@ngockhoale/ukit 2.3.2 → 2.3.4

package/templates/.claude/ukit/index/route-task.mjs

@@ -166,7 +166,11 @@ async function main() {
   const sharedStatePath = path.join(rootDir, '.claude', 'ukit', 'skill-router-state.json');
   const routeCachePath = path.join(rootDir, '.claude', 'ukit', 'route-cache.json');
   const routeAuditPath = path.join(rootDir, '.ukit', 'storage', 'cache', 'route-audit.json');
-  const previousState = await readJson(sharedStatePath, {});
+  const persistedPreviousState = await readJson(sharedStatePath, {});
+  const sessionId = normalizeSessionId(readFlagValue(args, '--session-id'));
+  const previousStateOwnershipBlocked = hasRouteStateOwner(persistedPreviousState)
+    && !isRouteStateCompatible(persistedPreviousState, sessionId);
+  const previousState = previousStateOwnershipBlocked ? {} : persistedPreviousState;
   const escalationConfig = await readJson(path.join(rootDir, '.ukit', 'storage', 'config.json'), null);
   const targetFile = readFlagValue(args, '--target');
   const taskType = readFlagValue(args, '--type');
@@ -185,7 +189,7 @@ async function main() {
     .trim();
 
   if (!promptText && !commandText && !targetFile) {
-    console.error('Usage: node .codex/ukit/index/route-task.mjs "<prompt>" [--tool-command <cmd>] [--target <file>] [--type trivial|simple|non-trivial] [--adapter codex|claude|antigravity|opencode]');
+    console.error('Usage: node .codex/ukit/index/route-task.mjs "<prompt>" [--tool-command <cmd>] [--target <file>] [--type trivial|simple|non-trivial] [--session-id <id>] [--adapter codex|claude|antigravity|opencode]');
     process.exitCode = 1;
     return;
   }
@@ -245,18 +249,33 @@ async function main() {
     previousState,
     requestKey,
   });
+  const routeCacheEntry = previousStateOwnershipBlocked
+    ? null
+    : await readRecentCacheEntry(routeCachePath, requestKey, {
+        maxEntries: DEFAULT_RECENT_CACHE_MAX_ENTRIES,
+        touch: false,
+      });
+  const cachedRouteState = reuseSharedRouteState({
+    previousState: routeCacheEntry,
+    requestKey,
+  });
+  const cachedRouteStateOwnershipBlocked = hasRouteStateOwner(routeCacheEntry)
+    && !isRouteStateCompatible(routeCacheEntry, sessionId);
+  const canPersistRouteState = !previousStateOwnershipBlocked;
+  const canPersistCachedRouteState = !cachedRouteStateOwnershipBlocked;
+
   if (reusableState) {
     printRouteState(reusableState);
     return;
   }
 
-  const cachedRouteState = reuseSharedRouteState({
-    previousState: await readRecentCacheEntry(routeCachePath, requestKey, {
+  if (cachedRouteState && canPersistCachedRouteState) {
+    await readRecentCacheEntry(routeCachePath, requestKey, {
       maxEntries: DEFAULT_RECENT_CACHE_MAX_ENTRIES,
       touch: true,
-    }),
-    requestKey,
-  });
+    });
+  }
+
   if (cachedRouteState) {
     const rescuedRouteSummary = cachedRouteState.routeSummary
       ? {
@@ -277,16 +296,19 @@ async function main() {
     }
     const sharedState = {
       ...cachedRouteState,
+      ...(sessionId ? { sessionId } : {}),
       source: 'task-route',
       ts: Date.now(),
       requestKey,
       routeSummary: rescuedRouteSummary,
     };
     sharedState.fingerprint = buildRouteStateFingerprint(sharedState);
-    await writeJson(sharedStatePath, sharedState);
-    await appendRouteAuditEntry(routeAuditPath, buildRouteAuditEntry({
-      state: sharedState,
-    }));
+    if (canPersistCachedRouteState) {
+      await writeJson(sharedStatePath, sharedState);
+      await appendRouteAuditEntry(routeAuditPath, buildRouteAuditEntry({
+        state: sharedState,
+      }));
+    }
     printRouteState(sharedState);
     return;
   }
@@ -324,15 +346,18 @@ async function main() {
     source: 'task-route',
     requestKey,
     indexGeneratedAtMs,
+    sessionId,
   });
-  await writeJson(sharedStatePath, sharedState);
-  await appendRouteAuditEntry(routeAuditPath, buildRouteAuditEntry({
-    route,
-    state: sharedState,
-  }));
-  await writeRecentCacheEntry(routeCachePath, compactRouteCacheState(sharedState), {
-    maxEntries: DEFAULT_RECENT_CACHE_MAX_ENTRIES,
-  });
+  if (canPersistRouteState) {
+    await writeJson(sharedStatePath, sharedState);
+    await appendRouteAuditEntry(routeAuditPath, buildRouteAuditEntry({
+      route,
+      state: sharedState,
+    }));
+    await writeRecentCacheEntry(routeCachePath, compactRouteCacheState(sharedState), {
+      maxEntries: DEFAULT_RECENT_CACHE_MAX_ENTRIES,
+    });
+  }
 
   printRouteState(sharedState);
 }
@@ -1509,6 +1534,7 @@ function buildRouteSummary({
     executionCandidates,
   });
   const executionContract = buildExecutionContract(executionMode);
+  const continuousExecution = buildContinuousExecutionPolicy(autonomyLevel);
   const tierLane = buildTierLane({ modelTier: executionContract?.modelTier ?? null });
   const completionState = buildCompletionState({
     executionMode,
@@ -1555,6 +1581,8 @@ function buildRouteSummary({
     tierLane,
     completionState,
     continuationState,
+    autonomyLevel,
+    continuousExecution,
     ...(expectedSourceFiles.length > 0 ? { expectedSourceFiles } : {}),
     intentMode: routingContext.intentMode ?? null,
     handoffFile,
@@ -1573,6 +1601,19 @@ function buildRouteSummary({
   };
 }
 
+// Execution-ledger.mjs mirrors this policy for its Stop gate; the two must stay aligned.
+// MAX_CONTINUATIONS (6) below is the same constant the ledger enforces for bounded modes.
+function buildContinuousExecutionPolicy(autonomyLevel) {
+  if (autonomyLevel === 'vibecode') {
+    return {
+      enabled: true,
+      stopOn: ['completion-evidence', 'genuine-blocker', 'dangerous-command-decision'],
+      maxContinuations: null,
+    };
+  }
+  return { enabled: false, maxContinuations: 6 };
+}
+
 function deriveContextMode(taskType) {
   if (taskType === 'trivial' || taskType === 'simple') return 'LITE';
   if (taskType === 'non-trivial' || taskType === 'shared-simple') return 'FULL';
@@ -2414,10 +2455,18 @@ function inferTaskType({ promptText, commandText, selectedIds, targetFile = null
   return inferred;
 }
 
+// Must mirror src/index/taskRouting.js: the printed helper command is meant to be pasted
+// into a shell, so arguments need POSIX single-quote escaping — JSON.stringify's double
+// quotes leave $(...), backticks, and $VAR open to shell expansion.
+function shellEscape(str) {
+  if (typeof str !== 'string') return '';
+  return "'" + str.replace(/'/g, "'\\''") + "'";
+}
+
 function buildHelperCommand({ commandNamespace = '.claude', scriptName, intent = '', targetFile = null, taskType = null }) {
   const parts = ['node', `${commandNamespace}/ukit/index/${scriptName}`];
-  if (intent) parts.push(JSON.stringify(intent));
-  if (targetFile) parts.push('--target', JSON.stringify(targetFile));
+  if (intent) parts.push(shellEscape(intent));
+  if (targetFile) parts.push('--target', shellEscape(targetFile));
   if (taskType) parts.push('--type', taskType);
   return parts.join(' ');
 }
@@ -2625,7 +2674,9 @@ function normalizeRelativeFile(rootDir, rawFilePath) {
     if (relative && !relative.startsWith('..') && !path.isAbsolute(relative)) {
       return relative.replaceAll('\\', '/');
     }
-    return trimmed.replaceAll('\\', '/');
+    // Absolute targets outside the project root are not routable repo files (src twin
+    // returns null here) — emitting them pulled outlines of foreign files into context.
+    return null;
   }
 
   return trimmed.replace(/^\.\/+/, '').replaceAll('\\', '/');
@@ -2665,11 +2716,25 @@ function readFlagValue(argv, flag) {
   return withEquals ? withEquals.slice(flag.length + 1) : null;
 }
 
+function normalizeSessionId(value) {
+  const normalized = value === undefined || value === null ? '' : String(value).trim();
+  return normalized || null;
+}
+
+function hasRouteStateOwner(state) {
+  return Boolean(normalizeSessionId(state?.sessionId));
+}
+
+function isRouteStateCompatible(state, sessionId) {
+  const owner = normalizeSessionId(state?.sessionId);
+  return Boolean(owner && sessionId && owner === sessionId);
+}
+
 function isFlagOrValue(argv, index) {
   const arg = argv[index];
   if (!arg.startsWith('--')) {
     const prev = argv[index - 1];
-    return Boolean(prev && ['--root', '--target', '--type', '--tool-command', '--last-prompt', '--adapter'].includes(prev));
+    return Boolean(prev && ['--root', '--target', '--type', '--tool-command', '--last-prompt', '--session-id', '--adapter'].includes(prev));
   }
   return true;
 }
@@ -2805,6 +2870,7 @@ function createSharedRouteState({
   route,
   source = 'task-route',
   requestKey = null,
+  sessionId = null,
 }) {
   const helpers = compactHelpers({
     verificationRecommendation: route.verificationRecommendation ?? null,
@@ -2812,6 +2878,7 @@ function createSharedRouteState({
   });
 
   return {
+    ...(sessionId ? { sessionId } : {}),
     requestKey,
     fingerprint: buildRouteStateFingerprint(route),
     ts: Date.now(),

package/templates/.claude/ukit/runtime/execution-ledger.mjs

@@ -7,6 +7,8 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const LEDGER_VERSION = 1;
+const RESUME_INTENT_VERSION = 1;
+const RESUME_INTENT_TTL_MS = 30 * 60 * 1000;
 const MAX_RECEIPTS = 24;
 const MAX_SOURCE_FILES = 16;
 const MAX_CONTINUATIONS = 6;
@@ -30,11 +32,17 @@ function firstDefined(values) {
   return values.find((value) => value !== undefined && value !== null);
 }
 
-function sessionIdentity(payload = {}) {
-  const sessionId = firstDefined([
-    payload.session_id,
-    payload.sessionId,
+function explicitSessionId(value = {}) {
+  const candidate = firstDefined([
+    value.session_id,
+    value.sessionId,
   ]);
+  const normalized = candidate === undefined || candidate === null ? '' : String(candidate).trim();
+  return normalized || null;
+}
+
+function sessionIdentity(payload = {}) {
+  const sessionId = explicitSessionId(payload);
   if (sessionId) return safeSegment(sessionId);
 
   const transcriptPath = firstDefined([
@@ -58,6 +66,17 @@ function ledgerPath(projectRoot, payload = {}) {
   );
 }
 
+function resumeIntentPath(projectRoot, sessionId) {
+  return path.join(
+    projectRoot,
+    '.ukit',
+    'storage',
+    'cache',
+    'resume-intents',
+    `${safeSegment(sessionId)}.json`,
+  );
+}
+
 async function readJson(filePath, fallback = null) {
   try {
     return JSON.parse(await fs.readFile(filePath, 'utf8'));
@@ -73,14 +92,112 @@ async function writeJsonAtomic(filePath, value) {
   await fs.rename(tempPath, filePath);
 }
 
-export async function readRouteState(projectRoot) {
-  return readJson(path.join(projectRoot, '.claude', 'ukit', 'skill-router-state.json'), null);
+export async function readRouteState(projectRoot, payload = {}) {
+  const state = await readJson(path.join(projectRoot, '.claude', 'ukit', 'skill-router-state.json'), null);
+  const sessionId = explicitSessionId(payload);
+  const stateSessionId = explicitSessionId(state || {});
+  if (!state || !sessionId) return state;
+  if (!stateSessionId) return null;
+  return stateSessionId === sessionId ? state : null;
 }
 
 export async function readExecutionLedger(projectRoot, payload = {}) {
   return readJson(ledgerPath(projectRoot, payload), null);
 }
 
+function promptKeyFromText(promptText) {
+  const normalized = String(promptText || '').trim();
+  if (!normalized) return null;
+  return `prompt-${crypto.createHash('sha256').update(normalized).digest('hex').slice(0, 20)}`;
+}
+
+function explicitPromptKey(routeState = {}) {
+  return promptKeyFromText(routeState?.routingContext?.lastExplicitUserPromptText);
+}
+
+function hasUnfinishedCompletion(state = {}, ledger = {}) {
+  if (ledger?.blocker) return false;
+  const mode = state?.routeSummary?.executionMode || state?.routeSummary?.approachSelector?.executionMode;
+  if (!IMPLEMENT_MODES.has(mode)) return false;
+  const required = requiredEvidence(state);
+  if (required.length === 0) return false;
+  return required.some((item) => !evidenceSatisfied(item, ledger, state?.routeSummary || {}));
+}
+
+function resumeSessionHash(sessionId) {
+  return crypto.createHash('sha256').update(String(sessionId)).digest('hex').slice(0, 32);
+}
+
+export async function readResumableExecution(projectRoot, payload = {}) {
+  const sessionId = explicitSessionId(payload);
+  if (!sessionId) return null;
+  const state = await readRouteState(projectRoot, payload);
+  const ledger = await readExecutionLedger(projectRoot, payload);
+  const promptKey = explicitPromptKey(state || {});
+  if (!state || !ledger || !ledger.sessionId || ledger.sessionId !== sessionId
+    || ledger.sessionKey !== safeSegment(sessionId) || !ledger.requestKey
+    || !ledger.promptKey || !promptKey || ledger.promptKey !== promptKey
+    || !hasUnfinishedCompletion(state, ledger)) {
+    return null;
+  }
+  return { state, ledger, sessionId };
+}
+
+export async function readResumeIntent(projectRoot, payload = {}, { consume = false, now = Date.now() } = {}) {
+  const sessionId = explicitSessionId(payload);
+  if (!sessionId) return null;
+  const intent = await readJson(resumeIntentPath(projectRoot, sessionId), null);
+  if (!intent || intent.version !== RESUME_INTENT_VERSION) return null;
+  if (intent.sessionKey !== safeSegment(sessionId) || intent.sessionHash !== resumeSessionHash(sessionId)) return null;
+  if (!intent.promptKey || !intent.requestKey || !Number.isFinite(intent.expiresAt) || intent.expiresAt <= now) return null;
+
+  const state = await readRouteState(projectRoot, payload);
+  const ledger = await readExecutionLedger(projectRoot, payload);
+  const promptKey = explicitPromptKey(state || {});
+  // Identity is session + promptKey, NOT requestKey. The router re-keys requestKey on
+  // every tool call (commandText/targetFile are part of the key), so requiring requestKey
+  // equality invalidated the intent after the FIRST tool call between the gate block and
+  // the compaction — the post-compact session then had no continuation instruction and
+  // sat idle silently. hasUnfinishedCompletion still re-validates against the CURRENT
+  // ledger evidence, so a request that finished meanwhile consumes nothing and never
+  // resumes; a genuinely different prompt produces a different promptKey and stays dead.
+  if (!state || !ledger || ledger.sessionId !== sessionId
+    || ledger.sessionKey !== safeSegment(sessionId)
+    || promptKey !== intent.promptKey
+    || ledger.promptKey !== intent.promptKey
+    || !hasUnfinishedCompletion(state, ledger)) {
+    return null;
+  }
+  if (consume) {
+    await fs.rm(resumeIntentPath(projectRoot, sessionId), { force: true });
+  }
+  return intent;
+}
+
+export async function writeResumeIntent(projectRoot, payload = {}, { now = Date.now() } = {}) {
+  const sessionId = explicitSessionId(payload);
+  if (!sessionId) return null;
+  const state = await readRouteState(projectRoot, payload);
+  const ledger = await readExecutionLedger(projectRoot, payload);
+  const promptKey = explicitPromptKey(state || {});
+  if (!state || !ledger || ledger.sessionId !== sessionId || !promptKey
+    || ledger.promptKey !== promptKey || !ledger.requestKey || !hasUnfinishedCompletion(state, ledger)) {
+    return null;
+  }
+  const intent = {
+    version: RESUME_INTENT_VERSION,
+    sessionKey: safeSegment(sessionId),
+    sessionHash: resumeSessionHash(sessionId),
+    promptKey,
+    requestKey: ledger.requestKey,
+    routeFingerprint: state.fingerprint || null,
+    createdAt: now,
+    expiresAt: now + RESUME_INTENT_TTL_MS,
+  };
+  await writeJsonAtomic(resumeIntentPath(projectRoot, sessionId), intent);
+  return intent;
+}
+
 function explicitError(payload = {}) {
   return [
     payload.isError,
@@ -246,7 +363,7 @@ export async function recordExecutionReceipt({
   harness = 'unknown',
 } = {}) {
   if (!projectRoot || !toolName) return null;
-  const routeState = await readRouteState(projectRoot);
+  const routeState = await readRouteState(projectRoot, payload);
   const current = await readExecutionLedger(projectRoot, payload);
   const ledger = !current || current.requestKey !== (routeState?.requestKey || null)
     ? carriedEvidenceLedger(freshLedger(payload, routeState, harness), current)
@@ -376,6 +493,9 @@ function recoveryInstruction(missingEvidence, ledger = {}, routeSummary = {}) {
 
 export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
   const routeSummary = state?.routeSummary || {};
+  // Explicit vibecode autonomy: the user asked UKit to run one prompt to a finished result,
+  // so the completion gate keeps pushing instead of releasing at the continuation cap.
+  const vibecode = routeSummary.autonomyLevel === 'vibecode';
   const mode = routeSummary.executionMode || routeSummary.approachSelector?.executionMode || null;
   const evidence = requiredEvidence(state);
   if (ledger?.blocker) {
@@ -411,7 +531,7 @@ export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
   const continuationCount = staleContinuations
     ? 0
     : Number(effectiveLedger?.continuationCount || 0);
-  if (continuationCount >= MAX_CONTINUATIONS) {
+  if (!vibecode && continuationCount >= MAX_CONTINUATIONS) {
     if (effectiveLedger?.notified === true) {
       return {
         continue: false,
@@ -431,7 +551,7 @@ export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
     };
   }
 
-  const finalAttempt = continuationCount === MAX_CONTINUATIONS - 1;
+  const finalAttempt = !vibecode && continuationCount === MAX_CONTINUATIONS - 1;
   const instruction = recoveryInstruction(missingEvidence, effectiveLedger, routeSummary);
   return {
     continue: true,
@@ -440,6 +560,7 @@ export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
       `UKit completion gate: missing ${missingEvidence.join(', ')}.`,
       instruction,
       finalAttempt ? 'Final automatic recovery attempt: finish now or report a concrete blocker with its evidence.' : null,
+      vibecode ? 'Continuous (vibecode) execution is active: keep working until the requested result is complete; UKit stops only on completion evidence, a genuine blocker, or a dangerous-command decision.' : null,
     ].filter(Boolean).join(' '),
   };
 }
@@ -490,15 +611,32 @@ async function main() {
     return;
   }
   if (process.argv.includes('--evaluate-stop')) {
-    const state = await readRouteState(projectRoot);
+    const state = await readRouteState(projectRoot, payload);
     const ledger = await readExecutionLedger(projectRoot, payload) || {};
     const result = evaluateCompletion({ state, ledger });
 
+    // A session ledger with activity proves this session was routed and accumulating
+    // evidence. If the route state is now missing or unreadable (router crashed/timed out
+    // before persisting it, or the session stamp was lost), the gate cannot evaluate
+    // completion — and ending silently there is indistinguishable from a mid-run stall.
+    // Surface the loss so the user sees WHY the run released. Sessions that were never
+    // routed (no ledger activity at all) stay silent: there is nothing to report.
+    if (!state && (ledger.sourceSucceeded || ledger.writeAttempted
+      || ledger.verificationAttempted || (ledger.receipts || []).length > 0)) {
+      process.stdout.write(`${JSON.stringify({
+        systemMessage: 'UKit completion gate: route state for this session was lost before the stop was evaluated (router did not persist it), so unfinished work could not be verified. Send the task again in a new message to re-route and finish it.',
+      })}\n`);
+      return;
+    }
+
     // Claude Code invokes Stop again after a Stop hook blocks the first stop. Re-blocking
     // that recovery turn creates a self-sustaining loop, so let it end normally instead.
     // If work still lacks evidence, surface the recovery reason to the user rather than
     // silently ending after the automatic continuation.
-    if (payload.stop_hook_active === true) {
+    // Vibecode autonomy keeps pushing through the reentrant Stop as well: the recovery turn
+    // after a block is another chance to finish the work, not a release valve. Block again
+    // with the reason; the loop still ends the moment evidence lands or a blocker appears.
+    if (payload.stop_hook_active === true && state?.routeSummary?.autonomyLevel !== 'vibecode') {
       if (result.continue || result.capped || result.notify) {
         const recoveryReason = result.reason
           || 'UKit completion gate reached its continuation limit; unfinished work was not retried again.';

package/templates/.claude/ukit/runtime/hook-chain-runner.mjs

@@ -106,7 +106,18 @@ function run(payloadText, scriptPaths) {
 }
 
 try {
-  const [, , payloadText = '{}', ...scriptPaths] = process.argv;
+  const [, , payloadArg = '{}', ...scriptPaths] = process.argv;
+  // The bridge passes the payload as a temp file (`@path`) when it can: argv is capped
+  // (~256KB per arg on macOS) and PostToolUse Bash payloads embed whole tool outputs.
+  // A leading '@' cannot occur in raw JSON, so the two forms are unambiguous.
+  let payloadText = payloadArg;
+  if (payloadArg.startsWith('@')) {
+    try {
+      payloadText = fs.readFileSync(payloadArg.slice(1), 'utf8');
+    } catch {
+      payloadText = '{}';
+    }
+  }
   process.stdout.write(JSON.stringify(run(payloadText, scriptPaths)));
 } catch (error) {
   process.stdout.write(JSON.stringify({

package/templates/.claude/ukit/runtime/reinject-context.mjs

@@ -58,6 +58,10 @@ async function main() {
     ...await buildRecentOutputLines(projectRoot, config),
     ...await buildResolverHintLines(projectRoot, state),
     ...await buildDuraOneHintLines(projectRoot),
+    // Post-compact discipline: the host summary keeps whatever it kept — the fastest way to
+    // re-inflate a just-compacted session is re-reading old files/logs to "recover" detail
+    // that is already on disk. Say it once, right where the fresh context starts.
+    '- Post-compact discipline: do NOT re-read old files/logs/tool outputs to rebuild context — durable state is on disk and in this block. Delegate broad reads/searches to subagents (separate windows), keep replies short, and let the main window rebuild headroom before any wide investigation.',
     '- If Claude hooks block broad verification, follow the routed targeted order or ask for explicit full-suite confirmation.',
   ].filter(Boolean);
 

package/templates/.omp/hooks/pre/ukit-bridge.js

@@ -138,6 +138,26 @@ function buildHookPayload(hookEventName, fields = {}) {
   return payload;
 }
 
+// A chain script may emit a Claude-Code-shaped structured decision on stdout. `ask` means
+// the human must decide — the chain layer passes it through as a non-block `ask` verdict and
+// the host boundary in hook() converts it to what the host supports. `deny` is a block that
+// carries the structured reason. Anything unparseable falls through to exit-code semantics.
+function parseStructuredDecision(stdout) {
+  if (typeof stdout !== 'string' || !stdout.trim()) return null;
+  try {
+    const decision = JSON.parse(stdout)?.hookSpecificOutput;
+    if (decision?.hookEventName !== 'PreToolUse') return null;
+    const permissionDecision = decision.permissionDecision;
+    if (permissionDecision !== 'ask' && permissionDecision !== 'deny') return null;
+    return {
+      permissionDecision,
+      reason: typeof decision.permissionDecisionReason === 'string' ? decision.permissionDecisionReason : '',
+    };
+  } catch {
+    return null;
+  }
+}
+
 function translateExecResult(scriptName, execResult) {
   const killed = Boolean(execResult?.killed);
   const code = killed ? 1 : (execResult?.code ?? 0);
@@ -150,6 +170,19 @@ function translateExecResult(scriptName, execResult) {
     return { block: false, stdout, stderr };
   }
   if (code === 2) {
+    const structured = parseStructuredDecision(stdout);
+    if (structured?.permissionDecision === 'ask') {
+      return {
+        block: false,
+        ask: true,
+        reason: structured.reason || stderr || `${scriptName} requires a human decision`,
+        stdout,
+        stderr,
+      };
+    }
+    if (structured?.permissionDecision === 'deny') {
+      return { block: true, reason: structured.reason || stderr || `${scriptName} denied the call`, stdout, stderr };
+    }
     return { block: true, reason: stderr || `${scriptName} exited 2 (blocked)`, stdout, stderr };
   }
   if (classifyFailure(scriptName) === 'closed') {
@@ -215,6 +248,39 @@ function resolveNodeExecutable() {
   return cachedNodeExecutable;
 }
 
+// argv is bounded: macOS allows ~256KB per argument (E2BIG), and PostToolUse Bash payloads
+// embed the whole tool output — routinely past that limit — so the exec fails before ANY
+// hook runs and the chain verdict is lost. Pass the payload through a temp file instead
+// (runner reads `@path` markers); inline argv stays as the fallback for read-only project
+// roots, and remains unambiguous because raw JSON never starts with '@'.
+function sweepStalePayloadFiles(dir) {
+  try {
+    const cutoff = Date.now() - 60 * 60 * 1000;
+    for (const name of fs.readdirSync(dir)) {
+      const filePath = path.join(dir, name);
+      try {
+        if (fs.statSync(filePath).mtimeMs < cutoff) fs.rmSync(filePath, { force: true });
+      } catch { /* raced away — fine */ }
+    }
+  } catch { /* sweeping is best effort */ }
+}
+
+function writePayloadFile(projectRoot, payload) {
+  try {
+    const dir = path.join(projectRoot, '.ukit', 'storage', 'cache', 'hook-payloads');
+    fs.mkdirSync(dir, { recursive: true });
+    sweepStalePayloadFiles(dir);
+    const filePath = path.join(
+      dir,
+      `${Date.now()}-${process.pid}-${Math.random().toString(36).slice(2, 8)}.json`,
+    );
+    fs.writeFileSync(filePath, JSON.stringify(payload), 'utf8');
+    return filePath;
+  } catch {
+    return null;
+  }
+}
+
 export async function runScriptChain(
   pi,
   scripts,
@@ -231,15 +297,21 @@ export async function runScriptChain(
   const scriptPaths = scripts.map((scriptName) => path.join(projectRoot, '.claude', 'hooks', scriptName));
   const nodeExecutable = resolveNodeExecutable();
   const startedAt = Date.now();
+  const payloadFile = writePayloadFile(projectRoot, payload);
+  const payloadArg = payloadFile ? `@${payloadFile}` : JSON.stringify(payload);
   let execResult;
   try {
     execResult = await pi.exec(
       nodeExecutable,
-      [runnerPath, JSON.stringify(payload), ...scriptPaths],
+      [runnerPath, payloadArg, ...scriptPaths],
       { cwd: projectRoot, timeout: chainExecTimeoutMs(scripts.length) },
     );
   } catch (error) {
     execResult = { code: 1, stdout: '', stderr: error?.message ?? String(error), killed: false };
+  } finally {
+    if (payloadFile) {
+      try { fs.rmSync(payloadFile, { force: true }); } catch { /* best effort cleanup */ }
+    }
   }
   const elapsedMs = Date.now() - startedAt;
 
@@ -300,6 +372,9 @@ export async function runScriptChain(
     if (verdict.block) {
       return { block: true, reason: verdict.reason, context, invoked };
     }
+    if (verdict.ask) {
+      return { block: false, ask: true, reason: verdict.reason, context, invoked };
+    }
   }
 
   return { block: false, context, invoked };
@@ -501,7 +576,7 @@ export async function runSessionStop(
 ) {
   const metadata = runtimeMetadata(event, extensionContext);
   const payload = buildHookPayload('Stop', metadata);
-  const state = suppliedState ?? await readRouteState(projectRoot);
+  const state = suppliedState ?? await readRouteState(projectRoot, payload);
   const ledger = suppliedLedger ?? await readExecutionLedger(projectRoot, payload) ?? {};
   const evaluation = evaluateCompletion({ state, ledger });
   if (!evaluation.continue) {
@@ -545,9 +620,12 @@ export default function hook(pi) {
   const projectRoot = process.env.CLAUDE_PROJECT_DIR || installedProjectRoot();
 
   pi.on('tool_call', (event, context) => {
-    return runToolCall(pi, event, { projectRoot, context }).then((result) => (
-      result.block ? { block: true, reason: result.reason } : undefined
-    ));
+    return runToolCall(pi, event, { projectRoot, context }).then((result) => {
+      // omp's hook surface has no native `ask`; a human-decision verdict is surfaced by
+      // blocking with the decision reason, so a dangerous command never runs silently.
+      if (result.block || result.ask) return { block: true, reason: result.reason };
+      return undefined;
+    });
   });
   pi.on('tool_result', (event, context) => runToolResult(pi, event, { projectRoot, context }));
   pi.on('before_agent_start', (event, context) => runBeforeAgentStart(pi, event, { projectRoot, context }));

package/templates/AGENTS.md

@@ -162,7 +162,7 @@ Khi Handoff mode: đọc `docs/AI_HANDOFF/RULES.md` để biết 4 phase (Idea+P
 
 ## Adaptive Autonomy
 
-- `autonomy.level` in `.ukit/storage/config.json` controls how much UKit acts without asking first: `conservative` (ask more), `balanced` (default), `free-run` (auto-run more).
+- `autonomy.level` in `.ukit/storage/config.json` controls how much UKit acts without asking first: `conservative` (ask more), `balanced` (default), `free-run` (auto-run more), `vibecode` (run one prompt to a finished result; the completion gate stops only on completion evidence, a genuine blocker, or a dangerous-command decision).
 - End users should not need to change this; maintainers may tune it per-project.
 
 ## 3-Tier Model Routing

package/templates/CLAUDE.md

@@ -162,7 +162,7 @@ Khi Handoff mode: đọc `docs/AI_HANDOFF/RULES.md` để biết 4 phase (Idea+P
 
 ## Adaptive Autonomy
 
-- `autonomy.level` in `.ukit/storage/config.json` controls how much UKit acts without asking first: `conservative` (ask more), `balanced` (default), `free-run` (auto-run more).
+- `autonomy.level` in `.ukit/storage/config.json` controls how much UKit acts without asking first: `conservative` (ask more), `balanced` (default), `free-run` (auto-run more), `vibecode` (run one prompt to a finished result; the completion gate stops only on completion evidence, a genuine blocker, or a dangerous-command decision).
 - End users should not need to change this; maintainers may tune it per-project.
 
 ## 3-Tier Model Routing