@haposoft/cafekit 0.18.1 → 0.18.2

package/src/claude/skills/ai-multimodal/scripts/gemini_batch_process.py

@@ -23,19 +23,10 @@ from typing import List, Dict, Any, Optional
 import csv
 import shutil
 
-# Import centralized environment resolver (works for both local and global installs)
-CLAUDE_ROOT = Path(__file__).parent.parent.parent.parent
-sys.path.insert(0, str(CLAUDE_ROOT / 'scripts'))
 try:
-    from resolve_env import resolve_env
-    CENTRALIZED_RESOLVER_AVAILABLE = True
+    from dotenv import load_dotenv
 except ImportError:
-    # Fallback if centralized resolver not available
-    CENTRALIZED_RESOLVER_AVAILABLE = False
-    try:
-        from dotenv import load_dotenv
-    except ImportError:
-        load_dotenv = None
+    load_dotenv = None
 
 # Import key rotation support
 sys.path.insert(0, str(Path(__file__).parent.parent.parent / 'common'))
@@ -74,10 +65,7 @@ IMAGEN_MODELS = {
 
 
 def find_api_key() -> Optional[str]:
-    """Find Gemini API key using centralized resolver or fallback.
-
-    Uses ~/packages/spec/src/claude/scripts/resolve_env.py for consistent resolution across all skills.
-    Falls back to local resolution if centralized resolver not available.
+    """Find Gemini API key using local environment resolution.
 
     Priority order (highest to lowest):
     1. process.env (runtime environment variables)
@@ -88,11 +76,6 @@ def find_api_key() -> Optional[str]:
     6. ~/packages/spec/src/claude/skills/.env (user shared)
     7. ~/packages/spec/src/claude/.env (user global)
     """
-    if CENTRALIZED_RESOLVER_AVAILABLE:
-        # Use centralized resolver (recommended)
-        return resolve_env('GEMINI_API_KEY', skill='ai-multimodal')
-
-    # Fallback: Local resolution (legacy)
     api_key = os.getenv('GEMINI_API_KEY')
     if api_key:
         return api_key
@@ -751,18 +734,13 @@ def batch_process(
         print("Error: GEMINI_API_KEY not found in any location")
         print("\nSearched locations (highest to lowest priority):")
         print("  1. OS environment (process.env)")
-        if CENTRALIZED_RESOLVER_AVAILABLE:
-            from resolve_env import get_env_file_paths
-            for i, (desc, path) in enumerate(get_env_file_paths('ai-multimodal'), 2):
-                exists = "[OK]" if path.exists() else "[  ]"
-                print(f"  {i}. {exists} {path}")
-        else:
-            print("  2-7. .env files (centralized resolver unavailable)")
+        print("  2. Runtime .env file")
+        print("  3. Shared skills .env file")
+        print("  4. Skill-specific .env file")
         print("\nQuick fix — add your key to any .env file above:")
         print("  echo 'GEMINI_API_KEY=your-key' >> ~/packages/spec/src/claude/.env")
         print("\nOther options:")
         print("  - Run setup checker: python scripts/check_setup.py")
-        print("  - Show full hierarchy: python ~/packages/spec/src/claude/scripts/resolve_env.py --show-hierarchy --skill ai-multimodal -v")
         print("\nFor key rotation, add multiple keys to any .env:")
         print("   GEMINI_API_KEY=key1")
         print("   GEMINI_API_KEY_2=key2")

package/src/claude/skills/git/SKILL.md

@@ -24,7 +24,7 @@ Present options via AskUserQuestion — header "Git Operation": commit / push /
   `gh repo view --json defaultBranchRef` or `origin/HEAD`; never assume `main`/`develop`.
 - `finish`: fresh `git status` + verification, then present exactly 4 options:
   merge locally / push + PR / keep branch-worktree / discard (typed confirmation, as in the worktree lifecycle: `remove <dir-name>` / `delete <branch>`).
-- `worktree <desc>`: sibling dir `../<project>-<branch>` for isolated setup, branched from the current branch unless the user names a base, hydrating the installer-ignored `.claude/`, `.codex/`, `.agents/` it lacks. Git alone is enough (plus `rsync`); Orca, Herdr and Claude Code's own worktree are optional shortcuts, never required.
+- `worktree <desc>`: sibling dir `../<project>-<branch>` for isolated setup, branched from the current branch unless the user names a base, hydrating the installer-ignored `.claude/`, `.codex/`, `.agents/` it lacks. Git alone is enough (plus `rsync`); Orca, Herdr and the host's own worktree are optional shortcuts, never required.
 - `worktree list | remove <dir> | prune`: lifecycle in `references/worktree-blueprint.md` — never lose uncommitted, ignored or unmerged work: before `git worktree remove`, check `git -C <dir> status --porcelain --ignored` and `git -C <dir> log --oneline <base>..HEAD`, never `--force`, and anything they show needs the typed `remove <dir-name>`; use `git worktree prune` for a missing directory, never `rm -rf`.
 
 ## Hard rules for `commit`

package/src/claude/skills/git/references/worktree-blueprint.md

@@ -19,7 +19,7 @@ Tuỳ theo `<feature-description>`, hãy sinh ra một cái tên nhánh dạng K
 *Lưu ý: Nếu User chủ động gõ tên có sẵn mã Jira (TD-1234) hoặc tên tuyệt đối thì bỏ qua prefix Type.*
 
 ### Bước 3: Khởi Sinh Worktree (Sibling Pattern)
-**Mặc định luôn là cấp Sibling (`../`)**: skill không bao giờ tự tạo worktree lồng bên trong repo. Một đường dẫn lồng (dưới `.claude/worktrees/` đã bị ignore) chỉ chấp nhận khi chính người dùng hoặc công cụ host đã đặt tên và tạo ra nó; khi còn worktree lồng, không chạy `git clean -fdx` ở root repo vì nó xoá cả thư mục bị ignore.
+**Mặc định luôn là cấp Sibling (`../`)**: skill không bao giờ tự tạo worktree lồng bên trong repo. Một đường dẫn lồng dưới runtime đã bị ignore chỉ chấp nhận khi chính người dùng hoặc công cụ host đã đặt tên và tạo ra nó; khi còn worktree lồng, không chạy `git clean -fdx` ở root repo vì nó xoá cả thư mục bị ignore.
 
 Lối tắt tùy chọn (không bắt buộc, không phải điều kiện): `claude --worktree`, Orca, Herdr. Chỉ cần `git` (thêm `rsync` cho Bước 4); máy không có công cụ nào khác vẫn làm đủ mọi bước.
 

package/src/codex/AGENTS.md

@@ -1,5 +1,9 @@
 ## Codex runtime
 
+Project notes (commands, files to leave unchanged, slow or expensive operations)
+belong in the root AGENTS.md after the CAFEKIT CORE END marker; Codex reads
+AGENTS.md directly.
+
 - Repository instructions live in `AGENTS.md`.
 - CafeKit skills live in `.agents/skills/`; invoke them as `$cf-<name>` or browse with `/skills`. Edit skills in the project, not in a global skills directory.
 - Run Python skill scripts with the project venv:
@@ -7,6 +11,10 @@
   - Windows: `.agents\\skills\\.venv\\Scripts\\python.exe scripts\\<script>.py`
 - CafeKit agents live in `.codex/agents/*.toml` and are auto-discovered after the repository is trusted.
 - Runtime support lives in `.codex/rules/`, `.codex/scripts/`, `.codex/references/`, and `.codex/runtime.json`.
+- Read `.codex/rules/workflow.md` before planning or implementing changes.
+- Follow `.codex/rules/ai-dev-rules.md` while writing or reviewing code.
+- Consult `.codex/rules/orchestrator.md` when delegating work or seeking specialist counsel.
+- Read `.codex/rules/manage-docs.md` when updating project documentation.
 - For skill selection, read `.codex/rules/skill-workflow-routing.md` and
   `.codex/rules/skill-domain-routing.md`. When capability presence is uncertain,
   run `node .codex/scripts/generate-skill-catalog.cjs --skills`; its Codex-bound

package/src/codex/hooks/ask-guard.cjs

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { atomicWrite, getHookContext, logCrash, readPayload } = require('./lib/hook-context.cjs');
+
+const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex');
+
+try {
+  const data = readPayload();
+  if (!['UserPromptSubmit', 'PreToolUse'].includes(data.hook_event_name)) process.exit(0);
+  if (typeof data.session_id !== 'string' || !data.session_id.trim()) {
+    throw new Error('missing session ID');
+  }
+  const { projectRoot } = getHookContext(data);
+  const sessionHash = sha256(data.session_id);
+  const root = process.env.CAFEKIT_ASK_GUARD_DIR
+    || path.join(os.tmpdir(), 'cafekit-ask-guard', sha256(projectRoot));
+  const directory = path.join(path.resolve(root), sessionHash);
+  const flag = path.join(directory, 'state.json');
+
+  if (data.hook_event_name === 'UserPromptSubmit') {
+    const active = /^(\$cf-ask|\/cf:ask)(?=\s|$)/.test(String(data.prompt || '').trim());
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    atomicWrite(flag, `${JSON.stringify({ active })}\n`);
+    process.exit(0);
+  }
+  // The live probe exposed this native edit separately from its enclosing exec.
+  // Shell commands and child sessions are outside this guard's scope.
+  if (data.tool_name !== 'apply_patch') process.exit(0);
+  let state;
+  try {
+    state = JSON.parse(fs.readFileSync(flag, 'utf8'));
+  } catch (error) {
+    if (error.code === 'ENOENT') process.exit(0);
+    throw error;
+  }
+  if (typeof state?.active !== 'boolean') throw new Error('invalid session flag');
+  if (!state.active) process.exit(0);
+
+  fs.appendFileSync(path.join(directory, 'denials.jsonl'), `${JSON.stringify({
+    timestamp: new Date().toISOString(),
+    session_id_sha256: sessionHash,
+    tool_name: 'apply_patch'
+  })}\n`, { mode: 0o600 });
+  process.stderr.write('This ask session answers only. Run $cf-fix to change files.\n');
+  process.exit(2);
+} catch {
+  // Do not log exception text: malformed payloads can contain private input.
+  logCrash('ask-guard', new Error('Ask guard could not read or persist session state; allowing the call.'));
+}

package/src/codex/hooks/inspect-block.cjs

@@ -2,13 +2,14 @@
 'use strict';
 
 const {
-  getHookContext,
+  PROJECT_ROOT,
   logCrash,
-  readPayload
+  readPayload,
+  readRuntime,
+  resolveSessionCwd
 } = require('./lib/hook-context.cjs');
-const { BLOCKED_DIRS, inspectInput } = require('./lib/inspect-paths.cjs');
 
-function denyPath(requested, blocked) {
+function denyPath(requested, blocked, BLOCKED_DIRS) {
   process.stderr.write(
     `SCOPE LIMIT EXCEEDED: Directory "${blocked}/" is explicitly forbidden\n`
     + `Requested Path: ${requested}\n`
@@ -18,12 +19,15 @@ function denyPath(requested, blocked) {
 }
 
 try {
+  const { BLOCKED_DIRS, inspectInput } = require('./lib/inspect-paths.cjs');
   const payload = readPayload();
   if (!payload) process.exit(0);
-  const { runtime } = getHookContext(payload);
+  const projectRoot = PROJECT_ROOT;
+  const runtime = readRuntime(PROJECT_ROOT);
+  const sessionCwd = resolveSessionCwd(payload);
   if (runtime.scout?.enabled === false || runtime.inspect?.enabled === false) process.exit(0);
 
-  const result = inspectInput(payload.tool_input || {});
+  const result = inspectInput(payload.tool_name || '', payload.tool_input || {}, { cwd: sessionCwd, projectRoot });
   if (result.broadGlob) {
     process.stderr.write(
       `SCOPE LIMIT EXCEEDED: Glob pattern is excessively broad\n`
@@ -33,7 +37,7 @@ try {
     process.exit(2);
   }
   if (result.blockedPath) {
-    denyPath(result.blockedPath.requested, result.blockedPath.blocked);
+    denyPath(result.blockedPath.requested, result.blockedPath.blocked, BLOCKED_DIRS);
   }
 } catch (error) {
   logCrash('inspect-block', error);

package/src/codex/hooks/lib/inspect-paths.cjs

@@ -1,199 +1 @@
-'use strict';
-
-const BLOCKED_DIRS = new Set([
-  'node_modules', 'dist', 'build', '.next', '.nuxt', '.output',
-  '__pycache__', '.venv', 'venv', 'vendor', 'target',
-  '.git', 'coverage', '.nyc_output'
-]);
-const BROAD_GLOBS = [/^\*\*\/\*$/, /^\*\*\.\w+$/, /^\*\*\/\*\.\w+$/];
-const PATH_KEYS = new RegExp(
-  '^(?:file_?paths?|paths?|search_?paths?|'
-  + '(?:source|target|destination)_?paths?|dirs?|director(?:y|ies)|'
-  + 'folders?|cwd|root|locations?|uris?)$',
-  'i'
-);
-const GLOB_KEYS = /(?:^|_)(?:glob|globs|pattern|patterns)$/i;
-function clean(value) {
-  return String(value || '').trim().replace(/^['"`]+|['"`,:]+$/g, '');
-}
-function blockedSegment(value) {
-  return clean(value)
-    .replace(/\\/g, '/')
-    .split('/')
-    .find((segment) => BLOCKED_DIRS.has(segment));
-}
-function isBroadGlob(value) {
-  const candidate = clean(value);
-  return BROAD_GLOBS.some((rule) => rule.test(candidate));
-}
-function collectStructured(value, key, paths, globs) {
-  if (typeof value === 'string') {
-    if (PATH_KEYS.test(key)) paths.push(value);
-    if (GLOB_KEYS.test(key)) globs.push(value);
-    return;
-  }
-  if (Array.isArray(value)) {
-    if (PATH_KEYS.test(key)) paths.push(...value.filter((item) => typeof item === 'string'));
-    if (GLOB_KEYS.test(key)) globs.push(...value.filter((item) => typeof item === 'string'));
-    for (const item of value) collectStructured(item, '', paths, globs);
-    return;
-  }
-  if (!value || typeof value !== 'object') return;
-  for (const [childKey, child] of Object.entries(value)) {
-    collectStructured(child, childKey, paths, globs);
-  }
-}
-function shellTokens(command) {
-  const tokens = [];
-  let token = '';
-  let quote = '';
-  for (let index = 0; index < command.length; index += 1) {
-    const char = command[index];
-    if (quote) {
-      if (char === quote) quote = '';
-      else if (char === '\\' && quote === '"' && index + 1 < command.length) {
-        token += command[index += 1];
-      } else token += char;
-      continue;
-    }
-    if (char === '"' || char === "'") {
-      quote = char;
-    } else if (char === '\n') {
-      if (token) tokens.push(token);
-      token = '';
-      tokens.push('|');
-    } else if (/\s/.test(char)) {
-      if (token) tokens.push(token);
-      token = '';
-    } else if (';&|'.includes(char)) {
-      if (token) tokens.push(token);
-      token = '';
-      const pair = command.slice(index, index + 2);
-      if (pair === '&&' || pair === '||') index += 1;
-      tokens.push('|');
-    } else {
-      token += char;
-    }
-  }
-  if (token) tokens.push(token);
-  return tokens;
-}
-function commandGroups(command) {
-  const groups = [[]];
-  for (const token of shellTokens(command)) {
-    if (token === '|') groups.push([]);
-    else groups[groups.length - 1].push(clean(token));
-  }
-  return groups.filter((group) => group.length);
-}
-
-function positional(tokens, optionsWithValue = new Set()) {
-  const out = [];
-  for (let index = 1; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (optionsWithValue.has(token)) index += 1;
-    else if (!token.startsWith('-') || token === '-') out.push(token);
-  }
-  return out;
-}
-
-function readerOptionPaths(name, tokens) {
-  if (!['rg', 'grep', 'sed'].includes(name)) return [];
-  const paths = [];
-  for (let index = 1; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (token === '-f' || token === '--file') {
-      if (tokens[index + 1]) paths.push(tokens[index + 1]);
-      index += 1;
-    } else if (token.startsWith('--file=')) {
-      paths.push(token.slice('--file='.length));
-    }
-  }
-  return paths;
-}
-
-function findRoots(tokens) {
-  const roots = [];
-  let index = 1;
-  while (['-H', '-L', '-P'].includes(tokens[index]) || /^-O\d+$/.test(tokens[index] || '')) {
-    index += 1;
-  }
-  if (tokens[index] === '-D') index += 2;
-  if (tokens[index] === '--') index += 1;
-  for (; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (token.startsWith('-') || ['!', '(', ')'].includes(token)) break;
-    roots.push(token);
-  }
-  return roots;
-}
-
-function commandPaths(group, globs) {
-  const commandIndex = group.findIndex((token) => (
-    token && !/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)
-  ));
-  if (commandIndex < 0) return [];
-  const tokens = group.slice(commandIndex);
-  while (['sudo', 'env', 'time', 'command'].includes(tokens[0])) tokens.shift();
-  if (!tokens.length) return [];
-  const name = tokens[0].replace(/\\/g, '/').split('/').pop();
-  const optionPaths = readerOptionPaths(name, tokens);
-
-  for (let index = 1; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (token === '-g' || token === '--glob' || token === '--iglob') {
-      if (tokens[index + 1]) globs.push(tokens[index + 1]);
-    } else if (/^--(?:i?glob)=/.test(token)) {
-      globs.push(token.slice(token.indexOf('=') + 1));
-    }
-  }
-
-  if (name === 'rg' || name === 'grep') {
-    const values = positional(tokens, new Set([
-      '-e', '--regexp', '-f', '--file', '-g', '--glob', '--iglob',
-      '-t', '--type', '-T', '--type-not'
-    ]));
-    const explicitPattern = tokens.some((token) => token === '-e' || token === '--regexp');
-    const fileMode = tokens.includes('--files');
-    return [...optionPaths, ...(explicitPattern || fileMode ? values : values.slice(1))];
-  }
-  if (name === 'sed') {
-    const values = positional(tokens, new Set(['-e', '--expression', '-f', '--file']));
-    const explicitScript = tokens.some((token) => (
-      ['-e', '--expression', '-f', '--file'].includes(token)
-    ));
-    return [...optionPaths, ...(explicitScript ? values : values.slice(1))];
-  }
-  if (name === 'find') return findRoots(tokens);
-  if (['cat', 'head', 'tail', 'ls', 'wc', 'du', 'tree', 'file', 'stat', 'cd', 'pushd', 'source', '.'].includes(name)) {
-    return positional(tokens, new Set(['-n', '--lines', '-c', '--bytes']));
-  }
-  return tokens.filter((token) => (
-    /^(?:\.{0,2}[\\/]|~[\\/])/.test(token)
-    || (token.includes('/') && blockedSegment(token))
-  ));
-}
-
-function inspectInput(input) {
-  const paths = [];
-  const globs = [];
-  collectStructured(input, '', paths, globs);
-  const command = typeof input?.command === 'string'
-    ? input.command
-    : typeof input?.cmd === 'string' ? input.cmd : '';
-  for (const group of commandGroups(command)) {
-    paths.push(...commandPaths(group, globs));
-  }
-  return {
-    broadGlob: globs.find(isBroadGlob),
-    blockedPath: paths.map((requested) => ({
-      requested,
-      blocked: blockedSegment(requested)
-    })).find((result) => result.blocked)
-  };
-}
-
-module.exports = {
-  BLOCKED_DIRS,
-  inspectInput
-};
+module.exports = require('../../../claude/hooks/lib/inspect-paths.cjs');

package/src/codex/hooks/lib/privacy-paths.cjs

@@ -0,0 +1 @@
+module.exports = require('../../../claude/hooks/lib/privacy-paths.cjs');

package/src/codex/hooks/lib/privacy-state.cjs

@@ -4,6 +4,7 @@ const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const PATH_SAFETY = require('./runtime-path-safety.cjs');
+const { displayNames } = require('./privacy-paths.cjs');
 
 // Codex cannot raise an interactive prompt from a hook -- PreToolUse honours no
 // "ask" decision -- so approval costs a full round trip: the agent has to relay
@@ -61,13 +62,6 @@ function samePathKeys(left, right) {
     && left.every((value, index) => value === right[index]);
 }
 
-function displayNames(filePaths) {
-  const names = [...new Set(filePaths.map((filePath) => path.basename(filePath)))].sort();
-  return names.length <= 3
-    ? names.join(', ')
-    : `${names.slice(0, 3).join(', ')} (+${names.length - 3} more)`;
-}
-
 function atomicWrite(dir, file, payload) {
   PATH_SAFETY.assertComponentPath(dir, path.dirname(file));
   const temp = `${file}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`;
@@ -84,14 +78,81 @@ function readJson(dir, file) {
   }
 }
 
+function validPending(record, sessionId, requestId, now = Date.now()) {
+  return record?.requestId === requestId && record.sessionId === sessionId
+    && Number.isFinite(record.expiresAt) && record.expiresAt > now
+    && typeof record.displayName === 'string' && record.displayName.length > 0
+    && Array.isArray(record.pathKeys) && record.pathKeys.length > 0
+    && record.pathKeys.every(key => typeof key === 'string' && /^[a-f0-9]{64}$/.test(key));
+}
+
+function writeShortMarker(dir, record) {
+  const { requestId, sessionId, expiresAt } = record;
+  fs.writeFileSync(path.join(dir, `short-${hash(sessionId)}-${requestId}.json`),
+    `${JSON.stringify({ requestId, sessionId, expiresAt })}\n`,
+    { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+}
+
+/** Each prompt owns only markers it successfully renamed, never a shared mutable flag. */
+function claimShortMarkers(projectRoot, sessionId) {
+  const requestIds = [];
+  if (typeof sessionId !== 'string' || !sessionId.trim()) return { ok: true, requestIds };
+  const dir = secureStateDir(projectRoot);
+  if (!dir) return { ok: true, requestIds };
+  const prefix = `short-${hash(sessionId)}-`;
+  let ok = true;
+  for (const name of fs.readdirSync(dir)) {
+    if (!name.startsWith(prefix) || !name.endsWith('.json')) continue;
+    const file = path.join(dir, name);
+    const claimed = path.join(dir, `claim-${crypto.randomBytes(12).toString('hex')}.tmp`);
+    const requestId = name.slice(prefix.length, -'.json'.length);
+    let moved = false;
+    try {
+      PATH_SAFETY.assertComponentPath(dir, file);
+      fs.renameSync(file, claimed);
+      moved = true;
+      requestIds.push(requestId);
+      PATH_SAFETY.assertComponentPath(dir, claimed);
+      const marker = JSON.parse(fs.readFileSync(claimed, 'utf8'));
+      if (!/^[a-f0-9]{24}$/.test(requestId) || marker.requestId !== requestId
+        || marker.sessionId !== sessionId || !Number.isFinite(marker.expiresAt)
+        || marker.expiresAt <= Date.now()) throw new Error('Invalid short approval marker');
+    } catch {
+      ok = false;
+      if (!moved) {
+        // A failed claim cancels the shortcut; deletion never counts as ownership.
+        try { fs.unlinkSync(file); }
+        catch {
+          let descriptor;
+          try {
+            PATH_SAFETY.canonicalRegularFile(dir, file, 'short approval marker');
+            descriptor = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW);
+            fs.ftruncateSync(descriptor, 0);
+          } catch { /* no permission follows a failed invalidation */ }
+          finally {
+            if (descriptor !== undefined) {
+              try { fs.closeSync(descriptor); } catch { /* already rejected */ }
+            }
+          }
+        }
+      }
+    } finally {
+      if (moved) {
+        try { fs.unlinkSync(claimed); } catch { ok = false; }
+      }
+    }
+  }
+  return { ok, requestIds };
+}
+
 function cleanup(projectRoot, now = Date.now()) {
   const dir = secureStateDir(projectRoot);
   if (!dir) return;
   for (const name of fs.readdirSync(dir)) {
-    if (!/^(pending|token)-[a-f0-9]+\.json$/.test(name)) continue;
+    if (!/^(?:(?:pending|token)-[a-f0-9]+|short-[a-f0-9]{64}-[a-f0-9]{24})\.json$/.test(name)) continue;
     const file = path.join(dir, name);
     const record = readJson(dir, file);
-    if (!record || Number(record.expiresAt) <= now) {
+    if (!record || !Number.isFinite(record.expiresAt) || record.expiresAt <= now) {
       try {
         fs.unlinkSync(file);
       } catch {
@@ -101,13 +162,20 @@ function cleanup(projectRoot, now = Date.now()) {
   }
 }
 
-function clearState(projectRoot) {
+function clearState(projectRoot, sessionId) {
   try {
+    if (typeof sessionId !== 'string' || !sessionId.trim()) return;
     const dir = secureStateDir(projectRoot);
     if (!dir) return;
     for (const name of fs.readdirSync(dir)) {
+      if (name.startsWith(`short-${hash(sessionId)}-`) && name.endsWith('.json')) {
+        try { fs.unlinkSync(path.join(dir, name)); } catch { /* concurrently claimed */ }
+        continue;
+      }
       if (/^(pending|token)-[a-f0-9]+\.json$/.test(name)) {
-        try { fs.unlinkSync(path.join(dir, name)); } catch { /* concurrently consumed */ }
+        const file = path.join(dir, name);
+        if (readJson(dir, file)?.sessionId !== sessionId) continue;
+        try { fs.unlinkSync(file); } catch { /* concurrently consumed */ }
       }
     }
   } catch {
@@ -123,26 +191,38 @@ function createPending({
   filePath
 }) {
   cleanup(projectRoot);
-  if (!sessionId) throw new Error('A Codex session ID is required');
+  if (typeof sessionId !== 'string' || !sessionId.trim()) throw new Error('A Codex session ID is required');
   const paths = requestPaths(filePaths, filePath);
   if (paths.length === 0) throw new Error('At least one sensitive path is required');
+  const pathKeys = requestPathKeys(paths, sessionCwd);
+  const dir = secureStateDir(projectRoot, true);
+  for (const name of fs.readdirSync(dir)) {
+    const match = name.match(/^pending-([a-f0-9]{24})\.json$/);
+    if (!match) continue;
+    const pending = readJson(dir, path.join(dir, name));
+    if (validPending(pending, sessionId, match[1]) && samePathKeys(pending.pathKeys, pathKeys)) {
+      try { writeShortMarker(dir, pending); }
+      catch (error) { if (error.code !== 'EEXIST') throw error; }
+      return pending;
+    }
+  }
   const requestId = crypto.randomBytes(12).toString('hex');
   const record = {
     version: 2,
     requestId,
     sessionId: String(sessionId || ''),
-    pathKeys: requestPathKeys(paths, sessionCwd),
+    pathKeys,
     displayName: displayNames(paths),
     expiresAt: Date.now() + TTL_MS
   };
-  const dir = secureStateDir(projectRoot, true);
   atomicWrite(dir, path.join(dir, `pending-${requestId}.json`), record);
+  writeShortMarker(dir, record);
   return record;
 }
 
 function approvePending({ projectRoot, sessionId, requestId }) {
   cleanup(projectRoot);
-  if (!sessionId) return { ok: false, reason: 'session' };
+  if (typeof sessionId !== 'string' || !sessionId.trim()) return { ok: false, reason: 'session' };
   if (!/^[a-f0-9]{24}$/.test(requestId)) return { ok: false, reason: 'invalid' };
 
   const dir = secureStateDir(projectRoot);
@@ -152,6 +232,7 @@ function approvePending({ projectRoot, sessionId, requestId }) {
   if (!record) return { ok: false, reason: 'missing' };
   if (record.sessionId !== String(sessionId || '')) return { ok: false, reason: 'session' };
   if (Number(record.expiresAt) <= Date.now()) return { ok: false, reason: 'expired' };
+  if (!validPending(record, sessionId, requestId)) return { ok: false, reason: 'invalid' };
 
   try {
     fs.unlinkSync(pendingFile);
@@ -218,5 +299,6 @@ module.exports = {
   approvePending,
   hasGrant,
   cleanup,
-  clearState
+  clearState,
+  claimShortMarkers
 };

package/src/codex/hooks/lib/rules-reservation.cjs

@@ -0,0 +1,38 @@
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { hookStateDir } = require('./hook-context.cjs');
+
+function reservationFile(projectRoot, sessionId) {
+  const key = crypto.createHash('sha256')
+    .update(String(sessionId || 'unknown'))
+    .digest('hex')
+    .slice(0, 16);
+  return path.join(hookStateDir(projectRoot), `rules-${key}.json`);
+}
+
+/** Reserve one injection slot per session. Returns null on reservation errors. */
+function reserveSession(projectRoot, sessionId) {
+  if (!sessionId) return null;
+  try {
+    const file = reservationFile(projectRoot, sessionId);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify({ sessionId: String(sessionId) }), {
+      encoding: 'utf8',
+      flag: 'wx',
+      mode: 0o600
+    });
+    return true;
+  } catch (error) {
+    return error.code === 'EEXIST' ? false : null;
+  }
+}
+
+function clearSessionReservation(projectRoot, sessionId) {
+  if (!sessionId) return;
+  try { fs.rmSync(reservationFile(projectRoot, sessionId), { force: true }); } catch { /* fail-open */ }
+}
+
+module.exports = { reserveSession, clearSessionReservation };

package/src/codex/hooks/lib/secret-keywords.cjs

@@ -0,0 +1 @@
+module.exports = require('../../../claude/hooks/lib/secret-keywords.cjs');