wogiflow 2.21.0 → 2.22.0

package/.claude/commands/wogi-finalize.md

@@ -79,6 +79,79 @@ Pre-finalization checks:
 
 If checks fail, display warnings and suggest fixes before proceeding.
 
+### Step 2.5: Merge-Plan Gate (when `mergePlan.threshold` exceeded)
+
+**Activates when** the branch carries more commits than `config.finalization.mergePlan.threshold` (default **5**) OR the diff is flagged cross-repo by the workspace manifest. The gate writes — and requires the AI to fill in — `.workflow/scratch/merge-plan.md`. The gate exists because the "1-2h mostly mechanical" audit that predicted a 27-conflict merge (wogi-hub, 2026-04-16) counted commits-per-file without reading diff content; the fix is to force per-commit action assignment in a file.
+
+**Mechanical invariants (gate blocks on violation):**
+
+1. For every commit in `git log <base>..<branch>`, the plan MUST contain one line starting with the short SHA and a tagged action. No commits in an "unaccounted" bucket.
+2. Allowed actions: `port | adapt | skip-style | superseded | skip-with-reason`.
+3. `git log <base>..<branch> | wc -l` MUST equal the count of SHA-prefixed lines in the plan. Mismatch → hard-stop until reconciled.
+4. `skip-with-reason` entries MUST include a one-line reason after a `—` (em dash).
+
+**Structural-change detection (before plan write):**
+
+Run the structure-change sensor (`scripts/flow-structure-sensor.js`) on the diff. If ≥ `config.finalization.mergePlan.restructureThreshold` (default **20%**) of changed files match one of these restructure patterns, display a STRUCTURAL CHANGE warning at the top of the plan and bias the default action for affected commits to `adapt`:
+
+| Pattern | Example | Meaning |
+|---------|---------|---------|
+| `X.tsx` deleted + `X/X.tsx` added | `Card.tsx` → `Card/Card.tsx` | folder-per-component |
+| `X.ts` deleted + `<dir>/X.ts` added at deeper depth | `utils.ts` → `utils/date.ts` | split into submodule |
+| `X` deleted + `X.<ext>` added elsewhere | `types.ts` → `types/index.ts` | barrel introduction |
+
+**Procedure:**
+
+```bash
+# 1. Gather commit list
+git log --pretty='%h %s' <base>..<branch> > .workflow/scratch/.merge-plan-commits.txt
+
+# 2. Run structure sensor
+node node_modules/wogiflow/scripts/flow-structure-sensor.js <base>..<branch> > .workflow/scratch/.merge-plan-sensor.json
+
+# 3. Write .workflow/scratch/merge-plan.md using the template below,
+#    one SHA-prefixed line per commit. Read the FULL diff of each commit
+#    (not just the subject line) before assigning an action — that is
+#    the whole point of this gate.
+
+# 4. Verify the mechanical invariant
+test "$(git log --oneline <base>..<branch> | wc -l)" -eq \
+     "$(grep -cE '^[a-f0-9]{7,}\s' .workflow/scratch/merge-plan.md)"
+```
+
+**Plan template** (write verbatim, then fill each row by reading the full diff):
+
+```markdown
+# Merge plan: <branch> → <base>
+
+Commits: N (from `git log <base>..<branch>`)
+Structural-change sensor: <WARN|clean>  — N/M files match restructure patterns
+Cross-repo impact: <list workspace members affected, or "single-repo">
+
+## Per-commit actions
+
+| SHA | Subject | Action | Notes |
+|-----|---------|--------|-------|
+| abc1234 | feat: add login form | port | — |
+| def5678 | refactor: split Card.tsx into Card/ | adapt | folder-per-component restructure |
+| ghi9012 | chore: lint fixes | skip-style | — |
+| jkl3456 | revert: roll back header | skip-with-reason | superseded by mno7890 |
+
+## Structural risks
+
+<leave empty if sensor is clean; otherwise list each pattern hit>
+
+## Content risks
+
+<list overlaps in shared types, DTOs, API surface that need manual review>
+```
+
+**When the plan is complete**, the gate verifies the commit-count invariant (step 4) and proceeds to Step 3 (options). If invariant fails, the command stops with the reconciliation command printed.
+
+**Skip conditions:**
+- `config.finalization.mergePlan.enabled: false` — opt-out for users who don't want the gate
+- Branch commits ≤ threshold AND single-repo — small merges don't need a plan
+
 ### Step 3: Present Options
 
 ```
@@ -241,6 +314,12 @@ When `/wogi-start` completes a task that was executed in a worktree, the finaliz
       "includeTaskSpec": true,
       "includeCommitList": true,
       "includeFileSummary": true
+    },
+    "mergePlan": {
+      "enabled": true,
+      "threshold": 5,
+      "restructureThreshold": 0.20,
+      "alwaysForCrossRepo": true
     }
   }
 }
@@ -254,6 +333,10 @@ When `/wogi-start` completes a task that was executed in a worktree, the finaliz
 | `requirePRForTypes` | `[]` | Task types that must create a PR (useful for teams) |
 | `squashOnMerge` | `true` | Squash commits when merging |
 | `prTemplate` | `{...}` | What to include in auto-generated PR body |
+| `mergePlan.enabled` | `true` | Require per-commit merge plan on large or cross-repo merges |
+| `mergePlan.threshold` | `5` | Commit count above which the merge plan is required |
+| `mergePlan.restructureThreshold` | `0.20` | % of changed files matching restructure patterns that triggers a structural-change warning |
+| `mergePlan.alwaysForCrossRepo` | `true` | Require the plan on any cross-repo merge regardless of commit count |
 
 ## Examples
 

package/.claude/rules/_internal/self-maintenance.md

@@ -75,7 +75,7 @@ Don't confuse them. `agents/security.md` (persona) is different from `.workflow/
 
 When modifying flow-*.js scripts:
 - Run `node --check scripts/<file>.js` after edits
-- WogiFlow has no test suite - syntax checking is the safety net
+- Run `npm test` — WogiFlow has a native-Node test suite (50+ files under `tests/`, 1800+ assertions) covering hooks, flow-io, security, session state, workspace gates, and more
 - Check for circular dependencies when moving shared functions
 
 ## 8. Feature Refactoring Cleanup

package/.claude/settings.json

@@ -170,6 +170,6 @@
   },
   "_comment_dynamicHooks": "TaskCreated (2.1.84+) and PermissionDenied (2.1.88+) are added by postinstall.js when the CC version supports them. They must NOT be committed statically — CC rejects the entire settings file if it encounters an unknown hook event name.",
   "_wogiFlowManaged": true,
-  "_wogiFlowVersion": "2.17.5",
+  "_wogiFlowVersion": "2.22.0",
   "_comment": "Shared WogiFlow hook configuration. Committed to repo for team use. User-specific overrides go in settings.local.json."
 }

package/lib/commands/login.js

@@ -414,7 +414,7 @@ async function login(args) {
         console.error(`\n\nServer error (${tokenResponse.statusCode}). Retrying...`);
         process.stdout.write('x');
       }
-    } catch (err) {
+    } catch (_err) {
       process.stdout.write('x');
     }
   }

package/lib/installer.js

@@ -194,7 +194,7 @@ function detectProjectScripts(projectRoot) {
   let pkgData;
   try {
     pkgData = safeReadJson(packageJsonPath);
-  } catch (err) {
+  } catch (_err) {
     return detected;
   }
 
@@ -989,7 +989,7 @@ async function init(args) {
       try {
         const analyzer = require('../scripts/flow-project-analyzer');
         detection = analyzer.detectProjectType(projectRoot);
-      } catch (err) {
+      } catch (_err) {
         // Fallback: use basic projectType from installer's own detection
         detection = {
           projectType: config.projectType || 'unknown',
@@ -1030,7 +1030,7 @@ async function init(args) {
         // Non-fatal — profile can be generated later via /wogi-test
       }
     }
-  } catch (err) {
+  } catch (_err) {
     // Non-fatal — flow-verification-profile may not exist yet during initial install
   }
 
@@ -1083,7 +1083,7 @@ function updateManifestAfterInit(cliDir) {
     if (!manifest || !Array.isArray(manifest.files)) {
       manifest = { version: 1, files: [], directories: ['.workflow'] };
     }
-  } catch (err) {
+  } catch (_err) {
     // No manifest yet — create a fresh one
     manifest = { version: 1, files: [], directories: ['.workflow'] };
   }
@@ -1129,7 +1129,7 @@ function walkDirForManifest(dir, baseDir, fileSet) {
         fileSet.add(path.relative(baseDir, fullPath));
       }
     }
-  } catch (err) {
+  } catch (_err) {
     // Non-critical — skip unreadable dirs
   }
 }

package/lib/release-channel.js

@@ -128,7 +128,7 @@ async function getLatestVersion(channel) {
     // Get version for the channel's npm tag
     const distTags = pkg['dist-tags'] || {};
     return distTags[channelConfig.npmTag] || distTags.latest || pkg.version;
-  } catch (err) {
+  } catch (_err) {
     return null;
   }
 }

package/lib/skill-registry.js

@@ -154,7 +154,7 @@ async function fetchSkillIndex(projectRoot) {
       throw new Error('Invalid index data');
     }
     return parsed;
-  } catch (err) {
+  } catch (_err) {
     // Return mock index for development/offline
     return {
       version: '1.0',
@@ -201,7 +201,7 @@ async function fetchSkillManifest(skillName, projectRoot) {
       throw new Error('Invalid manifest data');
     }
     return parsed;
-  } catch (err) {
+  } catch (_err) {
     throw new Error(`Skill '${skillName}' not found in registry`);
   }
 }
@@ -213,7 +213,7 @@ async function fetchSkillManifest(skillName, projectRoot) {
  * @param {string} projectRoot - Project root directory
  * @returns {Promise<Object>} Downloaded files
  */
-async function downloadSkillFiles(skillName, manifest, projectRoot) {
+async function downloadSkillFiles(skillName, manifest, _projectRoot) {
   const files = {};
   const baseUrl = `${REGISTRY_CONFIG.baseUrl}/${REGISTRY_CONFIG.branch}/skills/${skillName}`;
 

package/lib/workspace-events.js

@@ -46,7 +46,7 @@ const EVENT_TYPES = [
 
 const EVENTS_FILE = 'events.json';
 const MAX_EVENTS = 500; // Keep last 500 events
-const EVENT_ID_PATTERN = /^evt-[a-f0-9]{8}$/;
+const _EVENT_ID_PATTERN = /^evt-[a-f0-9]{8}$/;
 
 // ============================================================
 // Event Creation

package/lib/workspace-gates.js

@@ -470,7 +470,7 @@ function broadcastPostChange(workspaceRoot, fromRepo, context, options = {}) {
  * @param {Object} taskMeta
  * @returns {{ passed: boolean, message: string, severity: string }}
  */
-function gateDeploymentReadiness(workspaceRoot, context, taskMeta) {
+function gateDeploymentReadiness(workspaceRoot, _context, taskMeta) {
   const { execFileSync } = require('node:child_process');
 
   try {
@@ -668,7 +668,7 @@ function gatePeerNotification(workspaceRoot, context, taskMeta) {
  * Gate: cascadeVerification
  * For library repos, verify all consumers were notified.
  */
-function gateCascadeVerification(workspaceRoot, context, taskMeta) {
+function gateCascadeVerification(workspaceRoot, context, _taskMeta) {
   const gate = WORKSPACE_GATES.find(g => g.name === 'cascadeVerification');
 
   if (!context.currentMember || context.currentMember.role !== 'library') {

package/lib/workspace-intelligence.js

@@ -694,7 +694,7 @@ function analyzeReviewForCrossRepoImpact(workspaceRoot, manifest, changedFiles,
     result.endpointChanges = changedApiFiles;
 
     // Check if contract was also updated
-    const contractsDir = path.join(workspaceRoot, '.workspace', 'contracts');
+    const _contractsDir = path.join(workspaceRoot, '.workspace', 'contracts');
     const contractFiles = changedFiles.filter(f => f.includes('.workspace/contracts'));
 
     if (contractFiles.length === 0 && changedApiFiles.length > 0) {

package/lib/workspace-routing.js

@@ -344,7 +344,7 @@ function generateParallelInvestigation(workspaceRoot, bugDescription, manifest)
   const investigators = [];
 
   for (const [name, member] of Object.entries(manifest.members)) {
-    const repoPath = path.resolve(workspaceRoot, member.path);
+    const _repoPath = path.resolve(workspaceRoot, member.path);
 
     investigators.push({
       repoName: name,

package/lib/workspace.js

@@ -17,6 +17,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const { safeJsonParse } = require('../scripts/flow-io');
 
 /**
  * wf-f747f993 — resolve the claude-spawning command for workspace sessions.
@@ -682,7 +683,7 @@ ${Object.entries(config.channels?.members || {}).map(([name, ch]) => `- **${name
 
 **Check if workers are running:**
 \`\`\`bash
-${Object.entries(config.channels?.members || {}).map(([name, ch]) => `curl -s http://localhost:${ch.port}/health`).join('\n')}
+${Object.entries(config.channels?.members || {}).map(([_name, ch]) => `curl -s http://localhost:${ch.port}/health`).join('\n')}
 \`\`\`
 
 If a worker is down, tell the user: "Start the ${'{'}repo{'}'} worker: \`cd ${'{'}repo{'}'}/ && flow workspace start\`"
@@ -705,7 +706,7 @@ If a worker is down, tell the user: "Start the ${'{'}repo{'}'} worker: \`cd ${'{
 **Bug investigation — dispatch to all workers:**
 \`\`\`bash
 # Send investigation request to all workers in parallel
-${Object.entries(config.channels?.members || {}).map(([name, ch]) =>
+${Object.entries(config.channels?.members || {}).map(([_name, ch]) =>
   `curl -s -X POST http://localhost:${ch.port} -d "Investigate: <BUG_DESCRIPTION>. Check recent changes, error logs, relevant code. Report back via workspace message."`
 ).join('\n')}
 \`\`\`
@@ -1110,7 +1111,7 @@ function generateMemberMcpConfigs(workspaceRoot, config) {
     let existingConfig = {};
     try {
       if (fs.existsSync(mcpJsonPath)) {
-        existingConfig = JSON.parse(fs.readFileSync(mcpJsonPath, 'utf-8'));
+        existingConfig = safeJsonParse(mcpJsonPath, {});
       }
     } catch (_err) {
       // Ignore malformed existing config
@@ -1292,7 +1293,7 @@ For everything else — just do the work and report results.
   let existingManagerMcp = {};
   try {
     if (fs.existsSync(managerMcpPath)) {
-      existingManagerMcp = JSON.parse(fs.readFileSync(managerMcpPath, 'utf-8'));
+      existingManagerMcp = safeJsonParse(managerMcpPath, {});
     }
   } catch (_err) { /* ignore */ }
 
@@ -1315,7 +1316,7 @@ For everything else — just do the work and report results.
  * Initialize a Wogi Workspace
  * @param {string[]} args — CLI arguments
  */
-async function initWorkspace(args) {
+async function initWorkspace(_args) {
   let workspaceRoot = process.cwd();
 
   // Walk up to find existing workspace root (same as startWorkerSession)
@@ -1332,11 +1333,10 @@ async function initWorkspace(args) {
   // If we're inside an existing workspace (found in parent or CWD)
   if (existingWorkspaceRoot) {
     // Check if channels need to be enabled (upgrade path)
-    let existingConfig;
-    try {
-      existingConfig = JSON.parse(fs.readFileSync(path.join(existingWorkspaceRoot, WORKSPACE_CONFIG_FILE), 'utf-8'));
-    } catch (err) {
-      console.error(`Error reading workspace config: ${err.message}`);
+    const _workspaceConfigPath = path.join(existingWorkspaceRoot, WORKSPACE_CONFIG_FILE);
+    const existingConfig = safeJsonParse(_workspaceConfigPath, null);
+    if (!existingConfig) {
+      console.error(`Error reading workspace config at ${_workspaceConfigPath}`);
       process.exit(1);
     }
 
@@ -1373,7 +1373,7 @@ async function initWorkspace(args) {
       const manifestPath = path.join(existingWorkspaceRoot, WORKSPACE_DIR, 'state', 'workspace-manifest.json');
       try {
         if (fs.existsSync(manifestPath)) {
-          const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
+          const manifest = safeJsonParse(manifestPath, {});
           const claudeMd = generateWorkspaceClaudeMd(existingConfig, manifest);
           fs.writeFileSync(path.join(existingWorkspaceRoot, 'CLAUDE.md'), claudeMd);
           console.log('  ✓ CLAUDE.md (regenerated with channel dispatch instructions)');
@@ -1614,11 +1614,10 @@ function startWorkerSession(cwd) {
   }
 
   // Read workspace config
-  let config;
-  try {
-    config = JSON.parse(fs.readFileSync(path.join(workspaceRoot, WORKSPACE_CONFIG_FILE), 'utf-8'));
-  } catch (err) {
-    console.error(`Error reading workspace config: ${err.message}`);
+  const _cfgPath = path.join(workspaceRoot, WORKSPACE_CONFIG_FILE);
+  const config = safeJsonParse(_cfgPath, null);
+  if (!config) {
+    console.error(`Error reading workspace config at ${_cfgPath}`);
     process.exit(1);
   }
 
@@ -1697,7 +1696,7 @@ function startWorkerSession(cwd) {
   let mcpConfigValid = false;
   try {
     if (fs.existsSync(mcpJsonPath)) {
-      const mcpConfig = JSON.parse(fs.readFileSync(mcpJsonPath, 'utf-8'));
+      const mcpConfig = safeJsonParse(mcpJsonPath, {});
       mcpConfigValid = !!mcpConfig?.mcpServers?.['wogi-workspace-channel'];
     }
   } catch (_err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wogiflow",
-  "version": "2.21.0",
+  "version": "2.22.0",
   "description": "AI-powered development workflow management system with multi-model support",
   "main": "lib/index.js",
   "bin": {
@@ -10,7 +10,7 @@
   },
   "scripts": {
     "flow": "./scripts/flow",
-    "test": "NODE_ENV=test node --test tests/auto-compact-prompt.test.js tests/flow-paths.test.js tests/flow-io.test.js tests/flow-config-loader.test.js tests/flow-damage-control.test.js tests/flow-output.test.js tests/flow-constants.test.js tests/flow-session-state.test.js tests/flow-hooks-integration.test.js tests/flow-utils.test.js tests/flow-security.test.js tests/flow-memory-db.test.js tests/flow-durable-session.test.js tests/flow-skill-matcher.test.js tests/flow-bridge.test.js tests/flow-proactive-compact.test.js tests/flow-cascade-completion.test.js tests/flow-capture-gate.test.js tests/flow-correction-detector-hybrid.test.js tests/flow-promote.test.js tests/flow-archive-runs.test.js tests/flow-memory.test.js tests/flow-hooks-pre-tool-helpers.test.js tests/flow-hooks-bugfix-scope-gate.test.js tests/flow-hooks-routing-gate.test.js tests/flow-hooks-phase-read-gate.test.js tests/flow-hooks-commit-log-gate.test.js tests/flow-hooks-deploy-gate.test.js tests/flow-hooks-todowrite-gate.test.js tests/flow-hooks-git-safety-gate.test.js tests/flow-hooks-scope-mutation-gate.test.js tests/flow-hooks-strike-gate.test.js tests/flow-hooks-component-check.test.js tests/flow-hooks-scope-gate.test.js tests/flow-hooks-implementation-gate.test.js tests/flow-hooks-research-gate.test.js tests/flow-hooks-loop-check.test.js tests/flow-hooks-manager-boundary-gate.test.js tests/flow-hooks-phase-gate.test.js tests/flow-hooks-pre-tool-orchestrator.test.js tests/flow-hooks-observation-capture.test.js tests/flow-hooks-task-gate.test.js tests/flow-durable-session-suspension.test.js tests/flow-health-mcp-scopes.test.js tests/flow-lean-config.test.js tests/flow-workspace-autopickup.test.js tests/flow-worker-boundary-gate.test.js tests/flow-worker-question-classifier.test.js && NODE_ENV=test node tests/run-quality-gates.test.js",
+    "test": "NODE_ENV=test node --test tests/auto-compact-prompt.test.js tests/flow-paths.test.js tests/flow-io.test.js tests/flow-config-loader.test.js tests/flow-damage-control.test.js tests/flow-output.test.js tests/flow-constants.test.js tests/flow-session-state.test.js tests/flow-hooks-integration.test.js tests/flow-utils.test.js tests/flow-security.test.js tests/flow-memory-db.test.js tests/flow-durable-session.test.js tests/flow-skill-matcher.test.js tests/flow-bridge.test.js tests/flow-proactive-compact.test.js tests/flow-cascade-completion.test.js tests/flow-capture-gate.test.js tests/flow-correction-detector-hybrid.test.js tests/flow-promote.test.js tests/flow-archive-runs.test.js tests/flow-memory.test.js tests/flow-hooks-pre-tool-helpers.test.js tests/flow-hooks-bugfix-scope-gate.test.js tests/flow-hooks-routing-gate.test.js tests/flow-hooks-phase-read-gate.test.js tests/flow-hooks-commit-log-gate.test.js tests/flow-hooks-deploy-gate.test.js tests/flow-hooks-todowrite-gate.test.js tests/flow-hooks-git-safety-gate.test.js tests/flow-hooks-scope-mutation-gate.test.js tests/flow-hooks-strike-gate.test.js tests/flow-hooks-component-check.test.js tests/flow-hooks-scope-gate.test.js tests/flow-hooks-implementation-gate.test.js tests/flow-hooks-research-gate.test.js tests/flow-hooks-loop-check.test.js tests/flow-hooks-manager-boundary-gate.test.js tests/flow-hooks-phase-gate.test.js tests/flow-hooks-pre-tool-orchestrator.test.js tests/flow-hooks-observation-capture.test.js tests/flow-hooks-task-gate.test.js tests/flow-durable-session-suspension.test.js tests/flow-health-mcp-scopes.test.js tests/flow-lean-config.test.js tests/flow-workspace-autopickup.test.js tests/flow-worker-boundary-gate.test.js tests/flow-worker-question-classifier.test.js tests/flow-completion-truth-gate-contradictions.test.js tests/flow-structure-sensor.test.js && NODE_ENV=test node tests/run-quality-gates.test.js",
     "test:syntax": "find scripts/ lib/ -name '*.js' -not -path '*/node_modules/*' -exec node --check {} +",
     "lint": "eslint scripts/ lib/ tests/",
     "lint:ci": "eslint scripts/ lib/ tests/ --max-warnings 0",

package/scripts/base-workflow-step.js

@@ -29,7 +29,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { PATHS, getTodayDate } = require('./flow-utils');
+const { PATHS } = require('./flow-utils');
 
 class BaseWorkflowStep {
   /**
@@ -77,7 +77,7 @@ class BaseWorkflowStep {
    * @param {object} options - Remaining options (stepConfig, mode, taskType, etc.)
    * @returns {Promise<{passed: boolean, message: string, details?: any}>}
    */
-  async execute(files, options) {
+  async execute(_files, options) {
     throw new Error(`${this.name}: execute() must be overridden`);
   }
 

package/scripts/flow-adaptive-learning.js

@@ -15,7 +15,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { execFileSync } = require('node:child_process');
-const { getProjectRoot, colors, PATHS, getTodayDate } = require('./flow-utils');
+const { colors, PATHS, getTodayDate } = require('./flow-utils');
 const { error: errorMsg } = require('./flow-output');
 const { readJson } = require('./flow-io');
 const { storeSingleLearning, getAdapterPath } = require('./flow-model-adapter');
@@ -24,7 +24,7 @@ const {
   detectCategory,
   shouldEscalate: checkShouldEscalate
 } = require('./flow-failure-categories');
-const { validateRepoFormat, safeGitCommand, sanitizeCommitMessage } = require('./flow-security');
+const { validateRepoFormat, safeGitCommand } = require('./flow-security');
 
 const LEARNING_LOG_PATH = path.join(PATHS.state, 'adaptive-learning.json');
 const STRATEGY_STATS_PATH = path.join(PATHS.state, 'strategy-effectiveness.json');
@@ -66,7 +66,7 @@ const ERROR_CATEGORIES = {
  * @param {object} context - Task context
  * @returns {object} Failure analysis
  */
-function analyzeFailure(error, output, context = {}) {
+function analyzeFailure(error, output, _context = {}) {
   const errorStr = String(error);
   const outputStr = String(output || '');
 
@@ -393,7 +393,7 @@ function generateGuidanceFromFailures(category, details) {
   switch (category) {
     case 'IMPORT_ERROR': {
       const modules = details.map(d => d.moduleName).filter(Boolean);
-      const exports = details.map(d => d.exportName).filter(Boolean);
+      const _exports = details.map(d => d.exportName).filter(Boolean);
       return {
         do: 'Copy import paths exactly from the "Available Imports" section',
         dont: modules.length > 0
@@ -530,7 +530,7 @@ function getBestStrategy(modelName, category) {
 /**
  * Check if a similar learning already exists
  */
-function isDuplicateLearning(modelName, category, details) {
+function isDuplicateLearning(modelName, category, _details) {
   const adapterPath = getAdapterPath(modelName);
   if (!fs.existsSync(adapterPath)) return false;
 
@@ -800,7 +800,7 @@ function checkGitHubCLI() {
   try {
     execFileSync('gh', ['auth', 'status'], { stdio: 'pipe' });
     return { available: true };
-  } catch (err) {
+  } catch (_err) {
     return { available: false, error: 'gh CLI not authenticated. Run: gh auth login' };
   }
 }

package/scripts/flow-api-index.js

@@ -15,11 +15,11 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { getProjectRoot, getConfig, color, success, warn, error, safeJsonParse, PATHS } = require('./flow-utils');
+const { color, success, warn, error, safeJsonParse, PATHS } = require('./flow-utils');
 const {
   findSimilarItems,
   generateAIDecisionPrompt,
-  generateContextBlock,
+  generateContextBlock: _generateContextBlock,
   getMatchConfig
 } = require('./flow-semantic-match');
 const { BaseScanner, PROJECT_ROOT } = require('./flow-scanner-base');

package/scripts/flow-architect-pass.js

@@ -42,7 +42,7 @@ const path = require('node:path');
 const { PATHS } = require('./flow-paths');
 const { fileExists, ensureDir, readFile } = require('./flow-io');
 const { getConfig } = require('./flow-config-loader');
-const { color, info, warn, error } = require('./flow-output');
+const { color, warn, error } = require('./flow-output');
 
 const gateTelemetry = require('./flow-gate-telemetry');
 

package/scripts/flow-ask.js

@@ -69,7 +69,7 @@ function clearPendingQuestion() {
   try {
     fs.unlinkSync(p);
     return { cleared: true, wasPresent: true };
-  } catch (err) {
+  } catch (_err) {
     return { cleared: false, wasPresent: true };
   }
 }

package/scripts/flow-assumption-detector.js

@@ -159,7 +159,7 @@ function detectAssumptions(params) {
 /**
  * Detect technical assumptions (framework, patterns, etc.)
  */
-function detectTechnicalAssumptions(title, description, context) {
+function detectTechnicalAssumptions(title, description, _context) {
   const assumptions = [];
   const text = `${title} ${description}`.toLowerCase();
 

package/scripts/flow-audit-gates.js

@@ -33,7 +33,7 @@ const { execFileSync, execSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
 
-const { PATHS, getConfig, safeJsonParse, color } = require('./flow-utils');
+const { PATHS, safeJsonParse } = require('./flow-utils');
 
 // ============================================================
 // Score Cap Thresholds
@@ -90,15 +90,25 @@ function runProjectScript(scriptName, timeout = 60000) {
       stdio: ['pipe', 'pipe', 'pipe'],
       env: { ...process.env, FORCE_COLOR: '0', NO_COLOR: '1' }
     });
-    return { exists: true, passed: true, output: output.substring(0, 5000), errorCount: 0 };
+    return { exists: true, passed: true, output: truncateOutput(output), errorCount: 0, rawOutput: output };
   } catch (err) {
     const output = (err.stdout || '') + (err.stderr || '');
-    // Count error lines
     const errorCount = (output.match(/error TS\d+|Error:|ERROR/gi) || []).length;
-    return { exists: true, passed: false, output: output.substring(0, 5000), errorCount };
+    return { exists: true, passed: false, output: truncateOutput(output), errorCount, rawOutput: output };
   }
 }
 
+/**
+ * Truncate output while preserving head AND tail so that end-of-output
+ * summary lines (e.g. "N problems (X errors, Y warnings)") remain parseable.
+ */
+function truncateOutput(output) {
+  if (!output || output.length <= 5000) return output;
+  const head = output.substring(0, 3500);
+  const tail = output.substring(output.length - 1500);
+  return `${head}\n\n... [truncated ${output.length - 5000} chars] ...\n\n${tail}`;
+}
+
 /**
  * Gate: Build check — does the project compile?
  */
@@ -161,16 +171,22 @@ function checkTypecheck() {
 function checkLint() {
   const result = runProjectScript('lint', 60000);
 
-  // Parse error/warning counts
+  // Parse error/warning counts from the RAW (untruncated) output so the
+  // end-of-output ESLint summary line is never missed. Bug fixed 2026-04-16:
+  // previously used result.output which was truncated to 5000 chars, causing
+  // runs with many warnings to silently report "0 warnings".
   let errorCount = 0;
   let warningCount = 0;
-  if (result.output) {
-    // ESLint format: "N problems (X errors, Y warnings)"
-    const match = result.output.match(/(\d+) problems?\s*\((\d+) errors?,\s*(\d+) warnings?\)/);
-    if (match) {
-      errorCount = parseInt(match[2], 10);
-      warningCount = parseInt(match[3], 10);
-    }
+  const parseSource = result.rawOutput || result.output || '';
+  // ESLint format: "N problems (X errors, Y warnings)"
+  const match = parseSource.match(/(\d+) problems?\s*\((\d+) errors?,\s*(\d+) warnings?\)/);
+  if (match) {
+    errorCount = parseInt(match[2], 10);
+    warningCount = parseInt(match[3], 10);
+  } else {
+    // Fallback: count individual warning/error lines (still accurate if summary missing).
+    warningCount = (parseSource.match(/^\s*\d+:\d+\s+warning/gm) || []).length;
+    errorCount = (parseSource.match(/^\s*\d+:\d+\s+error/gm) || []).length;
   }
 
   let scoreCap = 100;
@@ -312,9 +328,19 @@ function checkScriptCompleteness() {
  */
 function countEslintDisables() {
   try {
+    // Exclude node_modules, dist, build, coverage, and .workflow runtime data.
+    // Bug fixed 2026-04-16: previously walked the entire repo and counted
+    // eslint-disable in dependencies, inflating project-health reports.
     const output = execFileSync('grep', [
       '-r', 'eslint-disable',
       '--include=*.ts', '--include=*.tsx', '--include=*.js', '--include=*.jsx',
+      '--exclude-dir=node_modules',
+      '--exclude-dir=dist',
+      '--exclude-dir=build',
+      '--exclude-dir=coverage',
+      '--exclude-dir=.next',
+      '--exclude-dir=.workflow',
+      '--exclude-dir=.git',
       '-c', '.'
     ], { cwd: PATHS.root, encoding: 'utf-8', timeout: 15000, stdio: ['pipe', 'pipe', 'pipe'] }).toString();
     const lines = output.trim().split('\n').filter(Boolean);

package/scripts/flow-audit.js

@@ -16,12 +16,12 @@
  */
 
 const { execFileSync } = require('node:child_process');
-const fs = require('node:fs');
+const _fs = require('node:fs');
 const path = require('node:path');
 const {
   PATHS,
   getConfig,
-  color,
+  color: _color,
   safeJsonParse,
   safeJsonParseString,
   escapeRegex
@@ -55,10 +55,10 @@ function getProjectFiles(extraExcludes = []) {
     const config = getConfig();
     // escapeRegex imported from flow-utils.js
     const configExcludes = (config.audit?.exclude || []).map(p => {
-      try { return new RegExp(`^${escapeRegex(p)}/`); } catch (err) { return null; }
+      try { return new RegExp(`^${escapeRegex(p)}/`); } catch (_err) { return null; }
     }).filter(Boolean);
     const allExcludes = [...DEFAULT_EXCLUDE, ...configExcludes, ...extraExcludes.map(p => {
-      try { return new RegExp(p); } catch (err) { return null; }
+      try { return new RegExp(p); } catch (_err) { return null; }
     }).filter(Boolean)];
 
     return output.trim().split('\n').filter(f =>

package/scripts/flow-auto-context.js

@@ -23,13 +23,13 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { execSync, spawnSync } = require('node:child_process');
 const {
-  getProjectRoot,
+  getProjectRoot: _getProjectRoot,
   getConfig,
   PATHS,
   colors,
   isAstGrepAvailable,
   astGrepSearch,
-  AST_PATTERNS,
+  AST_PATTERNS: _AST_PATTERNS,
   findReactComponents,
   findCustomHooks,
   findTypeDefinitions,
@@ -902,7 +902,7 @@ async function getLegacyContext(description, options = {}, config = null) {
 
   const autoConf = config.taskContext?.auto || config.context?.auto;
   const maxFiles = options.maxFiles || autoConf?.maxFilesToLoad || 10;
-  const showFiles = options.showFiles ?? autoConf?.showLoadedFiles ?? true;
+  const _showFiles = options.showFiles ?? autoConf?.showLoadedFiles ?? true;
 
   // Extract keywords
   const keywords = extractKeywords(description);