chati-dev 4.5.16 → 4.5.27

package/framework/hooks/reasoning-escalator.js

@@ -19,9 +19,12 @@
  * mutation — no js-yaml dependency).
  */
 
-import { existsSync, readFileSync, writeFileSync, readdirSync, statSync } from 'fs';
+import { existsSync, readdirSync, statSync } from 'fs';
 import { join, isAbsolute, relative } from 'path';
 import { execSync } from 'child_process';
+import { fileURLToPath } from 'url';
+import { readHookSession } from './session-reader.js';
+import { updateHookSession } from './session-writer.js';
 
 // ---------------------------------------------------------------------------
 // Pure helpers (exported for testing)
@@ -217,56 +220,36 @@ export function checkDeliberatePlanRequirement(input) {
 // ---------------------------------------------------------------------------
 
 /**
- * Parse the reasoning_tier and started_at fields out of session.yaml using
- * regex. Stays dependency-free (hooks do not import js-yaml).
+ * Read reasoning state through the canonical safe session boundary.
  */
 export function readSessionTier(projectDir) {
-  const sessionPath = join(projectDir, '.chati', 'session.yaml');
-  if (!existsSync(sessionPath)) return { tier: 'standard', startedAt: 0, raw: null };
-  let raw = '';
-  try { raw = readFileSync(sessionPath, 'utf-8'); } catch { return { tier: 'standard', startedAt: 0, raw: null }; }
-  const tierMatch = raw.match(/^\s*reasoning_tier:\s*(["']?)(\w+)\1\s*$/m);
-  const startedMatch = raw.match(/^\s*started_at:\s*(["']?)([^"'\n]+)\1\s*$/m);
-  let startedAt = 0;
-  if (startedMatch) {
-    const t = Date.parse(startedMatch[2]);
-    if (!Number.isNaN(t)) startedAt = t;
-  }
-  const tier = tierMatch ? tierMatch[2] : 'standard';
-  return { tier: TIERS.includes(tier) ? tier : 'standard', startedAt, raw };
+  const sessionRead = readHookSession(projectDir);
+  if (!sessionRead.loaded) return { tier: 'standard', startedAt: 0, raw: null };
+  const tier = TIERS.includes(sessionRead.session.reasoning_tier)
+    ? sessionRead.session.reasoning_tier
+    : 'standard';
+  const started = sessionRead.session.started_at;
+  const parsed = started instanceof Date ? started.getTime() : Date.parse(started);
+  return { tier, startedAt: Number.isNaN(parsed) ? 0 : parsed, raw: null };
 }
 
 /**
- * Parse session.language out of session.yaml. Defaults to 'en' if the key is
- * missing or unreadable. Kept regex-based to avoid a js-yaml dep in hooks.
+ * Read session language through the canonical safe session boundary.
  */
 export function readSessionLanguage(projectDir) {
-  const sessionPath = join(projectDir, '.chati', 'session.yaml');
-  if (!existsSync(sessionPath)) return 'en';
-  let raw = '';
-  try { raw = readFileSync(sessionPath, 'utf-8'); } catch { return 'en'; }
-  const m = raw.match(/^\s*language:\s*(["']?)([a-z]{2})\1\s*$/m);
-  return m ? m[2] : 'en';
+  const sessionRead = readHookSession(projectDir);
+  const language = sessionRead.loaded ? sessionRead.session.language : null;
+  return typeof language === 'string' && /^[a-z]{2}$/.test(language) ? language : 'en';
 }
 
 /**
- * Update session.yaml with a new reasoning_tier value. Append `reasoning_tier:`
- * if missing; replace in place if present. Silent on failure.
+ * Update session.yaml through the hook-local safe writer. An installed hook
+ * must not dynamically import the mutable project runtime just to persist its
+ * own scalar state.
  */
-export function writeSessionTier(projectDir, tier) {
+export async function writeSessionTier(projectDir, tier) {
   if (!TIERS.includes(tier)) return false;
-  const sessionPath = join(projectDir, '.chati', 'session.yaml');
-  if (!existsSync(sessionPath)) return false;
-  let raw = '';
-  try { raw = readFileSync(sessionPath, 'utf-8'); } catch { return false; }
-  const line = `reasoning_tier: ${tier}`;
-  let next;
-  if (/^\s*reasoning_tier:\s*\w+\s*$/m.test(raw)) {
-    next = raw.replace(/^\s*reasoning_tier:\s*\w+\s*$/m, line);
-  } else {
-    next = raw.trimEnd() + '\n' + line + '\n';
-  }
-  try { writeFileSync(sessionPath, next, 'utf-8'); return true; } catch { return false; }
+  return updateHookSession(projectDir, { reasoning_tier: tier }).saved === true;
 }
 
 /**
@@ -335,7 +318,7 @@ async function main() {
         language,
       });
       if (result.tier !== currentTier) {
-        writeSessionTier(projectDir, result.tier);
+        await writeSessionTier(projectDir, result.tier);
       }
       process.stdout.write(JSON.stringify(userPromptPassthrough()));
       return;

package/framework/hooks/session-digest.js

@@ -9,28 +9,27 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, chmodSync } from 'fs';
 import { createHash } from 'crypto';
 import { join } from 'path';
+import { readHookSession } from './session-reader.js';
 
 /**
  * Extract structured 8-section digest from session state.
  * Enriched version captures decisions, blockers, gotchas for better recovery.
  */
 function extractDigest(projectDir) {
-  const sessionPath = join(projectDir, '.chati', 'session.yaml');
-  if (!existsSync(sessionPath)) return null;
-
-  const raw = readFileSync(sessionPath, 'utf-8');
-  const extract = (key) => {
-    const match = raw.match(new RegExp(`^\\s*${key}:\\s*(.+)$`, 'm'));
-    return match ? match[1].trim().replace(/^["']|["']$/g, '') : null;
-  };
+  const sessionRead = readHookSession(projectDir);
+  if (!sessionRead.loaded) return null;
+  const session = sessionRead.session;
+  const scalar = (key) => ['string', 'number', 'boolean'].includes(typeof session[key])
+    ? String(session[key])
+    : null;
 
   // Base digest (backward-compatible)
   const base = {
     timestamp: new Date().toISOString(),
-    mode: extract('mode') || 'discover',
-    currentAgent: extract('current_agent') || 'none',
-    pipelinePosition: extract('pipeline_position') || 'unknown',
-    workflow: extract('workflow') || 'unknown',
+    mode: scalar('mode') || 'discover',
+    currentAgent: scalar('current_agent') || 'none',
+    pipelinePosition: scalar('pipeline_position') || 'unknown',
+    workflow: scalar('workflow') || 'unknown',
   };
 
   // Enrich with gotchas (lightweight read, capped at 10)
@@ -52,7 +51,7 @@ function extractDigest(projectDir) {
     ...base,
     version: '2.0',
     // Structured sections (enriched)
-    active_task: extract('active_task') || null,
+    active_task: scalar('active_task') || null,
     blockers: [],      // Populated by agents at runtime
     decisions_made: [], // Populated by agents at runtime
     gotchas_found: gotchas,

package/framework/hooks/session-reader.js

@@ -0,0 +1,224 @@
+import {
+  closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync,
+} from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+
+// Hooks are trusted by the host lifecycle, but the project runtime is not a
+// trust root. In particular, a hook must never import .chati.dev/_cli just to
+// read session state: a provider that can replace that runtime could execute
+// arbitrary code before a governance decision is made.
+const SESSION_MAX_BYTES = 4 * 1024 * 1024;
+const SESSION_STABILITY_ATTEMPTS = 3;
+const SESSION_STABILITY_RETRY_MS = 5;
+
+function sameSnapshot(left, right) {
+  return Boolean(left && right
+    && left.dev === right.dev
+    && left.ino === right.ino
+    && left.mode === right.mode
+    && left.uid === right.uid
+    && left.gid === right.gid
+    && left.nlink === right.nlink
+    && left.size === right.size
+    && left.mtimeMs === right.mtimeMs
+    && left.ctimeMs === right.ctimeMs);
+}
+
+function readBounded(descriptor) {
+  const buffer = Buffer.allocUnsafe(SESSION_MAX_BYTES + 1);
+  let offset = 0;
+  while (offset < buffer.length) {
+    const bytes = readSync(descriptor, buffer, offset, buffer.length - offset, null);
+    if (bytes === 0) break;
+    offset += bytes;
+  }
+  if (offset > SESSION_MAX_BYTES) throw new Error('session.yaml exceeds the 4 MiB safety limit');
+  return buffer.subarray(0, offset).toString('utf8');
+}
+
+function withoutYamlComment(value) {
+  let quote = null;
+  for (let index = 0; index < value.length; index += 1) {
+    const char = value[index];
+    if (quote) {
+      if (char === '\\' && quote === '"') { index += 1; continue; }
+      if (char === quote) quote = null;
+      continue;
+    }
+    if (char === '"' || char === "'") { quote = char; continue; }
+    if (char === '#' && (index === 0 || /\s/.test(value[index - 1]))) return value.slice(0, index).trimEnd();
+  }
+  if (quote) throw new Error('session.yaml has an unterminated scalar quote');
+  return value.trimEnd();
+}
+
+function scalar(value) {
+  const source = withoutYamlComment(String(value || '').trim());
+  if (source === '') return '';
+  if (source === 'null' || source === '~') return null;
+  if (source === 'true') return true;
+  if (source === 'false') return false;
+  if (/^-?(?:0|[1-9]\d*)(?:\.\d+)?$/.test(source)) return Number(source);
+  if (source === '[]') return [];
+  if (source === '{}') return {};
+  if (source.startsWith('"')) {
+    try { return JSON.parse(source); }
+    catch { throw new Error('session.yaml has an invalid quoted scalar'); }
+  }
+  if (source.startsWith("'")) {
+    if (!source.endsWith("'")) throw new Error('session.yaml has an invalid quoted scalar');
+    return source.slice(1, -1).replaceAll("''", "'");
+  }
+  if (/^[\[{]/.test(source) || /[\]}]$/.test(source)) {
+    throw new Error('session.yaml uses an unsupported flow collection');
+  }
+  return source;
+}
+
+function mapping(line, label) {
+  const match = line.match(/^([A-Za-z_][\w-]*):(?:\s+(.*))?\s*$/);
+  if (!match) throw new Error(`session.yaml has an invalid ${label} mapping`);
+  if (['__proto__', 'constructor', 'prototype'].includes(match[1])) {
+    throw new Error(`session.yaml has an unsafe ${label} mapping key`);
+  }
+  return { key: match[1], value: match[2] === undefined ? undefined : scalar(match[2]) };
+}
+
+function assignOnce(target, key, value, label) {
+  if (Object.hasOwn(target, key)) throw new Error(`session.yaml has a duplicate ${label} key: ${key}`);
+  Object.defineProperty(target, key, {
+    configurable: false,
+    enumerable: true,
+    value,
+    writable: true,
+  });
+}
+
+/**
+ * Read only the session projection used by lifecycle hooks. The generated
+ * document is YAML, but hooks do not need a general YAML implementation. A
+ * deliberately small data-only decoder eliminates dynamic imports from the
+ * project while supporting the canonical scalar, nested-map and team-list
+ * shapes. Unsupported syntax fails closed rather than being interpreted.
+ */
+export function parseHookSessionProjection(raw) {
+  if (typeof raw !== 'string' || raw.includes('\t')) throw new Error('session.yaml uses unsupported indentation');
+  const session = {};
+  const rootKeys = new Set();
+  let section = null;
+  let team = null;
+  const lines = raw.replace(/^\uFEFF/, '').split(/\r?\n/);
+
+  for (const original of lines) {
+    if (!original.trim() || /^\s*#/.test(original) || /^\s*(---|\.\.\.)\s*$/.test(original)) continue;
+    const indent = original.match(/^ */)[0].length;
+    const text = original.slice(indent);
+    if (indent === 0) {
+      const entry = mapping(text, 'root');
+      if (rootKeys.has(entry.key)) throw new Error(`session.yaml has a duplicate root key: ${entry.key}`);
+      rootKeys.add(entry.key);
+      section = entry.value === undefined ? entry.key : null;
+      team = null;
+      if (entry.value !== undefined) assignOnce(session, entry.key, entry.value, 'root');
+      continue;
+    }
+
+    if (section === 'project' || section === 'current_execution_binding') {
+      if (indent !== 2) throw new Error(`session.yaml has invalid ${section} indentation`);
+      const entry = mapping(text, section);
+      if (entry.value === undefined) throw new Error(`session.yaml has an unsupported nested ${section} value`);
+      if (!Object.hasOwn(session, section)) assignOnce(session, section, {}, section);
+      assignOnce(session[section], entry.key, entry.value, section);
+      continue;
+    }
+
+    if (section === 'teams') {
+      if (indent === 2 && text.startsWith('- ')) {
+        const entry = mapping(text.slice(2), 'team');
+        if (entry.value === undefined) throw new Error('session.yaml has an unsupported nested team value');
+        if (!Array.isArray(session.teams)) session.teams = [];
+        team = {};
+        assignOnce(team, entry.key, entry.value, 'team');
+        session.teams.push(team);
+        continue;
+      }
+      if (indent === 4 && team) {
+        const entry = mapping(text, 'team');
+        if (entry.value === undefined) throw new Error('session.yaml has an unsupported nested team value');
+        assignOnce(team, entry.key, entry.value, 'team');
+        continue;
+      }
+      throw new Error('session.yaml has invalid teams indentation');
+    }
+    // Other session sections are not authority inputs for a hook. Ignore their
+    // data-only YAML subtree while the root-level state remains pinned below.
+  }
+  return Object.freeze(session);
+}
+
+function readPinnedSession(projectDir) {
+  const root = realpathSync(resolve(projectDir));
+  const sessionDir = join(root, '.chati');
+  const sessionDirStat = lstatSync(sessionDir);
+  if (!sessionDirStat.isDirectory() || sessionDirStat.isSymbolicLink() || realpathSync(sessionDir) !== sessionDir || dirname(sessionDir) !== root) {
+    throw new Error('The .chati directory must be a real directory inside the project');
+  }
+  let directory;
+  let session;
+  try {
+    directory = openSync(sessionDir, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+    const openedDirectory = fstatSync(directory);
+    if (!openedDirectory.isDirectory() || openedDirectory.dev !== sessionDirStat.dev || openedDirectory.ino !== sessionDirStat.ino) {
+      throw new Error('The .chati directory changed during the session read');
+    }
+    // On Linux, continue through the pinned directory descriptor. An attacker
+    // cannot redirect this open by replacing the .chati ancestor after it was
+    // validated. Other platforms retain the same fail-closed snapshots below.
+    const pinnedDirectoryPath = process.platform === 'linux' ? `/proc/self/fd/${directory}` : sessionDir;
+    const pinnedSessionPath = join(pinnedDirectoryPath, 'session.yaml');
+    const path = join(sessionDir, 'session.yaml');
+    session = openSync(pinnedSessionPath, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+    const before = fstatSync(session);
+    if (!before.isFile() || before.nlink !== 1 || before.size > SESSION_MAX_BYTES) {
+      throw new Error('session.yaml must be a bounded single-link regular file');
+    }
+    const raw = readBounded(session);
+    const after = fstatSync(session);
+    const pathAfter = lstatSync(pinnedSessionPath);
+    const directoryAfter = fstatSync(directory);
+    if (!sameSnapshot(before, after) || !sameSnapshot(before, pathAfter)
+      || !sameSnapshot(openedDirectory, directoryAfter)) {
+      throw new Error('session.yaml changed during the session read');
+    }
+    return { session: parseHookSessionProjection(raw), path };
+  } finally {
+    if (session !== undefined) closeSync(session);
+    if (directory !== undefined) closeSync(directory);
+  }
+}
+
+export function readHookSession(projectDir) {
+  let path;
+  let error;
+  try {
+    for (let attempt = 0; attempt < SESSION_STABILITY_ATTEMPTS; attempt += 1) {
+      try {
+        const result = readPinnedSession(projectDir);
+        return { loaded: true, missing: false, session: result.session, path: result.path, error: null };
+      } catch (caught) {
+        error = caught;
+        // A descriptor and path identity mismatch is expected only while an
+        // already-authorized writer atomically replaces session.yaml. Retry a
+        // few times from scratch, never through the prior descriptor. Every
+        // other malformed or unsafe state fails closed immediately.
+        if (caught?.message !== 'session.yaml changed during the session read'
+          || attempt + 1 === SESSION_STABILITY_ATTEMPTS) break;
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, SESSION_STABILITY_RETRY_MS);
+      }
+    }
+  } finally {
+    try { path = join(resolve(projectDir), '.chati', 'session.yaml'); } catch { path = null; }
+  }
+  const message = error?.message || 'Safe session reader is unavailable';
+  return { loaded: false, missing: error?.code === 'ENOENT', session: null, path, error: message };
+}

package/framework/hooks/session-writer.js

@@ -0,0 +1,195 @@
+import {
+  closeSync, constants, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync,
+  readSync, realpathSync, renameSync, rmdirSync, unlinkSync, writeFileSync,
+} from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { parseHookSessionProjection } from './session-reader.js';
+
+const SESSION_MAX_BYTES = 4 * 1024 * 1024;
+const LOCK_WAIT_MS = 2_000;
+const LOCK_RETRY_MS = 20;
+
+function sameIdentity(left, right) {
+  return Boolean(left && right && left.dev === right.dev && left.ino === right.ino);
+}
+
+function readBounded(descriptor) {
+  const buffer = Buffer.allocUnsafe(SESSION_MAX_BYTES + 1);
+  let offset = 0;
+  while (offset < buffer.length) {
+    const bytes = readSync(descriptor, buffer, offset, buffer.length - offset, null);
+    if (bytes === 0) break;
+    offset += bytes;
+  }
+  if (offset > SESSION_MAX_BYTES) throw new Error('session.yaml exceeds the 4 MiB safety limit');
+  return buffer.subarray(0, offset).toString('utf8');
+}
+
+function encodeScalar(value) {
+  if (value === null) return 'null';
+  if (typeof value === 'boolean' || typeof value === 'number') return String(value);
+  if (typeof value === 'string') {
+    if (/^[A-Za-z0-9_.\-\[\]]+$/.test(value) && !['true', 'false', 'null', '~'].includes(value)) return value;
+    return JSON.stringify(value);
+  }
+  throw new Error('hook session updates must be scalar values');
+}
+
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function upsertRootScalar(raw, key, value) {
+  if (!/^[A-Za-z_][\w-]*$/.test(key)) throw new Error('hook session key is invalid');
+  const expression = new RegExp(`^${escapeRegex(key)}:[^\\r\\n]*$`, 'gm');
+  const matches = raw.match(expression) || [];
+  if (matches.length > 1) throw new Error(`session.yaml has duplicate root key: ${key}`);
+  const entry = `${key}: ${encodeScalar(value)}`;
+  if (matches.length === 1) return raw.replace(expression, entry);
+  return `${raw.replace(/\s*$/, '')}\n${entry}\n`;
+}
+
+function directoryReference(directoryPath, descriptor) {
+  return process.platform === 'linux' ? `/proc/self/fd/${descriptor}` : directoryPath;
+}
+
+function waitForHookSessionLock(directoryReferencePath) {
+  const lockPath = join(directoryReferencePath, 'session.yaml.lock');
+  const ownerPath = join(lockPath, 'owner.json');
+  const token = randomUUID();
+  const startedAt = Date.now();
+  while (true) {
+    try {
+      mkdirSync(lockPath, { mode: 0o700 });
+      let owner;
+      try {
+        owner = openSync(ownerPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+        writeFileSync(owner, JSON.stringify({
+          schema_version: 2, pid: process.pid, hostname: hostname(), token,
+          acquired_at: new Date().toISOString(),
+        }));
+        fsyncSync(owner);
+      } finally {
+        if (owner !== undefined) closeSync(owner);
+      }
+      return () => {
+        try { unlinkSync(ownerPath); } catch { /* lock ownership is verified by the bounded wait above */ }
+        try { rmdirSync(lockPath); } catch { /* a supervisor lock replacement must never be removed recursively */ }
+      };
+    } catch (error) {
+      if (error?.code !== 'EEXIST' || Date.now() - startedAt >= LOCK_WAIT_MS) {
+        throw error;
+      }
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, LOCK_RETRY_MS);
+    }
+  }
+}
+
+function updateSessionWithLock(projectDir, mutator) {
+  let directory;
+  let session;
+  let temporary;
+  let releaseLock;
+  try {
+    const root = realpathSync(resolve(projectDir));
+    const directoryPath = join(root, '.chati');
+    const initialDirectory = lstatSync(directoryPath);
+    if (!initialDirectory.isDirectory() || initialDirectory.isSymbolicLink() || realpathSync(directoryPath) !== directoryPath || dirname(directoryPath) !== root) {
+      throw new Error('The .chati directory must be a real directory inside the project');
+    }
+    directory = openSync(directoryPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+    const pinnedDirectory = fstatSync(directory);
+    if (!pinnedDirectory.isDirectory() || !sameIdentity(initialDirectory, pinnedDirectory)) {
+      throw new Error('The .chati directory changed during the session update');
+    }
+    const directoryPathRef = directoryReference(directoryPath, directory);
+    releaseLock = waitForHookSessionLock(directoryPathRef);
+    const sessionPath = join(directoryPathRef, 'session.yaml');
+    session = openSync(sessionPath, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+    const before = fstatSync(session);
+    if (!before.isFile() || before.nlink !== 1 || before.size > SESSION_MAX_BYTES) {
+      throw new Error('session.yaml must be a bounded single-link regular file');
+    }
+    const raw = readBounded(session);
+    const afterRead = fstatSync(session);
+    const currentPath = lstatSync(sessionPath);
+    const currentDirectory = fstatSync(directory);
+    if (!sameIdentity(before, afterRead) || !sameIdentity(before, currentPath) || !sameIdentity(pinnedDirectory, currentDirectory)) {
+      throw new Error('session.yaml changed during the session update');
+    }
+    const updates = mutator(parseHookSessionProjection(raw));
+    if (!updates || typeof updates !== 'object' || Array.isArray(updates)) throw new Error('hook session mutation is invalid');
+    let next = raw;
+    for (const [key, value] of Object.entries(updates)) next = upsertRootScalar(next, key, value);
+    if (Buffer.byteLength(next, 'utf8') > SESSION_MAX_BYTES) throw new Error('session.yaml exceeds the 4 MiB safety limit');
+    const temporaryPath = join(directoryPathRef, `session.yaml.${process.pid}.${randomUUID()}.tmp`);
+    temporary = openSync(temporaryPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    writeFileSync(temporary, next, 'utf8');
+    fsyncSync(temporary);
+    const beforeRenameDirectory = fstatSync(directory);
+    const beforeRenameSession = lstatSync(sessionPath);
+    if (!sameIdentity(pinnedDirectory, beforeRenameDirectory) || !sameIdentity(before, beforeRenameSession)) {
+      throw new Error('session.yaml changed before the atomic update');
+    }
+    closeSync(temporary);
+    temporary = undefined;
+    renameSync(temporaryPath, sessionPath);
+    fsyncSync(directory);
+    return { saved: true, session: parseHookSessionProjection(next) };
+  } catch (error) {
+    return { saved: false, error: error?.message || 'safe hook session update failed' };
+  } finally {
+    if (temporary !== undefined) closeSync(temporary);
+    if (releaseLock) releaseLock();
+    if (session !== undefined) closeSync(session);
+    if (directory !== undefined) closeSync(directory);
+  }
+}
+
+/** Update root-level scalar state without importing any project runtime. */
+export function updateHookSession(projectDir, updates) {
+  return updateSessionWithLock(projectDir, () => updates);
+}
+
+/** Apply PRISM's additive context accounting under the same session lock. */
+export function updateHookContextUsage(projectDir, {
+  delta = 0,
+  contextWindowTokens,
+  detectedModel = null,
+  routedProvider = null,
+} = {}) {
+  const normalizedDelta = Math.max(0, Number.isFinite(Number(delta)) ? Math.trunc(Number(delta)) : 0);
+  const normalizedWindow = Math.max(1, Number.isFinite(Number(contextWindowTokens))
+    ? Math.trunc(Number(contextWindowTokens))
+    : 200_000);
+  const persisted = updateSessionWithLock(projectDir, (session) => {
+    const current = Math.max(0, Number.isFinite(Number(session.context_tokens_used))
+      ? Math.trunc(Number(session.context_tokens_used))
+      : 0);
+    const tokensUsed = Math.min(normalizedWindow, current + normalizedDelta);
+    const remainingPercent = Math.max(0, Math.round((1 - tokensUsed / normalizedWindow) * 100));
+    const bracket = remainingPercent < 25 ? 'CRITICAL'
+      : remainingPercent < 40 ? 'DEPLETED'
+        : remainingPercent < 60 ? 'MODERATE' : 'FRESH';
+    const updates = {
+      context_tokens_used: tokensUsed,
+      context_window_tokens: normalizedWindow,
+      context_last_bracket: bracket,
+    };
+    if (detectedModel && (session.current_execution_binding?.model || !session.active_model)) updates.active_model = detectedModel;
+    if (routedProvider) updates.active_provider = routedProvider;
+    if ((detectedModel || session.active_model) && !session.model_at_last_audit) {
+      updates.model_at_last_audit = detectedModel || session.active_model;
+    }
+    return updates;
+  });
+  if (!persisted.saved) return persisted;
+  return {
+    ...persisted,
+    tokensUsed: persisted.session.context_tokens_used,
+    contextWindowTokens: persisted.session.context_window_tokens,
+    bracket: persisted.session.context_last_bracket,
+  };
+}

package/framework/hooks/team-quality-gate.js

@@ -13,8 +13,8 @@
  * Enforcement: BLOCK — writes to another member's artifact scope are rejected.
  */
 
-import { existsSync, readFileSync } from 'fs';
-import { join } from 'path';
+import { readHookSession } from './session-reader.js';
+import { isAbsolute, relative, resolve, sep } from 'path';
 
 // Artifact scope per agent — defines which output paths each agent owns
 const AGENT_ARTIFACT_SCOPES = {
@@ -82,23 +82,31 @@ async function main() {
   try {
     const event = JSON.parse(input);
     const projectDir = event.cwd || process.cwd();
+    const sessionRead = readHookSession(projectDir);
+    if (!sessionRead.loaded && !sessionRead.missing) {
+      process.stdout.write(JSON.stringify(denyOutput(
+        `[Session Security] Team-scoped writes are blocked because session.yaml could not be validated: ${sessionRead.error}`
+      )));
+      return;
+    }
 
     // The env var is the fast path, but it does not always propagate to a
     // parallel hook process. Fall back to the session file: if the env var is
     // absent AND no team is active in session.yaml, this is genuinely solo mode
     // and we allow. If a team IS active, we enforce isolation even without the
     // env var, otherwise cross-member overwrites slip through unblocked.
-    const teamActive = !!process.env.CHATI_TEAM_ID || hasActiveTeamInSession(projectDir);
+    const teamActive = !!process.env.CHATI_TEAM_ID || hasActiveTeam(sessionRead.session);
     if (!teamActive) {
       process.stdout.write(JSON.stringify(allowOutput()));
       return;
     }
 
     // Detect current agent from env or session
-    const currentAgent = process.env.CHATI_TEAM_MEMBER || detectAgentFromSession(projectDir);
+    const currentAgent = process.env.CHATI_TEAM_MEMBER || sessionRead.session?.current_agent || null;
     if (!currentAgent) {
-      // Cannot determine agent → allow (fail-open for safety)
-      process.stdout.write(JSON.stringify(allowOutput()));
+      process.stdout.write(JSON.stringify(denyOutput(
+        '[Team Quality Gate] Team execution is active but the current member identity is unavailable. Write blocked until CHATI_TEAM_MEMBER is propagated.'
+      )));
       return;
     }
 
@@ -109,8 +117,17 @@ async function main() {
       return;
     }
 
-    // Normalize path relative to project
-    const relativePath = filePath.replace(projectDir + '/', '').replace(projectDir, '');
+    // Normalize against the project root before matching ownership. Textual
+    // prefix replacement lets ../ traversal impersonate another member scope.
+    const absolutePath = isAbsolute(filePath) ? resolve(filePath) : resolve(projectDir, filePath);
+    const candidate = relative(resolve(projectDir), absolutePath);
+    if (candidate === '..' || candidate.startsWith(`..${sep}`) || isAbsolute(candidate)) {
+      process.stdout.write(JSON.stringify(denyOutput(
+        `[Team Quality Gate] ${currentAgent} cannot write outside the project root.`
+      )));
+      return;
+    }
+    const relativePath = candidate.split(sep).join('/');
 
     // Check shared paths first — always allowed
     if (SHARED_PATHS.some(sp => relativePath.startsWith(sp))) {
@@ -175,14 +192,6 @@ function denyOutput(reason) {
   };
 }
 
-function detectAgentFromSession(projectDir) {
-  const sessionPath = join(projectDir, '.chati', 'session.yaml');
-  if (!existsSync(sessionPath)) return null;
-  const raw = readFileSync(sessionPath, 'utf-8');
-  const match = raw.match(/current_agent:\s*(.+)/m);
-  return match ? match[1].trim().replace(/^["']|["']$/g, '') : null;
-}
-
 /**
  * Detect whether a team is active from session.yaml alone, for the case where
  * CHATI_TEAM_ID did not propagate to this hook process. An active team is an
@@ -190,15 +199,16 @@ function detectAgentFromSession(projectDir) {
  * completing. preview.status uses a different vocabulary (inactive/running/
  * approved/adjusting), so matching these specific values is team-specific.
  */
+function hasActiveTeam(session) {
+  return Array.isArray(session?.teams) && session.teams.some((team) =>
+    team?.team_id && ['active', 'forming', 'completing'].includes(team.status)
+  );
+}
+
 function hasActiveTeamInSession(projectDir) {
-  const sessionPath = join(projectDir, '.chati', 'session.yaml');
-  if (!existsSync(sessionPath)) return false;
-  try {
-    const raw = readFileSync(sessionPath, 'utf-8');
-    return /team_id:\s*\S/.test(raw) && /^\s*status:\s*(active|forming|completing)\b/m.test(raw);
-  } catch {
-    return false;
-  }
+  const result = readHookSession(projectDir);
+  if (!result.loaded) return !result.missing;
+  return hasActiveTeam(result.session);
 }
 
 // Only run main when executed directly (not imported by tests).