@haposoft/cafekit 0.16.0 → 0.16.1

package/bin/__tests__/hook-payload.test.js

@@ -0,0 +1,194 @@
+'use strict';
+
+// The gate hooks read Claude Code's envelope. Grok CLI runs the same scripts through its
+// Claude-compatibility layer but sends camelCase keys and its own tool names, and omp's
+// bridge sends Claude keys with lowercase tool names. Each case below states the failure
+// it prevents, because every one of them is a gate that looks installed and answers
+// nothing when the reader gets a spelling wrong.
+//
+// Envelope samples follow grok 1.0.13's embedded hooks documentation; regenerate it with
+// `strings -n 6 ~/.grok/downloads/grok-1.0.13-macos-aarch64`.
+
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const { normalizeHookPayload, normalizeToolName } = require(
+  path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/hook-payload.cjs'));
+
+test('a grok PreToolUse envelope becomes the Claude payload', () => {
+  const grok = {
+    hookEventName: 'pre_tool_use',
+    sessionId: 'abc-123',
+    cwd: '/Users/you/project',
+    workspaceRoot: '/Users/you/project',
+    permissionMode: 'default',
+    toolName: 'run_terminal_command',
+    toolInput: { command: 'npm test' },
+    toolUseId: 'call_1',
+    timestamp: '2026-04-14T12:00:00Z',
+  };
+  const out = normalizeHookPayload(grok);
+  // The four keys every gate reads first. Without them privacy-block sees no tool and
+  // no command, and allows a call it was installed to examine.
+  assert.equal(out.hook_event_name, 'PreToolUse');
+  assert.equal(out.session_id, 'abc-123');
+  assert.equal(out.tool_name, 'Bash');
+  assert.deepEqual(out.tool_input, { command: 'npm test' });
+  assert.equal(out.tool_use_id, 'call_1');
+  assert.equal(out.permission_mode, 'default');
+  assert.equal(out.workspace_root, '/Users/you/project');
+  assert.equal(out.cwd, '/Users/you/project', 'cwd is already Claude-shaped and must survive');
+});
+
+test('read_file path becomes file_path', () => {
+  const out = normalizeHookPayload({
+    hookEventName: 'pre_tool_use',
+    toolName: 'read_file',
+    toolInput: { path: '/p/.env' },
+  });
+  assert.equal(out.tool_name, 'Read');
+  // privacy-block reads file_path and path, but task-scaffold-guard reads file_path first
+  // and inspect-block's path list is keyed the same way.
+  assert.equal(out.tool_input.file_path, '/p/.env');
+  assert.equal(out.tool_input.path, '/p/.env', 'the original key stays for hooks that read it');
+});
+
+test('an existing file_path is never overwritten by path', () => {
+  const out = normalizeHookPayload({
+    toolName: 'read_file',
+    toolInput: { file_path: '/p/real.txt', path: '/p/other.txt' },
+  });
+  assert.equal(out.tool_input.file_path, '/p/real.txt');
+});
+
+test('Stop and subagent fields map', () => {
+  const stop = normalizeHookPayload({
+    hookEventName: 'stop',
+    sessionId: 's1',
+    stopHookActive: true,
+    lastAssistantMessage: 'done',
+    reason: 'end_turn',
+  });
+  // Without stop_hook_active the Stop gate loses its loop guard and blocks every
+  // continuation round until the host's own cap ends the turn.
+  assert.equal(stop.hook_event_name, 'Stop');
+  assert.equal(stop.stop_hook_active, true);
+  assert.equal(stop.last_assistant_message, 'done');
+
+  const sub = normalizeHookPayload({
+    hookEventName: 'subagent_stop',
+    subagentType: 'code-auditor',
+    subagentId: 'agent-7',
+    lastAssistantMessage: 'REVIEW: PASS',
+  });
+  // semantic-review-authority refuses to record an attestation without agent_id.
+  assert.equal(sub.hook_event_name, 'SubagentStop');
+  assert.equal(sub.agent_type, 'code-auditor');
+  assert.equal(sub.agent_id, 'agent-7');
+
+  const post = normalizeHookPayload({ hookEventName: 'post_tool_use', toolResult: { ok: true } });
+  assert.deepEqual(post.tool_response, { ok: true });
+});
+
+test('every name reaching a Bash matcher becomes Bash', () => {
+  // Grok expands the Bash matcher to its own shell tools, so a call can arrive under any
+  // of these names. One unmapped name means privacy-block skips its command scan and a
+  // secret-bearing command is never examined.
+  for (const name of ['run_terminal_command', 'run_terminal_cmd', 'PowerShell', 'bash']) {
+    assert.equal(normalizeToolName(name), 'Bash', `${name} must reach the Bash rule`);
+  }
+});
+
+test('write and search_replace map to different Claude tools', () => {
+  // The scaffold guard only fires on Write. Grok creates files with `write` and edits
+  // them with `search_replace`; conflating them would either disable the guard or make it
+  // reject the Edit-fill step the guard's own message tells the model to run.
+  assert.equal(normalizeToolName('write'), 'Write');
+  assert.equal(normalizeToolName('delete_file'), 'Write');
+  assert.equal(normalizeToolName('search_replace'), 'Edit');
+  assert.equal(normalizeToolName('read_file'), 'Read');
+  assert.equal(normalizeToolName('grep'), 'Grep');
+  assert.equal(normalizeToolName('grep_search'), 'Grep');
+  assert.equal(normalizeToolName('list_dir'), 'Glob');
+  assert.equal(normalizeToolName('spawn_subagent'), 'Task');
+});
+
+test('omp lowercase names are aliased even under a snake_case key', () => {
+  // omp's bridge sends Claude-shaped keys with lowercase values, so a reader that only
+  // translated camelCase keys would leave `bash` unmapped and reopen the exact gap the
+  // omp tool-name table was written to close.
+  const out = normalizeHookPayload({
+    hook_event_name: 'PreToolUse',
+    session_id: 'omp-1',
+    tool_name: 'bash',
+    tool_input: { command: 'cat .env' },
+  });
+  assert.equal(out.tool_name, 'Bash');
+  for (const [omp, claude] of [['read', 'Read'], ['edit', 'Edit'], ['write', 'Write'], ['grep', 'Grep'], ['ls', 'Glob']]) {
+    assert.equal(normalizeToolName(omp), claude);
+  }
+});
+
+test('a Claude payload keeps its keys', () => {
+  const claude = {
+    hook_event_name: 'PreToolUse',
+    session_id: 's1',
+    cwd: '/p',
+    tool_name: 'Bash',
+    tool_input: { command: 'ls' },
+    transcript_path: '/p/t.jsonl',
+  };
+  const before = JSON.stringify(claude);
+  const out = normalizeHookPayload(claude);
+  assert.deepEqual(out, claude, 'a Claude payload must come back with the same keys and values');
+  assert.notEqual(out, claude, 'the reader returns a copy');
+  assert.equal(JSON.stringify(claude), before, 'the input must not be mutated');
+});
+
+test('an unknown tool name is left alone', () => {
+  // A future host tool degrades to "not specially handled" rather than being renamed into
+  // a privileged rule it does not belong to.
+  assert.equal(normalizeToolName('some_future_tool'), 'some_future_tool');
+  assert.equal(normalizeToolName('Bash'), 'Bash');
+  const out = normalizeHookPayload({ toolName: 'some_future_tool', toolInput: {} });
+  assert.equal(out.tool_name, 'some_future_tool');
+});
+
+test('hostile input never throws', () => {
+  // The Stop gate and the approval hook end in a catch that emits a block, so an
+  // exception raised here would block completion on Claude, not just under grok.
+  const hostile = [
+    null, undefined, 42, 'string', true, [],
+    { toolName: 42, toolInput: 'not-an-object' },
+    { toolInput: [] },
+    { hookEventName: {} },
+    JSON.parse('{"__proto__": {"polluted": true}, "toolName": "read_file"}'),
+    Object.create(null),
+  ];
+  for (const input of hostile) {
+    assert.doesNotThrow(() => normalizeHookPayload(input), `threw on ${JSON.stringify(input)}`);
+  }
+  assert.equal(normalizeHookPayload(null), null);
+  assert.equal(normalizeHookPayload(42), 42);
+  assert.deepEqual(normalizeHookPayload([]), []);
+  assert.equal({}.polluted, undefined, 'a __proto__ key must not reach Object.prototype');
+});
+
+test('the event map covers every event grok emits', () => {
+  const expected = {
+    pre_tool_use: 'PreToolUse', post_tool_use: 'PostToolUse',
+    post_tool_use_failure: 'PostToolUseFailure', permission_denied: 'PermissionDenied',
+    user_prompt_submit: 'UserPromptSubmit', session_start: 'SessionStart',
+    session_end: 'SessionEnd', stop: 'Stop', stop_failure: 'StopFailure',
+    stop_cancelled: 'StopCancelled', subagent_start: 'SubagentStart',
+    subagent_stop: 'SubagentStop', pre_compact: 'PreCompact', post_compact: 'PostCompact',
+    notification: 'Notification',
+  };
+  for (const [snake, pascal] of Object.entries(expected)) {
+    assert.equal(normalizeHookPayload({ hookEventName: snake }).hook_event_name, pascal);
+  }
+  assert.equal(normalizeHookPayload({ hook_event_name: 'Stop' }).hook_event_name, 'Stop',
+    'an already-PascalCase value is kept');
+});

package/bin/__tests__/omp-bridge.test.js

@@ -0,0 +1,168 @@
+'use strict';
+
+// omp has no hooks.json. The bridge is the only thing between omp's lifecycle events and
+// CafeKit's gate scripts, so a mistranslation disables every gate while looking installed.
+// These tests drive the bridge's exported functions against real child hook processes from
+// the tree an omp install produces: the Claude hook set with the omp overlay written over
+// it. They do not launch omp, which needs provider credentials; the contract rows they rely
+// on were read from the installed omp binary and are recorded in plan.md.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const BRIDGE = path.join(PACKAGE_ROOT, 'src/omp/extensions/cafekit-bridge.mjs');
+const SETTINGS = require(path.join(PACKAGE_ROOT, 'src/claude/settings/settings.json'));
+const MANIFEST = require(path.join(PACKAGE_ROOT, 'src/claude/migration-manifest.json'));
+const { PREFIX } = require(path.join(PACKAGE_ROOT, 'src/claude/hooks/completion-authority-state.cjs'));
+
+/**
+ * The hooks an omp install runs: the Claude set the manifest ships, then `src/omp/hooks/`
+ * written over it. Composed once under a dotted folder so runtime-dir.cjs derives `.omp`.
+ */
+const COMPOSED_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-composed-'));
+const HOOKS = path.join(COMPOSED_ROOT, '.omp', 'hooks');
+for (const rel of MANIFEST.runtime.files.filter((f) => f.startsWith('hooks/'))) {
+  const target = path.join(COMPOSED_ROOT, '.omp', rel);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude', rel), target);
+}
+fs.cpSync(path.join(PACKAGE_ROOT, 'src/omp/hooks'), HOOKS, { recursive: true });
+fs.cpSync(path.join(PACKAGE_ROOT, 'src/claude/scripts'), path.join(COMPOSED_ROOT, '.omp', 'scripts'), { recursive: true });
+
+let bridge;
+test.before(async () => { bridge = await import(BRIDGE); });
+test.after(() => { fs.rmSync(COMPOSED_ROOT, { recursive: true, force: true }); });
+
+function tempProject(withSecret = true) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-bridge-'));
+  if (withSecret) fs.writeFileSync(path.join(root, '.env'), 'TOKEN=redacted\n');
+  return root;
+}
+
+function registered(eventName) {
+  return (SETTINGS.hooks[eventName] || [])
+    .flatMap((g) => g.hooks || [])
+    .map((h) => (h.command.match(/hooks\/([a-z-]+\.cjs)/) || [])[1])
+    .filter(Boolean);
+}
+
+test('the dispatch table mirrors settings.json for every event omp can deliver', () => {
+  const { DISPATCH } = bridge;
+  const pairs = [
+    ['session_start', 'SessionStart'], ['session_before_compact', 'PreCompact'],
+    ['input', 'UserPromptSubmit'], ['tool_call', 'PreToolUse'],
+    ['tool_result', 'PostToolUse'], ['session_stop', 'Stop'],
+  ];
+  for (const [omp, claude] of pairs) {
+    assert.deepEqual([...DISPATCH[omp].hooks].sort(), [...new Set(registered(claude))].sort(),
+      `${omp} must dispatch exactly the hooks settings.json registers for ${claude}`);
+  }
+  // omp has no subagent events; the gap is deliberate and documented, not forgotten.
+  assert.ok(!Object.values(DISPATCH).some((e) => e.event.startsWith('Subagent')));
+});
+
+test('every dispatch carries a stable session id and the project cwd', () => {
+  const { shapePayload } = bridge;
+  const ctx = { cwd: '/tmp/project' };
+  const a = shapePayload('input', { text: 'hi', source: 'user' }, ctx);
+  const b = shapePayload('tool_call', { toolName: 'bash', input: { command: 'ls' } }, ctx);
+  assert.ok(a.session_id && a.session_id === b.session_id,
+    'omp input carries no session id; rules.cjs exits without one, so the bridge must mint and reuse it');
+  assert.equal(a.cwd, '/tmp/project', 'spec-gate.cjs falls back to payload.cwd to find the project');
+  assert.equal(shapePayload('session_stop', { session_id: 'omp-real' }, ctx).session_id, 'omp-real',
+    'a session id omp does provide must win over the minted one');
+});
+
+test('each denial mechanism becomes an omp block carrying the hook reason', () => {
+  const { interpretVerdict } = bridge;
+  const stop = interpretVerdict({ code: 0, stdout: '{"decision":"block","reason":"R1"}\n' }, 'spec-gate.cjs');
+  assert.deepEqual([stop.block, stop.reason], [true, 'R1']);
+  const deny = interpretVerdict({ code: 0, stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: 'R2' } }) }, 'privacy-block.cjs');
+  assert.deepEqual([deny.block, deny.reason], [true, 'R2']);
+  // inspect-block / task-scaffold-guard exit 2 and write the reason on STDOUT, not stderr.
+  const exit2 = interpretVerdict({ code: 2, stdout: 'SCOPE LIMIT EXCEEDED\nRestricted zones: node_modules', stderr: '' }, 'inspect-block.cjs');
+  assert.equal(exit2.block, true);
+  assert.match(exit2.reason, /SCOPE LIMIT EXCEEDED/, 'a stderr-only reader would drop this reason');
+  // An ask under Claude has no omp equivalent; it must not fall through to allow.
+  const ask = interpretVerdict({ code: 0, stdout: JSON.stringify({ hookSpecificOutput: { permissionDecision: 'ask', permissionDecisionReason: 'R3' } }) }, 'x');
+  assert.equal(ask.block, true);
+  // Plain text that is not a verdict is context to inject, not a block.
+  const inject = interpretVerdict({ code: 0, stdout: '## Rules\n- keep docs under 800 lines' }, 'rules.cjs');
+  assert.deepEqual([inject.block, inject.inject.startsWith('## Rules')], [false, true]);
+});
+
+test('a lowercase bash command on a secret file is blocked end to end through the real fork', async () => {
+  const root = tempProject();
+  try {
+    const r = await bridge.runEvent('tool_call',
+      { toolName: 'bash', toolCallId: 'c1', input: { command: `cat ${path.join(root, '.env')}` } },
+      { cwd: root }, { dir: HOOKS });
+    assert.equal(r.block, true);
+    assert.equal(r.hook, 'privacy-block.cjs');
+    assert.match(r.reason, /\.env/, 'the block must name what it protected');
+    const ok = await bridge.runEvent('tool_call',
+      { toolName: 'read', toolCallId: 'c2', input: { file_path: path.join(root, 'README.md') } },
+      { cwd: root }, { dir: HOOKS });
+    assert.equal(ok.block, false, 'an ordinary read must not be blocked');
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});
+
+test('a slow hook blocks with its own name before omp cuts it off', async () => {
+  const slow = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-slow-'));
+  try {
+    fs.writeFileSync(path.join(slow, 'privacy-block.cjs'), 'setTimeout(() => {}, 60000);');
+    assert.ok(bridge.BRIDGE_TIMEOUT_MS < 30000, 'omp substitutes a reasonless block at 30000 ms');
+    const t0 = Date.now();
+    const r = await bridge.runEvent('tool_call', { toolName: 'bash', input: { command: 'ls' } }, { cwd: slow }, { dir: slow, timeoutMs: 300 });
+    assert.equal(r.block, true);
+    assert.match(r.reason, /privacy-block\.cjs exceeded 300 ms/);
+    assert.ok(Date.now() - t0 < 5000, 'the budget must actually fire');
+  } finally { fs.rmSync(slow, { recursive: true, force: true }); }
+});
+
+test('a crashing or missing gate blocks on gating events instead of silently allowing', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-crash-'));
+  try {
+    // Only the crashing gate is under test; the other two PreToolUse gates get allow stubs,
+    // otherwise their absence is what blocks (see the missing-gate case below).
+    fs.writeFileSync(path.join(dir, 'privacy-block.cjs'), 'throw new Error("boom");');
+    for (const stub of ['inspect-block.cjs', 'task-scaffold-guard.cjs']) fs.writeFileSync(path.join(dir, stub), 'process.exit(0);');
+    const crash = await bridge.runEvent('tool_call', { toolName: 'bash', input: { command: 'ls' } }, { cwd: dir }, { dir });
+    // A bare exit 1 with no verdict is an allow under the hooks' own contract. Real gates
+    // never surface a crash this way: the fork's privacy-block catch-all converts its own
+    // errors into a deny, which the fork tests pin separately.
+    assert.equal(crash.block, false, 'exit 1 with no verdict is an allow per the hooks\' own contract');
+    const missing = await bridge.runEvent('tool_call', { toolName: 'bash', input: { command: 'ls' } }, { cwd: dir }, { dir: path.join(dir, 'nowhere') });
+    assert.equal(missing.block, true, 'a gate that is not installed must be loud, not a silent allow');
+    assert.match(missing.reason, /not installed/);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('stop_hook_active short-circuits the gate so a blocked turn cannot loop forever', async () => {
+  const r = await bridge.runEvent('session_stop', { stop_hook_active: true, session_id: 's1' }, { cwd: os.tmpdir() }, { dir: HOOKS });
+  assert.deepEqual([r.block, r.skipped], [false, 'stop_hook_active']);
+});
+
+test('the approval phrase reaches completion-authority through the input event', async () => {
+  const { DISPATCH, shapePayload } = bridge;
+  assert.ok(DISPATCH.input.hooks.includes('completion-authority.cjs'),
+    'the --approve path only runs on UserPromptSubmit; without this routing a blocked turn has no exit');
+  const phrase = `${PREFIX}${'a'.repeat(24)}`;
+  const p = shapePayload('input', { text: phrase, source: 'user' }, { cwd: '/tmp/p' });
+  assert.equal(p.hook_event_name, 'UserPromptSubmit', 'completion-authority selects --approve from this field');
+  assert.equal(p.prompt, phrase, 'the phrase must arrive byte-exact; the hook compares it exactly');
+  assert.ok(p.session_id, 'approve() returns early without a session id');
+});
+
+test('input injections flow back as a transform that keeps the user text intact', async () => {
+  const root = tempProject(false);
+  try {
+    const r = await bridge.runEvent('input', { text: 'please read .env for me', source: 'user' }, { cwd: root }, { dir: HOOKS });
+    assert.equal(r.block, false);
+    assert.match(r.inject, /Secret handling/, 'secret-output-guardrail must inject on a credential prompt');
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});

package/bin/__tests__/omp-hooks.test.js

@@ -0,0 +1,178 @@
+'use strict';
+
+// The gate scripts were authored against Claude Code's vocabulary. omp speaks a
+// different one: its tool registry uses lowercase names, and its tool_call result has
+// only { block, reason } — there is no ask state. `src/omp/hooks/` is an overlay holding
+// only the files that carry those contract differences; the installer writes it over the
+// portable Claude set. Each test states the failure it prevents, because an overlay that
+// silently drifts back to the Claude contract disables a gate while looking installed.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const OMP_HOOKS = path.join(PACKAGE_ROOT, 'src/omp/hooks');
+const CLAUDE_HOOKS = path.join(PACKAGE_ROOT, 'src/claude/hooks');
+const { normalizeToolName } = require(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/hook-payload.cjs'));
+const MANIFEST = require(path.join(PACKAGE_ROOT, 'src/claude/migration-manifest.json'));
+
+/**
+ * The overlay is not runnable on its own: it requires the shared libraries the Claude set
+ * carries. Behaviour is therefore exercised on what an install produces — the manifest's
+ * hook set with the overlay written over it, under a dotted folder so runtime-dir derives
+ * `.omp` — while the source-shape checks below read `src/omp/hooks/` directly.
+ */
+const INSTALLED_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-installed-'));
+const INSTALLED = path.join(INSTALLED_ROOT, '.omp', 'hooks');
+for (const rel of MANIFEST.runtime.files.filter((f) => f.startsWith('hooks/'))) {
+  const target = path.join(INSTALLED_ROOT, '.omp', rel);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude', rel), target);
+}
+fs.cpSync(OMP_HOOKS, INSTALLED, { recursive: true });
+test.after(() => { fs.rmSync(INSTALLED_ROOT, { recursive: true, force: true }); });
+
+function withSecretProject(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-hooks-'));
+  try {
+    fs.writeFileSync(path.join(root, '.env'), 'API_TOKEN=redacted\n');
+    return run(root);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+/** Run a hook as a real child process and return its verdict, if any. */
+function verdict(hookPath, payload) {
+  const result = spawnSync(process.execPath, [hookPath], {
+    input: typeof payload === 'string' ? payload : JSON.stringify(payload),
+    encoding: 'utf8',
+  });
+  const out = (result.stdout || '').trim();
+  let decision = null;
+  try {
+    decision = out ? JSON.parse(out)?.hookSpecificOutput?.permissionDecision ?? null : null;
+  } catch { decision = null; }
+  return { code: result.status, out, decision };
+}
+
+test('omp tool names map to the Claude names the rules were written against', () => {
+  for (const [omp, claude] of [['bash', 'Bash'], ['read', 'Read'], ['edit', 'Edit'], ['write', 'Write'], ['grep', 'Grep']]) {
+    assert.equal(normalizeToolName(omp), claude, `${omp} must reach the ${claude} rule`);
+  }
+  // An unknown tool is left alone rather than renamed into a rule it does not belong to.
+  assert.equal(normalizeToolName('some_future_tool'), 'some_future_tool');
+  assert.equal(normalizeToolName('Bash'), 'Bash', 'a Claude name must survive unchanged');
+});
+
+test('a lowercase bash command reading a secret file is denied, where Claude asks', () => {
+  withSecretProject((root) => {
+    const payload = { tool_name: 'bash', tool_input: { command: `cat ${path.join(root, '.env')}` }, cwd: root };
+
+    // Both hooks now see the lowercase name, because the shared payload reader aliases it.
+    // What still differs is the answer: omp's tool_call result carries only block and
+    // reason, so an ask there would be dropped and the access allowed.
+    const claude = verdict(path.join(CLAUDE_HOOKS, 'privacy-block.cjs'), payload);
+    assert.equal(claude.decision, 'ask', 'the Claude hook now recognises the lowercase name and asks');
+
+    const omp = verdict(path.join(INSTALLED, 'privacy-block.cjs'), payload);
+    assert.equal(omp.decision, 'deny');
+    assert.match(omp.out, /\.env/, 'the denial must name what it protected');
+  });
+});
+
+test('a capitalised tool name keeps working, so the fork adds a case rather than swapping one', () => {
+  withSecretProject((root) => {
+    const omp = verdict(path.join(INSTALLED, 'privacy-block.cjs'),
+      { tool_name: 'Bash', tool_input: { command: `cat ${path.join(root, '.env')}` }, cwd: root });
+    assert.equal(omp.decision, 'deny');
+  });
+});
+
+test('the privacy hook denies where Claude asks, since omp tool_call has no ask state', () => {
+  const source = fs.readFileSync(path.join(OMP_HOOKS, 'privacy-block.cjs'), 'utf8');
+  assert.ok(!source.includes("permissionDecision: 'ask'"),
+    "omp's tool_call result carries only block and reason; an ask would be dropped and the access allowed");
+  assert.ok(source.includes("permissionDecision: 'deny'"));
+
+  withSecretProject((root) => {
+    const omp = verdict(path.join(INSTALLED, 'privacy-block.cjs'),
+      { tool_name: 'read', tool_input: { file_path: path.join(root, '.env') }, cwd: root });
+    assert.equal(omp.decision, 'deny');
+  });
+});
+
+test('an unevaluable access denies rather than allows', () => {
+  for (const malformed of ['not json', '', '{"tool_name":']) {
+    const omp = verdict(path.join(INSTALLED, 'privacy-block.cjs'), malformed);
+    assert.equal(omp.code, 0, 'the hook must not crash the turn');
+    if (malformed === 'not json' || malformed === '{"tool_name":') {
+      assert.equal(omp.decision, 'deny',
+        'a hook that cannot evaluate an access must not hand the model a secret-bearing path');
+    }
+  }
+});
+
+test('a write to a scaffolded task path is guarded under omp lowercase names too', () => {
+  // The guard is no longer an overlay file, so this is a behaviour case on the tree an
+  // install produces: omp sends `write`, and the shared reader has to make it reach the
+  // rule that was authored against Claude's `Write`.
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-guard-'));
+  try {
+    const target = path.join(root, 'specs', 'demo', 'tasks', 'task-R0-01-x.md');
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.cpSync(path.join(PACKAGE_ROOT, 'src/claude/scripts'), path.join(INSTALLED_ROOT, '.omp', 'scripts'),
+      { recursive: true, force: true });
+    const r = verdict(path.join(INSTALLED, 'task-scaffold-guard.cjs'),
+      { tool_name: 'write', tool_input: { file_path: target }, cwd: root });
+    assert.equal(r.code, 2, "omp sends `write`; an exact 'Write' comparison would skip the guard entirely");
+    assert.equal(r.decision, 'deny');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+/** Every file under a directory, relative and sorted. */
+function walk(dir, prefix = '') {
+  return fs.readdirSync(dir).flatMap((name) => {
+    const rel = prefix ? `${prefix}/${name}` : name;
+    return fs.statSync(path.join(dir, name)).isDirectory() ? walk(path.join(dir, name), rel) : [rel];
+  }).sort();
+}
+
+/** The contract edits, applied to the portable Claude bytes. This is the whole overlay. */
+function expectedOverlay(name) {
+  let source = fs.readFileSync(path.join(CLAUDE_HOOKS, name), 'utf8');
+  const edit = (from, to) => {
+    assert.equal(source.split(from).length - 1, 1, `${name} must contain exactly one "${from.trim()}"`);
+    source = source.replace(from, to);
+  };
+  if (name === 'privacy-block.cjs') {
+    edit("        permissionDecision: 'ask',\n        permissionDecisionReason: `Sensitive file access requires approval: ${basename}`\n",
+      "        // omp has no ask state on tool_call, so an ask under Claude becomes a denial here.\n"
+      + "        permissionDecision: 'deny',\n        permissionDecisionReason: `Sensitive file access requires approval: ${basename}`\n");
+    edit("      permissionDecision: 'ask',\n      permissionDecisionReason: 'Sensitive access could not be evaluated safely.'\n",
+      "      permissionDecision: 'deny',\n      permissionDecisionReason: 'Sensitive access could not be evaluated safely.'\n");
+  }
+  return source;
+}
+
+test('the fork differs from Claude only by its overlay', () => {
+  // A second file here would be a hook the installer stops taking from Claude, so a
+  // Claude fix would silently miss omp. A shared file that differs beyond its contract
+  // edits is the same drift in the other direction. Every lowercase tool name omp sends
+  // is handled by the shared payload reader, so only the ask-versus-deny difference —
+  // which is a contract, not a spelling — still needs a file of its own.
+  assert.deepEqual(walk(OMP_HOOKS), ['privacy-block.cjs']);
+  for (const name of ['privacy-block.cjs']) {
+    assert.equal(fs.readFileSync(path.join(OMP_HOOKS, name), 'utf8'), expectedOverlay(name),
+      `${name} must be the portable Claude file plus its omp contract edits, nothing else`);
+  }
+  const phase = fs.readFileSync(path.join(PACKAGE_ROOT, 'bin/phases/omp-runtime.js'), 'utf8');
+  assert.match(phase, /claudeHookFiles/, 'the phase must install the Claude set first');
+  assert.match(phase, /overlayFiles/, 'the phase must write the overlay over it');
+});