@ngockhoale/ukit 2.4.1 → 2.4.3

package/templates/.claude/hooks/vision-router.sh

@@ -19,19 +19,84 @@
 # every unrelated prompt is the false-positive loop this version exists to kill.
 # A named path that does not resolve from the project root gets a short note only.
 
-INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
+  trap ukit_cleanup_hook_input EXIT
+  # Bounded stdin (H01): stage before anything reads it; Node gets a path, never the payload.
+  ukit_stage_hook_input 2097152 truncate || exit 0
+else
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 2097152 ]; then
+    truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
+fi
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 
-INPUT="$INPUT" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE' || true
-const fs = require('fs');
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE' || true
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10) || 8000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
+const fs = require('fs').promises;
 const path = require('path');
-const { execFileSync } = require('child_process');
+const { spawn } = require('child_process');
 const { pathToFileURL } = require('url');
 
+// TASK-015: a self-deadline can only preempt work that yields to the event
+// loop. The extractor is spawned asynchronously with an abort timer armed
+// strictly BEFORE HOOK_DEADLINE_MS (so the deadline always wins), killed with
+// SIGKILL (no child can ignore it), and every live child is reaped on process
+// exit as a backstop. The old synchronous spawn blocked the loop and made the
+// unref'd watchdog above un-fireable — banned on this hot path.
+const liveChildren = new Set();
+process.on('exit', () => {
+  for (const child of liveChildren) {
+    try { child.kill('SIGKILL'); } catch {}
+  }
+});
+
+// TASK-015 fix round 1: every hot-path fs call is awaited. A synchronous read
+// parks the event loop for the whole syscall, so the unref'd self-deadline above
+// could never fire while a project filesystem stalled.
+async function readTextSafe(filePath) {
+  try { return await fs.readFile(filePath, 'utf8'); } catch { return ''; }
+}
+
 (async () => {
+  const rawInput = await readTextSafe(process.env.INPUT_FILE || '');
   const payload = (() => {
     try {
-      const parsed = JSON.parse(process.env.INPUT || '');
+      const parsed = JSON.parse(rawInput);
       return parsed && typeof parsed === 'object' ? parsed : {};
     } catch {
       return {};
@@ -53,7 +118,7 @@ const { pathToFileURL } = require('url');
   async function detectUnicModeSafe() {
     try {
       const gatewayPath = path.join(projectRoot, '.claude', 'ukit', 'index', 'unic-gateway.mjs');
-      if (!fs.existsSync(gatewayPath)) return null;
+      try { await fs.access(gatewayPath); } catch { return null; }
       const mod = await import(pathToFileURL(gatewayPath).href);
       if (typeof mod.detectUnicGateway !== 'function') return null;
       return !!mod.detectUnicGateway({ rootDir: projectRoot })?.unicMode;
@@ -70,8 +135,9 @@ const { pathToFileURL } = require('url');
   // whose receipt could never be accepted. Only a POSITIVE false short-circuits; null
   // (detection failed) still routes, matching the gate's fail-safe direction.
   //
-  // Cheaper than the old order, too: this replaces an execFileSync node spawn per prompt
-  // with one local import on the overwhelmingly common off-gateway path.
+  // Cheaper than the old order, too: this replaces a synchronous node spawn
+  // per prompt with one local import on the overwhelmingly common off-gateway
+  // path.
   if (unicMode === false) {
     process.exit(0);
   }
@@ -101,7 +167,7 @@ const { pathToFileURL } = require('url');
   // pair) and silently skips it. Kept here as a small inline copy rather than
   // a cross-file import — the contract is a few lines, the cost of drift is
   // small, and the hook must stay self-contained (no module resolution).
-  function stripPathNoise(raw) {
+  async function stripPathNoise(raw) {
     const value = String(raw ?? '').trim();
     if (!value) return value;
     const pairs = { '(': ')', '[': ']', '{': '}', '"': '"', "'": "'" };
@@ -134,7 +200,8 @@ const { pathToFileURL } = require('url');
     for (const c of candidates) {
       if (!c) continue;
       try {
-        if (fs.existsSync(path.resolve(c))) return c;
+        await fs.access(path.resolve(c));
+        return c;
       } catch {
         // ignore
       }
@@ -142,6 +209,56 @@ const { pathToFileURL } = require('url');
     return noSoft !== value ? noSoft : value;
   }
 
+  // TASK-015: async spawn, one settle path per child. The abort timer fires
+  // strictly before the hook deadline (min floor keeps it meaningful if the
+  // deadline is configured tiny) and is unref'd so it never holds the loop
+  // open by itself. Stdout capture is bounded; stream/child errors are absorbed
+  // so an abort racing a child exit settles exactly once with no unhandled
+  // rejection. Any failure degrades to a bounded diagnostic + advisory flow.
+  function runExtractorAsync(args) {
+    return new Promise((resolve, reject) => {
+      let child;
+      try {
+        child = spawn('node', args, { cwd: projectRoot, stdio: ['ignore', 'pipe', 'pipe'] });
+      } catch (err) {
+        reject(err);
+        return;
+      }
+      liveChildren.add(child);
+      let stdout = '';
+      let settled = false;
+      let abortTimer = null;
+      const settle = (err, text) => {
+        if (settled) return;
+        settled = true;
+        if (abortTimer) clearTimeout(abortTimer);
+        liveChildren.delete(child);
+        if (err) reject(err);
+        else resolve(text);
+      };
+      abortTimer = setTimeout(() => {
+        try { child.kill('SIGKILL'); } catch {}
+        settle(new Error(`extractor killed at ${HOOK_DEADLINE_MS}ms hook deadline`));
+      }, Math.max(250, HOOK_DEADLINE_MS - 500));
+      abortTimer.unref();
+      child.stdout.on('error', () => {});
+      child.stderr.on('error', () => {});
+      child.stdout.on('data', (chunk) => {
+        if (stdout.length < 1000000) stdout += chunk; // bounded capture
+      });
+      child.on('error', (err) => settle(err));
+      child.on('close', (code) => {
+        if (code === 0) {
+          settle(null, stdout);
+        } else {
+          settle(new Error(code === null
+            ? 'extractor was killed before exiting'
+            : `extractor exited with code ${code}`));
+        }
+      });
+    });
+  }
+
   const urlMatches = promptText.match(URL_IMAGE_RE) || [];
   const textWithoutUrls = promptText.replace(URL_IMAGE_RE, ' ');
   const localMatches = textWithoutUrls.match(LOCAL_PATH_RE) || [];
@@ -152,7 +269,8 @@ const { pathToFileURL } = require('url');
   // string inside the extractor.
   let extractorJson = null;
   const extractorPath = path.join(projectRoot, '.claude', 'ukit', 'index', 'extract-image.mjs');
-  if (fs.existsSync(extractorPath)) {
+  try {
+    await fs.access(extractorPath);
     const args = [extractorPath, '--detect', '--mark-pending', '--json'];
     if (typeof payload?.transcript_path === 'string' && payload.transcript_path.trim()) {
       args.push('--session', payload.transcript_path.trim());
@@ -164,18 +282,20 @@ const { pathToFileURL } = require('url');
       // Mirror extractor's resolveRefs input contract: the LLM sometimes leaves
       // trailing punctuation/quotes on a path named in a prompt. Clean before
       // handing off so the hook and the extractor agree on the ref string.
-      args.push('--ref', stripPathNoise(ref));
+      args.push('--ref', await stripPathNoise(ref));
     }
+    let out = null;
     try {
-      const out = execFileSync('node', args, {
-        cwd: projectRoot,
-        encoding: 'utf8',
-        timeout: 6000,
-      });
+      out = await runExtractorAsync(args);
       extractorJson = JSON.parse(out);
     } catch (err) {
-      process.stderr.write(`vision-router: extractor call skipped (${err?.message ?? err})\n`);
+      // Bounded diagnostic: the head of whatever the extractor emitted (if
+      // anything) plus the failure reason. Never the whole payload.
+      const head = typeof out === 'string' && out ? `; output head: ${out.slice(0, 200)}` : '';
+      process.stderr.write(`vision-router: extractor call skipped (${err?.message ?? err})${head}\n`);
     }
+  } catch {
+    // Missing extractor is a normal fail-open condition.
   }
 
   // TASK-006 contract: in --mark-pending --json mode `images[]` is the

package/templates/.claude/settings.json

@@ -208,11 +208,6 @@
             "type": "command",
             "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/completion-gate.sh\"",
             "timeout": 4
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/task-watchdog.sh\"",
-            "timeout": 4
           }
         ]
       }