@ngockhoale/ukit 2.2.12 → 2.2.16

package/templates/.claude/hooks/vision-router.sh

@@ -1,11 +1,10 @@
 #!/bin/bash
-# UserPromptSubmit hook: detect image input (pasted / local path / URL) and arm the
-# TASK-008 write gate by writing pending-<sha>.json markers via extract-image.mjs.
+# UserPromptSubmit hook: detect image input (pasted / local path / URL) and mark it for
+# the vision analyst by writing pending-<sha>.json markers via extract-image.mjs.
 #
 # FAILS OPEN, unconditionally: this hook must never block the user's prompt. Any
 # failure (malformed stdin, missing extractor, node crash) degrades to "no hint,
-# no markers" and exit 0. This is the deliberate opposite of the TASK-008 gate,
-# which fails closed on Edit/Write.
+# no markers" and exit 0. Advisory only — nothing is ever blocked.
 #
 # Detection only — never decodes an image, never writes an image file. Marker
 # writing is delegated entirely to `extract-image.mjs --mark-pending`; this hook
@@ -44,7 +43,7 @@ const { pathToFileURL } = require('url');
 
   const promptText = extractPromptText(payload);
 
-  // Tri-state, same contract as vision-gate.sh: true | false | null(unknown).
+  // Tri-state: true | false | null(unknown). Only a positive false short-circuits.
   async function detectUnicModeSafe() {
     try {
       const gatewayPath = path.join(projectRoot, '.claude', 'ukit', 'index', 'unic-gateway.mjs');
@@ -118,14 +117,12 @@ const { pathToFileURL } = require('url');
     }
   }
 
-  // `cases` reflects what the PROMPT mentioned; `armed` reflects what actually got a
-  // pending marker. They differ when a named path does not resolve from the project root
-  // — still worth a hint, but the gate is not armed and must not be claimed to be.
+  // `cases` reflects what the PROMPT mentioned. Named paths that do not resolve from
+  // the project root still get the unresolved-path note below.
   const cases = [];
   if (markedPasted > 0) cases.push('pasted image');
   if (localMatches.length > 0) cases.push('local file path');
   if (urlMatches.length > 0) cases.push('image URL');
-  const armed = markedPasted + markedPath + markedUrl;
 
   if (cases.length === 0) {
     process.exit(0);
@@ -135,8 +132,7 @@ const { pathToFileURL } = require('url');
   // Only unicMode true or null reach here; off-gateway already exited. Both remaining
   // cases get the same strict `unic-vision` remedy, so there is no fallback-model branch
   // to advertise. There must never be one: the analyst self-reports the model it really
-  // ran on, so telling it to claim some other ID is asking it to falsify the receipt —
-  // which the gate is entitled to reject, and which defeats the point of having a gate.
+  // ran on, so telling it to claim some other ID is asking it to falsify the receipt.
   let unicNote = '';
   if (unicMode === true) {
     try {
@@ -151,9 +147,7 @@ const { pathToFileURL } = require('url');
     }
   }
 
-  const reasonLine = armed > 0
-    ? 'unic-code / unic-smart cannot read images on this gateway, and Edit/Write is now GATED\nuntil a vision analysis exists. Do this before anything else:'
-    : 'unic-code / unic-smart cannot read images on this gateway. Do this before anything else:';
+  const reasonLine = 'unic-code / unic-smart cannot read images on this gateway — never guess at\nimage contents. Do this before relying on them:';
   const agentLine = '  2. Agent(subagent_type: "ukit-vision-analyst")  [model: unic-vision]';
 
   const lines = [

package/templates/.claude/settings.json

@@ -84,11 +84,6 @@
             "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\"",
             "timeout": 8
           },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/vision-gate.sh\"",
-            "timeout": 8
-          },
           {
             "type": "command",
             "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/context-hardcap-gate.sh\"",

package/templates/.claude/ukit/index/lib/index-core.mjs

@@ -24,11 +24,11 @@ const EXCLUDED_DIR_NAMES = new Set([
   '.venv',
   'venv',
 ]);
-const CODE_EXTENSIONS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.vue']);
+const CODE_EXTENSIONS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.vue', '.sql']);
 const STYLE_EXTENSIONS = new Set(['.css', '.scss', '.sass', '.less']);
-const TRACKED_EXTENSIONS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.vue', '.json', '.yaml', '.yml', '.md', '.sh']);
+const TRACKED_EXTENSIONS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.vue', '.sql', '.json', '.yaml', '.yml', '.md', '.sh']);
 const DISCOVERED_EXTENSIONS = new Set([...TRACKED_EXTENSIONS, ...STYLE_EXTENSIONS]);
-export const INDEX_SCHEMA_VERSION = 7;
+export const INDEX_SCHEMA_VERSION = 8;
 export const DEFAULT_INDEX_CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 const INDEX_PARSE_BATCH_SIZE = 8;
 const MAX_IMPORTER_HOPS = 2;
@@ -1810,26 +1810,38 @@ export function extractSymbols(filePath, content) {
     }
   };
 
-  addMatches(/export\s+(?:async\s+)?function\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, 'function');
-  addMatches(/export\s+class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, 'class');
-  addMatches(/(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(?:async\s*)?\(/g, 'callable');
-  addMatches(/(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(?:async\s*)?(?:\([^)]*\)|[A-Za-z_$][A-Za-z0-9_$]*)\s*=>/g, 'callable');
-  addMatches(/export\s+default\s+(?:async\s+)?function\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, 'default-function');
-  addMatches(/export\s+default\s+class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, 'default-class');
-  addMatches(/export\s+default\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*(?:;|\n|$)/g, 'default-reference');
-  addMatches(/defineOptions\(\s*\{[\s\S]*?name\s*:\s*['"]([^'"]+)['"]/g, 'component-name');
-  addMatches(/defineComponent\(\s*\{[\s\S]*?name\s*:\s*['"]([^'"]+)['"]/g, 'component-name');
-  addMatches(/export\s+default\s*\{[\s\S]*?name\s*:\s*['"]([^'"]+)['"]/g, 'component-name');
-
-  if (/\bexport\s+default\b/.test(content)) {
-    addSymbol('default', 'default-export');
-  }
-
-  for (const match of content.matchAll(/export\s*\{([^}]+)\}/g)) {
-    for (const part of (match[1] ?? '').split(',').map((x) => x.trim()).filter(Boolean)) {
-      const parsed = part.match(/^([A-Za-z_$][A-Za-z0-9_$]*)(?:\s+as\s+([A-Za-z_$][A-Za-z0-9_$]*))?$/);
-      if (!parsed) continue;
-      addSymbol(parsed[2] ?? parsed[1], 'named-export', match.index);
+  if (filePath.endsWith('.sql')) {
+    // Capture the object name, skipping an optional schema qualifier (qas.fn_rpt_billing → fn_rpt_billing).
+    const sqlIdent = '(?:(?:["`]?[A-Za-z_][A-Za-z0-9_$]*["`]?)\\s*\\.\\s*)?["`]?([A-Za-z_][A-Za-z0-9_$]*)["`]?';
+    addMatches(new RegExp(`CREATE\\s+(?:OR\\s+REPLACE\\s+)?TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?${sqlIdent}`, 'gi'), 'table');
+    addMatches(new RegExp(`CREATE\\s+(?:OR\\s+REPLACE\\s+)?VIEW\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?${sqlIdent}`, 'gi'), 'view');
+    addMatches(new RegExp(`CREATE\\s+(?:OR\\s+REPLACE\\s+)?FUNCTION\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?${sqlIdent}`, 'gi'), 'function');
+    addMatches(new RegExp(`CREATE\\s+(?:OR\\s+REPLACE\\s+)?PROCEDURE\\s+${sqlIdent}`, 'gi'), 'procedure');
+    addMatches(new RegExp(`CREATE\\s+(?:UNIQUE\\s+)?INDEX\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?${sqlIdent}`, 'gi'), 'index');
+    addMatches(new RegExp(`CREATE\\s+(?:TYPE|DOMAIN|SEQUENCE|MATERIALIZED\\s+VIEW)\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?${sqlIdent}`, 'gi'), 'type');
+    addMatches(new RegExp(`ALTER\\s+TABLE\\s+(?:IF\\s+EXISTS\\s+)?${sqlIdent}`, 'gi'), 'table');
+  } else {
+    addMatches(/export\s+(?:async\s+)?function\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, 'function');
+    addMatches(/export\s+class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, 'class');
+    addMatches(/(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(?:async\s*)?\(/g, 'callable');
+    addMatches(/(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(?:async\s*)?(?:\([^)]*\)|[A-Za-z_$][A-Za-z0-9_$]*)\s*=>/g, 'callable');
+    addMatches(/export\s+default\s+(?:async\s+)?function\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, 'default-function');
+    addMatches(/export\s+default\s+class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, 'default-class');
+    addMatches(/export\s+default\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*(?:;|\n|$)/g, 'default-reference');
+    addMatches(/defineOptions\(\s*\{[\s\S]*?name\s*:\s*['"]([^'"]+)['"]/g, 'component-name');
+    addMatches(/defineComponent\(\s*\{[\s\S]*?name\s*:\s*['"]([^'"]+)['"]/g, 'component-name');
+    addMatches(/export\s+default\s*\{[\s\S]*?name\s*:\s*['"]([^'"]+)['"]/g, 'component-name');
+
+    if (/\bexport\s+default\b/.test(content)) {
+      addSymbol('default', 'default-export');
+    }
+
+    for (const match of content.matchAll(/export\s*\{([^}]+)\}/g)) {
+      for (const part of (match[1] ?? '').split(',').map((x) => x.trim()).filter(Boolean)) {
+        const parsed = part.match(/^([A-Za-z_$][A-Za-z0-9_$]*)(?:\s+as\s+([A-Za-z_$][A-Za-z0-9_$]*))?$/);
+        if (!parsed) continue;
+        addSymbol(parsed[2] ?? parsed[1], 'named-export', match.index);
+      }
     }
   }
 

package/templates/.claude/ukit/index/provision-worktree.mjs

@@ -7,7 +7,7 @@
  *   - .claude/      -> REAL COPY preserving file modes (never a symlink: a worktree
  *                      edit must not write through into the live main-tree mirror).
  *                      Mode preservation matters: every .claude/hooks/*.sh is 755 and
- *                      tests/handoff/cycle4/vision-gate.test.mjs asserts the exec bit.
+ *                      tests/handoff/cycle7/provision-worktree.test.mjs asserts the exec bit.
  *   - .ukit/storage/config.json -> copy
  *   - .cache/index/             -> copy
  *

package/templates/.claude/ukit/index/route-catalog.mjs

@@ -234,7 +234,7 @@ export const ROUTE_CATALOG = [
     contextMode: 'standalone',
     signals: [
       { type: 'prompt', regex: /\b(what(?:'s| is)? next|next steps?|project status|current status|where are we|continue(?: from)?(?: last session)?|roadmap|status\.md|task queue|tasks\.md|next queued task|pick next task|work from tasks)\b/i, score: 7 },
-      { type: 'prompt', regex: /\b(làm gì tiếp|bước tiếp theo|tiếp theo làm gì|làm tiếp|đang ở đâu|trạng thái project|tình trạng project|task tiếp theo|việc tiếp theo trong tasks)\b/i, score: 7 },
+      { type: 'prompt', regex: /(?<![A-Za-z0-9_])(làm gì tiếp|bước tiếp theo|tiếp theo làm gì|làm tiếp|đang ở đâu|trạng thái project|tình trạng project|task tiếp theo|việc tiếp theo trong tasks)(?![A-Za-z0-9_])/i, score: 7 },
     ],
   },
   {

package/templates/.claude/ukit/index/route-task.mjs

@@ -1044,7 +1044,7 @@ function hasHandoffSignal(lower, raw) {
     || /\b(ai handoff|handoff phase|handoff mode|clear handoff|update handoff|start handoff|handoff clear)\b/.test(lower)
     || /\b(brainstorm|idea dump|ideas?).{0,80}\b(handoff|tasks?|taskify|split|breakdown)\b/.test(lower)
     || /\b(handoff|tasks?|taskify|split|breakdown).{0,80}\b(brainstorm|idea dump|ideas?)\b/.test(lower)
-    || /\b(gom|chia|tach|tách|lên|len|xóa|clear|dọn).{0,80}\b(idea|ý tưởng|y tuong|task|công việc|cong viec|handoff)\b/.test(raw)
+    || /(?<![A-Za-z0-9_])(gom|chia|tach|tách|lên|len|xóa|clear|dọn).{0,80}(?<![A-Za-z0-9_])(idea|ý tưởng|y tuong|task|công việc|cong viec|handoff)(?![A-Za-z0-9_])/.test(raw)
     || /\b(bàn giao|ban giao).{0,80}\b(ai|task|công việc|cong viec)\b/.test(raw);
 }
 
@@ -1056,7 +1056,7 @@ function hasHandoffClearSignal(lower, raw) {
 function hasOpenEndedStatusSignal(lower, raw) {
   return /\b(what next|what is next|what's next|next step|next steps|project status|current status|where are we|continue|continue from last session|roadmap|status\.md|task queue|tasks\.md|next queued task|pick next task|work from tasks)\b/.test(lower)
     || /\b(lam gi tiep|buoc tiep theo|tiep theo lam gi|lam tiep|dang o dau|trang thai project|tinh trang project|task tiep theo|viec tiep theo trong tasks)\b/.test(lower)
-    || /\b(làm gì tiếp|bước tiếp theo|tiếp theo làm gì|làm tiếp|đang ở đâu|trạng thái project|tình trạng project|task tiếp theo|việc tiếp theo trong tasks)\b/.test(raw);
+    || /(?<![A-Za-z0-9_])(làm gì tiếp|bước tiếp theo|tiếp theo làm gì|làm tiếp|đang ở đâu|trạng thái project|tình trạng project|task tiếp theo|việc tiếp theo trong tasks)(?![A-Za-z0-9_])/.test(raw);
 }
 
 function hasTaskQueueNextSignal(lower, raw) {
@@ -1070,7 +1070,7 @@ function hasConcreteTaskSignal(lower, raw, targetFile, { taskQueueNext = false }
   }
 
   return /\b(bug|debug|error|crash|broken|failing|stack trace|triage|fix|implement|build|create|add|ship|deliver|refactor|integrate|integration|scaffold|feature|update|change|modify|inject|apply|review|audit|diff|pr feedback|code review|auth|login|api|endpoint|test|spec)\b/.test(lower)
-    || /\b(sửa|fix|lỗi|bug|debug|implement|cài|thêm|review|kiểm tra|soát|đăng nhập)\b/.test(raw);
+    || /(?<![A-Za-z0-9_])(sửa|fix|lỗi|bug|debug|implement|cài|thêm|review|kiểm tra|soát|đăng nhập)(?![A-Za-z0-9_])/.test(raw);
 }
 
 function hasDocsSpecificTaskSignal(lower, raw, targetFile, { taskQueueNext = false } = {}) {
@@ -1093,11 +1093,11 @@ function hasDocsSpecificTaskSignal(lower, raw, targetFile, { taskQueueNext = fal
 
     return mentionsTargetDoc(lower, targetName)
       || /\b(edit|write|improve|document|docs?|readme|changelog|worklog|memory|code map|template|wording|copy|grammar|format|structure|heading|section|handoff notes?)\b/.test(lower)
-      || /\b(câu chữ|chỉnh|sửa chữ|ngữ pháp|định dạng|cấu trúc|tài liệu|ghi chú bàn giao)\b/.test(raw);
+      || /(?<![A-Za-z0-9_])(câu chữ|chỉnh|sửa chữ|ngữ pháp|định dạng|cấu trúc|tài liệu|ghi chú bàn giao)(?![A-Za-z0-9_])/.test(raw);
   }
 
   return /\b(template|wording|edit|copy|grammar|format|structure|heading|section|docs?)\b/.test(lower)
-    || /\b(mẫu|câu chữ|chỉnh|sửa chữ|ngữ pháp|định dạng|cấu trúc|tài liệu)\b/.test(raw);
+    || /(?<![A-Za-z0-9_])(mẫu|câu chữ|chỉnh|sửa chữ|ngữ pháp|định dạng|cấu trúc|tài liệu)(?![A-Za-z0-9_])/.test(raw);
 }
 
 function hasExplicitStatusUpdateSignal(lower, raw) {
@@ -1644,6 +1644,48 @@ function deriveExecutionScores({
   };
 }
 
+function isInformationalPrompt({
+  promptText = '',
+  commandText = '',
+  scores = null,
+} = {}) {
+  if (String(commandText || '').trim()) return false;
+  const raw = String(promptText || '').toLowerCase().trim();
+  if (!raw) return false;
+  const questionSignal = raw.includes('?')
+    || /\b(what|how|when|which|where|who|is|are|does|do|did|can|could|would|should|will)\b/.test(raw)
+    || /(là\s+(?:[^\s]+\s+){0,2}gì|thế nào|như thế nào|bao nhiêu|khi nào|bao giờ|ở đâu|nghĩa là|được không|không\b)/.test(raw);
+  // '?' or a leading/Vietnamese interrogative — required to overrule error wording.
+  const strongQuestion = raw.includes('?')
+    || /^(what|how|when|which|where|who|is|are|does|do|did|can|could|would|should|will)\b/.test(raw)
+    || /(là\s+(?:[^\s]+\s+){0,2}gì|thế nào|như thế nào|bao nhiêu|khi nào|bao giờ|ở đâu)/.test(raw);
+  if (scores) {
+    if (
+      scores.implementSignal
+      || scores.reviewSignal
+      || scores.debugSignal
+      || scores.impactSignal
+      || scores.smallFixSignal
+      || scores.directTransformSignal
+    ) {
+      return false;
+    }
+    if (scores.failureSignal && !strongQuestion) {
+      return false;
+    }
+  }
+  const implementWords = /(?<![A-Za-z0-9_])(implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|sửa|thêm|tạo|xóa|đổi|thay thế|cập nhật|viết|build|chạy|cài)(?![A-Za-z0-9_])/.test(raw);
+  if (implementWords) return false;
+  const investigationWords = /\b(why|debug|triage|root cause|investigate|tại sao)\b/.test(raw);
+  if (investigationWords) return false;
+  // \b never matches around 'lỗi' (diacritics are not \w), so test it as a plain
+  // substring: an error report is informational only when phrased as a question.
+  if (raw.includes('lỗi') && !strongQuestion) return false;
+  const reviewWords = /\b(review|audit|verify)\b/.test(raw);
+  if (reviewWords) return false;
+  return questionSignal;
+}
+
 function deriveExecutionMode({
   promptText = '',
   commandText = '',
@@ -1666,6 +1708,10 @@ function deriveExecutionMode({
     && (scores.impactSignal || /\b(check all affected|map all affected|across all affected)\b/.test(raw));
   const boundedLocalBuildCandidate = scores.buildSignal && scores.boundedEditSignal && scores.explicitTarget && !scores.sharedRisk;
 
+  if (isInformationalPrompt({ promptText, commandText, scores })) {
+    return 'informational';
+  }
+
   if ((intentMode === 'review-specific' || explicitReviewLead) && !scores.implementSignal) {
     return 'review-release';
   }
@@ -1956,7 +2002,7 @@ function buildApproachSelectorResult({
 }
 
 function buildCompletionState({ executionMode = null, verificationRecommendation = null } = {}) {
-  if (!executionMode) {
+  if (!executionMode || executionMode === 'informational') {
     return null;
   }
 

package/templates/.claude/ukit/index/unic-gateway.mjs

@@ -22,7 +22,7 @@
  * Every probe here is scoped to what changes the CALLING
  * runtime's OWN outbound endpoint — same rule that already governs probes 1-3. Cross-tool
  * configs are NOT probed. This module is only ever invoked from Claude Code / omp hooks
- * (vision-router.sh, vision-gate.sh, route-task.mjs, and the omp bridge) to gate what THIS
+ * (vision-router.sh, route-task.mjs, and the omp bridge) to gate what THIS
  * session does — a Codex `config.toml` `base_url`, a Kilo `secrets.json` endpoint, or an
  * `OPENAI_BASE_URL` env var describe a completely different tool's outbound endpoint and say
  * nothing about where Claude Code or omp itself is sending requests. Treating them as evidence

package/templates/.claude/ukit/runtime/compact-threshold.mjs

@@ -481,9 +481,80 @@ export function resetCompactPressureState(rawState = {}, config = {}) {
     recentOutputs: [],
     cooldownUntil: 0,
     latestPlan: null,
+    // Stamp the moment a compaction was accounted for, so the transcript sync (which may
+    // run slightly later than the boundary was written) does not double-fire.
+    lastCompactBoundaryAt: Date.now(),
   }, config);
 }
 
+const BOUNDARY_TAIL_BYTES = 4 * 1024 * 1024;
+
+// Find the newest compaction recorded in the session transcript, as epoch ms (0 if none).
+// Every real compaction — manual /compact AND harness auto-compact — appends a
+// `compact_boundary` entry to the transcript, while PreCompact hooks do not fire on every
+// compaction path (SDK/VSCode auto-compact being the known gap). That makes the transcript
+// the one record that cannot miss a compaction. Only the tail is read: boundaries are
+// appended chronologically and only the newest matters.
+export async function detectLatestCompactBoundaryAt(transcriptPath, { tailBytes = BOUNDARY_TAIL_BYTES } = {}) {
+  if (typeof transcriptPath !== 'string' || !transcriptPath.trim()) {
+    return 0;
+  }
+  try {
+    const stat = await fs.stat(transcriptPath);
+    if (!stat.isFile() || stat.size === 0) {
+      return 0;
+    }
+    const start = Math.max(0, stat.size - tailBytes);
+    const length = stat.size - start;
+    const buffer = Buffer.allocUnsafe(length);
+    const handle = await fs.open(transcriptPath, 'r');
+    let text;
+    try {
+      const { bytesRead } = await handle.read(buffer, 0, length, start);
+      text = buffer.toString('utf8', 0, bytesRead);
+    } finally {
+      await handle.close();
+    }
+    const lines = text.split('\n');
+    if (start > 0) lines.shift(); // a tail read can split the first line
+    for (let i = lines.length - 1; i >= 0; i -= 1) {
+      const line = lines[i];
+      if (!line.includes('compact_boundary')) continue;
+      try {
+        const entry = JSON.parse(line);
+        if (entry?.type === 'system' && entry?.subtype === 'compact_boundary') {
+          const at = Date.parse(entry.timestamp ?? '');
+          if (Number.isFinite(at)) return at;
+        }
+      } catch { /* not a usable boundary line */ }
+    }
+    return 0;
+  } catch {
+    return 0;
+  }
+}
+
+// Rebase the tracked counter whenever the transcript proves a compaction this state has
+// not accounted for yet (lastCompactBoundaryAt stamps what has been seen, so each
+// boundary fires the reset exactly once). Without this, sessionTokens keeps counting
+// history that was already summarised away and the hard-cap gate bricks a healthy
+// session. Callers must persist when reset=true, or the reset would re-fire (and
+// zero the counter) on every call.
+export async function syncCompactPressureStateWithTranscript(rawState = null, config = {}, transcriptPath = '') {
+  const boundaryAt = await detectLatestCompactBoundaryAt(transcriptPath);
+  const accounted = finiteNumber(rawState?.lastCompactBoundaryAt, 0);
+  if (!boundaryAt || boundaryAt <= accounted) {
+    return { state: rawState, reset: false };
+  }
+  return {
+    state: {
+      ...resetCompactPressureState(rawState ?? {}, config),
+      lastCompactBoundaryAt: boundaryAt,
+    },
+    reset: true,
+  };
+}
+
 function buildReleaseThresholds(thresholds = buildCompactThresholds()) {
   const softReleaseThreshold = Math.max(
     Math.min(thresholds.softThreshold, Math.round(thresholds.softThreshold * SOFT_RELEASE_RATIO)),
@@ -648,6 +719,7 @@ export function buildCompactPressureState(rawState = null, config = {}) {
     phase: resolveCompactPhase(estimatedTotalTokens, thresholds, rawState),
     taskMode,
     cooldownUntil: finiteNumber(rawState?.cooldownUntil, 0),
+    lastCompactBoundaryAt: finiteNumber(rawState?.lastCompactBoundaryAt, 0),
     routingContext: rawState?.routingContext && typeof rawState.routingContext === 'object'
       ? rawState.routingContext
       : {},
@@ -1058,6 +1130,22 @@ async function runCli() {
       return;
     }
 
+    // Heal a stale counter BEFORE the phase is computed. Auto-compact paths that never
+    // fire the PreCompact hook leave sessionTokens counting history that was already
+    // summarised away — that phantom total is how a healthy session got hard-cap blocked.
+    // The transcript's compact_boundary entries record every real compaction, manual or
+    // automatic, so they are the correction signal here.
+    try {
+      const synced = await syncCompactPressureStateWithTranscript(
+        await readCompactPressureState(projectRoot, config),
+        config,
+        payload.transcript_path,
+      );
+      if (synced.reset) {
+        await writeCompactPressureState(projectRoot, synced.state, config);
+      }
+    } catch { /* advisory healing only — never block the prompt over it */ }
+
     const nextState = await updateCompactPressureFromPrompt(projectRoot, {
       promptText,
       routingContext: routeState?.routingContext ?? {},
@@ -1065,9 +1153,16 @@ async function runCli() {
       routeSummary: routeState?.routeSummary ?? null,
     }, config);
 
-    if (nextState.phase === 'soft' || nextState.phase === 'hard') {
+    if (nextState.phase === 'hard') {
+      process.stdout.write(
+        `[ukit-skill-router] Context pressure: hard (est ${nextState.estimatedTotalTokens} / soft ${nextState.softThreshold} / hard ${nextState.hardThreshold}). `
+          + 'FIRST THING IN YOUR REPLY, tell the user plainly — do not stay silent: "Context sắp đầy — hãy gõ /compact ngay bây giờ (run /compact now)". '
+          + 'Then hold heavy work: no new investigations, subagents, or large edits until the user has compacted.\n',
+      );
+    } else if (nextState.phase === 'soft') {
       process.stdout.write(
-        `[ukit-skill-router] Context pressure: ${nextState.phase} (est ${nextState.estimatedTotalTokens} / soft ${nextState.softThreshold} / hard ${nextState.hardThreshold}). Suggest running /compact soon, or I will self-summarize before continuing.\n`,
+        `[ukit-skill-router] Context pressure: soft (est ${nextState.estimatedTotalTokens} / soft ${nextState.softThreshold} / hard ${nextState.hardThreshold}). `
+          + 'Finish the current step, then tell the user to run /compact at the next natural pause instead of continuing indefinitely.\n',
       );
     }
   }

package/templates/.claude/ukit/runtime/hook-chain-runner.mjs

@@ -8,7 +8,6 @@ const FAIL_CLOSED_SCRIPTS = new Set([
   'protect-files.sh',
   'stale-spec-guard.sh',
   'handoff-model-guard.sh',
-  'vision-gate.sh',
   'context-hardcap-gate.sh',
   'block-dangerous.sh',
 ]);

package/templates/.omp/README.md

@@ -62,14 +62,14 @@ One source of truth, two runtimes — fix a hook once and both runtimes get the
 Two things worth knowing:
 
 **Tool names are mapped explicitly, never guessed.** omp's write surface is `edit`, `write` *and*
-`ast_edit`; all three map to the `Edit` group, or `ast_edit` would slip past `protect-files.sh` and
-`vision-gate.sh`. `eval` maps to `Bash` so it still hits `block-dangerous.sh`. Anything not in the
+`ast_edit`; all three map to the `Edit` group, or `ast_edit` would slip past `protect-files.sh`.
+`eval` maps to `Bash` so it still hits `block-dangerous.sh`. Anything not in the
 table maps to nothing and runs zero scripts — it never falls back to `Bash` or `Edit`.
 
 **Failure direction is per-script, transcribed from each script's own header — not a blanket rule.**
 
 - *Fail closed* (a crash or non-zero exit blocks the action): `protect-files.sh`,
-  `stale-spec-guard.sh`, `handoff-model-guard.sh`, `vision-gate.sh`, `context-hardcap-gate.sh`,
+  `stale-spec-guard.sh`, `handoff-model-guard.sh`, `context-hardcap-gate.sh`,
   `block-dangerous.sh`, `verification-guard.sh`. These are gates; a broken gate must not open.
 - *Fail open* (a crash logs a warning and the action proceeds): the advisory scripts —
   routing, backups, output compression, context reinjection, pressure reset, handoff resume.

package/templates/.omp/hooks/pre/ukit-bridge.js

@@ -27,7 +27,6 @@ export const HOOK_EVENT_MAP = {
       'pre-edit-backup.sh',
       'skill-router.sh',
       'handoff-model-guard.sh',
-      'vision-gate.sh',
       'context-hardcap-gate.sh',
     ],
     Bash: [
@@ -83,7 +82,6 @@ export const FAIL_CLOSED_SCRIPTS = new Set([
   'protect-files.sh',
   'stale-spec-guard.sh',
   'handoff-model-guard.sh',
-  'vision-gate.sh',
   'context-hardcap-gate.sh',
   'block-dangerous.sh',
 ]);

package/templates/CLAUDE.md

@@ -209,7 +209,7 @@ This is internal orchestration — end users do not need to know about tiers, th
 `unic-vision` is a **capability lane**, not a fourth cost tier — it is orthogonal to lite/code/smart above and never appears as a row in the tier table. `unic-code` and `unic-smart` cannot read images on the UNIC gateway; they must never guess at image contents.
 
 - **Gateway detection**: UNIC routing for a Claude Code session is decided ONLY by what changes Claude Code's own outbound endpoint — `ANTHROPIC_BASE_URL` (env var, or the `env.ANTHROPIC_BASE_URL` key in project/home `.claude/settings.json`) containing `unicjsc.com`. Other tools' configs — Codex `config.toml`, Kilo `secrets.json`, or an `OPENAI_BASE_URL` env var — describe a different tool's endpoint entirely and never decide this session's routing.
-- **Enforcement**: every image (pasted, local file path, or URL) must be analysed by the `ukit-vision-analyst` agent running on the vision lane before any related edit happens. `Edit`/`Write` are **hard-blocked** until an analysis receipt exists for every pending image; `Read`/`Grep`/`Glob`/`Bash` stay unblocked so the analyst itself can see the image and write its receipt.
+- **Advisory routing (no hard block)**: when an image reaches the prompt, the vision router reminds the session to have `ukit-vision-analyst` analyse it before relying on its contents. Edits are **never blocked** — correctness relies on the model routing images to the analyst instead of guessing.
 - This is internal orchestration — end users never invoke a vision command directly; `ukit install` plus natural language remains the whole surface. No new commands.
 
 ## Skills

package/templates/ukit/storage/config.json

@@ -195,7 +195,7 @@
   "handoff": {
     "enabled": true,
     "crossTool": true,
-    "maxParallelAgents": 12,
+    "maxParallelAgents": 2,
     "autonomy": {
       "askWindow": "plan-only",
       "planReviewRounds": 2,
@@ -511,7 +511,7 @@
     "handoff": {
       "enabled": "Bật Quality Gate cho handoff: plan có Test Plan, executor test-first, reviewer model khác. Tắt = quay về flow cũ (dễ lọt lỗi vặt).",
       "crossTool": "true nghĩa là handoff truyền qua file (PLAN/INDEX/tasks) chứ không qua in-process subagent — cho phép plan ở Claude Code, execute ở Kilo Code, review ở Claude Code khác model.",
-      "maxParallelAgents": "Số agent chạy song song TỐI ĐA trong một wave (mặc định 12, tăng từ 3 để giảm thời gian chờ khi có nhiều task độc lập; 12 là số chọn theo dải an toàn ~10-15 dưới đây, không phải số đo được). Một wave có nhiều task hơn số này sẽ được chia thành nhiều batch chạy lần lượt — áp dụng cho cả Phase 3 Implement và Phase 4 Review. Lý do giới hạn vẫn còn: mỗi agent nền có context window riêng, và report của agent khi xong sẽ được inject ngược vào session chính — chạy quá nhiều cùng lúc (vd 20+) vẫn có thể làm session chính vượt context window và bỏ lại worktree rác. Hạ xuống 3-5 nếu task nặng (verification output dài) hoặc thấy compact bị trigger liên tục; tránh vượt quá ~10-15.",
+      "maxParallelAgents": "Số agent chạy song song TỐI ĐA trong một wave (mặc định 2 để giữ session chính nhẹ và hạn chế rủi ro compact/worktree rác; nếu máy khỏe và task độc lập nhiều thì có thể nâng dần 3-5, tối đa ~10-15). Một wave có nhiều task hơn số này sẽ được chia thành nhiều batch chạy lần lượt — áp dụng cho cả Phase 3 Implement và Phase 4 Review. Lý do giới hạn vẫn còn: mỗi agent nền có context window riêng, và report của agent khi xong sẽ được inject ngược vào session chính — chạy quá nhiều cùng lúc (vd 20+) vẫn có thể làm session chính vượt context window và bỏ lại worktree rác. Hạ xuống 1-2 nếu task nặng (verification output dài) hoặc thấy compact bị trigger liên tục.",
       "plan": {
         "requireTestPlan": "Bắt buộc PLAN.md §4 phải có Test Plan trước khi task chuyển ready.",
         "minTestsHappyPath": "Tối thiểu test cho happy path.",