIntentArtifact(key) {
  * @param {string} [opts.taskId]
  * @param {number} [opts.round=1] - Iteration round number (≥1).
  * @param {object} [opts.previousAdversaryOutput] - Prior round's parsed output when re-running.
- * @param {string} [opts.rubricVersion='logic-constitution-v2']
+ * @param {string} [opts.rubricVersion='logic-constitution-v3']
  * @param {number} [opts.calibrationCount=3] - How many calibration examples to inject.
  * @returns {{ systemPrompt:string, userPrompt:string, metadata:object }}
  */
@@ -317,7 +317,7 @@ All 10 principles must appear in the \`principles\` array, even if SKIPped.
  * @param {Object} ctx
  * @param {string} [ctx.taskId]
  * @param {number} [ctx.round=1]
- * @param {string} [ctx.rubricVersion='logic-constitution-v2']
+ * @param {string} [ctx.rubricVersion='logic-constitution-v3']
  * @returns {object} The validated adversary verdict.
  */
 function parseAdversaryOutput(response, ctx = {}) {

package/scripts/flow-long-input-cli.js

@@ -20,6 +20,12 @@ const c = {
   red: '\x1b[31m'
 };
 
+// Local helper — 5 call sites referenced printWarn without defining it
+// (latent no-undef bug caught by eslint upgrade; wf-5a6df88a).
+function printWarn(msg) {
+  console.warn(`${c.yellow}⚠ ${msg}${c.reset}`);
+}
+
 /**
  * CLI handler
  */

package/scripts/flow-long-input-stories.js

@@ -2150,7 +2150,7 @@ function cleanupTempFiles(digestId) {
       if (active && active.session?.digest_id === digestId) {
         try {
           fs.unlinkSync(activeFile);
-        } catch (_unlinkErr) {
+        } catch (_err) {
           // Ignore errors unlinking active file - main cleanup succeeded
         }
       }

package/scripts/flow-loop-retry-learning.js

@@ -15,7 +15,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { getConfig, getProjectRoot, colors, readJson, info, success, PATHS } = require('./flow-utils');
+const { getConfig, getProjectRoot, colors, readJson, info, success, PATHS, getTodayDate } = require('./flow-utils');
 const { FailureCategory, detectCategory } = require('./flow-failure-categories');
 
 const LEARNING_LOG_PATH = path.join(PATHS.state, 'adaptive-learning.json');

package/scripts/flow-mcp-capabilities.js

@@ -32,10 +32,9 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { PATHS, getConfig, safeJsonParse, readJson, writeJson, fileExists } = require('./flow-utils');
+const { PATHS, getConfig, safeJsonParse, readJson, writeJson, fileExists, DANGEROUS_KEYS } = require('./flow-utils');
 
-// Prototype pollution protection — same pattern as flow-plugin-registry.js
-const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+// Local DANGEROUS_KEYS consolidated to flow-io canonical (wf-2f6fbb12 / dup-002).
 
 // ============================================================
 // Constants

package/scripts/flow-mcp-docs.js

@@ -19,7 +19,8 @@ const path = require('node:path');
 const {
   getProjectRoot,
   safeJsonParse,
-  fileExists
+  fileExists,
+  PATHS
 } = require('./flow-utils')
 const { color, printHeader, printSection, success } = require('./flow-output');;
 

package/scripts/flow-memory-blocks.js

@@ -27,7 +27,8 @@ const {
   writeFile,
   fileExists,
   printHeader,
-  safeJsonParseString
+  safeJsonParseString,
+  getTodayDate
 } = require('./flow-utils');
 
 // ============================================================

package/scripts/flow-memory-sync.js

@@ -22,6 +22,7 @@ const path = require('node:path');
 const memoryDb = require('./flow-memory-db');
 const { getConfig, PROJECT_ROOT } = require('./flow-config-loader');
 const { color } = require('./flow-output');
+const { PATHS } = require('./flow-utils');
 
 // Lazy-load to avoid circular dependency
 let _syncDecisionsToRules = null;
@@ -469,7 +470,6 @@ module.exports = {
   listCandidates,
   promoteFact,
   showStatus,
-  loadConfig
 };
 
 // Run CLI if executed directly