@haposoft/cafekit 0.16.0-rc.3 → 0.16.0-rc.4

package/bin/__tests__/installer-safety.test.js

@@ -23,6 +23,7 @@ const { upsertManagedCoreBlock } = require('../lib/instruction-blocks');
 const { upsertManagedCodexBlock, normalizeCodexBody } = require('../lib/codex-install');
 const { copyRecursive } = require('../lib/copy-utils');
 const { createTracker, sha256 } = require('../lib/manifest');
+const { copyManagedTree } = require('../lib/managed-writer');
 
 const START = '<!-- CAFEKIT CLAUDE START -->';
 const END = '<!-- CAFEKIT CLAUDE END -->';
@@ -672,6 +673,44 @@ test('managed targets and snapshots reject project symlink traversal', () => {
   });
 });
 
+test('managed tree copy rejects source and destination symlink traversal before writes', () => {
+  inTempProject((root) => {
+    const source = path.join(root, 'source');
+    const outsideSource = path.join(root, 'outside-source.txt');
+    const destination = path.join('.codex', 'payload');
+    fs.mkdirSync(source);
+    fs.writeFileSync(outsideSource, 'outside');
+    fs.symlinkSync(outsideSource, path.join(source, 'linked.txt'));
+    const ctx = {
+      dryRun: false,
+      options: { forceOverwrite: false },
+      ownership: {},
+      results: { preservedFiles: [] },
+    };
+    const copy = () => copyManagedTree({
+      src: source,
+      dest: destination,
+      platformFolder: '.codex',
+      ctx,
+      tracker: null,
+    });
+    assert.throws(copy, /source tree cannot contain symlinks/i);
+    assert.equal(fs.existsSync(destination), false);
+
+    fs.rmSync(path.join(source, 'linked.txt'));
+    fs.writeFileSync(path.join(source, 'safe.txt'), 'safe');
+    const outsideDestination = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-managed-outside-'));
+    try {
+      fs.symlinkSync(outsideDestination, path.join(root, '.codex'));
+      assert.throws(copy, /Refusing to follow symlinked managed path/);
+      assert.deepEqual(fs.readdirSync(outsideDestination), []);
+    } finally {
+      fs.rmSync(path.join(root, '.codex'), { force: true });
+      fs.rmSync(outsideDestination, { recursive: true, force: true });
+    }
+  });
+});
+
 test('managed Claude Addressing survives force refresh when template drops it', () => {
   inTempProject(() => {
     const before = '# User preface\n\n';

package/bin/__tests__/opencode-spec-gate.test.js

@@ -47,6 +47,7 @@ function ensureSharedValidator(tmp) {
   const sources = [
     ['workflow-policy.cjs', path.join(PACKAGE_ROOT, 'src/claude/scripts/workflow-policy.cjs')],
     ['spec-resolver.cjs', path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-resolver.cjs')],
+    ['provenance.cjs', path.join(PACKAGE_ROOT, 'src/claude/scripts/provenance.cjs')],
   ];
   const dests = [
     path.join(tmp, '.opencode', 'scripts'),
@@ -66,7 +67,7 @@ test('OpenCode SpecGate lists multiple active candidates and does not pick first
     fs.mkdirSync(specsDir, { recursive: true });
     for (const name of ['alpha', 'beta']) {
       fs.mkdirSync(path.join(specsDir, name), { recursive: true });
-      fs.writeFileSync(path.join(specsDir, name, 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'design', task_registry: {} }));
+      fs.writeFileSync(path.join(specsDir, name, 'spec.json'), JSON.stringify({ feature_name: name, status: 'in_progress', current_phase: 'design', task_registry: {} }));
     }
     const out = path.join(tmp, 'plugins', 'spec-gate.mjs');
     compileToMjs(GATE_SRC, out);
@@ -109,6 +110,7 @@ test('OpenCode installed gate reports missing and malformed shared policy as con
     }
     fs.mkdirSync(path.join(tmp, 'specs', 'demo', 'tasks'), { recursive: true });
     fs.writeFileSync(path.join(tmp, 'specs', 'demo', 'spec.json'), JSON.stringify({
+      feature_name: 'demo',
       status: 'in_progress',
       task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } },
     }));
@@ -145,6 +147,7 @@ test('OpenCode hard-blocks completion tools with a controlled result and allows
     const taskDir = path.join(tmp, 'specs', 'demo', 'tasks');
     fs.mkdirSync(taskDir, { recursive: true });
     fs.writeFileSync(path.join(tmp, 'specs', 'demo', 'spec.json'), JSON.stringify({
+      feature_name: 'demo',
       status: 'in_progress',
       task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } },
     }));
@@ -183,7 +186,7 @@ test('OpenCode explicit feature/path target selects the requested spec and never
   try {
     for (const name of ['alpha', 'beta']) {
       fs.mkdirSync(path.join(tmp, 'specs', name), { recursive: true });
-      fs.writeFileSync(path.join(tmp, 'specs', name, 'spec.json'), JSON.stringify({ status: 'in_progress', task_registry: {} }));
+      fs.writeFileSync(path.join(tmp, 'specs', name, 'spec.json'), JSON.stringify({ feature_name: name, status: 'in_progress', task_registry: {} }));
     }
     const out = path.join(tmp, 'plugins', 'spec-gate.mjs');
     compileToMjs(GATE_SRC, out);
@@ -226,6 +229,7 @@ test('OpenCode adapter enforces declared task artifact SHA-256 with missing, inv
       const specsDir = path.join(tmp, 'specs');
       fs.mkdirSync(path.join(specsDir, 'artifact-demo', 'tasks'), { recursive: true });
       fs.writeFileSync(path.join(specsDir, 'artifact-demo', 'spec.json'), JSON.stringify({
+        feature_name: 'artifact-demo',
         status: 'in_progress',
         task_registry: {
           'tasks/task.md': {
@@ -276,8 +280,9 @@ test('OpenCode gate and state use the same configured external specs authority',
     const externalSpecs = path.join(tmp, 'external-specs');
     fs.mkdirSync(path.join(localSpecs, 'local'), { recursive: true });
     fs.mkdirSync(path.join(externalSpecs, 'remote', 'tasks'), { recursive: true });
-    fs.writeFileSync(path.join(localSpecs, 'local', 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'local' }));
+    fs.writeFileSync(path.join(localSpecs, 'local', 'spec.json'), JSON.stringify({ feature_name: 'local', status: 'in_progress', current_phase: 'local' }));
     fs.writeFileSync(path.join(externalSpecs, 'remote', 'spec.json'), JSON.stringify({
+      feature_name: 'remote',
       status: 'in_progress',
       current_phase: 'remote',
       task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } },
@@ -325,7 +330,7 @@ test('OpenCode SpecState injects multiple-active warning with candidates', async
     fs.mkdirSync(specsDir, { recursive: true });
     for (const name of ['alpha', 'beta']) {
       fs.mkdirSync(path.join(specsDir, name), { recursive: true });
-      fs.writeFileSync(path.join(specsDir, name, 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'design', task_registry: {} }));
+      fs.writeFileSync(path.join(specsDir, name, 'spec.json'), JSON.stringify({ feature_name: name, status: 'in_progress', current_phase: 'design', task_registry: {} }));
     }
     const out = path.join(tmp, 'plugins', 'spec-state.mjs');
     compileToMjs(STATE_SRC, out);
@@ -350,6 +355,7 @@ test('OpenCode SpecGate reports Exit:1 receipt as a completion failure', async (
     fs.mkdirSync(path.join(specsDir, 'demo', 'tasks'), { recursive: true });
     // Single active spec with done task but Exit 1 must remain incomplete.
     fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({
+      feature_name: 'demo',
       status: 'in_progress',
       current_phase: 'implement',
       task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } },
@@ -398,7 +404,7 @@ test('OpenCode SpecState single active injects tollgate block (not multiple)', a
   try {
     const specsDir = path.join(tmp, 'specs');
     fs.mkdirSync(path.join(specsDir, 'solo'), { recursive: true });
-    fs.writeFileSync(path.join(specsDir, 'solo', 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'design', task_registry: { 'tasks/a.md': { status: 'pending' } } }));
+    fs.writeFileSync(path.join(specsDir, 'solo', 'spec.json'), JSON.stringify({ feature_name: 'solo', status: 'in_progress', current_phase: 'design', task_registry: { 'tasks/a.md': { status: 'pending' } } }));
     const out = path.join(tmp, 'plugins', 'spec-state.mjs');
     compileToMjs(STATE_SRC, out);
     const { SpecState } = await import(pathToFileURL(out).href);
@@ -422,6 +428,7 @@ test('OpenCode tollgate cache binds canonical root, full session identity, and s
     for (const project of [projectA, projectB]) {
       fs.mkdirSync(path.join(project, 'specs', 'same'), { recursive: true });
       fs.writeFileSync(path.join(project, 'specs', 'same', 'spec.json'), JSON.stringify({
+        feature_name: 'same',
         status: 'in_progress',
         current_phase: 'design',
         task_registry: { 'tasks/task.md': { status: 'pending' } },
@@ -443,6 +450,7 @@ test('OpenCode tollgate cache binds canonical root, full session identity, and s
     fs.rmSync(path.join(projectA, 'specs', 'same'), { recursive: true, force: true });
     fs.mkdirSync(path.join(projectA, 'specs', 'other'), { recursive: true });
     fs.writeFileSync(path.join(projectA, 'specs', 'other', 'spec.json'), JSON.stringify({
+      feature_name: 'other',
       status: 'in_progress',
       current_phase: 'design',
       task_registry: { 'tasks/task.md': { status: 'pending' } },
@@ -479,7 +487,7 @@ test('OpenCode P0 regression: placeholder, explicit failure, artifact, symlink a
     try {
       const specsDir = path.join(tmp, 'specs');
       fs.mkdirSync(path.join(specsDir, 'demo', 'tasks'), { recursive: true });
-      fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'implement', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
+      fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ feature_name: 'demo', status: 'in_progress', current_phase: 'implement', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
       fs.writeFileSync(path.join(specsDir, 'demo', 'tasks', 'task.md'), ['# Task','','**Status:** done','','## Evidence','',body].join('\n'));
       const out = path.join(tmp, 'plugins', 'spec-gate.mjs');
       compileToMjs(GATE_SRC, out);
@@ -503,7 +511,7 @@ test('OpenCode P0 regression: placeholder, explicit failure, artifact, symlink a
     try {
       const specsDir = path.join(tmp, 'specs');
       fs.mkdirSync(path.join(specsDir, 'demo', 'tasks'), { recursive: true });
-      fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'implement', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
+      fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ feature_name: 'demo', status: 'in_progress', current_phase: 'implement', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
       fs.writeFileSync(path.join(specsDir, 'demo', 'tasks', 'task.md'), ['# Task','','**Status:** done','','## Evidence','','Verification: PASS','Command: npm run todo:test','Exit: 0',`Base: ${BASE_SHA}`,`Head: ${HEAD_SHA}`].join('\n'));
       const out = path.join(tmp, 'plugins', 'spec-gate.mjs');
       compileToMjs(GATE_SRC, out);
@@ -525,7 +533,7 @@ test('OpenCode P0 regression: placeholder, explicit failure, artifact, symlink a
     try {
       const specsDir = path.join(tmp, 'specs');
       fs.mkdirSync(path.join(specsDir, 'feat', 'tasks'), { recursive: true });
-      fs.writeFileSync(path.join(specsDir, 'feat', 'spec.json'), JSON.stringify({ status: 'in_progress', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
+      fs.writeFileSync(path.join(specsDir, 'feat', 'spec.json'), JSON.stringify({ feature_name: 'feat', status: 'in_progress', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
       const outside = path.join(tmp, 'outside-task.md');
       fs.writeFileSync(outside, `# Task\n\n**Status:** done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: ${BASE_SHA}\nHead: ${HEAD_SHA}\n`);
       const link = path.join(specsDir, 'feat', 'tasks', 'task.md');
@@ -552,7 +560,7 @@ test('OpenCode P0 regression: placeholder, explicit failure, artifact, symlink a
       const specsDir = path.join(tmp, 'specs');
       fs.mkdirSync(path.join(specsDir, 'good'), { recursive: true });
       fs.mkdirSync(path.join(specsDir, 'bad'), { recursive: true });
-      fs.writeFileSync(path.join(specsDir, 'good', 'spec.json'), JSON.stringify({ status: 'in_progress' }));
+      fs.writeFileSync(path.join(specsDir, 'good', 'spec.json'), JSON.stringify({ feature_name: 'good', status: 'in_progress' }));
       fs.writeFileSync(path.join(specsDir, 'bad', 'spec.json'), '{ malformed');
       const out = path.join(tmp, 'plugins', 'spec-state.mjs');
       compileToMjs(STATE_SRC, out);
@@ -572,10 +580,10 @@ test('OpenCode P0 regression: placeholder, explicit failure, artifact, symlink a
     try {
       const specsDir = path.join(tmp, 'specs');
       fs.mkdirSync(path.join(specsDir, 'valid'), { recursive: true });
-      fs.writeFileSync(path.join(specsDir, 'valid', 'spec.json'), JSON.stringify({ status: 'in_progress', task_registry: {} }));
+      fs.writeFileSync(path.join(specsDir, 'valid', 'spec.json'), JSON.stringify({ feature_name: 'valid', status: 'in_progress', task_registry: {} }));
       const outside = path.join(tmp, 'outside-spec');
       fs.mkdirSync(outside, { recursive: true });
-      fs.writeFileSync(path.join(outside, 'spec.json'), JSON.stringify({ status: 'in_progress' }));
+      fs.writeFileSync(path.join(outside, 'spec.json'), JSON.stringify({ feature_name: 'linked', status: 'in_progress' }));
       const link = path.join(specsDir, 'linked');
       fs.symlinkSync(outside, link);
       const out = path.join(tmp, 'plugins', 'spec-state.mjs');
@@ -596,7 +604,7 @@ test('OpenCode P0 regression: placeholder, explicit failure, artifact, symlink a
     try {
       const specsDir = path.join(tmp, 'specs');
       fs.mkdirSync(path.join(specsDir, 'demo', 'tasks'), { recursive: true });
-      fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'implement', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
+      fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ feature_name: 'demo', status: 'in_progress', current_phase: 'implement', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
       // Notes with failure handling should pass (not structured)
       fs.writeFileSync(path.join(specsDir, 'demo', 'tasks', 'task.md'), ['# Task','','**Status:** done','','## Evidence','','Verification: PASS','Command: pnpm test','Exit: 0',`Base: ${BASE_SHA}`,`Head: ${HEAD_SHA}`,'Notes: verifies failure handling'].join('\n'));
       const out = path.join(tmp, 'plugins', 'spec-gate.mjs');
@@ -639,7 +647,7 @@ test('OpenCode P0 regression: placeholder, explicit failure, artifact, symlink a
     try {
       const specsDir = path.join(tmp, 'specs');
       fs.mkdirSync(path.join(specsDir, 'demo', 'tasks'), { recursive: true });
-      fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'implement', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
+      fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ feature_name: 'demo', status: 'in_progress', current_phase: 'implement', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
       fs.writeFileSync(path.join(specsDir, 'demo', 'tasks', 'task.md'), ['# Task','','**Status:** done','','## Evidence','','Verification: PASS','Command: pnpm test','Exit: 0',`Base: ${BASE_SHA}`,`Head: ${HEAD_SHA}`].join('\n'));
       const out = path.join(tmp, 'plugins', 'spec-gate.mjs');
       compileToMjs(GATE_SRC, out);
@@ -661,7 +669,7 @@ test('OpenCode P0 regression: placeholder, explicit failure, artifact, symlink a
     try {
       const specsDir = path.join(tmp, 'specs');
       fs.mkdirSync(path.join(specsDir, 'feat', 'tasks'), { recursive: true });
-      fs.writeFileSync(path.join(specsDir, 'feat', 'spec.json'), JSON.stringify({ status: 'in_progress', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
+      fs.writeFileSync(path.join(specsDir, 'feat', 'spec.json'), JSON.stringify({ feature_name: 'feat', status: 'in_progress', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
       fs.writeFileSync(path.join(specsDir, 'feat', 'tasks', 'task.md'), ['# Task','','**Status:** done','','## Evidence','','Verification: PASS','Command: pnpm test','Exit: 0',`Base: ${BASE_SHA}`,`Head: ${HEAD_SHA}`].join('\n'));
       const out = path.join(tmp, 'plugins', 'spec-gate.mjs');
       compileToMjs(GATE_SRC, out);
@@ -714,7 +722,7 @@ test('OpenCode P0 phantom vectors via installed shared validator (r3)', async ()
     try {
       const specsDir = path.join(tmp, 'specs');
       fs.mkdirSync(path.join(specsDir, 'demo', 'tasks'), { recursive: true });
-      fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'implement', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
+      fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ feature_name: 'demo', status: 'in_progress', current_phase: 'implement', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
       fs.writeFileSync(path.join(specsDir, 'demo', 'tasks', 'task.md'), ['# Task','','**Status:** done','','## Evidence','','Verification: PASS','Command: pnpm test','Exit: 0',`Base: ${BASE_SHA}`,`Head: ${HEAD_SHA}`, v].join('\n'));
       const out = path.join(tmp, 'plugins', 'spec-gate.mjs');
       compileToMjs(GATE_SRC, out);
@@ -758,7 +766,7 @@ test('OpenCode P0 phantom vectors via installed shared validator (r3)', async ()
     try {
       const specsDir = path.join(tmp, 'specs');
       fs.mkdirSync(path.join(specsDir, 'demo', 'tasks'), { recursive: true });
-      fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'implement', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
+      fs.writeFileSync(path.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ feature_name: 'demo', status: 'in_progress', current_phase: 'implement', task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } } }));
       fs.writeFileSync(path.join(specsDir, 'demo', 'tasks', 'task.md'), [
         '# Task',
         '',