wogiflow 2.4.2 → 2.4.4

package/scripts/flow-bulk-orchestrator.js

@@ -430,9 +430,7 @@ async function orchestrateBulk(taskIds, options = {}) {
  * @param {number} ms - Milliseconds to sleep
  * @returns {Promise}
  */
-function sleep(ms) {
-  return new Promise(resolve => setTimeout(resolve, ms));
-}
+const { setTimeout: sleep } = require('node:timers/promises');
 
 /**
  * Get ready tasks from ready.json

package/scripts/flow-cascade-completion.js

@@ -1,6 +1,4 @@
 #!/usr/bin/env node
-'use strict';
-
 /**
  * Wogi Flow - Cascade Completion (v3.2)
  *

package/scripts/flow-cascade.js

@@ -28,9 +28,10 @@ const {
   getConfig,
   fileExists,
   writeJson,
+  safeJsonParse,
   printHeader,
   printSection,
-  showHelp: showHelpGeneric
+  showHelp: showHelpGeneric, PATHS
 } = require('./flow-utils');
 
 // ============================================================
@@ -92,7 +93,7 @@ const CATEGORY_PATTERNS = [
 // State Management
 // ============================================================
 
-const STATE_PATH = path.join(PROJECT_ROOT, '.workflow', 'state', 'cascade-state.json');
+const STATE_PATH = path.join(PATHS.state, 'cascade-state.json');
 
 /**
  * In-memory failure tracker.
@@ -113,8 +114,7 @@ function loadState() {
   }
 
   try {
-    const content = fs.readFileSync(STATE_PATH, 'utf-8');
-    const state = JSON.parse(content);
+    const state = safeJsonParse(STATE_PATH, {});
 
     // Clean up expired entries
     const now = Date.now();

package/scripts/flow-checkpoint.js

@@ -23,12 +23,10 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { execSync, spawnSync } = require('node:child_process');
-const { getProjectRoot, getConfig, colors: c } = require('./flow-utils');
+const { getProjectRoot, getConfig, colors: c, PATHS } = require('./flow-utils');
 const { success: printSuccess, warn: printWarn } = require('./flow-output');
 
-const PROJECT_ROOT = getProjectRoot();
-const WORKFLOW_DIR = path.join(PROJECT_ROOT, '.workflow');
-const CHECKPOINTS_DIR = path.join(WORKFLOW_DIR, 'checkpoints');
+const CHECKPOINTS_DIR = PATHS.checkpoints;
 const CHECKPOINT_LOG = path.join(CHECKPOINTS_DIR, 'checkpoint-log.json');
 
 // Alias getConfig as loadConfig for minimal code changes
@@ -182,7 +180,7 @@ class Checkpoint {
     const snapshots = {};
 
     for (const relPath of stateFiles) {
-      const srcPath = path.join(WORKFLOW_DIR, relPath);
+      const srcPath = path.join(PATHS.workflow, relPath);
       try {
         const content = fs.readFileSync(srcPath, 'utf-8');
         const destPath = path.join(snapshotDir, relPath.replace(/\//g, '_'));
@@ -205,7 +203,7 @@ class Checkpoint {
   hasGitChanges() {
     try {
       const result = spawnSync('git', ['status', '--porcelain'], {
-        cwd: PROJECT_ROOT,
+        cwd: PATHS.root,
         encoding: 'utf-8'
       });
       return result.stdout && result.stdout.trim().length > 0;
@@ -220,19 +218,19 @@ class Checkpoint {
   createGitCommit(message) {
     try {
       // Stage all changes
-      spawnSync('git', ['add', '-A'], { cwd: PROJECT_ROOT });
+      spawnSync('git', ['add', '-A'], { cwd: PATHS.root });
 
       // Create commit
       const commitMessage = `${this.config.commitPrefix} ${message}`;
       const result = spawnSync('git', ['commit', '-m', commitMessage], {
-        cwd: PROJECT_ROOT,
+        cwd: PATHS.root,
         encoding: 'utf-8'
       });
 
       if (result.status === 0) {
         // Get commit hash
         const hashResult = spawnSync('git', ['rev-parse', '--short', 'HEAD'], {
-          cwd: PROJECT_ROOT,
+          cwd: PATHS.root,
           encoding: 'utf-8'
         });
         return hashResult.stdout.trim();
@@ -264,7 +262,7 @@ class Checkpoint {
         for (const [relPath, snapshotPath] of Object.entries(checkpoint.stateSnapshot)) {
           try {
             const content = fs.readFileSync(snapshotPath, 'utf-8');
-            const destPath = path.join(WORKFLOW_DIR, relPath);
+            const destPath = path.join(PATHS.workflow, relPath);
             fs.writeFileSync(destPath, content);
           } catch (err) {
             if (err.code !== 'ENOENT') {
@@ -284,14 +282,14 @@ class Checkpoint {
         // Find commits since checkpoint
         const logResult = spawnSync('git', [
           'log', '--oneline', `${checkpoint.gitCommit}..HEAD`
-        ], { cwd: PROJECT_ROOT, encoding: 'utf-8' });
+        ], { cwd: PATHS.root, encoding: 'utf-8' });
 
         const commitsSince = logResult.stdout.trim().split('\n').filter(l => l).length;
 
         if (commitsSince > 0) {
           // Soft reset to checkpoint
           spawnSync('git', ['reset', '--soft', checkpoint.gitCommit], {
-            cwd: PROJECT_ROOT
+            cwd: PATHS.root
           });
           results.gitRestored = true;
         }
@@ -354,7 +352,6 @@ class Checkpoint {
   }
 }
 
-
 /**
  * Format checkpoint list for display
  */

package/scripts/flow-code-intelligence.js

@@ -22,15 +22,13 @@ const { getProjectRoot, getConfig, PATHS, colors, readJson } = require('./flow-u
 const { success, error: errorMsg } = require('./flow-output');
 const { safeGrep, safeFind, escapeRegex } = require('./flow-security');
 
-const PROJECT_ROOT = getProjectRoot();
-
 /**
  * Resolve a path alias (e.g., '@/*') from tsconfig.json compilerOptions.paths.
  * Returns the base directory (e.g., 'src') or null if not found.
  */
 function resolvePathAlias(alias) {
   try {
-    const tsconfigPath = path.join(PROJECT_ROOT, 'tsconfig.json');
+    const tsconfigPath = path.join(PATHS.root, 'tsconfig.json');
     if (!fs.existsSync(tsconfigPath)) return null;
     const content = fs.readFileSync(tsconfigPath, 'utf-8');
     // Strip comments then use safeJsonParseString for prototype-pollution protection
@@ -51,7 +49,7 @@ function resolvePathAlias(alias) {
  */
 function detectSourceRoot() {
   for (const dir of ['src', 'app', 'lib']) {
-    if (fs.existsSync(path.join(PROJECT_ROOT, dir))) return dir;
+    if (fs.existsSync(path.join(PATHS.root, dir))) return dir;
   }
   return '.'; // fallback to project root
 }
@@ -69,14 +67,14 @@ function detectSourceRoot() {
 function analyzeRelationships(filePath) {
   const fullPath = path.isAbsolute(filePath)
     ? filePath
-    : path.join(PROJECT_ROOT, filePath);
+    : path.join(PATHS.root, filePath);
 
   if (!fs.existsSync(fullPath)) {
     return { error: 'File not found' };
   }
 
   const content = fs.readFileSync(fullPath, 'utf-8');
-  const relPath = path.relative(PROJECT_ROOT, fullPath);
+  const relPath = path.relative(PATHS.root, fullPath);
 
   const relationships = {
     file: relPath,
@@ -371,10 +369,10 @@ function resolveImportPath(importSource, fromDir) {
   for (const ext of extensions) {
     const candidate = path.resolve(fromDir, importSource + ext);
     // Path containment check — reject paths that escape project root
-    if (!candidate.startsWith(PROJECT_ROOT + path.sep) && candidate !== PROJECT_ROOT) continue;
-    const relPath = path.relative(PROJECT_ROOT, candidate);
+    if (!candidate.startsWith(PATHS.root + path.sep) && candidate !== PATHS.root) continue;
+    const relPath = path.relative(PATHS.root, candidate);
 
-    if (fs.existsSync(path.join(PROJECT_ROOT, relPath))) {
+    if (fs.existsSync(path.join(PATHS.root, relPath))) {
       return relPath;
     }
   }
@@ -430,7 +428,7 @@ async function findFilesImporting(filePath) {
   // Use safe grep with escaped pattern to prevent injection
   const pattern = `from.*${escapeRegex(basename)}`;
   return safeGrep(pattern, {
-    cwd: PROJECT_ROOT,
+    cwd: PATHS.root,
     searchDir: 'src/',
     extensions: ['.ts', '.tsx', '.js', '.jsx'],
     maxResults: 20
@@ -443,7 +441,7 @@ async function findFilesImporting(filePath) {
 async function searchCodebase(keyword, maxResults = 10) {
   // Use safe grep with escaped pattern to prevent injection
   return safeGrep(keyword, {
-    cwd: PROJECT_ROOT,
+    cwd: PATHS.root,
     searchDir: 'src/',
     extensions: ['.ts', '.tsx', '.js', '.jsx'],
     maxResults
@@ -678,7 +676,7 @@ async function main() {
 
       // Use safe find to prevent command injection
       const files = safeFind(dir, {
-        cwd: PROJECT_ROOT,
+        cwd: PATHS.root,
         extensions: ['.ts', '.tsx', '.js', '.jsx'],
         maxResults: 100
       });

package/scripts/flow-community-sync.js

@@ -31,9 +31,9 @@ const { loadStats } = require('./flow-stats-collector');
 // Constants
 // ============================================================
 
-const COMMUNITY_SCORES_PATH = path.join(PATHS.root, '.workflow', 'models', 'community-scores.json');
-const COMMUNITY_ROUTING_PATH = path.join(PATHS.root, '.workflow', 'models', 'community-routing.json');
-const SYNC_QUEUE_PATH = path.join(PATHS.root, '.workflow', 'state', 'sync-queue.json');
+const COMMUNITY_SCORES_PATH = PATHS.communityScores;
+const COMMUNITY_ROUTING_PATH = PATHS.communityRouting;
+const SYNC_QUEUE_PATH = path.join(PATHS.state, 'sync-queue.json');
 
 const DEFAULT_SYNC_CONFIG = {
   enabled: false,
@@ -78,7 +78,7 @@ function isSyncEnabled() {
   if (!config.enabled) return false;
 
   // Check for auth token (set by `wogi login`)
-  const authPath = path.join(PATHS.root, '.workflow', 'state', 'auth.json');
+  const authPath = path.join(PATHS.state, 'auth.json');
   try {
     if (!fs.existsSync(authPath)) return false;
     const auth = readJson(authPath, {});

package/scripts/flow-community.js

@@ -1,5 +1,3 @@
-'use strict';
-
 /**
  * Wogi Flow - Community Knowledge Module
  *
@@ -1092,25 +1090,19 @@ function mergePatterns(items) {
   }
 
   if (newRows.length > 0) {
-    // Find the end of the Patterns Log table to insert before pending patterns
-    const tableEnd = content.indexOf('\n\n### ');
-    if (tableEnd !== -1) {
-      const updated = content.slice(0, tableEnd) + '\n' + newRows.join('\n') + content.slice(tableEnd);
-      try {
-        fs.writeFileSync(filePath, updated, 'utf-8');
-      } catch (err) {
-        if (process.env.DEBUG) {
-          console.error(`[flow-community] Failed to write feedback-patterns.md: ${err.message}`);
-        }
-      }
-    } else {
-      // Append at end
-      try {
-        fs.writeFileSync(filePath, content.trimEnd() + '\n' + newRows.join('\n') + '\n', 'utf-8');
-      } catch (err) {
-        if (process.env.DEBUG) {
-          console.error(`[flow-community] Failed to write feedback-patterns.md: ${err.message}`);
+    // Route through orchestrator for locking and dedup
+    try {
+      const { modifyFeedbackPatterns } = require('./flow-learning-orchestrator');
+      modifyFeedbackPatterns((curContent) => {
+        const tableEnd = curContent.indexOf('\n\n### ');
+        if (tableEnd !== -1) {
+          return { content: curContent.slice(0, tableEnd) + '\n' + newRows.join('\n') + curContent.slice(tableEnd) };
         }
+        return { content: curContent.trimEnd() + '\n' + newRows.join('\n') + '\n' };
+      }, { caller: 'flow-community/mergePatterns', skipDedup: true });
+    } catch (err) {
+      if (process.env.DEBUG) {
+        console.error(`[flow-community] Failed to write feedback-patterns.md: ${err.message}`);
       }
     }
   }

package/scripts/flow-config-defaults.js

@@ -27,8 +27,6 @@
  *   bulkLoop, corrections, agents (top-level list)
  */
 
-'use strict';
-
 // ============================================================
 // Static Data Constants (large objects extracted for readability)
 // ============================================================
@@ -575,6 +573,34 @@ const CONFIG_DEFAULTS = {
     failureThresholdForFallback: 3
   },
 
+  // --- Skeptical Evaluator (Anthropic harness design pattern) ---
+  // Spawns a separate sub-agent to evaluate task output before quality gates.
+  // Addresses "confident praise bias" where the implementer always thinks it did well.
+  skepticalEvaluator: {
+    enabled: true,
+    _comment_enabled: 'Spawn a separate evaluator agent between Step 3.5 and Step 4',
+    maxIterations: 3,
+    _comment_maxIterations: 'Max eval→fix cycles before proceeding anyway',
+    model: 'sonnet',
+    _comment_model: 'Use a different model than the implementer for diversity',
+    calibration: true,
+    _comment_calibration: 'Inject few-shot calibration examples into evaluator prompt',
+    skipForL3: true,
+    _comment_skipForL3: 'Skip for trivial L3 subtasks'
+  },
+
+  // --- Sprint-Based Context Reset (Anthropic harness design pattern) ---
+  // For large tasks (5+ criteria), commit and reset context every N criteria.
+  // Fresh context per sprint prevents quality degradation on later criteria.
+  sprintReset: {
+    enabled: true,
+    _comment_enabled: 'Enable sprint-based context resets for large tasks',
+    criteriaPerSprint: 3,
+    _comment_criteriaPerSprint: 'Number of criteria to complete before a context reset',
+    minTaskCriteria: 5,
+    _comment_minTaskCriteria: 'Only activate for tasks with this many or more criteria'
+  },
+
   // --- Session Features ---
   morningBriefing: { enabled: false },
   techDebt: {

package/scripts/flow-config-interactive.js

@@ -25,7 +25,8 @@ const {
   warn,
   error,
   parseFlags,
-  outputJson
+  outputJson,
+  safeJsonParse
 } = require('./flow-utils');
 
 // ============================================================
@@ -220,11 +221,14 @@ function exportConfig() {
 }
 
 function resetConfig() {
-  const configPath = path.join(PATHS.root, '.workflow', 'config.json');
-  try {
-    const content = fs.readFileSync(configPath, 'utf-8');
-    const config = JSON.parse(content);
+  const configPath = PATHS.config;
+  const config = safeJsonParse(configPath, null);
+  if (!config) {
+    error('Failed to read config.json');
+    return;
+  }
 
+  try {
     // Keep only structural keys, remove user overrides
     const minimal = {
       $schema: config.$schema,

package/scripts/flow-config-loader.js

@@ -1,5 +1,3 @@
-'use strict';
-
 /**
  * Wogi Flow - Config Loading and Management
  *
@@ -13,7 +11,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { PATHS, PROJECT_ROOT, isPathWithinProject } = require('./flow-paths');
-const { checkForDangerousKeys, readJson, writeJson, acquireLock } = require('./flow-io');
+const { checkForDangerousKeys, readJson, writeJson, acquireLock, safeJsonParse, safeJsonParseString } = require('./flow-io');
 const { warn } = require('./flow-output');
 
 // Late-loaded to avoid circular dependency
@@ -296,23 +294,12 @@ function getConfig() {
     }
 
     const configContent = fs.readFileSync(configPath, 'utf-8');
-    let rawConfig;
-    try {
-      rawConfig = JSON.parse(configContent);
-    } catch (err) {
-      console.warn(`Warning: Invalid JSON in config.json: ${err.message}`);
+    const rawConfig = safeJsonParseString(configContent, null);
+    if (!rawConfig || typeof rawConfig !== 'object') {
+      console.warn('Warning: Invalid or dangerous JSON in config.json');
       return {};
     }
 
-    // Prototype pollution check on config
-    if (rawConfig && typeof rawConfig === 'object') {
-      const dangerousKeyError = checkForDangerousKeys(rawConfig);
-      if (dangerousKeyError) {
-        console.warn(`Warning: Dangerous keys in config.json: ${dangerousKeyError}`);
-        return {};
-      }
-    }
-
     // Validate on first load (DEBUG mode or explicit request)
     if (process.env.DEBUG || process.env.VALIDATE_CONFIG) {
       validateConfig(rawConfig);
@@ -366,27 +353,7 @@ function getConfig() {
  * Use this when you need to read/modify config without resolving variables
  */
 function getRawConfig() {
-  const configPath = PATHS.config;
-  if (!fs.existsSync(configPath)) return {};
-
-  try {
-    const content = fs.readFileSync(configPath, 'utf-8');
-    const parsed = JSON.parse(content);
-
-    // Prototype pollution check
-    if (parsed && typeof parsed === 'object') {
-      const dangerousKeyError = checkForDangerousKeys(parsed);
-      if (dangerousKeyError) {
-        console.warn(`Warning: Dangerous keys in config.json: ${dangerousKeyError}`);
-        return {};
-      }
-    }
-
-    return parsed;
-  } catch (err) {
-    console.warn(`Warning: Could not parse config.json: ${err.message}`);
-    return {};
-  }
+  return safeJsonParse(PATHS.config, {});
 }
 
 /**
@@ -439,6 +406,48 @@ function getConfigValue(configPath, defaultValue = null) {
   return value;
 }
 
+/**
+ * Apply a value at a dot-notation path on a config object.
+ * Shared logic between setConfigValue (async, locked) and setConfigValueSync.
+ *
+ * @param {string} configPath - Dot-notation path (e.g., 'parallel.enabled')
+ * @param {*} newValue - New value to set
+ * @param {object} config - Config object to mutate
+ */
+function _applyConfigPath(configPath, newValue, config) {
+  const parts = configPath.split('.');
+  let obj = config;
+
+  for (let i = 0; i < parts.length - 1; i++) {
+    const part = parts[i];
+    if (DANGEROUS_CONFIG_PROPS.has(part)) {
+      throw new Error(`Dangerous config key: ${part}`);
+    }
+    if (!Object.hasOwn(obj, part)) {
+      obj[part] = {};
+    }
+    obj = obj[part];
+  }
+
+  const lastPart = parts[parts.length - 1];
+  if (DANGEROUS_CONFIG_PROPS.has(lastPart)) {
+    throw new Error(`Dangerous config key: ${lastPart}`);
+  }
+  obj[lastPart] = newValue;
+  writeJson(PATHS.config, config);
+  invalidateConfigCache();
+
+  // Auto-sync .gitignore only when config keys affect gitignore mappings
+  if (configPath.startsWith('testing.') || configPath.startsWith('webmcp.')) {
+    try {
+      const { syncGitignore } = require('./flow-gitignore');
+      syncGitignore(config);
+    } catch (_err) {
+      // Non-blocking — gitignore sync should never fail config writes
+    }
+  }
+}
+
 /**
  * Update config value (uses locking to prevent race conditions)
  * SECURITY: Always acquires lock before writing to prevent data corruption
@@ -448,51 +457,23 @@ function getConfigValue(configPath, defaultValue = null) {
  * @throws {Error} If lock cannot be acquired after retries
  */
 async function setConfigValue(configPath, newValue) {
-  // Validate path to prevent prototype pollution
   if (!isValidConfigPath(configPath)) {
     throw new Error(`Invalid config path: ${configPath}`);
   }
 
-  // Use file lock to prevent concurrent writes
   const lockPath = PATHS.config;
   let release;
 
   try {
-    // More retries with exponential backoff for better reliability
     release = await acquireLock(lockPath, { retries: 5, retryDelay: 100, exponentialBackoff: true });
   } catch (err) {
-    // SECURITY: Don't fall back to non-locked write - throw instead
     throw new Error(`Could not acquire config lock after retries: ${err.message}. Config not updated.`, { cause: err });
   }
 
   try {
-    // Re-read config after acquiring lock (may have changed)
     invalidateConfigCache();
     const config = getConfig();
-    const parts = configPath.split('.');
-    let obj = config;
-
-    for (let i = 0; i < parts.length - 1; i++) {
-      const part = parts[i];
-      if (!Object.hasOwn(obj, part)) {
-        obj[part] = {};
-      }
-      obj = obj[part];
-    }
-
-    obj[parts[parts.length - 1]] = newValue;
-    writeJson(PATHS.config, config);
-    invalidateConfigCache();
-
-    // Auto-sync .gitignore only when config keys affect gitignore mappings
-    if (configPath.startsWith('testing.') || configPath.startsWith('webmcp.')) {
-      try {
-        const { syncGitignore } = require('./flow-gitignore');
-        syncGitignore(config);
-      } catch (err) {
-        // Non-blocking — gitignore sync should never fail config writes
-      }
-    }
+    _applyConfigPath(configPath, newValue, config);
   } finally {
     if (release) release();
   }
@@ -503,36 +484,12 @@ async function setConfigValue(configPath, newValue) {
  * Use setConfigValue for concurrent-safe writes
  */
 function setConfigValueSync(configPath, newValue) {
-  // Validate path to prevent prototype pollution
   if (!isValidConfigPath(configPath)) {
     throw new Error(`Invalid config path: ${configPath}`);
   }
 
   const config = getConfig();
-  const parts = configPath.split('.');
-  let obj = config;
-
-  for (let i = 0; i < parts.length - 1; i++) {
-    const part = parts[i];
-    if (!Object.hasOwn(obj, part)) {
-      obj[part] = {};
-    }
-    obj = obj[part];
-  }
-
-  obj[parts[parts.length - 1]] = newValue;
-  writeJson(PATHS.config, config);
-  invalidateConfigCache();
-
-  // Auto-sync .gitignore only when config keys affect gitignore mappings
-  if (configPath.startsWith('testing.') || configPath.startsWith('webmcp.')) {
-    try {
-      const { syncGitignore } = require('./flow-gitignore');
-      syncGitignore(config);
-    } catch (err) {
-      // Non-blocking — gitignore sync should never fail config writes
-    }
-  }
+  _applyConfigPath(configPath, newValue, config);
 }
 
 /**

package/scripts/flow-config-substitution.js

@@ -1,5 +1,3 @@
-'use strict';
-
 /**
  * Wogi Flow - Config Substitution
  *

package/scripts/flow-context-estimator.js

@@ -111,7 +111,7 @@ function readSpecFile(taskId) {
     return null;
   }
 
-  const specPath = path.join(PATHS.root, '.workflow', 'specs', `${taskId}.md`);
+  const specPath = path.join(PATHS.specs, `${taskId}.md`);
 
   // Use try-catch only, no existsSync (prevents TOCTOU race condition)
   try {
@@ -127,7 +127,7 @@ function readSpecFile(taskId) {
   }
 
   // Also check changes directory
-  const changesDir = path.join(PATHS.root, '.workflow', 'changes');
+  const changesDir = PATHS.changes;
   try {
     const entries = fs.readdirSync(changesDir, { withFileTypes: true });
     for (const entry of entries) {
@@ -499,7 +499,7 @@ if (require.main === module) {
       process.exit(1);
     }
 
-    const readyPath = path.join(PATHS.state, 'ready.json');
+    const readyPath = PATHS.ready;
     const readyData = safeJsonParse(readyPath, { ready: [], inProgress: [] });
 
     const allTasks = [
@@ -546,7 +546,7 @@ if (require.main === module) {
 
     const currentPercent = parseFloat(args[2]) / 100;
 
-    const readyPath = path.join(PATHS.state, 'ready.json');
+    const readyPath = PATHS.ready;
     const readyData = safeJsonParse(readyPath, { ready: [], inProgress: [] });
 
     const allTasks = [