@haposoft/cafekit 0.16.0-rc.8 → 0.16.1

package/bin/__tests__/omp-bridge.test.js

@@ -0,0 +1,168 @@
+'use strict';
+
+// omp has no hooks.json. The bridge is the only thing between omp's lifecycle events and
+// CafeKit's gate scripts, so a mistranslation disables every gate while looking installed.
+// These tests drive the bridge's exported functions against real child hook processes from
+// the tree an omp install produces: the Claude hook set with the omp overlay written over
+// it. They do not launch omp, which needs provider credentials; the contract rows they rely
+// on were read from the installed omp binary and are recorded in plan.md.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const BRIDGE = path.join(PACKAGE_ROOT, 'src/omp/extensions/cafekit-bridge.mjs');
+const SETTINGS = require(path.join(PACKAGE_ROOT, 'src/claude/settings/settings.json'));
+const MANIFEST = require(path.join(PACKAGE_ROOT, 'src/claude/migration-manifest.json'));
+const { PREFIX } = require(path.join(PACKAGE_ROOT, 'src/claude/hooks/completion-authority-state.cjs'));
+
+/**
+ * The hooks an omp install runs: the Claude set the manifest ships, then `src/omp/hooks/`
+ * written over it. Composed once under a dotted folder so runtime-dir.cjs derives `.omp`.
+ */
+const COMPOSED_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-composed-'));
+const HOOKS = path.join(COMPOSED_ROOT, '.omp', 'hooks');
+for (const rel of MANIFEST.runtime.files.filter((f) => f.startsWith('hooks/'))) {
+  const target = path.join(COMPOSED_ROOT, '.omp', rel);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude', rel), target);
+}
+fs.cpSync(path.join(PACKAGE_ROOT, 'src/omp/hooks'), HOOKS, { recursive: true });
+fs.cpSync(path.join(PACKAGE_ROOT, 'src/claude/scripts'), path.join(COMPOSED_ROOT, '.omp', 'scripts'), { recursive: true });
+
+let bridge;
+test.before(async () => { bridge = await import(BRIDGE); });
+test.after(() => { fs.rmSync(COMPOSED_ROOT, { recursive: true, force: true }); });
+
+function tempProject(withSecret = true) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-bridge-'));
+  if (withSecret) fs.writeFileSync(path.join(root, '.env'), 'TOKEN=redacted\n');
+  return root;
+}
+
+function registered(eventName) {
+  return (SETTINGS.hooks[eventName] || [])
+    .flatMap((g) => g.hooks || [])
+    .map((h) => (h.command.match(/hooks\/([a-z-]+\.cjs)/) || [])[1])
+    .filter(Boolean);
+}
+
+test('the dispatch table mirrors settings.json for every event omp can deliver', () => {
+  const { DISPATCH } = bridge;
+  const pairs = [
+    ['session_start', 'SessionStart'], ['session_before_compact', 'PreCompact'],
+    ['input', 'UserPromptSubmit'], ['tool_call', 'PreToolUse'],
+    ['tool_result', 'PostToolUse'], ['session_stop', 'Stop'],
+  ];
+  for (const [omp, claude] of pairs) {
+    assert.deepEqual([...DISPATCH[omp].hooks].sort(), [...new Set(registered(claude))].sort(),
+      `${omp} must dispatch exactly the hooks settings.json registers for ${claude}`);
+  }
+  // omp has no subagent events; the gap is deliberate and documented, not forgotten.
+  assert.ok(!Object.values(DISPATCH).some((e) => e.event.startsWith('Subagent')));
+});
+
+test('every dispatch carries a stable session id and the project cwd', () => {
+  const { shapePayload } = bridge;
+  const ctx = { cwd: '/tmp/project' };
+  const a = shapePayload('input', { text: 'hi', source: 'user' }, ctx);
+  const b = shapePayload('tool_call', { toolName: 'bash', input: { command: 'ls' } }, ctx);
+  assert.ok(a.session_id && a.session_id === b.session_id,
+    'omp input carries no session id; rules.cjs exits without one, so the bridge must mint and reuse it');
+  assert.equal(a.cwd, '/tmp/project', 'spec-gate.cjs falls back to payload.cwd to find the project');
+  assert.equal(shapePayload('session_stop', { session_id: 'omp-real' }, ctx).session_id, 'omp-real',
+    'a session id omp does provide must win over the minted one');
+});
+
+test('each denial mechanism becomes an omp block carrying the hook reason', () => {
+  const { interpretVerdict } = bridge;
+  const stop = interpretVerdict({ code: 0, stdout: '{"decision":"block","reason":"R1"}\n' }, 'spec-gate.cjs');
+  assert.deepEqual([stop.block, stop.reason], [true, 'R1']);
+  const deny = interpretVerdict({ code: 0, stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: 'R2' } }) }, 'privacy-block.cjs');
+  assert.deepEqual([deny.block, deny.reason], [true, 'R2']);
+  // inspect-block / task-scaffold-guard exit 2 and write the reason on STDOUT, not stderr.
+  const exit2 = interpretVerdict({ code: 2, stdout: 'SCOPE LIMIT EXCEEDED\nRestricted zones: node_modules', stderr: '' }, 'inspect-block.cjs');
+  assert.equal(exit2.block, true);
+  assert.match(exit2.reason, /SCOPE LIMIT EXCEEDED/, 'a stderr-only reader would drop this reason');
+  // An ask under Claude has no omp equivalent; it must not fall through to allow.
+  const ask = interpretVerdict({ code: 0, stdout: JSON.stringify({ hookSpecificOutput: { permissionDecision: 'ask', permissionDecisionReason: 'R3' } }) }, 'x');
+  assert.equal(ask.block, true);
+  // Plain text that is not a verdict is context to inject, not a block.
+  const inject = interpretVerdict({ code: 0, stdout: '## Rules\n- keep docs under 800 lines' }, 'rules.cjs');
+  assert.deepEqual([inject.block, inject.inject.startsWith('## Rules')], [false, true]);
+});
+
+test('a lowercase bash command on a secret file is blocked end to end through the real fork', async () => {
+  const root = tempProject();
+  try {
+    const r = await bridge.runEvent('tool_call',
+      { toolName: 'bash', toolCallId: 'c1', input: { command: `cat ${path.join(root, '.env')}` } },
+      { cwd: root }, { dir: HOOKS });
+    assert.equal(r.block, true);
+    assert.equal(r.hook, 'privacy-block.cjs');
+    assert.match(r.reason, /\.env/, 'the block must name what it protected');
+    const ok = await bridge.runEvent('tool_call',
+      { toolName: 'read', toolCallId: 'c2', input: { file_path: path.join(root, 'README.md') } },
+      { cwd: root }, { dir: HOOKS });
+    assert.equal(ok.block, false, 'an ordinary read must not be blocked');
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});
+
+test('a slow hook blocks with its own name before omp cuts it off', async () => {
+  const slow = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-slow-'));
+  try {
+    fs.writeFileSync(path.join(slow, 'privacy-block.cjs'), 'setTimeout(() => {}, 60000);');
+    assert.ok(bridge.BRIDGE_TIMEOUT_MS < 30000, 'omp substitutes a reasonless block at 30000 ms');
+    const t0 = Date.now();
+    const r = await bridge.runEvent('tool_call', { toolName: 'bash', input: { command: 'ls' } }, { cwd: slow }, { dir: slow, timeoutMs: 300 });
+    assert.equal(r.block, true);
+    assert.match(r.reason, /privacy-block\.cjs exceeded 300 ms/);
+    assert.ok(Date.now() - t0 < 5000, 'the budget must actually fire');
+  } finally { fs.rmSync(slow, { recursive: true, force: true }); }
+});
+
+test('a crashing or missing gate blocks on gating events instead of silently allowing', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-crash-'));
+  try {
+    // Only the crashing gate is under test; the other two PreToolUse gates get allow stubs,
+    // otherwise their absence is what blocks (see the missing-gate case below).
+    fs.writeFileSync(path.join(dir, 'privacy-block.cjs'), 'throw new Error("boom");');
+    for (const stub of ['inspect-block.cjs', 'task-scaffold-guard.cjs']) fs.writeFileSync(path.join(dir, stub), 'process.exit(0);');
+    const crash = await bridge.runEvent('tool_call', { toolName: 'bash', input: { command: 'ls' } }, { cwd: dir }, { dir });
+    // A bare exit 1 with no verdict is an allow under the hooks' own contract. Real gates
+    // never surface a crash this way: the fork's privacy-block catch-all converts its own
+    // errors into a deny, which the fork tests pin separately.
+    assert.equal(crash.block, false, 'exit 1 with no verdict is an allow per the hooks\' own contract');
+    const missing = await bridge.runEvent('tool_call', { toolName: 'bash', input: { command: 'ls' } }, { cwd: dir }, { dir: path.join(dir, 'nowhere') });
+    assert.equal(missing.block, true, 'a gate that is not installed must be loud, not a silent allow');
+    assert.match(missing.reason, /not installed/);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('stop_hook_active short-circuits the gate so a blocked turn cannot loop forever', async () => {
+  const r = await bridge.runEvent('session_stop', { stop_hook_active: true, session_id: 's1' }, { cwd: os.tmpdir() }, { dir: HOOKS });
+  assert.deepEqual([r.block, r.skipped], [false, 'stop_hook_active']);
+});
+
+test('the approval phrase reaches completion-authority through the input event', async () => {
+  const { DISPATCH, shapePayload } = bridge;
+  assert.ok(DISPATCH.input.hooks.includes('completion-authority.cjs'),
+    'the --approve path only runs on UserPromptSubmit; without this routing a blocked turn has no exit');
+  const phrase = `${PREFIX}${'a'.repeat(24)}`;
+  const p = shapePayload('input', { text: phrase, source: 'user' }, { cwd: '/tmp/p' });
+  assert.equal(p.hook_event_name, 'UserPromptSubmit', 'completion-authority selects --approve from this field');
+  assert.equal(p.prompt, phrase, 'the phrase must arrive byte-exact; the hook compares it exactly');
+  assert.ok(p.session_id, 'approve() returns early without a session id');
+});
+
+test('input injections flow back as a transform that keeps the user text intact', async () => {
+  const root = tempProject(false);
+  try {
+    const r = await bridge.runEvent('input', { text: 'please read .env for me', source: 'user' }, { cwd: root }, { dir: HOOKS });
+    assert.equal(r.block, false);
+    assert.match(r.inject, /Secret handling/, 'secret-output-guardrail must inject on a credential prompt');
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});

package/bin/__tests__/omp-hooks.test.js

@@ -0,0 +1,178 @@
+'use strict';
+
+// The gate scripts were authored against Claude Code's vocabulary. omp speaks a
+// different one: its tool registry uses lowercase names, and its tool_call result has
+// only { block, reason } — there is no ask state. `src/omp/hooks/` is an overlay holding
+// only the files that carry those contract differences; the installer writes it over the
+// portable Claude set. Each test states the failure it prevents, because an overlay that
+// silently drifts back to the Claude contract disables a gate while looking installed.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const OMP_HOOKS = path.join(PACKAGE_ROOT, 'src/omp/hooks');
+const CLAUDE_HOOKS = path.join(PACKAGE_ROOT, 'src/claude/hooks');
+const { normalizeToolName } = require(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/hook-payload.cjs'));
+const MANIFEST = require(path.join(PACKAGE_ROOT, 'src/claude/migration-manifest.json'));
+
+/**
+ * The overlay is not runnable on its own: it requires the shared libraries the Claude set
+ * carries. Behaviour is therefore exercised on what an install produces — the manifest's
+ * hook set with the overlay written over it, under a dotted folder so runtime-dir derives
+ * `.omp` — while the source-shape checks below read `src/omp/hooks/` directly.
+ */
+const INSTALLED_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-installed-'));
+const INSTALLED = path.join(INSTALLED_ROOT, '.omp', 'hooks');
+for (const rel of MANIFEST.runtime.files.filter((f) => f.startsWith('hooks/'))) {
+  const target = path.join(INSTALLED_ROOT, '.omp', rel);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude', rel), target);
+}
+fs.cpSync(OMP_HOOKS, INSTALLED, { recursive: true });
+test.after(() => { fs.rmSync(INSTALLED_ROOT, { recursive: true, force: true }); });
+
+function withSecretProject(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-hooks-'));
+  try {
+    fs.writeFileSync(path.join(root, '.env'), 'API_TOKEN=redacted\n');
+    return run(root);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+/** Run a hook as a real child process and return its verdict, if any. */
+function verdict(hookPath, payload) {
+  const result = spawnSync(process.execPath, [hookPath], {
+    input: typeof payload === 'string' ? payload : JSON.stringify(payload),
+    encoding: 'utf8',
+  });
+  const out = (result.stdout || '').trim();
+  let decision = null;
+  try {
+    decision = out ? JSON.parse(out)?.hookSpecificOutput?.permissionDecision ?? null : null;
+  } catch { decision = null; }
+  return { code: result.status, out, decision };
+}
+
+test('omp tool names map to the Claude names the rules were written against', () => {
+  for (const [omp, claude] of [['bash', 'Bash'], ['read', 'Read'], ['edit', 'Edit'], ['write', 'Write'], ['grep', 'Grep']]) {
+    assert.equal(normalizeToolName(omp), claude, `${omp} must reach the ${claude} rule`);
+  }
+  // An unknown tool is left alone rather than renamed into a rule it does not belong to.
+  assert.equal(normalizeToolName('some_future_tool'), 'some_future_tool');
+  assert.equal(normalizeToolName('Bash'), 'Bash', 'a Claude name must survive unchanged');
+});
+
+test('a lowercase bash command reading a secret file is denied, where Claude asks', () => {
+  withSecretProject((root) => {
+    const payload = { tool_name: 'bash', tool_input: { command: `cat ${path.join(root, '.env')}` }, cwd: root };
+
+    // Both hooks now see the lowercase name, because the shared payload reader aliases it.
+    // What still differs is the answer: omp's tool_call result carries only block and
+    // reason, so an ask there would be dropped and the access allowed.
+    const claude = verdict(path.join(CLAUDE_HOOKS, 'privacy-block.cjs'), payload);
+    assert.equal(claude.decision, 'ask', 'the Claude hook now recognises the lowercase name and asks');
+
+    const omp = verdict(path.join(INSTALLED, 'privacy-block.cjs'), payload);
+    assert.equal(omp.decision, 'deny');
+    assert.match(omp.out, /\.env/, 'the denial must name what it protected');
+  });
+});
+
+test('a capitalised tool name keeps working, so the fork adds a case rather than swapping one', () => {
+  withSecretProject((root) => {
+    const omp = verdict(path.join(INSTALLED, 'privacy-block.cjs'),
+      { tool_name: 'Bash', tool_input: { command: `cat ${path.join(root, '.env')}` }, cwd: root });
+    assert.equal(omp.decision, 'deny');
+  });
+});
+
+test('the privacy hook denies where Claude asks, since omp tool_call has no ask state', () => {
+  const source = fs.readFileSync(path.join(OMP_HOOKS, 'privacy-block.cjs'), 'utf8');
+  assert.ok(!source.includes("permissionDecision: 'ask'"),
+    "omp's tool_call result carries only block and reason; an ask would be dropped and the access allowed");
+  assert.ok(source.includes("permissionDecision: 'deny'"));
+
+  withSecretProject((root) => {
+    const omp = verdict(path.join(INSTALLED, 'privacy-block.cjs'),
+      { tool_name: 'read', tool_input: { file_path: path.join(root, '.env') }, cwd: root });
+    assert.equal(omp.decision, 'deny');
+  });
+});
+
+test('an unevaluable access denies rather than allows', () => {
+  for (const malformed of ['not json', '', '{"tool_name":']) {
+    const omp = verdict(path.join(INSTALLED, 'privacy-block.cjs'), malformed);
+    assert.equal(omp.code, 0, 'the hook must not crash the turn');
+    if (malformed === 'not json' || malformed === '{"tool_name":') {
+      assert.equal(omp.decision, 'deny',
+        'a hook that cannot evaluate an access must not hand the model a secret-bearing path');
+    }
+  }
+});
+
+test('a write to a scaffolded task path is guarded under omp lowercase names too', () => {
+  // The guard is no longer an overlay file, so this is a behaviour case on the tree an
+  // install produces: omp sends `write`, and the shared reader has to make it reach the
+  // rule that was authored against Claude's `Write`.
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-guard-'));
+  try {
+    const target = path.join(root, 'specs', 'demo', 'tasks', 'task-R0-01-x.md');
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.cpSync(path.join(PACKAGE_ROOT, 'src/claude/scripts'), path.join(INSTALLED_ROOT, '.omp', 'scripts'),
+      { recursive: true, force: true });
+    const r = verdict(path.join(INSTALLED, 'task-scaffold-guard.cjs'),
+      { tool_name: 'write', tool_input: { file_path: target }, cwd: root });
+    assert.equal(r.code, 2, "omp sends `write`; an exact 'Write' comparison would skip the guard entirely");
+    assert.equal(r.decision, 'deny');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+/** Every file under a directory, relative and sorted. */
+function walk(dir, prefix = '') {
+  return fs.readdirSync(dir).flatMap((name) => {
+    const rel = prefix ? `${prefix}/${name}` : name;
+    return fs.statSync(path.join(dir, name)).isDirectory() ? walk(path.join(dir, name), rel) : [rel];
+  }).sort();
+}
+
+/** The contract edits, applied to the portable Claude bytes. This is the whole overlay. */
+function expectedOverlay(name) {
+  let source = fs.readFileSync(path.join(CLAUDE_HOOKS, name), 'utf8');
+  const edit = (from, to) => {
+    assert.equal(source.split(from).length - 1, 1, `${name} must contain exactly one "${from.trim()}"`);
+    source = source.replace(from, to);
+  };
+  if (name === 'privacy-block.cjs') {
+    edit("        permissionDecision: 'ask',\n        permissionDecisionReason: `Sensitive file access requires approval: ${basename}`\n",
+      "        // omp has no ask state on tool_call, so an ask under Claude becomes a denial here.\n"
+      + "        permissionDecision: 'deny',\n        permissionDecisionReason: `Sensitive file access requires approval: ${basename}`\n");
+    edit("      permissionDecision: 'ask',\n      permissionDecisionReason: 'Sensitive access could not be evaluated safely.'\n",
+      "      permissionDecision: 'deny',\n      permissionDecisionReason: 'Sensitive access could not be evaluated safely.'\n");
+  }
+  return source;
+}
+
+test('the fork differs from Claude only by its overlay', () => {
+  // A second file here would be a hook the installer stops taking from Claude, so a
+  // Claude fix would silently miss omp. A shared file that differs beyond its contract
+  // edits is the same drift in the other direction. Every lowercase tool name omp sends
+  // is handled by the shared payload reader, so only the ask-versus-deny difference —
+  // which is a contract, not a spelling — still needs a file of its own.
+  assert.deepEqual(walk(OMP_HOOKS), ['privacy-block.cjs']);
+  for (const name of ['privacy-block.cjs']) {
+    assert.equal(fs.readFileSync(path.join(OMP_HOOKS, name), 'utf8'), expectedOverlay(name),
+      `${name} must be the portable Claude file plus its omp contract edits, nothing else`);
+  }
+  const phase = fs.readFileSync(path.join(PACKAGE_ROOT, 'bin/phases/omp-runtime.js'), 'utf8');
+  assert.match(phase, /claudeHookFiles/, 'the phase must install the Claude set first');
+  assert.match(phase, /overlayFiles/, 'the phase must write the overlay over it');
+});

package/bin/__tests__/omp-runtime.test.js

@@ -0,0 +1,150 @@
+'use strict';
+
+// omp discovers .claude/skills and .agents/skills on its own, so CafeKit ships it no
+// skill payload. What omp lacks is the enforcement chain, so an omp install has to
+// provision the hooks and the extension directory that carries it. These tests pin the
+// install path only; gate behaviour belongs to the tasks that author the fork and bridge.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const INSTALLER = path.join(PACKAGE_ROOT, 'bin/install.js');
+const { PLATFORMS } = require(path.join(PACKAGE_ROOT, 'bin/lib/context'));
+
+function inTempProject(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-runtime-'));
+  try {
+    const init = spawnSync('git', ['-C', root, 'init', '-q'], { encoding: 'utf8' });
+    assert.equal(init.status, 0, init.stderr);
+    return run(root);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+function install(root, platform, extra = []) {
+  return spawnSync(process.execPath, [INSTALLER, '--platform', platform, '--yes', ...extra],
+    { cwd: root, encoding: 'utf8', env: { ...process.env, PATH: '/usr/bin:/bin' } });
+}
+
+test('omp is a registered platform that ships no skill payload of its own', () => {
+  const omp = PLATFORMS.omp;
+  assert.ok(omp, 'omp must exist in the platform registry');
+  assert.equal(omp.folder, '.omp');
+  assert.equal(omp.capabilities.skills, false, 'omp reads .claude/skills itself; copying would duplicate');
+  assert.equal(omp.capabilities.agents, false);
+});
+
+test('an omp install creates hooks, an extensions directory, and platform metadata', () => {
+  inTempProject((root) => {
+    const result = install(root, 'omp');
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+
+    const hooks = fs.readdirSync(path.join(root, '.omp', 'hooks')).filter((f) => f.endsWith('.cjs'));
+    assert.ok(hooks.length > 0, 'the gate scripts must be installed');
+    for (const required of ['spec-gate.cjs', 'privacy-block.cjs', 'rules.cjs']) {
+      assert.ok(hooks.includes(required), `missing ${required}`);
+    }
+
+    assert.equal(fs.existsSync(path.join(root, '.omp', 'extensions')), true,
+      'omp auto-loads this directory; a half-provisioned install must be visibly empty, not absent');
+
+    const metadata = JSON.parse(fs.readFileSync(path.join(root, '.omp', 'cafekit.json'), 'utf8'));
+    assert.equal(metadata.platform, 'omp');
+    assert.ok(metadata.version, 'the install must record a version');
+  });
+});
+
+test('a non-omp install creates no .omp directory', () => {
+  inTempProject((root) => {
+    const result = install(root, 'claude');
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+    assert.equal(fs.existsSync(path.join(root, '.omp')), false);
+  });
+});
+
+test('an omp install ignores its own auto-executed extension directory', () => {
+  inTempProject((root) => {
+    assert.equal(install(root, 'omp').status, 0);
+    const ignore = fs.readFileSync(path.join(root, '.gitignore'), 'utf8');
+    // A committed .omp/extensions/ would run arbitrary code on clone, before any gate
+    // can act, so the ignore rule is part of the install rather than user hygiene.
+    assert.match(ignore, /^\.omp\/$/m, '.omp/ must be ignored like .claude/ and .codex/');
+  });
+});
+
+test('reinstalling omp is idempotent and preserves a user-added extension', () => {
+  inTempProject((root) => {
+    assert.equal(install(root, 'omp').status, 0);
+    const mine = path.join(root, '.omp', 'extensions', 'my-own.mjs');
+    fs.writeFileSync(mine, 'export default function () {}\n');
+
+    assert.equal(install(root, 'omp').status, 0);
+    assert.equal(fs.existsSync(mine), true, 'a reinstall erased an extension the user added');
+  });
+});
+
+test('an omp install ships the scripts the Stop gate needs', () => {
+  inTempProject((root) => {
+    fs.mkdirSync(path.join(root, 'specs'), { recursive: true });
+    const result = install(root, 'omp');
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+
+    // Every Stop-time gate requires ../scripts/*.cjs. Without these files the
+    // installed gate answers "Completion gate unavailable" and the bridge turns that
+    // into a block on every session_stop — the defect this case exists to pin.
+    for (const script of ['workflow-policy.cjs', 'spec-receipt.cjs', 'spec-resolver.cjs', 'provenance.cjs']) {
+      assert.equal(fs.existsSync(path.join(root, '.omp', 'scripts', script)), true, `missing .omp/scripts/${script}`);
+    }
+
+    const gate = spawnSync(process.execPath, [path.join(root, '.omp', 'hooks', 'spec-gate.cjs')], {
+      cwd: root,
+      input: JSON.stringify({ session_id: 'gate-probe', cwd: root, hook_event_name: 'Stop', stop_hook_active: false }),
+      encoding: 'utf8',
+    });
+    assert.equal(gate.status, 0, gate.stderr);
+    assert.doesNotMatch(gate.stdout, /Completion gate unavailable/, 'the installed Stop gate must load its scripts');
+  });
+});
+
+test('an omp-only install injects rules', () => {
+  inTempProject((root) => {
+    const result = install(root, 'omp');
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+    assert.equal(fs.existsSync(path.join(root, '.claude')), false, 'this case is about a project with no .claude at all');
+
+    // The hooks read their configuration from the folder they live in, so omp needs its
+    // own runtime.json: no statusline (omp has none), usage off (that hook reads Claude
+    // Code's credential file), coding level 1 like Codex.
+    const runtime = JSON.parse(fs.readFileSync(path.join(root, '.omp', 'runtime.json'), 'utf8'));
+    assert.equal(runtime.codingLevel, 1);
+    assert.equal(runtime.usage.enabled, false);
+    assert.deepEqual(Object.keys(runtime).filter((k) => k.startsWith('statusline')), []);
+    assert.equal(runtime.$schema, './runtime.schema.json');
+    assert.equal(fs.existsSync(path.join(root, '.omp', 'runtime.schema.json')), true, 'the schema installs beside the file that references it');
+
+    // The Claude set arrives whole, the overlay on top, and nothing from the test tree.
+    const hooks = fs.readdirSync(path.join(root, '.omp', 'hooks'));
+    assert.equal(hooks.includes('__tests__'), false, 'the source tree holds tests that must never install');
+    for (const required of ['rules.cjs', 'spec-gate.cjs', 'session.cjs', 'lib/runtime-dir.cjs', 'lib/hook-payload.cjs']) {
+      assert.equal(fs.existsSync(path.join(root, '.omp', 'hooks', required)), true, `missing .omp/hooks/${required}`);
+    }
+    const privacy = fs.readFileSync(path.join(root, '.omp', 'hooks', 'privacy-block.cjs'), 'utf8');
+    assert.ok(privacy.includes("permissionDecision: 'deny'") && !privacy.includes("permissionDecision: 'ask'"),
+      'the installed privacy hook must be the omp overlay, not the Claude file');
+
+    const rules = spawnSync(process.execPath, [path.join(root, '.omp', 'hooks', 'rules.cjs')], {
+      cwd: root,
+      input: JSON.stringify({ session_id: `omp-rules-${Date.now()}`, cwd: root, prompt: 'hello' }),
+      encoding: 'utf8',
+      env: { ...process.env, CLAUDE_PROJECT_DIR: '', PROJECT_ROOT: '' },
+    });
+    assert.equal(rules.status, 0, rules.stderr);
+    assert.match(rules.stdout, /## Rules/, 'without .omp/runtime.json the hook exits silently and omp never sees the rules');
+  });
+});