@ngockhoale/ukit 2.2.4 → 2.2.6

package/CHANGELOG.md

@@ -2,6 +2,49 @@
 
 All notable changes to UKit are documented here.
 
+## 2.2.6 - 2026-08-27
+
+Follow-up to a real-world report: a user on a Bun-hosted/self-compiled omp build kept getting
+every Edit/Write blocked with `UKit OMP hook runner failed before producing a valid result
+(killed=true, ..., runtime=/Users/.../bin/omp)`. The diagnostic added in 2.2.4 was already
+honest about the failure, but it did not say *why* — `runtime=` pointed straight at omp's own
+binary (proof that `process.execPath` inside that omp build resolves to omp itself, not a real
+Node.js binary), yet the message never told the user the fix was to set `UKIT_NODE_PATH`.
+
+### Fixed
+
+- **The omp bridge's transport-failure message named the wrong-runtime symptom but never the
+  fix.** [`ukit-bridge.js`](.omp/hooks/pre/ukit-bridge.js) already resolved
+  `process.env.UKIT_NODE_PATH || process.execPath` and reported the resolved `runtime` on failure
+  (2.2.4), but a user seeing `runtime=/Users/lenk/.local/bin/omp` had no way to know that string
+  meant "wrong binary" or what to do about it. When `UKIT_NODE_PATH` is unset, the failure
+  message now appends: the reported runtime may not be a real Node.js binary, and the exact fix —
+  `export UKIT_NODE_PATH="$(command -v node)"`. No behavior change when `UKIT_NODE_PATH` is
+  already set.
+
+### Added
+
+- **2 regression tests** in `tests/hooks/ompHookBridge.test.js` (case 13) — the wrong-runtime
+  hint appears when `UKIT_NODE_PATH` is unset, and is omitted when it is already set.
+
+## 2.2.5 - 2026-08-27
+
+Follow-up to the user's report that UKit had become too heavy-handed: too many hook scripts firing per tool call, too much blocking, and a concrete false-positive in the destructive-command gate itself. This wave trims default hook wiring and fixes the false positive, while explicitly preserving `rm`/destructive-command protection as instructed.
+
+### Changed
+
+- **`PreToolUse:Bash` now runs 4 hook scripts instead of 6.** `verification-guard.sh` was removed from the default Bash chain (both `.claude/settings.json` copies, the omp bridge's `HOOK_EVENT_MAP`/`FAIL_CLOSED_SCRIPTS`, and `hook-chain-runner.mjs`'s own classification). Its hard-block path is gated behind `UKIT_VERIFICATION_GUARD_ENFORCE=1`, unset by default, so it was pure per-call overhead (a full `node` spawn) for zero present safety value. The script and its standalone tests are untouched — still shippable, opt-in.
+- **`PreToolUse:Read|Grep|Glob` no longer runs `skill-router.sh`.** Automatic skill activation still runs on `UserPromptSubmit` and `Edit|Write`, where a skill choice actually matters; it no longer re-evaluates on every read-only tool call. Traded away: skill-router no longer sees "which files were Read/Grep'd" as mid-task evidence — only the original prompt and Edit/Write targets.
+
+### Fixed
+
+- **`block-dangerous.sh` misidentified dangerous *text* as a dangerous *command*.** Both its per-pattern denylist and its `rm` handling matched against the entire raw command string with no awareness of shell quoting, so `grep -rn "rm -rf" .` or `echo "rm -rf /tmp/foo"` — which merely mention the text — were blocked as if they executed it. Quoted spans are now scrubbed before matching, but only when the command's own invoked program is a pure text tool (`grep|egrep|fgrep|rg|ag|awk|sed|echo|printf|cat`) and it does not pipe into a shell/eval sink (`| bash|sh|zsh|eval|xargs`), since `echo "rm -rf /" | bash` really does execute the quoted text. Every other command shape is scanned exactly as strictly as before.
+- **`rm -rf ./dist` (and other allowlisted safe-cleanup targets with a `./` prefix) was blocked as an "unsafe delete target."** The unsafe-target check ran before the safe-cleanup allowlist check and its pattern misfired on the literal `./` prefix. Reordered so the allowlist is checked first; genuinely risky targets like `rm -rf ../important` still block.
+
+### Added
+
+- **11 regression tests** in `tests/hooks/blockDangerous.test.js` covering the false-positive fix, the closed shell-pipe escape hatch, the `./dist` allowlist fix, and all pre-existing destructive-command blocks (`rm -rf /`, `rm -rf ~`, `rm -rf .`, `rm -rf ../important`, `git push --force`, `git reset --hard`).
+
 ## 2.2.4 - 2026-08-27
 
 Follow-up to 2.2.3's hook-chain collapse: a real omp session on a CloudMounter/FUSE-mounted project reported every tool call — including harmless `echo`, `pwd`, `ls`, and `Edit` — failing with `invalid hook-chain output`, and in one case `protect-files.sh hook chain was killed before safety gates completed`, despite `protect-files.sh` itself passing trivially. The bridge was misattributing any aggregate-runner transport failure to the first fail-closed script in the chain, whether or not that script ever ran.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "2.2.4",
+  "version": "2.2.6",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/templates/.claude/hooks/block-dangerous.sh

@@ -9,6 +9,22 @@ if [ -z "$COMMAND" ]; then
   exit 0
 fi
 
+# A command like `grep "rm -rf" file.sh` or `echo "rm -rf /"` merely mentions the
+# text of a dangerous pattern as data — it does not execute it. Naively substring-matching
+# the raw command line false-positives on any search/print of that text. Scrub quoted
+# spans before pattern-matching, but ONLY when the invoked command is a pure text tool
+# AND its output cannot reach a shell (no piping into bash/sh/zsh/eval/xargs), since
+# `echo "rm -rf /" | bash` really does execute the quoted text.
+SAFE_TEXT_CMD_REGEX='^(grep|egrep|fgrep|rg|ag|awk|sed|echo|printf|cat)$'
+PIPE_TO_SHELL_REGEX='\|[[:space:]]*(bash|sh|zsh|eval|xargs)([[:space:]]|$)'
+
+CMD_HEAD=$(echo "$COMMAND" | sed -E 's/^[[:space:]]*//' | awk '{print $1}' | xargs -I{} basename {} 2>/dev/null)
+
+SCAN_COMMAND="$COMMAND"
+if echo "$CMD_HEAD" | grep -qE "$SAFE_TEXT_CMD_REGEX" && ! echo "$COMMAND" | grep -qE "$PIPE_TO_SHELL_REGEX"; then
+  SCAN_COMMAND=$(printf '%s' "$COMMAND" | sed -E "s/'[^']*'/'Q'/g; s/\"[^\"]*\"/\"Q\"/g")
+fi
+
 # Dangerous patterns to block
 DANGEROUS_PATTERNS=(
   "rm -rf /"
@@ -27,24 +43,26 @@ DANGEROUS_PATTERNS=(
 )
 
 for pattern in "${DANGEROUS_PATTERNS[@]}"; do
-  if echo "$COMMAND" | grep -qE "$pattern"; then
+  if echo "$SCAN_COMMAND" | grep -qE "$pattern"; then
     echo "BLOCKED: Dangerous command detected matching pattern '$pattern'. This command could cause irreversible damage. Ask the user to run it manually if truly needed." >&2
     exit 2
   fi
 done
 
 # Handle rm commands: allow safe cleanup targets, block risky recursive force-deletes
-if echo "$COMMAND" | grep -qE "(^|[;&|[:space:]])rm([[:space:]]|$)"; then
-  if echo "$COMMAND" | grep -qE "rm\s+(-[a-zA-Z]*r[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*r|--recursive\s+--force|--force\s+--recursive|--recursive\s+-f|-f\s+--recursive)"; then
+if echo "$SCAN_COMMAND" | grep -qE "(^|[;&|[:space:]])rm([[:space:]]|$)"; then
+  if echo "$SCAN_COMMAND" | grep -qE "rm\s+(-[a-zA-Z]*r[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*r|--recursive\s+--force|--force\s+--recursive|--recursive\s+-f|-f\s+--recursive)"; then
     SAFE_DELETE_REGEX='(^|[[:space:]])(\./)?(dist|build|coverage|\.next|\.nuxt|\.turbo|tmp|temp|\.cache|node_modules)(/|[[:space:]]|$)'
     UNSAFE_TARGET_REGEX='(^|[[:space:]])(/|~|\.\.?($|/)|\.($|/))'
 
-    if echo "$COMMAND" | grep -qE "$UNSAFE_TARGET_REGEX"; then
+    # Check the allowlist first: `./dist` legitimately contains a leading "./" that would
+    # otherwise be mistaken for a bare current-directory target by UNSAFE_TARGET_REGEX below.
+    if echo "$SCAN_COMMAND" | grep -qE "$SAFE_DELETE_REGEX"; then
+      :
+    elif echo "$SCAN_COMMAND" | grep -qE "$UNSAFE_TARGET_REGEX"; then
       echo "BLOCKED: Unsafe delete target detected. Refusing recursive force-delete." >&2
       exit 2
-    fi
-
-    if ! echo "$COMMAND" | grep -qE "$SAFE_DELETE_REGEX"; then
+    else
       echo "BLOCKED: 'rm -rf' is only auto-allowed for safe cleanup targets (dist/build/coverage/.next/.nuxt/.turbo/tmp/.cache/node_modules)." >&2
       exit 2
     fi

package/templates/.claude/settings.json

@@ -54,13 +54,7 @@
     "PreToolUse": [
       {
         "matcher": "Read|Grep|Glob",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/skill-router.sh\"",
-            "timeout": 8
-          }
-        ]
+        "hooks": []
       },
       {
         "matcher": "Edit|Write",
@@ -105,21 +99,11 @@
       {
         "matcher": "Bash",
         "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/verification-guard.sh\"",
-            "timeout": 8
-          },
           {
             "type": "command",
             "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-allow-bash.sh\"",
             "timeout": 8
           },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/skill-router.sh\"",
-            "timeout": 8
-          },
           {
             "type": "command",
             "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/block-dangerous.sh\"",

package/templates/.claude/ukit/runtime/hook-chain-runner.mjs

@@ -11,7 +11,6 @@ const FAIL_CLOSED_SCRIPTS = new Set([
   'vision-gate.sh',
   'context-hardcap-gate.sh',
   'block-dangerous.sh',
-  'verification-guard.sh',
 ]);
 
 const TOTAL_BUDGET_MS = 10000;

package/templates/.omp/hooks/pre/ukit-bridge.js

@@ -18,7 +18,7 @@ import {
 
 export const HOOK_EVENT_MAP = {
   tool_call: {
-    'Read|Grep|Glob': ['skill-router.sh'],
+    'Read|Grep|Glob': [],
     'Edit|Write': [
       'protect-files.sh',
       'stale-spec-guard.sh',
@@ -29,9 +29,7 @@ export const HOOK_EVENT_MAP = {
       'context-hardcap-gate.sh',
     ],
     Bash: [
-      'verification-guard.sh',
       'auto-allow-bash.sh',
-      'skill-router.sh',
       'block-dangerous.sh',
       'handoff-model-guard.sh',
       'context-hardcap-gate.sh',
@@ -86,7 +84,6 @@ export const FAIL_CLOSED_SCRIPTS = new Set([
   'vision-gate.sh',
   'context-hardcap-gate.sh',
   'block-dangerous.sh',
-  'verification-guard.sh',
 ]);
 
 export const ADVISORY_SCRIPTS = new Set([
@@ -244,10 +241,15 @@ export async function runScriptChain(
       wrapperError: chainResult?.wrapperError || null,
     };
     recordHookErrorDiagnostic(projectRoot, payload.session_id, diagnostic);
+    const nodePathHint = process.env.UKIT_NODE_PATH
+      ? ''
+      : ` "${diagnostic.nodeExecutable}" may not be a real Node.js binary (e.g. a Bun-hosted or `
+        + `self-compiled omp reports its own path as process.execPath). If so, set UKIT_NODE_PATH `
+        + `to one, e.g.: export UKIT_NODE_PATH="$(command -v node)".`;
     const reason = `UKit OMP hook runner failed before producing a valid result `
       + `(killed=${diagnostic.killed}, code=${diagnostic.code}, elapsedMs=${diagnostic.elapsedMs}, `
       + `runtime=${diagnostic.nodeExecutable}). No safety-gate verdict was available for [${scripts.join(', ')}]. `
-      + `See .ukit/storage/cache/hook-errors/.`;
+      + `See .ukit/storage/cache/hook-errors/.${nodePathHint}`;
     if (failClosedOnTransportError) {
       return { block: true, reason, context, invoked };
     }