@haposoft/cafekit 0.18.1 → 0.18.2

package/bin/__tests__/codex-native-hook-boundaries.test.js

@@ -0,0 +1,136 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+const SOURCE = path.resolve(__dirname, '../../src');
+
+function fixture(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-native-boundaries-'));
+  const hooks = path.join(root, '.codex/hooks');
+  try {
+    fs.cpSync(path.join(SOURCE, 'codex/hooks'), hooks, { recursive: true });
+    for (const name of ['runtime-path-safety', 'privacy-command-analysis', 'privacy-paths', 'secret-keywords', 'inspect-paths', 'update-check']) {
+      fs.copyFileSync(path.join(SOURCE, `claude/hooks/lib/${name}.cjs`), path.join(hooks, `lib/${name}.cjs`));
+    }
+    fs.cpSync(path.join(SOURCE, 'claude/scripts'), path.join(root, '.codex/scripts'), { recursive: true });
+    fs.writeFileSync(path.join(root, '.gitignore'), '.codex/\n');
+    for (const args of [['init', '-q'], ['config', 'user.email', 'probe@example.invalid'], ['config', 'user.name', 'Probe'], ['add', '.gitignore'], ['commit', '-qm', 'base']]) {
+      assert.equal(spawnSync('git', ['-C', root, ...args]).status, 0);
+    }
+    const hook = (name, payload = {}) => spawnSync(process.execPath, [path.join(hooks, `${name}.cjs`)], {
+      cwd: root, input: JSON.stringify({ cwd: root, session_id: 'a', ...payload }), encoding: 'utf8',
+    });
+    run({ root, hooks, hook });
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+}
+function task(root, name, status = 'pending', receipt = '') {
+  const dir = path.join(root, 'specs/demo'); fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(dir, 'plan.md'), '# Plan\nSpecs-Contract: process-first-ready-v1\n');
+  fs.writeFileSync(path.join(dir, name), `# Task\nStatus: ${status}\n## Dependencies\n- none\n## Verification Plan\n- Command: node --test\n${receipt}`);
+}
+
+test('privacy walks nested operation arrays but ignores prose', () => fixture(({ hook }) => {
+  for (const tool_input of [{ operations: [{ path: 'credentials.json' }] }, { operations: [[{ file_path: 'credentials.json' }]] }, { paths: ['credentials.json'] }]) {
+    const result = hook('privacy-block', { tool_name: 'mcp__files__read', tool_input });
+    assert.match(result.stdout, /APPROVE CAFEKIT PRIVACY/);
+    assert.match(JSON.parse(result.stdout).hookSpecificOutput.permissionDecisionReason, /y \(or yes \/ có\)/);
+  }
+  assert.equal(hook('privacy-block', { tool_name: 'mcp__files__read', tool_input: { messages: ['credentials.json', { text: 'credentials.json' }] } }).stdout, '');
+}));
+
+test('privacy-block allows ls when configured specs escapes the project', () => fixture(({ root, hook }) => {
+  fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+  const result = hook('privacy-block', { tool_name: 'Bash', tool_input: { command: 'ls' } });
+  assert.equal(result.status, 0);
+  assert.equal(result.stdout, '');
+}));
+
+test('privacy-block issues approval for a sensitive read when configured specs escapes the project', () => fixture(({ root, hook }) => {
+  fs.writeFileSync(path.join(root, '.env'), '');
+  fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+  const result = hook('privacy-block', { tool_name: 'Bash', tool_input: { command: 'cat .env' } });
+  assert.equal(result.status, 0);
+  const output = JSON.parse(result.stdout).hookSpecificOutput;
+  assert.equal(output.permissionDecision, 'deny');
+  assert.match(output.permissionDecisionReason, /APPROVE CAFEKIT PRIVACY [a-f0-9]{24}/);
+  assert.match(output.permissionDecisionReason, /y \(or yes \/ có\)/);
+}));
+
+test('privacy-approval grants a pending read when configured specs escapes the project', () => fixture(({ root, hook }) => {
+  fs.writeFileSync(path.join(root, '.env'), '');
+  const payload = { tool_name: 'Bash', tool_input: { command: 'cat .env' } };
+  const pending = hook('privacy-block', payload);
+  assert.equal(pending.status, 0);
+  const approval = pending.stdout.match(/APPROVE CAFEKIT PRIVACY [a-f0-9]{24}/);
+  assert.ok(approval, 'the sensitive read must issue a pending approval');
+  fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+  const granted = hook('privacy-approval', { prompt: approval[0] });
+  assert.equal(granted.status, 0);
+  assert.match(granted.stdout, /User approved the pending sensitive access/);
+  const allowed = hook('privacy-block', payload);
+  assert.equal(allowed.status, 0);
+  assert.equal(allowed.stdout, '');
+}));
+
+test('session startup revokes only its own pending requests and grants', () => fixture(({ root, hooks, hook }) => {
+  const privacy = require(path.join(hooks, 'lib/privacy-state.cjs'));
+  const request = { projectRoot: root, sessionCwd: root, sessionId: 'a', filePath: 'credentials.json' };
+  const grant = privacy.createPending(request);
+  assert.equal(privacy.approvePending({ ...request, requestId: grant.requestId }).ok, true);
+  const pending = privacy.createPending(request);
+  for (const session_id of ['b', undefined]) {
+    assert.equal(hook('session', { session_id, hook_event_name: 'SessionStart', source: 'compact' }).status, 0);
+    assert.equal(privacy.hasGrant(request), true);
+    assert.ok(fs.existsSync(path.join(hooks, `.privacy/pending-${pending.requestId}.json`)));
+  }
+  assert.equal(hook('session', { hook_event_name: 'SessionStart', source: 'resume' }).status, 0);
+  assert.equal(privacy.hasGrant(request), false);
+  assert.equal(privacy.approvePending({ ...request, requestId: pending.requestId }).ok, false);
+}));
+
+test('cache persistence failure does not replace receipt authority', () => fixture(({ root, hooks, hook }) => {
+  task(root, 'task-01-work.md');
+  fs.mkdirSync(path.join(hooks, '.logs/spec-gate-last.json'), { recursive: true });
+  assert.equal(hook('spec-gate', { hook_event_name: 'Stop' }).stdout, '');
+  task(root, 'task-01-work.md', 'done');
+  const result = hook('spec-gate', { hook_event_name: 'Stop', explicitFeature: 'demo' });
+  assert.match(JSON.parse(result.stdout).reason, /lack a verification receipt/);
+  assert.doesNotMatch(result.stdout, /EISDIR|controlled failure/);
+  fs.writeFileSync(path.join(root, '.codex/runtime.json'), '{"spec":{"completion_gate":false}}');
+  assert.match(hook('spec-gate', { hook_event_name: 'Stop' }).stdout, /no completion-gate bypass/);
+}));
+
+test('build output directories are allowed while inspection commands stay blocked', () => fixture(({ hook }) => {
+  for (const command of ['vite build --outDir ./dist', 'tsc --outDir ./build', 'npm run build -- --outDir ./dist', 'cargo build --target-dir ./target']) {
+    assert.equal(hook('inspect-block', { tool_name: 'exec_command', tool_input: { command } }).status, 0, command);
+  }
+  for (const command of ['cat dist/index.js', 'find ./dist', 'grep x dist/index.js', 'vite build --outDir ./dist && cat dist/index.js', 'npm exec cat ./dist/index.js', 'vite build --outDir ./dist $(cat dist/index.js)']) {
+    assert.equal(hook('inspect-block', { tool_name: 'exec_command', tool_input: { command } }).status, 2, command);
+  }
+  assert.equal(hook('inspect-block', { tool_input: { path: './dist/index.js' } }).status, 2);
+}));
+
+test('one gate invocation captures one stable snapshot for multiple receipts and rechecks next run', () => fixture(({ root, hook }) => {
+  task(root, 'task-06-pending.md');
+  const provenanceFile = path.join(root, '.codex/scripts/provenance.cjs');
+  const trace = path.join(root, '.codex/manifest-count');
+  fs.writeFileSync(provenanceFile, fs.readFileSync(provenanceFile, 'utf8').replace('function manifest(root, specsRoot) {', `function manifest(root, specsRoot) { fs.appendFileSync(${JSON.stringify(trace)}, 'x');`));
+  const provenance = require(provenanceFile);
+  const context = provenance.deriveRuntimeContext({ projectRoot: root, specsRoot: path.join(root, 'specs'), specFile: path.join(root, 'specs/demo/plan.md'), featureName: 'demo', runtimeSession: 'a' });
+  const receipt = `## Receipt\nVerification: PASS\nCommand: node --test\nExit: 0\nBase: ${context.base}\nHead: ${context.head}\n\`\`\`text\nnode --test\n1 test passed\n\`\`\`\n`;
+  for (let n = 1; n <= 5; n += 1) task(root, `task-0${n}-work.md`, 'done', receipt);
+  for (const args of [['add', 'specs'], ['commit', '-qm', 'packet']]) assert.equal(spawnSync('git', ['-C', root, ...args]).status, 0);
+  fs.writeFileSync(trace, '');
+  assert.equal(hook('spec-gate', { hook_event_name: 'Stop' }).stdout, '');
+  assert.equal(fs.readFileSync(trace, 'utf8').length, 2);
+  fs.writeFileSync(path.join(root, 'changed.js'), 'changed');
+  fs.appendFileSync(path.join(root, 'specs/demo/task-01-work.md'), '\n');
+  const blocked = hook('spec-gate', { hook_event_name: 'Stop' }).stdout;
+  assert.match(blocked, /provenance/);
+  assert.match(blocked, /lines are present but are not the pair/);
+  assert.equal(fs.readFileSync(trace, 'utf8').length, 4);
+}));

package/bin/__tests__/codex-native.test.js

@@ -260,6 +260,99 @@ function parseGeneratedTomlString(content, key) {
   return JSON.parse(match[1]);
 }
 
+test('installed Codex instructions reference all ten runtime rules', () => {
+  inTempProject(root => {
+    const result = install(root);
+    assert.equal(result.status, 0, result.stderr);
+    const instructions = fs.readFileSync(path.join(root, 'AGENTS.md'), 'utf8');
+    const rules = ['workflow', 'ai-dev-rules', 'orchestrator', 'manage-docs', 'skill-workflow-routing', 'skill-domain-routing', 'review-audit-self-decision', 'process-management', 'state-sync', 'hook-protocols'];
+    for (const rule of rules) {
+      assert.ok(instructions.includes(`.codex/rules/${rule}.md`), rule);
+      assert.ok(fs.existsSync(path.join(root, '.codex/rules', `${rule}.md`)), rule);
+    }
+  });
+});
+
+test('installed Codex orchestrator describes high reasoning on the session model', () => {
+  inTempProject(root => {
+    const source = fs.readFileSync(path.join(PACKAGE_ROOT, 'src/claude/rules/orchestrator.md'));
+    const result = install(root);
+    assert.equal(result.status, 0, result.stderr);
+    const content = fs.readFileSync(path.join(root, '.codex/rules/orchestrator.md'), 'utf8');
+    assert.doesNotMatch(content, /strongest|below[^\n]*fable/);
+    assert.match(content, /high reasoning effort/);
+    assert.match(content, /session model unless[^.]*configur/i);
+    assert.deepEqual(fs.readFileSync(path.join(PACKAGE_ROOT, 'src/claude/rules/orchestrator.md')), source);
+  });
+});
+
+test('installed hook protocols share malformed-output handling and Codex receipt guidance', () => {
+  inTempProject(root => {
+    const result = installPlatforms(root, ['claude', 'codex']);
+    assert.equal(result.status, 0, result.stderr);
+    const sentence = 'If hook output is malformed, stop and report the exact failure instead of guessing.';
+    for (const runtime of ['.claude', '.codex']) {
+      const content = fs.readFileSync(path.join(root, runtime, 'rules/hook-protocols.md'), 'utf8');
+      assert.ok(content.includes(sentence), runtime);
+    }
+    assert.match(fs.readFileSync(path.join(root, '.codex/rules/hook-protocols.md'), 'utf8'), /state-sync\.md/);
+  });
+});
+
+test('installed Claude ignore rules preserve env samples and ignore temporary files', () => {
+  inTempProject(root => {
+    const result = installPlatforms(root, ['claude']);
+    assert.equal(result.status, 0, result.stderr);
+    const lines = fs.readFileSync(path.join(root, '.claude/.gitignore'), 'utf8').split(/\r?\n/);
+    for (const line of ['!.env.sample', '!.env.template', '*.tmp']) assert.ok(lines.includes(line), line);
+  });
+});
+
+const READ_ONLY_ROLE_SUFFIX = '\n\n## Read-only role\n\nRead-only role: never create, never edit, and never delete files, and never run commands that write to disk; return findings in your reply.';
+
+function assertInstalledAgentFields(content, name) {
+  const source = fs.readFileSync(path.join(PACKAGE_ROOT, 'src/claude/agents', `${name.replace(/_/g, '-')}.md`), 'utf8');
+  const { frontmatter, body } = require('../lib/codex-frontmatter').splitFrontmatter(source);
+  for (const key of ['name', 'description', 'developer_instructions']) {
+    assert.equal((content.match(new RegExp(`^${key} =`, 'gm')) || []).length, 1);
+  }
+  assert.equal(parseGeneratedTomlString(content, 'name'), name);
+  assert.equal(parseGeneratedTomlString(content, 'description'), normalizeCodexBody(frontmatter.description));
+  const suffix = ['brainstormer', 'code_auditor', 'inspector', 'researcher'].includes(name)
+    ? READ_ONLY_ROLE_SUFFIX : '';
+  const expectedBody = name === 'git_ops'
+    ? body.slice(0, body.indexOf('When instantiated as a team member'))
+      + body.split('\n').find(line => line.includes('NEVER arbitrarily use `force push`')).replace(/^3\. /, '- ') + '\n'
+    : body;
+  assert.equal(parseGeneratedTomlString(content, 'developer_instructions'), normalizeCodexBody(expectedBody).trim() + suffix);
+}
+
+for (const name of ['brainstormer', 'code_auditor', 'inspector', 'researcher']) {
+  test(`installed ${name} agent has exactly one read-only sandbox setting`, () => {
+    inTempProject(root => {
+      const result = install(root);
+      assert.equal(result.status, 0, result.stderr);
+      const content = fs.readFileSync(path.join(root, '.codex/agents', `${name}.toml`), 'utf8');
+      assert.deepEqual(content.match(/^sandbox_mode\s*=.*$/gm) || [], ['sandbox_mode = "read-only"']);
+      assert.ok(parseGeneratedTomlString(content, 'developer_instructions').endsWith(READ_ONLY_ROLE_SUFFIX));
+      assertInstalledAgentFields(content, name);
+    });
+  });
+}
+
+test('installed implementation agents retain their sandbox defaults', () => {
+  inTempProject(root => {
+    const result = install(root);
+    assert.equal(result.status, 0, result.stderr);
+    for (const name of ['implementer', 'test_runner', 'debugger', 'git_ops']) {
+      const content = fs.readFileSync(path.join(root, '.codex/agents', `${name}.toml`), 'utf8');
+      assert.doesNotMatch(content, /^sandbox_mode\s*=/m);
+      assert.doesNotMatch(parseGeneratedTomlString(content, 'developer_instructions'), /## Read-only role/);
+      assertInstalledAgentFields(content, name);
+    }
+  });
+});
+
 function replaceGeneratedTomlString(content, key, value) {
   const pattern = new RegExp(`^${key} = .+$`, 'gm');
   const matches = [...content.matchAll(pattern)];
@@ -816,7 +909,7 @@ function brainstormProjectionIssues(files) {
   }
   if (!skill.includes('Persist only approved decisions and semantics, only with user authority')
     || !skill.includes('redact live secrets, credentials, private keys, access tokens, and unnecessary PII;')
-    || !framework.includes('Do not write "user selected" unless direct user text or the native input tool confirms it.')) {
+    || !framework.includes('Do not write "user selected" unless direct user text or the question in the turn\'s final answer confirms it.')) {
     issues.add('approval-persistence');
   }
   for (const [issue, clause] of Object.entries(adaptiveClauses)) {
@@ -824,9 +917,9 @@ function brainstormProjectionIssues(files) {
   }
   const visible = `${skill}\n${framework}\n${agent}`;
   if (/\bAskUserQuestion\b/.test(visible)
-    || /\b(?:a|an|one|each|every|another|this|that|the|[0-9]+)\s+a structured user-input request\b/i.test(visible)
-    || /\ban structured user-input request\b/i.test(visible)
-    || /\ba structured user-input request\s+(?:calls|batches)\b/i.test(visible)) {
+    || /\b(?:a|an|one|each|every|another|this|that|the|[0-9]+)\s+a question in the turn\'s final answer\b/i.test(visible)
+    || /\ban question in the turn\'s final answer\b/i.test(visible)
+    || /\ba question in the turn\'s final answer\s+(?:calls|batches)\b/i.test(visible)) {
     issues.add('projection-grammar');
   }
   return [...issues].sort();
@@ -1379,26 +1472,26 @@ test('Codex payload transform emits native skill and subagent syntax', () => {
 
 test('Codex payload transform keeps structured user-input grammar across determiners', () => {
   const cases = [
-    ['standalone bare token', 'AskUserQuestion', 'a structured user-input request'],
-    ['standalone code token', '`AskUserQuestion`', 'a structured user-input request'],
-    ['standalone multi-backtick token', '``AskUserQuestion``', 'a structured user-input request'],
-    ['standalone padded multi-backtick token', '`` AskUserQuestion ``', 'a structured user-input request'],
-    ['one', 'one AskUserQuestion call', 'one structured user-input request call'],
-    ['one multi-backtick', 'one ``AskUserQuestion`` call', 'one structured user-input request call'],
-    ['one padded multi-backtick', 'one `` AskUserQuestion `` call', 'one structured user-input request call'],
-    ['each', 'each AskUserQuestion call', 'each structured user-input request call'],
-    ['every', 'every AskUserQuestion batch', 'every structured user-input request batch'],
-    ['another', 'another AskUserQuestion call', 'another structured user-input request call'],
-    ['this', 'this AskUserQuestion call', 'this structured user-input request call'],
-    ['that', 'that AskUserQuestion call', 'that structured user-input request call'],
-    ['a', 'a AskUserQuestion call', 'a structured user-input request call'],
-    ['an', 'an AskUserQuestion call', 'a structured user-input request call'],
-    ['capitalized each', 'Each AskUserQuestion call', 'Each structured user-input request call'],
-    ['capitalized an', 'An AskUserQuestion call', 'A structured user-input request call'],
-    ['the', 'the AskUserQuestion call', 'the structured user-input request call'],
-    ['numeric', '27 AskUserQuestion calls', '27 structured user-input request calls'],
-    ['plural calls', 'AskUserQuestion calls', 'structured user-input request calls'],
-    ['plural batches', 'AskUserQuestion batches', 'structured user-input request batches']
+    ['standalone bare token', 'AskUserQuestion', 'a question in the turn\'s final answer'],
+    ['standalone code token', '`AskUserQuestion`', 'a question in the turn\'s final answer'],
+    ['standalone multi-backtick token', '``AskUserQuestion``', 'a question in the turn\'s final answer'],
+    ['standalone padded multi-backtick token', '`` AskUserQuestion ``', 'a question in the turn\'s final answer'],
+    ['one', 'one AskUserQuestion call', 'one question in the turn\'s final answer call'],
+    ['one multi-backtick', 'one ``AskUserQuestion`` call', 'one question in the turn\'s final answer call'],
+    ['one padded multi-backtick', 'one `` AskUserQuestion `` call', 'one question in the turn\'s final answer call'],
+    ['each', 'each AskUserQuestion call', 'each question in the turn\'s final answer call'],
+    ['every', 'every AskUserQuestion batch', 'every question in the turn\'s final answer batch'],
+    ['another', 'another AskUserQuestion call', 'another question in the turn\'s final answer call'],
+    ['this', 'this AskUserQuestion call', 'this question in the turn\'s final answer call'],
+    ['that', 'that AskUserQuestion call', 'that question in the turn\'s final answer call'],
+    ['a', 'a AskUserQuestion call', 'a question in the turn\'s final answer call'],
+    ['an', 'an AskUserQuestion call', 'a question in the turn\'s final answer call'],
+    ['capitalized each', 'Each AskUserQuestion call', 'Each question in the turn\'s final answer call'],
+    ['capitalized an', 'An AskUserQuestion call', 'A question in the turn\'s final answer call'],
+    ['the', 'the AskUserQuestion call', 'the question in the turn\'s final answer call'],
+    ['numeric', '27 AskUserQuestion calls', '27 question in the turn\'s final answer calls'],
+    ['plural calls', 'AskUserQuestion calls', 'question in the turn\'s final answer calls'],
+    ['plural batches', 'AskUserQuestion batches', 'question in the turn\'s final answer batches']
   ];
 
   for (const [name, input, expected] of cases) {
@@ -1406,27 +1499,27 @@ test('Codex payload transform keeps structured user-input grammar across determi
     assert.equal(actual, expected, name);
     assert.equal(normalizeCodexBody(actual, '/fixture/instructions.md'), expected, `${name} idempotence`);
     assert.doesNotMatch(actual, /\bAskUserQuestion\b/, `${name} Claude-only token`);
-    assert.doesNotMatch(actual, /\ban structured user-input request\b/i, `${name} incompatible article`);
+    assert.doesNotMatch(actual, /\ban question in the turn\'s final answer\b/i, `${name} incompatible article`);
     assert.doesNotMatch(
       actual,
-      /\b(?:a|an|one|each|every|another|this|that|the|[0-9]+)\s+a structured user-input request\b/i,
+      /\b(?:a|an|one|each|every|another|this|that|the|[0-9]+)\s+a question in the turn\'s final answer\b/i,
       `${name} doubled article`
     );
   }
 
   assert.equal(
     normalizeCodexBody('one\nAskUserQuestion call', '/fixture/instructions.md'),
-    'one\nstructured user-input request call',
+    'one\nquestion in the turn\'s final answer call',
     'a single Markdown soft break must preserve its determiner relationship'
   );
   assert.equal(
     normalizeCodexBody('AskUserQuestion\nCalls', '/fixture/instructions.md'),
-    'structured user-input request\nCalls',
+    'question in the turn\'s final answer\nCalls',
     'a single Markdown soft break must preserve a plural relationship'
   );
   assert.equal(
     normalizeCodexBody('one\n\nAskUserQuestion call', '/fixture/instructions.md'),
-    'one\n\na structured user-input request call',
+    'one\n\na question in the turn\'s final answer call',
     'a paragraph break must not bind a prior determiner'
   );
   assert.equal(
@@ -1504,9 +1597,9 @@ test('Codex structured-input corpus oracle stays differential and production-awa
   assert.deepEqual(actualPaths, expectedPaths, 'every source occurrence needs an explicit projection oracle');
 
   const instructionExpectedSnippets = new Map([
-    ['src/claude/skills/git/SKILL.md', 'Present options via a structured user-input request — header'],
-    ['src/claude/skills/scout/SKILL.md', '**Fallback to a structured user-input request:**'],
-    ['src/claude/skills/sync/references/rebind-and-audit.md', 'End by asking with a structured user-input request when the host has']
+    ['src/claude/skills/git/SKILL.md', 'Present options via a question in the turn\'s final answer — header'],
+    ['src/claude/skills/scout/SKILL.md', '**Fallback to a question in the turn\'s final answer:**'],
+    ['src/claude/skills/sync/references/rebind-and-audit.md', 'End by asking with a question in the turn\'s final answer when the host has']
   ]);
   for (const [relativePath, expectedSnippet] of instructionExpectedSnippets) {
     const sourcePath = path.join(PACKAGE_ROOT, relativePath);
@@ -1515,7 +1608,7 @@ test('Codex structured-input corpus oracle stays differential and production-awa
     const withSentinel = source.replace(/`?\bAskUserQuestion\b`?/g, sentinel);
     assert.notEqual(withSentinel, source, `${relativePath} differential control must replace a token`);
     const expected = normalizeCodexBody(withSentinel, sourcePath)
-      .replaceAll(sentinel, 'a structured user-input request');
+      .replaceAll(sentinel, 'a question in the turn\'s final answer');
     const actual = normalizeCodexBody(source, sourcePath);
     assert.equal(actual, expected, `${relativePath} independent differential oracle`);
     assert.match(actual, new RegExp(expectedSnippet.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
@@ -1524,7 +1617,7 @@ test('Codex structured-input corpus oracle stays differential and production-awa
   const specMaker = fs.readFileSync(SPEC_MAKER_SOURCE_PATH, 'utf8');
   const convertedAgent = convertCodexAgentContent(specMaker, path.basename(SPEC_MAKER_SOURCE_PATH));
   assert.doesNotMatch(convertedAgent, /\bAskUserQuestion\b/);
-  assert.doesNotMatch(convertedAgent, /structured user-input request/);
+  assert.doesNotMatch(convertedAgent, /question in the turn\'s final answer/);
 
   const sessionPath = path.join(PACKAGE_ROOT, 'src/claude/hooks/session.cjs');
   const session = normalizeCodexBody(fs.readFileSync(sessionPath, 'utf8'), sessionPath);
@@ -1996,6 +2089,45 @@ function sessionLauncher(projectRoot) {
   return { config, command: config.hooks.SessionStart[0].hooks[0].command };
 }
 
+test('parity regression: moved Codex checkout rebinds both launcher fields and preserves metadata', () => {
+  inTempProject((root) => {
+    const oldRoot = path.join(root, "old ' quoted project"), newRoot = path.join(root, "new ' quoted project");
+    fs.mkdirSync(oldRoot);
+    assert.equal(install(oldRoot).status, 0);
+    const configPath = path.join(oldRoot, '.codex/hooks.json');
+    const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    config.hooks.SessionStart[0].matcher = 'custom-startup';
+    config.hooks.SessionStart[0].hooks[0].timeout = 41;
+    fs.writeFileSync(configPath, JSON.stringify(config));
+    fs.renameSync(oldRoot, newRoot);
+    const movedConfig = path.join(newRoot, '.codex/hooks.json');
+    const before = fs.readFileSync(movedConfig, 'utf8');
+    assert.equal(install(newRoot, ['--dry-run']).status, 0);
+    assert.equal(fs.readFileSync(movedConfig, 'utf8'), before, 'dry run modified launchers');
+    const upgraded = install(newRoot);
+    assert.equal(upgraded.status, 0, `${upgraded.stdout}\n${upgraded.stderr}`);
+    const rebound = sessionLauncher(newRoot);
+    assert.equal(rebound.config.hooks.SessionStart[0].matcher, 'custom-startup');
+    assert.equal(rebound.config.hooks.SessionStart[0].hooks[0].timeout, 41);
+    const launched = runPosixLauncher(rebound.command, newRoot);
+    assert.equal(launched.status, 0, launched.stderr);
+    assert.match(launched.stdout, /Session startup\./);
+    const windowsCommand = rebound.config.hooks.SessionStart[0].hooks[0].commandWindows.replace(/^node /, `"${process.execPath}" `);
+    const launchedWindows = spawnSync(windowsCommand, { cwd: newRoot, encoding: 'utf8', input: JSON.stringify({ session_id: 'moved-windows', hook_event_name: 'SessionStart', source: 'startup', cwd: newRoot }), shell: true });
+    assert.equal(launchedWindows.status, 0, launchedWindows.stderr);
+    assert.match(launchedWindows.stdout, /Session startup\./);
+    for (const { handler } of allHookLaunchers(rebound.config)) {
+      const encoded = handler.commandWindows.match(/\s([A-Za-z0-9_-]+)$/)?.[1];
+      assert.ok(encoded);
+      const target = Buffer.from(encoded, 'base64url').toString('utf8');
+      assert.equal(path.dirname(target), fs.realpathSync(path.join(newRoot, '.codex/hooks')));
+    }
+    const stable = fs.readFileSync(movedConfig, 'utf8');
+    assert.equal(install(newRoot).status, 0);
+    assert.equal(fs.readFileSync(movedConfig, 'utf8'), stable, 'reinstall changed stable hooks config');
+  });
+});
+
 test('Codex POSIX hook launchers run without Git and outside the repository root', () => {
   inTempProject((root) => {
     // A launcher that asks Git for its root gets nothing here and the outer root one
@@ -2248,7 +2380,7 @@ test('Codex installed Specs and spec-maker reject adaptive coverage mutations',
     const questionSkill = path.join(root, '.agents', 'skills', 'ask', 'SKILL.md');
     fs.appendFileSync(questionSkill, '\nUSER-CODEX-SENTINEL\n');
     // Fresh installs are exact. Refresh/upgrade intentionally documents the
-    // A skill file the manifest lists as obsolete is removed on refresh; edited skills stay.
+    // Untracked obsolete files and edited current skills both stay on refresh.
     const obsoleteSpecsRule = path.join(
       root, '.agents', 'skills', 'specs', 'rules', 'design-principles.md'
     );
@@ -2261,8 +2393,8 @@ test('Codex installed Specs and spec-maker reject adaptive coverage mutations',
     assert.match(fs.readFileSync(questionSkill, 'utf8'), /USER-CODEX-SENTINEL/);
     assert.equal(
       fs.existsSync(obsoleteSpecsRule),
-      false,
-      'Codex refresh removes obsolete skill files'
+      true,
+      'Codex refresh preserves untracked obsolete skill files'
     );
 
     const metadataPath = path.join(root, '.codex', 'cafekit.json');
@@ -2277,9 +2409,11 @@ test('Codex installed Specs and spec-maker reject adaptive coverage mutations',
     assert.match(fs.readFileSync(questionSkill, 'utf8'), /USER-CODEX-SENTINEL/);
     assert.equal(
       fs.existsSync(obsoleteSpecsRule),
-      false,
-      'Codex upgrade removes obsolete skill files'
+      true,
+      'Codex upgrade preserves untracked obsolete skill files'
     );
+    assert.match(sameVersion.stdout + sameVersion.stderr, /Preserved 1 obsolete runtime/);
+    assert.match(upgrade.stdout + upgrade.stderr, /Preserved 1 obsolete runtime/);
     assert.ok(fs.readFileSync(path.join(root, 'AGENTS.md'), 'utf8').startsWith(userInstructions));
 
     const forced = install(root, ['--force-overwrite']);
@@ -2509,7 +2643,7 @@ test('Codex installed Brainstorm skill reference and agent preserve proportional
       {
         name: 'decision-provenance-removed',
         source: 'framework',
-        from: 'Do not write "user selected" unless direct user text or the native input tool\n  confirms it.',
+        from: 'Do not write "user selected" unless direct user text or the question in the turn\'s final answer\n  confirms it.',
         to: 'Write "user selected" for inferred defaults.',
         expected: ['approval-persistence']
       },
@@ -2517,7 +2651,7 @@ test('Codex installed Brainstorm skill reference and agent preserve proportional
         name: 'installed-grammar-corruption',
         source: 'skill',
         from: '## Completion bar',
-        to: 'one a structured user-input request call\n\n## Completion bar',
+        to: 'one a question in the turn\'s final answer call\n\n## Completion bar',
         expected: ['projection-grammar']
       }
     ];
@@ -3079,28 +3213,28 @@ test('Codex installed code_auditor carries no Strict attestation marker', () =>
   });
 });
 
-test('reinstall removes obsolete scripts and skill files from Codex and omp installs', () => {
-  inTempProject((root) => {
+test('reinstall preserves untracked Codex runtime files while omp keeps its cleanup policy', () => {
+  for (const platform of ['codex', 'omp']) inTempProject(root => {
     const first = installPlatforms(root, ['codex', 'omp']);
     assert.equal(first.status, 0, `${first.stdout}\n${first.stderr}`);
+    const runtime = `.${platform}`;
     const retired = ['change-firewall.cjs', 'spec-final-state.cjs'];
-    for (const runtime of ['.codex', '.omp']) {
-      for (const name of retired) fs.writeFileSync(path.join(root, runtime, 'scripts', name), 'legacy\n');
-    }
-    const retiredSkillFiles = ['code-review/references/verification-gate.md', 'specs/references/archive-workflow.md'];
-    for (const rel of retiredSkillFiles) fs.writeFileSync(path.join(root, '.agents', 'skills', rel), 'legacy\n');
-    const again = installPlatforms(root, ['codex', 'omp'], ['--force-overwrite']);
-    assert.equal(again.status, 0, `${again.stdout}\n${again.stderr}`);
+    for (const name of retired) fs.writeFileSync(path.join(root, runtime, 'scripts', name), 'legacy\n');
+    const retiredSkillFiles = platform === 'codex'
+      ? ['code-review/references/verification-gate.md', 'specs/references/archive-workflow.md'] : [];
     for (const rel of retiredSkillFiles) {
-      assert.equal(fs.existsSync(path.join(root, '.agents', 'skills', rel)), false, `.agents/skills/${rel} must be removed`);
-    }
-    assert.equal(fs.existsSync(path.join(root, '.agents', 'skills', 'code-review', 'SKILL.md')), true, 'the code-review skill stays');
-    for (const runtime of ['.codex', '.omp']) {
-      for (const name of retired) {
-        assert.equal(fs.existsSync(path.join(root, runtime, 'scripts', name)), false, `${runtime}/scripts/${name} must be removed`);
-      }
-      assert.equal(fs.existsSync(path.join(root, runtime, 'scripts', 'spec-resolver.cjs')), true, `${runtime} keeps the resolver`);
+      const target = path.join(root, '.agents/skills', rel);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.writeFileSync(target, 'legacy\n');
     }
+    const again = installPlatforms(root, [platform], ['--force-overwrite']);
+    assert.equal(again.status, 0, `${again.stdout}\n${again.stderr}`);
+    const preserved = platform === 'codex';
+    for (const rel of retiredSkillFiles) assert.equal(fs.existsSync(path.join(root, '.agents/skills', rel)), preserved, rel);
+    for (const name of retired) assert.equal(fs.existsSync(path.join(root, runtime, 'scripts', name)), preserved, name);
+    if (preserved) assert.match(again.stdout + again.stderr, /Preserved 4 obsolete runtime/);
+    assert.equal(fs.existsSync(path.join(root, '.agents/skills/code-review/SKILL.md')), true);
+    assert.equal(fs.existsSync(path.join(root, runtime, 'scripts/spec-resolver.cjs')), true);
   });
 });
 
@@ -3222,4 +3356,3 @@ test('Claude and Codex installed rules preserve the ported review and process gu
     }
   });
 });
-