@haposoft/cafekit 0.16.0-rc.3 → 0.16.0-rc.5

package/bin/__tests__/codex-hooks.test.js

@@ -19,6 +19,10 @@ const { stateDir: codexStateDir } = require(
 );
 
 function runHook(file, cwd, payload) {
+  if (path.basename(file) === 'spec-gate.cjs') {
+    const rootResult = spawnSync('git', ['-C', cwd, 'rev-parse', '--show-toplevel'], { encoding: 'utf8' });
+    if (rootResult.status === 0) installFeatureReceipts(rootResult.stdout.trim(), payload.session_id || 'session-a');
+  }
   return spawnSync(process.execPath, [file], {
     cwd,
     input: JSON.stringify(payload),
@@ -41,11 +45,49 @@ function bindReceipt(root, value, feature = 'auth', session = 'session-a') {
   return value.replaceAll(VALID_BASE, context.base).replaceAll(VALID_HEAD, context.head);
 }
 
+function installFeatureReceipts(root, session = 'session-a') {
+  const specsRoot = path.join(root, 'specs');
+  if (!fs.existsSync(specsRoot)) return;
+  for (const feature of fs.readdirSync(specsRoot)) {
+    const featureDir = path.join(specsRoot, feature);
+    const specFile = path.join(featureDir, 'spec.json');
+    if (!fs.existsSync(specFile)) continue;
+    let spec;
+    try { spec = JSON.parse(fs.readFileSync(specFile, 'utf8')); } catch { continue; }
+    const lifecyclePhase = spec.current_phase || spec.phase;
+    const explicitCloseout = ['completed', 'complete'].includes(spec.status)
+      || ['closeout', 'completion', 'completed', 'complete'].includes(lifecyclePhase);
+    if (!explicitCloseout) continue;
+    const tasks = Object.values(spec.task_registry || {});
+    if (tasks.length === 0 || tasks.some((task) => task.status !== 'done')) continue;
+    const context = runtimeContext(root, feature, session);
+    fs.writeFileSync(path.join(featureDir, 'feature-receipt.md'), [
+      `Feature: ${feature}`,
+      'Expected: final integration verification passes',
+      'Observed: final integration verification passed',
+      'Verification: PASS',
+      'Command: node --test',
+      'Exit: 0',
+      `Base: ${context.base}`,
+      `Head: ${context.head}`,
+      '',
+    ].join('\n'));
+  }
+}
+
 function inHookFixture(run, options = {}) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-hooks-'));
   const hooks = path.join(root, '.codex', 'hooks');
   try {
     fs.cpSync(CODEX_HOOKS, hooks, { recursive: true });
+    fs.copyFileSync(
+      path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/privacy-command-analysis.cjs'),
+      path.join(hooks, 'lib/privacy-command-analysis.cjs'),
+    );
+    fs.copyFileSync(
+      path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/runtime-path-safety.cjs'),
+      path.join(hooks, 'lib/runtime-path-safety.cjs'),
+    );
     fs.mkdirSync(path.join(root, '.codex', 'scripts'), { recursive: true });
     if (options.policy !== 'missing') {
       if (options.policy === 'malformed') {
@@ -59,12 +101,22 @@ function inHookFixture(run, options = {}) {
           path.join(PACKAGE_ROOT, 'src/claude/scripts/provenance.cjs'),
           path.join(root, '.codex', 'scripts', 'provenance.cjs'),
         );
+        fs.copyFileSync(
+          path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-receipt.cjs'),
+          path.join(root, '.codex', 'scripts', 'spec-receipt.cjs'),
+        );
       }
     }
     fs.copyFileSync(
       path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-resolver.cjs'),
       path.join(root, '.codex', 'scripts', 'spec-resolver.cjs'),
     );
+    for (const file of ['validate-spec-output.cjs', 'spec-ground.cjs', 'spec-semantic-model.cjs', 'spec-final-state.cjs']) {
+      fs.copyFileSync(
+        path.join(PACKAGE_ROOT, 'src/claude/scripts', file),
+        path.join(root, '.codex', 'scripts', file),
+      );
+    }
     fs.writeFileSync(path.join(root, '.codex', 'scripts', 'spec-scaffold.cjs'), '');
     for (const args of [['init', '-q'], ['config', 'user.email', 'cafekit@example.invalid'], ['config', 'user.name', 'CafeKit Test'], ['commit', '--allow-empty', '-qm', 'fixture']]) {
       const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
@@ -76,7 +128,7 @@ function inHookFixture(run, options = {}) {
   }
 }
 
-test('Codex privacy approval is exact, session-bound, and one-time', () => {
+test('Codex privacy approval is exact, session-bound, and reusable within its window', () => {
   inHookFixture((root, hooks) => {
     const nested = path.join(root, 'packages', 'app');
     fs.mkdirSync(nested, { recursive: true });
@@ -121,23 +173,36 @@ test('Codex privacy approval is exact, session-bound, and one-time', () => {
     });
     assert.match(wrongSession.stdout, /rejected/);
 
-    const approved = runHook(approve, nested, {
+    // A pasted prompt carries the terminal's surrounding whitespace. The
+    // exactness that matters is the request id, not the padding.
+    const padded = runHook(approve, nested, {
       cwd: nested,
       session_id: 'session-a',
       hook_event_name: 'UserPromptSubmit',
-      prompt
+      prompt: ` ${prompt}\n`
     });
-    assert.match(approved.stdout, /approved one retry/);
+    assert.match(padded.stdout, /User approved/, 'whitespace padding must not void the approval');
 
+    // The grant now covers repeated access to the same paths, and is not bound
+    // to the tool that first tripped the gate.
     const allowedOnce = runHook(block, nested, request);
     assert.equal(allowedOnce.stdout, '');
 
-    const deniedAgain = runHook(block, nested, request);
-    assert.equal(JSON.parse(deniedAgain.stdout).hookSpecificOutput.permissionDecision, 'deny');
+    const allowedAgain = runHook(block, nested, request);
+    assert.equal(allowedAgain.stdout, '', 'one approval covers a re-read');
+
+    const allowedOtherTool = runHook(block, nested, {
+      ...request,
+      tool_name: 'exec_command'
+    });
+    assert.equal(allowedOtherTool.stdout, '', 'grant is not bound to a tool name');
 
+    // A fresh session, so the single-path grant above cannot mask the exact-set
+    // matching under test.
     fs.writeFileSync(path.join(nested, 'credentials.json'), '{"token":"test"}\n');
     const multiRequest = {
       ...request,
+      session_id: 'session-c',
       tool_input: { command: 'cat .env credentials.json' }
     };
     const multiDenied = runHook(block, nested, multiRequest);
@@ -150,31 +215,65 @@ test('Codex privacy approval is exact, session-bound, and one-time', () => {
 
     const multiApproved = runHook(approve, nested, {
       cwd: nested,
-      session_id: 'session-a',
+      session_id: 'session-c',
       hook_event_name: 'UserPromptSubmit',
       prompt: multiPrompt
     });
-    assert.match(multiApproved.stdout, /approved one retry/);
+    assert.match(multiApproved.stdout, /User approved/);
 
-    // A token for two paths cannot authorize a subset, and the failed subset
-    // attempt must not consume the exact-set token.
-    const subsetDenied = runHook(block, nested, request);
+    // A grant for two paths authorizes exactly that set: neither a subset nor a
+    // superset, in either order.
+    const subsetDenied = runHook(block, nested, { ...request, session_id: 'session-c' });
     assert.equal(JSON.parse(subsetDenied.stdout).hookSpecificOutput.permissionDecision, 'deny');
     fs.writeFileSync(path.join(nested, 'tokens.json'), '{"token":"test"}\n');
     const supersetDenied = runHook(block, nested, {
       ...request,
+      session_id: 'session-c',
       tool_input: { command: 'cat .env credentials.json tokens.json' }
     });
     assert.equal(JSON.parse(supersetDenied.stdout).hookSpecificOutput.permissionDecision, 'deny');
     const reordered = {
       ...request,
+      session_id: 'session-c',
       tool_input: { command: 'cat credentials.json .env' }
     };
     assert.equal(runHook(block, nested, reordered).stdout, '');
-    assert.equal(
-      JSON.parse(runHook(block, nested, multiRequest).stdout).hookSpecificOutput.permissionDecision,
-      'deny'
-    );
+    assert.equal(runHook(block, nested, multiRequest).stdout, '', 'the set stays granted');
+
+    // Session binding survives the change: another session sees no grant.
+    const otherSession = runHook(block, nested, { ...request, session_id: 'session-d' });
+    assert.equal(JSON.parse(otherSession.stdout).hookSpecificOutput.permissionDecision, 'deny');
+  });
+});
+
+test('Codex privacy grant window is one hour and restarts at approval', () => {
+  inHookFixture((root, hooks) => {
+    const state = require(path.join(hooks, 'lib', 'privacy-state.cjs'));
+    const HOUR = 60 * 60 * 1000;
+    assert.equal(state.TTL_MS, HOUR, 'a five-minute window expired mid-conversation');
+
+    fs.writeFileSync(path.join(root, '.env'), 'SECRET=1\n');
+    const pending = state.createPending({
+      projectRoot: root,
+      sessionCwd: root,
+      sessionId: 'session-ttl',
+      filePaths: ['.env'],
+    });
+    assert.ok(pending.expiresAt - Date.now() > HOUR - 5000, 'pending must live an hour');
+
+    const approved = state.approvePending({
+      projectRoot: root,
+      sessionId: 'session-ttl',
+      requestId: pending.requestId,
+    });
+    assert.equal(approved.ok, true);
+
+    const stateDir = path.join(root, '.codex', 'hooks', '.privacy');
+    const tokenFile = fs.readdirSync(stateDir).find((name) => name.startsWith('token-'));
+    assert.ok(tokenFile, 'approval must write a grant');
+    const grant = JSON.parse(fs.readFileSync(path.join(stateDir, tokenFile), 'utf8'));
+    assert.ok(grant.expiresAt - Date.now() > HOUR - 5000, 'the grant window starts at approval');
+    assert.equal(grant.toolName, undefined, 'a grant is not bound to a tool name');
   });
 });
 
@@ -293,10 +392,25 @@ test('Codex completion gate cannot be bypassed from a nested cwd', () => {
     fs.writeFileSync(path.join(feature, 'spec.json'), `${JSON.stringify(spec)}\n`);
     fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n');
 
-    const blocked = runHook(gate, nested, payload);
-    assert.equal(blocked.status, 0);
-    assert.equal(JSON.parse(blocked.stdout).decision, 'block');
-    assert.match(JSON.parse(blocked.stdout).reason, /verification receipt/);
+    const blockedBeforeCloseout = runHook(gate, nested, payload);
+    assert.equal(blockedBeforeCloseout.status, 0);
+    assert.equal(JSON.parse(blockedBeforeCloseout.stdout).decision, 'block');
+    assert.match(JSON.parse(blockedBeforeCloseout.stdout).reason, /verification receipt/);
+
+    fs.writeFileSync(path.join(feature, taskPath), bindReceipt(root, [
+      'Status: done', '', '## Evidence', '', 'Verification: PASS',
+      'Command: node --test', 'Exit: 0', `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`,
+    ].join('\n'), 'auth'));
+    const validBeforeCloseout = runHook(gate, nested, payload);
+    assert.equal(validBeforeCloseout.status, 0);
+    assert.equal(validBeforeCloseout.stdout, '');
+    assert.equal(fs.existsSync(path.join(feature, 'feature-receipt.md')), false);
+
+    spec.current_phase = 'closeout';
+    fs.writeFileSync(path.join(feature, 'spec.json'), `${JSON.stringify(spec)}\n`);
+    const closeout = runHook(gate, nested, payload);
+    assert.equal(closeout.status, 0);
+    assert.equal(closeout.stdout, '');
   });
 });
 
@@ -322,6 +436,7 @@ test('empty or forged Codex hook authority fails closed', () => {
     fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
     fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({
       status: 'in_progress',
+      current_phase: 'closeout',
       feature_name: 'auth',
       task_registry: { [taskPath]: { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' } },
     }));
@@ -347,15 +462,16 @@ test('empty or forged Codex hook authority fails closed', () => {
   });
 });
 
-test('Critical Codex completion ignores worker-writable proof strings and remains blocked', () => {
+test('explicit Strict Codex completion ignores worker-writable proof strings and remains blocked', () => {
   inHookFixture((root, hooks) => {
     const feature = path.join(root, 'specs', 'auth');
     const taskPath = 'tasks/task.md';
     fs.mkdirSync(path.join(feature, 'tasks'), { recursive: true });
     fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({
       status: 'in_progress',
+      current_phase: 'closeout',
       feature_name: 'auth',
-      workflow_policy: POLICY.workflowPolicySnapshot({ riskSignals: { auth: true } }),
+      workflow_policy: POLICY.workflowPolicySnapshot({ riskSignals: { auth: true }, assurance_level: 'Strict' }),
       proofs: {
         needsInspection: 'inspection completed',
         needsIndependentAudit: 'PASS',
@@ -453,6 +569,24 @@ test('Codex state hook persists direct native event fields at project root', ()
   });
 });
 
+test('semantic review authority hook is registered only for SubagentStop on Claude and Codex', () => {
+  const configurations = [
+    JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'src/claude/settings/settings.json'), 'utf8')).hooks,
+    JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'src/codex/hooks.json'), 'utf8')).hooks,
+  ];
+  for (const hooks of configurations) {
+    const registrations = [];
+    for (const [event, groups] of Object.entries(hooks)) {
+      for (const group of groups) {
+        for (const hook of group.hooks || []) {
+          if (String(hook.command || '').includes('semantic-review-authority.cjs')) registrations.push(event);
+        }
+      }
+    }
+    assert.deepEqual(registrations, ['SubagentStop']);
+  }
+});
+
 test('Codex canonical receipt provenance requires both Base and Head', () => {
   const receipt = require(path.join(CODEX_HOOKS, 'lib', 'spec-receipt.cjs'));
   const onlyBase = receipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc\n');
@@ -494,12 +628,12 @@ test('Codex canonical receipt provenance requires both Base and Head', () => {
     const payload = { cwd: path.join(root, 'packages', 'app'), session_id: 'session-a', hook_event_name: 'Stop', stop_hook_active: false };
 
     // only Base -> block
-    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({ status: 'in_progress', feature_name: 'auth', task_registry: { [taskPath]: { status: 'done', completed_at: '2026-07-29T10:00:00.000Z' } } }));
+    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'closeout', feature_name: 'auth', task_registry: { [taskPath]: { status: 'done', completed_at: '2026-07-29T10:00:00.000Z' } } }));
     fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc\n');
     fs.mkdirSync(payload.cwd, { recursive: true });
     const blocked = runHook(gate, payload.cwd, payload);
     assert.equal(JSON.parse(blocked.stdout).decision, 'block');
-    assert.match(JSON.parse(blocked.stdout).reason, /\bg\b|\bprovenance\b/);
+    assert.match(JSON.parse(blocked.stdout).reason, /\bprovenance\b/);
 
     // both -> no block
     fs.writeFileSync(path.join(feature, taskPath), bindReceipt(root, `Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: ${VALID_BASE}\nHead: ${VALID_HEAD}\n`));
@@ -511,14 +645,14 @@ test('Codex canonical receipt provenance requires both Base and Head', () => {
     fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase:\nHead: def\n');
     const blockedEmpty = runHook(gate, payload.cwd, payload);
     assert.equal(JSON.parse(blockedEmpty.stdout).decision, 'block');
-    assert.match(JSON.parse(blockedEmpty.stdout).reason, /\bg\b/);
+    assert.match(JSON.parse(blockedEmpty.stdout).reason, /\bprovenance\b/);
 
     // bare base_sha without colon should block — reset cache again
     try { fs.rmSync(path.join(root, '.codex', 'hooks', '.logs', 'spec-gate-last.json'), { force: true }); } catch {}
     fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha head_sha\n');
     const blockedBare = runHook(gate, payload.cwd, payload);
     assert.equal(JSON.parse(blockedBare.stdout).decision, 'block');
-    assert.match(JSON.parse(blockedBare.stdout).reason, /\bg\b/);
+    assert.match(JSON.parse(blockedBare.stdout).reason, /\bprovenance\b/);
   });
 });
 
@@ -540,7 +674,7 @@ test('Codex cache hardening: every done re-validated — mutation, deletion, mal
 
     // first-run (no cache) with valid receipt → no block, cache seeded
     try { fs.rmSync(cacheFile, { force: true }); } catch {}
-    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({ status: 'in_progress', feature_name: 'auth', task_registry: { [taskPath]: { status: 'done', completed_at: '2026-07-29T10:00:00.000Z' } } }));
+    fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({ status: 'in_progress', current_phase: 'closeout', feature_name: 'auth', task_registry: { [taskPath]: { status: 'done', completed_at: '2026-07-29T10:00:00.000Z' } } }));
     const validBody = bindReceipt(root, validBodyTemplate);
     fs.writeFileSync(path.join(feature, taskPath), validBody);
     let res = runHook(gate, appCwd, payload);
@@ -557,7 +691,7 @@ test('Codex cache hardening: every done re-validated — mutation, deletion, mal
     fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nExit: 0\nBase: abc123\nHead: def456\n```\npass\n```\n');
     res = runHook(gate, appCwd, payload);
     assert.equal(JSON.parse(res.stdout).decision, 'block', 'mutated receipt missing Verification/Command should block on cache-hit');
-    assert.match(JSON.parse(res.stdout).reason, /\bc\b|\be\b/);
+    assert.match(JSON.parse(res.stdout).reason, /\bverification_state\b|\bcommand\b/);
     // second hit still blocks
     res = runHook(gate, appCwd, payload);
     assert.equal(JSON.parse(res.stdout).decision, 'block', 'second hit after mutation still blocks');
@@ -568,7 +702,7 @@ test('Codex cache hardening: every done re-validated — mutation, deletion, mal
     fs.writeFileSync(path.join(feature, taskPath), 'Status: done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc123\n```\npass\n```\n');
     res = runHook(gate, appCwd, payload);
     assert.equal(JSON.parse(res.stdout).decision, 'block');
-    assert.match(JSON.parse(res.stdout).reason, /\bg\b/);
+    assert.match(JSON.parse(res.stdout).reason, /\bprovenance\b/);
 
     // deletion → block with check a
     fs.writeFileSync(path.join(feature, taskPath), validBody);
@@ -777,6 +911,7 @@ test('Codex adapter enforces declared task artifact SHA-256 with missing, invali
       fs.writeFileSync(path.join(root, 'output', 'bundle.js'), artifact);
       fs.writeFileSync(path.join(feature, 'spec.json'), JSON.stringify({
         status: 'in_progress',
+        current_phase: 'closeout',
         feature_name: 'artifact-demo',
         task_registry: {
           [taskPath]: {
@@ -805,10 +940,377 @@ test('Codex adapter enforces declared task artifact SHA-256 with missing, invali
       if (shouldBlock) {
         const block = JSON.parse(result.stdout);
         assert.equal(block.decision, 'block');
-        assert.match(block.reason, /\bh\b/);
+        assert.match(block.reason, /\bartifact_hash\b/);
       } else {
         assert.equal(result.stdout, '');
       }
     });
   }
 });
+
+test('Codex privacy denies obfuscated secret reads, allows benign and runtime state', () => {
+  inHookFixture((root, hooks) => {
+    const block = path.join(hooks, 'privacy-block.cjs');
+    const denied = [
+      { command: "cat .e''nv", tool: 'exec_command' },
+      { command: 'cat ~/.cafekit/completion-authority/hmac.key', tool: 'exec_command' },
+      { command: 'cat ~/.ssh/id_rsa', tool: 'Bash' },
+      { command: 'docker compose --env-file .env up', tool: 'exec_command' },
+      { command: "python3 -c \"open('.env').read()\"", tool: 'exec_command' },
+      { command: "node -e \"fs.readFileSync('.env')\"", tool: 'Bash' },
+      { command: "bash -c 'cat .e''nv'", tool: 'exec_command' },
+      { command: "echo ok; cat .env", tool: 'Bash' },
+    ];
+    for (const { command, tool } of denied) {
+      const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
+      assert.equal(JSON.parse(res.stdout).hookSpecificOutput.permissionDecision, 'deny', command);
+    }
+    // Runtime state and transcripts are CafeKit's own bookkeeping, not secrets.
+    // Guarding them by substring also matched every source file and doc that
+    // merely spelled `sessions` or `session-state`, so the gate fired on the
+    // repo it was installed in. The one real secret there, hmac.key, is still
+    // covered above by the `.key` rule.
+    const allowed = [
+      { command: "echo hello", tool: 'exec_command' },
+      { command: "cat README.md", tool: 'exec_command' },
+      { command: "cat src/app.js", tool: 'Bash' },
+      { command: 'cat .codex/sessions/test.json', tool: 'exec_command' },
+      { command: 'cat .codex/session-state/latest.md', tool: 'Bash' },
+      { command: 'cat docs/sessions-guide.md', tool: 'exec_command' },
+    ];
+    for (const { command, tool } of allowed) {
+      const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
+      assert.equal(res.stdout, '', command);
+    }
+  });
+});
+
+test('Codex privacy denies sensitive names it can resolve, allows pure indirection', () => {
+  inHookFixture((root, hooks) => {
+    const block = path.join(hooks, 'privacy-block.cjs');
+    const denied = [
+      { command: 'cat .e\\\nnv', tool: 'Bash' },
+      { command: "cat $'\\x2e\\x65\\x6e\\x76'", tool: 'exec_command' },
+      { command: 'cat .env*', tool: 'Bash' },
+      { command: 'cat certs/*.pem', tool: 'exec_command' },
+      { command: 'cat ~/.aws/credentials', tool: 'Bash' },
+      { command: 'ssh -i ~/.ssh/id_ed25519 host', tool: 'exec_command' },
+      { command: 'curl --config ~/.netrc https://example.com', tool: 'Bash' },
+      { command: 'kubectl --kubeconfig ~/.kube/kubeconfig get pods', tool: 'exec_command' },
+      { command: 'openssl rsa -in server.key', tool: 'Bash' },
+    ];
+    for (const { command, tool } of denied) {
+      const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
+      assert.equal(JSON.parse(res.stdout).hookSpecificOutput.permissionDecision, 'deny', `should deny ${command}`);
+    }
+    // Accepted gap: the target of `$FILE` is unknowable without running the
+    // shell, and every denial here costs a round trip through a one-shot
+    // approval prompt. `less "$HOME/.env"` is the edge of that decision.
+    const allowed = [
+      { command: "echo $VAR", tool: 'exec_command' },
+      { command: 'echo "$HOME"', tool: 'Bash' },
+      { command: "git status", tool: 'exec_command' },
+      { command: "git status $VAR", tool: 'Bash' },
+      { command: "cat README.md", tool: 'exec_command' },
+      { command: "cat .env.example", tool: 'Bash' },
+      { command: "cat .env.sample", tool: 'Bash' },
+      { command: "cat .env.template", tool: 'exec_command' },
+      { command: "cat .env.test", tool: 'Bash' },
+      { command: "cat '$FILE'", tool: 'exec_command' },
+      { command: "cat '$HOME/README.md'", tool: 'Bash' },
+      { command: "cat README.md '$EXTRA'", tool: 'exec_command' },
+      { command: "echo '$(cat $FILE)'", tool: 'Bash' },
+      { command: 'echo .envoy', tool: 'exec_command' },
+      { command: 'echo not.env', tool: 'Bash' },
+      { command: 'echo .env', tool: 'exec_command' },
+      { command: "printf '%s\\n' .env", tool: 'Bash' },
+      { command: 'git log -- .env', tool: 'Bash' },
+      { command: 'git status sessions.md', tool: 'exec_command' },
+      { command: 'python3 -c "print(os.environ[\'HOME\'])"', tool: 'Bash' },
+      { command: 'head -n "$COUNT" README.md', tool: 'exec_command' },
+      { command: 'grep .env README.md', tool: 'Bash' },
+      { command: "sed -n '/.env/p' README.md", tool: 'exec_command' },
+      { command: 'cat $FILE', tool: 'Bash' },
+      { command: 'cat "$FILE"', tool: 'exec_command' },
+      { command: 'cat ${FILE}', tool: 'Bash' },
+      { command: 'cat $1', tool: 'exec_command' },
+      { command: 'cat $(echo .env)', tool: 'Bash' },
+      { command: 'cat `echo .env`', tool: 'Bash' },
+      { command: 'head $SECRET', tool: 'exec_command' },
+      { command: 'tail ${MY_FILE}', tool: 'Bash' },
+      { command: 'less "$HOME/.env"', tool: 'Bash' },
+      { command: 'cat README.md $EXTRA', tool: 'Bash' },
+      { command: 'echo ok; cat README.md $FILE', tool: 'Bash' },
+      { command: 'cat README.md | head $FILE', tool: 'exec_command' },
+      { command: "bash -c 'cat $FILE'", tool: 'Bash' },
+      { command: 'cat README.md *', tool: 'Bash' },
+      { command: 'cat ~/.zshrc', tool: 'exec_command' },
+      { command: 'du -sh */', tool: 'Bash' },
+      { command: 'env -u UNUSED cat "$FILE"', tool: 'Bash' },
+      { command: 'timeout 1 cat "$FILE"', tool: 'exec_command' },
+      { command: "eval 'cat \"$FILE\"'", tool: 'exec_command' },
+      { command: "find . -exec sh -c 'cat \"$FILE\"' \\;", tool: 'Bash' },
+      { command: 'source "$FILE"', tool: 'exec_command' },
+      { command: 'xargs -a "$LIST" cat', tool: 'Bash' },
+      { command: 'python3 -c \'open(os.environ["FILE"]).read()\'', tool: 'exec_command' },
+      { command: 'node -e \'fs.readFileSync(process.env.FILE)\'', tool: 'Bash' },
+      { command: 'cat < "$FILE"', tool: 'exec_command' },
+    ];
+    for (const { command, tool } of allowed) {
+      const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
+      assert.equal(res.stdout, '', `should allow ${command}`);
+    }
+    const assignmentOnly = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat README.md' } });
+    assert.equal(assignmentOnly.stdout, '');
+    const assignmentRead = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat .env' } });
+    assert.equal(JSON.parse(assignmentRead.stdout).hookSpecificOutput.permissionDecision, 'deny');
+  });
+});
+
+test('Codex privacy reads an inert heredoc body as prose, not shell', () => {
+  inHookFixture((root, hooks) => {
+    const block = path.join(hooks, 'privacy-block.cjs');
+    const inert = "gh pr create --body \"$(cat <<'BODY'\nRun `cat .env` to inspect config\nBODY\n)\"";
+    const allowed = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: inert } });
+    assert.equal(allowed.stdout, '', 'quoted delimiter expands nothing');
+
+    const expanding = 'bash -c "cat <<BODY\n$(cat .env)\nBODY"';
+    const denied = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: expanding } });
+    assert.equal(JSON.parse(denied.stdout).hookSpecificOutput.permissionDecision, 'deny', 'unquoted delimiter expands');
+  });
+});
+
+test('Claude and Codex privacy lexers agree on literals, delimiters, and quote expansion', () => {
+  inHookFixture((root, hooks) => {
+    const claude = path.join(PACKAGE_ROOT, 'src/claude/hooks/privacy-block.cjs');
+    const codex = path.join(hooks, 'privacy-block.cjs');
+    const vectors = [
+      ["cat .e''nv", true],
+      ["python3 -c \"open('.env').read()\"", true],
+      ['cat README.md $FILE', false],
+      ['echo ok; cat README.md $FILE', false],
+      ["cat '$FILE'", false],
+      ["echo '$(cat $FILE)'", false],
+      ["cat README.md '*'", false],
+      ["cat README.md '~'", false],
+      ["cat README.md '{README.md,LICENSE}'", false],
+      ['cat .env.example', false],
+      ['echo .envoy', false],
+      ['cat .e\\\nnv', true],
+      ["cat $'\\x2e\\x65\\x6e\\x76'", true],
+      ['env -u UNUSED cat "$FILE"', false],
+      ['timeout 1 cat "$FILE"', false],
+      ["eval 'cat \"$FILE\"'", false],
+      ["find . -exec sh -c 'cat \"$FILE\"' \\;", false],
+      ['source "$FILE"', false],
+      ['xargs -a "$LIST" cat', false],
+      ['python3 -c \'open(os.environ["FILE"]).read()\'', false],
+      ['cat ~/.ssh/id_rsa', true],
+      ['docker compose --env-file .env up', true],
+      ['cat ~/.zshrc', false],
+      ['git log -- .env', false],
+      ['echo .env', false],
+      ["printf '%s\\n' .env", false],
+      ['git status sessions.md', false],
+      ['python3 -c "print(os.environ[\'HOME\'])"', false],
+    ];
+    for (const [command, blocked] of vectors) {
+      const payload = { cwd: root, hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command } };
+      const stateDir = path.join(hooks, '.privacy');
+      const pendingCount = () => fs.existsSync(stateDir)
+        ? fs.readdirSync(stateDir).filter((name) => name.startsWith('pending-')).length
+        : 0;
+      const beforePending = pendingCount();
+      const claudeResult = runHook(claude, root, payload);
+      const codexResult = runHook(codex, root, { ...payload, session_id: `parity-${command}` });
+      const claudeOutput = claudeResult.stdout.trim() ? JSON.parse(claudeResult.stdout) : null;
+      const codexOutput = codexResult.stdout.trim() ? JSON.parse(codexResult.stdout) : null;
+      assert.equal(claudeOutput?.hookSpecificOutput?.permissionDecision || null, blocked ? 'ask' : null, `Claude parity vector: ${command}`);
+      assert.equal(codexOutput?.hookSpecificOutput?.permissionDecision || null, blocked ? 'deny' : null, `Codex parity vector: ${command}`);
+      if (blocked) {
+        assert.equal(claudeOutput.hookSpecificOutput.hookEventName, 'PreToolUse');
+        assert.equal(codexOutput.hookSpecificOutput.hookEventName, 'PreToolUse');
+        assert.ok(claudeOutput.hookSpecificOutput.permissionDecisionReason);
+        assert.ok(codexOutput.hookSpecificOutput.permissionDecisionReason);
+      }
+      assert.equal(pendingCount() - beforePending, blocked ? 1 : 0, `Codex approval-state side effect: ${command}`);
+    }
+  });
+});
+
+test('Codex privacy handles dangling symlink to protected target (and allows benign/example)', () => {
+  inHookFixture((root, hooks) => {
+    const block = path.join(hooks, 'privacy-block.cjs');
+    // Create .env and dangling link
+    const env = path.join(root, '.env');
+    fs.writeFileSync(env, 'SECRET=1');
+    const link = path.join(root, 'innocent.txt');
+    fs.symlinkSync(env, link);
+    fs.unlinkSync(env);
+    const denied = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: link } });
+    assert.equal(JSON.parse(denied.stdout).hookSpecificOutput.permissionDecision, 'deny', 'dangling to .env must deny');
+
+    // Dangling benign
+    const benign = path.join(root, 'benign.txt');
+    fs.writeFileSync(benign, 'hi');
+    const dangling = path.join(root, 'dangling.txt');
+    fs.symlinkSync(benign, dangling);
+    fs.unlinkSync(benign);
+    const allowed1 = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: dangling } });
+    assert.equal(allowed1.stdout, '', 'dangling benign should allow');
+
+    // Dangling to .env.example
+    const example = path.join(root, '.env.example');
+    fs.writeFileSync(example, 'EXAMPLE=1');
+    const linkExample = path.join(root, 'link-example.txt');
+    fs.symlinkSync(example, linkExample);
+    fs.unlinkSync(example);
+    const allowed2 = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: linkExample } });
+    assert.equal(allowed2.stdout, '', 'dangling to .env.example should allow');
+
+    // Real link to allowed example remains allowed
+    fs.writeFileSync(example, 'EXAMPLE=1');
+    const realLink = path.join(root, 'real-example.txt');
+    if (fs.existsSync(realLink)) fs.unlinkSync(realLink);
+    // remove previous dangling if exists
+    try { fs.unlinkSync(linkExample); } catch {}
+    fs.symlinkSync(example, realLink);
+    const allowed3 = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: realLink } });
+    assert.equal(allowed3.stdout, '', 'real link to .env.example should allow');
+
+    // Looping symlink fails closed
+    const a = path.join(root, 'loop-a');
+    const b = path.join(root, 'loop-b');
+    try { fs.unlinkSync(a); } catch {}
+    try { fs.unlinkSync(b); } catch {}
+    fs.symlinkSync(b, a);
+    fs.symlinkSync(a, b);
+    const looped = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: a } });
+    assert.equal(JSON.parse(looped.stdout).hookSpecificOutput.permissionDecision, 'deny', 'looping symlink should deny');
+  });
+});
+
+test('Codex privacy apply_patch with temp fixtures respects sensitive vs safe', () => {
+  inHookFixture((root, hooks) => {
+    const block = path.join(hooks, 'privacy-block.cjs');
+    const safePatch = '*** Begin Patch\n*** Update File: README.md\n+hi\n*** End Patch\n';
+    const safeRes = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'apply_patch', tool_input: { patch: safePatch } });
+    assert.equal(safeRes.stdout, '', 'safe patch should allow');
+    const sensitivePatch = '*** Begin Patch\n*** Update File: .env\n+SECRET=x\n*** End Patch\n';
+    const denied = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: 'apply_patch', tool_input: { patch: sensitivePatch } });
+    assert.equal(JSON.parse(denied.stdout).hookSpecificOutput.permissionDecision, 'deny');
+  });
+});
+
+test('Codex hook-context canonicalizes symlink project root (regression)', () => {
+  inHookFixture((root, hooks) => {
+    const hookContextPath = path.join(hooks, 'lib', 'hook-context.cjs');
+    const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-symroot-'));
+    try {
+      const linkRoot = path.join(outside, 'link-project');
+      fs.symlinkSync(root, linkRoot);
+      // Require the installed hook-context via the symlink path to see PROJECT_ROOT canonicalization
+      const linkedContext = require(path.join(linkRoot, '.codex', 'hooks', 'lib', 'hook-context.cjs'));
+      const realRoot = fs.realpathSync(root);
+      assert.equal(linkedContext.PROJECT_ROOT, realRoot, 'PROJECT_ROOT should be canonicalized via realpath');
+      // getHookContext should still work with cwd inside symlink root
+      const payload = { cwd: linkRoot, session_id: 's1' };
+      const ctx = linkedContext.getHookContext(payload);
+      assert.equal(ctx.projectRoot, realRoot);
+      assert.ok(ctx.sessionCwd, 'sessionCwd should be resolved');
+    } finally {
+      fs.rmSync(outside, { recursive: true, force: true });
+      // Clear require cache for the symlink context to avoid polluting other tests
+      Object.keys(require.cache).forEach((k) => { if (k.includes('link-project')) delete require.cache[k]; });
+    }
+  });
+});
+
+test('Codex resolver and state reject symlink escape', () => {
+  inHookFixture((root, hooks) => {
+    const specUtils = require(path.join(hooks, 'lib', 'spec-utils.cjs'));
+    const resolverPath = path.join(root, '.codex', 'scripts', 'spec-resolver.cjs');
+    const linkTarget = path.join(root, 'external.js');
+    fs.writeFileSync(linkTarget, 'module.exports = {}');
+    const original = fs.readFileSync(resolverPath);
+    fs.unlinkSync(resolverPath);
+    fs.symlinkSync(linkTarget, resolverPath);
+    assert.throws(() => specUtils.specsDirectory(root, {}), /symlink|rejected/i);
+    fs.unlinkSync(resolverPath);
+    fs.writeFileSync(resolverPath, original);
+    const scripts = path.dirname(resolverPath);
+    const outsideScripts = fs.mkdtempSync(path.join(os.tmpdir(), 'codex-scripts-outside-'));
+    try {
+      fs.cpSync(scripts, outsideScripts, { recursive: true });
+      fs.rmSync(scripts, { recursive: true, force: true });
+      fs.symlinkSync(outsideScripts, scripts);
+      assert.throws(() => specUtils.specsDirectory(root, {}), /symlink|trusted root|rejected/i);
+    } finally {
+      try { fs.unlinkSync(scripts); } catch {}
+      fs.mkdirSync(scripts, { recursive: true });
+      fs.copyFileSync(
+        path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-resolver.cjs'),
+        path.join(scripts, 'spec-resolver.cjs'),
+      );
+      fs.rmSync(outsideScripts, { recursive: true, force: true });
+    }
+    // State dir symlink escape: create symlink for session-state dir
+    const stateStore = require(path.join(hooks, 'lib', 'state-store.cjs'));
+    const sessionId = 'sess-symlink';
+    const dir = stateStore.stateDir(root, sessionId);
+    fs.mkdirSync(path.dirname(dir), { recursive: true });
+    // Create a symlink that points outside project
+    const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'outside-'));
+    try {
+      if (fs.existsSync(dir)) fs.rmSync(dir, { recursive: true, force: true });
+      fs.symlinkSync(outside, dir);
+      // withStateLock should handle symlink safely (no crash, no write outside)
+      const ok = stateStore.withStateLock(root, sessionId, () => {});
+      assert.equal(typeof ok, 'boolean');
+    } finally {
+      try { fs.unlinkSync(dir); } catch {}
+      fs.rmSync(outside, { recursive: true, force: true });
+    }
+  });
+});
+
+test('Codex privacy state rejects a symlinked state directory without external writes', () => {
+  inHookFixture((root, hooks) => {
+    const block = path.join(hooks, 'privacy-block.cjs');
+    const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'codex-privacy-outside-'));
+    const state = path.join(hooks, '.privacy');
+    try {
+      fs.symlinkSync(outside, state);
+      const result = runHook(block, root, {
+        cwd: root,
+        session_id: 'state-symlink',
+        hook_event_name: 'PreToolUse',
+        tool_name: 'Read',
+        tool_input: { file_path: path.join(root, '.env') },
+      });
+      const output = JSON.parse(result.stdout);
+      assert.equal(output.hookSpecificOutput.permissionDecision, 'deny');
+      assert.match(output.hookSpecificOutput.permissionDecisionReason, /could not be evaluated safely/i);
+      assert.deepEqual(fs.readdirSync(outside), []);
+    } finally {
+      try { fs.unlinkSync(state); } catch {}
+      fs.rmSync(outside, { recursive: true, force: true });
+    }
+  });
+});
+
+test('Claude and Codex fail closed consistently for malformed cwd payloads', () => {
+  inHookFixture((root, hooks) => {
+    const payload = {
+      cwd: 123,
+      session_id: 'malformed-cwd',
+      hook_event_name: 'PreToolUse',
+      tool_name: 'Read',
+      tool_input: { file_path: path.join(root, '.env') },
+    };
+    const claude = runHook(path.join(PACKAGE_ROOT, 'src/claude/hooks/privacy-block.cjs'), root, payload);
+    const codex = runHook(path.join(hooks, 'privacy-block.cjs'), root, payload);
+    assert.equal(JSON.parse(claude.stdout).hookSpecificOutput.permissionDecision, 'ask');
+    assert.equal(JSON.parse(codex.stdout).hookSpecificOutput.permissionDecision, 'deny');
+  });
+});