@celilo/cli 2.1.0 → 2.2.1

package/src/hooks/executor.test.ts

@@ -1,8 +1,12 @@
-import { describe, expect, test } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { existsSync, mkdtempSync, readdirSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { closeDb, getDb } from '../db/client';
+import { runMigrations } from '../db/migrate';
+import { systemConfig } from '../db/schema';
 import type { ContractHookSignature } from '../manifest/contracts';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   checkRequiredCapabilities,
   declaredPathInputs,
@@ -15,7 +19,8 @@ import {
 } from './executor';
 import { readJailMode } from './jail';
 import { createCapturingLogger } from './logger';
-import type { HookDefinition } from './types';
+import { configStore, secretStore } from './test-fixtures/store-backed';
+import type { HookContext, HookDefinition } from './types';
 
 const FIXTURES_DIR = join(__dirname, 'test-fixtures');
 
@@ -115,8 +120,8 @@ describe('Hook Executor', () => {
       const scriptPath = join(FIXTURES_DIR, 'success-hook.ts');
 
       const result = await executeHookScript(scriptPath, {
-        config: { username: 'testuser' },
-        secrets: { password: 'secret' },
+        config: configStore({ username: 'testuser' }),
+        secrets: secretStore({ password: 'secret' }),
         systems: [],
         logger,
         debug: false,
@@ -136,8 +141,8 @@ describe('Hook Executor', () => {
 
       await expect(
         executeHookScript('/nonexistent/hook.ts', {
-          config: {},
-          secrets: {},
+          config: configStore(),
+          secrets: secretStore(),
           systems: [],
           logger,
           debug: false,
@@ -154,8 +159,8 @@ describe('Hook Executor', () => {
 
       await expect(
         executeHookScript(scriptPath, {
-          config: {},
-          secrets: {},
+          config: configStore(),
+          secrets: secretStore(),
           systems: [],
           logger,
           debug: false,
@@ -176,8 +181,8 @@ describe('Hook Executor', () => {
 
       await expect(
         executeHookScript(scriptPath, {
-          config: {},
-          secrets: {},
+          config: configStore(),
+          secrets: secretStore(),
           systems: [],
           logger,
           debug: false,
@@ -193,8 +198,8 @@ describe('Hook Executor', () => {
       const scriptPath = join(FIXTURES_DIR, 'void-hook.ts');
 
       const result = await executeHookScript(scriptPath, {
-        config: {},
-        secrets: {},
+        config: configStore(),
+        secrets: secretStore(),
         systems: [],
         logger,
         debug: false,
@@ -212,8 +217,8 @@ describe('Hook Executor', () => {
 
       await expect(
         executeHookScript(scriptPath, {
-          config: {},
-          secrets: {},
+          config: configStore(),
+          secrets: secretStore(),
           systems: [],
           logger,
           debug: false,
@@ -231,9 +236,9 @@ describe('Hook Executor', () => {
     test('honors a caller-supplied idle timeout instead of the 30s default', async () => {
       const { logger } = createCapturingLogger();
       const scriptPath = join(FIXTURES_DIR, 'silent-hook.ts');
-      const context = {
-        config: { silent_ms: 8000 },
-        secrets: {},
+      const context: HookContext = {
+        config: configStore({ silent_ms: 8000 }),
+        secrets: secretStore(),
         systems: [],
         logger,
         debug: false,
@@ -310,8 +315,8 @@ describe('Hook Executor', () => {
       try {
         const { logger } = createCapturingLogger();
         await executeHookScript(join(FIXTURES_DIR, 'void-hook.ts'), {
-          config: {},
-          secrets: {},
+          config: configStore(),
+          secrets: secretStore(),
           systems: [],
           logger,
           debug: false,
@@ -328,6 +333,88 @@ describe('Hook Executor', () => {
     });
   });
 
+  describe('the executor resolves the jail policy through stored config (hook-jail-config-surface slice 4)', () => {
+    // Each test gets its own migrated scratch database and its own jail-mode
+    // store, so a planted row here never leaks into another test (or another
+    // host). With no module tree in `options.jail`, `planJailedSpawn` treats a
+    // `required` policy as a hard failure on EVERY host — which makes the
+    // resolution outcome observable without depending on what jail backend a
+    // given machine happens to have.
+    let dir: string;
+    const saved: Record<string, string | undefined> = {};
+
+    const plantPolicyRow = (value: string): void => {
+      getDb().insert(systemConfig).values({ key: 'hooks.jail_policy', value }).run();
+    };
+
+    const runVoidHook = (): Promise<Record<string, unknown>> => {
+      const { logger } = createCapturingLogger();
+      return executeHookScript(join(FIXTURES_DIR, 'void-hook.ts'), {
+        config: configStore(),
+        secrets: secretStore(),
+        systems: [],
+        logger,
+        debug: false,
+        screenshotDir: '/tmp',
+        stateDir: '/tmp',
+        capabilities: {},
+      });
+    };
+
+    beforeEach(async () => {
+      for (const key of ['CELILO_HOOK_JAIL', 'CELILO_HOOK_JAIL_MODE_PATH']) {
+        saved[key] = process.env[key];
+      }
+      dir = mkdtempSync(join(tmpdir(), 'celilo-executor-policy-'));
+      process.env.CELILO_DB_PATH = join(dir, 'celilo.db');
+      process.env.CELILO_HOOK_JAIL_MODE_PATH = join(dir, 'mode.json');
+      delete process.env.CELILO_HOOK_JAIL;
+      await runMigrations(process.env.CELILO_DB_PATH);
+    });
+
+    afterEach(() => {
+      closeDb();
+      // The db path resets to the scratch path rather than restoring the
+      // saved value: that value may be another suite's temp database, or
+      // unset — which sends the next var-less reader to the operator's real
+      // celilo.db (celilo#1315).
+      resetTestDbPath();
+      for (const key of ['CELILO_HOOK_JAIL', 'CELILO_HOOK_JAIL_MODE_PATH']) {
+        if (saved[key] === undefined) delete process.env[key];
+        else process.env[key] = saved[key];
+      }
+      rmSync(dir, { recursive: true, force: true });
+    });
+
+    test('a stored row decides when the env is silent', async () => {
+      plantPolicyRow('required');
+      await expect(runVoidHook()).rejects.toThrow(/no hook jail is available/);
+    });
+
+    test('env wins over a conflicting stored row', async () => {
+      process.env.CELILO_HOOK_JAIL = 'off';
+      plantPolicyRow('required');
+      await expect(runVoidHook()).resolves.toBeDefined();
+    });
+
+    test('env=required still reaches the planner when the row says off', async () => {
+      process.env.CELILO_HOOK_JAIL = 'required';
+      plantPolicyRow('off');
+      await expect(runVoidHook()).rejects.toThrow(/no hook jail is available/);
+    });
+
+    test('a bad stored row fails the hook instead of running it unjailed', async () => {
+      plantPolicyRow('alwayssafe');
+      await expect(runVoidHook()).rejects.toThrow(/hooks\.jail_policy='alwayssafe'/);
+    });
+
+    test('nothing set resolves to the default, off (peba’s ruling on ce-rez7)', async () => {
+      // Migrated DB with no row: the stored-row read returns undefined and the
+      // resolver falls through to the default, which jails nobody.
+      await expect(runVoidHook()).resolves.toBeDefined();
+    });
+  });
+
   describe('resolveHookTimeouts', () => {
     test('no declaration: 60s total, 30s idle heuristic', () => {
       expect(resolveHookTimeouts(undefined, false)).toEqual({

package/src/hooks/executor.ts

@@ -51,6 +51,8 @@ import {
   moduleArtifactDir,
   moduleStateDir,
 } from '@celilo/capabilities';
+import { getDbPath } from '../config/paths';
+import { getDb } from '../db/client';
 import {
   type ContractHookSignature,
   contractHookSignature,
@@ -60,6 +62,7 @@ import {
 import { isPrivilegedCapability } from '../manifest/validate';
 import { pruneModuleArtifacts } from './artifact-retention';
 import { startBroker } from './broker';
+import type { HookStoresProvider } from './broker';
 import {
   HOOK_MOUNT_SET_ENV,
   HOOK_PROTOCOL_VERSION,
@@ -72,10 +75,10 @@ import {
 import {
   type JailPlan,
   detectJailBackend,
-  jailPolicy,
   planJailedSpawn,
   realpathRequest,
   recordJailMode,
+  resolveJailPolicy,
   runtimeModulePathsFor,
 } from './jail';
 import {
@@ -169,6 +172,50 @@ const FORWARDED_ENV = [
   'no_proxy',
 ] as const;
 
+/**
+ * The directory holding the `celilo` bin of the running CLI package, resolved
+ * from this file's own location: src/hooks -> the package's bin/. Every
+ * distribution layout lands there. The .deb wrapper execs
+ * `$CELILO_HOME/node_modules/@celilo/cli/bin/celilo` directly (packaging/celilo/
+ * scripts/wrapper.sh), and a bun global install symlinks ~/.bun/bin/celilo into
+ * that same bin directory, whose script self-locates its package dir.
+ */
+export const CLI_BIN_DIR = join(import.meta.dir, '..', '..', 'bin');
+
+/**
+ * The PATH a hook child gets: the CLI package's own bin directory, then the
+ * runtime's, ahead of the inherited one — so the child can exec the SAME
+ * `celilo` the parent runs, and that celilo can still find its interpreter.
+ *
+ * `dirname(process.execPath)` alone is NOT the CLI's directory under the fleet
+ * layout: the .deb runs the CLI through a wrapper at /usr/local/bin/celilo that
+ * execs bun on `node_modules/@celilo/cli/src/cli/index.ts`, so the directory
+ * beside the bun binary holds only bun (measured on the fleet, 2026-09-07,
+ * ce-y0fd). Hooks then found `celilo` only because the systemd unit happened to
+ * inherit /usr/local/bin on its PATH — the same accident that broke every hook
+ * spawning `celilo` by name in the e2e management image (celilo#1300).
+ * CLI_BIN_DIR resolves where the bin actually lives, whatever layout launched
+ * the parent, and comes FIRST so `celilo` is the package's own bin rather than
+ * an operator's wrapper. The runtime directory stays second because bin/celilo
+ * needs `command -v bun` (it is bash, not a shebanged TS file).
+ *
+ * Already-present wins: an operator who has a directory on PATH sees an
+ * unchanged value. An absent inherited PATH still yields both directories, so
+ * a hook can always reach `celilo` even from a stripped parent; bash resolves
+ * through the loader's default search.
+ *
+ * Exported for the allow-list tests (hook-trespass.test.ts), which pin this
+ * contract the same way they pin the rest of the child environment.
+ */
+export function childPath(inherited: string | undefined): string {
+  const base = inherited === undefined ? [] : inherited.split(':');
+  const prepended: string[] = [];
+  for (const dir of [CLI_BIN_DIR, dirname(process.execPath)]) {
+    if (!base.includes(dir) && !prepended.includes(dir)) prepended.push(dir);
+  }
+  return [...prepended, ...base].join(':');
+}
+
 /** The shim celilo spawns. Resolved from here so an npm install finds it too. */
 const HOOK_RUNNER_PATH = join(import.meta.dir, 'hook-runner.ts');
 /**
@@ -291,6 +338,32 @@ export interface ExecuteHookOptions {
    * fleet-credential operation is REFUSED, naming the gap (Rule 6.4).
    */
   remoteAccess?: RemoteAccessPolicy;
+  /**
+   * The module's hook-owned-state stores (hook-owned-state task 3.5), built
+   * lazily so a hook that never touches `context.secrets` / `context.config`
+   * pays nothing. Absent means the broker refuses store writes with an error
+   * naming the gap — never a silent drop.
+   */
+  hookStores?: HookStoresProvider;
+}
+
+/**
+ * The stored `hooks.jail_policy` value, or undefined when there is no row or
+ * no celilo DB to ask (a dev box). Same row-read pattern as
+ * `ipam/auto-allocator.ts` and the executor's fellow consumer
+ * `cli/commands/system-doctor.ts`; the drizzle table is `systemConfig` in
+ * `db/schema.ts`.
+ *
+ * Unlike `remoteAccess`, this read happens here rather than through a
+ * caller-built input because D2 names the executor itself as one of the two
+ * consumers that fetch the stored row and hand it to the pure resolver.
+ */
+function readStoredJailPolicy(): string | undefined {
+  if (!existsSync(getDbPath())) return undefined;
+  const row = getDb()
+    .$client.prepare('SELECT value FROM system_config WHERE key = ?')
+    .get('hooks.jail_policy') as { value: string } | undefined;
+  return row?.value;
 }
 
 /**
@@ -333,6 +406,7 @@ export async function executeHookScript(
     scriptPath,
     logger,
     onActivity: markActive,
+    stores: options.hookStores,
   });
   let remoteBroker: Awaited<ReturnType<typeof startRemoteBroker>> | undefined;
 
@@ -356,7 +430,7 @@ export async function executeHookScript(
       [process.execPath, HOOK_RUNNER_SPAWN_PATH],
       mountSet,
       detectJailBackend(),
-      jailPolicy(),
+      resolveJailPolicy(process.env.CELILO_HOOK_JAIL, readStoredJailPolicy()).policy,
     );
     reportJail(jail, logger);
     // Only a real module hook says anything about whether this HOST jails. An
@@ -516,6 +590,10 @@ export function hookChildEnv(
   const env: Record<string, string> = {};
 
   for (const name of FORWARDED_ENV) {
+    if (name === 'PATH') {
+      env.PATH = childPath(process.env.PATH);
+      continue;
+    }
     const value = process.env[name];
     if (value !== undefined) env[name] = value;
   }
@@ -564,19 +642,36 @@ function jailRequest(
 
 /**
  * Say what the jail did, once per run, at a level that matches how surprising
- * it is.
+ * it is. A dropped row is now either FATAL or SILENT, never a warning.
  *
- * `skipped` is a warning rather than debug output on purpose. A dropped
- * `/lib64` on arm64 is routine; a dropped contract input means the hook is
- * about to write into the run's private tmpfs and report success over a
- * directory that is discarded when it exits (task 4.2j). Both look identical
- * here, so the line names the paths and lets a reader tell them apart.
+ * This used to warn about every absent row, because it could not tell a routine
+ * absence from a damaging one: "both look identical here, so the line names the
+ * paths and lets a reader tell them apart." That reasoning was sound and the
+ * result was not. The line fired 96 times with a byte-identical payload in a
+ * single `cele2e run --all`, so the case it existed to catch was buried in
+ * ninety-six copies of the case that does not matter. A signal that repeats
+ * unchanged is one every reader learns to skip.
+ *
+ * Each row now states what its own absence means (`MountAbsence`), so there is
+ * no classification left for a human to do from a path string:
+ *
+ *   required       throw. The hook cannot do what it was asked.
+ *   declared-only  silent until a module can declare the facility (ce-qani).
+ *   runtime        silent. A genuinely needed one fails the runtime, louder.
+ *   conditional    silent. Expected at this point in the lifecycle.
  */
 function reportJail(plan: JailPlan, logger: HookLogger): void {
   if (plan.mode === 'jailed') {
-    if (plan.skipped.length > 0) {
-      logger.warn(
-        `Hook jail: ${plan.skipped.length} mount(s) absent on this host and dropped: ${plan.skipped.join(', ')}`,
+    const fatal = plan.skipped.filter((m) => m.absence === 'required');
+    if (fatal.length > 0) {
+      // Throw rather than warn. A dropped contract input means the hook writes
+      // into the run's PRIVATE TMPFS and reports success over a directory that
+      // is discarded when it exits (task 4.2j), and a dropped interpreter or
+      // module tree means it could never have run at all. Both were previously
+      // survivable-looking warnings.
+      const detail = fatal.map((m) => `${m.path} (${m.reason})`).join(', ');
+      throw new Error(
+        `Hook jail cannot be built: ${fatal.length} required mount(s) absent on this host: ${detail}`,
       );
     }
     return;
@@ -642,6 +737,13 @@ export interface InvokeHookOptions {
    * refused (Rule 6.4).
    */
   remoteAccess?: RemoteAccessPolicy;
+  /**
+   * The module's hook-owned-state stores (hook-owned-state task 3.5), as a
+   * lazy provider: `() => createHookStores(db, moduleId)`. Built on first use
+   * inside the run, so a hook that never persists state never reads the
+   * manifest or touches the master key.
+   */
+  hookStores?: HookStoresProvider;
 }
 
 /**
@@ -885,7 +987,11 @@ export async function invokeHook(
 
   // Build context
   const loadedCapabilities = options.capabilities ?? {};
-  const context: HookContext = {
+  // The store accessor methods attach on the CHILD side (hook-runner.ts,
+  // buildStoreView) where the socket is, so the object serialized here
+  // carries the map half only. Same cast rationale as the runner's own
+  // context build. (hook-owned-state task 3.5)
+  const context = {
     ...inputs,
     config,
     secrets,
@@ -895,7 +1001,7 @@ export async function invokeHook(
     screenshotDir,
     stateDir,
     capabilities: loadedCapabilities,
-  };
+  } as unknown as HookContext;
 
   // Pre-flight: every required capability must be loaded (HOOK_API_V2 D3).
   // Fail before invoking the handler so the script never sees a missing
@@ -945,6 +1051,7 @@ export async function invokeHook(
       idleTimeoutMs,
       jail: { modulePath, pathInputs: declaredPathInputs(signature, inputs) },
       remoteAccess: options.remoteAccess,
+      hookStores: options.hookStores,
     });
 
     // Validate outputs against the contract signature

package/src/hooks/hook-jail-toolchain-reach.test.ts

@@ -37,6 +37,7 @@ import { dirname, join, resolve } from 'node:path';
 import { executeHookScript } from './executor';
 import { detectJailBackend } from './jail';
 import { createCapturingLogger } from './logger';
+import { configStore, secretStore } from './test-fixtures/store-backed';
 import type { HookContext } from './types';
 
 const PROBE_HOOK = resolve(__dirname, 'test-fixtures/jail-toolchain-hook.ts');
@@ -115,8 +116,8 @@ async function measureReach(): Promise<{ reach: Reach; cleanup: () => void }> {
 
   const { logger } = createCapturingLogger();
   const context: HookContext = {
-    config: PROBE_BROWSER ? { browser_executable: PROBE_BROWSER } : {},
-    secrets: {},
+    config: PROBE_BROWSER ? configStore({ browser_executable: PROBE_BROWSER }) : configStore(),
+    secrets: secretStore(),
     systems: [],
     logger,
     debug: false,

package/src/hooks/hook-jail-unreachability.test.ts

@@ -35,6 +35,7 @@ const PLANTED_KEY_NAME = 'id_celilo_jail_probe';
 import { executeHookScript } from './executor';
 import { detectJailBackend, jailPolicy } from './jail';
 import { createCapturingLogger } from './logger';
+import { configStore, secretStore } from './test-fixtures/store-backed';
 import type { HookContext } from './types';
 
 const PROBE_HOOK = resolve(__dirname, 'test-fixtures/jail-probe-hook.ts');
@@ -110,12 +111,12 @@ async function runProbe(): Promise<Rig> {
 
   const { logger } = createCapturingLogger();
   const context: HookContext = {
-    config: {
+    config: configStore({
       planted_secret: plantedSecret,
       sibling_file: siblingFile,
       staged_input: stagedInput,
-    },
-    secrets: {},
+    }),
+    secrets: secretStore(),
     systems: [],
     logger,
     debug: false,

package/src/hooks/hook-protocol.ts

@@ -25,7 +25,7 @@
 
 import { z } from 'zod';
 
-export const HOOK_PROTOCOL_VERSION = 1;
+export const HOOK_PROTOCOL_VERSION = 2;
 
 /** Environment variable carrying the broker's socket path to the child. */
 export const HOOK_SOCKET_ENV = 'CELILO_HOOK_SOCKET';
@@ -91,6 +91,39 @@ export const CallFrameSchema = z.object({
   args: z.array(z.unknown()),
 });
 
+/**
+ * One hook-owned-state store operation, correlated like a `call` (and answered
+ * by the same `return`/`throw` frames — the runner's pending map keys on `id`
+ * alone).
+ *
+ * `store` names which of the module's two stores the call targets; `method` is
+ * one of the four `HookStore` operations. A `transaction` call carries the
+ * buffered operation list the CHILD accumulated — the hook's `fn` ran entirely
+ * child-side, so a throwing `fn` never sends anything, which is what makes the
+ * discard real rather than a promise the parent has to honor.
+ *
+ * Hook-owned-state design: the accessor is implemented once broker-side and
+ * reaches the hook as its own RPC family over this envelope, NOT as a fake
+ * capability — a fake one would surface in the `capabilities` shape frame and
+ * appear to the hook as a provider module.
+ */
+export const StoreCallFrameSchema = z.object({
+  type: z.literal('store'),
+  id: z.string(),
+  store: z.enum(['secrets', 'config']),
+  method: z.enum(['get', 'set', 'delete', 'transaction']),
+  args: z.array(z.unknown()),
+});
+
+/** One buffered operation inside a `transaction` store call. */
+export const BufferedStoreOpSchema = z.object({
+  op: z.enum(['set', 'delete']),
+  name: z.string(),
+  value: z.string().optional(),
+});
+
+export type BufferedStoreOp = z.infer<typeof BufferedStoreOpSchema>;
+
 /** One `ctx.logger` call. Fire and forget — the hook does not wait on it. */
 export const LogFrameSchema = z.object({
   type: z.literal('log'),
@@ -113,6 +146,7 @@ export const HookThrewFrameSchema = z.object({
 export const ChildFrameSchema = z.discriminatedUnion('type', [
   ReadyFrameSchema,
   CallFrameSchema,
+  StoreCallFrameSchema,
   LogFrameSchema,
   ResultFrameSchema,
   HookThrewFrameSchema,
@@ -145,6 +179,11 @@ export const MountEntrySchema = z.object({
   path: z.string(),
   mode: z.enum(['ro', 'rw', 'tmpfs']),
   reason: z.string(),
+  // Kept on the wire so this stays the structural twin its docblock below
+  // claims. The child ignores it — absence is decided when the set is derived,
+  // not by the hook — but a twin that has quietly stopped being one is how the
+  // round-trip test starts asserting about a shape nothing sends.
+  absence: z.enum(['required', 'declared-only', 'runtime', 'conditional']),
 });
 
 /** The derived mount set, on the wire. Structural twin of `MountSet`. */
@@ -272,6 +311,12 @@ export function createLineReader(onLine: (line: string) => void): (chunk: string
 /**
  * The handshake check, in one place so both ends produce the same sentence.
  *
+ * Version 2 added the `store` frame family (hook-owned-state task 3.5). Both
+ * ends of this protocol ship in the same celilo binary, so the check exists
+ * for one situation: a runner answering a broker built from different source
+ * than itself. It aborts the hook loudly instead of letting a store write
+ * disappear into a frame the other side cannot parse.
+ *
  * Names both numbers: a mismatch is an install skew (a `.deb` upgraded while a
  * module's bundled copy was not), and the operator needs to know which side is
  * which to fix it.

package/src/hooks/hook-runner.ts

@@ -26,6 +26,7 @@ import {
   serializeError,
   versionMismatch,
 } from './hook-protocol';
+import { buildStoreView } from './hook-store-proxy';
 import type { HookContext, HookLogger } from './types';
 import { forwardLintWarnings } from './unjailed-lint';
 
@@ -110,6 +111,22 @@ function callBroker(capability: string, method: string, args: unknown[]): Promis
   });
 }
 
+/**
+ * Store calls share the capability call's correlation machinery: the broker
+ * answers both families with the same `return`/`throw` frames, keyed by `id`.
+ */
+function callStore(
+  store: 'secrets' | 'config',
+  method: 'get' | 'set' | 'delete' | 'transaction',
+  args: unknown[],
+): Promise<unknown> {
+  const id = `c${nextCallId++}`;
+  return new Promise((resolve, reject) => {
+    pending.set(id, { resolve, reject });
+    send({ type: 'store', id, store, method, args });
+  });
+}
+
 /**
  * The `defineHook` brand check, moved here from the executor unchanged
  * (HOOK_API_V2 Phase 8 / D8). The brand is a `Symbol.for` key, so it survives
@@ -133,8 +150,27 @@ async function runHook(): Promise<void> {
     // hook's logger from here on (anything earlier was buffered).
     forwardLintWarnings(logger.warn);
 
+    // Attach the hook-owned-state accessor onto both maps. The maps crossed
+    // the context frame as plain data; the accessor methods exist only on
+    // this side, where the socket is. Old map reads keep working; new code
+    // calls `secrets.set(...)` / `config.get(...)` (hook-owned-state task 3.5).
+    // The casts say something true: celilo built both fields and controls
+    // their shape, the same rationale as the field check above.
+    const stores = buildStoreView(
+      'secrets',
+      (contextData.secrets ?? {}) as Record<string, string>,
+      callStore,
+    );
+    const configStores = buildStoreView(
+      'config',
+      (contextData.config ?? {}) as Record<string, unknown>,
+      callStore,
+    );
+
     const context = {
       ...contextData,
+      config: configStores,
+      secrets: stores,
       logger,
       capabilities: buildCapabilities(shape),
     } as unknown as HookContext;