@haposoft/cafekit 0.16.0 → 0.16.2

package/bin/__tests__/orca-skill.test.js

@@ -0,0 +1,210 @@
+'use strict';
+
+// The user runs Claude Code, Codex, Grok, and omp inside Orca (onorca.dev) panes across
+// many projects and had to explain Orca to the agent at the start of every session. This
+// packet makes that awareness ship with the install instead: a cf:orca skill that reads
+// Orca's own guide at use time, bounds what it may send to another pane, and never prints
+// the two credentials Orca sets in every pane's environment. Each case here states the
+// failure it prevents.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '..', '..');
+const INSTALLER = path.join(PACKAGE_ROOT, 'bin/install.js');
+const SKILL_SOURCE = path.join(PACKAGE_ROOT, 'src/claude/skills/orca/SKILL.md');
+const ROUTING_RULE_SOURCE = path.join(PACKAGE_ROOT, 'src/claude/rules/skill-domain-routing.md');
+const MANIFEST_PATH = path.join(PACKAGE_ROOT, 'src/claude/migration-manifest.json');
+
+const ROUTING_ROW = '| terminal/pane control in the surrounding agent host | reading, waiting on, or sending to another agent pane, or spawning an agent into a host-managed worktree |';
+
+function inTempProject(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-orca-skill-'));
+  try {
+    const init = spawnSync('git', ['-C', root, 'init', '-q'], { encoding: 'utf8' });
+    assert.equal(init.status, 0, init.stderr);
+    return run(root);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+function install(root, platforms, extra = []) {
+  return spawnSync(process.execPath, [INSTALLER, '--platform', platforms.join(','), '--yes', ...extra],
+    { cwd: root, encoding: 'utf8', env: { ...process.env, PATH: '/usr/bin:/bin' } });
+}
+
+function installedCatalog(root, runtime) {
+  const script = path.join(root, runtime === 'codex' ? '.codex' : '.claude', 'scripts', 'generate-skill-catalog.cjs');
+  const result = spawnSync(process.execPath, [script, '--json'], { cwd: root, encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  return JSON.parse(result.stdout);
+}
+
+/** The body is everything after the closing frontmatter fence; forbidden-string and
+ * authority checks apply there, not to the required `name: cf:orca` line above it. */
+function bodyOf(content) {
+  const match = content.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n([\s\S]*)$/);
+  assert.ok(match, 'SKILL.md must have a closing frontmatter fence');
+  return match[1];
+}
+
+function frontmatterDescription(content) {
+  const fm = content.match(/^---\r?\n([\s\S]*?)\r?\n---/)[1];
+  const line = fm.split(/\r?\n/).find((entry) => entry.startsWith('description:'));
+  assert.ok(line, 'frontmatter must declare description');
+  const raw = line.slice('description:'.length).trim();
+  assert.ok(raw.length >= 2 && raw[0] === raw[raw.length - 1] && /['"]/.test(raw[0]),
+    'description must be a single quoted scalar');
+  return raw.slice(1, -1);
+}
+
+const SOURCE = fs.readFileSync(SKILL_SOURCE, 'utf8');
+const BODY = bodyOf(SOURCE);
+const DESCRIPTION = frontmatterDescription(SOURCE);
+
+test('cf:orca installs for claude and codex', () => {
+  inTempProject((root) => {
+    const result = install(root, ['claude', 'codex']);
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+
+    const claudeSkill = path.join(root, '.claude', 'skills', 'orca', 'SKILL.md');
+    const codexSkill = path.join(root, '.agents', 'skills', 'orca', 'SKILL.md');
+    assert.equal(fs.existsSync(claudeSkill), true, 'the Claude skill directory must exist');
+    assert.equal(fs.existsSync(codexSkill), true, 'the Codex skill directory must exist');
+
+    const claudeContent = fs.readFileSync(claudeSkill, 'utf8');
+    const codexContent = fs.readFileSync(codexSkill, 'utf8');
+    assert.match(claudeContent, /^name: cf:orca$/m, 'Claude keeps the colon identity');
+    assert.match(codexContent, /^name: cf-orca$/m, 'Codex rewrites the colon to a hyphen');
+    assert.doesNotMatch(codexContent, /^name: cf:orca$/m);
+  });
+});
+
+test('an omp-only install ships no skill', () => {
+  inTempProject((root) => {
+    const result = install(root, ['omp']);
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+
+    // omp discovers .claude/skills and .agents/skills itself; CafeKit copies skills to
+    // neither for an omp-only install, so orca must be absent from both, not merely from
+    // some third omp-owned skills directory this packet never touches.
+    assert.equal(fs.existsSync(path.join(root, '.claude', 'skills', 'orca')), false);
+    assert.equal(fs.existsSync(path.join(root, '.agents', 'skills', 'orca')), false);
+  });
+});
+
+test('the catalog resolves cf:orca on both hosts with no diagnostic', () => {
+  inTempProject((root) => {
+    const result = install(root, ['claude', 'codex']);
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+
+    for (const runtime of ['claude', 'codex']) {
+      const catalog = installedCatalog(root, runtime);
+      const entry = catalog.skills.find((skill) => skill.directory === 'orca');
+      assert.ok(entry, `${runtime} catalog must list the orca directory`);
+      assert.equal(entry.public_id, 'cf:orca', `${runtime} public identity`);
+      const diagnostics = catalog.diagnostics.filter((item) => item.directory === 'orca');
+      assert.deepEqual(diagnostics, [], `${runtime} must report no diagnostic for orca`);
+    }
+  });
+});
+
+test('the description triggers only on Orca context', () => {
+  // Every trigger phrase carries "Orca", a pane's agent name, or Vietnamese context, and
+  // is quoted. Stripping the quoted phrases must leave no bare panel/terminal/worktree —
+  // otherwise "add a settings panel", "run this in a terminal", or "my worktree is stuck"
+  // would all pull this skill into requests that have nothing to do with Orca.
+  for (const phrase of ['pane Orca', 'panel Codex', 'theo dõi pane', 'gửi terminal bên kia', 'Orca worktree', 'spawn codex vào worktree']) {
+    assert.ok(DESCRIPTION.includes(`"${phrase}"`), `description must quote "${phrase}"`);
+  }
+  const stripped = DESCRIPTION.replace(/"[^"]*"/g, '');
+  for (const bare of ['panel', 'terminal', 'worktree']) {
+    assert.doesNotMatch(stripped, new RegExp(`\\b${bare}\\b`, 'i'),
+      `${bare} must not appear as a bare trigger outside a quoted phrase`);
+  }
+  assert.match(DESCRIPTION, /ORCA_PANE_KEY/);
+});
+
+test('the body points at orca skills get and stops when the CLI is missing', () => {
+  assert.match(BODY, /ORCA_PANE_KEY/);
+  assert.match(BODY, /orca skills get orca-cli/);
+  assert.match(BODY, /orca skills get orchestration/);
+  assert.match(BODY, /--references/);
+  assert.match(BODY, /--reference <name>/);
+  assert.match(BODY, /orca skills list/);
+  // The guide changes between CLI releases (observed between 1.4.198 and 1.4.200), so the
+  // skill must route to it rather than repeat any of its commands as a fact of its own.
+  assert.doesNotMatch(BODY, /ORCA_CLI_COMMAND/);
+  assert.match(BODY, /command -v orca/);
+  assert.match(BODY, /orca-dev/);
+  assert.match(BODY, /not available in this pane/i);
+});
+
+test('the body bounds terminal send to the current worktree and distrusts terminal output', () => {
+  assert.match(BODY, /ORCA_WORKTREE_ID/);
+  const sentences = BODY.split(/(?<=[.!?])\s+/);
+  const authoritySentence = sentences.find((sentence) => sentence.includes('terminal send'));
+  assert.ok(authoritySentence, 'one sentence must name terminal send');
+  assert.match(authoritySentence, /ORCA_WORKTREE_ID/);
+  assert.match(authoritySentence, /\bask\b/i);
+  assert.match(authoritySentence, /\bbefore\b/i);
+
+  assert.match(BODY, /terminal.{0,40}(read|show|list)/is);
+  assert.match(BODY, /untrusted/i);
+  assert.match(BODY, /never follow/i);
+  assert.match(BODY, /never echo/i);
+});
+
+test('the body draws the Herdr boundary and forbids printing the tokens', () => {
+  assert.match(BODY, /Herdr/);
+  assert.match(BODY, /HERDR_ENV=1/);
+  assert.match(BODY, /herdr-orchestrator/);
+  assert.match(BODY, /ORCA_AGENT_HOOK_TOKEN/);
+  assert.match(BODY, /ORCA_AGENT_LAUNCH_TOKEN/);
+  assert.match(BODY, /Never print/i);
+});
+
+test('the body carries nothing the Codex projection rewrites or forbids', () => {
+  // normalizeCodexBody rewrites "Claude Code" to "Codex CLI" and codex-native.test.js
+  // keeps a fixed four-file allowlist for AskUserQuestion and bans /cf:, cf:, and
+  // "Claude Code" across .agents/skills/**. A body written against one host only would
+  // read wrong, or fail installed, on the other.
+  assert.doesNotMatch(BODY, /Claude Code/);
+  assert.doesNotMatch(BODY, /AskUserQuestion/);
+  assert.doesNotMatch(BODY, /\/cf:/);
+  assert.doesNotMatch(BODY, /\bcf:/);
+  assert.doesNotMatch(BODY, /\bAgent\(/);
+  assert.doesNotMatch(BODY, /subagent_type/);
+  assert.doesNotMatch(BODY, /`Agent`/);
+  assert.doesNotMatch(BODY, /\bSendMessage\b/);
+});
+
+test('the manifest lists orca as a core skill', () => {
+  const manifest = JSON.parse(fs.readFileSync(MANIFEST_PATH, 'utf8'));
+  assert.equal(manifest.skills.required.includes('orca'), true);
+  assert.equal(manifest.skills.bundles.documentSkills.includes('orca'), false);
+});
+
+test('the routing row is a neutral slot on every host', () => {
+  const source = fs.readFileSync(ROUTING_RULE_SOURCE, 'utf8');
+  assert.ok(source.includes(ROUTING_ROW), 'the source rule must carry the exact row');
+  // The existing negative regex in skill-routing-source.test.js:91 covers only the six
+  // document skills, so a stray /cf:orca or "orchestration" in this row would slip past
+  // every existing guard.
+  assert.doesNotMatch(source, /\/cf:orca/);
+  assert.doesNotMatch(source, /orchestration/);
+
+  inTempProject((root) => {
+    const result = install(root, ['claude', 'codex', 'omp']);
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+    for (const relative of ['.claude/rules/skill-domain-routing.md', '.codex/rules/skill-domain-routing.md', '.omp/rules/skill-domain-routing.md']) {
+      const installed = fs.readFileSync(path.join(root, relative), 'utf8');
+      assert.ok(installed.includes(ROUTING_ROW), `${relative} must carry the row`);
+    }
+  });
+});

package/bin/__tests__/package-inventory.test.js

@@ -130,6 +130,7 @@ const REQUIRED_PAYLOAD = [
   'src/claude/skills/route/references/task-taxonomy.md',
   'src/claude/skills/route/references/chaining-patterns.md',
   'src/claude/skills/route/references/agent-timing.md',
+  'src/claude/skills/orca/SKILL.md',
   'src/claude/skills/brainstorm/SKILL.md',
   'src/claude/skills/brainstorm/references/question-framework.md',
   'src/claude/agents/brainstormer.md',

package/bin/__tests__/runtime-dir.test.js

@@ -0,0 +1,158 @@
+'use strict';
+
+// The gate hooks derive their runtime directory from their own location instead of a
+// literal `.claude`. Each case copies the helper into a directory shaped like a real
+// layout and requires it from there, so the derivation is exercised against the path the
+// module actually sees — not a mocked one.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '../..');
+const HELPER = path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/runtime-dir.cjs');
+const { spawnSync } = require('node:child_process');
+
+/** Place the helper at <root>/<layout>/hooks/lib/ and return what it derives. */
+function deriveAt(root, layout) {
+  const lib = path.join(root, layout, 'hooks', 'lib');
+  fs.mkdirSync(lib, { recursive: true });
+  const target = path.join(lib, 'runtime-dir.cjs');
+  fs.copyFileSync(HELPER, target);
+  // Each copy is a distinct module path, so require caches never collide.
+  return require(target);
+}
+
+function withTemp(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-runtime-dir-'));
+  try { return run(root); } finally { fs.rmSync(root, { recursive: true, force: true }); }
+}
+
+test('installed layouts derive their own folder', () => {
+  withTemp((root) => {
+    for (const folder of ['.claude', '.codex', '.omp']) {
+      const m = deriveAt(root, path.join('project-' + folder.slice(1), folder));
+      assert.equal(m.runtimeDirName(), folder);
+      assert.equal(m.runtimeDir('/p'), path.join('/p', folder));
+      assert.equal(m.runtimePath('/p', 'runtime.json'), path.join('/p', folder, 'runtime.json'));
+    }
+  });
+});
+
+test('the source tree maps platform to dotted name', () => {
+  withTemp((root) => {
+    for (const platform of ['claude', 'omp', 'codex']) {
+      const m = deriveAt(root, path.join('packages', 'spec', 'src', platform));
+      assert.equal(m.runtimeDirName(), `.${platform}`, `source tree for ${platform}`);
+    }
+  });
+});
+
+test('a dotted folder wins over the source marker', () => {
+  withTemp((root) => {
+    // An install whose absolute path happens to contain /packages/spec/src/ must still
+    // report its real folder, not a doubled-dot name derived from the marker.
+    const m = deriveAt(root, path.join('packages', 'spec', 'src', 'fixture', '.codex'));
+    assert.equal(m.runtimeDirName(), '.codex');
+  });
+});
+
+test('an unknown layout falls back to .claude', () => {
+  withTemp((root) => {
+    const m = deriveAt(root, path.join('somewhere', 'else'));
+    assert.equal(m.runtimeDirName(), '.claude', 'the pre-helper behaviour is the fallback');
+  });
+});
+
+test('the helper in the real source tree derives .claude', () => {
+  const m = require(HELPER);
+  assert.equal(m.runtimeDirName(), '.claude');
+});
+
+/** Copy the whole hook tree and the scripts it requires under <root>/<folder>/. */
+function installTreeAs(root, folder) {
+  const rt = path.join(root, folder);
+  fs.cpSync(path.join(PACKAGE_ROOT, 'src/claude/hooks'), path.join(rt, 'hooks'), {
+    recursive: true, filter: (src) => !src.includes(`${path.sep}__tests__`),
+  });
+  fs.cpSync(path.join(PACKAGE_ROOT, 'src/claude/scripts'), path.join(rt, 'scripts'), { recursive: true });
+  return rt;
+}
+
+/** Provenance derives Base/Head with git, so the fixture must be a repository (one empty commit). */
+function gitInit(root) {
+  for (const args of [['init', '-q'], ['config', 'user.email', 'cafekit@example.invalid'], ['config', 'user.name', 'CafeKit Test'], ['commit', '--allow-empty', '-qm', 'fixture']]) {
+    const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+    assert.equal(result.status, 0, `git ${args[0]} failed: ${result.stderr}`);
+  }
+}
+
+function runHook(rt, name, payload) {
+  const r = spawnSync(process.execPath, [path.join(rt, 'hooks', name)], {
+    cwd: path.dirname(rt), input: JSON.stringify(payload), encoding: 'utf8',
+    env: { ...process.env, CLAUDE_PROJECT_DIR: '', PROJECT_ROOT: '' },
+  });
+  return { code: r.status, out: (r.stdout || '') + (r.stderr || '') };
+}
+
+test('a hook tree copied under .omp reads .omp/runtime.json', () => {
+  withTemp((root) => {
+    const rt = installTreeAs(root, '.omp');
+    gitInit(root);
+    fs.mkdirSync(path.join(root, 'specs'), { recursive: true });
+    fs.writeFileSync(path.join(root, '.env'), 'TOKEN=redacted\n');
+    assert.equal(fs.existsSync(path.join(root, '.claude')), false, 'the fixture must hold no .claude path at all');
+
+    // rules.cjs: docs path from the sentinel config
+    fs.writeFileSync(path.join(rt, 'runtime.json'), JSON.stringify({ paths: { docs: 'SENTINEL-DOCS', plans: 'plans' } }));
+    const rules = runHook(rt, 'rules.cjs', { session_id: `s-${Date.now()}`, cwd: root });
+    assert.match(rules.out, /SENTINEL-DOCS/, 'rules.cjs must read .omp/runtime.json');
+
+    // inspect-block.cjs: disabled through the sentinel allows a broad search
+    fs.writeFileSync(path.join(rt, 'runtime.json'), JSON.stringify({ inspect: { enabled: false } }));
+    const inspect = runHook(rt, 'inspect-block.cjs', { tool_name: 'Bash', tool_input: { command: 'grep -rn TODO .' }, cwd: root });
+    assert.equal(inspect.code, 0, 'inspect.enabled:false in .omp/runtime.json must allow');
+
+    // privacy-block.cjs: kill switch through the sentinel allows a .env read
+    fs.writeFileSync(path.join(rt, 'runtime.json'), JSON.stringify({ privacyBlock: false }));
+    const privacy = runHook(rt, 'privacy-block.cjs', { tool_name: 'Read', tool_input: { file_path: path.join(root, '.env') }, cwd: root });
+    assert.doesNotMatch(privacy.out, /permissionDecision/, 'privacyBlock:false in .omp/runtime.json must allow');
+
+    // spec-gate.cjs exits silently unless a packet resolves, and only then reads the
+    // completion_gate flag. Resolving a done task derives provenance through git, so the
+    // fixture is a repository (gitInit above) and holds one done task to look at.
+    const feature = path.join(root, 'specs', 'demo'); fs.mkdirSync(feature, { recursive: true });
+    fs.writeFileSync(path.join(feature, 'plan.md'), '# Demo plan\n');
+    fs.writeFileSync(path.join(feature, 'task-01-demo.md'), [
+      '# Task 01: demo', '', 'Status: done', '', '## Dependencies', '', '- none', '',
+      '## Verification Plan', '', '- Command: node --test', '',
+    ].join('\n'));
+    // the completion_gate flag is read from the sentinel and answered as a block
+    fs.writeFileSync(path.join(rt, 'runtime.json'), JSON.stringify({ spec: { completion_gate: false } }));
+    const gate = runHook(rt, 'spec-gate.cjs', { session_id: 's', cwd: root, hook_event_name: 'Stop', stop_hook_active: false });
+    assert.match(gate.out, /worker-writable flag/, 'spec-gate.cjs must read .omp/runtime.json');
+  });
+});
+
+test('advice names the directory the hook lives in', () => {
+  withTemp((root) => {
+    for (const [folder, skills] of [['.omp', '.agents/skills'], ['.claude', '.claude/skills']]) {
+      const project = path.join(root, `p${folder}`); fs.mkdirSync(project, { recursive: true });
+      const rt = installTreeAs(project, folder);
+      fs.mkdirSync(path.join(project, 'specs', 'demo'), { recursive: true });
+      fs.writeFileSync(path.join(rt, 'runtime.json'), '{}');
+      // task-scaffold-guard: a raw Write into a nested task path is refused with scaffold advice
+      const guard = runHook(rt, 'task-scaffold-guard.cjs', { tool_name: 'Write', tool_input: { file_path: path.join(project, 'specs', 'demo', 'tasks', 'task-R0-01-x.md'), content: '# x' }, cwd: project });
+      assert.match(guard.out, new RegExp(`node ${folder.replace('.', '\\.')}/scripts/spec-scaffold\\.cjs`), `scaffold advice must name ${folder}`);
+      // inspect-block: header hint names the runtime file (static check on the installed copy)
+      const src = fs.readFileSync(path.join(rt, 'hooks', 'inspect-block.cjs'), 'utf8');
+      assert.match(src, /<runtime>\/runtime\.json/, 'the disable hint no longer hardcodes a platform');
+      // agent.cjs: skills advice follows the platform registry, not the runtime dir
+      const agentSrc = fs.readFileSync(path.join(rt, 'hooks', 'agent.cjs'), 'utf8');
+      assert.match(agentSrc, /'\.agents\/skills'/, 'non-Claude platforms read .agents/skills');
+      void skills;
+    }
+  });
+});

package/bin/__tests__/runtime-schema.test.js

@@ -12,7 +12,7 @@ const { test } = require('node:test');
 const PACKAGE_ROOT = path.join(__dirname, '../..');
 const SCHEMA_PATH = path.join(PACKAGE_ROOT, 'src/claude/runtime.schema.json');
 const SCHEMA = JSON.parse(fs.readFileSync(SCHEMA_PATH, 'utf8'));
-const RUNTIMES = ['src/claude/runtime.json', 'src/codex/runtime.json'];
+const RUNTIMES = ['src/claude/runtime.json', 'src/codex/runtime.json', 'src/omp/runtime.json'];
 const MANIFEST = require(path.join(PACKAGE_ROOT, 'src/claude/migration-manifest.json'));
 
 function readRuntime(relative) {
@@ -54,14 +54,14 @@ test('the schema is a valid, self-describing JSON Schema document', () => {
   assert.equal(SCHEMA.additionalProperties, false, 'an unknown top-level key must be reported, not accepted silently');
 });
 
-test('every key in both shipped runtime.json files is described by the schema', () => {
+test('every key in each shipped runtime.json is described by the schema', () => {
   for (const relative of RUNTIMES) {
     const missing = undescribedKeys(readRuntime(relative), SCHEMA);
     assert.deepEqual(missing, [], `${relative} ships keys the schema does not describe: ${missing.join(', ')}`);
   }
 });
 
-test('both runtimes point at the schema that installs beside them', () => {
+test('every runtime points at the schema that installs beside it', () => {
   for (const relative of RUNTIMES) {
     assert.equal(readRuntime(relative).$schema, './runtime.schema.json', `${relative} must reference the schema`);
   }
@@ -71,6 +71,8 @@ test('both runtimes point at the schema that installs beside them', () => {
   );
   const codexPhase = fs.readFileSync(path.join(PACKAGE_ROOT, 'bin/phases/codex-runtime.js'), 'utf8');
   assert.match(codexPhase, /runtime\.schema\.json/, 'the schema must also be installed for Codex');
+  const ompPhase = fs.readFileSync(path.join(PACKAGE_ROOT, 'bin/phases/omp-runtime.js'), 'utf8');
+  assert.match(ompPhase, /runtime\.schema\.json/, 'the schema must also be installed for omp');
 });
 
 test('every documented property carries a description a reader can act on', () => {

package/bin/__tests__/specs-v2-execution-closeout.test.js

@@ -263,7 +263,8 @@ function installGate(root, kind) {
     'scripts/workflow-policy.cjs', 'scripts/provenance.cjs', 'scripts/spec-resolver.cjs',
     'scripts/spec-receipt.cjs', 'scripts/validate-spec-output.cjs', 'scripts/spec-ground.cjs',
     'scripts/spec-semantic-model.cjs', 'scripts/spec-final-state.cjs',
-    'hooks/lib/runtime-path-safety.cjs', 'hooks/lib/hook-state-dir.cjs',
+    'hooks/lib/runtime-path-safety.cjs', 'hooks/lib/hook-state-dir.cjs', 'hooks/lib/runtime-dir.cjs',
+    'hooks/lib/hook-payload.cjs',
   ]);
   if (kind === 'claude') {
     for (const name of [
@@ -466,3 +467,29 @@ test('scaffold creates planning artifacts but no task or feature receipts', () =
     assert.equal(files.some((file) => file.includes('receipt')), false);
   });
 });
+
+test('legacy receipt still requires provenance under a clean committed tree', () => {
+  // The workflow task path may validate a committed, unchanged receipt on
+  // structure alone; the legacy task and feature receipt paths must not.
+  withTempResources((resources) => {
+    const root = gitRoot(resources);
+    const { featureDir } = prepare(root);
+    const stale = { base: 'f'.repeat(40), head: 'e'.repeat(40) };
+    fs.writeFileSync(
+      path.join(featureDir, 'receipts', path.basename(TASK)),
+      receiptBody(stale, `Task: ${path.basename(TASK)}\nTask path: ${TASK}`),
+    );
+    fs.writeFileSync(path.join(featureDir, 'feature-receipt.md'), receiptBody(stale, `Feature: ${FEATURE}`));
+    for (const args of [['add', '-A'], ['commit', '-qm', 'committed legacy receipts']]) {
+      const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+      assert.equal(result.status, 0, result.stderr);
+    }
+    const clean = spawnSync('git', ['-C', root, 'status', '--porcelain'], { encoding: 'utf8' });
+    assert.equal(clean.stdout.trim(), '', 'fixture tree must be clean before the check');
+    const ctx = runtime(root);
+    const taskFailures = RECEIPT.checkTaskReceipt(featureDir, TASK, { completed_at: '2026-08-13T00:00:00.000Z' }, ctx, POLICY).failures;
+    assert.ok(taskFailures.includes('provenance'), `legacy task receipts keep provenance binding when committed and clean; got ${JSON.stringify(taskFailures)}`);
+    const featureFailures = RECEIPT.checkFeatureReceipt(featureDir, ctx, POLICY).failures;
+    assert.ok(featureFailures.includes('provenance'), `feature receipts keep provenance binding when committed and clean; got ${JSON.stringify(featureFailures)}`);
+  });
+});

package/bin/install.js

@@ -37,12 +37,12 @@ const {
 const { reconcileSkillInventory } = require('./phases/skill-inventory');
 const { mergeClaudeSettings } = require('./phases/claude-settings');
 const { installCodexRuntime } = require('./phases/codex-runtime');
+const { installOmpRuntime } = require('./phases/omp-runtime');
 const { writePlatformVersionMetadata } = require('./phases/write-metadata');
 const { checkVersions } = require('./lib/version-check');
 const { ensureGitignore } = require('./phases/root-config');
 const { runPostInstall } = require('./phases/post-install');
 const { setupSkillDeps } = require('./phases/skills-setup');
-const { setupRtk } = require('./phases/setup-rtk');
 const { printSummary } = require('./phases/summary');
 
 /** Install a single platform: payload + runtime + metadata, under one spinner. */
@@ -78,6 +78,10 @@ function installPlatform(ctx, platformKey) {
     installCodexRuntime(ctx, platformKey);
   }
 
+  if (platformKey === 'omp') {
+    installOmpRuntime(ctx, platformKey);
+  }
+
   writePlatformVersionMetadata(ctx, platformKey);
 
   const wrote = (ctx.results.copied - before.copied) + (ctx.results.updated - before.updated);
@@ -105,7 +109,6 @@ Options:
   -u, --upgrade, -f, --force   Alias of --force-overwrite
   --with-skills-deps   Install skill dependencies (Python venv + pip, npm,
                        Chromium/Playwright). Otherwise prompted interactively.
-  --with-rtk           Install the rtk token-saver (binary + Claude Code hook).
                        Otherwise prompted interactively.
   --with-document-skills     Install docs/DOCX/PDF/PPTX/XLSX/multimodal skills
   --without-document-skills  Skip or remove CafeKit-owned document skills
@@ -190,9 +193,6 @@ async function main() {
     ensureGitignore(ctx);
     await runPostInstall(ctx);
     await setupSkillDeps(ctx);
-    if (ctx.platforms.includes('claude')) {
-      await setupRtk(ctx);
-    }
 
     // Phase handlers may report recoverable-looking errors through counters
     // instead of throwing. Treat them as transactional failure so the snapshot

package/bin/lib/context.js

@@ -119,6 +119,35 @@ const PLATFORMS = {
       rules: true,
       commands: false
     }
+  },
+  omp: {
+    id: 'omp',
+    name: 'Oh My Pi',
+    description: 'Oh My Pi coding agent',
+    folder: '.omp',
+    detectFiles: ['.omp'],
+    commandsDir: null,
+    // omp discovers .claude/skills and .agents/skills itself, so CafeKit copies
+    // no skill payload for it. See specs/omp-runtime-support/plan.md.
+    skillsDir: '.agents/skills',
+    agentsDir: null,
+    skillsRef: '.agents/skills',
+    commandPrefix: '$',
+    sourceDir: 'claude',
+    sourceSubdir: null,
+    backupTargets: ['.omp', 'AGENTS.md'],
+    ownership: {
+      recordRoot: '.',
+      allowedRoots: ['.omp']
+    },
+    capabilities: {
+      skills: false,
+      agents: false,
+      references: true,
+      scripts: true,
+      rules: true,
+      commands: false
+    }
   }
   // Add new platforms here:
   // cursor: {
@@ -132,6 +161,25 @@ const PLATFORMS = {
   // }
 };
 
+/**
+ * Hosts that run another platform's install rather than one of their own.
+ *
+ * Grok CLI discovers `.claude/skills`, `.claude/rules`, `CLAUDE*.md` and the hooks in
+ * `.claude/settings.json` through its own Claude-compatibility layer, and the gate hooks
+ * normalize its envelope, so `--platform grok` provisions the Claude runtime. There is no
+ * `.grok/` payload and deliberately no detection marker: a repository that merely holds
+ * `.grok/` has not asked for a CafeKit install.
+ */
+const PLATFORM_ALIASES = Object.freeze({
+  grok: 'claude'
+});
+
+/** Resolve host aliases and drop duplicates, preserving the requested order. */
+function resolvePlatformAliases(keys = []) {
+  const resolved = keys.map((key) => PLATFORM_ALIASES[key] || key);
+  return { platforms: [...new Set(resolved)], aliased: keys.some((key) => Boolean(PLATFORM_ALIASES[key])) };
+}
+
 // ═══════════════════════════════════════════════════════════
 // DETECTION + PLATFORM HELPERS
 // ═══════════════════════════════════════════════════════════
@@ -207,7 +255,6 @@ function parseInstallerArgs(argv) {
     dryRun: false,
     yes: false,
     withSkillsDeps: false,
-    withRtk: false,
     withDocumentSkills: false,
     withoutDocumentSkills: false,
     platforms: []
@@ -224,8 +271,6 @@ function parseInstallerArgs(argv) {
       args.yes = true;
     } else if (arg === '--with-skills-deps') {
       args.withSkillsDeps = true;
-    } else if (arg === '--with-rtk') {
-      args.withRtk = true;
     } else if (arg === '--with-document-skills') {
       args.withDocumentSkills = true;
     } else if (arg === '--without-document-skills') {
@@ -321,6 +366,8 @@ module.exports = {
   INSTALL_COMMAND,
   DEPENDENCY_TEMPLATES,
   PLATFORMS,
+  PLATFORM_ALIASES,
+  resolvePlatformAliases,
   validateManifestV2,
   loadClaudeMigrationManifest,
   detectPlatforms,