@haposoft/cafekit 0.16.0 → 0.16.2

package/bin/__tests__/omp-hooks.test.js

@@ -0,0 +1,178 @@
+'use strict';
+
+// The gate scripts were authored against Claude Code's vocabulary. omp speaks a
+// different one: its tool registry uses lowercase names, and its tool_call result has
+// only { block, reason } — there is no ask state. `src/omp/hooks/` is an overlay holding
+// only the files that carry those contract differences; the installer writes it over the
+// portable Claude set. Each test states the failure it prevents, because an overlay that
+// silently drifts back to the Claude contract disables a gate while looking installed.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const OMP_HOOKS = path.join(PACKAGE_ROOT, 'src/omp/hooks');
+const CLAUDE_HOOKS = path.join(PACKAGE_ROOT, 'src/claude/hooks');
+const { normalizeToolName } = require(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/hook-payload.cjs'));
+const MANIFEST = require(path.join(PACKAGE_ROOT, 'src/claude/migration-manifest.json'));
+
+/**
+ * The overlay is not runnable on its own: it requires the shared libraries the Claude set
+ * carries. Behaviour is therefore exercised on what an install produces — the manifest's
+ * hook set with the overlay written over it, under a dotted folder so runtime-dir derives
+ * `.omp` — while the source-shape checks below read `src/omp/hooks/` directly.
+ */
+const INSTALLED_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-installed-'));
+const INSTALLED = path.join(INSTALLED_ROOT, '.omp', 'hooks');
+for (const rel of MANIFEST.runtime.files.filter((f) => f.startsWith('hooks/'))) {
+  const target = path.join(INSTALLED_ROOT, '.omp', rel);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude', rel), target);
+}
+fs.cpSync(OMP_HOOKS, INSTALLED, { recursive: true });
+test.after(() => { fs.rmSync(INSTALLED_ROOT, { recursive: true, force: true }); });
+
+function withSecretProject(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-hooks-'));
+  try {
+    fs.writeFileSync(path.join(root, '.env'), 'API_TOKEN=redacted\n');
+    return run(root);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+/** Run a hook as a real child process and return its verdict, if any. */
+function verdict(hookPath, payload) {
+  const result = spawnSync(process.execPath, [hookPath], {
+    input: typeof payload === 'string' ? payload : JSON.stringify(payload),
+    encoding: 'utf8',
+  });
+  const out = (result.stdout || '').trim();
+  let decision = null;
+  try {
+    decision = out ? JSON.parse(out)?.hookSpecificOutput?.permissionDecision ?? null : null;
+  } catch { decision = null; }
+  return { code: result.status, out, decision };
+}
+
+test('omp tool names map to the Claude names the rules were written against', () => {
+  for (const [omp, claude] of [['bash', 'Bash'], ['read', 'Read'], ['edit', 'Edit'], ['write', 'Write'], ['grep', 'Grep']]) {
+    assert.equal(normalizeToolName(omp), claude, `${omp} must reach the ${claude} rule`);
+  }
+  // An unknown tool is left alone rather than renamed into a rule it does not belong to.
+  assert.equal(normalizeToolName('some_future_tool'), 'some_future_tool');
+  assert.equal(normalizeToolName('Bash'), 'Bash', 'a Claude name must survive unchanged');
+});
+
+test('a lowercase bash command reading a secret file is denied, where Claude asks', () => {
+  withSecretProject((root) => {
+    const payload = { tool_name: 'bash', tool_input: { command: `cat ${path.join(root, '.env')}` }, cwd: root };
+
+    // Both hooks now see the lowercase name, because the shared payload reader aliases it.
+    // What still differs is the answer: omp's tool_call result carries only block and
+    // reason, so an ask there would be dropped and the access allowed.
+    const claude = verdict(path.join(CLAUDE_HOOKS, 'privacy-block.cjs'), payload);
+    assert.equal(claude.decision, 'ask', 'the Claude hook now recognises the lowercase name and asks');
+
+    const omp = verdict(path.join(INSTALLED, 'privacy-block.cjs'), payload);
+    assert.equal(omp.decision, 'deny');
+    assert.match(omp.out, /\.env/, 'the denial must name what it protected');
+  });
+});
+
+test('a capitalised tool name keeps working, so the fork adds a case rather than swapping one', () => {
+  withSecretProject((root) => {
+    const omp = verdict(path.join(INSTALLED, 'privacy-block.cjs'),
+      { tool_name: 'Bash', tool_input: { command: `cat ${path.join(root, '.env')}` }, cwd: root });
+    assert.equal(omp.decision, 'deny');
+  });
+});
+
+test('the privacy hook denies where Claude asks, since omp tool_call has no ask state', () => {
+  const source = fs.readFileSync(path.join(OMP_HOOKS, 'privacy-block.cjs'), 'utf8');
+  assert.ok(!source.includes("permissionDecision: 'ask'"),
+    "omp's tool_call result carries only block and reason; an ask would be dropped and the access allowed");
+  assert.ok(source.includes("permissionDecision: 'deny'"));
+
+  withSecretProject((root) => {
+    const omp = verdict(path.join(INSTALLED, 'privacy-block.cjs'),
+      { tool_name: 'read', tool_input: { file_path: path.join(root, '.env') }, cwd: root });
+    assert.equal(omp.decision, 'deny');
+  });
+});
+
+test('an unevaluable access denies rather than allows', () => {
+  for (const malformed of ['not json', '', '{"tool_name":']) {
+    const omp = verdict(path.join(INSTALLED, 'privacy-block.cjs'), malformed);
+    assert.equal(omp.code, 0, 'the hook must not crash the turn');
+    if (malformed === 'not json' || malformed === '{"tool_name":') {
+      assert.equal(omp.decision, 'deny',
+        'a hook that cannot evaluate an access must not hand the model a secret-bearing path');
+    }
+  }
+});
+
+test('a write to a scaffolded task path is guarded under omp lowercase names too', () => {
+  // The guard is no longer an overlay file, so this is a behaviour case on the tree an
+  // install produces: omp sends `write`, and the shared reader has to make it reach the
+  // rule that was authored against Claude's `Write`.
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-guard-'));
+  try {
+    const target = path.join(root, 'specs', 'demo', 'tasks', 'task-R0-01-x.md');
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.cpSync(path.join(PACKAGE_ROOT, 'src/claude/scripts'), path.join(INSTALLED_ROOT, '.omp', 'scripts'),
+      { recursive: true, force: true });
+    const r = verdict(path.join(INSTALLED, 'task-scaffold-guard.cjs'),
+      { tool_name: 'write', tool_input: { file_path: target }, cwd: root });
+    assert.equal(r.code, 2, "omp sends `write`; an exact 'Write' comparison would skip the guard entirely");
+    assert.equal(r.decision, 'deny');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+/** Every file under a directory, relative and sorted. */
+function walk(dir, prefix = '') {
+  return fs.readdirSync(dir).flatMap((name) => {
+    const rel = prefix ? `${prefix}/${name}` : name;
+    return fs.statSync(path.join(dir, name)).isDirectory() ? walk(path.join(dir, name), rel) : [rel];
+  }).sort();
+}
+
+/** The contract edits, applied to the portable Claude bytes. This is the whole overlay. */
+function expectedOverlay(name) {
+  let source = fs.readFileSync(path.join(CLAUDE_HOOKS, name), 'utf8');
+  const edit = (from, to) => {
+    assert.equal(source.split(from).length - 1, 1, `${name} must contain exactly one "${from.trim()}"`);
+    source = source.replace(from, to);
+  };
+  if (name === 'privacy-block.cjs') {
+    edit("        permissionDecision: 'ask',\n        permissionDecisionReason: `Sensitive file access requires approval: ${basename}`\n",
+      "        // omp has no ask state on tool_call, so an ask under Claude becomes a denial here.\n"
+      + "        permissionDecision: 'deny',\n        permissionDecisionReason: `Sensitive file access requires approval: ${basename}`\n");
+    edit("      permissionDecision: 'ask',\n      permissionDecisionReason: 'Sensitive access could not be evaluated safely.'\n",
+      "      permissionDecision: 'deny',\n      permissionDecisionReason: 'Sensitive access could not be evaluated safely.'\n");
+  }
+  return source;
+}
+
+test('the fork differs from Claude only by its overlay', () => {
+  // A second file here would be a hook the installer stops taking from Claude, so a
+  // Claude fix would silently miss omp. A shared file that differs beyond its contract
+  // edits is the same drift in the other direction. Every lowercase tool name omp sends
+  // is handled by the shared payload reader, so only the ask-versus-deny difference —
+  // which is a contract, not a spelling — still needs a file of its own.
+  assert.deepEqual(walk(OMP_HOOKS), ['privacy-block.cjs']);
+  for (const name of ['privacy-block.cjs']) {
+    assert.equal(fs.readFileSync(path.join(OMP_HOOKS, name), 'utf8'), expectedOverlay(name),
+      `${name} must be the portable Claude file plus its omp contract edits, nothing else`);
+  }
+  const phase = fs.readFileSync(path.join(PACKAGE_ROOT, 'bin/phases/omp-runtime.js'), 'utf8');
+  assert.match(phase, /claudeHookFiles/, 'the phase must install the Claude set first');
+  assert.match(phase, /overlayFiles/, 'the phase must write the overlay over it');
+});

package/bin/__tests__/omp-runtime.test.js

@@ -0,0 +1,150 @@
+'use strict';
+
+// omp discovers .claude/skills and .agents/skills on its own, so CafeKit ships it no
+// skill payload. What omp lacks is the enforcement chain, so an omp install has to
+// provision the hooks and the extension directory that carries it. These tests pin the
+// install path only; gate behaviour belongs to the tasks that author the fork and bridge.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const INSTALLER = path.join(PACKAGE_ROOT, 'bin/install.js');
+const { PLATFORMS } = require(path.join(PACKAGE_ROOT, 'bin/lib/context'));
+
+function inTempProject(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-runtime-'));
+  try {
+    const init = spawnSync('git', ['-C', root, 'init', '-q'], { encoding: 'utf8' });
+    assert.equal(init.status, 0, init.stderr);
+    return run(root);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+function install(root, platform, extra = []) {
+  return spawnSync(process.execPath, [INSTALLER, '--platform', platform, '--yes', ...extra],
+    { cwd: root, encoding: 'utf8', env: { ...process.env, PATH: '/usr/bin:/bin' } });
+}
+
+test('omp is a registered platform that ships no skill payload of its own', () => {
+  const omp = PLATFORMS.omp;
+  assert.ok(omp, 'omp must exist in the platform registry');
+  assert.equal(omp.folder, '.omp');
+  assert.equal(omp.capabilities.skills, false, 'omp reads .claude/skills itself; copying would duplicate');
+  assert.equal(omp.capabilities.agents, false);
+});
+
+test('an omp install creates hooks, an extensions directory, and platform metadata', () => {
+  inTempProject((root) => {
+    const result = install(root, 'omp');
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+
+    const hooks = fs.readdirSync(path.join(root, '.omp', 'hooks')).filter((f) => f.endsWith('.cjs'));
+    assert.ok(hooks.length > 0, 'the gate scripts must be installed');
+    for (const required of ['spec-gate.cjs', 'privacy-block.cjs', 'rules.cjs']) {
+      assert.ok(hooks.includes(required), `missing ${required}`);
+    }
+
+    assert.equal(fs.existsSync(path.join(root, '.omp', 'extensions')), true,
+      'omp auto-loads this directory; a half-provisioned install must be visibly empty, not absent');
+
+    const metadata = JSON.parse(fs.readFileSync(path.join(root, '.omp', 'cafekit.json'), 'utf8'));
+    assert.equal(metadata.platform, 'omp');
+    assert.ok(metadata.version, 'the install must record a version');
+  });
+});
+
+test('a non-omp install creates no .omp directory', () => {
+  inTempProject((root) => {
+    const result = install(root, 'claude');
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+    assert.equal(fs.existsSync(path.join(root, '.omp')), false);
+  });
+});
+
+test('an omp install ignores its own auto-executed extension directory', () => {
+  inTempProject((root) => {
+    assert.equal(install(root, 'omp').status, 0);
+    const ignore = fs.readFileSync(path.join(root, '.gitignore'), 'utf8');
+    // A committed .omp/extensions/ would run arbitrary code on clone, before any gate
+    // can act, so the ignore rule is part of the install rather than user hygiene.
+    assert.match(ignore, /^\.omp\/$/m, '.omp/ must be ignored like .claude/ and .codex/');
+  });
+});
+
+test('reinstalling omp is idempotent and preserves a user-added extension', () => {
+  inTempProject((root) => {
+    assert.equal(install(root, 'omp').status, 0);
+    const mine = path.join(root, '.omp', 'extensions', 'my-own.mjs');
+    fs.writeFileSync(mine, 'export default function () {}\n');
+
+    assert.equal(install(root, 'omp').status, 0);
+    assert.equal(fs.existsSync(mine), true, 'a reinstall erased an extension the user added');
+  });
+});
+
+test('an omp install ships the scripts the Stop gate needs', () => {
+  inTempProject((root) => {
+    fs.mkdirSync(path.join(root, 'specs'), { recursive: true });
+    const result = install(root, 'omp');
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+
+    // Every Stop-time gate requires ../scripts/*.cjs. Without these files the
+    // installed gate answers "Completion gate unavailable" and the bridge turns that
+    // into a block on every session_stop — the defect this case exists to pin.
+    for (const script of ['workflow-policy.cjs', 'spec-receipt.cjs', 'spec-resolver.cjs', 'provenance.cjs']) {
+      assert.equal(fs.existsSync(path.join(root, '.omp', 'scripts', script)), true, `missing .omp/scripts/${script}`);
+    }
+
+    const gate = spawnSync(process.execPath, [path.join(root, '.omp', 'hooks', 'spec-gate.cjs')], {
+      cwd: root,
+      input: JSON.stringify({ session_id: 'gate-probe', cwd: root, hook_event_name: 'Stop', stop_hook_active: false }),
+      encoding: 'utf8',
+    });
+    assert.equal(gate.status, 0, gate.stderr);
+    assert.doesNotMatch(gate.stdout, /Completion gate unavailable/, 'the installed Stop gate must load its scripts');
+  });
+});
+
+test('an omp-only install injects rules', () => {
+  inTempProject((root) => {
+    const result = install(root, 'omp');
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+    assert.equal(fs.existsSync(path.join(root, '.claude')), false, 'this case is about a project with no .claude at all');
+
+    // The hooks read their configuration from the folder they live in, so omp needs its
+    // own runtime.json: no statusline (omp has none), usage off (that hook reads Claude
+    // Code's credential file), coding level 1 like Codex.
+    const runtime = JSON.parse(fs.readFileSync(path.join(root, '.omp', 'runtime.json'), 'utf8'));
+    assert.equal(runtime.codingLevel, 1);
+    assert.equal(runtime.usage.enabled, false);
+    assert.deepEqual(Object.keys(runtime).filter((k) => k.startsWith('statusline')), []);
+    assert.equal(runtime.$schema, './runtime.schema.json');
+    assert.equal(fs.existsSync(path.join(root, '.omp', 'runtime.schema.json')), true, 'the schema installs beside the file that references it');
+
+    // The Claude set arrives whole, the overlay on top, and nothing from the test tree.
+    const hooks = fs.readdirSync(path.join(root, '.omp', 'hooks'));
+    assert.equal(hooks.includes('__tests__'), false, 'the source tree holds tests that must never install');
+    for (const required of ['rules.cjs', 'spec-gate.cjs', 'session.cjs', 'lib/runtime-dir.cjs', 'lib/hook-payload.cjs']) {
+      assert.equal(fs.existsSync(path.join(root, '.omp', 'hooks', required)), true, `missing .omp/hooks/${required}`);
+    }
+    const privacy = fs.readFileSync(path.join(root, '.omp', 'hooks', 'privacy-block.cjs'), 'utf8');
+    assert.ok(privacy.includes("permissionDecision: 'deny'") && !privacy.includes("permissionDecision: 'ask'"),
+      'the installed privacy hook must be the omp overlay, not the Claude file');
+
+    const rules = spawnSync(process.execPath, [path.join(root, '.omp', 'hooks', 'rules.cjs')], {
+      cwd: root,
+      input: JSON.stringify({ session_id: `omp-rules-${Date.now()}`, cwd: root, prompt: 'hello' }),
+      encoding: 'utf8',
+      env: { ...process.env, CLAUDE_PROJECT_DIR: '', PROJECT_ROOT: '' },
+    });
+    assert.equal(rules.status, 0, rules.stderr);
+    assert.match(rules.stdout, /## Rules/, 'without .omp/runtime.json the hook exits silently and omp never sees the rules');
+  });
+});

package/bin/__tests__/orca-session.test.js

@@ -0,0 +1,225 @@
+'use strict';
+
+// SessionStart is the one place a session can learn where it is before the user says a
+// word. When ORCA_PANE_KEY is present the CafeKit session hook for Claude Code and for
+// Codex now appends "Orca: pane" to its first line. The same environment carries two
+// credentials, ORCA_AGENT_HOOK_TOKEN and ORCA_AGENT_LAUNCH_TOKEN; neither must ever reach
+// stdout, stderr, or the env file the Claude hook writes. Every case here builds its own
+// environment from a copy of process.env with every ORCA_* key removed first, because this
+// suite itself commonly runs inside an Orca pane — spawning with the ambient environment
+// unstripped would make the negative cases pass or fail by accident of where they run.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '..', '..');
+const CLAUDE_HOOK = path.join(PACKAGE_ROOT, 'src/claude/hooks/session.cjs');
+
+const HOOK_TOKEN_SENTINEL = 'sentinel-hook-token-2fc9a1';
+const LAUNCH_TOKEN_SENTINEL = 'sentinel-launch-token-7be04d';
+
+/** A copy of process.env with every ORCA_* key removed, then the case's own additions. */
+function baseEnv(overrides = {}) {
+  const stripped = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (!key.startsWith('ORCA_')) stripped[key] = value;
+  }
+  return { ...stripped, ...overrides };
+}
+
+function git(args, cwd) {
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  assert.equal(result.status, 0, `git ${args.join(' ')} failed: ${result.stderr}`);
+}
+
+/** A git repo with one commit on a named branch, and no package.json: detectProjectType
+ * always resolves to at least "app", so this is the smallest fixture that still has a
+ * second, real fact (Branch) alongside the unavoidable Type. */
+function withRepo(run) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-orca-session-'));
+  try {
+    git(['init', '-q'], dir);
+    git(['config', 'user.email', 'cafekit@example.invalid'], dir);
+    git(['config', 'user.name', 'CafeKit Test'], dir);
+    git(['commit', '--allow-empty', '-qm', 'fixture'], dir);
+    git(['checkout', '-q', '-b', 'orca-fixture'], dir);
+    return run(dir);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/** A plain directory: no git, no package.json. detectProjectType still returns "app", so
+ * this is the minimum a session can print — there is no directory shape that yields zero
+ * parts, on either hook, because "Type: app" is not conditional on anything being found. */
+function withBareDir(run) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-orca-session-bare-'));
+  try {
+    return run(dir);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function runClaude(cwd, env, envFile) {
+  const result = spawnSync(process.execPath, [CLAUDE_HOOK], {
+    cwd,
+    input: JSON.stringify({ source: 'startup' }),
+    encoding: 'utf8',
+    env: envFile ? { ...env, CLAUDE_ENV_FILE: envFile } : env,
+  });
+  assert.equal(result.status, 0, `hook must exit 0 (fail-open): ${result.stderr}`);
+  return result;
+}
+
+test('the Claude session line ends with Orca: pane', () => {
+  withRepo((dir) => {
+    const without = runClaude(dir, baseEnv());
+    const withOrca = runClaude(dir, baseEnv({ ORCA_PANE_KEY: 'pane-abc' }));
+    assert.match(withOrca.stdout, /Orca: pane$/m, 'Orca: pane must be the last part on its line');
+    assert.equal(withOrca.stdout.trimEnd(), `${without.stdout.trimEnd()} | Orca: pane`,
+      'the line must be byte-equal to the no-variable line plus " | Orca: pane"');
+  });
+});
+
+test('no Orca part outside a pane, byte for byte', () => {
+  withRepo((dir) => {
+    const first = runClaude(dir, baseEnv());
+    const second = runClaude(dir, baseEnv());
+    assert.doesNotMatch(first.stdout, /Orca/, 'without ORCA_PANE_KEY the line must never mention Orca');
+    assert.equal(first.stdout, second.stdout, 'the same fixture must print the same line every time');
+  });
+});
+
+test('keying on ORCA_TERMINAL_HANDLE instead of ORCA_PANE_KEY must not add the marker', () => {
+  // The handle is a real, non-secret variable Orca also sets, but it is not the presence
+  // marker this packet keys on: a hook that checked it instead would fire outside a
+  // trusted pane state or miss a pane that only carries the key.
+  withRepo((dir) => {
+    const handleOnly = runClaude(dir, baseEnv({ ORCA_TERMINAL_HANDLE: 'term-xyz' }));
+    assert.doesNotMatch(handleOnly.stdout, /Orca/, 'ORCA_TERMINAL_HANDLE alone must not print the marker');
+  });
+});
+
+test('an empty project inside a pane still prints the marker', () => {
+  // No directory shape yields zero parts: detectProjectType always resolves to at least
+  // "app". This is the true minimum line, not the empty-parts case the plan first assumed.
+  withBareDir((dir) => {
+    const withOrca = runClaude(dir, baseEnv({ ORCA_PANE_KEY: 'pane-abc' }));
+    assert.equal(withOrca.stdout.trimEnd(), 'Session startup. Type: app | Orca: pane');
+  });
+});
+
+test('no token ever reaches stdout, stderr, or the Claude env file', () => {
+  withRepo((dir) => {
+    const envFile = path.join(dir, 'orca-session-env.sh');
+    const result = runClaude(dir, baseEnv({
+      ORCA_PANE_KEY: 'pane-abc',
+      ORCA_AGENT_HOOK_TOKEN: HOOK_TOKEN_SENTINEL,
+      ORCA_AGENT_LAUNCH_TOKEN: LAUNCH_TOKEN_SENTINEL,
+    }), envFile);
+    assert.match(result.stdout, /Orca: pane$/m, 'the marker must still print alongside the tokens');
+    const envFileText = fs.existsSync(envFile) ? fs.readFileSync(envFile, 'utf8') : '';
+    for (const sentinel of [HOOK_TOKEN_SENTINEL, LAUNCH_TOKEN_SENTINEL]) {
+      assert.doesNotMatch(result.stdout, new RegExp(sentinel), 'stdout must not carry the token');
+      assert.doesNotMatch(result.stderr, new RegExp(sentinel), 'stderr must not carry the token');
+      assert.doesNotMatch(envFileText, new RegExp(sentinel), 'the env file must not carry the token');
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------------------
+// Codex: session.cjs resolves its own PROJECT_ROOT from lib/hook-context.cjs's __dirname,
+// not from payload.cwd or process.cwd(), so testing it means composing the same relative
+// layout an install produces rather than spawning the source file against an arbitrary
+// directory. The Codex-side runtime-path-safety.cjs in the source tree is a thin re-export
+// pointing at the Claude file three levels up; the real installer materializes the Claude
+// file's content in its place (bin/phases/codex-runtime.js), so the composed tree does too.
+// ---------------------------------------------------------------------------------------
+
+function composeCodexHookTree(root) {
+  const hooksDir = path.join(root, '.codex', 'hooks');
+  fs.mkdirSync(path.join(hooksDir, 'lib'), { recursive: true });
+  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/codex/hooks/session.cjs'), path.join(hooksDir, 'session.cjs'));
+  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/codex/hooks/completion-authority-state.cjs'),
+    path.join(hooksDir, 'completion-authority-state.cjs'));
+  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/codex/hooks/lib/hook-context.cjs'),
+    path.join(hooksDir, 'lib', 'hook-context.cjs'));
+  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/codex/hooks/lib/privacy-state.cjs'),
+    path.join(hooksDir, 'lib', 'privacy-state.cjs'));
+  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/runtime-path-safety.cjs'),
+    path.join(hooksDir, 'lib', 'runtime-path-safety.cjs'));
+  return path.join(hooksDir, 'session.cjs');
+}
+
+function withCodexProject(run) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-orca-codex-session-'));
+  try {
+    const hook = composeCodexHookTree(dir);
+    return run(dir, hook);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function runCodex(hook, cwd, env) {
+  const result = spawnSync(process.execPath, [hook], {
+    cwd,
+    input: JSON.stringify({ source: 'startup', cwd, session_id: 'orca-session-test' }),
+    encoding: 'utf8',
+    env,
+  });
+  assert.equal(result.status, 0, `hook must exit 0 (fail-open): ${result.stderr}`);
+  return result;
+}
+
+test('the Codex session line ends with Orca: pane', () => {
+  withCodexProject((dir, hook) => {
+    git(['init', '-q'], dir);
+    git(['config', 'user.email', 'cafekit@example.invalid'], dir);
+    git(['config', 'user.name', 'CafeKit Test'], dir);
+    git(['commit', '--allow-empty', '-qm', 'fixture'], dir);
+    git(['checkout', '-q', '-b', 'orca-fixture'], dir);
+
+    const without = runCodex(hook, dir, baseEnv());
+    const withOrca = runCodex(hook, dir, baseEnv({ ORCA_PANE_KEY: 'pane-abc' }));
+    assert.match(withOrca.stdout, /Orca: pane$/m);
+    assert.equal(withOrca.stdout.split('\n')[0], `${without.stdout.split('\n')[0]} | Orca: pane`,
+      'the summary line must be byte-equal to the no-variable line plus " | Orca: pane"');
+  });
+});
+
+test('no Orca part outside a pane on Codex, byte for byte', () => {
+  withCodexProject((dir, hook) => {
+    const first = runCodex(hook, dir, baseEnv());
+    const second = runCodex(hook, dir, baseEnv());
+    assert.doesNotMatch(first.stdout.split('\n')[0], /Orca/);
+    assert.equal(first.stdout, second.stdout);
+  });
+});
+
+test('an empty Codex project inside a pane still prints the marker', () => {
+  withCodexProject((dir, hook) => {
+    const result = runCodex(hook, dir, baseEnv({ ORCA_PANE_KEY: 'pane-abc' }));
+    assert.equal(result.stdout.split('\n')[0], 'Session startup. Type: app | Orca: pane');
+  });
+});
+
+test('no token ever reaches stdout or stderr on Codex', () => {
+  withCodexProject((dir, hook) => {
+    const result = runCodex(hook, dir, baseEnv({
+      ORCA_PANE_KEY: 'pane-abc',
+      ORCA_AGENT_HOOK_TOKEN: HOOK_TOKEN_SENTINEL,
+      ORCA_AGENT_LAUNCH_TOKEN: LAUNCH_TOKEN_SENTINEL,
+    }));
+    assert.match(result.stdout, /Orca: pane$/m);
+    for (const sentinel of [HOOK_TOKEN_SENTINEL, LAUNCH_TOKEN_SENTINEL]) {
+      assert.doesNotMatch(result.stdout, new RegExp(sentinel));
+      assert.doesNotMatch(result.stderr, new RegExp(sentinel));
+    }
+  });
+});