@haposoft/cafekit 0.15.3 → 0.16.0-rc.1

package/src/claude/hooks/spec-gate.cjs

@@ -9,13 +9,15 @@
  * Block contract (exit 0 + stdout): {"decision":"block","reason":"..."}.
  *
  * Safety: stop_hook_active loop guard; runtime.spec.completion_gate=false
- * escape hatch (missing key → ON); first-run seeds cache without blocking;
- * crash → fail-open + hooks/.logs/hook-log.jsonl. Exit: 0 always.
+ * escape hatch (missing key → ON); cache is optimization only - every
+ * done transition is validated even on first run / empty cache; crash → fail-open + hooks/.logs/hook-log.jsonl. Exit: 0 always.
  */
 
 try {
   const fs   = require('fs');
   const path = require('path');
+  const policyPath = path.join(__dirname, '..', 'scripts', 'workflow-policy.cjs');
+  const POLICY = require(policyPath);
 
   const stdin = fs.readFileSync(0, 'utf8').trim();
   if (!stdin) process.exit(0);
@@ -69,20 +71,24 @@ try {
     currentStatuses[tp] = task?.status || 'pending';
   }
 
-  // First run: treat all current done as historical — seed cache, never block.
-  if (!cacheExists) {
-    try {
-      fs.mkdirSync(path.dirname(cacheFile), { recursive: true });
-      cache[featureName] = currentStatuses;
-      fs.writeFileSync(cacheFile, JSON.stringify(cache));
-    } catch { /* fail-open */ }
+  const staleFlashTasks = Object.entries(taskRegistry)
+    .filter(([, task]) => POLICY.isStaleFlashDone(task))
+    .map(([taskPath]) => taskPath);
+  if (staleFlashTasks.length > 0) {
+    process.stdout.write(JSON.stringify({
+      decision: 'block',
+      reason: `Completion gate: ${staleFlashTasks.length} task(s) marked done with FLASH_UNVERIFIED (${staleFlashTasks.join(', ')}). Run /hapo:test for exact proof, then use explicit sync-finalize.`
+    }) + '\n');
     process.exit(0);
   }
 
-  const featureCache = cache[featureName] || {};
-  // Newly done: status is done now AND cached status differs or is absent.
-  const newlyDone = Object.keys(taskRegistry).filter((tp) =>
-    (taskRegistry[tp]?.status || 'pending') === 'done' && featureCache[tp] !== 'done'
+  // Cache hardening: every Stop revalidates the canonical receipt for
+  // every task currently marked done, so a cached PASS cannot hide later
+  // mutations (deletion, placeholder, changed Verification/Command/Exit/
+  // Base/Head, stale provenance). Cache is an optimization, not truth.
+  const featureCache = cacheExists ? (cache[featureName] || {}) : {};
+  const allDoneTasks = Object.keys(taskRegistry).filter((tp) =>
+    (taskRegistry[tp]?.status || 'pending') === 'done'
   );
   // /m so ^ matches line starts (Evidence is never at byte 0 of the file).
   // legacy heading aliases: read-compat only, no longer advertised
@@ -108,12 +114,35 @@ try {
     return lines.slice(start, end).join('\n');
   }
 
-  // Receipt checks a–d → failed letter list.
-  // a: file + Status header has "done"; b: Evidence heading; c: no {{...}} + (fence|proof); d: completed_at
+  function validateCanonicalReceipt(body) {
+    const fails = [];
+    if (!/^\s*Verification:\s*PASS\s*$/m.test(body)) fails.push('verification_state');
+    if (!/^\s*Command(?:\(s\))?\s*:/m.test(body)) fails.push('command');
+    if (!/^\s*Exit\s*:|exit\s+code\s*[:=]|\bResult\s*:\s*PASS\b/im.test(body)) fails.push('exit_result');
+    const hasBase = /^\s*Base[ \t]*:[ \t]*\S/im.test(body);
+    const hasHead = /^\s*Head[ \t]*:[ \t]*\S/im.test(body);
+    const hasBaseSha = /\bbase_sha[ \t]*:[ \t]*\S/im.test(body);
+    const hasHeadSha = /\bhead_sha[ \t]*:[ \t]*\S/im.test(body);
+    if (!((hasBase && hasHead) || (hasBaseSha && hasHeadSha))) fails.push('provenance');
+    if (/\bartifact\b/i.test(body) && !/sha256:/i.test(body)) fails.push('artifact_hash');
+    return fails;
+  }
+
+  // Receipt checks a–h → failed letter list.
+  // a: file + Status header has "done"; b: Evidence heading; c: no {{...}} + unambiguous PASS; d: completed_at; e: command; f: exit/result; g: provenance; h: artifact hash
+  function safeTaskFile(featureDir, taskPath) {
+    const target = path.resolve(featureDir, taskPath);
+    const relative = path.relative(featureDir, target);
+    // sibling-prefix safe: must not be .., ../..., or absolute (cross-platform)
+    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) return null;
+    return target;
+  }
+
   function checkReceipt(taskPath) {
     const fails = [];
-    const abs = path.join(specsPath, featureName, taskPath);
-    if (!fs.existsSync(abs)) return ['a'];
+    const featureDir = path.join(specsPath, featureName);
+    const abs = safeTaskFile(featureDir, taskPath);
+    if (!abs || !fs.existsSync(abs)) return ['a'];
     let text = '';
     try { text = fs.readFileSync(abs, 'utf8'); } catch { return ['a']; }
 
@@ -129,6 +158,20 @@ try {
       !(PASS_MARKER_RE.test(body) || LEGACY_SUCCESS_RE.test(body))
     ) {
       fails.push('c');
+    } else {
+      // Canonical receipt checks for done tasks
+      const canonicalFails = validateCanonicalReceipt(body);
+      const map = { verification_state: 'c', command: 'e', exit_result: 'f', provenance: 'g', artifact_hash: 'h' };
+      for (const cf of canonicalFails) {
+        if (cf === 'verification_state') {
+          if (!PASS_MARKER_RE.test(body) && !fails.includes('c')) fails.push('c');
+          continue;
+        }
+        const letter = map[cf];
+        if (letter && !fails.includes(letter)) fails.push(letter);
+      }
+      // Enforce strict Verification: PASS, not just legacy success
+      if (!PASS_MARKER_RE.test(body) && !fails.includes('c')) fails.push('c');
     }
 
     const at = taskRegistry[taskPath]?.completed_at;
@@ -140,12 +183,14 @@ try {
     return fails;
   }
 
-  const failures = newlyDone
+  const failures = allDoneTasks
     .map((tp) => ({ taskPath: tp, fails: checkReceipt(tp) }))
     .filter((f) => f.fails.length > 0);
 
-  // Always persist status transitions, including done → pending. Leave failing
-  // newly-done tasks at their old status so the gate re-fires next Stop.
+  // Always persist status transitions, including done → pending. Keep
+  // failing done tasks at their previous cached status so a stale valid
+  // entry cannot mask a mutated receipt on the next Stop; with
+  // revalidation of every done task the gate still re-fires regardless.
   try {
     const nextFeature = { ...featureCache, ...currentStatuses };
     for (const { taskPath } of failures) {
@@ -157,7 +202,7 @@ try {
     fs.writeFileSync(cacheFile, JSON.stringify(cache));
   } catch { /* fail-open */ }
 
-  if (newlyDone.length === 0) process.exit(0);
+  if (allDoneTasks.length === 0) process.exit(0);
   if (failures.length === 0) process.exit(0);
 
   const lines = [

package/src/claude/hooks/spec-state.cjs

@@ -14,6 +14,7 @@
 try {
   const fs   = require('fs');
   const path = require('path');
+  const POLICY = require(path.join(__dirname, '..', 'scripts', 'workflow-policy.cjs'));
 
   // ── Main ──────────────────────────────────────────────────────────────────
 
@@ -68,6 +69,7 @@ try {
 
   const phase = activeSpec.current_phase || activeSpec.phase || 'unknown';
   const taskRegistry = activeSpec.task_registry || {};
+  const flashTasks = POLICY.flashState(taskRegistry);
   const taskEntries = Object.entries(taskRegistry);
   const taskCounts = taskEntries.reduce((acc, [, task]) => {
     const status = task?.status || 'pending';
@@ -113,6 +115,9 @@ try {
   if (nextUnblocked) {
     lines.push(`- Next unblocked: \`${nextUnblocked[0]}\``);
   }
+  if (flashTasks.length > 0) {
+    lines.push(`- Flash verification pending: ${flashTasks.map((taskPath) => `\`${taskPath}\``).join(', ')}. PASS promotion keeps task in_progress until explicit sync-finalize.`);
+  }
   lines.push(`- Sync \`spec.json\` + task file after verified work; run \`node .claude/scripts/validate-spec-output.cjs specs/${featureName}\` before \`ready_for_implementation=true\`.`);
   lines.push(`- A completion gate verifies receipts when you end a turn with newly-done tasks.`);
   lines.push('');

package/src/claude/migration-manifest.json

@@ -41,7 +41,7 @@
     "required": [
       "test-runner.md",
       "code-auditor.md",
-      "god-developer.md",
+      "implementer.md",
       "debugger.md",
       "docs-keeper.md",
       "git-ops.md",
@@ -59,7 +59,9 @@
       "validate-docs.cjs",
       "validate-docs-reconstruct.cjs",
       "generate-skill-catalog.cjs",
-      "validate-spec-output.cjs"
+      "validate-spec-output.cjs",
+      "scan-staged-secrets.cjs",
+      "workflow-policy.cjs"
     ]
   },
   "agentReferences": {
@@ -69,6 +71,11 @@
     "assumed": []
   },
   "obsolete": {
+    "agents": {
+      "claude": ["agents/god-developer.md"],
+      "codex": ["agents/god_developer.toml"],
+      "opencode": ["agents/god-developer.md"]
+    },
     "runtimeFiles": [
       "hooks/skill-router.cjs",
       "hooks/lib/skill-router-routes.cjs",

package/src/claude/runtime.json

@@ -3,9 +3,6 @@
   "inspect": {
     "enabled": true
   },
-  "gemini": {
-    "model": "gemma-4-31b-it"
-  },
   "statusline": "full",
   "statuslineColors": true,
   "docs": {

package/src/claude/scripts/generate-skill-catalog.cjs

@@ -38,10 +38,10 @@ function parseArgs(argv) {
 
 function defaultSkillsRoot() {
   const candidates = [
+    path.resolve(__dirname, '..', 'skills'),
     path.resolve(process.cwd(), '.claude', 'skills'),
     path.resolve(process.cwd(), '.agents', 'skills'),
     path.resolve(process.cwd(), '.opencode', 'skills'),
-    path.resolve(__dirname, '..', 'skills'),
     path.resolve(__dirname, '..', '..', '.agents', 'skills')
   ];
   return candidates.find((candidate) => fs.existsSync(candidate)) || candidates[0];

package/src/claude/scripts/scan-staged-secrets.cjs

@@ -0,0 +1,170 @@
+'use strict';
+
+const { spawnSync } = require('node:child_process');
+
+const STRONG_SENSITIVE_NAMES = new Set([
+  'api_key', 'apikey', 'api-key', 'password', 'passwd', 'access_token',
+  'auth_token', 'bearer_token', 'client_secret', 'private_key',
+  'aws_secret_access_key', 'aws_access_key_id', 'github_token', 'jwt_secret',
+  'openai_api_key', 'anthropic_api_key', 'credential_url', 'credentials_url',
+  'database_url', 'connection_string', 'connection_url', 'dsn', 'basic_auth',
+  'basic-auth', 'auth_header', 'authorization'
+]);
+const GENERIC_SENSITIVE_NAMES = new Set(['secret', 'token', 'key', 'auth']);
+const SAFE_SUFFIXES = /(?:_label|_hint|_path|_file)$/i;
+const PLACEHOLDER = /^(?:$|(?:your|my|replace|change|set)[-_ ]?(?:value|secret|key|token|password)?$|(?:changeme|change-me|example|sample|dummy|placeholder|test|testing|fake|xxx+|<[^>]+>|\.{3,}|\*{3,}))/i;
+const ENV_REFERENCE = /^(?:\$\{?[A-Z0-9_]+\}?|process\.env(?:\.|\[)|import\.meta\.env(?:\.|\[)|(?:env|os\.environ)\s*\()/i;
+const FUNCTION_REFERENCE = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\s*\(/;
+const VALUE_SIGNAL = /(?:^|[\s_-])(sk-[a-z0-9_-]{8,}|gh[pousr]_[a-z0-9_]{8,}|ey[a-z0-9_-]{20,}|[a-f0-9]{24,}|[a-z0-9+/]{20,}={0,2})(?:$|[^a-z0-9_])/i;
+const PEM_SIGNAL = /-----BEGIN [A-Z0-9 ]*(?:PRIVATE KEY|CERTIFICATE)[A-Z0-9 ]*-----/i;
+const CREDENTIAL_URL_SIGNAL = /\b(?:https?|postgres(?:ql)?|mysql|mongodb(?:\+srv)?):\/\/[^\s/@:]+(?::[^\s/@]*)?@[^\s/]+/i;
+const PUBLIC_URL_SIGNAL = /^(?:https?|postgres(?:ql)?|mysql|mongodb(?:\+srv)?:)\/\//i;
+const BASIC_AUTH_SIGNAL = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/i;
+const SAFE_LITERAL = /^(?:true|false|null|undefined|enabled|disabled|none|safe)$/i;
+const ASSIGNMENT = /(?:^|[\s,{\-])(["']?[A-Za-z_$][A-Za-z0-9_$-]*["']?)\s*(?::|=)\s*(?:"([^"]*)"|'([^']*)'|`([^`]*)`|([^\s#},]*))/g;
+
+function normalizeIdentifier(name) {
+  return name.replace(/([a-z0-9])([A-Z])/g, '$1_$2').replace(/-/g, '_').toLowerCase();
+}
+
+function sensitivityLevel(name) {
+  const normalized = normalizeIdentifier(name);
+  if (SAFE_SUFFIXES.test(normalized) || normalized === 'tokenizer') return null;
+  if (STRONG_SENSITIVE_NAMES.has(normalized)
+    || /(?:^|_)(?:api_key|password|passwd|private_key|client_secret|access_token|auth_token|credential|credentials)(?:_|$)/i.test(normalized)) {
+    return 'strong';
+  }
+  if (GENERIC_SENSITIVE_NAMES.has(normalized)
+    || /(?:^|_)(?:secret|token|key|auth)(?:_|$)/i.test(normalized)) {
+    return 'generic';
+  }
+  return null;
+}
+
+function identifierIsSensitive(name) {
+  return sensitivityLevel(name) !== null;
+}
+
+function stripValue(value) {
+  return String(value || '').trim().replace(/^(['"`])([\s\S]*)\1$/, '$2').replace(/[;,]$/, '');
+}
+
+function valueLooksSecret(value, level = 'generic') {
+  const clean = stripValue(value);
+  if (!clean || PLACEHOLDER.test(clean) || ENV_REFERENCE.test(clean) || FUNCTION_REFERENCE.test(clean)) return false;
+  if (PUBLIC_URL_SIGNAL.test(clean) && !CREDENTIAL_URL_SIGNAL.test(clean)) return false;
+  if (PEM_SIGNAL.test(clean) || CREDENTIAL_URL_SIGNAL.test(clean) || BASIC_AUTH_SIGNAL.test(clean)) return true;
+  if (level === 'strong') return clean.length >= 4 && !SAFE_LITERAL.test(clean);
+  return VALUE_SIGNAL.test(clean) || (clean.length >= 20 && /[A-Za-z]/.test(clean) && /\d/.test(clean));
+}
+
+function parseAssignments(text) {
+  const assignments = [];
+  let match;
+  while ((match = ASSIGNMENT.exec(text)) !== null) {
+    const name = match[1].replace(/^["']|["']$/g, '');
+    const value = match[2] ?? match[3] ?? match[4] ?? match[5] ?? '';
+    assignments.push({ name, value, level: sensitivityLevel(name) });
+  }
+  return assignments;
+}
+
+function inspectAssignment(assignment, file, sourceLine, findings) {
+  const specializedValue = PEM_SIGNAL.test(assignment.value)
+    || CREDENTIAL_URL_SIGNAL.test(assignment.value)
+    || BASIC_AUTH_SIGNAL.test(assignment.value);
+  if ((assignment.level && valueLooksSecret(assignment.value, assignment.level)) || (!assignment.level && specializedValue)) {
+    findings.push({ file, sourceLine, name: assignment.name });
+  }
+}
+
+function parseDiff(diff) {
+  const findings = [];
+  let file = null;
+  let sourceLine = 0;
+  let pending = null;
+
+  const flushPending = () => {
+    if (!pending) return;
+    if (valueLooksSecret(pending.value, pending.level)) {
+      findings.push({ file: pending.file, sourceLine: pending.sourceLine, name: pending.name });
+    }
+    pending = null;
+  };
+
+  for (const line of diff.split(/\r?\n/)) {
+    if (line.startsWith('+++ b/')) {
+      flushPending();
+      file = line.slice(6);
+      continue;
+    }
+    const hunk = line.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/);
+    if (hunk) {
+      flushPending();
+      sourceLine = Number(hunk[1]);
+      continue;
+    }
+    if (!file || sourceLine < 1) continue;
+
+    if (line.startsWith('+') && !line.startsWith('+++')) {
+      const text = line.slice(1);
+      const assignments = parseAssignments(text);
+      const first = assignments[0];
+      const indented = /^\s+/.test(text);
+      if (pending && (!indented || first)) flushPending();
+
+      if (first) {
+        for (const assignment of assignments) inspectAssignment(assignment, file, sourceLine, findings);
+        if (first.level && (!first.value || /^(?:\||>|\{|\[)$/.test(first.value))) {
+          pending = {
+            file,
+            sourceLine,
+            name: first.name,
+            level: first.level,
+            value: ''
+          };
+        }
+      } else if (pending && indented) {
+        pending.value += `\n${text.trim()}`;
+      } else if (pending && (PEM_SIGNAL.test(text) || BASIC_AUTH_SIGNAL.test(text))) {
+        pending.value += `\n${text.trim()}`;
+      }
+      sourceLine++;
+    } else if (!line.startsWith('-') && !line.startsWith('\\')) {
+      flushPending();
+      sourceLine++;
+    } else if (line.startsWith('-')) {
+      flushPending();
+    }
+  }
+  flushPending();
+  return findings;
+}
+
+function main() {
+  const result = spawnSync(
+    'git',
+    ['diff', '--cached', '--unified=0', '--no-color', '--diff-filter=ACMR', '--'],
+    { encoding: 'utf8' }
+  );
+  if (result.error || result.status !== 0) {
+    process.stderr.write(`Unable to read staged diff: ${result.error?.message || result.stderr || 'git diff failed'}\n`);
+    return 2;
+  }
+
+  const findings = parseDiff(result.stdout);
+  const unique = new Map(findings.map((finding) => [
+    `${finding.file}:${finding.sourceLine}:${finding.name}`,
+    finding
+  ]));
+  for (const finding of unique.values()) {
+    process.stdout.write(
+      `Blocked: possible secret \`${finding.name}\` at ${finding.file}:${finding.sourceLine}. Value not shown.\n`
+    );
+  }
+  if (unique.size === 0) process.stdout.write('No staged secrets found.\n');
+  return unique.size > 0 ? 1 : 0;
+}
+
+if (require.main === module) process.exit(main());
+module.exports = { parseDiff, identifierIsSensitive, valueLooksSecret };