@haposoft/cafekit 0.16.0-rc.8 → 0.16.1

package/bin/__tests__/grok-envelope.test.js

@@ -0,0 +1,271 @@
+'use strict';
+
+// Grok CLI runs these hooks through its Claude-compatibility layer, so the scripts must
+// answer the same way whether the envelope came from Claude Code or from grok. Each case
+// runs a real hook as a child process from a tree shaped like an install, with grok's
+// camelCase envelope on stdin and CLAUDE_PROJECT_DIR set the way grok sets it.
+//
+// Every case names the gate it protects. Before the payload reader existed, each of them
+// answered nothing: the hook read an undefined key, found no tool and no path, and let
+// the call through while looking installed.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const MANIFEST = require(path.join(PACKAGE_ROOT, 'src/claude/migration-manifest.json'));
+
+/**
+ * A `.claude` tree holding exactly what an install ships, inside a git repository.
+ * The repository matters because the Stop gate derives provenance with git before it
+ * reads anything else.
+ */
+function withInstall(run, { git = false } = {}) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-grok-envelope-'));
+  try {
+    for (const rel of MANIFEST.runtime.files.filter((f) => f.startsWith('hooks/'))) {
+      const target = path.join(root, '.claude', rel);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude', rel), target);
+    }
+    fs.cpSync(path.join(PACKAGE_ROOT, 'src/claude/scripts'), path.join(root, '.claude', 'scripts'),
+      { recursive: true });
+    if (git) {
+      for (const args of [['init', '-q'], ['config', 'user.email', 'cafekit@example.invalid'],
+        ['config', 'user.name', 'CafeKit Test'], ['commit', '--allow-empty', '-qm', 'fixture']]) {
+        const r = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+        assert.equal(r.status, 0, r.stderr);
+      }
+    }
+    return run(root);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+/** Run one installed hook the way grok runs it. */
+function runHook(root, name, payload, args = []) {
+  const r = spawnSync(process.execPath, [path.join(root, '.claude', 'hooks', name), ...args], {
+    cwd: root,
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    // grok sets CLAUDE_PROJECT_DIR as an alias of GROK_WORKSPACE_ROOT on every hook.
+    env: { ...process.env, CLAUDE_PROJECT_DIR: root, PROJECT_ROOT: '', GROK_SESSION_ID: 'grok-1' },
+  });
+  return { code: r.status, stdout: r.stdout || '', stderr: r.stderr || '' };
+}
+
+function decisionOf(stdout) {
+  for (const line of stdout.trim().split('\n').filter(Boolean)) {
+    try {
+      const parsed = JSON.parse(line);
+      const d = parsed?.hookSpecificOutput?.permissionDecision ?? parsed?.decision;
+      if (d) return { decision: d, reason: parsed?.hookSpecificOutput?.permissionDecisionReason ?? parsed?.reason };
+    } catch { /* not JSON, keep looking */ }
+  }
+  return { decision: null, reason: null };
+}
+
+test('the privacy gate asks on a grok run_terminal_command', () => {
+  withInstall((root) => {
+    fs.writeFileSync(path.join(root, '.env'), 'TOKEN=redacted\n');
+    // grok's shell tool under grok's key names. Reading `data.tool_name` here yields
+    // undefined, so the command is never scanned and the secret is handed over.
+    const r = runHook(root, 'privacy-block.cjs', {
+      hookEventName: 'pre_tool_use',
+      sessionId: 'grok-1',
+      cwd: root,
+      toolName: 'run_terminal_command',
+      toolInput: { command: `cat ${path.join(root, '.env')}` },
+    });
+    const { decision, reason } = decisionOf(r.stdout);
+    assert.equal(decision, 'ask', 'a grok shell call touching .env must reach the approval prompt');
+    assert.match(reason, /\.env/, 'the prompt must name what it is protecting');
+  });
+});
+
+test('the privacy gate asks on a grok read_file path', () => {
+  withInstall((root) => {
+    fs.writeFileSync(path.join(root, '.env'), 'TOKEN=redacted\n');
+    // grok's read tool carries its argument as `path`, not `file_path`.
+    const r = runHook(root, 'privacy-block.cjs', {
+      hookEventName: 'pre_tool_use',
+      cwd: root,
+      toolName: 'read_file',
+      toolInput: { path: path.join(root, '.env') },
+    });
+    assert.equal(decisionOf(r.stdout).decision, 'ask');
+  });
+});
+
+test('an ordinary grok read is not disturbed', () => {
+  withInstall((root) => {
+    fs.writeFileSync(path.join(root, 'README.md'), '# hello\n');
+    const r = runHook(root, 'privacy-block.cjs', {
+      hookEventName: 'pre_tool_use',
+      cwd: root,
+      toolName: 'read_file',
+      toolInput: { path: path.join(root, 'README.md') },
+    });
+    assert.equal(decisionOf(r.stdout).decision, null, 'the gate must not ask about an ordinary file');
+    assert.equal(r.code, 0);
+  });
+});
+
+test('a broad glob is denied with its full reason in JSON', () => {
+  withInstall((root) => {
+    const r = runHook(root, 'inspect-block.cjs', {
+      hookEventName: 'pre_tool_use',
+      cwd: root,
+      toolName: 'Glob',
+      toolInput: { pattern: '**/*.ts' },
+    });
+    const { decision, reason } = decisionOf(r.stdout);
+    assert.equal(decision, 'deny');
+    // grok reads only the first stderr line, so the actionable half of the message has to
+    // travel in the JSON reason or the model is blocked without being told what to do.
+    assert.match(reason, /SCOPE LIMIT EXCEEDED/);
+    assert.match(reason, /Please narrow your scope/, 'the whole message must survive, not just its first line');
+    assert.equal(r.code, 2, 'exit 2 stays for a host that reads neither channel');
+  });
+});
+
+test('a nested task write is denied under the grok write tool', () => {
+  withInstall((root) => {
+    const target = path.join(root, 'specs', 'demo', 'tasks', 'task-R0-01-x.md');
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    // grok creates files with `write`; `search_replace` edits an existing one. The guard
+    // fires on Write only, so the alias has to keep those two apart.
+    const r = runHook(root, 'task-scaffold-guard.cjs', {
+      hookEventName: 'pre_tool_use',
+      cwd: root,
+      toolName: 'write',
+      toolInput: { path: target, content: '# x' },
+    });
+    const { decision, reason } = decisionOf(r.stdout);
+    assert.equal(decision, 'deny');
+    assert.match(reason, /TASK SCAFFOLD REQUIRED/);
+    assert.match(reason, /spec-scaffold\.cjs/, 'the command the model must run has to reach it');
+    assert.equal(r.code, 2);
+
+    // The escape route the message names must stay open: an edit is not a create.
+    const edit = runHook(root, 'task-scaffold-guard.cjs', {
+      hookEventName: 'pre_tool_use',
+      cwd: root,
+      toolName: 'search_replace',
+      toolInput: { path: target, old_string: 'a', new_string: 'b' },
+    });
+    assert.equal(decisionOf(edit.stdout).decision, null, 'search_replace must not be treated as a create');
+    assert.equal(edit.code, 0);
+  });
+});
+
+/** A packet the Stop gate will block: one done task with no receipt. */
+function unprovenPacket(root) {
+  const feature = path.join(root, 'specs', 'demo');
+  fs.mkdirSync(feature, { recursive: true });
+  fs.writeFileSync(path.join(feature, 'plan.md'), '# Demo plan\n');
+  fs.writeFileSync(path.join(feature, 'task-01-demo.md'), [
+    '# Task 01: demo', '', 'Status: done', '', '## Dependencies', '', '- none', '',
+    '## Verification Plan', '', '- Command: node --test', '',
+  ].join('\n'));
+}
+
+test('the Stop gate honours stopHookActive', () => {
+  withInstall((root) => {
+    // The fixture must be one the gate would otherwise block, or silence proves nothing:
+    // an empty specs directory makes the gate exit quietly for a different reason.
+    unprovenPacket(root);
+    // Without the guard the gate re-blocks its own continuation until grok's cap ends
+    // the turn eight rounds later.
+    const r = runHook(root, 'spec-gate.cjs', {
+      hookEventName: 'stop',
+      sessionId: 'grok-1',
+      cwd: root,
+      stopHookActive: true,
+    });
+    assert.equal(r.stdout.trim(), '', 'a continuation round must pass silently');
+    assert.equal(r.code, 0);
+  }, { git: true });
+});
+
+test('the Stop gate still blocks an unproven done task', () => {
+  withInstall((root) => {
+    unprovenPacket(root);
+    // The guard must not become a way through: a Stop with no continuation flag still
+    // faces the receipt check.
+    const r = runHook(root, 'spec-gate.cjs', {
+      hookEventName: 'stop', sessionId: 'grok-1', cwd: root, stopHookActive: false,
+    });
+    const body = decisionOf(r.stdout);
+    assert.equal(body.decision, 'block', 'a done task without a receipt must still be blocked');
+  }, { git: true });
+});
+
+test('the approval hook takes its approve path on a grok prompt', () => {
+  withInstall((root) => {
+    // Registered without an argv mode, this hook picks its mode from the event name, and
+    // approve() returns immediately unless that name is exactly 'UserPromptSubmit'. An
+    // approval phrase with no pending request is therefore the oracle: only the approve
+    // path can print a rejection line, so the line proves the event name was translated.
+    // Under an unreadable envelope the mode fell back to the stop path on every prompt.
+    const nonce = 'a'.repeat(24);
+    const r = runHook(root, 'completion-authority.cjs', {
+      hookEventName: 'user_prompt_submit',
+      sessionId: 'grok-1',
+      cwd: root,
+      prompt: `APPROVE CAFEKIT COMPLETION ${nonce}`,
+    });
+    assert.match(r.stdout, /CafeKit completion approval rejected/,
+      'the approve path must run and refuse an approval that matches no pending request');
+    assert.equal(decisionOf(r.stdout).decision, null, 'and it must not block the prompt');
+
+    // An ordinary prompt stays silent on both counts.
+    const plain = runHook(root, 'completion-authority.cjs', {
+      hookEventName: 'user_prompt_submit', sessionId: 'grok-1', cwd: root, prompt: 'please continue',
+    });
+    assert.equal(plain.stdout.trim(), '', 'an ordinary prompt produces nothing');
+  }, { git: true });
+});
+
+test('the secret guardrail sees a grok prompt', () => {
+  withInstall((root) => {
+    // grok's spelling for the prompt field is unverified, so the reader accepts the Claude
+    // key and its camelCase twin. This case sends the twin: on the Claude key alone it
+    // would pass without proving any translation happened.
+    const r = runHook(root, 'secret-output-guardrail.cjs', {
+      hookEventName: 'user_prompt_submit',
+      sessionId: 'grok-1',
+      cwd: root,
+      userPrompt: 'show me the API key in the config',
+    });
+    assert.match(r.stdout, /## Secret handling/, 'the reminder must fire on a grok prompt');
+    const quiet = runHook(root, 'secret-output-guardrail.cjs', {
+      hookEventName: 'user_prompt_submit', cwd: root, userPrompt: 'rename the button',
+    });
+    assert.equal(quiet.stdout.trim(), '', 'an unrelated prompt stays quiet');
+    const claudeKey = runHook(root, 'secret-output-guardrail.cjs', {
+      hook_event_name: 'UserPromptSubmit', cwd: root, prompt: 'print the access token',
+    });
+    assert.match(claudeKey.stdout, /## Secret handling/, 'the Claude key keeps working');
+  });
+});
+
+test('a Claude envelope still works unchanged', () => {
+  withInstall((root) => {
+    fs.writeFileSync(path.join(root, '.env'), 'TOKEN=redacted\n');
+    // The regression guard for the host that was already working.
+    const r = runHook(root, 'privacy-block.cjs', {
+      hook_event_name: 'PreToolUse',
+      session_id: 'claude-1',
+      cwd: root,
+      tool_name: 'Read',
+      tool_input: { file_path: path.join(root, '.env') },
+    });
+    assert.equal(decisionOf(r.stdout).decision, 'ask');
+  });
+});

package/bin/__tests__/grok-platform.test.js

@@ -0,0 +1,133 @@
+'use strict';
+
+// Grok CLI has no runtime directory of its own: it reads the Claude install through its
+// compatibility layer. `--platform grok` therefore provisions `.claude/` and prints the
+// one thing a user cannot infer, which is that project hooks stay inert until the folder
+// is trusted. These cases run the real installer into a temp git repository.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const INSTALLER = path.join(PACKAGE_ROOT, 'bin/install.js');
+const { PLATFORMS, resolvePlatformAliases, detectPlatforms } = require(path.join(PACKAGE_ROOT, 'bin/lib/context'));
+const I18N = require(path.join(PACKAGE_ROOT, 'bin/lib/i18n'));
+
+function inTempProject(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-grok-platform-'));
+  try {
+    const init = spawnSync('git', ['-C', root, 'init', '-q'], { encoding: 'utf8' });
+    assert.equal(init.status, 0, init.stderr);
+    return run(root);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+function install(root, platform, extra = []) {
+  return spawnSync(process.execPath, [INSTALLER, '--platform', platform, '--yes', ...extra],
+    { cwd: root, encoding: 'utf8', env: { ...process.env, HOME: path.join(root, 'home'), PATH: '/usr/bin:/bin' } });
+}
+
+test('grok is an alias, not a platform of its own', () => {
+  assert.equal(PLATFORMS.grok, undefined, 'a registry entry would create a .grok payload');
+  assert.deepEqual(resolvePlatformAliases(['grok']).platforms, ['claude']);
+  assert.equal(resolvePlatformAliases(['grok']).aliased, true);
+  assert.equal(resolvePlatformAliases(['claude']).aliased, false);
+});
+
+test('--platform grok installs the Claude runtime and no .grok directory', () => {
+  inTempProject((root) => {
+    const result = install(root, 'grok');
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+
+    assert.equal(fs.existsSync(path.join(root, '.claude', 'hooks', 'privacy-block.cjs')), true,
+      'grok runs the Claude gate scripts, so they have to be installed');
+    assert.equal(fs.existsSync(path.join(root, '.claude', 'settings.json')), true,
+      'grok discovers the hooks through this file');
+    assert.equal(fs.existsSync(path.join(root, '.grok')), false, 'CafeKit ships nothing under .grok');
+
+    const metadata = JSON.parse(fs.readFileSync(path.join(root, '.claude', 'cafekit.json'), 'utf8'));
+    assert.equal(metadata.platform, 'claude', 'the install is a Claude install and must record itself as one');
+  });
+});
+
+test('the trust reminder is printed once in the selected language', () => {
+  inTempProject((root) => {
+    const en = install(root, 'grok', ['--lang', 'en']);
+    assert.equal(en.status, 0, en.stderr);
+    const occurrences = en.stdout.split('grok --trust').length - 1;
+    assert.equal(occurrences, 1, 'the notice must appear exactly once');
+    assert.match(en.stdout, /\/hooks-trust/, 'both ways to grant trust are named');
+  });
+
+  inTempProject((root) => {
+    const vi = install(root, 'grok', ['--lang', 'vi']);
+    assert.equal(vi.status, 0, vi.stderr);
+    // The Vietnamese string, not the English one: the notice follows --lang like every
+    // other installer line.
+    assert.match(vi.stdout, /lớp tương thích Claude/);
+  });
+});
+
+test('grok and claude together install once', () => {
+  inTempProject((root) => {
+    const result = install(root, 'grok,claude');
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+    const lines = result.stdout.split('\n').filter((l) => l.includes('Claude Code'));
+    assert.ok(lines.length > 0, 'the Claude install must be reported');
+    const metadata = JSON.parse(fs.readFileSync(path.join(root, '.claude', 'cafekit.json'), 'utf8'));
+    assert.equal(metadata.platform, 'claude');
+    assert.equal(fs.existsSync(path.join(root, '.grok')), false);
+  });
+});
+
+test('a plain claude install prints no grok notice', () => {
+  inTempProject((root) => {
+    const result = install(root, 'claude');
+    assert.equal(result.status, 0, result.stderr);
+    assert.doesNotMatch(result.stdout, /grok --trust/, 'the alias must leave the Claude path unchanged');
+  });
+});
+
+test('.grok is not a detection marker', () => {
+  // A repository that merely holds `.grok/` has not asked for CafeKit. Adding `.grok` to
+  // Claude's detection markers would make a reinstall in a Codex project silently grow a
+  // `.claude/` tree beside it, because detected platforms are unioned with saved ones.
+  // (An install with no platform at all still defaults to Claude; that is separate, and
+  // predates this alias.)
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-grok-detect-'));
+  const cwd = process.cwd();
+  try {
+    fs.mkdirSync(path.join(root, '.grok', 'agents'), { recursive: true });
+    fs.mkdirSync(path.join(root, '.codex'), { recursive: true });
+    process.chdir(root);
+    const detected = detectPlatforms();
+    assert.deepEqual(detected, ['codex'], 'only the platform with a real payload may be detected');
+  } finally {
+    process.chdir(cwd);
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('an unknown platform is still rejected', () => {
+  inTempProject((root) => {
+    const result = install(root, 'nonesuch');
+    assert.notEqual(result.status, 0, 'the alias table must not swallow a typo');
+    assert.match(`${result.stdout}${result.stderr}`, /Unknown platform/);
+  });
+});
+
+test('the notice exists in every shipped locale', () => {
+  // A missing key renders as the key name, which is how a translation gap ships silently.
+  for (const code of I18N.SUPPORTED) {
+    const text = I18N.MESSAGES?.[code]?.grokCompatNotice ?? I18N[code]?.grokCompatNotice;
+    assert.ok(typeof text === 'string' && text.length > 0, `missing grokCompatNotice for ${code}`);
+    assert.match(text, /grok --trust/, `${code} must name the command`);
+    assert.match(text, /hooks-trust/, `${code} must name the slash command`);
+  }
+});

package/bin/__tests__/hook-payload.test.js

@@ -0,0 +1,194 @@
+'use strict';
+
+// The gate hooks read Claude Code's envelope. Grok CLI runs the same scripts through its
+// Claude-compatibility layer but sends camelCase keys and its own tool names, and omp's
+// bridge sends Claude keys with lowercase tool names. Each case below states the failure
+// it prevents, because every one of them is a gate that looks installed and answers
+// nothing when the reader gets a spelling wrong.
+//
+// Envelope samples follow grok 1.0.13's embedded hooks documentation; regenerate it with
+// `strings -n 6 ~/.grok/downloads/grok-1.0.13-macos-aarch64`.
+
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const { normalizeHookPayload, normalizeToolName } = require(
+  path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/hook-payload.cjs'));
+
+test('a grok PreToolUse envelope becomes the Claude payload', () => {
+  const grok = {
+    hookEventName: 'pre_tool_use',
+    sessionId: 'abc-123',
+    cwd: '/Users/you/project',
+    workspaceRoot: '/Users/you/project',
+    permissionMode: 'default',
+    toolName: 'run_terminal_command',
+    toolInput: { command: 'npm test' },
+    toolUseId: 'call_1',
+    timestamp: '2026-04-14T12:00:00Z',
+  };
+  const out = normalizeHookPayload(grok);
+  // The four keys every gate reads first. Without them privacy-block sees no tool and
+  // no command, and allows a call it was installed to examine.
+  assert.equal(out.hook_event_name, 'PreToolUse');
+  assert.equal(out.session_id, 'abc-123');
+  assert.equal(out.tool_name, 'Bash');
+  assert.deepEqual(out.tool_input, { command: 'npm test' });
+  assert.equal(out.tool_use_id, 'call_1');
+  assert.equal(out.permission_mode, 'default');
+  assert.equal(out.workspace_root, '/Users/you/project');
+  assert.equal(out.cwd, '/Users/you/project', 'cwd is already Claude-shaped and must survive');
+});
+
+test('read_file path becomes file_path', () => {
+  const out = normalizeHookPayload({
+    hookEventName: 'pre_tool_use',
+    toolName: 'read_file',
+    toolInput: { path: '/p/.env' },
+  });
+  assert.equal(out.tool_name, 'Read');
+  // privacy-block reads file_path and path, but task-scaffold-guard reads file_path first
+  // and inspect-block's path list is keyed the same way.
+  assert.equal(out.tool_input.file_path, '/p/.env');
+  assert.equal(out.tool_input.path, '/p/.env', 'the original key stays for hooks that read it');
+});
+
+test('an existing file_path is never overwritten by path', () => {
+  const out = normalizeHookPayload({
+    toolName: 'read_file',
+    toolInput: { file_path: '/p/real.txt', path: '/p/other.txt' },
+  });
+  assert.equal(out.tool_input.file_path, '/p/real.txt');
+});
+
+test('Stop and subagent fields map', () => {
+  const stop = normalizeHookPayload({
+    hookEventName: 'stop',
+    sessionId: 's1',
+    stopHookActive: true,
+    lastAssistantMessage: 'done',
+    reason: 'end_turn',
+  });
+  // Without stop_hook_active the Stop gate loses its loop guard and blocks every
+  // continuation round until the host's own cap ends the turn.
+  assert.equal(stop.hook_event_name, 'Stop');
+  assert.equal(stop.stop_hook_active, true);
+  assert.equal(stop.last_assistant_message, 'done');
+
+  const sub = normalizeHookPayload({
+    hookEventName: 'subagent_stop',
+    subagentType: 'code-auditor',
+    subagentId: 'agent-7',
+    lastAssistantMessage: 'REVIEW: PASS',
+  });
+  // semantic-review-authority refuses to record an attestation without agent_id.
+  assert.equal(sub.hook_event_name, 'SubagentStop');
+  assert.equal(sub.agent_type, 'code-auditor');
+  assert.equal(sub.agent_id, 'agent-7');
+
+  const post = normalizeHookPayload({ hookEventName: 'post_tool_use', toolResult: { ok: true } });
+  assert.deepEqual(post.tool_response, { ok: true });
+});
+
+test('every name reaching a Bash matcher becomes Bash', () => {
+  // Grok expands the Bash matcher to its own shell tools, so a call can arrive under any
+  // of these names. One unmapped name means privacy-block skips its command scan and a
+  // secret-bearing command is never examined.
+  for (const name of ['run_terminal_command', 'run_terminal_cmd', 'PowerShell', 'bash']) {
+    assert.equal(normalizeToolName(name), 'Bash', `${name} must reach the Bash rule`);
+  }
+});
+
+test('write and search_replace map to different Claude tools', () => {
+  // The scaffold guard only fires on Write. Grok creates files with `write` and edits
+  // them with `search_replace`; conflating them would either disable the guard or make it
+  // reject the Edit-fill step the guard's own message tells the model to run.
+  assert.equal(normalizeToolName('write'), 'Write');
+  assert.equal(normalizeToolName('delete_file'), 'Write');
+  assert.equal(normalizeToolName('search_replace'), 'Edit');
+  assert.equal(normalizeToolName('read_file'), 'Read');
+  assert.equal(normalizeToolName('grep'), 'Grep');
+  assert.equal(normalizeToolName('grep_search'), 'Grep');
+  assert.equal(normalizeToolName('list_dir'), 'Glob');
+  assert.equal(normalizeToolName('spawn_subagent'), 'Task');
+});
+
+test('omp lowercase names are aliased even under a snake_case key', () => {
+  // omp's bridge sends Claude-shaped keys with lowercase values, so a reader that only
+  // translated camelCase keys would leave `bash` unmapped and reopen the exact gap the
+  // omp tool-name table was written to close.
+  const out = normalizeHookPayload({
+    hook_event_name: 'PreToolUse',
+    session_id: 'omp-1',
+    tool_name: 'bash',
+    tool_input: { command: 'cat .env' },
+  });
+  assert.equal(out.tool_name, 'Bash');
+  for (const [omp, claude] of [['read', 'Read'], ['edit', 'Edit'], ['write', 'Write'], ['grep', 'Grep'], ['ls', 'Glob']]) {
+    assert.equal(normalizeToolName(omp), claude);
+  }
+});
+
+test('a Claude payload keeps its keys', () => {
+  const claude = {
+    hook_event_name: 'PreToolUse',
+    session_id: 's1',
+    cwd: '/p',
+    tool_name: 'Bash',
+    tool_input: { command: 'ls' },
+    transcript_path: '/p/t.jsonl',
+  };
+  const before = JSON.stringify(claude);
+  const out = normalizeHookPayload(claude);
+  assert.deepEqual(out, claude, 'a Claude payload must come back with the same keys and values');
+  assert.notEqual(out, claude, 'the reader returns a copy');
+  assert.equal(JSON.stringify(claude), before, 'the input must not be mutated');
+});
+
+test('an unknown tool name is left alone', () => {
+  // A future host tool degrades to "not specially handled" rather than being renamed into
+  // a privileged rule it does not belong to.
+  assert.equal(normalizeToolName('some_future_tool'), 'some_future_tool');
+  assert.equal(normalizeToolName('Bash'), 'Bash');
+  const out = normalizeHookPayload({ toolName: 'some_future_tool', toolInput: {} });
+  assert.equal(out.tool_name, 'some_future_tool');
+});
+
+test('hostile input never throws', () => {
+  // The Stop gate and the approval hook end in a catch that emits a block, so an
+  // exception raised here would block completion on Claude, not just under grok.
+  const hostile = [
+    null, undefined, 42, 'string', true, [],
+    { toolName: 42, toolInput: 'not-an-object' },
+    { toolInput: [] },
+    { hookEventName: {} },
+    JSON.parse('{"__proto__": {"polluted": true}, "toolName": "read_file"}'),
+    Object.create(null),
+  ];
+  for (const input of hostile) {
+    assert.doesNotThrow(() => normalizeHookPayload(input), `threw on ${JSON.stringify(input)}`);
+  }
+  assert.equal(normalizeHookPayload(null), null);
+  assert.equal(normalizeHookPayload(42), 42);
+  assert.deepEqual(normalizeHookPayload([]), []);
+  assert.equal({}.polluted, undefined, 'a __proto__ key must not reach Object.prototype');
+});
+
+test('the event map covers every event grok emits', () => {
+  const expected = {
+    pre_tool_use: 'PreToolUse', post_tool_use: 'PostToolUse',
+    post_tool_use_failure: 'PostToolUseFailure', permission_denied: 'PermissionDenied',
+    user_prompt_submit: 'UserPromptSubmit', session_start: 'SessionStart',
+    session_end: 'SessionEnd', stop: 'Stop', stop_failure: 'StopFailure',
+    stop_cancelled: 'StopCancelled', subagent_start: 'SubagentStart',
+    subagent_stop: 'SubagentStop', pre_compact: 'PreCompact', post_compact: 'PostCompact',
+    notification: 'Notification',
+  };
+  for (const [snake, pascal] of Object.entries(expected)) {
+    assert.equal(normalizeHookPayload({ hookEventName: snake }).hook_event_name, pascal);
+  }
+  assert.equal(normalizeHookPayload({ hook_event_name: 'Stop' }).hook_event_name, 'Stop',
+    'an already-PascalCase value is kept');
+});

package/bin/__tests__/installer-safety.test.js

@@ -228,8 +228,8 @@ test('combined install keeps CORE neutral and records native shared-root trade-o
       [agents, CODEX_START]
     ]) assert.equal((content.match(new RegExp(marker, 'g')) || []).length, 1);
 
-    assert.doesNotMatch(core, /Claude|Codex|\.claude|\.codex|\/hapo:|\$hapo-/i);
-    assert.doesNotMatch(claudeBlock, /Codex|\.codex|\$hapo-/i);
+    assert.doesNotMatch(core, /Claude|Codex|\.claude|\.codex|\/cf:|\$cf-/i);
+    assert.doesNotMatch(claudeBlock, /Codex|\.codex|\$cf-/i);
     assert.match(codex, /native project instruction surface is root `AGENTS\.md`/);
     assert.match(agents, /shared-root trade-off is intentional/);
     // H5 remediation: ownership/ignore contract must be explicit — not just marker presence
@@ -241,7 +241,7 @@ test('combined install keeps CORE neutral and records native shared-root trade-o
     assert.doesNotMatch(codex, /If you are Codex CLI or any other runtime, ignore this entire Codex block/i);
     assert.match(codex, /fail-safe/i);
     // CORE must not contain runtime-specific directives that would leak
-    assert.doesNotMatch(core, /\$hapo-|hapo:/i);
+    assert.doesNotMatch(core, /\$cf-|cf:/i);
     // No cross-runtime directive leakage: Claude block must not contain foreign runtime directives
     assert.doesNotMatch(claudeBlock, /<!-- CAFEKIT CODEX /);
     assert.doesNotMatch(codex, /<!-- CAFEKIT CORE /);