@haposoft/cafekit 0.16.2 → 0.16.3

package/README.md

@@ -2,7 +2,7 @@
 
 > Native spec-driven workflow and runtime bundle for Claude Code and Codex CLI.
 
-[![Version](https://img.shields.io/badge/version-0.16.2-blue.svg)](https://github.com/haposoft/cafekit)
+[![Version](https://img.shields.io/badge/version-0.16.3-blue.svg)](https://github.com/haposoft/cafekit)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![Claude%20Code](https://img.shields.io/badge/Claude%20Code-Native-orange.svg)](https://claude.ai/code)
 [![Codex%20CLI](https://img.shields.io/badge/Codex%20CLI-Native-111111.svg)](https://developers.openai.com/codex)
@@ -126,9 +126,12 @@ AGENTS.md
 CafeKit owns only its marked block in root `AGENTS.md`. Codex discovers skills
 and custom agents natively after the repository is trusted; no project
 `config.toml` is generated. Review and trust project hooks with `/hooks`.
-Installed hook commands are bound to the canonical project path on every platform,
-so they need no Git repository, stay correct for a project nested inside a larger
-repository, and remain stable when a session starts in a subdirectory.
+Installed Codex hook commands are bound to the canonical project path, so they need no
+Git repository, stay correct for a project nested inside a larger repository, and remain
+stable when a session starts in a subdirectory. They also carry a PATH floor pointing at
+the Node.js that installed them, so a host launched from the macOS GUI — whose children
+inherit only `/usr/bin:/bin:/usr/sbin:/sbin` — can still find the interpreter. The floor
+is appended, so a version manager's current Node still wins in a normal terminal.
 CafeKit uses Codex's native status and usage UI instead of installing the
 Claude statusline.
 

package/bin/__tests__/codex-native.test.js

@@ -2035,10 +2035,13 @@ test('Codex Windows hook launchers stay project-bound without Git from nested cw
   });
 });
 
-// Run an installed POSIX launcher with no PATH at all, so neither `git` nor a `node` on
-// PATH can rescue it. The launcher must already carry everything it needs.
-function runPosixLauncher(command, cwd) {
-  return spawnSync(command.replace(/^node /, `"${process.execPath}" `), {
+// Run an installed POSIX launcher verbatim under the environment a macOS GUI host hands
+// its children: no `git`, and no `node` on PATH. Nothing here rewrites the command, so a
+// launcher that cannot find its own interpreter fails the way it fails in the wild.
+const GUI_PATH = '/usr/bin:/bin:/usr/sbin:/sbin';
+
+function runPosixLauncher(command, cwd, pathValue = GUI_PATH) {
+  return spawnSync(command, {
     cwd,
     encoding: 'utf8',
     input: JSON.stringify({
@@ -2047,7 +2050,7 @@ function runPosixLauncher(command, cwd) {
       hook_event_name: 'SessionStart',
       source: 'startup'
     }),
-    env: { ...process.env, PATH: '' },
+    env: { PATH: pathValue, HOME: os.homedir() },
     shell: true
   });
 }
@@ -2076,13 +2079,13 @@ test('Codex POSIX hook launchers run without Git and outside the repository root
     for (const projectRoot of [plain, nested]) {
       const { config, command } = sessionLauncher(projectRoot);
       for (const { handler } of allHookLaunchers(config)) {
-        // `node '<single-quoted absolute path>'` and nothing else. Inside single quotes
-        // the shell expands nothing, so a project path may safely contain $, a backtick,
-        // or the word git — this fixture's own path contains it.
+        // A PATH floor, then `node`, then one single-quoted absolute path. Inside single
+        // quotes the shell expands nothing, so a project path may safely contain $, a
+        // backtick, or the word git — this fixture's own path contains it.
         assert.match(
           handler.command,
-          /^node '(?:[^']|'\\'')+'$/,
-          `launcher must be a plain quoted path: ${handler.command}`
+          /^PATH="\$PATH"(?::'(?:[^']|'\\'')+')+ node '(?:[^']|'\\'')+'$/,
+          `launcher must carry a PATH floor and a quoted path: ${handler.command}`
         );
         assert.doesNotMatch(handler.command, /rev-parse/, `launcher must not consult Git: ${handler.command}`);
         assert.ok(
@@ -2097,38 +2100,49 @@ test('Codex POSIX hook launchers run without Git and outside the repository root
   });
 });
 
-test('a reinstall repairs Codex launchers that resolved their path through Git', () => {
-  inTempProject((root) => {
-    assert.equal(install(root).status, 0);
-    const configPath = path.join(root, '.codex', 'hooks.json');
-
-    // Exactly what an installer before 0.16.2 wrote.
-    const downgraded = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-    for (const { handler } of allHookLaunchers(downgraded)) {
-      const script = path.basename(handler.command.replace(/'$/, ''));
-      handler.command = `node "$(git rev-parse --show-toplevel)/.codex/hooks/${script}"`;
-    }
-    const foreign = { type: 'command', command: 'node "$(git rev-parse --show-toplevel)/tools/mine.cjs"' };
-    downgraded.hooks.SessionStart[0].hooks.push(foreign);
-    fs.writeFileSync(configPath, `${JSON.stringify(downgraded, null, 2)}\n`);
-
-    const again = install(root);
-    assert.equal(again.status, 0, again.stderr);
-    assert.match(again.stdout, /repaired \d+ launcher/, 'the repair must be reported, not silent');
+// A reinstall treats an already-registered script as the user's placement, so a launcher
+// an older installer wrote would otherwise keep its broken command forever.
+for (const [label, legacyCommand] of [
+  ['resolved their path through Git', (script) => `node "$(git rev-parse --show-toplevel)/.codex/hooks/${script}"`],
+  ['looked for node on PATH', (script, root) => `node '${path.join(fs.realpathSync(root), '.codex', 'hooks', script)}'`],
+]) {
+  test(`a reinstall rebinds Codex launchers that ${label}`, () => {
+    inTempProject((root) => {
+      assert.equal(install(root).status, 0);
+      const configPath = path.join(root, '.codex', 'hooks.json');
+
+      const downgraded = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+      for (const { handler } of allHookLaunchers(downgraded)) {
+        handler.command = legacyCommand(path.basename(handler.command.replace(/'$/, '')), root);
+      }
+      // A hook the user wrote, in the same shape CafeKit used to emit, must never be
+      // rewritten: it points somewhere else entirely.
+      const foreign = { type: 'command', command: 'node "$(git rev-parse --show-toplevel)/tools/mine.cjs"' };
+      downgraded.hooks.SessionStart[0].hooks.push(foreign);
+      fs.writeFileSync(configPath, `${JSON.stringify(downgraded, null, 2)}\n`);
+
+      const again = install(root);
+      assert.equal(again.status, 0, again.stderr);
+      assert.match(again.stdout, /rebound \d+ launcher/, 'the rebind must be reported, not silent');
+
+      const { config, command } = sessionLauncher(root);
+      const commands = allHookLaunchers(config).map(({ handler }) => handler.command);
+      assert.ok(commands.includes(foreign.command), 'a foreign hook must survive untouched');
+      assert.equal(
+        commands.filter((entry) => !entry.startsWith('PATH=')).length,
+        1,
+        'every CafeKit launcher must be rebound, leaving only the foreign one'
+      );
+      const launched = runPosixLauncher(command, root);
+      assert.equal(launched.status, 0, launched.stderr);
+      assert.match(launched.stdout, /Session startup\./);
 
-    const { config, command } = sessionLauncher(root);
-    const commands = allHookLaunchers(config).map(({ handler }) => handler.command);
-    assert.equal(
-      commands.filter((entry) => /rev-parse/.test(entry)).length,
-      1,
-      'only the hook CafeKit did not author may keep its own command'
-    );
-    assert.ok(commands.includes(foreign.command), 'a foreign hook must survive untouched');
-    const launched = runPosixLauncher(command, root);
-    assert.equal(launched.status, 0, launched.stderr);
-    assert.match(launched.stdout, /Session startup\./);
+      // Running the installer again must change nothing.
+      const third = install(root);
+      assert.doesNotMatch(third.stdout, /rebound \d+ launcher/, 'rebinding must be idempotent');
+    });
   });
-});
+}
 
 test('Codex installed Specs and spec-maker reject adaptive coverage mutations', () => {
   inTempProject((root) => {

package/bin/phases/codex-hooks.js

@@ -17,8 +17,22 @@ const { PLATFORMS } = require('../lib/context');
 
 const CODEX_SRC = path.join(__dirname, '../../src/codex');
 const HOOK_COMMAND_TEMPLATE = /^node "\.codex\/hooks\/([a-z0-9-]+\.cjs)"$/;
-// What an installer before 0.16.2 wrote for POSIX. Kept only to recognize and repair it.
-const LEGACY_GIT_COMMAND = /^node "\$\(git rev-parse --show-toplevel\)\/\.codex\/hooks\/([a-z0-9-]+\.cjs)"$/;
+// Exact shapes earlier installers wrote, kept only to recognize and upgrade them. Before
+// 0.16.2 the path came from Git; 0.16.2 fixed the path but still resolved `node` through
+// PATH. Matching the whole command keeps a hook the user wrote from ever being rewritten.
+const LEGACY_POSIX_COMMANDS = [
+  /^node "\$\(git rev-parse --show-toplevel\)\/\.codex\/hooks\/([a-z0-9-]+\.cjs)"$/,
+  /^node '(?:[^']|'\\'')*[/\\]hooks[/\\]([a-z0-9-]+\.cjs)'$/,
+];
+
+function legacyPosixScript(command) {
+  if (typeof command !== 'string') return null;
+  for (const pattern of LEGACY_POSIX_COMMANDS) {
+    const match = command.match(pattern);
+    if (match) return match[1];
+  }
+  return null;
+}
 
 /** The hook script a command runs, which is stable across installs and platforms. */
 function hookScript(command) {
@@ -46,8 +60,26 @@ function hookPathFor(script, projectRoot) {
  * directly. The literal `/hooks/<script>.cjs` segment must survive, because hookScript()
  * reads it as the identity that lets a reinstall recognize CafeKit's own entries.
  */
+/**
+ * Directories to fall back on when PATH carries no `node`.
+ *
+ * `process.execPath` is realpath-resolved, so under Homebrew or a version manager it names
+ * a versioned directory that disappears on the next node upgrade. The stable aliases are
+ * listed after it, and a directory that does not exist costs nothing in PATH.
+ */
+function nodeFallbackDirectories() {
+  const candidates = [path.dirname(process.execPath), '/usr/local/bin', '/opt/homebrew/bin'];
+  return [...new Set(candidates.filter(Boolean))];
+}
+
 function posixHookCommand(script, projectRoot) {
-  return `node ${shellQuote(hookPathFor(script, projectRoot))}`;
+  // `node` is resolved through PATH, and a host launched from the macOS GUI hands its
+  // children the minimal `/usr/bin:/bin:/usr/sbin:/sbin`. Node installed by Homebrew, nvm,
+  // fnm, or Volta is not on that list, so the shell answered 127 and the hook never
+  // started. The fallbacks are appended, never prepended, so a version manager's current
+  // node still wins in a normal terminal and these act only as the floor.
+  const fallbacks = nodeFallbackDirectories().map((dir) => `:${shellQuote(dir)}`).join('');
+  return `PATH="$PATH"${fallbacks} node ${shellQuote(hookPathFor(script, projectRoot))}`;
 }
 
 /**
@@ -88,12 +120,12 @@ function repairLegacyCodexLaunchers(config, projectRoot) {
       return {
         ...group,
         hooks: group.hooks.map((handler) => {
-          const legacy = typeof handler?.command === 'string' && handler.command.match(LEGACY_GIT_COMMAND);
+          const legacy = legacyPosixScript(handler?.command);
           const template = typeof handler?.commandWindows === 'string'
             && handler.commandWindows.match(HOOK_COMMAND_TEMPLATE);
           if (!legacy && !template) return handler;
           const next = { ...handler };
-          if (legacy) next.command = posixHookCommand(legacy[1], projectRoot);
+          if (legacy) next.command = posixHookCommand(legacy, projectRoot);
           if (template) next.commandWindows = windowsHookCommand(template[1], projectRoot);
           repaired += 1;
           return next;
@@ -166,7 +198,7 @@ function mergeCodexHooks(ctx, platformKey, projectRoot = process.cwd()) {
 
   const { config: base, repaired } = repairLegacyCodexLaunchers(pruned, projectRoot);
   if (repaired > 0) {
-    ctx.ui.detail(`  ↻ ${ctx.dryRun ? '[dry-run] ' : ''}Codex hooks: repaired ${repaired} launcher(s) that resolved their path through Git`);
+    ctx.ui.detail(`  ↻ ${ctx.dryRun ? '[dry-run] ' : ''}Codex hooks: rebound ${repaired} launcher(s) written by an older installer`);
     ctx.results.updated++;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haposoft/cafekit",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "description": "Native spec-driven workflows for Claude Code and Codex CLI. Bundles CafeKit skills, runtime hooks, agents, and installer scaffolding.",
   "author": "Haposoft <nghialt@haposoft.com>",
   "license": "MIT",