@dzhechkov/harness-core 0.8.34 → 0.8.36

package/src/codex-hooks-assets.ts

@@ -141,6 +141,66 @@ function findProjectRoot(startDir) {
   }
 }
 
+/**
+ * FR-1 (codex-hook-root-provenance): the ONE place both hooks compute their start directory and
+ * walk to a project root — replacing two independent copies of the same ternary. T1 (fix-round 1:
+ * the original reproducer had an unexported \`BASE\`, so it measured the wrong file; corrected and
+ * re-run — see the feature's change manifest for both) measured LIVE on \`codex-cli 0.154.0\`: three
+ * real \`codex exec\` sessions (project root, a nested subdirectory, a directory with no \`.dz\`
+ * anywhere in its ancestry), each with BOTH hook events (\`PreToolUse\` and \`UserPromptSubmit\`)
+ * captured SEPARATELY. \`payload.cwd\` was present and equal to both \`PWD\` and the hook's own
+ * \`process.cwd()\` in every one of the 6 captures. \`PWD\`/\`process.cwd()\` therefore stay only as a
+ * DEFENSIVE fallback for a payload shaped without \`cwd\` — not because that fallback was ever
+ * observed to fire. This is a SCOPED finding, not a claim that the "hook read the wrong project"
+ * defect class cannot exist: it was not observed on codex-cli 0.154.0 across these 3 scenarios / 6
+ * captures, and 01_requirements.md's own Ограничение C-3 is what permits cutting FR-3 (the explicit
+ * \`DZ_PROJECT_ROOT\` override) on a scoped finding like that — not a claim of nonexistence.
+ */
+function resolveHookRoot(payload) {
+  const hasPayloadCwd = typeof payload.cwd === 'string' && payload.cwd !== '';
+  const startDir = hasPayloadCwd ? payload.cwd : (process.env.PWD || process.cwd());
+  const source = hasPayloadCwd ? 'payload-cwd' : (process.env.PWD ? 'env-pwd' : 'process-cwd');
+  return { root: findProjectRoot(startDir), source, startDir };
+}
+
+/**
+ * Fix-round 1, item 4: a path interpolated into the provenance line below can itself carry control
+ * characters — a \`payload.cwd\` from an untrusted producer, or a \`PWD\` set to something hostile —
+ * and a bare newline in the middle of it would defeat the "ONE line" promise the diagnostic makes.
+ * Escape the whole C0 range (0x00-0x1F) plus DEL (0x7F) into a visible \`\\n\`/\\r\`/\\t\`/\\xHH\`
+ * representation; every other byte, including non-ASCII path segments, passes through unchanged.
+ */
+function escapeControlChars(value) {
+  return String(value).replace(/[\\x00-\\x1f\\x7f]/g, function (ch) {
+    var code = ch.charCodeAt(0);
+    if (code === 10) return '\\\\n';
+    if (code === 13) return '\\\\r';
+    if (code === 9) return '\\\\t';
+    return '\\\\x' + code.toString(16).padStart(2, '0');
+  });
+}
+
+/**
+ * FR-2: ONE provenance line, same shape as the Claude hook's (\`apply-leg.ts\`'s \`skip()\`), printed
+ * to stderr. When no root was found it ALWAYS prints (the walk's whole verdict was silent before
+ * this feature); when a root WAS found it prints only under \`DZ_CODEX_HOOK_DEBUG\`, so the found
+ * path stays byte-for-byte silent by default (NFR-2). Tradeoff, named plainly: this line discloses
+ * the absolute directory the hook was asked about (which can embed a username, a customer or
+ * repository name) to stderr — accepted because it is a diagnostic aimed at the person running the
+ * hook, not a return value, and redacting it would make the not-found case as silent as the bug
+ * this feature exists to fix. \`startDir\`/\`root\` are escaped via \`escapeControlChars\` first, so an
+ * adversarial value cannot itself defeat the "ONE line" guarantee.
+ */
+function reportRootProvenance(resolved) {
+  if (resolved.root === null) {
+    process.stderr.write(\`[\${HELPER}] skipped reason=no-project-root start=\${escapeControlChars(resolved.startDir)} (\${resolved.source})\\n\`);
+    return;
+  }
+  if (process.env.DZ_CODEX_HOOK_DEBUG) {
+    process.stderr.write(\`[\${HELPER}] root=\${escapeControlChars(resolved.root)} start=\${escapeControlChars(resolved.startDir)} (\${resolved.source})\\n\`);
+  }
+}
+
 function readProjectConfig(root) {
   try {
     return JSON.parse(fs.readFileSync(path.join(root, '.dz', 'config.json'), 'utf8'));
@@ -229,9 +289,10 @@ async function main() {
   const command = input && typeof input === 'object' ? input.command : undefined;
   if (typeof command !== 'string' || command === '') return 0;
 
-  const cwd = typeof payload.cwd === 'string' && payload.cwd !== '' ? payload.cwd : process.env.PWD || process.cwd();
-  const root = findProjectRoot(cwd);
-  if (root === null) return 0; // inert outside an opted-in dz project: no decision, no output, no write
+  const resolved = resolveHookRoot(payload);
+  reportRootProvenance(resolved);
+  const root = resolved.root;
+  if (root === null) return 0; // inert outside an opted-in dz project: no DECISION and no WRITE — one diagnostic line on stderr (FR-2), nothing else
 
   // (1) The destructive-command guard. Never blocks on our own failure: an absent module, a throw,
   // or an \`undecidable\` verdict all fall through to the shell veto below (AC-10).
@@ -370,8 +431,9 @@ async function main() {
   const prompt = typeof payload.prompt === 'string' ? payload.prompt : '';
   if (prompt.trim() === '') return;
 
-  const cwd = typeof payload.cwd === 'string' && payload.cwd !== '' ? payload.cwd : process.env.PWD || process.cwd();
-  const root = findProjectRoot(cwd);
+  const resolved = resolveHookRoot(payload);
+  reportRootProvenance(resolved);
+  const root = resolved.root;
   if (root === null) return; // inert outside an opted-in dz project
 
   const policy = await loadCore(root, 'recall-hook-policy.js', (m) => typeof m.selectHookHits === 'function');

package/src/codex-hooks.ts

@@ -56,8 +56,20 @@ import { mergeManagedHookEntries } from './managed-hooks.js';
  * run was indistinguishable from a clean allow. The Claude hook already failed open loudly here.
  * Now it prints ONE line, `DZ-DESTRUCTIVE-WARN: classifier threw — <message>`, and still exits 0.
  * A changed body ⇒ re-trust.
+ * 8 — `codex-hook-root-provenance`: both hooks now share ONE `resolveHookRoot(payload)` instead of
+ * two copies of the same `payload.cwd || PWD || cwd()` ternary, and a silent `root === null` early
+ * return now prints one provenance line (`[dz-codex-<hook>] skipped reason=no-project-root
+ * start=<startDir> (<source>)`); the found-root path stays silent unless `DZ_CODEX_HOOK_DEBUG` is
+ * set. T1 (live probe, codex-cli 0.154.0) found `payload.cwd` always present and equal to `PWD`/
+ * `process.cwd()`, so no explicit-override knob was added. A changed body ⇒ re-trust.
+ * 9 — fix-round 1: the provenance line's interpolated paths are now escaped via
+ * `escapeControlChars` (C0 range + DEL) before printing, so a hostile `payload.cwd` cannot defeat
+ * the "ONE line" promise with an embedded newline; the corrected T1 re-run (both hook events
+ * captured separately, per-scenario — the original reproducer's `BASE` was never exported) reached
+ * the SAME conclusion, scoped honestly as "not observed on codex-cli 0.154.0 across 3 scenarios / 6
+ * captures", not "does not exist". A changed body ⇒ re-trust.
  */
-export const DZ_HOOK_HELPER_VERSION = 7;
+export const DZ_HOOK_HELPER_VERSION = 9;
 
 /** Seconds. Probe-proven (spike S2): `timeout` is honored, the unset default is 600 s. */
 export const DZ_HOOK_TIMEOUT_SECONDS = 5;

package/src/index.ts

@@ -12,6 +12,12 @@ export const HARNESS_CORE_VERSION: string =
 
 export { REPOSITORY_ORIGIN } from './repository-origin.js';
 
+// Fix-round 1 (feature recall-short-terms, Codex HIGH-1c): `dz recall`'s CLI printer needs the
+// single source of truth for "why did this query tokenize to nothing" without harness-cli taking
+// a new direct dependency on `@dzhechkov/memory` (a publishing-surface change outside this
+// feature's scope) — harness-core already depends on memory, so it re-exports the one helper.
+export { noSearchableTermsReason } from '@dzhechkov/memory';
+
 export * from './skills.js';
 export * from './apply.js';
 export {
@@ -197,6 +203,9 @@ export {
   mirrorPatternsToVector,
   backfillVectorMirror,
   mergeHybridHits,
+  compareHybridHits,
+  evidenceRank,
+  orderHitsForReRank,
   recallHybrid,
   teachGuard,
   vectorTierStatus,
@@ -218,6 +227,7 @@ export type {
   HybridRecall,
   HybridRecallMode,
   HybridHit,
+  HybridOrderKey,
   RankedPattern,
   VectorServiceOptions,
   VectorTierStatus,
@@ -246,6 +256,7 @@ export {
   applyLegHookEntries,
   applyLegStatus,
   applyLegReasonMessage,
+  probeApplyLeg,
   resolveIdleMs,
   IDLE_MS_INT32_MAX,
 } from './apply-leg.js';
@@ -255,6 +266,7 @@ export type {
   ApplyLegHookPresence,
   ApplyLegStatus,
   ApplyLegNotInstalledReason,
+  ApplyLegProbeResult,
   ResolvedIdleMs,
 } from './apply-leg.js';
 // embed-socket-short-path: the ONE resolver the daemon (inlined text), the recall hook (inlined
@@ -303,7 +315,7 @@ export {
   segmentRun,
 } from './eta.js';
 export type { CheckpointObservation, EtaEstimate, EtaInput, IncompleteCoverageSample, RunSegment, StageDurationSample, StageSample } from './eta.js';
-export { indexPatternsToAgentdb, resolveAgentdbPath, searchAgentdbPatterns, listAgentdbDzIds, resolveAgentdbEmbedder, resetAgentdbEmbedderCache, getAgentdbEmbedderCacheStats, cosineSimilarity, importVectorsToAgentdb, reindexAgentdbRows, bumpAgentdbUses, clearAgentdbQuarantine, deleteAgentdbByDzIds, readAgentdbRowsByTaskType, DZ_OWNED_TASK_TYPES, ensureAgentdbSchema } from './agentdb-index.js';
+export { indexPatternsToAgentdb, resolveAgentdbPath, searchAgentdbPatterns, listAgentdbDzIds, resolveAgentdbEmbedder, resetAgentdbEmbedderCache, getAgentdbEmbedderCacheStats, cosineSimilarity, importVectorsToAgentdb, reindexAgentdbRows, bumpAgentdbUses, clearAgentdbQuarantine, deleteAgentdbByDzIds, readAgentdbRowsByTaskType, DZ_OWNED_TASK_TYPES, ensureAgentdbSchema, readStoreGeneration, bumpStoreGeneration } from './agentdb-index.js';
 export type { AgentdbSearchHit, AgentdbSearchResult, AgentdbImportRow } from './agentdb-index.js';
 export { DEFAULT_EMBED_MODEL, LEGACY_EMBED_MODEL, DEFAULT_EMBED_DIM, KNOWN_EMBED_DIMS, resolveEmbedModel, readEmbedManifest, writeEmbedManifest, embedManifestPath, legacyEmbedManifest } from './embedding-config.js';
 export type { EmbedModelConfig, EmbedModelSource, EmbedManifest } from './embedding-config.js';
@@ -722,7 +734,8 @@ export type {
   ChainDefectAges,
   ChainedJournal,
 } from './event-chain.js';
-export { decideProvenance, environmentCanMintProvenance, publishArgv, discoverPackages, publishPackages, bumpPatch, compareVersions, findUnpackagedSkills, findUnpublishedWorkspaceFloors, rewriteWorkspaceSpecs, orderByDependencies, syncReadmeVersion, isChangelogEntryLine, changelogRegion } from './publish.js';
+export { decideProvenance, environmentCanMintProvenance, publishArgv, discoverPackages, publishPackages, bumpPatch, compareVersions, findUnpackagedSkills, findUnpublishedWorkspaceFloors, rewriteWorkspaceSpecs, orderByDependencies, syncReadmeVersion, isChangelogEntryLine, changelogRegion, planReadmeVersionSync } from './publish.js';
+export type { ReadmeVersionSyncPlan, ReadmeSyncRewrite } from './publish.js';
 export { RELEASE_LINE_RE, findReleaseLine, rewriteReleaseLine } from './release-line.js';
 export * from './course-staleness.js';
 export { fetchAllDownloads } from './downloads.js';

package/src/mutation-gate.ts

@@ -77,6 +77,22 @@ export interface MutationRegistry {
   readonly testCommand?: string;
   /** opt-in proof that the suite harness reached its clean completion path. */
   readonly requireCompletionReceipt?: boolean;
+  /**
+   * optional per-registry suite-run ceiling in milliseconds (mutation-gate-timeout-verdict FR-3):
+   * a package whose real baseline runs longer than the executor's 300000ms default (e.g. this
+   * repo's core package, MEASURED ≈5-8 min) declares its own floor here so `dz mutation-gate` with
+   * no `--timeout` flag still succeeds — precedence is flag > this field > the 300000ms default.
+   */
+  readonly timeoutMs?: number;
+  /**
+   * optional per-registry vitest worker ceiling (mutation-gate-baseline-honesty FR-2): baseline and
+   * mutant runs spawn the package's FULL `testCommand` at vitest's default worker count (= cpu
+   * cores), and under embedding-daemon tests (0.7-3.5 GB/process) this repo's core package measured
+   * load 62-358 and 0.4-1.8 GB free on an 8-core/16GB box — three full runs died overnight
+   * (0bb74d66). The same suite with `--maxWorkers=2` passed (6909/6909). Precedence is the
+   * `--max-workers` flag > this field > `min(4, max(1, floor(cpus/2)))`.
+   */
+  readonly maxWorkers?: number;
   readonly entries: readonly MutationRegistryEntry[];
 }
 
@@ -306,10 +322,12 @@ export function parseMutationRegistry(text: string): ParsedRegistry {
   let entriesRaw: unknown;
   let testCommand: string | undefined;
   let requireCompletionReceipt: boolean | undefined;
+  let timeoutMs: number | undefined;
+  let maxWorkers: number | undefined;
   if (Array.isArray(raw)) {
     entriesRaw = raw;
   } else if (raw && typeof raw === 'object') {
-    const obj = raw as { testCommand?: unknown; requireCompletionReceipt?: unknown; entries?: unknown };
+    const obj = raw as { testCommand?: unknown; requireCompletionReceipt?: unknown; timeoutMs?: unknown; maxWorkers?: unknown; entries?: unknown };
     entriesRaw = obj.entries;
     if (obj.testCommand !== undefined) {
       if (typeof obj.testCommand !== 'string' || obj.testCommand.trim() === '') {
@@ -323,6 +341,18 @@ export function parseMutationRegistry(text: string): ParsedRegistry {
       }
       requireCompletionReceipt = obj.requireCompletionReceipt;
     }
+    if (obj.timeoutMs !== undefined) {
+      if (typeof obj.timeoutMs !== 'number' || !Number.isFinite(obj.timeoutMs) || obj.timeoutMs <= 0) {
+        return { registry: null, entryResults: [], errors: ['timeoutMs must be a finite number > 0 when present'] };
+      }
+      timeoutMs = obj.timeoutMs;
+    }
+    if (obj.maxWorkers !== undefined) {
+      if (typeof obj.maxWorkers !== 'number' || !Number.isInteger(obj.maxWorkers) || obj.maxWorkers < 1) {
+        return { registry: null, entryResults: [], errors: ['maxWorkers must be a positive integer when present'] };
+      }
+      maxWorkers = obj.maxWorkers;
+    }
   }
   if (!Array.isArray(entriesRaw)) {
     return { registry: null, entryResults: [], errors: ['registry must be an array of entries or {testCommand?, requireCompletionReceipt?, entries: [...]}'] };
@@ -439,6 +469,8 @@ export function parseMutationRegistry(text: string): ParsedRegistry {
     registry: {
       ...(testCommand !== undefined ? { testCommand } : {}),
       ...(requireCompletionReceipt !== undefined ? { requireCompletionReceipt } : {}),
+      ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+      ...(maxWorkers !== undefined ? { maxWorkers } : {}),
       entries,
     },
     entryResults,
@@ -446,6 +478,26 @@ export function parseMutationRegistry(text: string): ParsedRegistry {
   };
 }
 
+// ── Feature scoping (qe-step-gate-scoped-to-feature) — pure registry diff, no IO ───────────────
+//
+// Step 8's QE mutation gate ran the FULL registry unconditionally (MEASURED 2026-09-12: 358
+// entries on this repo's core package, 30-40 minutes, timed out INCONCLUSIVE every time), though a
+// feature only owns its own touched files and any entries it newly declares. The `--touched` and
+// `--added-since` CLI selectors (harness-cli's executor) scope the run; the executor reads the base
+// registry via `git show <ref>:<path>` (I/O) and hands both parsed registries to this PURE diff so
+// the comparison itself stays testable without a filesystem or git process (NFR-1).
+
+/** Entry ids present in `current` but absent from `base` (by id, not by content). A `null` base
+ *  means the registry did not exist at the reference point — every current entry counts as added. */
+export function registryEntriesAddedSince(
+  base: MutationRegistry | null,
+  current: MutationRegistry,
+): string[] {
+  if (base === null) return current.entries.map((entry) => entry.id);
+  const baseIds = new Set(base.entries.map((entry) => entry.id));
+  return current.entries.filter((entry) => !baseIds.has(entry.id)).map((entry) => entry.id);
+}
+
 // ── Mutation application — exact text surgery, exactly once (rule 1) ──────────────────────────
 
 export interface AppliedMutation {
@@ -732,7 +784,11 @@ export function attributeBaselineRedness(
     if (file !== null && !files.includes(file)) files.push(file);
   };
 
-  const vitestMatches = [...output.matchAll(/^\s*FAIL\s+(\S+)/gm)];
+  // mutation-gate-baseline-honesty FR-1: vitest 3 prints an optional POOL LABEL between `FAIL` and
+  // the file path (`FAIL  |serial| test/x.test.ts > case`, `FAIL  |parallel| …`) — the plain
+  // `(\S+)` used to capture the label itself as "the file", which normaliseReportedFile then
+  // rejects, turning a perfectly parseable red run into `unparseable from runner output`.
+  const vitestMatches = [...output.matchAll(/^\s*FAIL\s+(?:\|[^|\n]*\|\s+)?(\S+)/gm)];
   for (const match of vitestMatches) add(match[1] ?? '');
 
   const tapMatches = [...output.matchAll(/^not ok \d+\s+-\s+(.+)$/gm)];

package/src/operations.ts

@@ -6,7 +6,7 @@
  * @packageDocumentation
  */
 
-import { execFileSync, spawnSync } from 'node:child_process';
+import { execFileSync, spawnSync, type SpawnSyncOptionsWithStringEncoding } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
@@ -1542,6 +1542,33 @@ export async function runDoctor(options: { projectRoot: string }): Promise<Docto
               ? `embed socket present at ${resolved.path}${tmpdirNote}${engineNote} — recall injection can run`
               : `embed socket ABSENT at ${resolved.path}: the recall hook is wired but cannot inject (the hook self-heals on the next prompt; a persistent absence means the daemon cannot start)`,
           });
+
+          // APPLY-LEG INJECTS — live probe (feature `apply-leg-never-silent`, ADR-001 Decision 1).
+          // Issue #2's whole defect was that `installed`/`alive` above can ALL read green while the
+          // leg injects nothing in every session but one (a foreign install-root symptom the file-
+          // presence and socket-presence checks above cannot see by construction — they check for
+          // the RIGHT FILES at the RIGHT PATH, never whether the deployed COMMAND actually resolves
+          // to this project's store from a foreign cwd). This row is the difference: it runs the
+          // ACTUAL configured hook command end-to-end and is green ONLY on an observed injection.
+          // Deliberately a SEPARATE try/catch from the socket-alive check above: a probe failure
+          // must never suppress the (already useful) socket-presence row, and vice versa.
+          try {
+            const { probeApplyLeg } = await import('./apply-leg.js');
+            const probe = await probeApplyLeg(root);
+            checks.push({
+              name: 'apply-leg injects (live probe)',
+              ok: probe.ok,
+              detail: probe.ok
+                ? `live probe injected its beacon lesson in ${probe.elapsedMs}ms — the recall hook actually finds this project's store`
+                : `installed but silent: ${probe.reason ?? 'unknown'} (probed in ${probe.elapsedMs}ms) — dz setup wrote the hook, but it is not injecting anything into real sessions`,
+            });
+          } catch (err) {
+            checks.push({
+              name: 'apply-leg injects (live probe)',
+              ok: false,
+              detail: `live probe could not run: ${err instanceof Error ? err.message : String(err)}`,
+            });
+          }
         }
       }
     } catch {
@@ -1852,18 +1879,72 @@ function probeCodexVersion(): string | null {
  * with the helper's own self-failure note unable to fire because the process never started.
  * Grading on file presence would call that "installed".
  */
-export function probeHookLiveness(command: string, payload: string): { readonly status: number | null; readonly stderr: string } {
+/**
+ * `opts` (feature `apply-leg-never-silent`, ADR-001 D1): additive, optional — every pre-existing
+ * 2-arg caller (the Codex veto-hook liveness checks above) is unaffected. `cwd`/`env` let a caller
+ * reproduce the EXACT conditions a real invoking session presents (a foreign cwd, an overridden
+ * `CLAUDE_PROJECT_DIR`) rather than always running from THIS process's own cwd/env — the apply-leg
+ * live probe needs exactly that to prove install-root resolution end-to-end, not merely structurally.
+ * `stdout` is returned alongside `stderr`/`status` for the same reason: a UserPromptSubmit hook's
+ * payload (`hookSpecificOutput.additionalContext`) rides stdout, not stderr (see `probeApplyLeg`'s
+ * own doc comment for the measured stderr-visibility fact this displaces).
+ */
+export function probeHookLiveness(
+  command: string,
+  payload: string,
+  opts: { readonly cwd?: string; readonly env?: Readonly<Record<string, string>>; readonly timeoutMs?: number } = {},
+): { readonly status: number | null; readonly stdout: string; readonly stderr: string; readonly groupKillAttempted: boolean } {
   const shell = process.env['SHELL'] ?? '/bin/sh';
+  // Fix round 1 (apply-leg-never-silent, HIGH-1): a caller previously had to INFER "was the group
+  // kill sent" by reading this function's source — a regression removing or bypassing the
+  // `process.kill(-pid, ...)` call below would silently invalidate that inference. `groupKillAttempted`
+  // is the OBSERVABLE fact instead: true exactly when this call reached the point of attempting the
+  // kill syscall (`res.pid` was a real positive pid), false when it never got that far (e.g. the
+  // spawn itself never produced a pid). It does NOT claim the signal found a live recipient — ESRCH
+  // ("group already gone", the common successful-exit case) still counts as "sent": the syscall was
+  // issued, its target simply no longer existed. That is a SEPARATE fact from whether the grandchild
+  // is actually dead by the time a caller checks — see `probeApplyLeg`'s AM-5 test for the
+  // kill-sent-vs-death-observed split this field exists to make possible.
+  let groupKillAttempted = false;
   try {
-    const res = spawnSync(shell, ['-lc', command], {
+    // AM-5 (fix round 1, apply-leg-never-silent): `detached: true` puts the shell in its OWN
+    // process GROUP (pgid === its own pid) instead of sharing the caller's — `spawnSync`'s own
+    // timeout kill signals only the DIRECT child (the shell), never anything the shell forked, so a
+    // `node "<hook>" || true` grandchild that is still running when the shell dies is orphaned but
+    // free to keep touching whatever this probe is about to remove (the beacon, the temp cwd).
+    // Killing the NEGATIVE pid below reaches the whole group in one signal. `@types/node`'s
+    // `SpawnSyncOptions` does not DECLARE `detached` (only the async `SpawnOptions` does) — MEASURED
+    // this is a typings gap, not a runtime one: a real child under `spawnSync(..., {detached:true})`
+    // reports its own pgid === its own pid (verified with `ps -o pgid=`), exactly as it would under
+    // async `spawn`. Widened via an inline type intersection rather than `as any` so every OTHER key
+    // stays checked.
+    const spawnOpts: SpawnSyncOptionsWithStringEncoding & { readonly detached?: boolean } = {
       input: payload,
       encoding: 'utf8',
-      timeout: 20_000,
-      env: { ...process.env, DZ_HOOK_LIVENESS_PROBE: '1' },
-    });
-    return { status: res.status, stderr: res.stderr ?? '' };
+      timeout: opts.timeoutMs ?? 20_000,
+      detached: true,
+      ...(opts.cwd !== undefined ? { cwd: opts.cwd } : {}),
+      env: { ...process.env, DZ_HOOK_LIVENESS_PROBE: '1', ...(opts.env ?? {}) },
+    };
+    const res = spawnSync(shell, ['-lc', command], spawnOpts);
+    // Belt, run on EVERY outcome (timeout OR a clean, on-time exit): a `node` grandchild can still
+    // be alive in the group even after the shell itself exited normally (e.g. it double-forked or
+    // outlived a `|| true` that already returned). ESRCH — the common, successful case, everything
+    // already exited — is swallowed; this is best-effort cleanup, never a probe failure.
+    if (typeof res.pid === 'number' && res.pid > 0) {
+      try {
+        process.kill(-res.pid, 'SIGKILL');
+      } catch {
+        /* group already gone */
+      } finally {
+        // set right after the process.kill(-pid, 'SIGKILL') attempt (HIGH-1 lead decision): reached
+        // regardless of ESRCH, because ESRCH means "no recipient", not "syscall not issued".
+        groupKillAttempted = true;
+      }
+    }
+    return { status: res.status, stdout: res.stdout ?? '', stderr: res.stderr ?? '', groupKillAttempted };
   } catch (err) {
-    return { status: null, stderr: String((err as Error)?.message ?? err) };
+    return { status: null, stdout: '', stderr: String((err as Error)?.message ?? err), groupKillAttempted };
   }
 }
 
@@ -2043,7 +2124,7 @@ export function runSyncCodexHooks(options: CodexHooksSyncOptions = {}): CodexHoo
   //     a home that never opted in (the leg-1 F12 lesson).
   if (options.check === true) {
     const drift = diffCodexHooks(currentText, entries, manifest);
-    const live = drift.installed && options.liveness !== false ? probeHookLiveness(entries[0]!.command, ALLOWED_PROBE_PAYLOAD) : { status: null, stderr: '' };
+    const live = drift.installed && options.liveness !== false ? probeHookLiveness(entries[0]!.command, ALLOWED_PROBE_PAYLOAD) : { status: null, stdout: '', stderr: '' };
     const executable = drift.installed && (options.liveness === false || live.status === 0 || live.status === 2);
     // `--check` must report the TRUST axis too. Without it the report said `installed && executable`
     // with `trust: 'unknown'`, and the CLI printed a success word for it — the exact G-G/AM-17
@@ -2142,7 +2223,7 @@ export function runSyncCodexHooks(options: CodexHooksSyncOptions = {}): CodexHoo
 
 
   // (6) LIVENESS: exit 127 is ALLOW to the runtime, so it must never be graded as installed (G-L).
-  const live = options.liveness === false ? { status: 0, stderr: '' } : probeHookLiveness(entries[0]!.command, ALLOWED_PROBE_PAYLOAD);
+  const live = options.liveness === false ? { status: 0, stdout: '', stderr: '' } : probeHookLiveness(entries[0]!.command, ALLOWED_PROBE_PAYLOAD);
   const executable = live.status === 0 || live.status === 2;
   if (!executable) {
     warnings.push(