@ngockhoale/ukit 3.4.0 → 3.4.2

package/template_project/.claude/ukit/index/worktree-sweep.mjs

@@ -5,8 +5,12 @@
  *
  * Enumerate → classify → gate → remove only classified-safe entries. Dry-run
  * is the default and mutates nothing; `--apply` runs `git worktree remove`
- * exclusively on entries classified `safe`. Never a blanket sweep — every
- * skipped entry keeps a named verdict.
+ * exclusively on entries classified `safe` — stale entries (`prunable` /
+ * missing dir) go through `git worktree prune` instead, since `remove` has
+ * no tree to detach (older git exits 128 there). The worktree containing this
+ * process's cwd/--root is excluded by resolved-path identity, never by
+ * porcelain record position. Never a blanket sweep — every skipped entry
+ * keeps a named verdict.
  *
  * Classification (in priority order, first match wins):
  *   safe   — prunable/stale worktree (missing dir or unborn branch) that is
@@ -15,15 +19,20 @@
  *   skip-locked        — porcelain `locked` flag (a human locked it)
  *   skip-detached-head — detached HEAD (nothing merges into anything)
  *   skip-dirty         — `git -C <wt> status --porcelain` non-empty or
- *                        unreadable (unknown state is never removable)
+ *                        unreadable (unknown state is never removable);
+ *                        `reason=` on the verdict line names which case it was
  *   skip-active        — resumable-run records present (.ukit/storage/runs/)
  *                        OR docs/AI_HANDOFF/RUN.md phase not done/blocked,
  *                        OR the branch has commits not merged into default
  *
  * CLI: node worktree-sweep.mjs [--apply] [--root <dir>]
  * exit 0 on a successful report/apply (even when nothing is removable);
- * non-zero only on invocation error (bad flag, not-a-repo, git spawn
- * failure). A failed `worktree remove` is reported per-entry, not fatal.
+ * non-zero only on invocation or repo-level errors (bad flag, not-a-repo,
+ * a git spawn failure/timeout on a root call such as `worktree list`).
+ * A failed or timed-out per-worktree call is NOT an invocation error —
+ * it degrades that entry to skip-dirty with a `reason=` on its verdict
+ * line and the sweep continues (C92-D-02). A failed `worktree remove`
+ * is reported per-entry, not fatal.
  */
 
 import fs from 'node:fs';
@@ -42,13 +51,17 @@ function fail(msg) {
   process.exit(1);
 }
 
-function git(root, args) {
+// `degrade` marks a per-worktree call whose spawn error or timeout must not
+// abort the sweep: the caller gets the errored result back and degrades that
+// entry (C92-D-02 — one worktree on a wedged volume is not an invocation
+// error). Calls without it are repo-level and stay fatal on spawn errors.
+function git(root, args, { degrade = false } = {}) {
   const res = spawnSync('git', ['-C', root, ...args], {
     encoding: 'utf8',
     timeout: GIT_CALL_TIMEOUT_MS,
     killSignal: 'SIGKILL',
   });
-  if (res.error) {
+  if (res.error && !degrade) {
     fail(`git ${args[0]} failed to run: ${res.error.message ?? res.error}`);
   }
   return res;
@@ -93,10 +106,29 @@ for (const line of list.stdout.split('\n')) {
 }
 if (cur) worktrees.push(cur);
 
-// The main worktree is always the first record — it is the checkout running
-// this sweep and is never a removal candidate.
-const main = worktrees.shift();
-const candidates = worktrees;
+// Removal candidates are excluded by resolved-path identity, never by list
+// position (W3-06): the old positional `worktrees.shift()` only protected the
+// FIRST porcelain record. Invoked from inside a linked worktree (or with a
+// --root pointing at one), the caller's own worktree stayed in the removal
+// set and `git worktree remove` happily deleted the process's cwd.
+// The main worktree is record 0 — kept for the default-branch fallback but
+// also excluded below by path identity.
+const main = worktrees[0] ?? null;
+const realPath = (p) => {
+  try { return fs.realpathSync(p); } catch { return path.resolve(p); }
+};
+const mainPath = main ? realPath(main.path) : null;
+// A worktree is "self" when its root contains this process's cwd or the
+// resolved --root (usually the same path). Containment, not equality — the
+// sweep may be invoked from any subdirectory of the worktree.
+const selfRoots = [root, process.cwd()].map((p) => realPath(p) + path.sep);
+const isSelfWorktree = (wtPath) => {
+  const wt = realPath(wtPath) + path.sep;
+  return selfRoots.some((self) => self.startsWith(wt));
+};
+const candidates = worktrees.filter(
+  (wt) => realPath(wt.path) !== mainPath && !isSelfWorktree(wt.path),
+);
 
 // Default branch: prefer remote HEAD, then local main/master, then the main
 // worktree's own checked-out branch.
@@ -120,11 +152,19 @@ if (defaultBranch) {
 }
 
 // --- classify ---------------------------------------------------------------
-function isDirty(wtPath) {
-  const res = git(wtPath, ['status', '--porcelain']);
-  // Unreadable status → treat as dirty: unknown state is never removable.
-  if (res.status !== 0) return true;
-  return res.stdout.trim().length > 0;
+// Readability check, not just dirtiness: returns the reason to print whenever
+// the status is non-clean — actual uncommitted work, a non-zero exit, or a
+// spawn error/timeout on that worktree (degraded, never fatal: C92-D-02).
+// Unknown state is never removable.
+function dirtyState(wtPath) {
+  const res = git(wtPath, ['status', '--porcelain'], { degrade: true });
+  if (res.error) return { dirty: true, reason: `status check failed: ${res.error.message ?? res.error}` };
+  if (res.status !== 0) {
+    const detail = (res.stderr || '').split('\n')[0].trim();
+    return { dirty: true, reason: `status check failed (exit ${res.status})${detail ? `: ${detail}` : ''}` };
+  }
+  if (res.stdout.trim().length > 0) return { dirty: true, reason: 'uncommitted changes' };
+  return { dirty: false };
 }
 
 function hasActiveRun(wtPath) {
@@ -148,27 +188,29 @@ function hasActiveRun(wtPath) {
 }
 
 function classify(wt) {
-  if (wt.locked) return 'skip-locked';
+  const verdict = (v, reason) => ({ verdict: v, reason });
+  if (wt.locked) return verdict('skip-locked');
   if (wt.prunable || !fs.existsSync(wt.path)) {
     // Stale: the checkout directory is already gone — clean by definition.
-    return 'safe';
+    return verdict('safe');
   }
-  if (wt.detached || !wt.branch) return 'skip-detached-head';
-  if (isDirty(wt.path)) return 'skip-dirty';
-  if (hasActiveRun(wt.path)) return 'skip-active';
+  if (wt.detached || !wt.branch) return verdict('skip-detached-head');
+  const status = dirtyState(wt.path);
+  if (status.dirty) return verdict('skip-dirty', status.reason);
+  if (hasActiveRun(wt.path)) return verdict('skip-active');
   const branchExists = git(root, ['rev-parse', '--verify', '--quiet', `refs/heads/${wt.branch}`]).status === 0;
-  if (!branchExists) return 'safe'; // stale: branch gone/unborn, and clean
+  if (!branchExists) return verdict('safe'); // stale: branch gone/unborn, and clean
   if (mergedSet.has(wt.branch)) {
     // `git branch --merged` lists tip-merged branches; zero commits ahead is
     // implied — a merged tip IS zero-ahead. Double-check cheaply.
     const ahead = git(root, ['rev-list', '--count', `${defaultBranch}..${wt.branch}`]);
-    if (ahead.status === 0 && Number(ahead.stdout.trim()) === 0) return 'safe';
+    if (ahead.status === 0 && Number(ahead.stdout.trim()) === 0) return verdict('safe');
   }
-  return 'skip-active'; // branch carries unmerged work — a run may resume it
+  return verdict('skip-active'); // branch carries unmerged work — a run may resume it
 }
 
 // --- report + apply ---------------------------------------------------------
-const results = candidates.map((wt) => ({ ...wt, verdict: classify(wt) }));
+const results = candidates.map((wt) => ({ ...wt, ...classify(wt) }));
 
 const mode = apply ? 'apply' : 'dry-run';
 console.log(`worktree-sweep (${mode}) — root: ${root}`);
@@ -178,13 +220,29 @@ if (results.length === 0) {
 }
 for (const r of results) {
   let line = `${r.path}  branch=${r.branch ?? '(none)'}  verdict=${r.verdict}`;
+  if (r.reason) line += `  reason=${r.reason}`;
   if (apply && r.verdict === 'safe') {
-    const rm = spawnSync('git', ['-C', root, 'worktree', 'remove', r.path], {
-      encoding: 'utf8',
-      timeout: GIT_CALL_TIMEOUT_MS,
-      killSignal: 'SIGKILL',
-    });
-    if (rm.status === 0) line += '  removed';
+    // W3-01: a stale entry (porcelain `prunable` or missing dir) has no tree
+    // left for `git worktree remove`, which fails outright on older git
+    // (exit 128, "fatal: '<path>' does not exist"). Drop the admin record via
+    // `git worktree prune` instead; `--expire=now` bypasses the default
+    // gc.worktreePruneExpire window. Prune skips locked worktrees — but a
+    // locked entry never reaches 'safe' anyway.
+    const stale = r.prunable || !fs.existsSync(r.path);
+    const rm = stale
+      ? spawnSync('git', ['-C', root, 'worktree', 'prune', '--expire=now'], {
+          encoding: 'utf8',
+          timeout: GIT_CALL_TIMEOUT_MS,
+          killSignal: 'SIGKILL',
+        })
+      : spawnSync('git', ['-C', root, 'worktree', 'remove', r.path], {
+          encoding: 'utf8',
+          timeout: GIT_CALL_TIMEOUT_MS,
+          killSignal: 'SIGKILL',
+        });
+    const stillRegistered = stale
+      && git(root, ['worktree', 'list', '--porcelain']).stdout.includes(`worktree ${r.path}\n`);
+    if (rm.status === 0 && !stillRegistered) line += '  removed';
     else line += `  remove-failed: ${(rm.stderr || rm.error?.message || '').trim() || 'unknown error'}`;
   }
   console.log(line);

package/template_project/.claude/ukit/runtime/compact-threshold.mjs

@@ -497,13 +497,18 @@ export async function buildCompactThresholds(config = {}) {
   const hardCapTokens = negotiated
     ? Math.max(1, Math.min(shippedHardCap, negotiated.capTokens))
     : shippedHardCap;
-  // An explicit operator tokenThreshold is honored as-is; otherwise the advisory phase is
-  // derived from the cap it precedes, so a soft phase can never sit above the cap (150k of
-  // advisory over a negotiated 100k cap would simply never fire).
+  // An explicit operator tokenThreshold is honoured but still clamped under the
+  // negotiated cap: an advisory soft/hard pair sitting at or above hardCapTokens can
+  // never fire, because context-hardcap-gate.sh already refuses tools at the cap
+  // (C92-H-01 — on a default install tokenThreshold is the shipped 150k default, not a
+  // real operator choice, so this is correcting a number, not overriding intent).
   const softThreshold = explicitSoftThreshold > 0
-    ? Math.max(1, explicitSoftThreshold)
+    ? Math.max(1, Math.min(explicitSoftThreshold, hardCapTokens - 1))
     : Math.max(1, Math.round(hardCapTokens * SOFT_TO_CAP_RATIO));
-  const hardThreshold = Math.max(softThreshold + 1, Math.round(softThreshold * 1.6));
+  const hardThreshold = Math.min(
+    hardCapTokens,
+    Math.max(softThreshold + 1, Math.round(softThreshold * 1.6)),
+  );
   const baselineTokens = Math.max(120, Math.min(18_000, Math.round(softThreshold * 0.18)));
 
   return {
@@ -773,6 +778,9 @@ export function resolveThresholdCompactBudget({
 // record's flat fields stay projected at the document's top level so readers that predate
 // this shape (raw JSON readers) still see a coherent state.
 const PRESSURE_SESSIONS_MAX = 8;
+// C90-16: sessionless writers (omp tool events without session_id/transcript)
+// accumulate here — never on the newest sibling's record.
+const SESSIONLESS_PRESSURE_BUCKET = '_sessionless';
 
 function normalizeSessionId(value) {
   const id = typeof value === 'string' ? value.trim() : '';
@@ -793,12 +801,20 @@ function readPressureDocument(raw) {
   return raw && typeof raw === 'object' ? { default: raw } : {};
 }
 
-function pickPressureSession(sessions, sessionId) {
+function pickPressureSession(sessions, sessionId, { forWrite = false } = {}) {
   if (sessionId) {
     // A session id that has no record yet starts clean — it must not inherit another
     // session's totals, and the other way round nothing here touches that session.
     return { id: sessionId, record: sessions[sessionId] ?? null };
   }
+  if (forWrite) {
+    // C90-16: a writer without a session id must never accumulate onto the
+    // newest sibling's record — cross-session pressure corruption survives a
+    // SessionStart reset and wedges that session's hard-cap gate. Sessionless
+    // mutations accumulate on a dedicated bucket instead, even when the
+    // document holds no records yet.
+    return { id: SESSIONLESS_PRESSURE_BUCKET, record: sessions[SESSIONLESS_PRESSURE_BUCKET] ?? null };
+  }
   const entries = Object.entries(sessions);
   if (!entries.length) {
     return { id: 'default', record: null };
@@ -835,11 +851,22 @@ export async function buildCompactPressureState(rawState = null, config = {}) {
   const rawSoftThreshold = finiteNumber(rawState?.softThreshold, 0);
   const rawHardThreshold = finiteNumber(rawState?.hardThreshold, 0);
   if (!finiteNumber(config?.compact?.tokenThreshold, 0) && rawSoftThreshold > 0) {
-    thresholds.softThreshold = rawSoftThreshold;
-    thresholds.hardThreshold = rawHardThreshold > rawSoftThreshold
-      ? rawHardThreshold
-      : Math.max(rawSoftThreshold + 1, Math.round(rawSoftThreshold * 1.6));
-    thresholds.baselineTokens = Math.max(120, Math.min(18_000, Math.round(thresholds.softThreshold * 0.18)));
+    // A persisted pair is only honoured while it still sits inside the negotiated cap.
+    // The record outlives capacity negotiation: an install that ran before the record
+    // existed, or before the model was verified, carries thresholds tuned for the
+    // shipped 500k ceiling — restoring them re-pins the advisory ABOVE the live
+    // hardCapTokens forever (C92-H-02). Falling through keeps the freshly derived
+    // pair, which is also what the rewritten record persists, so the file self-heals.
+    if (rawSoftThreshold < thresholds.hardCapTokens) {
+      thresholds.softThreshold = rawSoftThreshold;
+      thresholds.hardThreshold = Math.min(
+        thresholds.hardCapTokens,
+        rawHardThreshold > rawSoftThreshold
+          ? rawHardThreshold
+          : Math.max(rawSoftThreshold + 1, Math.round(rawSoftThreshold * 1.6)),
+      );
+      thresholds.baselineTokens = Math.max(120, Math.min(18_000, Math.round(thresholds.softThreshold * 0.18)));
+    }
   }
   const recentPrompts = (Array.isArray(rawState?.recentPrompts) ? rawState.recentPrompts : [])
     .map((entry) => normalizePromptEntry(entry))
@@ -1185,13 +1212,17 @@ export async function buildThresholdCompactPlan({
   const compacted = compactContextBlock(rawLines, {
     maxTokens: budget.maxTokens,
     maxLines: budget.maxLines,
+    // Guardrail anchors are listed FIRST: under hard pressure the block budget may
+    // not fit every anchor, and the lines that protect the user (ask-before-drop)
+    // and the session (memory bridge) are the ones that must never be the tail
+    // casualty (C92-H-03).
     anchorLines: [
       thresholdLine,
+      askBeforeDropLine,
+      memoryBridgeLine,
       routeLine,
       previousLine,
       outputLine,
-      memoryBridgeLine,
-      askBeforeDropLine,
     ].filter(Boolean),
     maxAnchors: 6,
   });
@@ -1208,6 +1239,7 @@ export async function buildThresholdCompactPlan({
     tokensBefore: compacted.tokensBefore,
     tokensAfter: compacted.tokensAfter,
     savedTokens: compacted.savedTokens,
+    missingAnchors: compacted.missingAnchors ?? [],
   };
 }
 
@@ -1232,7 +1264,7 @@ async function mutateCompactPressureState(projectRoot, mutator, config = {}) {
   const scopedConfig = scopeCapacityConfig(config, projectRoot);
   return withFileLock(runtimePaths.compactPressurePath, async () => {
     const sessions = readPressureDocument(await readJson(runtimePaths.compactPressurePath, null));
-    const { id, record } = pickPressureSession(sessions, normalizeSessionId(config?.sessionId));
+    const { id, record } = pickPressureSession(sessions, normalizeSessionId(config?.sessionId), { forWrite: true });
     const current = await buildCompactPressureState(record, scopedConfig);
     const next = await mutator(current);
     const normalized = await buildCompactPressureState(next, scopedConfig);
@@ -1247,7 +1279,7 @@ export async function writeCompactPressureState(projectRoot, state, config = {})
   const scopedConfig = scopeCapacityConfig(config, projectRoot);
   return withFileLock(runtimePaths.compactPressurePath, async () => {
     const sessions = readPressureDocument(await readJson(runtimePaths.compactPressurePath, null));
-    const { id } = pickPressureSession(sessions, normalizeSessionId(config?.sessionId));
+    const { id } = pickPressureSession(sessions, normalizeSessionId(config?.sessionId), { forWrite: true });
     const normalized = await buildCompactPressureState(state, scopedConfig);
     sessions[id] = { ...normalized, updatedAt: Date.now() };
     await writeJson(runtimePaths.compactPressurePath, projectPressureDocument(sessions));

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -1086,33 +1086,48 @@ async function mergeContinuationSidecar(ledger, target) {
 // Reads the merged ledger view (main file + existing sidecar) so consecutive ticks
 // accumulate even while the main lock stays busy. Returns { ok } — a sidecar write
 // failure means the tick is genuinely lost and the caller reports the rejection.
-async function bumpContinuationSidecar(target, event) {
-  try {
-    const base = (await mergeContinuationSidecar(await readJson(target, null), target)) || {};
-    const applied = event.type === 'notified'
-      ? { ...base, notified: true, updatedAt: Date.now() }
-      : applyContinuationToLedger(base, event);
-    // The merge gate requires sidecarAt > ledgerAt. A notified tick inherits the
-    // base stamp unchanged, so it must be bumped past the base it was computed
-    // from — otherwise the tick is invisible to every evaluator and the cap's
-    // final notice loops forever while contention persists. The +1 floor also
-    // covers a continuation landing in the same millisecond as the base stamp.
-    const baseAt = Number(base.lastContinuationAt) || 0;
-    const stampedAt = Math.max(Number(applied.lastContinuationAt) || 0, baseAt + 1);
-    await writeJsonAtomic(continuationSidecarPathFor(target), {
-      requestKey: event?.requestKey ?? applied.requestKey ?? applied.continuationRequestKey ?? null,
-      promptKey: event?.promptKey ?? applied.promptKey ?? null,
-      continuationCount: Number(applied.continuationCount) || 0,
-      noProgressCount: Number(applied.noProgressCount) || 0,
-      lastProgressDigest: applied.lastProgressDigest ?? null,
-      notified: applied.notified === true,
-      lastContinuationAt: stampedAt,
-      updatedAt: Date.now(),
-    });
-    return { ok: true };
-  } catch {
-    return { ok: false };
-  }
+// W3-LED1: the RMW runs under a sidecar-local lock — two racing continuations
+// must both tick, not clobber each other's read-merge-write. The main ledger
+// lock stays unavailable here (that is why this path runs), so the sidecar
+// lock is the ONLY lock taken: lock order sidecar-alone can never deadlock
+// with the main→journal order. A busy sidecar lock fails closed — the tick is
+// reported rejected rather than written unlocked over a holder's mid-flight
+// merge — and the caller reports the rejection.
+async function bumpContinuationSidecar(target, event, { signal, deadlineMs } = {}) {
+  const sidecarPath = continuationSidecarPathFor(target);
+  const outcome = await withAsyncLock(
+    sidecarPath,
+    { signal, deadlineMs: deadlineMs ?? LOCK_MAX_SLICE_MS },
+    async () => {
+      try {
+        const base = (await mergeContinuationSidecar(await readJson(target, null), target)) || {};
+        const applied = event.type === 'notified'
+          ? { ...base, notified: true, updatedAt: Date.now() }
+          : applyContinuationToLedger(base, event);
+        // The merge gate requires sidecarAt > ledgerAt. A notified tick inherits the
+        // base stamp unchanged, so it must be bumped past the base it was computed
+        // from — otherwise the tick is invisible to every evaluator and the cap's
+        // final notice loops forever while contention persists. The +1 floor also
+        // covers a continuation landing in the same millisecond as the base stamp.
+        const baseAt = Number(base.lastContinuationAt) || 0;
+        const stampedAt = Math.max(Number(applied.lastContinuationAt) || 0, baseAt + 1);
+        await writeJsonAtomic(sidecarPath, {
+          requestKey: event?.requestKey ?? applied.requestKey ?? applied.continuationRequestKey ?? null,
+          promptKey: event?.promptKey ?? applied.promptKey ?? null,
+          continuationCount: Number(applied.continuationCount) || 0,
+          noProgressCount: Number(applied.noProgressCount) || 0,
+          lastProgressDigest: applied.lastProgressDigest ?? null,
+          notified: applied.notified === true,
+          lastContinuationAt: stampedAt,
+          updatedAt: Date.now(),
+        });
+        return { ok: true };
+      } catch {
+        return { ok: false };
+      }
+    },
+  );
+  return outcome.ok === true ? outcome.value : { ok: false };
 }
 
 function newEventId() {
@@ -1998,9 +2013,27 @@ export async function recordLedgerEvent(event, {
     if (drained.commit) await drained.commit();
     // The continuation sidecar was already merged into `current` (and therefore into
     // the ledger just written): its ticks are now durable state, so the sidecar is
-    // retired. A tick landing between the read and this rm is lost — same accepted
-    // window as the journal drain — but the breaker still advances.
-    try { await fs.rm(continuationSidecarPathFor(target), { force: true }); } catch {}
+    // retired. W3-LED1: the retire runs under the sidecar-local lock and re-merges
+    // a tick that landed between the ledger read and the write — removing the
+    // sidecar unlocked deleted a durable tick outright. A busy sidecar lock skips
+    // the retire entirely: the file re-merges idempotently on the next read
+    // (merge gate sidecarAt > ledgerAt, notified OR-ed) and the next commit retires it.
+    try {
+      await withAsyncLock(
+        continuationSidecarPathFor(target),
+        { signal, deadlineMs: deadlineMs ?? LOCK_MAX_SLICE_MS },
+        async () => {
+          const base = await readJson(target, null);
+          const remerged = await mergeContinuationSidecar(base, target);
+          if (remerged && remerged !== base) {
+            await writeJsonAtomic(target, remerged);
+          }
+          try { await fs.rm(continuationSidecarPathFor(target), { force: true }); } catch {}
+        },
+      );
+    } catch {
+      // retire is best-effort post-commit; the sidecar re-merges idempotently
+    }
     return { committed: true, eventId, value, drained: drained.applied, quarantined: drained.quarantined };
   });
   if (outcome.ok) {

package/template_project/.claude/ukit/runtime/hook-field-salvage.mjs

@@ -56,21 +56,55 @@ const matchBrace = (s, open) => {
   return -1;
 };
 
-// Find `"key"` used as an object key inside region [lo, hi); returns the index
-// of its `:` or -1. A bare `"key"` inside a string value cannot produce this
-// shape (its quotes are escaped), and non-key uses lack the `:` — both are
-// skipped by scanning forward.
+// Index of the closer matching the `{`/`[` at `open` (string-aware, mixed
+// brackets), or -1 when unclosed/mismatched. A strict mismatch also aborts:
+// depth bookkeeping past it would be meaningless.
+const matchEnclosure = (s, open) => {
+  const stack = [];
+  for (let i = open; i < s.length; i += 1) {
+    const c = s[i];
+    if (c === '"') {
+      const end = scanStringEnd(s, i);
+      if (end === -1) return -1;
+      i = end;
+      continue;
+    }
+    if (c === '{' || c === '[') { stack.push(c); continue; }
+    if (c === '}' || c === ']') {
+      const top = stack.pop();
+      if ((c === '}' && top !== '{') || (c === ']' && top !== '[')) return -1;
+      if (stack.length === 0) return i;
+    }
+  }
+  return -1;
+};
+
+// BUG-C90-14 (FR-002): find `"key"` at THIS object's depth inside [lo, hi) —
+// the region bounds are the parent object's braces, so every candidate here is
+// top-level by construction. A same-named key inside a NESTED value (object or
+// array) must be skipped structurally, never matched: the previous flat
+// indexOf scan let `{"nested":{"command":"echo hi"},"command":"rm -rf /"}`
+// salvage "echo hi" instead of the real outer field (fail-open on the deny
+// gates). Returns the index of the key's `:` or -1.
 const findKey = (s, key, lo, hi) => {
   const needle = `"${key}"`;
-  let pos = s.indexOf(needle, lo);
-  while (pos !== -1 && pos < hi) {
-    const colon = skipWs(s, pos + needle.length);
-    if (colon < hi && colon < s.length && s[colon] === ':') {
-      const prev = pos - 1;
-      const pc = prev >= 0 ? s[prev] : '';
-      if (prev < 0 || pc === '{' || pc === ',' || isWs(pc)) return colon;
+  for (let i = lo; i < hi; i += 1) {
+    const c = s[i];
+    if (c === '"') {
+      if (s.startsWith(needle, i)) {
+        const colon = skipWs(s, i + needle.length);
+        if (colon < hi && s[colon] === ':') return colon;
+      }
+      const end = scanStringEnd(s, i);
+      if (end === -1) return -1; // truncated string — nothing provable beyond
+      i = end;
+      continue;
+    }
+    if (c === '{' || c === '[') {
+      const close = matchEnclosure(s, i);
+      if (close === -1 || close >= hi) return -1;
+      i = close;
     }
-    pos = s.indexOf(needle, pos + 1);
   }
   return -1;
 };
@@ -84,7 +118,9 @@ export function salvageField(text, dotPath) {
     .filter(Boolean);
   if (!data || data[0] !== '{' || dotted.length === 0 || dotted.length > 4) return INCOMPLETE;
 
-  let regionLo = 0;
+  // The scan region is INSIDE the current object: [lo, hi) bounds the braces,
+  // so start after the opening `{` (data[0] === '{' is guaranteed above).
+  let regionLo = 1;
   let regionHi = data.length;
   for (let k = 0; k < dotted.length; k += 1) {
     const colon = findKey(data, dotted[k], regionLo, regionHi);

package/template_project/.claude/ukit/runtime/hook-input.sh

@@ -233,26 +233,61 @@ const matchBrace = (s, open) => {
   }
   return -1;
 };
-// Find `"key"` used as an object key inside region [lo, hi); returns the index
-// of its `:` or -1. A bare `"key"` inside a string value cannot produce this
-// shape (its quotes are escaped), and non-key uses lack the `:` — both are
-// skipped by scanning forward.
+// Index of the closer matching the `{`/`[` at `open` (string-aware, mixed
+// brackets), or -1 when unclosed/mismatched. A strict mismatch also aborts:
+// depth bookkeeping past it would be meaningless.
+const matchEnclosure = (s, open) => {
+  const stack = [];
+  for (let i = open; i < s.length; i += 1) {
+    const c = s[i];
+    if (c === '"') {
+      const end = scanStringEnd(s, i);
+      if (end === -1) return -1;
+      i = end;
+      continue;
+    }
+    if (c === '{' || c === '[') { stack.push(c); continue; }
+    if (c === '}' || c === ']') {
+      const top = stack.pop();
+      if ((c === '}' && top !== '{') || (c === ']' && top !== '[')) return -1;
+      if (stack.length === 0) return i;
+    }
+  }
+  return -1;
+};
+// BUG-C90-14 (FR-002): find `"key"` at THIS object's depth inside [lo, hi) —
+// the region bounds are the parent object's braces, so every candidate here is
+// top-level by construction. A same-named key inside a NESTED value (object or
+// array) must be skipped structurally, never matched: the previous flat
+// indexOf scan let `{"nested":{"command":"echo hi"},"command":"rm -rf /"}`
+// salvage "echo hi" instead of the real outer field (fail-open on the deny
+// gates). Returns the index of the key's `:` or -1.
 const findKey = (s, key, lo, hi) => {
   const needle = `"${key}"`;
-  let pos = s.indexOf(needle, lo);
-  while (pos !== -1 && pos < hi) {
-    const colon = skipWs(s, pos + needle.length);
-    if (colon < hi && colon < s.length && s[colon] === ':') {
-      const prev = pos - 1;
-      const pc = prev >= 0 ? s[prev] : '';
-      if (prev < 0 || pc === '{' || pc === ',' || isWs(pc)) return colon;
+  for (let i = lo; i < hi; i += 1) {
+    const c = s[i];
+    if (c === '"') {
+      if (s.startsWith(needle, i)) {
+        const colon = skipWs(s, i + needle.length);
+        if (colon < hi && s[colon] === ':') return colon;
+      }
+      const end = scanStringEnd(s, i);
+      if (end === -1) return -1; // truncated string — nothing provable beyond
+      i = end;
+      continue;
+    }
+    if (c === '{' || c === '[') {
+      const close = matchEnclosure(s, i);
+      if (close === -1 || close >= hi) return -1;
+      i = close;
     }
-    pos = s.indexOf(needle, pos + 1);
   }
   return -1;
 };
 
-let regionLo = 0;
+// The scan region is INSIDE the current object: [lo, hi) bounds the braces, so
+// start after the opening `{` (data[0] === '{' is guaranteed above).
+let regionLo = 1;
 let regionHi = data.length;
 for (let k = 0; k < dotted.length; k += 1) {
   const colon = findKey(data, dotted[k], regionLo, regionHi);