Kjell Tore Guttormsen
d2b6a696bd
An unreadable ledger returned 0 from countTurns in BOTH the primitive and the hook, so a run whose ledger existed but could not be read (EISDIR, EACCES, EIO) was handed the full budget again on every call - unbounded. research-loop-cap.mjs argues against exactly that three lines above the code that did it, and its missing-DIRECTORY case already failed closed. The unreadable-FILE case now agrees with it. Only ENOENT still counts as zero turns spent: that is the legitimate first-turn state, and the reason this cannot just throw on any read failure. The hook no longer carries its own countTurns. It imports the primitive's exported readLedger(), the same way it already resolves the data root through resolveDataRoot() - a reader and a writer with private copies of the counting rule is how a hook ends up enforcing a different bound than the gate it backs. In scope + cannot count now exits 2 with a message that says counting failed, not that the budget is spent. Fail-closed stays scoped to the loop: a test pins that an unreadable ledger in an OUT-of-scope session still exits 0, because a PreToolUse hook that over-blocks bricks every session on the box. Also dropped the existsSync pre-check before the read - readFileSync's own ENOENT carries the same information without a second syscall that can disagree with the read that follows it. Review finding 5e1c6230f48ead38fa77cd8f4b06bfdc2b5b7bbf (MINOR). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LuGhWAbWyRFBFeemfhxoVv
9.5 MiB
9.5 MiB