@ngockhoale/ukit 2.7.3 → 2.7.5

package/templates/.claude/hooks/block-dangerous.mjs

@@ -0,0 +1,377 @@
+// block-dangerous.mjs — C40 TASK-003 port of block-dangerous.sh into a
+// dual-mode module (SPEC §FR-006, §8):
+//
+//   * `runHook(ctx)` — in-proc chain step. ctx = { payload, payloadText,
+//     projectRoot, env, deadlineMs, signal } -> { code, stdout, stderr }.
+//     Byte-identical verdicts to the .sh: dangerous pattern / unsafe rm verdict
+//     -> identical permissionDecision JSON + `BLOCKED: <reason>` stderr; safe
+//     command -> code 0 empty. Under the chain marker (UKIT_HOOK_CHAIN_RUNNER)
+//     decisions are `ask` + code 2; on the direct host they are `deny` + code 0
+//     (bypassPermissions auto-approves `ask` — TASK-223/probe verdict).
+//   * `isDirectRun()` CLI mode — the .sh thin wrapper execs
+//     `node block-dangerous.mjs` with the exact env contract the bash glue
+//     produced (INPUT_FILE PROJECT_ROOT UKIT_HOOK_DEADLINE_MS
+//     UKIT_SALVAGE_ACTIVE UKIT_SALVAGED_COMMAND).
+//
+// FAIL-CLOSED gate. The raw command and matched pattern are NEVER echoed —
+// arguments and comments can carry secrets, and the pattern text itself
+// restates the dangerous command. Truncated/degraded input salvages only a
+// provably-complete tool_input.command via ukit/runtime/hook-field-salvage.mjs;
+// anything else refuses `deny` — a partial command is never evaluated.
+
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { salvageField } from '../ukit/runtime/hook-field-salvage.mjs';
+
+export const hookFailClosed = true;
+
+// POSIX [[:space:]] exactly (grep -E semantics; JS \s also matches unicode).
+const SP = '[\\t\\n\\v\\f\\r ]';
+
+// --- byte-pinned verdicts ----------------------------------------------------
+const REASON_DANGEROUS =
+  'Dangerous command pattern detected; it could cause irreversible damage. UKit defers this to a human decision.';
+const REASON_UNSAFE_TARGET =
+  'Unsafe delete target detected; recursive force-delete could cause irreversible damage. UKit defers this to a human decision.';
+const REASON_GENERIC_RM =
+  'Recursive force-delete outside safe cleanup targets (dist/build/coverage/.next/.nuxt/.turbo/tmp/.cache/node_modules) is destructive. UKit defers this to a human decision.';
+const REASON_SALVAGE_REFUSAL =
+  'UKit could not fully read this tool-call payload (stdin staging was cut at the deadline/size bound) and the command could not be recovered, so dangerous-command gate cannot prove it safe.';
+
+const TIMEOUT_REFUSAL = {
+  code: 2,
+  stdout:
+    '{"systemMessage":"UKit dangerous-command gate timed out before finishing its scan; blocked fail-closed rather than pass an uninspected payload."}\n',
+  stderr:
+    'BLOCKED: dangerous-command gate timed out; blocked fail-closed rather than pass an uninspected payload.\n',
+};
+const CRASH_REFUSAL = {
+  code: 2,
+  stdout:
+    '{"systemMessage":"UKit dangerous-command gate crashed before finishing its scan; blocked fail-closed rather than pass an uninspected payload. Run `ukit install` if this repeats."}\n',
+  stderr: 'BLOCKED: dangerous-command gate crashed; payload never inspected (fail-closed).\n',
+};
+
+// ukit_emit_permission_decision parity (hook-input.sh): the JSON shape is
+// harness-agnostic, the exit code is not — direct host exits 0 (non-zero
+// discards stdout), chain exits 2 (bridge parses stdout only on code 2).
+// stderr always carries the BLOCKED line.
+function emitDecision(decision, reason, env) {
+  const inChain = Boolean(env.UKIT_HOOK_CHAIN_RUNNER);
+  return {
+    code: inChain ? 2 : 0,
+    stdout:
+      `{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"${decision}",` +
+      `"permissionDecisionReason":"${reason}"}}\n`,
+    stderr: `BLOCKED: ${reason}\n`,
+  };
+}
+const emitDangerous = (reason, env) =>
+  emitDecision(env.UKIT_HOOK_CHAIN_RUNNER ? 'ask' : 'deny', reason, env);
+const emitRefusal = (env) => emitDecision('deny', REASON_SALVAGE_REFUSAL, env);
+
+// --- command extraction ------------------------------------------------------
+// jq/node heredoc parity: tool_input.command string, else ''.
+function extractCommand({ rawInput, env }) {
+  if (env.UKIT_SALVAGE_ACTIVE === '1') {
+    // TASK-003 degraded path: the wrapper already recovered a COMPLETE command —
+    // skip normal extraction (the staged prefix would not parse anyway).
+    return { command: env.UKIT_SALVAGED_COMMAND ?? '' };
+  }
+  try {
+    const payload = JSON.parse(rawInput || '{}');
+    const command = payload?.tool_input?.command;
+    return { command: typeof command === 'string' ? command : '' };
+  } catch {
+    return { unparseable: true };
+  }
+}
+
+// --- verbatim ports of the .sh scan semantics ---------------------------------
+// CMD_HEAD=$(echo "$COMMAND" | sed -E 's/^[[:space:]]*//' | awk '{print $1}' | basename)
+const SAFE_TEXT_HEADS = new Set(['grep', 'egrep', 'fgrep', 'rg', 'ag', 'awk', 'sed', 'echo', 'printf', 'cat']);
+const PIPE_TO_SHELL_RE = new RegExp(`\\|${SP}*(bash|sh|zsh|eval|xargs)(${SP}|$)`, 'm');
+
+// DANGEROUS_PATTERNS — grep -E semantics preserved. Verified against BSD/GNU
+// grep: the fork-bomb entry's `{` is an invalid interval, so it (and every
+// other entry) is a literal substring except the three that carry real ERE.
+const DANGEROUS_LITERALS = [
+  'rm -rf /',
+  'rm -rf ~',
+  'git push --force',
+  'git push -f ',
+  'git reset --hard',
+  'git clean -fd',
+  '> /dev/sda',
+  'mkfs.',
+  ':(){ :|:& };:',
+  'dd if=/dev/',
+];
+const DANGEROUS_REGEXES = [
+  // "rm -rf \.?\.([[:space:]]|$)" — rm -rf . / rm -rf .. (+ trailing ws/EOL)
+  new RegExp(`rm -rf \\.?\\.(${SP}|$)`, 'm'),
+  /git checkout \./,
+  /git restore \./,
+];
+
+// rm segment analysis — byte-identical port of the .sh per-segment allowlist.
+const SAFE_NAMES = '(?:dist|build|coverage|\\.next|\\.nuxt|\\.turbo|tmp|temp|\\.cache|node_modules)';
+const SAFE_ONE_TARGET_RE = new RegExp(`^(?:\\./)?${SAFE_NAMES}(?:/.*)?$`);
+const UNSAFE_ONE_TARGET_RE = /^(\/.*|~|~\/.*|\.\.|\.\.\/.*|\.)$/;
+const RM_WORD_RE = new RegExp(`(^|[;&|${SP.slice(1, -1)}"'])rm([${SP.slice(1, -1)}"']|$)`, 'm');
+const UNSAFE_TARGET_RE = new RegExp(`(^|${SP})(\\/|~|\\.\\.?($|\\/)|\\.($|\\/))`, 'm');
+const SAFE_DELETE_RE = new RegExp(`(^|${SP})(\\./)?${SAFE_NAMES}(\\/|${SP}|$)`, 'm');
+const HAS_RECURSIVE_RE = new RegExp(`(^|${SP})--recursive|(^|${SP})-[a-zA-Z]*[rR]`, 'm');
+const HAS_FORCE_RE = new RegExp(`(^|${SP})--force|(^|${SP})-[a-zA-Z]*f`, 'm');
+
+const basename = (token) => token.split('/').pop();
+
+// ukit_canonical_path parity: realpath -m semantics — resolve the deepest
+// existing ancestor, append the lexical remainder; unresolvable -> '' (the
+// caller fails closed, never silently allows). UKIT_REALPATH_MISSING=1 (set by
+// the wrapper when no system realpath exists) forces the same fail-closed —
+// the pre-port gate could not prove containment without realpath.
+function canonicalPath(p, env) {
+  if (env && env.UKIT_REALPATH_MISSING === '1') return '';
+  try {
+    const out = fs.realpathSync.native(p);
+    if (out) return out;
+  } catch {}
+  let rest = '';
+  let cur = p;
+  const existsOrLink = (q) => {
+    try {
+      fs.lstatSync(q);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  while (cur && cur !== '/' && !existsOrLink(cur)) {
+    rest = `/${path.basename(cur)}${rest}`;
+    const parent = cur.slice(0, cur.lastIndexOf('/')) || (cur.startsWith('/') ? '/' : cur);
+    if (parent === cur) break;
+    cur = parent;
+  }
+  if (!cur) cur = '/';
+  try {
+    const out = fs.realpathSync.native(cur);
+    return `${out}${rest}`;
+  } catch {
+    return '';
+  }
+}
+
+function evaluate({ command, projectRoot, env }) {
+  if (!command) return { code: 0, stdout: '', stderr: '' };
+
+  // Quoted-span scrub: only when the invoked command is a pure text tool AND
+  // its output cannot reach a shell — `echo "rm -rf /" | bash` executes the
+  // quoted text, so it must never be scrubbed.
+  const head = (command.trimStart().split(/\s+/)[0] || '');
+  const cmdHead = basename(head);
+  let scan = command;
+  if (SAFE_TEXT_HEADS.has(cmdHead) && !PIPE_TO_SHELL_RE.test(command)) {
+    scan = command.replace(/'[^']*'/g, "'Q'").replace(/"[^"]*"/g, '"Q"');
+  }
+
+  for (const literal of DANGEROUS_LITERALS) {
+    if (scan.includes(literal)) return emitDangerous(REASON_DANGEROUS, env);
+  }
+  for (const re of DANGEROUS_REGEXES) {
+    if (re.test(scan)) return emitDangerous(REASON_DANGEROUS, env);
+  }
+
+  // rm handling: allow safe cleanup targets only; everything else defers.
+  const projectRootCanon = canonicalPath(projectRoot, env);
+
+  let verdictUnsafe = false;
+  let verdictGeneric = false;
+  let directSeen = false;
+
+  for (const rawSegment of scan.split(/[;&|\n]/)) {
+    const segment = rawSegment;
+    if (!segment) continue;
+    const tokens = segment.trimStart().split(/\s+/).filter(Boolean);
+    if (basename(tokens[0] || '') !== 'rm') continue;
+
+    // flags: leading -x tokens until `--` or the first non-flag word.
+    let hasR = false;
+    let hasF = false;
+    let i = 1;
+    for (; i < tokens.length; i += 1) {
+      const t = tokens[i];
+      if (t === '--') break;
+      if (!t.startsWith('-')) break;
+      if (t === '--recursive') hasR = true;
+      else if (t === '--force') hasF = true;
+      else if (t.startsWith('--')) { /* other long flag: ignore */ }
+      else {
+        if (/[rR]/.test(t)) hasR = true;
+        if (t.includes('f')) hasF = true;
+      }
+    }
+    if (!(hasR && hasF)) continue;
+    directSeen = true;
+
+    // targets: the first non-flag word and every later non-dash word.
+    const targets = [];
+    {
+      let saw = false;
+      for (let j = 1; j < tokens.length; j += 1) {
+        const t = tokens[j];
+        if (!saw) {
+          if (t === '--') {
+            saw = true;
+            continue;
+          }
+          if (t.startsWith('-')) continue;
+          saw = true;
+          targets.push(t);
+        } else if (!t.startsWith('-')) {
+          targets.push(t);
+        }
+      }
+    }
+
+    let allSafe = true;
+    let anyUnsafe = false;
+    for (let target of targets) {
+      // Strip ONE trailing slash (never shrink a bare `/` or `~` to '').
+      if (target.length > 1 && target.endsWith('/')) target = target.slice(0, -1);
+      if (UNSAFE_ONE_TARGET_RE.test(target)) {
+        anyUnsafe = true;
+        allSafe = false;
+      } else if (SAFE_ONE_TARGET_RE.test(target)) {
+        // TASK-013 containment gate: the allowlisted NAME is not enough — the
+        // canonical target must live inside the canonical project root.
+        if (target.includes('..')) {
+          allSafe = false;
+        } else {
+          const abs = target.startsWith('/') ? target : `${projectRootCanon}/${target}`;
+          const canon = canonicalPath(abs, env);
+          if (!projectRootCanon || !canon || !canon.startsWith(`${projectRootCanon}/`)) {
+            allSafe = false;
+          }
+        }
+      } else {
+        allSafe = false;
+      }
+    }
+    if (anyUnsafe) verdictUnsafe = true;
+    else if (!allSafe) verdictGeneric = true;
+  }
+
+  if (!directSeen && RM_WORD_RE.test(scan) && HAS_RECURSIVE_RE.test(scan) && HAS_FORCE_RE.test(scan)) {
+    // Whole-command fallback (wrapped/quoted rm, flags after targets): unsafe
+    // wins over the allowlist — a safe word elsewhere never legitimises an
+    // absolute/home/parent target we can also see.
+    if (UNSAFE_TARGET_RE.test(scan)) verdictUnsafe = true;
+    else if (!SAFE_DELETE_RE.test(scan)) verdictGeneric = true;
+  }
+
+  if (verdictUnsafe) return emitDangerous(REASON_UNSAFE_TARGET, env);
+  if (verdictGeneric) return emitDangerous(REASON_GENERIC_RM, env);
+  return { code: 0, stdout: '', stderr: '' };
+}
+
+// --- SPEC §8 chain-step entry --------------------------------------------------
+export async function runHook(ctx) {
+  const env = (ctx && ctx.env) || {};
+  const projectRoot =
+    env.CLAUDE_PROJECT_DIR || (ctx && ctx.projectRoot) || env.PROJECT_ROOT || process.cwd();
+  const deadlineMs =
+    Number.parseInt((ctx && ctx.deadlineMs) ?? env.UKIT_HOOK_DEADLINE_MS ?? '', 10) || 3000;
+
+  const rawInput =
+    typeof (ctx && ctx.payloadText) === 'string' && ctx.payloadText.length > 0
+      ? ctx.payloadText
+      : (() => {
+          try {
+            return JSON.stringify((ctx && ctx.payload) ?? {});
+          } catch {
+            return '';
+          }
+        })();
+
+  let extracted = extractCommand({ rawInput, env });
+  if (extracted.unparseable) {
+    // The .sh only salvages on a staging-degraded flag; in-proc there is no flag
+    // — an unparseable payloadText IS the degradation. `{"…`-prefixed text that
+    // fails to parse is a truncated payload: salvage tool_input.command only
+    // when provably complete, else refuse deny (a partial command is never
+    // evaluated). Non-JSON garbage is nothing to scan -> pass, same as jq
+    // failing on the .sh path.
+    if (rawInput.trimStart().startsWith('{')) {
+      const salvaged = salvageField(rawInput, 'tool_input.command');
+      if (!salvaged.complete || salvaged.value === null) return emitRefusal(env);
+      extracted = { command: salvaged.value };
+    } else {
+      extracted = { command: '' };
+    }
+  }
+
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(TIMEOUT_REFUSAL), Math.max(1, deadlineMs));
+    if (timer && typeof timer.unref === 'function') timer.unref();
+  });
+  try {
+    const run = (async () => {
+      if (ctx && ctx.signal && ctx.signal.aborted) return TIMEOUT_REFUSAL;
+      return evaluate({ command: extracted.command, projectRoot, env });
+    })();
+    return await Promise.race([run, timeout]);
+  } catch {
+    return CRASH_REFUSAL;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// --- direct-run CLI mode (the .sh thin wrapper's target) -----------------------
+export function isDirectRun() {
+  try {
+    const invoked = process.argv[1] ? fs.realpathSync(process.argv[1]) : '';
+    const self = fs.realpathSync(fileURLToPath(import.meta.url));
+    return invoked === self;
+  } catch {
+    return false;
+  }
+}
+
+async function main() {
+  const env = process.env;
+  const HOOK_DEADLINE_MS = Number.parseInt(env.UKIT_HOOK_DEADLINE_MS || '', 10) || 3000;
+  // .sh parity: the deadline bounded the extraction node — expiry produced an
+  // empty command and a pass (exit 0, no output).
+  const timer = setTimeout(() => process.exit(0), HOOK_DEADLINE_MS);
+  if (timer && typeof timer.unref === 'function') timer.unref();
+
+  let rawInput = '';
+  try {
+    rawInput = await fsp.readFile(env.INPUT_FILE || '', 'utf8');
+  } catch {}
+  const projectRoot = env.PROJECT_ROOT || env.CLAUDE_PROJECT_DIR || process.cwd();
+
+  try {
+    const extracted = extractCommand({ rawInput, env });
+    const command = extracted.unparseable ? '' : extracted.command;
+    const verdict = evaluate({ command, projectRoot, env });
+    if (verdict.stdout) process.stdout.write(verdict.stdout);
+    if (verdict.stderr) process.stderr.write(verdict.stderr);
+    process.exit(verdict.code);
+  } catch {
+    // Fail-closed (guard parity): a crash means the payload was never
+    // inspected — refuse, never a silent non-blocking hook error.
+    if (CRASH_REFUSAL.stdout) process.stdout.write(CRASH_REFUSAL.stdout);
+    if (CRASH_REFUSAL.stderr) process.stderr.write(CRASH_REFUSAL.stderr);
+    process.exit(CRASH_REFUSAL.code);
+  }
+}
+
+if (isDirectRun()) {
+  main();
+}

package/templates/.claude/hooks/block-dangerous.sh

@@ -1,8 +1,17 @@
 #!/bin/bash
 # PreToolUse hook: Block dangerous bash commands
 # Matched on: Bash
+#
+# C40 TASK-003: this script is a THIN WRAPPER. The single source of truth for
+# command extraction, quoted-span scrub, the pattern table, the rm allowlist
+# and every verdict byte is block-dangerous.mjs (SPEC §14 — one implementation
+# of a fail-closed gate; this shell keeps staging, the degraded-input salvage
+# path, telemetry, and the env contract so direct/debug invocation and
+# git-revert rollback keep working).
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK_DIR="$SCRIPT_DIR"
+PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 # shellcheck source=/dev/null
 if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
 # TASK-019: arm advisory latency telemetry; the finish row is written by the
@@ -75,228 +84,20 @@ else
   fi
   trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
 fi
-if [ "${UKIT_SALVAGE_ACTIVE:-0}" = "1" ]; then
-  # TASK-003: degraded path already recovered a COMPLETE command — skip the
-  # normal extraction (the staged prefix would not parse anyway).
-  COMMAND="$UKIT_SALVAGED_COMMAND"
-else
-INPUT="$(cat "$UKIT_INPUT_FILE")"
-# jq is not installed on stock macOS. Keep jq as the low-latency normal path, but use
-# UKit's required Node runtime as a fallback so its absence cannot silently disable the gate.
-if command -v jq >/dev/null 2>&1 && jq --version >/dev/null 2>&1; then
-  COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty')
-else
-  COMMAND=$(printf '%s' "$INPUT" | node -e '
-const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || "", 10) || 3000;
-setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
-const chunks = [];
-process.stdin.on("data", (chunk) => chunks.push(chunk));
-process.stdin.on("end", () => {
-  try {
-    const payload = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
-    process.stdout.write(typeof payload?.tool_input?.command === "string" ? payload.tool_input.command : "");
-  } catch {}
-});
-' 2>/dev/null)
-fi
-fi
-
-if [ -z "$COMMAND" ]; then
-  exit 0
-fi
 
-# A command like `grep "rm -rf" file.sh` or `echo "rm -rf /"` merely mentions the
-# text of a dangerous pattern as data — it does not execute it. Naively substring-matching
-# the raw command line false-positives on any search/print of that text. Scrub quoted
-# spans before pattern-matching, but ONLY when the invoked command is a pure text tool
-# AND its output cannot reach a shell (no piping into bash/sh/zsh/eval/xargs), since
-# `echo "rm -rf /" | bash` really does execute the quoted text.
-SAFE_TEXT_CMD_REGEX='^(grep|egrep|fgrep|rg|ag|awk|sed|echo|printf|cat)$'
-PIPE_TO_SHELL_REGEX='\|[[:space:]]*(bash|sh|zsh|eval|xargs)([[:space:]]|$)'
-
-CMD_HEAD=$(echo "$COMMAND" | sed -E 's/^[[:space:]]*//' | awk '{print $1}' | xargs -I{} basename {} 2>/dev/null)
-
-SCAN_COMMAND="$COMMAND"
-if echo "$CMD_HEAD" | grep -qE "$SAFE_TEXT_CMD_REGEX" && ! echo "$COMMAND" | grep -qE "$PIPE_TO_SHELL_REGEX"; then
-  SCAN_COMMAND=$(printf '%s' "$COMMAND" | sed -E "s/'[^']*'/'Q'/g; s/\"[^\"]*\"/\"Q\"/g")
+# Delegate to the module: identical env contract the bash glue consumed.
+# realpath parity (TASK-013): the pre-port gate failed closed when the system
+# `realpath` was unavailable; the module resolves in-proc via Node, so the
+# wrapper forwards the dependency signal — no realpath binary -> canonical
+# containment cannot be proven -> allowlist targets defer, never allow.
+command -v realpath >/dev/null 2>&1 || UKIT_REALPATH_MISSING=1
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" UKIT_SALVAGE_ACTIVE="${UKIT_SALVAGE_ACTIVE:-0}" UKIT_SALVAGED_COMMAND="${UKIT_SALVAGED_COMMAND:-}" UKIT_REALPATH_MISSING="${UKIT_REALPATH_MISSING:-0}" node "$HOOK_DIR/block-dangerous.mjs"
+NODE_RC=$?
+# BUG-C21-03 parity (fail-closed): a node crash means the payload was never
+# fully inspected — announce + block, never a silent non-blocking hook error.
+if [ "$NODE_RC" -ne 0 ] && [ "$NODE_RC" -ne 2 ]; then
+  printf '%s\n' '{"systemMessage":"UKit dangerous-command gate crashed before finishing its scan; blocked fail-closed rather than pass an uninspected payload. Run `ukit install` if this repeats."}'
+  echo "BLOCKED: dangerous-command gate crashed (exit $NODE_RC); payload never inspected (fail-closed)." >&2
+  exit 2
 fi
-
-# Dangerous patterns to block
-DANGEROUS_PATTERNS=(
-  "rm -rf /"
-  "rm -rf ~"
-  "rm -rf \\.?\\.([[:space:]]|$)"
-  "git push --force"
-  "git push -f "
-  "git reset --hard"
-  "git clean -fd"
-  "git checkout \."
-  "git restore \."
-  "> /dev/sda"
-  "mkfs\."
-  ":(){ :|:& };:"
-  "dd if=/dev/"
-)
-
-# Dangerous detections surface as a structured decision (stdout JSON). TASK-223:
-# emission is centralized in ukit_emit_permission_decision — exit 0 on the direct
-# host (where a non-zero exit would discard the JSON as a bare "hook error"),
-# exit 2 inside the omp chain (whose bridge only parses stdout on code 2).
-# Probe verdict (2026-09-20, spec step 4): this repo runs
-# permissions.defaultMode=bypassPermissions, where an exit-0 `ask` auto-approves —
-# dead for refusals. So the direct host gets `deny` (a proper denied surface, still
-# fail-closed); the omp chain keeps `ask` (the host boundary prompts the human).
-# The raw command and the matched pattern are NEVER echoed — arguments and comments can
-# carry secrets, and the pattern text itself restates the dangerous command.
-emit_dangerous_decision() {
-  REASON="$1"
-  if command -v ukit_emit_permission_decision >/dev/null 2>&1; then
-    if [ -n "${UKIT_HOOK_CHAIN_RUNNER:-}" ]; then
-      ukit_emit_permission_decision ask "$REASON"
-    else
-      ukit_emit_permission_decision deny "$REASON"
-    fi
-  fi
-  # Helper unavailable (pre-install tree): keep the safe inline parity — the
-  # direct host gets deny + exit 0, the chain gets ask + exit 2.
-  if [ -n "${UKIT_HOOK_CHAIN_RUNNER:-}" ]; then
-    printf '%s\n' "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"$REASON\"}}"
-    echo "BLOCKED: $REASON" >&2
-    exit 2
-  fi
-  printf '%s\n' "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"$REASON\"}}"
-  echo "BLOCKED: $REASON" >&2
-  exit 0
-}
-
-for pattern in "${DANGEROUS_PATTERNS[@]}"; do
-  if echo "$SCAN_COMMAND" | grep -qE "$pattern"; then
-    emit_dangerous_decision "Dangerous command pattern detected; it could cause irreversible damage. UKit defers this to a human decision."
-  fi
-done
-
-# Handle rm commands: allow safe cleanup targets only, defer everything else to a human.
-# Direct rm invocations are parsed per shell segment (`;`, `&`, `|` split) with per-target
-# allowlist evaluation: split flags (`rm -r -f`, `rm --force -r`) register, and one
-# allowlisted word can never legitimise a sibling target (`rm -rf dist /`). A whole-command
-# fallback still catches rm inside wrapped/quoted contexts (`bash -c "rm -r -f /x"`) and
-# flags placed after targets (`rm src -rf`), where segment parsing cannot see rm as a head.
-SAFE_DELETE_REGEX='(^|[[:space:]])(\./)?(dist|build|coverage|\.next|\.nuxt|\.turbo|tmp|temp|\.cache|node_modules)(/|[[:space:]]|$)'
-UNSAFE_TARGET_REGEX='(^|[[:space:]])(/|~|\.\.?($|/)|\.($|/))'
-SAFE_ONE_TARGET_REGEX='^(\./)?(dist|build|coverage|\.next|\.nuxt|\.turbo|tmp|temp|\.cache|node_modules)(/.*)?$'
-UNSAFE_ONE_TARGET_REGEX='^(/.*|~|~/.*|\.\.|\.\./.*|\.)$'
-RM_WORD_REGEX=$'(^|[;&|[:space:]"\x27])rm([[:space:]"\x27]|$)'
-
-# TASK-013 / SPEC §10: canonical-path containment for the name allowlist. A
-# target that passes SAFE_ONE_TARGET_REGEX must ALSO resolve inside
-# realpath(projectRoot) — a `dist` symlinked outside the project (or a `..`
-# segment) downgrades the segment to the generic verdict, never allow.
-#
-# ukit_canonical_path mirrors GNU `realpath -m` semantics portably:
-#   1. `realpath -m` (GNU/coreutils) when supported;
-#   2. ONE documented fallback — stock macOS `realpath` cannot resolve
-#      nonexistent paths, so resolve the deepest existing ancestor and append
-#      the lexical remainder (equivalent for containment);
-#   3. `realpath` itself absent → empty output → fail closed (unresolved-
-#      generic), never silently allow.
-ukit_canonical_path() {
-  __u_p="$1"
-  __u_out=$(realpath -m -- "$__u_p" 2>/dev/null) && [ -n "$__u_out" ] && { printf '%s' "$__u_out"; return 0; }
-  __u_rest=""
-  while [ -n "$__u_p" ] && [ "$__u_p" != "/" ] && [ ! -e "$__u_p" ] && [ ! -L "$__u_p" ]; do
-    __u_rest="/${__u_p##*/}${__u_rest}"
-    __u_p="${__u_p%/*}"
-  done
-  [ -z "$__u_p" ] && __u_p="/"
-  __u_out=$(realpath -- "$__u_p" 2>/dev/null) || return 1
-  printf '%s%s' "$__u_out" "$__u_rest"
-}
-
-# Project-root canonical prefix, resolved once before the segment loop. Targets
-# are interpreted relative to the project root (the host's rm cwd), not the
-# hook's own cwd. An unresolvable root fails closed: no allowlist target can
-# prove containment against an unknown root.
-UKIT_PROJECT_ROOT_CANON=$(ukit_canonical_path "${CLAUDE_PROJECT_DIR:-$PWD}")
-
-RM_VERDICT_UNSAFE=0
-RM_VERDICT_GENERIC=0
-RM_DIRECT_SEEN=0
-set -f
-while IFS= read -r segment; do
-  [ -n "$segment" ] || continue
-  seg_head=$(printf '%s' "$segment" | sed -E 's/^[[:space:]]*//' | awk '{print $1}' | xargs -I{} basename {} 2>/dev/null)
-  [ "$seg_head" = "rm" ] || continue
-  seg_flags=$(printf '%s' "$segment" | awk '{for(i=2;i<=NF;i++){if($i=="--")break;if($i ~ /^-/)printf "%s\n",$i;else break}}')
-  seg_has_r=0
-  seg_has_f=0
-  for flag in $seg_flags; do
-    case "$flag" in
-      --recursive) seg_has_r=1 ;;
-      --force) seg_has_f=1 ;;
-      --*) ;;
-      -*) case "$flag" in *[rR]*) seg_has_r=1 ;; esac
-          case "$flag" in *f*) seg_has_f=1 ;; esac ;;
-    esac
-  done
-  [ "$seg_has_r" -eq 1 ] && [ "$seg_has_f" -eq 1 ] || continue
-  RM_DIRECT_SEEN=1
-  seg_targets=$(printf '%s' "$segment" | awk '{saw=0;for(i=2;i<=NF;i++){if(!saw){if($i=="--"){saw=1;continue}if($i ~ /^-/)continue;saw=1;printf "%s\n",$i}else if($i !~ /^-/)printf "%s\n",$i}}')
-  seg_all_safe=1
-  seg_any_unsafe=0
-  for target in $seg_targets; do
-    # Strip ONE trailing slash so `dist/` matches the allowlist — but never shrink a
-    # bare `/` (or `~`) to an empty string, which would silently dodge the unsafe check.
-    if [ "${#target}" -gt 1 ]; then target="${target%/}"; fi
-    if printf '%s' "$target" | grep -qE "$UNSAFE_ONE_TARGET_REGEX"; then
-      seg_any_unsafe=1
-      seg_all_safe=0
-    elif printf '%s' "$target" | grep -qE "$SAFE_ONE_TARGET_REGEX"; then
-      # Containment gate (TASK-013): the allowlisted NAME is not enough — the
-      # canonical target must live inside the canonical project root. `..`
-      # segments and unresolvable/missing realpath fail closed to generic.
-      case "$target" in
-        *..*) seg_all_safe=0 ;;
-        *)
-          case "$target" in /*) __t_abs="$target" ;; *) __t_abs="$UKIT_PROJECT_ROOT_CANON/$target" ;; esac
-          __t_canon=$(ukit_canonical_path "$__t_abs")
-          if [ -z "$UKIT_PROJECT_ROOT_CANON" ] || [ -z "$__t_canon" ]; then
-            seg_all_safe=0
-          else
-            case "$__t_canon" in
-              "$UKIT_PROJECT_ROOT_CANON"/*) : ;;
-              *) seg_all_safe=0 ;;
-            esac
-          fi
-          ;;
-      esac
-    else
-      seg_all_safe=0
-    fi
-  done
-  if [ "$seg_any_unsafe" -eq 1 ]; then RM_VERDICT_UNSAFE=1
-  elif [ "$seg_all_safe" -eq 0 ]; then RM_VERDICT_GENERIC=1
-  fi
-done <<SEGMENTS
-$(printf '%s' "$SCAN_COMMAND" | tr ';&|' '\n\n\n')
-SEGMENTS
-set +f
-
-if [ "$RM_DIRECT_SEEN" -eq 0 ] && echo "$SCAN_COMMAND" | grep -qE "$RM_WORD_REGEX" \
-  && echo "$SCAN_COMMAND" | grep -qE "(^|[[:space:]])--recursive|(^|[[:space:]])-[a-zA-Z]*[rR]" \
-  && echo "$SCAN_COMMAND" | grep -qE "(^|[[:space:]])--force|(^|[[:space:]])-[a-zA-Z]*f"; then
-  # Unsafe wins over the allowlist here: a safe word elsewhere in the line must never
-  # legitimise an absolute/home/parent target we can also see.
-  if echo "$SCAN_COMMAND" | grep -qE "$UNSAFE_TARGET_REGEX"; then
-    RM_VERDICT_UNSAFE=1
-  elif ! echo "$SCAN_COMMAND" | grep -qE "$SAFE_DELETE_REGEX"; then
-    RM_VERDICT_GENERIC=1
-  fi
-fi
-
-if [ "$RM_VERDICT_UNSAFE" -eq 1 ]; then
-  emit_dangerous_decision "Unsafe delete target detected; recursive force-delete could cause irreversible damage. UKit defers this to a human decision."
-elif [ "$RM_VERDICT_GENERIC" -eq 1 ]; then
-  emit_dangerous_decision "Recursive force-delete outside safe cleanup targets (dist/build/coverage/.next/.nuxt/.turbo/tmp/.cache/node_modules) is destructive. UKit defers this to a human decision."
-fi
-
-exit 0
+exit "$NODE_RC"