@ngockhoale/ukit 2.7.4 → 2.7.6

package/templates/.claude/hooks/sensitive-data-guard.sh

@@ -126,359 +126,7 @@ else
   trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
 fi
 
-INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" SCRIPT_PATH="$SCRIPT_PATH" UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" UKIT_SALVAGE_ACTIVE="${UKIT_SALVAGE_ACTIVE:-0}" UKIT_SALVAGED_EVENT="${UKIT_SALVAGED_EVENT:-}" UKIT_SALVAGED_TOOL_NAME="${UKIT_SALVAGED_TOOL_NAME:-}" UKIT_SALVAGED_FIELD_NAME="${UKIT_SALVAGED_FIELD_NAME:-}" UKIT_SALVAGED_FIELD_VALUE="${UKIT_SALVAGED_FIELD_VALUE:-}" node <<'NODE'
-const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10) || 3000;
-// BUG-C21-03 (chosen posture: FAIL-CLOSED, parity with the staging refusal):
-// a wedged scan must never pass an uninspected payload. The deadline emits a
-// redacted §8 degrade reason and exits 2 — never a silent exit-0 pass.
-setTimeout(() => {
-  try {
-    process.stdout.write(`${JSON.stringify({
-      systemMessage: 'UKit sensitive-data gate timed out before finishing its scan; blocked fail-closed rather than pass an uninspected payload.',
-    })}\n`);
-  } catch {}
-  try {
-    // stderr mirror: piped stdout is async and process.exit() can truncate the
-    // pending write — without this the block can arrive with no visible reason.
-    process.stderr.write('BLOCKED (sensitive data gate): scan timed out; blocked fail-closed rather than pass an uninspected payload.\n');
-  } catch {}
-  process.exit(2);
-}, HOOK_DEADLINE_MS).unref();
-const fs = require('fs');
-const fsp = fs.promises;
-const path = require('path');
-const { createHash } = require('crypto');
-
-// BUG-C21-04: every fs call below is async — a sync read on a stalled mount
-// parks the event loop and the deadline above could never fire.
-void (async () => {
-let rawInput = '';
-try { rawInput = await fsp.readFile(process.env.INPUT_FILE || '', 'utf8'); } catch {}
-const payload = (() => {
-  try {
-    const parsed = JSON.parse(rawInput);
-    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
-  } catch {
-    return {};
-  }
-})();
-
-// TASK-003: on the degraded path the staged prefix cannot parse, so the shell
-// handed us the provably-COMPLETE salvaged fields — reconstruct just enough
-// payload for the normal channel scan below.
-if (process.env.UKIT_SALVAGE_ACTIVE === '1' && process.env.UKIT_SALVAGED_EVENT) {
-  payload.hook_event_name = process.env.UKIT_SALVAGED_EVENT;
-  if (process.env.UKIT_SALVAGED_EVENT === 'PreToolUse' && process.env.UKIT_SALVAGED_TOOL_NAME) {
-    payload.tool_name = process.env.UKIT_SALVAGED_TOOL_NAME;
-    payload.tool_input = {};
-    if (process.env.UKIT_SALVAGED_FIELD_NAME) {
-      payload.tool_input[process.env.UKIT_SALVAGED_FIELD_NAME] = process.env.UKIT_SALVAGED_FIELD_VALUE;
-    }
-  } else if (process.env.UKIT_SALVAGED_EVENT === 'UserPromptSubmit') {
-    payload.prompt = process.env.UKIT_SALVAGED_FIELD_VALUE;
-  }
-}
-
-const projectRoot = process.env.PROJECT_ROOT || process.cwd();
-
-async function readJsonSafe(filePath, fallback) {
-  try {
-    return JSON.parse(await fsp.readFile(filePath, 'utf8'));
-  } catch {
-    return fallback;
-  }
-}
-
-const config = await readJsonSafe(path.join(projectRoot, '.ukit', 'storage', 'config.json'), null);
-if (config && config.security && config.security.sensitiveDataGate === false) {
-  process.exit(0);
-}
-
-const allowlist = (await readJsonSafe(path.join(projectRoot, '.ukit', 'storage', 'security', 'allowlist.json'), null)) || {};
-const allowedValueHashes = new Set(
-  Array.isArray(allowlist.values) ? allowlist.values.filter((v) => typeof v === 'string') : [],
-);
-const allowedPaths = Array.isArray(allowlist.paths) ? allowlist.paths.filter((p) => typeof p === 'string') : [];
-
-function sha256(value) {
-  return createHash('sha256').update(value).digest('hex');
-}
-
-function pathAllowed(filePath) {
-  const normalized = String(filePath).replace(/\\/g, '/').trim();
-  let relative = normalized;
-  try {
-    relative = path.relative(projectRoot, normalized);
-  } catch {
-    // keep normalized
-  }
-  return allowedPaths.some((allowed) => allowed === normalized || allowed === relative);
-}
-
-// --- high-confidence secret value scan (TASK-039: shared runtime module) ---
-// The token-pattern definitions and matching live in the shared runtime
-// module ukit/runtime/sensitive-value-scanner.mjs (manifest requires:
-// ukit-runtime-scripts) — there is deliberately NO local pattern copy here, so
-// the hook and the PROJECT_IMPORTANT renderer can never drift apart. File/path
-// classification and Bash command shapes stay in this hook.
-// Leak-safety: the scanner returns labels only — never a value, excerpt, or
-// hash — so blocked-prompt previews can no longer print a value's truncated
-// sha256; the redacted block message says the value is withheld instead.
-const SCANNER_PATH = process.env.SCRIPT_PATH || '';
-let scannerModule = null;
-let scannerTried = false;
-async function loadScanner() {
-  if (scannerTried) return scannerModule;
-  scannerTried = true;
-  try {
-    const { pathToFileURL } = require('url');
-    scannerModule = await import(pathToFileURL(SCANNER_PATH).href);
-  } catch {
-    scannerModule = null;
-  }
-  return scannerModule;
-}
-
-// The gate is fail-closed on detection AND on scanner availability: a missing
-// or crashing scanner must never silently bypass a channel that could carry a
-// secret (the module is shipped by ukit-runtime-scripts, which the manifest
-// declares this hook requires). Same redacted block shape as a detection.
-function blockScannerUnavailable() {
-  process.stderr.write(
-    'BLOCKED (sensitive data gate unavailable): the shared scanner module '
-    + 'ukit/runtime/sensitive-value-scanner.mjs is missing or failed to load, '
-    + 'so this payload cannot be proven clean. Run `ukit install` to restore it.\n',
-  );
-  process.stdout.write(`${JSON.stringify({
-    systemMessage: 'UKit blocked this call: the sensitive-data scanner module is unavailable (fail-closed). Run `ukit install`.',
-  })}\n`);
-  process.exit(2);
-}
-
-// --- secret file classification ---
-function classifySecretFile(filePath) {
-  if (typeof filePath !== 'string' || !filePath.trim()) return null;
-  const normalized = filePath.replace(/\\/g, '/').trim();
-  const rawBase = normalized.split('/').pop();
-  if (!rawBase) return null;
-  const base = rawBase.toLowerCase();
-  if (base.endsWith('.env.example')) return null;
-  if (base === '.env' || base.startsWith('.env.')) return 'dotenv/secret env file';
-  if (base.endsWith('.pub') || base.endsWith('.public')) return null;
-  if (/^id_(rsa|dsa|ecdsa|ed25519)(\.|$)/.test(base)) return 'SSH private key';
-  if (/\.(pem|key|p12|pfx|keystore|jks)$/.test(base)) return 'key/certificate file';
-  if (/^credentials\.(json|ya?ml|txt|ini)$/.test(base)) return 'credentials file';
-  if (/^service[_-]?account.*\.json$/.test(base)) return 'service-account key file';
-  if (base === '.npmrc' || base === '.netrc' || base === '.htpasswd') return 'credentials file';
-  if (/^secrets?\.(json|ya?ml|txt|ini|env)$/.test(base)) return 'secrets file';
-  if (/(^|\/)\.aws\/credentials$/i.test(normalized)) return 'AWS credentials file';
-  return null;
-}
-
-// --- bash command shapes that dump secrets ---
-const DUMP_VERBS = new Set([
-  'cat', 'head', 'tail', 'less', 'more', 'zless', 'zcat', 'xxd', 'strings',
-  'base64', 'od', 'hexdump', 'bat', 'grep', 'egrep', 'fgrep', 'rg', 'awk', 'sed',
-]);
-
-function scanBashShapes(command) {
-  const found = [];
-  const segments = command.split(/\|\||&&|;|\||\n/);
-  for (const rawSegment of segments) {
-    const segment = rawSegment.trim();
-    if (!segment) continue;
-    const tokens = segment.split(/\s+/);
-    const head = tokens[0].replace(/^["']+|["']+$/g, '');
-
-    if ((head === 'env' || head === 'printenv' || head === 'history') && tokens.length === 1) {
-      found.push({ label: `bare \`${head}\` dumps environment/history (may contain tokens)`, value: segment });
-      continue;
-    }
-    if (head === 'export' && (tokens[1] === '-p' || tokens[1] === '--print')) {
-      found.push({ label: 'bare `export -p` dumps all environment variables', value: segment });
-      continue;
-    }
-
-    if (DUMP_VERBS.has(head)) {
-      for (const token of tokens.slice(1)) {
-        const cleaned = token.replace(/^["']+|["',:]+$/g, '');
-        const kind = classifySecretFile(cleaned);
-        if (kind && !pathAllowed(cleaned)) {
-          found.push({ label: `${head} reads ${kind}`, value: cleaned, isPath: true });
-        }
-      }
-    }
-
-    // `-u/--user user:pass` is only credentials on tools that authenticate with it.
-    // The same flag shape on docker/runuser/chown (`--user 1000:1000`, a uid:gid pair)
-    // is NOT a secret — matching it anyway false-positives every containerised test run.
-    const headBase = head.replace(/^.*\//, '');
-    const CRED_USER_TOOLS = new Set(['curl', 'wget', 'ftp', 'lftp', 'aria2c', 'http', 'https']);
-    const inlineUser = /(^|\s)(-u|--user)\s+["']?([^\s"':]+):([^\s"']+)/.exec(segment);
-    if (inlineUser && CRED_USER_TOOLS.has(headBase)) {
-      // Even on credential tools, a purely numeric pair is a uid:gid, not a password.
-      const numericIds = /^\d+$/.test(inlineUser[3]) && /^\d+$/.test(inlineUser[4]);
-      if (!numericIds) {
-        found.push({ label: 'curl/wget inline credentials (-u user:password)', value: segment });
-      }
-    }
-    if (/https?:\/\/[^\s/@'"]+:[^\s/@'"]+@/.test(segment)) {
-      found.push({ label: 'URL with embedded credentials (user:pass@host)', value: segment });
-    }
-  }
-  return found;
-}
-
-// --- channel wiring ---
-const event = String(payload.hook_event_name || '');
-const toolName = String(payload.tool_name || '');
-const toolInput = payload.tool_input && typeof payload.tool_input === 'object' ? payload.tool_input : {};
-
-const textChannels = [];
-const filePathChannels = [];
-let bashCommand = null;
-
-if (event === 'UserPromptSubmit') {
-  const prompt = [payload.prompt, payload.user_prompt, payload.text].find(
-    (candidate) => typeof candidate === 'string' && candidate.trim(),
-  );
-  if (prompt) textChannels.push({ channel: 'prompt', text: prompt });
-} else if (event === 'PreToolUse') {
-  if (toolName === 'Read' && typeof toolInput.file_path === 'string') {
-    filePathChannels.push(toolInput.file_path);
-  } else if (toolName === 'Grep') {
-    if (typeof toolInput.path === 'string' && toolInput.path.trim()) filePathChannels.push(toolInput.path);
-    if (typeof toolInput.pattern === 'string') textChannels.push({ channel: 'grep pattern', text: toolInput.pattern });
-  } else if (toolName === 'Bash' && typeof toolInput.command === 'string') {
-    bashCommand = toolInput.command;
-  }
-} else {
-  process.exit(0);
-}
-
-// --- collect findings (async: the value scan delegates to the shared module) ---
-void (async () => {
-const findings = [];
-
-for (const filePath of filePathChannels) {
-  const kind = classifySecretFile(filePath);
-  if (kind && !pathAllowed(filePath)) {
-    findings.push({ label: `Read of ${kind}`, preview: filePath, hashSource: filePath });
-  }
-}
-
-// The value scan needs the shared scanner module only when a text/bash
-// channel exists to scan; a pure secret-file Read verdict never depends on it.
-const needsScanner = textChannels.length > 0 || bashCommand;
-let scanner = null;
-if (needsScanner) {
-  scanner = await loadScanner();
-  if (!scanner || typeof scanner.scanText !== 'function') {
-    blockScannerUnavailable();
-  }
-}
-const gateEnabled = scanner ? scanner.isSensitiveDataGateEnabled(config) !== false : true;
-const allowlistHashes = scanner ? scanner.loadSensitiveAllowlist({ security: { allowlist } }) : [];
-
-function scanTextLabels(text) {
-  let verdict;
-  try {
-    verdict = scanner.scanText(text, { allowlistHashes, gateEnabled });
-  } catch {
-    blockScannerUnavailable();
-  }
-  return verdict && Array.isArray(verdict.labels) ? verdict.labels : [];
-}
-
-const seenLabels = new Set();
-for (const { channel, text } of textChannels) {
-  for (const label of scanTextLabels(text)) {
-    const key = `${channel}:${label}`;
-    if (seenLabels.has(key)) continue;
-    seenLabels.add(key);
-    findings.push({ label: `${label} in ${channel}` });
-  }
-}
-
-if (bashCommand) {
-  for (const finding of scanBashShapes(bashCommand)) {
-    if (finding.isPath) {
-      findings.push({ label: `bash command touches ${finding.label}`, preview: finding.value });
-      continue;
-    }
-    if (allowedValueHashes.has(sha256(finding.value))) continue;
-    findings.push({ label: `${finding.label} in bash command`, value: finding.value });
-  }
-  for (const label of scanTextLabels(bashCommand)) {
-    const key = `bash:${label}`;
-    if (seenLabels.has(key)) continue;
-    seenLabels.add(key);
-    findings.push({ label: `${label} in bash command` });
-  }
-}
-
-if (findings.length === 0) {
-  process.exit(0);
-}
-
-// --- machine-generated envelope lane (UserPromptSubmit only) ---
-// Harness plumbing (<task-notification>, <system-reminder>,
-// <cross-session-message>) legitimately carries fixture/log content through
-// the prompt channel — test tokens quoted in task bodies, CI logs, agent
-// results. Blocking it silently drops the notification and stalls pipelines
-// ("Waiting for N background agents"). These envelopes flow with a redacted
-// advisory: labels + counts only, never values. Everything a human types —
-// and every other event/channel — stays fail-closed below.
-const MACHINE_ENVELOPE_RE = /^(?:task-notification|system-reminder|cross-session-message)$/i;
-function isCompleteMachineEnvelope(text) {
-  const trimmed = String(text || '').trim();
-  const opening = /^<([a-z-]+)(?:\s[^>]*)?>/i.exec(trimmed);
-  if (!opening || !MACHINE_ENVELOPE_RE.test(opening[1])) return false;
-  const tag = opening[1];
-  const closing = new RegExp(`</${tag}>$`, 'i');
-  return closing.test(trimmed);
-}
-const promptText = textChannels.length > 0 ? textChannels[0].text : null;
-if (event === 'UserPromptSubmit' && promptText && isCompleteMachineEnvelope(promptText)) {
-  const labels = [...new Set(findings.map((f) => f.label))];
-  process.stdout.write(`${JSON.stringify({
-    systemMessage: `UKit sensitive-data gate: ${findings.length} secret-shaped value(s) inside a machine-generated notification (${labels.slice(0, 3).join('; ')}${labels.length > 3 ? '; …' : ''}). Delivered without blocking — treat as fixture/log plumbing, not a typed secret. Never repeat the values in your reply.`,
-  })}\n`);
-  process.exit(0);
-}
-
-// --- block message: redacted previews only, never the secret itself ---
-// The shared scanner returns labels only, so value findings can no longer show
-// a truncated sha256 — the value stays withheld entirely (leak-safe contract).
-function describeFinding(finding) {
-  const where = finding.preview ? `${finding.preview}` : '(value withheld)';
-  return `  - ${finding.label}: ${where}`;
-}
-
-const lines = [
-  `BLOCKED (sensitive data): ${findings.length} potential secret(s) detected. Nothing was sent to the AI.`,
-  ...findings.map(describeFinding),
-  'Detection is format-true only: a match must itself be a vendor-formatted key,',
-  'a private key block, a JWT, or a credentials file. Code, prose, hashes and',
-  'encoded blobs are not blocked. To proceed, the USER can choose one of:',
-  '  1. Redact the secret (placeholder like <API_KEY>) and retry.',
-  '  2. Approve it explicitly: add the full sha256 (shasum -a 256 of the value) or the file path',
-  '     to .ukit/storage/security/allowlist.json — that file is protected from AI edits.',
-  '  3. Disable the gate: security.sensitiveDataGate=false in .ukit/storage/config.json (not recommended).',
-  'Never repeat or guess the detected value in your reply. Ask the user instead.',
-];
-process.stderr.write(`${lines.join('\n')}\n`);
-// stderr reaches the model; the user needs a stop reason they can actually see. Emit a
-// structured systemMessage (redacted — labels only, never the matched value) so a
-// sensitive-data block never looks like a silent stall in the UI.
-process.stdout.write(`${JSON.stringify({
-  systemMessage: `UKit blocked this call: ${findings.length} potential secret(s) detected (${findings.map((f) => f.label).slice(0, 3).join('; ')}${findings.length > 3 ? '; …' : ''}). Redact the value, allowlist its sha256, or ask the user to decide.`,
-})}\n`);
-process.exit(2);
-})();
-})();
-NODE
-
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" SCRIPT_PATH="$SCRIPT_PATH" UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" UKIT_SALVAGE_ACTIVE="${UKIT_SALVAGE_ACTIVE:-0}" UKIT_SALVAGED_EVENT="${UKIT_SALVAGED_EVENT:-}" UKIT_SALVAGED_TOOL_NAME="${UKIT_SALVAGED_TOOL_NAME:-}" UKIT_SALVAGED_FIELD_NAME="${UKIT_SALVAGED_FIELD_NAME:-}" UKIT_SALVAGED_FIELD_VALUE="${UKIT_SALVAGED_FIELD_VALUE:-}" node "$HOOK_DIR/sensitive-data-guard.mjs"
 NODE_RC=$?
 # BUG-C21-03: a node crash (any non-blocking non-zero exit) means the payload
 # was never fully scanned — fail-closed parity: announce + block, never a

package/templates/.claude/settings.json

@@ -48,7 +48,6 @@
       "Bash(rm -rf ~:*)",
       "Bash(rm -rf ..:*)",
       "Bash(rm -rf .:*)",
-      "Bash(rm -rf:*)",
       "Bash(dd if=/dev/:*)",
       "Bash(*> /dev/sda:*)",
       "Bash(mkfs:*)",
@@ -65,7 +64,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.sh\":8",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.mjs\":8",
             "timeout": 18
           }
         ]
@@ -85,7 +84,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-allow-bash.sh\":15 \"$CLAUDE_PROJECT_DIR/.claude/hooks/block-dangerous.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/context-hardcap-gate.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/verification-guard.sh\":8",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-allow-bash.sh\":15 \"$CLAUDE_PROJECT_DIR/.claude/hooks/block-dangerous.mjs\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.mjs\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/context-hardcap-gate.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/verification-guard.sh\":8",
             "timeout": 65
           }
         ]
@@ -97,7 +96,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/record-execution.sh\":8",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/record-execution.mjs\":8",
             "timeout": 18
           }
         ]
@@ -107,7 +106,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/post-edit-verify.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/record-execution.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/task-watchdog.sh\":8",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/post-edit-verify.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/record-execution.mjs\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/task-watchdog.sh\":8",
             "timeout": 34
           }
         ]
@@ -117,7 +116,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/compress-output.sh\":12 \"$CLAUDE_PROJECT_DIR/.claude/hooks/record-execution.sh\":8",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/compress-output.sh\":12 \"$CLAUDE_PROJECT_DIR/.claude/hooks/record-execution.mjs\":8",
             "timeout": 30
           }
         ]
@@ -128,7 +127,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/skill-router.sh\":20 \"$CLAUDE_PROJECT_DIR/.claude/hooks/vision-router.sh\":12 \"$CLAUDE_PROJECT_DIR/.claude/hooks/context-window-guard.sh\":10",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.mjs\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/skill-router.sh\":20 \"$CLAUDE_PROJECT_DIR/.claude/hooks/vision-router.sh\":12 \"$CLAUDE_PROJECT_DIR/.claude/hooks/context-window-guard.sh\":10",
             "timeout": 60
           }
         ]

package/templates/.claude/ukit/runtime/execution-ledger.mjs

@@ -209,14 +209,30 @@ export async function sweepExecLedgerDir(dir, {
 // bound. Announce the first failure and then every 25th, C22 rate-limit
 // posture. writeSync(1) because a same-tick exit can drop a buffered write.
 let sweepFailureCount = 0;
+// TASK-004 (C40, SPEC §FR-004): in-proc chain steps must never write fd 1 —
+// their messages have to travel back through the step's returned stdout so the
+// runner routes them into the right channel. record-execution.mjs sets this
+// emitter for the duration of its call and resets it in `finally`; when unset,
+// the legacy writeSync(1) posture is unchanged for .sh/CLI callers.
+let ledgerMessageEmitter = null;
+export function setLedgerMessageEmitter(fn) {
+  ledgerMessageEmitter = typeof fn === 'function' ? fn : null;
+}
 export function noteSweepFailure(error) {
   sweepFailureCount += 1;
   if (sweepFailureCount !== 1 && sweepFailureCount % 25 !== 0) return null;
   const message =
     `UKit execution-ledger: dir sweep failed (${sweepFailureCount} failure(s) so far) — `
     + `the committed event is safe but the backlog bound may lag. Cause: ${error?.message || error}`;
+  const line = `${JSON.stringify({ systemMessage: message })}\n`;
+  if (ledgerMessageEmitter) {
+    try {
+      ledgerMessageEmitter(line);
+    } catch { /* an emitter failure never loses the ledger event */ }
+    return message;
+  }
   try {
-    fsSync.writeSync(1, `${JSON.stringify({ systemMessage: message })}\n`);
+    fsSync.writeSync(1, line);
   } catch { /* stdout already gone */ }
   return message;
 }