@haposoft/cafekit 0.16.0-rc.8 → 0.16.0

package/src/codex/hooks/rules.cjs

@@ -5,6 +5,7 @@ const fs = require('fs');
 const path = require('path');
 const {
   getHookContext,
+  hookStateDir,
   logCrash,
   readPayload,
   resolveProjectPath
@@ -15,7 +16,7 @@ function reservationFile(projectRoot, sessionId) {
     .update(String(sessionId || 'unknown'))
     .digest('hex')
     .slice(0, 16);
-  return path.join(projectRoot, '.codex', 'hooks', '.logs', `rules-${key}.json`);
+  return path.join(hookStateDir(projectRoot), `rules-${key}.json`);
 }
 
 /** Reserve one injection slot per session. Returns null on reservation errors. */
@@ -35,6 +36,28 @@ function reserveSession(projectRoot, sessionId) {
   }
 }
 
+/**
+ * Body of the output style for `codingLevel`, or null.
+ *
+ * Codex CLI has no output-style feature, so the style Claude Code would load natively is
+ * injected here instead. The rules hook reserves one injection per session, so this costs
+ * the same as a host-loaded style rather than repeating every turn.
+ */
+function readCodingStyle(projectRoot, level) {
+  if (!Number.isInteger(level) || level < 0 || level > 5) return null;
+  try {
+    const dir = path.join(projectRoot, '.codex', 'output-styles');
+    const match = fs.readdirSync(dir).find((name) => name.startsWith(`coding-level-${level}-`));
+    if (!match) return null;
+    const raw = fs.readFileSync(path.join(dir, match), 'utf8');
+    // Strip the frontmatter Claude Code reads; Codex only needs the instructions.
+    const body = raw.replace(/^---\n[\s\S]*?\n---\n/, '').trim();
+    return body || null;
+  } catch {
+    return null;
+  }
+}
+
 function readRuntime(projectRoot) {
   try {
     const file = path.join(projectRoot, '.codex', 'runtime.json');
@@ -74,6 +97,11 @@ try {
     `- docs.maxLoc: ${runtime.docs?.maxLoc || 800} lines per doc file`
   );
 
+  const style = readCodingStyle(projectRoot, runtime.codingLevel);
+  if (style) {
+    lines.push('', '## Communication style', style);
+  }
+
   process.stdout.write(`${lines.join('\n')}\n`);
 } catch (error) {
   logCrash('rules', error);

package/src/codex/hooks/secret-output-guardrail.cjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Copyright (c) 2026 Haposoft. MIT License.
+ *
+ * UserPromptSubmit hook — secret-output-guardrail.cjs (Codex)
+ *
+ * Mirror of the Claude hook. The privacy hook gates whether a sensitive file may be
+ * read; nothing gated whether an approved value may then be printed into the
+ * transcript, where it survives compaction and is replayed on every later turn.
+ *
+ * Reads the prompt and never echoes it: no prompt text and no matched value is
+ * written out, so the guardrail cannot itself become the leak. Fail-open.
+ */
+
+const { logCrash, readPayload } = require('./lib/hook-context.cjs');
+const { REMINDER, containsSecretKeyword } = require('./lib/secret-keywords.cjs');
+
+try {
+  const payload = readPayload();
+  if (!payload) process.exit(0);
+
+  const prompt = String(payload.prompt || payload.user_prompt || '');
+  if (!containsSecretKeyword(prompt)) process.exit(0);
+
+  process.stdout.write(`${REMINDER}\n`);
+} catch (error) {
+  logCrash('secret-output-guardrail', error);
+}

package/src/codex/hooks/spec-gate.cjs

@@ -6,6 +6,7 @@ const path = require('path');
 const {
   atomicWrite,
   getHookContext,
+  hookStateDir,
   logCrash,
   readPayload
 } = require('./lib/hook-context.cjs');
@@ -132,13 +133,7 @@ try {
   const currentStatuses = processWorkflow
     ? Object.fromEntries(Object.entries(registry).map(([taskPath, task]) => [taskPath, task?.status || 'pending']))
     : taskStatusMap(activeSpec);
-  const cacheFile = path.join(
-    projectRoot,
-    '.codex',
-    'hooks',
-    '.logs',
-    'spec-gate-last.json'
-  );
+  const cacheFile = path.join(hookStateDir(projectRoot), 'spec-gate-last.json');
   const cacheExists = fs.existsSync(cacheFile);
   let cache = {};
   if (cacheExists) {
@@ -169,7 +164,7 @@ try {
   if (staleFlashTasks.length > 0) {
     process.stdout.write(`${JSON.stringify({
       decision: 'block',
-      reason: `Completion gate: ${staleFlashTasks.length} task(s) marked done with FLASH_UNVERIFIED (${staleFlashTasks.join(', ')}). Run /hapo:test, then use explicit sync-finalize.`
+      reason: `Completion gate: ${staleFlashTasks.length} task(s) marked done with FLASH_UNVERIFIED (${staleFlashTasks.join(', ')}). Run /cf:test, then use explicit sync-finalize.`
     })}\n`);
     process.exit(0);
   }

package/src/codex/hooks/spec-state.cjs

@@ -7,6 +7,7 @@ const path = require('path');
 const {
   atomicWrite,
   getHookContext,
+  hookStateDir,
   logCrash,
   readPayload
 } = require('./lib/hook-context.cjs');
@@ -21,7 +22,7 @@ function cacheFile(projectRoot, sessionId) {
     .update(String(sessionId || 'unknown'))
     .digest('hex')
     .slice(0, 16);
-  return path.join(projectRoot, '.codex', 'hooks', '.logs', `tollgate-${key}.txt`);
+  return path.join(hookStateDir(projectRoot), `tollgate-${key}.txt`);
 }
 
 try {

package/src/codex/hooks.json

@@ -38,6 +38,11 @@
     "UserPromptSubmit": [
       {
         "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/secret-output-guardrail.cjs\"",
+            "commandWindows": "node \".codex/hooks/secret-output-guardrail.cjs\""
+          },
           {
             "type": "command",
             "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/privacy-approval.cjs\"",

package/src/codex/runtime.json

@@ -1,4 +1,5 @@
 {
+  "$schema": "./runtime.schema.json",
   "privacyBlock": true,
   "inspect": {
     "enabled": true
@@ -23,6 +24,7 @@
     "thinkingLanguage": null,
     "responseLanguage": null
   },
+  "codingLevel": 1,
   "hooks": {},
   "assertions": []
 }

package/src/common/.env.example

@@ -8,7 +8,7 @@
 # ============================================
 
 # Google Gemini / AI Studio API key
-# Required for hapo:test Multimodal Visual checks
+# Required for cf:test Multimodal Visual checks
 # Get from: https://aistudio.google.com/apikey
 GEMINI_API_KEY=
 

package/src/claude/skills/backend-development/SKILL.md

@@ -1,101 +0,0 @@
----
-name: hapo:backend-development
-description: Build backends with Node.js, Python, Go (NestJS, FastAPI, Django). Use for REST/GraphQL/gRPC APIs, auth (OAuth, JWT), databases, microservices, security (OWASP), Docker/K8s.
-license: MIT
-user-invocable: true
-when_to_use: "Invoke to build or modify server APIs, services, and data layers."
-category: backend
-keywords: [backend, api, server, database]
-argument-hint: "[framework] [task]"
-metadata:
-  author: haposoft
-  version: "1.0.0"
----
-# Backend Development Skill
-
-Production-ready backend development with modern technologies, best practices, and proven patterns.
-
-## When to Use
-
-- Designing RESTful, GraphQL, or gRPC APIs
-- Building authentication/authorization systems
-- Optimizing database queries and schemas
-- Implementing caching and performance optimization
-- OWASP Top 10 security mitigation
-- Designing scalable microservices
-- Testing strategies (unit, integration, E2E)
-- CI/CD pipelines and deployment
-- Monitoring and debugging production systems
-
-## Technology Selection Guide
-
-**Languages:** Node.js/TypeScript (full-stack), Python (data/ML), Go (concurrency), Rust (performance)
-**Frameworks:** NestJS, FastAPI, Django, Express, Gin
-**Databases:** PostgreSQL (ACID), MongoDB (flexible schema), Redis (caching)
-**APIs:** REST (simple), GraphQL (flexible), gRPC (performance)
-
-See: `references/backend-technologies.md` for detailed comparisons
-
-## Reference Navigation
-
-**Core Technologies:**
-- `backend-technologies.md` - Languages, frameworks, databases, message queues, ORMs
-- `backend-api-design.md` - REST, GraphQL, gRPC patterns and best practices
-
-**Security & Authentication:**
-- `backend-security.md` - OWASP Top 10 2025, security best practices, input validation
-- `backend-authentication.md` - OAuth 2.1, JWT, RBAC, MFA, session management
-
-**Performance & Architecture:**
-- `backend-performance.md` - Caching, query optimization, load balancing, scaling
-- `backend-architecture.md` - Microservices, event-driven, CQRS, saga patterns
-
-**Quality & Operations:**
-- `backend-testing.md` - Testing strategies, frameworks, tools, CI/CD testing
-- `backend-code-quality.md` - SOLID principles, design patterns, clean code
-- `backend-devops.md` - Docker, Kubernetes, deployment strategies, monitoring
-- `backend-debugging.md` - Debugging strategies, profiling, logging, production debugging
-- `backend-mindset.md` - Problem-solving, architectural thinking, collaboration
-
-## Key Best Practices (2025)
-
-**Security:** Argon2id passwords, parameterized queries prevent SQL injection, OAuth 2.1 + PKCE, rate limiting, security headers
-
-**Performance:** Redis caching reduces DB load, database indexing reduces I/O, CDN cuts latency, connection pooling
-
-**Testing:** 70-20-10 pyramid (unit-integration-E2E), Vitest or Jest, contract testing for microservices, migration tests
-
-**DevOps:** Blue-green/canary deployments, feature flags can reduce failures, Kubernetes, Prometheus/Grafana monitoring, OpenTelemetry tracing
-
-## Quick Decision Matrix
-
-| Need | Choose |
-|------|--------|
-| Fast development | Node.js + NestJS |
-| Data/ML integration | Python + FastAPI |
-| High concurrency | Go + Gin |
-| Max performance | Rust + Axum |
-| ACID transactions | PostgreSQL |
-| Flexible schema | MongoDB |
-| Caching | Redis |
-| Internal services | gRPC |
-| Public APIs | GraphQL/REST |
-| Real-time events | Kafka |
-
-## Implementation Checklist
-
-**API:** Choose style → Design schema → Validate input → Add auth → Rate limiting → Documentation → Error handling
-
-**Database:** Choose DB → Design schema → Create indexes → Connection pooling → Migration strategy → Backup/restore → Test performance
-
-**Security:** OWASP Top 10 → Parameterized queries → OAuth 2.1 + JWT → Security headers → Rate limiting → Input validation → Argon2id passwords
-
-**Testing:** Unit 70% → Integration 20% → E2E 10% → Load tests → Migration tests → Contract tests (microservices)
-
-**Deployment:** Docker → CI/CD → Blue-green/canary → Feature flags → Monitoring → Logging → Health checks
-
-## Resources
-
-- OWASP Top 10: https://owasp.org/www-project-top-ten/
-- OAuth 2.1: https://oauth.net/2.1/
-- OpenTelemetry: https://opentelemetry.io/