wogiflow 2.33.0 → 2.34.2

package/scripts/hooks/core/phase-read-gate.js

@@ -23,10 +23,31 @@
 
 const path = require('node:path');
 const fs = require('node:fs');
-const { PATHS, safeJsonParse } = require('../../flow-utils');
+const { PATHS, safeJsonParse, getCanonicalStateDir, isLinkedWorktree } = require('../../flow-utils');
 
+// Exported for tests (main-tree path). The gate resolves these paths CANONICALLY
+// at call time (see workflowPhasePath / phaseReadsPath) so it cannot be evaded
+// from a git worktree, where the gitignored phase file is absent (wf-e5e57361 /
+// RC2). In the main working tree the canonical path equals this constant.
 const PHASE_READS_FILE = path.join(PATHS.state, 'phase-reads.json');
-const WORKFLOW_PHASE_FILE = path.join(PATHS.state, 'workflow-phase.json');
+
+// Lazy canonical resolvers — `stateDir` override is injectable for tests.
+function workflowPhasePath(stateDir) { return path.join(stateDir || getCanonicalStateDir(), 'workflow-phase.json'); }
+function phaseReadsPath(stateDir) { return path.join(stateDir || getCanonicalStateDir(), 'phase-reads.json'); }
+
+/**
+ * True if the canonical ready.json shows a task in-progress. Used to fail the
+ * gate CLOSED (rather than open) when phase state is unresolvable inside a
+ * worktree of an in-progress task — the gate-evasion shape from RC2.
+ */
+function hasCanonicalInProgressTask(stateDir) {
+  try {
+    const ready = safeJsonParse(path.join(stateDir || getCanonicalStateDir(), 'ready.json'), { inProgress: [] });
+    return Array.isArray(ready.inProgress) && ready.inProgress.length > 0;
+  } catch (_err) {
+    return false;
+  }
+}
 
 // Maps workflow phases to required instruction files
 const PHASE_FILE_REGISTRY = {
@@ -80,7 +101,8 @@ function recordPhaseRead(filePath) {
   // fail-open semantics mean a lost write just means the gate asks for a
   // re-read — safe degradation, not a correctness bug.
   try {
-    const existing = safeJsonParse(PHASE_READS_FILE, {});
+    const readsFile = phaseReadsPath();
+    const existing = safeJsonParse(readsFile, {});
     if (!existing.reads) existing.reads = {};
 
     existing.reads[matchedPhase] = {
@@ -88,7 +110,8 @@ function recordPhaseRead(filePath) {
       at: new Date().toISOString()
     };
 
-    fs.writeFileSync(PHASE_READS_FILE, JSON.stringify(existing, null, 2));
+    fs.mkdirSync(path.dirname(readsFile), { recursive: true });
+    fs.writeFileSync(readsFile, JSON.stringify(existing, null, 2));
 
     if (process.env.DEBUG) {
       console.error(`[PhaseReadGate] Recorded read of ${PHASE_FILE_REGISTRY[matchedPhase]} for phase ${matchedPhase}`);
@@ -113,8 +136,10 @@ function recordPhaseRead(filePath) {
  *
  * @param {string} toolName
  * @param {Object} [config] - Optional config object
+ * @param {Object} [deps] - Injectable seams for tests:
+ *   { stateDir, isLinkedWorktree, hasInProgressTask }
  */
-function checkPhaseReadGate(toolName, config) {
+function checkPhaseReadGate(toolName, config, deps = {}) {
   try {
     // Respect phaseReadGate config with fallback to phaseGate (backwards compat).
     // If phaseReadGate.enabled is explicitly false, skip. If it's undefined,
@@ -129,10 +154,32 @@ function checkPhaseReadGate(toolName, config) {
       return { blocked: false };
     }
 
-    // Read current phase
-    const phaseData = safeJsonParse(WORKFLOW_PHASE_FILE, null);
+    // RC2 (wf-e5e57361): resolve phase from the CANONICAL state dir, not cwd —
+    // a git worktree lacks the gitignored phase file, so a cwd-relative read
+    // would fail-open to an unrestricted "idle" phase ("ungated context").
+    const stateDir = deps.stateDir || getCanonicalStateDir();
+    const inWorktree = (deps.isLinkedWorktree || isLinkedWorktree);
+    const hasInProgress = (deps.hasInProgressTask || hasCanonicalInProgressTask);
+
+    // Read current phase (canonically)
+    const phaseData = safeJsonParse(workflowPhasePath(stateDir), null);
     if (!phaseData || !phaseData.phase) {
-      return { blocked: false }; // No phase data = fail-open
+      // RC2 fail-CLOSED: a missing phase file inside a linked worktree while a
+      // task is in-progress (per canonical ready.json) is the gate-evasion
+      // shape — block mutation tools instead of failing open.
+      if ((toolName === 'Edit' || toolName === 'Write' || toolName === 'Bash') &&
+          inWorktree(stateDir) && hasInProgress(stateDir)) {
+        return {
+          blocked: true,
+          message: 'Phase gate (RC2): a task is in progress but the workflow phase ' +
+            'could not be resolved, and you appear to be operating from a git worktree. ' +
+            'Gates are NOT evadable by working from a worktree — phase is resolved from ' +
+            'the canonical (main-repo) state. Return to the main working tree and satisfy ' +
+            'the gate legitimately, or channel-escalate to the manager. Do NOT create ' +
+            'worktrees or write gate-satisfying markers to bypass this.'
+        };
+      }
+      return { blocked: false }; // No phase data = fail-open (normal main-tree)
     }
 
     const currentPhase = phaseData.phase;
@@ -149,7 +196,7 @@ function checkPhaseReadGate(toolName, config) {
     }
 
     // Check if that file has been read
-    const readData = safeJsonParse(PHASE_READS_FILE, {});
+    const readData = safeJsonParse(phaseReadsPath(stateDir), {});
     const reads = readData.reads || {};
 
     if (reads[currentPhase]) {
@@ -182,7 +229,9 @@ function checkPhaseReadGate(toolName, config) {
  */
 function clearPhaseReads() {
   try {
-    fs.writeFileSync(PHASE_READS_FILE, JSON.stringify({ reads: {} }, null, 2));
+    const readsFile = phaseReadsPath();
+    fs.mkdirSync(path.dirname(readsFile), { recursive: true });
+    fs.writeFileSync(readsFile, JSON.stringify({ reads: {} }, null, 2));
   } catch (_err) {
     if (process.env.DEBUG) {
       console.error(`[PhaseReadGate] Failed to clear phase reads: ${_err.message}`);
@@ -194,6 +243,9 @@ module.exports = {
   recordPhaseRead,
   checkPhaseReadGate,
   clearPhaseReads,
+  hasCanonicalInProgressTask,
+  workflowPhasePath,
+  phaseReadsPath,
   PHASE_FILE_REGISTRY,
   PHASE_READS_FILE
 };

package/scripts/hooks/core/session-start-worker.js

@@ -40,6 +40,58 @@ function handleWorkerSessionStart() {
     const { isWorker, shouldAnnounceReady, announceWorkerReady } = require(WORKER_READY_LIB);
     if (!isWorker()) return { branch: 'skip', reason: 'not-worker' };
 
+    // S5 (wf-ee87a24e): RESUME-IN-PROGRESS. If this restarted session has a task
+    // still in `inProgress` with sub-tasks remaining (durable S1 ledger), resume
+    // THAT task — do NOT fall through to "announce idle" (which would orphan it)
+    // or pick a different next task. The durable ledger means completed sub-tasks
+    // are NOT redone. Also post a worker-ready ack so the manager actively
+    // re-triggers if the resume wake-up was missed.
+    try {
+      const { PATHS, safeJsonParse } = require('../../flow-utils');
+      const ready = safeJsonParse(path.join(PATHS.state, 'ready.json'), { inProgress: [] });
+      const inProgress = (ready.inProgress || [])[0] || null;
+      if (inProgress && inProgress.id) {
+        let remaining = null, total = null;
+        try {
+          const subtaskState = require(path.join(__dirname, '..', '..', '..', 'lib', 'workspace-subtask-state.js'));
+          const summary = subtaskState.summary(inProgress.id);
+          remaining = summary.remaining; total = summary.total;
+        } catch (_err) { /* ledger optional */ }
+        // Only treat as resumable if there is remaining decomposed work, OR no
+        // ledger exists at all (single-step task interrupted mid-flight).
+        if (remaining === null || remaining > 0) {
+          // Best-effort ack so the manager knows the worker is back on this task.
+          // Bypass shouldAnnounceReady's empty-queue gating (it returns
+          // 'in-progress-not-empty' here by design) — for a resume we WANT the
+          // manager pinged. announceWorkerReady dedups via hasPendingAnnounce.
+          try {
+            const wr = require(WORKER_READY_LIB);
+            const wsRoot = process.env.WOGI_WORKSPACE_ROOT;
+            const repoName = process.env.WOGI_REPO_NAME;
+            if (wsRoot && repoName && repoName !== 'manager') {
+              wr.announceWorkerReady(wsRoot, repoName);
+            }
+          } catch (_err) { /* ack is best-effort */ }
+          const ctx = [
+            `⚡ WORKSPACE SESSION START — RESUMING IN-PROGRESS TASK`,
+            '',
+            `This worker restarted with task ${inProgress.id} still in progress${total != null ? ` (${remaining} of ${total} sub-task(s) remaining)` : ''}.`,
+            `Durable sub-task state is on disk — completed sub-tasks are recorded and must NOT be redone.`,
+            '',
+            'AUTONOMOUS MODE CONTRACT (workspace worker):',
+            '  • Resume the SAME task — do not pick a different one, do not go idle.',
+            '  • Read .workflow/state/subtask-state.json to see which sub-tasks remain.',
+            '  • Grind to completion; only stop when done (flow done) or genuinely blocked.',
+            '',
+            `ACT NOW: Invoke Skill(skill="wogi-start", args="${inProgress.id}")`
+          ].join('\n');
+          return { branch: 'resume-in-progress', context: ctx, taskId: inProgress.id, remaining, total };
+        }
+      }
+    } catch (err) {
+      if (process.env.DEBUG) console.error(`[session-start-worker] resume-in-progress check failed (fail-open): ${err.message}`);
+    }
+
     // Check for queued work first — if any, tell the model to pick it up
     // instead of announcing idle readiness.
     let pickup;

package/scripts/hooks/core/stop-orchestrator.js

@@ -87,8 +87,12 @@ async function orchestrateStop({ parsedInput }) {
     };
   }
 
+  // S3 (wf-d3ae1717): the worker-stopped emission used to fire HERE,
+  // unconditionally, before any gate decided to continue — so the manager saw
+  // "stopped mid-work" on every turn boundary. It now fires only at a genuine
+  // stop (end of this function) with a precise terminal type, and a
+  // worker-progress heartbeat fires from the continuation gate instead.
   const workspaceNotify = require('./workspace-stop-notify');
-  await workspaceNotify.notifyWorkerStopped();
 
   const restartCoordinator = require('./task-boundary-restart-coordinator');
   const restartResult = await restartCoordinator.handleTaskBoundaryRestart({ parsedInput });
@@ -120,7 +124,18 @@ async function orchestrateStop({ parsedInput }) {
   const wsResult = await workspaceGates.checkWorkspaceStopGates({ parsedInput });
   if (wsResult?.shouldReturn) return wsResult.result;
 
-  return await checkLoopExit();
+  // Genuine stop path: no gate forced continuation. Emit a precise terminal
+  // worker signal ONLY when we're actually allowing the turn to end (canExit).
+  // continueToNext / blocked-continue are not terminal stops.
+  const loopResult = await checkLoopExit();
+  try {
+    if (loopResult?.canExit === true) {
+      await workspaceNotify.notifyWorkerTerminal();
+    }
+  } catch (err) {
+    if (process.env.DEBUG) console.error(`[Stop] terminal notify error (fail-open): ${err.message}`);
+  }
+  return loopResult;
 }
 
 module.exports = { orchestrateStop };

package/scripts/hooks/core/validation.js

@@ -222,6 +222,14 @@ async function runValidation(options = {}) {
 
   return {
     passed: allPassed,
+    // F6 (R-379): signal `blocked` so the adapter's `decision: 'block'` path
+    // actually fires when validation fails. Without this, the `continueOnBlock`
+    // wiring in transformPostToolUse is inert (decision is always undefined).
+    // With it, lint/typecheck failure after Edit/Write feeds back to Claude
+    // and (per the continueOnBlock setting) the turn continues so Claude can
+    // fix the error in-loop — which is what CLAUDE.md's "validate after every
+    // file edit" rule needs.
+    blocked: !allPassed,
     skipped: false,
     results,
     summary: generateValidationSummary(results, filePath)