oh-my-copilot 5.6.2 → 5.7.0

package/scripts/lib/state-lock.mjs

@@ -156,33 +156,41 @@ function sameOwner(left, right) {
   return Boolean(left && right && left.pid === right.pid && left.processStart === right.processStart && left.nonce === right.nonce);
 }
 
+// BigInt ids: NTFS file IDs exceed 2^53 once the MFT sequence number reaches
+// 32, and a Number ino rounds distinct files onto the same value.
 function ownerArtifactIdentity(path) {
   try {
-    const stats = statSync(path);
+    const stats = statSync(path, { bigint: true });
     return stats.isFile() ? { dev: stats.dev, ino: stats.ino } : null;
   } catch {
     return null;
   }
 }
 
-/** Windows reports dev=0 from some stat paths (#4156); compare ino always, dev only when both are known. */
+/** Mirrors sameFileIdentity in src/lib/atomic-write.ts: ino always, dev unless win32 reports 0 (#4156). */
 function sameArtifactIdentity(a, b) {
   if (a.ino !== b.ino) return false;
-  if (process.platform === 'win32' && (a.dev === 0 || b.dev === 0)) return true;
+  if (process.platform === 'win32' && (a.dev === 0n || b.dev === 0n)) return true;
   return a.dev === b.dev;
 }
 
 /** Remove only the exact dead publication that was inspected. */
 function reclaimDeadOwner(path, observed, identity) {
-  // Fork fix: the liveness verdict can be seconds old (win32 probe), and the owner may have
-  // exited and been replaced meanwhile. Renaming a live replacement into quarantine lets a third
-  // contender publish before the restore, leaving two holders, so re-verify the exact artifact
-  // (owner record AND dev/ino, upstream #4149 checks only the latter) immediately before the rename.
-  const current = readOwner(path);
-  const currentIdentity = ownerArtifactIdentity(path);
-  if (current === 'absent' || !current || !sameOwner(current, observed) || !currentIdentity ||
-      !sameArtifactIdentity(currentIdentity, identity)) return 'changed';
   const quarantinePath = `${path}.reclaim.${process.pid}.${randomUUID()}`;
+  // The liveness verdict can be seconds old (the win32 probe spawns PowerShell),
+  // and the identity alone cannot tell a replacement apart when its inode reuses
+  // the old one (or when the identity was captured after the probe). Renaming a
+  // live replacement into quarantine opens a window in which a third contender
+  // publishes, leaving two holders. Re-verify the exact artifact, owner record
+  // AND file identity, immediately before the rename. Bracketing the read with
+  // two stats binds the record that was read to the identity that was checked.
+  const before = ownerArtifactIdentity(path);
+  const current = readOwner(path);
+  const after = ownerArtifactIdentity(path);
+  if (current === 'absent' || !current || !sameOwner(current, observed) ||
+      !before || !after || !sameArtifactIdentity(before, identity) || !sameArtifactIdentity(after, identity)) {
+    return 'changed';
+  }
   try {
     renameSync(path, quarantinePath);
   } catch (error) {
@@ -194,7 +202,8 @@ function reclaimDeadOwner(path, observed, identity) {
   try {
     moved = readOwner(quarantinePath);
     movedIdentity = ownerArtifactIdentity(quarantinePath);
-    if (moved !== 'absent' && moved && movedIdentity && sameArtifactIdentity(movedIdentity, identity) &&
+    if (moved !== 'absent' && moved && movedIdentity &&
+        sameArtifactIdentity(movedIdentity, identity) &&
         sameOwner(moved, observed)) {
       try {
         unlinkSync(quarantinePath);

package/scripts/run.cjs

@@ -271,8 +271,17 @@ function resolveTrustedSessionEndTarget(resolution, extraArgs) {
 }
 
 
+// oh-my-copilot fail-closed contract (fork-only): with OMC_HOOK_FAIL_CLOSED=1
+// a hook timeout exits 124 so the host records a failed hook. Unset keeps the
+// upstream fail-open exit 0.
+const HOOK_TIMEOUT_FAIL_CLOSED_STATUS = 124;
+function hookTimeoutStatus() {
+  return process.env.OMC_HOOK_FAIL_CLOSED === '1' ? HOOK_TIMEOUT_FAIL_CLOSED_STATUS : 0;
+}
+
 function writeTimeoutDiagnostic(targetPath, manifestHook, timeoutMs, sink) {
-  const message = `[run.cjs] Hook ${basename(targetPath)} timed out after ${timeoutMs}ms; exiting fail-open.\n`;
+  const outcome = hookTimeoutStatus() === 0 ? 'fail-open' : `fail-closed (${HOOK_TIMEOUT_FAIL_CLOSED_STATUS})`;
+  const message = `[run.cjs] Hook ${basename(targetPath)} timed out after ${timeoutMs}ms; exiting ${outcome}.\n`;
   if (manifestHook?.event !== 'UserPromptSubmit' || isDebugHooksEnabled()) {
     if (sink) return sink.write(process.stderr, Buffer.from(message));
     try { process.stderr.write(message); } catch { /* protocol dest may already be closed */ }
@@ -842,7 +851,7 @@ function runGenericChild(targetPath, extraArgs, timeoutMs, manifestHook, options
         if (require.main === module) {
           sink.closeDestinations();
         }
-        finish(0);
+        finish(hookTimeoutStatus()); // fork: fail-closed contract, see hookTimeoutStatus
       });
     }, timeoutMs);
 
@@ -996,7 +1005,8 @@ async function runWorker(targetPath, manifestHook, timeoutMs) {
         }
         await writeTimeoutDiagnostic(targetPath, manifestHook, timeoutMs, sink);
         sink.uninstall();
-        resolve(0);
+        // Also the SessionEnd foreground-budget path. Fork: fail-closed contract, see hookTimeoutStatus.
+        resolve(hookTimeoutStatus());
       }, timeoutMs);
 
       try {

package/scripts/wiki-session-end.mjs

@@ -15,7 +15,8 @@ export async function runWikiSessionEndHook() {
   }
 
   try {
-    const { processWikiSessionEnd } = await import('../dist/hooks/session-end/index.js');
+    // Lean entry (not index.js): the full SessionEnd graph costs ~100ms of the 300ms budget.
+    const { processWikiSessionEnd } = await import('../dist/hooks/session-end/wiki-foreground-bootstrap.js');
     const result = await processWikiSessionEnd(frame.value);
     console.log(JSON.stringify(result));
   } catch (error) {

package/templates/hooks/lib/atomic-write.mjs

@@ -137,9 +137,11 @@ function readEmergencyJournal(path) {
   } catch { return null; }
 }
 
+// BigInt ids: NTFS file IDs exceed 2^53 once the MFT sequence number reaches
+// 32, and a Number ino rounds distinct files onto the same value.
 function fileIdentity(path) {
   try {
-    const stat = statSync(path);
+    const stat = statSync(path, { bigint: true });
     return { dev: stat.dev, ino: stat.ino };
   } catch { return null; }
 }
@@ -157,7 +159,7 @@ function sameFileIdentity(a, b) {
   // On Windows, lstat returns dev=0, so skip dev comparison when on Windows
   // unless both are non-zero (indicating a real comparison is possible)
   const isWindows = process.platform === 'win32';
-  if (isWindows && (a.dev === 0 || b.dev === 0)) {
+  if (isWindows && (a.dev === 0n || b.dev === 0n)) {
     return true; // Skip dev comparison on Windows when either is 0
   }