session-orchestrator 3.23.0 → 4.0.0

package/hooks/post-bash-write-verify.mjs

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
 /**
  * post-bash-write-verify.mjs — PostToolUse hook (matcher `Bash`): report
- * working-tree changes a Bash call made OUTSIDE the wave's `allowedPaths`.
+ * working-tree changes a Bash call made OUTSIDE the wave's `allowedPaths` —
+ * except a path a PEER session declared through a `peer-session-*` record in
+ * the wave's aggregate scope sidecar (#1195), which is named as a peer write.
  *
  * ## Why this hook exists (#915, follow-up to #906 / #800)
  *
@@ -160,7 +162,14 @@ import { findScopeFile, pathMatchesPattern } from '../scripts/lib/hardening.mjs'
 // tests/hooks/post-bash-write-verify.test.mjs, which imports the named export —
 // is unchanged. Two byte-identical copies of a clock is exactly the one-fact-two-
 // copies class this repo keeps paying for.
-import { sessionAgeMs } from '../scripts/lib/scope-gate.mjs';
+import { sessionAgeMs, PEER_RECORD_PREFIX, isPeerRecordId } from '../scripts/lib/scope-gate.mjs';
+// #1153 P1 — the same process-local ownership check hooks/enforce-scope.mjs
+// applies at Gate 3b. This hook reads the SAME working-copy `wave-scope.json`,
+// so without it a peer session's manifest drives this session's advisories.
+import {
+  readProcessLocalSessionIds,
+  classifyManifestSession,
+} from '../scripts/lib/session-identity/own-session.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -322,6 +331,90 @@ export function isInScope(relPath, allowedPaths) {
   return allowedPaths.some((p) => typeof p === 'string' && pathMatchesPattern(relPath, p));
 }
 
+/**
+ * Re-exported for readers of this hook: the prefix that marks an
+ * aggregate-sidecar record as a PEER SESSION's declared scope rather than one
+ * of this wave's own agents (#1195). The DEFINITION lives in
+ * `scripts/lib/scope-gate.mjs`, next to `unionFileScopes`, which must exclude
+ * exactly these records from `allowedPaths` for the peer branch below to be
+ * reachable at all.
+ */
+export { PEER_RECORD_PREFIX };
+
+/**
+ * The peer-session records of a wave's aggregate scope sidecar.
+ *
+ * Shape, as written by `scripts/materialize-wave-scope.mjs`
+ * (`<state-dir>/filescopes/wave-<N>.scopes.json`): ONE JSON array of
+ * `{ id, files }` records — the per-agent files under
+ * `<state-dir>/filescopes/wave-<N>/<id>.json` are path STRINGS and are a
+ * different artefact (see `docs/scope-collision-guard.md` § 2.2). Only records
+ * whose `id` starts with `peer-session-` are returned: those are paths a peer
+ * session announced and this session's coordinator carried into the manifest
+ * union (`skills/wave-executor/wave-loop.md` § Scope Manifest).
+ *
+ * Absent, unreadable or malformed sidecar ⇒ `[]`, which restores the exact
+ * pre-#1195 behaviour. Never throws.
+ *
+ * @param {string} stateDir absolute path of the harness state dir (the
+ *   directory holding `wave-scope.json`)
+ * @param {unknown} wave the manifest's `wave` field
+ * @returns {Array<{ id: string, files: string[] }>}
+ */
+export function readPeerScopeRecords(stateDir, wave) {
+  if (typeof stateDir !== 'string' || stateDir === '') return [];
+  if (typeof wave !== 'number' || !Number.isInteger(wave) || wave <= 0) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(
+      readFileSync(path.join(stateDir, 'filescopes', `wave-${wave}.scopes.json`), 'utf8'),
+    );
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed)) return [];
+  return parsed
+    .filter(
+      (r) => r && typeof r === 'object'
+        && isPeerRecordId(r.id)
+        && Array.isArray(r.files),
+    )
+    .map((r) => ({ id: r.id, files: r.files.filter((f) => typeof f === 'string') }));
+}
+
+/**
+ * Which peer record — if any — declared this path?
+ *
+ * Same matcher as `isInScope`, so a peer's declaration is read exactly the way
+ * the wave's own `allowedPaths` are.
+ *
+ * @param {string} relPath
+ * @param {Array<{ id: string, files: string[] }>} peerRecords
+ * @returns {string|null} the peer record id, or null
+ */
+export function peerRecordFor(relPath, peerRecords) {
+  if (!Array.isArray(peerRecords)) return null;
+  for (const record of peerRecords) {
+    if (record.files.some((p) => pathMatchesPattern(relPath, p))) return record.id;
+  }
+  return null;
+}
+
+/**
+ * Render the peer-write notice (#1195) — deliberately a NOTICE and not part of
+ * the violation report: a peer record is EXCLUDED from the union that computes
+ * `allowedPaths` (`unionFileScopes`, `scripts/lib/scope-gate.mjs`), so a peer
+ * path is outside `allowedPaths` and reaches this branch; naming it as a
+ * violation would re-file an agreed peer write as an alarm.
+ *
+ * @param {string} relPath
+ * @param {string} peerId the `peer-session-<id>` record id
+ * @returns {string}
+ */
+export function formatPeerWriteNotice(relPath, peerId) {
+  return `bash-write-verify: ${relPath} inside ${peerId} scope — peer write, not a violation`;
+}
+
 /**
  * Stable signature of the wave's scope. A change means a new wave, which must
  * re-baseline silently rather than blame the next Bash call for the previous
@@ -768,6 +861,17 @@ async function main() {
   }
   if (raw === null) return; // file vanished between findScopeFile and read
 
+  // The control-file identity of THIS call, computed BEFORE the G3b
+  // stand-down (W4/F7). Ordering is the whole fix: G3b used to `return` above
+  // this, so a peer or agent that REBOUND `wave-scope.json` to a fabricated
+  // `session_id` with one `cat >` redirect disarmed this session's gates AND
+  // suppressed the #938 control-file notice at the same time. Deleting the file
+  // was reported (G3 above); rebinding it was not — the louder half of the
+  // tamper trail was the one behind the gate the tamper opens.
+  //
+  // Nothing but the hash/enforcement snapshot is derived here: no path
+  // evaluation, no allowedPaths read, no report — those still wait for the
+  // classification below to judge the manifest ours.
   const relScopePath = path.relative(repoRoot, scopePath) || scopePath;
   const currentScopeState = {
     hash: createHash('sha1').update(raw).digest('hex').slice(0, 16),
@@ -777,6 +881,73 @@ async function main() {
     gateOn: scope ? scope?.gates?.['bash-write-verify'] !== false : true,
   };
 
+  // G3b (#1153 P1) — is this manifest even MINE?
+  //
+  // `wave-scope.json` is a WORKING-COPY artefact; two live sessions in one
+  // checkout read the same bytes. Everything below this point — the path
+  // report, the control-file notice, the snapshot — describes THIS session's
+  // relationship to a wave plan. When the manifest provably names another
+  // session, none of it is about us, and the advisories were a peer's
+  // `allowedPaths` scolding an unrelated session (#1082 / #1123).
+  //
+  // Deliberately AFTER the parse: an unparseable manifest leaves `scope === null`,
+  // which classifies as `'unknown'` and keeps every pre-#1153 behaviour —
+  // including the #938 tamper notices, which must never be reachable via a
+  // manifest a Bash call just corrupted. `'own'` and `'unknown'` (legacy,
+  // unbound, or no resolvable own identity) fall through unchanged.
+  //
+  // CEILING (BV-004): on a harness that supplies no session id at all (Codex
+  // CLI, Cursor today) the own-id set is empty, so this gate is permanently
+  // `'unknown'` = full pre-#1153 behaviour there.
+  {
+    const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
+    const { verdict, manifestIds } = classifyManifestSession(scope ?? {}, ownIds);
+    if (verdict === 'foreign') {
+      // Observability only — one event per stand-down decision, awaited so the
+      // append cannot be lost to the process exiting.
+      try {
+        const { emitEvent } = await import('../scripts/lib/events.mjs');
+        await emitEvent(
+          'orchestrator.scope.foreign_session_ignored',
+          {
+            hook: 'post-bash-write-verify',
+            manifest: scopePath,
+            manifest_session: manifestIds,
+            own_session: [...ownIds],
+            wave: scope?.wave,
+          },
+          { repoRoot },
+        );
+      } catch { /* observability is best-effort — never blocks the decision */ }
+
+      // The stand-down itself is a control-file event when the binding CHANGED
+      // since the last call: the manifest this session was baselined against is
+      // now bound to someone else, which switches every scope gate off. Reported
+      // on the visible channel exactly once — the snapshot below records the new
+      // hash, so a stable foreign manifest (an ordinary peer wave) is silent from
+      // the next call on, and a rebind back to us reports again.
+      if (prevScopeState
+        && prevScopeState.hash !== 'absent'
+        && prevScopeState.hash !== currentScopeState.hash) {
+        writeSnapshot(snapFile, { ...carriedRecord, scopeState: currentScopeState });
+        emitMessages([
+          `bash-write-verify: control file ${relScopePath} changed its SESSION BINDING `
+          + `since the last Bash call (now names ${manifestIds.join(', ') || 'an unnamed session'}) — `
+          + 'this session\'s scope gates are standing down. '
+          + 'Scope-control changes are never exempt from reporting (#938).',
+        ], true);
+      }
+      return;
+    }
+  }
+
+  // ADVERSARIAL CEILING: `wave-scope.json` is a file ANY process in this working
+  // copy can write, so writing a foreign id into it is a per-file kill switch for
+  // this session's own gate. Accepted because "no manifest" already means allow
+  // (G3), so a foreign manifest grants nothing an `rm` would not — but the change
+  // MUST stay visible: see post-bash-write-verify's control-file notice (#938),
+  // which is the only thing that distinguishes this from a legitimate peer wave.
+
   let scopeMtimeMs = null;
   try {
     scopeMtimeMs = statSync(scopePath).mtimeMs;
@@ -915,8 +1086,22 @@ async function main() {
   // first run is named, not silently trusted. Computed before the G4/G5 gate
   // above so the gate cannot swallow it.
   if (missingSnapshotNotice) messages.push(missingSnapshotNotice);
-  if (report.length > 0) {
-    messages.push(formatMessage(report, allowedPaths.length));
+  // #1195 — a path a PEER session declared (a `peer-session-*` record in this
+  // wave's aggregate sidecar) is outside `allowedPaths` because `--union`
+  // EXCLUDES peer records when computing it (`unionFileScopes`,
+  // `scripts/lib/scope-gate.mjs`) — that exclusion is what keeps this branch
+  // reachable. Such a write is agreed, not a bypass. Split it out of the violation report and
+  // name it, so the peer's file is countable without being an alarm. Sidecar
+  // absent ⇒ `peerRecords` is empty ⇒ every path stays a violation, unchanged.
+  const peerRecords = readPeerScopeRecords(path.dirname(scopePath), scope.wave);
+  const violations = [];
+  for (const relPath of report) {
+    const peerId = peerRecordFor(relPath, peerRecords);
+    if (peerId) messages.push(formatPeerWriteNotice(relPath, peerId));
+    else violations.push(relPath);
+  }
+  if (violations.length > 0) {
+    messages.push(formatMessage(violations, allowedPaths.length));
     warn = true;
   }
   if (messages.length === 0) return; // silence is the common case (0.91 % fire rate)

package/hooks/post-edit-import-probe.mjs

@@ -0,0 +1,344 @@
+#!/usr/bin/env node
+/**
+ * post-edit-import-probe.mjs — PostToolUse hook that catches a BROKEN
+ * hook-reachable module the moment it is saved (GitLab #1224).
+ *
+ * Incident 2026-09-04: `scripts/lib/session-identity/own-session.mjs` was saved
+ * with a call to a function that was written two edits later. Three hook entry
+ * files import that module on every tool call, so every Bash/Edit/Write call
+ * across the host — including two foreign sessions — got "Internal hook error —
+ * request blocked" for ~8 minutes. The defect was invisible to `node --check`
+ * (syntactically valid) and to a plain `await import()` (module-level
+ * evaluation succeeds; the ReferenceError is raised only when the exported
+ * function is CALLED). ESLint `no-undef` catches it — that is the primary check
+ * here; the import probe is the secondary net for load-time throws.
+ *
+ * Decision flow (each gate exits 0 silently):
+ *   G1  profile gate — shouldRunHook('post-edit-import-probe')
+ *   G2  stdin JSON (null-safe)
+ *   G3  tool_name ∈ {Edit, Write, MultiEdit}
+ *   G4  tool_input.file_path present
+ *   G5  extension ∈ {.mjs, .js, .cjs}
+ *   G6  membership in hooks/_lib/hook-import-set.json (the committed
+ *       hook-reachable allowlist) — anything else is not this probe's business
+ *   C1  PRIMARY: ESLint on the single file; only `no-undef` and fatal/parse
+ *       errors count as a failure (other rules belong to `npm run lint`)
+ *   C2  SECONDARY (scripts/lib/** only — NEVER hooks/*.mjs, half of which run
+ *       main() at module bottom): `await import(file)` in a child process
+ *
+ * The PRIMARY check needs an ESLint install in EITHER the project's own
+ * `node_modules` (tried first — an npm-installed consumer repo has no plugin
+ * devDeps) or the plugin root's; with neither, C1 degrades to a silent no-op
+ * and only C2 remains. `SO_IMPORT_PROBE_ESLINT` overrides that resolution.
+ *
+ * Output on failure: an `additionalContext` roll-up + a `systemMessage`.
+ * Exit codes: 0 ALWAYS — a probe for hook breakage must never become one
+ * (the probe's own internal faults go to stderr, never to the tool call).
+ */
+
+import { shouldRunHook } from './_lib/profile-gate.mjs';
+// Exit 0 immediately when disabled via SO_HOOK_PROFILE / SO_DISABLED_HOOKS.
+if (!shouldRunHook('post-edit-import-probe')) process.exit(0);
+
+import path from 'node:path';
+import { readFileSync, existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { performance } from 'node:perf_hooks';
+
+import { getProjectDir } from '../scripts/lib/platform.mjs';
+
+/** Tool names whose payload carries an edited file path. */
+const EDIT_TOOLS = new Set(['Edit', 'Write', 'MultiEdit']);
+
+/** Extensions this probe can reason about (Node ESM/CJS modules). */
+const MODULE_EXTS = new Set(['.mjs', '.js', '.cjs']);
+
+/**
+ * Total wall-clock budget for BOTH checks. The hooks.json ceiling is 5 s; the
+ * measured ESLint single-file run is 0.3–0.5 s, so 3 s leaves headroom for a
+ * cold start without ever approaching the harness timeout.
+ */
+const BUDGET_MS = 3_000;
+
+/** The plugin's own root (…/hooks/.. ), used to locate a vendored ESLint. */
+const PLUGIN_ROOT = path.resolve(import.meta.dirname, '..');
+
+/**
+ * Read stdin to EOF (best-effort). Returns parsed JSON or null on any failure.
+ *
+ * @returns {Promise<object|null>}
+ */
+function readStdinJson() {
+  return new Promise((resolve) => {
+    if (process.stdin.readableEnded || process.stdin.closed) { resolve(null); return; }
+    const chunks = [];
+    const timer = setTimeout(() => resolve(null), 5_000);
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (c) => chunks.push(c));
+    process.stdin.on('end', () => {
+      clearTimeout(timer);
+      const raw = chunks.join('').trim();
+      if (!raw) { resolve(null); return; }
+      try { resolve(JSON.parse(raw)); } catch { resolve(null); }
+    });
+    process.stdin.on('error', () => { clearTimeout(timer); resolve(null); });
+    process.stdin.resume();
+  });
+}
+
+/**
+ * Load the committed hook-reachable allowlist.
+ * Missing / unreadable / malformed → empty map (silent no-op, never a crash).
+ *
+ * @param {string} projectDir
+ * @returns {Map<string, string[]>} repo-relative path → hook entry basenames
+ */
+export function loadImportSet(projectDir) {
+  const file = path.join(projectDir, 'hooks', '_lib', 'hook-import-set.json');
+  try {
+    if (!existsSync(file)) return new Map();
+    const parsed = JSON.parse(readFileSync(file, 'utf8'));
+    const entries = Array.isArray(parsed?.entries) ? parsed.entries : [];
+    const map = new Map();
+    for (const e of entries) {
+      if (e && typeof e.file === 'string') {
+        map.set(e.file, Array.isArray(e.reachable_from) ? e.reachable_from : []);
+      }
+    }
+    return map;
+  } catch {
+    return new Map();
+  }
+}
+
+/**
+ * Repo-relative POSIX path, or null when the file lives outside the project.
+ *
+ * @param {string} projectDir
+ * @param {string} absFile
+ * @returns {string|null}
+ */
+export function toRepoRelative(projectDir, absFile) {
+  const rel = path.relative(projectDir, absFile);
+  if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) return null;
+  return rel.split(path.sep).join('/');
+}
+
+/**
+ * Locate an ESLint entry script. The PROJECT's own install is tried first —
+ * in an npm-installed consumer repo the plugin root has no devDependencies at
+ * all, so a plugin-root-only lookup makes the primary check a silent no-op
+ * there. Both the `.bin` shim and the package's own entry script are probed at
+ * each root (a pnpm/npm layout may publish either).
+ *
+ * `SO_IMPORT_PROBE_ESLINT` overrides the search: an explicit path is used as
+ * given, and an EMPTY value suppresses the check (test seam for the
+ * eslint-unavailable path).
+ *
+ * Returns null when nothing is found → the check is skipped silently: a
+ * consumer repo without ESLint installed is not a defect.
+ *
+ * @param {string} projectDir
+ * @returns {string|null}
+ */
+export function resolveEslintBin(projectDir) {
+  const override = process.env.SO_IMPORT_PROBE_ESLINT;
+  if (typeof override === 'string') {
+    if (!override) return null;
+    try { return existsSync(override) ? override : null; } catch { return null; }
+  }
+  const candidates = [];
+  for (const root of [projectDir, PLUGIN_ROOT]) {
+    candidates.push(path.join(root, 'node_modules', '.bin', 'eslint'));
+    candidates.push(path.join(root, 'node_modules', 'eslint', 'bin', 'eslint.js'));
+  }
+  for (const c of candidates) {
+    try { if (existsSync(c)) return c; } catch { /* unreadable → next candidate */ }
+  }
+  return null;
+}
+
+/**
+ * PRIMARY check — run ESLint on the single file and keep only the message
+ * classes that indicate a module which will THROW when a hook calls into it:
+ * `no-undef` (the 2026-09-04 incident shape) and any fatal/parse error.
+ *
+ * @param {string} projectDir
+ * @param {string} absFile
+ * @param {number} timeoutMs
+ * @returns {string|null} first offending message, or null when clean/skipped
+ */
+export function runEslintCheck(projectDir, absFile, timeoutMs) {
+  const bin = resolveEslintBin(projectDir);
+  if (!bin) {
+    // ESLint unavailable → skip, never guess. Traced so a consumer repo can
+    // tell "primary check found nothing" from "primary check never ran".
+    if (process.env.SO_IMPORT_PROBE_TRACE) process.stderr.write('probe:eslint-unavailable\n');
+    return null;
+  }
+
+  const res = spawnSync(
+    process.execPath,
+    [bin, '--no-warn-ignored', '--format', 'json', absFile],
+    { cwd: projectDir, encoding: 'utf8', timeout: timeoutMs },
+  );
+  // A crashed/timed-out ESLint produces no parseable report — skip rather than
+  // invent a finding. Same for a repo whose flat config cannot be resolved.
+  let report;
+  try { report = JSON.parse(res.stdout ?? ''); } catch { return null; }
+  if (!Array.isArray(report)) return null;
+
+  for (const fileResult of report) {
+    for (const m of fileResult?.messages ?? []) {
+      const isFatal = m.fatal === true;
+      const isUndef = m.ruleId === 'no-undef';
+      if (isFatal || isUndef) {
+        return `L${m.line ?? '?'} ${m.ruleId ?? 'parse-error'}: ${m.message}`;
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * SECONDARY check — actually import the module in a child process to catch a
+ * load-time throw. Restricted to `scripts/lib/**`: roughly half the
+ * `hooks/*.mjs` entry files call `main()` at module bottom, so importing one
+ * would EXECUTE it.
+ *
+ * @param {string} absFile
+ * @param {number} timeoutMs
+ * @returns {string|null} first error line, or null when clean
+ */
+export function runImportCheck(absFile, timeoutMs) {
+  const res = spawnSync(
+    process.execPath,
+    [
+      '--input-type=module',
+      '-e',
+      "const { pathToFileURL } = await import('node:url');"
+      + ' await import(pathToFileURL(process.env.SO_IMPORT_PROBE_TARGET).href);',
+    ],
+    {
+      encoding: 'utf8',
+      timeout: timeoutMs,
+      // NO positional argument: a target passed as argv[1] satisfies the
+      // `import.meta.url === file://${process.argv[1]}` main-guard that many
+      // modules carry, so the probe would EXECUTE their CLI main() (measured:
+      // scripts/lib/sunset/walker.mjs walks the repo for ~3.9 s and is then
+      // SIGTERMed at the budget). The path travels in the environment instead.
+      // The env is minimal and deliberately drops NODE_OPTIONS — an inherited
+      // --require/--import would run foreign code inside the probe.
+      env: {
+        PATH: process.env.PATH ?? '',
+        HOME: process.env.HOME ?? '',
+        SO_HOOK_PROFILE: 'off',
+        SO_IMPORT_PROBE_TARGET: absFile,
+      },
+    },
+  );
+  if (res.status === 0) return null;
+  // A timeout (killed child, status null) is not evidence of breakage.
+  if (res.status === null) return null;
+  // Node echoes the offending SOURCE line before the diagnostic, and that echo
+  // also contains the word "Error" — anchor on the diagnostic shape
+  // ("ReferenceError: x is not defined") so the report names the fault, not the
+  // source text that triggered it.
+  const lines = String(res.stderr ?? '').split('\n').map((s) => s.trim()).filter(Boolean);
+  const diagnostic = lines.find((s) => /^[A-Za-z]*Error(:|\b)/.test(s));
+  return diagnostic || lines.find((s) => /Error/.test(s)) || `import failed with exit ${res.status}`;
+}
+
+/**
+ * Build the operator-facing warning. It names the blast radius explicitly —
+ * the whole point of the probe is that a broken module here is not a local
+ * defect.
+ *
+ * @param {string} relPath
+ * @param {string} error
+ * @param {string[]} reachableFrom
+ * @returns {string}
+ */
+export function buildWarning(relPath, error, reachableFrom) {
+  const hooks = reachableFrom.length > 0 ? reachableFrom.join(', ') : '(unknown)';
+  return (
+    `⚠ import-probe: ${relPath} — ${error}. ` +
+    `This module is reached by hooks ${hooks} — every Edit/Write/Bash call may now be ` +
+    `blocked host-wide. Fix before continuing.`
+  );
+}
+
+// ---------------------------------------------------------------------------
+// main
+// ---------------------------------------------------------------------------
+
+async function main() {
+  const started = performance.now();
+  const input = await readStdinJson();
+  if (!input) return;                                                    // G2
+
+  const toolName = typeof input.tool_name === 'string' ? input.tool_name : null;
+  if (!toolName || !EDIT_TOOLS.has(toolName)) return;                    // G3
+
+  const toolInput = input.tool_input;
+  const filePath = toolInput && typeof toolInput.file_path === 'string'
+    ? toolInput.file_path : null;
+  if (!filePath) return;                                                 // G4
+
+  if (!MODULE_EXTS.has(path.extname(filePath).toLowerCase())) return;    // G5
+
+  const projectDir = getProjectDir();
+  const absFile = path.resolve(projectDir, filePath);
+  const rel = toRepoRelative(projectDir, absFile);
+  if (!rel) return;
+
+  const importSet = loadImportSet(projectDir);
+  if (!importSet.has(rel)) return;                                       // G6
+  const reachableFrom = importSet.get(rel) ?? [];
+
+  // Trace hook for tests: proves the gates above short-circuit BEFORE any spawn.
+  if (process.env.SO_IMPORT_PROBE_TRACE) process.stderr.write('probe:checks-start\n');
+
+  let error = runEslintCheck(projectDir, absFile, BUDGET_MS);            // C1
+  let check = 'eslint';
+
+  if (!error && rel.startsWith('scripts/lib/')) {                        // C2
+    // spawnSync rejects a fractional timeout (RangeError) — round it.
+    const remaining = Math.max(250, Math.round(BUDGET_MS - (performance.now() - started)));
+    error = runImportCheck(absFile, remaining);
+    if (error) check = 'import';
+  }
+
+  if (!error) return;
+
+  const durationMs = Math.round(performance.now() - started);
+  try {
+    const { emitEvent } = await import('../scripts/lib/events.mjs');
+    await emitEvent('orchestrator.hook.import_probe_failed', {
+      file: rel,
+      check,
+      error,
+      reachable_from: reachableFrom,
+      duration_ms: durationMs,
+    });
+  } catch { /* best-effort telemetry — never blocks the hook */ }
+
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PostToolUse',
+      additionalContext: buildWarning(rel, error, reachableFrom),
+    },
+    systemMessage: `⚠ import-probe FAILED: ${rel}`,
+  }));
+}
+
+// Exit 0 always — a hook that guards against hook breakage must never block.
+// The catch stays silent towards the TOOL CALL but not towards the operator:
+// a probe whose own breakage is invisible is a probe nobody can trust.
+main()
+  .catch((err) => {
+    try {
+      process.stderr.write(`post-edit-import-probe: ${err?.message ?? String(err)}\n`);
+    } catch { /* stderr gone — nothing left to report to */ }
+  })
+  .finally(() => process.exit(0));