@haposoft/cafekit 0.16.0 → 0.16.2

package/bin/__tests__/grok-platform.test.js

@@ -0,0 +1,133 @@
+'use strict';
+
+// Grok CLI has no runtime directory of its own: it reads the Claude install through its
+// compatibility layer. `--platform grok` therefore provisions `.claude/` and prints the
+// one thing a user cannot infer, which is that project hooks stay inert until the folder
+// is trusted. These cases run the real installer into a temp git repository.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const INSTALLER = path.join(PACKAGE_ROOT, 'bin/install.js');
+const { PLATFORMS, resolvePlatformAliases, detectPlatforms } = require(path.join(PACKAGE_ROOT, 'bin/lib/context'));
+const I18N = require(path.join(PACKAGE_ROOT, 'bin/lib/i18n'));
+
+function inTempProject(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-grok-platform-'));
+  try {
+    const init = spawnSync('git', ['-C', root, 'init', '-q'], { encoding: 'utf8' });
+    assert.equal(init.status, 0, init.stderr);
+    return run(root);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+function install(root, platform, extra = []) {
+  return spawnSync(process.execPath, [INSTALLER, '--platform', platform, '--yes', ...extra],
+    { cwd: root, encoding: 'utf8', env: { ...process.env, HOME: path.join(root, 'home'), PATH: '/usr/bin:/bin' } });
+}
+
+test('grok is an alias, not a platform of its own', () => {
+  assert.equal(PLATFORMS.grok, undefined, 'a registry entry would create a .grok payload');
+  assert.deepEqual(resolvePlatformAliases(['grok']).platforms, ['claude']);
+  assert.equal(resolvePlatformAliases(['grok']).aliased, true);
+  assert.equal(resolvePlatformAliases(['claude']).aliased, false);
+});
+
+test('--platform grok installs the Claude runtime and no .grok directory', () => {
+  inTempProject((root) => {
+    const result = install(root, 'grok');
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+
+    assert.equal(fs.existsSync(path.join(root, '.claude', 'hooks', 'privacy-block.cjs')), true,
+      'grok runs the Claude gate scripts, so they have to be installed');
+    assert.equal(fs.existsSync(path.join(root, '.claude', 'settings.json')), true,
+      'grok discovers the hooks through this file');
+    assert.equal(fs.existsSync(path.join(root, '.grok')), false, 'CafeKit ships nothing under .grok');
+
+    const metadata = JSON.parse(fs.readFileSync(path.join(root, '.claude', 'cafekit.json'), 'utf8'));
+    assert.equal(metadata.platform, 'claude', 'the install is a Claude install and must record itself as one');
+  });
+});
+
+test('the trust reminder is printed once in the selected language', () => {
+  inTempProject((root) => {
+    const en = install(root, 'grok', ['--lang', 'en']);
+    assert.equal(en.status, 0, en.stderr);
+    const occurrences = en.stdout.split('grok --trust').length - 1;
+    assert.equal(occurrences, 1, 'the notice must appear exactly once');
+    assert.match(en.stdout, /\/hooks-trust/, 'both ways to grant trust are named');
+  });
+
+  inTempProject((root) => {
+    const vi = install(root, 'grok', ['--lang', 'vi']);
+    assert.equal(vi.status, 0, vi.stderr);
+    // The Vietnamese string, not the English one: the notice follows --lang like every
+    // other installer line.
+    assert.match(vi.stdout, /lớp tương thích Claude/);
+  });
+});
+
+test('grok and claude together install once', () => {
+  inTempProject((root) => {
+    const result = install(root, 'grok,claude');
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+    const lines = result.stdout.split('\n').filter((l) => l.includes('Claude Code'));
+    assert.ok(lines.length > 0, 'the Claude install must be reported');
+    const metadata = JSON.parse(fs.readFileSync(path.join(root, '.claude', 'cafekit.json'), 'utf8'));
+    assert.equal(metadata.platform, 'claude');
+    assert.equal(fs.existsSync(path.join(root, '.grok')), false);
+  });
+});
+
+test('a plain claude install prints no grok notice', () => {
+  inTempProject((root) => {
+    const result = install(root, 'claude');
+    assert.equal(result.status, 0, result.stderr);
+    assert.doesNotMatch(result.stdout, /grok --trust/, 'the alias must leave the Claude path unchanged');
+  });
+});
+
+test('.grok is not a detection marker', () => {
+  // A repository that merely holds `.grok/` has not asked for CafeKit. Adding `.grok` to
+  // Claude's detection markers would make a reinstall in a Codex project silently grow a
+  // `.claude/` tree beside it, because detected platforms are unioned with saved ones.
+  // (An install with no platform at all still defaults to Claude; that is separate, and
+  // predates this alias.)
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-grok-detect-'));
+  const cwd = process.cwd();
+  try {
+    fs.mkdirSync(path.join(root, '.grok', 'agents'), { recursive: true });
+    fs.mkdirSync(path.join(root, '.codex'), { recursive: true });
+    process.chdir(root);
+    const detected = detectPlatforms();
+    assert.deepEqual(detected, ['codex'], 'only the platform with a real payload may be detected');
+  } finally {
+    process.chdir(cwd);
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('an unknown platform is still rejected', () => {
+  inTempProject((root) => {
+    const result = install(root, 'nonesuch');
+    assert.notEqual(result.status, 0, 'the alias table must not swallow a typo');
+    assert.match(`${result.stdout}${result.stderr}`, /Unknown platform/);
+  });
+});
+
+test('the notice exists in every shipped locale', () => {
+  // A missing key renders as the key name, which is how a translation gap ships silently.
+  for (const code of I18N.SUPPORTED) {
+    const text = I18N.MESSAGES?.[code]?.grokCompatNotice ?? I18N[code]?.grokCompatNotice;
+    assert.ok(typeof text === 'string' && text.length > 0, `missing grokCompatNotice for ${code}`);
+    assert.match(text, /grok --trust/, `${code} must name the command`);
+    assert.match(text, /hooks-trust/, `${code} must name the slash command`);
+  }
+});

package/bin/__tests__/hook-payload.test.js

@@ -0,0 +1,194 @@
+'use strict';
+
+// The gate hooks read Claude Code's envelope. Grok CLI runs the same scripts through its
+// Claude-compatibility layer but sends camelCase keys and its own tool names, and omp's
+// bridge sends Claude keys with lowercase tool names. Each case below states the failure
+// it prevents, because every one of them is a gate that looks installed and answers
+// nothing when the reader gets a spelling wrong.
+//
+// Envelope samples follow grok 1.0.13's embedded hooks documentation; regenerate it with
+// `strings -n 6 ~/.grok/downloads/grok-1.0.13-macos-aarch64`.
+
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const { normalizeHookPayload, normalizeToolName } = require(
+  path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/hook-payload.cjs'));
+
+test('a grok PreToolUse envelope becomes the Claude payload', () => {
+  const grok = {
+    hookEventName: 'pre_tool_use',
+    sessionId: 'abc-123',
+    cwd: '/Users/you/project',
+    workspaceRoot: '/Users/you/project',
+    permissionMode: 'default',
+    toolName: 'run_terminal_command',
+    toolInput: { command: 'npm test' },
+    toolUseId: 'call_1',
+    timestamp: '2026-04-14T12:00:00Z',
+  };
+  const out = normalizeHookPayload(grok);
+  // The four keys every gate reads first. Without them privacy-block sees no tool and
+  // no command, and allows a call it was installed to examine.
+  assert.equal(out.hook_event_name, 'PreToolUse');
+  assert.equal(out.session_id, 'abc-123');
+  assert.equal(out.tool_name, 'Bash');
+  assert.deepEqual(out.tool_input, { command: 'npm test' });
+  assert.equal(out.tool_use_id, 'call_1');
+  assert.equal(out.permission_mode, 'default');
+  assert.equal(out.workspace_root, '/Users/you/project');
+  assert.equal(out.cwd, '/Users/you/project', 'cwd is already Claude-shaped and must survive');
+});
+
+test('read_file path becomes file_path', () => {
+  const out = normalizeHookPayload({
+    hookEventName: 'pre_tool_use',
+    toolName: 'read_file',
+    toolInput: { path: '/p/.env' },
+  });
+  assert.equal(out.tool_name, 'Read');
+  // privacy-block reads file_path and path, but task-scaffold-guard reads file_path first
+  // and inspect-block's path list is keyed the same way.
+  assert.equal(out.tool_input.file_path, '/p/.env');
+  assert.equal(out.tool_input.path, '/p/.env', 'the original key stays for hooks that read it');
+});
+
+test('an existing file_path is never overwritten by path', () => {
+  const out = normalizeHookPayload({
+    toolName: 'read_file',
+    toolInput: { file_path: '/p/real.txt', path: '/p/other.txt' },
+  });
+  assert.equal(out.tool_input.file_path, '/p/real.txt');
+});
+
+test('Stop and subagent fields map', () => {
+  const stop = normalizeHookPayload({
+    hookEventName: 'stop',
+    sessionId: 's1',
+    stopHookActive: true,
+    lastAssistantMessage: 'done',
+    reason: 'end_turn',
+  });
+  // Without stop_hook_active the Stop gate loses its loop guard and blocks every
+  // continuation round until the host's own cap ends the turn.
+  assert.equal(stop.hook_event_name, 'Stop');
+  assert.equal(stop.stop_hook_active, true);
+  assert.equal(stop.last_assistant_message, 'done');
+
+  const sub = normalizeHookPayload({
+    hookEventName: 'subagent_stop',
+    subagentType: 'code-auditor',
+    subagentId: 'agent-7',
+    lastAssistantMessage: 'REVIEW: PASS',
+  });
+  // semantic-review-authority refuses to record an attestation without agent_id.
+  assert.equal(sub.hook_event_name, 'SubagentStop');
+  assert.equal(sub.agent_type, 'code-auditor');
+  assert.equal(sub.agent_id, 'agent-7');
+
+  const post = normalizeHookPayload({ hookEventName: 'post_tool_use', toolResult: { ok: true } });
+  assert.deepEqual(post.tool_response, { ok: true });
+});
+
+test('every name reaching a Bash matcher becomes Bash', () => {
+  // Grok expands the Bash matcher to its own shell tools, so a call can arrive under any
+  // of these names. One unmapped name means privacy-block skips its command scan and a
+  // secret-bearing command is never examined.
+  for (const name of ['run_terminal_command', 'run_terminal_cmd', 'PowerShell', 'bash']) {
+    assert.equal(normalizeToolName(name), 'Bash', `${name} must reach the Bash rule`);
+  }
+});
+
+test('write and search_replace map to different Claude tools', () => {
+  // The scaffold guard only fires on Write. Grok creates files with `write` and edits
+  // them with `search_replace`; conflating them would either disable the guard or make it
+  // reject the Edit-fill step the guard's own message tells the model to run.
+  assert.equal(normalizeToolName('write'), 'Write');
+  assert.equal(normalizeToolName('delete_file'), 'Write');
+  assert.equal(normalizeToolName('search_replace'), 'Edit');
+  assert.equal(normalizeToolName('read_file'), 'Read');
+  assert.equal(normalizeToolName('grep'), 'Grep');
+  assert.equal(normalizeToolName('grep_search'), 'Grep');
+  assert.equal(normalizeToolName('list_dir'), 'Glob');
+  assert.equal(normalizeToolName('spawn_subagent'), 'Task');
+});
+
+test('omp lowercase names are aliased even under a snake_case key', () => {
+  // omp's bridge sends Claude-shaped keys with lowercase values, so a reader that only
+  // translated camelCase keys would leave `bash` unmapped and reopen the exact gap the
+  // omp tool-name table was written to close.
+  const out = normalizeHookPayload({
+    hook_event_name: 'PreToolUse',
+    session_id: 'omp-1',
+    tool_name: 'bash',
+    tool_input: { command: 'cat .env' },
+  });
+  assert.equal(out.tool_name, 'Bash');
+  for (const [omp, claude] of [['read', 'Read'], ['edit', 'Edit'], ['write', 'Write'], ['grep', 'Grep'], ['ls', 'Glob']]) {
+    assert.equal(normalizeToolName(omp), claude);
+  }
+});
+
+test('a Claude payload keeps its keys', () => {
+  const claude = {
+    hook_event_name: 'PreToolUse',
+    session_id: 's1',
+    cwd: '/p',
+    tool_name: 'Bash',
+    tool_input: { command: 'ls' },
+    transcript_path: '/p/t.jsonl',
+  };
+  const before = JSON.stringify(claude);
+  const out = normalizeHookPayload(claude);
+  assert.deepEqual(out, claude, 'a Claude payload must come back with the same keys and values');
+  assert.notEqual(out, claude, 'the reader returns a copy');
+  assert.equal(JSON.stringify(claude), before, 'the input must not be mutated');
+});
+
+test('an unknown tool name is left alone', () => {
+  // A future host tool degrades to "not specially handled" rather than being renamed into
+  // a privileged rule it does not belong to.
+  assert.equal(normalizeToolName('some_future_tool'), 'some_future_tool');
+  assert.equal(normalizeToolName('Bash'), 'Bash');
+  const out = normalizeHookPayload({ toolName: 'some_future_tool', toolInput: {} });
+  assert.equal(out.tool_name, 'some_future_tool');
+});
+
+test('hostile input never throws', () => {
+  // The Stop gate and the approval hook end in a catch that emits a block, so an
+  // exception raised here would block completion on Claude, not just under grok.
+  const hostile = [
+    null, undefined, 42, 'string', true, [],
+    { toolName: 42, toolInput: 'not-an-object' },
+    { toolInput: [] },
+    { hookEventName: {} },
+    JSON.parse('{"__proto__": {"polluted": true}, "toolName": "read_file"}'),
+    Object.create(null),
+  ];
+  for (const input of hostile) {
+    assert.doesNotThrow(() => normalizeHookPayload(input), `threw on ${JSON.stringify(input)}`);
+  }
+  assert.equal(normalizeHookPayload(null), null);
+  assert.equal(normalizeHookPayload(42), 42);
+  assert.deepEqual(normalizeHookPayload([]), []);
+  assert.equal({}.polluted, undefined, 'a __proto__ key must not reach Object.prototype');
+});
+
+test('the event map covers every event grok emits', () => {
+  const expected = {
+    pre_tool_use: 'PreToolUse', post_tool_use: 'PostToolUse',
+    post_tool_use_failure: 'PostToolUseFailure', permission_denied: 'PermissionDenied',
+    user_prompt_submit: 'UserPromptSubmit', session_start: 'SessionStart',
+    session_end: 'SessionEnd', stop: 'Stop', stop_failure: 'StopFailure',
+    stop_cancelled: 'StopCancelled', subagent_start: 'SubagentStart',
+    subagent_stop: 'SubagentStop', pre_compact: 'PreCompact', post_compact: 'PostCompact',
+    notification: 'Notification',
+  };
+  for (const [snake, pascal] of Object.entries(expected)) {
+    assert.equal(normalizeHookPayload({ hookEventName: snake }).hook_event_name, pascal);
+  }
+  assert.equal(normalizeHookPayload({ hook_event_name: 'Stop' }).hook_event_name, 'Stop',
+    'an already-PascalCase value is kept');
+});

package/bin/__tests__/omp-bridge.test.js

@@ -0,0 +1,168 @@
+'use strict';
+
+// omp has no hooks.json. The bridge is the only thing between omp's lifecycle events and
+// CafeKit's gate scripts, so a mistranslation disables every gate while looking installed.
+// These tests drive the bridge's exported functions against real child hook processes from
+// the tree an omp install produces: the Claude hook set with the omp overlay written over
+// it. They do not launch omp, which needs provider credentials; the contract rows they rely
+// on were read from the installed omp binary and are recorded in plan.md.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const BRIDGE = path.join(PACKAGE_ROOT, 'src/omp/extensions/cafekit-bridge.mjs');
+const SETTINGS = require(path.join(PACKAGE_ROOT, 'src/claude/settings/settings.json'));
+const MANIFEST = require(path.join(PACKAGE_ROOT, 'src/claude/migration-manifest.json'));
+const { PREFIX } = require(path.join(PACKAGE_ROOT, 'src/claude/hooks/completion-authority-state.cjs'));
+
+/**
+ * The hooks an omp install runs: the Claude set the manifest ships, then `src/omp/hooks/`
+ * written over it. Composed once under a dotted folder so runtime-dir.cjs derives `.omp`.
+ */
+const COMPOSED_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-composed-'));
+const HOOKS = path.join(COMPOSED_ROOT, '.omp', 'hooks');
+for (const rel of MANIFEST.runtime.files.filter((f) => f.startsWith('hooks/'))) {
+  const target = path.join(COMPOSED_ROOT, '.omp', rel);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude', rel), target);
+}
+fs.cpSync(path.join(PACKAGE_ROOT, 'src/omp/hooks'), HOOKS, { recursive: true });
+fs.cpSync(path.join(PACKAGE_ROOT, 'src/claude/scripts'), path.join(COMPOSED_ROOT, '.omp', 'scripts'), { recursive: true });
+
+let bridge;
+test.before(async () => { bridge = await import(BRIDGE); });
+test.after(() => { fs.rmSync(COMPOSED_ROOT, { recursive: true, force: true }); });
+
+function tempProject(withSecret = true) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-bridge-'));
+  if (withSecret) fs.writeFileSync(path.join(root, '.env'), 'TOKEN=redacted\n');
+  return root;
+}
+
+function registered(eventName) {
+  return (SETTINGS.hooks[eventName] || [])
+    .flatMap((g) => g.hooks || [])
+    .map((h) => (h.command.match(/hooks\/([a-z-]+\.cjs)/) || [])[1])
+    .filter(Boolean);
+}
+
+test('the dispatch table mirrors settings.json for every event omp can deliver', () => {
+  const { DISPATCH } = bridge;
+  const pairs = [
+    ['session_start', 'SessionStart'], ['session_before_compact', 'PreCompact'],
+    ['input', 'UserPromptSubmit'], ['tool_call', 'PreToolUse'],
+    ['tool_result', 'PostToolUse'], ['session_stop', 'Stop'],
+  ];
+  for (const [omp, claude] of pairs) {
+    assert.deepEqual([...DISPATCH[omp].hooks].sort(), [...new Set(registered(claude))].sort(),
+      `${omp} must dispatch exactly the hooks settings.json registers for ${claude}`);
+  }
+  // omp has no subagent events; the gap is deliberate and documented, not forgotten.
+  assert.ok(!Object.values(DISPATCH).some((e) => e.event.startsWith('Subagent')));
+});
+
+test('every dispatch carries a stable session id and the project cwd', () => {
+  const { shapePayload } = bridge;
+  const ctx = { cwd: '/tmp/project' };
+  const a = shapePayload('input', { text: 'hi', source: 'user' }, ctx);
+  const b = shapePayload('tool_call', { toolName: 'bash', input: { command: 'ls' } }, ctx);
+  assert.ok(a.session_id && a.session_id === b.session_id,
+    'omp input carries no session id; rules.cjs exits without one, so the bridge must mint and reuse it');
+  assert.equal(a.cwd, '/tmp/project', 'spec-gate.cjs falls back to payload.cwd to find the project');
+  assert.equal(shapePayload('session_stop', { session_id: 'omp-real' }, ctx).session_id, 'omp-real',
+    'a session id omp does provide must win over the minted one');
+});
+
+test('each denial mechanism becomes an omp block carrying the hook reason', () => {
+  const { interpretVerdict } = bridge;
+  const stop = interpretVerdict({ code: 0, stdout: '{"decision":"block","reason":"R1"}\n' }, 'spec-gate.cjs');
+  assert.deepEqual([stop.block, stop.reason], [true, 'R1']);
+  const deny = interpretVerdict({ code: 0, stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: 'R2' } }) }, 'privacy-block.cjs');
+  assert.deepEqual([deny.block, deny.reason], [true, 'R2']);
+  // inspect-block / task-scaffold-guard exit 2 and write the reason on STDOUT, not stderr.
+  const exit2 = interpretVerdict({ code: 2, stdout: 'SCOPE LIMIT EXCEEDED\nRestricted zones: node_modules', stderr: '' }, 'inspect-block.cjs');
+  assert.equal(exit2.block, true);
+  assert.match(exit2.reason, /SCOPE LIMIT EXCEEDED/, 'a stderr-only reader would drop this reason');
+  // An ask under Claude has no omp equivalent; it must not fall through to allow.
+  const ask = interpretVerdict({ code: 0, stdout: JSON.stringify({ hookSpecificOutput: { permissionDecision: 'ask', permissionDecisionReason: 'R3' } }) }, 'x');
+  assert.equal(ask.block, true);
+  // Plain text that is not a verdict is context to inject, not a block.
+  const inject = interpretVerdict({ code: 0, stdout: '## Rules\n- keep docs under 800 lines' }, 'rules.cjs');
+  assert.deepEqual([inject.block, inject.inject.startsWith('## Rules')], [false, true]);
+});
+
+test('a lowercase bash command on a secret file is blocked end to end through the real fork', async () => {
+  const root = tempProject();
+  try {
+    const r = await bridge.runEvent('tool_call',
+      { toolName: 'bash', toolCallId: 'c1', input: { command: `cat ${path.join(root, '.env')}` } },
+      { cwd: root }, { dir: HOOKS });
+    assert.equal(r.block, true);
+    assert.equal(r.hook, 'privacy-block.cjs');
+    assert.match(r.reason, /\.env/, 'the block must name what it protected');
+    const ok = await bridge.runEvent('tool_call',
+      { toolName: 'read', toolCallId: 'c2', input: { file_path: path.join(root, 'README.md') } },
+      { cwd: root }, { dir: HOOKS });
+    assert.equal(ok.block, false, 'an ordinary read must not be blocked');
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});
+
+test('a slow hook blocks with its own name before omp cuts it off', async () => {
+  const slow = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-slow-'));
+  try {
+    fs.writeFileSync(path.join(slow, 'privacy-block.cjs'), 'setTimeout(() => {}, 60000);');
+    assert.ok(bridge.BRIDGE_TIMEOUT_MS < 30000, 'omp substitutes a reasonless block at 30000 ms');
+    const t0 = Date.now();
+    const r = await bridge.runEvent('tool_call', { toolName: 'bash', input: { command: 'ls' } }, { cwd: slow }, { dir: slow, timeoutMs: 300 });
+    assert.equal(r.block, true);
+    assert.match(r.reason, /privacy-block\.cjs exceeded 300 ms/);
+    assert.ok(Date.now() - t0 < 5000, 'the budget must actually fire');
+  } finally { fs.rmSync(slow, { recursive: true, force: true }); }
+});
+
+test('a crashing or missing gate blocks on gating events instead of silently allowing', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-crash-'));
+  try {
+    // Only the crashing gate is under test; the other two PreToolUse gates get allow stubs,
+    // otherwise their absence is what blocks (see the missing-gate case below).
+    fs.writeFileSync(path.join(dir, 'privacy-block.cjs'), 'throw new Error("boom");');
+    for (const stub of ['inspect-block.cjs', 'task-scaffold-guard.cjs']) fs.writeFileSync(path.join(dir, stub), 'process.exit(0);');
+    const crash = await bridge.runEvent('tool_call', { toolName: 'bash', input: { command: 'ls' } }, { cwd: dir }, { dir });
+    // A bare exit 1 with no verdict is an allow under the hooks' own contract. Real gates
+    // never surface a crash this way: the fork's privacy-block catch-all converts its own
+    // errors into a deny, which the fork tests pin separately.
+    assert.equal(crash.block, false, 'exit 1 with no verdict is an allow per the hooks\' own contract');
+    const missing = await bridge.runEvent('tool_call', { toolName: 'bash', input: { command: 'ls' } }, { cwd: dir }, { dir: path.join(dir, 'nowhere') });
+    assert.equal(missing.block, true, 'a gate that is not installed must be loud, not a silent allow');
+    assert.match(missing.reason, /not installed/);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('stop_hook_active short-circuits the gate so a blocked turn cannot loop forever', async () => {
+  const r = await bridge.runEvent('session_stop', { stop_hook_active: true, session_id: 's1' }, { cwd: os.tmpdir() }, { dir: HOOKS });
+  assert.deepEqual([r.block, r.skipped], [false, 'stop_hook_active']);
+});
+
+test('the approval phrase reaches completion-authority through the input event', async () => {
+  const { DISPATCH, shapePayload } = bridge;
+  assert.ok(DISPATCH.input.hooks.includes('completion-authority.cjs'),
+    'the --approve path only runs on UserPromptSubmit; without this routing a blocked turn has no exit');
+  const phrase = `${PREFIX}${'a'.repeat(24)}`;
+  const p = shapePayload('input', { text: phrase, source: 'user' }, { cwd: '/tmp/p' });
+  assert.equal(p.hook_event_name, 'UserPromptSubmit', 'completion-authority selects --approve from this field');
+  assert.equal(p.prompt, phrase, 'the phrase must arrive byte-exact; the hook compares it exactly');
+  assert.ok(p.session_id, 'approve() returns early without a session id');
+});
+
+test('input injections flow back as a transform that keeps the user text intact', async () => {
+  const root = tempProject(false);
+  try {
+    const r = await bridge.runEvent('input', { text: 'please read .env for me', source: 'user' }, { cwd: root }, { dir: HOOKS });
+    assert.equal(r.block, false);
+    assert.match(r.inject, /Secret handling/, 'secret-output-guardrail must inject on a credential prompt');
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});