@haposoft/cafekit 0.18.1 → 0.18.2

package/src/claude/hooks/__tests__/state.test.js

@@ -6,9 +6,13 @@ const { spawnSync } = require('node:child_process');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const crypto = require('node:crypto');
 
 const CLAUDE_ROOT = path.join(__dirname, '..', '..');
 const STATE_HOOK = path.join(CLAUDE_ROOT, 'hooks', 'state.cjs');
+const HOOK_ENV = { ...process.env };
+delete HOOK_ENV.CLAUDE_PROJECT_DIR;
+delete HOOK_ENV.PROJECT_ROOT;
 const POLICY = require(path.join(CLAUDE_ROOT, 'scripts', 'workflow-policy.cjs'));
 
 function processTaskContent(title, status, dependency = 'none') {
@@ -44,6 +48,9 @@ function inInstalledProcessSpecStateFixture(run) {
     fs.mkdirSync(scripts, { recursive: true });
     fs.copyFileSync(path.join(CLAUDE_ROOT, 'hooks', 'spec-state.cjs'), path.join(hooks, 'spec-state.cjs'));
     fs.mkdirSync(path.join(hooks, 'lib'), { recursive: true });
+    for (const lib of ['project-root.cjs', 'spec-touch.cjs']) {
+      fs.copyFileSync(path.join(CLAUDE_ROOT, 'hooks', 'lib', lib), path.join(hooks, 'lib', lib));
+    }
     fs.copyFileSync(path.join(CLAUDE_ROOT, 'hooks', 'lib', 'runtime-dir.cjs'), path.join(hooks, 'lib', 'runtime-dir.cjs'));
     fs.copyFileSync(path.join(CLAUDE_ROOT, 'hooks', 'lib', 'hook-payload.cjs'), path.join(hooks, 'lib', 'hook-payload.cjs'));
     fs.copyFileSync(
@@ -92,7 +99,7 @@ function inInstalledProcessSpecStateFixture(run) {
       encoding: 'utf8',
     });
     return run({
-      cacheFile: path.join(hooks, '.logs', 'tollgate-last.txt'),
+      cacheFile: path.join(hooks, '.logs', `tollgate-last-${crypto.createHash('sha256').update('session-auth-state').digest('hex').slice(0, 16)}.txt`),
       dir,
       feature,
       hooks,
@@ -277,6 +284,7 @@ test('Stop snapshot includes tracked modifications and untracked files', () => {
     fs.writeFileSync(path.join(dir, 'new-untracked.json'), '{}\n');
     const result = spawnSync(process.execPath, [STATE_HOOK], {
       cwd: dir,
+      env: HOOK_ENV,
       input: JSON.stringify({ hook_event_name: 'Stop', cwd: dir }),
       encoding: 'utf8',
     });
@@ -302,6 +310,7 @@ test('Stop snapshot includes untracked files before the first commit', () => {
 
     const result = spawnSync(process.execPath, [STATE_HOOK], {
       cwd: dir,
+      env: HOOK_ENV,
       input: JSON.stringify({ hook_event_name: 'Stop', cwd: dir }),
       encoding: 'utf8',
     });
@@ -344,7 +353,7 @@ const PLACEHOLDER_STATE = [
   '',
 ].join('\n');
 
-function sessionStartWith(content, runtimeFolder = '.claude') {
+function sessionStartWith(content, runtimeFolder = '.claude', readingSession = 'start-1') {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-state-start-'));
   try {
     let hook = STATE_HOOK;
@@ -352,17 +361,19 @@ function sessionStartWith(content, runtimeFolder = '.claude') {
       const hooks = path.join(dir, runtimeFolder, 'hooks');
       fs.mkdirSync(path.join(hooks, 'lib'), { recursive: true });
       fs.copyFileSync(STATE_HOOK, path.join(hooks, 'state.cjs'));
-      for (const lib of ['parser.cjs', 'runtime-dir.cjs', 'hook-payload.cjs', 'hook-state-dir.cjs']) {
+      for (const lib of ['parser.cjs', 'runtime-dir.cjs', 'hook-payload.cjs', 'hook-state-dir.cjs', 'project-root.cjs', 'secret-keywords.cjs']) {
         fs.copyFileSync(path.join(path.dirname(STATE_HOOK), 'lib', lib), path.join(hooks, 'lib', lib));
       }
       hook = path.join(hooks, 'state.cjs');
     }
-    const stateFolder = path.join(dir, runtimeFolder, 'session-state');
+    const stateFolder = path.join(dir, runtimeFolder, 'session-state',
+      ...(['.claude', '.omp'].includes(runtimeFolder) ? [crypto.createHash('sha256').update('start-1').digest('hex').slice(0, 16)] : []));
     fs.mkdirSync(stateFolder, { recursive: true });
     fs.writeFileSync(path.join(stateFolder, 'latest.md'), content.replace('GENERATED', new Date().toISOString()));
     const result = spawnSync(process.execPath, [hook], {
       cwd: dir,
-      input: JSON.stringify({ hook_event_name: 'SessionStart', session_id: 'start-1', cwd: dir }),
+      env: HOOK_ENV,
+      input: JSON.stringify({ hook_event_name: 'SessionStart', session_id: readingSession, cwd: dir }),
       encoding: 'utf8',
     });
     assert.strictEqual(result.status, 0, result.stderr);
@@ -381,6 +392,195 @@ test('SessionStart prints prior context that has a completed todo', () => {
   assert.match(sessionStartWith(withTodo), /Prior Execution Context[\s\S]*Ship the statusline/);
 });
 
-test('SessionStart under .omp keeps printing placeholder-only context', () => {
-  assert.match(sessionStartWith(PLACEHOLDER_STATE, '.omp'), /Prior Execution Context/);
+test('SessionStart under .omp drops placeholder-only context like Claude', () => {
+  assert.strictEqual(sessionStartWith(PLACEHOLDER_STATE, '.omp'), '');
+});
+
+test('two omp sessions keep separate state', () => {
+  const withTodo = PLACEHOLDER_STATE.replace('- (No completed tasks recorded)', '- Ship the statusline');
+  assert.match(sessionStartWith(withTodo, '.omp'), /Ship the statusline/, 'the same session reads its own state');
+  assert.strictEqual(sessionStartWith(withTodo, '.omp', 'start-2'), '', 'another omp session does not');
+});
+
+function inSessionStateFixture(run) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-state-sessions-'));
+  try {
+    const hooks = path.join(dir, '.claude/hooks');
+    fs.mkdirSync(path.join(hooks, 'lib'), { recursive: true });
+    fs.copyFileSync(STATE_HOOK, path.join(hooks, 'state.cjs'));
+    for (const lib of ['parser.cjs', 'runtime-dir.cjs', 'hook-payload.cjs', 'hook-state-dir.cjs', 'project-root.cjs', 'secret-keywords.cjs']) {
+      fs.copyFileSync(path.join(CLAUDE_ROOT, 'hooks/lib', lib), path.join(hooks, 'lib', lib));
+    }
+    const invoke = (payload) => {
+      const result = spawnSync(process.execPath, [path.join(hooks, 'state.cjs')], {
+        cwd: dir, env: HOOK_ENV, encoding: 'utf8', input: JSON.stringify({ cwd: dir, ...payload }),
+      });
+      assert.strictEqual(result.status, 0, result.stderr);
+      return result.stdout;
+    };
+    const write = (session, todo) => {
+      const transcript = path.join(dir, `${session}.jsonl`);
+      fs.writeFileSync(transcript, JSON.stringify({ message: { content: [{
+        type: 'tool_use', id: 'todo-write', name: 'TodoWrite',
+        input: { todos: [{ content: todo, status: 'completed' }] },
+      }] } }) + '\n');
+      invoke({ hook_event_name: 'PostToolUse', session_id: session, tool_name: 'TodoWrite', transcript_path: transcript });
+    };
+    run({ dir, invoke, write, stateRoot: path.join(dir, '.claude/session-state') });
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+}
+
+function savedSession(stateRoot, session = 'robust-session') {
+  return path.join(stateRoot, crypto.createHash('sha256').update(session).digest('hex').slice(0, 16));
+}
+
+test('Agent refreshes the installed state from transcript todos and is parsed as an agent', () => {
+  inSessionStateFixture(({ dir, invoke, stateRoot }) => {
+    const transcript = path.join(dir, 'agent.jsonl');
+    const agent = { type: 'tool_use', id: 'agent-call', name: 'Agent', input: { subagent_type: 'tester' } };
+    fs.writeFileSync(transcript, JSON.stringify({ message: { content: [agent, {
+      type: 'tool_use', id: 'todos', name: 'TodoWrite', input: { todos: [{ content: 'Verify agent snapshot', status: 'pending' }] },
+    }] } }) + '\n');
+    invoke({ hook_event_name: 'PostToolUse', tool_name: 'Agent', session_id: 'robust-session', transcript_path: transcript });
+    const file = path.join(savedSession(stateRoot), 'latest.md');
+    assert.ok(fs.existsSync(file), 'Agent must create the state snapshot');
+    assert.match(fs.readFileSync(file, 'utf8'), /Verify agent snapshot/);
+    const agents = new Map();
+    const tools = new Map();
+    require('../lib/parser.cjs').processEntry({ message: { content: [agent] } }, tools, agents, [], {});
+    assert.ok(agents.has('agent-call'));
+    assert.ok(!tools.has('agent-call'));
+  });
+});
+
+test('Stop persists a bounded summary of the last assistant message', () => {
+  inSessionStateFixture(({ invoke, stateRoot }) => {
+    invoke({ hook_event_name: 'Stop', session_id: 'robust-session', last_assistant_message: 'Verified the change. ' + 'x'.repeat(700) });
+    const state = fs.readFileSync(path.join(savedSession(stateRoot), 'latest.md'), 'utf8');
+    assert.match(state, /## Latest Assistant Message\nVerified the change\./);
+    assert.ok(!state.includes('x'.repeat(601)), 'the summary must be bounded');
+  });
+});
+
+test('Stop omits secret-related assistant messages before saving state', () => {
+  inSessionStateFixture(({ invoke, stateRoot }) => {
+    const message = 'API key handling was discussed in this synthetic test.';
+    invoke({ hook_event_name: 'Stop', session_id: 'robust-session', last_assistant_message: message });
+    const state = fs.readFileSync(path.join(savedSession(stateRoot), 'latest.md'), 'utf8');
+    assert.ok(state.includes('[omitted: possible secret]'));
+    assert.ok(!state.includes(message));
+  });
+});
+
+test('SubagentStop saves the assistant summary and omits secret-related content', () => {
+  inSessionStateFixture(({ invoke, stateRoot }) => {
+    invoke({ hook_event_name: 'SubagentStop', session_id: 'robust-session', agent_type: 'tester', last_assistant_message: 'Checks passed.' });
+    const file = path.join(savedSession(stateRoot), 'latest.md');
+    assert.match(fs.readFileSync(file, 'utf8'), /Checks passed\./);
+    const message = 'Credentials handling was discussed in this synthetic test.';
+    invoke({ hook_event_name: 'SubagentStop', session_id: 'robust-session', agent_type: 'reviewer', last_assistant_message: message });
+    const state = fs.readFileSync(file, 'utf8');
+    assert.ok(state.includes('[omitted: possible secret]'));
+    assert.ok(!state.includes(message));
+  });
+});
+
+test('a fresh state write lock skips the snapshot without changing existing bytes', () => {
+  inSessionStateFixture(({ invoke, stateRoot }) => {
+    const dir = savedSession(stateRoot);
+    fs.mkdirSync(path.join(dir, '.write-lock'), { recursive: true });
+    const file = path.join(dir, 'latest.md');
+    fs.writeFileSync(file, 'Prior state must survive\n');
+    const before = fs.readFileSync(file);
+    invoke({ hook_event_name: 'Stop', session_id: 'robust-session', last_assistant_message: 'New snapshot' });
+    assert.deepStrictEqual(fs.readFileSync(file), before);
+    assert.ok(fs.existsSync(path.join(dir, '.write-lock')));
+  });
+});
+
+test('a stale state write lock is removed and the snapshot is saved', () => {
+  inSessionStateFixture(({ invoke, stateRoot }) => {
+    const dir = savedSession(stateRoot);
+    const lock = path.join(dir, '.write-lock');
+    fs.mkdirSync(lock, { recursive: true });
+    const old = new Date(Date.now() - 20000);
+    fs.utimesSync(lock, old, old);
+    invoke({ hook_event_name: 'Stop', session_id: 'robust-session' });
+    assert.ok(fs.existsSync(path.join(dir, 'latest.md')));
+    assert.ok(!fs.existsSync(lock), 'the stale lock must be released');
+  });
+});
+
+test('consecutive PostToolUse snapshots both save their todos and release the write lock', () => {
+  inSessionStateFixture(({ write, stateRoot }) => {
+    const dir = savedSession(stateRoot);
+    for (const todo of ['First saved todo', 'Second saved todo']) {
+      write('robust-session', todo);
+      assert.ok(fs.readFileSync(path.join(dir, 'latest.md'), 'utf8').includes(todo));
+      assert.ok(!fs.existsSync(path.join(dir, '.write-lock')));
+    }
+  });
+});
+
+test('malformed state input exits successfully and records a crash', () => {
+  inSessionStateFixture(({ dir }) => {
+    const hooks = path.join(dir, '.claude/hooks');
+    const result = spawnSync(process.execPath, [path.join(hooks, 'state.cjs')], { cwd: dir, input: '{', encoding: 'utf8' });
+    assert.strictEqual(result.status, 0);
+    const file = path.join(hooks, '.logs/hook-log.jsonl');
+    assert.ok(fs.existsSync(file), 'the asynchronous failure must be logged');
+    const rows = fs.readFileSync(file, 'utf8').trim().split('\n').map(line => JSON.parse(line));
+    assert.strictEqual(rows.length, 1);
+    assert.strictEqual(rows[0].hook, 'state');
+    assert.strictEqual(rows[0].status, 'crash');
+  });
+});
+
+test('a new Claude session startup does not inherit another session context', () => {
+  inSessionStateFixture(({ write, invoke }) => {
+    write('session-a', 'Completed work for session A');
+    const output = invoke({ hook_event_name: 'SessionStart', session_id: 'session-b', source: 'startup' });
+    assert.doesNotMatch(output, /Prior Execution Context/);
+  });
+});
+
+test('a Claude session resumes its own saved todo', () => {
+  inSessionStateFixture(({ write, invoke, stateRoot }) => {
+    write('session-a', 'Completed work for session A');
+    const key = crypto.createHash('sha256').update('session-a').digest('hex').slice(0, 16);
+    assert.match(fs.readFileSync(path.join(stateRoot, key, 'latest.md'), 'utf8'), /Completed work for session A/);
+    const output = invoke({ hook_event_name: 'SessionStart', session_id: 'session-a', source: 'resume' });
+    assert.match(output, /Prior Execution Context[\s\S]*Completed work for session A/);
+  });
+});
+
+test('two Claude sessions resume only their own completed todos', () => {
+  inSessionStateFixture(({ write, invoke }) => {
+    write('session-a', 'Completed work for session A');
+    write('session-b', 'Completed work for session B');
+    for (const [session, own, other] of [['session-a', 'session A', 'session B'], ['session-b', 'session B', 'session A']]) {
+      const output = invoke({ hook_event_name: 'SessionStart', session_id: session, source: 'resume' });
+      const verified = output.split('## What Worked (Verified)')[1]?.split("## What's Left")[0] || '';
+      assert.match(output, /Prior Execution Context/);
+      assert.ok(verified.includes(own));
+      assert.ok(!verified.includes(other));
+    }
+  });
+});
+
+test('a session-less payload still reads project-level context', () => {
+  inSessionStateFixture(({ stateRoot, invoke }) => {
+    fs.mkdirSync(stateRoot, { recursive: true });
+    fs.writeFileSync(path.join(stateRoot, 'latest.md'), PLACEHOLDER_STATE.replace('GENERATED', new Date().toISOString())
+      .replace('- (No completed tasks recorded)', '- Legacy project todo'));
+    assert.match(invoke({ hook_event_name: 'SessionStart' }), /Prior Execution Context[\s\S]*Legacy project todo/);
+  });
+});
+
+test('Claude SessionStart does not create state directories', () => {
+  inSessionStateFixture(({ stateRoot, invoke }) => {
+    assert.strictEqual(fs.existsSync(stateRoot), false);
+    assert.strictEqual(invoke({ hook_event_name: 'SessionStart', session_id: 'new-session', source: 'startup' }).trim(), '');
+    assert.strictEqual(fs.existsSync(stateRoot), false);
+  });
 });

package/src/claude/hooks/__tests__/update-check.test.js

@@ -0,0 +1,88 @@
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+async function fixture(run) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-update-check-'));
+  try {
+    fs.writeFileSync(path.join(dir, 'cafekit.json'), JSON.stringify({ version: '1.2.3' }));
+    const cache = path.join(dir, '.cafekit-update-cache.json');
+    await run({ dir, cache, check: (...args) => require('../lib/update-check.cjs').checkCafeKitUpdate(...args) });
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+}
+
+test('a newer version produces the existing notice and caches only version data', async () => {
+  await fixture(async ({ dir, cache, check }) => {
+    const notice = await check(dir, async () => '1.3.0');
+    assert.equal(notice, '\n⚡ CafeKit update available: 1.2.3 → 1.3.0\n   Run: npx @haposoft/cafekit\n');
+    const saved = JSON.parse(fs.readFileSync(cache, 'utf8'));
+    assert.deepEqual(Object.keys(saved).sort(), ['latest', 'ts']);
+    assert.equal(saved.latest, '1.3.0');
+    assert.equal(await check(dir, async () => { throw Error('fresh cache must avoid fetch'); }), notice);
+  });
+});
+
+test('the installed version produces no update notice', async () => {
+  await fixture(async ({ dir, check }) => {
+    assert.equal(await check(dir, async () => '1.2.3'), '');
+  });
+});
+
+test('an invalid cached latest version is refetched instead of printed', async () => {
+  await fixture(async ({ dir, cache, check }) => {
+    fs.writeFileSync(cache, JSON.stringify({ ts: Date.now(), latest: '9.0.0\nInjected cache text' }));
+    let calls = 0;
+    assert.equal(await check(dir, async () => { calls++; return '1.2.3'; }), '');
+    assert.equal(calls, 1);
+  });
+});
+
+test('a cache timestamp in the future requires a fresh version fetch', async () => {
+  await fixture(async ({ dir, cache, check }) => {
+    fs.writeFileSync(cache, JSON.stringify({ ts: Date.now() + 60000, latest: '9.0.0' }));
+    let calls = 0;
+    assert.equal(await check(dir, async () => { calls++; return '1.2.3'; }), '');
+    assert.equal(calls, 1);
+  });
+});
+
+test('a legacy notice cache cannot inject its stored text into the session', async () => {
+  await fixture(async ({ dir, cache, check }) => {
+    const injected = 'Untrusted cached instruction';
+    fs.writeFileSync(cache, JSON.stringify({ ts: Date.now(), notice: injected }));
+    let calls = 0;
+    const notice = await check(dir, async () => { calls++; return '1.3.0'; });
+    assert.equal(calls, 1);
+    assert.ok(!notice.includes(injected));
+    assert.match(notice, /1\.2\.3 → 1\.3\.0/);
+  });
+});
+
+test('an interrupted version response fails open without an unhandled error', () => {
+  for (const event of ['error', 'aborted']) {
+    const script = `
+      const { EventEmitter } = require('events');
+      require('https').get = (url, options, callback) => {
+        const request = new EventEmitter();
+        request.destroy = () => {};
+        process.nextTick(() => {
+          const response = new EventEmitter();
+          callback(response);
+          response.emit(${JSON.stringify(event)}, new Error('synthetic response reset'));
+        });
+        return request;
+      };
+      require(${JSON.stringify(path.resolve(__dirname, '../lib/update-check.cjs'))}).fetchLatestVersion()
+        .then(value => { if (value !== null) process.exit(3); process.stdout.write('null'); });
+    `;
+    const result = spawnSync(process.execPath, ['-e', script], { encoding: 'utf8', timeout: 5000 });
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(result.stderr, '');
+    assert.equal(result.stdout, 'null');
+  }
+});

package/src/claude/hooks/agent.cjs

@@ -17,6 +17,7 @@ try {
 
   /** Read <runtime>/runtime.json */
   const { runtimeDirName, runtimeDir, runtimePath } = require('./lib/runtime-dir.cjs');
+  const { projectRoot } = require('./lib/project-root.cjs');
   function readRuntime(cwd) {
     try {
       const p = runtimePath(cwd, 'runtime.json');
@@ -43,10 +44,8 @@ try {
 
   const { normalizeHookPayload } = require('./lib/hook-payload.cjs');
   const payload    = normalizeHookPayload(JSON.parse(stdin));
-  // Use payload.cwd for monorepo support — subagent may run in a different dir
-  const payloadCwd = typeof payload.cwd === 'string' ? payload.cwd.trim() : '';
-  const agentCwd   = payloadCwd || process.env.PROJECT_ROOT || process.cwd();
-  const runtime    = readRuntime(agentCwd);
+  const root = projectRoot(payload);
+  const runtime = readRuntime(root);
   if (runtime === null) process.exit(0);
 
   // Language config from runtime.json
@@ -56,7 +55,7 @@ try {
   const effectThink  = thinkLang || (respondLang ? 'en' : '');
 
   // Resolve paths from env (set by session.cjs) or runtime defaults
-  const baseDir    = agentCwd;
+  const baseDir    = root;
   const plansPath  = path.join(baseDir, runtime.paths?.plans || 'plans');
   const docsPath   = path.join(baseDir, runtime.paths?.docs  || 'docs');
   const specsPath  = path.join(baseDir, runtime.paths?.specs || 'specs');
@@ -74,10 +73,12 @@ try {
   }
 
   // Python venv (optional — if <skills>/.venv exists)
-  const venv = resolveVenv(agentCwd);
+  const venv = resolveVenv(root);
 
   lines.push('## Rules');
   lines.push(`- Specs → ${specsPath}/ | Plans → ${plansPath}/ | Docs → ${docsPath}/`);
+  lines.push('- YAGNI · KISS · DRY');
+  lines.push('- Be concise. List unresolved questions at end.');
   if (venv) {
     lines.push(`- Python in ${skillsDir()}/: use \`${venv}\``);
     lines.push('- Never use global pip install');

package/src/claude/hooks/inspect-block.cjs

@@ -15,50 +15,8 @@
 
 try {
   const fs   = require('fs');
-  const path = require('path');
-  const { execSync } = require('child_process');
-
-  // Directories that should never be read (too large / irrelevant to LLM)
-  const BLOCKED_DIRS = [
-    'node_modules', 'dist', 'build', '.next', '.nuxt', '.output',
-    '__pycache__', '.venv', 'venv',
-    'vendor', 'target',
-    '.git', 'coverage', '.nyc_output',
-  ];
-
-  // Glob patterns too broad to be useful
-  const BROAD_GLOB = [/^\*\*\/\*$/, /^\*\*\.\w+$/, /^\*\*\/\*\.\w+$/];
-
-  // Commands that are always allowed (build tools, package managers, venv)
-  const ALLOWED_CMD = /^(npm|pnpm|yarn|bun|npx|pnpx|bunx|tsc|vite|esbuild|webpack|rollup|turbo|nx|jest|vitest|eslint|prettier|go|cargo|make|mvn|gradle|dotnet|docker|kubectl|helm|python3?|pip|uv|deno|bundle|rake|php|composer|ruby|mix)\b/;
-  const VENV_EXEC   = /(^|[\/\\])\.?venv[\/\\](bin|Scripts)[\/\\]/;
-  const VENV_CREATE = /^(python3?|py)\s+.*-m\s+venv\s+|^uv\s+venv(\s|$)/;
-
-  function isAllowedCommand(cmd) {
-    const s = cmd.trim().replace(/^(\w+=\S+\s+)+/, '').replace(/^(sudo|env|time)\s+/, '').trim();
-    return ALLOWED_CMD.test(s) || VENV_EXEC.test(s) || VENV_CREATE.test(s);
-  }
-
-  function isBlockedPath(p) {
-    return p.replace(/\\/g, '/').split('/').some(seg => BLOCKED_DIRS.includes(seg));
-  }
-
-  function isBroadGlob(p) {
-    return BROAD_GLOB.some(r => r.test(p.trim()));
-  }
-
-  function extractPaths(toolName, input) {
-    const out = [];
-    if (!input) return out;
-    if (input.file_path) out.push(input.file_path);
-    if (input.path)      out.push(input.path);
-    if (input.pattern)   out.push(input.pattern);
-    if (typeof input.command === 'string') {
-      const m = input.command.match(/(?:cat|ls|find|head|tail)\s+(\S+)/g);
-      if (m) m.forEach(s => out.push(s.trim().split(/\s+/).pop()));
-    }
-    return out.filter(Boolean);
-  }
+  const { BLOCKED_DIRS, inspectInput } = require('./lib/inspect-paths.cjs');
+  const { projectRoot } = require('./lib/project-root.cjs');
 
   const { runtimeDirName, runtimeDir, runtimePath } = require('./lib/runtime-dir.cjs');
   function readRuntime(cwd) {
@@ -97,37 +55,31 @@ function denyWithReason(reason) {
   const data      = normalizeHookPayload(JSON.parse(stdin));
   const toolName  = data.tool_name  || '';
   const toolInput = data.tool_input || {};
-  const cwd       = data.cwd        || process.cwd();
-  const runtime   = readRuntime(cwd);
+  let cwd         = data.cwd        || process.cwd();
+  try { cwd = fs.realpathSync(cwd); } catch { /* retain the payload cwd when unavailable */ }
+  const root      = projectRoot(data);
+  const runtime   = readRuntime(root);
 
   if (runtime.scout?.enabled === false || runtime.inspect?.enabled === false) process.exit(0);
 
-  // Allow all-permitted bash commands immediately
-  if (toolInput.command) {
-    const cmds = toolInput.command.split(/\s*(?:&&|\|\||;)\s*/).filter(Boolean);
-    if (cmds.every(c => isAllowedCommand(c))) process.exit(0);
-  }
-
-  // Broad glob check
-  if (toolInput.pattern && isBroadGlob(toolInput.pattern)) {
+  const result = inspectInput(toolName, toolInput, {
+    cwd, projectRoot: root
+  });
+  if (result.broadGlob) {
     denyWithReason(
       `SCOPE LIMIT EXCEEDED: Glob pattern is excessively broad\n` +
-      `Requested Pattern: ${toolInput.pattern}\n\n` +
+      `Requested Pattern: ${result.broadGlob}\n\n` +
       `Please narrow your scope (e.g., src/**/*.ts rather than **/*.ts).`
     );
   }
 
-  // Blocked directory check
-  const paths = extractPaths(toolName, toolInput);
-  for (const p of paths) {
-    if (isBlockedPath(p)) {
-      const blocked = p.replace(/\\/g, '/').split('/').find(s => BLOCKED_DIRS.includes(s));
+  if (result.blockedPath) {
+      const { requested, blocked } = result.blockedPath;
       denyWithReason(
         `SCOPE LIMIT EXCEEDED: Directory "${blocked}/" is explicitly forbidden\n` +
-        `Requested Path: ${p}\n` +
-        `Restricted zones: ${BLOCKED_DIRS.join(', ')}`
+        `Requested Path: ${requested}\n` +
+        `Restricted zones: ${[...BLOCKED_DIRS].join(', ')}`
       );
-    }
   }
 
   process.exit(0);