chati-dev 4.0.10 → 4.1.0

package/framework/agents/quality/qa-implementation.md

@@ -78,9 +78,30 @@ Categories:
 9. Prototype Pollution
 10. Insecure Configuration
 
+Language-Specific Patterns (scan for these exact patterns):
+
+JavaScript/TypeScript:
+  - eval(), new Function(), setTimeout/setInterval with string arg: RCE risk
+  - innerHTML, outerHTML, document.write(): XSS risk
+  - dangerouslySetInnerHTML (React): XSS risk
+  - getElementById/querySelector without null check: runtime crash risk
+  - JSON.parse without try/catch: crash on malformed input
+
+Python:
+  - eval(), exec(), compile(): RCE risk
+  - subprocess with shell=True: command injection
+  - pickle.loads from untrusted source: deserialization attack
+  - format strings with user input: injection
+
+For ALL languages:
+  - Hardcoded secrets matching /api[_-]?key|secret|password|token.*[:=]\s*["'][^"']{8,}/i
+  - SQL with string interpolation (template literals, f-strings in queries)
+  - Missing input validation (direct req.body/req.params without validation)
+  - Insecure CORS (Access-Control-Allow-Origin: *)
+
 Severity Classification:
-  - Critical: Immediate exploitation risk
-  - High: Exploitable with some effort
+  - Critical: Immediate exploitation risk (eval, innerHTML, shell=True, hardcoded secrets)
+  - High: Exploitable with effort (null DOM, missing validation, insecure CORS)
   - Medium: Potential risk, lower probability
   - Low: Best practice improvement
 
@@ -101,6 +122,12 @@ Review code for:
 6. Code duplication detection
 7. Performance anti-patterns
 8. Accessibility compliance
+9. Client-side analysis (if project has frontend):
+   - DOM queries (getElementById, querySelector) have null checks
+   - Event listeners are cleaned up (removeEventListener on unmount)
+   - No memory leaks (intervals/timeouts cleared, subscriptions unsubscribed)
+   - Form validation exists on client side (not just server)
+   - Loading/error states handled (not just happy path)
 
 If CodeRabbit MCP available:
   - Run CodeRabbit review
@@ -120,23 +147,53 @@ For each completed task:
 Flag unverified criteria for manual review
 ```
 
-### Phase 5: Adversarial Review (Mandatory)
+### Phase 4b: Evidence Validation (by change type)
+```
+Validate that appropriate evidence exists for the type of change:
+
+| Change Type | Required Evidence |
+|-------------|-------------------|
+| Bug fix | Before/after reproduction, root cause documented, regression test added |
+| New feature | All acceptance criteria mapped to implementation, new tests cover feature |
+| Refactor | No behavior change proof (same test results before/after), no new features |
+| Performance | Benchmark data (before/after measurements with methodology) |
+| Security fix | Vulnerability scan results, exploit reproduction steps |
+| UI change | Visual comparison (screenshots or description of visual diff) |
+
+If evidence is missing for the change type, flag as WARNING.
 ```
-RULE: Every QA pass MUST identify minimum 5 findings.
-Zero findings = suspiciously clean -> mandatory re-review.
 
-Process:
-1. After Phases 1-4, count total findings across all categories
-2. IF findings < 5:
-   - Log: "Adversarial trigger: only {N} findings detected"
-   - Re-run Phases 2-4 with DEEPER analysis:
-     * Lower severity threshold (include INFO-level observations)
-     * Check for implicit issues (poor naming, missing edge cases, weak error messages)
-     * Look for "things that work but could fail under load/scale"
-   - Findings now include: improvements, suggestions, best-practice deviations
-3. IF findings still < 5 after deep re-review:
-   - Document explicitly WHY the code is genuinely clean
-   - This documentation itself counts as a finding (type: attestation)
+### Phase 5: Triple Review Protocol (Mandatory)
+```
+Execute 3 review passes INDEPENDENTLY. Each pass has a different scope
+and produces its own findings. Findings are merged at the end.
+
+Pass 1 -- Shadow Review (zero-context adversarial):
+  Analyze ONLY the diff/changes. Do NOT read project context, architecture,
+  or acceptance criteria. Judge the code purely on its own merits:
+  - Does the code make sense in isolation?
+  - Are there obvious bugs, missing error handling, or logic flaws?
+  - Would a senior developer reject this in a PR review?
+  - Are there hardcoded values, magic numbers, or unclear naming?
+
+Pass 2 -- Sentinel Review (edge case enumeration):
+  With full project access, enumerate ALL execution paths:
+  - What happens with null/undefined/empty inputs?
+  - What happens under concurrent access?
+  - What happens at scale (10x data, 100x users)?
+  - What happens when external services fail (timeout, 500, unreachable)?
+  - What happens with malformed/malicious input?
+  - Are there resource leaks (unclosed connections, streams, file handles)?
+
+Pass 3 -- Compliance Review (spec alignment):
+  With spec + acceptance criteria + architecture:
+  - Does every Given-When-Then criterion have a matching implementation?
+  - Does the code follow architecture patterns from architecture.md?
+  - Are Design System tokens used (no hardcoded visual values)?
+  - Does the API contract match the spec?
+  - Are all component states implemented (not just happy path)?
+
+After all 3 passes, execute the 5 Structural Checks:
 
 Structural Checks (5 mandatory):
   1. DEPENDENCY AUDIT: Scan for unused imports, circular dependencies,
@@ -154,8 +211,12 @@ Structural Checks (5 mandatory):
      prototype pollution, ReDoS (regex denial of service), path traversal,
      command injection via string interpolation, timing attacks.
 
+Each check produces a classified finding (ERROR, WARNING, SUGGESTION, or ATTESTATION).
+ATTESTATION documents WHY the check passed and what was verified. It is a quality
+record proving thoroughness, not a padding finding.
+
 Devil's Advocate Pass:
-  After initial review concludes APPROVED:
+  After the Triple Review concludes:
   1. Assume the opposite: "This code has a hidden flaw"
   2. Spend one focused pass actively seeking:
      - Race conditions, memory leaks, unhandled edge cases
@@ -172,6 +233,41 @@ Findings Classification:
   - ATTESTATION: Explicit documentation of why something is clean
 ```
 
+### Phase 5b: Cross-File Consistency (Mandatory)
+```
+Check for inconsistencies ACROSS files (not just within code):
+
+1. ENV SYNC: Compare .env.example against all env references in code
+   (process.env.X, import.meta.env.X). Flag missing or extra vars.
+2. README ACCURACY: Verify that features described in README.md actually
+   exist in the codebase. Flag phantom features (documented but not implemented).
+3. API CONTRACT: Compare error response format across ALL endpoints.
+   Flag inconsistent error shapes ({error: ...} vs {message: ...}).
+4. CONFIG SYNC: Verify that config files (package.json scripts, tsconfig paths,
+   etc.) match actual file structure.
+5. DEPENDENCY AUDIT: Check for unused dependencies in package.json and
+   missing dependencies (imported but not in package.json).
+6. DOCUMENTATION SYNC: If API docs exist, verify endpoints match actual routes.
+```
+
+### Phase 5c: Causation Verification (for bug fixes)
+```
+If the implementation includes a bug fix, verify causation:
+
+1. ROOT CAUSE: Is the fix addressing the root cause or just a symptom?
+   Ask: "If we remove this fix, does the original bug return?"
+2. PLACEBO CHECK: Does the fix actually change the execution path
+   that causes the bug? Or is it a cosmetic change nearby?
+3. COMPLETENESS: Does the fix handle ALL variations of the bug?
+   (different inputs, different timing, different environments)
+4. REGRESSION: Could this fix break existing functionality?
+   Check: are there tests that cover the changed behavior?
+5. ENVIRONMENT: Will this fix work in production? Or only in dev?
+   Check: hardcoded URLs, localhost references, debug flags.
+
+If not a bug fix, skip this phase and document: "Not a bug fix -- causation verification N/A."
+```
+
 ### Phase 6: Score & Decide
 ```
 Calculate overall quality score:
@@ -382,13 +478,16 @@ Criteria (binary pass/fail):
 4. Zero High security vulnerabilities
 5. Code review completed (architecture adherence, patterns, error handling)
 6. All acceptance criteria from tasks verified
-7. Adversarial review completed with minimum 5 findings
+7. Adversarial review completed: all 5 structural checks executed with classified outcomes
 8. Devil's Advocate pass documented
 9. Correction loops executed for all issues (or escalated with justification)
 10. No skipped tests without documented reason
+11. Triple Review Protocol completed (Shadow + Sentinel + Compliance passes)
+12. Cross-file consistency checks completed (ENV, README, API, Config, Deps, Docs)
+13. Evidence validation completed for change type (bug/feature/refactor/performance/security)
 
 Score = criteria met / total criteria
-Threshold: >= 95% (10/10 minimum, no criteria may fail)
+Threshold: >= 95% (12/13 minimum)
 ```
 
 ---
@@ -410,7 +509,7 @@ Threshold: >= 95% (10/10 minimum, no criteria may fail)
 | `sast-scan` | SAST Security Scan | Scan codebase for security vulnerabilities across 10 categories | After run-tests |
 | `code-review` | Code Review | Review code for architecture adherence, patterns, error handling, Design System tokens | After sast-scan |
 | `verify-criteria` | Verify Acceptance Criteria | Check each task's Given-When-Then criteria against implementation | After code-review |
-| `adversarial` | Adversarial Review | Run mandatory adversarial review with 5 structural checks and Devil's Advocate pass (minimum 5 findings) | After verify-criteria |
+| `adversarial` | Adversarial Review | Run 5 mandatory structural checks + Devil's Advocate pass. Each check produces classified finding (ERROR/WARNING/SUGGESTION/ATTESTATION) | After verify-criteria |
 | `score-decide` | Score and Decide | Calculate weighted quality score and issue APPROVED or NEEDS CORRECTION verdict | After adversarial |
 
 ---
@@ -453,7 +552,7 @@ Beyond self-validation (Protocol 5.1), the QA-Implementation agent enforces:
 2. **Full Acceptance Coverage**: Every task's Given-When-Then criteria must be verified against the implementation — unverified criteria block approval
 3. **Pattern Adherence**: Code must follow architecture patterns defined in the Architecture artifact — deviations must be justified
 4. **Token Enforcement**: Design System tokens must be used — hardcoded visual values (colors, spacing, typography) reduce the score
-5. **Adversarial Completeness**: The adversarial review must produce minimum 5 findings (including 5 structural checks) — zero findings trigger mandatory re-review
+5. **Adversarial Completeness**: All 5 structural checks must be executed, each producing a classified finding (ERROR, WARNING, SUGGESTION, or ATTESTATION). Attestations document verified quality, not filler.
 
 ---
 

package/framework/agents/quality/qa-planning.md

@@ -122,6 +122,24 @@ For each agent that completed PLANNING:
      - Example: Brief said "Brief is well-written" (subjective, not binary)
 ```
 
+### Step 3b: Dimensional Validation (6 quality dimensions)
+```
+Validate planning artifacts across 6 independent dimensions.
+Each dimension produces PASS/FAIL with evidence.
+
+| Dimension | What It Checks | FAIL Trigger |
+|-----------|---------------|--------------|
+| TRACEABILITY | Brief to PRD to Phases to Tasks chains complete | Any orphaned requirement |
+| INFORMATION DENSITY | No filler phrases, padding, or LLM-generated fluff | "It is important to note", "Furthermore", "In conclusion", repetitive restatements |
+| IMPLEMENTATION LEAKAGE | PRD says WHAT not HOW. No technology names in FRs | React, PostgreSQL, Tailwind, etc. found inside FR descriptions |
+| MEASURABILITY | All success metrics and NFRs are quantifiable | "Fast", "responsive", "secure" without numeric thresholds |
+| COMPLETENESS | All Brief categories covered, no gaps | Missing user personas, constraints, negative scope |
+| SMART | Requirements are Specific, Measurable, Achievable, Relevant, Time-bound | Vague scope, unmeasurable criteria, unrealistic estimates |
+
+Report as dimensional audit table in the QA report.
+Apply penalties: -10 per FAIL dimension (in addition to existing per-item penalties).
+```
+
 ### Step 4: Adversarial Review (Mandatory)
 
 ```

package/framework/config.yaml

@@ -1,8 +1,8 @@
 # chati.dev Configuration
-version: "4.0.4"
+version: "4.1.0"
 installed_at: "2026-02-07T10:00:00Z"
-updated_at: "2026-03-22T00:00:00Z"
-installer_version: "4.0.4"
+updated_at: "2026-04-02T00:00:00Z"
+installer_version: "4.1.0"
 project_type: greenfield
 language: en
 ides: [claude-code]
@@ -28,7 +28,7 @@ providers:
 #     provider: gemini
 #     model: pro
 
-# Feature flags — toggle new capabilities (v4.0 Pegasus)
+# Feature flags — toggle new capabilities (v4.0 Pegasus + Intelligence Upgrade)
 features:
   hybrid_budget: true
   anti_dash: true
@@ -42,6 +42,17 @@ features:
   tech_presets: true
   doctor_autofix: true
   brandbook: true
+  # Intelligence Upgrade (v4.0.5 — Claude Code patterns)
+  undercover_mode: true             # Sanitize framework terms from deliverables
+  memory_extraction: true           # Per-turn automatic memory capture
+  memory_consolidation: true        # /chati dream — 4-phase memory consolidation
+  daily_digest: true                # /chati digest — KAIROS Lite daily activity log
+  structured_session_memory: true   # 8-section session digest with token budgets
+  static_prism_boundary: true       # Static/Dynamic PRISM boundary for cache optimization
+  token_bracket_estimation: true    # Token-based bracket estimation (replaces turn count)
+  model_fallback: true              # Automatic opus→sonnet fallback on overload
+  frustration_detection: true       # Detect user frustration and adapt response style
+  bash_security_checks: true        # 23-point shell injection defense system
 
 # Telemetry — opt-in anonymous usage tracking
 telemetry:

package/framework/constitution.md

@@ -322,6 +322,12 @@ The pipeline operates in three execution modes that control agent permissions. M
 
 7. Memory attention scoring SHALL use natural decay — memories not accessed lose relevance organically. No memory is permanent unless explicitly marked as durable by the user.
 
+8. The system SHALL support memory consolidation (`/chati dream`) to merge, deduplicate, and prune accumulated memories. Consolidation follows a 4-phase cycle (Orient, Gather, Consolidate, Prune) and archives removed entries rather than deleting them.
+
+9. Per-turn memory extraction MAY capture decisions, resolutions, corrections, and validated patterns automatically from agent output. Extracted memories start at warm tier (confidence 0.5) and are promoted through evidence accumulation.
+
+10. Daily activity digests (`/chati digest`) SHALL maintain append-only session logs for observability. Digests are cumulative per calendar day and include agent scores, decisions, and gotchas.
+
 **Enforcement: BLOCK** — Auto-modification of user files is a critical violation.
 
 ---
@@ -461,7 +467,7 @@ When multiple CLI providers are enabled, the system SHALL coordinate agent execu
 
 1. The CLI Provider Registry (`packages/chati-dev/src/terminal/cli-registry.js`) is the source of truth for provider capabilities: command syntax, model flags, stdin support, hook support, MCP support, and context file format.
 
-2. The handoff format is provider-agnostic. All agents, regardless of which CLI executes them, produce handoffs in the same two-layer format (Article VIII). This ensures seamless inter-provider communication.
+2. The handoff format is provider-agnostic. All agents, regardless of which CLI executes them, produce handoffs in the same two-layer format (Article VIII). This ensures consistent inter-provider communication without format translation.
 
 3. Provider availability SHALL be validated by the health check engine before spawning. If a configured provider is unavailable, the system SHALL fall back to the primary provider (claude) with a warning.
 
@@ -481,5 +487,5 @@ When multiple CLI providers are enabled, the system SHALL coordinate agent execu
 
 ---
 
-*Chati.dev Constitution v4.0.1 — 19 Articles + Preamble*
+*Chati.dev Constitution v4.1.0 — 19 Articles + Preamble*
 *All agents are bound by this Constitution. Violations are enforced per article.*

package/framework/context/root.md

@@ -1,7 +1,7 @@
 # Chati.dev System Context
 
 ## Framework
-- **Version**: 4.0.0
+- **Version**: 4.1.0
 - **Agents**: 13 (12 specialized + orchestrator)
 - **Constitution**: 19 Articles + Preamble
 - **Quality**: 5 pipeline gates + 3-tier verdicts (APPROVED / NEEDS_REVISION / BLOCKED)

package/framework/data/entity-registry.yaml

@@ -3,9 +3,9 @@
 # and by the Health Check for system integrity validation.
 
 metadata:
-  version: "4.0.0"
-  last_updated: "2026-03-17T00:00:00Z"
-  entity_count: 55
+  version: "4.1.0"
+  last_updated: "2026-04-02T00:00:00Z"
+  entity_count: 62
   checksum_algorithm: sha256
 
 entities:
@@ -195,6 +195,14 @@ entities:
       dependencies: [brandbook]
       adaptability: 0.8
 
+    session-memory:
+      path: chati.dev/templates/session-memory-tmpl.yaml
+      type: template
+      purpose: "8-section structured digest template for session memory capture"
+      keywords: [memory, digest, session, structured, sections, budget]
+      dependencies: [constitution]
+      adaptability: 0.6
+
   workflows:
     greenfield-fullstack:
       path: chati.dev/workflows/greenfield-fullstack.yaml
@@ -351,6 +359,54 @@ entities:
       dependencies: []
       adaptability: 0.7
 
+    memory-consolidation:
+      path: packages/chati-dev/src/memory/dream.js
+      type: module
+      purpose: "4-phase memory consolidation (Orient, Gather, Consolidate, Prune)"
+      keywords: [memory, consolidation, dream, deduplication, pruning, archive]
+      dependencies: [memory-layer]
+      adaptability: 0.3
+
+    memory-extraction:
+      path: packages/chati-dev/src/memory/memory-extractor.js
+      type: module
+      purpose: "Per-turn automatic memory extraction from agent output"
+      keywords: [memory, extraction, patterns, decisions, resolutions, corrections]
+      dependencies: [memory-layer]
+      adaptability: 0.4
+
+    daily-digest:
+      path: packages/chati-dev/src/memory/daily-digest.js
+      type: module
+      purpose: "KAIROS Lite daily activity digest with append-only entries"
+      keywords: [digest, daily, kairos, activity, summary, sessions]
+      dependencies: [memory-layer]
+      adaptability: 0.5
+
+    magic-docs:
+      path: packages/chati-dev/src/memory/magic-docs.js
+      type: module
+      purpose: "Auto-updating CLAUDE.md Current State section after handoffs"
+      keywords: [documentation, auto-update, claude-md, handoff, state]
+      dependencies: [constitution]
+      adaptability: 0.4
+
+    undercover-guard:
+      path: chati.dev/hooks/undercover-guard.js
+      type: hook
+      purpose: "Sanitize framework terminology from user-facing deliverables"
+      keywords: [security, sanitization, undercover, internal-terms, deliverables]
+      dependencies: [constitution]
+      adaptability: 0.2
+
+    bash-security:
+      path: packages/chati-dev/src/security/bash-security.js
+      type: module
+      purpose: "23-point shell injection defense system for bash commands"
+      keywords: [security, bash, injection, shell, defense, checks]
+      dependencies: [constitution]
+      adaptability: 0.1
+
   quality-gates:
     planning-gate:
       path: chati.dev/quality-gates/planning-gate.md

package/framework/hooks/constitution-guard.js

@@ -99,6 +99,25 @@ async function main() {
         }));
         return;
       }
+
+      // Run 23-point shell injection security checks
+      const injectionFindings = runShellInjectionChecks(command);
+      if (injectionFindings.length > 0) {
+        const critical = injectionFindings.filter(f => f.severity === 'critical');
+        if (critical.length > 0) {
+          process.stdout.write(JSON.stringify({
+            decision: 'block',
+            reason: `[Article IV] Shell injection risk detected (${critical.length} critical): ${critical.map(f => f.id).join(', ')}. Command: "${command.slice(0, 60)}..."`,
+          }));
+          return;
+        }
+        // High/medium findings: allow with warning (advisory)
+        process.stdout.write(JSON.stringify({
+          decision: 'allow',
+          reason: `[Security Advisory] ${injectionFindings.length} shell security finding(s): ${injectionFindings.map(f => f.id).join(', ')}`,
+        }));
+        return;
+      }
     }
 
     process.stdout.write(JSON.stringify({ decision: 'allow' }));
@@ -108,7 +127,54 @@ async function main() {
   }
 }
 
-export { containsSecrets, isDestructiveCommand, SECRET_PATTERNS, DESTRUCTIVE_COMMANDS };
+/**
+ * 23-point shell injection security checks.
+ * Inline implementation (hooks are standalone — no imports from src/).
+ * Based on Claude Code's bashSecurity.ts patterns.
+ */
+// SYNC: These 23 check IDs MUST match packages/chati-dev/src/security/bash-security.js
+// Hooks are standalone (no imports from src/), so duplication is necessary.
+// If you update here, update bash-security.js too. Run: npm test to verify both.
+const SHELL_INJECTION_CHECKS = [
+  { id: 'INCOMPLETE_COMMANDS', pattern: /[|&;]\s*$/, severity: 'high' },
+  { id: 'JQ_SYSTEM_FUNCTION', pattern: /jq\b.*\bsystem\s*\(/i, severity: 'critical' },
+  { id: 'JQ_FILE_ARGUMENTS', pattern: /jq\b.*--from-file|jq\b.*-f\s+[^|&;]+/i, severity: 'high' },
+  { id: 'OBFUSCATED_FLAGS', pattern: /\$[({].*[)}].*-/, severity: 'high' },
+  { id: 'SHELL_METACHARACTERS', pattern: /[`]|(?:\$\((?!.*\becho\b))/, severity: 'critical' },
+  { id: 'DANGEROUS_VARIABLES', pattern: /(?:^|\s)(?:PATH|LD_PRELOAD|LD_LIBRARY_PATH|DYLD_INSERT_LIBRARIES|PYTHONPATH|NODE_PATH|RUBYLIB|PERL5LIB)\s*=/, severity: 'critical' },
+  { id: 'NEWLINES', pattern: /(?<!\\)\n.*(?:rm|curl|wget|chmod|chown|sudo|eval|exec)/, severity: 'high' },
+  { id: 'BACKSLASH_ESCAPED_WHITESPACE', pattern: /\\\s+(?:-|\/)/,severity: 'medium' },
+  // eslint-disable-next-line no-control-regex
+  { id: 'CONTROL_CHARACTERS', pattern: /[\x00-\x08\x0e-\x1f\x7f]/, severity: 'critical' },
+  { id: 'UNICODE_WHITESPACE', pattern: /[\u200B-\u200F\u2028-\u202F\uFEFF\u00A0\u2060\u180E]/, severity: 'critical' },
+  { id: 'DANGEROUS_PATTERNS_COMMAND_SUBSTITUTION', pattern: /\$\(.*(?:curl|wget|nc|bash|sh|python|perl|ruby|node)\b/i, severity: 'critical' },
+  { id: 'DANGEROUS_PATTERNS_INPUT_REDIRECTION', pattern: /<\s*(?:\/etc\/(?:passwd|shadow|sudoers)|\/proc\/|~\/\.ssh\/|~\/\.aws\/)/, severity: 'critical' },
+  { id: 'DANGEROUS_PATTERNS_OUTPUT_REDIRECTION', pattern: />\s*(?:\/etc\/|~\/\.ssh\/|~\/\.bashrc|~\/\.zshrc|~\/\.profile|~\/\.gitconfig)/, severity: 'critical' },
+  { id: 'IFS_INJECTION', pattern: /\bIFS\s*=/, severity: 'critical' },
+  { id: 'BRACE_EXPANSION', pattern: /\{.*(?:rm|curl|wget|chmod|eval|exec|sudo).*[,}]/, severity: 'high' },
+  { id: 'GIT_COMMIT_SUBSTITUTION', pattern: /git\s+(?:commit|push|tag).*\$[({]/, severity: 'high' },
+  { id: 'PROC_ENVIRON_ACCESS', pattern: /\/proc\/(?:self|\d+)\/(?:environ|cmdline|maps|mem)/, severity: 'critical' },
+  { id: 'MALFORMED_TOKEN_INJECTION', pattern: /\\x[0-9a-f]{2}|\\u[0-9a-f]{4}|\\[0-7]{3}/i, severity: 'high' },
+  { id: 'MID_WORD_HASH', pattern: /\w#\w/, severity: 'medium' },
+  { id: 'COMMENT_QUOTE_DESYNC', pattern: /#.*['"][^'"]*$/, severity: 'medium' },
+  { id: 'QUOTED_NEWLINE', pattern: /["'][^"']*\n[^"']*["']/, severity: 'high' },
+  { id: 'ZSH_DANGEROUS_COMMANDS', pattern: /\b(?:zmodload|sysopen|sysread|syswrite|zsystem|zselect|ztcp)\b/, severity: 'critical' },
+  { id: 'BACKSLASH_ESCAPED_OPERATORS', pattern: /\\[|;&]/, severity: 'medium' },
+];
+
+function runShellInjectionChecks(command) {
+  if (!command || typeof command !== 'string') return [];
+  const findings = [];
+  for (const check of SHELL_INJECTION_CHECKS) {
+    check.pattern.lastIndex = 0;
+    if (check.pattern.test(command)) {
+      findings.push({ id: check.id, severity: check.severity });
+    }
+  }
+  return findings;
+}
+
+export { containsSecrets, isDestructiveCommand, runShellInjectionChecks, SECRET_PATTERNS, DESTRUCTIVE_COMMANDS, SHELL_INJECTION_CHECKS };
 
 // Only run main when executed directly (not imported by tests)
 import { fileURLToPath } from 'url';

package/framework/hooks/license-guard.js

@@ -89,11 +89,11 @@ async function main() {
         return;
       }
       block(buildMessage(data.status, data.reason));
-    } catch {
-      allow(); // Fail open — API unreachable
+    } catch { /* expected: API may be unreachable — fail open */
+      allow();
     }
-  } catch {
-    allow(); // Parse error — fail open
+  } catch { /* expected: stdin parse may fail — fail open */
+    allow();
   }
 }
 

package/framework/hooks/model-governance.js

@@ -88,7 +88,8 @@ async function main() {
     } else {
       process.stdout.write(JSON.stringify({ result: 'allow' }));
     }
-  } catch {
+  } catch (err) {
+    process.stderr.write(`[chati] model-governance: ${err.message}\n`);
     process.stdout.write(JSON.stringify({ result: 'allow' }));
   }
 }

package/framework/hooks/prism-engine.js

@@ -32,6 +32,7 @@ function readSessionState(projectDir) {
     workflow: extract('workflow') || null,
     pipelinePosition: extract('pipeline_position') || null,
     turnCount: parseInt(extract('turn_count') || '0', 10),
+    provider: extract('provider') || 'claude',
   };
 }
 
@@ -56,9 +57,39 @@ async function main() {
       return;
     }
 
-    // Estimate remaining context from turn count
-    const maxTurns = 40;
-    const remainingPercent = Math.max(0, Math.round((1 - session.turnCount / maxTurns) * 100));
+    // Estimate remaining context — prefer token-based estimation over turn count
+    // Token estimation: 1 token ≈ 4 characters (Claude Code pattern)
+    // SYNC: These limits MUST match packages/chati-dev/src/utils/provider-limits.js
+    const HOOK_MODEL_LIMITS = { opus: 1_000_000, sonnet: 200_000, haiku: 200_000, pro: 1_000_000, flash: 1_000_000, codex: 128_000 };
+    const HOOK_PROVIDER_LIMITS = { claude: 200_000, gemini: 1_000_000, codex: 128_000 };
+
+    // Infer model from current agent via AGENT_MODELS map
+    const HOOK_AGENT_MODELS = {
+      orchestrator: 'sonnet', 'greenfield-wu': 'haiku', 'brownfield-wu': 'opus',
+      brief: 'sonnet', detail: 'opus', architect: 'opus', ux: 'sonnet',
+      phases: 'sonnet', tasks: 'sonnet', 'qa-planning': 'opus',
+      'qa-implementation': 'opus', dev: 'opus', devops: 'sonnet',
+    };
+    const inferredModel = session.currentAgent ? HOOK_AGENT_MODELS[session.currentAgent] : null;
+
+    // Resolve context limit: model > provider > default
+    function hookResolveLimit(model, provider) {
+      if (model && HOOK_MODEL_LIMITS[model]) return HOOK_MODEL_LIMITS[model];
+      if (provider && HOOK_PROVIDER_LIMITS[provider]) return HOOK_PROVIDER_LIMITS[provider];
+      return 200_000;
+    }
+
+    let remainingPercent;
+    const promptText = event.prompt || '';
+    if (promptText.length > 0) {
+      const estimatedTokens = Math.ceil(promptText.length / 4);
+      const contextLimit = hookResolveLimit(inferredModel, session.provider);
+      remainingPercent = Math.max(0, Math.round((1 - estimatedTokens / contextLimit) * 100));
+    } else {
+      // Fallback to turn-count heuristic when prompt text unavailable
+      const maxTurns = 40;
+      remainingPercent = Math.max(0, Math.round((1 - session.turnCount / maxTurns) * 100));
+    }
 
     // Determine bracket
     let bracket = 'FRESH';
@@ -79,6 +110,15 @@ async function main() {
       }
     }
 
+    // Frustration detection — adapt response style when user is frustrated
+    const frustrationDetected = detectFrustration(promptText);
+
+    // Microcompact advisory — hint to economize context when depleted + idle
+    let microcompactAdvisory = '';
+    if ((bracket === 'DEPLETED' || bracket === 'CRITICAL') && session.turnCount > 10) {
+      microcompactAdvisory = '  <advisory priority="medium">Context constrained. Avoid re-reading files already in context. Summarize stale outputs before proceeding.</advisory>';
+    }
+
     // Build minimal context block (full PRISM pipeline is used by orchestrator internally)
     const contextBlock = [
       `<chati-context bracket="${bracket}">`,
@@ -87,6 +127,8 @@ async function main() {
       session.pipelinePosition ? `  <pipeline-position>${session.pipelinePosition}</pipeline-position>` : '',
       memoryBlock,
       bracket === 'CRITICAL' ? '  <advisory>Context running low. Consider handoff or summary.</advisory>' : '',
+      microcompactAdvisory,
+      frustrationDetected ? '  <advisory priority="high">User shows signs of frustration. Be more direct, acknowledge the issue explicitly, focus on the solution, avoid repeating previous suggestions.</advisory>' : '',
       '</chati-context>',
     ].filter(Boolean).join('\n');
 
@@ -94,13 +136,39 @@ async function main() {
       result: 'allow',
       prefix: contextBlock,
     }));
-  } catch {
-    // On error, allow without injection
+  } catch (err) {
+    process.stderr.write(`[chati] prism-engine: ${err.message}\n`);
     process.stdout.write(JSON.stringify({ result: 'allow' }));
   }
 }
 
-export { readSessionState };
+/**
+ * Frustration detection patterns.
+ * Inspired by Claude Code's regex-based emotion detection.
+ * Soft advisory only — never blocks or overrides behavior.
+ */
+const FRUSTRATION_PATTERNS = [
+  /this (is|isn't|isnt) working/i,
+  /I (already|just) (told|said|asked)/i,
+  /why (won't|doesn't|can't|isn't|wont|doesnt|cant|isnt)/i,
+  /stop (doing|repeating|ignoring)/i,
+  /you('re| are) (not|never) (listening|reading|understanding)/i,
+  /for the (second|third|fourth|last) time/i,
+  /!!+/,
+  /\b(WTF|WHAT THE|FFS|OMG)\b/i,
+];
+
+/**
+ * Detect user frustration from prompt text.
+ * @param {string} prompt - User prompt text
+ * @returns {boolean} True if frustration patterns detected
+ */
+function detectFrustration(prompt) {
+  if (!prompt || prompt.length < 5) return false;
+  return FRUSTRATION_PATTERNS.some(p => p.test(prompt));
+}
+
+export { readSessionState, detectFrustration };
 
 // Only run main when executed directly (not imported by tests)
 import { fileURLToPath } from 'url';

package/framework/hooks/read-protection.js

@@ -52,7 +52,7 @@ function isSensitivePath(filePath, cwd) {
   let rel;
   try {
     rel = relative(cwd, filePath);
-  } catch {
+  } catch { /* expected: path may be on different drive */
     rel = filePath;
   }