wogiflow 2.4.2 → 2.4.4

package/.claude/commands/wogi-start.md

@@ -305,6 +305,45 @@ Test framework auto-detected from package.json: jest, vitest, mocha, tap, or fal
 4. If failing: debug, fix, retry (max 5 attempts)
 5. Mark completed only when verification passes
 
+### Step 3.05: Sprint-Based Context Reset (L1+ tasks with 5+ criteria)
+
+**Activates when**: `config.sprintReset.enabled` (default: true) AND task has 5+ acceptance criteria AND current criterion index is a multiple of `config.sprintReset.criteriaPerSprint` (default: 3).
+
+**The problem this solves**: For large tasks, context fills with implementation details from early criteria. By criterion 6+, the AI is working with degraded context — old diffs, stale tool results, and exploration artifacts crowd out what matters for the current criterion. The Anthropic harness design research found that full context resets with structured file-based handoffs produce higher quality output than continuous context for long-running tasks.
+
+**Procedure** (runs automatically at sprint boundaries):
+
+1. After completing criterion N (where N % `criteriaPerSprint` === 0 AND remaining criteria > 0):
+2. **Commit progress**: `git add -A && git commit -m "sprint: criteria 1-N of M complete"`
+3. **Save sprint checkpoint** to `.workflow/state/task-checkpoint.json`:
+   - Task ID, spec path, completed criteria indices, changed files, remaining criteria
+4. **Output sprint summary** (visible to user):
+   ```
+   ━━━ SPRINT BOUNDARY ━━━
+   Completed criteria 1-N of M. Committing and resetting context.
+   Remaining: criteria (N+1)-M
+   ```
+5. **Compact context** — this triggers a full compaction. The PostCompact hook restores:
+   - Active task ID and spec reference
+   - Which criteria are done vs pending (from checkpoint)
+   - Changed files list
+6. **Resume from checkpoint** — read the spec fresh, skip completed criteria, continue with criterion N+1
+
+**Why this is different from normal compaction**: Normal compaction summarizes the conversation. Sprint reset goes further — it commits work, saves a structured checkpoint, and compacts. The next sprint starts with a clean slate + the checkpoint file, not a compressed summary of everything that happened. The AI reads the spec fresh rather than relying on a summarized memory of it.
+
+**Configuration**:
+```json
+{
+  "sprintReset": {
+    "enabled": true,
+    "criteriaPerSprint": 3,
+    "minTaskCriteria": 5
+  }
+}
+```
+
+**Skip when**: Task has < 5 criteria, TDD mode is active (TDD has its own rhythm), or `sprintReset.enabled` is false.
+
 ### Step 3.5: Criteria Completion Verification (MANDATORY)
 
 After implementing all scenarios, BEFORE quality gates:
@@ -416,6 +455,91 @@ After implementing all scenarios, BEFORE quality gates:
 
 **Skip conditions**: Tasks that target a specific file or a small known set (e.g., "remove the mock import in Dashboard.tsx") don't need the full inventory — they're scoped enough already. The inventory is for "all X" / "every X" / "clean up X everywhere" tasks.
 
+### Step 3.56: Skeptical Evaluator Gate (L2+ tasks, when `config.skepticalEvaluator.enabled`)
+
+**The problem this solves**: The same agent that wrote the code verifies its own work in Step 3.5. Anthropic's harness design research found that "separating the agent doing the work from the agent judging it proves to be a strong lever" and that "tuning standalone evaluators toward skepticism is far more tractable than making a generator critical of its own work." This is "confident praise bias" — the implementer always thinks it did a good job.
+
+**Activates when**: `config.skepticalEvaluator.enabled` (default: true) AND task level is L2 or higher (not L3 trivial tasks).
+
+**Procedure**:
+
+1. **Spawn a skeptical evaluator sub-agent** (separate from the implementation agent):
+   ```
+   Agent({
+     subagent_type: "code-reviewer",
+     model: "sonnet",  // Use a different model for diversity
+     prompt: <see below>
+   })
+   ```
+
+2. **Evaluator prompt** (tuned toward skepticism):
+   ```
+   You are a SKEPTICAL code evaluator. Your job is to find problems, not praise.
+   Assume the implementation has gaps until proven otherwise.
+
+   ## Task Specification
+   <read and paste the spec from .workflow/specs/wf-XXXXXXXX.md>
+
+   ## Implementation Diff
+   <git diff of all changed files>
+
+   ## Your Job
+
+   For EACH acceptance criterion in the spec:
+   1. Read the criterion carefully
+   2. Find the EXACT code that implements it (cite file:line)
+   3. Grade: PASS (fully works), PARTIAL (code exists but incomplete), FAIL (not implemented)
+   4. If PARTIAL or FAIL: explain exactly what's missing
+
+   IMPORTANT: "Code exists" is NOT the same as "criterion is met."
+   A service that exists but is never called = FAIL.
+   A component that renders but doesn't handle the specified edge case = PARTIAL.
+   Only grade PASS when the criterion is FULLY satisfied end-to-end.
+
+   ## Output Format
+   Return JSON:
+   {
+     "criteria": [
+       { "criterion": "...", "grade": "PASS|PARTIAL|FAIL", "evidence": "file:line", "issue": "..." }
+     ],
+     "overallPass": true/false,
+     "criticalIssues": ["..."]
+   }
+   ```
+
+3. **Process evaluator results**:
+   - If `overallPass: true` → proceed to Step 3.6
+   - If `overallPass: false` → **iteration loop** (see below)
+
+4. **Generator-Evaluator Iteration Loop** (when evaluator finds issues):
+   - Feed the evaluator's `criticalIssues` and failed criteria back to the implementation context
+   - Fix the identified issues (targeted fixes, not re-implementation)
+   - Re-run the evaluator on the updated diff
+   - **Max iterations**: `config.skepticalEvaluator.maxIterations` (default: 3)
+   - If still failing after max iterations → proceed to Step 3.6 anyway but **flag the unresolved issues** in the completion report
+
+5. **Calibration** (when `config.skepticalEvaluator.calibration` is true):
+   - Before spawning the evaluator, check `.workflow/state/eval-calibration.json` for calibration examples
+   - If examples exist, inject 2-3 into the evaluator prompt as few-shot examples:
+     - One high-scoring example (what a PASS looks like)
+     - One low-scoring example (what a FAIL looks like)
+   - This prevents score drift — the evaluator is anchored to concrete examples
+
+**Configuration**:
+```json
+{
+  "skepticalEvaluator": {
+    "enabled": true,
+    "maxIterations": 3,
+    "model": "sonnet",
+    "calibration": true,
+    "skipForL3": true
+  }
+}
+```
+
+**Why this works**: The evaluator has NO emotional investment in the code. It reads the spec and the diff cold. It's explicitly prompted to be skeptical. And because it's a separate sub-agent, it has a fresh context — no accumulated "I already know this works" bias from the implementation phase.
+
 ### Step 3.6: Integration Wiring Validation (MANDATORY)
 
 Run `node node_modules/wogiflow/scripts/flow-wiring-verifier.js wf-XXXXXXXX`

package/.claude/docs/claude-code-compatibility.md

@@ -70,6 +70,8 @@ flow parallel check  # See available parallel tasks
 | 1.9.5+ | 2.1.74+ | SessionEnd timeout fix, managed policy ask rules, autoMemoryDirectory, Agent tool routing gate fix |
 | 2.0.0+ | 2.1.76+ | PostCompact hook, Elicitation/ElicitationResult events, deferred tool schema fix |
 | 2.1.0+ | 2.1.77+ | PreToolUse allow/deny separation, 128k output tokens, worktree sparse checkout, compaction circuit breaker |
+| 2.4.0+ | 2.1.83+ | managed-settings.d/, CwdChanged/FileChanged hooks, ENV_SCRUB, --channels limitations, MEMORY.md 25KB cap |
+| 2.5.0+ | 2.1.84+ | TaskCreated hook, YAML glob lists in rules, CLAUDE_STREAM_IDLE_TIMEOUT_MS, WorktreeCreate HTTP transport, idle-return prompt, MCP 2KB cap |
 
 ### Environment Variables (2.1.19+)
 
@@ -162,6 +164,7 @@ await cancelTask('wf-123', 'superseded', false);
 | Stop | stop.js | Session cleanup |
 | SessionEnd | session-end.js | Request logging, progress update |
 | TaskCompleted | task-completed.js | Move task to recentlyCompleted |
+| TaskCreated | task-created.js | Link native tasks to active WogiFlow task (2.1.84+) |
 | ConfigChange | config-change.js | Re-sync bridge on mid-session config changes |
 | InstructionsLoaded | instructions-loaded.js | Package check, rule conflicts, auto-onboard |
 | PostCompact | post-compact.js | Re-inject state after context compaction (2.1.76+) |
@@ -236,6 +239,54 @@ await cancelTask('wf-123', 'superseded', false);
 - **Memory growth fix**: Fixed progress messages surviving compaction in long-running sessions. Reduces memory pressure during long WogiFlow bulk-loop sessions.
 - **Faster startup on macOS**: ~60ms faster by reading keychain credentials in parallel. Faster `--resume` on fork-heavy sessions — up to 45% faster loading and ~100-150MB less peak memory. Benefits WogiFlow sessions with heavy hook context.
 
+### Features in 2.1.83+
+
+- **managed-settings.d/ drop-in directory**: A `managed-settings.d/` directory alongside `managed-settings.json` allows separate teams/tools to deploy independent policy fragments that merge alphabetically. WogiFlow currently generates `settings.local.json` — for wogiflow-cloud teams, this opens the door to deploying team policies as individual fragments (e.g., `00-wogiflow-hooks.json`, `50-team-policy.json`). No code change needed yet; tracked as cloud opportunity.
+
+- **CwdChanged and FileChanged hook events**: Two new hook events. `CwdChanged` fires when the working directory changes (useful for direnv-style setups). `FileChanged` fires when watched files change on disk — WogiFlow could use this to detect external changes to `.workflow/state/` files and auto-rescan. Added to `UNUSED_SUPPORTED_EVENTS` in `claude-code.js`. Implementation deferred to a future task.
+
+- **CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1**: Strips Anthropic and cloud provider credentials from subprocess environments (Bash tool, hooks, MCP stdio servers). **Impact on WogiFlow**: Hooks are subprocesses, so any hook that needs API keys (e.g., `flow-correction-detector.js` spawning a child process for async correction detection) will not have credentials available. The correction detector now gracefully degrades (returns `isCorrection: false`) when no API key is available. `flow-providers.js` makes direct `https.request()` calls from the hook process itself (not a subprocess of the subprocess), so it reads `process.env` before scrubbing — but if ENV_SCRUB applies transitively to hook processes, provider calls would also be affected. For wogiflow-cloud: if cloud sync hooks need API keys, they must use an alternative credential mechanism (file-based, keychain, or passed via hook input JSON).
+
+- **Agents can declare initialPrompt in frontmatter**: Agents can now auto-submit a first turn without the AI composing it. WogiFlow's 11 persona agents in `agents/` could use this for standardized opening probes. No code change needed; optimization opportunity.
+
+- **Background subagent fixes**: (1) Fixed subagents becoming invisible after context compaction — this prevented duplicate agent spawns in WogiFlow's parallel explore phase. (2) Fixed agents staying stuck in "running" state when git/API calls hang during cleanup. Both fixes improve reliability of `/wogi-start` explore phase and `/wogi-bulk-loop`.
+
+- **--channels disables AskUserQuestion and plan mode**: When `--channels` is active (remote/SDK), `AskUserQuestion` and plan-mode tools are disabled. **Impact on WogiFlow**: WogiFlow uses `AskUserQuestion` extensively for approval gates, clarifying questions, and interactive decisions. In `--channels` mode, these will silently fail or be unavailable. WogiFlow should detect channels mode and fall back to non-interactive patterns: auto-approve with defaults, skip clarifying questions, use best-effort decisions. Documented in CLAUDE.md template and wogi-start command.
+
+- **TaskOutput deprecated**: `TaskOutput` tool is deprecated in favor of using `Read` on the background task's output file path. WogiFlow does not use `TaskOutput` directly (confirmed by codebase search). No change needed.
+
+- **MEMORY.md index truncation**: Now truncates at **25KB** as well as 200 lines (previously only 200 lines). WogiFlow's MEMORY.md enforcement block at the top consumes space from this budget. Projects with large MEMORY.md files may lose entries silently. The CLAUDE.md template's auto-memory section already mentions 200 lines; the 25KB limit is enforced by Claude Code's system prompt and does not need to be duplicated in the template.
+
+- **Plugin manifest.userConfig**: Plugins can now prompt for configuration at enable time, with `sensitive: true` values stored in keychain (macOS) or protected credentials file. If WogiFlow becomes a Claude Code plugin, this provides native credential storage for cloud API tokens and model API keys — replacing `wogi login`'s file-based token storage. Tracked as cloud opportunity.
+
+- **WebFetch identifies as Claude-User**: `WebFetch` now sends a `Claude-User` user agent so site operators can recognize and allowlist/block Claude Code traffic via `robots.txt`. WogiFlow's explore agents (Agent 2: Best Practices, Agent 3: Version Verifier) use `WebFetch` for research. If sites block `Claude-User`, research agents will get empty results. Agents should treat unexpectedly empty WebFetch results as potentially blocked and log a warning.
+
+- **--mcp-config bypass fix**: Fixed `--mcp-config` CLI flag bypassing `allowedMcpServers`/`deniedMcpServers` managed policy enforcement. Security improvement — no WogiFlow code change needed.
+
+- **Uninstalled plugin hooks fix**: Fixed uninstalled plugin hooks continuing to fire until the next session. Improves hook hygiene for WogiFlow plugin management.
+
+### Features in 2.1.84+
+
+- **TaskCreated hook event**: New hook event fired when a task is created via TaskCreate. WogiFlow uses this to link native Claude Code tasks to the active WogiFlow task in `session-state.json`, enabling cross-system task tracking. Implemented in `scripts/hooks/core/task-created.js`.
+
+- **YAML glob lists in rules/skills frontmatter**: Rules and skills `globs:` field now accepts YAML lists in addition to single strings. WogiFlow's `flow-rules-sync.js` currently generates single-string globs with brace expansion (`"**/*.{js,ts}"`). This opens the door to cleaner multi-pattern rules without brace expansion hacks. No immediate code change — tracked as improvement.
+
+- **CLAUDE_STREAM_IDLE_TIMEOUT_MS**: New env var to configure the streaming idle watchdog threshold (default 90s). WogiFlow's explore phase launches 5-6 parallel agents — if an agent takes >90s without streaming output, the watchdog may kill the connection. Users experiencing timeouts during explore should set this higher (e.g., `CLAUDE_STREAM_IDLE_TIMEOUT_MS=180000` for 3 minutes).
+
+- **WorktreeCreate hook HTTP transport**: WorktreeCreate now supports `type: "http"` — return the created worktree path via `hookSpecificOutput.worktreePath`. WogiFlow continues to use command transport locally. HTTP transport enables wogiflow-cloud to receive worktree events server-side for team task tracking. Listed in `UNUSED_SUPPORTED_EVENTS` as a cloud opportunity.
+
+- **Idle-return prompt**: Users returning after 75+ minutes are nudged to `/clear`. WogiFlow's PostCompact hook handles `/clear` correctly — it fires on compaction, re-injects state (active task, workflow phase, durable session progress), and re-arms routing. Session restore tested and working via the same PostCompact pathway.
+
+- **MCP tool descriptions capped at 2KB**: MCP tool descriptions and server instructions now capped at 2KB to prevent OpenAPI-generated servers from bloating context. WogiFlow's plugin system registers MCP servers — plugins with verbose OpenAPI specs may have descriptions silently truncated. Plugin docs should note this limit.
+
+- **System-prompt caching with ToolSearch**: Global system-prompt caching now works when ToolSearch is enabled. WogiFlow sessions use ToolSearch for deferred MCP tools — this reduces input token costs automatically. No code change needed.
+
+- **Subagent JSON-schema fix**: Fixed workflow subagents failing with API 400 when the outer session uses `--json-schema` and the subagent also specifies a schema. Improves reliability of WogiFlow explore agents in structured-output sessions.
+
+- **allowedChannelPlugins managed setting**: Enterprise admins can define a channel plugin allowlist. Relevant for wogiflow-cloud teams product — team admins could control which wogi plugins are allowed across the team. Tracked as cloud opportunity.
+
+- **ANTHROPIC_DEFAULT_{OPUS,SONNET,HAIKU}_MODEL_SUPPORTS**: New env vars to override effort/thinking capability detection for pinned default models on Bedrock/Vertex/Foundry. WogiFlow's hybrid mode routes to different models — 3P users who pin models can now declare their capabilities properly.
+
 ### Simple Mode Naming Distinction
 
 Claude Code's `CLAUDE_CODE_SIMPLE` environment variable (which enables a simplified tool set) is **unrelated** to WogiFlow's `loops.simpleMode` (a lightweight task completion loop using string detection). They are separate features that happen to share the word "simple":

package/.claude/docs/explore-agents.md

@@ -111,12 +111,23 @@ Planned files: [FILES_TO_CHANGE]
 4. If a memory database exists (.workflow/memory/local.db or via MCP):
    - Query for rejected approaches from past tasks touching the same files
    - Surface any "approach X was tried and failed" warnings
+5. **Eval trend analysis** (NEW — from Anthropic harness design research):
+   - Read `.workflow/evals/` directory for the last 5-10 eval results
+   - Calculate average score per dimension (completeness, accuracy, workflowCompliance, tokenEfficiency, quality)
+   - If any dimension averages below 6/10 across recent evals:
+     - Flag it as a RECURRING WEAKNESS
+     - Suggest a mitigation for the spec (e.g., "tokenEfficiency averaging 4/10 → add context budgeting hints")
+   - If eval calibration exists (`.workflow/state/eval-calibration.json`):
+     - Compare the current task type against high/low calibration examples
+     - Warn if this task type historically scores low
 
 Return:
 - Known risks for this task type (from feedback-patterns)
 - Past corrections in this area (from corrections/)
 - Promoted rules that apply (from decisions.md, count >= 3)
 - Rejected approaches from similar past work (from memory-db)
+- **Eval trend warnings** (dimensions scoring below 6/10 in recent evals)
+- **Recommended spec hints** (based on eval trends — inject into spec generation)
 - Confidence: HIGH (many data points) / MEDIUM / LOW (no history)
 ```
 

package/.claude/settings.json

@@ -132,9 +132,20 @@
           }
         ]
       }
+    ],
+    "TaskCreated": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node scripts/hooks/entry/claude-code/task-created.js",
+            "timeout": 5
+          }
+        ]
+      }
     ]
   },
   "_wogiFlowManaged": true,
-  "_wogiFlowVersion": "1.9.10",
+  "_wogiFlowVersion": "2.4.2",
   "_comment": "Shared WogiFlow hook configuration. Committed to repo for team use. User-specific overrides go in settings.local.json."
 }

package/.workflow/models/registry.json

@@ -100,7 +100,7 @@
       "displayName": "Claude Sonnet 4.6",
       "contextWindow": 200000,
       "contextWindowBeta": 1000000,
-      "maxOutputTokens": 64000,
+      "maxOutputTokens": 128000,
       "costTier": "standard",
       "pricing": {
         "inputPer1kTokens": 0.003,

package/bin/flow

@@ -23,7 +23,7 @@ const packageJson = require('../package.json');
 const VERSION = packageJson.version;
 
 // Global commands that don't require a project context
-const GLOBAL_COMMANDS = ['init', 'upgrade', 'version', '--version', '-v', '--help', '-h', 'skill', 'channel', 'login', 'logout'];
+const GLOBAL_COMMANDS = ['init', 'upgrade', 'version', '--version', '-v', '--help', '-h', 'skill', 'channel', 'login', 'logout', 'workspace'];
 
 /**
  * Find the project root by looking for .workflow directory
@@ -97,6 +97,7 @@ Usage: flow <command> [options]
 
 Global Commands:
   init                 Initialize Wogi Flow in a new project
+  workspace init       Initialize a multi-repo workspace
   upgrade              Upgrade an existing project to latest version
   login                Connect to WogiFlow Teams
   logout               Disconnect from WogiFlow Teams
@@ -208,6 +209,15 @@ function main() {
     return;
   }
 
+  if (command === 'workspace') {
+    const { workspace } = require('../lib/workspace');
+    workspace(args.slice(1)).catch(err => {
+      console.error(`Workspace error: ${err.message}`);
+      process.exit(1);
+    });
+    return;
+  }
+
   // For all other commands, try to find project context
   const projectRoot = findProjectRoot();