@haposoft/cafekit 0.18.1 → 0.18.2

package/bin/phases/codex-runtime.js

@@ -5,7 +5,8 @@ const path = require('path');
 const { PLATFORMS } = require('../lib/context');
 const { writeManagedFile, copyManagedTree } = require('../lib/managed-writer');
 const { report, treeAction } = require('./report');
-const { copyRulesDirectory, copyOutputStylesDirectory } = require('./claude-runtime');
+const { isGeneratedArtifact } = require('../lib/copy-utils');
+const { copyRulesDirectory, copyOutputStylesDirectory, removeObsoleteRuntimeFiles } = require('./claude-runtime');
 const {
   managedRange,
   upsertManagedCodexBlock
@@ -23,30 +24,9 @@ const CODEX_OWN_RUNTIME = [
   ['runtime.json', 'runtime.json']
 ];
 
-/**
- * Delete hooks, scripts and skill files the manifest marks obsolete. Codex tracker keys are project-relative
- * (`.codex/hooks/…`), so the record is pruned through keyFor, and always: a record whose
- * file is already gone must still leave the manifest.
- */
+/** Use the shared ownership and symlink checks for Codex runtime cleanup. */
 function removeObsoleteCodexHooks(ctx, platformKey) {
-  const platform = PLATFORMS[platformKey];
-  const tracker = ctx.trackers && ctx.trackers[platformKey];
-  const obsoleteHooks = (ctx.manifest?.obsolete?.runtimeFiles || []).filter((rel) => rel.startsWith('hooks/') || rel.startsWith('scripts/') || rel.startsWith('skills/'));
-  for (const rel of obsoleteHooks) {
-    // Skill files live in the shared skills directory, not under the runtime folder.
-    const target = rel.startsWith('skills/')
-      ? path.join(platform.skillsDir, rel.slice('skills/'.length))
-      : path.join(platform.folder, rel);
-    const exists = fs.existsSync(target);
-    if (!ctx.dryRun) {
-      if (exists) fs.rmSync(target, { force: true, recursive: fs.statSync(target).isDirectory() });
-      if (tracker) tracker.prune(tracker.keyFor(target));
-    }
-    if (exists) {
-      ctx.ui.detail(`  ↻ ${ctx.dryRun ? '[dry-run] ' : ''}Removed obsolete Codex runtime: ${rel}`);
-      ctx.results.updated++;
-    }
-  }
+  removeObsoleteRuntimeFiles(ctx, platformKey);
 }
 
 function writeSourceFile(ctx, platformKey, src, dest, label) {
@@ -82,13 +62,32 @@ function installRuntimeFiles(ctx, platformKey) {
 
   mergeCodexHooks(ctx, platformKey);
 
-  const agg = copyManagedTree({
-    src: path.join(CODEX_SRC, 'hooks'),
-    dest: path.join(platform.folder, 'hooks'),
-    platformFolder: platform.folder,
-    ctx,
-    tracker: ctx.trackers[platformKey]
+  const hooksSource = path.join(CODEX_SRC, 'hooks');
+  const libsSource = path.join(hooksSource, 'lib');
+  const shimPattern = /^(?:['"]use strict['"];?\s*)?module\.exports\s*=\s*require\(['"]\.\.\/\.\.\/\.\.\/claude\/hooks\/lib\/([^'"/]+)['"]\);?\s*$/;
+  const sharedLibraries = fs.readdirSync(libsSource).filter(name => {
+    const file = path.join(libsSource, name);
+    if (!fs.lstatSync(file).isFile()) return false;
+    const match = fs.readFileSync(file, 'utf8').match(shimPattern);
+    return match && match[1] === name;
   });
+  const agg = { created: 0, updated: 0, unchanged: 0, preserved: 0, missing: 0 };
+  const copyHookEntry = relative => {
+    if (isGeneratedArtifact(path.basename(relative))) return;
+    const child = copyManagedTree({
+      src: path.join(hooksSource, relative),
+      dest: path.join(platform.folder, 'hooks', relative),
+      sourceRoot: hooksSource,
+      platformFolder: platform.folder, ctx, tracker: ctx.trackers[platformKey]
+    });
+    for (const key of Object.keys(agg)) agg[key] += child[key];
+  };
+  for (const name of fs.readdirSync(hooksSource)) {
+    if (name !== 'lib') copyHookEntry(name);
+    else for (const lib of fs.readdirSync(libsSource)) {
+      if (!sharedLibraries.includes(lib)) copyHookEntry(path.join('lib', lib));
+    }
+  }
   report(ctx, treeAction(agg), 'Codex native hooks');
   removeObsoleteCodexHooks(ctx, platformKey);
   // Keep one canonical command analyzer in the Claude source tree, then
@@ -102,27 +101,21 @@ function installRuntimeFiles(ctx, platformKey) {
     path.join(platform.folder, 'runtime.schema.json'),
     'Codex runtime schema'
   );
-  writeSourceFile(
-    ctx,
-    platformKey,
-    path.join(SRC, 'claude', 'hooks', 'lib', 'privacy-command-analysis.cjs'),
-    path.join(platform.folder, 'hooks', 'lib', 'privacy-command-analysis.cjs'),
-    'Codex privacy command analyzer'
-  );
-  writeSourceFile(
-    ctx,
-    platformKey,
-    path.join(SRC, 'claude', 'hooks', 'lib', 'secret-keywords.cjs'),
-    path.join(platform.folder, 'hooks', 'lib', 'secret-keywords.cjs'),
-    'Codex secret keyword matcher'
-  );
-  writeSourceFile(
-    ctx,
-    platformKey,
-    path.join(SRC, 'claude', 'hooks', 'lib', 'runtime-path-safety.cjs'),
-    path.join(platform.folder, 'hooks', 'lib', 'runtime-path-safety.cjs'),
-    'Codex runtime path safety'
-  );
+  const helperLabels = {
+    'privacy-command-analysis.cjs': 'Codex privacy command analyzer',
+    'privacy-paths.cjs': 'Codex privacy path analyzer',
+    'secret-keywords.cjs': 'Codex secret keyword matcher',
+    'runtime-path-safety.cjs': 'Codex runtime path safety',
+    'inspect-paths.cjs': 'Codex inspection path analyzer',
+    'spec-touch.cjs': 'Codex spec touch helpers',
+    'update-check.cjs': 'Codex update check'
+  };
+  for (const name of sharedLibraries) {
+    writeSourceFile(ctx, platformKey,
+      path.join(SRC, 'claude', 'hooks', 'lib', name),
+      path.join(platform.folder, 'hooks', 'lib', name),
+      helperLabels[name] || `Codex hook helper: ${name}`);
+  }
 }
 
 function installNativeRuleOverrides(ctx, platformKey) {
@@ -170,7 +163,7 @@ function installManagedAgentsMd(ctx) {
 function installCodexRuntime(ctx, platformKey) {
   if (platformKey !== 'codex') return ctx;
   installRuntimeFiles(ctx, platformKey);
-  copyRulesDirectory(ctx, platformKey);
+  copyRulesDirectory(ctx, platformKey, new Set(fs.readdirSync(path.join(CODEX_SRC, 'rules'))));
   copyOutputStylesDirectory(ctx, platformKey);
   installNativeRuleOverrides(ctx, platformKey);
   installManagedAgentsMd(ctx);

package/bin/phases/copy-payload.js

@@ -97,9 +97,7 @@ function copyPlatformFiles(ctx, platformKey) {
     // The specs skill tree above carries its templates; remove the ones retired
     // with the spec.json planning flow from earlier installs.
     if (platformKey === 'claude' || platformKey === 'codex') {
-      const retiredTemplates = platformKey === 'claude'
-        ? ['init.json', 'spec-state.json', 'requirements-init.md', 'requirements.md', 'design.md', 'task.md']
-        : ['spec-state.json', 'requirements-init.md', 'requirements.md', 'design.md', 'task.md'];
+      const retiredTemplates = ['init.json', 'spec-state.json', 'requirements-init.md', 'requirements.md', 'design.md', 'task.md'];
       for (const fileName of retiredTemplates) {
         const retired = path.join(platform.skillsDir, 'specs', 'templates', fileName);
         if (!fs.existsSync(retired)) continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haposoft/cafekit",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "Native spec-driven workflows for Claude Code and Codex CLI. Bundles CafeKit skills, runtime hooks, agents, and installer scaffolding.",
   "author": "Haposoft <nghialt@haposoft.com>",
   "license": "MIT",

package/src/claude/CLAUDE.md

@@ -7,6 +7,10 @@
 
 ## Claude Code runtime
 
+Project notes (commands, files to leave unchanged, slow or expensive operations)
+belong in the root AGENTS.md after the CAFEKIT CORE END marker; Claude Code reads
+them through `@AGENTS.md`.
+
 - Edit project skills under `.claude/skills/`, not `~/.claude/skills`.
 - Run Python skill scripts with the skill venv:
   - macOS/Linux: `.claude/skills/.venv/bin/python3 scripts/<script>.py`

package/src/claude/gitignore

@@ -6,6 +6,8 @@
 .env
 .env.*
 !.env.example
+!.env.sample
+!.env.template
 
 # Skill dependency installs (Python venv + npm)
 skills/.venv/
@@ -25,3 +27,4 @@ agent-memory/
 settings.bak.json
 .mcp.json
 .cafekit-update-cache.json
+*.tmp

package/src/claude/hooks/__tests__/installed-root.test.js

@@ -0,0 +1,111 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const CLAUDE = path.resolve(__dirname, '../..');
+const MANIFEST = require('../../migration-manifest.json');
+const RUNTIME = { paths: { specs: 'work-specs', plans: 'work-plans', docs: 'work-docs' }, inspect: { enabled: false } };
+
+function fixture(run, withRuntime = true) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-installed-root-'));
+  const sessions = new Set();
+  try {
+    for (const relative of MANIFEST.runtime.files) {
+      const target = path.join(root, '.claude', relative);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(path.join(CLAUDE, relative), target);
+    }
+    for (const relative of MANIFEST.scripts.required) {
+      const target = path.join(root, '.claude/scripts', relative);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(path.join(CLAUDE, 'scripts', relative), target);
+    }
+    const runtimeFile = path.join(root, '.claude/runtime.json');
+    const writeRuntime = () => fs.writeFileSync(runtimeFile, JSON.stringify(RUNTIME));
+    if (withRuntime) writeRuntime();
+    else fs.unlinkSync(runtimeFile);
+    const cwd = path.join(root, 'sub/dir');
+    fs.mkdirSync(cwd, { recursive: true });
+    const env = { ...process.env };
+    delete env.CLAUDE_PROJECT_DIR;
+    delete env.PROJECT_ROOT;
+    const invoke = (name, payload) => {
+      if (payload.session_id) sessions.add(payload.session_id);
+      return spawnSync(process.execPath, [path.join(root, '.claude/hooks', `${name}.cjs`)], {
+        cwd, env, encoding: 'utf8', input: JSON.stringify({ cwd, ...payload }),
+      });
+    };
+    run({ root: fs.realpathSync(root), cwd, invoke, writeRuntime });
+  } finally {
+    for (const session of sessions) {
+      const key = crypto.createHash('sha256').update(session).digest('hex').slice(0, 16);
+      fs.rmSync(path.join(os.tmpdir(), `cafekit-rules-${key}.json`), { force: true });
+    }
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+test('installed rules read the project runtime from a nested session cwd', () => {
+  fixture(({ root, invoke }) => {
+    const result = invoke('rules', { hook_event_name: 'UserPromptSubmit', session_id: crypto.randomUUID() });
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /## Rules/);
+    assert.ok(result.stdout.includes(`${root}/work-specs/`));
+  });
+});
+
+test('rules wait for runtime before reserving the session injection', () => {
+  fixture(({ invoke, writeRuntime }) => {
+    const payload = { hook_event_name: 'UserPromptSubmit', session_id: crypto.randomUUID() };
+    const absent = invoke('rules', payload);
+    assert.equal(absent.status, 0, absent.stderr);
+    assert.equal(absent.stdout, '');
+    writeRuntime();
+    const present = invoke('rules', payload);
+    assert.equal(present.status, 0, present.stderr);
+    assert.match(present.stdout, /## Rules/);
+  }, false);
+});
+
+test('installed inspect respects a disabled project runtime from a nested cwd', () => {
+  fixture(({ invoke }) => {
+    const result = invoke('inspect-block', { hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: 'node_modules/pkg/index.js' } });
+    assert.equal(result.status, 0, result.stderr);
+  });
+});
+
+test('installed agent context uses project paths from a nested session cwd', () => {
+  fixture(({ root, invoke }) => {
+    const result = invoke('agent', { hook_event_name: 'SubagentStart', agent_id: 'nested-agent' });
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /additionalContext/);
+    const context = JSON.parse(result.stdout).hookSpecificOutput.additionalContext;
+    for (const relative of ['work-specs', 'work-plans', 'work-docs']) assert.ok(context.includes(`${root}/${relative}/`));
+  });
+});
+
+test('installed spec gate checks root packet receipts from a nested session cwd', () => {
+  fixture(({ root, invoke }) => {
+    for (const args of [['init', '-q'], ['config', 'user.email', 'cafekit@example.invalid'], ['config', 'user.name', 'CafeKit Test'], ['commit', '--allow-empty', '-qm', 'fixture']]) {
+      const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+      assert.equal(result.status, 0, result.stderr);
+    }
+    const packet = path.join(root, 'work-specs/demo');
+    fs.mkdirSync(packet, { recursive: true });
+    fs.writeFileSync(path.join(packet, 'plan.md'), '# Demo\nSpecs-Contract: process-first-ready-v1\n');
+    fs.writeFileSync(path.join(packet, 'task-01-work.md'), '# Work\n\nStatus: done\n\n## Dependencies\n\n- none\n\n## Verification Plan\n\n- Command: node --test\n');
+    const result = invoke('spec-gate', { hook_event_name: 'Stop', session_id: crypto.randomUUID() });
+    assert.equal(result.status, 0, result.stderr);
+    const block = JSON.parse(result.stdout);
+    assert.equal(block.decision, 'block');
+    assert.match(block.reason, /receipt/i);
+    assert.match(block.reason, /task-01-work\.md/);
+    assert.doesNotMatch(block.reason, /unavailable|controlled failure/i);
+  });
+});

package/src/claude/hooks/__tests__/precompact.test.js

@@ -11,11 +11,21 @@ const { spawnSync } = require('node:child_process');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const crypto = require('node:crypto');
 
 const PRECOMPACT = path.join(__dirname, '..', 'precompact.cjs');
 const SESSION = path.join(__dirname, '..', 'session.cjs');
 const { hookStateDir } = require(path.join(__dirname, '..', 'lib', 'hook-state-dir.cjs'));
-const RECOVERY = path.join(hookStateDir(), 'compact-recovery.json');
+const CAPTURES = new Set([path.join(hookStateDir(), 'compact-recovery.json')]);
+function recoveryPath(session = 'compact-session') {
+  const key = crypto.createHash('sha256').update(session).digest('hex');
+  const file = path.join(hookStateDir(), `compact-recovery-${key}.json`);
+  CAPTURES.add(file);
+  return file;
+}
+const HOOK_ENV = { ...process.env };
+delete HOOK_ENV.CLAUDE_PROJECT_DIR;
+delete HOOK_ENV.PROJECT_ROOT;
 
 function fixture() {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-precompact-'));
@@ -36,21 +46,24 @@ function fixture() {
 }
 
 function run(hook, dir, payload) {
+  if (typeof payload?.session_id === 'string' && payload.session_id.trim()) recoveryPath(payload.session_id);
   const result = spawnSync(process.execPath, [hook], {
     cwd: dir,
     input: JSON.stringify(payload),
     encoding: 'utf8',
-    env: { ...process.env, CLAUDE_PROJECT_DIR: dir },
+    env: HOOK_ENV,
   });
   return { code: result.status, stdout: result.stdout || '', stderr: result.stderr || '' };
 }
 
 function clearCapture() {
-  try { fs.unlinkSync(RECOVERY); } catch { /* absent */ }
+  for (const file of CAPTURES) {
+    try { fs.unlinkSync(file); } catch { /* absent */ }
+  }
 }
 
-function readCapture() {
-  return JSON.parse(fs.readFileSync(RECOVERY, 'utf8'));
+function readCapture(session) {
+  return JSON.parse(fs.readFileSync(recoveryPath(session), 'utf8'));
 }
 
 test('PreCompact records branch, HEAD, dirty count and the in-flight task', () => {
@@ -93,8 +106,8 @@ test('a compact restart prints the captured anchors alongside the authorization
   const dir = fixture();
   try {
     clearCapture();
-    assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', trigger: 'manual', cwd: dir }).code, 0);
-    const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', cwd: dir });
+    assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', trigger: 'manual', session_id: 'compact-session', cwd: dir }).code, 0);
+    const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', session_id: 'compact-session', cwd: dir });
     assert.strictEqual(restart.code, 0, restart.stderr);
     assert.match(restart.stdout, /VERIFY PENDING AUTHORIZATIONS/, 'the existing warning must survive');
     assert.match(restart.stdout, /State before compaction/);
@@ -119,6 +132,53 @@ test('a compact restart without a capture still prints the warning and nothing i
   }
 });
 
+test('a compact restart in another session prints the warning without foreign anchors', () => {
+  const dir = fixture();
+  try {
+    clearCapture();
+    assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', session_id: 'session-a', cwd: dir }).code, 0);
+    const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', session_id: 'session-b', cwd: dir });
+    assert.strictEqual(restart.code, 0, restart.stderr);
+    assert.match(restart.stdout, /SESSION COMPRESSED/);
+    assert.doesNotMatch(restart.stdout, /State before compaction/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+    clearCapture();
+  }
+});
+
+test('a compact restart in the same session restores its captured anchors', () => {
+  const dir = fixture();
+  try {
+    clearCapture();
+    assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', session_id: 'session-a', cwd: dir }).code, 0);
+    const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', session_id: 'session-a', cwd: dir });
+    assert.strictEqual(restart.code, 0, restart.stderr);
+    assert.match(restart.stdout, /SESSION COMPRESSED/);
+    assert.match(restart.stdout, /State before compaction[\s\S]*branch work/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+    clearCapture();
+  }
+});
+
+for (const [captureId, restartId] of [[undefined, 'session-a'], ['session-a', undefined], [undefined, undefined]]) {
+  test(`a compact restart without ${captureId ? 'restart' : restartId ? 'capture' : 'either'} session identity keeps only the warning`, () => {
+    const dir = fixture();
+    try {
+      clearCapture();
+      assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', session_id: captureId, cwd: dir }).code, 0);
+      const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', session_id: restartId, cwd: dir });
+      assert.strictEqual(restart.code, 0, restart.stderr);
+      assert.match(restart.stdout, /SESSION COMPRESSED/);
+      assert.doesNotMatch(restart.stdout, /State before compaction/);
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+      clearCapture();
+    }
+  });
+}
+
 test('a normal session start prints no compaction anchors', () => {
   const dir = fixture();
   try {
@@ -138,7 +198,7 @@ test('PreCompact fails open outside a repository and on malformed input', () =>
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-precompact-bare-'));
   try {
     clearCapture();
-    const noGit = run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', cwd: dir });
+    const noGit = run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', session_id: 'compact-session', cwd: dir });
     assert.strictEqual(noGit.code, 0, 'a directory outside git must not fail the hook');
     const record = readCapture();
     assert.strictEqual(record.branch, null, 'unavailable git facts are recorded as null, never guessed');
@@ -147,12 +207,148 @@ test('PreCompact fails open outside a repository and on malformed input', () =>
 
     clearCapture();
     const malformed = spawnSync(process.execPath, [PRECOMPACT], {
-      cwd: dir, input: 'not json', encoding: 'utf8', env: { ...process.env, CLAUDE_PROJECT_DIR: dir },
+      cwd: dir, input: 'not json', encoding: 'utf8', env: HOOK_ENV,
     });
     assert.strictEqual(malformed.status, 0, 'malformed payload must fail open');
-    assert.strictEqual(fs.existsSync(RECOVERY), false, 'a malformed payload writes no capture');
+    assert.strictEqual(fs.existsSync(recoveryPath()), false, 'a malformed payload writes no capture');
   } finally {
     fs.rmSync(dir, { recursive: true, force: true });
     clearCapture();
   }
 });
+
+function installedFixture(callback) {
+  const root = fixture();
+  const source = path.resolve(__dirname, '../..');
+  const manifest = require('../../migration-manifest.json');
+  const sessions = new Set();
+  try {
+    for (const relative of manifest.runtime.files) {
+      const target = path.join(root, '.claude', relative);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(path.join(source, relative), target);
+    }
+    for (const relative of manifest.scripts.required) {
+      const target = path.join(root, '.claude/scripts', relative);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(path.join(source, 'scripts', relative), target);
+    }
+    const hooks = path.join(root, '.claude/hooks');
+    const invoke = (name, payload, overrides = {}) => {
+      if (typeof payload?.session_id === 'string' && payload.session_id.trim()) sessions.add(payload.session_id);
+      return spawnSync(process.execPath, [path.join(hooks, `${name}.cjs`)], {
+        cwd: root, env: HOOK_ENV, encoding: 'utf8', timeout: 10000,
+        input: typeof payload === 'string' ? payload : JSON.stringify(payload), ...overrides,
+      });
+    };
+    callback({ root: fs.realpathSync(root), hooks, invoke });
+  } finally {
+    for (const session of sessions) {
+      const key = crypto.createHash('sha256').update(session).digest('hex').slice(0, 16);
+      fs.rmSync(path.join(os.tmpdir(), `cafekit-rules-${key}.json`), { force: true });
+    }
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+test('two compacting sessions keep separate anchors and restore only their own branch', () => {
+  installedFixture(({ root, hooks, invoke }) => {
+    const sessions = [crypto.randomUUID(), crypto.randomUUID()];
+    const files = [];
+    for (const [index, session_id] of sessions.entries()) {
+      const branch = `anchor-${index === 0 ? 'first' : 'second'}`;
+      const checkout = spawnSync('git', ['-C', root, 'checkout', '-qb', branch], { encoding: 'utf8' });
+      assert.strictEqual(checkout.status, 0, checkout.stderr);
+      const capture = invoke('precompact', { hook_event_name: 'PreCompact', session_id, cwd: root });
+      assert.strictEqual(capture.status, 0, capture.stderr);
+      const hash = crypto.createHash('sha256').update(session_id).digest('hex');
+      files.push(path.join(hooks, '.logs', `compact-recovery-${hash}.json`));
+    }
+    for (const [index, file] of files.entries()) {
+      assert.ok(fs.existsSync(file), 'both session captures must survive');
+      const record = JSON.parse(fs.readFileSync(file, 'utf8'));
+      assert.strictEqual(record.session_id, sessions[index]);
+      assert.strictEqual(record.branch, `anchor-${index === 0 ? 'first' : 'second'}`);
+    }
+    for (const [index, session_id] of sessions.entries()) {
+      const compact = invoke('session', { hook_event_name: 'SessionStart', source: 'compact', session_id, cwd: root });
+      assert.strictEqual(compact.status, 0, compact.stderr);
+      assert.match(compact.stdout, /SESSION COMPRESSED/);
+      assert.match(compact.stdout, /State before compaction/);
+      assert.ok(compact.stdout.includes(`branch anchor-${index === 0 ? 'first' : 'second'}`));
+      assert.ok(!compact.stdout.includes(`branch anchor-${index === 0 ? 'second' : 'first'}`));
+    }
+  });
+});
+
+test('PreCompact without a usable session identity creates no anchor or state directory', () => {
+  installedFixture(({ root, hooks, invoke }) => {
+    for (const session_id of [undefined, null, '', 42, '   ']) {
+      const capture = invoke('precompact', { hook_event_name: 'PreCompact', session_id, cwd: root });
+      assert.strictEqual(capture.status, 0, capture.stderr);
+      assert.strictEqual(fs.existsSync(path.join(hooks, '.logs')), false);
+    }
+  });
+});
+
+test('compact reinjects rules only for its own session even without matching anchors', () => {
+  installedFixture(({ root, hooks, invoke }) => {
+    const session = crypto.randomUUID();
+    const other = crypto.randomUUID();
+    const prompt = id => invoke('rules', { hook_event_name: 'UserPromptSubmit', session_id: id, cwd: root });
+    for (const id of [session, other]) {
+      const first = prompt(id);
+      assert.strictEqual(first.status, 0, first.stderr);
+      assert.match(first.stdout, /## Rules/);
+      assert.strictEqual(prompt(id).stdout, '');
+    }
+    fs.mkdirSync(path.join(hooks, '.logs'), { recursive: true });
+    const otherHash = crypto.createHash('sha256').update(other).digest('hex');
+    fs.writeFileSync(path.join(hooks, '.logs', `compact-recovery-${otherHash}.json`), JSON.stringify({ session_id: other }));
+    const compact = invoke('session', { hook_event_name: 'SessionStart', source: 'compact', session_id: session, cwd: root });
+    assert.strictEqual(compact.status, 0, compact.stderr);
+    assert.match(compact.stdout, /SESSION COMPRESSED/);
+    assert.doesNotMatch(compact.stdout, /State before compaction/);
+    const again = prompt(session);
+    assert.strictEqual(again.status, 0, again.stderr);
+    assert.match(again.stdout, /## Rules/);
+    assert.strictEqual(prompt(other).stdout, '');
+  });
+});
+
+test('malformed session input fails open without a stack and logs its crash', () => {
+  installedFixture(({ hooks, invoke }) => {
+    const result = invoke('session', '{');
+    assert.strictEqual(result.status, 0);
+    assert.strictEqual(result.stderr, '');
+    const rows = fs.readFileSync(path.join(hooks, '.logs/hook-log.jsonl'), 'utf8').trim().split('\n').map(line => JSON.parse(line));
+    assert.strictEqual(rows.length, 1);
+    assert.strictEqual(rows[0].hook, 'session');
+    assert.strictEqual(rows[0].status, 'crash');
+  });
+});
+
+test('installed session explains a nested cwd but omits the root line without a cwd', () => {
+  installedFixture(({ root, invoke }) => {
+    const cwd = path.join(root, 'sub/dir');
+    fs.mkdirSync(cwd, { recursive: true });
+    const nested = invoke('session', { source: 'startup', cwd }, { cwd });
+    assert.strictEqual(nested.status, 0, nested.stderr);
+    assert.ok(nested.stdout.includes(`CafeKit project root: ${root} (session working directory: ${cwd}).`));
+    const missing = invoke('session', { source: 'startup' }, { cwd });
+    assert.strictEqual(missing.status, 0, missing.stderr);
+    assert.doesNotMatch(missing.stdout, /CafeKit project root:/);
+  });
+});
+
+test('PreCompact bounds slow git calls and finishes within ten seconds', { timeout: 15000 }, () => {
+  installedFixture(({ root, invoke }) => {
+    const bin = path.join(root, 'fake-bin');
+    fs.mkdirSync(bin);
+    fs.writeFileSync(path.join(bin, 'git'), '#!/bin/sh\nexec /bin/sleep 30\n', { mode: 0o755 });
+    const start = Date.now();
+    const result = invoke('precompact', { hook_event_name: 'PreCompact', session_id: crypto.randomUUID(), cwd: root }, { env: { ...HOOK_ENV, PATH: bin } });
+    assert.strictEqual(result.status, 0, 'slow git must not exhaust the hook timeout');
+    assert.ok(Date.now() - start < 10000);
+  });
+});

package/src/claude/hooks/__tests__/privacy-block.test.js

@@ -11,12 +11,16 @@ const os = require('node:os');
 const path = require('node:path');
 
 const HOOK = path.join(__dirname, '..', 'privacy-block.cjs');
+const HOOK_ENV = { ...process.env };
+delete HOOK_ENV.CLAUDE_PROJECT_DIR;
+delete HOOK_ENV.PROJECT_ROOT;
 
 /** Run the hook with a tool payload; return process output. */
 function runHook(payload, cwd) {
   const res = spawnSync(process.execPath, [HOOK], {
     input: JSON.stringify({ ...payload, cwd: cwd || payload.cwd }),
     encoding: 'utf8',
+    env: HOOK_ENV,
   });
   return { code: res.status, stdout: res.stdout || '', stderr: res.stderr || '' };
 }
@@ -30,6 +34,29 @@ function permissionDecision(stdout) {
   return JSON.parse(stdout).hookSpecificOutput?.permissionDecision || null;
 }
 
+test('sensitive reads list sorted distinct basenames and the remaining count', () => {
+  const dir = tmpDir();
+  try {
+    const command = 'cat token.json nested/.env secrets.json credentials.json .env';
+    const { code, stdout } = runHook({ tool_name: 'Bash', tool_input: { command } }, dir);
+    assert.strictEqual(code, 0);
+    const output = JSON.parse(stdout).hookSpecificOutput;
+    assert.strictEqual(output.permissionDecision, 'ask');
+    assert.strictEqual(output.permissionDecisionReason,
+      'Sensitive file access requires approval: .env, credentials.json, secrets.json (+1 more)');
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('empty stdin asks because sensitive access cannot be evaluated safely', () => {
+  const result = spawnSync(process.execPath, [HOOK], { input: '', encoding: 'utf8', env: HOOK_ENV });
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  assert.deepStrictEqual(JSON.parse(result.stdout).hookSpecificOutput, {
+    hookEventName: 'PreToolUse', permissionDecision: 'ask',
+    permissionDecisionReason: 'Sensitive access could not be evaluated safely.',
+  });
+});
+
 test('asks natively for a direct Read of .env', () => {
   const dir = tmpDir();
   try {

package/src/claude/hooks/__tests__/session-writeenv.test.js

@@ -17,6 +17,31 @@ const path = require('node:path');
 
 const HOOK = path.join(__dirname, '..', 'session.cjs');
 
+test('session.cjs does not export GIT_URL or remote userinfo', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-session-remote-'));
+  const envFile = path.join(dir, 'env.sh');
+  try {
+    git(['init', '-q'], dir);
+    const userinfo = 'fixture-user:fixture-placeholder';
+    const remote = `https://${userinfo}@example.invalid/r.git`;
+    const configured = spawnSync('git', ['remote', 'add', 'origin', remote], { cwd: dir, encoding: 'utf8' });
+    assert.strictEqual(configured.status, 0, 'fake remote setup must succeed');
+    const result = spawnSync(process.execPath, [HOOK], {
+      cwd: dir, input: JSON.stringify({ source: 'startup', cwd: dir }), encoding: 'utf8',
+      env: { ...process.env, CLAUDE_ENV_FILE: envFile },
+    });
+    assert.strictEqual(result.status, 0, 'session hook must exit successfully');
+    assert.ok(fs.existsSync(envFile), 'session env file must exist');
+    const content = fs.readFileSync(envFile, 'utf8');
+    assert.deepStrictEqual({
+      exportsGitUrl: /^\s*(?:export\s+)?GIT_URL=/m.test(content),
+      containsUserInfo: content.includes(userinfo),
+    }, { exportsGitUrl: false, containsUserInfo: false });
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 function git(args, cwd) {
   const res = spawnSync('git', args, { cwd, encoding: 'utf8' });
   if (res.status !== 0) {