@ngockhoale/ukit 2.4.1 → 2.4.3

package/templates/.claude/hooks/protect-files.sh

@@ -2,13 +2,58 @@
 # PreToolUse hook: Block edits to sensitive/protected files
 # Matched on: Edit|Write
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; the shell var is capped.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
+INPUT="$(cat "$UKIT_INPUT_FILE")"
 # jq is absent on stock macOS. Keep jq as the low-latency normal path, but fall back to
 # UKit's required Node runtime so a missing optional binary cannot disable this gate.
 if command -v jq >/dev/null 2>&1 && jq --version >/dev/null 2>&1; then
   FILE_PATH=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty')
 else
   FILE_PATH=$(printf '%s' "$INPUT" | node -e '
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || "", 10) || 3000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 const chunks = [];
 process.stdin.on("data", (chunk) => chunks.push(chunk));
 process.stdin.on("end", () => {

package/templates/.claude/hooks/record-execution.sh

@@ -2,7 +2,51 @@
 # PostToolUse hook: persist session-scoped source/write/verification receipts.
 # ADVISORY ONLY — always exit 0. A missing or failing runtime must be loud, not a silent pass.
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): receipts can legitimately be large, so the staged file
+  # is the transport and the shell var only mirrors the capped payload.
+  ukit_stage_hook_input 33554432 temp-file || exit 0
+else
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 33554433 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 33554433 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 33554432 ]; then
+    truncate -s 33554432 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
+INPUT="$(cat "$UKIT_INPUT_FILE")"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 SCRIPT="$PROJECT_ROOT/.claude/ukit/runtime/execution-ledger.mjs"
 
@@ -11,7 +55,7 @@ if [ ! -f "$SCRIPT" ]; then
   exit 0
 fi
 
-OUTPUT=$(printf '%s' "$INPUT" | UKIT_HARNESS=claude-code node "$SCRIPT" --record)
+OUTPUT=$(printf '%s' "$INPUT" | UKIT_HARNESS=claude-code UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" node "$SCRIPT" --record)
 STATUS=$?
 
 if [ "$STATUS" -ne 0 ]; then

package/templates/.claude/hooks/reinject-context.sh

@@ -10,7 +10,7 @@ HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
 SCRIPT_PATH="$HOOK_DIR/../ukit/runtime/reinject-context.mjs"
 
 if [ -f "$SCRIPT_PATH" ]; then
-  node "$SCRIPT_PATH"
+  UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" node "$SCRIPT_PATH"
   exit $?
 fi
 

package/templates/.claude/hooks/reset-compact-pressure.sh

@@ -26,6 +26,10 @@ fi
 
 # The lock directory lives beside the state file; its parent exists because the file does.
 node -e '
+// Deadline must exceed the bounded lock wait in this block (maxWaitMs = 5000) so the
+// watchdog can never fire while the mutation is still legally waiting for the lock.
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || "", 10) || 8000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 const crypto = require("crypto");
 const fs = require("fs");
 const path = require("path");

package/templates/.claude/hooks/sensitive-data-guard.sh

@@ -2,13 +2,17 @@
 # PreToolUse (Read|Grep|Bash) + UserPromptSubmit hook: sensitive-data gate.
 #
 # Blocks sensitive data — API keys, private keys, credentials, secret files —
-# from being sent to the AI. Strict by design ("cảnh cực gắt"): mere suspicion
-# of private data blocks the call so the USER decides. Detection covers three
+# from being sent to the AI. Detection is format-true only (owner directive
+# "chặn khi thấy rõ" after repeated false positives): a text match must itself
+# BE a credential — a vendor-formatted key, a private key block, or a JWT.
+# Keyword-assignment guessing and loose bearer matching are gone on purpose;
+# code, config snippets, hashes and encoded blobs flow. Detection covers three
 # egress channels into model context:
 #   1. Read/Grep of secret files (.env*, *.pem, id_rsa, credentials.json, ...)
 #   2. Bash commands that dump secrets (cat .env, bare `env`, curl -u user:pass,
 #      URL-embedded credentials, any high-confidence token in the command text)
-#   3. UserPromptSubmit prompt text containing high-confidence secret patterns
+#   3. UserPromptSubmit prompt text containing high-confidence secret patterns;
+#      complete machine-generated envelopes are delivered with a redacted advisory
 #
 # FAIL-CLOSED on detection (exit 2). Never echoes the detected value — only a
 # redacted preview plus a truncated sha256 (12 hex chars: enough for the human
@@ -22,17 +26,70 @@
 # Fails open only when there is nothing to scan (malformed stdin, no channel):
 # a broken gate must not brick every session, but every real detection blocks.
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
+# Bounded stdin (H01) — fail-closed overflow: an oversized payload is REFUSED
+# (silent exit 2, nothing staged, nothing echoed). The gate never truncates
+# unknown overflow and never materializes it in a shell variable.
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
+  trap ukit_cleanup_hook_input EXIT
+  ukit_stage_hook_input 2097152 refuse
+  STAGE_RC=$?
+  if [ "$STAGE_RC" -ne 0 ]; then
+    exit "$STAGE_RC"
+  fi
+else
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  if [ "$__ukit_stage_rc" -ne 0 ] || [ "$__ukit_size" -gt 2097152 ]; then
+    # Fail-closed: an unstaged/oversized payload was never inspected
+    # (exit 2 blocks; 1 would be a non-blocking hook error).
+    rm -f "$UKIT_INPUT_FILE"
+    exit 2
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
 
-INPUT="$INPUT" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE'
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE'
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10) || 3000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 const fs = require('fs');
 const path = require('path');
 const { createHash } = require('crypto');
 
+let rawInput = '';
+try { rawInput = fs.readFileSync(process.env.INPUT_FILE || '', 'utf8'); } catch {}
 const payload = (() => {
   try {
-    const parsed = JSON.parse(process.env.INPUT || '');
+    const parsed = JSON.parse(rawInput);
     return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
@@ -76,22 +133,26 @@ function pathAllowed(filePath) {
 }
 
 // --- high-confidence secret value patterns (shared by prompt + bash scanning) ---
+// AKIA/ASIA/AIza prefixes are pure base64-compatible text, so an encoded blob
+// can contain a coincidental key-shaped substring (round-17 live case: ASIA…
+// inside a base64 payload). Those rules must stand alone — no base64/base64url
+// character on either side. Padding "=" is a boundary: it only ends a blob.
 const TOKEN_PATTERNS = [
   { label: 'OpenAI/Anthropic-style API key', re: /\bsk-(?:proj-|ant-|svc-|acct-|admin-)?[A-Za-z0-9_-]{20,}/g },
-  { label: 'AWS access key id', re: /\bAKIA[0-9A-Z]{16}\b/g },
+  { label: 'AWS access key id', re: /(?<![A-Za-z0-9+/_-])(?:AKIA|ASIA)[0-9A-Z]{16}(?![A-Za-z0-9+/_-])/g },
   { label: 'GitHub token', re: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g },
   { label: 'GitHub fine-grained token', re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g },
   { label: 'GitLab token', re: /\bglpat-[A-Za-z0-9_-]{20,}/g },
   { label: 'Slack token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
-  { label: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{20,}/g },
+  { label: 'Google API key', re: /(?<![A-Za-z0-9+/_-])AIza[0-9A-Za-z_-]{20,}(?![A-Za-z0-9+/_-])/g },
   { label: 'Stripe live key', re: /\b[srp]k_live_[A-Za-z0-9]{20,}/g },
   { label: 'JWT', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
   { label: 'private key block', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----/g },
-  { label: 'bearer token', re: /\bBearer\s+[A-Za-z0-9._+/=-]{20,}/gi },
 ];
 
-const ASSIGNMENT_RE = /(^|[^A-Za-z0-9_])(api[_-]?key|apikey|secret[_-]?key|secret|client[_-]?secret|password|passwd|auth[_-]?token|access[_-]?token|token)\s*[:=]\s*["']?([A-Za-z0-9+/_.~-]{16,})/gi;
-
+// No keyword-assignment lane ("password: …", "token = …") on purpose — it was
+// the source of every false positive: it guessed at whatever followed a
+// keyword, blocking code, prose and shell syntax that is never a secret.
 function scanSecretText(text) {
   const found = [];
   for (const { label, re } of TOKEN_PATTERNS) {
@@ -101,11 +162,6 @@ function scanSecretText(text) {
       found.push({ label, value: match[0] });
     }
   }
-  ASSIGNMENT_RE.lastIndex = 0;
-  let match;
-  while ((match = ASSIGNMENT_RE.exec(text)) !== null) {
-    found.push({ label: `${match[2].toLowerCase()} assignment`, value: match[3] });
-  }
   return found;
 }
 
@@ -253,6 +309,32 @@ if (findings.length === 0) {
   process.exit(0);
 }
 
+// --- machine-generated envelope lane (UserPromptSubmit only) ---
+// Harness plumbing (<task-notification>, <system-reminder>,
+// <cross-session-message>) legitimately carries fixture/log content through
+// the prompt channel — test tokens quoted in task bodies, CI logs, agent
+// results. Blocking it silently drops the notification and stalls pipelines
+// ("Waiting for N background agents"). These envelopes flow with a redacted
+// advisory: labels + counts only, never values. Everything a human types —
+// and every other event/channel — stays fail-closed below.
+const MACHINE_ENVELOPE_RE = /^(?:task-notification|system-reminder|cross-session-message)$/i;
+function isCompleteMachineEnvelope(text) {
+  const trimmed = String(text || '').trim();
+  const opening = /^<([a-z-]+)(?:\s[^>]*)?>/i.exec(trimmed);
+  if (!opening || !MACHINE_ENVELOPE_RE.test(opening[1])) return false;
+  const tag = opening[1];
+  const closing = new RegExp(`</${tag}>$`, 'i');
+  return closing.test(trimmed);
+}
+const promptText = textChannels.length > 0 ? textChannels[0].text : null;
+if (event === 'UserPromptSubmit' && promptText && isCompleteMachineEnvelope(promptText)) {
+  const labels = [...new Set(findings.map((f) => f.label))];
+  process.stdout.write(`${JSON.stringify({
+    systemMessage: `UKit sensitive-data gate: ${findings.length} secret-shaped value(s) inside a machine-generated notification (${labels.slice(0, 3).join('; ')}${labels.length > 3 ? '; …' : ''}). Delivered without blocking — treat as fixture/log plumbing, not a typed secret. Never repeat the values in your reply.`,
+  })}\n`);
+  process.exit(0);
+}
+
 // --- block message: redacted previews only, never the secret itself ---
 function describeFinding(finding) {
   const where = finding.preview
@@ -264,8 +346,9 @@ function describeFinding(finding) {
 const lines = [
   `BLOCKED (sensitive data): ${findings.length} potential secret(s) detected. Nothing was sent to the AI.`,
   ...findings.map(describeFinding),
-  'This gate is intentionally strict — it blocks on suspicion so the USER decides.',
-  'To proceed, the USER must choose one of:',
+  'Detection is format-true only: a match must itself be a vendor-formatted key,',
+  'a private key block, a JWT, or a credentials file. Code, prose, hashes and',
+  'encoded blobs are not blocked. To proceed, the USER can choose one of:',
   '  1. Redact the secret (placeholder like <API_KEY>) and retry.',
   '  2. Approve it explicitly: add the full sha256 (shasum -a 256 of the value) or the file path',
   '     to .ukit/storage/security/allowlist.json — that file is protected from AI edits.',

package/templates/.claude/hooks/skill-router.sh

@@ -2,16 +2,63 @@
 # Hook: route prompt/tool signals to the smallest useful installed skill set.
 # Used from UserPromptSubmit and PreToolUse so end users do not need to name skills.
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; the shell var is capped,
+  # env passes only the staged-file path — never the payload.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
+INPUT="$(cat "$UKIT_INPUT_FILE")"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 
 # Internal orchestration envelopes are not user requests. Ignore them before routing or
 # compact-pressure bookkeeping so task results cannot replace the active completion contract.
 case "$INPUT" in
   *"<task-notification"*|*"<tool-result"*|*"<system-reminder"*|*"<local-command-caveat"*)
-    INTERNAL_ORCHESTRATION=$(INPUT="$INPUT" node -e '
+    INTERNAL_ORCHESTRATION=$(INPUT_FILE="$UKIT_INPUT_FILE" node -e '
+// wall-clock watchdog: never let a wedged parse outlive the hook (same arm as the router heredoc below)
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || "", 10) || 3000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 try {
-  const payload = JSON.parse(process.env.INPUT || "{}");
+  const payload = JSON.parse(require("fs").readFileSync(process.env.INPUT_FILE || "", "utf8") || "{}");
   const candidates = [payload?.prompt, payload?.user_prompt, payload?.text, payload?.message, payload?.input]
     .filter((value) => typeof value === "string")
     .map((value) => value.trim());
@@ -44,6 +91,9 @@ esac
 case "$INPUT" in
   *".worktrees/"*)
     if printf '%s' "$INPUT" | node -e '
+// wall-clock watchdog: never let a wedged stdin read outlive the hook (same arm as the router heredoc below)
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || "", 10) || 3000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 const chunks = [];
 process.stdin.on("data", (c) => chunks.push(c));
 process.stdin.on("end", () => {
@@ -79,6 +129,9 @@ THRESHOLD_SCRIPT="$HOOK_DIR/../ukit/runtime/compact-threshold.mjs"
 case "$INPUT" in
   *'"agent_id"'*|*'"agent_type"'*)
     if printf '%s' "$INPUT" | node -e '
+// wall-clock watchdog: never let a wedged stdin read outlive the hook (same arm as the router heredoc below)
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || "", 10) || 3000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 const chunks = [];
 process.stdin.on("data", (c) => chunks.push(c));
 process.stdin.on("end", () => {
@@ -96,7 +149,7 @@ process.stdin.on("end", () => {
     ;;
 esac
 
-INPUT="$INPUT" PROJECT_ROOT="$PROJECT_ROOT" STATE_FILE="$STATE_FILE" HOOK_DIR="$HOOK_DIR" node <<'NODE'
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" STATE_FILE="$STATE_FILE" HOOK_DIR="$HOOK_DIR" node <<'NODE'
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
@@ -2566,7 +2619,8 @@ setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
     return compactState;
   }
 
-  const rawInput = process.env.INPUT || '';
+  let rawInput = '';
+  try { rawInput = fs.readFileSync(process.env.INPUT_FILE || '', 'utf8'); } catch {}
   const projectRoot = process.env.PROJECT_ROOT || process.cwd();
   const statePath = process.env.STATE_FILE || path.join(projectRoot, '.claude', 'ukit', 'skill-router-state.json');
   const routeCachePath = path.join(projectRoot, '.claude', 'ukit', 'route-cache.json');

package/templates/.claude/hooks/stale-spec-guard.sh

@@ -2,7 +2,50 @@
 # PreToolUse hook: prevent stale/ambiguous risky Edit specs and whole-file risky Write.
 # Matched on: Edit|Write
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; the shell var is capped.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
+INPUT="$(cat "$UKIT_INPUT_FILE")"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
 SCRIPT="$PROJECT_ROOT/.claude/ukit/index/stale-spec-check.mjs"
 
@@ -21,6 +64,8 @@ fi
 case "$INPUT" in
   *".worktrees/"*)
     if printf '%s' "$INPUT" | node -e '
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || "", 10) || 3000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 const chunks = [];
 process.stdin.on("data", (c) => chunks.push(c));
 process.stdin.on("end", () => {
@@ -42,4 +87,4 @@ process.stdin.on("end", () => {
     ;;
 esac
 
-printf '%s' "$INPUT" | node "$SCRIPT"
+printf '%s' "$INPUT" | UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" node "$SCRIPT"