@haposoft/cafekit 0.14.0 → 0.14.2

package/src/claude/agents/debugger.md

@@ -2,6 +2,7 @@
 name: debugger
 description: "Investigates bugs, incidents, CI/log/DB/performance/frontend failures, traces exact root causes with evidence, and hands off a verification-ready fix plan. Edits code only when explicitly requested by a fix workflow."
 model: sonnet
+memory: user
 tools: Glob, Grep, Read, Bash, WebFetch, WebSearch
 ---
 

package/src/claude/agents/god-developer.md

@@ -1,6 +1,6 @@
 ---
 name: god-developer
-description: "Primary code execution agent. Receives specifications (spec) from hapo:specs or task files and transforms them into production-grade source code. Operates on a Single-Track principle (linear, non-parallel)."
+description: "Primary code execution agent. Receives specifications (spec) from hapo:specs or task files and transforms them into production-grade source code. Operates on a Single-Track principle within its workspace (linear inside one working tree; multiple instances may run concurrently in separate isolated worktrees)."
 model: sonnet
 tools: Glob, Grep, Read, Edit, Write, NotebookEdit, Bash, WebFetch, WebSearch
 ---
@@ -94,3 +94,12 @@ Upon completion, output a concise report in this format:
 - Do not add AI attribution to code or commit messages.
 - Prioritize security (validate input, never hardcode secrets).
 - Code should be self-documenting — only add comments for complex logic.
+
+## Worktree Conduct (Parallel Wave dispatch)
+
+When dispatched into an isolated git worktree by `hapo:develop --parallel`:
+
+- Work ONLY inside this worktree; Single-Track discipline applies unchanged within it.
+- Do NOT edit `spec.json` or any `tasks/*.md` — the orchestrator is the single writer of spec state.
+- Do NOT touch files outside this task's `Related Files`.
+- Commit your completed work: `git commit -m "task(<id>): <title>"` — an uncommitted worktree cannot be merged back.

package/src/claude/agents/inspector.md

@@ -3,6 +3,7 @@ name: inspector
 tools: Glob, Grep, Read, Bash
 description: "Codebase structure scanner. Use this agent when you need to quickly scout/inspect the codebase architecture, files, and directories. Specializes in finding relevant files for a given work scope before implementation begins."
 model: haiku
+memory: user
 ---
 
 # Inspect — Codebase Scout

package/src/claude/agents/spec-maker.md

@@ -127,7 +127,7 @@ Before writing `design.md`, select a discovery mode and record the reason:
 - When requirement coverage format: list numeric IDs only, no descriptive suffixes
 - Apply `(P)` parallel markers when applicable (load `.claude/skills/specs/rules/tasks-parallel-analysis.md`)
 - Every task MUST use the compact implementation-ready shape: `Context`, `Steps`, `Requirements`, `Related Files`, `Completion Criteria`, `Evidence`, `Risk Assessment`.
-- `Evidence` MUST include exact commands, artifacts/runtime surfaces, runtime reachability proof, and negative-path checks. Existing specs may use `Task Test Plan & Verification Evidence` or legacy `Verification & Evidence`.
+- `## Evidence` (legacy heading aliases still parse) MUST include exact commands, artifacts/runtime surfaces, runtime reachability proof, and negative-path checks.
 - Completion criteria MUST be objective enough that a downstream quality gate can prove them without guesswork.
 - UI/app/runtime workflows MUST include a final integration/reachability task or final integration section that names the real entrypoint and proves all scoped user-facing surfaces are wired.
 - Do not allow orphan task outputs: components, services, hooks, routes, commands, workers, providers, reducers, data loaders, and generated artifacts must be reachable now or assigned to a named later integration task.

package/src/claude/agents/test-runner.md

@@ -11,7 +11,7 @@ You are a battle-hardened QA engineer who has been burned by production incident
 
 ## Task-Aware Inputs
 
-If the prompt includes task file paths, Completion Criteria, Evidence, Task Test Plan & Verification Evidence, or legacy Verification & Evidence instructions, treat them as authoritative.
+If the prompt includes task file paths, Completion Criteria, or `## Evidence` (legacy heading aliases still parse) instructions, treat them as authoritative.
 Diff-aware test selection does NOT replace task-specific verification.
 If the task/spec names a specific framework, auth system, transport, or shared-state boundary, keep that contract visible while evaluating evidence.
 If the prompt includes a feature name or `specs/<feature>`, load `spec.json`, `requirements.md`, `design.md`, and the active/recent task files. Treat `scope_lock`, Completion Criteria, and Evidence as the test contract.
@@ -30,7 +30,7 @@ Select tests by the task's touched surface:
 ## Command Resolution Order
 
 When the task file names exact commands, use this order:
-1. Run every exact executable command from `Evidence` (or `Task Test Plan & Verification Evidence` / legacy `Verification & Evidence`) in declaration order.
+1. Run every exact executable command from `## Evidence` (legacy heading aliases still parse) in declaration order.
 2. Run repo-default typecheck/test/build commands only to fill gaps not already covered above.
 3. Apply diff-aware test selection only after task-mandated commands are satisfied.
 

package/src/claude/gitignore

@@ -1,19 +1,26 @@
-# Environment and Sandbox credentials within .claude
+# CafeKit local runtime (.claude/ or .opencode/)
+# Also ignored at project root by the installer. This file protects
+# force-adds (`git add -f`) and partial un-ignores of the runtime folder.
+
+# Secrets and local credentials
 .env
 .env.*
 !.env.example
 
-# Virtual environments for python scripts (skills)
+# Skill dependency installs (Python venv + npm)
 skills/.venv/
+skills/**/.venv/
+skills/**/node_modules/
 .venv/
 venv/
-skills/**/node_modules/
 __pycache__/
+**/__pycache__/
 *.pyc
 
-# System generated state, caches, and logs
+# Generated session state, caches, and logs
 session-state/
 hooks/.logs/
+plugins/.logs/
 agent-memory/
 settings.bak.json
 .mcp.json

package/src/claude/hooks/__tests__/privacy-block.test.js

@@ -1,8 +1,7 @@
 'use strict';
 
 // Behavioral tests for privacy-block.cjs. The hook is run as a real subprocess:
-// a PreToolUse payload is piped to stdin and the exit code is asserted
-// (0 = allow, 2 = block). Covers the symlink-bypass hardening.
+// a PreToolUse payload is piped to stdin and native permission output asserted.
 
 const { test } = require('node:test');
 const assert = require('node:assert');
@@ -13,40 +12,47 @@ const path = require('node:path');
 
 const HOOK = path.join(__dirname, '..', 'privacy-block.cjs');
 
-/** Run the hook with a tool payload; return { code, stderr }. */
+/** Run the hook with a tool payload; return process output. */
 function runHook(payload, cwd) {
   const res = spawnSync(process.execPath, [HOOK], {
     input: JSON.stringify({ ...payload, cwd: cwd || payload.cwd }),
     encoding: 'utf8',
   });
-  return { code: res.status, stderr: res.stderr || '' };
+  return { code: res.status, stdout: res.stdout || '', stderr: res.stderr || '' };
 }
 
 function tmpDir() {
   return fs.mkdtempSync(path.join(os.tmpdir(), 'ck-privacy-'));
 }
 
-test('blocks a direct Read of .env (exit 2)', () => {
+function permissionDecision(stdout) {
+  if (!stdout.trim()) return null;
+  return JSON.parse(stdout).hookSpecificOutput?.permissionDecision || null;
+}
+
+test('asks natively for a direct Read of .env', () => {
   const dir = tmpDir();
   try {
     const env = path.join(dir, '.env');
     fs.writeFileSync(env, 'SECRET=1');
-    const { code } = runHook({ tool_name: 'Read', tool_input: { file_path: env } }, dir);
-    assert.strictEqual(code, 2);
+    const { code, stdout } = runHook({ tool_name: 'Read', tool_input: { file_path: env } }, dir);
+    assert.strictEqual(code, 0);
+    assert.strictEqual(permissionDecision(stdout), 'ask');
   } finally {
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
 
-test('blocks a symlink whose target is .env (regression: symlink bypass)', () => {
+test('asks for a symlink whose target is .env (regression: symlink bypass)', () => {
   const dir = tmpDir();
   try {
     const env = path.join(dir, '.env');
     fs.writeFileSync(env, 'SECRET=1');
     const link = path.join(dir, 'notes.txt'); // harmless-looking name
     fs.symlinkSync(env, link);
-    const { code } = runHook({ tool_name: 'Read', tool_input: { file_path: link } }, dir);
-    assert.strictEqual(code, 2, 'symlink to .env must be blocked, not allowed');
+    const { code, stdout } = runHook({ tool_name: 'Read', tool_input: { file_path: link } }, dir);
+    assert.strictEqual(code, 0);
+    assert.strictEqual(permissionDecision(stdout), 'ask');
   } finally {
     fs.rmSync(dir, { recursive: true, force: true });
   }
@@ -77,3 +83,37 @@ test('allows a symlink to an exempt .env.example (exemption still wins)', () =>
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+
+test('an exempt-looking symlink to .env still asks based on its target', () => {
+  const dir = tmpDir();
+  try {
+    const env = path.join(dir, '.env');
+    fs.writeFileSync(env, 'SECRET=1');
+    const link = path.join(dir, '.env.example');
+    fs.symlinkSync(env, link);
+    const { stdout } = runHook({ tool_name: 'Read', tool_input: { file_path: link } }, dir);
+    assert.strictEqual(permissionDecision(stdout), 'ask');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+for (const command of [
+  'cat ".env"',
+  'cat .env',
+  'cat .env*',
+  'sed -n 1p .env',
+  "bash -c 'sed -n 1p .env'",
+]) {
+  test(`asks natively for Bash sensitive reference: ${command}`, () => {
+    const dir = tmpDir();
+    try {
+      fs.writeFileSync(path.join(dir, '.env'), 'SECRET=1');
+      const { code, stdout } = runHook({ tool_name: 'Bash', tool_input: { command } }, dir);
+      assert.strictEqual(code, 0);
+      assert.strictEqual(permissionDecision(stdout), 'ask');
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+}

package/src/claude/hooks/__tests__/spec-gate.test.js

@@ -64,7 +64,7 @@ function readCache() {
  * @param {string} [opts.taskStatus='done']
  * @param {string|null} [opts.completed_at='2026-07-01T00:00:00Z']
  * @param {string} [opts.mdStatus='done']
- * @param {'valid'|'missing-evidence'|'placeholder'|'none'} [opts.evidence='valid']
+ * @param {'valid'|'legacy-valid'|'failed'|'fence-only'|'missing-evidence'|'placeholder'|'none'} [opts.evidence='valid']
  * @param {object|null} [opts.runtime] — if set, write .claude/runtime.json
  */
 function makeFixture(opts = {}) {
@@ -97,12 +97,19 @@ function makeFixture(opts = {}) {
     evidenceBlock = [
       '## Evidence',
       '',
+      'Verification: PASS',
       '```',
       'npm test',
       'PASS: 10 tests',
       '```',
       '',
     ].join('\n');
+  } else if (evidence === 'legacy-valid') {
+    evidenceBlock = '## Evidence\n\nnpm test — passed, exit code 0\n';
+  } else if (evidence === 'failed') {
+    evidenceBlock = '## Evidence\n\nVerification: PASS\n\nFAIL: tests failed, exit code 1\n';
+  } else if (evidence === 'fence-only') {
+    evidenceBlock = '## Evidence\n\n```\nnpm test\n```\n';
   } else if (evidence === 'placeholder') {
     evidenceBlock = [
       '## Evidence',
@@ -268,3 +275,70 @@ test('7. Evidence with {{...}} placeholder → blocked (check c)', () => {
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+
+test('8. explicit failure cannot pass even when PASS text is present', () => {
+  const dir = makeFixture({ evidence: 'failed' });
+  try {
+    seedCache({ [FEATURE]: { [TASK_REL]: 'pending' } });
+    const body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body);
+    assert.match(body.reason, /\bc\b/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('9. a code fence alone is not verification proof', () => {
+  const dir = makeFixture({ evidence: 'fence-only' });
+  try {
+    seedCache({ [FEATURE]: { [TASK_REL]: 'pending' } });
+    assert.ok(parseBlock(runHook({}, dir).stdout));
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('10. completed_at must be a valid ISO timestamp', () => {
+  const dir = makeFixture({ completed_at: 'yesterday' });
+  try {
+    seedCache({ [FEATURE]: { [TASK_REL]: 'pending' } });
+    const body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body);
+    assert.match(body.reason, /\bd\b/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('11. done → pending cache transition is persisted and can be gated again', () => {
+  const dir = makeFixture({ taskStatus: 'pending', mdStatus: 'pending' });
+  try {
+    seedCache({ [FEATURE]: { [TASK_REL]: 'done' } });
+    assert.strictEqual(runHook({}, dir).stdout, '');
+    assert.strictEqual(readCache()[FEATURE][TASK_REL], 'pending');
+
+    const specFile = path.join(dir, 'specs', FEATURE, 'spec.json');
+    const spec = JSON.parse(fs.readFileSync(specFile, 'utf8'));
+    spec.task_registry[TASK_REL] = {
+      status: 'done',
+      completed_at: '2026-07-01T00:00:00Z',
+    };
+    fs.writeFileSync(specFile, JSON.stringify(spec));
+    const taskFile = path.join(dir, 'specs', FEATURE, TASK_REL);
+    fs.writeFileSync(taskFile, '# Task\n\n**Status:** done\n\n## Evidence\n\nFAIL: tests failed\n');
+
+    assert.ok(parseBlock(runHook({}, dir).stdout), 're-completed failing task must be gated');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('12. legacy successful receipt remains read-compatible', () => {
+  const dir = makeFixture({ evidence: 'legacy-valid' });
+  try {
+    seedCache({ [FEATURE]: { [TASK_REL]: 'pending' } });
+    assert.strictEqual(runHook({}, dir).stdout, '');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});

package/src/claude/hooks/__tests__/state.test.js

@@ -0,0 +1,65 @@
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const HOOK = path.join(__dirname, '..', 'state.cjs');
+
+test('Stop snapshot includes tracked modifications and untracked files', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-state-'));
+  try {
+    fs.mkdirSync(path.join(dir, '.claude'));
+    spawnSync('git', ['init', '-q'], { cwd: dir });
+    spawnSync('git', ['config', 'user.email', 'test@example.com'], { cwd: dir });
+    spawnSync('git', ['config', 'user.name', 'Test'], { cwd: dir });
+    fs.writeFileSync(path.join(dir, 'tracked.txt'), 'before\n');
+    spawnSync('git', ['add', 'tracked.txt'], { cwd: dir });
+    spawnSync('git', ['commit', '-qm', 'initial'], { cwd: dir });
+
+    fs.writeFileSync(path.join(dir, 'tracked.txt'), 'after\n');
+    fs.writeFileSync(path.join(dir, 'new-untracked.json'), '{}\n');
+    const result = spawnSync(process.execPath, [HOOK], {
+      cwd: dir,
+      input: JSON.stringify({ hook_event_name: 'Stop', cwd: dir }),
+      encoding: 'utf8',
+    });
+
+    assert.strictEqual(result.status, 0);
+    const state = fs.readFileSync(
+      path.join(dir, '.claude', 'session-state', 'latest.md'),
+      'utf8',
+    );
+    assert.match(state, /- tracked\.txt/);
+    assert.match(state, /- new-untracked\.json/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('Stop snapshot includes untracked files before the first commit', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-state-no-head-'));
+  try {
+    fs.mkdirSync(path.join(dir, '.claude'));
+    spawnSync('git', ['init', '-q'], { cwd: dir });
+    fs.writeFileSync(path.join(dir, 'first-untracked.txt'), 'new\n');
+
+    const result = spawnSync(process.execPath, [HOOK], {
+      cwd: dir,
+      input: JSON.stringify({ hook_event_name: 'Stop', cwd: dir }),
+      encoding: 'utf8',
+    });
+
+    assert.strictEqual(result.status, 0);
+    const state = fs.readFileSync(
+      path.join(dir, '.claude', 'session-state', 'latest.md'),
+      'utf8',
+    );
+    assert.match(state, /- first-untracked\.txt/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});

package/src/claude/hooks/docs-sync.cjs

@@ -39,24 +39,20 @@ try {
 
   const lines = [];
 
-  // Trường hợp 1: Có Code nhưng chưa có thư mục docs
+  // Case 1: source present but docs/ missing
   if (!fs.existsSync(docsDir)) {
     lines.push('');
-    lines.push('### 🔴 URGENT SYSTEM ACTION: MISSING DOCUMENTATION 🔴');
-    lines.push(`> BẮT BUỘC (MANDATORY): Hệ thống phát hiện dự án đã có Source Code nhưng thư mục \`docs/\` chưa tồn tại.`);
-    lines.push(`> Nhiệm vụ ĐẦU TIÊN của bạn trong session này là đọc hiểu mã nguồn hiện tại và tạo ra các tài liệu tiêu chuẩn:`);
-    lines.push(`> 1. \`docs/system-architecture.md\` (Kiến trúc hệ thống, phân tích flow)`);
-    lines.push(`> 2. \`docs/project-overview-pdr.md\` (Tổng quan, mục tiêu, tính năng)`);
-    lines.push(`> 3. Khởi tạo file hidden \`docs/.sync_hash\` để theo dõi cập nhật.`);
-    lines.push(`> `);
-    lines.push(`> LƯU Ý BẮT BUỘC: Bạn phải chạy lệnh Git này trong Terminal để lấy Hash Code mới nhất: \`git log -1 --format="%H" -- . ":(exclude)docs"\``);
-    lines.push(`> Sau đó ghi chuẩn giá trị Hash đó vào file \`docs/.sync_hash\`.`);
+    lines.push('### Missing docs/');
+    lines.push('> Source exists but `docs/` does not. Create baseline docs first:');
+    lines.push('> 1. `docs/system-architecture.md` — system architecture and flows');
+    lines.push('> 2. `docs/project-overview-pdr.md` — overview, goals, features');
+    lines.push('> 3. Write current hash to `docs/.sync_hash` via `git log -1 --format="%H" -- . ":(exclude)docs"`');
     lines.push('');
-  } 
-  // Trường hợp 2: Có Code, đã có Docs. Kiểm tra Continuous Sync
+  }
+  // Case 2: docs exist — check continuous sync vs source-only git hash
   else {
     try {
-      // Lấy hash của lần thay đổi SOURCE CODE gần nhất (Bỏ qua những commit chỉ sửa docs)
+      // Latest SOURCE-only hash (ignore docs-only commits)
       const currentHash = execSync('git log -1 --format="%H" -- . ":(exclude)docs"', { 
         cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] 
       }).trim();
@@ -69,18 +65,16 @@ try {
 
         if (lastSyncHash !== currentHash) {
           lines.push('');
-          lines.push('### 🔄 CONTINUOUS DOCS SYNC REQUIRED 🔄');
-          lines.push(`> Source Code vừa có sự thay đổi mới (Git Hash: \`${currentHash}\`) kể từ lần đồng bộ Docs cuối cùng (\`${lastSyncHash || 'Chưa gán'}\`).`);
-          lines.push(`> YÊU CẦU TRƯỚC KHI LÀM THÊM TÍNH NĂNG:`);
-          lines.push(`> 1. Rà soát file bị thay đổi gần đây (dùng \`git diff ${lastSyncHash} ${currentHash}\` hoặc \`git log\`).`);
-          lines.push(`> 2. Cập nhật lại \`docs/system-architecture.md\` hoặc các chuẩn code nếu cần thiết.`);
-          lines.push(`> 3. Cập nhật Changelog (nhật ký thay đổi).`);
-          lines.push(`> 4. KHI HOÀN TẤT, BẠN PHẢI GHI ĐÈ GIÁ TRỊ SAU: \`${currentHash}\` VÀO FILE \`docs/.sync_hash\` ĐỂ CHỐT TRẠNG THÁI HIỆN TẠI.`);
+          lines.push('### Docs sync needed');
+          lines.push(`> Source changed (\`${currentHash}\`) since last docs sync (\`${lastSyncHash || 'none'}\`).`);
+          lines.push(`> 1. Review recent changes (\`git diff ${lastSyncHash} ${currentHash}\` or \`git log\`).`);
+          lines.push('> 2. Update architecture/code-standards docs and changelog as needed.');
+          lines.push(`> 3. Write \`${currentHash}\` to \`docs/.sync_hash\` when done.`);
           lines.push('');
         }
       }
     } catch (e) {
-      // Git chưa init hoặc chưa có commit nào thì im lặng fail-open
+      // Git not initialized or no commits — fail-open
     }
   }
 

package/src/claude/hooks/inspect-block.cjs

@@ -21,7 +21,7 @@ try {
   // Directories that should never be read (too large / irrelevant to LLM)
   const BLOCKED_DIRS = [
     'node_modules', 'dist', 'build', '.next', '.nuxt', '.output',
-    '__pycache__', '.venv', 'venv', '.env',
+    '__pycache__', '.venv', 'venv',
     'vendor', 'target',
     '.git', 'coverage', '.nyc_output',
   ];

package/src/claude/hooks/lib/config.cjs

@@ -52,11 +52,6 @@ const DEFAULT_CONFIG = {
     packageManager: 'auto',
     framework: 'auto'
   },
-  skills: {
-    research: {
-      useGemini: true  // Toggle Gemini CLI usage in research skill
-    }
-  },
   assertions: [],
   statusline: 'full',
   statuslineColors: true,

package/src/claude/hooks/privacy-block.cjs

@@ -7,12 +7,11 @@
  * Claude Code CLI privacy gate for sensitive files.
  *
  * Runtime contract:
- * - Non-bash file access to sensitive files is blocked with a JSON marker
- * - Assistant must use AskUserQuestion with that JSON payload
- * - If user approves, assistant should read via `bash cat "file"`
- * - Bash access is allowed with a warning to enable the approved follow-up path
+ * - Sensitive access returns Claude Code's native PreToolUse "ask" decision
+ * - The same decision applies to direct tools and Bash commands
+ * - Symlinks are classified by their resolved target before their alias
  *
- * Exit: 0 = allow, 2 = block
+ * Exit: 0 (the JSON hook output carries the permission decision)
  */
 
 try {
@@ -20,7 +19,7 @@ try {
   const path = require('path');
 
   const RESTRICTED_PATTERNS = [
-    /^\.env(\.|$)/i,
+    /^\.env(?:[.\[*?{]|$)/i,
     /^credentials/i,
     /secrets?\.(ya?ml|json)$/i,
     /\.pem$/i,
@@ -66,22 +65,28 @@ try {
    * when the path cannot be resolved (missing file, broken link) — fail-open to
    * the original-path check in that case.
    */
-  function resolveTarget(filePath) {
+  function resolveTarget(filePath, cwd) {
     try {
-      return fs.realpathSync(filePath);
+      const requested = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+      return fs.realpathSync(requested);
     } catch {
       return null;
     }
   }
 
   function extractBashPaths(command) {
-    const paths = [];
-    const regex = /(?:cat|less|more|head|tail|source|\.)\s+(?:"([^"]+)"|'([^']+)'|([^\s]+))/g;
-    let match;
-    while ((match = regex.exec(command)) !== null) {
-      paths.push(match[1] || match[2] || match[3]);
+    const paths = new Set();
+    // Quotes are delimiters rather than grouped tokens so nested shell
+    // commands such as `bash -c 'cat .env'` cannot hide the sensitive path.
+    const tokens = command.split(/[\s|;&<>"']+/).filter(Boolean);
+    for (const token of tokens) {
+      const cleaned = token.replace(/^["'()`]+|["'(),]+$/g, '');
+      for (const candidate of cleaned.split('=')) {
+        const value = candidate.replace(/^["'()`]+|["'(),]+$/g, '');
+        if (value && (isSensitive(value) || isSafe(value))) paths.add(value);
+      }
     }
-    return paths;
+    return [...paths];
   }
 
   function extractPaths(toolName, input) {
@@ -107,42 +112,15 @@ try {
     return paths.filter(Boolean);
   }
 
-  function formatBlockMessage(filePath) {
+  function askForPermission(filePath) {
     const basename = path.basename(filePath);
-    const promptData = {
-      type: 'PRIVACY_PROMPT',
-      file: filePath,
-      basename,
-      question: {
-        header: 'File Access',
-        text: `I need to read "${basename}" which may contain sensitive data (API keys, passwords, tokens). Do you approve?`,
-        options: [
-          {
-            label: 'Yes, approve access',
-            description: `Allow reading ${basename} this time`
-          },
-          {
-            label: 'No, skip this file',
-            description: 'Continue without accessing this file'
-          }
-        ]
+    process.stdout.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'ask',
+        permissionDecisionReason: `Sensitive file access requires approval: ${basename}`
       }
-    };
-
-    return [
-      'NOTE: This is not an error. This block protects sensitive data.',
-      '',
-      `PRIVACY BLOCK: Sensitive file access requires user approval`,
-      `File: ${filePath}`,
-      '',
-      '@@PRIVACY_PROMPT_START@@',
-      JSON.stringify(promptData, null, 2),
-      '@@PRIVACY_PROMPT_END@@',
-      '',
-      'Claude Code follow-up:',
-      `- If approved: use bash to read: cat "${filePath}"`,
-      '- If denied: continue without this file'
-    ].join('\n');
+    }) + '\n');
   }
 
   const stdin = fs.readFileSync(0, 'utf8').trim();
@@ -160,22 +138,21 @@ try {
   if (!paths.length) process.exit(0);
 
   for (const filePath of paths) {
-    // Check the requested path and, when it is a symlink, its real target.
-    const target = resolveTarget(filePath);
-    const candidates = target && target !== filePath ? [filePath, target] : [filePath];
-
-    // An exemption on either name wins (e.g. a symlink to .env.example).
-    if (candidates.some(isSafe)) continue;
-    // Sensitive if the requested path OR its symlink target is sensitive.
-    if (!candidates.some(isSensitive)) continue;
-
-    if (toolName === 'Bash') {
-      console.error(`WARN: Privacy-sensitive file access via bash allowed for approved follow-up: ${path.basename(filePath)}`);
-      process.exit(0);
+    const target = resolveTarget(filePath, cwd);
+
+    // The real target is authoritative: an exempt-looking alias must not hide
+    // a sensitive target, while a real .env.example target remains safe.
+    if (target) {
+      if (isSensitive(target) && !isSafe(target)) {
+        askForPermission(filePath);
+        process.exit(0);
+      }
+      if (isSafe(target)) continue;
     }
 
-    console.error(formatBlockMessage(filePath));
-    process.exit(2);
+    if (isSafe(filePath) || !isSensitive(filePath)) continue;
+    askForPermission(filePath);
+    process.exit(0);
   }
 
   process.exit(0);