@haposoft/cafekit 0.18.1 → 0.18.3

package/src/claude/hooks/lib/rules-reservation.cjs

@@ -0,0 +1,36 @@
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { hookStateDir } = require('./hook-state-dir.cjs');
+
+function reservationFile(sessionId) {
+  if (!sessionId) return null;
+  const key = crypto.createHash('sha256').update(String(sessionId)).digest('hex');
+  return path.join(hookStateDir(), `rules-${key}.json`);
+}
+
+/** Reserve one injection slot per session. Returns null on reservation errors. */
+function reserveSession(sessionId) {
+  try {
+    const file = reservationFile(sessionId);
+    if (!file) return null;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify({ sessionId: String(sessionId) }), {
+      encoding: 'utf8', flag: 'wx', mode: 0o600,
+    });
+    return true;
+  } catch (error) {
+    return error.code === 'EEXIST' ? false : null;
+  }
+}
+
+function clearSessionReservation(sessionId) {
+  try {
+    const file = reservationFile(sessionId);
+    if (file) fs.rmSync(file, { force: true });
+  } catch { /* fail-open */ }
+}
+
+module.exports = { reserveSession, clearSessionReservation };

package/src/claude/hooks/lib/spec-touch.cjs

@@ -0,0 +1,80 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+// Deleted/new paths still resolve through their deepest existing ancestor. This also
+// prevents an innocent lexical prefix from hiding a symlink outside the specs root.
+function canonicalTarget(value) {
+  const missing = [];
+  let current = path.resolve(value);
+  while (true) {
+    try { return path.join(fs.realpathSync(current), ...missing); } catch (error) {
+      if (error.code !== 'ENOENT') return null;
+      const parent = path.dirname(current);
+      if (parent === current) return null;
+      missing.unshift(path.basename(current));
+      current = parent;
+    }
+  }
+}
+
+function packetAt(value, specsRoot, cwd) {
+  if (typeof value !== 'string' || !value.trim()) return null;
+  const root = canonicalTarget(specsRoot);
+  const target = canonicalTarget(path.resolve(cwd, value));
+  if (!root || !target) return null;
+  const rel = path.relative(root, target);
+  if (!rel || path.isAbsolute(rel) || rel === '..' || rel.startsWith(`..${path.sep}`)) return null;
+  const segments = rel.split(path.sep);
+  return segments[0] === '_shared' ? null : segments[0];
+}
+
+function namedPackets(prompt, names, specsRoot, projectRoot) {
+  if (typeof prompt !== 'string') return [];
+  const escape = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const prefix = path.relative(projectRoot, specsRoot).split(path.sep).join('/');
+  const named = names.filter((name) => {
+    const n = escape(name);
+    const absolute = specsRoot.split(path.sep).join('/');
+    return new RegExp(`(^|[^\\w])${escape(absolute)}/${n}(?![\\w-])`).test(prompt)
+      || new RegExp(`(^|[^\\w/-])${escape(prefix)}/${n}(?![\\w-])`).test(prompt)
+      || new RegExp(`(?:\\$cf-[\\w-]+|/cf:[\\w-]+)\\s+(?:${escape(prefix)}/)?${n}(?![\\w-])`).test(prompt)
+      || (/[-_0-9]/.test(name) && new RegExp(`(^|[^\\w/-])${n}(?![\\w-])`).test(prompt));
+  });
+  // Absolute prompt references may use another realpath alias (notably /var on macOS).
+  const paths = [...prompt.matchAll(/(?:^|[\s"'`])((?:\/|[A-Za-z]:[\\/])[^\s"'`]+)/g)].map((match) => match[1]);
+  for (const match of prompt.matchAll(/["']([^"']+)["']/g)) {
+    if (path.isAbsolute(match[1])) paths.push(match[1]);
+  }
+  for (const value of paths) {
+    const name = packetAt(value, specsRoot, projectRoot);
+    if (names.includes(name)) named.push(name);
+  }
+  return [...new Set(named)];
+}
+
+function explicitFailure(payload) {
+  const failed = (value) => {
+    if (!value || typeof value !== 'object') return false;
+    if (value.success === false || value.is_error === true || value.isError === true
+      || value.ok === false || value.error || ['error', 'failed', 'failure'].includes(value.status)) return true;
+    return ['exit_code', 'exitCode'].some((key) => value[key] !== undefined && value[key] !== 0);
+  };
+  return payload.success === false || failed(payload.tool_response);
+}
+
+/**
+ * Every file a write tool reports touching: the Claude `file_path`, omp's `path`/`paths`
+ * (omp derives them from an edit's file headers), and the files an omp result says it
+ * changed. A glob names no file, so it is skipped.
+ */
+function touchedPaths(payload) {
+  const input = payload.tool_input || {};
+  const details = (payload.tool_response && payload.tool_response.details) || {};
+  const values = [input.file_path, input.path, ...(Array.isArray(input.paths) ? input.paths : []), details.path,
+    ...[details.perFileResults, details.fileChanges].flatMap((list) => (Array.isArray(list) ? list.map((entry) => entry && entry.path) : []))];
+  return [...new Set(values.filter((value) => typeof value === 'string' && value.trim() && !/[*?[\]{}]/.test(value)))];
+}
+
+module.exports = { canonicalTarget, packetAt, namedPackets, explicitFailure, touchedPaths };

package/src/claude/hooks/lib/update-check.cjs

@@ -0,0 +1,77 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const VERSION = /^\d+\.\d+\.\d+$/;
+const CACHE_TTL = 12 * 60 * 60 * 1000;
+
+function fetchLatestVersion() {
+  try {
+    const https = require('https');
+    return new Promise((resolve) => {
+      const req = https.get(
+        'https://registry.npmjs.org/@haposoft/cafekit/latest',
+        { timeout: 3000, headers: { Accept: 'application/json' } },
+        (res) => {
+          let body = '';
+          res.on('error', () => resolve(null));
+          res.on('aborted', () => resolve(null));
+          res.on('data', (chunk) => { body += chunk; });
+          res.on('end', () => {
+            try { resolve(JSON.parse(body).version || null); } catch { resolve(null); }
+          });
+        }
+      );
+      req.on('error', () => resolve(null));
+      req.on('timeout', () => { req.destroy(); resolve(null); });
+    });
+  } catch { return Promise.resolve(null); }
+}
+
+function isNewer(a, b) {
+  const n = (v) => String(v).split('.').map((x) => parseInt(x, 10) || 0);
+  const [aN, bN] = [n(a), n(b)];
+  for (let i = 0; i < 3; i++) {
+    if (bN[i] > aN[i]) return true;
+    if (bN[i] < aN[i]) return false;
+  }
+  return false;
+}
+
+function getInstalledVersion(runtimeDirectory) {
+  try {
+    const meta = JSON.parse(fs.readFileSync(path.join(runtimeDirectory, 'cafekit.json'), 'utf8'));
+    return typeof meta.version === 'string' ? meta.version : null;
+  } catch { return null; }
+}
+
+function noticeFor(installed, latest) {
+  return isNewer(installed, latest)
+    ? `\n⚡ CafeKit update available: ${installed} → ${latest}\n   Run: npx @haposoft/cafekit\n`
+    : '';
+}
+
+async function checkCafeKitUpdate(runtimeDirectory, fetchVersion = fetchLatestVersion) {
+  const installed = getInstalledVersion(runtimeDirectory);
+  if (!installed) return '';
+  const cachePath = path.join(runtimeDirectory, '.cafekit-update-cache.json');
+  const now = Date.now();
+  try {
+    const cache = JSON.parse(fs.readFileSync(cachePath, 'utf8'));
+    if (typeof cache.ts === 'number' && Number.isFinite(cache.ts) && cache.ts <= now
+      && now - cache.ts < CACHE_TTL && typeof cache.latest === 'string' && VERSION.test(cache.latest)) {
+      return noticeFor(installed, cache.latest);
+    }
+  } catch {
+    // Missing, corrupt or legacy cache requires a fresh version fetch.
+  }
+  let latest;
+  try { latest = await fetchVersion(); } catch { return ''; }
+  if (typeof latest !== 'string' || !VERSION.test(latest)) return '';
+  try {
+    fs.writeFileSync(cachePath, JSON.stringify({ ts: Date.now(), latest }), 'utf8');
+  } catch { /* cache persistence is optional */ }
+  return noticeFor(installed, latest);
+}
+
+module.exports = { fetchLatestVersion, isNewer, getInstalledVersion, checkCafeKitUpdate };

package/src/claude/hooks/plugin-context.cjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+/**
+ * Copyright (c) 2026 Haposoft. MIT License.
+ *
+ * SessionStart Hook — plugin-context.cjs (Claude Code plugin only)
+ *
+ * A plugin cannot ship CLAUDE.md or rules files as always-on context, so this
+ * hook injects the CafeKit core instructions as SessionStart additionalContext.
+ * The host caps that text at 10,000 characters; plugin/core.md is sized for it
+ * and points to the detailed rules files by absolute path.
+ *
+ * Registered only in the plugin's hooks.json; the npx install never runs it.
+ * Exit: 0 always (fail-open)
+ */
+
+try {
+  const fs = require('fs');
+  const path = require('path');
+
+  const os = require('os');
+
+  const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT;
+  if (!pluginRoot) process.exit(0);
+
+  function writeAtomic(file, text) {
+    const temp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(temp, text);
+    fs.renameSync(temp, file);
+  }
+
+  // A user statusLine cannot use ${CLAUDE_PLUGIN_ROOT}, which moves on every
+  // update, so keep a stable launcher in the data directory pointing at the
+  // current version, and record where it is for /cf:setup-statusline.
+  function writeStatuslineLauncher(root) {
+    const data = process.env.CLAUDE_PLUGIN_DATA;
+    if (!data || !path.isAbsolute(data)) return;
+    try {
+      const target = JSON.stringify(path.join(root, 'status.cjs'));
+      writeAtomic(path.join(data, 'status.cjs'), [
+        '#!/usr/bin/env node',
+        '// Written by the CafeKit plugin at session start; runs the installed version\'s statusline.',
+        '// A removed or replaced version prints nothing; a broken one still reports its error.',
+        `if (!require('fs').existsSync(${target})) process.exit(0);`,
+        `require(${target});`,
+        '',
+      ].join('\n'));
+      writeAtomic(path.join(os.homedir(), '.claude', 'cafekit-plugin-data'), `${data}\n`);
+    } catch { /* the statusline is optional; never fail the session for it */ }
+  }
+
+  try { fs.readFileSync(0, 'utf8'); } catch { /* the payload is not needed */ }
+
+  let core = fs.readFileSync(path.join(__dirname, '..', 'plugin', 'core.md'), 'utf8')
+    // A function replacement keeps `$&`-style sequences in the path literal.
+    .replaceAll('${CLAUDE_PLUGIN_ROOT}', () => pluginRoot);
+
+  // The npx install writes this section into CLAUDE.md; the plugin takes it from its option.
+  const address = require('./lib/plugin-options.cjs').pluginOption('address');
+  if (address) {
+    core += `\n## Addressing (Context Overflow Indicator)\n\nAlways address the user as ${JSON.stringify(address)} throughout the conversation. If you stop doing so, the context has been compacted or truncated; tell the user to consider \`/clear\`.\n`;
+  }
+
+  writeStatuslineLauncher(pluginRoot);
+
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: core },
+  }));
+  process.exit(0);
+} catch (e) {
+  try {
+    const fs = require('fs');
+    const p = require('path');
+    const d = require('./lib/hook-state-dir.cjs').hookStateDir();
+    if (!fs.existsSync(d)) fs.mkdirSync(d, { recursive: true });
+    fs.appendFileSync(p.join(d, 'hook-log.jsonl'),
+      JSON.stringify({ ts: new Date().toISOString(), hook: 'plugin-context', status: 'crash', error: e.message }) + '\n');
+  } catch (_) { /* logging must not fail the session */ }
+  process.exit(0);
+}

package/src/claude/hooks/precompact.cjs

@@ -23,27 +23,16 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const { spawnSync } = require('child_process');
 
-const RECOVERY_FILE = 'compact-recovery.json';
-
 function gitLine(root, args) {
-  const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+  const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8', timeout: 3000 });
   if (result.error || result.status !== 0) return null;
   const value = String(result.stdout || '').trim();
   return value === '' ? null : value;
 }
 
-function projectRoot(payload) {
-  const configured = typeof process.env.CLAUDE_PROJECT_DIR === 'string' ? process.env.CLAUDE_PROJECT_DIR.trim() : '';
-  const candidates = [configured, typeof payload.cwd === 'string' ? payload.cwd.trim() : '', process.cwd()];
-  for (const candidate of candidates) {
-    if (!candidate) continue;
-    try { return fs.realpathSync(path.resolve(candidate)); } catch { /* next */ }
-  }
-  return process.cwd();
-}
-
 /** The one task the packet currently says is in flight, if any. */
 function activeTask(root) {
   try {
@@ -72,13 +61,16 @@ try {
   const { normalizeHookPayload } = require('./lib/hook-payload.cjs');
   const payload = stdin ? normalizeHookPayload(JSON.parse(stdin)) : {};
   if (!payload || typeof payload !== 'object' || Array.isArray(payload)) process.exit(0);
+  const sessionId = payload.session_id;
+  if (typeof sessionId !== 'string' || !sessionId.trim()) process.exit(0);
 
+  const { projectRoot } = require('./lib/project-root.cjs');
   const root = projectRoot(payload);
   const status = gitLine(root, ['status', '--porcelain']);
   const record = {
     captured_at: new Date().toISOString(),
     trigger: typeof payload.trigger === 'string' ? payload.trigger : null,
-    session_id: typeof payload.session_id === 'string' ? payload.session_id : null,
+    session_id: sessionId,
     project_root: root,
     branch: gitLine(root, ['rev-parse', '--abbrev-ref', 'HEAD']),
     head: gitLine(root, ['rev-parse', '--short', 'HEAD']),
@@ -88,7 +80,8 @@ try {
 
   const dir = require('./lib/hook-state-dir.cjs').hookStateDir();
   fs.mkdirSync(dir, { recursive: true });
-  const target = path.join(dir, RECOVERY_FILE);
+  const key = crypto.createHash('sha256').update(sessionId).digest('hex');
+  const target = path.join(dir, `compact-recovery-${key}.json`);
   const temp = `${target}.${process.pid}.tmp`;
   fs.writeFileSync(temp, `${JSON.stringify(record, null, 2)}\n`);
   fs.renameSync(temp, target);

package/src/claude/hooks/privacy-block.cjs

@@ -14,32 +14,22 @@
  * Exit: 0 (the JSON hook output carries the permission decision)
  */
 
-try {
-  const fs = require('fs');
-  const path = require('path');
-  const { commandAccess } = require('./lib/privacy-command-analysis.cjs');
+const EVALUATION_FAILURE = 'Sensitive access could not be evaluated safely.';
 
-  const RESTRICTED_PATTERNS = [
-    /^\.env(?:[.\[*?{]|$)/i,
-    /^credentials/i,
-    /secrets?\.(ya?ml|json)$/i,
-    /\.pem$/i,
-    /\.key$/i,
-    /\.p12$/i,
-    /\.pfx$/i,
-    /^id_(rsa|ed25519|ecdsa|dsa)$/i,
-    /\.netrc$/i,
-    /\.pgpass$/i,
-    /kubeconfig/i,
-    /\.keystore$/i,
-    /\.jks$/i,
-    /auth\.json$/i,
-    /token(s)?\.json$/i
-  ];
+function askForPermission(reason) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'ask',
+      permissionDecisionReason: reason
+    }
+  }) + '\n');
+}
 
-  const ALLOWED_EXEMPTIONS = [
-    /\.env\.(example|sample|template|test)$/i
-  ];
+try {
+  const fs = require('fs');
+  const { sensitivePaths, displayNames } = require('./lib/privacy-paths.cjs');
+  const { projectRoot: resolveProjectRoot } = require('./lib/project-root.cjs');
 
   const { runtimeDirName, runtimeDir, runtimePath } = require('./lib/runtime-dir.cjs');
   function readRuntime(cwd) {
@@ -51,199 +41,28 @@ try {
     }
   }
 
-  function isSafe(filePath) {
-    const base = path.basename(filePath);
-    return ALLOWED_EXEMPTIONS.some((rule) => rule.test(base) || rule.test(filePath));
-  }
-
-  function isSensitive(filePath) {
-    const base = path.basename(filePath);
-    return RESTRICTED_PATTERNS.some((rule) => rule.test(base) || rule.test(filePath));
-  }
-
-  /**
-   * Resolve a symlink to its real target so a harmless-looking name that points
-   * at a sensitive file cannot slip through the basename check. Returns null
-   * when the path cannot be resolved (missing file, broken link) — fail-open to
-   * the original-path check in that case. See isSymlinkToSensitive for dangling handling.
-   */
-  function resolveTarget(filePath, cwd) {
-    try {
-      const requested = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
-      return fs.realpathSync(requested);
-    } catch {
-      return null;
-    }
-  }
-
-  /**
-   * When realpath fails, check whether the requested path is a symlink (or chain)
-   * whose lexical target is sensitive. Dangling link to protected target -> true (fail-closed ask);
-   * dangling benign link or link to allowed example/template -> false (allow).
-   * Limit hops to avoid loops; malformed/looping -> fail closed.
-   * TOCTOU note: check and use are not atomic; target could be swapped between this check and the actual read.
-   * This is a best-effort guardrail, not an arbitrary-shell security boundary. For strong isolation use OS sandbox.
-   */
-  function isSymlinkToSensitive(filePath, cwd) {
-    try {
-      const requested = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
-      let current = requested;
-      let hops = 0;
-      const MAX_HOPS = 8;
-      while (hops < MAX_HOPS) {
-        let stat;
-        try {
-          stat = fs.lstatSync(current);
-        } catch {
-          return false;
-        }
-        if (!stat.isSymbolicLink()) return false;
-        let linkTarget;
-        try {
-          linkTarget = fs.readlinkSync(current);
-        } catch {
-          return true;
-        }
-        if (isSensitive(linkTarget) && !isSafe(linkTarget)) return true;
-        if (isSafe(linkTarget)) return false;
-        const next = path.isAbsolute(linkTarget) ? linkTarget : path.resolve(path.dirname(current), linkTarget);
-        if (next === current) return true;
-        try {
-          const real = fs.realpathSync(next);
-          if (isSensitive(real) && !isSafe(real)) return true;
-          if (isSafe(real)) return false;
-          return false;
-        } catch {
-          current = next;
-          hops += 1;
-          continue;
-        }
-      }
-      return true;
-    } catch {
-      return true;
-    }
-  }
-
-  function extractBashPaths(command) {
-    // The analyzer parses the command and returns the operands of every reading
-    // command it recognises, nested shells and `find -exec` included. Treating
-    // every unresolved expansion as sensitive, as this did before, asked on
-    // `cat $FILE`, `wc -l *.cjs` and `cat ~/.zshrc` alike. Noise is what trains
-    // people to click through the prompt that matters.
-    // A heredoc whose delimiter is quoted (<<'BODY') is inert: the shell
-    // expands nothing inside it, so no word in the body is ever read. The
-    // analyzer has no notion of heredocs and parses the body as shell, so prose
-    // that quotes a command -- a PR body carrying `cat .env` in backticks --
-    // came back as a real command substitution. Blank those bodies out first.
-    // An unquoted delimiter (<<BODY) does expand, so it is left to the
-    // analyzer.
-    const scrubbed = String(command).replace(
-      /(<<-?[ \t]*)(['"])([A-Za-z_]\w*)\2[^\n]*\n[\s\S]*?\n[ \t]*\3\b/g,
-      '$1$2$3$2'
-    );
-
-    const paths = new Set(commandAccess(scrubbed).paths);
-
-    // Two shapes the analyzer cannot return. It drops any word carrying an
-    // expansion, so `~/.ssh/id_rsa` and `certs/*.pem` still have to be matched
-    // by name. And it only walks commands it recognises, so an unknown tool
-    // handed a secret through a file-shaped option, such as
-    // `docker compose --env-file .env`, is invisible to it.
-    const FILE_OPTION = /^--?[\w-]*(?:file|config|key|cert|identity)$/i;
-    const tokens = scrubbed.split(/[\s|;&<>"'()`]+/);
-    for (let index = 0; index < tokens.length; index += 1) {
-      const token = tokens[index];
-      const shaped = /^~|[*?[{]/.test(token);
-      const optionFed = index > 0 && FILE_OPTION.test(tokens[index - 1]);
-      if (!shaped && !optionFed) continue;
-      const value = token.replace(/^~/, '').replace(/^["'()`]+|["'(),]+$/g, '');
-      if (value && isSensitive(value) && !isSafe(value)) paths.add(value);
-    }
-
-    return [...paths];
-  }
-
-  function extractPaths(toolName, input) {
-    const paths = [];
-    if (!input) return paths;
-
-    for (const key of ['file_path', 'path']) {
-      if (typeof input[key] === 'string' && input[key].trim()) {
-        paths.push(input[key].trim());
-      }
-    }
-
-    for (const key of ['paths', 'search_paths']) {
-      if (Array.isArray(input[key])) {
-        paths.push(...input[key].filter(Boolean));
-      }
-    }
-
-    if (toolName === 'Bash' && typeof input.command === 'string') {
-      paths.push(...extractBashPaths(input.command));
-    }
-
-    return paths.filter(Boolean);
-  }
-
-  function askForPermission(filePath) {
-    const basename = path.basename(filePath);
-    process.stdout.write(JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: 'PreToolUse',
-        permissionDecision: 'ask',
-        permissionDecisionReason: `Sensitive file access requires approval: ${basename}`
-      }
-    }) + '\n');
-  }
-
   const stdin = fs.readFileSync(0, 'utf8').trim();
-  if (!stdin) process.exit(0);
+  if (!stdin) {
+    askForPermission(EVALUATION_FAILURE);
+    process.exit(0);
+  }
 
   const { normalizeHookPayload } = require('./lib/hook-payload.cjs');
   const data = normalizeHookPayload(JSON.parse(stdin));
   const toolName = data.tool_name || '';
   const toolInput = data.tool_input || {};
   const cwd = typeof data.cwd === 'string' && data.cwd.trim() ? data.cwd : process.cwd();
-  const runtime = readRuntime(cwd);
-
-  if (runtime.privacyBlock === false) process.exit(0);
-
-  const paths = extractPaths(toolName, toolInput);
-  if (!paths.length) process.exit(0);
+  const projectRoot = resolveProjectRoot(data);
+  const runtime = readRuntime(projectRoot);
 
-  for (const filePath of paths) {
-    const target = resolveTarget(filePath, cwd);
+  // A plugin is trusted once for every repository, so a repository cannot switch it off.
+  if (runtime.privacyBlock === false && !require('./lib/plugin-options.cjs').isPlugin()) process.exit(0);
 
-    // The real target is authoritative: an exempt-looking alias must not hide
-    // a sensitive target, while a real .env.example target remains safe.
-    if (target) {
-      if (isSensitive(target) && !isSafe(target)) {
-        askForPermission(filePath);
-        process.exit(0);
-      }
-      if (isSafe(target)) continue;
-    } else {
-      if (isSymlinkToSensitive(filePath, cwd)) {
-        askForPermission(filePath);
-        process.exit(0);
-      }
-    }
-
-    if (isSafe(filePath) || !isSensitive(filePath)) continue;
-    askForPermission(filePath);
-    process.exit(0);
-  }
+  const paths = sensitivePaths(toolName, toolInput, cwd);
+  if (paths.length) askForPermission(`Sensitive file access requires approval: ${displayNames(paths)}`);
 
   process.exit(0);
 } catch (_) {
-  process.stdout.write(JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: 'ask',
-      permissionDecisionReason: 'Sensitive access could not be evaluated safely.'
-    }
-  }) + '\n');
+  askForPermission(EVALUATION_FAILURE);
   process.exit(0);
 }

package/src/claude/hooks/rules.cjs

@@ -11,12 +11,12 @@
  */
 
 try {
-  const crypto = require('crypto');
   const fs   = require('fs');
-  const os   = require('os');
   const path = require('path');
 
   const { runtimeDirName, runtimeDir, runtimePath } = require('./lib/runtime-dir.cjs');
+  const { projectRoot } = require('./lib/project-root.cjs');
+  const { reserveSession } = require('./lib/rules-reservation.cjs');
   function readRuntime(cwd) {
     try {
       const p = runtimePath(cwd, 'runtime.json');
@@ -24,26 +24,6 @@ try {
     } catch { return null; }
   }
 
-  /** Reserve one injection slot per session. Returns null on reservation errors. */
-  function reserveSession(sessionId) {
-    if (!sessionId) return null;
-    try {
-      const key = crypto.createHash('sha256')
-        .update(String(sessionId))
-        .digest('hex')
-        .slice(0, 16);
-      const file = path.join(os.tmpdir(), `cafekit-rules-${key}.json`);
-      fs.writeFileSync(file, JSON.stringify({ sessionId: String(sessionId) }), {
-        encoding: 'utf8',
-        flag: 'wx',
-        mode: 0o600
-      });
-      return true;
-    } catch (error) {
-      return error.code === 'EEXIST' ? false : null;
-    }
-  }
-
   // ── Main ──────────────────────────────────────────────────────────────────
 
   const stdin = fs.readFileSync(0, 'utf8').trim();
@@ -52,22 +32,23 @@ try {
   const { normalizeHookPayload } = require('./lib/hook-payload.cjs');
   const payload   = normalizeHookPayload(JSON.parse(stdin));
   const sessionId = payload.session_id || null;
-  const payloadCwd = typeof payload.cwd === 'string' ? payload.cwd.trim() : '';
-  const cwd       = payloadCwd || process.env.PROJECT_ROOT || process.cwd();
+  const root = projectRoot(payload);
+  // An npx install always has runtime.json; under the plugin it is optional.
+  // Loaded only under the plugin, so npx installs need no extra hook file.
+  const plugin = process.env.CLAUDE_PLUGIN_ROOT ? require('./lib/plugin-options.cjs') : null;
+  const runtime = readRuntime(root) || (plugin ? {} : null);
+  if (runtime === null) process.exit(0);
 
   // No session identity or reservation means no injection. Fail open.
   if (reserveSession(sessionId) !== true) process.exit(0);
 
-  const runtime = readRuntime(cwd);
-  if (runtime === null) process.exit(0);
-
   // Language
   const thinkLang   = runtime.locale?.thinkingLanguage || '';
-  const respondLang = runtime.locale?.responseLanguage || '';
+  const respondLang = runtime.locale?.responseLanguage || (plugin ? plugin.pluginOption('response_language') : '');
   const effectThink = thinkLang || (respondLang ? 'en' : '');
 
   // Paths
-  const baseDir   = cwd;
+  const baseDir   = root;
   const plansPath = path.join(baseDir, runtime.paths?.plans || 'plans');
   const docsPath  = path.join(baseDir, runtime.paths?.docs  || 'docs');
   const specsPath = path.join(baseDir, runtime.paths?.specs || 'specs');