@ngockhoale/ukit 2.4.1 → 2.4.3

package/templates/.claude/hooks/context-window-guard.sh

@@ -22,26 +22,80 @@
 # loud early warning is the thing that actually helps: it arrives while compacting or
 # starting a fresh session still works.
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; Node gets a path, never the payload.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 
-INPUT="$INPUT" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE' || true
-const fs = require('fs');
-const path = require('path');
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" SCRIPT_DIR="$SCRIPT_DIR" node --input-type=module <<'NODE' || true
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10) || 3000;
+// H04: the transcript scan below is async and tail-bounded. It must be abandoned past
+// the existing 3 s self-deadline: this controller fires a moment BEFORE the hard exit so
+// the in-flight read unwinds cooperatively, and the timer underneath still guarantees the
+// process is gone at the deadline no matter what. Every path exits 0 — advisory only.
+const scanAbort = new AbortController();
+setTimeout(() => { try { scanAbort.abort(); } catch { /* already aborted */ } }, Math.max(0, HOOK_DEADLINE_MS - 250)).unref();
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 
-// Reading more than this per prompt is not worth the latency. Reading only the TAIL is
-// also the safe direction: if the last compact boundary is older than the tail, we count
-// the whole tail as live context, which over-estimates and warns earlier.
-const MAX_READ_BYTES = 24 * 1024 * 1024;
+// Reading only the TAIL is also the safe direction: if the last compact boundary is
+// older than the tail, we count the whole tail as live context, which over-estimates and
+// warns earlier. The byte ceiling itself lives in transcript-tail.mjs
+// (DEFAULT_TAIL_MAX_BYTES) so the reader and its regression tests share one number —
+// never again the old whole-transcript sync stat/read/split of up to 24 MiB per prompt.
 
 // Chars-per-token. Calibrated against a real 2843-line transcript: whole-file bytes read
 // ~1.44M "tokens" (constant false alarms), while message content after the last compact
 // boundary read ~145k for a session that did in fact need compacting right after.
 const CHARS_PER_TOKEN = 4;
 
+let rawInput = '';
+try { rawInput = fs.readFileSync(process.env.INPUT_FILE || '', 'utf8'); } catch {}
 const payload = (() => {
   try {
-    const parsed = JSON.parse(process.env.INPUT || '');
+    const parsed = JSON.parse(rawInput);
     return parsed && typeof parsed === 'object' ? parsed : {};
   } catch {
     return {};
@@ -52,70 +106,74 @@ const projectRoot = process.env.PROJECT_ROOT;
 const transcriptPath = typeof payload.transcript_path === 'string' ? payload.transcript_path.trim() : '';
 if (!transcriptPath) process.exit(0);
 
-function readTail(filePath) {
-  const stat = fs.statSync(filePath);
-  if (stat.size <= MAX_READ_BYTES) {
-    return { text: fs.readFileSync(filePath, 'utf8'), truncated: false };
-  }
-  const fd = fs.openSync(filePath, 'r');
-  try {
-    const buf = Buffer.allocUnsafe(MAX_READ_BYTES);
-    fs.readSync(fd, buf, 0, MAX_READ_BYTES, stat.size - MAX_READ_BYTES);
-    return { text: buf.toString('utf8'), truncated: true };
-  } finally {
-    fs.closeSync(fd);
-  }
+// Operator config is read once; a missing/corrupt file just means the defaults.
+let runtimeConfig = {};
+try {
+  runtimeConfig = JSON.parse(fs.readFileSync(path.join(projectRoot, '.ukit', 'storage', 'config.json'), 'utf8'));
+} catch { /* fall through to the defaults */ }
+if (!runtimeConfig || typeof runtimeConfig !== 'object') runtimeConfig = {};
+
+// Absolute operator ceiling (compact.hardCapTokens). Negotiated capacity can only ever
+// tighten this, never raise it.
+function operatorHardCap() {
+  const value = runtimeConfig?.compact?.hardCapTokens;
+  if (typeof value === 'number' && Number.isFinite(value) && Number.isInteger(value) && value > 0) return value;
+  return 500_000;
 }
 
-// The cap the rest of UKit already agrees on, so one config key tunes both this warning
-// and context-hardcap-gate.sh. Default mirrors compact-threshold.mjs.
-function loadHardCap() {
+// H04: bounded async tail scan instead of a whole-transcript sync stat/read/split. The
+// runtime module owns the byte ceiling (DEFAULT_TAIL_MAX_BYTES, regression-tested well
+// under the old 24 MiB) and the fail-open posture. A missing runtime helper (pre-install
+// tree) simply means nothing to measure: the advisory guard exits 0.
+async function loadTailScanner() {
   try {
-    const raw = fs.readFileSync(path.join(projectRoot, '.ukit', 'storage', 'config.json'), 'utf8');
-    const value = JSON.parse(raw)?.compact?.hardCapTokens;
-    if (typeof value === 'number' && Number.isFinite(value) && Number.isInteger(value) && value > 0) return value;
-  } catch { /* fall through to the default */ }
-  return 500_000;
+    return await import(pathToFileURL(path.join(
+      process.env.SCRIPT_DIR || process.cwd(),
+      '..',
+      'ukit',
+      'runtime',
+      'transcript-tail.mjs',
+    )).href);
+  } catch {
+    return null;
+  }
 }
 
-let text;
-let truncated;
+const scanner = await loadTailScanner();
+if (!scanner || typeof scanner.scanTranscriptTail !== 'function') process.exit(0);
+let tail;
 try {
-  ({ text, truncated } = readTail(transcriptPath));
+  tail = await scanner.scanTranscriptTail(transcriptPath, { signal: scanAbort.signal });
 } catch {
   // Transcript unreadable (first prompt of a session, permissions, races). Nothing to
   // measure and nothing worth reporting.
   process.exit(0);
 }
-
-const lines = text.split('\n').filter(Boolean);
-if (truncated) lines.shift(); // a tail read almost certainly split the first line
+const entries = Array.isArray(tail?.entries) ? tail.entries : [];
 
 // Everything before the last compact boundary is already summarised away and is NOT in
 // the live context. Counting it is what makes naive file-size estimates useless.
 let start = 0;
 let boundaryTs = null;
-for (let i = lines.length - 1; i >= 0; i -= 1) {
-  if (!lines[i].includes('compact_boundary')) continue;
-  try {
-    const entry = JSON.parse(lines[i]);
-    if (entry?.type === 'system' && entry?.subtype === 'compact_boundary') {
-      start = i + 1;
-      boundaryTs = Date.parse(entry.timestamp) || null;
-      break;
-    }
-  } catch { /* not a usable boundary line */ }
+for (let i = entries.length - 1; i >= 0; i -= 1) {
+  const entry = entries[i];
+  if (entry?.type === 'system' && entry?.subtype === 'compact_boundary') {
+    start = i + 1;
+    boundaryTs = Date.parse(entry.timestamp) || null;
+    break;
+  }
 }
 
+// If the tail window cuts off history AND holds no boundary, the newest compact boundary
+// may sit before the window: the estimate counts only what was read and is a lower
+// bound. Say so instead of pretending whole-session precision.
+const estimatePartial = Boolean(tail?.truncated) && boundaryTs === null;
+
 let contentChars = 0;
 let sidechainEntries = 0;
-for (let i = start; i < lines.length; i += 1) {
-  let entry;
-  try {
-    entry = JSON.parse(lines[i]);
-  } catch {
-    continue;
-  }
+const modelSequence = [];
+for (let i = start; i < entries.length; i += 1) {
+  const entry = entries[i];
   // Subagent traffic lives in its own context window, not the main one. Count it
   // separately: it is a leading indicator of the "many teammates at once" blow-up, but
   // adding it to the main estimate would overstate the main window.
@@ -123,6 +181,10 @@ for (let i = start; i < lines.length; i += 1) {
     sidechainEntries += 1;
     continue;
   }
+  if (entry?.type === 'assistant') {
+    const model = entry?.message?.model;
+    if (typeof model === 'string' && model.trim()) modelSequence.push(model.trim());
+  }
   if (entry?.type !== 'user' && entry?.type !== 'assistant' && entry?.type !== 'attachment') continue;
   try {
     contentChars += JSON.stringify(entry.message ?? entry.attachment ?? '').length;
@@ -130,9 +192,89 @@ for (let i = start; i < lines.length; i += 1) {
 }
 
 const estimatedTokens = Math.round(contentChars / CHARS_PER_TOKEN);
-const hardCap = loadHardCap();
+
+// Latest assistant model in the live window — this is the model that must fit the NEXT
+// request, so capacity negotiation follows it. A mid-session gateway swap to a smaller
+// model tightens the cap immediately; the earlier model's window is never sticky.
+// (Hoisted above the ratio so both capacity negotiation and the swap note share it.)
+const RECENT_MODEL_WINDOW = 40;
+const recentModels = modelSequence.slice(-RECENT_MODEL_WINDOW);
+const currentModel = recentModels[recentModels.length - 1] || null;
+
+// Negotiated capacity (H22): derive the advisory cap from the best available evidence —
+// env override > config override > verified model table > conservative default — instead
+// of assuming one hard-coded 500k window. The source is surfaced in the warning lines
+// below (capacitySource=...) so a mis-negotiated cap is diagnosable at a glance. A
+// missing runtime helper (pre-install tree) keeps the shipped fallback behavior —
+// advisory and fail-open either way.
+async function loadCapacityResolver() {
+  try {
+    return await import(pathToFileURL(path.join(
+      process.env.SCRIPT_DIR || process.cwd(),
+      '..',
+      'ukit',
+      'runtime',
+      'context-capacity.mjs',
+    )).href);
+  } catch {
+    return null;
+  }
+}
+
+let hardCap = operatorHardCap();
+let capacitySource = 'default';
+let negotiatedCapacity = null;
+try {
+  const capacityModule = await loadCapacityResolver();
+  if (capacityModule && typeof capacityModule.resolveContextCapTokens === 'function') {
+    const resolved = capacityModule.resolveContextCapTokens({
+      env: process.env,
+      config: runtimeConfig,
+      modelMetadata: { model: currentModel },
+    });
+    hardCap = resolved.capTokens;
+    capacitySource = resolved.capacity?.source ?? 'default';
+    negotiatedCapacity = resolved.capacity ?? null;
+  }
+} catch { /* negotiation is advisory — the operator ceiling already applies */ }
 const ratio = estimatedTokens / hardCap;
 
+// Publish what this hook negotiated so the compact-threshold/hard-cap-gate path stops
+// assuming a 500k window: this is the only place with live evidence (env + config + the
+// transcript's assistant models). Without the record, automatic compact waits until 240k
+// and the fail-closed gate until 500k on a verified 200k route — after the provider already
+// rejected the request. Best-effort: an unwritable cache dir must never break the guard.
+const CAPACITY_RECORD_PATH = path.join(projectRoot, '.ukit', 'storage', 'cache', 'context-capacity.json');
+if (negotiatedCapacity) {
+  try {
+    fs.mkdirSync(path.dirname(CAPACITY_RECORD_PATH), { recursive: true });
+    const previous = readCapacityRecord();
+    // Only rewrite when the evidence changed, so prompt caching sees a stable file.
+    if (!previous
+      || previous.tokens !== negotiatedCapacity.tokens
+      || previous.source !== negotiatedCapacity.source
+      || previous.model !== (currentModel ?? null)) {
+      const record = {
+        tokens: negotiatedCapacity.tokens,
+        source: negotiatedCapacity.source,
+        confidence: negotiatedCapacity.confidence,
+        model: currentModel ?? null,
+        updatedAt: Date.now(),
+      };
+      fs.writeFileSync(CAPACITY_RECORD_PATH, `${JSON.stringify(record)}\n`, 'utf8');
+    }
+  } catch { /* fail open: negotiation is advisory */ }
+}
+
+function readCapacityRecord() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(CAPACITY_RECORD_PATH, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
 // Debounce/state file shared by the context warning and the gateway model-swap note.
 const GUARD_STATE_PATH = path.join(projectRoot, '.ukit', 'storage', 'cache', 'context-guard-state.json');
 
@@ -164,22 +306,9 @@ let persistedState = { ...guardState };
 // keep working through swaps, and on a tool error after a swap, re-check the tool and
 // call it again instead of stopping. Runs before the ratio early-exit because a swap
 // can happen at any context level.
-const RECENT_MODEL_WINDOW = 40;
 const SWAP_NOTE_COOLDOWN_MS = 60 * 60 * 1000;
-const modelSequence = [];
-for (let i = start; i < lines.length; i += 1) {
-  let entry;
-  try {
-    entry = JSON.parse(lines[i]);
-  } catch {
-    continue;
-  }
-  if (entry?.isSidechain || entry?.type !== 'assistant') continue;
-  const model = entry?.message?.model;
-  if (typeof model === 'string' && model.trim()) modelSequence.push(model.trim());
-}
-const recentModels = modelSequence.slice(-RECENT_MODEL_WINDOW);
-const currentModel = recentModels[recentModels.length - 1] || null;
+// recentModels/currentModel were hoisted above for capacity negotiation; modelSequence
+// was collected in the single pass over entries.
 let previousModel = null;
 for (let i = recentModels.length - 2; i >= 0; i -= 1) {
   if (recentModels[i] !== currentModel) {
@@ -267,10 +396,14 @@ const run = readRunCursor();
 
 const lines_out = [];
 if (ratio >= 1) {
-  lines_out.push(`UKIT CONTEXT ALERT — live context ~${estimatedTokens.toLocaleString()} tokens, at/over the ${hardCap.toLocaleString()} cap (${pct}%).`);
+  lines_out.push(`UKIT CONTEXT ALERT — live context ~${estimatedTokens.toLocaleString()} tokens, at/over the ${hardCap.toLocaleString()} cap (${pct}%, capacitySource=${capacitySource}).`);
   lines_out.push('The next few turns risk "Your input exceeds the context window of this model".');
 } else {
-  lines_out.push(`UKIT CONTEXT WARNING — live context ~${estimatedTokens.toLocaleString()} tokens (${pct}% of the ${hardCap.toLocaleString()} cap).`);
+  lines_out.push(`UKIT CONTEXT WARNING — live context ~${estimatedTokens.toLocaleString()} tokens (${pct}% of the ${hardCap.toLocaleString()} cap, capacitySource=${capacitySource}).`);
+}
+
+if (estimatePartial) {
+  lines_out.push(`Note: this estimate is partial — only the last ~${Math.max(1, Math.round(Number(tail?.bytesRead || 0) / 1024))} KiB of transcript were read, so real live context may be higher.`);
 }
 
 if (withinCooldown) {

package/templates/.claude/hooks/handoff-model-guard.sh

@@ -11,7 +11,50 @@
 # Always hard-blocks (exit 2). No advisory/soft mode — the user explicitly asked for
 # strict enforcement of this contract.
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; the shell var is capped.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
+INPUT="$(cat "$UKIT_INPUT_FILE")"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 
 # Fast path — skip the node spawn (~70ms) when this hook provably has nothing to say.
@@ -26,12 +69,16 @@ if ! printf '%s' "$INPUT" | grep -qE 'AI_HANDOFF|git[[:space:]]+push'; then
   exit 0
 fi
 
-INPUT="$INPUT" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE'
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE'
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10) || 3000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 const fs = require('fs');
 const path = require('path');
 
 const payload = (() => {
-  try { return JSON.parse(process.env.INPUT || '{}'); } catch { return {}; }
+  let raw = '';
+  try { raw = fs.readFileSync(process.env.INPUT_FILE || '', 'utf8'); } catch {}
+  try { return JSON.parse(raw || '{}'); } catch { return {}; }
 })();
 const projectRoot = process.env.PROJECT_ROOT;
 const toolName = payload?.tool_name || '';

package/templates/.claude/hooks/handoff-resume.sh

@@ -19,10 +19,52 @@
 # ADVISORY ONLY — always exit 0. A resume hint must never be able to block a session from
 # starting.
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; Node gets a path, never the payload.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 
-INPUT="$INPUT" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE' || true
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE' || true
 const fs = require('fs');
 const path = require('path');
 const { pathToFileURL } = require('url');
@@ -35,9 +77,11 @@ const { pathToFileURL } = require('url');
 const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10) || 3000;
 setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 
+let rawInput = '';
+try { rawInput = fs.readFileSync(process.env.INPUT_FILE || '', 'utf8'); } catch {}
 const payload = (() => {
   try {
-    const parsed = JSON.parse(process.env.INPUT || '');
+    const parsed = JSON.parse(rawInput);
     return parsed && typeof parsed === 'object' ? parsed : {};
   } catch {
     return {};

package/templates/.claude/hooks/post-edit-verify.sh

@@ -2,7 +2,50 @@
 # PostToolUse hook: verify risky Edit|Write delta after rollback bytes exist.
 # Matched on: Edit|Write
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; the shell var is capped.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
+INPUT="$(cat "$UKIT_INPUT_FILE")"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
 SCRIPT="$PROJECT_ROOT/.claude/ukit/index/post-edit-verify.mjs"
 
@@ -10,4 +53,4 @@ if [ ! -f "$SCRIPT" ]; then
   exit 0
 fi
 
-printf '%s' "$INPUT" | node "$SCRIPT"
+printf '%s' "$INPUT" | UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" node "$SCRIPT"

package/templates/.claude/hooks/pre-edit-backup.sh

@@ -2,7 +2,50 @@
 # PreToolUse hook: create rollback bytes for risky Edit|Write operations.
 # Matched on: Edit|Write
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; the shell var is capped.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
+INPUT="$(cat "$UKIT_INPUT_FILE")"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
 SCRIPT="$PROJECT_ROOT/.claude/ukit/index/pre-edit-backup.mjs"
 
@@ -10,4 +53,4 @@ if [ ! -f "$SCRIPT" ]; then
   exit 0
 fi
 
-printf '%s' "$INPUT" | node "$SCRIPT"
+printf '%s' "$INPUT" | UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" node "$SCRIPT"