@ngockhoale/ukit 3.0.4 → 3.0.5

package/CHANGELOG.md

@@ -3,6 +3,15 @@
 All notable changes to UKit are documented here.
 
 
+## 3.0.5 - 2026-09-24
+
+- **Review-fix hardening (cycle C53 fix round 1)** — defects found by the release reviewer after 3.0.4 shipped:
+  - **Memory**: `appendCompactHistory` read-modify-write now runs under the store lock — concurrent appends can no longer lose entries (unlocked RMW race).
+  - **Installed mirror**: restored the missing `index-core` declaration in the installed `.claude/ukit/` mirror so dev-mirror parity checks pass on hydrated workspaces.
+  - **Shipped hooks**: `sensitive-data-guard` no longer bypassed by wrapper commands (`sudo`/`env`/`bash -c`/`xargs`) or basename-obfuscated invocations — the guard now unwraps wrappers and matches on the real binary name.
+  - **Test scoping**: `payloadDocs` stale-prose sweep restricted to shipped surfaces (root docs, `template_project`, `src`, `bin`, `scripts`) — it no longer walks `docs/AI_HANDOFF/**` reports or gitignored runtime dirs; `mirrorPayload` parity now tolerates stale/runtime files under the gitignored installed mirror.
+  - **Installed-mirror resync**: stale `index/detectProjectContext.js`, query-index cache, lock dirs, and resolve-context cache regenerated so the installed mirror matches the template payload.
+
 ## 3.0.4 - 2026-09-24
 
 - **Full source audit (cycle C53) — ~86 defects fixed across all 14 audit areas**; every fix carries a RED→GREEN regression test under `tests/audit/`:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.0.4",
+  "version": "3.0.5",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/src/cli/commands/memory.js

@@ -18,9 +18,8 @@ import {
 import {
   addUserRecord,
   getUserRecord,
-  loadUserRecords,
   queryUserRecords,
-  saveUserRecords,
+  removeUserRecord,
   updateUserRecord,
   userMemoryStats,
 } from '../../core/memory/userMemory.js';
@@ -297,12 +296,10 @@ async function runUserMemory(homeDir, args) {
     if (!id) {
       throw new Error('Missing record id. Usage: ukit memory --user forget <id>');
     }
-    const records = await loadUserRecords({ homeDir });
-    const remaining = records.filter((r) => r.id !== id);
-    if (remaining.length === records.length) {
+    const removed = await removeUserRecord(id, { homeDir });
+    if (!removed) {
       throw new Error(`User memory record not found: ${id}`);
     }
-    await saveUserRecords(remaining, { homeDir });
     console.log(`[UKit] Forgot user record ${id}.`);
     return;
   }

package/src/core/memory/userMemory.js

@@ -63,6 +63,21 @@ export async function updateUserRecord(id, patch = {}, { homeDir } = {}) {
   });
 }
 
+/**
+ * removeUserRecord(id, {homeDir}={}) → record | null
+ * Deletes the record with `id` under the shared store lock — a concurrent
+ * add/update cannot be clobbered by the removal. Returns the removed record,
+ * or null when the id is absent.
+ */
+export async function removeUserRecord(id, { homeDir } = {}) {
+  return mutateRecordStore(userRecordsPath(homeDir), (records) => {
+    const index = records.findIndex((r) => r.id === id);
+    if (index === -1) return null;
+    const removed = records[index];
+    return { result: removed, records: records.filter((r) => r.id !== id) };
+  });
+}
+
 /**
  * getUserRecord(id, {homeDir}={}) → record | null
  */

package/src/index/resolveContext.js

@@ -10,9 +10,9 @@ const TASK_TYPE_BUDGETS = {
 
 const TRIVIAL_SIGNALS = ['typo', 'label', 'text', 'rename', 'color', 'spacing', 'toggle', 'config', 'comment'];
 const RISKY_SIGNALS = [
-  'auth', 'security', 'migration', 'uninstall', 'password', 'token', 'permission',
-  'delete all', 'drop table', 'race', 'flaky', 'intermittent', 'timeout', 'deadlock',
-  'core', 'shared', 'runtime',
+  'auth', 'authentication', 'authorization', 'security', 'migration', 'uninstall',
+  'password', 'token', 'permission', 'delete all', 'drop table', 'race', 'flaky',
+  'flakiness', 'intermittent', 'timeout', 'deadlock', 'core', 'shared', 'runtime',
 ];
 const EXPANSION_SIGNALS = [
   'similar',
@@ -39,12 +39,15 @@ const EXPANSION_SIGNALS = [
 
 // Signals must match whole words: bare `includes` let 'score' fire 'core',
 // 'author' fire 'auth', 'context' fire 'text', and 'install ' fire 'all '.
+// Common inflections (plural/past/-ing) still count — 'timeouts', 'migrations',
+// 'deadlocked' — but 'authentication'/'authorization'/'flakiness' need explicit
+// entries since their stems diverge from the base signal.
 function escapeSignalRegExp(signal) {
   return signal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
 function containsSignalWord(lower, signals) {
-  return signals.some((signal) => new RegExp(`\\b${escapeSignalRegExp(signal)}\\b`).test(lower));
+  return signals.some((signal) => new RegExp(`\\b${escapeSignalRegExp(signal)}(?:s|es|ed|d|ing)?\\b`).test(lower));
 }
 
 export async function resolveContext({

package/template_project/.claude/hooks/sensitive-data-guard.mjs

@@ -271,9 +271,25 @@ async function evaluate({ rawInput, projectRoot, env }) {
         if (t === undefined) break;
         if (t === '--') { headIdx += 1; break; }
         if (isAssignToken(t)) { headIdx += 1; continue; }
+        if (wrapperPositionalPending > 0 && !isVerbToken(t) && !isFlagToken(t)) {
+          // The wrapper's own operand (user/host/duration/image/service), then
+          // the next token is the real command. Consumed BEFORE the wrapper
+          // branch so a 0-positional wrapper token sitting in an operand slot
+          // (`exec` after `docker`/`kubectl`) cannot clobber the pending count.
+          // Flags are never operands — they fall through to the flag branch.
+          wrapperPositionalPending -= 1;
+          headIdx += 1;
+          continue;
+        }
         const positionalCount = wrapperPositionals(t);
         if (positionalCount !== undefined) {
           wrapperPositionalPending = positionalCount;
+          // `docker compose <sub> <svc> <cmd>` carries one extra operand (the
+          // service) beyond the flat two — `compose` is a sub-CLI, not a
+          // subcommand like `exec`.
+          if (positionalCount === 2 && unquote(tokens[headIdx + 1]) === 'compose') {
+            wrapperPositionalPending += 1;
+          }
           headIdx += 1;
           continue;
         }
@@ -291,18 +307,12 @@ async function evaluate({ rawInput, projectRoot, env }) {
           }
           continue;
         }
-        if (wrapperPositionalPending > 0 && !isVerbToken(t)) {
-          // The wrapper's own operand (user/host/duration/image), then the
-          // next token is the real command.
-          wrapperPositionalPending -= 1;
-          headIdx += 1;
-          continue;
-        }
         break;
       }
       const effectiveHead = unquote(tokens[headIdx] ?? '');
+      const headBase = effectiveHead.replace(/^.*\//, '');
 
-      if (DUMP_VERBS.has(effectiveHead)) {
+      if (DUMP_VERBS.has(headBase)) {
         for (const token of tokens.slice(headIdx + 1)) {
           const cleaned = token.replace(/^["']+|["',:]+$/g, '');
           const kind = classifySecretFile(cleaned);
@@ -312,7 +322,6 @@ async function evaluate({ rawInput, projectRoot, env }) {
         }
       }
 
-      const headBase = effectiveHead.replace(/^.*\//, '');
       const CRED_USER_TOOLS = new Set(['curl', 'wget', 'ftp', 'lftp', 'aria2c', 'http', 'https']);
       // `-uuser:pass`, `-u user:pass`, `--user=user:pass`, `--user user:pass` —
       // the old `\s+` separator missed the joined and `=` forms entirely.

package/template_project/.claude/ukit/index/lib/index-core.mjs

@@ -967,6 +967,7 @@ async function tryIncrementalIndexUpdate({ absoluteRoot, indexDir, changedPaths,
   const previousCodePaths = new Set(
     filesArtifact.items.filter((item) => CODE_EXTENSIONS.has(item?.ext)).map((item) => item.filePath),
   );
+  const currentCodePaths = new Set(codeFiles.map((file) => file.filePath));
   const canReuseArchetypes = parsedFiles.length === 0
     && !recordsChanged
     && archetypesArtifact?.schemaVersion === INDEX_SCHEMA_VERSION
@@ -1358,11 +1359,10 @@ const TASK_TYPE_BUDGETS = {
   'non-trivial': { minFiles: 4, maxFiles: 8 },
 };
 
-const TRIVIAL_SIGNALS = ['typo', 'label', 'text', 'rename', 'color', 'spacing', 'toggle', 'config', 'comment'];
 const RISKY_SIGNALS = [
-  'auth', 'security', 'migration', 'uninstall', 'password', 'token', 'permission',
-  'delete all', 'drop table', 'race', 'flaky', 'intermittent', 'timeout', 'deadlock',
-  'core', 'shared', 'runtime',
+  'auth', 'authentication', 'authorization', 'security', 'migration', 'uninstall',
+  'password', 'token', 'permission', 'delete all', 'drop table', 'race', 'flaky',
+  'flakiness', 'intermittent', 'timeout', 'deadlock', 'core', 'shared', 'runtime',
 ];
 const EXPANSION_SIGNALS = [
   'similar',
@@ -1389,12 +1389,15 @@ const EXPANSION_SIGNALS = [
 
 // Signals must match whole words: bare `includes` let 'score' fire 'core',
 // 'author' fire 'auth', 'context' fire 'text', and 'install ' fire 'all '.
+// Common inflections (plural/past/-ing) still count — 'timeouts', 'migrations',
+// 'deadlocked' — but 'authentication'/'authorization'/'flakiness' need explicit
+// entries since their stems diverge from the base signal.
 function escapeSignalRegExp(signal) {
   return signal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
 function containsSignalWord(lower, signals) {
-  return signals.some((signal) => new RegExp(`\\b${escapeSignalRegExp(signal)}\\b`).test(lower));
+  return signals.some((signal) => new RegExp(`\\b${escapeSignalRegExp(signal)}(?:s|es|ed|d|ing)?\\b`).test(lower));
 }
 
 export async function resolveContext({