@haposoft/cafekit 0.18.0 → 0.18.2

package/src/claude/agents/project-manager.md

@@ -1,6 +1,6 @@
 ---
 name: project-manager
-description: 'Ecosystem Orchestrator. Oversees the cf:specs lifecycle, aggregates outputs, and tracks implementation progress. Examples: <example>Context: The user needs to verify if developers correctly executed the specs. user: "I finished coding the new login flow. Can you aggregate the results and check progress?" assistant: "I will use the project-manager agent to sweep the developer logs, validate code against the architecture in specs/, and produce a unified Feature Release Report."</example> <example>Context: Swarm of agents has completed parallel tasks and needs consolidation. user: "The backend and frontend agents said they are done. What is the overall status?" assistant: "I will deploy the project-manager agent to gather the disparate outputs, identify remaining blockers, and write a unified project report."</example>'
+description: 'Ecosystem Orchestrator. Aggregates evidence for a process-first feature packet (plan.md, flat task files, receipts, worker and review reports) and reports scope drift, task and receipt status, blockers, and the pending GATE-DONE decision. Use when several tasks or agents have finished and the overall state needs reconciling; it does not write task Status or Receipts.'
 model: haiku
 tools: Glob, Grep, Read, Edit, Write, NotebookEdit, Bash, WebFetch, TaskCreate, TaskGet, TaskUpdate, TaskList, WebSearch, ListMcpResourcesTool, ReadMcpResourceTool, SendMessage
 ---
@@ -45,7 +45,7 @@ Before you declare any phase complete or issue a final status report, you must i
   decision; never end with a vague conclusion.
 
 ## Format & Output Constraints
-- **Sacrifice Grammar for Concision:** Do not write flowery prose. Your reports must be highly mechanical, bulleted, and brutally concise.
+- **Concision:** Keep reports scannable and limited to what the minimum report below requires.
 - **Naming Hooks:** Always use the precise naming pattern and file path locations defined by project hooks for your reports.
 - **Minimum report:** Include GATE-SCOPE scope drift, accepted GATE-REVIEW finding coverage,
   task/receipt status, executed command results, blockers, docs impact, and the

package/src/claude/agents/spec-maker.md

@@ -17,7 +17,7 @@ removes product decisions from implementation. The output is Markdown under
 - existing plans or decisions explicitly placed in scope;
 - the three human-gate decisions from `cf:specs`.
 
-Read `skills/specs/SKILL.md` and `skills/specs/references/templates.md` before
+Read `.claude/skills/specs/SKILL.md` and `.claude/skills/specs/references/templates.md` before
 routing; they are the canonical risk and coverage authority. Do not duplicate
 their taxonomy here. Apply their risk-first route before GATE-SCOPE and stop when the
 request qualifies for direct work; hand off when it requires Brainstorm-only exploration.
@@ -58,7 +58,7 @@ task `Status: blocked` while GATE-REVIEW is open, and keep its `## Receipt` empt
 
 ### 4. Review from fresh context
 
-Read `skills/specs/references/review.md`. Route fresh reviewers by capability
+Read `.claude/skills/specs/references/review.md`. Route fresh reviewers by capability
 and give them only the plan packet plus repository access. Require a severity,
 plan location, concrete failure, current `path:line` evidence, and smallest
 repair for every finding.
@@ -91,14 +91,14 @@ chooses when execution begins.
 - Ownership overlap or dependency uncertainty prevents a parallel claim.
 - A command that cannot be run from the named work context is not verification.
 - User approval and test proof are different facts; never infer either.
-- Existing legacy specs remain untouched unless migration is explicitly asked.
+- Leave an existing packet directory without `plan.md` untouched unless migration is explicitly asked.
 
 ## Output
 
 End with:
 
 ```text
-Status: DONE | DONE_WITH_CONCERNS | BLOCKED | NEEDS_CONTEXT
+Status: DONE | CONCERNS | BLOCKED | NEEDS_INFO
 Files: <plan and task paths>
 GATE-SCOPE: <decision>
 GATE-REVIEW: <accepted/rejected/revised counts>

package/src/claude/agents/test-runner.md

@@ -16,11 +16,12 @@ separate concise redacted report. Do not invent proof from remembered output.
 When the target is a feature or task, classify current bytes before execution:
 
 - A valid process-first packet has a regular `plan.md` with
-  `Specs-Contract: process-first-ready-v1`, regular flat `task-NN-*.md` files,
-  and no legacy marker. Read the exact current Verification Plan.
-- A valid legacy packet keeps its isolated adapter and separate receipt rules.
-- Mixed, orphaned, malformed, symlinked, nonregular, or identity-conflicting
-  packet markers return `BLOCKED`; never migrate or repair them.
+  `Specs-Contract: process-first-ready-v1` and regular flat `task-NN-*.md`
+  files. Read the exact current Verification Plan.
+- A packet directory with no `plan.md` that holds the old JSON planning state is no
+  longer read; return `BLOCKED` and name it.
+- Orphaned, malformed, symlinked, nonregular, or identity-conflicting packet
+  markers return `BLOCKED`; never migrate or repair them.
 - With no packet marker, use ordinary repository-aware test selection.
 
 For process-first work, the task's exact Command, exact unique Named probes,
@@ -125,9 +126,5 @@ proof and does not rerun it.
 Do not paste the full payload, secrets, verbose logs, or screenshots into this
 report. `PASS_WITH_WARNINGS` remains unfinished.
 
-## Legacy workflow compatibility
-
-After a valid legacy route, resolve its current spec/task contract and emit the
-existing legacy evidence through its separate-receipt adapter. Normalize legacy
-diagnostics to the canonical four verdicts. Never search for or write a separate
-receipt for process-first work, and never copy legacy proof into a flat task.
+Proof for process-first work lives only in the task's inline `## Receipt`; never
+search for or write a receipt file beside it.

package/src/claude/agents/ui-ux-designer.md

@@ -30,7 +30,6 @@ You are an award-caliber UI/UX designer. You merge aesthetic excellence with eng
   .claude/skills/.venv/bin/python3 .claude/skills/ui-ux-pro-max/scripts/search.py "<mood>" --domain typography
   .claude/skills/.venv/bin/python3 .claude/skills/ui-ux-pro-max/scripts/search.py "<industry>" --domain color
   ```
-- Study current design trends sourced from Dribbble, Awwwards, Mobbin via the python extractor outputs.
 - Review existing `docs/design-guidelines.md` if it exists.
 - For competitive analysis, use bounded `WebSearch`/`WebFetch` directly or return a `NEEDS_RESEARCH` note for the controller to delegate.
 

package/src/claude/gitignore

@@ -6,6 +6,8 @@
 .env
 .env.*
 !.env.example
+!.env.sample
+!.env.template
 
 # Skill dependency installs (Python venv + npm)
 skills/.venv/
@@ -25,3 +27,4 @@ agent-memory/
 settings.bak.json
 .mcp.json
 .cafekit-update-cache.json
+*.tmp

package/src/claude/hooks/__tests__/installed-root.test.js

@@ -0,0 +1,111 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const CLAUDE = path.resolve(__dirname, '../..');
+const MANIFEST = require('../../migration-manifest.json');
+const RUNTIME = { paths: { specs: 'work-specs', plans: 'work-plans', docs: 'work-docs' }, inspect: { enabled: false } };
+
+function fixture(run, withRuntime = true) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-installed-root-'));
+  const sessions = new Set();
+  try {
+    for (const relative of MANIFEST.runtime.files) {
+      const target = path.join(root, '.claude', relative);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(path.join(CLAUDE, relative), target);
+    }
+    for (const relative of MANIFEST.scripts.required) {
+      const target = path.join(root, '.claude/scripts', relative);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(path.join(CLAUDE, 'scripts', relative), target);
+    }
+    const runtimeFile = path.join(root, '.claude/runtime.json');
+    const writeRuntime = () => fs.writeFileSync(runtimeFile, JSON.stringify(RUNTIME));
+    if (withRuntime) writeRuntime();
+    else fs.unlinkSync(runtimeFile);
+    const cwd = path.join(root, 'sub/dir');
+    fs.mkdirSync(cwd, { recursive: true });
+    const env = { ...process.env };
+    delete env.CLAUDE_PROJECT_DIR;
+    delete env.PROJECT_ROOT;
+    const invoke = (name, payload) => {
+      if (payload.session_id) sessions.add(payload.session_id);
+      return spawnSync(process.execPath, [path.join(root, '.claude/hooks', `${name}.cjs`)], {
+        cwd, env, encoding: 'utf8', input: JSON.stringify({ cwd, ...payload }),
+      });
+    };
+    run({ root: fs.realpathSync(root), cwd, invoke, writeRuntime });
+  } finally {
+    for (const session of sessions) {
+      const key = crypto.createHash('sha256').update(session).digest('hex').slice(0, 16);
+      fs.rmSync(path.join(os.tmpdir(), `cafekit-rules-${key}.json`), { force: true });
+    }
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+test('installed rules read the project runtime from a nested session cwd', () => {
+  fixture(({ root, invoke }) => {
+    const result = invoke('rules', { hook_event_name: 'UserPromptSubmit', session_id: crypto.randomUUID() });
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /## Rules/);
+    assert.ok(result.stdout.includes(`${root}/work-specs/`));
+  });
+});
+
+test('rules wait for runtime before reserving the session injection', () => {
+  fixture(({ invoke, writeRuntime }) => {
+    const payload = { hook_event_name: 'UserPromptSubmit', session_id: crypto.randomUUID() };
+    const absent = invoke('rules', payload);
+    assert.equal(absent.status, 0, absent.stderr);
+    assert.equal(absent.stdout, '');
+    writeRuntime();
+    const present = invoke('rules', payload);
+    assert.equal(present.status, 0, present.stderr);
+    assert.match(present.stdout, /## Rules/);
+  }, false);
+});
+
+test('installed inspect respects a disabled project runtime from a nested cwd', () => {
+  fixture(({ invoke }) => {
+    const result = invoke('inspect-block', { hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: 'node_modules/pkg/index.js' } });
+    assert.equal(result.status, 0, result.stderr);
+  });
+});
+
+test('installed agent context uses project paths from a nested session cwd', () => {
+  fixture(({ root, invoke }) => {
+    const result = invoke('agent', { hook_event_name: 'SubagentStart', agent_id: 'nested-agent' });
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /additionalContext/);
+    const context = JSON.parse(result.stdout).hookSpecificOutput.additionalContext;
+    for (const relative of ['work-specs', 'work-plans', 'work-docs']) assert.ok(context.includes(`${root}/${relative}/`));
+  });
+});
+
+test('installed spec gate checks root packet receipts from a nested session cwd', () => {
+  fixture(({ root, invoke }) => {
+    for (const args of [['init', '-q'], ['config', 'user.email', 'cafekit@example.invalid'], ['config', 'user.name', 'CafeKit Test'], ['commit', '--allow-empty', '-qm', 'fixture']]) {
+      const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+      assert.equal(result.status, 0, result.stderr);
+    }
+    const packet = path.join(root, 'work-specs/demo');
+    fs.mkdirSync(packet, { recursive: true });
+    fs.writeFileSync(path.join(packet, 'plan.md'), '# Demo\nSpecs-Contract: process-first-ready-v1\n');
+    fs.writeFileSync(path.join(packet, 'task-01-work.md'), '# Work\n\nStatus: done\n\n## Dependencies\n\n- none\n\n## Verification Plan\n\n- Command: node --test\n');
+    const result = invoke('spec-gate', { hook_event_name: 'Stop', session_id: crypto.randomUUID() });
+    assert.equal(result.status, 0, result.stderr);
+    const block = JSON.parse(result.stdout);
+    assert.equal(block.decision, 'block');
+    assert.match(block.reason, /receipt/i);
+    assert.match(block.reason, /task-01-work\.md/);
+    assert.doesNotMatch(block.reason, /unavailable|controlled failure/i);
+  });
+});

package/src/claude/hooks/__tests__/precompact.test.js

@@ -11,11 +11,21 @@ const { spawnSync } = require('node:child_process');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const crypto = require('node:crypto');
 
 const PRECOMPACT = path.join(__dirname, '..', 'precompact.cjs');
 const SESSION = path.join(__dirname, '..', 'session.cjs');
 const { hookStateDir } = require(path.join(__dirname, '..', 'lib', 'hook-state-dir.cjs'));
-const RECOVERY = path.join(hookStateDir(), 'compact-recovery.json');
+const CAPTURES = new Set([path.join(hookStateDir(), 'compact-recovery.json')]);
+function recoveryPath(session = 'compact-session') {
+  const key = crypto.createHash('sha256').update(session).digest('hex');
+  const file = path.join(hookStateDir(), `compact-recovery-${key}.json`);
+  CAPTURES.add(file);
+  return file;
+}
+const HOOK_ENV = { ...process.env };
+delete HOOK_ENV.CLAUDE_PROJECT_DIR;
+delete HOOK_ENV.PROJECT_ROOT;
 
 function fixture() {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-precompact-'));
@@ -36,21 +46,24 @@ function fixture() {
 }
 
 function run(hook, dir, payload) {
+  if (typeof payload?.session_id === 'string' && payload.session_id.trim()) recoveryPath(payload.session_id);
   const result = spawnSync(process.execPath, [hook], {
     cwd: dir,
     input: JSON.stringify(payload),
     encoding: 'utf8',
-    env: { ...process.env, CLAUDE_PROJECT_DIR: dir },
+    env: HOOK_ENV,
   });
   return { code: result.status, stdout: result.stdout || '', stderr: result.stderr || '' };
 }
 
 function clearCapture() {
-  try { fs.unlinkSync(RECOVERY); } catch { /* absent */ }
+  for (const file of CAPTURES) {
+    try { fs.unlinkSync(file); } catch { /* absent */ }
+  }
 }
 
-function readCapture() {
-  return JSON.parse(fs.readFileSync(RECOVERY, 'utf8'));
+function readCapture(session) {
+  return JSON.parse(fs.readFileSync(recoveryPath(session), 'utf8'));
 }
 
 test('PreCompact records branch, HEAD, dirty count and the in-flight task', () => {
@@ -93,8 +106,8 @@ test('a compact restart prints the captured anchors alongside the authorization
   const dir = fixture();
   try {
     clearCapture();
-    assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', trigger: 'manual', cwd: dir }).code, 0);
-    const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', cwd: dir });
+    assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', trigger: 'manual', session_id: 'compact-session', cwd: dir }).code, 0);
+    const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', session_id: 'compact-session', cwd: dir });
     assert.strictEqual(restart.code, 0, restart.stderr);
     assert.match(restart.stdout, /VERIFY PENDING AUTHORIZATIONS/, 'the existing warning must survive');
     assert.match(restart.stdout, /State before compaction/);
@@ -119,6 +132,53 @@ test('a compact restart without a capture still prints the warning and nothing i
   }
 });
 
+test('a compact restart in another session prints the warning without foreign anchors', () => {
+  const dir = fixture();
+  try {
+    clearCapture();
+    assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', session_id: 'session-a', cwd: dir }).code, 0);
+    const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', session_id: 'session-b', cwd: dir });
+    assert.strictEqual(restart.code, 0, restart.stderr);
+    assert.match(restart.stdout, /SESSION COMPRESSED/);
+    assert.doesNotMatch(restart.stdout, /State before compaction/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+    clearCapture();
+  }
+});
+
+test('a compact restart in the same session restores its captured anchors', () => {
+  const dir = fixture();
+  try {
+    clearCapture();
+    assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', session_id: 'session-a', cwd: dir }).code, 0);
+    const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', session_id: 'session-a', cwd: dir });
+    assert.strictEqual(restart.code, 0, restart.stderr);
+    assert.match(restart.stdout, /SESSION COMPRESSED/);
+    assert.match(restart.stdout, /State before compaction[\s\S]*branch work/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+    clearCapture();
+  }
+});
+
+for (const [captureId, restartId] of [[undefined, 'session-a'], ['session-a', undefined], [undefined, undefined]]) {
+  test(`a compact restart without ${captureId ? 'restart' : restartId ? 'capture' : 'either'} session identity keeps only the warning`, () => {
+    const dir = fixture();
+    try {
+      clearCapture();
+      assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', session_id: captureId, cwd: dir }).code, 0);
+      const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', session_id: restartId, cwd: dir });
+      assert.strictEqual(restart.code, 0, restart.stderr);
+      assert.match(restart.stdout, /SESSION COMPRESSED/);
+      assert.doesNotMatch(restart.stdout, /State before compaction/);
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+      clearCapture();
+    }
+  });
+}
+
 test('a normal session start prints no compaction anchors', () => {
   const dir = fixture();
   try {
@@ -138,7 +198,7 @@ test('PreCompact fails open outside a repository and on malformed input', () =>
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-precompact-bare-'));
   try {
     clearCapture();
-    const noGit = run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', cwd: dir });
+    const noGit = run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', session_id: 'compact-session', cwd: dir });
     assert.strictEqual(noGit.code, 0, 'a directory outside git must not fail the hook');
     const record = readCapture();
     assert.strictEqual(record.branch, null, 'unavailable git facts are recorded as null, never guessed');
@@ -147,12 +207,148 @@ test('PreCompact fails open outside a repository and on malformed input', () =>
 
     clearCapture();
     const malformed = spawnSync(process.execPath, [PRECOMPACT], {
-      cwd: dir, input: 'not json', encoding: 'utf8', env: { ...process.env, CLAUDE_PROJECT_DIR: dir },
+      cwd: dir, input: 'not json', encoding: 'utf8', env: HOOK_ENV,
     });
     assert.strictEqual(malformed.status, 0, 'malformed payload must fail open');
-    assert.strictEqual(fs.existsSync(RECOVERY), false, 'a malformed payload writes no capture');
+    assert.strictEqual(fs.existsSync(recoveryPath()), false, 'a malformed payload writes no capture');
   } finally {
     fs.rmSync(dir, { recursive: true, force: true });
     clearCapture();
   }
 });
+
+function installedFixture(callback) {
+  const root = fixture();
+  const source = path.resolve(__dirname, '../..');
+  const manifest = require('../../migration-manifest.json');
+  const sessions = new Set();
+  try {
+    for (const relative of manifest.runtime.files) {
+      const target = path.join(root, '.claude', relative);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(path.join(source, relative), target);
+    }
+    for (const relative of manifest.scripts.required) {
+      const target = path.join(root, '.claude/scripts', relative);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(path.join(source, 'scripts', relative), target);
+    }
+    const hooks = path.join(root, '.claude/hooks');
+    const invoke = (name, payload, overrides = {}) => {
+      if (typeof payload?.session_id === 'string' && payload.session_id.trim()) sessions.add(payload.session_id);
+      return spawnSync(process.execPath, [path.join(hooks, `${name}.cjs`)], {
+        cwd: root, env: HOOK_ENV, encoding: 'utf8', timeout: 10000,
+        input: typeof payload === 'string' ? payload : JSON.stringify(payload), ...overrides,
+      });
+    };
+    callback({ root: fs.realpathSync(root), hooks, invoke });
+  } finally {
+    for (const session of sessions) {
+      const key = crypto.createHash('sha256').update(session).digest('hex').slice(0, 16);
+      fs.rmSync(path.join(os.tmpdir(), `cafekit-rules-${key}.json`), { force: true });
+    }
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+test('two compacting sessions keep separate anchors and restore only their own branch', () => {
+  installedFixture(({ root, hooks, invoke }) => {
+    const sessions = [crypto.randomUUID(), crypto.randomUUID()];
+    const files = [];
+    for (const [index, session_id] of sessions.entries()) {
+      const branch = `anchor-${index === 0 ? 'first' : 'second'}`;
+      const checkout = spawnSync('git', ['-C', root, 'checkout', '-qb', branch], { encoding: 'utf8' });
+      assert.strictEqual(checkout.status, 0, checkout.stderr);
+      const capture = invoke('precompact', { hook_event_name: 'PreCompact', session_id, cwd: root });
+      assert.strictEqual(capture.status, 0, capture.stderr);
+      const hash = crypto.createHash('sha256').update(session_id).digest('hex');
+      files.push(path.join(hooks, '.logs', `compact-recovery-${hash}.json`));
+    }
+    for (const [index, file] of files.entries()) {
+      assert.ok(fs.existsSync(file), 'both session captures must survive');
+      const record = JSON.parse(fs.readFileSync(file, 'utf8'));
+      assert.strictEqual(record.session_id, sessions[index]);
+      assert.strictEqual(record.branch, `anchor-${index === 0 ? 'first' : 'second'}`);
+    }
+    for (const [index, session_id] of sessions.entries()) {
+      const compact = invoke('session', { hook_event_name: 'SessionStart', source: 'compact', session_id, cwd: root });
+      assert.strictEqual(compact.status, 0, compact.stderr);
+      assert.match(compact.stdout, /SESSION COMPRESSED/);
+      assert.match(compact.stdout, /State before compaction/);
+      assert.ok(compact.stdout.includes(`branch anchor-${index === 0 ? 'first' : 'second'}`));
+      assert.ok(!compact.stdout.includes(`branch anchor-${index === 0 ? 'second' : 'first'}`));
+    }
+  });
+});
+
+test('PreCompact without a usable session identity creates no anchor or state directory', () => {
+  installedFixture(({ root, hooks, invoke }) => {
+    for (const session_id of [undefined, null, '', 42, '   ']) {
+      const capture = invoke('precompact', { hook_event_name: 'PreCompact', session_id, cwd: root });
+      assert.strictEqual(capture.status, 0, capture.stderr);
+      assert.strictEqual(fs.existsSync(path.join(hooks, '.logs')), false);
+    }
+  });
+});
+
+test('compact reinjects rules only for its own session even without matching anchors', () => {
+  installedFixture(({ root, hooks, invoke }) => {
+    const session = crypto.randomUUID();
+    const other = crypto.randomUUID();
+    const prompt = id => invoke('rules', { hook_event_name: 'UserPromptSubmit', session_id: id, cwd: root });
+    for (const id of [session, other]) {
+      const first = prompt(id);
+      assert.strictEqual(first.status, 0, first.stderr);
+      assert.match(first.stdout, /## Rules/);
+      assert.strictEqual(prompt(id).stdout, '');
+    }
+    fs.mkdirSync(path.join(hooks, '.logs'), { recursive: true });
+    const otherHash = crypto.createHash('sha256').update(other).digest('hex');
+    fs.writeFileSync(path.join(hooks, '.logs', `compact-recovery-${otherHash}.json`), JSON.stringify({ session_id: other }));
+    const compact = invoke('session', { hook_event_name: 'SessionStart', source: 'compact', session_id: session, cwd: root });
+    assert.strictEqual(compact.status, 0, compact.stderr);
+    assert.match(compact.stdout, /SESSION COMPRESSED/);
+    assert.doesNotMatch(compact.stdout, /State before compaction/);
+    const again = prompt(session);
+    assert.strictEqual(again.status, 0, again.stderr);
+    assert.match(again.stdout, /## Rules/);
+    assert.strictEqual(prompt(other).stdout, '');
+  });
+});
+
+test('malformed session input fails open without a stack and logs its crash', () => {
+  installedFixture(({ hooks, invoke }) => {
+    const result = invoke('session', '{');
+    assert.strictEqual(result.status, 0);
+    assert.strictEqual(result.stderr, '');
+    const rows = fs.readFileSync(path.join(hooks, '.logs/hook-log.jsonl'), 'utf8').trim().split('\n').map(line => JSON.parse(line));
+    assert.strictEqual(rows.length, 1);
+    assert.strictEqual(rows[0].hook, 'session');
+    assert.strictEqual(rows[0].status, 'crash');
+  });
+});
+
+test('installed session explains a nested cwd but omits the root line without a cwd', () => {
+  installedFixture(({ root, invoke }) => {
+    const cwd = path.join(root, 'sub/dir');
+    fs.mkdirSync(cwd, { recursive: true });
+    const nested = invoke('session', { source: 'startup', cwd }, { cwd });
+    assert.strictEqual(nested.status, 0, nested.stderr);
+    assert.ok(nested.stdout.includes(`CafeKit project root: ${root} (session working directory: ${cwd}).`));
+    const missing = invoke('session', { source: 'startup' }, { cwd });
+    assert.strictEqual(missing.status, 0, missing.stderr);
+    assert.doesNotMatch(missing.stdout, /CafeKit project root:/);
+  });
+});
+
+test('PreCompact bounds slow git calls and finishes within ten seconds', { timeout: 15000 }, () => {
+  installedFixture(({ root, invoke }) => {
+    const bin = path.join(root, 'fake-bin');
+    fs.mkdirSync(bin);
+    fs.writeFileSync(path.join(bin, 'git'), '#!/bin/sh\nexec /bin/sleep 30\n', { mode: 0o755 });
+    const start = Date.now();
+    const result = invoke('precompact', { hook_event_name: 'PreCompact', session_id: crypto.randomUUID(), cwd: root }, { env: { ...HOOK_ENV, PATH: bin } });
+    assert.strictEqual(result.status, 0, 'slow git must not exhaust the hook timeout');
+    assert.ok(Date.now() - start < 10000);
+  });
+});

package/src/claude/hooks/__tests__/privacy-block.test.js

@@ -11,12 +11,16 @@ const os = require('node:os');
 const path = require('node:path');
 
 const HOOK = path.join(__dirname, '..', 'privacy-block.cjs');
+const HOOK_ENV = { ...process.env };
+delete HOOK_ENV.CLAUDE_PROJECT_DIR;
+delete HOOK_ENV.PROJECT_ROOT;
 
 /** Run the hook with a tool payload; return process output. */
 function runHook(payload, cwd) {
   const res = spawnSync(process.execPath, [HOOK], {
     input: JSON.stringify({ ...payload, cwd: cwd || payload.cwd }),
     encoding: 'utf8',
+    env: HOOK_ENV,
   });
   return { code: res.status, stdout: res.stdout || '', stderr: res.stderr || '' };
 }
@@ -30,6 +34,29 @@ function permissionDecision(stdout) {
   return JSON.parse(stdout).hookSpecificOutput?.permissionDecision || null;
 }
 
+test('sensitive reads list sorted distinct basenames and the remaining count', () => {
+  const dir = tmpDir();
+  try {
+    const command = 'cat token.json nested/.env secrets.json credentials.json .env';
+    const { code, stdout } = runHook({ tool_name: 'Bash', tool_input: { command } }, dir);
+    assert.strictEqual(code, 0);
+    const output = JSON.parse(stdout).hookSpecificOutput;
+    assert.strictEqual(output.permissionDecision, 'ask');
+    assert.strictEqual(output.permissionDecisionReason,
+      'Sensitive file access requires approval: .env, credentials.json, secrets.json (+1 more)');
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('empty stdin asks because sensitive access cannot be evaluated safely', () => {
+  const result = spawnSync(process.execPath, [HOOK], { input: '', encoding: 'utf8', env: HOOK_ENV });
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  assert.deepStrictEqual(JSON.parse(result.stdout).hookSpecificOutput, {
+    hookEventName: 'PreToolUse', permissionDecision: 'ask',
+    permissionDecisionReason: 'Sensitive access could not be evaluated safely.',
+  });
+});
+
 test('asks natively for a direct Read of .env', () => {
   const dir = tmpDir();
   try {

package/src/claude/hooks/__tests__/session-writeenv.test.js

@@ -17,6 +17,31 @@ const path = require('node:path');
 
 const HOOK = path.join(__dirname, '..', 'session.cjs');
 
+test('session.cjs does not export GIT_URL or remote userinfo', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-session-remote-'));
+  const envFile = path.join(dir, 'env.sh');
+  try {
+    git(['init', '-q'], dir);
+    const userinfo = 'fixture-user:fixture-placeholder';
+    const remote = `https://${userinfo}@example.invalid/r.git`;
+    const configured = spawnSync('git', ['remote', 'add', 'origin', remote], { cwd: dir, encoding: 'utf8' });
+    assert.strictEqual(configured.status, 0, 'fake remote setup must succeed');
+    const result = spawnSync(process.execPath, [HOOK], {
+      cwd: dir, input: JSON.stringify({ source: 'startup', cwd: dir }), encoding: 'utf8',
+      env: { ...process.env, CLAUDE_ENV_FILE: envFile },
+    });
+    assert.strictEqual(result.status, 0, 'session hook must exit successfully');
+    assert.ok(fs.existsSync(envFile), 'session env file must exist');
+    const content = fs.readFileSync(envFile, 'utf8');
+    assert.deepStrictEqual({
+      exportsGitUrl: /^\s*(?:export\s+)?GIT_URL=/m.test(content),
+      containsUserInfo: content.includes(userinfo),
+    }, { exportsGitUrl: false, containsUserInfo: false });
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 function git(args, cwd) {
   const res = spawnSync('git', args, { cwd, encoding: 'utf8' });
   if (res.status !== 0) {