@haposoft/cafekit 0.15.3 → 0.16.0-rc.2

package/src/claude/hooks/__tests__/spec-gate.test.js

@@ -98,6 +98,12 @@ function makeFixture(opts = {}) {
       '## Evidence',
       '',
       'Verification: PASS',
+      'Command: npm test',
+      'Exit: 0',
+      'Result: PASS',
+      'Base: abc123',
+      'Head: def456',
+      'Artifact: dist/bundle.js (sha256:deadbeef)',
       '```',
       'npm test',
       'PASS: 10 tests',
@@ -105,7 +111,7 @@ function makeFixture(opts = {}) {
       '',
     ].join('\n');
   } else if (evidence === 'legacy-valid') {
-    evidenceBlock = '## Evidence\n\nnpm test — passed, exit code 0\n';
+    evidenceBlock = '## Evidence\n\nVerification: PASS\nCommand: npm test\nExit: 0\nBase: abc123\nHead: def456\nnpm test — passed, exit code 0\n';
   } else if (evidence === 'failed') {
     evidenceBlock = '## Evidence\n\nVerification: PASS\n\nFAIL: tests failed, exit code 1\n';
   } else if (evidence === 'fence-only') {
@@ -227,17 +233,21 @@ test('4. stop_hook_active: true → exit 0 silent even with violating task', ()
   }
 });
 
-test('5. first run (no cache) with done-without-receipt → exit 0, cache created', () => {
+test('5. first run (no cache) with done-without-receipt → block (cache is not truth)', () => {
   const dir = makeFixture({ evidence: 'missing-evidence' });
   try {
     clearCache();
     assert.ok(!fs.existsSync(CACHE), 'cache must be absent for first-run');
     const { code, stdout } = runHook({}, dir);
     assert.strictEqual(code, 0);
-    assert.strictEqual(stdout, '', 'first run must never block');
-    assert.ok(fs.existsSync(CACHE), 'cache file must be created');
+    const body = parseBlock(stdout);
+    assert.ok(body, 'first run must block done without receipt');
+    assert.strictEqual(body.decision, 'block');
+    assert.ok(body.reason.includes(TASK_REL));
+    assert.ok(fs.existsSync(CACHE), 'cache file must be created even when blocking');
     const cache = readCache();
-    assert.strictEqual(cache[FEATURE][TASK_REL], 'done');
+    // failing task must not be cached as done
+    assert.strictEqual(cache[FEATURE]?.[TASK_REL], undefined);
   } finally {
     fs.rmSync(dir, { recursive: true, force: true });
   }
@@ -342,3 +352,344 @@ test('12. legacy successful receipt remains read-compatible', () => {
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+
+test('13. provenance requires both Base and Head - only Base fails', () => {
+  const dir = tmpDir();
+  const featureDir = path.join(dir, 'specs', FEATURE);
+  const tasksDir = path.join(featureDir, 'tasks');
+  fs.mkdirSync(tasksDir, { recursive: true });
+  fs.writeFileSync(path.join(featureDir, 'spec.json'), JSON.stringify({
+    status: 'in_progress',
+    current_phase: 'implementation',
+    task_registry: { [TASK_REL]: { status: 'done', completed_at: '2026-07-01T00:00:00Z' } },
+  }));
+  // Only Base, missing Head
+  fs.writeFileSync(path.join(dir, 'specs', FEATURE, TASK_REL), [
+    '# Task',
+    '',
+    '**Status:** done',
+    '',
+    '## Evidence',
+    '',
+    'Verification: PASS',
+    'Command: npm test',
+    'Exit: 0',
+    'Base: abc123',
+    '```',
+    'npm test PASS',
+    '```',
+  ].join('\n'));
+  try {
+    seedCache({ [FEATURE]: { [TASK_REL]: 'pending' } });
+    const body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body, 'only Base should block');
+    assert.strictEqual(body.decision, 'block');
+    assert.match(body.reason, /\bg\b/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('14. provenance requires both Base and Head - only Head fails', () => {
+  const dir = tmpDir();
+  const featureDir = path.join(dir, 'specs', FEATURE);
+  const tasksDir = path.join(featureDir, 'tasks');
+  fs.mkdirSync(tasksDir, { recursive: true });
+  fs.writeFileSync(path.join(featureDir, 'spec.json'), JSON.stringify({
+    status: 'in_progress',
+    current_phase: 'implementation',
+    task_registry: { [TASK_REL]: { status: 'done', completed_at: '2026-07-01T00:00:00Z' } },
+  }));
+  // Only Head, missing Base
+  fs.writeFileSync(path.join(dir, 'specs', FEATURE, TASK_REL), [
+    '# Task',
+    '',
+    '**Status:** done',
+    '',
+    '## Evidence',
+    '',
+    'Verification: PASS',
+    'Command: npm test',
+    'Exit: 0',
+    'Head: def456',
+    '```',
+    'npm test PASS',
+    '```',
+  ].join('\n'));
+  try {
+    seedCache({ [FEATURE]: { [TASK_REL]: 'pending' } });
+    const body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body, 'only Head should block');
+    assert.strictEqual(body.decision, 'block');
+    assert.match(body.reason, /\bg\b/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('15. provenance with both Base and Head passes', () => {
+  const dir = tmpDir();
+  const featureDir = path.join(dir, 'specs', FEATURE);
+  const tasksDir = path.join(featureDir, 'tasks');
+  fs.mkdirSync(tasksDir, { recursive: true });
+  fs.writeFileSync(path.join(featureDir, 'spec.json'), JSON.stringify({
+    status: 'in_progress',
+    current_phase: 'implementation',
+    task_registry: { [TASK_REL]: { status: 'done', completed_at: '2026-07-01T00:00:00Z' } },
+  }));
+  fs.writeFileSync(path.join(dir, 'specs', FEATURE, TASK_REL), [
+    '# Task',
+    '',
+    '**Status:** done',
+    '',
+    '## Evidence',
+    '',
+    'Verification: PASS',
+    'Command: npm test',
+    'Exit: 0',
+    'Base: abc123',
+    'Head: def456',
+    '```',
+    'npm test PASS',
+    '```',
+  ].join('\n'));
+  try {
+    seedCache({ [FEATURE]: { [TASK_REL]: 'pending' } });
+    const { stdout } = runHook({}, dir);
+    assert.strictEqual(stdout, '', 'both Base and Head should not block');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('16. registry task path with ../ escape or sibling-prefix is rejected (check a)', () => {
+  const dir = tmpDir();
+  const featureDir = path.join(dir, 'specs', FEATURE);
+  const evilFeature = path.join(dir, 'specs', `${FEATURE}-evil`);
+  const maliciousRel = `../${FEATURE}-evil/tasks/task.md`;
+  const maliciousAbs = path.join(evilFeature, 'tasks/task.md');
+  // Prepare evil file with valid receipt outside feature (should be ignored due to path traversal)
+  fs.mkdirSync(path.join(featureDir, 'tasks'), { recursive: true });
+  fs.mkdirSync(path.join(evilFeature, 'tasks'), { recursive: true });
+  fs.writeFileSync(maliciousAbs, [
+    '# Task',
+    '',
+    '**Status:** done',
+    '',
+    '## Evidence',
+    '',
+    'Verification: PASS',
+    'Command: npm test',
+    'Exit: 0',
+    'Base: abc123',
+    'Head: def456',
+    '```',
+    'pass',
+    '```',
+  ].join('\n'));
+  // Also create sibling-prefix style path: tasks/../../demo-evil/tasks/task.md
+  const siblingPrefixRel = `tasks/../../${FEATURE}-evil/tasks/task.md`;
+  fs.writeFileSync(path.join(featureDir, 'spec.json'), JSON.stringify({
+    status: 'in_progress',
+    current_phase: 'implementation',
+    task_registry: {
+      [maliciousRel]: { status: 'done', completed_at: '2026-07-01T00:00:00Z' },
+      [siblingPrefixRel]: { status: 'done', completed_at: '2026-07-01T00:00:00Z' },
+      [path.resolve(featureDir, maliciousRel)]: { status: 'done', completed_at: '2026-07-01T00:00:00Z' },
+    },
+  }));
+  try {
+    seedCache({ [FEATURE]: { [maliciousRel]: 'pending', [siblingPrefixRel]: 'pending', [path.resolve(featureDir, maliciousRel)]: 'pending' } });
+    const body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body, 'traversal path should block');
+    assert.strictEqual(body.decision, 'block');
+    // Must fail check a (file + Status)
+    assert.match(body.reason, /\ba\b/);
+    // Ensure malicious path is named in reason
+    assert.ok(body.reason.includes(maliciousRel) || body.reason.includes(siblingPrefixRel));
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('17. empty or bare provenance fails — Base:/Head: require non-empty same-line values', () => {
+  const cases = [
+    { evidence: ['Verification: PASS','Command: npm test','Exit: 0','Base:','Head: def456'].join('\n'), desc: 'empty Base:' },
+    { evidence: ['Verification: PASS','Command: npm test','Exit: 0','Base:   ','Head: def456'].join('\n'), desc: 'Base: spaces only' },
+    { evidence: ['Verification: PASS','Command: npm test','Exit: 0','Base: abc','Head:'].join('\n'), desc: 'empty Head:' },
+    { evidence: ['Verification: PASS','Command: npm test','Exit: 0','base_sha','head_sha: def'].join('\n'), desc: 'bare base_sha without colon' },
+    { evidence: ['Verification: PASS','Command: npm test','Exit: 0','base_sha:','head_sha: def'].join('\n'), desc: 'empty base_sha:' },
+    { evidence: ['Verification: PASS','Command: npm test','Exit: 0','base_sha:   ','head_sha: def'].join('\n'), desc: 'base_sha spaces only' },
+    { evidence: ['Verification: PASS','Command: npm test','Exit: 0','base_sha head_sha'].join('\n'), desc: 'bare base_sha head_sha without colon' },
+  ];
+  for (const { evidence, desc } of cases) {
+    const dir = tmpDir();
+    const featureDir = path.join(dir, 'specs', FEATURE);
+    fs.mkdirSync(path.join(featureDir, 'tasks'), { recursive: true });
+    fs.writeFileSync(path.join(featureDir, 'spec.json'), JSON.stringify({
+      status: 'in_progress',
+      current_phase: 'implementation',
+      task_registry: { [TASK_REL]: { status: 'done', completed_at: '2026-07-01T00:00:00Z' } },
+    }));
+    fs.writeFileSync(path.join(dir, 'specs', FEATURE, TASK_REL), ['# Task','','**Status:** done','','## Evidence','','' + evidence,'```','pass','```'].join('\n'));
+    seedCache({ [FEATURE]: { [TASK_REL]: 'pending' } });
+    const body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body, `empty/bare provenance should block for ${desc}`);
+    assert.strictEqual(body.decision, 'block', `empty/bare should block: ${desc}`);
+    assert.match(body.reason, /\bg\b/, `should fail provenance g for ${desc}`);
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('18. valid non-empty Base: value and base_sha: value pass', () => {
+  const validCases = [
+    ['Verification: PASS','Command: npm test','Exit: 0','Base: abc123','Head: def456'].join('\n'),
+    ['Verification: PASS','Command: npm test','Exit: 0','base_sha: abc123','head_sha: def456'].join('\n'),
+    ['Verification: PASS','Command: npm test','Exit: 0','Base: a1b2c3','Head: d4e5f6'].join('\n'),
+  ];
+  for (const evidence of validCases) {
+    const dir = tmpDir();
+    const featureDir = path.join(dir, 'specs', FEATURE);
+    fs.mkdirSync(path.join(featureDir, 'tasks'), { recursive: true });
+    fs.writeFileSync(path.join(featureDir, 'spec.json'), JSON.stringify({
+      status: 'in_progress',
+      current_phase: 'implementation',
+      task_registry: { [TASK_REL]: { status: 'done', completed_at: '2026-07-01T00:00:00Z' } },
+    }));
+    fs.writeFileSync(path.join(dir, 'specs', FEATURE, TASK_REL), ['# Task','','**Status:** done','','## Evidence','','' + evidence,'```','pass','```'].join('\n'));
+    seedCache({ [FEATURE]: { [TASK_REL]: 'pending' } });
+    const { stdout } = runHook({}, dir);
+    assert.strictEqual(stdout, '', `valid provenance should not block: ${evidence.slice(0,40)}`);
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// --- Cache-hardening regressions: cached PASS must not hide later mutations ---
+
+test('19. cache-hit: unchanged valid receipt stays PASS on second Stop (revalidation)', () => {
+  const dir = makeFixture({ evidence: 'valid' });
+  try {
+    clearCache();
+    // first Stop (no cache file) with valid receipt → no block, cache seeded as done
+    let res = runHook({}, dir);
+    assert.strictEqual(res.stdout, '', 'first run valid must not block');
+    assert.strictEqual(readCache()[FEATURE][TASK_REL], 'done');
+    // second Stop with same valid receipt and cache-hit → must still not block
+    res = runHook({}, dir);
+    assert.strictEqual(res.stdout, '', 'cache-hit with unchanged valid receipt must not block');
+    assert.strictEqual(readCache()[FEATURE][TASK_REL], 'done');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('20. cache-hit: receipt mutation (removed Verification/Command) blocks even though status stays done', () => {
+  const dir = makeFixture({ evidence: 'valid' });
+  try {
+    seedCache({ [FEATURE]: { [TASK_REL]: 'pending' } });
+    assert.strictEqual(runHook({}, dir).stdout, '', 'initial valid must pass');
+    assert.strictEqual(readCache()[FEATURE][TASK_REL], 'done');
+    // mutate: strip Verification: PASS and Command — keep file as done
+    const taskFile = path.join(dir, 'specs', FEATURE, TASK_REL);
+    fs.writeFileSync(taskFile, [
+      '# Task', '', '**Status:** done', '',
+      '## Evidence', '',
+      'Exit: 0', 'Base: abc123', 'Head: def456',
+      '```', 'pass', '```',
+    ].join('\n'));
+    const blocked = parseBlock(runHook({}, dir).stdout);
+    assert.ok(blocked, 'mutated receipt missing Verification/Command should block on cache-hit');
+    assert.strictEqual(blocked.decision, 'block');
+    assert.match(blocked.reason, /\bc\b|\be\b/);
+    // cache must not have been promoted to still-valid done; next run must still block
+    const secondBlocked = parseBlock(runHook({}, dir).stdout);
+    assert.ok(secondBlocked, 'second hit after mutation must still block');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('21. cache-hit: provenance mutation (removed Head / changed to stale) blocks', () => {
+  const dir = makeFixture({ evidence: 'valid' });
+  try {
+    seedCache({ [FEATURE]: { [TASK_REL]: 'pending' } });
+    assert.strictEqual(runHook({}, dir).stdout, '');
+    // mutate: remove Head, leave only Base
+    const taskFile = path.join(dir, 'specs', FEATURE, TASK_REL);
+    fs.writeFileSync(taskFile, [
+      '# Task', '', '**Status:** done', '',
+      '## Evidence', '', 'Verification: PASS', 'Command: npm test', 'Exit: 0', 'Base: abc123',
+      '```', 'pass', '```',
+    ].join('\n'));
+    let body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body, 'missing Head provenance should block on cache-hit');
+    assert.match(body.reason, /\bg\b/);
+    // mutate back to include both but with empty Head value (stale)
+    fs.writeFileSync(taskFile, [
+      '# Task', '', '**Status:** done', '',
+      '## Evidence', '', 'Verification: PASS', 'Command: npm test', 'Exit: 0', 'Base: abc123', 'Head:',
+      '```', 'pass', '```',
+    ].join('\n'));
+    body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body, 'empty Head should block as stale provenance');
+    assert.match(body.reason, /\bg\b/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('22. cache-hit: deleted task file blocks even though spec still says done', () => {
+  const dir = makeFixture({ evidence: 'valid' });
+  try {
+    seedCache({ [FEATURE]: { [TASK_REL]: 'pending' } });
+    assert.strictEqual(runHook({}, dir).stdout, '');
+    assert.strictEqual(readCache()[FEATURE][TASK_REL], 'done');
+    fs.unlinkSync(path.join(dir, 'specs', FEATURE, TASK_REL));
+    const body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body, 'deleted receipt file should block on cache-hit');
+    assert.strictEqual(body.decision, 'block');
+    assert.match(body.reason, /\ba\b/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('23. malformed cache JSON does not bypass validation', () => {
+  // valid receipt with malformed cache → must still PASS (fail-open on cache parse, not on receipt)
+  const dirValid = makeFixture({ evidence: 'valid' });
+  try {
+    clearCache();
+    fs.mkdirSync(path.dirname(CACHE), { recursive: true });
+    fs.writeFileSync(CACHE, '{ not json');
+    const res = runHook({}, dirValid);
+    assert.strictEqual(res.stdout, '', 'malformed cache with valid receipt must not block');
+    assert.ok(fs.existsSync(CACHE), 'hook must rewrite cache file');
+  } finally {
+    fs.rmSync(dirValid, { recursive: true, force: true });
+  }
+  // invalid receipt with malformed cache → must still BLOCK (cache not truth)
+  const dirInvalid = makeFixture({ evidence: 'missing-evidence' });
+  try {
+    fs.mkdirSync(path.dirname(CACHE), { recursive: true });
+    fs.writeFileSync(CACHE, '{ malformed: ');
+    const body = parseBlock(runHook({}, dirInvalid).stdout);
+    assert.ok(body, 'malformed cache with invalid receipt must block');
+    assert.strictEqual(body.decision, 'block');
+  } finally {
+    fs.rmSync(dirInvalid, { recursive: true, force: true });
+  }
+});
+
+test('24. first-run (no cache file) with valid receipt passes and seeds cache', () => {
+  const dir = makeFixture({ evidence: 'valid' });
+  try {
+    clearCache();
+    assert.ok(!fs.existsSync(CACHE));
+    const { stdout } = runHook({}, dir);
+    assert.strictEqual(stdout, '', 'first run valid receipt must not block');
+    assert.ok(fs.existsSync(CACHE), 'cache must be created on first valid run');
+    assert.strictEqual(readCache()[FEATURE][TASK_REL], 'done');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});

package/src/claude/hooks/agent.cjs

@@ -6,7 +6,7 @@
  * Implements: https://docs.anthropic.com/en/docs/claude-code/hooks
  *
  * Fires when a subagent (Task tool) is spawned.
- * Injects lightweight context: language, rules, paths (~100 tokens).
+ * Injects lightweight context: language, paths, and skill venv guidance.
  *
  * Exit: 0 always (fail-open)
  */
@@ -19,8 +19,8 @@ try {
   function readRuntime(cwd) {
     try {
       const p = path.join(cwd, '.claude', 'runtime.json');
-      return fs.existsSync(p) ? JSON.parse(fs.readFileSync(p, 'utf8')) : {};
-    } catch { return {}; }
+      return fs.existsSync(p) ? JSON.parse(fs.readFileSync(p, 'utf8')) : null;
+    } catch { return null; }
   }
 
   /** Resolve Python venv executable path if it exists */
@@ -38,11 +38,11 @@ try {
   if (!stdin) process.exit(0);
 
   const payload    = JSON.parse(stdin);
-  const agentType  = payload.agent_type || 'unknown';
-  const agentId    = payload.agent_id   || 'unknown';
   // Use payload.cwd for monorepo support — subagent may run in a different dir
-  const agentCwd   = payload.cwd?.trim() || process.cwd();
+  const payloadCwd = typeof payload.cwd === 'string' ? payload.cwd.trim() : '';
+  const agentCwd   = payloadCwd || process.env.PROJECT_ROOT || process.cwd();
   const runtime    = readRuntime(agentCwd);
+  if (runtime === null) process.exit(0);
 
   // Language config from runtime.json
   const thinkLang    = runtime.locale?.thinkingLanguage || '';
@@ -51,17 +51,13 @@ try {
   const effectThink  = thinkLang || (respondLang ? 'en' : '');
 
   // Resolve paths from env (set by session.cjs) or runtime defaults
-  const baseDir    = process.env.PROJECT_ROOT || agentCwd;
+  const baseDir    = agentCwd;
   const plansPath  = path.join(baseDir, runtime.paths?.plans || 'plans');
   const docsPath   = path.join(baseDir, runtime.paths?.docs  || 'docs');
 
   // Build context block
   const lines = [];
 
-  lines.push(`## Subagent: ${agentType}`);
-  lines.push(`ID: ${agentId} | CWD: ${agentCwd}`);
-  lines.push('');
-
   // Language section (only if configured)
   const hasThink = effectThink && effectThink !== respondLang;
   if (hasThink || respondLang) {
@@ -74,11 +70,8 @@ try {
   // Python venv (optional — if .claude/skills/.venv exists)
   const venv = resolveVenv(agentCwd);
 
-  // Rules
   lines.push('## Rules');
   lines.push(`- Plans → ${plansPath}/ | Docs → ${docsPath}/`);
-  lines.push('- YAGNI · KISS · DRY');
-  lines.push('- Be concise. List unresolved questions at end.');
   if (venv) {
     lines.push(`- Python in .claude/skills/: use \`${venv}\``);
     lines.push('- Never use global pip install');

package/src/claude/hooks/rules.cjs

@@ -5,45 +5,42 @@
  * UserPromptSubmit Hook — rules.cjs
  * Implements: https://docs.anthropic.com/en/docs/claude-code/hooks
  *
- * Injects a lightweight rules reminder into Claude's context on each prompt.
- * Uses a per-session cooldown (5 min) to avoid repeating on every message.
+ * Injects project-specific rules once per session.
  *
  * Exit: 0 always (fail-open)
  */
 
 try {
+  const crypto = require('crypto');
   const fs   = require('fs');
   const os   = require('os');
   const path = require('path');
 
-  const COOLDOWN_MS = 5 * 60 * 1000; // 5 minutes
-
   function readRuntime(cwd) {
     try {
       const p = path.join(cwd, '.claude', 'runtime.json');
-      return fs.existsSync(p) ? JSON.parse(fs.readFileSync(p, 'utf8')) : {};
-    } catch { return {}; }
-  }
-
-  /** Check cooldown via temp file — returns true if injection was recent */
-  function recentlyInjected(sessionId) {
-    if (!sessionId) return false;
-    try {
-      const f = path.join(os.tmpdir(), `cafekit-rules-${sessionId}.json`);
-      if (!fs.existsSync(f)) return false;
-      const { ts } = JSON.parse(fs.readFileSync(f, 'utf8'));
-      return (Date.now() - ts) < COOLDOWN_MS;
-    } catch { return false; }
+      return fs.existsSync(p) ? JSON.parse(fs.readFileSync(p, 'utf8')) : null;
+    } catch { return null; }
   }
 
-  function markInjected(sessionId) {
-    if (!sessionId) return;
+  /** Reserve one injection slot per session. Returns null on reservation errors. */
+  function reserveSession(sessionId) {
+    if (!sessionId) return null;
     try {
-      fs.writeFileSync(
-        path.join(os.tmpdir(), `cafekit-rules-${sessionId}.json`),
-        JSON.stringify({ ts: Date.now() })
-      );
-    } catch { /* fail-open */ }
+      const key = crypto.createHash('sha256')
+        .update(String(sessionId))
+        .digest('hex')
+        .slice(0, 16);
+      const file = path.join(os.tmpdir(), `cafekit-rules-${key}.json`);
+      fs.writeFileSync(file, JSON.stringify({ sessionId: String(sessionId) }), {
+        encoding: 'utf8',
+        flag: 'wx',
+        mode: 0o600
+      });
+      return true;
+    } catch (error) {
+      return error.code === 'EEXIST' ? false : null;
+    }
   }
 
   // ── Main ──────────────────────────────────────────────────────────────────
@@ -53,11 +50,14 @@ try {
 
   const payload   = JSON.parse(stdin);
   const sessionId = payload.session_id || null;
-  const cwd       = payload.cwd || process.cwd();
+  const payloadCwd = typeof payload.cwd === 'string' ? payload.cwd.trim() : '';
+  const cwd       = payloadCwd || process.env.PROJECT_ROOT || process.cwd();
 
-  if (recentlyInjected(sessionId)) process.exit(0);
+  // No session identity or reservation means no injection. Fail open.
+  if (reserveSession(sessionId) !== true) process.exit(0);
 
   const runtime = readRuntime(cwd);
+  if (runtime === null) process.exit(0);
 
   // Language
   const thinkLang   = runtime.locale?.thinkingLanguage || '';
@@ -65,14 +65,13 @@ try {
   const effectThink = thinkLang || (respondLang ? 'en' : '');
 
   // Paths
-  const baseDir   = process.env.PROJECT_ROOT || cwd;
+  const baseDir   = cwd;
   const plansPath = path.join(baseDir, runtime.paths?.plans || 'plans');
   const docsPath  = path.join(baseDir, runtime.paths?.docs  || 'docs');
   const maxLoc    = runtime.docs?.maxLoc || 800;
 
   const lines = [];
 
-  // Language reminder
   const hasThink = effectThink && effectThink !== respondLang;
   if (hasThink || respondLang) {
     lines.push('## Language');
@@ -81,33 +80,14 @@ try {
     lines.push('');
   }
 
-  // Rules reminder
-  lines.push('## Rules');
-  lines.push(`- Markdown files: Plans → "${plansPath}/" | Docs → "${docsPath}/"`);
-  lines.push(`- **DO NOT** create markdown files outside of those directories unless explicitly asked.`);
-  lines.push(`- docs.maxLoc: ${maxLoc} lines max per doc file`);
-  lines.push('- Follow **YAGNI · KISS · DRY** principles');
-  lines.push('- Sacrifice grammar for concision in reports. List unresolved Qs at end.');
-  lines.push('- Ensure token efficiency while maintaining high quality.');
-  lines.push('');
-
-  // Skill routing: advisory rule docs, no automatic prompt router.
-  lines.push('## Skill Routing');
-  lines.push('- Choose skills from intent using `.claude/rules/skill-workflow-routing.md` and `.claude/rules/skill-domain-routing.md`.');
-  lines.push('- If needed, run `node .claude/scripts/generate-skill-catalog.cjs --skills` to inspect installed skills.');
-  lines.push('- Explicit user commands and direct-answer requests override routing suggestions.');
-  lines.push('');
-
-  // Modularization
-  lines.push('## [IMPORTANT] Consider Modularization:');
-  lines.push('- If a file exceeds 200 lines, consider splitting it');
-  lines.push('- Check existing modules before creating new ones');
-  lines.push('- Prefer kebab-case (JS/TS/Python/shell); PascalCase (C#/Java); snake_case (Go/Rust)');
-  lines.push('- Write descriptive code comments');
-  lines.push('- Skip modularization for: markdown, plain text, bash scripts, config files, .env files');
+  lines.push(
+    '## Rules',
+    `- Markdown files: Plans → "${plansPath}/" | Docs → "${docsPath}/"`,
+    '- **DO NOT** create markdown files outside of those directories unless explicitly asked.',
+    `- docs.maxLoc: ${maxLoc} lines max per doc file`
+  );
 
   console.log(lines.join('\n'));
-  markInjected(sessionId);
   process.exit(0);
 
 } catch (e) {