@haposoft/cafekit 0.18.1 → 0.18.2

package/src/claude/hooks/__tests__/spec-gate.test.js

@@ -29,9 +29,10 @@ const FIXTURE_ARTIFACT_DIGEST = crypto.createHash('sha256').update(FIXTURE_ARTIF
 function runHook(payload, cwd) {
   const projectRoot = cwd || payload.cwd;
   const specsRoot = path.join(projectRoot, 'specs');
-  // PROJECT_ROOT wins over cwd in the hook; pin it to the fixture so a host
-  // monorepo's real specs/ cannot leak into the test (e.g. active rtk-* specs).
-  const env = { ...process.env, PROJECT_ROOT: projectRoot };
+  // Source hooks use payload.cwd without inherited root overrides.
+  const env = { ...process.env };
+  delete env.CLAUDE_PROJECT_DIR;
+  delete env.PROJECT_ROOT;
   const res = spawnSync(process.execPath, [HOOK], {
     input: JSON.stringify({
       hook_event_name: 'Stop',
@@ -235,6 +236,8 @@ function installClaudeGate(root, policyMode = 'valid') {
   fs.copyFileSync(HOOK, path.join(hooks, 'spec-gate.cjs'));
   fs.mkdirSync(path.join(hooks, 'lib'), { recursive: true });
   fs.copyFileSync(path.join(__dirname, '..', 'lib', 'runtime-dir.cjs'), path.join(hooks, 'lib', 'runtime-dir.cjs'));
+  fs.copyFileSync(path.join(__dirname, '..', 'lib', 'project-root.cjs'), path.join(hooks, 'lib', 'project-root.cjs'));
+  fs.copyFileSync(path.join(__dirname, '..', 'lib', 'spec-touch.cjs'), path.join(hooks, 'lib', 'spec-touch.cjs'));
   fs.copyFileSync(path.join(__dirname, '..', 'lib', 'hook-payload.cjs'), path.join(hooks, 'lib', 'hook-payload.cjs'));
   fs.copyFileSync(
     path.join(__dirname, '..', 'lib', 'hook-state-dir.cjs'),
@@ -1264,11 +1267,14 @@ function boundReceipt(base = VALID_BASE, head = VALID_HEAD) {
 }
 
 function runHookFrom(dir, cwd) {
+  const env = { ...process.env };
+  delete env.CLAUDE_PROJECT_DIR;
+  delete env.PROJECT_ROOT;
   const res = spawnSync(process.execPath, [HOOK], {
     cwd,
     input: JSON.stringify({ hook_event_name: 'Stop', session_id: 'test', transcript_path: '/tmp/t', stop_hook_active: false, cwd: dir }),
     encoding: 'utf8',
-    env: { ...process.env, PROJECT_ROOT: dir },
+    env,
   });
   return { code: res.status, stdout: (res.stdout || '').trim(), stderr: res.stderr || '' };
 }
@@ -1371,17 +1377,142 @@ test('41. unborn HEAD fails closed before any receipt check', () => {
     clearCache();
     const body = parseBlock(runHook({}, dir).stdout);
     assert.ok(body && body.decision === 'block', 'an unborn HEAD must block');
-    // The block arrives from provenance derivation, which cannot resolve a base
-    // commit here, so the receipt check is never reached. Asserting the reason
-    // keeps this case honest: it guards fail-closed behavior on an unborn HEAD,
-    // not the binding-mode selector. The selector's own HEAD-unreadable branch
-    // is guarded by cases 38 and 39.
-    assert.match(body.reason, /controlled failure/);
+    // A done task still blocks before receipt validation, with guidance to
+    // create the first commit before recording its Base/Head.
+    assert.match(body.reason, /first commit/);
   } finally {
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
 
+function noHistoryFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-spec-no-history-'));
+  for (const args of [['init', '-q'], ['config', 'user.email', 'cafekit@example.invalid'], ['config', 'user.name', 'CafeKit Test']]) {
+    const result = spawnSync('git', ['-C', dir, ...args], { encoding: 'utf8' });
+    assert.strictEqual(result.status, 0, result.stderr);
+  }
+  installClaudeGate(dir);
+  fs.copyFileSync(path.join(__dirname, '..', 'spec-state.cjs'), path.join(dir, '.claude/hooks/spec-state.cjs'));
+  return dir;
+}
+
+test('Stop still blocks multiple active specs for an untouched session', () => {
+  const dir = tmpDir();
+  try {
+    const gate = installClaudeGate(dir);
+    for (const feature of ['demo', 'other']) writeNoHistoryPacket(dir, feature, 'in_progress');
+    const result = spawnSync(process.execPath, [gate], {
+      cwd: dir, encoding: 'utf8', env: { ...process.env, PROJECT_ROOT: dir, CLAUDE_PROJECT_DIR: dir },
+      input: JSON.stringify({ cwd: dir, session_id: 'untouched-session', hook_event_name: 'Stop', prompt: 'Continue' }),
+    });
+    assert.strictEqual(result.status, 0, result.stderr);
+    const body = parseBlock(result.stdout);
+    assert.strictEqual(body.decision, 'block');
+    assert.match(body.reason, /multiple active specs/);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+function writeNoHistoryPacket(dir, feature, status) {
+  const packet = path.join(dir, 'specs', feature);
+  fs.mkdirSync(packet, { recursive: true });
+  fs.writeFileSync(path.join(packet, 'plan.md'), `# ${feature}\nSpecs-Contract: process-first-ready-v1\n`);
+  fs.writeFileSync(path.join(packet, 'task-01-work.md'), [
+    '# Task 01: work', '', `Status: ${status}`, '', '## Dependencies', '', '- none', '',
+    '## Verification Plan', '', '- Command: node --test', '',
+    ...(status === 'done' ? ['## Receipt', '', 'Verification: PASS', ''] : []),
+  ].join('\n'));
+}
+
+function runInstalledHistoryHook(dir, hook = 'spec-gate', extraEnv = {}) {
+  return spawnSync(process.execPath, [path.join(dir, '.claude/hooks', `${hook}.cjs`)], {
+    cwd: dir, encoding: 'utf8',
+    env: { ...process.env, PROJECT_ROOT: dir, CLAUDE_PROJECT_DIR: dir, ...extraEnv },
+    input: JSON.stringify({ cwd: dir, session_id: 'no-history',
+      hook_event_name: hook === 'spec-state' ? 'UserPromptSubmit' : 'Stop', prompt: 'Continue specs/demo' }),
+  });
+}
+
+test('no commits allows Stop without done tasks and prints one reminder', () => {
+  const dir = noHistoryFixture();
+  try {
+    writeNoHistoryPacket(dir, 'demo', 'in_progress');
+    const gate = runInstalledHistoryHook(dir);
+    assert.strictEqual(gate.status, 0, gate.stderr);
+    assert.strictEqual(gate.stdout.trim(), '');
+    const state = runInstalledHistoryHook(dir, 'spec-state');
+    assert.strictEqual(state.status, 0, state.stderr);
+    assert.match(state.stdout, /no commits/);
+    assert.strictEqual(state.stdout.trim().split('\n').length, 1);
+    assert.doesNotMatch(state.stdout, /Spec tollgate unavailable/);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('no commits blocks a done task with first commit guidance', () => {
+  const dir = noHistoryFixture();
+  try {
+    writeNoHistoryPacket(dir, 'demo', 'done');
+    const result = runInstalledHistoryHook(dir);
+    assert.strictEqual(result.status, 0, result.stderr);
+    const body = parseBlock(result.stdout);
+    assert.strictEqual(body.decision, 'block');
+    assert.match(body.reason, /first commit/);
+    assert.doesNotMatch(body.reason, /controlled failure/);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('no commits blocks two completed packets with first commit guidance', () => {
+  const dir = noHistoryFixture();
+  try {
+    for (const feature of ['demo', 'other']) writeNoHistoryPacket(dir, feature, 'done');
+    const result = runInstalledHistoryHook(dir);
+    assert.strictEqual(result.status, 0, result.stderr);
+    const body = parseBlock(result.stdout);
+    assert.strictEqual(body.decision, 'block');
+    assert.match(body.reason, /first commit/);
+    assert.doesNotMatch(body.reason, /controlled failure/);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('a corrupt current branch ref remains a controlled failure', () => {
+  const dir = tmpDir();
+  try {
+    installClaudeGate(dir);
+    writeNoHistoryPacket(dir, 'demo', 'in_progress');
+    const ref = spawnSync('git', ['-C', dir, 'symbolic-ref', '-q', 'HEAD'], { encoding: 'utf8' });
+    assert.strictEqual(ref.status, 0, ref.stderr);
+    fs.writeFileSync(path.join(dir, '.git', ref.stdout.trim()), 'corrupt-ref\n');
+    const result = runInstalledHistoryHook(dir);
+    assert.strictEqual(result.status, 0, result.stderr);
+    const body = parseBlock(result.stdout);
+    assert.strictEqual(body.decision, 'block');
+    assert.match(body.reason, /controlled failure/);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('unavailable git remains a controlled failure in a repo without commits', () => {
+  const dir = noHistoryFixture();
+  try {
+    writeNoHistoryPacket(dir, 'demo', 'in_progress');
+    const emptyPath = path.join(dir, 'empty-path');
+    fs.mkdirSync(emptyPath);
+    const result = runInstalledHistoryHook(dir, 'spec-gate', { PATH: emptyPath });
+    assert.strictEqual(result.status, 0, result.stderr);
+    const body = parseBlock(result.stdout);
+    assert.strictEqual(body.decision, 'block');
+    assert.match(body.reason, /controlled failure/);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('a committed repo still accepts a valid done task receipt', () => {
+  const dir = makeFixture({ evidence: 'valid' });
+  try {
+    installClaudeGate(dir);
+    const result = runInstalledHistoryHook(dir);
+    assert.strictEqual(result.status, 0, result.stderr);
+    assert.strictEqual(result.stdout.trim(), '');
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
 test('42. a dirty tree outside specs does not reopen a committed receipt', () => {
   // Contract change. This used to require a block. `Base` is the last commit
   // touching anything outside the specs root, so a receipt written before any

package/src/claude/hooks/__tests__/spec-state-touched.test.js

@@ -2,8 +2,8 @@
 
 // spec-state injects the active packet's tollgate on every prompt. With several sessions in
 // one checkout, a Claude session kept seeing a packet another session was working on. On
-// Claude the hook now speaks only about packets this session touched; omp, grok and
-// payloads without a Claude session id keep the old behaviour. Each case names the failure
+// Claude and omp the hook now speaks only about packets this session touched; grok and
+// payloads without a session id keep the old behaviour. Each case names the failure
 // it prevents.
 
 const { test } = require('node:test');
@@ -12,6 +12,7 @@ const { spawnSync } = require('node:child_process');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const crypto = require('node:crypto');
 
 const CLAUDE_ROOT = path.join(__dirname, '..', '..');
 
@@ -36,7 +37,7 @@ function fixture(packets, runtimeDir = '.claude') {
   fs.mkdirSync(path.join(hooks, 'lib'), { recursive: true });
   fs.mkdirSync(scripts, { recursive: true });
   fs.copyFileSync(path.join(CLAUDE_ROOT, 'hooks', 'spec-state.cjs'), path.join(hooks, 'spec-state.cjs'));
-  for (const lib of ['runtime-dir.cjs', 'hook-payload.cjs', 'hook-state-dir.cjs']) {
+  for (const lib of ['runtime-dir.cjs', 'hook-payload.cjs', 'hook-state-dir.cjs', 'project-root.cjs', 'spec-touch.cjs']) {
     fs.copyFileSync(path.join(CLAUDE_ROOT, 'hooks', 'lib', lib), path.join(hooks, 'lib', lib));
   }
   for (const file of ['provenance.cjs', 'spec-receipt.cjs', 'spec-resolver.cjs', 'workflow-policy.cjs']) {
@@ -48,23 +49,61 @@ function fixture(packets, runtimeDir = '.claude') {
     const git = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
     assert.strictEqual(git.status, 0, git.stderr);
   }
+  let lastSession = null;
   const run = (payload) => {
+    lastSession = payload.session_id;
+    const env = { ...process.env };
+    delete env.CLAUDE_PROJECT_DIR;
+    delete env.PROJECT_ROOT;
     const result = spawnSync(process.execPath, [path.join(hooks, 'spec-state.cjs')], {
-      cwd: root, env: { ...process.env, PROJECT_ROOT: root },
+      cwd: root, env,
       input: JSON.stringify({ cwd: root, ...payload }), encoding: 'utf8',
     });
     assert.strictEqual(result.status, 0, result.stderr);
     return result.stdout.trim();
   };
   const prompt = (session, text) => run({ hook_event_name: 'UserPromptSubmit', session_id: session, prompt: text });
-  const cacheFile = path.join(hooks, '.logs', 'tollgate-last.txt');
-  return { root, hooks, run, prompt, cacheFile, cleanup: () => fs.rmSync(root, { recursive: true, force: true }) };
+  return {
+    root, hooks, run, prompt,
+    get cacheFile() {
+      const name = ['.claude', '.omp'].includes(runtimeDir) && typeof lastSession === 'string' && lastSession
+        ? `tollgate-last-${crypto.createHash('sha256').update(lastSession).digest('hex').slice(0, 16)}.txt`
+        : 'tollgate-last.txt';
+      return path.join(hooks, '.logs', name);
+    },
+    cleanup: () => fs.rmSync(root, { recursive: true, force: true }),
+  };
 }
 
 function within(fx, fn) {
   try { return fn(fx); } finally { fx.cleanup(); }
 }
 
+test('Claude spec-state says receipt revalidation never grants approval', () => {
+  within(fixture(['auth-flow']), fx => {
+    assert.match(fx.prompt('message-session', 'specs/auth-flow'), /^- Hooks revalidate receipt bytes but never grant approval\.$/m);
+  });
+});
+
+test('Claude subagent rules include the shared simplicity and reporting instructions', () => {
+  within(fixture([]), fx => {
+    fs.copyFileSync(path.join(CLAUDE_ROOT, 'hooks/agent.cjs'), path.join(fx.hooks, 'agent.cjs'));
+    fs.writeFileSync(path.join(fx.root, '.claude/runtime.json'), '{}');
+    const env = { ...process.env };
+    delete env.CLAUDE_PROJECT_DIR;
+    delete env.PROJECT_ROOT;
+    const result = spawnSync(process.execPath, [path.join(fx.hooks, 'agent.cjs')], {
+      cwd: fx.root, env, encoding: 'utf8', input: JSON.stringify({ cwd: fx.root, hook_event_name: 'SubagentStart', agent_type: 'checker' }),
+    });
+    assert.strictEqual(result.status, 0, result.stderr);
+    const context = JSON.parse(result.stdout).hookSpecificOutput.additionalContext;
+    const rules = context.split('## Rules\n')[1];
+    assert.ok(rules, 'the rules section must be present');
+    assert.match(rules, /^- YAGNI · KISS · DRY$/m);
+    assert.match(rules, /^- Be concise\. List unresolved questions at end\.$/m);
+  });
+});
+
 test('an untouched packet prints nothing on Claude', () => {
   within(fixture(['auth-flow']), (fx) => {
     assert.strictEqual(fx.prompt('s1', 'Continue'), '');
@@ -72,6 +111,58 @@ test('an untouched packet prints nothing on Claude', () => {
   });
 });
 
+test('a touched packet respects the project tollgate toggle from a nested cwd', () => {
+  within(fixture(['auth-flow']), fx => {
+    assert.match(fx.prompt('s1', 'specs/auth-flow'), /Spec state changed/);
+    fs.writeFileSync(path.join(fx.root, '.claude/runtime.json'), JSON.stringify({ spec: { tollgate: false } }));
+    const cwd = path.join(fx.root, 'sub/dir');
+    fs.mkdirSync(cwd, { recursive: true });
+    assert.strictEqual(fx.run({ cwd, session_id: 's1', hook_event_name: 'UserPromptSubmit', prompt: 'Continue' }), '');
+  });
+});
+
+test('an explicitly failed edit does not touch its packet', () => {
+  within(fixture(['auth-flow']), fx => {
+    fx.run({ session_id: 's1', hook_event_name: 'PostToolUse', tool_name: 'Edit',
+      tool_input: { file_path: path.join(fx.root, 'specs/auth-flow/plan.md') }, tool_response: { is_error: true } });
+    assert.strictEqual(fx.prompt('s1', 'Continue'), '');
+  });
+});
+
+test('written content mentioning failure still touches its packet', () => {
+  within(fixture(['auth-flow']), fx => {
+    fx.run({ session_id: 's1', hook_event_name: 'PostToolUse', tool_name: 'Write',
+      tool_input: { file_path: path.join(fx.root, 'specs/auth-flow/plan.md') }, tool_response: { content: 'Failed x' } });
+    assert.match(fx.prompt('s1', 'Continue'), /Spec state changed/);
+  });
+});
+
+test('a configured specs prefix names a plain lowercase packet', () => {
+  within(fixture(['auth']), fx => {
+    fs.renameSync(path.join(fx.root, 'specs'), path.join(fx.root, 'planning'));
+    fs.writeFileSync(path.join(fx.root, '.claude/runtime.json'), JSON.stringify({ paths: { specs: 'planning' } }));
+    assert.match(fx.prompt('s1', 'Continue planning/auth'), /Spec state changed: `auth`/);
+  });
+});
+
+test('an explicit packet path records the session touch', () => {
+  within(fixture(['auth']), fx => {
+    assert.match(fx.run({ session_id: 's1', hook_event_name: 'UserPromptSubmit',
+      specPath: path.join(fs.realpathSync(fx.root), 'specs/auth'), prompt: 'Continue' }), /Spec state changed: `auth`/);
+    assert.match(fx.prompt('s1', 'Continue'), /Tollgate active/);
+  });
+});
+
+test('another session does not displace the compact tollgate cache', () => {
+  within(fixture(['auth-flow']), fx => {
+    assert.match(fx.prompt('session-a', 'specs/auth-flow'), /Spec state changed/);
+    assert.match(fx.prompt('session-b', 'specs/auth-flow'), /Spec state changed/);
+    const again = fx.prompt('session-a', 'Continue');
+    assert.match(again, /Tollgate active/);
+    assert.doesNotMatch(again, /Spec state changed/);
+  });
+});
+
 test('naming the packet in the prompt touches it and keeps the full block', () => {
   within(fixture(['auth-flow']), (fx) => {
     assert.strictEqual(fx.prompt('s1', 'Continue'), '');
@@ -113,10 +204,15 @@ test("another session's touch does not leak", () => {
   });
 });
 
-test('omp, grok and session-less payloads keep the old behaviour', () => {
+test('omp filters by touch like Claude', () => {
   within(fixture(['auth-flow'], '.omp'), (fx) => {
-    assert.match(fx.prompt('s5', 'Continue'), /Spec state changed/, 'omp is unchanged');
+    assert.strictEqual(fx.prompt('s5', 'Continue'), '', 'an untouched packet is silent under omp');
+    assert.match(fx.prompt('s5', 'specs/auth-flow'), /Spec state changed/);
+    assert.strictEqual(fx.prompt('s5b', 'Continue'), '', "another omp session's touch does not leak");
   });
+});
+
+test('grok and session-less payloads keep the old behaviour', () => {
   within(fixture(['auth-flow']), (fx) => {
     assert.match(fx.run({ hook_event_name: 'UserPromptSubmit', sessionId: 's6', prompt: 'Continue' }), /Spec/, 'grok sends sessionId');
   });
@@ -133,6 +229,53 @@ test('a prompt touch is remembered even when two packets are active', () => {
   });
 });
 
+test('an untouched session stays quiet with two active packets', () => {
+  within(fixture(['auth-flow', 'billing-2']), (fx) => {
+    assert.strictEqual(fx.prompt('s1', 'Continue'), '');
+  });
+});
+
+function invalidateTask(root, feature) {
+  fs.writeFileSync(path.join(root, 'specs', feature, 'task-01-work.md'),
+    '# Task 01: broken\n\n## Verification Plan\n\n- Command: node --test\n');
+}
+
+test('an untouched session stays quiet when a packet is invalid', () => {
+  within(fixture(['broken-flow']), (fx) => {
+    invalidateTask(fx.root, 'broken-flow');
+    assert.strictEqual(fx.prompt('s1', 'Continue'), '');
+  });
+});
+
+test('touching an invalid packet still prints its warning', () => {
+  within(fixture(['broken-flow']), (fx) => {
+    invalidateTask(fx.root, 'broken-flow');
+    assert.match(fx.prompt('s1', 'Continue specs/broken-flow'), /Invalid workflow packet/);
+  });
+});
+
+test('a session-less prompt still warns about two active packets', () => {
+  within(fixture(['auth-flow', 'billing-2']), (fx) => {
+    assert.match(fx.run({ hook_event_name: 'UserPromptSubmit', prompt: 'Continue' }), /Multiple active specs/);
+  });
+});
+
+test('a touched valid packet prints its tollgate when another packet is invalid', () => {
+  within(fixture(['auth-flow', 'broken-flow']), (fx) => {
+    invalidateTask(fx.root, 'broken-flow');
+    const output = fx.prompt('s1', 'Continue specs/auth-flow');
+    assert.match(output, /Spec state changed: `auth-flow`/);
+    assert.doesNotMatch(output, /Invalid workflow packet/);
+  });
+});
+
+test('an invalid specs root still warns an untouched session', () => {
+  within(fixture(['auth-flow']), (fx) => {
+    fs.writeFileSync(path.join(fx.root, '.claude/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+    assert.match(fx.prompt('s1', 'Continue'), /Invalid workflow packet detected: <specs>/);
+  });
+});
+
 function writeLegacyPacket(root, name) {
   const dir = path.join(root, 'specs', name);
   fs.mkdirSync(path.join(dir, 'tasks'), { recursive: true });
@@ -158,3 +301,56 @@ test('a legacy packet is noticed even when it is the only packet', () => {
     assert.match(fx.prompt('s1', 'Continue'), LEGACY_NOTICE);
   });
 });
+
+test('Claude spec-state uses one snapshot for done task receipts', (t) => {
+  within(fixture(['auth-flow']), (fx) => {
+    const trace = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-snapshot-count-'));
+    try {
+      const feature = path.join(fx.root, 'specs/auth-flow');
+      const tasks = ['task-01-work.md', 'task-02-work.md'];
+      for (const name of tasks) fs.writeFileSync(path.join(feature, name), taskContent('done'));
+      fs.writeFileSync(path.join(feature, 'task-03-work.md'), taskContent('in_progress'));
+      const scripts = path.join(fx.root, '.claude/scripts');
+      const provenance = require(path.join(scripts, 'provenance.cjs'));
+      const policy = require(path.join(scripts, 'workflow-policy.cjs'));
+      const receipt = require(path.join(scripts, 'spec-receipt.cjs'));
+      const context = provenance.deriveRuntimeContext({ projectRoot: fx.root,
+        specsRoot: path.join(fx.root, 'specs'), specFile: path.join(feature, 'plan.md'),
+        featureName: 'auth-flow', runtimeSession: 'one-snapshot' });
+      for (const name of tasks) {
+        fs.appendFileSync(path.join(feature, name), [
+          '\n## Receipt', '', 'Verification: PASS', 'Command: node --test', 'Exit: 0',
+          `Base: ${context.base}`, `Head: ${context.head}`, '```text', '1 test passed', '```', '',
+        ].join('\n'));
+        assert.deepStrictEqual(receipt.checkWorkflowTaskReceipt(feature, name, context, policy).failures, []);
+      }
+      const countFile = path.join(trace, 'git-status.txt');
+      const preload = path.join(trace, 'count.cjs');
+      fs.writeFileSync(preload, `
+const cp = require('node:child_process');
+const fs = require('node:fs');
+const path = require('node:path');
+for (const method of ['spawnSync', 'execFileSync']) {
+  const original = cp[method];
+  cp[method] = function(command, args, ...rest) {
+    if (path.basename(String(command)) === 'git' && Array.isArray(args) && args.includes('status'))
+      fs.appendFileSync(${JSON.stringify(countFile)}, 'status\\n');
+    return original.call(this, command, args, ...rest);
+  };
+}
+`);
+      const result = spawnSync(process.execPath, [path.join(fx.hooks, 'spec-state.cjs')], {
+        cwd: fx.root, encoding: 'utf8',
+        env: { ...process.env, PROJECT_ROOT: fx.root,
+          NODE_OPTIONS: `${process.env.NODE_OPTIONS || ''} --require ${JSON.stringify(preload)}` },
+        input: JSON.stringify({ cwd: fx.root, hook_event_name: 'UserPromptSubmit',
+          session_id: 'one-snapshot', prompt: 'Continue specs/auth-flow' }),
+      });
+      assert.strictEqual(result.status, 0, result.stderr);
+      assert.match(result.stdout, /Spec state changed/);
+      const count = fs.readFileSync(countFile, 'utf8').trim().split('\n').length;
+      t.diagnostic(`Claude git status calls: ${count}`);
+      assert.ok(count > 0 && count <= 2, `git status calls: ${count}; expected at most 2`);
+    } finally { fs.rmSync(trace, { recursive: true, force: true }); }
+  });
+});