@haposoft/cafekit 0.16.0-rc.3 → 0.16.0-rc.5

package/src/claude/hooks/__tests__/privacy-block.test.js

@@ -98,12 +98,20 @@ test('an exempt-looking symlink to .env still asks based on its target', () => {
   }
 });
 
+// A secret named in a read operand the analyzer can resolve, however it is
+// spelled: quoted, concatenated, line-continued, ANSI-C escaped, or reached
+// through a nested shell or inline runtime.
 for (const command of [
   'cat ".env"',
   'cat .env',
   'cat .env*',
   'sed -n 1p .env',
   "bash -c 'sed -n 1p .env'",
+  "python3 -c \"open('.env').read()\"",
+  "node -e \"fs.readFileSync('.env')\"",
+  "bash -c 'cat .e''nv'",
+  'cat .e\\\nnv',
+  "cat $'\\x2e\\x65\\x6e\\x76'",
 ]) {
   test(`asks natively for Bash sensitive reference: ${command}`, () => {
     const dir = tmpDir();
@@ -117,3 +125,249 @@ for (const command of [
     }
   });
 }
+
+// --- Shapes the command analyzer cannot return ---
+// It drops any word carrying an expansion, and it only walks readers it
+// recognises. A sensitive name still has to be caught when it arrives with a
+// glob or `~`, or when an unknown tool is handed it through a file-shaped
+// option.
+for (const command of [
+  'cat ~/.ssh/id_rsa',
+  'cat ~/.aws/credentials',
+  'cat certs/*.pem',
+  'ssh -i ~/.ssh/id_ed25519 host',
+  'docker compose --env-file .env up',
+  'curl --config ~/.netrc https://example.com',
+  'kubectl --kubeconfig ~/.kube/kubeconfig get pods',
+  'openssl rsa -in server.key',
+  'cat secrets.yaml',
+]) {
+  test(`asks for sensitive name via expansion or file-shaped option: ${command}`, () => {
+    const dir = tmpDir();
+    try {
+      const { code, stdout } = runHook({ tool_name: 'Bash', tool_input: { command } }, dir);
+      assert.strictEqual(code, 0);
+      assert.strictEqual(permissionDecision(stdout), 'ask', `should ask for ${command}`);
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+}
+
+// --- Naming a secret is not reading one (fix: 740798c) ---
+// The analyzer returns the operands of readers it recognises. A command that
+// only spells a secret's name -- an echo, a grep pattern, a pathspec -- reads
+// nothing, and asking there is the noise that trains people to click through
+// the prompt that matters.
+for (const command of [
+  'echo .env',
+  'echo "update .env"',
+  'echo .envoy',
+  'echo not.env',
+  "printf '%s\\n' .env",
+  'git log -- .env',
+  'git status sessions.md',
+  'grep .env README.md',
+  "sed -n '/.env/p' README.md",
+]) {
+  test(`allows naming a secret without reading it: ${command}`, () => {
+    const dir = tmpDir();
+    try {
+      fs.writeFileSync(path.join(dir, 'README.md'), 'hi');
+      const { stdout } = runHook({ tool_name: 'Bash', tool_input: { command } }, dir);
+      assert.strictEqual(permissionDecision(stdout), null, `should allow ${command}`);
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+}
+
+// --- Accepted gap: pure indirection ---
+// The target of `$FILE` is unknowable without running the shell. Treating every
+// unresolved expansion as sensitive asked on `cat ~/.zshrc`, `wc -l *.cjs` and
+// `du -sh */` too, so these are allowed by design. `less "$HOME/.env"` is the
+// edge of that decision: a literal secret joined to a variable goes through.
+for (const command of [
+  'cat $FILE',
+  'cat "$FILE"',
+  'cat ${FILE}',
+  'cat $1',
+  'cat $(echo .env)',
+  'cat `echo .env`',
+  'head $SECRET',
+  'tail ${MY_FILE}',
+  'less "$HOME/.env"',
+  'cat README.md $EXTRA',
+  'echo ok; cat README.md $FILE',
+  'cat README.md | head $FILE',
+  "bash -c 'cat $FILE'",
+  'echo $(cat $FILE)',
+  'env -u UNUSED cat "$FILE"',
+  'timeout 1 cat "$FILE"',
+  'nice -n 10 cat "$FILE"',
+  "eval 'cat \"$FILE\"'",
+  "find . -exec sh -c 'cat \"$FILE\"' \\;",
+  'source "$FILE"',
+  'xargs -a "$LIST" cat',
+  'python3 -c \'open(os.environ["FILE"]).read()\'',
+  'node -e \'fs.readFileSync(process.env.FILE)\'',
+  'cat < "$FILE"',
+  'cat -n "$FILE"',
+]) {
+  test(`allows pure indirection with no sensitive literal: ${command}`, () => {
+    const dir = tmpDir();
+    try {
+      fs.writeFileSync(path.join(dir, '.env'), 'SECRET=1');
+      const { code, stdout } = runHook({ tool_name: 'Bash', tool_input: { command } }, dir);
+      assert.strictEqual(code, 0);
+      assert.strictEqual(permissionDecision(stdout), null, `should allow ${command}`);
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+}
+
+// --- An inert heredoc body is prose, not shell (fix: e867051) ---
+test('allows a quoted-delimiter heredoc whose body quotes a read command', () => {
+  const dir = tmpDir();
+  try {
+    const command = "gh pr create --body \"$(cat <<'BODY'\nRun `cat .env` to inspect config\nBODY\n)\"";
+    const { stdout } = runHook({ tool_name: 'Bash', tool_input: { command } }, dir);
+    assert.strictEqual(permissionDecision(stdout), null, 'quoted delimiter expands nothing');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('still asks for an unquoted-delimiter heredoc that does expand a read', () => {
+  const dir = tmpDir();
+  try {
+    const command = 'bash -c "cat <<BODY\n$(cat .env)\nBODY"';
+    const { stdout } = runHook({ tool_name: 'Bash', tool_input: { command } }, dir);
+    assert.strictEqual(permissionDecision(stdout), 'ask', 'unquoted delimiter expands');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+for (const command of [
+  'echo $VAR',
+  'echo "$HOME"',
+  'git status',
+  'git status $VAR',
+  'cat README.md',
+  'cat .env.example',
+  'cat .env.sample',
+  'cat .env.template',
+  'cat .env.test',
+  "cat '$FILE'",
+  "cat '$HOME/README.md'",
+  "cat README.md '$EXTRA'",
+  "cat README.md '*'",
+  "cat README.md '~'",
+  "cat README.md '{README.md,LICENSE}'",
+  "echo '$(cat $FILE)'",
+  'cat ~/.zshrc',
+  'wc -l README.md',
+  'cat *.md',
+  'du -sh */',
+  'python3 -c "print(os.environ[\'HOME\'])"',
+  'head -n "$COUNT" README.md',
+]) {
+  test(`allows harmless dynamic / safe static with extra var: ${command}`, () => {
+    const dir = tmpDir();
+    try {
+      // Create safe files so hook has cwd context, but path check is lexical
+      fs.writeFileSync(path.join(dir, 'README.md'), 'hi');
+      fs.writeFileSync(path.join(dir, '.env.example'), 'EXAMPLE=1');
+      const { stdout } = runHook({ tool_name: 'Bash', tool_input: { command } }, dir);
+      assert.strictEqual(permissionDecision(stdout), null, `should allow ${command}`);
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+}
+
+test('an assignment naming a secret does not ask, with or without a later read', () => {
+  const dir = tmpDir();
+  try {
+    const assigned = runHook({ tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat README.md' } }, dir);
+    assert.strictEqual(permissionDecision(assigned.stdout), null);
+    // Pure indirection: the hook cannot resolve $FILE without running the shell.
+    const read = runHook({ tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat "$FILE"' } }, dir);
+    assert.strictEqual(permissionDecision(read.stdout), null);
+    // Spelling the target out again does ask.
+    const literal = runHook({ tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat .env' } }, dir);
+    assert.strictEqual(permissionDecision(literal.stdout), 'ask');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('asks for dangling symlink aimed at protected target (regression: broken-link fail-open)', () => {
+  const dir = tmpDir();
+  try {
+    const env = path.join(dir, '.env');
+    fs.writeFileSync(env, 'SECRET=1');
+    const link = path.join(dir, 'innocent.txt');
+    fs.symlinkSync(env, link);
+    fs.unlinkSync(env); // now dangling
+    const { stdout } = runHook({ tool_name: 'Read', tool_input: { file_path: link } }, dir);
+    assert.strictEqual(permissionDecision(stdout), 'ask', 'dangling link to .env must ask');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('allows dangling symlink to benign file and to allowed example', () => {
+  const dir = tmpDir();
+  try {
+    const benign = path.join(dir, 'benign.txt');
+    fs.writeFileSync(benign, 'hi');
+    const link = path.join(dir, 'dangling.txt');
+    fs.symlinkSync(benign, link);
+    fs.unlinkSync(benign);
+    const { stdout: s1 } = runHook({ tool_name: 'Read', tool_input: { file_path: link } }, dir);
+    assert.strictEqual(permissionDecision(s1), null, 'dangling benign should allow');
+
+    const example = path.join(dir, '.env.example');
+    fs.writeFileSync(example, 'EXAMPLE=1');
+    const link2 = path.join(dir, 'link-example.txt');
+    fs.symlinkSync(example, link2);
+    fs.unlinkSync(example);
+    const { stdout: s2 } = runHook({ tool_name: 'Read', tool_input: { file_path: link2 } }, dir);
+    assert.strictEqual(permissionDecision(s2), null, 'dangling link to .env.example should allow');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('still allows real link to allowed example (regression: real link to .env.example)', () => {
+  const dir = tmpDir();
+  try {
+    const example = path.join(dir, '.env.example');
+    fs.writeFileSync(example, 'EXAMPLE=1');
+    const link = path.join(dir, 'real-example-link.txt');
+    fs.symlinkSync(example, link);
+    const { stdout } = runHook({ tool_name: 'Read', tool_input: { file_path: link } }, dir);
+    assert.strictEqual(permissionDecision(stdout), null);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('fails closed on malformed/looping symlink (hop limit)', () => {
+  const dir = tmpDir();
+  try {
+    const a = path.join(dir, 'a');
+    const b = path.join(dir, 'b');
+    fs.symlinkSync(b, a);
+    fs.symlinkSync(a, b);
+    const { stdout } = runHook({ tool_name: 'Read', tool_input: { file_path: a } }, dir);
+    // Loop should fail closed to ask (treated as sensitive to be safe) or at least not allow silently
+    // Our implementation returns ask for looping link
+    assert.strictEqual(permissionDecision(stdout), 'ask');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});

package/src/claude/hooks/__tests__/semantic-review-authority.test.js

@@ -0,0 +1,257 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.resolve(__dirname, '../../../..');
+const VALIDATOR = path.join(PACKAGE_ROOT, 'src/claude/scripts/validate-spec-output.cjs');
+const HOOKS = ['claude', 'codex'].map((runtime) => path.join(PACKAGE_ROOT, `src/${runtime}/hooks/semantic-review-authority.cjs`));
+
+function fixture(base, name) {
+  const root = path.join(base, name);
+  const specDir = path.join(root, 'specs', 'feature');
+  fs.mkdirSync(specDir, { recursive: true });
+  fs.writeFileSync(path.join(specDir, 'requirements.md'), '# Requirements\n\n- **R1.1** The service shall return one result.\n');
+  fs.writeFileSync(path.join(specDir, 'design.md'), '# Design\n\n### D1 — Stable result\n\nReturn one stable result.\n');
+  fs.writeFileSync(path.join(specDir, 'spec.json'), `${JSON.stringify({ feature_name: 'feature', status: 'in_progress', task_registry: {}, workflow_policy: { assurance_level: 'Strict' } })}\n`);
+  return { root, specDir, specFile: path.join(specDir, 'spec.json') };
+}
+
+function installSemanticRuntime(target, runtime) {
+  const runtimeRoot = path.join(target.root, runtime === 'claude' ? '.claude' : '.codex');
+  const hooks = path.join(runtimeRoot, 'hooks');
+  const scripts = path.join(runtimeRoot, 'scripts');
+  fs.mkdirSync(path.join(hooks, 'lib'), { recursive: true });
+  fs.cpSync(path.join(PACKAGE_ROOT, 'src/claude/scripts'), scripts, { recursive: true });
+  for (const name of ['semantic-review-authority.cjs', 'completion-authority-state.cjs']) {
+    fs.copyFileSync(path.join(PACKAGE_ROOT, `src/${runtime}/hooks`, name), path.join(hooks, name));
+  }
+  fs.copyFileSync(
+    path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/runtime-path-safety.cjs'),
+    path.join(hooks, 'lib/runtime-path-safety.cjs'),
+  );
+  return {
+    hook: path.join(hooks, 'semantic-review-authority.cjs'),
+    validator: path.join(scripts, 'validate-spec-output.cjs'),
+  };
+}
+
+function envFor(root, home) {
+  return { ...process.env, HOME: home, USERPROFILE: home, PROJECT_ROOT: root };
+}
+
+function digest(target, home) {
+  const result = spawnSync(process.execPath, [VALIDATOR, target.specDir, '--semantic-digest'], { cwd: target.root, env: envFor(target.root, home), encoding: 'utf8' });
+  assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+  return result.stdout.trim();
+}
+
+function claim(target, semanticDigest, overrides = {}) {
+  return `CAFEKIT_SEMANTIC_REVIEW_ATTESTATION ${JSON.stringify({ feature_name: 'feature', spec_file: 'specs/feature/spec.json', semantic_digest: semanticDigest, verdict: 'PASS', ...overrides })}`;
+}
+
+function runHook(hook, target, home, message, event = 'SubagentStop', payload = {}) {
+  return spawnSync(process.execPath, [hook], {
+    cwd: target.root, env: envFor(target.root, home), encoding: 'utf8',
+    input: JSON.stringify({ hook_event_name: event, session_id: 'host-session', agent_id: 'review-agent', agent_type: 'code_auditor', last_assistant_message: message, cwd: target.root, ...payload }),
+  });
+}
+
+function verify(hook, target, home, semanticDigest) {
+  const script = 'const a=require(process.argv[1]); console.log(JSON.stringify(a.verifyAttestation(process.argv[2],process.argv[3],process.argv[4],process.argv[5])))';
+  const result = spawnSync(process.execPath, ['-e', script, hook, target.root, target.specFile, 'feature', semanticDigest], { env: envFor(target.root, home), encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  return JSON.parse(result.stdout);
+}
+
+function observationFile(home) {
+  const files = fs.readdirSync(home, { recursive: true }).filter((entry) => String(entry).endsWith('.json') && String(entry).includes('observation-'));
+  assert.equal(files.length, 1);
+  return path.join(home, files[0]);
+}
+
+test('Claude and Codex observe equivalent allowlisted SubagentStop claims with HMAC integrity', () => {
+  for (const hook of HOOKS) {
+    const base = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-semantic-authority-'));
+    try {
+      const target = fixture(base, 'project');
+      const home = path.join(base, 'home');
+      const current = digest(target, home);
+      assert.equal(runHook(hook, target, home, claim(target, current), 'SessionStart').stderr, '');
+      assert.equal(fs.existsSync(path.join(home, '.cafekit')), false, 'non-SubagentStop event wrote authority state');
+      assert.equal(runHook(hook, target, home, 'Ordinary worker finished without a semantic review claim.').stderr, '');
+      assert.equal(fs.existsSync(path.join(home, '.cafekit')), false, 'ordinary SubagentStop wrote authority state');
+      const recorded = runHook(hook, target, home, claim(target, current));
+      assert.equal(recorded.status, 0);
+      assert.equal(recorded.stderr, '');
+      const observed = verify(hook, target, home, current);
+      assert.equal(observed.ok, true);
+      assert.equal(observed.record.kind, 'semantic-review-observation');
+      assert.equal(observed.record.event, 'SubagentStop');
+
+      const before = current;
+      const spec = JSON.parse(fs.readFileSync(target.specFile, 'utf8'));
+      spec.status = 'done';
+      spec.updated_at = '2026-08-13T12:00:00+07:00';
+      fs.writeFileSync(target.specFile, `${JSON.stringify(spec)}\n`);
+      assert.equal(digest(target, home), before);
+      assert.equal(verify(hook, target, home, before).ok, true);
+
+      fs.appendFileSync(path.join(target.specDir, 'requirements.md'), '\nSemantic behavior changed.\n');
+      const changed = digest(target, home);
+      assert.notEqual(changed, before);
+      assert.match(verify(hook, target, home, changed).reason, /stale/);
+    } finally { fs.rmSync(base, { recursive: true, force: true }); }
+  }
+});
+
+test('observation rejects wrong identity, digest, verdict, tampered MAC, copied record, and self-authored strings', () => {
+  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-semantic-adversarial-'));
+  try {
+    const home = path.join(base, 'home');
+    const first = fixture(base, 'first');
+    const second = fixture(base, 'second');
+    const firstDigest = digest(first, home);
+    const secondDigest = digest(second, home);
+    const hook = HOOKS[0];
+
+    for (const badClaim of [
+      claim(first, `sha256:${'0'.repeat(64)}`),
+      claim(first, firstDigest, { verdict: 'FAIL' }),
+      claim(first, firstDigest, { feature_name: 'copied-feature' }),
+      claim(first, firstDigest, { spec_file: 'specs/missing/spec.json' }),
+    ]) {
+      const result = runHook(hook, first, home, badClaim);
+      assert.match(result.stderr, /rejected/);
+    }
+    assert.equal(verify(hook, first, home, firstDigest).ok, false, 'self-authored claims created authority');
+
+    assert.equal(runHook(hook, first, home, claim(first, firstDigest)).stderr, '');
+    const firstRecordPath = observationFile(home);
+    const firstRecord = fs.readFileSync(firstRecordPath);
+    assert.equal(runHook(hook, second, home, claim(second, secondDigest)).stderr, '');
+    const records = fs.readdirSync(home, { recursive: true }).filter((entry) => String(entry).includes('observation-'));
+    assert.equal(records.length, 2);
+    const secondRecordPath = records.map((entry) => path.join(home, entry)).find((file) => file !== firstRecordPath);
+    fs.writeFileSync(secondRecordPath, firstRecord);
+    assert.equal(verify(hook, second, home, secondDigest).ok, false, 'copied project record was accepted');
+
+    const tampered = JSON.parse(fs.readFileSync(firstRecordPath, 'utf8'));
+    tampered.verdict = 'FAIL';
+    fs.writeFileSync(firstRecordPath, `${JSON.stringify(tampered)}\n`);
+    assert.match(verify(hook, first, home, firstDigest).reason, /MAC|malformed/);
+  } finally { fs.rmSync(base, { recursive: true, force: true }); }
+});
+
+test('SubagentStop markers and claimed capabilities cannot turn a non-reviewer into authority', () => {
+  for (const hook of HOOKS) {
+    const base = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-semantic-role-'));
+    try {
+      const target = fixture(base, 'project');
+      const home = path.join(base, 'home');
+      const current = digest(target, home);
+      for (const payload of [
+        { agent_type: 'implementer' },
+        { agent_type: 'test_runner', capability: 'reviewer' },
+        { agent_type: 'worker', reviewer_capability: true },
+      ]) {
+        const result = runHook(hook, target, home, claim(target, current), 'SubagentStop', payload);
+        assert.equal(result.status, 0);
+        assert.equal(result.stderr, '');
+        assert.equal(verify(hook, target, home, current).ok, false);
+      }
+      assert.equal(runHook(hook, target, home, claim(target, current), 'SubagentStop', { agent_type: 'code-auditor' }).stderr, '');
+      assert.equal(verify(hook, target, home, current).ok, true);
+    } finally { fs.rmSync(base, { recursive: true, force: true }); }
+  }
+});
+
+test('canonicalizes and contains the validator before semantic digest spawn', () => {
+  for (const runtime of ['claude', 'codex']) {
+    const base = fs.mkdtempSync(path.join(os.tmpdir(), `cafekit-semantic-validator-${runtime}-`));
+    try {
+      const target = fixture(base, 'project');
+      const installed = installSemanticRuntime(target, runtime);
+      const digestValue = digest(target, path.join(base, 'digest-home'));
+      const validHome = path.join(base, 'valid-home');
+      const valid = runHook(installed.hook, target, validHome, claim(target, digestValue));
+      assert.equal(valid.status, 0);
+      assert.equal(valid.stderr, '', `${runtime} contained validator should be accepted`);
+      assert.equal(verify(installed.hook, target, validHome, digestValue).ok, true);
+
+      const outsideValidator = path.join(base, 'outside-validator.cjs');
+      fs.copyFileSync(VALIDATOR, outsideValidator);
+      fs.rmSync(installed.validator);
+      fs.symlinkSync(outsideValidator, installed.validator);
+      const escapedHome = path.join(base, 'escaped-home');
+      const escaped = runHook(installed.hook, target, escapedHome, claim(target, digestValue));
+      assert.equal(escaped.status, 0);
+      assert.match(escaped.stderr, /semantic validator|escapes|rejected/i, `${runtime} validator escape must be rejected`);
+      assert.equal(verify(installed.hook, target, escapedHome, digestValue).ok, false);
+
+      fs.rmSync(installed.validator);
+      fs.copyFileSync(VALIDATOR, installed.validator);
+      const dependency = path.join(path.dirname(installed.validator), 'workflow-policy.cjs');
+      const outsideDependency = path.join(base, 'outside-workflow-policy.cjs');
+      fs.copyFileSync(dependency, outsideDependency);
+      fs.rmSync(dependency);
+      fs.symlinkSync(outsideDependency, dependency);
+      const dependencyHome = path.join(base, 'dependency-home');
+      const dependencyEscape = runHook(installed.hook, target, dependencyHome, claim(target, digestValue));
+      assert.equal(dependencyEscape.status, 0);
+      assert.match(dependencyEscape.stderr, /dependency|symlink|rejected/i, `${runtime} transitive dependency escape must be rejected`);
+      assert.equal(verify(installed.hook, target, dependencyHome, digestValue).ok, false);
+
+      fs.rmSync(dependency);
+      fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/scripts/workflow-policy.cjs'), dependency);
+      const runtimeRoot = path.dirname(path.dirname(installed.hook));
+      const outsideRuntime = path.join(base, `outside-${runtime}`);
+      fs.renameSync(runtimeRoot, outsideRuntime);
+      fs.symlinkSync(outsideRuntime, runtimeRoot);
+      const rootHome = path.join(base, 'root-home');
+      const rootEscape = runHook(installed.hook, target, rootHome, claim(target, digestValue));
+      assert.equal(rootEscape.status, 0);
+      assert.match(rootEscape.stderr, /symlink|identity|rejected/i, `${runtime} adapter-root symlink must be rejected`);
+      assert.equal(verify(installed.hook, target, rootHome, digestValue).ok, false);
+    } finally { fs.rmSync(base, { recursive: true, force: true }); }
+  }
+});
+
+test('rejects scratch/spec.json and traversal feature identities', () => {
+  for (const hook of HOOKS) {
+    const base = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-semantic-scratch-'));
+    try {
+      const target = fixture(base, 'project');
+      const home = path.join(base, 'home');
+      const current = digest(target, home);
+      const badScratch = claim(target, current, { spec_file: 'scratch/spec.json' });
+      const resScratch = runHook(hook, target, home, badScratch);
+      assert.match(resScratch.stderr, /rejected|spec identity/);
+      assert.equal(verify(hook, target, home, current).ok, false, 'scratch identity should not create observation');
+
+      const traversal = `CAFEKIT_SEMANTIC_REVIEW_ATTESTATION ${JSON.stringify({ feature_name: '../evil', spec_file: 'specs/../evil/spec.json', semantic_digest: current, verdict: 'PASS' })}`;
+      const resTraversal = runHook(hook, target, home, traversal);
+      assert.match(resTraversal.stderr, /rejected|malformed/);
+      assert.equal(verify(hook, target, home, current).ok, false);
+
+      const slash = claim(target, current, { feature_name: 'evil/traversal' });
+      const resSlash = runHook(hook, target, home, slash);
+      assert.match(resSlash.stderr, /rejected|malformed/);
+    } finally { fs.rmSync(base, { recursive: true, force: true }); }
+  }
+});
+
+test('code-auditor agent ships Strict conditional marker contract', () => {
+  const agentPath = path.join(PACKAGE_ROOT, 'src/claude/agents/code-auditor.md');
+  const content = fs.readFileSync(agentPath, 'utf8');
+  assert.match(content, /Strict Semantic Review Attestation/);
+  assert.match(content, /CAFEKIT_SEMANTIC_REVIEW_ATTESTATION/);
+  assert.match(content, /Emit only for `Strict`/);
+  assert.match(content, /specs\/<feature>\/spec\.json/);
+  assert.match(content, /MAC-protected host-hook observation/);
+  assert.doesNotMatch(content, /host-signed|proves causal/);
+});