@ngockhoale/ukit 3.4.1 → 3.4.3

package/template_project/.claude/hooks/reset-compact-pressure.sh

@@ -24,23 +24,55 @@ if [ ! -f "$PRESSURE_FILE" ]; then
   exit 0
 fi
 
-# O1 (TASK-009): armed AFTER the no-pressure-file short-circuit above, so the common
-# "nothing to reset" start stays unmeasured while real resets get timed. This hook
-# stages no stdin (SPEC §14), so it owns its EXIT trap; the trap restores the captured
-# status and the always-exit-0 posture below is unchanged.
+# O1 (TASK-009): armed AFTER the no-pressure-file short-circuit above, so the
+# common "nothing to reset" start stays unmeasured while real resets get timed.
+# W2-D05 (TASK-C91-005): stdin is staged through the shared bounded path — the
+# hook used to wait on the producer's EOF inside node, so a pipe held open
+# parked every SessionStart reset. Payload completeness is proven by staging;
+# a stalled/truncated payload degrades (announced, skipped) rather than acting
+# on input it never fully read — the whole-file escape hatch still works via a
+# CLOSED empty stdin, which stages cleanly.
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=/dev/null
-source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
-if [ "${UKIT_TEL_ARMED:-}" = "1" ]; then
-  ukit_hook_telemetry_arm
-  __ukit_tel_finish() {
-    local __ukit_tel_rc=$?
-    if [ "${UKIT_TEL_ARMED:-}" = "1" ] && command -v ukit_hook_telemetry_finish >/dev/null 2>&1; then
-      UKIT_TEL_RC="$__ukit_tel_rc" UKIT_TEL_EVENT="SessionStart" ukit_hook_telemetry_finish
-    fi
-    return "$__ukit_tel_rc"
-  }
-  trap __ukit_tel_finish EXIT
+if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+  # shellcheck source=/dev/null
+  source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
+  trap ukit_cleanup_hook_input EXIT
+  ukit_stage_hook_input 65536 truncate
+  __ukit_reset_stage_rc=$?
+  if [ "$__ukit_reset_stage_rc" -ne 0 ] || ukit_input_degraded; then
+    ukit_emit_input_degraded advisory "reset-compact-pressure"
+  fi
+else
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline — cap+1 in the background, bounded wait, never a bare EOF wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 65537 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 65537 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  if [ "$__ukit_stage_rc" -ne 0 ]; then
+    rm -f "$UKIT_INPUT_FILE"
+    UKIT_INPUT_FILE=""
+    printf '%s\n' '{"systemMessage":"UKit reset-compact-pressure: session payload stalled during stdin staging; skipped this pass rather than act on incomplete input."}'
+    exit 0
+  fi
+  trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
 fi
 
 # The lock directory lives beside the state file; its parent exists because the file does.
@@ -91,6 +123,11 @@ async function withLock(lockPath, fn) {
   const maxWaitMs = 5000;
   const startedAt = Date.now();
   const ownerToken = `${process.pid}-${crypto.randomBytes(8).toString("hex")}`;
+  // W2-D04: a read-modify-write that could not take the lock must NOT run
+  // unlocked — a half-read pressure file torn under a concurrent writer is how
+  // sibling records get lost. The escape hatch survives ONLY as an explicit,
+  // operator-chosen override: UKIT_PRESSURE_RESET_FORCE=1.
+  const force = process.env.UKIT_PRESSURE_RESET_FORCE === "1";
   let held = false;
   while (!held) {
     try {
@@ -109,7 +146,15 @@ async function withLock(lockPath, fn) {
       }
       held = true;
     } catch (error) {
-      if (!error || error.code !== "EEXIST") return fn();
+      if (!error || error.code !== "EEXIST") {
+        // Non-contention failure (EACCES, ENOSPC, EPERM on mkdir/owner write):
+        // retrying will not help — fail closed, or run unlocked only when the
+        // operator explicitly forced it.
+        if (!force) {
+          throw new Error(`could not acquire pressure lock (${error?.code ?? error})`);
+        }
+        return fn();
+      }
       try {
         const stat = await fsp.stat(lockPath);
         if (Date.now() - stat.mtimeMs > staleMs) {
@@ -122,7 +167,12 @@ async function withLock(lockPath, fn) {
           }
         }
       } catch {}
-      if (Date.now() - startedAt > maxWaitMs) break;
+      if (Date.now() - startedAt > maxWaitMs) {
+        if (!force) {
+          throw new Error("pressure lock held past the 5s wait bound");
+        }
+        return fn();
+      }
       await new Promise((resolve) => setTimeout(resolve, 3 + Math.floor(Math.random() * 9)));
     }
   }
@@ -140,12 +190,15 @@ async function withLock(lockPath, fn) {
   }
 }
 
-const chunks = [];
-process.stdin.on("data", (chunk) => chunks.push(chunk));
-process.stdin.on("end", () => {
+// W2-D05: the payload arrives as a STAGED file (bounded by the shell wrapper),
+// never a live stdin stream — a producer that holds the pipe open cannot park
+// this hook waiting on EOF.
+const inputFile = process.argv[2];
+(async () => {
   const payload = (() => {
     try {
-      return JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+      const raw = require("fs").readFileSync(inputFile, "utf8");
+      return JSON.parse(raw || "{}");
     } catch {
       return {};
     }
@@ -160,60 +213,63 @@ process.stdin.on("end", () => {
   const transcriptKey = typeof payload.transcript_path === "string" ? payload.transcript_path.trim() : "";
   const pressurePath = process.argv[1];
 
-  withLock(`${pressurePath}.lock`, async () => {
-    const raw = await (async () => {
-      try {
-        return JSON.parse(await fsp.readFile(pressurePath, "utf8"));
-      } catch {
-        return null;
+  try {
+    await withLock(`${pressurePath}.lock`, async () => {
+      const raw = await (async () => {
+        try {
+          return JSON.parse(await fsp.readFile(pressurePath, "utf8"));
+        } catch {
+          return null;
+        }
+      })();
+      if (!raw || typeof raw !== "object") {
+        try {
+          await fsp.rm(pressurePath, { force: true });
+        } catch {}
+        return;
       }
-    })();
-    if (!raw || typeof raw !== "object") {
-      try {
-        await fsp.rm(pressurePath, { force: true });
-      } catch {}
-      return;
-    }
 
-    // Without a session id (unknown caller) keep the old whole-file reset: this hook is
-    // the documented escape hatch for a bricked gate, and it must stay one.
-    if (!sessionId || !raw.sessions || typeof raw.sessions !== "object") {
-      try {
-        await fsp.rm(pressurePath, { force: true });
-      } catch {}
-      return;
-    }
+      // Without a session id (unknown caller) keep the old whole-file reset: this hook is
+      // the documented escape hatch for a bricked gate, and it must stay one.
+      if (!sessionId || !raw.sessions || typeof raw.sessions !== "object") {
+        try {
+          await fsp.rm(pressurePath, { force: true });
+        } catch {}
+        return;
+      }
 
-    const sessions = { ...raw.sessions };
-    delete sessions[sessionId];
-    if (transcriptKey && transcriptKey !== sessionId) {
-      delete sessions[transcriptKey];
-    }
-    const newest = Object.entries(sessions)
-      .sort(([, a], [, b]) => (b?.updatedAt ?? 0) - (a?.updatedAt ?? 0))[0]?.[1] ?? null;
-    const tempPath = `${pressurePath}.tmp-${Date.now()}-${Math.random().toString(16).slice(2)}`;
-    try {
-      await fsp.writeFile(
-        tempPath,
-        JSON.stringify({
-          ...(newest && typeof newest === "object" ? newest : {}),
-          updatedAt: newest?.updatedAt ?? Date.now(),
-          v: 2,
-          sessions,
-        }, null, 2) + "\n",
-      );
-      await fsp.rename(tempPath, pressurePath);
-    } catch (error) {
+      const sessions = { ...raw.sessions };
+      delete sessions[sessionId];
+      if (transcriptKey && transcriptKey !== sessionId) {
+        delete sessions[transcriptKey];
+      }
+      const newest = Object.entries(sessions)
+        .sort(([, a], [, b]) => (b?.updatedAt ?? 0) - (a?.updatedAt ?? 0))[0]?.[1] ?? null;
+      const tempPath = `${pressurePath}.tmp-${Date.now()}-${Math.random().toString(16).slice(2)}`;
       try {
-        await fsp.rm(tempPath, { force: true });
-      } catch {}
-      throw error;
-    }
-  }).catch((error) => {
-    emitDegrade(`reset failed (${error?.message ?? error}); the compact-pressure record may still be stale — restarting the session retries the reset.`);
+        await fsp.writeFile(
+          tempPath,
+          JSON.stringify({
+            ...(newest && typeof newest === "object" ? newest : {}),
+            updatedAt: newest?.updatedAt ?? Date.now(),
+            v: 2,
+            sessions,
+          }, null, 2) + "\n",
+        );
+        await fsp.rename(tempPath, pressurePath);
+      } catch (error) {
+        try {
+          await fsp.rm(tempPath, { force: true });
+        } catch {}
+        throw error;
+      }
+    });
+    process.exit(0);
+  } catch (error) {
+    emitDegrade(`reset skipped or failed (${error?.message ?? error}); the compact-pressure record may still be stale — restarting the session retries the reset.`);
     process.exit(0);
-  });
-});
-' "$PRESSURE_FILE" 2>/dev/null || true
+  }
+})();
+' "$PRESSURE_FILE" "$UKIT_INPUT_FILE" 2>/dev/null || true
 
 exit 0