@mutmutco/kilo-plugin 3.85.0 → 3.87.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/kilo-plugin",
-  "version": "3.85.0",
+  "version": "3.87.0",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/scripts/hook-run.mjs

@@ -135,7 +135,7 @@ function normalizeInput(surface, gate, input) {
  *  and the deny was gone. So the line is elected by PARSING it, `hookSpecificOutput` carriers first, and
  *  the result reports `malformed` when stdout exists but cannot be reduced to exactly one — which
  *  runPolicyGate treats as a gate fault, i.e. the fail-closed fallback for vault-edit/command-ladder. */
-function decisionEnvelope(stdout) {
+export function decisionEnvelope(stdout) {
   if (!stdout.trim()) return { envelope: '', stray: '', malformed: false };
   const lines = stdout.split(/\r?\n/);
   const objects = [];

package/scripts/secret-redact.mjs

@@ -493,21 +493,28 @@ export async function runHookGate({ input: buffered } = {}) {
     }
     const healed = Boolean(decision?.redactable) && canRewriteOutput;
     const outcome = !decision ? 'ran' : healed ? 'heal' : 'observe';
+    // #4015/#4021: every operator- and log-facing string names the tool the HOST fired, never
+    // `decision.toolName` — that one is the name hook-run.mjs rewrote into the Claude vocabulary so it can
+    // be tested against UPDATABLE_TOOLS, and it collapsed Codex `shell` and `local_shell` into "PowerShell".
+    // #4012 fixed this call's `tool` FIELD and #4015 the stderr arms; the `action` TEXT below was converted
+    // by neither, so one row read `{"tool":"shell","action":"secret detected in PowerShell output …"}` and
+    // disagreed with itself — in the log doctor, the Stop summary and scrooge.md's detection counts read.
+    const alarmTool = tracedTool(input) || decision?.toolName || 'tool';
     const action = !decision
       ? 'clean'
       : healed
         ? 'redacted secrets from tool output'
         : decision.redactable
-          ? `secret detected in ${decision.toolName || 'tool'} output and NOT masked — this host cannot rewrite tool output (no updatedToolOutput channel on this surface)`
-          : `secret detected in ${decision.toolName || 'tool'} output but PostToolUse cannot redact this tool (harness limitation)`;
+          ? `secret detected in ${alarmTool} output and NOT masked — this host cannot rewrite tool output (no updatedToolOutput channel on this surface)`
+          : `secret detected in ${alarmTool} output but PostToolUse cannot redact this tool (harness limitation)`;
     // Detection without masking must be audible, not just logged: on Codex the value is still on screen.
     if (decision?.redactable && !canRewriteOutput) {
-      process.stderr.write(`[mmi-hook] secret-redact: a secret-shaped value was detected in ${decision.toolName || 'tool'} output and could NOT be masked on this host — treat the transcript as exposed.\n`);
+      process.stderr.write(`[mmi-hook] secret-redact: a secret-shaped value was detected in ${alarmTool} output and could NOT be masked on this host — treat the transcript as exposed.\n`);
     }
     // #3630: same audibility for the non-redactable-TOOL arm. A detection in Read/WebFetch/Agent/mcp__*
     // output landed only in the trace file — silent on the one surface where the value is still visible.
     if (decision && !decision.redactable) {
-      process.stderr.write(`[mmi-hook] secret-redact: a secret-shaped value was detected in ${decision.toolName || 'tool'} output and cannot be masked for this tool (no updatedToolOutput channel) — treat the transcript as exposed.\n`);
+      process.stderr.write(`[mmi-hook] secret-redact: a secret-shaped value was detected in ${alarmTool} output and cannot be masked for this tool (no updatedToolOutput channel) — treat the transcript as exposed.\n`);
     }
     appendHookActivity({ event: 'PostToolUse', script: 'secret-redact', outcome, action, tool: tracedTool(input) });
   } catch (err) {

package/server.mjs

@@ -24,6 +24,8 @@ import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { decisionEnvelope } from './scripts/hook-run.mjs';
+import { hookGate } from './scripts/hook-policy.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const PACKAGE_JSON = JSON.parse(readFileSync(join(HERE, 'package.json'), 'utf8'));
@@ -124,10 +126,22 @@ export function runGate(gate, payload) {
     return { denied: false, reason: '', stdout: '', error: String(err && err.message) };
   }
   const stdout = typeof result.stdout === 'string' ? result.stdout : '';
-  const denyLine = stdout.split(/\r?\n/).find((line) => line.trim().startsWith('{'));
-  if (denyLine) {
+  // #4018: elect the envelope with the RUNNER's own helper, never "the first line beginning with `{`".
+  // That weaker rule is exactly what #4016 measured failing OPEN on vault-edit: a stray line that is
+  // itself JSON wins over the real deny, and a stray write with no trailing newline merges with the
+  // envelope so nothing matches at all. It was safe here only because hook-run.mjs happens to emit one
+  // envelope or nothing — an invariant held by a different file and unasserted at this boundary.
+  const { envelope, malformed } = decisionEnvelope(stdout);
+  if (malformed) {
+    // The runner treats an unreducible stdout as a gate fault, i.e. fail-closed on the gates declared
+    // that way. Kilo is the surface where `permissionDecision` is honoured, so it must not be the one
+    // host that answers "allow" to a stream it could not read.
+    if (hookGate(gate).failure === 'closed') {
+      return { denied: true, reason: `${gate} produced no readable decision — failing closed`, stdout };
+    }
+  } else if (envelope) {
     try {
-      const decision = JSON.parse(denyLine).hookSpecificOutput;
+      const decision = JSON.parse(envelope).hookSpecificOutput;
       if (decision?.permissionDecision === 'deny') {
         return { denied: true, reason: decision.permissionDecisionReason || `${gate} denied the tool call`, stdout };
       }
@@ -166,10 +180,12 @@ function editToolInput(args) {
 /** The redactor's stdout is `{"hookSpecificOutput":{"updatedToolOutput": <redacted>}}` when it changed
  *  something, and nothing when clean. Returns the rewrite, or undefined when there is none. */
 function readRedactorRewrite(stdout) {
-  const line = String(stdout ?? '').split(/\r?\n/).find((l) => l.trim().startsWith('{'));
-  if (!line) return undefined;
+  // #4018: same election rule as runGate. `secret-output` is fail-OPEN, so an unreducible stream means
+  // "no rewrite" — the original output stands and the redactor's own stderr alarm stays the signal.
+  const { envelope, malformed } = decisionEnvelope(String(stdout ?? ''));
+  if (malformed || !envelope) return undefined;
   try {
-    const updated = JSON.parse(line).hookSpecificOutput?.updatedToolOutput;
+    const updated = JSON.parse(envelope).hookSpecificOutput?.updatedToolOutput;
     return typeof updated === 'string' || updated !== undefined ? updated : undefined;
   } catch {
     return undefined;

package/skills/bootstrap/seeds/manifest.json

@@ -8,7 +8,7 @@
     { "target": ".github/ISSUE_TEMPLATE/config.yml", "source": "self", "ownership": "repo", "classes": ["deployable", "content"] },
     { "target": "scripts/next-version.mjs", "source": "self", "ownership": "org", "classes": ["deployable"] },
     { "target": ".github/workflows/gate.yml", "source": "seed:gate.template.yml", "ownership": "org", "classes": ["deployable"] },
-    { "target": ".github/workflows/agent-pr.yml", "source": "self", "ownership": "org", "classes": ["deployable"] },
+    { "target": ".github/workflows/agent-pr.yml", "source": "self", "ownership": "org", "classes": ["deployable"], "waivers": { "jerv-jervcode": "runs a hardened variant the org copy does not carry — pull_request_target off the trusted base branch, an immutable BASE..HEAD compare with a file-count equality wall, a repo-scoped App token, and a certified-head merge that re-asserts base/head/state. Its own scripts/workflow-boundary-core.test.mjs pins those properties, so a seed refresh both weakens the repo and reds its gate. Widen the org seed to match before lifting this (#4033)." } },
     { "target": ".github/rulesets/mmi-product-required-checks.json", "source": "seed:mmi-product-required-checks.template.json", "ownership": "org", "classes": ["deployable"] },
     { "target": ".gitignore", "source": "managed-block", "ownership": "org", "classes": ["deployable", "content"] },
     { "target": "README.md", "source": "seed:README.template.md", "ownership": "repo", "classes": ["deployable", "content"] },