@ngockhoale/ukit 2.4.3 → 2.5.1

package/src/core/projectImportant.js

@@ -0,0 +1,433 @@
+/**
+ * projectImportant.js (TASK-037)
+ *
+ * Source-side inspector + deterministic envelope renderer for
+ * PROJECT_IMPORTANT.md per docs/PROJECT_IMPORTANT_SPEC.md §3, §4, §5.2, §6,
+ * §12.1.
+ *
+ * Guarantees:
+ * - Open no-follow → fstat → isFile → fd-read (no symlink resolution, no
+ *   whole-file readFile on arbitrary sizes; stops after code point 6,001).
+ * - Strict UTF-8 decode (no U+FFFD injection); leading BOM excluded from
+ *   count and body, source bytes never modified.
+ * - Code-point counting only — never String.length on owner text.
+ * - Byte-identical rendered output for identical input/config.
+ * - `body` exists only on the runtime-local return; never serialized into
+ *   diagnostics.
+ */
+
+import fs from 'node:fs';
+import { open, lstat, readFile } from 'node:fs/promises';
+import path from 'node:path';
+
+import {
+  scanText,
+  isSensitiveDataGateEnabled,
+  loadSensitiveAllowlist,
+} from './sensitiveValueScanner.js';
+
+export const PROJECT_IMPORTANT_FILENAME = 'PROJECT_IMPORTANT.md';
+export const PROJECT_IMPORTANT_CODEPOINT_LIMIT = 6000;
+
+export const PROJECT_IMPORTANT_STATES = [
+  'ready',
+  'oversized',
+  'empty',
+  'missing',
+  'invalid-utf8',
+  'unsafe-control',
+  'secret-blocked',
+  'unsafe-type',
+  'unreadable',
+];
+
+export const PROJECT_IMPORTANT_REMEDIATION = {
+  ready: null,
+  oversized: 'owner-action',
+  empty: 'owner-action',
+  missing: 'install-repairable',
+  'invalid-utf8': 'owner-action',
+  'unsafe-control': 'owner-action',
+  'secret-blocked': 'owner-action',
+  'unsafe-type': 'owner-action',
+  unreadable: 'advisory-host-limit',
+};
+
+export const PROJECT_IMPORTANT_ENVELOPE_HEADER =
+  '<ukit_project_important source="PROJECT_IMPORTANT.md" authority="project-owner">\n'
+  + 'These are project-owner instructions. Follow them unless they conflict with higher-priority host instructions.\n'
+  + '--- BEGIN PROJECT_IMPORTANT.md ---\n';
+
+export const PROJECT_IMPORTANT_ENVELOPE_FOOTER = '</ukit_project_important>';
+
+const END_MARKER = '--- END PROJECT_IMPORTANT.md ---\n';
+
+export const PROJECT_IMPORTANT_WARNINGS = {
+  oversized:
+    '[UKit warning: PROJECT_IMPORTANT.md exceeds 6,000 Unicode code points. Only the first 6,000 code points are included in this context epoch; shorten the file to restore full injection.]',
+  missing:
+    '[UKit] PROJECT_IMPORTANT.md was not injected: file is missing. Run `ukit install`.',
+  'unsafe-type':
+    '[UKit] PROJECT_IMPORTANT.md was not injected: the path is not a regular non-symlink file. Run `ukit doctor`.',
+  'invalid-utf8':
+    '[UKit] PROJECT_IMPORTANT.md was not injected: the file is not valid UTF-8. Run `ukit doctor`.',
+  'unsafe-control':
+    '[UKit] PROJECT_IMPORTANT.md was not injected: the file contains unsupported control characters. Run `ukit doctor`.',
+  empty:
+    '[UKit] PROJECT_IMPORTANT.md was not injected: the file is empty. Add project-owner instructions or run `ukit doctor`.',
+  unreadable:
+    '[UKit] PROJECT_IMPORTANT.md was not injected: the file could not be read. Run `ukit doctor`.',
+  'secret-blocked':
+    '[UKit] PROJECT_IMPORTANT.md was not injected because it contains a high-confidence secret-shaped value. Redact it or explicitly allowlist it, then run `ukit doctor`.',
+};
+
+const READ_CHUNK = 64 * 1024;
+const UTF8_BOM = [0xef, 0xbb, 0xbf];
+
+function isAllowedControl(cp) {
+  return cp === 0x09 || cp === 0x0a || cp === 0x0d;
+}
+
+function isForbiddenControl(cp) {
+  return (cp < 0x20 && !isAllowedControl(cp)) || (cp >= 0x7f && cp <= 0x9f);
+}
+
+function invalidResult(state) {
+  return {
+    state,
+    body: undefined,
+    codePointCount: 0,
+    oversized: false,
+    bom: false,
+    rendered: PROJECT_IMPORTANT_WARNINGS[state],
+    remediationClass: PROJECT_IMPORTANT_REMEDIATION[state],
+  };
+}
+
+/**
+ * Bounded, strict inspector.
+ *
+ * @param {{ projectRoot: string, config?: object }} options
+ * @returns {Promise<{ state, body?, codePointCount, oversized, bom, rendered, remediationClass }>}
+ */
+export async function inspectProjectImportant(options = {}) {
+  const { projectRoot, config } = options;
+  if (typeof projectRoot !== 'string' || projectRoot.length === 0) {
+    return invalidResult('unreadable');
+  }
+  const target = path.join(projectRoot, PROJECT_IMPORTANT_FILENAME);
+
+  let handle;
+  try {
+    // O_NOFOLLOW where supported: symlinks fail open instead of resolving.
+    const flags = fs.constants.O_RDONLY
+      | (fs.constants.O_NOFOLLOW || 0)
+      | (fs.constants.O_NONBLOCK || 0);
+    handle = await open(target, flags);
+  } catch (err) {
+    if (err && (err.code === 'ENOENT' || err.code === 'ENOTDIR')) {
+      return invalidResult('missing');
+    }
+    if (err && (err.code === 'ELOOP' || err.code === 'EMLINK')) {
+      return invalidResult('unsafe-type');
+    }
+    // Broken symlink surfaces as ENOENT on some platforms only via lstat —
+    // but O_NOFOLLOW gives ELOOP. ENOENT from a symlinked *path* means the
+    // link target is missing; check whether the entry itself is a symlink.
+    if (err && (err.code === 'EACCES' || err.code === 'EPERM')) {
+      return invalidResult('unreadable');
+    }
+    // Platforms without O_NOFOLLOW support, or odd errors: distinguish
+    // symlink/type via lstat before declaring unreadable.
+    try {
+      const lst = await lstat(target);
+      if (!lst.isFile()) return invalidResult('unsafe-type');
+    } catch {
+      return invalidResult('missing');
+    }
+    return invalidResult('unreadable');
+  }
+
+  try {
+    const fst = await handle.stat();
+    if (!fst.isFile()) return invalidResult('unsafe-type');
+
+    // Streamed, bounded strict decode: stop at code point 6,001.
+    const decoder = createStrictDecoder();
+    const buf = Buffer.allocUnsafe(READ_CHUNK);
+    const cps = [];
+    let bom = false;
+    let firstChunk = true;
+    let done = false;
+
+    while (!done) {
+      const { bytesRead } = await handle.read(buf, 0, READ_CHUNK, null);
+      let chunk = buf.subarray(0, bytesRead);
+      if (bytesRead === 0) {
+        decoder.flush(); // throws on truncated trailing sequence
+        done = true;
+        break;
+      }
+      if (firstChunk) {
+        firstChunk = false;
+        if (
+          bytesRead >= 3
+          && chunk[0] === UTF8_BOM[0]
+          && chunk[1] === UTF8_BOM[1]
+          && chunk[2] === UTF8_BOM[2]
+        ) {
+          bom = true;
+          chunk = chunk.subarray(3);
+        }
+      }
+      for (const cp of decoder.decode(chunk)) {
+        cps.push(cp);
+        if (cps.length >= PROJECT_IMPORTANT_CODEPOINT_LIMIT + 1) {
+          done = true;
+          break;
+        }
+      }
+    }
+
+    if (cps.length === 0) {
+      return { ...invalidResult('empty'), bom };
+    }
+
+    const oversized = cps.length > PROJECT_IMPORTANT_CODEPOINT_LIMIT;
+    const injected = oversized ? cps.slice(0, PROJECT_IMPORTANT_CODEPOINT_LIMIT) : cps;
+    for (const cp of injected) {
+      if (isForbiddenControl(cp)) {
+        return { ...invalidResult('unsafe-control'), bom, codePointCount: cps.length };
+      }
+    }
+
+    const body = String.fromCodePoint(...injected);
+    const codePointCount = cps.length;
+
+    // Secret gate on the body that would be injected.
+    const gateEnabled = isSensitiveDataGateEnabled(config);
+    const allowlistHashes = loadSensitiveAllowlist(config);
+    const scan = scanText(body, { allowlistHashes, gateEnabled });
+    if (scan.hasSecret) {
+      return {
+        ...invalidResult('secret-blocked'),
+        bom,
+        codePointCount,
+        oversized,
+      };
+    }
+
+    const inspection = {
+      state: oversized ? 'oversized' : 'ready',
+      body,
+      codePointCount,
+      oversized,
+      bom,
+      rendered: undefined,
+      remediationClass: PROJECT_IMPORTANT_REMEDIATION[oversized ? 'oversized' : 'ready'],
+    };
+    inspection.rendered = renderProjectImportant(inspection);
+    return inspection;
+  } catch (err) {
+    if (err && err.message === 'invalid-utf8') {
+      return invalidResult('invalid-utf8');
+    }
+    if (err && (err.code === 'EACCES' || err.code === 'EPERM')) {
+      return invalidResult('unreadable');
+    }
+    return invalidResult('unreadable');
+  } finally {
+    await handle.close().catch(() => {});
+  }
+}
+
+/**
+ * Strict incremental UTF-8 decoder that rejects overlong, surrogate,
+ * >U+10FFFF and truncated sequences; throws Error('invalid-utf8').
+ */
+function createStrictDecoder() {
+  let needed = 0;
+  let value = 0;
+  let min = 0;
+
+  function push(out, cp, seqMin) {
+    if (cp < seqMin || cp > 0x10ffff || (cp >= 0xd800 && cp <= 0xdfff)) {
+      throw new Error('invalid-utf8');
+    }
+    out.push(cp);
+  }
+
+  return {
+    /** @param {Buffer|Uint8Array} chunk @returns {number[]} */
+    decode(chunk) {
+      const out = [];
+      for (let i = 0; i < chunk.length; i += 1) {
+        const b = chunk[i];
+        if (needed > 0) {
+          if (b < 0x80 || b > 0xbf) throw new Error('invalid-utf8');
+          value = (value << 6) | (b & 0x3f);
+          needed -= 1;
+          if (needed === 0) {
+            push(out, value, min);
+          }
+          continue;
+        }
+        if (b < 0x80) {
+          out.push(b);
+        } else if (b >= 0xc2 && b <= 0xdf) {
+          needed = 1; min = 0x80; value = b & 0x1f;
+        } else if (b >= 0xe0 && b <= 0xef) {
+          needed = 2; min = 0x800; value = b & 0x0f;
+        } else if (b >= 0xf0 && b <= 0xf4) {
+          needed = 3; min = 0x10000; value = b & 0x07;
+        } else {
+          throw new Error('invalid-utf8');
+        }
+      }
+      return out;
+    },
+    flush() {
+      if (needed > 0) throw new Error('invalid-utf8');
+    },
+  };
+}
+
+/**
+ * Deterministic envelope renderer. Warning states render as the frozen
+ * warning literal only; ready/oversized render the full envelope.
+ *
+ * @param {{ state: string, body?: string }} inspection
+ * @returns {string}
+ */
+export function renderProjectImportant(inspection) {
+  const { state, body } = inspection || {};
+  if (state !== 'ready' && state !== 'oversized') {
+    return PROJECT_IMPORTANT_WARNINGS[state] || PROJECT_IMPORTANT_WARNINGS.unreadable;
+  }
+  const warning = state === 'oversized'
+    ? PROJECT_IMPORTANT_WARNINGS.oversized + '\n'
+    : '';
+  // Framing newline outside the body: body bytes are preserved verbatim,
+  // the END marker always starts on its own line.
+  const framing = body.endsWith('\n') ? '' : '\n';
+  return (
+    PROJECT_IMPORTANT_ENVELOPE_HEADER
+    + body
+    + framing
+    + END_MARKER
+    + warning
+    + PROJECT_IMPORTANT_ENVELOPE_FOOTER
+  );
+}
+
+/**
+ * Convenience: inspect + ensure `rendered` is populated.
+ *
+ * @param {string} projectRoot
+ * @param {{ config?: object }} [options]
+ */
+export async function renderProjectImportantForProject(projectRoot, options = {}) {
+  const inspection = await inspectProjectImportant({ projectRoot, ...options });
+  if (inspection.rendered === undefined) {
+    inspection.rendered = renderProjectImportant(inspection);
+  }
+  return inspection;
+}
+
+/**
+ * TASK-044 — adapter wiring facts for status/doctor (spec §13/§14).
+ *
+ * Returns install + wiring facts only — never file bodies. Claude wiring is
+ * always expected; omp/Codex/OpenCode are checked only when installed, and an
+ * absent adapter is `installed:false`, never a failure.
+ *
+ * @param {string} projectRoot
+ * @param {{ trackedPaths?: string[] }} [options] install.json file list, if known
+ * @returns {Promise<{claude: object, omp: object, codex: object, opencode: object, agentsFallback: boolean}>}
+ */
+export async function inspectProjectImportantWiring(projectRoot, options = {}) {
+  const trackedPaths = Array.isArray(options.trackedPaths) ? options.trackedPaths : [];
+  const tracked = (prefix) => trackedPaths.some((entry) => entry.startsWith(prefix));
+
+  const runtimeModulePath = path.join(projectRoot, '.claude', 'ukit', 'runtime', 'project-important.mjs');
+  const hookPath = path.join(projectRoot, '.claude', 'hooks', 'project-important.sh');
+  const settingsPath = path.join(projectRoot, '.claude', 'settings.json');
+  const ompBridgePath = path.join(projectRoot, '.omp', 'hooks', 'pre', 'ukit-bridge.js');
+  const agentsPath = path.join(projectRoot, 'AGENTS.md');
+
+  const exists = async (p) => {
+    try {
+      await lstat(p);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+
+  // --- Claude wiring (always expected) ---
+  const runtimeModule = await exists(runtimeModulePath);
+  let hookInstalled = false;
+  let hookExecutable = false;
+  try {
+    const st = await lstat(hookPath);
+    hookInstalled = st.isFile();
+    hookExecutable = hookInstalled && (st.mode & 0o111) !== 0;
+  } catch {
+    // absent
+  }
+  let settingsWired = false;
+  try {
+    const raw = await readFile(settingsPath, 'utf8');
+    const settings = JSON.parse(raw);
+    const sessionStart = Array.isArray(settings?.hooks?.SessionStart) ? settings.hooks.SessionStart : [];
+    const commands = sessionStart.flatMap((entry) => (
+      Array.isArray(entry?.hooks) ? entry.hooks.map((h) => String(h?.command ?? '')) : []
+    ));
+    const idx = commands.findIndex((cmd) => cmd.includes('project-important.sh'));
+    settingsWired = idx === 0;
+  } catch {
+    settingsWired = false;
+  }
+  const claude = {
+    installed: true,
+    runtimeModule,
+    hookInstalled,
+    hookExecutable,
+    settingsWired,
+    wired: runtimeModule && hookInstalled && hookExecutable && settingsWired,
+  };
+
+  // --- AGENTS.md owner-instructions pointer (shared Codex/OpenCode fallback) ---
+  let agentsFallback = false;
+  try {
+    const agents = await readFile(agentsPath, 'utf8');
+    agentsFallback = agents.includes('Project Owner Instructions')
+      && agents.includes(PROJECT_IMPORTANT_FILENAME);
+  } catch {
+    agentsFallback = false;
+  }
+
+  // --- omp bridge (only when omp installed/tracked) ---
+  const ompBridgeExists = await exists(ompBridgePath);
+  const ompInstalled = tracked('.omp/') || ompBridgeExists || await exists(path.join(projectRoot, '.omp', 'config.yml'));
+  let ompWired = false;
+  if (ompInstalled && ompBridgeExists) {
+    try {
+      const bridge = await readFile(ompBridgePath, 'utf8');
+      ompWired = /session_start\s*:\s*\[\s*['"]project-important\.sh/.test(bridge);
+    } catch {
+      ompWired = false;
+    }
+  }
+  const omp = { installed: ompInstalled, wired: ompInstalled && ompWired };
+
+  // --- Codex fallback (only when adapter installed) ---
+  const codexInstalled = tracked('.codex/') || await exists(path.join(projectRoot, '.codex', 'settings.json'));
+  const codex = { installed: codexInstalled, wired: codexInstalled && agentsFallback };
+
+  // --- OpenCode fallback (only when opencode.json tracked/installed) ---
+  const opencodeInstalled = tracked('opencode.json') || await exists(path.join(projectRoot, 'opencode.json'));
+  const opencode = { installed: opencodeInstalled, wired: opencodeInstalled && agentsFallback };
+
+  return { claude, omp, codex, opencode, agentsFallback };
+}

package/src/core/sensitiveValueScanner.js

@@ -0,0 +1,118 @@
+/**
+ * sensitiveValueScanner.js (TASK-036)
+ *
+ * Shared source-side extraction of the high-confidence secret *value* scanner
+ * that lives in templates/.claude/hooks/sensitive-data-guard.sh. One semantic
+ * implementation is consumed by the runtime hook mirror (TASK-038/039) and the
+ * PROJECT_IMPORTANT.md renderer (TASK-037).
+ *
+ * Scope is the value scanner only: vendor/API-key patterns, JWT, private-key
+ * block, SHA-256 exact-value allowlist matching, and the
+ * security.sensitiveDataGate config read. File/path classification and Bash
+ * command-shape logic stay in the hook.
+ *
+ * Leak-safety contract: return values carry labels only — never a secret
+ * value, prefix, suffix, excerpt, or hash of a matched secret.
+ */
+
+import { createHash } from 'node:crypto';
+
+function sha256(value) {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+// --- high-confidence secret value patterns ---
+// Semantically identical to TOKEN_PATTERNS in sensitive-data-guard.sh.
+// AKIA/ASIA/AIza prefixes are pure base64-compatible text, so an encoded blob
+// can contain a coincidental key-shaped substring — those rules must stand
+// alone with no base64/base64url character on either side.
+const TOKEN_PATTERNS = [
+  { label: 'OpenAI/Anthropic-style API key', re: /\bsk-(?:proj-|ant-|svc-|acct-|admin-)?[A-Za-z0-9_-]{20,}/g },
+  { label: 'AWS access key id', re: /(?<![A-Za-z0-9+/_-])(?:AKIA|ASIA)[0-9A-Z]{16}(?![A-Za-z0-9+/_-])/g },
+  { label: 'GitHub token', re: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g },
+  { label: 'GitHub fine-grained token', re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g },
+  { label: 'GitLab token', re: /\bglpat-[A-Za-z0-9_-]{20,}/g },
+  { label: 'Slack token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
+  { label: 'Google API key', re: /(?<![A-Za-z0-9+/_-])AIza[0-9A-Za-z_-]{20,}(?![A-Za-z0-9+/_-])/g },
+  { label: 'Stripe live key', re: /\b[srp]k_live_[A-Za-z0-9]{20,}/g },
+  { label: 'JWT', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+  { label: 'private key block', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----/g },
+];
+
+const SHA256_HEX_RE = /^[0-9a-f]{64}$/i;
+
+/**
+ * Scan text for high-confidence secret values.
+ *
+ * @param {string} text
+ * @param {{ allowlistHashes?: string[], gateEnabled?: boolean }} [options]
+ *   allowlistHashes: SHA-256 hex digests of explicitly approved exact values.
+ *   gateEnabled: pass isSensitiveDataGateEnabled(config); when false the scan
+ *   reports the gate's exit-0 semantics (no detection) like today's hook.
+ * @returns {{ hasSecret: boolean, allowed: boolean, labels: string[] }}
+ *   labels only — never values, excerpts, or hashes.
+ */
+export function scanText(text, options = {}) {
+  const { allowlistHashes = [], gateEnabled = true } = options || {};
+  const clean = { hasSecret: false, allowed: false, labels: [] };
+  if (gateEnabled === false) return clean;
+  if (typeof text !== 'string' || text.length === 0) return clean;
+
+  const allowed = new Set(
+    Array.isArray(allowlistHashes) ? allowlistHashes.filter((h) => typeof h === 'string') : [],
+  );
+
+  const labels = new Set();
+  let sawAllowlisted = false;
+  for (const { label, re } of TOKEN_PATTERNS) {
+    re.lastIndex = 0;
+    let match;
+    while ((match = re.exec(text)) !== null) {
+      if (allowed.has(sha256(match[0]))) {
+        sawAllowlisted = true;
+        continue;
+      }
+      labels.add(label);
+    }
+  }
+
+  if (labels.size === 0) {
+    return { hasSecret: false, allowed: sawAllowlisted, labels: [] };
+  }
+  return { hasSecret: true, allowed: false, labels: [...labels] };
+}
+
+/**
+ * Gate toggle: enabled unless security.sensitiveDataGate === false
+ * (mirrors the hook's explicit-false check on .ukit/storage/config.json).
+ *
+ * @param {object|null|undefined} config injected config object
+ * @returns {boolean}
+ */
+export function isSensitiveDataGateEnabled(config) {
+  if (config && config.security && config.security.sensitiveDataGate === false) {
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Load the SHA-256 exact-value allowlist from an injected config object.
+ * Accepts security.allowlist.values (mirror of allowlist.json) or
+ * security.sensitiveDataAllowlist; keeps only well-formed 64-hex digests.
+ *
+ * @param {object|null|undefined} config
+ * @returns {string[]} SHA-256 hex digests
+ */
+export function loadSensitiveAllowlist(config) {
+  if (!config || typeof config !== 'object') return [];
+  const security = config.security && typeof config.security === 'object' ? config.security : {};
+  const candidates = [];
+  if (security.allowlist && Array.isArray(security.allowlist.values)) {
+    candidates.push(...security.allowlist.values);
+  }
+  if (Array.isArray(security.sensitiveDataAllowlist)) {
+    candidates.push(...security.sensitiveDataAllowlist);
+  }
+  return candidates.filter((v) => typeof v === 'string' && SHA256_HEX_RE.test(v));
+}

package/src/core/status.js

@@ -7,6 +7,7 @@ import { buildPromptCacheStats } from './token/index.js';
 import { countMemoryItems } from './memory/store.js';
 import { buildCompactPressureState } from './compact/threshold.js';
 import { detectProjectContext } from '../context/detectProjectContext.js';
+import { inspectProjectImportant, inspectProjectImportantWiring } from './projectImportant.js';
 
 function formatPrimaryAgent(agentKey) {
   if (agentKey === 'claude-code') return 'Claude Code';
@@ -151,6 +152,29 @@ export async function buildStatusReport(projectRoot) {
   const memoryCounts = await countMemoryItems(projectRoot);
   const adapters = await detectAdapterLabels(projectRoot, config.agent);
 
+  // TASK-044 — typed projectImportant state + conditional adapter wiring (spec §13).
+  const installMeta = await readStatusJson(
+    path.join(projectRoot, '.claude', 'ukit', '.ukit', 'install.json'),
+  );
+  const trackedPaths = Array.isArray(installMeta?.files)
+    ? installMeta.files
+      .map((entry) => (typeof entry === 'string' ? entry : entry?.p))
+      .filter((entry) => typeof entry === 'string')
+    : [];
+  const piInspection = await inspectProjectImportant({ projectRoot, config });
+  const piWiring = await inspectProjectImportantWiring(projectRoot, { trackedPaths });
+  const projectImportant = {
+    state: piInspection.state,
+    codePointCount: piInspection.codePointCount,
+    oversized: piInspection.oversized,
+    wiring: {
+      claude: piWiring.claude.wired,
+      omp: piWiring.omp.installed ? piWiring.omp.wired : undefined,
+      codex: piWiring.codex.installed ? piWiring.codex.wired : undefined,
+      opencode: piWiring.opencode.installed ? piWiring.opencode.wired : undefined,
+    },
+  };
+
   return {
     version: config.version,
     projectName: projectContext.project.name,
@@ -176,14 +200,43 @@ export async function buildStatusReport(projectRoot) {
     ),
     defaultModel: config.router.defaultModel,
     advisorEnabled: Boolean(config.router.advisorEnabled),
+    projectImportant,
   };
 }
 
+const PROJECT_IMPORTANT_STATE_LABELS = {
+  ready: (pi) => `ready / ${pi.codePointCount.toLocaleString('en-US')} of 6,000 code points`,
+  oversized: () => 'oversized / >6,000 code points / injects first 6,000',
+  empty: () => 'empty / not injected',
+  missing: () => 'missing / not injected',
+  'invalid-utf8': () => 'invalid UTF-8 / not injected',
+  'unsafe-control': () => 'unsupported control characters / not injected',
+  'secret-blocked': () => 'secret-blocked / not injected',
+  'unsafe-type': () => 'unsafe symlink / not injected',
+  unreadable: () => 'unreadable / not injected',
+};
+
+function formatProjectImportantRules(pi) {
+  const formatter = PROJECT_IMPORTANT_STATE_LABELS[pi?.state] ?? (() => 'unreadable / not injected');
+  return formatter(pi);
+}
+
+function formatProjectImportantWiring(pi) {
+  const mark = (wired) => (wired ? '✓' : '✗');
+  const parts = [`Claude runtime ${mark(pi.wiring.claude)}`];
+  if (pi.wiring.omp !== undefined) parts.push(`omp runtime ${mark(pi.wiring.omp)}`);
+  if (pi.wiring.codex !== undefined) parts.push(`Codex fallback ${mark(pi.wiring.codex)}`);
+  if (pi.wiring.opencode !== undefined) parts.push(`OpenCode fallback ${mark(pi.wiring.opencode)}`);
+  return parts.join(' / ');
+}
+
 export function formatStatusReport(report) {
   return [
     `UKit v${report.version} — Status`,
     '─────────────────────',
     `${padLabel('Project')} ${report.projectName}`,
+    `${padLabel('Project rules')} ${formatProjectImportantRules(report.projectImportant)}`,
+    `${padLabel('Rule wiring')} ${formatProjectImportantWiring(report.projectImportant)}`,
     `${padLabel('Adapters')} ${report.adapters.join(', ')}`,
     `${padLabel('Memory items')} ${report.memoryCounts.projectCount} project / ${report.memoryCounts.sessionCount} session / ${report.memoryCounts.userCount} user`,
     `${padLabel('Last compact')} ${report.lastCompact}`,
@@ -191,7 +244,8 @@ export function formatStatusReport(report) {
     `${padLabel('Compact lanes')} ${report.compactLanes}`,
     `${padLabel('Ctx pressure')} ${report.contextPressure}`,
     `${padLabel('Threshold cmp')} ${report.thresholdCompact}`,
-    `${padLabel('Prompt cache')} ${report.promptCache}`,
+    `${padLabel('Local p-cache')} ${report.promptCache}`,
+    `${padLabel('Provider cache')} unknown (host telemetry unavailable)`,
     `${padLabel('Cache lanes')} ${report.cacheLanes}`,
     `${padLabel('Output comp.')} ${report.outputCompression}`,
     `${padLabel('Output lanes')} ${report.outputLanes}`,