@celilo/cli 2.0.0 → 2.2.0

package/src/hooks/executor.ts

@@ -60,6 +60,7 @@ import {
 import { isPrivilegedCapability } from '../manifest/validate';
 import { pruneModuleArtifacts } from './artifact-retention';
 import { startBroker } from './broker';
+import type { HookStoresProvider } from './broker';
 import {
   HOOK_MOUNT_SET_ENV,
   HOOK_PROTOCOL_VERSION,
@@ -169,6 +170,35 @@ const FORWARDED_ENV = [
   'no_proxy',
 ] as const;
 
+/**
+ * The PATH a hook child gets: the CLI's own directory ahead of the inherited
+ * one, so the child can exec the SAME `celilo` the parent runs.
+ *
+ * A bun global install lands the `celilo` bin beside the bun binary itself
+ * (install.sh sets `BUN_INSTALL/bin`, default `~/.bun/bin`), so
+ * `dirname(process.execPath)` is that directory. The inherited PATH carries no
+ * such guarantee: the e2e management image runs the CLI only through an
+ * absolute-path wrapper at /usr/local/bin because its ENV has no /root/.bun/bin,
+ * and every hook that spawned `celilo` by name — caddy-internal's
+ * `on_consumer_removed` route withdrawal — died with "Executable not found in
+ * $PATH", leaving the stale routes it was withdrawing in place (celilo#1300).
+ * A real fleet hits the same class whenever the CLI is launched by a systemd
+ * unit or an absolute path with a minimal PATH.
+ *
+ * Already-present wins: an operator who has the directory on PATH sees an
+ * unchanged value. An absent inherited PATH still yields the CLI directory,
+ * so a hook can always reach `celilo` even from a stripped parent.
+ *
+ * Exported for the allow-list tests (hook-trespass.test.ts), which pin this
+ * contract the same way they pin the rest of the child environment.
+ */
+export function childPath(inherited: string | undefined): string {
+  const cliDir = dirname(process.execPath);
+  if (inherited === undefined) return cliDir;
+  if (inherited.split(':').includes(cliDir)) return inherited;
+  return `${cliDir}:${inherited}`;
+}
+
 /** The shim celilo spawns. Resolved from here so an npm install finds it too. */
 const HOOK_RUNNER_PATH = join(import.meta.dir, 'hook-runner.ts');
 /**
@@ -291,6 +321,13 @@ export interface ExecuteHookOptions {
    * fleet-credential operation is REFUSED, naming the gap (Rule 6.4).
    */
   remoteAccess?: RemoteAccessPolicy;
+  /**
+   * The module's hook-owned-state stores (hook-owned-state task 3.5), built
+   * lazily so a hook that never touches `context.secrets` / `context.config`
+   * pays nothing. Absent means the broker refuses store writes with an error
+   * naming the gap — never a silent drop.
+   */
+  hookStores?: HookStoresProvider;
 }
 
 /**
@@ -333,6 +370,7 @@ export async function executeHookScript(
     scriptPath,
     logger,
     onActivity: markActive,
+    stores: options.hookStores,
   });
   let remoteBroker: Awaited<ReturnType<typeof startRemoteBroker>> | undefined;
 
@@ -367,6 +405,12 @@ export async function executeHookScript(
 
     const child = Bun.spawn({
       cmd: [...jail.cmd],
+      // `sandbox-exec` has no `--chdir`, so the plan names one and the spawn
+      // sets it. Without it the child inherits the operator's shell directory,
+      // which the profile does not name — and `bun` reads its cwd before it
+      // runs anything, so the hook dies with a message about nothing in
+      // particular. bubblewrap plans leave this absent and use `--chdir`.
+      ...(jail.cwd ? { cwd: jail.cwd } : {}),
       env: hookChildEnv(
         broker.socketPath,
         remoteBroker.socketPath,
@@ -510,6 +554,10 @@ export function hookChildEnv(
   const env: Record<string, string> = {};
 
   for (const name of FORWARDED_ENV) {
+    if (name === 'PATH') {
+      env.PATH = childPath(process.env.PATH);
+      continue;
+    }
     const value = process.env[name];
     if (value !== undefined) env[name] = value;
   }
@@ -558,19 +606,36 @@ function jailRequest(
 
 /**
  * Say what the jail did, once per run, at a level that matches how surprising
- * it is.
+ * it is. A dropped row is now either FATAL or SILENT, never a warning.
+ *
+ * This used to warn about every absent row, because it could not tell a routine
+ * absence from a damaging one: "both look identical here, so the line names the
+ * paths and lets a reader tell them apart." That reasoning was sound and the
+ * result was not. The line fired 96 times with a byte-identical payload in a
+ * single `cele2e run --all`, so the case it existed to catch was buried in
+ * ninety-six copies of the case that does not matter. A signal that repeats
+ * unchanged is one every reader learns to skip.
+ *
+ * Each row now states what its own absence means (`MountAbsence`), so there is
+ * no classification left for a human to do from a path string:
  *
- * `skipped` is a warning rather than debug output on purpose. A dropped
- * `/lib64` on arm64 is routine; a dropped contract input means the hook is
- * about to write into the run's private tmpfs and report success over a
- * directory that is discarded when it exits (task 4.2j). Both look identical
- * here, so the line names the paths and lets a reader tell them apart.
+ *   required       throw. The hook cannot do what it was asked.
+ *   declared-only  silent until a module can declare the facility (ce-qani).
+ *   runtime        silent. A genuinely needed one fails the runtime, louder.
+ *   conditional    silent. Expected at this point in the lifecycle.
  */
 function reportJail(plan: JailPlan, logger: HookLogger): void {
   if (plan.mode === 'jailed') {
-    if (plan.skipped.length > 0) {
-      logger.warn(
-        `Hook jail: ${plan.skipped.length} mount(s) absent on this host and dropped: ${plan.skipped.join(', ')}`,
+    const fatal = plan.skipped.filter((m) => m.absence === 'required');
+    if (fatal.length > 0) {
+      // Throw rather than warn. A dropped contract input means the hook writes
+      // into the run's PRIVATE TMPFS and reports success over a directory that
+      // is discarded when it exits (task 4.2j), and a dropped interpreter or
+      // module tree means it could never have run at all. Both were previously
+      // survivable-looking warnings.
+      const detail = fatal.map((m) => `${m.path} (${m.reason})`).join(', ');
+      throw new Error(
+        `Hook jail cannot be built: ${fatal.length} required mount(s) absent on this host: ${detail}`,
       );
     }
     return;
@@ -636,6 +701,13 @@ export interface InvokeHookOptions {
    * refused (Rule 6.4).
    */
   remoteAccess?: RemoteAccessPolicy;
+  /**
+   * The module's hook-owned-state stores (hook-owned-state task 3.5), as a
+   * lazy provider: `() => createHookStores(db, moduleId)`. Built on first use
+   * inside the run, so a hook that never persists state never reads the
+   * manifest or touches the master key.
+   */
+  hookStores?: HookStoresProvider;
 }
 
 /**
@@ -879,7 +951,11 @@ export async function invokeHook(
 
   // Build context
   const loadedCapabilities = options.capabilities ?? {};
-  const context: HookContext = {
+  // The store accessor methods attach on the CHILD side (hook-runner.ts,
+  // buildStoreView) where the socket is, so the object serialized here
+  // carries the map half only. Same cast rationale as the runner's own
+  // context build. (hook-owned-state task 3.5)
+  const context = {
     ...inputs,
     config,
     secrets,
@@ -889,7 +965,7 @@ export async function invokeHook(
     screenshotDir,
     stateDir,
     capabilities: loadedCapabilities,
-  };
+  } as unknown as HookContext;
 
   // Pre-flight: every required capability must be loaded (HOOK_API_V2 D3).
   // Fail before invoking the handler so the script never sees a missing
@@ -939,6 +1015,7 @@ export async function invokeHook(
       idleTimeoutMs,
       jail: { modulePath, pathInputs: declaredPathInputs(signature, inputs) },
       remoteAccess: options.remoteAccess,
+      hookStores: options.hookStores,
     });
 
     // Validate outputs against the contract signature

package/src/hooks/hook-jail-toolchain-reach.test.ts

@@ -37,6 +37,7 @@ import { dirname, join, resolve } from 'node:path';
 import { executeHookScript } from './executor';
 import { detectJailBackend } from './jail';
 import { createCapturingLogger } from './logger';
+import { configStore, secretStore } from './test-fixtures/store-backed';
 import type { HookContext } from './types';
 
 const PROBE_HOOK = resolve(__dirname, 'test-fixtures/jail-toolchain-hook.ts');
@@ -115,8 +116,8 @@ async function measureReach(): Promise<{ reach: Reach; cleanup: () => void }> {
 
   const { logger } = createCapturingLogger();
   const context: HookContext = {
-    config: PROBE_BROWSER ? { browser_executable: PROBE_BROWSER } : {},
-    secrets: {},
+    config: PROBE_BROWSER ? configStore({ browser_executable: PROBE_BROWSER }) : configStore(),
+    secrets: secretStore(),
     systems: [],
     logger,
     debug: false,
@@ -125,22 +126,38 @@ async function measureReach(): Promise<{ reach: Reach; cleanup: () => void }> {
     capabilities: {},
   };
 
-  const reach = (await executeHookScript(PROBE_HOOK, context, {
-    timeoutMs: 60_000,
-    idleTimeoutMs: 60_000,
-    jail: {
-      modulePath,
-      // The browser reaches the jail as a DECLARED PATH INPUT, which is the
-      // mechanism 4.10's fix would use. Binding it by editing the derivation
-      // and then asking the derivation whether it is bound would prove
-      // nothing.
-      pathInputs: PROBE_BROWSER
-        ? [{ name: 'browser_executable', value: probeBrowserDir(), access: 'read' as const }]
-        : [],
-    },
-  })) as unknown as Reach;
-
-  return { reach, cleanup: () => rmSync(scratch, { recursive: true, force: true }) };
+  // The jailed run jails under `required`: ce-29z made `auto` defer on
+  // sandbox-exec until D14 exists, so this suite's jail is the operator's
+  // explicit act — the bypass the deferral deliberately leaves open.
+  const savedPolicy = process.env.CELILO_HOOK_JAIL;
+  process.env.CELILO_HOOK_JAIL = 'required';
+  try {
+    const reach = (await executeHookScript(PROBE_HOOK, context, {
+      timeoutMs: 60_000,
+      idleTimeoutMs: 60_000,
+      jail: {
+        modulePath,
+        // The browser reaches the jail as a DECLARED PATH INPUT, which is the
+        // mechanism 4.10's fix would use. Binding it by editing the derivation
+        // and then asking the derivation whether it is bound would prove
+        // nothing.
+        pathInputs: PROBE_BROWSER
+          ? [{ name: 'browser_executable', value: probeBrowserDir(), access: 'read' as const }]
+          : [],
+      },
+    })) as unknown as Reach;
+
+    return { reach, cleanup: restorePolicy };
+  } catch (error) {
+    restorePolicy();
+    throw error;
+  }
+
+  function restorePolicy() {
+    if (savedPolicy === undefined) delete process.env.CELILO_HOOK_JAIL;
+    else process.env.CELILO_HOOK_JAIL = savedPolicy;
+    rmSync(scratch, { recursive: true, force: true });
+  }
 }
 
 describe.skipIf(!jailed)(`what a jailed hook can run (backend: ${availability.backend})`, () => {
@@ -157,18 +174,46 @@ describe.skipIf(!jailed)(`what a jailed hook can run (backend: ${availability.ba
         console.error(`  ${probe.succeeded ? 'REACHED' : 'ABSENT '} ${name}: ${probe.detail}`);
       }
 
-      // ── The finding ────────────────────────────────────────────────────
-      // No shell, so `execSync` cannot run and neither can any hook that uses
-      // it. 22 module script files import `node:child_process`.
-      expect(reach.shell.succeeded).toBe(false);
-      expect(reach.exec_without_shell.succeeded).toBe(false);
+      // ── The finding, per backend ────────────────────────────────────────
+      // bubblewrap BUILDS a namespace, so reach is filesystem absence: no
+      // `/bin` is bound, so no shell, so `execSync` cannot run at all. 22
+      // module script files import `node:child_process`.
+      //
+      // `sandbox-exec` FILTERS the tree that is already there, and its parity
+      // statements change what exec means. `(allow process*)` lets the kernel
+      // map and run an image the jail cannot READ — exec is not file-read in
+      // SBPL — so `/bin/sh` runs, `/bin/echo` runs, and `ssh` spawns. Measured
+      // 2026-08-30, first run of this suite under the second backend. The
+      // boundary that DOES hold on macOS is the filesystem and the credential:
+      // writes outside the mount set are EPERM, secrets are unreadable, and
+      // the `~/.ssh` key stage 3 withheld is not in the jail for ssh to use —
+      // asserted by hook-trespass.test.ts and hook-jail-unreachability.test.ts,
+      // which pass under both backends.
+      if (availability.backend === 'sandbox-exec') {
+        expect(reach.shell.succeeded).toBe(true);
+        expect(reach.exec_without_shell.succeeded).toBe(true);
+        // It spawns; it cannot authenticate. That is stage 3's boundary, not
+        // this suite's.
+        expect(reach.ssh.succeeded).toBe(true);
+        // `ansible-playbook` is not installed on the probe host, so the row
+        // measures the HOST, not the jail: posix_spawn of anything present is
+        // allowed. No assertion either way.
+        // `dns_lookup` also stays a printed row rather than an assertion:
+        // measured REACHED — `(allow network*)` plus macOS resolving
+        // out-of-process in mDNSResponder — but gating on it needs a live
+        // resolver, which a unit suite should not require.
+      } else {
+        expect(reach.shell.succeeded).toBe(false);
+        expect(reach.exec_without_shell.succeeded).toBe(false);
 
-      // `~/.ssh` is bound read-only in stage 2 specifically so `remote.ts`
-      // keeps working. There is no `ssh` to hand that key to.
-      expect(reach.ssh.succeeded).toBe(false);
-      expect(reach.ansible.succeeded).toBe(false);
+        // `~/.ssh` is bound read-only in stage 2 specifically so `remote.ts`
+        // keeps working. There is no `ssh` to hand that key to.
+        expect(reach.ssh.succeeded).toBe(false);
+        expect(reach.ansible.succeeded).toBe(false);
+      }
 
-      // Nothing binds the resolver's configuration.
+      // Nothing binds the resolver's configuration, on either platform:
+      // bubblewrap by absence, sandbox-exec by `deny default` (EPERM).
       expect(reach.resolv_conf.succeeded).toBe(false);
 
       // ── Task 4.10 ──────────────────────────────────────────────────────
@@ -209,7 +254,12 @@ describe.skipIf(!jailed)(`what a jailed hook can run (backend: ${availability.ba
       // edit that would flip it: someone reads the failures above, binds
       // `/usr/bin` to fix them, and brings `bwrap` in with it. `isForbidden`
       // compares whole paths, so a bind of the DIRECTORY passes that filter.
-      expect(reach.bwrap_present.succeeded).toBe(false);
+      // Asserted under bubblewrap only: there is no bubblewrap jail on macOS,
+      // so the row would measure whether the OPERATOR has bwrap installed,
+      // and posix_spawn of it is allowed anyway.
+      if (availability.backend !== 'sandbox-exec') {
+        expect(reach.bwrap_present.succeeded).toBe(false);
+      }
     } finally {
       cleanup();
     }

package/src/hooks/hook-jail-unreachability.test.ts

@@ -33,8 +33,9 @@ import { join, resolve } from 'node:path';
 /** Uniquely named so it never collides with a real key on a jailed dev box. */
 const PLANTED_KEY_NAME = 'id_celilo_jail_probe';
 import { executeHookScript } from './executor';
-import { detectJailBackend } from './jail';
+import { detectJailBackend, jailPolicy } from './jail';
 import { createCapturingLogger } from './logger';
+import { configStore, secretStore } from './test-fixtures/store-backed';
 import type { HookContext } from './types';
 
 const PROBE_HOOK = resolve(__dirname, 'test-fixtures/jail-probe-hook.ts');
@@ -45,7 +46,12 @@ interface Probe {
 }
 
 const availability = detectJailBackend();
-const jailed = availability.backend !== 'none';
+// A host with a backend is not a host that JAILS: `CELILO_HOOK_JAIL=off` is an
+// operator switch and the executor honours it, so without this the suite runs
+// its assertions against a deliberately unjailed hook and reports the jail
+// broken. Only reachable since macOS gained a backend (task 4.8) — before that
+// every Mac skipped for want of one and the hole never showed.
+const jailed = availability.backend !== 'none' && jailPolicy() !== 'off';
 
 interface Rig {
   outputs: {
@@ -105,12 +111,12 @@ async function runProbe(): Promise<Rig> {
 
   const { logger } = createCapturingLogger();
   const context: HookContext = {
-    config: {
+    config: configStore({
       planted_secret: plantedSecret,
       sibling_file: siblingFile,
       staged_input: stagedInput,
-    },
-    secrets: {},
+    }),
+    secrets: secretStore(),
     systems: [],
     logger,
     debug: false,
@@ -119,26 +125,38 @@ async function runProbe(): Promise<Rig> {
     capabilities: {},
   };
 
-  const outputs = (await executeHookScript(PROBE_HOOK, context, {
-    timeoutMs: 60_000,
-    idleTimeoutMs: 60_000,
-    jail: {
-      modulePath,
-      pathInputs: [{ name: 'staged_input', value: stagedInput, access: 'write' }],
-    },
-  })) as unknown as Rig['outputs'];
-
-  return {
-    outputs,
-    stagedInput,
-    siblingFile,
-    cleanup: () => {
-      rmSync(scratch, { recursive: true, force: true });
-      rmSync(stagedInput, { recursive: true, force: true });
-      rmSync(plantedKey, { force: true });
-      if (createdSshDir) rmSync(sshDir, { recursive: true, force: true });
-    },
-  };
+  // The jailed run jails under `required`: ce-29z made `auto` defer on
+  // sandbox-exec until D14 exists, so this suite's jail is the operator's
+  // explicit act — the bypass the deferral deliberately leaves open.
+  const savedPolicy = process.env.CELILO_HOOK_JAIL;
+  process.env.CELILO_HOOK_JAIL = 'required';
+  try {
+    const outputs = (await executeHookScript(PROBE_HOOK, context, {
+      timeoutMs: 60_000,
+      idleTimeoutMs: 60_000,
+      jail: {
+        modulePath,
+        pathInputs: [{ name: 'staged_input', value: stagedInput, access: 'write' }],
+      },
+    })) as unknown as Rig['outputs'];
+    return {
+      outputs,
+      stagedInput,
+      siblingFile,
+      cleanup: () => {
+        if (savedPolicy === undefined) delete process.env.CELILO_HOOK_JAIL;
+        else process.env.CELILO_HOOK_JAIL = savedPolicy;
+        rmSync(scratch, { recursive: true, force: true });
+        rmSync(stagedInput, { recursive: true, force: true });
+        rmSync(plantedKey, { force: true });
+        if (createdSshDir) rmSync(sshDir, { recursive: true, force: true });
+      },
+    };
+  } catch (error) {
+    if (savedPolicy === undefined) delete process.env.CELILO_HOOK_JAIL;
+    else process.env.CELILO_HOOK_JAIL = savedPolicy;
+    throw error;
+  }
 }
 
 describe.skipIf(!jailed)(`the jail is real (backend: ${availability.backend})`, () => {
@@ -187,13 +205,21 @@ describe.skipIf(!jailed)(`the jail is real (backend: ${availability.backend})`,
   }, 90_000);
 });
 
-describe.skipIf(jailed)('no jail on this host', () => {
+describe.skipIf(jailed)('this run is not jailed', () => {
   test('says so, rather than reporting a pass it did not earn', () => {
     // Not an assertion about the product. It is the line that stops a green
-    // run on a Mac reading as "the jail was proven".
+    // run on an unjailed host reading as "the jail was proven".
+    const why =
+      availability.backend === 'none'
+        ? (availability.reason ?? 'no backend')
+        : `CELILO_HOOK_JAIL=${process.env.CELILO_HOOK_JAIL}, so the operator switched the ${availability.backend} jail off here`;
     console.log(
-      `\nhook jail: SKIPPED the live suite — ${availability.reason ?? 'no backend'}\nThese properties are proven on Linux with bubblewrap. The hermetic half runs everywhere (jail.test.ts).`,
+      `\nhook jail: SKIPPED the live suite — ${why}\nThese properties are proven wherever a backend is available and enabled. The hermetic half runs everywhere (jail.test.ts).`,
     );
-    expect(availability.backend).toBe('none');
+    // Both reasons are legitimate and they are different facts, so assert the
+    // disjunction rather than one of them. Asserting `backend === 'none'` alone
+    // went red the day macOS got a backend AND the operator turned it off — a
+    // combination that is not a defect in anything.
+    expect(availability.backend === 'none' || jailPolicy() === 'off').toBe(true);
   });
 });

package/src/hooks/hook-protocol.ts

@@ -25,7 +25,7 @@
 
 import { z } from 'zod';
 
-export const HOOK_PROTOCOL_VERSION = 1;
+export const HOOK_PROTOCOL_VERSION = 2;
 
 /** Environment variable carrying the broker's socket path to the child. */
 export const HOOK_SOCKET_ENV = 'CELILO_HOOK_SOCKET';
@@ -91,6 +91,39 @@ export const CallFrameSchema = z.object({
   args: z.array(z.unknown()),
 });
 
+/**
+ * One hook-owned-state store operation, correlated like a `call` (and answered
+ * by the same `return`/`throw` frames — the runner's pending map keys on `id`
+ * alone).
+ *
+ * `store` names which of the module's two stores the call targets; `method` is
+ * one of the four `HookStore` operations. A `transaction` call carries the
+ * buffered operation list the CHILD accumulated — the hook's `fn` ran entirely
+ * child-side, so a throwing `fn` never sends anything, which is what makes the
+ * discard real rather than a promise the parent has to honor.
+ *
+ * Hook-owned-state design: the accessor is implemented once broker-side and
+ * reaches the hook as its own RPC family over this envelope, NOT as a fake
+ * capability — a fake one would surface in the `capabilities` shape frame and
+ * appear to the hook as a provider module.
+ */
+export const StoreCallFrameSchema = z.object({
+  type: z.literal('store'),
+  id: z.string(),
+  store: z.enum(['secrets', 'config']),
+  method: z.enum(['get', 'set', 'delete', 'transaction']),
+  args: z.array(z.unknown()),
+});
+
+/** One buffered operation inside a `transaction` store call. */
+export const BufferedStoreOpSchema = z.object({
+  op: z.enum(['set', 'delete']),
+  name: z.string(),
+  value: z.string().optional(),
+});
+
+export type BufferedStoreOp = z.infer<typeof BufferedStoreOpSchema>;
+
 /** One `ctx.logger` call. Fire and forget — the hook does not wait on it. */
 export const LogFrameSchema = z.object({
   type: z.literal('log'),
@@ -113,6 +146,7 @@ export const HookThrewFrameSchema = z.object({
 export const ChildFrameSchema = z.discriminatedUnion('type', [
   ReadyFrameSchema,
   CallFrameSchema,
+  StoreCallFrameSchema,
   LogFrameSchema,
   ResultFrameSchema,
   HookThrewFrameSchema,
@@ -145,6 +179,11 @@ export const MountEntrySchema = z.object({
   path: z.string(),
   mode: z.enum(['ro', 'rw', 'tmpfs']),
   reason: z.string(),
+  // Kept on the wire so this stays the structural twin its docblock below
+  // claims. The child ignores it — absence is decided when the set is derived,
+  // not by the hook — but a twin that has quietly stopped being one is how the
+  // round-trip test starts asserting about a shape nothing sends.
+  absence: z.enum(['required', 'declared-only', 'runtime', 'conditional']),
 });
 
 /** The derived mount set, on the wire. Structural twin of `MountSet`. */
@@ -272,6 +311,12 @@ export function createLineReader(onLine: (line: string) => void): (chunk: string
 /**
  * The handshake check, in one place so both ends produce the same sentence.
  *
+ * Version 2 added the `store` frame family (hook-owned-state task 3.5). Both
+ * ends of this protocol ship in the same celilo binary, so the check exists
+ * for one situation: a runner answering a broker built from different source
+ * than itself. It aborts the hook loudly instead of letting a store write
+ * disappear into a frame the other side cannot parse.
+ *
  * Names both numbers: a mismatch is an install skew (a `.deb` upgraded while a
  * module's bundled copy was not), and the operator needs to know which side is
  * which to fix it.

package/src/hooks/hook-runner.ts

@@ -26,6 +26,7 @@ import {
   serializeError,
   versionMismatch,
 } from './hook-protocol';
+import { buildStoreView } from './hook-store-proxy';
 import type { HookContext, HookLogger } from './types';
 import { forwardLintWarnings } from './unjailed-lint';
 
@@ -110,6 +111,22 @@ function callBroker(capability: string, method: string, args: unknown[]): Promis
   });
 }
 
+/**
+ * Store calls share the capability call's correlation machinery: the broker
+ * answers both families with the same `return`/`throw` frames, keyed by `id`.
+ */
+function callStore(
+  store: 'secrets' | 'config',
+  method: 'get' | 'set' | 'delete' | 'transaction',
+  args: unknown[],
+): Promise<unknown> {
+  const id = `c${nextCallId++}`;
+  return new Promise((resolve, reject) => {
+    pending.set(id, { resolve, reject });
+    send({ type: 'store', id, store, method, args });
+  });
+}
+
 /**
  * The `defineHook` brand check, moved here from the executor unchanged
  * (HOOK_API_V2 Phase 8 / D8). The brand is a `Symbol.for` key, so it survives
@@ -133,8 +150,27 @@ async function runHook(): Promise<void> {
     // hook's logger from here on (anything earlier was buffered).
     forwardLintWarnings(logger.warn);
 
+    // Attach the hook-owned-state accessor onto both maps. The maps crossed
+    // the context frame as plain data; the accessor methods exist only on
+    // this side, where the socket is. Old map reads keep working; new code
+    // calls `secrets.set(...)` / `config.get(...)` (hook-owned-state task 3.5).
+    // The casts say something true: celilo built both fields and controls
+    // their shape, the same rationale as the field check above.
+    const stores = buildStoreView(
+      'secrets',
+      (contextData.secrets ?? {}) as Record<string, string>,
+      callStore,
+    );
+    const configStores = buildStoreView(
+      'config',
+      (contextData.config ?? {}) as Record<string, unknown>,
+      callStore,
+    );
+
     const context = {
       ...contextData,
+      config: configStores,
+      secrets: stores,
       logger,
       capabilities: buildCapabilities(shape),
     } as unknown as HookContext;