@haposoft/cafekit 0.18.0 → 0.18.2

package/src/claude/hooks/spec-state.cjs

@@ -13,6 +13,8 @@
 
 const fs = require('fs');
 const path = require('path');
+const { projectRoot } = require('./lib/project-root.cjs');
+const { packetAt, namedPackets, explicitFailure } = require('./lib/spec-touch.cjs');
 const { runtimeDirName, runtimeDir, runtimePath } = require('./lib/runtime-dir.cjs');
 
 function logCrash(error) {
@@ -40,44 +42,6 @@ function sessionIdentity(payload) {
   return candidates.find((value) => typeof value === 'string' && value.length > 0) || null;
 }
 
-function canonicalPath(value) {
-  try { return fs.realpathSync(value); } catch { return null; }
-}
-
-/** Real path of `value`, resolving its deepest existing ancestor (the file may not exist yet). */
-function canonicalTarget(value) {
-  if (typeof value !== 'string' || !value) return null;
-  let current = path.resolve(value);
-  const rest = [];
-  while (!fs.existsSync(current)) {
-    const parent = path.dirname(current);
-    if (parent === current) return null;
-    rest.unshift(path.basename(current));
-    current = parent;
-  }
-  const real = canonicalPath(current);
-  return real ? path.join(real, ...rest) : null;
-}
-
-function escapeRegExp(text) {
-  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-/**
- * Packets the prompt names: `specs/<name>`, a `/cf:<command> <name>` token, or the bare
- * name when it carries `-`, `_` or a digit. A plain word such as `docs` must use `specs/`,
- * so an ordinary sentence does not touch a packet.
- */
-function packetsNamedIn(text, names) {
-  if (typeof text !== 'string' || !text) return [];
-  return names.filter((name) => {
-    const n = escapeRegExp(name);
-    if (new RegExp(`(^|[^\\w-])specs/${n}(?![\\w-])`).test(text)) return true;
-    if (new RegExp(`/cf:[\\w-]+\\s+(?:specs/)?${n}(?![\\w-])`).test(text)) return true;
-    return /[-_0-9]/.test(name) && new RegExp(`(^|[^\\w/-])${n}(?![\\w-])`).test(text);
-  });
-}
-
 try {
   // ── Main ──────────────────────────────────────────────────────────────────
 
@@ -94,19 +58,22 @@ try {
   let RECEIPT;
   try {
     POLICY = require(path.join(__dirname, '..', 'scripts', 'workflow-policy.cjs'));
+    require(path.join(__dirname, '..', 'scripts', 'provenance.cjs')).enableSnapshotMemo();
     RESOLVER = require(path.join(__dirname, '..', 'scripts', 'spec-resolver.cjs'));
     RECEIPT = require(path.join(__dirname, '..', 'scripts', 'spec-receipt.cjs'));
-    if (typeof POLICY.flashState !== 'function') throw new Error('shared workflow policy has no flashState function');
+    if (typeof RESOLVER.resolveWorkflowCandidate !== 'function') throw new Error('shared spec resolver has no resolveWorkflowCandidate function');
   } catch (error) {
     logCrash(error);
     emitControlledFailure(error.message);
     process.exit(0);
   }
 
+  const baseDir = projectRoot(payload);
+
   // Read runtime configuration if exists
   let runtime = {};
   try {
-    const p = runtimePath(cwd, 'runtime.json');
+    const p = runtimePath(baseDir, 'runtime.json');
     if (fs.existsSync(p)) runtime = JSON.parse(fs.readFileSync(p, 'utf8'));
   } catch { /* ignore */ }
 
@@ -114,20 +81,17 @@ try {
   // (The Stop completion gate has its own toggle: spec.completion_gate.)
   if (runtime.spec && runtime.spec.tollgate === false) process.exit(0);
 
-  // Same rule as spec-gate: an installed hook trusts its own location over the environment.
-  const installedRoot = path.basename(path.resolve(__dirname, '..')).startsWith('.') ? path.resolve(__dirname, '..', '..') : null;
-  const baseDir   = installedRoot || process.env.PROJECT_ROOT || cwd;
   const explicitFeature = payload.featureName || payload.feature || payload.explicitFeature || null;
-  const explicitPath = payload.specPath || payload.spec_path || payload.featurePath || null;
+  const explicitPath = payload.explicitPath || payload.specPath || payload.spec_path || payload.featurePath || null;
 
-  // ── Per-session touch set (Claude only) ───────────────────────────────────
-  // Several sessions can share one checkout. On Claude the tollgate speaks only about a
-  // packet this session touched. omp and Codex run their own copies, and grok sends
-  // `sessionId` before normalization, so all three keep the old behaviour.
+  // ── Per-session touch set (Claude and omp) ────────────────────────────────
+  // Several sessions can share one checkout. On Claude and omp the tollgate speaks only
+  // about a packet this session touched. Codex runs its own copy, and grok sends
+  // `sessionId` before normalization, so both keep the old behaviour.
   const claudeSession = rawPayload && typeof rawPayload.session_id === 'string' && rawPayload.session_id
     ? rawPayload.session_id
     : null;
-  const touchFilter = runtimeDirName() === '.claude' && claudeSession !== null;
+  const touchFilter = ['.claude', '.omp'].includes(runtimeDirName()) && claudeSession !== null;
   const touchFile = touchFilter
     ? path.join(
       require('./lib/hook-state-dir.cjs').hookStateDir(),
@@ -155,32 +119,73 @@ try {
 
   if (payload.hook_event_name === 'PostToolUse') {
     // Record only; no resolve, no git, no tollgate cache.
-    if (touchFilter && specsRoot && /^(Edit|Write|MultiEdit)$/.test(payload.tool_name || '')) {
-      const realRoot = canonicalPath(specsRoot);
-      const realTarget = canonicalTarget(payload.tool_input && payload.tool_input.file_path);
-      if (realRoot && realTarget) {
-        const rel = path.relative(realRoot, realTarget);
-        const parts = rel.split(path.sep);
-        if (rel && parts[0] !== '..' && !path.isAbsolute(rel) && parts.length > 1) addTouched([parts[0]]);
-      }
+    if (touchFilter && specsRoot && !explicitFailure(payload) && /^(Edit|Write|MultiEdit)$/.test(payload.tool_name || '')) {
+      const name = packetAt(payload.tool_input && payload.tool_input.file_path, specsRoot, cwd);
+      if (name) addTouched([name]);
     }
     process.exit(0);
   }
 
+  // A legacy packet (a specs/<x>/ directory without plan.md that the old flow left
+  // behind) is no longer read. Say so once per session instead of on every prompt.
+  const legacyPackets = typeof RESOLVER.findLegacyPackets === 'function'
+    ? RESOLVER.findLegacyPackets(baseDir, runtime)
+    : [];
+  if (legacyPackets.length > 0) {
+    const sessionKey = sessionIdentity(payload);
+    const noticeFile = sessionKey
+      ? path.join(
+        require('./lib/hook-state-dir.cjs').hookStateDir(),
+        `legacy-notice-${require('crypto').createHash('sha256').update(sessionKey).digest('hex')}.json`,
+      )
+      : null;
+    let noticed = [];
+    if (noticeFile) {
+      try { noticed = JSON.parse(fs.readFileSync(noticeFile, 'utf8')); } catch { noticed = []; }
+      if (!Array.isArray(noticed)) noticed = [];
+    }
+    const fresh = legacyPackets.filter((name) => !noticed.includes(name));
+    if (fresh.length > 0) {
+      for (const name of fresh) {
+        console.log(`\n> ⚠️ \`specs/${name}\` is a legacy Specs packet without plan.md; CafeKit no longer reads it. Move ongoing work to a process-first plan.md packet.`);
+      }
+      if (noticeFile) {
+        try {
+          fs.mkdirSync(path.dirname(noticeFile), { recursive: true });
+          fs.writeFileSync(noticeFile, JSON.stringify([...noticed, ...fresh].sort()));
+        } catch { /* an unwritable state dir only repeats the notice */ }
+      }
+    }
+  }
+
   if (touchFilter) {
     let packets = [];
     try {
       packets = fs.readdirSync(specsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
     } catch { /* no specs root */ }
-    const named = packetsNamedIn(payload.prompt, packets);
+    const named = specsRoot ? namedPackets(payload.prompt || payload.user_prompt, packets, specsRoot, baseDir) : [];
     if (typeof explicitFeature === 'string' && explicitFeature) named.push(explicitFeature);
+    const fromPath = specsRoot ? packetAt(explicitPath, specsRoot, baseDir) : null;
+    if (fromPath) named.push(fromPath);
     if (named.length) addTouched(named);
   }
 
-  const resolveWorkflow = typeof RESOLVER.resolveWorkflowCandidate === 'function'
-    ? RESOLVER.resolveWorkflowCandidate
-    : RESOLVER.resolveActiveSpec;
-  const resolved = resolveWorkflow({ projectRoot: baseDir, runtime, explicitFeature, explicitPath });
+  let resolved = RESOLVER.resolveWorkflowCandidate({ projectRoot: baseDir, runtime, explicitFeature, explicitPath });
+  if (touchFilter && !explicitFeature && !explicitPath
+    && ['multiple_active', 'invalid_specs'].includes(resolved?.error)) {
+    const touched = readTouched();
+    const candidates = resolved.candidates || [];
+    if (!candidates.includes('<specs>') && !candidates.some(name => touched.has(name))) {
+      const selected = [...touched].map(name => RESOLVER.resolveWorkflowCandidate({
+        projectRoot: baseDir, runtime, explicitFeature: name,
+      }));
+      resolved = selected.find(candidate => candidate?.error);
+      const active = selected.filter(candidate => candidate && !candidate.error && !candidate.allTasksDone);
+      if (!resolved) resolved = active.length > 1
+        ? { error: 'multiple_active', candidates: active.map(candidate => candidate.featureName) }
+        : active[0] || null;
+    }
+  }
 
   if (!resolved) {
     process.exit(0); // No active spec, do nothing
@@ -194,7 +199,7 @@ try {
 
   if (resolved.error === 'invalid_specs') {
     const cands = resolved.candidates.join(', ');
-    console.log(`\n> ⚠️ Invalid spec JSON detected: ${cands}. ${resolved.reason}. Fix or remove malformed spec.json before continuing. Tollgate paused.\n`);
+    console.log(`\n> ⚠️ Invalid workflow packet detected: ${cands}. ${resolved.reason}. Fix the packet's plan.md or task files before continuing. Tollgate paused.\n`);
     process.exit(0);
   }
 
@@ -208,22 +213,19 @@ try {
     process.exit(0);
   }
 
-  const activeSpec = resolved.spec || {};
-  const processWorkflow = resolved.layoutKind === 'process-v3';
   const featureName = resolved.featureName;
   if (touchFilter && !readTouched().has(featureName)) process.exit(0);
   const specsPath = resolved.specsDir;
   const runtimeContext = POLICY.deriveRuntimeContext({
     projectRoot: baseDir,
     specsRoot: specsPath,
-    specFile: resolved.stateFile || resolved.specFile || path.join(specsPath, featureName, 'spec.json'),
+    specFile: resolved.stateFile,
     featureName,
     runtimeSession: sessionIdentity(payload),
   });
 
-  const phase = resolved.phase || activeSpec.current_phase || activeSpec.phase || 'unknown';
-  const taskRegistry = resolved.taskRegistry || activeSpec.task_registry || {};
-  const flashTasks = POLICY.flashState(taskRegistry);
+  const phase = resolved.phase || 'unknown';
+  const taskRegistry = resolved.taskRegistry || {};
   const taskEntries = Object.entries(taskRegistry);
   const taskCounts = taskEntries.reduce((acc, [, task]) => {
     const status = task?.status || 'pending';
@@ -231,10 +233,7 @@ try {
     return acc;
   }, {});
   const featureDir = path.join(specsPath, featureName);
-  const taskStatusByPath = new Map(taskEntries.map(([taskPath, task]) => [taskPath, task?.status || 'pending']));
-  const dependencyProof = processWorkflow
-    ? RECEIPT.workflowDependencyProofState(featureDir, taskRegistry, runtimeContext, POLICY)
-    : {};
+  const dependencyProof = RECEIPT.workflowDependencyProofState(featureDir, taskRegistry, runtimeContext, POLICY);
   const taskState = taskEntries.map(([taskPath, task]) => [
     taskPath,
     task?.status || 'pending',
@@ -250,12 +249,9 @@ try {
   const nextUnblocked = taskEntries.find(([, task]) => {
     const status = task?.status || 'pending';
     const deps = Array.isArray(task?.dependencies) ? task.dependencies : [];
-    return resolved.queueReady !== false && status === 'pending' && deps.every((dep) => (
-      processWorkflow ? dependencyProof[dep]?.eligible === true : taskStatusByPath.get(dep) === 'done'
-    ));
+    return resolved.queueReady !== false && status === 'pending'
+      && deps.every((dep) => dependencyProof[dep]?.eligible === true);
   });
-  const featureReceiptPresent = !processWorkflow
-    && RECEIPT.safeRead(featureDir, 'feature-receipt.md').status === 'ok';
 
   // ── State-change gate: only emit the full tollgate when spec state changed ──
   // The cache is shared by installed hook copies, so its key must carry the
@@ -278,9 +274,11 @@ try {
     proofState,
     done: taskCounts.done || 0,
     total: taskEntries.length,
-    featureReceiptPresent,
   });
-  const cacheFile = path.join(require('./lib/hook-state-dir.cjs').hookStateDir(), 'tollgate-last.txt');
+  const cacheName = touchFilter
+    ? `tollgate-last-${require('crypto').createHash('sha256').update(claudeSession).digest('hex').slice(0, 16)}.txt`
+    : 'tollgate-last.txt';
+  const cacheFile = path.join(require('./lib/hook-state-dir.cjs').hookStateDir(), cacheName);
 
   let lastKey = '';
   if (stateKey) {
@@ -288,11 +286,10 @@ try {
   }
 
   if (stateKey && lastKey === stateKey) {
-    const stateTarget = processWorkflow ? 'task Markdown' : '`spec.json`';
-    const migration = processWorkflow && resolved.queueReady === false
+    const migration = resolved.queueReady === false
       ? ' Add `Specs-Contract: process-first-ready-v1` after the plan title before tasks can enter Next.'
       : '';
-    console.log(`\n> 🔵 Spec \`${featureName}\` @ \`${phase}\` (${taskCounts.done || 0}/${taskEntries.length} tasks done). Tollgate active — sync ${stateTarget} when state changes.${migration}\n`);
+    console.log(`\n> 🔵 Spec \`${featureName}\` @ \`${phase}\` (${taskCounts.done || 0}/${taskEntries.length} tasks done). Tollgate active — sync task Markdown when state changes.${migration}\n`);
     process.exit(0);
   }
 
@@ -312,26 +309,22 @@ try {
   if (nextUnblocked) {
     lines.push(`- Next unblocked: \`${nextUnblocked[0]}\``);
   }
-  if (flashTasks.length > 0) {
-    lines.push(`- Flash verification pending: ${flashTasks.map((taskPath) => `\`${taskPath}\``).join(', ')}. A PASS proof keeps the persisted task in_progress until explicit sync-finalize.`);
-  }
-  if (processWorkflow) {
-    if (resolved.queueReady === false) {
-      lines.push('- Migration required: add `Specs-Contract: process-first-ready-v1` after the plan title before tasks can enter Next.');
-    }
-    lines.push('- Sync each flat task `Status:` only after verified work; task proof belongs in that task\'s inline `## Receipt`.');
-    lines.push(`- Workflow source: \`specs/${featureName}/plan.md\`; Stop re-checks every done receipt, binding Base/Head to the runtime only while a committed task file no longer matches its committed bytes.`);
-  } else {
-    lines.push('- Sync `spec.json` + task Markdown status after verified work; task proof belongs in `receipts/<task-basename>.md`.');
-    lines.push(`- Create \`feature-receipt.md\` once after final integration proof${featureReceiptPresent ? ' (present)' : ' (not required before closeout)'}.`);
-    lines.push(`- Validate with \`node ${runtimeDirName()}/scripts/validate-spec-output.cjs specs/${featureName}\`; hooks revalidate receipt bytes but never grant approval.`);
+  if (resolved.queueReady === false) {
+    lines.push('- Migration required: add `Specs-Contract: process-first-ready-v1` after the plan title before tasks can enter Next.');
   }
+  lines.push('- Sync each flat task `Status:` only after verified work; task proof belongs in that task\'s inline `## Receipt`.');
+  lines.push(`- Workflow source: \`specs/${featureName}/plan.md\`; Stop re-checks every done receipt, binding Base/Head to the runtime only while a committed task file no longer matches its committed bytes.`);
+  lines.push('- Hooks revalidate receipt bytes but never grant approval.');
   lines.push('');
 
   console.log(lines.join('\n'));
   process.exit(0);
 
 } catch (e) {
+  if (e.code === 'no_git_history') {
+    console.log('Repo has no commits yet; create the first commit, then record Base/Head after it.');
+    process.exit(0);
+  }
   logCrash(e);
   emitControlledFailure(e.message);
   process.exit(0);

package/src/claude/hooks/state.cjs

@@ -8,14 +8,26 @@
  *
  * Events:
  *   SessionStart  → load previous state and print to context
- *   PostToolUse   → refresh state after Task/TaskCreate/TaskUpdate/TodoWrite
+ *   PostToolUse   → refresh state after Agent/Task/TaskCreate/TaskUpdate/TodoWrite
  *   Stop          → persist full session state and archive
  *   SubagentStop  → append agent completion note to current state
  *
- * Storage: <runtime>/session-state/latest.md (+ archive/)
+ * Storage: <runtime>/session-state/[session hash/]latest.md (+ archive/)
  * Exit: 0 always (fail-open)
  */
 
+function logCrash(error) {
+  try {
+    const fs = require('fs');
+    const path = require('path');
+    const logDir = require('./lib/hook-state-dir.cjs').hookStateDir();
+    fs.mkdirSync(logDir, { recursive: true });
+    fs.appendFileSync(path.join(logDir, 'hook-log.jsonl'), JSON.stringify({
+      ts: new Date().toISOString(), hook: 'state', status: 'crash', error: error.message,
+    }) + '\n');
+  } catch (_) {}
+}
+
 try {
   const fs = require('fs');
   const path = require('path');
@@ -23,34 +35,73 @@ try {
   const crypto = require('crypto');
   const { execSync } = require('child_process');
   const { parseTranscript } = require('./lib/parser.cjs');
+  const { projectRoot } = require('./lib/project-root.cjs');
+  const { containsSecretKeyword } = require('./lib/secret-keywords.cjs');
   const { runtimeDirName, runtimeDir, runtimePath } = require('./lib/runtime-dir.cjs');
 
   const EXPIRY_DAYS = 7;
   const MAX_ARCHIVES = 5;
   const MAX_AGENT_SECTIONS = 3;
   const MAX_MODIFIED_FILES_DISPLAY = 5;
-  const TRACKED_POST_TOOL_EVENTS = new Set(['Task', 'TaskCreate', 'TaskUpdate', 'TodoWrite']);
+  const TRACKED_POST_TOOL_EVENTS = new Set(['Agent', 'Task', 'TaskCreate', 'TaskUpdate', 'TodoWrite']);
+  const WAIT_BUFFER = new Int32Array(new SharedArrayBuffer(4));
 
-  function stateDir(cwd) {
+  function withStateLock(dir, callback) {
+    const lock = path.join(dir, '.write-lock');
+    const deadline = Date.now() + 3000;
+    while (Date.now() < deadline) {
+      try {
+        fs.mkdirSync(lock);
+      } catch (error) {
+        if (error.code !== 'EEXIST') return;
+        try {
+          if (Date.now() - fs.statSync(lock).mtimeMs > 15000) {
+            fs.rmSync(lock, { recursive: true, force: true });
+            continue;
+          }
+        } catch { continue; }
+        Atomics.wait(WAIT_BUFFER, 0, 0, 20);
+        continue;
+      }
+      try { return callback(); } finally {
+        try { fs.rmdirSync(lock); } catch { /* already released */ }
+      }
+    }
+  }
+
+  function assistantSummary(value) {
+    if (value === null || value === undefined) return '';
+    let text;
+    if (typeof value === 'object') {
+      const preferred = value.message ?? value.output ?? value.result ?? value.content;
+      text = typeof preferred === 'string' ? preferred : JSON.stringify(value);
+    } else {
+      text = String(value);
+    }
+    if (containsSecretKeyword(text)) return '[omitted: possible secret]';
+    const clean = text.replace(/\0/g, '').trim();
+    return clean.length > 600 ? `${clean.slice(0, 600)}…` : clean;
+  }
+
+  function stateDir(cwd, sessionId, create = true) {
     try {
-      const local = runtimePath(cwd, 'session-state');
+      let dir;
       if (fs.existsSync(runtimeDir(cwd))) {
-        if (!fs.existsSync(local)) fs.mkdirSync(local, { recursive: true });
-        return local;
+        dir = runtimePath(cwd, 'session-state');
+      } else {
+        const hash = crypto.createHash('md5').update(cwd).digest('hex').slice(0, 12);
+        dir = path.join(os.homedir(), '.claude', 'session-states', hash);
       }
-
-      const hash = crypto.createHash('md5').update(cwd).digest('hex').slice(0, 12);
-      const global = path.join(os.homedir(), '.claude', 'session-states', hash);
-      if (!fs.existsSync(global)) fs.mkdirSync(global, { recursive: true });
-      return global;
+      if (sessionId) dir = path.join(dir, crypto.createHash('sha256').update(sessionId).digest('hex').slice(0, 16));
+      if (create && !fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+      return dir;
     } catch {
       return null;
     }
   }
 
-  function loadLatest(cwd) {
+  function loadLatest(dir) {
     try {
-      const dir = stateDir(cwd);
       if (!dir) return null;
 
       const file = path.join(dir, 'latest.md');
@@ -109,7 +160,8 @@ try {
       timestamp: new Date().toISOString(),
       branch: process.env.GIT_BRANCH || '',
       todos: [],
-      modifiedFiles: []
+      modifiedFiles: [],
+      lastAssistant: assistantSummary(stdinData.last_assistant_message),
     };
 
     if (stdinData.transcript_path && fs.existsSync(stdinData.transcript_path)) {
@@ -178,6 +230,7 @@ try {
       "## What's Left",
       ...(pending.length ? pending.map((todo) => `- [ ] ${todo.content}`) : ['- (All tasks completed)']),
       '',
+      ...(data.lastAssistant ? ['## Latest Assistant Message', data.lastAssistant, ''] : []),
       '## Key Files Modified',
       ...(data.modifiedFiles.length ? data.modifiedFiles.map((file) => `- ${file}`) : ['- (No file changes detected)']),
       ''
@@ -186,9 +239,10 @@ try {
 
   function buildAgentSection(data) {
     const agentType = data.agent_type || '';
-    if (!agentType || agentType === 'unknown') return '';
+    const message = assistantSummary(data.last_assistant_message);
+    if (!agentType || agentType === 'unknown') return message ? `\n## Latest Assistant Message\n${message}\n` : '';
     const time = new Date().toISOString().slice(11, 19);
-    return `\n## Agent Result: ${agentType} (${time})\n- Completed at ${time}\n`;
+    return `\n## Agent Result: ${agentType} (${time})\n- ${message || `Completed at ${time}`}\n`;
   }
 
   function takeRecentAgentSections(sections) {
@@ -229,11 +283,13 @@ try {
   }
 
   async function persistSnapshot(dir, data, options = {}) {
-    const file = path.join(dir, 'latest.md');
-    const existing = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
-    const content = mergeAgentSections(existing, buildStateContent(data));
-    writeAtomic(file, content);
-    if (options.archive) archive(dir);
+    withStateLock(dir, () => {
+      const file = path.join(dir, 'latest.md');
+      const existing = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+      const content = mergeAgentSections(existing, buildStateContent(data));
+      writeAtomic(file, content);
+      if (options.archive) archive(dir);
+    });
   }
 
   async function main() {
@@ -244,14 +300,14 @@ try {
     const rawPayload = JSON.parse(stdin);
     const data = normalizeHookPayload(rawPayload);
     const event = data.hook_event_name || '';
-    const cwd = data.cwd || process.cwd();
-    const dir = stateDir(cwd);
+    const cwd = projectRoot(data);
+    const claudeSession = ['.claude', '.omp'].includes(runtimeDirName())
+      && typeof rawPayload.session_id === 'string' && rawPayload.session_id.length > 0;
+    const dir = stateDir(cwd, claudeSession ? rawPayload.session_id : null, event !== 'SessionStart');
 
     if (event === 'SessionStart') {
-      const previous = loadLatest(cwd);
-      // Claude only: grok (camelCase sessionId), omp and Codex keep printing the block.
-      const claudeSession = runtimeDirName() === '.claude'
-        && typeof rawPayload.session_id === 'string' && rawPayload.session_id.length > 0;
+      const previous = loadLatest(dir);
+      // Claude and omp: grok (camelCase sessionId) and Codex keep printing the block.
       if (previous && (!claudeSession || hasPriorContent(previous))) {
         console.log('\n=== Prior Execution Context ===');
         console.log(previous.trim());
@@ -275,13 +331,15 @@ try {
       const agentSection = buildAgentSection(data);
       if (!agentSection) process.exit(0);
 
-      const file = path.join(dir, 'latest.md');
-      const existing = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
-      const updated = existing
-        ? appendAgentSection(existing, agentSection)
-        : `${buildStateContent(await extractSessionData(data))}\n${agentSection}`;
-
-      writeAtomic(file, updated);
+      const sessionData = await extractSessionData(data);
+      withStateLock(dir, () => {
+        const file = path.join(dir, 'latest.md');
+        const existing = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+        const updated = existing
+          ? appendAgentSection(existing, agentSection)
+          : `${buildStateContent(sessionData)}\n${agentSection}`;
+        writeAtomic(file, updated);
+      });
       process.exit(0);
     }
 
@@ -294,24 +352,11 @@ try {
     process.exit(0);
   }
 
-  main().catch(() => {
+  main().catch((error) => {
+    logCrash(error);
     process.exit(0);
   });
 } catch (error) {
-  try {
-    const fs = require('fs');
-    const path = require('path');
-    const logDir = require('./lib/hook-state-dir.cjs').hookStateDir();
-    if (!fs.existsSync(logDir)) fs.mkdirSync(logDir, { recursive: true });
-    fs.appendFileSync(
-      path.join(logDir, 'hook-log.jsonl'),
-      JSON.stringify({
-        ts: new Date().toISOString(),
-        hook: 'state',
-        status: 'crash',
-        error: error.message
-      }) + '\n'
-    );
-  } catch (_) {}
+  logCrash(error);
   process.exit(0);
 }

package/src/claude/migration-manifest.json

@@ -59,15 +59,10 @@
       "validate-docs.cjs",
       "validate-docs-reconstruct.cjs",
       "generate-skill-catalog.cjs",
-      "validate-spec-output.cjs",
       "scan-staged-secrets.cjs",
       "workflow-policy.cjs",
       "spec-resolver.cjs",
       "spec-receipt.cjs",
-      "spec-ground.cjs",
-      "spec-semantic-model.cjs",
-      "spec-final-state.cjs",
-      "spec-readiness.cjs",
       "provenance.cjs"
     ]
   },
@@ -97,6 +92,18 @@
       "codex": ["agents/god_developer.toml"]
     },
     "runtimeFiles": [
+      "scripts/validate-spec-output.cjs",
+      "scripts/spec-ground.cjs",
+      "scripts/spec-authoring-digest.cjs",
+      "scripts/spec-semantic-model.cjs",
+      "scripts/spec-final-state.cjs",
+      "skills/code-review/references/verification-gate.md",
+      "scripts/change-firewall.cjs",
+      "scripts/spec-scaffold.cjs",
+      "scripts/spec-readiness.cjs",
+      "scripts/spec-authoring-validation.cjs",
+      "hooks/lib/context.cjs",
+      "hooks/lib/detect.cjs",
       "hooks/skill-router.cjs",
       "hooks/lib/skill-router-routes.cjs",
       "scripts/browser-tool.cjs",
@@ -136,7 +143,8 @@
       ".codex\\hooks\\semantic-review-authority.cjs",
       ".claude/hooks/task-scaffold-guard.cjs",
       ".codex/hooks/task-scaffold-guard.cjs",
-      ".codex\\hooks\\task-scaffold-guard.cjs"
+      ".codex\\hooks\\task-scaffold-guard.cjs",
+      ".claude/hooks/inspector-block.cjs"
     ]
   },
   "runtime": {
@@ -161,12 +169,16 @@
       "hooks/lib/counter.cjs",
       "hooks/lib/git.cjs",
       "hooks/lib/config.cjs",
-      "hooks/lib/context.cjs",
-      "hooks/lib/detect.cjs",
       "hooks/lib/hook-state-dir.cjs",
       "hooks/lib/runtime-dir.cjs",
+      "hooks/lib/spec-touch.cjs",
+      "hooks/lib/project-root.cjs",
+      "hooks/lib/update-check.cjs",
+      "hooks/lib/rules-reservation.cjs",
       "hooks/lib/hook-payload.cjs",
+      "hooks/lib/inspect-paths.cjs",
       "hooks/lib/privacy-command-analysis.cjs",
+      "hooks/lib/privacy-paths.cjs",
       "hooks/lib/secret-keywords.cjs",
       "hooks/lib/runtime-path-safety.cjs"
     ]