wogiflow 2.4.1 → 2.4.3

package/scripts/flow-pattern-enforcer.js

@@ -39,10 +39,6 @@ const {
 // Configuration
 // ============================================================
 
-const PROJECT_ROOT = getProjectRoot();
-const WORKFLOW_DIR = path.join(PROJECT_ROOT, '.workflow');
-const STATE_DIR = path.join(WORKFLOW_DIR, 'state');
-
 // ============================================================
 // Pattern Extraction
 // ============================================================
@@ -50,7 +46,7 @@ const STATE_DIR = path.join(WORKFLOW_DIR, 'state');
 /**
  * Load all patterns from decisions.md
  */
-function loadDecisionPatterns(projectRoot = PROJECT_ROOT) {
+function loadDecisionPatterns(projectRoot = PATHS.root) {
   const decisionsPath = path.join(projectRoot, '.workflow', 'state', 'decisions.md');
 
   // Read file directly in try-catch (no pre-check to avoid TOCTOU race condition)
@@ -93,7 +89,7 @@ function loadDecisionPatterns(projectRoot = PROJECT_ROOT) {
 /**
  * Load components from app-map.md
  */
-function loadAppMapComponents(projectRoot = PROJECT_ROOT) {
+function loadAppMapComponents(projectRoot = PATHS.root) {
   const appMapPath = path.join(projectRoot, '.workflow', 'state', 'app-map.md');
 
   // Read file directly in try-catch (no pre-check to avoid TOCTOU race condition)
@@ -205,7 +201,7 @@ function loadSkillPatterns(projectRoot, fileExtension, taskDescription = '') {
 /**
  * Extract patterns relevant to a specific task
  */
-function extractRelevantPatterns(task, projectRoot = PROJECT_ROOT) {
+function extractRelevantPatterns(task, projectRoot = PATHS.root) {
   const relevant = {
     decisions: [],
     components: [],
@@ -329,7 +325,7 @@ function formatPatternsForPrompt(relevantPatterns, config = {}) {
 /**
  * Inject patterns into a prompt
  */
-function injectPatterns(prompt, task, projectRoot = PROJECT_ROOT) {
+function injectPatterns(prompt, task, projectRoot = PATHS.root) {
   const config = getConfig();
   const enforcement = config.enforcement || {};
 
@@ -483,7 +479,7 @@ function validateCitations(code, patterns) {
 /**
  * Generate session start summary showing loaded patterns
  */
-function generateSessionSummary(projectRoot = PROJECT_ROOT) {
+function generateSessionSummary(projectRoot = PATHS.root) {
   const decisions = loadDecisionPatterns(projectRoot);
   const components = loadAppMapComponents(projectRoot);
   const config = getConfig();
@@ -601,16 +597,18 @@ ${userReason ? `**Reason**: ${userReason}` : ''}
 
 /**
  * Add a cross-session rule to decisions.md
- * Uses file locking to prevent race conditions with concurrent writes
+ * Routes through the learning orchestrator for centralized locking and dedup.
  */
 function addCrossSessionRuleToDecisions(rule, category) {
-  const decisionsPath = path.join(PATHS.state, 'decisions.md');
-
   try {
-    // Use file locking to prevent race conditions
-    return withLockSync(decisionsPath, () => {
-      if (!fileExists(decisionsPath)) {
-        const template = `# Project Decisions
+    const { modifyDecisions } = require('./flow-learning-orchestrator');
+
+    // modifyDecisions is async; fire-and-forget for sync callers
+    const result = modifyDecisions((currentContent) => {
+      let content = currentContent;
+
+      if (!content) {
+        content = `# Project Decisions
 
 This document captures project-level coding rules and patterns.
 
@@ -629,16 +627,12 @@ This document captures project-level coding rules and patterns.
 ## General
 
 `;
-        writeFile(decisionsPath, template);
       }
 
-      let content = readFile(decisionsPath, '');
-
       const sectionHeader = `## ${category}`;
       const sectionIndex = content.indexOf(sectionHeader);
 
       if (sectionIndex === -1) {
-        // Category doesn't exist - add it with the rule
         content += `\n${sectionHeader}\n\n${rule}\n`;
       } else {
         const afterSection = content.slice(sectionIndex + sectionHeader.length);
@@ -652,9 +646,17 @@ This document captures project-level coding rules and patterns.
         }
       }
 
-      writeFile(decisionsPath, content);
-      return { success: true };
-    });
+      return { content, entryText: rule.slice(0, 100) };
+    }, { caller: 'flow-pattern-enforcer/addCrossSessionRule' });
+
+    // Handle async result for sync callers
+    if (result && result.then) {
+      result.catch(_err => {
+        if (process.env.DEBUG) console.error(`[DEBUG] addCrossSessionRuleToDecisions: ${_err.message}`);
+      });
+    }
+
+    return { success: true };
   } catch (err) {
     return { success: false, error: err.message };
   }
@@ -662,7 +664,7 @@ This document captures project-level coding rules and patterns.
 
 /**
  * Add a cross-session rule to .claude/rules/ directory
- * Uses PROJECT_ROOT for consistent path resolution
+ * Uses PATHS.root for consistent path resolution
  */
 function addCrossSessionRuleToClaudeRules(pattern, category) {
   try {
@@ -682,14 +684,14 @@ function addCrossSessionRuleToClaudeRules(pattern, category) {
     };
 
     const subdir = categoryToDir[category] || 'general';
-    // Use PROJECT_ROOT instead of process.cwd() for consistent path resolution
-    const rulesDir = path.join(PROJECT_ROOT, '.claude', 'rules', subdir);
+    // Use PATHS.root instead of process.cwd() for consistent path resolution
+    const rulesDir = path.join(PATHS.root, '.claude', 'rules', subdir);
 
     // Validate path is within project (defense in depth)
     // Use path.sep check to prevent prefix-matching attacks (e.g., /project vs /project-evil)
     const resolvedRulesDir = path.resolve(rulesDir);
-    const normalizedRoot = PROJECT_ROOT.endsWith(path.sep) ? PROJECT_ROOT : PROJECT_ROOT + path.sep;
-    if (!resolvedRulesDir.startsWith(normalizedRoot) && resolvedRulesDir !== PROJECT_ROOT) {
+    const normalizedRoot = PATHS.root.endsWith(path.sep) ? PATHS.root : PATHS.root + path.sep;
+    if (!resolvedRulesDir.startsWith(normalizedRoot) && resolvedRulesDir !== PATHS.root) {
       return { success: false, error: 'Invalid rules directory: outside project' };
     }
 

package/scripts/flow-pattern-extractor.js

@@ -38,7 +38,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { execSync, execFileSync } = require('node:child_process');
 const { resolvePatterns } = require('./flow-framework-resolver');
-const { getProjectRoot, generateHashId, readJson } = require('./flow-utils');
+const { getProjectRoot, generateHashId, readJson, safeJsonParse, PATHS } = require('./flow-utils');
 
 // ============================================================================
 // Constants
@@ -217,9 +217,8 @@ function detectFramework(projectRoot) {
 
   if (fs.existsSync(packageJsonPath)) {
     try {
-      const raw = fs.readFileSync(packageJsonPath, 'utf-8');
-      const pkg = JSON.parse(raw);
-      if (!pkg || typeof pkg !== 'object' || Array.isArray(pkg)) return null;
+      const pkg = safeJsonParse(packageJsonPath, null);
+      if (!pkg) return null;
       const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
 
       // Check for frameworks

package/scripts/flow-pending.js

@@ -1,5 +1,3 @@
-'use strict';
-
 /**
  * Wogi Flow - Pending Prompts Queue
  *

package/scripts/flow-permissions.js

@@ -20,7 +20,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const {
   getProjectRoot,
-  safeJsonParse
+  safeJsonParse, PATHS
 } = require('./flow-utils')
 const { color, printHeader, printSection, success } = require('./flow-output');;
 
@@ -28,8 +28,7 @@ const { color, printHeader, printSection, success } = require('./flow-output');;
 // Configuration
 // ============================================================
 
-const PROJECT_ROOT = getProjectRoot();
-const PERMISSIONS_PATH = path.join(PROJECT_ROOT, '.workflow', 'state', 'permissions.json');
+const PERMISSIONS_PATH = path.join(PATHS.state, 'permissions.json');
 
 // In-memory session permissions (cleared on process exit or explicit clear)
 const sessionPermissions = new Map();

package/scripts/flow-plugin-registry.js

@@ -26,7 +26,7 @@ const {
   fileExists,
   isPathWithinProject,
   color,
-  printHeader
+  printHeader, PATHS
 } = require('./flow-utils');
 
 // Dangerous keys that must never be used as plugin names or metadata keys
@@ -41,8 +41,6 @@ const VALID_FLOW_PHASES = new Set(['exploring', 'coding', 'validating', 'complet
 // Configuration
 // ============================================================
 
-const PROJECT_ROOT = getProjectRoot();
-
 /**
  * Get plugin config from workflow config
  * @returns {Object} Plugin configuration
@@ -68,10 +66,10 @@ function getPluginConfig() {
 function getRegistryPath() {
   const pluginConfig = getPluginConfig();
   const registryRelPath = pluginConfig.registryPath || '.workflow/state/plugin-registry.json';
-  const resolved = path.resolve(PROJECT_ROOT, registryRelPath);
+  const resolved = path.resolve(PATHS.root, registryRelPath);
   if (!isPathWithinProject(resolved)) {
     console.error(`[plugin-registry] Unsafe registryPath in config: ${registryRelPath}`);
-    return path.join(PROJECT_ROOT, '.workflow', 'state', 'plugin-registry.json');
+    return path.join(PATHS.state, 'plugin-registry.json');
   }
   return resolved;
 }
@@ -134,8 +132,8 @@ function discoverMcpTools(pluginName) {
 
   // Strategy 1: Check Claude Code's MCP settings for matching servers
   const settingsLocations = [
-    path.join(PROJECT_ROOT, '.claude', 'settings.local.json'),
-    path.join(PROJECT_ROOT, '.claude', 'settings.json')
+    path.join(PATHS.root, '.claude', 'settings.local.json'),
+    path.join(PATHS.root, '.claude', 'settings.json')
   ];
 
   for (const settingsPath of settingsLocations) {
@@ -163,7 +161,7 @@ function discoverMcpTools(pluginName) {
   }
 
   // Strategy 2: Check cached MCP tools from flow-mcp-docs
-  const mcpCachePath = path.join(PROJECT_ROOT, '.workflow', 'state', 'mcp-tools.json');
+  const mcpCachePath = path.join(PATHS.state, 'mcp-tools.json');
   if (fileExists(mcpCachePath)) {
     try {
       const mcpCache = safeJsonParse(mcpCachePath, { allTools: [] });
@@ -210,8 +208,8 @@ function scanUnregisteredMcpServers() {
   const seen = new Set(); // Dedup across multiple settings files
 
   const settingsLocations = [
-    path.join(PROJECT_ROOT, '.claude', 'settings.local.json'),
-    path.join(PROJECT_ROOT, '.claude', 'settings.json')
+    path.join(PATHS.root, '.claude', 'settings.local.json'),
+    path.join(PATHS.root, '.claude', 'settings.json')
   ];
 
   // Internal/built-in servers that should not be auto-registered as plugins
@@ -263,8 +261,8 @@ function scanUnregisteredMcpServers() {
 function deactivateStaleMcpPlugins() {
   const registry = readRegistry();
   const settingsLocations = [
-    path.join(PROJECT_ROOT, '.claude', 'settings.local.json'),
-    path.join(PROJECT_ROOT, '.claude', 'settings.json')
+    path.join(PATHS.root, '.claude', 'settings.local.json'),
+    path.join(PATHS.root, '.claude', 'settings.json')
   ];
 
   const availableServers = new Set();

package/scripts/flow-prd-manager.js

@@ -275,7 +275,7 @@ module.exports = {
 };
 
 if (require.main === module) {
-  main().catch(e => {
+  main().catch(err => {
     error(err.message);
     process.exit(1);
   });

package/scripts/flow-progress.js

@@ -6,7 +6,7 @@
  * Provides visual feedback during hybrid execution.
  */
 
-const readline = require('node:readline');
+const readline = require('node:readline/promises');
 const { colors } = require('./flow-utils');
 
 const symbols = {
@@ -230,12 +230,9 @@ async function prompt(question) {
     output: process.stdout
   });
 
-  return new Promise(resolve => {
-    rl.question(question, answer => {
-      rl.close();
-      resolve(answer.trim());
-    });
-  });
+  const answer = await rl.question(question);
+  rl.close();
+  return answer.trim();
 }
 
 function formatResults(results) {
@@ -288,14 +285,15 @@ if (require.main === module) {
 
     const spinner = new Spinner('Detecting providers...');
     spinner.start();
-    await new Promise(r => setTimeout(r, 2000));
+    const { setTimeout: sleep } = require('node:timers/promises');
+    await sleep(2000);
     spinner.stop('Providers detected', true);
 
     console.log('\nProgress bar:');
     const bar = new ProgressBar(10);
     for (let i = 0; i <= 10; i++) {
       bar.update(i, `Step ${i}/10`);
-      await new Promise(r => setTimeout(r, 200));
+      await sleep(200);
     }
     bar.complete('All steps done');
 

package/scripts/flow-prompt-composer.js

@@ -29,7 +29,7 @@ const {
   printHeader,
   printSection,
   isPathWithinProject,
-  estimateTokens
+  estimateTokens, PATHS
 } = require('./flow-utils');
 
 // Smart Context System integration
@@ -49,8 +49,8 @@ try {
 // Constants
 // ============================================================
 
-const FRAGMENTS_DIR = path.join(PROJECT_ROOT, '.workflow', 'prompts', 'fragments');
-const COMPOSED_DIR = path.join(PROJECT_ROOT, '.workflow', 'prompts', 'composed');
+const FRAGMENTS_DIR = path.join(PATHS.workflow, 'prompts', 'fragments');
+const COMPOSED_DIR = path.join(PATHS.workflow, 'prompts', 'composed');
 
 // Model to CLI mapping (Claude Code only)
 const MODEL_CLI_MAP = {

package/scripts/flow-prompt-template.js

@@ -25,7 +25,7 @@ const {
 // Constants
 // ============================================================
 
-const TEMPLATES_DIR = path.join(PATHS.root, '.workflow', 'templates', 'prompts');
+const TEMPLATES_DIR = PATHS.templatesPrompts;
 
 // Model family to template file mapping
 const MODEL_TEMPLATE_MAP = {
@@ -387,7 +387,7 @@ function getAgentModel(taskType, options = {}) {
  * @returns {number} Score 0-10, or 0 if not found
  */
 function getCapabilityScore(modelFamily, taskType) {
-  const capDir = path.join(PATHS.root, '.workflow', 'models', 'capabilities');
+  const capDir = PATHS.modelCapabilities;
 
   // Map model family to capability file
   const fileMap = {

package/scripts/flow-providers.js

@@ -24,12 +24,9 @@ const fs = require('node:fs');
 const path = require('node:path');
 const https = require('node:https');
 const http = require('node:http');
-const { getProjectRoot, getConfig, colors: c, estimateTokens } = require('./flow-utils');
+const { getProjectRoot, getConfig, colors: c, estimateTokens, PATHS } = require('./flow-utils');
 const { success: printSuccess, error: printError } = require('./flow-output');
 
-const PROJECT_ROOT = getProjectRoot();
-const WORKFLOW_DIR = path.join(PROJECT_ROOT, '.workflow');
-
 /**
  * Provider types
  */
@@ -918,6 +915,12 @@ async function detectProviders() {
     // Not available
   }
 
+  // NOTE: When CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 (Claude Code 2.1.83+), cloud provider
+  // API keys are stripped from subprocess environments. Since hybrid mode invokes this
+  // script via the Bash tool (a subprocess), no cloud providers will be detected.
+  // Workaround: pass API keys via config.json hybrid.providers[].apiKey instead of env vars.
+  // Local providers (Ollama, LM Studio) are unaffected (they use localhost HTTP, no keys).
+
   // Check Anthropic (cloud - if key present)
   if (process.env.ANTHROPIC_API_KEY) {
     available.push({

package/scripts/flow-registry-manager.js

@@ -1,7 +1,5 @@
 #!/usr/bin/env node
 
-'use strict';
-
 /**
  * Wogi Flow - Registry Manager
  *
@@ -18,12 +16,9 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { getProjectRoot, getConfig, safeJsonParse, color, success, warn, error, info } = require('./flow-utils');
+const { getProjectRoot, getConfig, safeJsonParse, color, success, warn, error, info, PATHS } = require('./flow-utils');
 
-const PROJECT_ROOT = getProjectRoot();
-const WORKFLOW_DIR = path.join(PROJECT_ROOT, '.workflow');
-const STATE_DIR = path.join(WORKFLOW_DIR, 'state');
-const MANIFEST_PATH = path.join(STATE_DIR, 'registry-manifest.json');
+const MANIFEST_PATH = path.join(PATHS.state, 'registry-manifest.json');
 const REGISTRIES_DIR = path.join(__dirname, 'registries');
 
 // ============================================================
@@ -268,7 +263,7 @@ class RegistryManager {
     // Detect stack
     try {
       const { detectStack } = require('./flow-context-init');
-      this.stack = detectStack(PROJECT_ROOT);
+      this.stack = detectStack(PATHS.root);
     } catch (err) {
       this.stack = null;
     }
@@ -355,7 +350,7 @@ class RegistryManager {
     };
 
     try {
-      fs.mkdirSync(STATE_DIR, { recursive: true });
+      fs.mkdirSync(PATHS.state, { recursive: true });
       fs.writeFileSync(MANIFEST_PATH, JSON.stringify(manifest, null, 2));
     } catch (err) {
       warn(`Failed to write manifest: ${err.message}`);
@@ -440,7 +435,7 @@ function printStatus(manager) {
   if (fs.existsSync(MANIFEST_PATH)) {
     try {
       const manifest = safeJsonParse(MANIFEST_PATH, {});
-      console.log(`  Manifest: ${path.relative(PROJECT_ROOT, MANIFEST_PATH)}`);
+      console.log(`  Manifest: ${path.relative(PATHS.root, MANIFEST_PATH)}`);
       console.log(`  Generated: ${manifest.generatedAt || 'unknown'}`);
       console.log(`  Version: ${manifest.version || 'unknown'}`);
       console.log(`  Registries: ${(manifest.registries || []).length}`);
@@ -482,7 +477,7 @@ async function main() {
       }
 
       console.log('');
-      success(`Manifest saved to ${path.relative(PROJECT_ROOT, MANIFEST_PATH)}`);
+      success(`Manifest saved to ${path.relative(PATHS.root, MANIFEST_PATH)}`);
       console.log('');
       break;
     }
@@ -493,7 +488,7 @@ async function main() {
 
     case 'manifest':
       manager.generateManifest();
-      success(`Manifest saved to ${path.relative(PROJECT_ROOT, MANIFEST_PATH)}`);
+      success(`Manifest saved to ${path.relative(PATHS.root, MANIFEST_PATH)}`);
       break;
 
     case 'status':

package/scripts/flow-regression.js

@@ -17,12 +17,10 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { execFileSync } = require('node:child_process');
-const { getProjectRoot, colors, getConfig, safeJsonParse } = require('./flow-utils');
+const { getProjectRoot, colors, getConfig, safeJsonParse, PATHS } = require('./flow-utils');
 const { getExecParts, getCommand } = require('./flow-script-resolver');
 
-const PROJECT_ROOT = getProjectRoot();
-const STATE_DIR = path.join(PROJECT_ROOT, '.workflow', 'state');
-const READY_PATH = path.join(STATE_DIR, 'ready.json');
+const READY_PATH = PATHS.ready;
 const SAFE_PATH = /^[a-zA-Z0-9_.\-/]+$/;
 
 function log(color, ...args) {
@@ -56,8 +54,8 @@ function findTestFiles(taskId, taskData) {
   if (taskData?.testFiles) {
     for (const tf of taskData.testFiles) {
       if (typeof tf === 'string' && SAFE_PATH.test(tf) && !tf.includes('..')) {
-        const resolved = path.resolve(PROJECT_ROOT, tf);
-        if (resolved.startsWith(PROJECT_ROOT + path.sep) || resolved === PROJECT_ROOT) {
+        const resolved = path.resolve(PATHS.root, tf);
+        if (resolved.startsWith(PATHS.root + path.sep) || resolved === PATHS.root) {
           testFiles.push(tf);
         }
       }
@@ -80,14 +78,14 @@ function findTestFiles(taskId, taskData) {
     ];
 
     for (const pattern of testPatterns) {
-      if (fs.existsSync(path.join(PROJECT_ROOT, pattern))) {
+      if (fs.existsSync(path.join(PATHS.root, pattern))) {
         testFiles.push(pattern);
       }
     }
   }
 
   // Also look in request-log for files changed
-  const logPath = path.join(STATE_DIR, 'request-log.md');
+  const logPath = PATHS.requestLog;
   if (fs.existsSync(logPath)) {
     let logContent;
     try {
@@ -111,7 +109,7 @@ function findTestFiles(taskId, taskData) {
             `${base}.spec${ext}`,
           ];
           for (const pattern of testPatterns) {
-            if (fs.existsSync(path.join(PROJECT_ROOT, pattern))) {
+            if (fs.existsSync(path.join(PATHS.root, pattern))) {
               testFiles.push(pattern);
             }
           }
@@ -147,7 +145,7 @@ function runTaskTests(taskId, taskData) {
     }
     const { cmd, args } = runner;
     execFileSync(cmd, args, {
-      cwd: PROJECT_ROOT,
+      cwd: PATHS.root,
       stdio: 'pipe',
       timeout: 60000 // 1 minute timeout per task
     });
@@ -173,7 +171,7 @@ function runTaskTests(taskId, taskData) {
  * @returns {{ cmd: string, args: string[] }}
  */
 function detectTestRunner(testFiles) {
-  const packageJson = path.join(PROJECT_ROOT, 'package.json');
+  const packageJson = path.join(PATHS.root, 'package.json');
 
   if (fs.existsSync(packageJson)) {
     try {

package/scripts/flow-roadmap.js

@@ -46,7 +46,7 @@ const MIN_ITEM_TITLE_LENGTH = 2;    // Minimum length for a valid item title
 // Paths
 // Note: .workflow/roadmap.md is for USER project roadmaps managed by this module.
 // WogiFlow's own internal roadmap is at .workflow/roadmap/roadmap.md (separate file).
-const ROADMAP_PATH = path.join(PROJECT_ROOT, '.workflow', 'roadmap.md');
+const ROADMAP_PATH = path.join(PATHS.workflow, 'roadmap.md');
 const TEMPLATE_PATH = path.join(__dirname, '..', 'templates', 'roadmap.md');
 
 // ============================================================
@@ -487,7 +487,7 @@ function validateItem(item) {
 
     // Check if dependency is in ready.json as completed
     let inReadyCompleted = false;
-    const readyPath = path.join(PROJECT_ROOT, '.workflow', 'state', 'ready.json');
+    const readyPath = PATHS.ready;
     if (fileExists(readyPath)) {
       const ready = safeJsonParse(readyPath, {});
       const completed = ready.recentlyCompleted || [];

package/scripts/flow-run-trace.js

@@ -18,14 +18,12 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { readJson } = require('./flow-io');
+const { readJson, safeJsonParse, safeJsonParseString } = require('./flow-io');
 const crypto = require('node:crypto');
-const { getProjectRoot, colors: c } = require('./flow-utils');
+const { getProjectRoot, colors: c, PATHS } = require('./flow-utils');
 const { success: printSuccess } = require('./flow-output');
 
-const PROJECT_ROOT = getProjectRoot();
-const WORKFLOW_DIR = path.join(PROJECT_ROOT, '.workflow');
-const RUNS_DIR = path.join(WORKFLOW_DIR, 'runs');
+const RUNS_DIR = PATHS.runs;
 
 // Event types
 const EVENT_TYPES = {
@@ -282,16 +280,17 @@ function endRun(runId, status = 'completed') {
  */
 function generateSummary(runId) {
   const runDir = path.join(RUNS_DIR, runId);
-  const manifest = JSON.parse(
-    fs.readFileSync(path.join(runDir, 'manifest.json'), 'utf-8')
-  );
+  const manifest = safeJsonParse(path.join(runDir, 'manifest.json'), null);
+  if (!manifest) return;
+
   const tracePath = path.join(runDir, 'trace.jsonl');
 
   const events = fs.existsSync(tracePath)
     ? fs.readFileSync(tracePath, 'utf-8')
         .split('\n')
         .filter(line => line.trim())
-        .map(line => JSON.parse(line))
+        .map(line => safeJsonParseString(line, null))
+        .filter(Boolean)
     : [];
 
   const durationSec = manifest.durationMs
@@ -421,7 +420,7 @@ function updateIndex(runId, manifest) {
   });
 
   // Load config for retention settings
-  const configPath = path.join(WORKFLOW_DIR, 'config.json');
+  const configPath = path.join(PATHS.workflow, 'config.json');
   const config = readJson(configPath, {});
   const maxRuns = config.traces?.runs?.maxRuns || 100;
 
@@ -453,16 +452,18 @@ function inspectRun(runId) {
     throw new Error(`Run not found: ${runId}`);
   }
 
-  const manifest = JSON.parse(
-    fs.readFileSync(path.join(runDir, 'manifest.json'), 'utf-8')
-  );
+  const manifest = safeJsonParse(path.join(runDir, 'manifest.json'), null);
+  if (!manifest) {
+    throw new Error(`Could not read manifest for run: ${runId}`);
+  }
 
   const tracePath = path.join(runDir, 'trace.jsonl');
   const events = fs.existsSync(tracePath)
     ? fs.readFileSync(tracePath, 'utf-8')
         .split('\n')
         .filter(line => line.trim())
-        .map(line => JSON.parse(line))
+        .map(line => safeJsonParseString(line, null))
+        .filter(Boolean)
     : [];
 
   const summaryPath = path.join(runDir, 'summary.md');
@@ -477,7 +478,7 @@ function inspectRun(runId) {
  * Cleanup old runs based on retention policy
  */
 function cleanupRuns() {
-  const configPath = path.join(WORKFLOW_DIR, 'config.json');
+  const configPath = path.join(PATHS.workflow, 'config.json');
   const cleanupConfig = readJson(configPath, {});
   const retentionDays = cleanupConfig.traces?.runs?.retentionDays || 30;
   const maxRuns = cleanupConfig.traces?.runs?.maxRuns || 100;

package/scripts/flow-safety.js

@@ -19,12 +19,9 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { getProjectRoot, getConfig, colors: c } = require('./flow-utils');
+const { getProjectRoot, getConfig, colors: c, PATHS } = require('./flow-utils');
 const { success: printSuccess, error: printError } = require('./flow-output');
 
-const PROJECT_ROOT = getProjectRoot();
-const WORKFLOW_DIR = path.join(PROJECT_ROOT, '.workflow');
-
 /**
  * Custom error for safety violations
  */
@@ -213,7 +210,7 @@ class SafetyGuard {
 
     // Normalize path
     const normalizedPath = filePath.startsWith('/')
-      ? path.relative(PROJECT_ROOT, filePath)
+      ? path.relative(PATHS.root, filePath)
       : filePath;
 
     // Check deny list first (takes precedence)