@ngockhoale/ukit 2.3.9 → 2.3.11

package/templates/.claude/ukit/runtime/token-utils.mjs

@@ -82,17 +82,49 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+function isPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // EPERM: the process exists but belongs to another user — still alive.
+    return error?.code === 'EPERM';
+  }
+}
+
+async function readLockOwner(lockPath) {
+  try {
+    const raw = JSON.parse(await fs.readFile(path.join(lockPath, 'owner'), 'utf8'));
+    const pid = Number(raw?.pid);
+    return Number.isInteger(pid) && pid > 0
+      ? { pid, token: typeof raw?.token === 'string' ? raw.token : null }
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+// In-process holder registry: same-pid holders are parallel async flows whose liveness a
+// pid probe cannot prove, so the module tracks them itself.
+const inProcessLockHolders = new Map();
+
 /**
  * Serialize read-modify-write mutations of a shared state file — across processes
  * (hook invocations run as separate node processes) and across concurrent async
  * flows in one process (parallel subagents). The lock is a directory created next
  * to the target file: `mkdir` is atomic, so exactly one caller can create it.
- * A crashed holder is reclaimed once the directory's mtime exceeds staleMs.
+ * Ownership is recorded in an `owner` file inside the lock dir: stale reclaim first
+ * proves the recorded holder is gone (dead pid, or no in-process holder for our own
+ * pid — no owner file means a pre-token holder and keeps the legacy mtime-only
+ * reclaim), so a slow-but-alive holder on a crawling disk is waited out, not stolen.
+ * Release only removes a dir this acquisition still owns, so a reclaimed-then-
+ * re-acquired lock is never deleted out from under its successor.
  * Liveness wins over strictness: if the lock cannot be acquired within maxWaitMs
  * the callback runs anyway (the pre-lock behaviour) — these state files are
  * advisory caches, and losing an update beats freezing a hook mid-flight.
  * Protocol-compatible with src/core/fileOps.js withFileLock (same `<file>.lock`
- * path), so CLI processes and hook processes serialize against each other.
+ * path and owner-file format), so CLI processes and hook processes serialize
+ * against each other.
  * @param {string} filePath - state file the mutation targets (lock lives beside it)
  * @param {() => Promise<*>} fn - critical section; its result is returned
  * @returns {Promise<*>} whatever fn resolves with
@@ -100,24 +132,48 @@ function sleep(ms) {
 export async function withFileLock(filePath, fn, { staleMs = LOCK_STALE_MS, maxWaitMs = LOCK_MAX_WAIT_MS } = {}) {
   const lockPath = `${filePath}.lock`;
   const startedAt = Date.now();
+  const ownerToken = `${process.pid}-${crypto.randomBytes(8).toString('hex')}`;
   let locked = false;
+  let ownerStamped = false;
 
   while (!locked) {
     try {
       await fs.mkdir(path.dirname(lockPath), { recursive: true });
       await fs.mkdir(lockPath); // atomic acquire — EEXIST means another holder exists
       locked = true;
+      inProcessLockHolders.set(lockPath, ownerToken);
+      try {
+        await fs.writeFile(
+          path.join(lockPath, 'owner'),
+          `${JSON.stringify({ pid: process.pid, token: ownerToken, ts: Date.now() })}\n`,
+          'utf8',
+        );
+        ownerStamped = true;
+      } catch {
+        ownerStamped = false; // unverifiable release skips removal; stale reclaim cleans up
+      }
       break;
     } catch (error) {
       if (error?.code !== 'EEXIST') throw error;
     }
 
-    // Someone holds the lock. Reclaim it when it looks abandoned; otherwise back off.
+    // Someone holds the lock. Reclaim it only when the holder is provably gone.
     try {
       const stat = await fs.stat(lockPath);
       if (Date.now() - stat.mtimeMs > staleMs) {
-        await fs.rm(lockPath, { recursive: true, force: true });
-        continue; // the slot is free now — retry immediately
+        const owner = await readLockOwner(lockPath);
+        const liveInProcess = inProcessLockHolders.has(lockPath);
+        // Stealing a live holder reintroduces the exact interleaved-write race this
+        // lock exists to prevent, and the stolen holder's release then deleted the
+        // successor's lock. Only a dead pid (or a leaked same-pid dir with no live
+        // registered flow) may be reclaimed.
+        const reclaimable = !owner || owner.pid === process.pid
+          ? !liveInProcess
+          : !isPidAlive(owner.pid);
+        if (reclaimable) {
+          await fs.rm(lockPath, { recursive: true, force: true });
+          continue; // the slot is free now — retry immediately
+        }
       }
     } catch {
       continue; // lock vanished between mkdir and stat — retry immediately
@@ -132,7 +188,14 @@ export async function withFileLock(filePath, fn, { staleMs = LOCK_STALE_MS, maxW
   } finally {
     if (locked) {
       try {
-        await fs.rm(lockPath, { recursive: true, force: true });
+        // Remove the lock only if THIS acquisition still owns it: after a stale reclaim
+        // another holder may already own the dir, and deleting it would unlock their
+        // critical section for a third waiter.
+        const current = ownerStamped ? await readLockOwner(lockPath) : null;
+        if (current && current.token === ownerToken) {
+          await fs.rm(lockPath, { recursive: true, force: true });
+        }
+        if (inProcessLockHolders.get(lockPath) === ownerToken) inProcessLockHolders.delete(lockPath);
       } catch {
         // best-effort release; a stale lock is reclaimed by the next waiter
       }

package/templates/.omp/hooks/pre/ukit-bridge.js

@@ -11,8 +11,10 @@ import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
 import {
   evaluateCompletion,
+  evidencePromptKey,
   incrementContinuation,
   markNotified,
+  noteStopProgress,
   readExecutionLedger,
   readRouteState,
   recordExecutionReceipt,
@@ -107,6 +109,15 @@ function classifyFailure(scriptName) {
   return FAIL_CLOSED_SCRIPTS.has(scriptName) ? 'closed' : 'open';
 }
 
+// A child killed by its per-script budget produced NO verdict — that is an infrastructure
+// event (slow disk, lock contention, process storm), not a safety decision. Routing it
+// into the fail-closed branch below blocked every Edit/Write (and Read's sensitive-data
+// guard) for as long as the machine was slow — the exact mid-run freeze class this bridge
+// must not create. One deliberate exception: block-dangerous.sh is the gate the user
+// explicitly required to never fail open (destructive-command protection), so a Bash chain
+// whose dangerous-command check timed out stays blocked with the honest reason.
+const TIMEOUT_STAYS_CLOSED = new Set(['block-dangerous.sh']);
+
 function runtimeMetadata(event = {}, context = {}) {
   const sessionManager = context?.sessionManager;
   return {
@@ -160,12 +171,30 @@ function parseStructuredDecision(stdout) {
 
 function translateExecResult(scriptName, execResult) {
   const killed = Boolean(execResult?.killed);
-  const code = killed ? 1 : (execResult?.code ?? 0);
   const stdout = execResult?.stdout ?? '';
   const stderr = killed
     ? (execResult?.stderr || `${scriptName} was killed before it completed`)
     : (execResult?.stderr ?? '');
 
+  if (killed) {
+    if (TIMEOUT_STAYS_CLOSED.has(scriptName)) {
+      return {
+        block: true,
+        reason: `${scriptName} exceeded its hook budget and was killed, so UKit could not verify the command is safe — the call stays blocked. Retry once; if this repeats, the machine is too slow for the guard to finish.`,
+        stdout,
+        stderr,
+      };
+    }
+    return {
+      block: false,
+      warning: `${scriptName} exceeded its hook budget and was killed — treated as "could not verify", not as a block (a timeout is an infrastructure event, not a verdict): ${stderr}`,
+      stdout,
+      stderr,
+    };
+  }
+
+  const code = execResult?.code ?? 0;
+
   if (code === 0) {
     return { block: false, stdout, stderr };
   }
@@ -437,16 +466,18 @@ function sendContext(pi, context, deliverAs, { display = false } = {}) {
 
 export async function runToolCall(pi, event, { projectRoot, context: extensionContext = {} }) {
   const rawToolName = event.toolName ?? event.tool;
-  const toolName = mapToolName(rawToolName);
-  if (!toolName && looksMutationCapable(event.input)) {
-    return {
-      block: true,
-      reason: `UKit blocked unmapped mutation-capable tool "${rawToolName}"; add a host adapter mapping before retrying.`,
-      context: [],
-      invoked: [],
-      toolName,
-    };
-  }
+  const mappedToolName = mapToolName(rawToolName);
+  // An unmapped tool that LOOKS like a file mutation must not sail past the guards — but
+  // hard-blocking it froze the run whenever omp renamed or added a tool, because the model
+  // cannot add a host adapter mapping mid-run and the block had no recovery path. Run the
+  // Edit guard chain on the normalized input instead: the guards key off
+  // tool_input.file_path and the mutation fields, not the host tool name. The mapping gap
+  // still surfaces as a visible warning so it gets fixed.
+  const unmappedMutation = !mappedToolName && looksMutationCapable(event.input);
+  const toolName = mappedToolName || (unmappedMutation ? 'Edit' : null);
+  const priorContext = unmappedMutation
+    ? [`[UKit] unmapped mutation-capable tool "${rawToolName}" was normalized to Edit so the guard chain still ran; add a mapping for it in ukit-bridge.js.`]
+    : [];
 
   const metadata = runtimeMetadata(event, extensionContext);
   const payload = buildHookPayload('PreToolUse', {
@@ -462,8 +493,9 @@ export async function runToolCall(pi, event, { projectRoot, context: extensionCo
     projectRoot,
     failClosedOnTransportError,
   });
-  if (!result.block) sendContext(pi, result.context, 'steer');
-  return { ...result, toolName };
+  const merged = { ...result, context: [...priorContext, ...(result.context || [])] };
+  if (!merged.block) sendContext(pi, merged.context, 'steer');
+  return { ...merged, toolName };
 }
 
 export async function runToolResult(pi, event, { projectRoot, context: extensionContext = {} }) {
@@ -581,9 +613,12 @@ export async function runSessionStop(
   const evaluation = evaluateCompletion({ state, ledger });
   if (!evaluation.continue) {
     if (evaluation.capped) pi.logger?.warn?.(`[UKit] ${evaluation.reason}`);
-    if (Array.isArray(evaluation.missingEvidence) && evaluation.missingEvidence.length > 0) {
+    const missingEvidence = Array.isArray(evaluation.missingEvidence) ? evaluation.missingEvidence : [];
+    // The visible-blocker exit (verification loop) carries no missingEvidence but must still
+    // reach the user — a silent release is indistinguishable from a stall.
+    if (missingEvidence.length > 0 || evaluation.notify) {
       const notice = [
-        `[UKit] Stopping with unfinished work: ${evaluation.missingEvidence.join(', ')}.`,
+        missingEvidence.length > 0 ? `[UKit] Stopping with unfinished work: ${missingEvidence.join(', ')}.` : '[UKit] Stopping automatic recovery.',
         evaluation.reason,
       ].filter(Boolean).join(' ');
       // VERIFIED (2026-08-29, source read of omp v18.0.10 pi-coding-agent/src) PLAN.md §3 D4:
@@ -598,9 +633,26 @@ export async function runSessionStop(
   }
 
   if (suppliedLedger === undefined) {
+    // Claude Code flags reentrant stops with stop_hook_active and the ledger CLI releases on
+    // them; omp's session_stop carries no such field. Detect the equivalent from the ledger:
+    // when the recovery turn produced no new receipts since the stop that blocked it,
+    // blocking again would only burn another turn in a self-sustaining loop — release with a
+    // visible reason instead. Vibecode autonomy keeps pushing (same as the CLI valve).
+    let reentrantStop = false;
+    try {
+      reentrantStop = (await noteStopProgress(projectRoot, payload)).reentrant === true;
+    } catch {
+      reentrantStop = false;
+    }
+    if (reentrantStop && state?.routeSummary?.autonomyLevel !== 'vibecode') {
+      const notice = `UKit stopped automatic recovery after one continuation: ${evaluation.reason}`;
+      pi.logger?.warn?.(`[UKit] ${notice}`);
+      sendContext(pi, [notice], 'nextTurn', { display: true });
+      return undefined;
+    }
     try {
       if (evaluation.finalNotice) await markNotified(projectRoot, payload, ledger);
-      else await incrementContinuation(projectRoot, payload, ledger, state?.requestKey || null);
+      else await incrementContinuation(projectRoot, payload, ledger, state?.requestKey || null, evidencePromptKey(state));
     } catch (error) {
       pi.logger?.warn?.(`[UKit] continuation bookkeeping failed open: ${error?.message || error}`);
     }