@haposoft/cafekit 0.18.0 → 0.18.2

package/src/claude/hooks/session.cjs

@@ -11,11 +11,24 @@
  * Exit: 0 always (fail-open)
  */
 
+function logCrash(error) {
+  try {
+    const fs = require('fs'), path = require('path');
+    const dir = require('./lib/hook-state-dir.cjs').hookStateDir();
+    fs.mkdirSync(dir, { recursive: true });
+    fs.appendFileSync(path.join(dir, 'hook-log.jsonl'),
+      JSON.stringify({ ts: new Date().toISOString(), hook: 'session', status: 'crash', error: error.message }) + '\n');
+  } catch (_) {}
+}
+
 try {
   const fs   = require('fs');
   const path = require('path');
   const { runtimeDirName, runtimeDir, runtimePath } = require('./lib/runtime-dir.cjs');
   const os   = require('os');
+  const { projectRoot } = require('./lib/project-root.cjs');
+  const { checkCafeKitUpdate } = require('./lib/update-check.cjs');
+  const { clearSessionReservation } = require('./lib/rules-reservation.cjs');
   const { execSync } = require('child_process');
 
   // ── Utilities ─────────────────────────────────────────────────────────────
@@ -41,21 +54,6 @@ try {
     } catch { /* fail-open */ }
   }
 
-  function projectRoot() {
-    const configured = typeof process.env.CLAUDE_PROJECT_DIR === 'string'
-      ? process.env.CLAUDE_PROJECT_DIR.trim()
-      : '';
-    if (configured) {
-      try { return fs.realpathSync(path.resolve(configured)); } catch { /* continue */ }
-    }
-
-    const installedRoot = path.resolve(__dirname, '..', '..');
-    const installedHook = runtimePath(installedRoot, 'hooks', path.basename(__filename));
-    if (fs.existsSync(installedHook)) return installedRoot;
-
-    try { return fs.realpathSync(process.cwd()); } catch { return path.resolve(process.cwd()); }
-  }
-
   /** Read <runtime>/runtime.json config */
   function readRuntime(cwd) {
     try {
@@ -104,94 +102,6 @@ try {
     return '';
   }
 
-  // ── CafeKit Update Check ──────────────────────────────────────────────────
-
-  /**
-   * Fetch the latest published version of @haposoft/cafekit from the npm registry.
-   * Returns a string (e.g. "0.11.2") or null on any failure. Timeout: 3 s.
-   */
-  function fetchLatestVersion() {
-    try {
-      const https = require('https');
-      return new Promise((resolve) => {
-        const req = https.get(
-          'https://registry.npmjs.org/@haposoft/cafekit/latest',
-          { timeout: 3000, headers: { Accept: 'application/json' } },
-          (res) => {
-            let body = '';
-            res.on('data', (chunk) => { body += chunk; });
-            res.on('end', () => {
-              try { resolve(JSON.parse(body).version || null); }
-              catch { resolve(null); }
-            });
-          }
-        );
-        req.on('error', () => resolve(null));
-        req.on('timeout', () => { req.destroy(); resolve(null); });
-      });
-    } catch { return Promise.resolve(null); }
-  }
-
-  /** Simple semver compare: returns true when b > a. */
-  function isNewer(a, b) {
-    const n = (v) => String(v).split('.').map((x) => parseInt(x, 10) || 0);
-    const [aN, bN] = [n(a), n(b)];
-    for (let i = 0; i < 3; i++) {
-      if (bN[i] > aN[i]) return true;
-      if (bN[i] < aN[i]) return false;
-    }
-    return false;
-  }
-
-  /**
-   * Read the installed CafeKit version from <runtime>/cafekit.json.
-   * Returns null if not found.
-   */
-  function getInstalledVersion(cwd) {
-    try {
-      const p = runtimePath(cwd, 'cafekit.json');
-      if (!fs.existsSync(p)) return null;
-      const meta = JSON.parse(fs.readFileSync(p, 'utf8'));
-      return typeof meta.version === 'string' ? meta.version : null;
-    } catch { return null; }
-  }
-
-  /**
-   * Check for a newer CafeKit version and return an update notice string,
-   * or an empty string if already up to date or check fails.
-   * Result is cached in <runtime>/.cafekit-update-cache.json for 12 hours.
-   */
-  async function checkCafeKitUpdate(cwd) {
-    const installed = getInstalledVersion(cwd);
-    if (!installed) return '';
-
-    const CACHE_TTL = 12 * 60 * 60 * 1000; // 12 hours
-    const cachePath = runtimePath(cwd, '.cafekit-update-cache.json');
-
-    // Return cached result if still fresh.
-    try {
-      if (fs.existsSync(cachePath)) {
-        const cache = JSON.parse(fs.readFileSync(cachePath, 'utf8'));
-        if (Date.now() - (cache.ts || 0) < CACHE_TTL) {
-          return cache.notice || '';
-        }
-      }
-    } catch { /* stale or corrupt — refetch */ }
-
-    // Fetch from npm registry.
-    const latest = await fetchLatestVersion();
-    const notice = (latest && isNewer(installed, latest))
-      ? `\n⚡ CafeKit update available: ${installed} → ${latest}\n   Run: npx @haposoft/cafekit\n`
-      : '';
-
-    // Persist cache (fail-open if write fails).
-    try {
-      fs.writeFileSync(cachePath, JSON.stringify({ ts: Date.now(), notice }), 'utf8');
-    } catch { /* fail-open */ }
-
-    return notice;
-  }
-
   // ── Main ──────────────────────────────────────────────────────────────────
 
   (async () => {
@@ -199,12 +109,13 @@ try {
   const { normalizeHookPayload } = require('./lib/hook-payload.cjs');
   const payload = stdin ? normalizeHookPayload(JSON.parse(stdin)) : {};
   const source  = payload.source || 'unknown';
+  if (source === 'compact') clearSessionReservation(payload.session_id);
   const envFile = process.env.CLAUDE_ENV_FILE;
-  const cwd     = projectRoot();
+  const cwd     = projectRoot(payload);
   const runtime = readRuntime(cwd);
 
   // Check CafeKit update in parallel with project detection (async, fail-open).
-  const updateCheckPromise = checkCafeKitUpdate(cwd);
+  const updateCheckPromise = checkCafeKitUpdate(runtimeDir(cwd)).catch(() => '');
 
   // Project detection
   const projectType = runtime.project?.type !== 'auto'
@@ -221,7 +132,6 @@ try {
 
   // Static environment
   const gitBranch  = run('git branch --show-current', '', cwd);
-  const gitUrl     = run('git remote get-url origin', '', cwd);
   const gitRoot    = run('git rev-parse --show-toplevel', '', cwd);
   const nodeVer    = process.version;
   const pythonVer  = run('python3 --version', '', cwd) || run('python --version', '', cwd);
@@ -235,7 +145,6 @@ try {
     writeEnv(envFile, 'PACKAGE_MANAGER', packageManager);
     writeEnv(envFile, 'FRAMEWORK',       framework);
     writeEnv(envFile, 'GIT_BRANCH',      gitBranch);
-    writeEnv(envFile, 'GIT_URL',         gitUrl);
     writeEnv(envFile, 'GIT_ROOT',        gitRoot);
     writeEnv(envFile, 'NODE_VERSION',    nodeVer);
     writeEnv(envFile, 'PYTHON_VERSION',  pythonVer);
@@ -262,6 +171,14 @@ try {
 
   console.log(`Session ${source}. ${parts.length ? parts.join(' | ') : 'No project info detected.'}${updateNotice}`);
 
+  if (typeof payload.cwd === 'string' && payload.cwd) {
+    let sessionCwd = path.resolve(payload.cwd);
+    try { sessionCwd = fs.realpathSync(sessionCwd); } catch { /* lexical fallback */ }
+    if (sessionCwd !== cwd) {
+      console.log(`CafeKit project root: ${cwd} (session working directory: ${sessionCwd}).`);
+    }
+  }
+
   // Compact warning — context compaction can lose pending approval state
   if (source === 'compact') {
     console.log('\n🚨 SESSION COMPRESSED — VERIFY PENDING AUTHORIZATIONS:');
@@ -274,8 +191,11 @@ try {
     // bearings, and nothing more.
     try {
       const fs2 = require('fs'), p2 = require('path');
-      const file = p2.join(require('./lib/hook-state-dir.cjs').hookStateDir(), 'compact-recovery.json');
+      if (typeof payload.session_id !== 'string' || !payload.session_id.trim()) process.exit(0);
+      const key = require('crypto').createHash('sha256').update(payload.session_id).digest('hex');
+      const file = p2.join(require('./lib/hook-state-dir.cjs').hookStateDir(), `compact-recovery-${key}.json`);
       const record = JSON.parse(fs2.readFileSync(file, 'utf8'));
+      if (record.session_id !== payload.session_id) process.exit(0);
       const parts = [];
       if (record.branch) parts.push(`branch ${record.branch}`);
       if (record.head) parts.push(`HEAD ${record.head}`);
@@ -297,15 +217,12 @@ try {
   }
 
   process.exit(0);
-  })(); // end async IIFE
+  })().catch((error) => {
+    logCrash(error);
+    process.exit(0);
+  });
 
-} catch (e) {
-  try {
-    const fs = require('fs'), p = require('path');
-    const d = require('./lib/hook-state-dir.cjs').hookStateDir();
-    if (!fs.existsSync(d)) fs.mkdirSync(d, { recursive: true });
-    fs.appendFileSync(p.join(d, 'hook-log.jsonl'),
-      JSON.stringify({ ts: new Date().toISOString(), hook: 'session', status: 'crash', error: e.message }) + '\n');
-  } catch (_) {}
+} catch (error) {
+  logCrash(error);
   process.exit(0);
 }

package/src/claude/hooks/spec-gate.cjs

@@ -16,32 +16,7 @@
 const fs = require('fs');
 const path = require('path');
 const { runtimeDirName, runtimeDir, runtimePath } = require('./lib/runtime-dir.cjs');
-
-function projectRoot(payload = {}) {
-  const configured = typeof process.env.CLAUDE_PROJECT_DIR === 'string'
-    ? process.env.CLAUDE_PROJECT_DIR.trim()
-    : '';
-  if (configured) {
-    try { return fs.realpathSync(path.resolve(configured)); } catch { /* continue */ }
-  }
-
-  const installedRoot = path.resolve(__dirname, '..', '..');
-  const installedHook = runtimePath(installedRoot, 'hooks', path.basename(__filename));
-  if (fs.existsSync(installedHook)) return installedRoot;
-
-  const sourceFixture = typeof process.env.PROJECT_ROOT === 'string'
-    ? process.env.PROJECT_ROOT.trim()
-    : '';
-  if (sourceFixture) {
-    try { return fs.realpathSync(path.resolve(sourceFixture)); } catch { /* continue */ }
-  }
-
-  const legacy = typeof payload.cwd === 'string' ? payload.cwd.trim() : '';
-  if (legacy) {
-    try { return fs.realpathSync(path.resolve(legacy)); } catch { /* continue */ }
-  }
-  try { return fs.realpathSync(process.cwd()); } catch { return path.resolve(process.cwd()); }
-}
+const { projectRoot } = require('./lib/project-root.cjs');
 
 function logCrash(error) {
   try {
@@ -68,6 +43,7 @@ function sessionIdentity(payload) {
   return candidates.find((value) => typeof value === 'string' && value.trim() !== '') || null;
 }
 
+let hasDoneTasks = false;
 try {
   const policyPath = path.join(__dirname, '..', 'scripts', 'workflow-policy.cjs');
 
@@ -97,8 +73,7 @@ try {
     RESOLVER = require(path.join(__dirname, '..', 'scripts', 'spec-resolver.cjs'));
     RECEIPT = require(path.join(__dirname, '..', 'scripts', 'spec-receipt.cjs'));
     if (typeof POLICY.validateCanonicalReceipt !== 'function'
-      || typeof POLICY.completionDecisionForSpec !== 'function'
-      || typeof RECEIPT.checkTaskReceipt !== 'function'
+      || typeof RECEIPT.checkWorkflowTaskReceipt !== 'function'
       || typeof RECEIPT.checkWorkflowReceiptSet !== 'function'
       || typeof RESOLVER.resolveWorkflowCandidate !== 'function') {
       throw new Error('shared workflow policy lacks completion authority functions');
@@ -133,6 +108,8 @@ try {
   }
   if (!resolved) process.exit(0);
   if (resolved.layoutKind === 'process-v3-completed-set') {
+    hasDoneTasks = resolved.candidates.some(candidate =>
+      Object.values(candidate.taskRegistry || {}).some(task => task?.status === 'done'));
     const configuredGate = runtime.spec?.completion_gate;
     if (configuredGate !== undefined && configuredGate !== true) {
       emitBlock('Completion gate: runtime.spec.completion_gate is a worker-writable flag, not an authorization; no completion-gate bypass is supported. Remove the flag and satisfy the gate.');
@@ -164,7 +141,7 @@ try {
   if (resolved.error === 'invalid_specs') {
     process.stdout.write(JSON.stringify({
       decision: 'block',
-      reason: `Completion gate: invalid spec JSON detected (${resolved.candidates.join(', ')}): ${resolved.reason}. Fix or remove malformed spec.json before completing tasks.`
+      reason: `Completion gate: invalid workflow packet detected (${resolved.candidates.join(', ')}): ${resolved.reason}. Fix the packet's plan.md or task files before completing tasks.`,
     }) + '\n');
     process.exit(0);
   }
@@ -177,22 +154,13 @@ try {
   }
   if (resolved.error) process.exit(0);
 
-  const activeSpec = resolved.spec || {};
-  const processWorkflow = resolved.layoutKind === 'process-v3';
   const featureName = resolved.featureName;
   const specsPath = resolved.specsDir;
-  const lifecyclePhase = activeSpec.current_phase || activeSpec.phase;
-  const explicitCloseout = ['done', 'completed', 'complete'].includes(activeSpec.status)
-    || ['closeout', 'completion', 'completed', 'complete'].includes(lifecyclePhase);
-  // Legacy 2.1 closeout is retired; a 2.1 packet mid-execution keeps the ordinary receipt checks.
-  if (!processWorkflow && activeSpec.schema_version === '2.1' && explicitCloseout) {
-    emitBlock('Completion gate: Legacy spec.json closeout is no longer supported; move the packet to plan.md with flat task files');
-    process.exit(0);
-  }
+  hasDoneTasks = Object.values(resolved.taskRegistry || {}).some(task => task?.status === 'done');
   const runtimeContext = POLICY.deriveRuntimeContext({
     projectRoot: baseDir,
     specsRoot: specsPath,
-    specFile: resolved.stateFile || resolved.specFile || path.join(specsPath, featureName, 'spec.json'),
+    specFile: resolved.stateFile,
     featureName,
     runtimeSession: sessionIdentity(payload),
   });
@@ -202,7 +170,7 @@ try {
     emitBlock('Completion gate: runtime.spec.completion_gate is a worker-writable flag, not an authorization; no completion-gate bypass is supported. Remove the flag and satisfy the gate.');
     process.exit(0);
   }
-  const taskRegistry = resolved.taskRegistry || activeSpec.task_registry || {};
+  const taskRegistry = resolved.taskRegistry || {};
   const cacheFile = path.join(require('./lib/hook-state-dir.cjs').hookStateDir(), 'spec-gate-last.json');
   const cacheExists = fs.existsSync(cacheFile);
   let cache = {};
@@ -215,17 +183,6 @@ try {
     currentStatuses[tp] = task?.status || 'pending';
   }
 
-  const staleFlashTasks = processWorkflow ? [] : Object.entries(taskRegistry)
-    .filter(([, task]) => POLICY.isStaleFlashDone(task))
-    .map(([taskPath]) => taskPath);
-  if (staleFlashTasks.length > 0) {
-    process.stdout.write(JSON.stringify({
-      decision: 'block',
-      reason: `Completion gate: ${staleFlashTasks.length} task(s) marked done with FLASH_UNVERIFIED (${staleFlashTasks.join(', ')}). Run /cf:test for exact proof, then use explicit sync-finalize.`
-    }) + '\n');
-    process.exit(0);
-  }
-
   // Cache hardening: every Stop re-reads and re-checks the receipt of every
   // task currently marked done, so a cached PASS cannot hide later mutations
   // (deletion, placeholder, changed Verification/Command/Exit, missing
@@ -241,29 +198,11 @@ try {
   const featureDir = path.join(specsPath, featureName);
   const failures = allDoneTasks
     .map((taskPath) => {
-      const proof = processWorkflow
-        ? RECEIPT.checkWorkflowTaskReceipt(featureDir, taskPath, runtimeContext, POLICY)
-        : RECEIPT.checkTaskReceipt(featureDir, taskPath, taskRegistry[taskPath], runtimeContext, POLICY);
+      const proof = RECEIPT.checkWorkflowTaskReceipt(featureDir, taskPath, runtimeContext, POLICY);
       return { taskPath, fails: proof.failures, body: proof.body };
     })
     .filter((f) => f.fails.length > 0);
 
-  const featureCloseoutRequired = !processWorkflow && explicitCloseout && allDoneTasks.length > 0;
-  const featureReceipt = featureCloseoutRequired
-    ? RECEIPT.checkFeatureReceipt(featureDir, runtimeContext, POLICY)
-    : null;
-  if (featureReceipt && featureReceipt.failures.length) {
-    failures.push({ taskPath: 'feature-receipt.md', fails: featureReceipt.failures });
-  }
-  const completion = featureCloseoutRequired && featureReceipt?.failures.length === 0
-    && Object.prototype.hasOwnProperty.call(activeSpec, 'workflow_policy')
-    ? POLICY.completionDecisionForSpec(activeSpec, {
-      runtimeContext,
-      executionReceipt: featureReceipt.body,
-      taskContext: {},
-    })
-    : null;
-
   // Always persist status transitions, including done → pending. Keep
   // failing done tasks at their previous cached status so a stale valid
   // entry cannot mask a mutated receipt on the next Stop; with
@@ -279,32 +218,21 @@ try {
     fs.writeFileSync(cacheFile, JSON.stringify(cache));
   } catch { /* fail-open */ }
 
-  const completionBlocked = completion && completion.completion !== 'complete' && completion.completion !== 'not_applicable';
-  if (failures.length === 0 && !completionBlocked) process.exit(0);
+  if (failures.length === 0) process.exit(0);
 
-  const lines = [
-    failures.length > 0
-      ? `⚠️ Completion gate: ${failures.length} done task(s) lack a verification receipt.`
-      : '⚠️ Completion gate: workflow completion proof is incomplete.',
-  ];
+  const lines = [`⚠️ Completion gate: ${failures.length} done task(s) lack a verification receipt.`];
   for (const { taskPath, fails, body } of failures) {
     lines.push(`- \`${taskPath}\`: failed check(s) ${fails.join(', ')}`);
-    lines.push(taskPath === 'feature-receipt.md'
-      ? `  Fix: run final integration proof, then write \`specs/${featureName}/feature-receipt.md\`.`
-      : processWorkflow
-        ? `  Fix in \`specs/${featureName}/${path.posix.basename(taskPath)}\`: ${(typeof RECEIPT.receiptFixHint === 'function' && RECEIPT.receiptFixHint(fails, body)) || 'write a runtime-bound `## Receipt` with command output'}.`
-        : `  Fix: write canonical proof to \`specs/${featureName}/receipts/${path.posix.basename(taskPath)}\`; legacy \`## Evidence\` remains read-compatible.`);
-  }
-  if (completionBlocked) {
-    lines.push(`- Completion decision unfinished: ${completion.blocker || 'required workflow proof is missing.'}`);
-    if (Array.isArray(completion.missingProof) && completion.missingProof.length > 0) {
-      lines.push(`  Missing proof: ${completion.missingProof.join(', ')}`);
-    }
+    lines.push(`  Fix in \`specs/${featureName}/${path.posix.basename(taskPath)}\`: ${(typeof RECEIPT.receiptFixHint === 'function' && RECEIPT.receiptFixHint(fails, body)) || 'write a runtime-bound `## Receipt` with command output'}.`);
   }
   process.stdout.write(JSON.stringify({ decision: 'block', reason: lines.slice(0, 8).join('\n') }) + '\n');
   process.exit(0);
 
 } catch (e) {
+  if (e.code === 'no_git_history') {
+    if (hasDoneTasks) emitBlock('Completion gate: repo has no commits yet; create the first commit, then record Base/Head after it.');
+    process.exit(0);
+  }
   logCrash(e);
   emitBlock(`Completion gate controlled failure: ${e.message}. Completion is blocked until the hook is repaired.`);
   process.exit(0);