@ngockhoale/ukit 3.4.1 → 3.4.3

package/src/index/queryIndex.js

@@ -34,6 +34,16 @@ function safeItems(artifact) {
   return artifact.items.filter((entry) => entry && typeof entry === 'object');
 }
 
+// C92-B-03 consumer symmetry: an artifact written under a different
+// INDEX_SCHEMA_VERSION (older OR newer — a package downgrade leaves newer
+// artifacts on disk) is treated as absent, exactly like getFileOutline's
+// schema gate on symbols.json. Without it, queryCodeIndex scores the
+// mismatched set and looks healthy while outline: silently disappears.
+function safeSchemaArtifact(artifact) {
+  const normalized = ensureArtifact(artifact);
+  return normalized.schemaVersion === INDEX_SCHEMA_VERSION ? normalized : { items: [] };
+}
+
 export async function queryCodeIndex({ rootDir = process.cwd(), query, limit = 5 } = {}) {
   const normalizedQuery = String(query ?? '').trim();
   if (!normalizedQuery) {
@@ -67,7 +77,7 @@ export async function queryCodeIndex({ rootDir = process.cwd(), query, limit = 5
 
     for (const file of safeItems(files)) {
       const filePath = file.filePath;
-      if (isLikelyTestFilePath(filePath) && !includeLikelyTestFiles) {
+      if (typeof filePath !== 'string' || !filePath || (isLikelyTestFilePath(filePath) && !includeLikelyTestFiles)) {
         continue;
       }
       const searchDescriptor = searchDescriptorsByFile.get(filePath) ?? createFileSearchDescriptor({ filePath, symbols: [] });
@@ -235,8 +245,10 @@ async function loadQuerySearchBundle(rootDir) {
         readArtifact(absoluteRoot, INDEX_ARTIFACTS.symbols),
       ])
         .then(([files, symbols]) => {
-          const safeFiles = ensureArtifact(files);
-          const safeSymbols = ensureArtifact(symbols);
+          // C92-B-03: same schema contract getFileOutline applies — a mismatched
+          // artifact reads as empty instead of feeding ranking.
+          const safeFiles = safeSchemaArtifact(files);
+          const safeSymbols = safeSchemaArtifact(symbols);
           const symbolMap = groupBy(safeItems(safeSymbols), (item) => item.filePath);
           return {
             files: safeFiles,
@@ -269,11 +281,11 @@ async function loadQuerySupportBundle(rootDir) {
           readArtifact(absoluteRoot, INDEX_ARTIFACTS.archetypes),
         ]))
         .then(([files, imports, testsMap, hotspots, archetypes]) => {
-          const safeFiles = ensureArtifact(files);
-          const safeImports = ensureArtifact(imports);
-          const safeTestsMap = ensureArtifact(testsMap);
-          const safeHotspots = ensureArtifact(hotspots);
-          const safeArchetypes = ensureArtifact(archetypes);
+          const safeFiles = safeSchemaArtifact(files);
+          const safeImports = safeSchemaArtifact(imports);
+          const safeTestsMap = safeSchemaArtifact(testsMap);
+          const safeHotspots = safeSchemaArtifact(hotspots);
+          const safeArchetypes = safeSchemaArtifact(archetypes);
           const indexedFileSet = new Set(safeItems(safeFiles).map((item) => item.filePath));
           const aliasContextPromise = importsNeedAliasContext(safeItems(safeImports))
             ? loadImportAliasContext({ rootDir: absoluteRoot })
@@ -566,7 +578,7 @@ function buildResolvedImportGraphs(rootDir, imports, indexedFileSet, importAlias
   const importersByTarget = new Map();
 
   for (const edge of imports) {
-    if (!edge?.from || !edge?.to) {
+    if (typeof edge?.from !== 'string' || typeof edge?.to !== 'string' || !edge.from || !edge.to) {
       continue;
     }
 
@@ -700,6 +712,12 @@ function ensureArtifact(artifact) {
   };
 }
 
+// The cache keys matched against this escaped value are produced by
+// JSON.stringify, which escapes control characters (\n, \b, \u00XX, lone
+// surrogates) on top of backslash/quote. Hand-escaping only \\ and \" means a
+// rootDir containing control characters never matches its own cache keys, so
+// clearIndexArtifactCache leaves stale results behind. Reuse JSON.stringify
+// itself and strip the surrounding quotes to stay in lockstep.
 function escapeJsonString(value) {
-  return String(value).replaceAll('\\', '\\\\').replaceAll('"', '\\"');
+  return JSON.stringify(String(value)).slice(1, -1);
 }

package/src/index/routeResolver.js

@@ -312,7 +312,7 @@ export function deriveRiskFloor({
     codes.push('shared-impact');
   }
   if (
-    /(^|\/)(package\.json|manifests\/|.*\.d\.ts$|(^|\/)api\/|openapi|swagger)/i.test(target)
+    /(^|\/)(package\.json|manifests\/|.*\.d\.ts$|api\/|openapi|swagger)/i.test(target)
     || /\b(public api|breaking change|api contract|semver)\b/i.test(signalText)
   ) {
     codes.push('public-contract');
@@ -417,14 +417,19 @@ export function deriveFastPath({
     return null;
   }
   const reasons = (riskFloor.codes ?? []).filter((code) => FAST_PATH_REASON_CODES.has(code));
-  const hasLocalTarget = Boolean(targetFile) || contextPreview?.primaryTargets?.length === 1;
+  // C91-022 (W3-TR2): the shared-impact veto must consult the same target that
+  // granted locality — the explicit targetFile, else the single primaryTarget.
+  const localTarget = targetFile || (contextPreview?.primaryTargets?.length === 1
+    ? contextPreview.primaryTargets[0]
+    : null);
+  const hasLocalTarget = Boolean(localTarget);
   const hasBoundedVerification = (verificationRecommendation?.commands?.length ?? 0) > 0
     || buildExecutionContract(executionMode)?.verificationPolicy === 'minimal-or-targeted';
   const eligible = FAST_PATH_MODES.has(executionMode)
     && hasLocalTarget
     && riskFloor.floor === 'none'
     && hasBoundedVerification
-    && !isSharedImpactFile(targetFile);
+    && !isSharedImpactFile(localTarget);
   return {
     eligible,
     suppressed: eligible ? [...FAST_PATH_SUPPRESSED] : [],

package/src/index/taskRouting.js

@@ -2452,6 +2452,29 @@ function normalizeRelativeFile(rootDir, rawFilePath) {
   return trimmed.replace(/^\.\/+/, '').replaceAll('\\', '/');
 }
 
+// C91-022 (W3-TR3): the probe stays a health check but must not re-parse ~23MB
+// of index artifacts on every routed prompt. Results are cached per index-dir
+// fingerprint (entry names + mtime + size of each *.json artifact), so an
+// unchanged index costs O(#files) stats and zero parses; any artifact change
+// shifts the fingerprint and re-probes. The cache is bounded so long-running
+// hosts probing many roots never grow it without limit.
+const INDEX_PROBE_CACHE_MAX = 64;
+const indexProbeCache = new Map();
+
+async function fingerprintIndexDir(indexDir, entries) {
+  const jsonEntries = entries.filter((entry) => entry.endsWith('.json')).sort();
+  const parts = [];
+  for (const entry of jsonEntries) {
+    try {
+      const stat = await fs.stat(path.join(indexDir, entry));
+      parts.push(`${entry}:${stat.mtimeMs}:${stat.size}`);
+    } catch {
+      parts.push(`${entry}:missing`);
+    }
+  }
+  return parts.join('|');
+}
+
 async function findUnreadableIndexArtifact(rootDir) {
   const indexDir = path.join(rootDir, '.cache', 'index');
   let entries;
@@ -2461,6 +2484,13 @@ async function findUnreadableIndexArtifact(rootDir) {
     return null;
   }
 
+  const fingerprint = await fingerprintIndexDir(indexDir, entries);
+  const cacheKey = `${indexDir}\0${fingerprint}`;
+  if (indexProbeCache.has(cacheKey)) {
+    return indexProbeCache.get(cacheKey);
+  }
+
+  let unreadable = null;
   for (const entry of entries) {
     if (!entry.endsWith('.json')) {
       continue;
@@ -2469,11 +2499,16 @@ async function findUnreadableIndexArtifact(rootDir) {
     try {
       JSON.parse(await fs.readFile(path.join(indexDir, entry), 'utf8'));
     } catch (error) {
-      return new Error(`${entry}: ${error?.message ?? String(error)}`);
+      unreadable = new Error(`${entry}: ${error?.message ?? String(error)}`);
+      break;
     }
   }
 
-  return null;
+  if (indexProbeCache.size >= INDEX_PROBE_CACHE_MAX) {
+    indexProbeCache.clear();
+  }
+  indexProbeCache.set(cacheKey, unreadable);
+  return unreadable;
 }
 
 async function pathExists(filePath) {

package/src/learning/codeProposals.js

@@ -28,7 +28,7 @@ const TASKS_DIR_REL = path.join('docs', 'AI_HANDOFF', 'tasks');
 const ARCHIVE_DIR_REL = path.join('docs', 'AI_HANDOFF', 'archive');
 const ARTIFACT_REL = path.join('.ukit', 'storage', 'cache', 'failure-patterns.json');
 const PLAN_REL = 'docs/plans/SELF_IMPROVE_CODE_LANE.md';
-const SIGNATURE_FIELD_RE = /signature["']?\s*:\s*["'`]?([^\n"'`,}]+)/gi;
+const SIGNATURE_FIELD_RE = /signature["']?\s*:\s*(?:`([^`\n]*)`|"((?:[^"\\\n]|\\.)*)"|'([^'\n]*)')/gi;
 const MIN_SESSIONS = 2;
 const AUTO_NAME_RE = /^AUTO-(\d+)\.md$/;
 
@@ -94,11 +94,19 @@ export function mapPatternToFixTarget(pattern) {
   return null;
 }
 
+// W3-F4: strip ./ and resolve ../ so syntactic variants can't slip past the
+// denylist. On case-insensitive filesystems (win32/darwin) a case variant
+// names the same denied file, so the patterns are folded there — Linux keeps
+// case-sensitive matching (denylist semantics unchanged, planner note).
+const DENY_TARGET_RES = (process.platform === 'win32' || process.platform === 'darwin')
+  ? DENIED_TARGET_RES.map((re) => (re.ignoreCase ? re : new RegExp(re.source, `${re.flags}i`)))
+  : DENIED_TARGET_RES;
+
 function normalizeTargets(pattern) {
   const files = Array.isArray(pattern?.files)
     ? pattern.files.filter((f) => typeof f === 'string' && f.trim())
     : [];
-  return files.map((f) => f.replace(/\\/g, '/'));
+  return files.map((f) => path.posix.normalize(f.replace(/\\/g, '/')));
 }
 
 async function loadPatterns(projectRoot) {
@@ -157,8 +165,19 @@ async function scanHandoffDirs(projectRoot) {
       }
       SIGNATURE_FIELD_RE.lastIndex = 0;
       for (const match of text.matchAll(SIGNATURE_FIELD_RE)) {
-        const sig = match[1].trim();
-        if (sig) signatures.add(sig);
+        const raw = (match[1] ?? match[2] ?? match[3] ?? '').trim();
+        if (!raw) continue;
+        // JSON "…" captures may carry escapes; decode so the scanned signature
+        // equals the raw pattern.signature stored in the evidence block.
+        let sig = raw;
+        if (match[2] !== undefined) {
+          try {
+            sig = JSON.parse(`"${match[2]}"`);
+          } catch {
+            // keep raw
+          }
+        }
+        signatures.add(sig);
       }
     }
   }
@@ -300,7 +319,7 @@ export async function proposeCodeFixTasks(projectRoot, {
       entry.fixClass = fixClass.id;
 
       const targets = normalizeTargets(pattern);
-      if (targets.some((f) => DENIED_TARGET_RES.some((re) => re.test(f)))) {
+      if (targets.some((f) => DENY_TARGET_RES.some((re) => re.test(f)))) {
         entry.reason = 'denied-target';
         continue;
       }

package/src/learning/selfImprove.js

@@ -37,6 +37,7 @@ import path from 'node:path';
 import { inspectRuntimeConfig, resolveDecisionRuntimeStage } from '../core/runtimeConfig.js';
 import { withFileLock } from '../core/fileOps.js';
 import { detectProjectContext } from '../context/detectProjectContext.js';
+import { buildUserPaths } from '../core/userPaths.js';
 import { backfillEpisodes } from '../core/memory/episodes.js';
 import { mineFailurePatterns } from '../diagnostics/failurePatterns.js';
 import { collectFeedbackEvents } from '../diagnostics/feedbackEvents.js';
@@ -68,13 +69,27 @@ async function readJson(filePath) {
 }
 
 async function writeJsonAtomic(filePath, value) {
-  const tmp = `${filePath}.tmp-${process.pid}`;
+  const tmp = `${filePath}.tmp-${process.pid}-${Math.random().toString(16).slice(2)}`;
   try {
     await fs.mkdir(path.dirname(filePath), { recursive: true });
     await fs.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`);
     await fs.rename(tmp, filePath);
-  } catch {
+    return null;
+  } catch (error) {
     await fs.rm(tmp, { force: true }).catch(() => {});
+    return error?.message ?? String(error);
+  }
+}
+
+// W3-F3: read the user-level config layer raw so its tuning opt-out can
+// override project config (resolveApplyMode treats user 'manual'|'off'|disabled
+// as the more restrictive mode that wins).
+async function readUserRawConfig(homeDir) {
+  const configPath = buildUserPaths({ homeDir }).configPath;
+  try {
+    return JSON.parse(await fs.readFile(configPath, 'utf8'));
+  } catch {
+    return null;
   }
 }
 
@@ -167,7 +182,11 @@ export async function runSelfImprove(projectRoot, {
     }
     const stamp = await readJson(stampPath);
     const lastRunAt = Date.parse(stamp?.lastRunAt ?? '');
-    if (!force && Number.isFinite(lastRunAt) && now - lastRunAt < minIntervalMs) {
+    // W3-F5: a future lastRunAt (clock skew, hand-edit) would keep
+    // `now - lastRunAt` negative forever — treat it as stale so the pass
+    // re-stamps the clock-corrected value.
+    const stampIsFuture = Number.isFinite(lastRunAt) && lastRunAt > now;
+    if (!force && Number.isFinite(lastRunAt) && !stampIsFuture && now - lastRunAt < minIntervalMs) {
       return { status: 'skipped', reason: 'min_interval' };
     }
 
@@ -227,7 +246,7 @@ export async function runSelfImprove(projectRoot, {
       }));
       steps.push(await step('tuning', async () => {
         const result = await computeTuningSuggestions(root);
-        const mode = resolveApplyMode(rawConfig ?? {});
+        const mode = resolveApplyMode(rawConfig ?? {}, await readUserRawConfig(homeDir));
         const applied = mode === 'auto' ? await applyTuning(root, result.suggestions, { now }) : [];
         return { status: 'ok', mode, suggestions: result.suggestions.length, applied };
       }));
@@ -256,10 +275,15 @@ export async function runSelfImprove(projectRoot, {
         };
       }));
 
-      await writeJsonAtomic(stampPath, {
+      const stampError = await writeJsonAtomic(stampPath, {
         lastRunAt: new Date(now).toISOString(),
         steps,
       });
+      // W3-F7: surface the failure — a swallowed stamp write leaves lastRunAt
+      // stale and the next trigger re-runs the full pass invisibly.
+      if (stampError !== null) {
+        steps.push({ name: 'stamp', status: 'failed', reason: stampError });
+      }
       return steps;
     }, { maxWaitMs: 500 });
 

package/src/learning/tunedOverlay.js

@@ -67,7 +67,7 @@ export async function readTunedDocument(projectRoot) {
 
 export async function writeTunedDocument(projectRoot, doc) {
   const filePath = path.join(projectRoot, TUNED_REL);
-  const tmp = `${filePath}.tmp-${process.pid}`;
+  const tmp = `${filePath}.tmp-${process.pid}-${Math.random().toString(16).slice(2)}`;
   try {
     await fs.mkdir(path.dirname(filePath), { recursive: true });
     await fs.writeFile(tmp, `${JSON.stringify({ ...doc, version: TUNED_VERSION }, null, 2)}\n`);
@@ -79,13 +79,24 @@ export async function writeTunedDocument(projectRoot, doc) {
   }
 }
 
-// Resolves the effective apply mode from a raw (pre-default) config object:
-// absent → 'auto' (the shipped default).
-export function resolveApplyMode(rawConfig) {
+// Resolves the effective apply mode from raw (pre-default) config objects:
+// absent → 'auto' (the shipped default). When the user-level layer is passed,
+// the more restrictive mode wins so a user opt-out ('manual'|'off'|disabled)
+// can never be overridden back to auto-apply by project config.
+const APPLY_MODE_RANK = { off: 0, manual: 1, auto: 2 };
+export function resolveApplyMode(rawConfig, userConfig) {
   const tuning = rawConfig?.learning?.tuning;
-  if (tuning?.enabled === false) return 'off';
-  const mode = tuning?.applyMode;
-  return mode === 'manual' || mode === 'off' || mode === 'auto' ? mode : 'auto';
+  const enabled = tuning?.enabled !== false
+    && (!userConfig || userConfig?.learning?.tuning?.enabled !== false);
+  if (!enabled) return 'off';
+  const modeOf = (cfg) => {
+    const mode = cfg?.learning?.tuning?.applyMode;
+    return mode === 'manual' || mode === 'off' || mode === 'auto' ? mode : 'auto';
+  };
+  const mode = modeOf(rawConfig);
+  if (userConfig === undefined) return mode;
+  const userMode = modeOf(userConfig);
+  return APPLY_MODE_RANK[userMode] < APPLY_MODE_RANK[mode] ? userMode : mode;
 }
 
 // Returns a copy of `config` with `overrides` set at their dotted paths.

package/src/learning/tuning.js

@@ -24,6 +24,8 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
+import { mergeTunedOverlay } from './tunedOverlay.js';
+
 const LEARNING_DIR_REL = path.join('.ukit', 'storage', 'learning');
 const SUGGESTIONS_REL = path.join(LEARNING_DIR_REL, 'suggestions.json');
 const FEEDBACK_EVENTS_REL = path.join(LEARNING_DIR_REL, 'feedback-events.json');
@@ -63,7 +65,7 @@ async function readJson(filePath) {
 
 async function writeArtifact(filePath, result) {
   const dir = path.dirname(filePath);
-  const tmp = path.join(dir, `.suggestions-${process.pid}.tmp`);
+  const tmp = path.join(dir, `.suggestions-${process.pid}-${Math.random().toString(16).slice(2)}.tmp`);
   try {
     await fs.mkdir(dir, { recursive: true });
     await fs.writeFile(tmp, JSON.stringify(result, null, 2));
@@ -197,10 +199,14 @@ export async function computeTuningSuggestions(projectRoot) {
       result.skipped.push({ target: 'skills.*', reason: 'no skill-accuracy.json artifact' });
     }
 
-    const weights = isObject(config?.codeIntel?.retriever?.weights)
-      ? config.codeIntel.retriever.weights
+    // W3-F2: suggestions must ratchet off the effective (overlay-applied)
+    // value — merging tuned.json mirrors what inspectRuntimeConfig feeds the
+    // runtime. In non-'auto' modes mergeTunedOverlay returns the raw config.
+    const effectiveConfig = await mergeTunedOverlay(projectRoot, config ?? {});
+    const weights = isObject(effectiveConfig?.codeIntel?.retriever?.weights)
+      ? effectiveConfig.codeIntel.retriever.weights
       : DEFAULT_WEIGHTS;
-    const debugLoopThreshold = config?.orchestration?.escalation?.debugLoopThreshold;
+    const debugLoopThreshold = effectiveConfig?.orchestration?.escalation?.debugLoopThreshold;
 
     laneWeightSuggestions(laneStats, weights, result.suggestions, result.skipped);
     escalationSuggestion(feedbackEvents, debugLoopThreshold, result.suggestions, result.skipped);

package/src/skill/auditSkill.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { writeFileAtomic } from '../core/fileOps.js';
 
 const TEMPLATE_FILES = [
   'pressure-scenario-template.md',
@@ -7,7 +8,21 @@ const TEMPLATE_FILES = [
   'trigger-accuracy-template.md',
 ];
 
+// C91-022 (W3-skill): skillName becomes a path segment — reject traversal and
+// separators before path.join so `../../x` can never escape docs/skill-audits.
+function isValidSkillName(skillName) {
+  return typeof skillName === 'string'
+    && skillName.trim().length > 0
+    && skillName !== '.'
+    && !skillName.includes('..')
+    && !skillName.includes('/')
+    && !skillName.includes('\\');
+}
+
 export function getAuditDir(rootDir, skillName) {
+  if (!isValidSkillName(skillName)) {
+    throw new Error(`invalid skill name: ${JSON.stringify(skillName)} — expected a plain directory name without path separators or ".."`);
+  }
   return path.join(rootDir, 'docs', 'skill-audits', skillName);
 }
 
@@ -64,7 +79,7 @@ export async function recordAuditEntry({ rootDir = process.cwd(), skillName, ent
   };
 
   history.push(record);
-  await fs.writeFile(historyPath, `${JSON.stringify(history, null, 2)}\n`, 'utf8');
+  await writeFileAtomic(historyPath, `${JSON.stringify(history, null, 2)}\n`);
 
   return record;
 }
@@ -88,14 +103,38 @@ export async function statusSkillAudit({ rootDir = process.cwd(), skillName } =
 }
 
 async function readHistory(historyPath) {
-  const raw = await fs.readFile(historyPath, 'utf8').catch(() => null);
-  if (!raw) {
-    return [];
+  // C92-H-04: "absent" and "unreadable" are NOT the same. Only ENOENT yields a
+  // fresh array — any other failure to read or parse an existing history must
+  // fail loudly, or recordAuditEntry would overwrite the whole audit trail
+  // with a single row and report it as success.
+  let raw;
+  try {
+    raw = await fs.readFile(historyPath, 'utf8');
+  } catch (error) {
+    if (error?.code === 'ENOENT') {
+      return [];
+    }
+    const wrapped = new Error(
+      `cannot read skill-audit history at ${historyPath}: ${error?.message ?? error}. ` +
+      'Fix the file permissions or remove it to start a fresh audit trail.',
+      { cause: error },
+    );
+    wrapped.code = 'ERR_SKILL_AUDIT_HISTORY_UNREADABLE';
+    throw wrapped;
   }
   try {
     const parsed = JSON.parse(raw);
-    return Array.isArray(parsed) ? parsed : [];
-  } catch {
-    return [];
+    if (!Array.isArray(parsed)) {
+      throw new Error(`expected a JSON array at the top level, got ${Array.isArray(parsed) ? 'array' : typeof parsed}`);
+    }
+    return parsed;
+  } catch (error) {
+    const wrapped = new Error(
+      `malformed skill-audit history at ${historyPath}: ${error?.message ?? error}. ` +
+      'The file was left untouched — repair or remove it before recording a new entry.',
+      { cause: error },
+    );
+    wrapped.code = 'ERR_SKILL_AUDIT_HISTORY_MALFORMED';
+    throw wrapped;
   }
 }

package/template_project/.claude/commands/ukit/handoff-review.md

@@ -129,7 +129,10 @@ node .claude/ukit/index/review-panel-aggregate.mjs docs/AI_HANDOFF/tasks/TASK-xx
 
 The script emits an Agreement Map (finding → set of panel members reporting it) and a
 consensus verdict (`approved` when ≥2 members approve and no critical;
-`changes_requested` when ≥1 critical or ≥2 request changes; else `approved_minor`).
+`changes_requested` on ≥1 critical verdict/finding, ≥1 member requesting
+changes, or zero parseable verdict blocks — it fails closed; else
+`approved_minor`). Only the latest review round counts: `## Reviewer Verdict
+(round N)` blocks supersede earlier rounds.
 `consensus≥2 identical findings = high signal` — a finding reported by two or more
 members is high-signal. The consensus verdict, not any single member's vote, drives
 `NEXT_STATUS_FOR_INDEX`.

package/template_project/.claude/hooks/auto-allow-bash.sh

@@ -107,7 +107,16 @@ fi
 
 BIN_BASENAME=$(basename "$BIN")
 
-if [[ "$BIN" =~ ^(rm|sudo|dd|mkfs|shutdown|reboot|halt|poweroff|chown|killall|pkill)$ ]]; then
+if [[ "$BIN_BASENAME" =~ ^(rm|sudo|dd|mkfs|shutdown|reboot|halt|poweroff|chown|killall|pkill)$ ]]; then
+  exit 0
+fi
+
+# W2-D02: wrapper executables launch an arbitrary operand (a command string or
+# another binary), so minting Bash(<wrapper>:*) allows anything they can run.
+# They are NOT in the token-skip list above: skipping would resolve BIN to the
+# operand token (`timeout 30 ls` → BIN=30, `ssh host ls` → BIN=host) and mint a
+# nonsense wildcard rule. Deny outright and fall back to the permission prompt.
+if [[ "$BIN_BASENAME" =~ ^(eval|nice|timeout|xargs|ssh|su|chroot|docker|sudo|doas|watch|stdbuf|noglob)$ ]]; then
   exit 0
 fi
 

package/template_project/.claude/hooks/block-dangerous.mjs

@@ -128,6 +128,14 @@ const HAS_FORCE_RE = new RegExp(`(^|${SP})--force|(^|${SP})-[a-zA-Z]*f`, 'm');
 
 const basename = (token) => token.split('/').pop();
 
+// BUG-C90-04 (FR-001): a shell word is formed AFTER quote removal and
+// backslash escapes, so `r''m`, `r""m`, `r'm'`, `\rm` are all the single word
+// `rm`. Whitespace-splitting the raw text leaves those splices inside token[0]
+// and the literal 'rm' comparison below would silently pass them. Minimal
+// normalization only (strip ' " \, then basename) — this is not a shell
+// parser; every other token keeps its raw bytes.
+const normalizeExecWord = (token) => basename(token.replace(/['"\\]/g, ''));
+
 // ukit_canonical_path parity: realpath -m semantics — resolve the deepest
 // existing ancestor, append the lexical remainder; unresolvable -> '' (the
 // caller fails closed, never silently allows). UKIT_REALPATH_MISSING=1 (set by
@@ -196,7 +204,7 @@ async function evaluate({ command, projectRoot, env, deadlineMs, signal }) {
   // its output cannot reach a shell — `echo "rm -rf /" | bash` executes the
   // quoted text, so it must never be scrubbed.
   const head = (command.trimStart().split(/\s+/)[0] || '');
-  const cmdHead = basename(head);
+  const cmdHead = normalizeExecWord(head);
   let scan = command;
   if (SAFE_TEXT_HEADS.has(cmdHead) && !PIPE_TO_SHELL_RE.test(command)) {
     scan = command.replace(/'[^']*'/g, "'Q'").replace(/"[^"]*"/g, '"Q"');
@@ -220,7 +228,7 @@ async function evaluate({ command, projectRoot, env, deadlineMs, signal }) {
     const segment = rawSegment;
     if (!segment) continue;
     const tokens = segment.trimStart().split(/\s+/).filter(Boolean);
-    if (basename(tokens[0] || '') !== 'rm') continue;
+    if (normalizeExecWord(tokens[0] || '') !== 'rm') continue;
 
     // flags: leading -x tokens until `--` or the first non-flag word.
     let hasR = false;

package/template_project/.claude/hooks/handoff-model-guard.sh

@@ -161,6 +161,42 @@ function isPlaceholderValue(value) {
   if (!raw || /^[<(]/.test(raw)) return true;
   return ['-','--','tbd','todo','n/a','na','none','unknown','pending'].includes(raw.toLowerCase());
 }
+  // W2-D07 fix: `OVERRIDE_APPROVED_BY: human` was plain text inside gated files —
+  // self-authorizable by the gated model. The in-file `## Model-Tier Guard Override`
+  // declaration stays (it is the audit trail), but it only counts when a marker file
+  // `.ukit/storage/tier-override` — created by the human/operator OUTSIDE the gated
+  // paths — exists and scopes this target:
+  //   `all`           → every target in this cycle
+  //   `plan`          → plan-level checks (PLANNER_MODEL gate)
+  //   `TASK-<id>`     → that task only (e.g. TASK-C91-001, TASK-042)
+  // One scope token per line; `#` comments allowed. Empty/scopeless marker = no
+  // override (fail closed). UKIT_TIER_OVERRIDE and other env vars are NOT anchors —
+  // tool-run env is agent-settable; the marker is a distinct filesystem action.
+  const overrideScopeSet = async () => {
+    const text = await readTextSafe(path.join(projectRoot, '.ukit/storage/tier-override'));
+    const scopes = new Set();
+    for (const line of text.split(/\r?\n/)) {
+      const t = line.trim();
+      if (!t || t.startsWith('#')) continue;
+      for (const tok of t.split(/\s+/)) {
+        const m = tok.toUpperCase().match(/^(ALL|PLAN|TASK-(?:C\d+-)?\d+)$/);
+        if (m) scopes.add(m[1]);
+      }
+    }
+    return scopes;
+  };
+  const declaresOverride = (text) =>
+    /## Model-Tier Guard Override/.test(text) && /OVERRIDE_APPROVED_BY:\s*human/i.test(text);
+  const planHasHumanOverride = async (text) => {
+    if (!declaresOverride(text)) return false;
+    const s = await overrideScopeSet();
+    return s.has('ALL') || s.has('PLAN');
+  };
+  const taskHasHumanOverride = async (text, taskId) => {
+    if (!declaresOverride(text)) return false;
+    const s = await overrideScopeSet();
+    return s.has('ALL') || s.has(String(taskId).toUpperCase());
+  };
 
 if (toolName === 'Write' || toolName === 'Edit') {
   const filePath = String(input.file_path || '');
@@ -168,7 +204,7 @@ if (toolName === 'Write' || toolName === 'Edit') {
 
   const relPath = path.relative(projectRoot, filePath).replace(/\\/g, '/');
   const isPlan = relPath === 'docs/AI_HANDOFF/PLAN.md';
-  const taskMatch = relPath.match(/^docs\/AI_HANDOFF\/tasks\/(TASK-\d+)\.md$/);
+  const taskMatch = relPath.match(/^docs\/AI_HANDOFF\/tasks\/(TASK-(?:C\d+-)?\d+)\.md$/);
   if (!isPlan && !taskMatch) process.exit(0);
 
   const fileExists = await pathExists(filePath);
@@ -189,15 +225,9 @@ if (toolName === 'Write' || toolName === 'Edit') {
   const newVisible = stripHtmlComments(newContent);
   const currentVisible = stripHtmlComments(currentContent);
 
-  // A documented, human-approved override closes the tier contract for this
-  // cycle — e.g. a gateway with no smart-tier model where the human approved
-  // planning on the available tier. Same semantics as the push-time check.
-  const planHasHumanOverride = (text) =>
-    /## Model-Tier Guard Override/.test(text) && /OVERRIDE_APPROVED_BY:\s*human/i.test(text);
-
   if (isPlan && /## Planner Report/.test(newVisible)) {
     const plannerModel = extractField(newVisible, 'PLANNER_MODEL');
-    if (!planHasHumanOverride(newVisible)) {
+    if (!(await planHasHumanOverride(newVisible))) {
       if (!plannerModel || /^unknown$/i.test(plannerModel)) {
         block('PLANNER_MODEL missing/unknown in PLAN.md. Planning must run via Agent tool subagent_type: "handoff-planner" (opus/unic-smart) and self-report its model.');
       }
@@ -221,7 +251,7 @@ if (toolName === 'Write' || toolName === 'Edit') {
       const planContent = (await pathExists(planPath)) ? await readTextSafe(planPath) : '';
       const planVisible = stripHtmlComments(planContent);
       const plannerModel = extractField(planVisible, 'PLANNER_MODEL');
-      if (!planHasHumanOverride(planVisible) && (!plannerModel || tierOf(plannerModel) !== 'smart')) {
+      if (!(await planHasHumanOverride(planVisible)) && (!plannerModel || tierOf(plannerModel) !== 'smart')) {
         block(`Cannot create ${taskId}.md — PLAN.md has no valid smart-tier PLANNER_MODEL yet. Run planning via Agent tool subagent_type: "handoff-planner" (opus/unic-smart) first.`);
       }
 
@@ -297,7 +327,8 @@ if (toolName === 'Write' || toolName === 'Edit') {
       const executorModel = extractField(currentVisible, 'EXECUTOR_MODEL') || extractField(newVisible, 'EXECUTOR_MODEL');
       const reviewerModel = extractField(newVisible, 'REVIEWER_MODEL');
       const planContentForReview = (await pathExists(planPath)) ? await readTextSafe(planPath) : '';
-      const reviewOverride = planHasHumanOverride(stripHtmlComments(planContentForReview));
+      const reviewOverride = await taskHasHumanOverride(newVisible, taskId)
+        || await planHasHumanOverride(stripHtmlComments(planContentForReview));
       if (isPlaceholderValue(reviewerModel) || /^unknown$/i.test(reviewerModel)) {
         if (!isFreshTaskFile) {
           block(`${taskId}: REVIEWER_MODEL missing/placeholder. Review must run via Agent tool subagent_type: "code-reviewer" (opus/unic-smart) and self-report its model.`);
@@ -345,7 +376,7 @@ if (toolName === 'Bash') {
   const indexPath = path.join(projectRoot, 'docs/AI_HANDOFF/INDEX.md');
   if (!(await pathExists(activePath)) || !(await pathExists(indexPath))) process.exit(0); // no handoff cycle here
 
-  const taskIds = [...(await fsp.readFile(indexPath, 'utf8')).matchAll(/TASK-\d+/g)]
+  const taskIds = [...(await fsp.readFile(indexPath, 'utf8')).matchAll(/TASK-(?:C\d+-)?\d+/g)]
     .map((m) => m[0])
     .filter((v, i, a) => a.indexOf(v) === i);
 
@@ -356,11 +387,10 @@ if (toolName === 'Bash') {
     const text = stripHtmlComments(await fsp.readFile(taskPath, 'utf8'));
     if (!text.includes('## Reviewer Verdict')) continue; // not yet reviewed, not this push's concern
 
-    // A documented, human-approved exception (e.g. an opus-tier executor escalation left no
-    // second opus identity free to review it) is a closed, one-time decision — it must not
-    // re-block every future unrelated push forever just because the task file still contains
-    // the exempted model string.
-    if (/## Model-Tier Guard Override/.test(text) && /OVERRIDE_APPROVED_BY:\s*human/i.test(text)) continue;
+    // A declared + externally-evidenced human override (see planHasHumanOverride above)
+    // is a closed decision — it must not re-block every future unrelated push forever
+    // just because the task file still contains the exempted model string.
+    if (await taskHasHumanOverride(text, taskId)) continue;
 
     const executorModel = extractField(text, 'EXECUTOR_MODEL');
     const reviewerModel = extractField(text, 'REVIEWER_MODEL');