wogiflow 2.33.0 → 2.34.2

package/lib/workspace-subtask-state.js

@@ -0,0 +1,215 @@
+'use strict';
+
+/**
+ * Wogi Flow — Durable Sub-task State (epic-workspace-sustained-exec / S1, wf-e72350bf)
+ *
+ * Sub-tasks of a decomposed task are normally tracked ONLY in Claude Code's
+ * in-context TodoWrite list, which is ephemeral: a Stop hook running in a fresh
+ * `node` process can't read it, and a session restart loses it entirely. That's
+ * the root cause behind workers re-executing completed sub-tasks after a restart
+ * and behind the continuation gate (S2) having no reliable "work remaining"
+ * signal.
+ *
+ * This module mirrors the decomposition to a durable, atomically-written ledger
+ * at `.workflow/state/subtask-state.json` so that:
+ *   - a fresh-process Stop hook can read "N of M sub-tasks remain" (S2),
+ *   - a restarted session can resume without redoing completed sub-tasks (S5).
+ *
+ * The ledger holds the CURRENT in-progress task's decomposition. There is one
+ * active task per worker at a time, so a single-task shape is sufficient and
+ * avoids stale cross-task contamination — read* helpers take an optional taskId
+ * and return empty when it doesn't match the ledger's task.
+ *
+ * Atomic write: tmp + fsync(file) + rename + fsync(dir), mirroring
+ * task-boundary-reset.js:writeCleanCompletionMarker so the ledger survives the
+ * SIGTERM/relaunch boundary and concurrent readers never see torn JSON.
+ *
+ * Fail-open throughout: any error degrades to "no durable state" (callers fall
+ * back to their prior behavior). Never throws.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { PATHS } = require('../scripts/flow-utils');
+const { safeJsonParse } = require('../scripts/flow-io');
+
+const LEDGER_FILE = 'subtask-state.json';
+const LEDGER_VERSION = 1;
+// Statuses that count as "still needs work" for remaining().
+const OPEN_STATUSES = new Set(['pending', 'in_progress']);
+const TERMINAL_STATUSES = new Set(['completed', 'blocked']);
+
+function getLedgerPath() {
+  return path.join(PATHS.state, LEDGER_FILE);
+}
+
+/**
+ * Normalize a free-form sub-task entry (TodoWrite item or plain object/string)
+ * into the ledger shape { id, title, status }.
+ */
+function normalizeSubtask(entry, index) {
+  if (entry == null) return null;
+  if (typeof entry === 'string') {
+    return { id: String(index + 1).padStart(2, '0'), title: entry.slice(0, 500), status: 'pending' };
+  }
+  if (typeof entry !== 'object') return null;
+  const rawStatus = typeof entry.status === 'string' ? entry.status.toLowerCase() : 'pending';
+  const status = OPEN_STATUSES.has(rawStatus) || TERMINAL_STATUSES.has(rawStatus) ? rawStatus : 'pending';
+  const title = entry.title || entry.content || entry.text || entry.description || entry.activeForm || `Sub-task ${index + 1}`;
+  const id = entry.id != null ? String(entry.id) : String(index + 1).padStart(2, '0');
+  return { id, title: String(title).slice(0, 500), status };
+}
+
+/**
+ * Map a Claude Code TodoWrite toolInput ({ todos: [{ content, status }] })
+ * into normalized sub-tasks. Returns [] for anything unparseable.
+ */
+function subtasksFromTodos(toolInput) {
+  try {
+    const todos = toolInput && Array.isArray(toolInput.todos) ? toolInput.todos : null;
+    if (!todos) return [];
+    return todos.map(normalizeSubtask).filter(Boolean);
+  } catch (_err) {
+    return [];
+  }
+}
+
+/**
+ * Read the full ledger object, or null if absent/unreadable.
+ * @returns {{version:number, taskId:string, updatedAt:string, subtasks:Array}|null}
+ */
+function readLedger() {
+  try {
+    const data = safeJsonParse(getLedgerPath(), null);
+    if (!data || typeof data !== 'object' || !Array.isArray(data.subtasks)) return null;
+    return data;
+  } catch (_err) {
+    return null;
+  }
+}
+
+/**
+ * Read the sub-tasks for a given task. When taskId is provided and doesn't match
+ * the ledger's task, returns [] (the ledger belongs to a different task).
+ * @param {string} [taskId]
+ * @returns {Array<{id:string,title:string,status:string}>}
+ */
+function read(taskId) {
+  const led = readLedger();
+  if (!led) return [];
+  if (taskId && led.taskId && led.taskId !== taskId) return [];
+  return led.subtasks;
+}
+
+/**
+ * Write/replace the ledger for taskId atomically.
+ * @param {string} taskId
+ * @param {Array} subtasks  raw or normalized entries
+ * @returns {{written:boolean, reason?:string, path?:string}}
+ */
+function write(taskId, subtasks) {
+  if (!taskId) return { written: false, reason: 'no-task-id' };
+  try {
+    const normalized = (Array.isArray(subtasks) ? subtasks : [])
+      .map(normalizeSubtask)
+      .filter(Boolean);
+    const payload = {
+      version: LEDGER_VERSION,
+      taskId,
+      updatedAt: new Date().toISOString(),
+      subtasks: normalized
+    };
+    const p = getLedgerPath();
+    const dir = path.dirname(p);
+    fs.mkdirSync(dir, { recursive: true });
+    const tmp = `${p}.tmp.${process.pid}.${Math.random().toString(36).slice(2, 8)}`;
+    const fd = fs.openSync(tmp, 'w');
+    try {
+      fs.writeSync(fd, JSON.stringify(payload, null, 2));
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.renameSync(tmp, p);
+    try {
+      const dfd = fs.openSync(dir, 'r');
+      try { fs.fsyncSync(dfd); } finally { fs.closeSync(dfd); }
+    } catch (_err) { /* directory fsync best-effort (not supported on all FS) */ }
+    return { written: true, path: p };
+  } catch (err) {
+    return { written: false, reason: `write-failed: ${err.message}` };
+  }
+}
+
+/**
+ * Count sub-tasks still needing work (pending + in_progress) for taskId.
+ * blocked and completed do NOT count. Returns 0 when no matching ledger exists
+ * (no durable state ⇒ "nothing known to remain"; callers decide what that means).
+ * @param {string} [taskId]
+ * @returns {number}
+ */
+function remaining(taskId) {
+  const subs = read(taskId);
+  return subs.filter(s => OPEN_STATUSES.has(s.status)).length;
+}
+
+/**
+ * Summary counts for heartbeats / status (S3, S4).
+ * @param {string} [taskId]
+ * @returns {{total:number, remaining:number, completed:number, blocked:number}}
+ */
+function summary(taskId) {
+  const subs = read(taskId);
+  return {
+    total: subs.length,
+    remaining: subs.filter(s => OPEN_STATUSES.has(s.status)).length,
+    completed: subs.filter(s => s.status === 'completed').length,
+    blocked: subs.filter(s => s.status === 'blocked').length
+  };
+}
+
+/**
+ * Mark one sub-task's status, preserving the rest. No-op if the ledger task
+ * doesn't match. Returns the updated count.
+ * @param {string} taskId
+ * @param {string} subId
+ * @param {string} [status='completed']
+ */
+function markStatus(taskId, subId, status = 'completed') {
+  const led = readLedger();
+  if (!led || (taskId && led.taskId !== taskId)) return { written: false, reason: 'no-matching-ledger' };
+  const next = led.subtasks.map(s => (s.id === String(subId) ? { ...s, status } : s));
+  return write(led.taskId, next);
+}
+
+/**
+ * Clear the ledger (e.g. on task completion). Best-effort.
+ */
+function clear() {
+  try {
+    fs.unlinkSync(getLedgerPath());
+    return { cleared: true };
+  } catch (err) {
+    if (err && err.code !== 'ENOENT' && process.env.DEBUG) {
+      console.error(`[workspace-subtask-state] clear: ${err.code} ${err.message}`);
+    }
+    return { cleared: false };
+  }
+}
+
+module.exports = {
+  getLedgerPath,
+  normalizeSubtask,
+  subtasksFromTodos,
+  readLedger,
+  read,
+  write,
+  remaining,
+  summary,
+  markStatus,
+  clear,
+  LEDGER_FILE,
+  OPEN_STATUSES,
+  TERMINAL_STATUSES
+};

package/lib/workspace.js

@@ -1209,6 +1209,18 @@ You are a workspace worker. There is NO human watching your terminal. You MUST o
 
 The \`TaskCompleted\` hook will inject an auto-pickup directive when channel dispatches are queued (v2.20.0+). The \`Stop\` hook will BLOCK end-of-turn if you try to stop while dispatches are queued and no task is in progress. These enforcements exist because the silent-stall pattern was incident-worthy (2026-04-16).
 
+### Sustained Execution — Grind a Dispatched Task to Completion (v2.34.0+)
+
+**A dispatched task runs to COMPLETION across turns. Do NOT stop to "report progress" after each sub-task.** When you decompose a task into sub-tasks (TodoWrite), work through ALL of them in the same session — the decomposition is mirrored to durable state (\`subtask-state.json\`) so it survives turn boundaries.
+
+"The work" in *"reply to the manager after completing the work"* means the **entire dispatched task** (all its sub-tasks), not one increment. Reply with \`## Results\` ONLY when:
+- the task is **complete** (you ran \`flow done <id>\` and it left inProgress), or
+- you are **escalating** a genuine blocker (\`## QUESTION:\` / \`## BLOCKED:\`).
+
+The \`Stop\` hook's **in-progress continuation gate** will force you to keep going (\`{continue:true}\`) while a task is in-progress in the coding/validating phase with sub-tasks remaining. If you stop early to "give visibility," it will re-prompt you to continue. Make real progress every turn (an edit, a test, a completed sub-task) — idle turns with no file changes are detected across a few continuations and stop with an escalation.
+
+**Escalate instead of proceeding** when the next step is destructive, irreversible, touches production, needs external credentials, or genuinely needs a human decision. Otherwise: keep grinding until done.
+
 ### Tool-First Turn Contract (v2.27.0+)
 
 **Every worker turn after a UserPromptSubmit MUST contain at least one tool call. In strict mode (default), the FIRST content block must be a tool call, not text.**
@@ -1768,6 +1780,61 @@ function startWorkerSession(cwd) {
  * Handle workspace subcommands
  * @param {string[]} args
  */
+/**
+ * S5 (wf-ee87a24e): manager-triggered worker restart. Resolves the worker's
+ * channel port from the workspace config and POSTs /restart. The worker's
+ * channel server writes the wrapper restart flag and SIGTERMs claude, so the
+ * wogi-claude wrapper relaunches it with a fresh require cache (reloading any
+ * upgraded wogiflow code). Resume of the in-progress task is handled by the
+ * worker's SessionStart hook (resume-in-progress branch).
+ */
+async function restartWorkerSession(cwd, workerName) {
+  // Find workspace root
+  let workspaceRoot = null;
+  let dir = cwd;
+  while (dir !== path.dirname(dir)) {
+    if (fs.existsSync(path.join(dir, WORKSPACE_CONFIG_FILE))) { workspaceRoot = dir; break; }
+    dir = path.dirname(dir);
+  }
+  if (!workspaceRoot) {
+    console.error('Error: Not inside a workspace (no wogi-workspace.json found).');
+    process.exit(1);
+  }
+  const config = safeJsonParse(path.join(workspaceRoot, WORKSPACE_CONFIG_FILE), null);
+  const member = config?.channels?.members?.[workerName];
+  if (!member || !member.port) {
+    console.error(`Error: unknown worker "${workerName}". Known workers: ${Object.keys(config?.channels?.members || {}).join(', ') || '(none)'}`);
+    process.exit(1);
+  }
+
+  const http = require('node:http');
+  const result = await new Promise((resolve) => {
+    const req = http.request({
+      hostname: '127.0.0.1', port: member.port, path: '/restart', method: 'POST',
+      headers: { 'X-Wogi-From': 'manager', 'Content-Length': 0 }, timeout: 5000
+    }, (res) => {
+      let data = '';
+      res.on('data', c => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: data }));
+    });
+    req.on('error', (err) => resolve({ error: err.message }));
+    req.on('timeout', () => { req.destroy(); resolve({ error: 'timeout' }); });
+    req.end();
+  });
+
+  if (result.error) {
+    console.error(`✗ Could not reach worker "${workerName}" on port ${member.port}: ${result.error}`);
+    console.error(`  Is the worker running? Start it with: cd ${member.path || workerName} && flow workspace start`);
+    process.exit(1);
+  }
+  if (result.status === 202) {
+    console.log(`✓ Restart signalled to "${workerName}" (port ${member.port}). The worker will relaunch with fresh code and resume its in-progress task.`);
+  } else {
+    console.error(`✗ Worker "${workerName}" returned HTTP ${result.status}: ${result.body}`);
+    process.exit(1);
+  }
+}
+
 async function workspace(args) {
   const subcommand = args[0];
 
@@ -1816,6 +1883,18 @@ async function workspace(args) {
       startWorkerSession(process.cwd());
       break;
     }
+    case 'restart': {
+      // S5 (wf-ee87a24e): cycle a worker session so it reloads upgraded code.
+      // POSTs /restart to the worker's channel; the channel server writes the
+      // wrapper flag and SIGTERMs claude → wogi-claude relaunches it fresh.
+      const workerName = args[1];
+      if (!workerName) {
+        console.error('Usage: flow workspace restart <worker>');
+        process.exit(1);
+      }
+      await restartWorkerSession(process.cwd(), workerName);
+      break;
+    }
     default:
       console.log(`
 Wogi Workspace — Multi-Repo Orchestration
@@ -1829,12 +1908,14 @@ Commands:
   add        Add a member repo to the workspace
   remove     Remove a member repo from the workspace
   start      Start a worker session with channel (run from a member repo)
+  restart    Cycle a worker session so it reloads upgraded code + resumes its task
 
 Examples:
   flow workspace init          # Create workspace from subdirectories
   flow workspace sync          # Refresh after external changes
   flow workspace status        # Show all repos, tasks, contracts
   cd frontend/ && flow workspace start   # Start worker session
+  flow workspace restart backend         # Restart the 'backend' worker (after npm upgrade)
 `);
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wogiflow",
-  "version": "2.33.0",
+  "version": "2.34.2",
   "description": "AI-powered development workflow management system with multi-model support",
   "main": "lib/index.js",
   "bin": {
@@ -10,7 +10,7 @@
   },
   "scripts": {
     "flow": "./scripts/flow",
-    "test": "NODE_ENV=test node --test tests/auto-compact-prompt.test.js tests/flow-paths.test.js tests/flow-io.test.js tests/flow-audit-gates.test.js tests/flow-standards-hook-three-layer.test.js tests/flow-correction-detector-reconcile.test.js tests/flow-correction-backfill.test.js tests/flow-audit-gates-feature-output-health.test.js tests/flow-config-loader.test.js tests/flow-damage-control.test.js tests/flow-output.test.js tests/flow-constants.test.js tests/flow-session-state.test.js tests/flow-hooks-integration.test.js tests/flow-utils.test.js tests/flow-security.test.js tests/flow-memory-db.test.js tests/flow-durable-session.test.js tests/flow-skill-matcher.test.js tests/flow-bridge.test.js tests/flow-proactive-compact.test.js tests/flow-cascade-completion.test.js tests/flow-capture-gate.test.js tests/flow-correction-detector-hybrid.test.js tests/flow-promote.test.js tests/flow-archive-runs.test.js tests/flow-memory.test.js tests/flow-hooks-pre-tool-helpers.test.js tests/flow-hooks-bugfix-scope-gate.test.js tests/flow-hooks-routing-gate.test.js tests/flow-hooks-phase-read-gate.test.js tests/flow-hooks-commit-log-gate.test.js tests/flow-hooks-deploy-gate.test.js tests/flow-hooks-todowrite-gate.test.js tests/flow-hooks-git-safety-gate.test.js tests/flow-hooks-scope-mutation-gate.test.js tests/flow-hooks-strike-gate.test.js tests/flow-hooks-component-check.test.js tests/flow-hooks-scope-gate.test.js tests/flow-hooks-implementation-gate.test.js tests/flow-hooks-research-gate.test.js tests/flow-hooks-loop-check.test.js tests/flow-hooks-manager-boundary-gate.test.js tests/flow-hooks-phase-gate.test.js tests/flow-hooks-pre-tool-orchestrator.test.js tests/flow-hooks-observation-capture.test.js tests/flow-hooks-task-gate.test.js tests/flow-durable-session-suspension.test.js tests/flow-health-mcp-scopes.test.js tests/flow-lean-config.test.js tests/flow-workspace-autopickup.test.js tests/flow-worker-boundary-gate.test.js tests/flow-worker-question-classifier.test.js tests/flow-completion-truth-gate-contradictions.test.js tests/flow-structure-sensor.test.js tests/flow-workspace-dispatch-tracking.test.js tests/workspace-ipc-sqlite.test.js tests/workspace-ipc-multi-worker.test.js tests/flow-story-gates.test.js tests/flow-workspace-restart-handoff.test.js tests/flow-wogi-claude-wrapper.test.js tests/flow-wave1-integrations.test.js tests/flow-wave2-integrations.test.js tests/flow-wave3-integrations.test.js tests/flow-commit-claims-gate.test.js tests/auto-review.test.js tests/gate-telemetry-surface.test.js tests/agents-md-alias.test.js tests/flow-skill-manage.test.js tests/fuzzy-patch.test.js tests/mode-schema.test.js tests/flow-feature-dossier.test.js tests/flow-autonomous-mode.test.js tests/flow-epic-cascade.test.js tests/flow-workspace-summary.test.js tests/flow-hooks-research-evidence-gate.test.js tests/flow-worker-mcp-strip.test.js tests/flow-orchestrate-corrections.test.js tests/flow-source-fidelity.test.js tests/flow-hooks-long-input-enforcement.test.js tests/workspace-channel-tracking.test.js tests/flow-hooks-deletion-log.test.js tests/flow-task-boundary-reset.test.js tests/flow-deferral-gate.test.js tests/flow-research-required-gate.test.js tests/flow-standards-forbidden-patterns.test.js tests/flow-hooks-architect-required-gate.test.js tests/flow-architect-runs.test.js tests/flow-installer-forbidden-patterns.test.js tests/flow-deferral-classifier-ai.test.js tests/flow-no-defer-policy.test.js tests/flow-self-adversary-loop.test.js tests/flow-impl-question-classifier.test.js tests/flow-hooks-self-adversary-gate.test.js tests/flow-scheduled-runner.test.js tests/flow-schedule-cli.test.js tests/flow-skill-portability.test.js tests/flow-skill-export.test.js && NODE_ENV=test node tests/run-quality-gates.test.js",
+    "test": "NODE_ENV=test node --test tests/auto-compact-prompt.test.js tests/flow-paths.test.js tests/flow-io.test.js tests/flow-audit-gates.test.js tests/flow-standards-hook-three-layer.test.js tests/flow-correction-detector-reconcile.test.js tests/flow-correction-backfill.test.js tests/flow-audit-gates-feature-output-health.test.js tests/flow-config-loader.test.js tests/flow-damage-control.test.js tests/flow-output.test.js tests/flow-constants.test.js tests/flow-session-state.test.js tests/flow-hooks-integration.test.js tests/flow-utils.test.js tests/flow-security.test.js tests/flow-memory-db.test.js tests/flow-durable-session.test.js tests/flow-skill-matcher.test.js tests/flow-bridge.test.js tests/flow-proactive-compact.test.js tests/flow-cascade-completion.test.js tests/flow-capture-gate.test.js tests/flow-correction-detector-hybrid.test.js tests/flow-promote.test.js tests/flow-archive-runs.test.js tests/flow-memory.test.js tests/flow-hooks-pre-tool-helpers.test.js tests/flow-hooks-bugfix-scope-gate.test.js tests/flow-hooks-routing-gate.test.js tests/flow-hooks-phase-read-gate.test.js tests/flow-hooks-commit-log-gate.test.js tests/flow-hooks-deploy-gate.test.js tests/flow-hooks-todowrite-gate.test.js tests/flow-hooks-git-safety-gate.test.js tests/flow-hooks-scope-mutation-gate.test.js tests/flow-hooks-strike-gate.test.js tests/flow-hooks-component-check.test.js tests/flow-hooks-scope-gate.test.js tests/flow-hooks-implementation-gate.test.js tests/flow-hooks-research-gate.test.js tests/flow-hooks-loop-check.test.js tests/flow-hooks-manager-boundary-gate.test.js tests/flow-hooks-phase-gate.test.js tests/flow-hooks-pre-tool-orchestrator.test.js tests/flow-hooks-observation-capture.test.js tests/flow-hooks-task-gate.test.js tests/flow-durable-session-suspension.test.js tests/flow-health-mcp-scopes.test.js tests/flow-lean-config.test.js tests/flow-workspace-autopickup.test.js tests/flow-worker-boundary-gate.test.js tests/flow-worker-question-classifier.test.js tests/flow-completion-truth-gate-contradictions.test.js tests/flow-structure-sensor.test.js tests/flow-workspace-dispatch-tracking.test.js tests/workspace-ipc-sqlite.test.js tests/workspace-ipc-multi-worker.test.js tests/flow-story-gates.test.js tests/flow-workspace-restart-handoff.test.js tests/flow-wogi-claude-wrapper.test.js tests/flow-wave1-integrations.test.js tests/flow-wave2-integrations.test.js tests/flow-wave3-integrations.test.js tests/flow-commit-claims-gate.test.js tests/auto-review.test.js tests/gate-telemetry-surface.test.js tests/agents-md-alias.test.js tests/flow-skill-manage.test.js tests/fuzzy-patch.test.js tests/mode-schema.test.js tests/flow-feature-dossier.test.js tests/flow-autonomous-mode.test.js tests/flow-epic-cascade.test.js tests/flow-workspace-summary.test.js tests/flow-hooks-research-evidence-gate.test.js tests/flow-worker-mcp-strip.test.js tests/flow-orchestrate-corrections.test.js tests/flow-source-fidelity.test.js tests/flow-hooks-long-input-enforcement.test.js tests/workspace-channel-tracking.test.js tests/flow-hooks-deletion-log.test.js tests/flow-task-boundary-reset.test.js tests/flow-deferral-gate.test.js tests/flow-research-required-gate.test.js tests/flow-standards-forbidden-patterns.test.js tests/flow-hooks-architect-required-gate.test.js tests/flow-architect-runs.test.js tests/flow-installer-forbidden-patterns.test.js tests/flow-deferral-classifier-ai.test.js tests/flow-no-defer-policy.test.js tests/flow-self-adversary-loop.test.js tests/flow-impl-question-classifier.test.js tests/flow-hooks-self-adversary-gate.test.js tests/flow-scheduled-runner.test.js tests/flow-schedule-cli.test.js tests/flow-skill-portability.test.js tests/flow-skill-export.test.js tests/flow-workspace-subtask-state.test.js tests/flow-worker-continuation-gate.test.js tests/flow-workspace-stop-notify.test.js tests/flow-workspace-channel-status.test.js tests/flow-workspace-restart-resume.test.js tests/flow-workspace-sustained-execution.test.js && NODE_ENV=test node tests/run-quality-gates.test.js",
     "test:syntax": "find scripts/ lib/ -name '*.js' -not -path '*/node_modules/*' -exec node --check {} +",
     "lint": "eslint scripts/ lib/ tests/",
     "lint:ci": "eslint scripts/ lib/ tests/ --max-warnings 0",

package/scripts/flow

@@ -381,6 +381,23 @@ case "${1:-}" in
     ready)
         node "$SCRIPT_DIR/flow-ready.js" "${@:2}"
         ;;
+    # F11 (R-379): bin/flow (npm-installed dispatcher) had `schedule` wired
+    # at line 232, but scripts/flow (dev/repo dispatcher) did not — so
+    # `flow schedule install` failed silently inside the dev repo. Wire it
+    # here so both dispatchers stay in sync. Same for `skill export`, which
+    # ships in v2.33.0 but was only reachable from the npm-installed path.
+    schedule)
+        node "$SCRIPT_DIR/flow-schedule.js" "${@:2}"
+        ;;
+    skill|skills)
+        # Sub-subcommand: `flow skill export ...` → flow-skill-export.js
+        # Other `flow skill ...` subcommands → flow-skill-manage.js (existing).
+        if [ "${2:-}" = "export" ]; then
+            node "$SCRIPT_DIR/flow-skill-export.js" "${@:3}"
+        else
+            node "$SCRIPT_DIR/flow-skill-manage.js" "${@:2}"
+        fi
+        ;;
     start)
         node "$SCRIPT_DIR/flow-start.js" "${@:2}"
         ;;

package/scripts/flow-constants.js

@@ -148,7 +148,9 @@ const KNOWN_CONFIG_KEYS = [
   // Task-boundary session restart (wf-39e9dc09) — opt-in, experimental
   'taskBoundaryReset',
   // Session hydration recency filter (wf-729ab5c0)
-  'sessionHydration'
+  'sessionHydration',
+  // Workspace (multi-repo manager/worker) — epic-workspace-sustained-exec
+  'workspace'
 ];
 
 module.exports = {

package/scripts/flow-io.js

@@ -607,6 +607,23 @@ async function acquireLock(filePath, options = {}) {
           await require('node:timers/promises').setTimeout(delay);
           continue;
         }
+      } else if (err.code === 'ENOENT' && attempt < retries) {
+        // Race: a concurrent cleanup (another process's release() or
+        // cleanupStaleLocks) removed the lock dir between our mkdirSync and the
+        // info.json write, so writeFileSync(lockInfoFile) failed ENOENT. This is
+        // transient — retry rather than failing hard. (Pre-existing flaky-lock
+        // root cause surfaced by parallel test runs; wf-0381b27b.)
+        //
+        // Remove only our EMPTY orphan dir if one lingers: rmdirSync succeeds
+        // only when the dir is empty, so we never clobber another holder's lock
+        // (its info.json would make this ENOTEMPTY → we leave it for the normal
+        // EEXIST/stale path on the next attempt).
+        try { fs.rmdirSync(lockDir); } catch (_e) { /* gone, or now held by another */ }
+        const delay = exponentialBackoff
+          ? retryDelay * Math.pow(2, attempt)
+          : retryDelay * (attempt + 1);
+        await require('node:timers/promises').setTimeout(delay);
+        continue;
       }
 
       throw new Error(`Failed to acquire lock for ${filePath}: ${err.message}`, { cause: err });

package/scripts/flow-paths.js

@@ -64,6 +64,85 @@ function getProjectRoot() {
   return process.cwd();
 }
 
+// ============================================================
+// Worktree-stable canonical resolution (wf-e5e57361 / RC2)
+// ============================================================
+//
+// `git rev-parse --show-toplevel` is NOT worktree-stable: from inside a linked
+// git worktree it returns the WORKTREE root, not the main repository root. State
+// files under `.workflow/state/` are gitignored, so a worktree never carries them
+// (e.g. `workflow-phase.json`). That made the phase gates fail-open to an
+// unrestricted "idle" phase when a process ran from a worktree — an "ungated
+// context" a worker could reach by `git worktree add`. The fix: resolve gate
+// state from the CANONICAL (main-repo) location via `--git-common-dir`, which IS
+// worktree-stable (it always points at the main repo's `.git`).
+//
+// Both values come from a single `git rev-parse` call, memoized per-process.
+
+let _gitInfo; // { topLevel, mainRoot } | null
+function resolveGitInfo() {
+  if (_gitInfo !== undefined) return _gitInfo;
+  try {
+    // One call returns two lines: show-toplevel, then git-common-dir (absolute).
+    const out = execSync('git rev-parse --path-format=absolute --show-toplevel --git-common-dir', {
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe']
+    }).trim();
+    const [topLevel, commonDir] = out.split('\n').map(s => s.trim());
+    if (topLevel && commonDir) {
+      // commonDir is `<mainRoot>/.git` in both the main tree and any worktree.
+      _gitInfo = { topLevel: path.resolve(topLevel), mainRoot: path.dirname(path.resolve(commonDir)) };
+      return _gitInfo;
+    }
+  } catch (_err) { /* not a git repo / git unavailable */ }
+  _gitInfo = null;
+  return _gitInfo;
+}
+
+/**
+ * Resolve the canonical (main-repo) `.workflow/state` directory, stable across
+ * git worktrees. Falls back to the cwd-relative STATE_DIR when git is
+ * unavailable or the canonical state dir doesn't exist (no regression vs prior
+ * behavior). An explicit `WOGI_CANONICAL_STATE_DIR` env var overrides everything
+ * (used by tests and by callers that already resolved it).
+ *
+ * @returns {string} Absolute path to the canonical `.workflow/state` directory
+ */
+let _canonicalStateDir; // memo
+function getCanonicalStateDir() {
+  if (_canonicalStateDir !== undefined) return _canonicalStateDir;
+  if (process.env.WOGI_CANONICAL_STATE_DIR && fs.existsSync(process.env.WOGI_CANONICAL_STATE_DIR)) {
+    _canonicalStateDir = process.env.WOGI_CANONICAL_STATE_DIR;
+    return _canonicalStateDir;
+  }
+  const info = resolveGitInfo();
+  if (info && info.mainRoot) {
+    const candidate = path.join(info.mainRoot, '.workflow', 'state');
+    if (fs.existsSync(candidate)) {
+      _canonicalStateDir = candidate;
+      return _canonicalStateDir;
+    }
+  }
+  _canonicalStateDir = STATE_DIR; // fallback: cwd-relative (current behavior)
+  return _canonicalStateDir;
+}
+
+/**
+ * True when the current working directory is inside a LINKED git worktree
+ * (i.e. the working-tree top-level differs from the main repository root). Used
+ * to fail gates CLOSED for in-progress tasks rather than fail-open to "idle"
+ * when phase state cannot be resolved. Returns false outside git or on the main
+ * working tree.
+ *
+ * @returns {boolean}
+ */
+function isLinkedWorktree() {
+  if (process.env.WOGI_FORCE_WORKTREE === '1') return true; // test seam
+  const info = resolveGitInfo();
+  if (!info) return false;
+  return info.topLevel !== info.mainRoot;
+}
+
 // ============================================================
 // Package Root (where wogiflow npm package lives)
 // ============================================================
@@ -283,6 +362,8 @@ function checkSpecMigration() {
 
 module.exports = {
   getProjectRoot,
+  getCanonicalStateDir,
+  isLinkedWorktree,
   PROJECT_ROOT,
   PACKAGE_ROOT,
   PACKAGE_PATHS,

package/scripts/flow-schedule.js

@@ -100,6 +100,15 @@ function nodeBinary() {
 // Unit content generators (pure — no I/O)
 // ============================================================
 
+// F8 (R-379): paths that get inlined into shell-interpreted contexts
+// (crontab lines, systemd ExecStart) MUST be single-quoted with embedded
+// single-quotes escaped. Without this, a project at `/Users/Alice Smith/...`
+// breaks the schedule because cron treats the space as an argument boundary.
+function shellQuote(s) {
+  // POSIX single-quote escape: replace each ' with '\''
+  return `'${String(s).replace(/'/g, "'\\''")}'`;
+}
+
 function generateCrontabLines(opts = {}) {
   const node = opts.node || nodeBinary();
   const runner = opts.runner || runnerScriptPath();
@@ -109,9 +118,11 @@ function generateCrontabLines(opts = {}) {
   ];
   for (const jobName of SCHEDULED_JOB_NAMES) {
     const spec = SCHEDULES[jobName];
+    const logPath = path.join(projectRoot, '.workflow', 'scratch', `scheduled-${jobName}.log`);
     lines.push(
-      `${spec.cronExpr} cd ${projectRoot} && ${node} ${runner} ${jobName} ` +
-      `>> ${path.join(projectRoot, '.workflow', 'scratch', `scheduled-${jobName}.log`)} 2>&1`
+      `${spec.cronExpr} cd ${shellQuote(projectRoot)} && ` +
+      `${shellQuote(node)} ${shellQuote(runner)} ${jobName} ` +
+      `>> ${shellQuote(logPath)} 2>&1`
     );
   }
   lines.push(`# === wogi-scheduled end ===`);
@@ -172,14 +183,18 @@ function generateSystemdServiceUnit(jobName, opts = {}) {
   const projectRoot = opts.projectRoot || repoRoot();
   if (!SCHEDULES[jobName]) throw new Error(`No schedule defined for "${jobName}"`);
 
+  // F8 (R-379): systemd ExecStart with a path containing spaces needs each
+  // arg surrounded by quotes — systemd's argument parser splits on spaces.
+  // WorkingDirectory and Standard{Output,Error} accept literal paths (no
+  // splitting), but quoting them too is harmless and consistent.
   return `[Unit]
 Description=Wogi Flow scheduled job: ${jobName}
 After=network-online.target
 
 [Service]
 Type=oneshot
-WorkingDirectory=${projectRoot}
-ExecStart=${node} ${runner} ${jobName}
+WorkingDirectory="${projectRoot}"
+ExecStart="${node}" "${runner}" "${jobName}"
 StandardOutput=append:${path.join(projectRoot, '.workflow', 'scratch', `scheduled-${jobName}.log`)}
 StandardError=append:${path.join(projectRoot, '.workflow', 'scratch', `scheduled-${jobName}.err.log`)}
 `;
@@ -361,12 +376,14 @@ function getStatus(deps = {}) {
   const cfrag = path.join(homeDir, '.config', 'wogi-flow', 'crontab-fragment');
   if (fsx.existsSync(cfrag)) status.cron.push(cfrag);
 
-  // systemd
+  // systemd — both .service and .timer files are tracked under the same key.
+  // F21 (R-379): the prior ternary `ext === 'timer' ? 'systemd' : 'systemd'`
+  // had identical branches — a meaningless conditional. Just push directly.
   const sdir = path.join(homeDir, '.config', 'systemd', 'user');
   for (const jobName of SCHEDULED_JOB_NAMES) {
     for (const ext of ['service', 'timer']) {
       const p = path.join(sdir, `wogi-scheduled-${jobName}.${ext}`);
-      if (fsx.existsSync(p)) status[ext === 'timer' ? 'systemd' : 'systemd'].push(p);
+      if (fsx.existsSync(p)) status.systemd.push(p);
     }
   }
   return status;