@ngockhoale/ukit 2.4.0 → 2.4.2

package/templates/.claude/hooks/context-window-guard.sh

@@ -22,26 +22,54 @@
 # loud early warning is the thing that actually helps: it arrives while compacting or
 # starting a fresh session still works.
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; Node gets a path, never the payload.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): bounded inline staging keeps the
+  # advisory/fail-open behavior below alive with a capped payload file.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null
+  cat >/dev/null 2>&1
+  if [ "$(wc -c < "$UKIT_INPUT_FILE" | tr -d '[:space:]')" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 
-INPUT="$INPUT" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE' || true
-const fs = require('fs');
-const path = require('path');
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" SCRIPT_DIR="$SCRIPT_DIR" node --input-type=module <<'NODE' || true
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10) || 3000;
+// H04: the transcript scan below is async and tail-bounded. It must be abandoned past
+// the existing 3 s self-deadline: this controller fires a moment BEFORE the hard exit so
+// the in-flight read unwinds cooperatively, and the timer underneath still guarantees the
+// process is gone at the deadline no matter what. Every path exits 0 — advisory only.
+const scanAbort = new AbortController();
+setTimeout(() => { try { scanAbort.abort(); } catch { /* already aborted */ } }, Math.max(0, HOOK_DEADLINE_MS - 250)).unref();
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 
-// Reading more than this per prompt is not worth the latency. Reading only the TAIL is
-// also the safe direction: if the last compact boundary is older than the tail, we count
-// the whole tail as live context, which over-estimates and warns earlier.
-const MAX_READ_BYTES = 24 * 1024 * 1024;
+// Reading only the TAIL is also the safe direction: if the last compact boundary is
+// older than the tail, we count the whole tail as live context, which over-estimates and
+// warns earlier. The byte ceiling itself lives in transcript-tail.mjs
+// (DEFAULT_TAIL_MAX_BYTES) so the reader and its regression tests share one number —
+// never again the old whole-transcript sync stat/read/split of up to 24 MiB per prompt.
 
 // Chars-per-token. Calibrated against a real 2843-line transcript: whole-file bytes read
 // ~1.44M "tokens" (constant false alarms), while message content after the last compact
 // boundary read ~145k for a session that did in fact need compacting right after.
 const CHARS_PER_TOKEN = 4;
 
+let rawInput = '';
+try { rawInput = fs.readFileSync(process.env.INPUT_FILE || '', 'utf8'); } catch {}
 const payload = (() => {
   try {
-    const parsed = JSON.parse(process.env.INPUT || '');
+    const parsed = JSON.parse(rawInput);
     return parsed && typeof parsed === 'object' ? parsed : {};
   } catch {
     return {};
@@ -52,23 +80,6 @@ const projectRoot = process.env.PROJECT_ROOT;
 const transcriptPath = typeof payload.transcript_path === 'string' ? payload.transcript_path.trim() : '';
 if (!transcriptPath) process.exit(0);
 
-function readTail(filePath) {
-  const stat = fs.statSync(filePath);
-  if (stat.size <= MAX_READ_BYTES) {
-    return { text: fs.readFileSync(filePath, 'utf8'), truncated: false };
-  }
-  const fd = fs.openSync(filePath, 'r');
-  try {
-    const buf = Buffer.allocUnsafe(MAX_READ_BYTES);
-    fs.readSync(fd, buf, 0, MAX_READ_BYTES, stat.size - MAX_READ_BYTES);
-    return { text: buf.toString('utf8'), truncated: true };
-  } finally {
-    fs.closeSync(fd);
-  }
-}
-
-// The cap the rest of UKit already agrees on, so one config key tunes both this warning
-// and context-hardcap-gate.sh. Default mirrors compact-threshold.mjs.
 function loadHardCap() {
   try {
     const raw = fs.readFileSync(path.join(projectRoot, '.ukit', 'storage', 'config.json'), 'utf8');
@@ -78,44 +89,59 @@ function loadHardCap() {
   return 500_000;
 }
 
-let text;
-let truncated;
+// H04: bounded async tail scan instead of a whole-transcript sync stat/read/split. The
+// runtime module owns the byte ceiling (DEFAULT_TAIL_MAX_BYTES, regression-tested well
+// under the old 24 MiB) and the fail-open posture. A missing runtime helper (pre-install
+// tree) simply means nothing to measure: the advisory guard exits 0.
+async function loadTailScanner() {
+  try {
+    return await import(pathToFileURL(path.join(
+      process.env.SCRIPT_DIR || process.cwd(),
+      '..',
+      'ukit',
+      'runtime',
+      'transcript-tail.mjs',
+    )).href);
+  } catch {
+    return null;
+  }
+}
+
+const scanner = await loadTailScanner();
+if (!scanner || typeof scanner.scanTranscriptTail !== 'function') process.exit(0);
+let tail;
 try {
-  ({ text, truncated } = readTail(transcriptPath));
+  tail = await scanner.scanTranscriptTail(transcriptPath, { signal: scanAbort.signal });
 } catch {
   // Transcript unreadable (first prompt of a session, permissions, races). Nothing to
   // measure and nothing worth reporting.
   process.exit(0);
 }
-
-const lines = text.split('\n').filter(Boolean);
-if (truncated) lines.shift(); // a tail read almost certainly split the first line
+const entries = Array.isArray(tail?.entries) ? tail.entries : [];
 
 // Everything before the last compact boundary is already summarised away and is NOT in
 // the live context. Counting it is what makes naive file-size estimates useless.
 let start = 0;
 let boundaryTs = null;
-for (let i = lines.length - 1; i >= 0; i -= 1) {
-  if (!lines[i].includes('compact_boundary')) continue;
-  try {
-    const entry = JSON.parse(lines[i]);
-    if (entry?.type === 'system' && entry?.subtype === 'compact_boundary') {
-      start = i + 1;
-      boundaryTs = Date.parse(entry.timestamp) || null;
-      break;
-    }
-  } catch { /* not a usable boundary line */ }
+for (let i = entries.length - 1; i >= 0; i -= 1) {
+  const entry = entries[i];
+  if (entry?.type === 'system' && entry?.subtype === 'compact_boundary') {
+    start = i + 1;
+    boundaryTs = Date.parse(entry.timestamp) || null;
+    break;
+  }
 }
 
+// If the tail window cuts off history AND holds no boundary, the newest compact boundary
+// may sit before the window: the estimate counts only what was read and is a lower
+// bound. Say so instead of pretending whole-session precision.
+const estimatePartial = Boolean(tail?.truncated) && boundaryTs === null;
+
 let contentChars = 0;
 let sidechainEntries = 0;
-for (let i = start; i < lines.length; i += 1) {
-  let entry;
-  try {
-    entry = JSON.parse(lines[i]);
-  } catch {
-    continue;
-  }
+const modelSequence = [];
+for (let i = start; i < entries.length; i += 1) {
+  const entry = entries[i];
   // Subagent traffic lives in its own context window, not the main one. Count it
   // separately: it is a leading indicator of the "many teammates at once" blow-up, but
   // adding it to the main estimate would overstate the main window.
@@ -123,6 +149,10 @@ for (let i = start; i < lines.length; i += 1) {
     sidechainEntries += 1;
     continue;
   }
+  if (entry?.type === 'assistant') {
+    const model = entry?.message?.model;
+    if (typeof model === 'string' && model.trim()) modelSequence.push(model.trim());
+  }
   if (entry?.type !== 'user' && entry?.type !== 'assistant' && entry?.type !== 'attachment') continue;
   try {
     contentChars += JSON.stringify(entry.message ?? entry.attachment ?? '').length;
@@ -166,18 +196,7 @@ let persistedState = { ...guardState };
 // can happen at any context level.
 const RECENT_MODEL_WINDOW = 40;
 const SWAP_NOTE_COOLDOWN_MS = 60 * 60 * 1000;
-const modelSequence = [];
-for (let i = start; i < lines.length; i += 1) {
-  let entry;
-  try {
-    entry = JSON.parse(lines[i]);
-  } catch {
-    continue;
-  }
-  if (entry?.isSidechain || entry?.type !== 'assistant') continue;
-  const model = entry?.message?.model;
-  if (typeof model === 'string' && model.trim()) modelSequence.push(model.trim());
-}
+// modelSequence was collected in the single pass over entries above.
 const recentModels = modelSequence.slice(-RECENT_MODEL_WINDOW);
 const currentModel = recentModels[recentModels.length - 1] || null;
 let previousModel = null;
@@ -273,6 +292,10 @@ if (ratio >= 1) {
   lines_out.push(`UKIT CONTEXT WARNING — live context ~${estimatedTokens.toLocaleString()} tokens (${pct}% of the ${hardCap.toLocaleString()} cap).`);
 }
 
+if (estimatePartial) {
+  lines_out.push(`Note: this estimate is partial — only the last ~${Math.max(1, Math.round(Number(tail?.bytesRead || 0) / 1024))} KiB of transcript were read, so real live context may be higher.`);
+}
+
 if (withinCooldown) {
   lines_out.push('(Directive already issued this phase — act on it now if not already done; this is just a reminder.)');
 } else if (run) {

package/templates/.claude/hooks/handoff-model-guard.sh

@@ -11,7 +11,24 @@
 # Always hard-blocks (exit 2). No advisory/soft mode — the user explicitly asked for
 # strict enforcement of this contract.
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; the shell var is capped.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): bounded inline staging keeps the
+  # wrapper's own fail-loud/advisory behavior below alive.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null
+  cat >/dev/null 2>&1
+  if [ "$(wc -c < "$UKIT_INPUT_FILE" | tr -d '[:space:]')" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
+INPUT="$(cat "$UKIT_INPUT_FILE")"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 
 # Fast path — skip the node spawn (~70ms) when this hook provably has nothing to say.
@@ -26,12 +43,16 @@ if ! printf '%s' "$INPUT" | grep -qE 'AI_HANDOFF|git[[:space:]]+push'; then
   exit 0
 fi
 
-INPUT="$INPUT" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE'
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE'
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10) || 3000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 const fs = require('fs');
 const path = require('path');
 
 const payload = (() => {
-  try { return JSON.parse(process.env.INPUT || '{}'); } catch { return {}; }
+  let raw = '';
+  try { raw = fs.readFileSync(process.env.INPUT_FILE || '', 'utf8'); } catch {}
+  try { return JSON.parse(raw || '{}'); } catch { return {}; }
 })();
 const projectRoot = process.env.PROJECT_ROOT;
 const toolName = payload?.tool_name || '';

package/templates/.claude/hooks/handoff-resume.sh

@@ -19,10 +19,26 @@
 # ADVISORY ONLY — always exit 0. A resume hint must never be able to block a session from
 # starting.
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; Node gets a path, never the payload.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): bounded inline staging keeps the
+  # advisory/fail-open behavior below alive with a capped payload file.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null
+  cat >/dev/null 2>&1
+  if [ "$(wc -c < "$UKIT_INPUT_FILE" | tr -d '[:space:]')" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 
-INPUT="$INPUT" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE' || true
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE' || true
 const fs = require('fs');
 const path = require('path');
 const { pathToFileURL } = require('url');
@@ -35,9 +51,11 @@ const { pathToFileURL } = require('url');
 const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10) || 3000;
 setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 
+let rawInput = '';
+try { rawInput = fs.readFileSync(process.env.INPUT_FILE || '', 'utf8'); } catch {}
 const payload = (() => {
   try {
-    const parsed = JSON.parse(process.env.INPUT || '');
+    const parsed = JSON.parse(rawInput);
     return parsed && typeof parsed === 'object' ? parsed : {};
   } catch {
     return {};

package/templates/.claude/hooks/post-edit-verify.sh

@@ -2,7 +2,24 @@
 # PostToolUse hook: verify risky Edit|Write delta after rollback bytes exist.
 # Matched on: Edit|Write
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; the shell var is capped.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): bounded inline staging keeps the
+  # wrapper's own fail-loud/advisory behavior below alive.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null
+  cat >/dev/null 2>&1
+  if [ "$(wc -c < "$UKIT_INPUT_FILE" | tr -d '[:space:]')" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
+INPUT="$(cat "$UKIT_INPUT_FILE")"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
 SCRIPT="$PROJECT_ROOT/.claude/ukit/index/post-edit-verify.mjs"
 
@@ -10,4 +27,4 @@ if [ ! -f "$SCRIPT" ]; then
   exit 0
 fi
 
-printf '%s' "$INPUT" | node "$SCRIPT"
+printf '%s' "$INPUT" | UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" node "$SCRIPT"

package/templates/.claude/hooks/pre-edit-backup.sh

@@ -2,7 +2,24 @@
 # PreToolUse hook: create rollback bytes for risky Edit|Write operations.
 # Matched on: Edit|Write
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; the shell var is capped.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): bounded inline staging keeps the
+  # wrapper's own fail-loud/advisory behavior below alive.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null
+  cat >/dev/null 2>&1
+  if [ "$(wc -c < "$UKIT_INPUT_FILE" | tr -d '[:space:]')" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
+INPUT="$(cat "$UKIT_INPUT_FILE")"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
 SCRIPT="$PROJECT_ROOT/.claude/ukit/index/pre-edit-backup.mjs"
 
@@ -10,4 +27,4 @@ if [ ! -f "$SCRIPT" ]; then
   exit 0
 fi
 
-printf '%s' "$INPUT" | node "$SCRIPT"
+printf '%s' "$INPUT" | UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" node "$SCRIPT"

package/templates/.claude/hooks/protect-files.sh

@@ -2,13 +2,32 @@
 # PreToolUse hook: Block edits to sensitive/protected files
 # Matched on: Edit|Write
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; the shell var is capped.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): bounded inline staging keeps the
+  # wrapper's own fail-loud/advisory behavior below alive.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null
+  cat >/dev/null 2>&1
+  if [ "$(wc -c < "$UKIT_INPUT_FILE" | tr -d '[:space:]')" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
+INPUT="$(cat "$UKIT_INPUT_FILE")"
 # jq is absent on stock macOS. Keep jq as the low-latency normal path, but fall back to
 # UKit's required Node runtime so a missing optional binary cannot disable this gate.
 if command -v jq >/dev/null 2>&1 && jq --version >/dev/null 2>&1; then
   FILE_PATH=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty')
 else
   FILE_PATH=$(printf '%s' "$INPUT" | node -e '
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || "", 10) || 3000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 const chunks = [];
 process.stdin.on("data", (chunk) => chunks.push(chunk));
 process.stdin.on("end", () => {

package/templates/.claude/hooks/record-execution.sh

@@ -2,7 +2,25 @@
 # PostToolUse hook: persist session-scoped source/write/verification receipts.
 # ADVISORY ONLY — always exit 0. A missing or failing runtime must be loud, not a silent pass.
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): receipts can legitimately be large, so the staged file
+  # is the transport and the shell var only mirrors the capped payload.
+  ukit_stage_hook_input 33554432 temp-file || exit 0
+else
+  # Runtime helper missing (pre-install tree): bounded inline staging keeps the
+  # wrapper's own fail-loud/advisory behavior below alive.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  head -c 33554433 > "$UKIT_INPUT_FILE" 2>/dev/null
+  cat >/dev/null 2>&1
+  if [ "$(wc -c < "$UKIT_INPUT_FILE" | tr -d '[:space:]')" -gt 33554432 ]; then
+    truncate -s 33554432 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
+INPUT="$(cat "$UKIT_INPUT_FILE")"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 SCRIPT="$PROJECT_ROOT/.claude/ukit/runtime/execution-ledger.mjs"
 
@@ -11,7 +29,7 @@ if [ ! -f "$SCRIPT" ]; then
   exit 0
 fi
 
-OUTPUT=$(printf '%s' "$INPUT" | UKIT_HARNESS=claude-code node "$SCRIPT" --record)
+OUTPUT=$(printf '%s' "$INPUT" | UKIT_HARNESS=claude-code UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" node "$SCRIPT" --record)
 STATUS=$?
 
 if [ "$STATUS" -ne 0 ]; then

package/templates/.claude/hooks/reinject-context.sh

@@ -10,7 +10,7 @@ HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
 SCRIPT_PATH="$HOOK_DIR/../ukit/runtime/reinject-context.mjs"
 
 if [ -f "$SCRIPT_PATH" ]; then
-  node "$SCRIPT_PATH"
+  UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" node "$SCRIPT_PATH"
   exit $?
 fi
 

package/templates/.claude/hooks/reset-compact-pressure.sh

@@ -26,6 +26,10 @@ fi
 
 # The lock directory lives beside the state file; its parent exists because the file does.
 node -e '
+// Deadline must exceed the bounded lock wait in this block (maxWaitMs = 5000) so the
+// watchdog can never fire while the mutation is still legally waiting for the lock.
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || "", 10) || 8000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 const crypto = require("crypto");
 const fs = require("fs");
 const path = require("path");

package/templates/.claude/hooks/sensitive-data-guard.sh

@@ -2,8 +2,11 @@
 # PreToolUse (Read|Grep|Bash) + UserPromptSubmit hook: sensitive-data gate.
 #
 # Blocks sensitive data — API keys, private keys, credentials, secret files —
-# from being sent to the AI. Strict by design ("cảnh cực gắt"): mere suspicion
-# of private data blocks the call so the USER decides. Detection covers three
+# from being sent to the AI. Detection is format-true only (owner directive
+# "chặn khi thấy rõ" after repeated false positives): a text match must itself
+# BE a credential — a vendor-formatted key, a private key block, or a JWT.
+# Keyword-assignment guessing and loose bearer matching are gone on purpose;
+# code, config snippets, hashes and encoded blobs flow. Detection covers three
 # egress channels into model context:
 #   1. Read/Grep of secret files (.env*, *.pem, id_rsa, credentials.json, ...)
 #   2. Bash commands that dump secrets (cat .env, bare `env`, curl -u user:pass,
@@ -22,17 +25,43 @@
 # Fails open only when there is nothing to scan (malformed stdin, no channel):
 # a broken gate must not brick every session, but every real detection blocks.
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
+# Bounded stdin (H01) — fail-closed overflow: an oversized payload is REFUSED
+# (silent exit 2, nothing staged, nothing echoed). The gate never truncates
+# unknown overflow and never materializes it in a shell variable.
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+  trap ukit_cleanup_hook_input EXIT
+  ukit_stage_hook_input 2097152 refuse
+  STAGE_RC=$?
+  if [ "$STAGE_RC" -ne 0 ]; then
+    exit "$STAGE_RC"
+  fi
+else
+  # Runtime helper missing (pre-install tree): same refuse posture, inline.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")" || exit 2
+  head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null
+  cat >/dev/null 2>&1
+  if [ "$(wc -c < "$UKIT_INPUT_FILE" | tr -d '[:space:]')" -gt 2097152 ]; then
+    rm -f "$UKIT_INPUT_FILE"
+    exit 2
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
 
-INPUT="$INPUT" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE'
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE'
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10) || 3000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 const fs = require('fs');
 const path = require('path');
 const { createHash } = require('crypto');
 
+let rawInput = '';
+try { rawInput = fs.readFileSync(process.env.INPUT_FILE || '', 'utf8'); } catch {}
 const payload = (() => {
   try {
-    const parsed = JSON.parse(process.env.INPUT || '');
+    const parsed = JSON.parse(rawInput);
     return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
@@ -76,22 +105,26 @@ function pathAllowed(filePath) {
 }
 
 // --- high-confidence secret value patterns (shared by prompt + bash scanning) ---
+// AKIA/ASIA/AIza prefixes are pure base64-compatible text, so an encoded blob
+// can contain a coincidental key-shaped substring (round-17 live case: ASIA…
+// inside a base64 payload). Those rules must stand alone — no base64/base64url
+// character on either side. Padding "=" is a boundary: it only ends a blob.
 const TOKEN_PATTERNS = [
   { label: 'OpenAI/Anthropic-style API key', re: /\bsk-(?:proj-|ant-|svc-|acct-|admin-)?[A-Za-z0-9_-]{20,}/g },
-  { label: 'AWS access key id', re: /\bAKIA[0-9A-Z]{16}\b/g },
+  { label: 'AWS access key id', re: /(?<![A-Za-z0-9+/_-])(?:AKIA|ASIA)[0-9A-Z]{16}(?![A-Za-z0-9+/_-])/g },
   { label: 'GitHub token', re: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g },
   { label: 'GitHub fine-grained token', re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g },
   { label: 'GitLab token', re: /\bglpat-[A-Za-z0-9_-]{20,}/g },
   { label: 'Slack token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
-  { label: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{20,}/g },
+  { label: 'Google API key', re: /(?<![A-Za-z0-9+/_-])AIza[0-9A-Za-z_-]{20,}(?![A-Za-z0-9+/_-])/g },
   { label: 'Stripe live key', re: /\b[srp]k_live_[A-Za-z0-9]{20,}/g },
   { label: 'JWT', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
   { label: 'private key block', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----/g },
-  { label: 'bearer token', re: /\bBearer\s+[A-Za-z0-9._+/=-]{20,}/gi },
 ];
 
-const ASSIGNMENT_RE = /(^|[^A-Za-z0-9_])(api[_-]?key|apikey|secret[_-]?key|secret|client[_-]?secret|password|passwd|auth[_-]?token|access[_-]?token|token)\s*[:=]\s*["']?([A-Za-z0-9+/_.~-]{16,})/gi;
-
+// No keyword-assignment lane ("password: …", "token = …") on purpose — it was
+// the source of every false positive: it guessed at whatever followed a
+// keyword, blocking code, prose and shell syntax that is never a secret.
 function scanSecretText(text) {
   const found = [];
   for (const { label, re } of TOKEN_PATTERNS) {
@@ -101,11 +134,6 @@ function scanSecretText(text) {
       found.push({ label, value: match[0] });
     }
   }
-  ASSIGNMENT_RE.lastIndex = 0;
-  let match;
-  while ((match = ASSIGNMENT_RE.exec(text)) !== null) {
-    found.push({ label: `${match[2].toLowerCase()} assignment`, value: match[3] });
-  }
   return found;
 }
 
@@ -253,6 +281,24 @@ if (findings.length === 0) {
   process.exit(0);
 }
 
+// --- machine-generated envelope lane (UserPromptSubmit only) ---
+// Harness plumbing (<task-notification>, <system-reminder>,
+// <cross-session-message>) legitimately carries fixture/log content through
+// the prompt channel — test tokens quoted in task bodies, CI logs, agent
+// results. Blocking it silently drops the notification and stalls pipelines
+// ("Waiting for N background agents"). These envelopes flow with a redacted
+// advisory: labels + counts only, never values. Everything a human types —
+// and every other event/channel — stays fail-closed below.
+const MACHINE_ENVELOPE_RE = /^\s*<(?:task-notification|system-reminder|cross-session-message)\b/i;
+const promptText = textChannels.length > 0 ? textChannels[0].text : null;
+if (event === 'UserPromptSubmit' && promptText && MACHINE_ENVELOPE_RE.test(promptText)) {
+  const labels = [...new Set(findings.map((f) => f.label))];
+  process.stdout.write(`${JSON.stringify({
+    systemMessage: `UKit sensitive-data gate: ${findings.length} secret-shaped value(s) inside a machine-generated notification (${labels.slice(0, 3).join('; ')}${labels.length > 3 ? '; …' : ''}). Delivered without blocking — treat as fixture/log plumbing, not a typed secret. Never repeat the values in your reply.`,
+  })}\n`);
+  process.exit(0);
+}
+
 // --- block message: redacted previews only, never the secret itself ---
 function describeFinding(finding) {
   const where = finding.preview
@@ -264,8 +310,9 @@ function describeFinding(finding) {
 const lines = [
   `BLOCKED (sensitive data): ${findings.length} potential secret(s) detected. Nothing was sent to the AI.`,
   ...findings.map(describeFinding),
-  'This gate is intentionally strict — it blocks on suspicion so the USER decides.',
-  'To proceed, the USER must choose one of:',
+  'Detection is format-true only: a match must itself be a vendor-formatted key,',
+  'a private key block, a JWT, or a credentials file. Code, prose, hashes and',
+  'encoded blobs are not blocked. To proceed, the USER can choose one of:',
   '  1. Redact the secret (placeholder like <API_KEY>) and retry.',
   '  2. Approve it explicitly: add the full sha256 (shasum -a 256 of the value) or the file path',
   '     to .ukit/storage/security/allowlist.json — that file is protected from AI edits.',