@celilo/cli 1.14.0 → 2.1.0

package/src/hooks/hook-jail-toolchain-reach.test.ts

@@ -0,0 +1,273 @@
+/**
+ * What TOOLING the jail leaves a hook (task 4.13).
+ *
+ * `hook-jail-unreachability.test.ts` asserts D9's filesystem claims and they
+ * hold. This suite asks the question D9's table never answers, and the answer
+ * turns out to be the reason task 4.13 exists: **the fleet's real hooks shell
+ * out, and the jail as derived today has no shell.**
+ *
+ * `execSync` spawns `/bin/sh -c`. `remote.ts` — the single seam every remote
+ * primitive routes through — builds an `ssh <user>@<host> <cmd>` string and
+ * hands it to exactly that. The derivation binds `/usr/lib`, `/lib`, `/lib64`
+ * and `/etc/ssl`, and nothing else outside the module's own tree. No `/bin`,
+ * no `/usr/bin`, no `/etc/resolv.conf`.
+ *
+ * That is measured here rather than argued, because reading the derivation is
+ * what produced the belief that stage 2 was complete. The mount set is correct
+ * about every path it names. It is silent about the ones a hook needs to run
+ * another program at all, and silence and correctness look identical from the
+ * outside.
+ *
+ * ⚠️ **These tests assert the CURRENT reach, including the failures.** They are
+ * not a wish list. When stage 2 gains a shell — or stage 3 brokers the remote
+ * calls and hooks stop needing one — the expectations here change with it, and
+ * the diff that changes them is where somebody states which of those happened.
+ * A suite that asserted the desired end state would be red for the whole of
+ * stage 2 and would teach nobody anything.
+ *
+ * **Needs a real jail and skips without one, loudly**, for the reason its
+ * neighbour gives: a check that cannot reach its subject returns a confident
+ * answer about nothing.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { executeHookScript } from './executor';
+import { detectJailBackend } from './jail';
+import { createCapturingLogger } from './logger';
+import type { HookContext } from './types';
+
+const PROBE_HOOK = resolve(__dirname, 'test-fixtures/jail-toolchain-hook.ts');
+
+interface Probe {
+  succeeded: boolean;
+  detail: string;
+}
+
+interface Reach {
+  shell: Probe;
+  exec_without_shell: Probe;
+  ssh: Probe;
+  ansible: Probe;
+  resolv_conf: Probe;
+  dns_lookup: Probe;
+  nsswitch: Probe;
+  hosts_file: Probe;
+  playwright_cache: Probe;
+  celilo_browser_root: Probe;
+  data_dir_sibling: Probe;
+  dynamic_loader: Probe;
+  browser_binary_present: Probe;
+  browser_sandboxed: Probe;
+  browser_no_sandbox: Probe;
+  bwrap_present: Probe;
+}
+
+/**
+ * A real browser to launch inside the jail, or nothing.
+ *
+ * Task 4.10's question cannot be answered without one, and most hosts have
+ * none. `CELILO_PROBE_BROWSER` names it for the run that does — the Docker
+ * image this suite's finding was measured in. Absent, the two browser probes
+ * report "no browser supplied" and the run says so out loud rather than
+ * reporting an ABSENT that means "not tested".
+ */
+const PROBE_BROWSER = process.env.CELILO_PROBE_BROWSER ?? '';
+
+/**
+ * The browser's directory, refused if handing it over would defeat this
+ * suite's own `bwrap` guard.
+ *
+ * Binding the browser's directory as a path input is how a browser reaches the
+ * jail here. Point `CELILO_PROBE_BROWSER` at `/usr/bin/chromium` and that
+ * directory is `/usr/bin`, which carries `bwrap` in with it — the guard below
+ * then fails for a reason that is the harness's fault, not the derivation's.
+ * Measured: it happened on the first run of this file.
+ *
+ * Debian's `/usr/bin/chromium` is a `#!/bin/sh` wrapper anyway and cannot exec
+ * in a jail with no shell. The real ELF is under `/usr/lib`, which the
+ * derivation already binds, so the honest browser to name is that one.
+ */
+function probeBrowserDir(): string {
+  const dir = dirname(PROBE_BROWSER);
+  if (existsSync(join(dir, 'bwrap'))) {
+    throw new Error(
+      `CELILO_PROBE_BROWSER=${PROBE_BROWSER} would bind ${dir}, which holds bwrap and would defeat the guard this suite exists to keep. Name the browser's real ELF (Debian: /usr/lib/chromium/chromium), not the /usr/bin wrapper.`,
+    );
+  }
+  return dir;
+}
+
+const availability = detectJailBackend();
+const jailed = availability.backend !== 'none';
+
+/** Run the probe hook against a module tree laid out the way celilo lays one out. */
+async function measureReach(): Promise<{ reach: Reach; cleanup: () => void }> {
+  const scratch = mkdtempSync(join(tmpdir(), 'celilo-jail-reach-'));
+  const modulePath = join(scratch, 'modules', 'jail-reach');
+  const stateDir = join(modulePath, 'state');
+  const screenshotDir = join(modulePath, 'screenshots', 'run');
+  mkdirSync(join(modulePath, 'scripts'), { recursive: true });
+  mkdirSync(stateDir, { recursive: true });
+  mkdirSync(screenshotDir, { recursive: true });
+
+  const { logger } = createCapturingLogger();
+  const context: HookContext = {
+    config: PROBE_BROWSER ? { browser_executable: PROBE_BROWSER } : {},
+    secrets: {},
+    systems: [],
+    logger,
+    debug: false,
+    screenshotDir,
+    stateDir,
+    capabilities: {},
+  };
+
+  // The jailed run jails under `required`: ce-29z made `auto` defer on
+  // sandbox-exec until D14 exists, so this suite's jail is the operator's
+  // explicit act — the bypass the deferral deliberately leaves open.
+  const savedPolicy = process.env.CELILO_HOOK_JAIL;
+  process.env.CELILO_HOOK_JAIL = 'required';
+  try {
+    const reach = (await executeHookScript(PROBE_HOOK, context, {
+      timeoutMs: 60_000,
+      idleTimeoutMs: 60_000,
+      jail: {
+        modulePath,
+        // The browser reaches the jail as a DECLARED PATH INPUT, which is the
+        // mechanism 4.10's fix would use. Binding it by editing the derivation
+        // and then asking the derivation whether it is bound would prove
+        // nothing.
+        pathInputs: PROBE_BROWSER
+          ? [{ name: 'browser_executable', value: probeBrowserDir(), access: 'read' as const }]
+          : [],
+      },
+    })) as unknown as Reach;
+
+    return { reach, cleanup: restorePolicy };
+  } catch (error) {
+    restorePolicy();
+    throw error;
+  }
+
+  function restorePolicy() {
+    if (savedPolicy === undefined) delete process.env.CELILO_HOOK_JAIL;
+    else process.env.CELILO_HOOK_JAIL = savedPolicy;
+    rmSync(scratch, { recursive: true, force: true });
+  }
+}
+
+describe.skipIf(!jailed)(`what a jailed hook can run (backend: ${availability.backend})`, () => {
+  // 30s, not bun's default 5s: the DNS probe deliberately waits for an answer
+  // that never comes, and a runner timeout would report as a suite failure
+  // rather than as the measurement it is.
+  test('measures the reach', async () => {
+    const { reach, cleanup } = await measureReach();
+    try {
+      // Printed unconditionally, and to stderr because bun swallows a passing
+      // test's stdout. This suite's value is the table, and a run that only
+      // says "1 pass" has thrown the finding away.
+      for (const [name, probe] of Object.entries(reach)) {
+        console.error(`  ${probe.succeeded ? 'REACHED' : 'ABSENT '} ${name}: ${probe.detail}`);
+      }
+
+      // ── The finding, per backend ────────────────────────────────────────
+      // bubblewrap BUILDS a namespace, so reach is filesystem absence: no
+      // `/bin` is bound, so no shell, so `execSync` cannot run at all. 22
+      // module script files import `node:child_process`.
+      //
+      // `sandbox-exec` FILTERS the tree that is already there, and its parity
+      // statements change what exec means. `(allow process*)` lets the kernel
+      // map and run an image the jail cannot READ — exec is not file-read in
+      // SBPL — so `/bin/sh` runs, `/bin/echo` runs, and `ssh` spawns. Measured
+      // 2026-08-30, first run of this suite under the second backend. The
+      // boundary that DOES hold on macOS is the filesystem and the credential:
+      // writes outside the mount set are EPERM, secrets are unreadable, and
+      // the `~/.ssh` key stage 3 withheld is not in the jail for ssh to use —
+      // asserted by hook-trespass.test.ts and hook-jail-unreachability.test.ts,
+      // which pass under both backends.
+      if (availability.backend === 'sandbox-exec') {
+        expect(reach.shell.succeeded).toBe(true);
+        expect(reach.exec_without_shell.succeeded).toBe(true);
+        // It spawns; it cannot authenticate. That is stage 3's boundary, not
+        // this suite's.
+        expect(reach.ssh.succeeded).toBe(true);
+        // `ansible-playbook` is not installed on the probe host, so the row
+        // measures the HOST, not the jail: posix_spawn of anything present is
+        // allowed. No assertion either way.
+        // `dns_lookup` also stays a printed row rather than an assertion:
+        // measured REACHED — `(allow network*)` plus macOS resolving
+        // out-of-process in mDNSResponder — but gating on it needs a live
+        // resolver, which a unit suite should not require.
+      } else {
+        expect(reach.shell.succeeded).toBe(false);
+        expect(reach.exec_without_shell.succeeded).toBe(false);
+
+        // `~/.ssh` is bound read-only in stage 2 specifically so `remote.ts`
+        // keeps working. There is no `ssh` to hand that key to.
+        expect(reach.ssh.succeeded).toBe(false);
+        expect(reach.ansible.succeeded).toBe(false);
+      }
+
+      // Nothing binds the resolver's configuration, on either platform:
+      // bubblewrap by absence, sandbox-exec by `deny default` (EPERM).
+      expect(reach.resolv_conf.succeeded).toBe(false);
+
+      // ── Task 4.10 ──────────────────────────────────────────────────────
+      // `~/.cache/ms-playwright` is the path task 4.10 names and it is bound
+      // by nothing, deliberately: `managed-browser-runtime` moved the browser
+      // into a celilo-owned tree, so binding the cache would bind a directory
+      // nothing launches from.
+      expect(reach.playwright_cache.succeeded).toBe(false);
+
+      // Binding BROWSER_ROOT must not expose what sits beside it. This one IS
+      // asserted unconditionally: `master.key` is unreadable whether or not
+      // the browser directory exists on this host, so unlike the row below
+      // there is no configuration in which this passes vacuously.
+      expect(reach.data_dir_sibling.succeeded).toBe(false);
+
+      // `BROWSER_ROOT` is NOT asserted here, and the reason is worth stating
+      // because asserting it would be the trap this file exists to avoid.
+      // `deriveMountSet` now emits the row, but `planJailedSpawn` drops any
+      // row whose source is missing — so on a host with no provisioned
+      // browser this probe reports ABSENT for a reason that has nothing to do
+      // with the mount set, and an assertion either way would be measuring
+      // the host rather than the derivation. The row itself is asserted
+      // hermetically in `mount-set.test.ts`, where it can be.
+
+      // The nesting question, asserted only on a run that supplied a browser.
+      // Measured 2026-08-28 in `oven/bun:latest` on aarch64 with Debian's
+      // chromium: with its own sandbox Chromium will not start inside the
+      // jail, and `--no-sandbox` renders. That is task 4.10's prediction
+      // confirmed, and it says what the fix has to include.
+      if (PROBE_BROWSER) {
+        expect(reach.browser_binary_present.succeeded).toBe(true);
+        expect(reach.browser_sandboxed.succeeded).toBe(false);
+        expect(reach.browser_no_sandbox.succeeded).toBe(true);
+      }
+
+      // ── The guard ──────────────────────────────────────────────────────
+      // Opposite direction, and it must never flip. D9 predicts the exact
+      // edit that would flip it: someone reads the failures above, binds
+      // `/usr/bin` to fix them, and brings `bwrap` in with it. `isForbidden`
+      // compares whole paths, so a bind of the DIRECTORY passes that filter.
+      // Asserted under bubblewrap only: there is no bubblewrap jail on macOS,
+      // so the row would measure whether the OPERATOR has bwrap installed,
+      // and posix_spawn of it is allowed anyway.
+      if (availability.backend !== 'sandbox-exec') {
+        expect(reach.bwrap_present.succeeded).toBe(false);
+      }
+    } finally {
+      cleanup();
+    }
+  }, 30_000);
+});
+
+describe.skipIf(jailed)('no jail on this host', () => {
+  test('says so rather than passing quietly', () => {
+    console.log(`hook jail unavailable, so 4.13's reach was NOT measured: ${availability.reason}`);
+    expect(availability.backend).toBe('none');
+  });
+});

package/src/hooks/hook-jail-unreachability.test.ts

@@ -27,10 +27,13 @@
 
 import { describe, expect, test } from 'bun:test';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { homedir, tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
+
+/** Uniquely named so it never collides with a real key on a jailed dev box. */
+const PLANTED_KEY_NAME = 'id_celilo_jail_probe';
 import { executeHookScript } from './executor';
-import { detectJailBackend } from './jail';
+import { detectJailBackend, jailPolicy } from './jail';
 import { createCapturingLogger } from './logger';
 import type { HookContext } from './types';
 
@@ -42,7 +45,12 @@ interface Probe {
 }
 
 const availability = detectJailBackend();
-const jailed = availability.backend !== 'none';
+// A host with a backend is not a host that JAILS: `CELILO_HOOK_JAIL=off` is an
+// operator switch and the executor honours it, so without this the suite runs
+// its assertions against a deliberately unjailed hook and reports the jail
+// broken. Only reachable since macOS gained a backend (task 4.8) — before that
+// every Mac skipped for want of one and the hole never showed.
+const jailed = availability.backend !== 'none' && jailPolicy() !== 'off';
 
 interface Rig {
   outputs: {
@@ -50,6 +58,7 @@ interface Rig {
     sibling_write: Probe;
     state_write: Probe;
     staged_write: Probe;
+    ssh_key: Probe;
   };
   stagedInput: string;
   siblingFile: string;
@@ -85,6 +94,20 @@ async function runProbe(): Promise<Rig> {
   // produces. This is the path the tmpfs would erase.
   const stagedInput = mkdtempSync(join(tmpdir(), 'celilo-jail-staged-'));
 
+  // A throwaway SSH key at the exact path the pre-stage-3 jail bound —
+  // `homedir()/.ssh` — so the flip (task 5.5) is real: the red baseline
+  // binds this directory and the probe reads the key, this branch binds no
+  // `.ssh` at all and the read gives ENOENT. Guarded to jailed hosts only
+  // (this whole suite is `skipIf(!jailed)`), which on a Mac is never — so
+  // the operator's real key is never touched on a dev box; on a jailed CI
+  // box homedir is an ephemeral container root. Uniquely named and removed
+  // in cleanup regardless.
+  const sshDir = join(homedir(), '.ssh');
+  const plantedKey = join(sshDir, PLANTED_KEY_NAME);
+  const createdSshDir = !existsSync(sshDir);
+  mkdirSync(sshDir, { recursive: true });
+  writeFileSync(plantedKey, 'not-a-real-key\n');
+
   const { logger } = createCapturingLogger();
   const context: HookContext = {
     config: {
@@ -101,31 +124,45 @@ async function runProbe(): Promise<Rig> {
     capabilities: {},
   };
 
-  const outputs = (await executeHookScript(PROBE_HOOK, context, {
-    timeoutMs: 60_000,
-    idleTimeoutMs: 60_000,
-    jail: {
-      modulePath,
-      pathInputs: [{ name: 'staged_input', value: stagedInput, access: 'write' }],
-    },
-  })) as unknown as Rig['outputs'];
-
-  return {
-    outputs,
-    stagedInput,
-    siblingFile,
-    cleanup: () => {
-      rmSync(scratch, { recursive: true, force: true });
-      rmSync(stagedInput, { recursive: true, force: true });
-    },
-  };
+  // The jailed run jails under `required`: ce-29z made `auto` defer on
+  // sandbox-exec until D14 exists, so this suite's jail is the operator's
+  // explicit act — the bypass the deferral deliberately leaves open.
+  const savedPolicy = process.env.CELILO_HOOK_JAIL;
+  process.env.CELILO_HOOK_JAIL = 'required';
+  try {
+    const outputs = (await executeHookScript(PROBE_HOOK, context, {
+      timeoutMs: 60_000,
+      idleTimeoutMs: 60_000,
+      jail: {
+        modulePath,
+        pathInputs: [{ name: 'staged_input', value: stagedInput, access: 'write' }],
+      },
+    })) as unknown as Rig['outputs'];
+    return {
+      outputs,
+      stagedInput,
+      siblingFile,
+      cleanup: () => {
+        if (savedPolicy === undefined) delete process.env.CELILO_HOOK_JAIL;
+        else process.env.CELILO_HOOK_JAIL = savedPolicy;
+        rmSync(scratch, { recursive: true, force: true });
+        rmSync(stagedInput, { recursive: true, force: true });
+        rmSync(plantedKey, { force: true });
+        if (createdSshDir) rmSync(sshDir, { recursive: true, force: true });
+      },
+    };
+  } catch (error) {
+    if (savedPolicy === undefined) delete process.env.CELILO_HOOK_JAIL;
+    else process.env.CELILO_HOOK_JAIL = savedPolicy;
+    throw error;
+  }
 }
 
 describe.skipIf(!jailed)(`the jail is real (backend: ${availability.backend})`, () => {
   test('a hook cannot reach celilo’s master key, or a sibling module', async () => {
     const rig = await runProbe();
     try {
-      const { planted_secret, sibling_write, state_write, staged_write } = rig.outputs;
+      const { planted_secret, sibling_write, state_write, staged_write, ssh_key } = rig.outputs;
       console.log(['', 'jail probe:', JSON.stringify(rig.outputs, null, 2)].join('\n'));
 
       // Unreachability, not an errno. Under bubblewrap the message is ENOENT
@@ -136,6 +173,12 @@ describe.skipIf(!jailed)(`the jail is real (backend: ${availability.backend})`,
       // And the parent's own view: the write did not land by another route.
       expect(existsSync(rig.siblingFile)).toBe(false);
 
+      // Stage 3 (design D12, task 5.5): the SSH credential is not bound, so
+      // a jailed hook cannot authenticate anywhere by hand. This is the
+      // recurrence-gate row that FLIPPED when the `~/.ssh` mount was removed
+      // — it read `succeeded: true` for the whole of stage 2.
+      expect(ssh_key.succeeded).toBe(false);
+
       // The carve-out. `state/` is inside the read-only module tree and is
       // bound read-write on top of it; if the ordering were wrong this is the
       // assertion that would catch it.
@@ -161,13 +204,21 @@ describe.skipIf(!jailed)(`the jail is real (backend: ${availability.backend})`,
   }, 90_000);
 });
 
-describe.skipIf(jailed)('no jail on this host', () => {
+describe.skipIf(jailed)('this run is not jailed', () => {
   test('says so, rather than reporting a pass it did not earn', () => {
     // Not an assertion about the product. It is the line that stops a green
-    // run on a Mac reading as "the jail was proven".
+    // run on an unjailed host reading as "the jail was proven".
+    const why =
+      availability.backend === 'none'
+        ? (availability.reason ?? 'no backend')
+        : `CELILO_HOOK_JAIL=${process.env.CELILO_HOOK_JAIL}, so the operator switched the ${availability.backend} jail off here`;
     console.log(
-      `\nhook jail: SKIPPED the live suite — ${availability.reason ?? 'no backend'}\nThese properties are proven on Linux with bubblewrap. The hermetic half runs everywhere (jail.test.ts).`,
+      `\nhook jail: SKIPPED the live suite — ${why}\nThese properties are proven wherever a backend is available and enabled. The hermetic half runs everywhere (jail.test.ts).`,
     );
-    expect(availability.backend).toBe('none');
+    // Both reasons are legitimate and they are different facts, so assert the
+    // disjunction rather than one of them. Asserting `backend === 'none'` alone
+    // went red the day macOS got a backend AND the operator turned it off — a
+    // combination that is not a defect in anything.
+    expect(availability.backend === 'none' || jailPolicy() === 'off').toBe(true);
   });
 });

package/src/hooks/hook-protocol.ts

@@ -31,6 +31,28 @@ export const HOOK_PROTOCOL_VERSION = 1;
 export const HOOK_SOCKET_ENV = 'CELILO_HOOK_SOCKET';
 /** Environment variable carrying the parent's protocol version to the child. */
 export const HOOK_PROTOCOL_VERSION_ENV = 'CELILO_HOOK_PROTOCOL_VERSION';
+/**
+ * Environment variable carrying the remote-ops broker's socket path (stage 3,
+ * design D12). The ASKING half lives in `@celilo/capabilities`' remote
+ * primitives, which a module bundles — so that side names this variable as a
+ * string literal of its own (`packages/capabilities/src/remote.ts`), and the
+ * two must agree the way the socket framing must.
+ */
+export const HOOK_REMOTE_SOCKET_ENV = 'CELILO_HOOK_REMOTE_SOCKET';
+/**
+ * Environment variable carrying the derived mount set to the child, as JSON
+ * (task 4.7, the unjailed advisory lint).
+ *
+ * Set ONLY when the run is unjailed AND a mount set exists — its presence is
+ * the shim's signal to install the lint, so a jailed run carries nothing. The
+ * environment is the right channel rather than a protocol frame because this
+ * is spawn-time configuration of the shim, exactly like the two socket paths
+ * above, and because the value is finalised in the same planning step that
+ * picks the spawn command. The child validates it with `MountSetWireSchema`
+ * before use; it is written by celilo and read by celilo, but it crosses a
+ * process boundary and gets the same treatment as any other payload.
+ */
+export const HOOK_MOUNT_SET_ENV = 'CELILO_HOOK_MOUNT_SET';
 
 /**
  * An error crossing the boundary.
@@ -111,6 +133,28 @@ export const ContextFrameSchema = z.object({
   context: z.record(z.unknown()),
 });
 
+/**
+ * One row of the mount set, on the wire.
+ *
+ * Structural twin of `mount-set.ts`'s `MountEntry`. Duplicated as a schema
+ * rather than imported because this file is the wire contract and the wire
+ * must not grow a compile-time dependency on the derivation's internals —
+ * `hook-protocol.ts`'s docblock records who may import whom.
+ */
+export const MountEntrySchema = z.object({
+  path: z.string(),
+  mode: z.enum(['ro', 'rw', 'tmpfs']),
+  reason: z.string(),
+});
+
+/** The derived mount set, on the wire. Structural twin of `MountSet`. */
+export const MountSetWireSchema = z.object({
+  entries: z.array(MountEntrySchema),
+  chdir: z.string(),
+});
+
+export type MountSetWire = z.infer<typeof MountSetWireSchema>;
+
 /**
  * The capability shape descriptor (design D2).
  *

package/src/hooks/hook-runner-entry.ts

@@ -0,0 +1,23 @@
+/**
+ * The runner shim's entry point — the first file the hook process executes.
+ *
+ * **It exists to fix the evaluation order of one import.** The advisory lint
+ * (`unjailed-lint.ts`) must have its `node:fs` wrappers in place before any
+ * other module in this process ESM-loads `node:fs`, because Bun resolves a
+ * builtin's named ESM exports once — the first import freezes them. The
+ * runner shim itself imports `@celilo/capabilities`, whose graph reaches
+ * `node:fs`, so by the time the shim's own body could install anything, the
+ * facade is already frozen and the lint is silently disarmed (measured while
+ * landing task 4.7; `unjailed-lint.test.ts` goes red without this file).
+ *
+ * So: install first (the module also self-installs at evaluation; the guard
+ * makes whichever lands first correct), and only then hand off to the real
+ * runner. Nothing else belongs in this file, and nothing here may import a
+ * module whose graph reaches `node:fs` — that is the whole point of it.
+ */
+
+import { installUnjailedLintIfUnjailed } from './unjailed-lint';
+
+installUnjailedLintIfUnjailed();
+
+await import('./hook-runner');

package/src/hooks/hook-runner.ts

@@ -27,6 +27,12 @@ import {
   versionMismatch,
 } from './hook-protocol';
 import type { HookContext, HookLogger } from './types';
+import { forwardLintWarnings } from './unjailed-lint';
+
+// The advisory lint was installed before this module was even loaded — the
+// executor spawns `hook-runner-entry.ts`, whose first statement forces
+// `unjailed-lint`'s evaluation (see that module's docblock for why the order
+// is load-bearing there and irrelevant here).
 
 const socketPath = process.env[HOOK_SOCKET_ENV];
 if (!socketPath) {
@@ -123,6 +129,10 @@ async function runHook(): Promise<void> {
       if (!(field in contextData)) throw new Error(`Hook context is missing '${field}'.`);
     }
 
+    // Before the import, not after — the lint's warnings flow through the
+    // hook's logger from here on (anything earlier was buffered).
+    forwardLintWarnings(logger.warn);
+
     const context = {
       ...contextData,
       logger,