@ngockhoale/ukit 2.6.0 → 2.6.3

package/templates/.omp/hooks/pre/ukit-bridge.js

@@ -47,6 +47,7 @@ export const HOOK_EVENT_MAP = {
       'sensitive-data-guard.sh',
       'handoff-model-guard.sh',
       'context-hardcap-gate.sh',
+      'verification-guard.sh',
     ],
   },
   tool_result: {
@@ -102,6 +103,7 @@ export const FAIL_CLOSED_SCRIPTS = new Set([
 
 export const ADVISORY_SCRIPTS = new Set([
   'skill-router.sh',
+  'verification-guard.sh',
   'record-execution.sh',
   'auto-allow-bash.sh',
   'pre-edit-backup.sh',
@@ -331,17 +333,122 @@ export { translateExecResult };
 // 30s cap that silently disagreed with the runner whenever the env knobs were set.
 const chainExecTimeoutMs = resolveChainExecTimeoutMs;
 
-function recordHookErrorDiagnostic(projectRoot, sessionId, diagnostic) {
+// BUG-C21-09 (FR-006): hook-errors/ used to append one JSONL row per chain
+// transport error with no byte cap, no rotation, and no sweep — files grew per
+// session forever. Per-file cap mirrors hook-telemetry's <=512KB rotate; the
+// directory sweep is bounded (<= maxEntries stats, <= maxRemovals unlinks) and
+// sampled (~1/16 writes, UKIT_HOOK_ERRORS_SWEEP_PROBABILITY to force/disable).
+const HOOK_ERROR_MAX_BYTES = 512 * 1024;
+const HOOK_ERROR_SWEEP_PROBABILITY_DEFAULT = 1 / 16;
+const HOOK_ERROR_SWEEP_MAX_ENTRIES = 128;
+const HOOK_ERROR_SWEEP_MAX_REMOVALS = 64;
+const HOOK_ERROR_MAX_FILES = 200;
+const HOOK_ERROR_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1000;
+
+function hookErrorsDirFor(projectRoot) {
+  return path.join(projectRoot, '.ukit', 'storage', 'cache', 'hook-errors');
+}
+
+// Bounded work on THIS session's file only — identical keep-newest-half shape
+// as hook-telemetry's rotateIfNeeded.
+function rotateHookErrorFileIfNeeded(filePath, incomingBytes, maxBytes) {
+  let size = 0;
+  try {
+    size = fs.statSync(filePath).size;
+  } catch {
+    return; // first row for this session
+  }
+  if (size + incomingBytes <= maxBytes) return;
+  try {
+    const lines = fs.readFileSync(filePath, 'utf8').split('\n');
+    if (lines.length && lines[lines.length - 1] === '') lines.pop();
+    const keepBudget = Math.floor(maxBytes / 2);
+    const keep = [];
+    let kept = 0;
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const lineBytes = Buffer.byteLength(lines[i], 'utf8') + 1;
+      if (kept + lineBytes > keepBudget) break;
+      keep.unshift(lines[i]);
+      kept += lineBytes;
+    }
+    fs.writeFileSync(filePath, keep.length ? `${keep.join('\n')}\n` : '', 'utf8');
+  } catch {
+    // Rotation failed; drop this row rather than grow past the cap.
+  }
+}
+
+// sweepHookErrorsDir(dir, {now, maxAgeMs, maxFiles, maxEntries, maxRemovals}) ->
+//   { scanned, removed } — bounded: never scans or removes more than the caps,
+// so a pre-existing oversized dir is amortized down across sampled sweeps.
+function sweepHookErrorsDir(dir, {
+  now = Date.now,
+  maxAgeMs = HOOK_ERROR_MAX_AGE_MS,
+  maxFiles = HOOK_ERROR_MAX_FILES,
+  maxEntries = HOOK_ERROR_SWEEP_MAX_ENTRIES,
+  maxRemovals = HOOK_ERROR_SWEEP_MAX_REMOVALS,
+} = {}) {
+  let names;
+  try {
+    names = fs.readdirSync(dir);
+  } catch {
+    return { scanned: 0, removed: 0 };
+  }
+  const cutoff = now() - maxAgeMs;
+  const entries = [];
+  let scanned = 0;
+  for (const name of names) {
+    if (scanned >= maxEntries) break;
+    scanned += 1;
+    if (!name.endsWith('.jsonl')) continue;
+    try {
+      const stats = fs.statSync(path.join(dir, name));
+      if (stats.isFile()) entries.push({ name, mtimeMs: stats.mtimeMs });
+    } catch { /* raced away — fine */ }
+  }
+  entries.sort((a, b) => a.mtimeMs - b.mtimeMs); // oldest first
+  // Overflow counts eligible FILES only — foreign entries (non-matching names,
+  // dirs) inflate `names.length` and would evict real entries while the dir is
+  // actually under the cap.
+  const overflow = Math.max(0, entries.length - maxFiles);
+  let removed = 0;
+  for (const entry of entries) {
+    if (removed >= maxRemovals) break;
+    if (removed < overflow || entry.mtimeMs < cutoff) {
+      try {
+        fs.rmSync(path.join(dir, entry.name), { force: true });
+        removed += 1;
+      } catch { /* raced away — fine */ }
+    }
+  }
+  return { scanned, removed };
+}
+
+function hookErrorsSweepProbabilityFromEnv() {
+  const raw = Number(process.env.UKIT_HOOK_ERRORS_SWEEP_PROBABILITY);
+  if (!Number.isFinite(raw)) return HOOK_ERROR_SWEEP_PROBABILITY_DEFAULT;
+  return Math.min(1, Math.max(0, raw));
+}
+
+function recordHookErrorDiagnostic(projectRoot, sessionId, diagnostic, { maxBytes = HOOK_ERROR_MAX_BYTES } = {}) {
   try {
-    const dir = path.join(projectRoot, '.ukit', 'storage', 'cache', 'hook-errors');
+    const dir = hookErrorsDirFor(projectRoot);
     fs.mkdirSync(dir, { recursive: true });
     const safeSession = String(sessionId || 'unknown').replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 96) || 'unknown';
-    fs.appendFileSync(path.join(dir, `${safeSession}.jsonl`), `${JSON.stringify(diagnostic)}\n`, 'utf8');
+    const filePath = path.join(dir, `${safeSession}.jsonl`);
+    const line = `${JSON.stringify(diagnostic)}\n`;
+    rotateHookErrorFileIfNeeded(filePath, Buffer.byteLength(line, 'utf8'), maxBytes);
+    fs.appendFileSync(filePath, line, 'utf8');
+    // Sampled bounded dir sweep — amortizes down any pre-existing oversized dir.
+    if (Math.random() < hookErrorsSweepProbabilityFromEnv()) {
+      sweepHookErrorsDir(dir);
+    }
   } catch {
     // Diagnostics are advisory and must never block or throw.
   }
 }
 
+export { recordHookErrorDiagnostic, sweepHookErrorsDir };
+
 // Cached across the omp process lifetime: resolution below spawns a probe process, and every
 // tool call would otherwise pay that cost again.
 let cachedNodeExecutable = null;

package/templates/ukit/storage/config.json

@@ -329,6 +329,7 @@
         "skill-routing-needed",
         "step-budget-enough",
         "compact-now-or-later",
+        "codex-context-budget",
         "summarize-docs-or-keep-detail"
       ],
       "stepBudgets": {