@ngockhoale/ukit 2.3.9 → 2.3.10

package/templates/.omp/hooks/pre/ukit-bridge.js

@@ -11,8 +11,10 @@ import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
 import {
   evaluateCompletion,
+  evidencePromptKey,
   incrementContinuation,
   markNotified,
+  noteStopProgress,
   readExecutionLedger,
   readRouteState,
   recordExecutionReceipt,
@@ -107,6 +109,15 @@ function classifyFailure(scriptName) {
   return FAIL_CLOSED_SCRIPTS.has(scriptName) ? 'closed' : 'open';
 }
 
+// A child killed by its per-script budget produced NO verdict — that is an infrastructure
+// event (slow disk, lock contention, process storm), not a safety decision. Routing it
+// into the fail-closed branch below blocked every Edit/Write (and Read's sensitive-data
+// guard) for as long as the machine was slow — the exact mid-run freeze class this bridge
+// must not create. One deliberate exception: block-dangerous.sh is the gate the user
+// explicitly required to never fail open (destructive-command protection), so a Bash chain
+// whose dangerous-command check timed out stays blocked with the honest reason.
+const TIMEOUT_STAYS_CLOSED = new Set(['block-dangerous.sh']);
+
 function runtimeMetadata(event = {}, context = {}) {
   const sessionManager = context?.sessionManager;
   return {
@@ -160,12 +171,30 @@ function parseStructuredDecision(stdout) {
 
 function translateExecResult(scriptName, execResult) {
   const killed = Boolean(execResult?.killed);
-  const code = killed ? 1 : (execResult?.code ?? 0);
   const stdout = execResult?.stdout ?? '';
   const stderr = killed
     ? (execResult?.stderr || `${scriptName} was killed before it completed`)
     : (execResult?.stderr ?? '');
 
+  if (killed) {
+    if (TIMEOUT_STAYS_CLOSED.has(scriptName)) {
+      return {
+        block: true,
+        reason: `${scriptName} exceeded its hook budget and was killed, so UKit could not verify the command is safe — the call stays blocked. Retry once; if this repeats, the machine is too slow for the guard to finish.`,
+        stdout,
+        stderr,
+      };
+    }
+    return {
+      block: false,
+      warning: `${scriptName} exceeded its hook budget and was killed — treated as "could not verify", not as a block (a timeout is an infrastructure event, not a verdict): ${stderr}`,
+      stdout,
+      stderr,
+    };
+  }
+
+  const code = execResult?.code ?? 0;
+
   if (code === 0) {
     return { block: false, stdout, stderr };
   }
@@ -437,16 +466,18 @@ function sendContext(pi, context, deliverAs, { display = false } = {}) {
 
 export async function runToolCall(pi, event, { projectRoot, context: extensionContext = {} }) {
   const rawToolName = event.toolName ?? event.tool;
-  const toolName = mapToolName(rawToolName);
-  if (!toolName && looksMutationCapable(event.input)) {
-    return {
-      block: true,
-      reason: `UKit blocked unmapped mutation-capable tool "${rawToolName}"; add a host adapter mapping before retrying.`,
-      context: [],
-      invoked: [],
-      toolName,
-    };
-  }
+  const mappedToolName = mapToolName(rawToolName);
+  // An unmapped tool that LOOKS like a file mutation must not sail past the guards — but
+  // hard-blocking it froze the run whenever omp renamed or added a tool, because the model
+  // cannot add a host adapter mapping mid-run and the block had no recovery path. Run the
+  // Edit guard chain on the normalized input instead: the guards key off
+  // tool_input.file_path and the mutation fields, not the host tool name. The mapping gap
+  // still surfaces as a visible warning so it gets fixed.
+  const unmappedMutation = !mappedToolName && looksMutationCapable(event.input);
+  const toolName = mappedToolName || (unmappedMutation ? 'Edit' : null);
+  const priorContext = unmappedMutation
+    ? [`[UKit] unmapped mutation-capable tool "${rawToolName}" was normalized to Edit so the guard chain still ran; add a mapping for it in ukit-bridge.js.`]
+    : [];
 
   const metadata = runtimeMetadata(event, extensionContext);
   const payload = buildHookPayload('PreToolUse', {
@@ -462,8 +493,9 @@ export async function runToolCall(pi, event, { projectRoot, context: extensionCo
     projectRoot,
     failClosedOnTransportError,
   });
-  if (!result.block) sendContext(pi, result.context, 'steer');
-  return { ...result, toolName };
+  const merged = { ...result, context: [...priorContext, ...(result.context || [])] };
+  if (!merged.block) sendContext(pi, merged.context, 'steer');
+  return { ...merged, toolName };
 }
 
 export async function runToolResult(pi, event, { projectRoot, context: extensionContext = {} }) {
@@ -581,9 +613,12 @@ export async function runSessionStop(
   const evaluation = evaluateCompletion({ state, ledger });
   if (!evaluation.continue) {
     if (evaluation.capped) pi.logger?.warn?.(`[UKit] ${evaluation.reason}`);
-    if (Array.isArray(evaluation.missingEvidence) && evaluation.missingEvidence.length > 0) {
+    const missingEvidence = Array.isArray(evaluation.missingEvidence) ? evaluation.missingEvidence : [];
+    // The visible-blocker exit (verification loop) carries no missingEvidence but must still
+    // reach the user — a silent release is indistinguishable from a stall.
+    if (missingEvidence.length > 0 || evaluation.notify) {
       const notice = [
-        `[UKit] Stopping with unfinished work: ${evaluation.missingEvidence.join(', ')}.`,
+        missingEvidence.length > 0 ? `[UKit] Stopping with unfinished work: ${missingEvidence.join(', ')}.` : '[UKit] Stopping automatic recovery.',
         evaluation.reason,
       ].filter(Boolean).join(' ');
       // VERIFIED (2026-08-29, source read of omp v18.0.10 pi-coding-agent/src) PLAN.md §3 D4:
@@ -598,9 +633,26 @@ export async function runSessionStop(
   }
 
   if (suppliedLedger === undefined) {
+    // Claude Code flags reentrant stops with stop_hook_active and the ledger CLI releases on
+    // them; omp's session_stop carries no such field. Detect the equivalent from the ledger:
+    // when the recovery turn produced no new receipts since the stop that blocked it,
+    // blocking again would only burn another turn in a self-sustaining loop — release with a
+    // visible reason instead. Vibecode autonomy keeps pushing (same as the CLI valve).
+    let reentrantStop = false;
+    try {
+      reentrantStop = (await noteStopProgress(projectRoot, payload)).reentrant === true;
+    } catch {
+      reentrantStop = false;
+    }
+    if (reentrantStop && state?.routeSummary?.autonomyLevel !== 'vibecode') {
+      const notice = `UKit stopped automatic recovery after one continuation: ${evaluation.reason}`;
+      pi.logger?.warn?.(`[UKit] ${notice}`);
+      sendContext(pi, [notice], 'nextTurn', { display: true });
+      return undefined;
+    }
     try {
       if (evaluation.finalNotice) await markNotified(projectRoot, payload, ledger);
-      else await incrementContinuation(projectRoot, payload, ledger, state?.requestKey || null);
+      else await incrementContinuation(projectRoot, payload, ledger, state?.requestKey || null, evidencePromptKey(state));
     } catch (error) {
       pi.logger?.warn?.(`[UKit] continuation bookkeeping failed open: ${error?.message || error}`);
     }