@haposoft/cafekit 0.16.0-rc.2 → 0.16.0-rc.4

package/bin/__tests__/codex-hooks.test.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const assert = require('node:assert/strict');
+const crypto = require('node:crypto');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
@@ -9,11 +10,19 @@ const { test } = require('node:test');
 
 const PACKAGE_ROOT = path.join(__dirname, '../..');
 const CODEX_HOOKS = path.join(PACKAGE_ROOT, 'src/codex/hooks');
+const PROVENANCE = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/provenance.cjs'));
+const POLICY = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/workflow-policy.cjs'));
+const VALID_BASE = '0123456789abcdef0123456789abcdef01234567';
+const VALID_HEAD = '89abcdef0123456789abcdef0123456789abcdef';
 const { stateDir: codexStateDir } = require(
   path.join(CODEX_HOOKS, 'lib', 'state-store.cjs')
 );
 
 function runHook(file, cwd, payload) {
+  if (path.basename(file) === 'spec-gate.cjs') {
+    const rootResult = spawnSync('git', ['-C', cwd, 'rev-parse', '--show-toplevel'], { encoding: 'utf8' });
+    if (rootResult.status === 0) installFeatureReceipts(rootResult.stdout.trim(), payload.session_id || 'session-a');
+  }
   return spawnSync(process.execPath, [file], {
     cwd,
     input: JSON.stringify(payload),
@@ -21,17 +30,98 @@ function runHook(file, cwd, payload) {
   });
 }
 
-function inHookFixture(run) {
+function runtimeContext(root, feature = 'auth', session = 'session-a') {
+  return PROVENANCE.deriveRuntimeContext({
+    projectRoot: root,
+    specsRoot: path.join(root, 'specs'),
+    specFile: path.join(root, 'specs', feature, 'spec.json'),
+    featureName: feature,
+    runtimeSession: session,
+  });
+}
+
+function bindReceipt(root, value, feature = 'auth', session = 'session-a') {
+  const context = runtimeContext(root, feature, session);
+  return value.replaceAll(VALID_BASE, context.base).replaceAll(VALID_HEAD, context.head);
+}
+
+function installFeatureReceipts(root, session = 'session-a') {
+  const specsRoot = path.join(root, 'specs');
+  if (!fs.existsSync(specsRoot)) return;
+  for (const feature of fs.readdirSync(specsRoot)) {
+    const featureDir = path.join(specsRoot, feature);
+    const specFile = path.join(featureDir, 'spec.json');
+    if (!fs.existsSync(specFile)) continue;
+    let spec;
+    try { spec = JSON.parse(fs.readFileSync(specFile, 'utf8')); } catch { continue; }
+    const lifecyclePhase = spec.current_phase || spec.phase;
+    const explicitCloseout = ['completed', 'complete'].includes(spec.status)
+      || ['closeout', 'completion', 'completed', 'complete'].includes(lifecyclePhase);
+    if (!explicitCloseout) continue;
+    const tasks = Object.values(spec.task_registry || {});
+    if (tasks.length === 0 || tasks.some((task) => task.status !== 'done')) continue;
+    const context = runtimeContext(root, feature, session);
+    fs.writeFileSync(path.join(featureDir, 'feature-receipt.md'), [
+      `Feature: ${feature}`,
+      'Expected: final integration verification passes',
+      'Observed: final integration verification passed',
+      'Verification: PASS',
+      'Command: node --test',
+      'Exit: 0',
+      `Base: ${context.base}`,
+      `Head: ${context.head}`,
+      '',
+    ].join('\n'));
+  }
+}
+
+function inHookFixture(run, options = {}) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-hooks-'));
   const hooks = path.join(root, '.codex', 'hooks');
   try {
     fs.cpSync(CODEX_HOOKS, hooks, { recursive: true });
+    fs.copyFileSync(
+      path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/privacy-command-analysis.cjs'),
+      path.join(hooks, 'lib/privacy-command-analysis.cjs'),
+    );
+    fs.copyFileSync(
+      path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/runtime-path-safety.cjs'),
+      path.join(hooks, 'lib/runtime-path-safety.cjs'),
+    );
     fs.mkdirSync(path.join(root, '.codex', 'scripts'), { recursive: true });
+    if (options.policy !== 'missing') {
+      if (options.policy === 'malformed') {
+        fs.writeFileSync(path.join(root, '.codex', 'scripts', 'workflow-policy.cjs'), 'module.exports = {\n');
+      } else {
+        fs.copyFileSync(
+          path.join(PACKAGE_ROOT, 'src/claude/scripts/workflow-policy.cjs'),
+          path.join(root, '.codex', 'scripts', 'workflow-policy.cjs'),
+        );
+        fs.copyFileSync(
+          path.join(PACKAGE_ROOT, 'src/claude/scripts/provenance.cjs'),
+          path.join(root, '.codex', 'scripts', 'provenance.cjs'),
+        );
+        fs.copyFileSync(
+          path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-receipt.cjs'),
+          path.join(root, '.codex', 'scripts', 'spec-receipt.cjs'),
+        );
+      }
+    }
     fs.copyFileSync(
-      path.join(PACKAGE_ROOT, 'src/claude/scripts/workflow-policy.cjs'),
-      path.join(root, '.codex', 'scripts', 'workflow-policy.cjs'),
+      path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-resolver.cjs'),
+      path.join(root, '.codex', 'scripts', 'spec-resolver.cjs'),
     );
+    for (const file of ['validate-spec-output.cjs', 'spec-ground.cjs', 'spec-semantic-model.cjs', 'spec-final-state.cjs']) {
+      fs.copyFileSync(
+        path.join(PACKAGE_ROOT, 'src/claude/scripts', file),
+        path.join(root, '.codex', 'scripts', file),
+      );
+    }
     fs.writeFileSync(path.join(root, '.codex', 'scripts', 'spec-scaffold.cjs'), '');
+    for (const args of [['init', '-q'], ['config', 'user.email', 'cafekit@example.invalid'], ['config', 'user.name', 'CafeKit Test'], ['commit', '--allow-empty', '-qm', 'fixture']]) {
+      const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+      assert.equal(result.status, 0, result.stderr);
+    }
     return run(root, hooks);
   } finally {
     fs.rmSync(root, { recursive: true, force: true });
@@ -83,6 +173,14 @@ test('Codex privacy approval is exact, session-bound, and one-time', () => {
     });
     assert.match(wrongSession.stdout, /rejected/);
 
+    const padded = runHook(approve, nested, {
+      cwd: nested,
+      session_id: 'session-a',
+      hook_event_name: 'UserPromptSubmit',
+      prompt: ` ${prompt}\n`
+    });
+    assert.equal(padded.stdout, '', 'whitespace-padded prompt must not issue a token');
+
     const approved = runHook(approve, nested, {
       cwd: nested,
       session_id: 'session-a',
@@ -228,6 +326,7 @@ test('Codex completion gate cannot be bypassed from a nested cwd', () => {
     fs.mkdirSync(nested, { recursive: true });
     const spec = {
       status: 'in_progress',
+      feature_name: 'auth',
       task_registry: {
         [taskPath]: { status: 'pending', completed_at: null }
       }
@@ -254,10 +353,107 @@ test('Codex completion gate cannot be bypassed from a nested cwd', () => {
     fs.writeFileSync(path.join(feature, 'spec.json'), `${JSON.stringify(spec)}\n`);
     fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n');
 
-    const blocked = runHook(gate, nested, payload);
-    assert.equal(blocked.status, 0);
-    assert.equal(JSON.parse(blocked.stdout).decision, 'block');
-    assert.match(JSON.parse(blocked.stdout).reason, /verification receipt/);
+    const blockedBeforeCloseout = runHook(gate, nested, payload);
+    assert.equal(blockedBeforeCloseout.status, 0);
+    assert.equal(JSON.parse(blockedBeforeCloseout.stdout).decision, 'block');
+    assert.match(JSON.parse(blockedBeforeCloseout.stdout).reason, /verification receipt/);
+
+    fs.writeFileSync(path.join(feature, taskPath), bindReceipt(root, [
+      'Status: done', '', '## Evidence', '', 'Verification: PASS',
+      'Command: node --test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
+    ].join('\n'), 'auth'));
+    const validBeforeCloseout = runHook(gate, nested, payload);
+    assert.equal(validBeforeCloseout.status, 0);
+    assert.equal(validBeforeCloseout.stdout, '');
+    assert.equal(fs.existsSync(path.join(feature, 'feature-receipt.md')), false);
+
+    spec.current_phase = 'closeout';
+    fs.writeFileSync(path.join(feature, 'spec.json'), `${JSON.stringify(spec)}\n`);
+    const closeout = runHook(gate, nested, payload);
+    assert.equal(closeout.status, 0);
+    assert.equal(closeout.stdout, '');
+  });
+});
+
+test('empty or forged Codex hook authority fails closed', () => {
+  inHookFixture((root, hooks) => {
+    const gate = path.join(hooks, 'spec-gate.cjs');
+    for (const input of ['', 'null', '[]']) {
+      const result = spawnSync(process.execPath, [gate], {
+        cwd: root,
+        env: { ...process.env },
+        input,
+        encoding: 'utf8',
+      });
+      assert.equal(result.status, 0, `${JSON.stringify(input)}: ${result.stderr}`);
+      assert.equal(result.stderr, '');
+      const block = JSON.parse(result.stdout);
+      assert.equal(block.decision, 'block');
+      assert.match(block.reason, /hook payload (is empty|must be a JSON object)/i);
+    }
+
+    const feature = path.join(root, 'specs', 'auth');
+    const taskPath = 'tasks/task.md';
+    fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
+    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({
+      status: 'in_progress',
+      current_phase: 'closeout',
+      feature_name: 'auth',
+      task_registry: { [taskPath]: { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } },
+    }));
+    fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n');
+    fs.writeFileSync(path.join(root, '.codex', 'runtime.json'), JSON.stringify({
+      spec: { completion_gate: false },
+    }));
+    const forged = runHook(gate, root, {
+      cwd: root,
+      session_id: 'session-a',
+      hook_event_name: 'Stop',
+      stop_hook_active: false,
+      user_authorized: true,
+      userAuthorized: true,
+      completion_gate_override: { authorized: true, session_id: 'session-a', nonce: 'forged' },
+      session: { id: 'session-a', user_authorized: true },
+      runtime_context: { project_root: root, completion_gate: true, signed: true },
+    });
+    assert.equal(forged.status, 0);
+    const block = JSON.parse(forged.stdout);
+    assert.equal(block.decision, 'block');
+    assert.match(block.reason, /no completion-gate bypass is supported/i);
+  });
+});
+
+test('explicit Strict Codex completion ignores worker-writable proof strings and remains blocked', () => {
+  inHookFixture((root, hooks) => {
+    const feature = path.join(root, 'specs', 'auth');
+    const taskPath = 'tasks/task.md';
+    fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
+    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({
+      status: 'in_progress',
+      current_phase: 'closeout',
+      feature_name: 'auth',
+      workflow_policy: POLICY.workflowPolicySnapshot({ riskSignals: { auth: true }, assurance_level: 'Strict' }),
+      proofs: {
+        needsInspection: 'inspection completed',
+        needsIndependentAudit: 'PASS',
+        needsResearchGrounding: 'research completed',
+      },
+      task_registry: { [taskPath]: { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } },
+    }));
+    fs.writeFileSync(path.join(feature, taskPath), bindReceipt(root, [
+      'Status: done', '', '## Evidence', '', 'Verification: PASS',
+      'Command: node --test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
+    ].join('\n'), 'auth'));
+    const result = runHook(path.join(hooks, 'spec-gate.cjs'), root, {
+      cwd: root,
+      session_id: 'session-a',
+      hook_event_name: 'Stop',
+      stop_hook_active: false,
+    });
+    assert.equal(result.status, 0, result.stderr);
+    const block = JSON.parse(result.stdout);
+    assert.equal(block.decision, 'block');
+    assert.match(block.reason, /needsInspection|needsIndependentAudit|needsResearchGrounding/);
   });
 });
 
@@ -334,17 +530,35 @@ test('Codex state hook persists direct native event fields at project root', ()
   });
 });
 
+test('semantic review authority hook is registered only for SubagentStop on Claude and Codex', () => {
+  const configurations = [
+    JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'src/claude/settings/settings.json'), 'utf8')).hooks,
+    JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'src/codex/hooks.json'), 'utf8')).hooks,
+  ];
+  for (const hooks of configurations) {
+    const registrations = [];
+    for (const [event, groups] of Object.entries(hooks)) {
+      for (const group of groups) {
+        for (const hook of group.hooks || []) {
+          if (String(hook.command || '').includes('semantic-review-authority.cjs')) registrations.push(event);
+        }
+      }
+    }
+    assert.deepEqual(registrations, ['SubagentStop']);
+  }
+});
+
 test('Codex canonical receipt provenance requires both Base and Head', () => {
   const receipt = require(path.join(CODEX_HOOKS, 'lib', 'spec-receipt.cjs'));
   const onlyBase = receipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc\n');
   assert.ok(onlyBase.includes('provenance'), 'only Base should fail');
   const onlyHead = receipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nHead: def\n');
   assert.ok(onlyHead.includes('provenance'), 'only Head should fail');
-  const both = receipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc\nHead: def\n');
+  const both = receipt.validateCanonicalReceipt(`Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: ${VALID_BASE}\nHead: ${VALID_HEAD}\n`);
   assert.deepEqual(both, [], 'both Base and Head should pass');
   const onlyBaseSha = receipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha: abc\n');
   assert.ok(onlyBaseSha.includes('provenance'));
-  const bothSha = receipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha: abc\nhead_sha: def\n');
+  const bothSha = receipt.validateCanonicalReceipt(`Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha: ${VALID_BASE}\nhead_sha: ${VALID_HEAD}\n`);
   assert.deepEqual(bothSha, [], 'both base_sha and head_sha should pass');
   // Empty / bare provenance must fail — non-empty same-line value required
   const emptyBase = receipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase:\nHead: def\n');
@@ -361,9 +575,9 @@ test('Codex canonical receipt provenance requires both Base and Head', () => {
   assert.ok(spacesBaseSha.includes('provenance'), 'base_sha spaces only should fail');
   const bareBoth = receipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha head_sha\n');
   assert.ok(bareBoth.includes('provenance'), 'bare base_sha head_sha without colon should fail');
-  const validBaseHead = receipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc123\nHead: def456\n');
+  const validBaseHead = receipt.validateCanonicalReceipt(`Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: ${VALID_BASE}\nHead: ${VALID_HEAD}\n`);
   assert.deepEqual(validBaseHead, [], 'valid Base+Head with values should pass');
-  const validSha = receipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha: abc123\nhead_sha: def456\n');
+  const validSha = receipt.validateCanonicalReceipt(`Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha: ${VALID_BASE}\nhead_sha: ${VALID_HEAD}\n`);
   assert.deepEqual(validSha, [], 'valid base_sha+head_sha with values should pass');
 
   // Integration via spec-gate hook: only Base blocks, both passes
@@ -375,15 +589,15 @@ test('Codex canonical receipt provenance requires both Base and Head', () => {
     const payload = { cwd: path.join(root, 'packages', 'app'), session_id: 'session-a', hook_event_name: 'Stop', stop_hook_active: false };
 
     // only Base -> block
-    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({ status: 'in_progress', task_registry: { [taskPath]: { status: 'done', completed_at: '2026-07-29T10:00:00.000Z' } } }));
+    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'closeout', feature_name: 'auth', task_registry: { [taskPath]: { status: 'done', completed_at: '2026-07-29T10:00:00.000Z' } } }));
     fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc\n');
     fs.mkdirSync(payload.cwd, { recursive: true });
     const blocked = runHook(gate, payload.cwd, payload);
     assert.equal(JSON.parse(blocked.stdout).decision, 'block');
-    assert.match(JSON.parse(blocked.stdout).reason, /\bg\b|\bprovenance\b/);
+    assert.match(JSON.parse(blocked.stdout).reason, /\bprovenance\b/);
 
     // both -> no block
-    fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc\nHead: def\n');
+    fs.writeFileSync(path.join(feature, taskPath), bindReceipt(root, `Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: ${VALID_BASE}\nHead: ${VALID_HEAD}\n`));
     const passed = runHook(gate, payload.cwd, payload);
     assert.equal(passed.stdout, '');
 
@@ -392,14 +606,14 @@ test('Codex canonical receipt provenance requires both Base and Head', () => {
     fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase:\nHead: def\n');
     const blockedEmpty = runHook(gate, payload.cwd, payload);
     assert.equal(JSON.parse(blockedEmpty.stdout).decision, 'block');
-    assert.match(JSON.parse(blockedEmpty.stdout).reason, /\bg\b/);
+    assert.match(JSON.parse(blockedEmpty.stdout).reason, /\bprovenance\b/);
 
     // bare base_sha without colon should block — reset cache again
     try { fs.rmSync(path.join(root, '.codex', 'hooks', '.logs', 'spec-gate-last.json'), { force: true }); } catch {}
     fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha head_sha\n');
     const blockedBare = runHook(gate, payload.cwd, payload);
     assert.equal(JSON.parse(blockedBare.stdout).decision, 'block');
-    assert.match(JSON.parse(blockedBare.stdout).reason, /\bg\b/);
+    assert.match(JSON.parse(blockedBare.stdout).reason, /\bprovenance\b/);
   });
 });
 
@@ -413,16 +627,22 @@ test('Codex cache hardening: every done re-validated — mutation, deletion, mal
     fs.mkdirSync(appCwd, { recursive: true });
     const payload = { cwd: appCwd, session_id: 'session-a', hook_event_name: 'Stop', stop_hook_active: false };
     const cacheFile = path.join(root, '.codex', 'hooks', '.logs', 'spec-gate-last.json');
-    const validBody = 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc123\nHead: def456\n```\npass\n```\n';
+    const validBodyTemplate = [
+      'Status: done', '', '## Evidence', '', 'Verification: PASS',
+      'Command: pnpm test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
+      '```', 'pass', '```', '',
+    ].join('\n');
 
     // first-run (no cache) with valid receipt → no block, cache seeded
     try { fs.rmSync(cacheFile, { force: true }); } catch {}
-    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({ status: 'in_progress', task_registry: { [taskPath]: { status: 'done', completed_at: '2026-07-29T10:00:00.000Z' } } }));
+    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'closeout', feature_name: 'auth', task_registry: { [taskPath]: { status: 'done', completed_at: '2026-07-29T10:00:00.000Z' } } }));
+    const validBody = bindReceipt(root, validBodyTemplate);
     fs.writeFileSync(path.join(feature, taskPath), validBody);
     let res = runHook(gate, appCwd, payload);
     assert.equal(res.stdout, '', 'first-run valid should not block');
     assert.ok(fs.existsSync(cacheFile), 'cache file must be created on first valid run');
-    assert.equal(JSON.parse(fs.readFileSync(cacheFile, 'utf8')).auth[taskPath], 'done');
+    const cache = JSON.parse(fs.readFileSync(cacheFile, 'utf8'));
+    assert.equal(cache.entries[runtimeContext(root).context_id].tasks[taskPath], 'done');
 
     // cache-hit unchanged valid → still no block (revalidation passes)
     res = runHook(gate, appCwd, payload);
@@ -432,7 +652,7 @@ test('Codex cache hardening: every done re-validated — mutation, deletion, mal
     fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nExit: 0\nBase: abc123\nHead: def456\n```\npass\n```\n');
     res = runHook(gate, appCwd, payload);
     assert.equal(JSON.parse(res.stdout).decision, 'block', 'mutated receipt missing Verification/Command should block on cache-hit');
-    assert.match(JSON.parse(res.stdout).reason, /\bc\b|\be\b/);
+    assert.match(JSON.parse(res.stdout).reason, /\bverification_state\b|\bcommand\b/);
     // second hit still blocks
     res = runHook(gate, appCwd, payload);
     assert.equal(JSON.parse(res.stdout).decision, 'block', 'second hit after mutation still blocks');
@@ -443,7 +663,7 @@ test('Codex cache hardening: every done re-validated — mutation, deletion, mal
     fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc123\n```\npass\n```\n');
     res = runHook(gate, appCwd, payload);
     assert.equal(JSON.parse(res.stdout).decision, 'block');
-    assert.match(JSON.parse(res.stdout).reason, /\bg\b/);
+    assert.match(JSON.parse(res.stdout).reason, /\bprovenance\b/);
 
     // deletion → block with check a
     fs.writeFileSync(path.join(feature, taskPath), validBody);
@@ -469,3 +689,556 @@ test('Codex cache hardening: every done re-validated — mutation, deletion, mal
     assert.equal(JSON.parse(res.stdout).decision, 'block', 'malformed cache with invalid receipt must block');
   });
 });
+
+test('Codex cache identity separates same-feature receipts from different roots', () => {
+  const contexts = [];
+  for (let index = 0; index < 2; index += 1) {
+    const context = inHookFixture((root, hooks) => {
+      const feature = path.join(root, 'specs', 'auth');
+      const taskPath = 'tasks/task.md';
+      fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
+      fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({
+        status: 'in_progress',
+        feature_name: 'auth',
+        task_registry: { [taskPath]: { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } },
+      }));
+      fs.writeFileSync(path.join(feature, taskPath), bindReceipt(root, [
+        'Status: done', '', '## Evidence', '', 'Verification: PASS',
+        'Command: node --test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
+      ].join('\n')));
+      const result = runHook(path.join(hooks, 'spec-gate.cjs'), root, {
+        cwd: root,
+        session_id: 'session-a',
+        hook_event_name: 'Stop',
+        stop_hook_active: false,
+      });
+      assert.equal(result.stdout, '');
+      const cache = JSON.parse(fs.readFileSync(path.join(root, '.codex', 'hooks', '.logs', 'spec-gate-last.json'), 'utf8'));
+      const ids = Object.keys(cache.entries);
+      assert.equal(ids.length, 1);
+      assert.equal(cache.entries[ids[0]].identity.feature_name, 'auth');
+      return runtimeContext(root);
+    });
+    contexts.push(context);
+  }
+  assert.notEqual(contexts[0].context_id, contexts[1].context_id);
+});
+
+test('Codex P0 regression: placeholder, explicit failure, artifact, symlink and invalid_specs', () => {
+  const path2 = require('node:path');
+  const specReceipt = require(path2.join(__dirname, '../../src/codex/hooks/lib/spec-receipt.cjs'));
+  const specUtils = require(path2.join(__dirname, '../../src/codex/hooks/lib/spec-utils.cjs'));
+  const fs2 = require('node:fs');
+  const os2 = require('node:os');
+  // Probe A: Tests failed and multiple Results
+  assert.ok(specReceipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nTests failed: 1\n').length > 0);
+  assert.ok(specReceipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nResult: FAIL\nResult: PASS\n').includes('exit_result'));
+  // Probe B: placeholder tokens
+  assert.ok(specReceipt.validateCanonicalReceipt('Verification: PASS\nCommand: TODO\nExit: 0\nBase: a\nHead: b\n').includes('command'));
+  assert.ok(specReceipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: TBD\nHead: b\n').includes('provenance'));
+  assert.ok(specReceipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha: pending\nhead_sha: unknown\n').includes('provenance'));
+  assert.deepEqual(specReceipt.validateCanonicalReceipt(`Verification: PASS\nCommand: npm run todo:test\nExit: 0\nBase: ${VALID_BASE}\nHead: ${VALID_HEAD}\n`), []);
+  // Probe C: artifact
+  assert.ok(specReceipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nArtifact: x\nsha256: TBD\n').includes('artifact_hash'));
+  assert.ok(specReceipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nArtifact: x\nsha256: \n').includes('artifact_hash'));
+  assert.deepEqual(specReceipt.validateCanonicalReceipt(`Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: ${VALID_BASE}\nHead: ${VALID_HEAD}\nArtifact: bundle\nsha256: ${'a'.repeat(64)}\n`), []);
+  // Probe D/E: symlink spec/task
+  const tmp = fs2.mkdtempSync(path2.join(os2.tmpdir(), 'cafekit-codex-reg-'));
+  try {
+    const specsDir = path2.join(tmp, 'specs');
+    fs2.mkdirSync(specsDir, { recursive: true });
+    fs2.mkdirSync(path2.join(specsDir, 'valid'), { recursive: true });
+    fs2.writeFileSync(path2.join(specsDir, 'valid', 'spec.json'), JSON.stringify({ status: 'in_progress' }));
+    const outside = path2.join(tmp, 'outside');
+    fs2.mkdirSync(outside, { recursive: true });
+    fs2.writeFileSync(path2.join(outside, 'spec.json'), JSON.stringify({ status: 'in_progress' }));
+    const link = path2.join(specsDir, 'linked');
+    fs2.symlinkSync(outside, link);
+    assert.equal(specUtils.resolveActiveSpec(tmp, {}, 'linked', null).error, 'explicit_malformed');
+    assert.equal(specUtils.resolveActiveSpec(tmp, {}, null, path2.join(specsDir, 'linked', 'spec.json')).error, 'explicit_malformed');
+    // task symlink
+    const featDir = path2.join(specsDir, 'valid');
+    fs2.mkdirSync(path2.join(featDir, 'tasks'), { recursive: true });
+    const outsideTask = path2.join(tmp, 'outside-task.md');
+    fs2.writeFileSync(outsideTask, '# Task\n\n**Status:** done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\n');
+    const taskLink = path2.join(featDir, 'tasks', 'task.md');
+    fs2.symlinkSync(outsideTask, taskLink);
+    const fails = specReceipt.checkReceipt(featDir, 'tasks/task.md', { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' });
+    assert.ok(fails.includes('a'));
+    // malformed spec
+    fs2.mkdirSync(path2.join(specsDir, 'bad'), { recursive: true });
+    fs2.writeFileSync(path2.join(specsDir, 'bad', 'spec.json'), '{ bad');
+    const mal = specUtils.resolveActiveSpec(tmp, {}, null, null);
+    assert.equal(mal.error, 'invalid_specs');
+  } finally {
+    fs2.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('Codex adapter parity - phantom vectors via shared validator (r3)', () => {
+  const receipt = require(path.join(__dirname, '../../src/codex/hooks/lib/spec-receipt.cjs'));
+  const base = `Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: ${VALID_BASE}\nHead: ${VALID_HEAD}\n`;
+  const rejects = [
+    'Tests: 0 total',
+    'Test Suites: 1 failed, 1 total',
+    'FAIL ./foo.test.js',
+    'FAIL\tpackage',
+    'FAIL\texample.test/probe\t0.431s',
+    '--- FAIL: TestName (0.00s)',
+    'FAILED tests/test_demo.py::test_foo - assert 1 == 2',
+    'FAILED tests/test_demo.py',
+    'ERROR collecting tests/test_demo.py',
+    '# fail 1',
+    'ℹ fail 1',
+    'not ok 1 - test',
+    '[ERROR] Tests run: 5, Failures: 1, Errors: 0, Skipped: 0',
+    '[ERROR] Tests run: 5, Failures: 0, Errors: 1, Skipped: 0',
+    '[ERROR] Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:3.2.5:test',
+    'ℹ tests 0',
+    'collected 0 items',
+    '1 error in 0.12s',
+    'ℹ cancelled 1',
+  ];
+  for (const vector of rejects) {
+    assert.ok(receipt.validateCanonicalReceipt(base + vector + '\n').length > 0, `should reject via Codex: ${vector}`);
+  }
+  const passes = [
+    'Notes: handles error/failure',
+    'collected 1 item',
+    'Test Suites: 0 failed',
+    '[INFO] Tests run: 5, Failures: 0, Errors: 0, Skipped: 0',
+    '[ERROR] Tests run: 5, Failures: 0, Errors: 0, Skipped: 0',
+    '[ERROR] Error handling is documented',
+    'FAILURE mode analysis',
+    'Notes: tests failed previously but now fixed',
+  ];
+  for (const vector of passes) {
+    assert.deepEqual(receipt.validateCanonicalReceipt(base + vector + '\n'), [], `should pass via Codex: ${vector}`);
+  }
+
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-tap-heading-'));
+  try {
+    const featureDir = path.join(tmp, 'feature');
+    const taskPath = 'tasks/task.md';
+    fs.mkdirSync(path.join(featureDir, 'tasks'), { recursive: true });
+    const taskPrefix = ['# Task', '', '**Status:** done', '', '## Evidence', '', base.trim()];
+    fs.writeFileSync(path.join(featureDir, taskPath), [...taskPrefix, '# fail 1', ''].join('\n'));
+    const tapFailure = receipt.checkReceipt(featureDir, taskPath, { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' });
+    assert.ok(tapFailure.includes('c'), 'unindented TAP # fail 1 must reach the shared validator');
+
+    fs.writeFileSync(path.join(featureDir, taskPath), [...taskPrefix, '# Notes', 'FAILED tests/test_demo.py', ''].join('\n'));
+    const markdownBody = receipt.evidenceBody(fs.readFileSync(path.join(featureDir, taskPath), 'utf8'));
+    assert.doesNotMatch(markdownBody, /FAILED tests\/test_demo\.py/);
+    assert.deepEqual(receipt.validateCanonicalReceipt(markdownBody), [], 'a real Markdown heading must still end Evidence');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('installed Codex gate fails closed with a controlled decision when policy is missing or malformed', () => {
+  for (const policy of ['missing', 'malformed']) {
+    inHookFixture((root, hooks) => {
+      const result = runHook(path.join(hooks, 'spec-gate.cjs'), root, {
+        cwd: root,
+        session_id: 'session-a',
+        hook_event_name: 'Stop',
+        stop_hook_active: false,
+      });
+      assert.equal(result.status, 0, `${policy}: ${result.stderr}`);
+      assert.equal(result.stderr, '', `${policy} must not leak a stack trace`);
+      const block = JSON.parse(result.stdout);
+      assert.equal(block.decision, 'block');
+      assert.match(block.reason, /workflow policy could not be loaded/i);
+      assert.ok(fs.existsSync(path.join(hooks, '.logs', 'hook-log.jsonl')));
+    }, { policy });
+  }
+});
+
+test('Codex adapter enforces declared task artifact SHA-256 with missing, invalid, and valid evidence', () => {
+  const artifact = Buffer.from('cafekit codex fixture artifact\n');
+  const digest = crypto.createHash('sha256').update(artifact).digest('hex');
+  const cases = [
+    ['', true],
+    ['sha256: abc123\n', true],
+    [`sha256: ${'0'.repeat(64)}\n`, true],
+    [`sha256: ${digest}\n`, false],
+  ];
+  for (const [hashLine, shouldBlock] of cases) {
+    inHookFixture((root, hooks) => {
+      const feature = path.join(root, 'specs', 'artifact-demo');
+      const taskPath = 'tasks/task.md';
+      fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
+      fs.mkdirSync(path.join(root, 'output'), { recursive: true });
+      fs.writeFileSync(path.join(root, 'output', 'bundle.js'), artifact);
+      fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({
+        status: 'in_progress',
+        current_phase: 'closeout',
+        feature_name: 'artifact-demo',
+        task_registry: {
+          [taskPath]: {
+            status: 'done',
+            completed_at: '2026-08-11T00:00:00.000Z',
+            artifacts: ['output/bundle.js'],
+          },
+        },
+      }));
+      fs.writeFileSync(path.join(feature, taskPath), [
+        '# Task', '', '**Status:** done', '', '## Evidence', '',
+        'Verification: PASS', 'Command: node --test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
+        'Artifact: output/bundle.js', hashLine,
+      ].join('\n'));
+      fs.writeFileSync(
+        path.join(feature, taskPath),
+        bindReceipt(root, fs.readFileSync(path.join(feature, taskPath), 'utf8'), 'artifact-demo'),
+      );
+      const result = runHook(path.join(hooks, 'spec-gate.cjs'), root, {
+        cwd: root,
+        session_id: 'session-a',
+        hook_event_name: 'Stop',
+        stop_hook_active: false,
+      });
+      assert.equal(result.status, 0, result.stderr);
+      if (shouldBlock) {
+        const block = JSON.parse(result.stdout);
+        assert.equal(block.decision, 'block');
+        assert.match(block.reason, /\bartifact_hash\b/);
+      } else {
+        assert.equal(result.stdout, '');
+      }
+    });
+  }
+});
+
+test('Codex privacy denies obfuscated and session paths, allows benign', () => {
+  inHookFixture((root, hooks) => {
+    const block = path.join(hooks, 'privacy-block.cjs');
+    const denied = [
+      { command: "cat .e''nv", tool: 'exec_command' },
+      { command: "cat .codex/sessions/test.json", tool: 'exec_command' },
+      { command: "cat $HOME/.cafekit/completion-authority/hmac.key", tool: 'exec_command' },
+      { command: "cat .codex/sessions/abc.json", tool: 'Bash' },
+      { command: "python3 -c \"open('.env').read()\"", tool: 'exec_command' },
+      { command: "node -e \"fs.readFileSync('.env')\"", tool: 'Bash' },
+      { command: "bash -c 'cat .e''nv'", tool: 'exec_command' },
+      { command: "echo ok; cat .env", tool: 'Bash' },
+    ];
+    for (const { command, tool } of denied) {
+      const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
+      assert.equal(JSON.parse(res.stdout).hookSpecificOutput.permissionDecision, 'deny', command);
+    }
+    const allowed = [
+      { command: "echo hello", tool: 'exec_command' },
+      { command: "cat README.md", tool: 'exec_command' },
+      { command: "cat src/app.js", tool: 'Bash' },
+    ];
+    for (const { command, tool } of allowed) {
+      const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
+      assert.equal(res.stdout, '', command);
+    }
+  });
+});
+
+test('Codex privacy denies active read expansion, preserves literal dollars and safe controls', () => {
+  inHookFixture((root, hooks) => {
+    const block = path.join(hooks, 'privacy-block.cjs');
+    const denied = [
+      { command: "cat $FILE", tool: 'Bash' },
+      { command: 'cat "$FILE"', tool: 'exec_command' },
+      { command: "cat ${FILE}", tool: 'Bash' },
+      { command: "cat $1", tool: 'exec_command' },
+      { command: "cat $(echo .env)", tool: 'Bash' },
+      { command: "cat `echo .env`", tool: 'Bash' },
+      { command: "head $SECRET", tool: 'exec_command' },
+      { command: "tail ${MY_FILE}", tool: 'Bash' },
+      { command: "cat README.md $EXTRA", tool: 'Bash' },
+      { command: "head README.md $UNRELATED", tool: 'exec_command' },
+      { command: "echo ok; cat README.md $FILE", tool: 'Bash' },
+      { command: "cat README.md | head $FILE", tool: 'exec_command' },
+      { command: "bash -c 'cat $FILE'", tool: 'Bash' },
+      { command: "echo $(cat $FILE)", tool: 'exec_command' },
+      { command: 'cat README.md "$(printf safe)"', tool: 'Bash' },
+      { command: 'cat README.md *', tool: 'Bash' },
+      { command: 'cat README.md ~/README.md', tool: 'exec_command' },
+      { command: 'cat README.md {README.md,LICENSE}', tool: 'Bash' },
+      { command: 'cat .e\\\nnv', tool: 'Bash' },
+      { command: "cat $'\\x2e\\x65\\x6e\\x76'", tool: 'exec_command' },
+      { command: 'env -u UNUSED cat "$FILE"', tool: 'Bash' },
+      { command: 'timeout 1 cat "$FILE"', tool: 'exec_command' },
+      { command: 'nice -n 10 cat "$FILE"', tool: 'Bash' },
+      { command: "eval 'cat \"$FILE\"'", tool: 'exec_command' },
+      { command: "find . -exec sh -c 'cat \"$FILE\"' \\;", tool: 'Bash' },
+      { command: 'source "$FILE"', tool: 'exec_command' },
+      { command: 'xargs -a "$LIST" cat', tool: 'Bash' },
+      { command: 'python3 -c \'open(os.environ["FILE"]).read()\'', tool: 'exec_command' },
+      { command: 'node -e \'fs.readFileSync(process.env.FILE)\'', tool: 'Bash' },
+      { command: 'cat < "$FILE"', tool: 'exec_command' },
+    ];
+    for (const { command, tool } of denied) {
+      const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
+      assert.equal(JSON.parse(res.stdout).hookSpecificOutput.permissionDecision, 'deny', `should deny ${command}`);
+    }
+    const allowed = [
+      { command: "echo $VAR", tool: 'exec_command' },
+      { command: 'echo "$HOME"', tool: 'Bash' },
+      { command: "git status", tool: 'exec_command' },
+      { command: "git status $VAR", tool: 'Bash' },
+      { command: "cat README.md", tool: 'exec_command' },
+      { command: "cat .env.example", tool: 'Bash' },
+      { command: "cat .env.sample", tool: 'Bash' },
+      { command: "cat .env.template", tool: 'exec_command' },
+      { command: "cat .env.test", tool: 'Bash' },
+      { command: "cat '$FILE'", tool: 'exec_command' },
+      { command: "cat '$HOME/README.md'", tool: 'Bash' },
+      { command: "cat README.md '$EXTRA'", tool: 'exec_command' },
+      { command: "echo '$(cat $FILE)'", tool: 'Bash' },
+      { command: 'echo .envoy', tool: 'exec_command' },
+      { command: 'echo not.env', tool: 'Bash' },
+      { command: 'echo .env', tool: 'exec_command' },
+      { command: "printf '%s\\n' .env", tool: 'Bash' },
+      { command: 'git status sessions.md', tool: 'exec_command' },
+      { command: 'python3 -c "print(os.environ[\'HOME\'])"', tool: 'Bash' },
+      { command: 'head -n "$COUNT" README.md', tool: 'exec_command' },
+      { command: 'grep .env README.md', tool: 'Bash' },
+      { command: "sed -n '/.env/p' README.md", tool: 'exec_command' },
+    ];
+    for (const { command, tool } of allowed) {
+      const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
+      assert.equal(res.stdout, '', `should allow ${command}`);
+    }
+    const assignmentOnly = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat README.md' } });
+    assert.equal(assignmentOnly.stdout, '');
+    const assignmentRead = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat "$FILE"' } });
+    assert.equal(JSON.parse(assignmentRead.stdout).hookSpecificOutput.permissionDecision, 'deny');
+  });
+});
+
+test('Claude and Codex privacy lexers agree on literals, delimiters, and quote expansion', () => {
+  inHookFixture((root, hooks) => {
+    const claude = path.join(PACKAGE_ROOT, 'src/claude/hooks/privacy-block.cjs');
+    const codex = path.join(hooks, 'privacy-block.cjs');
+    const vectors = [
+      ["cat .e''nv", true],
+      ["python3 -c \"open('.env').read()\"", true],
+      ['cat README.md $FILE', true],
+      ['echo ok; cat README.md $FILE', true],
+      ["cat '$FILE'", false],
+      ["echo '$(cat $FILE)'", false],
+      ["cat README.md '*'", false],
+      ["cat README.md '~'", false],
+      ["cat README.md '{README.md,LICENSE}'", false],
+      ['cat .env.example', false],
+      ['echo .envoy', false],
+      ['cat .e\\\nnv', true],
+      ["cat $'\\x2e\\x65\\x6e\\x76'", true],
+      ['env -u UNUSED cat "$FILE"', true],
+      ['timeout 1 cat "$FILE"', true],
+      ["eval 'cat \"$FILE\"'", true],
+      ["find . -exec sh -c 'cat \"$FILE\"' \\;", true],
+      ['source "$FILE"', true],
+      ['xargs -a "$LIST" cat', true],
+      ['python3 -c \'open(os.environ["FILE"]).read()\'', true],
+      ['echo .env', false],
+      ["printf '%s\\n' .env", false],
+      ['git status sessions.md', false],
+      ['python3 -c "print(os.environ[\'HOME\'])"', false],
+    ];
+    for (const [command, blocked] of vectors) {
+      const payload = { cwd: root, hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command } };
+      const stateDir = path.join(hooks, '.privacy');
+      const pendingCount = () => fs.existsSync(stateDir)
+        ? fs.readdirSync(stateDir).filter((name) => name.startsWith('pending-')).length
+        : 0;
+      const beforePending = pendingCount();
+      const claudeResult = runHook(claude, root, payload);
+      const codexResult = runHook(codex, root, { ...payload, session_id: `parity-${command}` });
+      const claudeOutput = claudeResult.stdout.trim() ? JSON.parse(claudeResult.stdout) : null;
+      const codexOutput = codexResult.stdout.trim() ? JSON.parse(codexResult.stdout) : null;
+      assert.equal(claudeOutput?.hookSpecificOutput?.permissionDecision || null, blocked ? 'ask' : null, `Claude parity vector: ${command}`);
+      assert.equal(codexOutput?.hookSpecificOutput?.permissionDecision || null, blocked ? 'deny' : null, `Codex parity vector: ${command}`);
+      if (blocked) {
+        assert.equal(claudeOutput.hookSpecificOutput.hookEventName, 'PreToolUse');
+        assert.equal(codexOutput.hookSpecificOutput.hookEventName, 'PreToolUse');
+        assert.ok(claudeOutput.hookSpecificOutput.permissionDecisionReason);
+        assert.ok(codexOutput.hookSpecificOutput.permissionDecisionReason);
+      }
+      assert.equal(pendingCount() - beforePending, blocked ? 1 : 0, `Codex approval-state side effect: ${command}`);
+    }
+  });
+});
+
+test('Codex privacy handles dangling symlink to protected target (and allows benign/example)', () => {
+  inHookFixture((root, hooks) => {
+    const block = path.join(hooks, 'privacy-block.cjs');
+    // Create .env and dangling link
+    const env = path.join(root, '.env');
+    fs.writeFileSync(env, 'SECRET=1');
+    const link = path.join(root, 'innocent.txt');
+    fs.symlinkSync(env, link);
+    fs.unlinkSync(env);
+    const denied = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: link } });
+    assert.equal(JSON.parse(denied.stdout).hookSpecificOutput.permissionDecision, 'deny', 'dangling to .env must deny');
+
+    // Dangling benign
+    const benign = path.join(root, 'benign.txt');
+    fs.writeFileSync(benign, 'hi');
+    const dangling = path.join(root, 'dangling.txt');
+    fs.symlinkSync(benign, dangling);
+    fs.unlinkSync(benign);
+    const allowed1 = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: dangling } });
+    assert.equal(allowed1.stdout, '', 'dangling benign should allow');
+
+    // Dangling to .env.example
+    const example = path.join(root, '.env.example');
+    fs.writeFileSync(example, 'EXAMPLE=1');
+    const linkExample = path.join(root, 'link-example.txt');
+    fs.symlinkSync(example, linkExample);
+    fs.unlinkSync(example);
+    const allowed2 = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: linkExample } });
+    assert.equal(allowed2.stdout, '', 'dangling to .env.example should allow');
+
+    // Real link to allowed example remains allowed
+    fs.writeFileSync(example, 'EXAMPLE=1');
+    const realLink = path.join(root, 'real-example.txt');
+    if (fs.existsSync(realLink)) fs.unlinkSync(realLink);
+    // remove previous dangling if exists
+    try { fs.unlinkSync(linkExample); } catch {}
+    fs.symlinkSync(example, realLink);
+    const allowed3 = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: realLink } });
+    assert.equal(allowed3.stdout, '', 'real link to .env.example should allow');
+
+    // Looping symlink fails closed
+    const a = path.join(root, 'loop-a');
+    const b = path.join(root, 'loop-b');
+    try { fs.unlinkSync(a); } catch {}
+    try { fs.unlinkSync(b); } catch {}
+    fs.symlinkSync(b, a);
+    fs.symlinkSync(a, b);
+    const looped = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: a } });
+    assert.equal(JSON.parse(looped.stdout).hookSpecificOutput.permissionDecision, 'deny', 'looping symlink should deny');
+  });
+});
+
+test('Codex privacy apply_patch with temp fixtures respects sensitive vs safe', () => {
+  inHookFixture((root, hooks) => {
+    const block = path.join(hooks, 'privacy-block.cjs');
+    const safePatch = '*** Begin Patch\n*** Update File: README.md\n+hi\n*** End Patch\n';
+    const safeRes = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'apply_patch', tool_input: { patch: safePatch } });
+    assert.equal(safeRes.stdout, '', 'safe patch should allow');
+    const sensitivePatch = '*** Begin Patch\n*** Update File: .env\n+SECRET=x\n*** End Patch\n';
+    const denied = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'apply_patch', tool_input: { patch: sensitivePatch } });
+    assert.equal(JSON.parse(denied.stdout).hookSpecificOutput.permissionDecision, 'deny');
+  });
+});
+
+test('Codex hook-context canonicalizes symlink project root (regression)', () => {
+  inHookFixture((root, hooks) => {
+    const hookContextPath = path.join(hooks, 'lib', 'hook-context.cjs');
+    const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-symroot-'));
+    try {
+      const linkRoot = path.join(outside, 'link-project');
+      fs.symlinkSync(root, linkRoot);
+      // Require the installed hook-context via the symlink path to see PROJECT_ROOT canonicalization
+      const linkedContext = require(path.join(linkRoot, '.codex', 'hooks', 'lib', 'hook-context.cjs'));
+      const realRoot = fs.realpathSync(root);
+      assert.equal(linkedContext.PROJECT_ROOT, realRoot, 'PROJECT_ROOT should be canonicalized via realpath');
+      // getHookContext should still work with cwd inside symlink root
+      const payload = { cwd: linkRoot, session_id: 's1' };
+      const ctx = linkedContext.getHookContext(payload);
+      assert.equal(ctx.projectRoot, realRoot);
+      assert.ok(ctx.sessionCwd, 'sessionCwd should be resolved');
+    } finally {
+      fs.rmSync(outside, { recursive: true, force: true });
+      // Clear require cache for the symlink context to avoid polluting other tests
+      Object.keys(require.cache).forEach((k) => { if (k.includes('link-project')) delete require.cache[k]; });
+    }
+  });
+});
+
+test('Codex resolver and state reject symlink escape', () => {
+  inHookFixture((root, hooks) => {
+    const specUtils = require(path.join(hooks, 'lib', 'spec-utils.cjs'));
+    const resolverPath = path.join(root, '.codex', 'scripts', 'spec-resolver.cjs');
+    const linkTarget = path.join(root, 'external.js');
+    fs.writeFileSync(linkTarget, 'module.exports = {}');
+    const original = fs.readFileSync(resolverPath);
+    fs.unlinkSync(resolverPath);
+    fs.symlinkSync(linkTarget, resolverPath);
+    assert.throws(() => specUtils.specsDirectory(root, {}), /symlink|rejected/i);
+    fs.unlinkSync(resolverPath);
+    fs.writeFileSync(resolverPath, original);
+    const scripts = path.dirname(resolverPath);
+    const outsideScripts = fs.mkdtempSync(path.join(os.tmpdir(), 'codex-scripts-outside-'));
+    try {
+      fs.cpSync(scripts, outsideScripts, { recursive: true });
+      fs.rmSync(scripts, { recursive: true, force: true });
+      fs.symlinkSync(outsideScripts, scripts);
+      assert.throws(() => specUtils.specsDirectory(root, {}), /symlink|trusted root|rejected/i);
+    } finally {
+      try { fs.unlinkSync(scripts); } catch {}
+      fs.mkdirSync(scripts, { recursive: true });
+      fs.copyFileSync(
+        path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-resolver.cjs'),
+        path.join(scripts, 'spec-resolver.cjs'),
+      );
+      fs.rmSync(outsideScripts, { recursive: true, force: true });
+    }
+    // State dir symlink escape: create symlink for session-state dir
+    const stateStore = require(path.join(hooks, 'lib', 'state-store.cjs'));
+    const sessionId = 'sess-symlink';
+    const dir = stateStore.stateDir(root, sessionId);
+    fs.mkdirSync(path.dirname(dir), { recursive: true });
+    // Create a symlink that points outside project
+    const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'outside-'));
+    try {
+      if (fs.existsSync(dir)) fs.rmSync(dir, { recursive: true, force: true });
+      fs.symlinkSync(outside, dir);
+      // withStateLock should handle symlink safely (no crash, no write outside)
+      const ok = stateStore.withStateLock(root, sessionId, () => {});
+      assert.equal(typeof ok, 'boolean');
+    } finally {
+      try { fs.unlinkSync(dir); } catch {}
+      fs.rmSync(outside, { recursive: true, force: true });
+    }
+  });
+});
+
+test('Codex privacy state rejects a symlinked state directory without external writes', () => {
+  inHookFixture((root, hooks) => {
+    const block = path.join(hooks, 'privacy-block.cjs');
+    const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'codex-privacy-outside-'));
+    const state = path.join(hooks, '.privacy');
+    try {
+      fs.symlinkSync(outside, state);
+      const result = runHook(block, root, {
+        cwd: root,
+        session_id: 'state-symlink',
+        hook_event_name: 'PreToolUse',
+        tool_name: 'Read',
+        tool_input: { file_path: path.join(root, '.env') },
+      });
+      const output = JSON.parse(result.stdout);
+      assert.equal(output.hookSpecificOutput.permissionDecision, 'deny');
+      assert.match(output.hookSpecificOutput.permissionDecisionReason, /could not be evaluated safely/i);
+      assert.deepEqual(fs.readdirSync(outside), []);
+    } finally {
+      try { fs.unlinkSync(state); } catch {}
+      fs.rmSync(outside, { recursive: true, force: true });
+    }
+  });
+});
+
+test('Claude and Codex fail closed consistently for malformed cwd payloads', () => {
+  inHookFixture((root, hooks) => {
+    const payload = {
+      cwd: 123,
+      session_id: 'malformed-cwd',
+      hook_event_name: 'PreToolUse',
+      tool_name: 'Read',
+      tool_input: { file_path: path.join(root, '.env') },
+    };
+    const claude = runHook(path.join(PACKAGE_ROOT, 'src/claude/hooks/privacy-block.cjs'), root, payload);
+    const codex = runHook(path.join(hooks, 'privacy-block.cjs'), root, payload);
+    assert.equal(JSON.parse(claude.stdout).hookSpecificOutput.permissionDecision, 'ask');
+    assert.equal(JSON.parse(codex.stdout).hookSpecificOutput.permissionDecision, 'deny');
+  });
+});