wogiflow 2.26.2 → 2.29.1

package/scripts/hooks/core/feature-dossier-gate.js

@@ -0,0 +1,194 @@
+#!/usr/bin/env node
+
+/**
+ * Wogi Flow - Feature Dossier Gate (Core Module)
+ *
+ * Auto-injects matching feature dossiers + cross-cutting logic rules into
+ * the phase context so Claude doesn't have to fetch them under token pressure.
+ *
+ * Problem this solves (2026-04-24 workspace failure catalog):
+ *   - Claude doesn't proactively fetch context — grabs one thing, ignores rest
+ *   - Feature/workflow knowledge is lost between sessions
+ *   - Owner corrections stop being remembered
+ *   - "I know the rule exists" ≠ "I consulted it before acting"
+ *
+ * Two enforcement surfaces:
+ *   1. buildPhaseInjection() — called by UserPromptSubmit. Returns a
+ *      markdown block with the top matching dossiers' canonical content.
+ *      Injected into the phase prompt alongside the phase-context injection.
+ *
+ *   2. validateSpecContradictions() — called from /wogi-story spec-review.
+ *      Scans a spec file against every matching dossier and returns
+ *      blocking issues (spec mentions rejected alternative, spec reintroduces
+ *      removed element). Returns { blocked: boolean, issues: [...] }.
+ *
+ * Fail-open throughout. Missing dossiers, unreadable files, grep failures —
+ * all fail-open. The gate is an aid, not a hard stopgap; the core invariant
+ * is "don't break existing workflow if dossiers aren't set up yet."
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { PATHS, safeJsonParse, getConfig } = require('../../flow-utils');
+
+function isEnabled() {
+  try {
+    const config = getConfig();
+    return config.featureDossier?.enabled !== false;
+  } catch (_err) {
+    return true;
+  }
+}
+
+function getCurrentTaskInfo() {
+  try {
+    const ready = safeJsonParse(PATHS.ready, null);
+    if (!ready || !Array.isArray(ready.inProgress) || ready.inProgress.length === 0) {
+      return null;
+    }
+    const task = ready.inProgress[0];
+    const files = [];
+    if (task.specPath && fs.existsSync(path.join(PATHS.root, task.specPath))) {
+      files.push(task.specPath);
+    }
+    const changeFiles = listRecentlyChangedFiles();
+    return {
+      id: task.id,
+      title: task.title || '',
+      description: task.notes || task.description || '',
+      criteria: task.criteria || [],
+      files: [...new Set([...files, ...changeFiles])]
+    };
+  } catch (_err) {
+    return null;
+  }
+}
+
+function listRecentlyChangedFiles() {
+  try {
+    const { execSync } = require('node:child_process');
+    const out = execSync('git diff --name-only HEAD 2>/dev/null; git status --porcelain 2>/dev/null | awk \'{print $2}\' ', {
+      cwd: PATHS.root, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe']
+    });
+    return out.split('\n').map(s => s.trim()).filter(Boolean).slice(0, 100);
+  } catch (_err) { return []; }
+}
+
+/**
+ * Build the phase-injection block for the current task.
+ * Returns null if no matches, dossier system is disabled, or on any error.
+ */
+function getDossierInjection() {
+  if (!isEnabled()) return null;
+  let dossier, logicRules;
+  try {
+    dossier = require('../../flow-feature-dossier');
+    logicRules = require('../../flow-logic-rules');
+  } catch (_err) { return null; }
+
+  const taskInfo = getCurrentTaskInfo();
+  if (!taskInfo) return null;
+
+  const criteriaText = (taskInfo.criteria || []).map(c =>
+    typeof c === 'string' ? c : (c && c.text) || ''
+  ).join('\n');
+  const matchInput = {
+    title: taskInfo.title,
+    description: `${taskInfo.description}\n${criteriaText}`,
+    files: taskInfo.files
+  };
+
+  let featureBlock = null, rulesBlock = null;
+  try {
+    const featureMatches = dossier.matchFeatures(matchInput);
+    const config = getConfig();
+    const minScore = config.featureDossier?.autoMatchConfidence ?? 1;
+    featureBlock = dossier.buildPhaseInjection(featureMatches, { minScore, maxDossiers: 3 });
+  } catch (_err) { /* non-blocking */ }
+
+  try {
+    const ruleMatches = logicRules.matchRulesForFiles(
+      taskInfo.files,
+      [taskInfo.title, taskInfo.description].filter(Boolean)
+    );
+    rulesBlock = logicRules.buildRulesInjection(ruleMatches);
+  } catch (_err) { /* non-blocking */ }
+
+  const parts = [featureBlock, rulesBlock].filter(Boolean);
+  if (parts.length === 0) return null;
+  return parts.join('\n\n---\n\n');
+}
+
+/**
+ * Validate a spec file against all matching dossiers.
+ * Returns { blocked, issues } — blocked=true if any blocker-severity issue.
+ *
+ * @param {string} specContent
+ * @param {Object} [taskInfo] — optional pre-computed task info; otherwise detected
+ */
+function validateSpecContradictions(specContent, taskInfo) {
+  if (!isEnabled()) return { blocked: false, issues: [] };
+  let dossier;
+  try { dossier = require('../../flow-feature-dossier'); }
+  catch (_err) { return { blocked: false, issues: [] }; }
+
+  const info = taskInfo || getCurrentTaskInfo();
+  if (!info) return { blocked: false, issues: [] };
+
+  const matches = dossier.matchFeatures({
+    title: info.title,
+    description: info.description,
+    files: info.files
+  });
+
+  const allIssues = [];
+  for (const m of matches) {
+    const d = dossier.loadDossier(m.slug);
+    if (!d) continue;
+    const issues = dossier.validateSpecAgainstDossier(specContent, d);
+    for (const issue of issues) {
+      allIssues.push({ ...issue, dossier: m.slug });
+    }
+  }
+
+  let blockOnContradiction = true;
+  try {
+    const config = getConfig();
+    blockOnContradiction = config.featureDossier?.blockOnContradiction !== false;
+  } catch (_err) { /* default true */ }
+
+  const blockers = allIssues.filter(i => i.severity === 'blocker');
+  return {
+    blocked: blockOnContradiction && blockers.length > 0,
+    issues: allIssues
+  };
+}
+
+/**
+ * Format contradictions as a block message the caller can surface to the user.
+ */
+function formatContradictionMessage(issues) {
+  if (!issues || issues.length === 0) return '';
+  const lines = ['## Feature Dossier Contradiction Gate', ''];
+  lines.push(`${issues.length} contradiction(s) found between the proposed spec and one or more active feature dossiers.`);
+  lines.push('');
+  lines.push('Dossiers capture owner-rejected alternatives and removed elements. A spec that reintroduces any of these would re-introduce a bug the owner already corrected.');
+  lines.push('');
+  for (const issue of issues) {
+    lines.push(`- **[${issue.severity}]** (${issue.dossier} / ${issue.kind}) ${issue.detail}`);
+  }
+  lines.push('');
+  lines.push('**Resolution**:');
+  lines.push('1. Read the referenced dossier section in full.');
+  lines.push('2. If the owner has actually changed their mind, update the dossier (move the item out of Rejected / Removed) before proceeding.');
+  lines.push('3. Otherwise, revise the spec to not reintroduce the rejected/removed item.');
+  return lines.join('\n');
+}
+
+module.exports = {
+  isEnabled,
+  getCurrentTaskInfo,
+  getDossierInjection,
+  validateSpecContradictions,
+  formatContradictionMessage
+};

package/scripts/hooks/core/observation-capture.js

@@ -376,6 +376,27 @@ async function captureObservation(options) {
 // Exports
 // ============================================================
 
+/**
+ * Pick the authoritative tool-execution duration.
+ *
+ * Claude Code 2.1.119+ attaches a numeric `duration_ms` to PostToolUse /
+ * PostToolUseFailure payloads — real tool execution time, excluding
+ * permission prompts and PreToolUse hooks. Older CC versions omit it, so
+ * callers pass a locally-computed fallback (typically near-zero because
+ * the hook only measures the gap between adjacent statements, not the
+ * tool itself). Prefer native when numeric; fall back otherwise.
+ *
+ * @param {object} parsedInput - hook payload
+ * @param {number} fallbackMs - local duration to use when native is absent
+ * @returns {number}
+ */
+function selectDuration(parsedInput, fallbackMs) {
+  if (parsedInput && typeof parsedInput.duration_ms === 'number') {
+    return parsedInput.duration_ms;
+  }
+  return fallbackMs;
+}
+
 module.exports = {
   // Configuration
   isObservationCaptureEnabled,
@@ -387,6 +408,9 @@ module.exports = {
   summarizeInput,
   summarizeOutput,
 
+  // Duration source selection (CC 2.1.119+ native, fallback otherwise)
+  selectDuration,
+
   // Main capture function
   captureObservation
 };

package/scripts/hooks/core/overdue-dispatches.js

@@ -259,10 +259,29 @@ function buildOverdueContext(opts = {}) {
     return lostBlock;
   }
 
-  if ((!Array.isArray(overdue) || overdue.length === 0) && !lostBlock) return null;
+  // Worker completion summaries (Story B / wf-ab59f0e4): surface unseen
+  // summaries from any worker that finished an autonomous epic. Render via
+  // flow-workspace-summary.renderMultiWorker for the multi-worker block.
+  let summariesBlock = null;
+  let seenTaskIds = [];
+  try {
+    const libPath = path.resolve(__dirname, '..', '..', '..', 'lib', 'workspace-dispatch-tracking.js');
+    const { readPendingCompletionSummaries, markCompletionSummariesSeen } = require(libPath);
+    const pending = readPendingCompletionSummaries(workspaceRoot);
+    if (Array.isArray(pending) && pending.length > 0) {
+      const wsSummary = require(path.resolve(__dirname, '..', '..', 'flow-workspace-summary.js'));
+      const payloads = pending.map(p => p.summary);
+      summariesBlock = wsSummary.renderMultiWorker(payloads);
+      seenTaskIds = pending.map(p => p.taskId);
+      markCompletionSummariesSeen(workspaceRoot, seenTaskIds);
+    }
+  } catch (_err) { /* fail-open — surface what we can */ }
+
+  if ((!Array.isArray(overdue) || overdue.length === 0) && !lostBlock && !summariesBlock) return null;
 
   const sections = [];
 
+  if (summariesBlock) sections.push(summariesBlock);
   if (lostBlock) sections.push(lostBlock);
 
   if (Array.isArray(overdue) && overdue.length > 0) {

package/scripts/hooks/core/phase-gate.js

@@ -186,12 +186,26 @@ function transitionPhase(from, to, taskId) {
     }
   }
 
-  return writePhaseState({
+  const wrote = writePhaseState({
     phase: to,
     taskId: taskId || current.taskId,
     updatedAt: new Date().toISOString(),
     previousPhase: from
   });
+
+  // Clear any stale routing-pending flag left over from a prior turn when
+  // crossing a phase boundary. Uses removeRoutingFlag() (not clearRoutingPending)
+  // so the cleared-marker is preserved — we don't want to open a 15s bypass
+  // window just because a phase transitioned. Fail-open if the module is
+  // unavailable (e.g. future CLI adapter without routing-gate wired).
+  if (wrote) {
+    try {
+      const { removeRoutingFlag } = require('./routing-gate');
+      removeRoutingFlag();
+    } catch (_err) { /* fail-open */ }
+  }
+
+  return wrote;
 }
 
 /**

package/scripts/hooks/core/phase-transition-auto-review.js

@@ -0,0 +1,61 @@
+'use strict';
+
+/**
+ * Phase-transition Auto-Review trigger (wf-8d635d0e / E1).
+ *
+ * Called after a successful phase transition. When the transition is
+ * `coding → validating` and `config.autoReview.enabled`, fire a detached
+ * background review worker. Non-blocking by design (AC5) — parent returns
+ * immediately; the worker writes findings asynchronously.
+ *
+ * Failure-mode: any error from the spawn path is swallowed and logged via
+ * DEBUG only. Auto-review is an advisory signal layered on top of the
+ * existing Completion Truth Gate — a crash here must never fail the
+ * primary phase transition.
+ */
+
+const { getConfig } = require('../../flow-utils');
+
+function isAutoReviewEnabled(cfg) {
+  try {
+    const c = cfg || getConfig();
+    return c?.autoReview?.enabled === true;
+  } catch (_err) {
+    return false;
+  }
+}
+
+/**
+ * Trigger a background auto-review when appropriate.
+ *
+ * @param {string} from - prior phase
+ * @param {string} to   - new phase
+ * @param {string} taskId
+ * @param {Object} [opts]
+ * @param {Function} [opts.starter] — injectable startReview (tests)
+ * @returns {{ started:boolean, reason?:string, handle?:Object }}
+ */
+function maybeStartAutoReview(from, to, taskId, opts = {}) {
+  if (from !== 'coding' || to !== 'validating') {
+    return { started: false, reason: 'not-validating-transition' };
+  }
+  if (!taskId) {
+    return { started: false, reason: 'no-task-id' };
+  }
+  if (!isAutoReviewEnabled(opts.config)) {
+    return { started: false, reason: 'disabled' };
+  }
+
+  const starter = opts.starter || require('../../../lib/worktree-review').startReview;
+  try {
+    const handle = starter({ taskId, repoRoot: opts.repoRoot });
+    return { started: true, handle };
+  } catch (err) {
+    if (process.env.DEBUG) {
+      console.error(`[auto-review] startReview failed: ${err.message}`);
+    }
+    return { started: false, reason: 'spawn-error', error: String(err.message || err) };
+  }
+}
+
+module.exports = { maybeStartAutoReview, isAutoReviewEnabled };

package/scripts/hooks/core/post-compact.js

@@ -184,10 +184,13 @@ function handlePostCompact() {
 
   // 3. Re-set routing-pending flag
   // After compaction, the AI has fresh context and may try to act without routing.
-  // Setting routing-pending ensures the next tool use goes through routing checks.
+  // resetRoutingState() first clears any stale cleared-marker from the pre-compact
+  // turn — otherwise setRoutingPending() would short-circuit on the 15s skill-chain
+  // suppression window and leave the flag unset, creating a bypass.
   let routingReArmed = false;
   try {
-    const { setRoutingPending } = require('./routing-gate');
+    const { setRoutingPending, resetRoutingState } = require('./routing-gate');
+    resetRoutingState();
     setRoutingPending();
     routingReArmed = true;
   } catch (err) {

package/scripts/hooks/core/pre-tool-orchestrator.js

@@ -261,6 +261,27 @@ function runPreToolGates(ctx, deps) {
     }
   }
 
+  // Path-discipline gate (Story B / wf-ab59f0e4): runs in BOTH manager and
+  // worker mode (different rules each side). Cross-process state writes are
+  // blocked fail-loud so file corruption is impossible to ignore.
+  if (process.env.WOGI_WORKSPACE_ROOT) {
+    try {
+      if (typeof deps.checkPathDiscipline === 'function') {
+        const pathResult = deps.checkPathDiscipline(toolName, toolInput);
+        if (pathResult.blocked) {
+          return {
+            allowed: false,
+            blocked: true,
+            reason: pathResult.reason,
+            message: pathResult.message,
+          };
+        }
+      }
+    } catch (err) {
+      if (process.env.DEBUG) console.error(`[Hook] Path discipline gate error (fail-open): ${err.message}`);
+    }
+  }
+
   // Commit log gate
   if (toolName === 'Bash' && toolInput.command) {
     try {

package/scripts/hooks/core/routing-gate.js

@@ -385,6 +385,62 @@ function incrementStopAttempts(maxAttempts = 10) {
   }
 }
 
+/**
+ * Remove the routing-pending flag file WITHOUT writing a cleared-marker.
+ *
+ * Distinct from clearRoutingPending(): that writes a 15s cleared-marker to
+ * suppress re-setting during skill chains. This helper just deletes the flag
+ * so stale pending state (e.g. from a crashed prior turn) can't block tools
+ * on the next check. The cleared-marker path is left untouched — so if a
+ * /wogi-* skill is actively executing, its suppression window is preserved.
+ *
+ * Used by phase transitions: moving between phases should not leave stale
+ * pending flags blocking tools, but must not create a bypass window either.
+ *
+ * @returns {{ removed: boolean }}
+ */
+function removeRoutingFlag() {
+  try {
+    fs.unlinkSync(ROUTING_FLAG_PATH);
+    return { removed: true };
+  } catch (err) {
+    if (err.code === 'ENOENT') return { removed: true };
+    if (process.env.DEBUG) {
+      console.error(`[routing-gate] removeRoutingFlag failed: ${err.message}`);
+    }
+    return { removed: false };
+  }
+}
+
+/**
+ * Reset routing state entirely — delete BOTH the pending flag and the
+ * cleared-marker. Leaves a clean slate so the next UserPromptSubmit re-arms
+ * the gate normally without any inherited bypass window.
+ *
+ * Used by PostCompact: compaction produces fresh context, so any in-flight
+ * skill-chain suppression or stale pending flag from the pre-compact turn
+ * is no longer relevant. Caller is responsible for re-arming via
+ * setRoutingPending() if the post-reset state needs a pending flag.
+ *
+ * @returns {{ reset: boolean }}
+ */
+function resetRoutingState() {
+  let ok = true;
+  for (const p of [ROUTING_FLAG_PATH, ROUTING_CLEARED_PATH]) {
+    try {
+      fs.unlinkSync(p);
+    } catch (err) {
+      if (err.code !== 'ENOENT') {
+        ok = false;
+        if (process.env.DEBUG) {
+          console.error(`[routing-gate] resetRoutingState unlink ${p} failed: ${err.message}`);
+        }
+      }
+    }
+  }
+  return { reset: ok };
+}
+
 module.exports = {
   isRoutingGateEnabled,
   hasActiveTask,
@@ -394,6 +450,8 @@ module.exports = {
   isRoutingRecentlyCleared,
   checkRoutingGate,
   incrementStopAttempts,
+  removeRoutingFlag,
+  resetRoutingState,
   ROUTING_FLAG_PATH,
   ROUTING_CLEARED_PATH
 };

package/scripts/hooks/core/session-context.js

@@ -138,6 +138,12 @@ const KNOWN_STATE_FILES = new Set([
   '.routing-pending',
   '.routing-cleared',
   '.gates-passed.json',
+
+  // Task-boundary restart machinery (wf-39e9dc09, R-336, wf-f267ea2a)
+  'task-just-completed',
+  'task-boundary-last-triggered',
+  'task-boundary-clean-completion.json',
+  'pending-question.json',
 ]);
 
 /** Known directory names within state/ (not files) */
@@ -871,6 +877,108 @@ function formatContextForInjection(context) {
     // Non-critical — history file may not exist; continue with normal context
   }
 
+  // AUTO-PICKUP after clean completion (wf-f267ea2a).
+  // When the prior task completed cleanly AND the ready queue is non-empty AND
+  // no pending-question marker exists, instruct the AI to immediately invoke
+  // /wogi-start <nextReadyId> on the first user message rather than asking
+  // "what's next?". This is the main-mode mirror of workspace.autoPickupChannelDispatches.
+  //
+  // Marker is consumed (deleted) on every SessionStart that observes it,
+  // regardless of whether AUTO-PICKUP fires — so a stale marker can't loop
+  // across unrelated future restarts. Fail-open throughout: any error or
+  // missing config falls back to the default "proceed with next instruction".
+  try {
+    const cleanMarkerPath = path.join(PATHS.state, 'task-boundary-clean-completion.json');
+    if (fs.existsSync(cleanMarkerPath)) {
+      const config = getConfig();
+      const tbr = config.taskBoundaryReset || {};
+      const flagEnabled = tbr.autoPickupNextTask !== false; // default true
+      const pendingQuestionPath = path.join(PATHS.state, 'pending-question.json');
+      const hasPendingQuestion = fs.existsSync(pendingQuestionPath);
+
+      // Read the marker for diagnostic context (which task completed)
+      const markerPayload = safeJsonParse(cleanMarkerPath, null);
+
+      // Find next ready task. Prefer the first non-epic task — epics are
+      // containers whose work lives in their child stories, and auto-picking an
+      // epic produces a restart loop (wogi-start on an epic has no actionable
+      // next step when its children are not yet ready-queue tasks). If the
+      // queue contains only epics, emit no auto-pickup (safer to stop the loop
+      // than to re-enter it).
+      //
+      // Cascade-after-decomposition (Story E / wf-e28b6cd8): when the marker
+      // carries a `nextTaskId` (set by the cascade helper after epic
+      // decomposition), use that explicitly. Verify the ID still exists in
+      // ready.json before honoring it; if missing/stale, fall back to default
+      // first-actionable resolution.
+      let nextTaskId = null;
+      let nextTaskTitle = null;
+      try {
+        const ready = getReadyData();
+        const queue = Array.isArray(ready?.ready) ? ready.ready : [];
+        if (markerPayload && markerPayload.nextTaskId) {
+          const explicit = queue.find(t => t && t.id === markerPayload.nextTaskId);
+          if (explicit) {
+            nextTaskId = explicit.id;
+            nextTaskTitle = explicit.title || null;
+          }
+        }
+        if (!nextTaskId) {
+          const firstActionable = queue.find(t => t && t.type !== 'epic');
+          if (firstActionable) {
+            nextTaskId = firstActionable.id || null;
+            nextTaskTitle = firstActionable.title || null;
+          }
+        }
+      } catch (_err) { /* fall through — no auto-pickup if ready.json unreadable */ }
+
+      const shouldInject = flagEnabled && !hasPendingQuestion && nextTaskId;
+
+      if (shouldInject) {
+        output += `### ⚡ AUTO-PICKUP MODE ACTIVE\n`;
+        output += `Prior task **${markerPayload?.completedTaskId || 'unknown'}** (${markerPayload?.completedTaskTitle || 'no title'}) completed cleanly. The next ready task is **${nextTaskId}** — ${nextTaskTitle || '(no title)'}.\n\n`;
+        output += `**ON THE FIRST USER MESSAGE IN THIS SESSION (regardless of content): immediately invoke \`Skill(skill="wogi-start", args="${nextTaskId}")\`.**\n\n`;
+        output += `Do NOT ask "what's next?". Do NOT summarize prior work. Do NOT propose alternatives. The user has authorized autonomous continuation across this epic. If you have a question that genuinely cannot be resolved by self-challenge, use \`flow ask "<question>"\` so the next restart defers correctly (R-336).\n\n`;
+      }
+
+      // Always consume the marker (single-use), regardless of whether we injected
+      try { fs.unlinkSync(cleanMarkerPath); } catch (_err) { /* best effort */ }
+    }
+  } catch (_err) {
+    // Non-critical — fall through to default context
+  }
+
+  // Autonomous walk-away mode rehydration (wf-d712002e / Story C).
+  // Disk is canonical; cache evaporates at SIGTERM. SessionStart re-hydrates
+  // the cache from disk and surfaces the active-mode reminder so the AI
+  // continues to honor autonomous routing across task-boundary restarts.
+  // Stale-flag detection (older than autonomousMode.stalenessThresholdMs,
+  // default 1h) emits an interruption notice and clears the flag — no
+  // auto-resume; the user must explicitly say "continue" / "resume".
+  try {
+    const sessionState = require('../../flow-session-state');
+    const result = sessionState.rehydrateAutonomousFromDisk();
+    if (result.hydrated && result.mode) {
+      const mode = result.mode;
+      output += `### ⚡ AUTONOMOUS MODE ACTIVE\n`;
+      output += `Walk-away run \`${mode.runId}\` is in progress (trigger: "${mode.trigger}", started ${mode.activatedAt}).\n\n`;
+      output += `**Routing rules** for this run:\n`;
+      output += `- productBehavior / ux questions → \`queue-for-review\` (do NOT ask the user; \`flow-question-queue\` collects them).\n`;
+      output += `- engineering / naming / implementation → decide autonomously.\n`;
+      output += `- low-confidence technical → self-adversarial challenge to ≥90% confidence; if still uncertain after the cap, queue.\n`;
+      output += `- Blocking errors (typecheck/test/conflict) → fix autonomously; only surface if fundamentally un-fixable.\n\n`;
+      output += `**No hedging**. Forbidden phrases (per feedback-patterns.md 2026-04-16): "let me know if", "should I continue", "awaiting your signal", "standing by", "would you like me to". The user is walked away; there is no one to answer until the run ends.\n\n`;
+      output += `**Exit conditions**: ready queue drains, user types "stop"/"pause", or fatal error. On exit: render completion summary (terminal block + JSON payload at \`autonomous-run-summary-${mode.runId}.json\`).\n\n`;
+    } else if (result.reason === 'stale' && result.staleMode) {
+      const stale = result.staleMode;
+      output += `### ⚠️ Autonomous Run Interrupted\n`;
+      output += `A previous autonomous run (\`${stale.runId}\`, started ${stale.activatedAt}) exceeded the staleness threshold and has been cleared.\n\n`;
+      output += `Review \`.workflow/state/autonomous-run-summary-${stale.runId}.json\` (if present) to see what completed before the interruption. The session is now in standard interactive mode. To resume, the user must explicitly say "continue" / "resume autonomous run" — do not auto-restart.\n\n`;
+    }
+  } catch (_err) {
+    // Non-critical — autonomous-mode injection failure must not block session start
+  }
+
   // Workspace worker auto-resume (wf-restart-handoff / 2.22.2).
   // CRITICAL priority — shown at the top so the model acts on it before
   // anything else. Fires when a worker session starts with queued channel

package/scripts/hooks/core/session-end-memory-proposals.js

@@ -0,0 +1,65 @@
+'use strict';
+
+/**
+ * Wogi Flow — Session End: Memory Proposal Surfacing
+ *
+ * Reads pending IGR-artifact edit proposals staged by `flow memory propose`
+ * and returns a structured summary for the session-end adapter to display.
+ *
+ * Agent-proposed edits do NOT auto-apply. The user reviews at session-end
+ * and runs `flow memory approve <id>` / `flow memory reject <id>`.
+ *
+ * Story: wf-4434851f (IGR artifact edit proposals).
+ */
+
+const store = require('../../../lib/memory-proposal-store');
+
+function summarizePendingMemoryProposals() {
+  let pending;
+  try {
+    pending = store.listProposals({ status: 'pending' });
+  } catch (_err) {
+    return null;
+  }
+  if (!pending || pending.length === 0) return null;
+
+  const byOp = { append: 0, 'replace-section': 0, 'replace-all': 0 };
+  const byBlock = {};
+  const previews = [];
+  for (const p of pending) {
+    byOp[p.op] = (byOp[p.op] || 0) + 1;
+    byBlock[p.block] = (byBlock[p.block] || 0) + 1;
+    try {
+      previews.push(store.previewProposal(p));
+    } catch (_err) {
+      // Non-fatal — skip a broken preview but keep the rest.
+    }
+  }
+
+  return {
+    count: pending.length,
+    byOp,
+    byBlock,
+    proposals: pending,
+    previews,
+    message: formatMessage(pending.length, byOp, previews),
+  };
+}
+
+function formatMessage(count, byOp, previews) {
+  const plural = count !== 1 ? 's' : '';
+  const breakdown = Object.entries(byOp)
+    .filter(([, n]) => n > 0)
+    .map(([op, n]) => `${n} ${op}`)
+    .join(', ');
+  return [
+    `${count} pending memory proposal${plural} (${breakdown}):`,
+    ...previews,
+    '',
+    'Review:  flow memory list',
+    'Approve: flow memory approve <id>',
+    'Reject:  flow memory reject  <id> [--reason <text>]',
+  ].join('\n');
+}
+
+module.exports = { summarizePendingMemoryProposals };