wogiflow 2.26.0 → 2.26.2

package/.claude/docs/phases/05-complete.md

@@ -33,7 +33,7 @@ Reflection: "Have I introduced any bugs or regressions?"
 
 1. Reflection: "Does this match what the user asked for?"
 2. Close out all TodoWrite items for this task
-3. Move task to recentlyCompleted in ready.json
+3. **Run `node node_modules/wogiflow/scripts/flow-done.js <taskId>`** — this is the ONLY supported way to complete a task. It runs quality gates, moves the task from `inProgress` → `recentlyCompleted`, writes the gate latch, and fires the task-boundary-restart Phase 1 marker. **Do NOT hand-edit `ready.json` to move the task** — that bypasses the CLI and silently disables: quality-gate verification, gate latch, and the task-boundary session restart. If `flow` is not on PATH in this environment, invoke it as `node node_modules/wogiflow/scripts/flow-done.js <taskId>` directly.
 4. Registry maps auto-updated by `registryUpdate` quality gate (runs `flow registry-manager scan` on all active registries — app-map, function-map, api-map, schema-map, service-map)
 5. If `config.webmcp.enabled` and UI files created: run `node node_modules/wogiflow/scripts/flow-webmcp-generator.js scan`
 6. Commit: `feat: Complete wf-XXXXXXXX - [title]`

package/lib/wogi-claude

@@ -41,27 +41,68 @@ set -u
 WOGI_CLAUDE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 WOGI_EXPECT_SCRIPT="$WOGI_CLAUDE_DIR/wogi-claude-expect.exp"
 
-# Detect whether to use the expect wrapper (v2.22.4: OPT-IN only).
-# Four conditions must all hold:
-#   1. WOGI_USE_EXPECT=1 is explicitly set (opt-in)
-#   2. WOGI_NO_EXPECT is NOT set (legacy escape hatch still honored)
-#   3. `expect` is on PATH and the wogi-claude-expect.exp script exists
-#   4. The args include --dangerously-load-development-channels (the only
-#      flag that triggers the dialog we want to auto-dismiss)
+# Detect whether to use the expect wrapper for auto-dismissing the
+# --dangerously-load-development-channels modal.
 #
-# 2.22.3 tried opt-out by default; in practice, expect's text match can miss
-# Ink's ANSI-fragmented output, which deadlocks the dialog (user keystrokes
-# get held in expect's buffer instead of reaching claude). 2.22.4 flips to
-# opt-in so the default UX is predictable.
+# Precedence (highest to lowest):
+#   1. WOGI_NO_EXPECT=1 → always OFF (kill switch)
+#   2. Workspace worker mode → ON automatically (headless, cannot Enter by hand)
+#   3. WOGI_USE_EXPECT=1 → ON (explicit opt-in for interactive users)
+#   4. Default → OFF (interactive users get the native Claude Code dialog)
+#
+# Worker auto-enable (v2.26.2): WOGI_WORKSPACE_ROOT + WOGI_REPO_NAME (worker
+# side) are set by `flow workspace start` before spawning this wrapper, so
+# detection here is reliable. Interactive users never set these vars, so their
+# default remains opt-in — the v2.22.3 regression (expect's text match miss on
+# Ink ANSI output) is bounded to users who explicitly asked for expect.
+#
+# The rewritten wogi-claude-expect.exp (v2.26.2) replaces the old brittle
+# per-chunk text match with: rolling buffer + ANSI strip + bounded elapsed-time
+# window. Misses fall back to the same failure mode as running claude without
+# the wrapper (dialog stays up until someone presses Enter) — no unsafe blind
+# keystrokes injected into server-mode Claude.
+
+__wogi_is_worker=0
+if [ -n "${WOGI_WORKSPACE_ROOT:-}" ] && [ -n "${WOGI_REPO_NAME:-}" ] && \
+   [ "${WOGI_REPO_NAME}" != "manager" ]; then
+  __wogi_is_worker=1
+fi
+
+__wogi_wants_expect=0
+if [ -z "${WOGI_NO_EXPECT:-}" ]; then
+  if [ "$__wogi_is_worker" -eq 1 ] || [ "${WOGI_USE_EXPECT:-}" = "1" ]; then
+    __wogi_wants_expect=1
+  fi
+fi
+
 __wogi_use_expect=0
-if [ "${WOGI_USE_EXPECT:-}" = "1" ] && [ -z "${WOGI_NO_EXPECT:-}" ] && \
-   command -v expect >/dev/null 2>&1 && [ -x "$WOGI_EXPECT_SCRIPT" ]; then
+if [ "$__wogi_wants_expect" -eq 1 ]; then
+  # The dialog only fires when --dangerously-load-development-channels is in
+  # argv; skip the expect dance otherwise.
+  __wogi_has_flag=0
   for arg in "$@"; do
     if [ "$arg" = "--dangerously-load-development-channels" ]; then
-      __wogi_use_expect=1
+      __wogi_has_flag=1
       break
     fi
   done
+  if [ "$__wogi_has_flag" -eq 1 ]; then
+    if command -v expect >/dev/null 2>&1 && [ -x "$WOGI_EXPECT_SCRIPT" ]; then
+      __wogi_use_expect=1
+      if [ "$__wogi_is_worker" -eq 1 ]; then
+        echo "[wogi-claude] worker mode detected — auto-enabled expect-based dialog dismissal" >&2
+      fi
+    elif [ "$__wogi_is_worker" -eq 1 ]; then
+      # Headless worker + missing expect = the dialog WILL deadlock this
+      # worker on restart. Warn loudly so the operator can install expect,
+      # but still start claude (better than failing the worker outright).
+      echo "[wogi-claude] WARNING: worker mode detected (repo '${WOGI_REPO_NAME}') but 'expect' is not installed." >&2
+      echo "[wogi-claude] The --dangerously-load-development-channels dialog will block this worker on the next restart." >&2
+      echo "[wogi-claude] Install expect to enable headless auto-dismiss:" >&2
+      echo "[wogi-claude]   macOS:           brew install expect" >&2
+      echo "[wogi-claude]   Debian/Ubuntu:   apt install expect" >&2
+    fi
+  fi
 fi
 
 # run_claude — invoke claude, routing through expect when we can auto-dismiss

package/lib/wogi-claude-expect.exp

@@ -8,21 +8,38 @@
 #   - The CLI is launched with --dangerously-load-development-channels
 #
 # There's no Claude Code setting that persists an "accepted" state
-# (verified via decompiled source 2026-04-17). So we intercept the dialog
-# at the wrapper level: spawn claude in an expect-managed PTY, watch for
-# the dialog title text, send Enter to accept the already-highlighted
-# "I am using this for local development" option, then hand off control
-# to the user via `interact`.
+# (verified via decompiled source 2026-04-17) and no --accept-dev-channels
+# flag exists in `claude --help`.
+#
+# v2.22.x implementation (DEPRECATED): `-re "Loading development channels"`
+# matched per-chunk output. Ink paints the dialog in fragmented writes
+# interleaved with ANSI color codes, so the literal phrase rarely arrived
+# in a single buffer and the regex missed. Workers deadlocked.
+#
+# v2.26.2 rewrite (this file) solves it with three properties:
+#   1. Rolling buffer — accumulate every chunk into one growing string,
+#      match against the whole buffer on each iteration, not per-chunk.
+#   2. ANSI strip — remove CSI / OSC escape sequences before matching,
+#      so the color-interleaved Ink output normalizes to plain text.
+#   3. Bounded elapsed-time window — stop accumulating after
+#      WOGI_EXPECT_TIMEOUT seconds (default 30). Without this, a very
+#      chatty claude startup with no dialog would keep exp_continue'ing
+#      forever until the per-iteration timeout.
+#
+# NO BLIND FALLBACK. If the window elapses without matching, we hand off
+# to interact unchanged. Sending a speculative \r to claude in server:
+# mode mid-startup is not safe (server-mode input handling is not a
+# standard REPL and could corrupt the handshake). Miss = same failure
+# mode as running claude without this wrapper. Worker retries via
+# wogi-claude's restart loop.
 #
 # Usage (invoked from lib/wogi-claude):
 #   expect wogi-claude-expect.exp /absolute/path/to/claude [args...]
 #
 # Disable at runtime: set WOGI_NO_EXPECT=1. The wrapper then execs claude
-# directly and the user sees the dialog as before (manual single-click).
+# directly and the user sees the dialog as before.
 
 set timeout 30
-
-# Allow WOGI_EXPECT_TIMEOUT override (rarely needed)
 if {[info exists env(WOGI_EXPECT_TIMEOUT)]} {
     set timeout $env(WOGI_EXPECT_TIMEOUT)
 }
@@ -40,34 +57,84 @@ set claude_bin [lindex $argv 0]
 set claude_args [lrange $argv 1 end]
 
 # Spawn claude in a pseudo-TTY so its Ink UI renders normally.
-# eval is needed because claude_args is a list and spawn expects a
-# flattened command line.
-eval spawn $claude_bin $claude_args
+# Use {*} list-splice rather than `eval spawn` — `eval` reparses its
+# arguments as Tcl script, which lets an argument containing bracket syntax
+# (e.g. `[exec attacker-cmd]`) escape to command execution. The splice form
+# expands the list without reparsing.
+spawn $claude_bin {*}$claude_args
 
-# Watch for the DevChannels dialog title, then press Enter to accept
-# the default-highlighted "I am using this for local development" option.
+# --- Dialog dismissal watch ---
 #
-# On timeout or EOF: fall through to `interact`. If the dialog appears
-# AFTER our timeout window, the user can still answer it manually —
-# same failure mode as running claude directly.
+# dialog_buf accumulates raw stdout chunks. After each chunk we strip ANSI
+# escapes into `plain` and substring-search for the dialog title text. If
+# found, we send Enter (accepts the default-highlighted "I am using this
+# for local development" option). Otherwise we exp_continue until either
+# the total elapsed time exceeds $timeout or EOF.
+set dialog_buf ""
+set start_ts [clock seconds]
+
 expect {
-    -re "Loading development channels" {
-        # Let Ink finish rendering the dialog before sending Enter.
-        # Without this, the select-input component may not have bound
-        # its keyboard listener yet and the keystroke is dropped.
-        after 250
-        send "\r"
+    -re "(.+)" {
+        append dialog_buf $expect_out(1,string)
+
+        # Strip ANSI CSI sequences (colors, cursor moves): ESC [ ... letter
+        regsub -all {\x1b\[[0-9;?]*[a-zA-Z]} $dialog_buf "" plain
+        # Strip 8-bit CSI form (0x9B byte instead of ESC [), same terminator
+        regsub -all {\x9b[0-9;?]*[a-zA-Z]} $plain "" plain
+        # Strip OSC sequences (titles, hyperlinks): ESC ] ... BEL
+        regsub -all {\x1b\][^\x07]*\x07} $plain "" plain
+        # Strip ISO 2022 charset-selection sequences: ESC ( B, ESC ) 0, etc.
+        regsub -all {\x1b[\(\)\*\+\-\.\/][\x20-\x7e]} $plain "" plain
+        # Strip bare ESC that didn't belong to a recognized sequence
+        regsub -all {\x1b} $plain "" plain
+
+        if {[string first "Loading development channels" $plain] >= 0} {
+            # Let Ink finish rendering the select-input component before
+            # sending Enter — without this the keystroke can land before
+            # the keyboard listener binds and gets dropped.
+            after 250
+            send "\r"
+            # Fall through to interact — dialog is dismissed, user drives
+            # from here.
+        } else {
+            # Bound total accumulation by elapsed wall-clock time so we
+            # don't exp_continue forever on a chatty startup with no
+            # dialog.
+            set elapsed [expr {[clock seconds] - $start_ts}]
+            if {$elapsed < $timeout} {
+                # Cap buffer at 64KB to prevent runaway memory on a very
+                # long startup that never shows the dialog. Keep the tail
+                # half so any late-arriving title text still matches.
+                if {[string length $dialog_buf] > 65536} {
+                    set dialog_buf [string range $dialog_buf 32768 end]
+                }
+                exp_continue
+            }
+            # Elapsed >= timeout: fall through to interact without
+            # dismissing. Same failure mode as running claude without
+            # this wrapper.
+        }
     }
     timeout { }
     eof { exit }
 }
 
-# Hand off: user's keystrokes flow to claude, claude's output flows
-# to the user's terminal. interact blocks until claude exits.
-interact
+# Hand off: user's keystrokes flow to claude, claude's output flows to
+# the user's terminal. interact blocks until claude exits.
+#
+# Test hook: set WOGI_EXPECT_NO_INTERACT=1 to substitute `expect eof`.
+# `interact` requires a real TTY on stdin; under node:test / CI with
+# pipe-backed stdin it closes the PTY before our sent \r flushes to the
+# child. The test harness sets this env var so the behavioral tests (dialog
+# dismissal, ANSI fragmentation) can actually observe the child receiving
+# the keystroke. Production callers MUST NOT set this — users need
+# interact to drive claude after the dialog dismisses.
+if {[info exists env(WOGI_EXPECT_NO_INTERACT)] && $env(WOGI_EXPECT_NO_INTERACT) eq "1"} {
+    expect eof
+} else {
+    interact
+}
 
-# After claude exits, let the bash wrapper decide whether to restart.
-# Pass through claude's exit status (expect sets it in $expect_out(-code)
-# after `interact`, but a plain exit is sufficient since the wrapper
-# only cares about the restart flag file, not exit code).
+# Pass claude's exit status — wrapper cares about the restart flag file,
+# not exit code, so a plain exit suffices.
 exit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wogiflow",
-  "version": "2.26.0",
+  "version": "2.26.2",
   "description": "AI-powered development workflow management system with multi-model support",
   "main": "lib/index.js",
   "bin": {

package/scripts/hooks/core/task-boundary-reset.js

@@ -50,6 +50,12 @@ const { getConfig, PATHS } = require('../../flow-utils');
 const { safeJsonParse } = require('../../flow-io');
 
 const PENDING_MARKER_FILE = 'task-just-completed';
+const LAST_TRIGGERED_FILE = 'task-boundary-last-triggered';
+// Window during which a recentlyCompleted[0] entry is considered "fresh
+// enough" to retro-mark Phase 1 from the Stop hook. Large enough to cover
+// a slow quality-gate run; small enough that a session opened hours later
+// doesn't trigger a bogus restart.
+const FRESHNESS_WINDOW_MS = 5 * 60 * 1000;
 
 /**
  * Locate the pending-marker file path inside .workflow/state/.
@@ -59,6 +65,26 @@ function getPendingMarkerPath() {
   return path.join(PATHS.state, PENDING_MARKER_FILE);
 }
 
+function getLastTriggeredPath() {
+  return path.join(PATHS.state, LAST_TRIGGERED_FILE);
+}
+
+function readLastTriggered() {
+  try {
+    return safeJsonParse(getLastTriggeredPath(), null);
+  } catch (_err) {
+    return null;
+  }
+}
+
+function writeLastTriggered(taskId) {
+  try {
+    const p = getLastTriggeredPath();
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify({ taskId, at: new Date().toISOString() }));
+  } catch (_err) { /* best effort — anti-replay is defense-in-depth */ }
+}
+
 /**
  * Phase 1 — mark that a task just completed and a restart is desired at the
  * next Stop-hook boundary. Safe to call even when the feature is disabled;
@@ -196,6 +222,13 @@ function consumeAndTriggerRestart() {
     return { triggered: false, reason: `sigterm-failed: ${err.message}` };
   }
 
+  // Record anti-replay sentinel so the Stop-hook fallback in the NEW session
+  // (post-restart) doesn't retro-mark the same recentlyCompleted[0] and
+  // trigger a second restart.
+  if (markerPayload?.taskId) {
+    writeLastTriggered(markerPayload.taskId);
+  }
+
   return {
     triggered: true,
     flagPath: pre.flagPath,
@@ -203,6 +236,72 @@ function consumeAndTriggerRestart() {
   };
 }
 
+/**
+ * Phase 1 fallback — called from the Stop hook BEFORE
+ * consumeAndTriggerRestart. Detects a freshly-completed task in
+ * recentlyCompleted and writes the pending marker if neither of the primary
+ * Phase 1 paths fired.
+ *
+ * Why this exists: the primary Phase 1 writers are (a) flow-done.js:604 when
+ * `flow done <taskId>` runs, and (b) task-completed.js:522 driven by Claude
+ * Code's TaskCompleted hook. Path (b) does not fire for /wogi-start workflow
+ * completions (TaskCompleted fires for Task-tool sub-agents only — the reason
+ * for the two-phase redesign above). Path (a) only fires if the agent runs
+ * `flow done`. Older phase docs quietly encouraged "move task to
+ * recentlyCompleted in ready.json" as a substitute for `flow done`, which
+ * silently disables the restart. This fallback catches that case: if a fresh
+ * completion is visible in ready.json but no marker exists, we write one so
+ * Phase 2 can do its job.
+ *
+ * Anti-replay: recentlyCompleted[0] survives the SIGTERM + wrapper restart
+ * cycle, so without a guard the Stop hook in the NEW session would see the
+ * same fresh completion and trigger a second restart. The
+ * task-boundary-last-triggered sentinel prevents that — it records the last
+ * taskId we triggered on, and we skip if the current fresh completion
+ * matches.
+ *
+ * @returns {{ marked: boolean, taskId?: string, reason?: string }}
+ */
+function ensurePhase1MarkedIfRecentlyCompleted() {
+  try {
+    if (hasPendingMarker()) {
+      return { marked: false, reason: 'marker-already-present' };
+    }
+
+    const readyPath = path.join(PATHS.state, 'ready.json');
+    const ready = safeJsonParse(readyPath, null);
+    const recent = ready && Array.isArray(ready.recentlyCompleted)
+      ? ready.recentlyCompleted[0]
+      : null;
+    if (!recent || typeof recent !== 'object' || !recent.id || !recent.completedAt) {
+      return { marked: false, reason: 'no-fresh-completion' };
+    }
+
+    const completedTs = new Date(recent.completedAt).getTime();
+    if (!Number.isFinite(completedTs)) {
+      return { marked: false, reason: 'unparseable-completedAt' };
+    }
+    const ageMs = Date.now() - completedTs;
+    if (ageMs < 0 || ageMs > FRESHNESS_WINDOW_MS) {
+      return { marked: false, reason: 'stale-completion' };
+    }
+
+    const lastTriggered = readLastTriggered();
+    if (lastTriggered?.taskId === recent.id) {
+      return { marked: false, reason: 'already-triggered-for-this-task' };
+    }
+
+    const result = markRestartPending({
+      taskId: recent.id,
+      taskTitle: recent.title,
+      source: 'stop-hook-fallback'
+    });
+    return { marked: result.marked, taskId: recent.id, reason: result.reason };
+  } catch (err) {
+    return { marked: false, reason: `fallback-error: ${err.message}` };
+  }
+}
+
 /**
  * Convenience: whether a pending marker currently exists. Diagnostic only.
  * @returns {boolean}
@@ -219,6 +318,10 @@ module.exports = {
   // Phase 1 — called from task-completion code paths
   markRestartPending,
 
+  // Phase 1 fallback — called from the Stop hook entry BEFORE Phase 2,
+  // catches the case where flow-done didn't run and TaskCompleted didn't fire
+  ensurePhase1MarkedIfRecentlyCompleted,
+
   // Phase 2 — called from the Stop hook entry
   consumeAndTriggerRestart,
 

package/scripts/hooks/entry/claude-code/stop.js

@@ -155,7 +155,33 @@ runHook('Stop', async ({ parsedInput }) => {
   // No-op unless task-just-completed marker exists AND feature is enabled
   // AND wogi-claude wrapper env is present.
   try {
-    const { consumeAndTriggerRestart, hasPendingMarker } = require('../../core/task-boundary-reset');
+    const {
+      consumeAndTriggerRestart,
+      hasPendingMarker,
+      ensurePhase1MarkedIfRecentlyCompleted
+    } = require('../../core/task-boundary-reset');
+
+    // Phase 1 fallback: if the task completed via a path that didn't write the
+    // marker (e.g., agent edited ready.json directly instead of running
+    // `flow done`, or TaskCompleted hook didn't fire), retro-mark here so
+    // Phase 2 below can consume it. Anti-replay sentinel prevents double-firing
+    // across the SIGTERM + wrapper restart cycle.
+    try {
+      const fallback = ensurePhase1MarkedIfRecentlyCompleted();
+      if (fallback.marked && process.env.DEBUG) {
+        console.error(`[Stop] Phase 1 fallback marked ${fallback.taskId}`);
+      } else if (!fallback.marked && fallback.reason !== 'marker-already-present' &&
+                 fallback.reason !== 'no-fresh-completion' &&
+                 fallback.reason !== 'stale-completion' &&
+                 fallback.reason !== 'already-triggered-for-this-task' &&
+                 process.env.DEBUG) {
+        console.error(`[Stop] Phase 1 fallback skipped: ${fallback.reason}`);
+      }
+    } catch (err) {
+      if (process.env.DEBUG) {
+        console.error(`[Stop] Phase 1 fallback error (fail-open): ${err.message}`);
+      }
+    }
 
     // If we're about to restart, record the session in history FIRST so the
     // new session can find the prior session's resume token. Use parsedInput