@opengsd/gsd-core 1.10.0 → 1.12.0

package/hooks/gsd-cursor-subagent-start.js

@@ -56,12 +56,22 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { allow } = require('./lib/hook-exit.js');
 
 // Workspace resolution is shared across the Cursor hooks (#2587) — see
 // hooks/lib/cursor-workspace.js. Staged next to these scripts by
 // writeCursorHooksJson so the require always resolves post-install.
 const { resolveStatePath } = require('./lib/cursor-workspace.js');
 const { readSentinel, VALID_ISOLATION, extractDispatchIdentifiers, sentinelAppliesToDispatch } = require('./lib/isolation-sentinel.js');
+const { REASON_CODE } = require('./lib/isolation-deny-reason.js');
+// #3582: gsd-core/bin/lib/*.cjs (runtime-homes.cjs, worktree-safety.cjs,
+// runtime-name-policy.cjs, capability-registry.cjs — required below, inside
+// resolveIsolationEvidence and resolveFallbackIsolation) are tsc build
+// artifacts (ADR-457), gitignored and absent on a raw plugin-marketplace /
+// git-clone install that never ran `npm run build:lib`. Self-heal once, in
+// evaluateRootIsolation, before any of those four requires run — see the
+// call site below. This module itself depends on nothing under ./lib.
+const { ensureRuntimeBuild, RuntimeBuildError } = require('../gsd-core/bin/ensure-runtime-build.cjs');
 
 const MSG_PRESENT =
   'GSD: Subagent session started — review .planning/STATE.md for the current phase and any blockers before acting.';
@@ -333,6 +343,41 @@ function resolveIsolationDecision(data, { clock = Date, realpath = fs.realpathSy
   return { action: 'allow' };
 }
 
+// ─── #3897 rung 2: per-install runtime marker, single canonical owner ────────
+// bin/install.js writes `<install>/gsd-core/.gsd-runtime` beside VERSION for
+// every runtime install (#2297); this hook ships at `<install>/hooks/`, so the
+// marker is the `gsd-core` sibling of this file's own directory. Previously
+// this hook held its own private reader/cache (one of four #3897 found); it
+// now delegates to the single canonical owner, `src/runtime-slash.cts`
+// (compiled to gsd-core/bin/lib/runtime-slash.cjs), reached through
+// `ensureRuntimeBuild()` like the other compiled-lib requires in this file
+// (`scripts/lint-hooks-runtime-build-seam.cjs`).
+function readInstallRuntimeMarker() {
+  try {
+    ensureRuntimeBuild();
+    const runtimeSlash = require('../gsd-core/bin/lib/runtime-slash.cjs');
+    return runtimeSlash.readInstallRuntimeMarker();
+  } catch {
+    // Unbuilt runtime library, or any other failure reaching the canonical
+    // owner — "no signal from this rung", never a resolution failure.
+    return null;
+  }
+}
+
+// Test seam — forwards to the canonical owner's seam so this hook and
+// runtime-slash.cjs always share one cache (#3897 rung 2). Spawned-hook tests
+// (fresh process, no marker) are unaffected.
+function _setInstallRuntimeMarkerForTests(value) {
+  try {
+    ensureRuntimeBuild();
+    const runtimeSlash = require('../gsd-core/bin/lib/runtime-slash.cjs');
+    runtimeSlash._setInstallRuntimeMarkerForTests(value);
+  } catch {
+    // Test-only seam; an unbuilt library here means the test itself will fail
+    // downstream, which is a louder and more actionable signal than throwing here.
+  }
+}
+
 /**
  * Conservative fallback resolution used when the #3045 sentinel is absent or
  * stale for `root`: re-derive isolation from the registry CAPABILITY, gated
@@ -355,7 +400,8 @@ function resolveIsolationDecision(data, { clock = Date, realpath = fs.realpathSy
  * otherwise legitimate dispatches, unlike `hooks/gsd-agent-isolation-guard.js`,
  * which degrades an undeterminable runtime to inert (#3045 MAJOR 2). Aligned
  * here: an explicit signal is now required — `GSD_RUNTIME` > config.json
- * `runtime` key > `~/.gsd/defaults.json` `runtime` (mirrors the Claude hook's
+ * `runtime` key > the per-install `.gsd-runtime` marker (#3566) >
+ * `~/.gsd/defaults.json` `runtime` (mirrors the Claude hook's
  * `resolveRuntimeIdentity`; `bin/install.js`'s `writeNonClaudeDefaults`
  * persists the installed runtime there for every non-Claude install,
  * including Cursor, so a REAL Cursor+GSD install still resolves confidently
@@ -372,6 +418,13 @@ function resolveFallbackIsolation(root, configPath) {
   if (!runtimeId && parsedConfig && typeof parsedConfig === 'object' && 'runtime' in parsedConfig) {
     runtimeId = resolveRuntimeNameFromCandidates(parsedConfig.runtime) || null;
   }
+  if (!runtimeId) {
+    // #3566: the per-install marker, above the host-wide defaults — same fix as
+    // hooks/gsd-agent-isolation-guard.js's resolveRuntimeIdentity. defaults.json
+    // is host-wide and names whichever runtime installed LAST (#2840's poison);
+    // the marker describes THIS install (written for every runtime since #2297).
+    runtimeId = resolveRuntimeNameFromCandidates(readInstallRuntimeMarker()) || null;
+  }
   if (!runtimeId) {
     try {
       const defaultsPath = path.join(os.homedir(), '.gsd', 'defaults.json');
@@ -419,6 +472,28 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
   }
   if (!isGsdProject) return { action: 'allow' };
 
+  // #3582: self-heal the compiled runtime library BEFORE any of its four
+  // downstream requires (resolveFallbackIsolation's two, resolveIsolationEvidence's
+  // two — reached only below this point). Checked separately from the
+  // sentinel/fallback try block below so a build failure surfaces its own
+  // actionable RuntimeBuildError message rather than being folded into the
+  // generic "could not read or resolve ... configuration" deny reason (the
+  // #3050 misreport this issue exists to fix). Still fails closed either way.
+  try {
+    ensureRuntimeBuild();
+  } catch (err) {
+    return {
+      action: 'deny',
+      reason:
+        `GSD subagent isolation guard: cannot resolve this project's dispatch-isolation ` +
+        `configuration because the GSD runtime library failed to self-build. ` +
+        `${err instanceof RuntimeBuildError ? err.message : String(err && err.message || err)} ` +
+        `Refusing to allow this subagent to spawn until the runtime library is built — a guard ` +
+        `that cannot verify must not answer "safe" (#3050).`,
+      reasonCode: REASON_CODE.RUNTIME_BUILD_FAILED,
+    };
+  }
+
   let declaredIsolation;
   try {
     // #3045 BLOCKER fix: a fresh sentinel is authoritative for THIS
@@ -439,6 +514,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
         `Refusing to allow this subagent to spawn without being able to verify whether ` +
         `isolation is required — a guard that cannot verify must not answer "safe" (#3050). ` +
         `Retry once the project configuration is readable.`,
+      reasonCode: REASON_CODE.CONFIG_UNREADABLE,
     };
   }
 
@@ -455,6 +531,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
         `"harness-worktree", but the subagentStart payload for this dispatch carries no usable ` +
         `subagent_type. Refusing to allow it to spawn without being able to confirm whether it ` +
         `is a GSD executor — a guard that cannot verify must not answer "safe" (#3050).`,
+      reasonCode: REASON_CODE.NO_SUBAGENT_TYPE,
     };
   }
 
@@ -471,6 +548,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
         `could not be determined (git did not respond). Refusing to allow subagent_type=` +
         `"${subagentType}" to spawn without being able to verify isolation — a guard that ` +
         `cannot verify must not answer "safe" (#3050). Retry once git is responsive.`,
+      reasonCode: REASON_CODE.CANNOT_DETERMINE_ISOLATION,
     };
   }
 
@@ -483,6 +561,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
       `directly, with no consent and no warning. Start an isolated session first (the ` +
       `"--worktree" CLI flag or the "/worktree" chat command; Cursor manages these worktrees ` +
       `under "~/.cursor/worktrees/") and retry.`,
+    reasonCode: REASON_CODE.NOT_ISOLATED_WORKTREE,
   };
 }
 
@@ -490,7 +569,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
 function main() {
   let raw = '';
   const stdinTimeout = setTimeout(() => {
-    process.exit(0);
+    allow(undefined);
   }, 10000);
 
   process.stdin.setEncoding('utf8');
@@ -532,7 +611,7 @@ function main() {
         decision = { action: 'allow' };
       }
       if (decision.action === 'deny') {
-        const out = { permission: 'deny', user_message: decision.reason };
+        const out = { permission: 'deny', user_message: decision.reason, reason_code: decision.reasonCode };
         if (additionalContext !== null) out.additional_context = additionalContext;
         process.stdout.write(JSON.stringify(out));
         return;
@@ -557,4 +636,5 @@ module.exports = {
   resolveFallbackIsolation,
   resolveIsolationEvidence,
   getWorkspaceRoots,
+  _setInstallRuntimeMarkerForTests,
 };

package/hooks/gsd-cursor-subagent-stop.js

@@ -20,13 +20,16 @@
 
 'use strict';
 
-let raw = '';
+const { allow } = require('./lib/hook-exit.js');
+
 const stdinTimeout = setTimeout(() => {
-  process.exit(0);
+  allow(undefined);
 }, 10000);
 
 process.stdin.setEncoding('utf8');
-process.stdin.on('data', (chunk) => { raw += chunk; });
+// Drain stdin (puts the stream into flowing mode so 'end' fires); the
+// payload itself is unused — this hook responds unconditionally.
+process.stdin.on('data', () => {});
 process.stdin.on('end', () => {
   clearTimeout(stdinTimeout);
   try {

package/hooks/gsd-ensure-canonical-path.js

@@ -34,6 +34,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { allow } = require('./lib/hook-exit.js');
 
 // Immutable, bundled subdirectories that the canonical path must expose. These
 // are the directories `@~/.claude/gsd-core/<subdir>/...` includes point into.
@@ -301,5 +302,5 @@ if (require.main === module) {
   } catch (_) {
     // Best-effort: a canonical-path failure must never abort a session.
   }
-  process.exit(0);
+  allow(undefined);
 }

package/hooks/gsd-graphify-update.sh

@@ -9,17 +9,20 @@
 # graphify.auto_update defaults to false so existing users see no behavior change.
 #
 # Gates (in fast-fail order — each shaves work off the common non-dispatch path):
+#   0. .planning/config.json exists AND $CI unset/empty (#3729 — both are
+#      parse-free shell tests; running them before the Gate 1 node spawn keeps
+#      non-GSD repositories and CI off the spawn path entirely, which on
+#      Windows otherwise flashes a console window per Bash call)
 #   1. Stdin payload present and tool_name == "Bash"
 #   2. tool_input.command matches a HEAD-advancing git op (shell-direct or
 #      the exact `gsd-tools query commit` command shape; the SDK command invokes
 #      git internally, so the literal "git commit" substring never appears —
 #      see #3653)
-#   3. $CI is unset/empty
-#   4. Inside a git repo
-#   5. Current branch == default branch (git.base_branch override, else main/master/trunk)
-#   6. .planning/config.json sets graphify.enabled=true AND graphify.auto_update=true
-#   7. graphify binary on PATH
-#   8. No rebuild already in flight (PID lock — kill -0 check, stale-tolerant)
+#   3. Inside a git repo
+#   4. Current branch == default branch (git.base_branch override, else main/master/trunk)
+#   5. .planning/config.json sets graphify.enabled=true AND graphify.auto_update=true
+#   6. graphify binary on PATH
+#   7. No rebuild already in flight (PID lock — kill -0 check, stale-tolerant)
 #
 # When all gates pass:
 #   - Writes .planning/graphs/.last-build-status.json with status="running"
@@ -30,6 +33,13 @@
 
 set -uo pipefail
 
+# Gate 0 — GSD project at all, and not CI (#3729). Both are pure shell tests;
+# they must precede the Gate 1 node spawn so the common non-GSD/CI path pays
+# for zero child processes. Hoisting is behavior-preserving: old Gates 3 and 6
+# made the same decisions, just later.
+[ -f .planning/config.json ] || exit 0
+[ -z "${CI:-}" ] || exit 0
+
 # Gate 1 — tool_name == Bash; extract command
 INPUT=$(cat 2>/dev/null || true)
 [ -n "$INPUT" ] || exit 0
@@ -71,22 +81,17 @@ case "$COMMAND" in
   *) exit 0 ;;
 esac
 
-# Gate 3 — not CI
-[ -z "${CI:-}" ] || exit 0
-
-# Gate 4 — inside git repo
+# Gate 3 — inside git repo
 git rev-parse --git-dir >/dev/null 2>&1 || exit 0
 
-# Gate 5 — current branch == default branch
+# Gate 4 — current branch == default branch (config guaranteed by Gate 0)
 DEFAULT_BRANCH=""
-if [ -f .planning/config.json ]; then
-  DEFAULT_BRANCH=$(node -e '
+DEFAULT_BRANCH=$(node -e '
 try {
   const c = require("./.planning/config.json");
   process.stdout.write(c.git?.base_branch || "");
 } catch { process.stdout.write(""); }
 ' 2>/dev/null || echo "")
-fi
 if [ -z "$DEFAULT_BRANCH" ]; then
   for cand in main master trunk; do
     if git rev-parse --verify "$cand" >/dev/null 2>&1; then
@@ -100,8 +105,7 @@ fi
 CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
 [ "$CURRENT_BRANCH" = "$DEFAULT_BRANCH" ] || exit 0
 
-# Gate 6 — both graphify gates true in config
-[ -f .planning/config.json ] || exit 0
+# Gate 5 — both graphify gates true in config (file existence checked at Gate 0)
 GATES=$(node -e '
 try {
   const c = require("./.planning/config.json");
@@ -111,11 +115,11 @@ try {
 ' 2>/dev/null || echo "0")
 [ "$GATES" = "1" ] || exit 0
 
-# Gate 7 — graphify on PATH
+# Gate 6 — graphify on PATH
 GRAPHIFY_BIN=$(command -v graphify 2>/dev/null || true)
 [ -n "$GRAPHIFY_BIN" ] || exit 0
 
-# Gate 8 — no live rebuild in flight
+# Gate 7 — no live rebuild in flight
 mkdir -p .planning/graphs
 LOCK_FILE=".planning/graphs/.rebuild.lock"
 if [ -f "$LOCK_FILE" ]; then

package/hooks/gsd-node-runner.sh

@@ -0,0 +1,76 @@
+#!/bin/sh
+# gsd-node-runner.sh — GSD portable node resolver (#3662).
+#
+# Managed JS hook commands under --portable-hooks route through this script:
+#
+#   bash "<hooks>/gsd-node-runner.sh" "<baked-node-path>" "<script.js>" [args...]
+#
+# so a config root shared across environments (mounted ~/.claude, shared
+# containers) resolves node at hook-fire time instead of depending on the
+# absolute path of whichever environment ran the installer. Candidates, in
+# order — the first executable one wins:
+#
+#   1. the first argument — the install-time node path, tried FIRST and by
+#      absolute path so the #2979/#3002/#3017/#3022 minimal-PATH guarantee
+#      holds (GUI launches with a stripped PATH still resolve where the
+#      baked path exists);
+#   2. `command -v node`, accepted only when it yields an absolute path;
+#   3. the well-known stable layouts: $HOME-derived mise/volta shims, the
+#      Homebrew prefixes, /usr/local/bin/node, /usr/bin/node.
+#
+# No bare `node` lookup is ever depended on: a candidate is used only after
+# an explicit executable check, and when nothing resolves this script fails
+# visibly (stderr diagnostic + exit 127) rather than emitting a half-resolved
+# invocation.
+#
+# The candidate list below is a SUPERSET of the inline chain token emitted by
+# buildNodeRunnerChainToken (src/runtime-hooks-surface.cts, #3662) — keep the
+# two lists consistent.
+#
+# Diagnostic escape: GSD_NODE_RUNNER_NO_FALLBACKS=1 disables candidates 2-3
+# (first-argument-only resolution) — used by the test suite and useful to
+# pin down which node a given environment picks.
+set -u
+
+preferred=${1:-}
+script=${2:-}
+if [ -n "$script" ]; then
+  shift 2
+elif [ -n "$preferred" ]; then
+  shift 1
+  preferred=
+fi
+
+found=''
+
+# check <path> — record <path> if it is an absolute, executable file.
+# Absolute = POSIX root (/*) or a win32 drive-letter path (C:/…), which is
+# what the installer bakes on Windows; anything else (a relative `command -v`
+# hit under a relative PATH entry, a bare name) is rejected so repo-cwd
+# content can never reach the runner slot.
+check() {
+  case "$1" in
+    /*|[A-Za-z]:/*) if [ -x "$1" ]; then found=$1; fi ;;
+  esac
+  [ -n "$found" ]
+}
+
+check "$preferred" || {
+  if [ "${GSD_NODE_RUNNER_NO_FALLBACKS:-0}" != "1" ]; then
+    path_node=$(command -v node 2>/dev/null || true)
+    check "$path_node" ||
+      check "${HOME:-}/.local/share/mise/shims/node" ||
+      check "${HOME:-}/.volta/bin/node" ||
+      check /opt/homebrew/bin/node ||
+      check /usr/local/bin/node ||
+      check /usr/bin/node ||
+      true
+  fi
+}
+
+if [ -z "$found" ]; then
+  echo "gsd-node-runner: no usable node found (preferred: ${preferred:-<none>})" >&2
+  exit 127
+fi
+
+exec "$found" "$script" "$@"

package/hooks/gsd-phase-boundary.sh

@@ -6,6 +6,7 @@
 #
 # OPT-IN: This hook is a no-op unless config.json has hooks.community: true.
 # Enable with: "hooks": { "community": true } in .planning/config.json
+set -euo pipefail
 
 # Check opt-in config — exit silently if not enabled
 if [ -f .planning/config.json ]; then

package/hooks/gsd-prompt-guard.js

@@ -11,26 +11,21 @@
 // The goal is to surface suspicious content so the orchestrator can inspect it,
 // not to create false-positive deadlocks.
 
-const fs = require('fs');
 const path = require('path');
+const { HOOK_ON_CRASH, allow, crash } = require('./lib/hook-exit.js');
 
-// Prompt injection patterns (subset of security.cjs patterns, inlined for hook independence)
-const INJECTION_PATTERNS = [
-  /ignore\s+(all\s+)?previous\s+instructions/i,
-  /ignore\s+(all\s+)?above\s+instructions/i,
-  /disregard\s+(all\s+)?previous/i,
-  /forget\s+(all\s+)?(your\s+)?instructions/i,
-  /override\s+(system|previous)\s+(prompt|instructions)/i,
-  /you\s+are\s+now\s+(?:a|an|the)\s+/i,
-  /act\s+as\s+(?:a|an|the)\s+(?!plan|phase|wave)/i,
-  /pretend\s+(?:you(?:'re| are)\s+|to\s+be\s+)/i,
-  /from\s+now\s+on,?\s+you\s+(?:are|will|should|must)/i,
-  /(?:print|output|reveal|show|display|repeat)\s+(?:your\s+)?(?:system\s+)?(?:prompt|instructions)/i,
-  /<\/?(?:system|assistant|human)>/i,
-  /\[SYSTEM\]/i,
-  /\[INST\]/i,
-  /<<\s*SYS\s*>>/i,
-];
+// This guard is advisory-only by design (see header) — it never blocks the
+// Write/Edit it scans, only adds context about it. A crash here must not
+// start blocking now, which is strictly worse than the advisory it exists
+// to add on top of an already-permitted operation (#3911).
+const ON_CRASH = HOOK_ON_CRASH.ALLOW;
+
+// Prompt injection patterns — shared with gsd-read-injection-scanner.js via
+// hooks/lib/injection-patterns.js so the two surfaces cannot drift (#3504).
+// Deliberately a subset of security.cjs's set: hooks stay loadable without the
+// compiled lib tree. Staging of the lib helper is allowlisted in
+// GSD_HOOK_LIB_FILES (bin/install.js).
+const { INJECTION_PATTERNS } = require('./lib/injection-patterns.js');
 
 // #2304: Kimi's native hook bus delivers Kimi's tool vocabulary in the payload
 // (Write → WriteFile, Edit/MultiEdit → StrReplaceFile) while the [[hooks]]
@@ -127,7 +122,7 @@ function normalizeKimiPayload(data) {
 }
 
 let input = '';
-const stdinTimeout = setTimeout(() => process.exit(0), 3000);
+const stdinTimeout = setTimeout(() => allow(undefined), 3000);
 process.stdin.setEncoding('utf8');
 process.stdin.on('data', chunk => input += chunk);
 process.stdin.on('end', () => {
@@ -138,7 +133,7 @@ process.stdin.on('end', () => {
 
     // Only scan Write and Edit operations
     if (toolName !== 'Write' && toolName !== 'Edit') {
-      process.exit(0);
+      allow(undefined);
     }
 
     // #2595 (review Major 3, sibling sweep): typed read. A non-string
@@ -150,13 +145,26 @@ process.stdin.on('end', () => {
 
     // Only scan files going into .planning/ (agent context files)
     if (!filePath.includes('.planning/') && !filePath.includes('.planning\\')) {
-      process.exit(0);
+      allow(undefined);
     }
 
-    // Get the content being written
-    const content = data.tool_input?.content || data.tool_input?.new_string || '';
+    // Get the content being written. #3504 (isolated review finding 3): the
+    // bare `||` chain handed a NON-STRING truthy `content` straight to
+    // pattern.test(), where ToString can throw ("Cannot convert object to a
+    // primitive value" for `{"toString": null}`) into the outer catch — the
+    // exact crash-to-allow class #2547/#2595 hardened inside
+    // normalizeKimiPayload, unreached on this read. Guarded selection: take
+    // the first field that is a string, or String-coerces without throwing,
+    // so a poisoned `content` no longer shadows a real `new_string`.
+    let content = '';
+    for (const candidate of [data.tool_input?.content, data.tool_input?.new_string]) {
+      if (typeof candidate === 'string' && candidate) { content = candidate; break; }
+      if (candidate && typeof candidate !== 'string') {
+        try { const s = String(candidate); if (s) { content = s; break; } } catch { /* keep looking */ }
+      }
+    }
     if (!content) {
-      process.exit(0);
+      allow(undefined);
     }
 
     // Scan for injection patterns
@@ -173,7 +181,7 @@ process.stdin.on('end', () => {
     }
 
     if (findings.length === 0) {
-      process.exit(0);
+      allow(undefined);
     }
 
     // Advisory warning — does not block the operation
@@ -190,7 +198,9 @@ process.stdin.on('end', () => {
 
     process.stdout.write(JSON.stringify(output));
   } catch {
-    // Silent fail — never block tool execution
-    process.exit(0);
+    // Silent fail — never block tool execution.
+    // ON_CRASH is declared ALLOW at module top: this preserves today's
+    // exit(0) fail-open behavior exactly (#3911).
+    crash(ON_CRASH, undefined);
   }
 });

package/hooks/gsd-read-guard.js

@@ -20,6 +20,13 @@
 
 const fs = require('fs');
 const path = require('path');
+const { HOOK_ON_CRASH, allow, crash } = require('./lib/hook-exit.js');
+
+// This guard is pure advisory UX — a reminder to Read before Write/Edit on
+// non-Claude-Code runtimes. A crash here must not block a legitimate Write/
+// Edit; the worst outcome of failing open is the model hitting the runtime's
+// own read-before-edit rejection it was trying to help avoid (#3911).
+const ON_CRASH = HOOK_ON_CRASH.ALLOW;
 
 // #2304: Kimi's native hook bus delivers Kimi's tool vocabulary in the payload
 // (Write → WriteFile, Edit/MultiEdit → StrReplaceFile) while the [[hooks]]
@@ -116,7 +123,7 @@ function normalizeKimiPayload(data) {
 }
 
 let input = '';
-const stdinTimeout = setTimeout(() => process.exit(0), 3000);
+const stdinTimeout = setTimeout(() => allow(undefined), 3000);
 process.stdin.setEncoding('utf8');
 process.stdin.on('data', chunk => input += chunk);
 process.stdin.on('end', () => {
@@ -127,7 +134,7 @@ process.stdin.on('end', () => {
 
     // Only intercept Write and Edit tool calls
     if (toolName !== 'Write' && toolName !== 'Edit') {
-      process.exit(0);
+      allow(undefined);
     }
 
     // Claude Code natively enforces read-before-edit — skip the advisory (#1984, #2344, #2520).
@@ -151,7 +158,7 @@ process.stdin.on('end', () => {
       process.env.CLAUDE_SESSION_ID ||
       process.env.CLAUDECODE;
     if (isClaudeCode) {
-      process.exit(0);
+      allow(undefined);
     }
 
     // #2595 (review Major 3, sibling sweep): typed read — same class as the
@@ -160,7 +167,7 @@ process.stdin.on('end', () => {
       ? data.tool_input.file_path
       : '';
     if (!filePath) {
-      process.exit(0);
+      allow(undefined);
     }
 
     // Only inject guidance when the file already exists.
@@ -174,7 +181,7 @@ process.stdin.on('end', () => {
     }
 
     if (!fileExists) {
-      process.exit(0);
+      allow(undefined);
     }
 
     const fileName = path.basename(filePath);
@@ -193,7 +200,9 @@ process.stdin.on('end', () => {
 
     process.stdout.write(JSON.stringify(output));
   } catch {
-    // Silent fail — never block tool execution
-    process.exit(0);
+    // Silent fail — never block tool execution.
+    // ON_CRASH is declared ALLOW at module top: this preserves today's
+    // exit(0) fail-open behavior exactly (#3911).
+    crash(ON_CRASH, undefined);
   }
 });