@haposoft/cafekit 0.16.0-rc.7 → 0.16.0

package/src/codex/hooks/rules.cjs

@@ -5,6 +5,7 @@ const fs = require('fs');
 const path = require('path');
 const {
   getHookContext,
+  hookStateDir,
   logCrash,
   readPayload,
   resolveProjectPath
@@ -15,7 +16,7 @@ function reservationFile(projectRoot, sessionId) {
     .update(String(sessionId || 'unknown'))
     .digest('hex')
     .slice(0, 16);
-  return path.join(projectRoot, '.codex', 'hooks', '.logs', `rules-${key}.json`);
+  return path.join(hookStateDir(projectRoot), `rules-${key}.json`);
 }
 
 /** Reserve one injection slot per session. Returns null on reservation errors. */
@@ -35,6 +36,28 @@ function reserveSession(projectRoot, sessionId) {
   }
 }
 
+/**
+ * Body of the output style for `codingLevel`, or null.
+ *
+ * Codex CLI has no output-style feature, so the style Claude Code would load natively is
+ * injected here instead. The rules hook reserves one injection per session, so this costs
+ * the same as a host-loaded style rather than repeating every turn.
+ */
+function readCodingStyle(projectRoot, level) {
+  if (!Number.isInteger(level) || level < 0 || level > 5) return null;
+  try {
+    const dir = path.join(projectRoot, '.codex', 'output-styles');
+    const match = fs.readdirSync(dir).find((name) => name.startsWith(`coding-level-${level}-`));
+    if (!match) return null;
+    const raw = fs.readFileSync(path.join(dir, match), 'utf8');
+    // Strip the frontmatter Claude Code reads; Codex only needs the instructions.
+    const body = raw.replace(/^---\n[\s\S]*?\n---\n/, '').trim();
+    return body || null;
+  } catch {
+    return null;
+  }
+}
+
 function readRuntime(projectRoot) {
   try {
     const file = path.join(projectRoot, '.codex', 'runtime.json');
@@ -74,6 +97,11 @@ try {
     `- docs.maxLoc: ${runtime.docs?.maxLoc || 800} lines per doc file`
   );
 
+  const style = readCodingStyle(projectRoot, runtime.codingLevel);
+  if (style) {
+    lines.push('', '## Communication style', style);
+  }
+
   process.stdout.write(`${lines.join('\n')}\n`);
 } catch (error) {
   logCrash('rules', error);

package/src/codex/hooks/secret-output-guardrail.cjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Copyright (c) 2026 Haposoft. MIT License.
+ *
+ * UserPromptSubmit hook — secret-output-guardrail.cjs (Codex)
+ *
+ * Mirror of the Claude hook. The privacy hook gates whether a sensitive file may be
+ * read; nothing gated whether an approved value may then be printed into the
+ * transcript, where it survives compaction and is replayed on every later turn.
+ *
+ * Reads the prompt and never echoes it: no prompt text and no matched value is
+ * written out, so the guardrail cannot itself become the leak. Fail-open.
+ */
+
+const { logCrash, readPayload } = require('./lib/hook-context.cjs');
+const { REMINDER, containsSecretKeyword } = require('./lib/secret-keywords.cjs');
+
+try {
+  const payload = readPayload();
+  if (!payload) process.exit(0);
+
+  const prompt = String(payload.prompt || payload.user_prompt || '');
+  if (!containsSecretKeyword(prompt)) process.exit(0);
+
+  process.stdout.write(`${REMINDER}\n`);
+} catch (error) {
+  logCrash('secret-output-guardrail', error);
+}

package/src/codex/hooks/spec-gate.cjs

@@ -6,6 +6,7 @@ const path = require('path');
 const {
   atomicWrite,
   getHookContext,
+  hookStateDir,
   logCrash,
   readPayload
 } = require('./lib/hook-context.cjs');
@@ -132,13 +133,7 @@ try {
   const currentStatuses = processWorkflow
     ? Object.fromEntries(Object.entries(registry).map(([taskPath, task]) => [taskPath, task?.status || 'pending']))
     : taskStatusMap(activeSpec);
-  const cacheFile = path.join(
-    projectRoot,
-    '.codex',
-    'hooks',
-    '.logs',
-    'spec-gate-last.json'
-  );
+  const cacheFile = path.join(hookStateDir(projectRoot), 'spec-gate-last.json');
   const cacheExists = fs.existsSync(cacheFile);
   let cache = {};
   if (cacheExists) {
@@ -169,7 +164,7 @@ try {
   if (staleFlashTasks.length > 0) {
     process.stdout.write(`${JSON.stringify({
       decision: 'block',
-      reason: `Completion gate: ${staleFlashTasks.length} task(s) marked done with FLASH_UNVERIFIED (${staleFlashTasks.join(', ')}). Run /hapo:test, then use explicit sync-finalize.`
+      reason: `Completion gate: ${staleFlashTasks.length} task(s) marked done with FLASH_UNVERIFIED (${staleFlashTasks.join(', ')}). Run /cf:test, then use explicit sync-finalize.`
     })}\n`);
     process.exit(0);
   }

package/src/codex/hooks/spec-state.cjs

@@ -7,6 +7,7 @@ const path = require('path');
 const {
   atomicWrite,
   getHookContext,
+  hookStateDir,
   logCrash,
   readPayload
 } = require('./lib/hook-context.cjs');
@@ -21,7 +22,7 @@ function cacheFile(projectRoot, sessionId) {
     .update(String(sessionId || 'unknown'))
     .digest('hex')
     .slice(0, 16);
-  return path.join(projectRoot, '.codex', 'hooks', '.logs', `tollgate-${key}.txt`);
+  return path.join(hookStateDir(projectRoot), `tollgate-${key}.txt`);
 }
 
 try {
@@ -77,15 +78,33 @@ try {
     result[status] = (result[status] || 0) + 1;
     return result;
   }, {});
+  const featureDir = path.join(active.specsDir, active.featureName);
   const statuses = new Map(tasks.map(([taskPath, task]) => [
     taskPath,
     task?.status || 'pending'
   ]));
+  const dependencyProof = processWorkflow
+    ? RECEIPT.workflowDependencyProofState(featureDir, taskRegistry, runtimeContext, POLICY)
+    : {};
+  const taskState = tasks.map(([taskPath, task]) => [
+    taskPath,
+    task?.status || 'pending',
+    [...(Array.isArray(task?.dependencies) ? task.dependencies : [])].sort(),
+  ]).sort(([left], [right]) => left.localeCompare(right));
+  const proofState = Object.entries(dependencyProof).map(([taskPath, proof]) => [
+    taskPath,
+    proof.done,
+    proof.valid,
+    proof.eligible,
+    proof.signature,
+  ]);
   const next = tasks.find(([, task]) => (
-    (task?.status || 'pending') === 'pending'
-    && (task?.dependencies || []).every((dependency) => statuses.get(dependency) === 'done')
+    active.queueReady !== false
+    && (task?.status || 'pending') === 'pending'
+    && (task?.dependencies || []).every((dependency) => (
+      processWorkflow ? dependencyProof[dependency]?.eligible === true : statuses.get(dependency) === 'done'
+    ))
   ));
-  const featureDir = path.join(active.specsDir, active.featureName);
   const featureReceiptPresent = !processWorkflow
     && RECEIPT.safeRead(featureDir, 'feature-receipt.md').status === 'ok';
   const stateKey = JSON.stringify({
@@ -99,6 +118,10 @@ try {
     Head: runtimeContext.head,
     context_id: runtimeContext.context_id,
     phase,
+    workflow_contract: active.workflowContract || null,
+    queue_ready: active.queueReady !== false,
+    task_state: taskState,
+    proof_state: proofState,
     done: counts.done || 0,
     total: tasks.length,
     feature_receipt_present: featureReceiptPresent,
@@ -108,9 +131,12 @@ try {
   try { previous = fs.readFileSync(cache, 'utf8').trim(); } catch { /* first run */ }
 
   if (previous === stateKey) {
+    const migration = processWorkflow && active.queueReady === false
+      ? ' Add `Specs-Contract: process-first-ready-v1` after the plan title before tasks can enter Next.'
+      : '';
     process.stdout.write(
       `> Spec \`${active.featureName}\` @ \`${phase}\` `
-      + `(${counts.done || 0}/${tasks.length} tasks done). Tollgate active.\n`
+      + `(${counts.done || 0}/${tasks.length} tasks done). Tollgate active.${migration}\n`
     );
     process.exit(0);
   }
@@ -125,6 +151,9 @@ try {
     lines.push(`- Flash verification pending: ${flashTasks.map((taskPath) => `\`${taskPath}\``).join(', ')}. A PASS proof keeps the persisted task in_progress until explicit sync-finalize.`);
   }
   if (processWorkflow) {
+    if (active.queueReady === false) {
+      lines.push('- Migration required: add `Specs-Contract: process-first-ready-v1` after the plan title before tasks can enter Next.');
+    }
     lines.push(
       '- Sync each flat task `Status:` only after verified work; task proof belongs in that task\'s inline `## Receipt`.',
       `- Workflow source: \`specs/${active.featureName}/plan.md\`; Stop revalidates every task currently marked done.`,

package/src/codex/hooks.json

@@ -38,6 +38,11 @@
     "UserPromptSubmit": [
       {
         "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/secret-output-guardrail.cjs\"",
+            "commandWindows": "node \".codex/hooks/secret-output-guardrail.cjs\""
+          },
           {
             "type": "command",
             "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/privacy-approval.cjs\"",

package/src/codex/runtime.json

@@ -1,4 +1,5 @@
 {
+  "$schema": "./runtime.schema.json",
   "privacyBlock": true,
   "inspect": {
     "enabled": true
@@ -23,6 +24,7 @@
     "thinkingLanguage": null,
     "responseLanguage": null
   },
+  "codingLevel": 1,
   "hooks": {},
   "assertions": []
 }

package/src/common/.env.example

@@ -8,7 +8,7 @@
 # ============================================
 
 # Google Gemini / AI Studio API key
-# Required for hapo:test Multimodal Visual checks
+# Required for cf:test Multimodal Visual checks
 # Get from: https://aistudio.google.com/apikey
 GEMINI_API_KEY=
 

package/src/claude/skills/backend-development/SKILL.md

@@ -1,101 +0,0 @@
----
-name: hapo:backend-development
-description: Build backends with Node.js, Python, Go (NestJS, FastAPI, Django). Use for REST/GraphQL/gRPC APIs, auth (OAuth, JWT), databases, microservices, security (OWASP), Docker/K8s.
-license: MIT
-user-invocable: true
-when_to_use: "Invoke to build or modify server APIs, services, and data layers."
-category: backend
-keywords: [backend, api, server, database]
-argument-hint: "[framework] [task]"
-metadata:
-  author: haposoft
-  version: "1.0.0"
----
-# Backend Development Skill
-
-Production-ready backend development with modern technologies, best practices, and proven patterns.
-
-## When to Use
-
-- Designing RESTful, GraphQL, or gRPC APIs
-- Building authentication/authorization systems
-- Optimizing database queries and schemas
-- Implementing caching and performance optimization
-- OWASP Top 10 security mitigation
-- Designing scalable microservices
-- Testing strategies (unit, integration, E2E)
-- CI/CD pipelines and deployment
-- Monitoring and debugging production systems
-
-## Technology Selection Guide
-
-**Languages:** Node.js/TypeScript (full-stack), Python (data/ML), Go (concurrency), Rust (performance)
-**Frameworks:** NestJS, FastAPI, Django, Express, Gin
-**Databases:** PostgreSQL (ACID), MongoDB (flexible schema), Redis (caching)
-**APIs:** REST (simple), GraphQL (flexible), gRPC (performance)
-
-See: `references/backend-technologies.md` for detailed comparisons
-
-## Reference Navigation
-
-**Core Technologies:**
-- `backend-technologies.md` - Languages, frameworks, databases, message queues, ORMs
-- `backend-api-design.md` - REST, GraphQL, gRPC patterns and best practices
-
-**Security & Authentication:**
-- `backend-security.md` - OWASP Top 10 2025, security best practices, input validation
-- `backend-authentication.md` - OAuth 2.1, JWT, RBAC, MFA, session management
-
-**Performance & Architecture:**
-- `backend-performance.md` - Caching, query optimization, load balancing, scaling
-- `backend-architecture.md` - Microservices, event-driven, CQRS, saga patterns
-
-**Quality & Operations:**
-- `backend-testing.md` - Testing strategies, frameworks, tools, CI/CD testing
-- `backend-code-quality.md` - SOLID principles, design patterns, clean code
-- `backend-devops.md` - Docker, Kubernetes, deployment strategies, monitoring
-- `backend-debugging.md` - Debugging strategies, profiling, logging, production debugging
-- `backend-mindset.md` - Problem-solving, architectural thinking, collaboration
-
-## Key Best Practices (2025)
-
-**Security:** Argon2id passwords, parameterized queries prevent SQL injection, OAuth 2.1 + PKCE, rate limiting, security headers
-
-**Performance:** Redis caching reduces DB load, database indexing reduces I/O, CDN cuts latency, connection pooling
-
-**Testing:** 70-20-10 pyramid (unit-integration-E2E), Vitest or Jest, contract testing for microservices, migration tests
-
-**DevOps:** Blue-green/canary deployments, feature flags can reduce failures, Kubernetes, Prometheus/Grafana monitoring, OpenTelemetry tracing
-
-## Quick Decision Matrix
-
-| Need | Choose |
-|------|--------|
-| Fast development | Node.js + NestJS |
-| Data/ML integration | Python + FastAPI |
-| High concurrency | Go + Gin |
-| Max performance | Rust + Axum |
-| ACID transactions | PostgreSQL |
-| Flexible schema | MongoDB |
-| Caching | Redis |
-| Internal services | gRPC |
-| Public APIs | GraphQL/REST |
-| Real-time events | Kafka |
-
-## Implementation Checklist
-
-**API:** Choose style → Design schema → Validate input → Add auth → Rate limiting → Documentation → Error handling
-
-**Database:** Choose DB → Design schema → Create indexes → Connection pooling → Migration strategy → Backup/restore → Test performance
-
-**Security:** OWASP Top 10 → Parameterized queries → OAuth 2.1 + JWT → Security headers → Rate limiting → Input validation → Argon2id passwords
-
-**Testing:** Unit 70% → Integration 20% → E2E 10% → Load tests → Migration tests → Contract tests (microservices)
-
-**Deployment:** Docker → CI/CD → Blue-green/canary → Feature flags → Monitoring → Logging → Health checks
-
-## Resources
-
-- OWASP Top 10: https://owasp.org/www-project-top-ten/
-- OAuth 2.1: https://oauth.net/2.1/
-- OpenTelemetry: https://opentelemetry.io/