@haposoft/cafekit 0.18.1 → 0.18.2

package/src/codex/hooks/spec-gate.cjs

@@ -31,6 +31,7 @@ function sessionIdentity(payload) {
   return candidates.find((value) => typeof value === 'string' && value.trim() !== '') || null;
 }
 
+let hasDoneTasks = false;
 try {
   const payload = readPayload();
   if (payload.stop_hook_active === true) process.exit(0);
@@ -41,6 +42,8 @@ try {
     process.exit(0);
   }
   const POLICY = loaded.policy;
+  // Match Claude: one invocation validates receipts against one checkout snapshot.
+  require(path.join(path.dirname(loaded.path), 'provenance.cjs')).enableSnapshotMemo();
   const { projectRoot, runtime } = getHookContext(payload);
   if (typeof POLICY.deriveRuntimeContext !== 'function') {
     throw new Error('shared workflow policy lacks completion authority functions');
@@ -56,6 +59,8 @@ try {
   }
   if (!resolved) process.exit(0);
   if (resolved.layoutKind === 'process-v3-completed-set') {
+    hasDoneTasks = resolved.candidates.some(candidate =>
+      Object.values(candidate.taskRegistry || {}).some(task => task?.status === 'done'));
     const configuredGate = runtime.spec?.completion_gate;
     if (configuredGate !== undefined && configuredGate !== true) {
       emitBlock('Completion gate: runtime.spec.completion_gate is a worker-writable flag, not an authorization; no completion-gate bypass is supported. Remove the flag and satisfy the gate.');
@@ -98,6 +103,7 @@ try {
   }
   if (resolved.error) process.exit(0);
   const active = resolved;
+  hasDoneTasks = Object.values(active.taskRegistry || {}).some(task => task?.status === 'done');
   const runtimeContext = POLICY.deriveRuntimeContext({
     projectRoot,
     specsRoot: active.specsDir,
@@ -143,13 +149,12 @@ try {
     currentStatuses[taskPath] === 'done'
   ));
   const featureDir = path.join(active.specsDir, active.featureName);
-  const receiptBodies = new Map();
   const failures = allDoneTasks
     .map((taskPath) => {
       const proof = checkWorkflowReceiptDetails(featureDir, taskPath, runtimeContext);
-      if (proof.body) receiptBodies.set(taskPath, proof.body);
       return {
         taskPath,
+        body: proof.body,
         failures: proof.failures
       };
     })
@@ -160,9 +165,11 @@ try {
     if (previous[result.taskPath] === undefined) delete next[result.taskPath];
     else next[result.taskPath] = previous[result.taskPath];
   }
-  atomicWrite(cacheFile, `${JSON.stringify({
-    entries: { ...cacheEntries, [runtimeContext.context_id]: { identity: cacheIdentity, tasks: next } },
-  })}\n`);
+  try {
+    atomicWrite(cacheFile, `${JSON.stringify({
+      entries: { ...cacheEntries, [runtimeContext.context_id]: { identity: cacheIdentity, tasks: next } },
+    })}\n`);
+  } catch { /* Cache persistence is not completion authority. */ }
 
   if (!failures.length) process.exit(0);
   const lines = [`Completion gate: ${failures.length} done task(s) lack a verification receipt.`];
@@ -175,6 +182,14 @@ try {
     reason: lines.slice(0, 8).join('\n')
   })}\n`);
 } catch (error) {
+  if (error.code === 'no_git_history') {
+    if (hasDoneTasks) emitBlock('Completion gate: repo has no commits yet; create the first commit, then record Base/Head after it.');
+    process.exit(0);
+  }
   logCrash('spec-gate', error);
-  emitBlock(`Completion gate controlled failure: ${error.message}. Completion is blocked until the hook is repaired.`);
+  if (/^(?:runtime\.paths\.specs|configured specs root)/.test(error.message)) {
+    emitBlock(`Completion gate: invalid workflow packet detected (<specs>): ${error.message}. Fix the packet's plan.md or task files before completing tasks.`);
+  } else {
+    emitBlock(`Completion gate controlled failure: ${error.message}. Completion is blocked until the hook is repaired.`);
+  }
 }

package/src/codex/hooks/spec-state.cjs

@@ -25,9 +25,16 @@ function cacheFile(projectRoot, sessionId) {
   return path.join(hookStateDir(projectRoot), `tollgate-${key}.txt`);
 }
 
+let mutationObserver = false;
 try {
   const payload = readPayload();
+  mutationObserver = payload?.hook_event_name === 'PostToolUse';
   if (!payload) process.exit(0);
+  const context = getHookContext(payload);
+  const { touchSession } = require('./lib/spec-session-touch.cjs');
+  const touch = touchSession(payload, context);
+  // Mutation observers only persist paths. They must not inspect packet state or proof.
+  if (payload.hook_event_name === 'PostToolUse') process.exit(0);
   const loaded = loadSharedPolicy();
   if (!loaded.policy) {
     logCrash('spec-state', loaded.error);
@@ -35,13 +42,14 @@ try {
     process.exit(0);
   }
   const POLICY = loaded.policy;
+  require(path.join(path.dirname(loaded.path), 'provenance.cjs')).enableSnapshotMemo();
   const receiptLoaded = loadSharedReceipt();
   if (!receiptLoaded.receipt) throw receiptLoaded.error;
   const RECEIPT = receiptLoaded.receipt;
-  const { projectRoot, runtime } = getHookContext(payload);
+  const { projectRoot, runtime } = context;
   if (runtime.spec?.tollgate === false) process.exit(0);
   const { findLegacyPackets, resolveWorkflowCandidate } = require('./lib/spec-utils.cjs');
-  const sessionId = payload.session_id || payload.sessionId || payload.sessionID || payload.session?.id;
+  const sessionId = touch.sessionId;
   // A legacy packet (a specs/<x>/ directory without plan.md that the old flow left
   // behind) is no longer read. Say so once per session instead of on every prompt.
   const legacyPackets = findLegacyPackets(projectRoot, runtime);
@@ -62,9 +70,22 @@ try {
       try { atomicWrite(noticeFile, `${JSON.stringify([...noticed, ...fresh].sort())}\n`); } catch { /* repeats the notice */ }
     }
   }
-  const explicitFeature = payload.featureName || payload.feature || payload.explicitFeature || null;
-  const explicitPath = payload.specPath || payload.spec_path || payload.featurePath || null;
-  const resolved = resolveWorkflowCandidate(projectRoot, runtime, explicitFeature, explicitPath);
+  const explicitFeature = payload.explicitFeature ?? payload.featureName ?? payload.feature ?? null;
+  const explicitPath = payload.explicitPath ?? payload.specPath ?? payload.spec_path ?? payload.featurePath ?? null;
+  const hasExplicit = explicitFeature !== null || explicitPath !== null;
+  if (sessionId && !hasExplicit && touch.touched.length === 0) process.exit(0);
+  let resolved;
+  if (sessionId && !hasExplicit) {
+    const names = touch.names.length ? touch.names : touch.touched;
+    const candidates = names.map((name) => resolveWorkflowCandidate(projectRoot, runtime, name, null));
+    resolved = candidates.find((candidate) => candidate?.error);
+    const active = candidates.filter((candidate) => candidate && !candidate.error && !candidate.allTasksDone);
+    if (!resolved) resolved = active.length > 1
+      ? { error: 'multiple_active', candidates: active.map((candidate) => candidate.featureName) }
+      : active[0] || null;
+  } else {
+    resolved = resolveWorkflowCandidate(projectRoot, runtime, explicitFeature, explicitPath);
+  }
   if (!resolved) process.exit(0);
   if (resolved.error === 'multiple_active') {
     process.stdout.write(`> ⚠️ Multiple active specs detected: ${resolved.candidates.join(', ')}. Provide explicit feature target or resolve ambiguity. Tollgate paused.\n`);
@@ -153,6 +174,7 @@ try {
   const lines = [
     `### Spec state changed: \`${active.featureName}\``,
     `- Phase: \`${phase}\` | Tasks: ${counts.done || 0} done / ${tasks.length} total`
+      + (tasks.length > 0 ? ` (${counts.in_progress || 0} in_progress, ${counts.pending || 0} pending, ${counts.blocked || 0} blocked)` : '')
   ];
   if (next) lines.push(`- Next unblocked: \`${next[0]}\``);
   if (active.queueReady === false) {
@@ -165,6 +187,10 @@ try {
   );
   process.stdout.write(`${lines.join('\n')}\n`);
 } catch (error) {
+  if (error.code === 'no_git_history') {
+    console.log('Repo has no commits yet; create the first commit, then record Base/Head after it.');
+    process.exit(0);
+  }
   logCrash('spec-state', error);
-  emitControlledFailure(error.message);
+  if (!mutationObserver) emitControlledFailure(error.message);
 }

package/src/codex/hooks/state.cjs

@@ -3,6 +3,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { containsSecretKeyword } = require('./lib/secret-keywords.cjs');
 const {
   getHookContext,
   logCrash,
@@ -34,6 +35,11 @@ function summary(value, limit = 600) {
   return clean.length > limit ? `${clean.slice(0, limit)}…` : clean;
 }
 
+function assistantSummary(value) {
+  const text = summary(value, Number.MAX_SAFE_INTEGER);
+  return containsSecretKeyword(text) ? '[omitted: possible secret]' : summary(text);
+}
+
 function normalizeTodos(items) {
   if (!Array.isArray(items)) return [];
   return items.map((item, index) => ({
@@ -74,11 +80,24 @@ function isTrackedTool(toolName) {
   const name = String(toolName || '').toLowerCase();
   return name === 'agent'
     || name === 'spawn_agent'
+    || name === 'collaborationspawn_agent'
     || name === 'update_plan'
     || name.includes('task')
     || name.includes('todo');
 }
 
+function hasPriorContent(text) {
+  const filler = [
+    /^#{1,6}\s/,
+    /^<!--.*-->$/,
+    /^- \((?:No completed tasks recorded|No pending tasks recorded|All tasks completed|No file changes detected)\)$/,
+    /^- Completed at \d{2}:\d{2}:\d{2}$/,
+    /^- Completed without a result message\.$/,
+  ];
+  return text.split('\n').map((line) => line.trim())
+    .some((line) => line && !filler.some((pattern) => pattern.test(line)));
+}
+
 function loadPrevious(projectRoot, sessionId) {
   try {
     const dir = stateDir(projectRoot, sessionId);
@@ -87,7 +106,9 @@ function loadPrevious(projectRoot, sessionId) {
     if (!fs.existsSync(file)) return '';
     const text = fs.readFileSync(file, 'utf8');
     const generated = text.match(/<!-- Generated: (.+?) -->/)?.[1];
-    if (!generated || Date.now() - Date.parse(generated) > EXPIRY_MS) return '';
+    const timestamp = Date.parse(generated);
+    if (!generated || !Number.isFinite(timestamp) || Date.now() - timestamp > EXPIRY_MS) return '';
+    if (!hasPriorContent(text)) return '';
     return text;
   } catch {
     return '';
@@ -118,7 +139,7 @@ try {
       const data = readData(dir);
       const input = payload.tool_input || {};
       const response = payload.tool_response;
-      updateTaskState(data, input, response);
+      if (!['spawn_agent', 'collaborationspawn_agent'].includes(String(toolName).toLowerCase())) updateTaskState(data, input, response);
       data.lastToolEvent = `${toolName}: ${summary(response) || summary(input)}`.slice(0, 700);
       refreshGit(data, projectRoot);
       writeData(dir, data);
@@ -135,7 +156,7 @@ try {
       data.agentResults.push({
         id,
         type: String(payload.agent_type || 'unknown'),
-        message: summary(payload.last_assistant_message)
+        message: assistantSummary(payload.last_assistant_message)
       });
       refreshGit(data, projectRoot);
       writeData(dir, data);
@@ -147,7 +168,7 @@ try {
   if (event === 'Stop') {
     withStateLock(projectRoot, sessionId, (dir) => {
       const data = readData(dir);
-      data.lastAssistant = summary(payload.last_assistant_message);
+      data.lastAssistant = assistantSummary(payload.last_assistant_message);
       refreshGit(data, projectRoot);
       writeData(dir, data);
       archive(dir);

package/src/codex/hooks.json

@@ -10,11 +10,6 @@
             "command": "node \".codex/hooks/session.cjs\"",
             "commandWindows": "node \".codex/hooks/session.cjs\""
           },
-          {
-            "type": "command",
-            "command": "node \".codex/hooks/docs-sync.cjs\"",
-            "commandWindows": "node \".codex/hooks/docs-sync.cjs\""
-          },
           {
             "type": "command",
             "command": "node \".codex/hooks/state.cjs\"",
@@ -23,6 +18,18 @@
         ]
       }
     ],
+    "PreCompact": [
+      {
+        "matcher": "auto|manual",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \".codex/hooks/precompact.cjs\"",
+            "commandWindows": "node \".codex/hooks/precompact.cjs\""
+          }
+        ]
+      }
+    ],
     "SubagentStart": [
       {
         "matcher": "*",
@@ -57,13 +64,18 @@
             "type": "command",
             "command": "node \".codex/hooks/spec-state.cjs\"",
             "commandWindows": "node \".codex/hooks/spec-state.cjs\""
+          },
+          {
+            "type": "command",
+            "command": "node \".codex/hooks/ask-guard.cjs\"",
+            "commandWindows": "node \".codex/hooks/ask-guard.cjs\""
           }
         ]
       }
     ],
     "PreToolUse": [
       {
-        "matcher": "Bash|exec_command|apply_patch|Edit|Write|Read|Glob|Grep|mcp__.*|shell",
+        "matcher": "Bash|exec_command|shell|apply_patch|mcp__.*|collaborationspawn_agent|collaborationwait_agent",
         "hooks": [
           {
             "type": "command",
@@ -76,11 +88,21 @@
             "commandWindows": "node \".codex/hooks/inspect-block.cjs\""
           }
         ]
+      },
+      {
+        "matcher": "apply_patch",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \".codex/hooks/ask-guard.cjs\"",
+            "commandWindows": "node \".codex/hooks/ask-guard.cjs\""
+          }
+        ]
       }
     ],
     "PostToolUse": [
       {
-        "matcher": "Agent|spawn_agent|update_plan|task|Task|TodoWrite",
+        "matcher": "collaborationspawn_agent|Agent|spawn_agent|update_plan",
         "hooks": [
           {
             "type": "command",
@@ -88,6 +110,16 @@
             "commandWindows": "node \".codex/hooks/state.cjs\""
           }
         ]
+      },
+      {
+        "matcher": "apply_patch",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \".codex/hooks/spec-state.cjs\"",
+            "commandWindows": "node \".codex/hooks/spec-state.cjs\""
+          }
+        ]
       }
     ],
     "Stop": [

package/src/codex/rules/hook-protocols.md

@@ -5,16 +5,22 @@ Hooks are instruction boundaries. Do not bypass or work around them.
 ## Privacy Block Hook
 
 Codex cannot pause a blocked tool call for an interactive permission question.
-CafeKit therefore denies the sensitive access and emits one exact approval
-phrase tied to the current session, requested path, tool, and expiry.
+CafeKit denies sensitive access and offers a short reply and an exact fallback
+phrase. A grant is reusable for one hour in the same session for exactly the
+approved paths; it is not tied to a tool.
 
 Required flow:
 
 1. Stop the blocked access and show the user the hook's reason.
-2. Ask the user to send the exact approval phrase if they want one retry.
-3. Do not write, repeat as a user message, or otherwise simulate that phrase.
-4. Retry only after a later real user prompt exactly matches it.
-5. Use the resulting token once, only for the originally blocked operation.
+2. Ask one privacy question as the only question at the end of the turn, naming
+   exactly the files shown in the denial. Do not add any other yes/no question.
+3. Explain that the user's very next message may be `y`, `yes`, or `có` only
+   while exactly one request is pending; any other reply cancels the shortcut.
+   The exact `APPROVE CAFEKIT PRIVACY <id>` prompt remains the fallback.
+4. Never send, repeat as a user message, or simulate either a short approval or
+   the exact fallback phrase. Wait for a real user prompt and the approval hook.
+5. After approval, tell the user which paths were just granted before reading
+   them. Access only those exact paths during the one-hour session grant.
 
 Never use another command, path, encoding, subprocess, or side channel to read a
 privacy-blocked file without that explicit approval.
@@ -24,6 +30,7 @@ privacy-blocked file without that explicit approval.
 - If a hook reports state drift, run the appropriate sync or audit flow before continuing.
 - If a hook rejects task completion, keep the task `in_progress` or `blocked` until proof exists.
 - Do not mark a task `done` unless the matching task file contains a valid verification receipt.
+- Read `state-sync.md` for the receipt contract.
 
 ## Hook Failure Handling
 

package/src/omp/extensions/cafekit-bridge.mjs

@@ -38,16 +38,16 @@ export const BRIDGE_TIMEOUT_MS = 8000;
  * Mirrors src/claude/settings/settings.json; `omp-bridge.test.js` fails if the two drift.
  */
 export const DISPATCH = {
-  session_start:          { event: 'SessionStart',     hooks: ['session.cjs', 'docs-sync.cjs', 'state.cjs'] },
+  session_start:          { event: 'SessionStart',     hooks: ['session.cjs', 'state.cjs'] },
   session_compact:        { event: 'SessionStart',     hooks: ['session.cjs'], source: 'compact' },
   session_before_compact: { event: 'PreCompact',       hooks: ['precompact.cjs'] },
   input:                  { event: 'UserPromptSubmit', hooks: ['secret-output-guardrail.cjs', 'rules.cjs', 'spec-state.cjs'] },
   tool_call:              { event: 'PreToolUse',       hooks: ['privacy-block.cjs', 'inspect-block.cjs'] },
-  tool_result:            { event: 'PostToolUse',      hooks: ['state.cjs'] },
+  tool_result:            { event: 'PostToolUse',      hooks: ['state.cjs', 'spec-state.cjs'] },
   session_stop:           { event: 'Stop',             hooks: ['spec-gate.cjs', 'state.cjs'] },
 };
 
-/** One id per extension load. omp loads an extension once per session, so this is per-session. */
+/** Fallback id per extension load, for an omp whose context has no session manager. */
 const SESSION_ID = `omp-${randomUUID()}`;
 
 export function hooksDir() {
@@ -55,13 +55,21 @@ export function hooksDir() {
   return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'hooks');
 }
 
+function sessionIdFrom(ctx) {
+  try {
+    const id = ctx?.sessionManager?.getSessionId?.();
+    return typeof id === 'string' && id ? id : null;
+  } catch { return null; }
+}
+
 /** Build the Claude-shaped payload a CafeKit hook reads on stdin. */
 export function shapePayload(kind, event, ctx) {
   const entry = DISPATCH[kind];
   const cwd = ctx?.cwd || process.cwd();
   const payload = {
     hook_event_name: entry.event,
-    session_id: event?.session_id || SESSION_ID,
+    // omp's own id first: session_stop carries it, and touch and state must stay in one place.
+    session_id: event?.session_id || sessionIdFrom(ctx) || SESSION_ID,
     cwd,
   };
   switch (kind) {

package/src/omp/hooks/privacy-block.cjs

@@ -14,32 +14,23 @@
  * Exit: 0 (the JSON hook output carries the permission decision)
  */
 
-try {
-  const fs = require('fs');
-  const path = require('path');
-  const { commandAccess } = require('./lib/privacy-command-analysis.cjs');
+const EVALUATION_FAILURE = 'Sensitive access could not be evaluated safely.';
 
-  const RESTRICTED_PATTERNS = [
-    /^\.env(?:[.\[*?{]|$)/i,
-    /^credentials/i,
-    /secrets?\.(ya?ml|json)$/i,
-    /\.pem$/i,
-    /\.key$/i,
-    /\.p12$/i,
-    /\.pfx$/i,
-    /^id_(rsa|ed25519|ecdsa|dsa)$/i,
-    /\.netrc$/i,
-    /\.pgpass$/i,
-    /kubeconfig/i,
-    /\.keystore$/i,
-    /\.jks$/i,
-    /auth\.json$/i,
-    /token(s)?\.json$/i
-  ];
+function askForPermission(reason) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      // omp has no ask state on tool_call, so an ask under Claude becomes a denial here.
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason
+    }
+  }) + '\n');
+}
 
-  const ALLOWED_EXEMPTIONS = [
-    /\.env\.(example|sample|template|test)$/i
-  ];
+try {
+  const fs = require('fs');
+  const { sensitivePaths, displayNames } = require('./lib/privacy-paths.cjs');
+  const { projectRoot: resolveProjectRoot } = require('./lib/project-root.cjs');
 
   const { runtimeDirName, runtimeDir, runtimePath } = require('./lib/runtime-dir.cjs');
   function readRuntime(cwd) {
@@ -51,200 +42,27 @@ try {
     }
   }
 
-  function isSafe(filePath) {
-    const base = path.basename(filePath);
-    return ALLOWED_EXEMPTIONS.some((rule) => rule.test(base) || rule.test(filePath));
-  }
-
-  function isSensitive(filePath) {
-    const base = path.basename(filePath);
-    return RESTRICTED_PATTERNS.some((rule) => rule.test(base) || rule.test(filePath));
-  }
-
-  /**
-   * Resolve a symlink to its real target so a harmless-looking name that points
-   * at a sensitive file cannot slip through the basename check. Returns null
-   * when the path cannot be resolved (missing file, broken link) — fail-open to
-   * the original-path check in that case. See isSymlinkToSensitive for dangling handling.
-   */
-  function resolveTarget(filePath, cwd) {
-    try {
-      const requested = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
-      return fs.realpathSync(requested);
-    } catch {
-      return null;
-    }
-  }
-
-  /**
-   * When realpath fails, check whether the requested path is a symlink (or chain)
-   * whose lexical target is sensitive. Dangling link to protected target -> true (fail-closed ask);
-   * dangling benign link or link to allowed example/template -> false (allow).
-   * Limit hops to avoid loops; malformed/looping -> fail closed.
-   * TOCTOU note: check and use are not atomic; target could be swapped between this check and the actual read.
-   * This is a best-effort guardrail, not an arbitrary-shell security boundary. For strong isolation use OS sandbox.
-   */
-  function isSymlinkToSensitive(filePath, cwd) {
-    try {
-      const requested = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
-      let current = requested;
-      let hops = 0;
-      const MAX_HOPS = 8;
-      while (hops < MAX_HOPS) {
-        let stat;
-        try {
-          stat = fs.lstatSync(current);
-        } catch {
-          return false;
-        }
-        if (!stat.isSymbolicLink()) return false;
-        let linkTarget;
-        try {
-          linkTarget = fs.readlinkSync(current);
-        } catch {
-          return true;
-        }
-        if (isSensitive(linkTarget) && !isSafe(linkTarget)) return true;
-        if (isSafe(linkTarget)) return false;
-        const next = path.isAbsolute(linkTarget) ? linkTarget : path.resolve(path.dirname(current), linkTarget);
-        if (next === current) return true;
-        try {
-          const real = fs.realpathSync(next);
-          if (isSensitive(real) && !isSafe(real)) return true;
-          if (isSafe(real)) return false;
-          return false;
-        } catch {
-          current = next;
-          hops += 1;
-          continue;
-        }
-      }
-      return true;
-    } catch {
-      return true;
-    }
-  }
-
-  function extractBashPaths(command) {
-    // The analyzer parses the command and returns the operands of every reading
-    // command it recognises, nested shells and `find -exec` included. Treating
-    // every unresolved expansion as sensitive, as this did before, asked on
-    // `cat $FILE`, `wc -l *.cjs` and `cat ~/.zshrc` alike. Noise is what trains
-    // people to click through the prompt that matters.
-    // A heredoc whose delimiter is quoted (<<'BODY') is inert: the shell
-    // expands nothing inside it, so no word in the body is ever read. The
-    // analyzer has no notion of heredocs and parses the body as shell, so prose
-    // that quotes a command -- a PR body carrying `cat .env` in backticks --
-    // came back as a real command substitution. Blank those bodies out first.
-    // An unquoted delimiter (<<BODY) does expand, so it is left to the
-    // analyzer.
-    const scrubbed = String(command).replace(
-      /(<<-?[ \t]*)(['"])([A-Za-z_]\w*)\2[^\n]*\n[\s\S]*?\n[ \t]*\3\b/g,
-      '$1$2$3$2'
-    );
-
-    const paths = new Set(commandAccess(scrubbed).paths);
-
-    // Two shapes the analyzer cannot return. It drops any word carrying an
-    // expansion, so `~/.ssh/id_rsa` and `certs/*.pem` still have to be matched
-    // by name. And it only walks commands it recognises, so an unknown tool
-    // handed a secret through a file-shaped option, such as
-    // `docker compose --env-file .env`, is invisible to it.
-    const FILE_OPTION = /^--?[\w-]*(?:file|config|key|cert|identity)$/i;
-    const tokens = scrubbed.split(/[\s|;&<>"'()`]+/);
-    for (let index = 0; index < tokens.length; index += 1) {
-      const token = tokens[index];
-      const shaped = /^~|[*?[{]/.test(token);
-      const optionFed = index > 0 && FILE_OPTION.test(tokens[index - 1]);
-      if (!shaped && !optionFed) continue;
-      const value = token.replace(/^~/, '').replace(/^["'()`]+|["'(),]+$/g, '');
-      if (value && isSensitive(value) && !isSafe(value)) paths.add(value);
-    }
-
-    return [...paths];
-  }
-
-  function extractPaths(toolName, input) {
-    const paths = [];
-    if (!input) return paths;
-
-    for (const key of ['file_path', 'path']) {
-      if (typeof input[key] === 'string' && input[key].trim()) {
-        paths.push(input[key].trim());
-      }
-    }
-
-    for (const key of ['paths', 'search_paths']) {
-      if (Array.isArray(input[key])) {
-        paths.push(...input[key].filter(Boolean));
-      }
-    }
-
-    if (toolName === 'Bash' && typeof input.command === 'string') {
-      paths.push(...extractBashPaths(input.command));
-    }
-
-    return paths.filter(Boolean);
-  }
-
-  function askForPermission(filePath) {
-    const basename = path.basename(filePath);
-    process.stdout.write(JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: 'PreToolUse',
-        // omp has no ask state on tool_call, so an ask under Claude becomes a denial here.
-        permissionDecision: 'deny',
-        permissionDecisionReason: `Sensitive file access requires approval: ${basename}`
-      }
-    }) + '\n');
-  }
-
   const stdin = fs.readFileSync(0, 'utf8').trim();
-  if (!stdin) process.exit(0);
+  if (!stdin) {
+    askForPermission(EVALUATION_FAILURE);
+    process.exit(0);
+  }
 
   const { normalizeHookPayload } = require('./lib/hook-payload.cjs');
   const data = normalizeHookPayload(JSON.parse(stdin));
   const toolName = data.tool_name || '';
   const toolInput = data.tool_input || {};
   const cwd = typeof data.cwd === 'string' && data.cwd.trim() ? data.cwd : process.cwd();
-  const runtime = readRuntime(cwd);
+  const projectRoot = resolveProjectRoot(data);
+  const runtime = readRuntime(projectRoot);
 
   if (runtime.privacyBlock === false) process.exit(0);
 
-  const paths = extractPaths(toolName, toolInput);
-  if (!paths.length) process.exit(0);
-
-  for (const filePath of paths) {
-    const target = resolveTarget(filePath, cwd);
-
-    // The real target is authoritative: an exempt-looking alias must not hide
-    // a sensitive target, while a real .env.example target remains safe.
-    if (target) {
-      if (isSensitive(target) && !isSafe(target)) {
-        askForPermission(filePath);
-        process.exit(0);
-      }
-      if (isSafe(target)) continue;
-    } else {
-      if (isSymlinkToSensitive(filePath, cwd)) {
-        askForPermission(filePath);
-        process.exit(0);
-      }
-    }
-
-    if (isSafe(filePath) || !isSensitive(filePath)) continue;
-    askForPermission(filePath);
-    process.exit(0);
-  }
+  const paths = sensitivePaths(toolName, toolInput, cwd);
+  if (paths.length) askForPermission(`Sensitive file access requires approval: ${displayNames(paths)}`);
 
   process.exit(0);
 } catch (_) {
-  process.stdout.write(JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: 'deny',
-      permissionDecisionReason: 'Sensitive access could not be evaluated safely.'
-    }
-  }) + '\n');
+  askForPermission(EVALUATION_FAILURE);
   process.exit(0);
 }