@ngockhoale/ukit 2.6.11 → 2.7.0

package/templates/.claude/settings.json

@@ -57,8 +57,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.sh\"",
-            "timeout": 8
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.sh\":8",
+            "timeout": 18
           }
         ]
       },
@@ -67,33 +67,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/protect-files.sh\"",
-            "timeout": 8
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/stale-spec-guard.sh\"",
-            "timeout": 11
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/pre-edit-backup.sh\"",
-            "timeout": 8
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/skill-router.sh\"",
-            "timeout": 20
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\"",
-            "timeout": 8
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/context-hardcap-gate.sh\"",
-            "timeout": 8
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/protect-files.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/stale-spec-guard.sh\":11 \"$CLAUDE_PROJECT_DIR/.claude/hooks/pre-edit-backup.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/skill-router.sh\":20 \"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/context-hardcap-gate.sh\":8",
+            "timeout": 73
           }
         ]
       },
@@ -102,33 +77,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-allow-bash.sh\"",
-            "timeout": 15
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/block-dangerous.sh\"",
-            "timeout": 8
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.sh\"",
-            "timeout": 8
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\"",
-            "timeout": 8
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/context-hardcap-gate.sh\"",
-            "timeout": 8
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/verification-guard.sh\"",
-            "timeout": 8
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-allow-bash.sh\":15 \"$CLAUDE_PROJECT_DIR/.claude/hooks/block-dangerous.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/context-hardcap-gate.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/verification-guard.sh\":8",
+            "timeout": 65
           }
         ]
       }
@@ -139,8 +89,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/record-execution.sh\"",
-            "timeout": 8
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/record-execution.sh\":8",
+            "timeout": 18
           }
         ]
       },
@@ -149,18 +99,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/post-edit-verify.sh\"",
-            "timeout": 8
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/record-execution.sh\"",
-            "timeout": 8
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/task-watchdog.sh\"",
-            "timeout": 8
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/post-edit-verify.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/record-execution.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/task-watchdog.sh\":8",
+            "timeout": 34
           }
         ]
       },
@@ -169,13 +109,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/compress-output.sh\"",
-            "timeout": 12
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/record-execution.sh\"",
-            "timeout": 8
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/compress-output.sh\":12 \"$CLAUDE_PROJECT_DIR/.claude/hooks/record-execution.sh\":8",
+            "timeout": 30
           }
         ]
       }
@@ -185,23 +120,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.sh\"",
-            "timeout": 8
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/skill-router.sh\"",
-            "timeout": 20
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/vision-router.sh\"",
-            "timeout": 12
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/context-window-guard.sh\"",
-            "timeout": 10
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/skill-router.sh\":20 \"$CLAUDE_PROJECT_DIR/.claude/hooks/vision-router.sh\":12 \"$CLAUDE_PROJECT_DIR/.claude/hooks/context-window-guard.sh\":10",
+            "timeout": 60
           }
         ]
       }
@@ -211,8 +131,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/completion-gate.sh\"",
-            "timeout": 8
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/completion-gate.sh\":8",
+            "timeout": 18
           }
         ]
       }
@@ -222,8 +142,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/reinject-context.sh\"",
-            "timeout": 8
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/reinject-context.sh\":8",
+            "timeout": 18
           }
         ]
       }
@@ -233,23 +153,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/project-important.sh\"",
-            "timeout": 8
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-prune-bash.sh\"",
-            "timeout": 12
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/reset-compact-pressure.sh\"",
-            "timeout": 12
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-resume.sh\"",
-            "timeout": 8
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/project-important.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-prune-bash.sh\":12 \"$CLAUDE_PROJECT_DIR/.claude/hooks/reset-compact-pressure.sh\":12 \"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-resume.sh\":8",
+            "timeout": 50
           }
         ]
       }
@@ -259,8 +164,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/session-episode.sh\"",
-            "timeout": 8
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/session-episode.sh\":8",
+            "timeout": 18
           }
         ]
       }

package/templates/.claude/ukit/runtime/hook-chain-runner.mjs

@@ -14,7 +14,9 @@ import { appendTelemetryRow, TELEMETRY_VERSION } from './hook-telemetry.mjs';
 // disagree. Kept as a per-run resolution (not module constants) so an operator's
 // env change is honored without a reimport.
 import {
+  resolveChainBaseBudgetMs,
   resolveChainBudgetMs,
+  resolveChainCeilingMs,
   resolveChainChildBudgetMs,
 } from './hook-chain-budget.mjs';
 
@@ -28,6 +30,41 @@ const FAIL_CLOSED_SCRIPTS = new Set([
 
 const MAX_BUFFER_BYTES = 2 * 1024 * 1024;
 
+// TASK-234 review fix (critical): stdin staging must be bounded. The old
+// `fs.readFileSync(0)` blocked until the producer closed the pipe — a stalled
+// producer held the runner until the settings timeout SIGKILLed it, so every
+// fail-closed gate in the chain silently failed OPEN (no verdict emitted).
+// Bound the read: at most MAX_STDIN_BYTES and at most STDIN_STAGE_MS, then
+// mark the payload degraded so children see the same truncated-input contract
+// hook-input.sh gives them (UKIT_INPUT_TRUNCATED=1 → fail-closed gates deny).
+const MAX_STDIN_BYTES = 2 * 1024 * 1024;
+const STDIN_STAGE_MS = Number(process.env.UKIT_HOOK_STDIN_STAGE_MS || 2000);
+
+async function readStdinBounded() {
+  return new Promise((resolve) => {
+    const chunks = [];
+    let bytes = 0;
+    let settled = false;
+    const finish = (truncated) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      process.stdin.removeAllListeners();
+      process.stdin.unref?.();
+      resolve({ text: Buffer.concat(chunks).toString('utf8'), truncated });
+    };
+    const timer = setTimeout(() => finish(true), STDIN_STAGE_MS);
+    process.stdin.on('data', (chunk) => {
+      chunks.push(chunk);
+      bytes += chunk.length;
+      if (bytes > MAX_STDIN_BYTES) finish(true);
+    });
+    process.stdin.on('end', () => finish(false));
+    process.stdin.on('error', () => finish(true));
+    process.stdin.resume();
+  });
+}
+
 // TASK-018 failure taxonomy (chain level; distinct from hook-process.mjs's
 // process-level kinds). Overflow, timeout, signal, and exit-code failures are
 // distinct values so downstream consumers never have to guess:
@@ -58,8 +95,24 @@ function recordTiming(projectRoot, payload, timing) {
   // appendTelemetryRow carries the same posture (and the per-session cap).
   appendTelemetryRow(projectRoot, payload?.session_id, timing);
 }
+// TASK-234: a script arg may carry a per-script timeout suffix `<path>:<seconds>`
+// so consolidated settings.json chains keep each hook's original settings.json
+// `timeout` instead of sharing one child budget. The suffix is stripped before
+// the path is used; absent → resolveChainChildBudgetMs() fallback, unchanged.
+// A `:0` or negative suffix is rejected (falls back) — zero would mean "no
+// budget", which silently disables the deadline; that is never a valid hook
+// contract.
+function parseScriptArg(arg) {
+  const match = /^(.*):(\d+(?:\.\d+)?)$/.exec(arg || '');
+  if (!match) return { scriptPath: arg, timeoutMs: null };
+  const seconds = Number(match[2]);
+  if (!Number.isFinite(seconds) || seconds <= 0) return { scriptPath: arg, timeoutMs: null };
+  return { scriptPath: match[1], timeoutMs: Math.round(seconds * 1000) };
+}
 
-async function run(payloadText, scriptPaths) {
+async function run(payloadText, scriptArgs, { chainMarker = true } = {}) {
+  const parsedArgs = scriptArgs.map(parseScriptArg);
+  const scriptPaths = parsedArgs.map((a) => a.scriptPath);
   const payload = JSON.parse(payloadText || '{}');
   const firstScript = scriptPaths[0] || '';
   const projectRoot = firstScript
@@ -71,13 +124,41 @@ async function run(payloadText, scriptPaths) {
   // (UserPromptSubmit now carries 4 hooks). The floor keeps short chains at 10s,
   // and TASK-018's explicit ceiling stops the per-chain growth from running away.
   // Resolved per run (not at import) so an env change takes effect immediately.
-  const childBudgetMs = resolveChainChildBudgetMs();
-  const totalBudgetMs = resolveChainBudgetMs(scriptPaths.length);
+  const defaultChildBudgetMs = resolveChainChildBudgetMs();
+  const childBudgetsMs = parsedArgs.map((a) => a.timeoutMs ?? defaultChildBudgetMs);
+  // TASK-234: with per-script budgets the total must cover the SUM of declared
+  // budgets (not count × shared fallback) or a 6-hook Edit chain would be capped
+  // below its own scripts' combined timeouts. When EVERY script declares a
+  // budget the declared sum IS the inner budget — the count×fallback floor
+  // would otherwise exceed the registered outer timeout (PostToolUse Edit|Write:
+  // 3×12s=36s inner vs 34s outer → host kills the runner mid-chain). Mixed
+  // chains keep the floor so undeclared scripts still get the fallback.
+  const declaredTotalMs = childBudgetsMs.reduce((sum, ms) => sum + ms, 0);
+  const allDeclared = parsedArgs.every((a) => a.timeoutMs != null);
+  // TASK-234 review fix (important): the ceiling bounds FALLBACK-driven growth,
+  // never the declared contract — a 52s ceiling clamping a 63s declared sum
+  // starves the last fail-closed gate (context-hardcap-gate) and turns a legal
+  // edit into a block. Only EXPLICIT `:N` budgets raise the ceiling floor —
+  // fallback-filled budgets must not, or bare bridge chains would bypass the
+  // ceiling entirely (ompHookBridge TASK-018 pins that bound).
+  const explicitDeclaredMs = parsedArgs.reduce((sum, a) => sum + (a.timeoutMs ?? 0), 0);
+  const ceilingMs = Math.max(
+    resolveChainCeilingMs(),
+    resolveChainBaseBudgetMs(),
+    explicitDeclaredMs,
+  );
+  const totalBudgetMs = Math.min(
+    allDeclared
+      ? declaredTotalMs
+      : Math.max(resolveChainBudgetMs(scriptPaths.length), declaredTotalMs),
+    ceilingMs,
+  );
   const deadline = startedAt + totalBudgetMs;
   const results = [];
   let budgetExhausted = false;
 
-  for (const scriptPath of scriptPaths) {
+  for (let scriptIndex = 0; scriptIndex < scriptPaths.length; scriptIndex++) {
+    const scriptPath = scriptPaths[scriptIndex];
     const scriptName = path.basename(scriptPath);
     const remainingMs = deadline - Date.now();
     if (remainingMs <= 0) {
@@ -97,9 +178,9 @@ async function run(payloadText, scriptPaths) {
     const childStartedAt = Date.now();
     const result = await runHookProcess({
       command: scriptPath,
+      deadlineMs: Math.min(childBudgetsMs[scriptIndex], remainingMs),
       args: [],
       input: payloadText,
-      deadlineMs: Math.min(childBudgetMs, remainingMs),
       maxBuffer: MAX_BUFFER_BYTES,
       cwd: projectRoot,
       // TASK-223 (HK-401): mark chain-spawned children so their structured
@@ -109,7 +190,10 @@ async function run(payloadText, scriptPaths) {
       env: {
         ...process.env,
         CLAUDE_PROJECT_DIR: projectRoot,
-        UKIT_HOOK_CHAIN_RUNNER: '1',
+        // TASK-234: the marker selects the omp structured-decision contract
+        // (ask + exit 2). Under --emit-verdict the runner replays the direct
+        // Claude contract (deny + exit 0), so children must NOT see it.
+        ...(chainMarker ? { UKIT_HOOK_CHAIN_RUNNER: '1' } : {}),
       },
     });
     const failureKind = chainFailureKind(result);
@@ -139,6 +223,15 @@ async function run(payloadText, scriptPaths) {
     }
   }
 
+  // TASK-234 review fix (critical): a mid-chain break (killed advisory, budget
+  // exhausted, or a fail-closed non-zero) leaves later scripts unrun. When any
+  // of those unrun scripts is fail-closed, the chain must fail CLOSED — the old
+  // per-script path ran every hook independently, so a timed-out advisory never
+  // skipped a gate. `skippedFailClosed` carries that signal to the verdict.
+  const skippedFailClosed = scriptPaths
+    .slice(results.length)
+    .some((p) => FAIL_CLOSED_SCRIPTS.has(path.basename(p)));
+
   const elapsedMs = Date.now() - startedAt;
   // TASK-019: versioned rows shared with direct hooks. `outcome` reuses this
   // runner's own failure taxonomy — the aggregate of the worst child result —
@@ -165,23 +258,137 @@ async function run(payloadText, scriptPaths) {
     })),
   });
 
-  return { results, elapsedMs, budgetMs: totalBudgetMs, budgetExhausted };
+  return { results, elapsedMs, budgetMs: totalBudgetMs, budgetExhausted, skippedFailClosed };
 }
 
 try {
-  const [, , payloadArg = '{}', ...scriptPaths] = process.argv;
+  let argv = process.argv.slice(2);
+  // TASK-234: `--emit-verdict` adapts the runner for Claude Code settings.json
+  // hooks, where the command's own stdout/exit-code IS the verdict — not the
+  // JSON aggregate the omp bridge parses. In this mode the runner replays the
+  // last executed script's stdout verbatim and maps the chain outcome onto the
+  // single-command contract: exit 0 normally; exit 2 + the child's stderr when
+  // a child blocked (code 2) or a FAIL_CLOSED script could not produce a
+  // verdict (killed/error/budget-exhausted). Non-fail-closed transport failures
+  // stay fail-open (exit 0), matching today's per-script behavior where a
+  // timed-out advisory hook never blocks the call.
+  const emitVerdict = argv[0] === '--emit-verdict';
+  if (emitVerdict) argv = argv.slice(1);
+  const [payloadArg = '{}', ...scriptPaths] = argv;
   // The bridge passes the payload as a temp file (`@path`) when it can: argv is capped
   // (~256KB per arg on macOS) and PostToolUse Bash payloads embed whole tool outputs.
   // A leading '@' cannot occur in raw JSON, so the two forms are unambiguous.
+  // '-' reads the payload from stdin — the form Claude Code hook commands use.
   let payloadText = payloadArg;
-  if (payloadArg.startsWith('@')) {
+  let stdinTruncated = false;
+  if (payloadArg === '-') {
+    const staged = await readStdinBounded();
+    payloadText = staged.text;
+    stdinTruncated = staged.truncated;
+  } else if (payloadArg.startsWith('@')) {
     try {
       payloadText = fs.readFileSync(payloadArg.slice(1), 'utf8');
     } catch {
       payloadText = '{}';
     }
   }
-  process.stdout.write(JSON.stringify(await run(payloadText, scriptPaths)));
+  // A truncated stdin means the payload was never fully read — the same
+  // degraded contract hook-input.sh enforces (uninspected input must never be
+  // treated as a clean scan). Children stage their own stdin and cannot see
+  // the runner's truncation, so the runner owns the degraded verdict: when the
+  // chain carries a fail-closed gate, emit deny now instead of letting gates
+  // pass on a payload they never fully received.
+  if (stdinTruncated) {
+    const hasFailClosed = scriptPaths.some((p) =>
+      FAIL_CLOSED_SCRIPTS.has(path.basename(String(p).replace(/:\d+(?:\.\d+)?$/, ''))));
+    if (hasFailClosed) {
+      const deny = JSON.stringify({
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          permissionDecision: 'deny',
+          permissionDecisionReason:
+            'UKit could not fully read this tool-call payload (stdin staging was cut at the deadline/size bound), so the fail-closed gate chain cannot prove it safe.',
+        },
+      });
+      if (emitVerdict) {
+        process.stdout.write(deny);
+        process.exitCode = 0;
+      } else {
+        process.stdout.write(JSON.stringify({
+          results: [],
+          wrapperError: 'stdin staging truncated — fail-closed chain refused',
+          stdinTruncated: true,
+        }));
+        process.exitCode = 2;
+      }
+      process.exit(emitVerdict ? 0 : 2);
+    }
+  }
+  const chain = await run(payloadText, scriptPaths, { chainMarker: !emitVerdict });
+  if (!emitVerdict) {
+    process.stdout.write(JSON.stringify(chain));
+  } else {
+    // TASK-234: a script that emits a hookSpecificOutput decision JSON owns the
+    // verdict even when it exits 0 (the direct Claude contract: deny + exit 0
+    // still blocks). The first decision wins, matching per-script semantics
+    // where each hook's output is its own verdict and a deny short-circuits.
+    const decisionResult = chain.results.find((r) =>
+      typeof r.stdout === 'string' && r.stdout.includes('"hookSpecificOutput"'));
+    const last = decisionResult ?? chain.results[chain.results.length - 1];
+
+    // TASK-234 review fix (critical): context stdout must be REPLAYED, not
+    // dropped. SessionStart/UserPromptSubmit hooks emit plain-text context
+    // (PROJECT_IMPORTANT mandate, skill-router guidance) — replaying only the
+    // decision owner's or last script's stdout loses every earlier emission.
+    // Concatenate every script's non-decision stdout in order, then append the
+    // decision JSON last so the verdict still parses.
+    const contextStdout = chain.results
+      .filter((r) => r !== decisionResult && r !== last && typeof r.stdout === 'string' && r.stdout.length > 0)
+      .map((r) => r.stdout)
+      .join('');
+
+    // TASK-234 review fix (critical): a mid-chain break that skipped a
+    // fail-closed gate must fail CLOSED — the old per-script path ran every
+    // hook independently, so a killed advisory never skipped a gate.
+    if (chain.skippedFailClosed) {
+      if (contextStdout) process.stdout.write(contextStdout);
+      const skipped = scriptPaths
+        .slice(chain.results.length)
+        .map((p) => path.basename(String(p).replace(/:\d+(?:\.\d+)?$/, '')))
+        .filter((name) => FAIL_CLOSED_SCRIPTS.has(name))
+        .join(', ');
+      process.stderr.write(`UKit hook chain broke before fail-closed gate(s) ran: ${skipped}\n`);
+      process.exitCode = 2;
+    } else if (!last) {
+      // No script ran at all (empty chain or budget spent before the first
+      // child). With fail-closed scripts declared in the chain this must not
+      // fail open.
+      const hasFailClosed = scriptPaths.some((p) => FAIL_CLOSED_SCRIPTS.has(path.basename(String(p).replace(/:\d+(?:\.\d+)?$/, ''))));
+      if (hasFailClosed) {
+        process.stderr.write('UKit hook chain produced no verdict — fail-closed gate did not run\n');
+        process.exitCode = 2;
+      }
+    } else {
+      const lastIsFailClosed = FAIL_CLOSED_SCRIPTS.has(last.scriptName);
+      const lastFailedToVerdict = last.killed || last.failureKind === 'error' || last.failureKind === 'budget-exhausted';
+      if (last.code === 2) {
+        if (contextStdout) process.stdout.write(contextStdout);
+        if (last.stdout) process.stdout.write(last.stdout);
+        if (last.stderr) process.stderr.write(last.stderr);
+        process.exitCode = 2;
+      } else if (lastIsFailClosed && lastFailedToVerdict) {
+        if (contextStdout) process.stdout.write(contextStdout);
+        if (last.stderr) process.stderr.write(last.stderr);
+        else process.stderr.write(`UKit fail-closed hook ${last.scriptName} could not produce a verdict (${last.failureKind})\n`);
+        process.exitCode = 2;
+      } else {
+        if (contextStdout) process.stdout.write(contextStdout);
+        if (last.stdout) process.stdout.write(last.stdout);
+        if (last.stderr) process.stderr.write(last.stderr);
+        process.exitCode = last.code === 0 ? 0 : (lastIsFailClosed ? 2 : 0);
+      }
+    }
+  }
 } catch (error) {
   process.stdout.write(JSON.stringify({
     results: [],

package/templates/.claude/ukit/runtime/hook-input.sh

@@ -169,6 +169,125 @@ ukit_emit_input_degraded() {
   exit 0
 }
 
+# TASK-003 (salvage verdicts from truncated payloads): when the staged payload
+# is flagged truncated/stalled, a gated hook may still recover a DECISION-RELEVANT
+# field if that field's value is provably COMPLETE — the closing quote AND a
+# following `,`/`}` boundary must appear before the cut. Anything else (cut
+# inside the string, EOF right after the quote, malformed prefix, missing key)
+# is unrecoverable: callers map that to `deny`, never `ask` (bypassPermissions
+# auto-approves `ask` on the direct host = gates silently skipped).
+#
+# Contract:
+#   ukit_salvage_tool_field <json-file> <dotted-field>
+#     stdout: the decoded string value (single line may contain \n escapes
+#             decoded — the value itself is written raw)
+#     exit 0 — field recovered AND proven complete
+#     exit 3 — unrecoverable / incomplete / malformed / non-string value
+#   Budget: UKIT_SALVAGE_BUDGET_MS (default 3000) bounds the node process; the
+#   file is already capped by staging (≤2MiB), so no unbounded reads.
+#   Single string fields only — this is a salvage step, not a JSON repairer.
+ukit_salvage_tool_field() {
+  UKIT_SALVAGE_FILE="$1" UKIT_SALVAGE_FIELD="$2" \
+  UKIT_SALVAGE_BUDGET_MS="${UKIT_SALVAGE_BUDGET_MS:-3000}" node <<'UKIT_SALVAGE_NODE'
+const budget = Number.parseInt(process.env.UKIT_SALVAGE_BUDGET_MS || '3000', 10) || 3000;
+setTimeout(() => process.exit(3), budget).unref();
+const fs = require('fs');
+const fail = () => process.exit(3);
+let data;
+try {
+  data = fs.readFileSync(process.env.UKIT_SALVAGE_FILE || '', 'utf8');
+} catch {
+  fail();
+}
+const dotted = String(process.env.UKIT_SALVAGE_FIELD || '').split('.').filter(Boolean);
+if (!data || data[0] !== '{' || dotted.length === 0 || dotted.length > 4) fail();
+
+const isWs = (c) => c === ' ' || c === '\t' || c === '\n' || c === '\r';
+const skipWs = (s, i) => { while (i < s.length && isWs(s[i])) i += 1; return i; };
+// End index of the string literal starting at `start` (which must be `"`), or -1
+// when the string is cut before its closing quote.
+const scanStringEnd = (s, start) => {
+  for (let i = start + 1; i < s.length; i += 1) {
+    const c = s[i];
+    if (c === '\\') { i += 1; continue; }
+    if (c === '"') return i;
+  }
+  return -1;
+};
+// Closing brace matching the `{` at `open` (string-aware), or -1 if unclosed.
+const matchBrace = (s, open) => {
+  let depth = 0;
+  for (let i = open; i < s.length; i += 1) {
+    const c = s[i];
+    if (c === '"') {
+      const end = scanStringEnd(s, i);
+      if (end === -1) return -1;
+      i = end;
+      continue;
+    }
+    if (c === '{') depth += 1;
+    else if (c === '}') {
+      depth -= 1;
+      if (depth === 0) return i;
+    }
+  }
+  return -1;
+};
+// Find `"key"` used as an object key inside region [lo, hi); returns the index
+// of its `:` or -1. A bare `"key"` inside a string value cannot produce this
+// shape (its quotes are escaped), and non-key uses lack the `:` — both are
+// skipped by scanning forward.
+const findKey = (s, key, lo, hi) => {
+  const needle = `"${key}"`;
+  let pos = s.indexOf(needle, lo);
+  while (pos !== -1 && pos < hi) {
+    const colon = skipWs(s, pos + needle.length);
+    if (colon < hi && colon < s.length && s[colon] === ':') {
+      const prev = pos - 1;
+      const pc = prev >= 0 ? s[prev] : '';
+      if (prev < 0 || pc === '{' || pc === ',' || isWs(pc)) return colon;
+    }
+    pos = s.indexOf(needle, pos + 1);
+  }
+  return -1;
+};
+
+let regionLo = 0;
+let regionHi = data.length;
+for (let k = 0; k < dotted.length; k += 1) {
+  const colon = findKey(data, dotted[k], regionLo, regionHi);
+  if (colon === -1) fail();
+  const vstart = skipWs(data, colon + 1);
+  if (vstart >= data.length) fail();
+  const last = k === dotted.length - 1;
+  const c = data[vstart];
+  if (!last) {
+    if (c !== '{') fail();
+    const close = matchBrace(data, vstart);
+    // An unclosed parent object still bounds the search to what arrived; the
+    // leaf's own boundary proof below decides completeness.
+    regionLo = vstart + 1;
+    regionHi = close === -1 ? data.length : close;
+    continue;
+  }
+  if (c !== '"') fail(); // string fields only
+  const end = scanStringEnd(data, vstart);
+  if (end === -1) fail(); // cut inside the value — never trust a partial field
+  const after = skipWs(data, end + 1);
+  if (after >= data.length) fail(); // closed quote but no boundary proof — err closed
+  const boundary = data[after];
+  if (boundary !== ',' && boundary !== '}') fail();
+  try {
+    process.stdout.write(JSON.parse(data.slice(vstart, end + 1)));
+  } catch {
+    fail();
+  }
+  process.exit(0);
+}
+fail();
+UKIT_SALVAGE_NODE
+}
+
 ukit_cleanup_hook_input() {
   # TASK-019: emit the telemetry finish marker while the staged payload file
   # still exists (its mtime is the envelope start). Strictly advisory — the