@haposoft/cafekit 0.18.1 → 0.18.3

package/src/claude/hooks/__tests__/plugin-state-isolation.test.js

@@ -0,0 +1,125 @@
+'use strict';
+
+const { test, before, after } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const BUILD = path.resolve(__dirname, '../../../../scripts/build-claude-plugin.mjs');
+const SAMPLE_PAYLOADS = {
+  SessionStart: { source: 'startup' },
+  UserPromptSubmit: { prompt: 'hello' },
+  PreToolUse: { tool_name: 'Read', tool_input: { file_path: 'README.md' } },
+  PostToolUse: { tool_name: 'Edit', tool_input: { file_path: 'README.md' }, tool_response: {} },
+  Stop: { stop_hook_active: false },
+  SubagentStart: { agent_type: 'cf:debugger' },
+  SubagentStop: { agent_type: 'cf:debugger', stop_hook_active: false, last_assistant_message: 'done' },
+  PreCompact: { trigger: 'manual' },
+};
+
+let work;
+let tree;
+
+function walk(root) {
+  if (!fs.existsSync(root)) return [];
+  return fs.readdirSync(root, { withFileTypes: true }).flatMap((entry) => {
+    const full = path.join(root, entry.name);
+    return entry.isDirectory() ? [`${full}/`, ...walk(full)] : [full];
+  }).sort();
+}
+
+function makeRepo(name, withDotClaude) {
+  const repo = path.join(work, name);
+  fs.mkdirSync(repo, { recursive: true });
+  spawnSync('git', ['init', '-q'], { cwd: repo });
+  fs.writeFileSync(path.join(repo, 'README.md'), '# demo\n');
+  if (withDotClaude) {
+    fs.mkdirSync(path.join(repo, '.claude'));
+    fs.writeFileSync(path.join(repo, '.claude/settings.local.json'), '{}\n');
+  }
+  return repo;
+}
+
+// Runs every hook the plugin registers, the way Claude Code would, and returns
+// the SessionStart output so callers can inspect it.
+function runAllHooks(repo, env) {
+  const { hooks } = JSON.parse(fs.readFileSync(path.join(tree, 'hooks/hooks.json'), 'utf8'));
+  let sessionOutput = '';
+  for (const [event, entries] of Object.entries(hooks)) {
+    for (const entry of entries) {
+      for (const { command } of entry.hooks) {
+        const file = command.match(/hooks\/([^"]+)"$/)[1];
+        const payload = { session_id: 'isolation-test', hook_event_name: event, cwd: repo, transcript_path: path.join(repo, 'none.jsonl'), ...SAMPLE_PAYLOADS[event] };
+        const run = spawnSync('node', [path.join(tree, 'hooks', file)], {
+          cwd: repo, input: JSON.stringify(payload), encoding: 'utf8', timeout: 20000,
+          env: { ...process.env, HOME: path.join(work, 'home'), CLAUDE_PLUGIN_ROOT: tree, CLAUDE_PROJECT_DIR: repo, ...env },
+        });
+        assert.equal(run.status, 0, `${event} ${file}: ${run.stderr}`);
+        if (event === 'SessionStart') sessionOutput += run.stdout;
+      }
+    }
+  }
+  return sessionOutput;
+}
+
+before(() => {
+  work = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-plugin-isolation-'));
+  tree = path.join(work, 'cf');
+  const built = spawnSync('node', [BUILD, '--out', tree], { encoding: 'utf8' });
+  assert.equal(built.status, 0, built.stderr);
+});
+
+after(() => fs.rmSync(work, { recursive: true, force: true }));
+
+for (const [label, withDotClaude] of [['empty-repo', false], ['repo-with-dot-claude', true]]) {
+  test(`${label}: hooks write only under CLAUDE_PLUGIN_DATA`, () => {
+    const repo = makeRepo(label, withDotClaude);
+    const data = fs.mkdtempSync(path.join(work, `data-${label}-`));
+    const repoBefore = walk(repo);
+    const treeBefore = walk(tree);
+    runAllHooks(repo, { CLAUDE_PLUGIN_DATA: data });
+    assert.deepEqual(walk(repo), repoBefore, 'the project gained files');
+    assert.deepEqual(walk(tree), treeBefore, 'the plugin tree gained files');
+    assert.ok(walk(data).some((p) => p.endsWith('hook-log.jsonl') || p.includes('session-states')), 'no state under CLAUDE_PLUGIN_DATA');
+  });
+}
+
+test('no-data-env-uses-tmp: without CLAUDE_PLUGIN_DATA state goes to the OS temp directory', () => {
+  const repo = makeRepo('no-data', true);
+  const tmp = fs.mkdtempSync(path.join(work, 'tmp-'));
+  const repoBefore = walk(repo);
+  const treeBefore = walk(tree);
+  runAllHooks(repo, { CLAUDE_PLUGIN_DATA: '', TMPDIR: tmp });
+  assert.deepEqual(walk(repo), repoBefore, 'the project gained files');
+  assert.deepEqual(walk(tree), treeBefore, 'the plugin tree gained files');
+  const uid = typeof process.getuid === 'function' ? process.getuid() : 'user';
+  assert.ok(walk(path.join(tmp, `cafekit-plugin-${uid}`)).length > 0, 'no state under the temp directory');
+});
+
+test('no-npx-notice: the plugin session hook prints no npx update notice and writes no update cache', () => {
+  const repo = makeRepo('npx-notice', true);
+  // An old npx install left version metadata behind; the plugin must ignore it.
+  fs.writeFileSync(path.join(repo, '.claude/cafekit.json'), JSON.stringify({ version: '0.0.1' }));
+  // A fresh cached "latest" makes the npx branch print its notice without any
+  // network access, so this test cannot pass merely because the registry is unreachable.
+  const cache = path.join(repo, '.claude/.cafekit-update-cache.json');
+  const cacheBytes = JSON.stringify({ ts: Date.now(), latest: '99.0.0' });
+  fs.writeFileSync(cache, cacheBytes);
+  const data = fs.mkdtempSync(path.join(work, 'data-notice-'));
+  const output = runAllHooks(repo, { CLAUDE_PLUGIN_DATA: data });
+  assert.doesNotMatch(output, /npx @haposoft\/cafekit/);
+  assert.equal(fs.readFileSync(cache, 'utf8'), cacheBytes, 'update cache rewritten');
+});
+
+test('npx-branch-unchanged: outside a plugin, source-tree hooks keep the temp log directory', () => {
+  const script = `delete process.env.CLAUDE_PLUGIN_ROOT; delete process.env.CLAUDE_PLUGIN_DATA;
+    process.stdout.write(require(${JSON.stringify(path.resolve(__dirname, '../lib/hook-state-dir.cjs'))}).hookStateDir());`;
+  const env = { ...process.env };
+  delete env.CLAUDE_PLUGIN_ROOT;
+  delete env.CLAUDE_PLUGIN_DATA;
+  const run = spawnSync('node', ['-e', script], { encoding: 'utf8', env });
+  assert.equal(run.status, 0, run.stderr);
+  assert.equal(run.stdout, path.join(os.tmpdir(), 'cafekit-hook-logs', 'claude'));
+});

package/src/claude/hooks/__tests__/precompact.test.js

@@ -5,17 +5,33 @@
 // fixture; the capture is asserted from the file it writes and from what the
 // next session actually prints.
 
-const { test } = require('node:test');
+const { test, after } = require('node:test');
 const assert = require('node:assert');
 const { spawnSync } = require('node:child_process');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const crypto = require('node:crypto');
+
+// Hooks run from source keep state under os.tmpdir(); a private one per test process
+// keeps a parallel run of this file from reading or clearing this run's state.
+const PRIVATE_TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-precompact-tmp-'));
+for (const key of ['TMPDIR', 'TMP', 'TEMP']) process.env[key] = PRIVATE_TMP;
+after(() => { fs.rmSync(PRIVATE_TMP, { recursive: true, force: true }); });
 
 const PRECOMPACT = path.join(__dirname, '..', 'precompact.cjs');
 const SESSION = path.join(__dirname, '..', 'session.cjs');
 const { hookStateDir } = require(path.join(__dirname, '..', 'lib', 'hook-state-dir.cjs'));
-const RECOVERY = path.join(hookStateDir(), 'compact-recovery.json');
+const CAPTURES = new Set([path.join(hookStateDir(), 'compact-recovery.json')]);
+function recoveryPath(session = 'compact-session') {
+  const key = crypto.createHash('sha256').update(session).digest('hex');
+  const file = path.join(hookStateDir(), `compact-recovery-${key}.json`);
+  CAPTURES.add(file);
+  return file;
+}
+const HOOK_ENV = { ...process.env };
+delete HOOK_ENV.CLAUDE_PROJECT_DIR;
+delete HOOK_ENV.PROJECT_ROOT;
 
 function fixture() {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-precompact-'));
@@ -36,21 +52,24 @@ function fixture() {
 }
 
 function run(hook, dir, payload) {
+  if (typeof payload?.session_id === 'string' && payload.session_id.trim()) recoveryPath(payload.session_id);
   const result = spawnSync(process.execPath, [hook], {
     cwd: dir,
     input: JSON.stringify(payload),
     encoding: 'utf8',
-    env: { ...process.env, CLAUDE_PROJECT_DIR: dir },
+    env: HOOK_ENV,
   });
   return { code: result.status, stdout: result.stdout || '', stderr: result.stderr || '' };
 }
 
 function clearCapture() {
-  try { fs.unlinkSync(RECOVERY); } catch { /* absent */ }
+  for (const file of CAPTURES) {
+    try { fs.unlinkSync(file); } catch { /* absent */ }
+  }
 }
 
-function readCapture() {
-  return JSON.parse(fs.readFileSync(RECOVERY, 'utf8'));
+function readCapture(session) {
+  return JSON.parse(fs.readFileSync(recoveryPath(session), 'utf8'));
 }
 
 test('PreCompact records branch, HEAD, dirty count and the in-flight task', () => {
@@ -93,8 +112,8 @@ test('a compact restart prints the captured anchors alongside the authorization
   const dir = fixture();
   try {
     clearCapture();
-    assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', trigger: 'manual', cwd: dir }).code, 0);
-    const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', cwd: dir });
+    assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', trigger: 'manual', session_id: 'compact-session', cwd: dir }).code, 0);
+    const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', session_id: 'compact-session', cwd: dir });
     assert.strictEqual(restart.code, 0, restart.stderr);
     assert.match(restart.stdout, /VERIFY PENDING AUTHORIZATIONS/, 'the existing warning must survive');
     assert.match(restart.stdout, /State before compaction/);
@@ -119,6 +138,53 @@ test('a compact restart without a capture still prints the warning and nothing i
   }
 });
 
+test('a compact restart in another session prints the warning without foreign anchors', () => {
+  const dir = fixture();
+  try {
+    clearCapture();
+    assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', session_id: 'session-a', cwd: dir }).code, 0);
+    const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', session_id: 'session-b', cwd: dir });
+    assert.strictEqual(restart.code, 0, restart.stderr);
+    assert.match(restart.stdout, /SESSION COMPRESSED/);
+    assert.doesNotMatch(restart.stdout, /State before compaction/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+    clearCapture();
+  }
+});
+
+test('a compact restart in the same session restores its captured anchors', () => {
+  const dir = fixture();
+  try {
+    clearCapture();
+    assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', session_id: 'session-a', cwd: dir }).code, 0);
+    const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', session_id: 'session-a', cwd: dir });
+    assert.strictEqual(restart.code, 0, restart.stderr);
+    assert.match(restart.stdout, /SESSION COMPRESSED/);
+    assert.match(restart.stdout, /State before compaction[\s\S]*branch work/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+    clearCapture();
+  }
+});
+
+for (const [captureId, restartId] of [[undefined, 'session-a'], ['session-a', undefined], [undefined, undefined]]) {
+  test(`a compact restart without ${captureId ? 'restart' : restartId ? 'capture' : 'either'} session identity keeps only the warning`, () => {
+    const dir = fixture();
+    try {
+      clearCapture();
+      assert.strictEqual(run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', session_id: captureId, cwd: dir }).code, 0);
+      const restart = run(SESSION, dir, { hook_event_name: 'SessionStart', source: 'compact', session_id: restartId, cwd: dir });
+      assert.strictEqual(restart.code, 0, restart.stderr);
+      assert.match(restart.stdout, /SESSION COMPRESSED/);
+      assert.doesNotMatch(restart.stdout, /State before compaction/);
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+      clearCapture();
+    }
+  });
+}
+
 test('a normal session start prints no compaction anchors', () => {
   const dir = fixture();
   try {
@@ -138,7 +204,7 @@ test('PreCompact fails open outside a repository and on malformed input', () =>
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-precompact-bare-'));
   try {
     clearCapture();
-    const noGit = run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', cwd: dir });
+    const noGit = run(PRECOMPACT, dir, { hook_event_name: 'PreCompact', session_id: 'compact-session', cwd: dir });
     assert.strictEqual(noGit.code, 0, 'a directory outside git must not fail the hook');
     const record = readCapture();
     assert.strictEqual(record.branch, null, 'unavailable git facts are recorded as null, never guessed');
@@ -147,12 +213,148 @@ test('PreCompact fails open outside a repository and on malformed input', () =>
 
     clearCapture();
     const malformed = spawnSync(process.execPath, [PRECOMPACT], {
-      cwd: dir, input: 'not json', encoding: 'utf8', env: { ...process.env, CLAUDE_PROJECT_DIR: dir },
+      cwd: dir, input: 'not json', encoding: 'utf8', env: HOOK_ENV,
     });
     assert.strictEqual(malformed.status, 0, 'malformed payload must fail open');
-    assert.strictEqual(fs.existsSync(RECOVERY), false, 'a malformed payload writes no capture');
+    assert.strictEqual(fs.existsSync(recoveryPath()), false, 'a malformed payload writes no capture');
   } finally {
     fs.rmSync(dir, { recursive: true, force: true });
     clearCapture();
   }
 });
+
+function installedFixture(callback) {
+  const root = fixture();
+  const source = path.resolve(__dirname, '../..');
+  const manifest = require('../../migration-manifest.json');
+  const sessions = new Set();
+  try {
+    for (const relative of manifest.runtime.files) {
+      const target = path.join(root, '.claude', relative);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(path.join(source, relative), target);
+    }
+    for (const relative of manifest.scripts.required) {
+      const target = path.join(root, '.claude/scripts', relative);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.copyFileSync(path.join(source, 'scripts', relative), target);
+    }
+    const hooks = path.join(root, '.claude/hooks');
+    const invoke = (name, payload, overrides = {}) => {
+      if (typeof payload?.session_id === 'string' && payload.session_id.trim()) sessions.add(payload.session_id);
+      return spawnSync(process.execPath, [path.join(hooks, `${name}.cjs`)], {
+        cwd: root, env: HOOK_ENV, encoding: 'utf8', timeout: 10000,
+        input: typeof payload === 'string' ? payload : JSON.stringify(payload), ...overrides,
+      });
+    };
+    callback({ root: fs.realpathSync(root), hooks, invoke });
+  } finally {
+    for (const session of sessions) {
+      const key = crypto.createHash('sha256').update(session).digest('hex').slice(0, 16);
+      fs.rmSync(path.join(os.tmpdir(), `cafekit-rules-${key}.json`), { force: true });
+    }
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+test('two compacting sessions keep separate anchors and restore only their own branch', () => {
+  installedFixture(({ root, hooks, invoke }) => {
+    const sessions = [crypto.randomUUID(), crypto.randomUUID()];
+    const files = [];
+    for (const [index, session_id] of sessions.entries()) {
+      const branch = `anchor-${index === 0 ? 'first' : 'second'}`;
+      const checkout = spawnSync('git', ['-C', root, 'checkout', '-qb', branch], { encoding: 'utf8' });
+      assert.strictEqual(checkout.status, 0, checkout.stderr);
+      const capture = invoke('precompact', { hook_event_name: 'PreCompact', session_id, cwd: root });
+      assert.strictEqual(capture.status, 0, capture.stderr);
+      const hash = crypto.createHash('sha256').update(session_id).digest('hex');
+      files.push(path.join(hooks, '.logs', `compact-recovery-${hash}.json`));
+    }
+    for (const [index, file] of files.entries()) {
+      assert.ok(fs.existsSync(file), 'both session captures must survive');
+      const record = JSON.parse(fs.readFileSync(file, 'utf8'));
+      assert.strictEqual(record.session_id, sessions[index]);
+      assert.strictEqual(record.branch, `anchor-${index === 0 ? 'first' : 'second'}`);
+    }
+    for (const [index, session_id] of sessions.entries()) {
+      const compact = invoke('session', { hook_event_name: 'SessionStart', source: 'compact', session_id, cwd: root });
+      assert.strictEqual(compact.status, 0, compact.stderr);
+      assert.match(compact.stdout, /SESSION COMPRESSED/);
+      assert.match(compact.stdout, /State before compaction/);
+      assert.ok(compact.stdout.includes(`branch anchor-${index === 0 ? 'first' : 'second'}`));
+      assert.ok(!compact.stdout.includes(`branch anchor-${index === 0 ? 'second' : 'first'}`));
+    }
+  });
+});
+
+test('PreCompact without a usable session identity creates no anchor or state directory', () => {
+  installedFixture(({ root, hooks, invoke }) => {
+    for (const session_id of [undefined, null, '', 42, '   ']) {
+      const capture = invoke('precompact', { hook_event_name: 'PreCompact', session_id, cwd: root });
+      assert.strictEqual(capture.status, 0, capture.stderr);
+      assert.strictEqual(fs.existsSync(path.join(hooks, '.logs')), false);
+    }
+  });
+});
+
+test('compact reinjects rules only for its own session even without matching anchors', () => {
+  installedFixture(({ root, hooks, invoke }) => {
+    const session = crypto.randomUUID();
+    const other = crypto.randomUUID();
+    const prompt = id => invoke('rules', { hook_event_name: 'UserPromptSubmit', session_id: id, cwd: root });
+    for (const id of [session, other]) {
+      const first = prompt(id);
+      assert.strictEqual(first.status, 0, first.stderr);
+      assert.match(first.stdout, /## Rules/);
+      assert.strictEqual(prompt(id).stdout, '');
+    }
+    fs.mkdirSync(path.join(hooks, '.logs'), { recursive: true });
+    const otherHash = crypto.createHash('sha256').update(other).digest('hex');
+    fs.writeFileSync(path.join(hooks, '.logs', `compact-recovery-${otherHash}.json`), JSON.stringify({ session_id: other }));
+    const compact = invoke('session', { hook_event_name: 'SessionStart', source: 'compact', session_id: session, cwd: root });
+    assert.strictEqual(compact.status, 0, compact.stderr);
+    assert.match(compact.stdout, /SESSION COMPRESSED/);
+    assert.doesNotMatch(compact.stdout, /State before compaction/);
+    const again = prompt(session);
+    assert.strictEqual(again.status, 0, again.stderr);
+    assert.match(again.stdout, /## Rules/);
+    assert.strictEqual(prompt(other).stdout, '');
+  });
+});
+
+test('malformed session input fails open without a stack and logs its crash', () => {
+  installedFixture(({ hooks, invoke }) => {
+    const result = invoke('session', '{');
+    assert.strictEqual(result.status, 0);
+    assert.strictEqual(result.stderr, '');
+    const rows = fs.readFileSync(path.join(hooks, '.logs/hook-log.jsonl'), 'utf8').trim().split('\n').map(line => JSON.parse(line));
+    assert.strictEqual(rows.length, 1);
+    assert.strictEqual(rows[0].hook, 'session');
+    assert.strictEqual(rows[0].status, 'crash');
+  });
+});
+
+test('installed session explains a nested cwd but omits the root line without a cwd', () => {
+  installedFixture(({ root, invoke }) => {
+    const cwd = path.join(root, 'sub/dir');
+    fs.mkdirSync(cwd, { recursive: true });
+    const nested = invoke('session', { source: 'startup', cwd }, { cwd });
+    assert.strictEqual(nested.status, 0, nested.stderr);
+    assert.ok(nested.stdout.includes(`CafeKit project root: ${root} (session working directory: ${cwd}).`));
+    const missing = invoke('session', { source: 'startup' }, { cwd });
+    assert.strictEqual(missing.status, 0, missing.stderr);
+    assert.doesNotMatch(missing.stdout, /CafeKit project root:/);
+  });
+});
+
+test('PreCompact bounds slow git calls and finishes within ten seconds', { timeout: 15000 }, () => {
+  installedFixture(({ root, invoke }) => {
+    const bin = path.join(root, 'fake-bin');
+    fs.mkdirSync(bin);
+    fs.writeFileSync(path.join(bin, 'git'), '#!/bin/sh\nexec /bin/sleep 30\n', { mode: 0o755 });
+    const start = Date.now();
+    const result = invoke('precompact', { hook_event_name: 'PreCompact', session_id: crypto.randomUUID(), cwd: root }, { env: { ...HOOK_ENV, PATH: bin } });
+    assert.strictEqual(result.status, 0, 'slow git must not exhaust the hook timeout');
+    assert.ok(Date.now() - start < 10000);
+  });
+});

package/src/claude/hooks/__tests__/privacy-block.test.js

@@ -11,12 +11,16 @@ const os = require('node:os');
 const path = require('node:path');
 
 const HOOK = path.join(__dirname, '..', 'privacy-block.cjs');
+const HOOK_ENV = { ...process.env };
+delete HOOK_ENV.CLAUDE_PROJECT_DIR;
+delete HOOK_ENV.PROJECT_ROOT;
 
 /** Run the hook with a tool payload; return process output. */
 function runHook(payload, cwd) {
   const res = spawnSync(process.execPath, [HOOK], {
     input: JSON.stringify({ ...payload, cwd: cwd || payload.cwd }),
     encoding: 'utf8',
+    env: HOOK_ENV,
   });
   return { code: res.status, stdout: res.stdout || '', stderr: res.stderr || '' };
 }
@@ -30,6 +34,29 @@ function permissionDecision(stdout) {
   return JSON.parse(stdout).hookSpecificOutput?.permissionDecision || null;
 }
 
+test('sensitive reads list sorted distinct basenames and the remaining count', () => {
+  const dir = tmpDir();
+  try {
+    const command = 'cat token.json nested/.env secrets.json credentials.json .env';
+    const { code, stdout } = runHook({ tool_name: 'Bash', tool_input: { command } }, dir);
+    assert.strictEqual(code, 0);
+    const output = JSON.parse(stdout).hookSpecificOutput;
+    assert.strictEqual(output.permissionDecision, 'ask');
+    assert.strictEqual(output.permissionDecisionReason,
+      'Sensitive file access requires approval: .env, credentials.json, secrets.json (+1 more)');
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('empty stdin asks because sensitive access cannot be evaluated safely', () => {
+  const result = spawnSync(process.execPath, [HOOK], { input: '', encoding: 'utf8', env: HOOK_ENV });
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  assert.deepStrictEqual(JSON.parse(result.stdout).hookSpecificOutput, {
+    hookEventName: 'PreToolUse', permissionDecision: 'ask',
+    permissionDecisionReason: 'Sensitive access could not be evaluated safely.',
+  });
+});
+
 test('asks natively for a direct Read of .env', () => {
   const dir = tmpDir();
   try {
@@ -183,20 +210,17 @@ for (const command of [
 }
 
 // --- Accepted gap: pure indirection ---
-// The target of `$FILE` is unknowable without running the shell. Treating every
+// The target of a bare `$FILE` is unknowable without running the shell. Treating every
 // unresolved expansion as sensitive asked on `cat ~/.zshrc`, `wc -l *.cjs` and
-// `du -sh */` too, so these are allowed by design. `less "$HOME/.env"` is the
-// edge of that decision: a literal secret joined to a variable goes through.
+// `du -sh */` too, so these are allowed by design. A secret's name spelled out next to
+// the expansion -- `"$HOME/.env"`, `$(echo .env)` -- is not indirection and asks below.
 for (const command of [
   'cat $FILE',
   'cat "$FILE"',
   'cat ${FILE}',
   'cat $1',
-  'cat $(echo .env)',
-  'cat `echo .env`',
   'head $SECRET',
   'tail ${MY_FILE}',
-  'less "$HOME/.env"',
   'cat README.md $EXTRA',
   'echo ok; cat README.md $FILE',
   'cat README.md | head $FILE',
@@ -288,14 +312,29 @@ for (const command of [
   });
 }
 
-test('an assignment naming a secret does not ask, with or without a later read', () => {
+for (const command of ['cat $(echo .env)', 'cat `echo .env`', 'less "$HOME/.env"']) {
+  test(`asks when a secret's name is spelled out next to an expansion: ${command}`, () => {
+    const dir = tmpDir();
+    try {
+      const result = runHook({ tool_name: 'Bash', tool_input: { command } }, dir);
+      assert.strictEqual(permissionDecision(result.stdout), 'ask');
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+}
+
+test('an assignment naming a secret asks only when the same command reads it through the variable', () => {
   const dir = tmpDir();
   try {
     const assigned = runHook({ tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat README.md' } }, dir);
     assert.strictEqual(permissionDecision(assigned.stdout), null);
-    // Pure indirection: the hook cannot resolve $FILE without running the shell.
+    // A literal assigned earlier in the same command is resolved, so reading it through the variable asks.
     const read = runHook({ tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat "$FILE"' } }, dir);
-    assert.strictEqual(permissionDecision(read.stdout), null);
+    assert.strictEqual(permissionDecision(read.stdout), 'ask');
+    // A prefix assignment does not reach the expansion: the shell expands $FILE first.
+    const prefix = runHook({ tool_name: 'Bash', tool_input: { command: 'FILE=.env cat "$FILE"' } }, dir);
+    assert.strictEqual(permissionDecision(prefix.stdout), null);
     // Spelling the target out again does ask.
     const literal = runHook({ tool_name: 'Bash', tool_input: { command: 'FILE=.env; cat .env' } }, dir);
     assert.strictEqual(permissionDecision(literal.stdout), 'ask');
@@ -371,3 +410,15 @@ test('fails closed on malformed/looping symlink (hop limit)', () => {
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+
+test('a Claude Read of an ordinary path is not affected by omp selector handling', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-privacy-selector-'));
+  try {
+    fs.writeFileSync(path.join(root, 'notes.md'), 'hi\n');
+    const result = spawnSync(process.execPath, [HOOK], {
+      input: JSON.stringify({ tool_name: 'Read', tool_input: { file_path: path.join(root, 'notes.md') }, cwd: root }),
+      encoding: 'utf8', env: HOOK_ENV,
+    });
+    assert.equal(result.stdout.trim(), '');
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});

package/src/claude/hooks/__tests__/session-writeenv.test.js

@@ -17,6 +17,31 @@ const path = require('node:path');
 
 const HOOK = path.join(__dirname, '..', 'session.cjs');
 
+test('session.cjs does not export GIT_URL or remote userinfo', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-session-remote-'));
+  const envFile = path.join(dir, 'env.sh');
+  try {
+    git(['init', '-q'], dir);
+    const userinfo = 'fixture-user:fixture-placeholder';
+    const remote = `https://${userinfo}@example.invalid/r.git`;
+    const configured = spawnSync('git', ['remote', 'add', 'origin', remote], { cwd: dir, encoding: 'utf8' });
+    assert.strictEqual(configured.status, 0, 'fake remote setup must succeed');
+    const result = spawnSync(process.execPath, [HOOK], {
+      cwd: dir, input: JSON.stringify({ source: 'startup', cwd: dir }), encoding: 'utf8',
+      env: { ...process.env, CLAUDE_ENV_FILE: envFile },
+    });
+    assert.strictEqual(result.status, 0, 'session hook must exit successfully');
+    assert.ok(fs.existsSync(envFile), 'session env file must exist');
+    const content = fs.readFileSync(envFile, 'utf8');
+    assert.deepStrictEqual({
+      exportsGitUrl: /^\s*(?:export\s+)?GIT_URL=/m.test(content),
+      containsUserInfo: content.includes(userinfo),
+    }, { exportsGitUrl: false, containsUserInfo: false });
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 function git(args, cwd) {
   const res = spawnSync('git', args, { cwd, encoding: 'utf8' });
   if (res.status !== 0) {