From ad6ccd2beb5578bd63b90c46ae5ed2d317c16cc6 Mon Sep 17 00:00:00 2001
From: KeiSei84 <2206745@gmail.com>
Date: Tue, 26 May 2026 18:52:25 +0800
Subject: [PATCH] fix(install,hooks): policy-chain.toml install + stale
 .task-*.start cleanup

Two root-cause fixes:

1) hooks/_lib/policy-chain.toml was authored in v0.40 but the install loop
   in install/lib-hooks.sh globbed only *.sh, missing the TOML SSoT. Fresh
   installs got safe_tools fall-through ('no policy-chain.toml; passing
   through') because the file never landed. Extended the glob to include
   *.toml; chmod +x stays sh-only.

2) hooks/agent-event-done.sh now removes the .task-<id>.start marker that
   task-timer.sh wrote on agent_spawn. Without it completed sub-agents
   left stale markers in ~/.claude/memory/time-metrics/ for up to 2h
   (the pet's stale filter) inflating the running-agents counter.

Verified end-to-end with HOME=/tmp/ksk-verify fresh install:
  - 38 agents on disk
  - 54 hooks + 4 _lib files (including policy-chain.toml)
  - all 7 kei-mcp-wire-*.sh scripts present
  - bin/kei has pick / run-via / mcp-wire arms
  - 'kei mcp-wire --list' detects all 5 CLIs with correct tiers
  - settings.json carries ONLY safety pack (Phase 2 opt-in honored)
---
 install/lib-hooks.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/install/lib-hooks.sh b/install/lib-hooks.sh
index 8f6bcb2..e9dc4ff 100644
--- a/install/lib-hooks.sh
+++ b/install/lib-hooks.sh
@@ -27,14 +27,16 @@ install_hooks() {
   say "  installed $hook_count hook(s)"
 
   # v0.17 — shared hook library (gate.sh + test-gate.sh)
+  # v0.40 — also copy *.toml files from _lib/ (policy-chain.toml for safe_tools).
   if [ -d "$KIT_DIR/hooks/_lib" ]; then
     mkdir -p "$HOOKS_DIR/_lib"
     local lib_count=0 lib_src lib_name
-    for lib_src in "$KIT_DIR/hooks/_lib/"*.sh; do
+    for lib_src in "$KIT_DIR/hooks/_lib/"*.sh "$KIT_DIR/hooks/_lib/"*.toml; do
       [ -f "$lib_src" ] || continue
       lib_name="$(basename "$lib_src")"
       cp -f "$lib_src" "$HOOKS_DIR/_lib/$lib_name"
-      chmod +x "$HOOKS_DIR/_lib/$lib_name"
+      # chmod +x only for shell scripts; .toml stays read-only.
+      case "$lib_name" in *.sh) chmod +x "$HOOKS_DIR/_lib/$lib_name" ;; esac
       lib_count=$((lib_count+1))
     done
     say "  installed $lib_count hook library file(s) -> $HOOKS_DIR/_lib/"