@haposoft/cafekit 0.18.1 → 0.18.3

package/bin/__tests__/codex-hooks.test.js

@@ -5,9 +5,84 @@ const crypto = require('node:crypto');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { spawnSync } = require('node:child_process');
+const { spawnSync, spawn } = require('node:child_process');
 const { test } = require('node:test');
 
+const OLD_INSPECTION_MATCHER = 'Bash|exec_command|apply_patch|Edit|Write|Read|Glob|Grep|mcp__.*|shell';
+const NEW_INSPECTION_MATCHER = 'Bash|exec_command|shell|apply_patch|mcp__.*|collaborationspawn_agent|collaborationwait_agent';
+function matcherFixture(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-matcher-'));
+  const previous = process.cwd();
+  const config = JSON.parse(fs.readFileSync(path.resolve(__dirname, '../../src/codex/hooks.json'), 'utf8'));
+  const messages = [], warnings = [];
+  const ctx = { dryRun: false, results: { updated: 0, unchanged: 0, errors: 0 },
+    manifest: require('../../src/claude/migration-manifest.json'),
+    ui: { detail: value => messages.push(value), warn: value => warnings.push(value) } };
+  const file = path.join(root, '.codex/hooks.json');
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true }); process.chdir(root);
+    const merge = require('../phases/codex-hooks.js').mergeCodexHooks;
+    run({ root, config, ctx, file, messages, warnings, merge: () => merge(ctx, 'codex', root),
+      save: () => fs.writeFileSync(file, JSON.stringify(config)), read: () => JSON.parse(fs.readFileSync(file, 'utf8')) });
+  } finally { process.chdir(previous); fs.rmSync(root, { recursive: true, force: true }); }
+}
+test('upgrade refreshes a former managed inspection matcher and reports it', () => matcherFixture(f => {
+  f.config.hooks.PreToolUse[0].matcher = OLD_INSPECTION_MATCHER; f.save();
+  const before = fs.readFileSync(f.file, 'utf8');
+  f.ctx.dryRun = true; f.merge();
+  assert.equal(fs.readFileSync(f.file, 'utf8'), before);
+  assert.ok(f.messages.some(line => /↻.*matcher updated/.test(line)));
+  f.ctx.dryRun = false; f.messages.length = 0; f.merge();
+  assert.equal(f.read().hooks.PreToolUse[0].matcher, NEW_INSPECTION_MATCHER);
+  assert.ok(f.messages.some(line => /↻.*matcher updated/.test(line)));
+  assert.ok(!f.messages.some(line => /already registered/.test(line)));
+}));
+test('upgrade preserves a mixed user group and warns', () => matcherFixture(f => {
+  f.config.hooks.PreToolUse[0].matcher = OLD_INSPECTION_MATCHER;
+  f.config.hooks.PreToolUse[0].hooks.push({ type: 'command', command: 'echo user-owned' }); f.save(); f.merge();
+  assert.equal(f.read().hooks.PreToolUse[0].matcher, OLD_INSPECTION_MATCHER);
+  assert.ok(f.read().hooks.PreToolUse[0].hooks.some(h => h.command === 'echo user-owned'));
+  assert.ok(f.warnings.some(line => /matcher.*preserv/i.test(line)));
+}));
+test('reinstall keeps purely user groups unchanged without matcher warnings', () => matcherFixture(f => {
+  const userPre = { matcher: 'Bash', hooks: [{ command: 'my-linter' }] };
+  const userPost = { hooks: [{ command: 'my-logger' }] };
+  f.config.hooks = { PreToolUse: [userPre], PostToolUse: [userPost] }; f.save();
+  const installs = Array.from({ length: 2 }, () => {
+    const result = spawnSync(process.execPath, [path.resolve(__dirname, '../install.js'), '--platform', 'codex', '-y'], {
+      cwd: f.root, encoding: 'utf8',
+    });
+    return { result, config: f.read() };
+  });
+  for (const { result, config } of installs) {
+    assert.equal(result.status, 0, result.stderr);
+    for (const [event, original] of [['PreToolUse', userPre], ['PostToolUse', userPost]]) {
+      const group = config.hooks[event].find(g => g.hooks.some(h => h.command === original.hooks[0].command));
+      assert.equal(JSON.stringify(group), JSON.stringify(original));
+    }
+    assert.doesNotMatch(result.stdout + result.stderr, /matcher preserved/);
+  }
+}));
+test('fresh hook registration uses every template matcher', () => matcherFixture(f => {
+  f.merge();
+  for (const [event, groups] of Object.entries(f.config.hooks)) {
+    assert.deepEqual(f.read().hooks[event].map(g => g.matcher), groups.map(g => g.matcher));
+  }
+}));
+test('upgrade preserves a user-selected managed matcher and warns', () => matcherFixture(f => {
+  f.config.hooks.PreToolUse[0].matcher = 'Read|Grep'; f.save(); f.merge();
+  assert.equal(f.read().hooks.PreToolUse[0].matcher, 'Read|Grep');
+  assert.ok(f.warnings.some(line => /matcher.*preserv/i.test(line)));
+}));
+test('upgrade refreshes the surviving group after retired hooks are pruned', () => matcherFixture(f => {
+  f.config.hooks.PreToolUse[0].matcher = OLD_INSPECTION_MATCHER;
+  f.config.hooks.PreToolUse[0].hooks.push({ type: 'command', command: 'node ".codex/hooks/task-scaffold-guard.cjs"' });
+  f.save(); f.merge();
+  assert.equal(f.read().hooks.PreToolUse[0].matcher, NEW_INSPECTION_MATCHER);
+  assert.ok(!JSON.stringify(f.read()).includes('task-scaffold-guard'));
+  assert.ok(f.messages.some(line => /matcher updated/.test(line)));
+}));
+
 const PACKAGE_ROOT = path.join(__dirname, '../..');
 const CODEX_HOOKS = path.join(PACKAGE_ROOT, 'src/codex/hooks');
 const PROVENANCE = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/provenance.cjs'));
@@ -68,12 +143,24 @@ function writeProcessTask(featureDir, status, receiptLines = null, command = 'pn
 function inHookFixture(run, options = {}) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-hooks-'));
   const hooks = path.join(root, '.codex', 'hooks');
+  let deferred = false;
   try {
     fs.cpSync(CODEX_HOOKS, hooks, { recursive: true });
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/spec-touch.cjs'), path.join(hooks, 'lib/spec-touch.cjs'));
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/secret-keywords.cjs'), path.join(hooks, 'lib/secret-keywords.cjs'));
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/update-check.cjs'), path.join(hooks, 'lib/update-check.cjs'));
+    fs.copyFileSync(
+      path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/inspect-paths.cjs'),
+      path.join(hooks, 'lib/inspect-paths.cjs'),
+    );
     fs.copyFileSync(
       path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/privacy-command-analysis.cjs'),
       path.join(hooks, 'lib/privacy-command-analysis.cjs'),
     );
+    fs.copyFileSync(
+      path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/privacy-paths.cjs'),
+      path.join(hooks, 'lib/privacy-paths.cjs'),
+    );
     fs.copyFileSync(
       path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/runtime-path-safety.cjs'),
       path.join(hooks, 'lib/runtime-path-safety.cjs'),
@@ -106,9 +193,14 @@ function inHookFixture(run, options = {}) {
       const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
       assert.equal(result.status, 0, result.stderr);
     }
-    return run(root, hooks);
+    const result = run(root, hooks);
+    if (result && typeof result.then === 'function') {
+      deferred = true;
+      return result.finally(() => fs.rmSync(root, { recursive: true, force: true }));
+    }
+    return result;
   } finally {
-    fs.rmSync(root, { recursive: true, force: true });
+    if (!deferred) fs.rmSync(root, { recursive: true, force: true });
   }
 }
 
@@ -120,6 +212,116 @@ function processTaskContent(title, status, dependency = 'none') {
   ].join('\n');
 }
 
+function inNoCommitCodexFixture(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-no-commit-'));
+  const hooks = path.join(root, '.codex/hooks');
+  try {
+    fs.cpSync(CODEX_HOOKS, hooks, { recursive: true });
+    for (const name of ['privacy-paths.cjs', 'privacy-command-analysis.cjs']) {
+      fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib', name), path.join(hooks, 'lib', name));
+    }
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/spec-touch.cjs'), path.join(hooks, 'lib/spec-touch.cjs'));
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/secret-keywords.cjs'), path.join(hooks, 'lib/secret-keywords.cjs'));
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/update-check.cjs'), path.join(hooks, 'lib/update-check.cjs'));
+    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/runtime-path-safety.cjs'),
+      path.join(hooks, 'lib/runtime-path-safety.cjs'));
+    const scripts = path.join(root, '.codex/scripts');
+    fs.mkdirSync(scripts, { recursive: true });
+    for (const name of ['workflow-policy.cjs', 'provenance.cjs', 'spec-receipt.cjs', 'spec-resolver.cjs']) {
+      fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/scripts', name), path.join(scripts, name));
+    }
+    for (const args of [['init', '-q'], ['config', 'user.email', 'cafekit@example.invalid'], ['config', 'user.name', 'CafeKit Test']]) {
+      const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+      assert.equal(result.status, 0, result.stderr);
+    }
+    const writePacket = (feature, status) => {
+      const dir = path.join(root, 'specs', feature);
+      fs.mkdirSync(dir, { recursive: true });
+      fs.writeFileSync(path.join(dir, 'plan.md'), '# Plan\nSpecs-Contract: process-first-ready-v1\n');
+      fs.writeFileSync(path.join(dir, 'task-01-work.md'), processTaskContent('Task 01: work', status)
+        + (status === 'done' ? '\n## Receipt\n\nVerification: PASS\n' : ''));
+    };
+    const invoke = (hook, event) => runHook(path.join(hooks, `${hook}.cjs`), root, {
+      cwd: root, session_id: 'no-commit-codex', hook_event_name: event, prompt: 'Continue specs/auth',
+    });
+    run({ writePacket, gate: () => invoke('spec-gate', 'Stop'), state: () => invoke('spec-state', 'UserPromptSubmit') });
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+}
+
+test('Codex collaborationspawn_agent appears as the latest tracked tool on resume', () => {
+  inHookFixture((root, hooks) => {
+    const state = path.join(hooks, 'state.cjs');
+    const session = { cwd: root, session_id: 'spawn-tracking' };
+    const tracked = runHook(state, root, {
+      ...session, hook_event_name: 'PostToolUse', tool_name: 'collaborationspawn_agent',
+      tool_input: { message: 'Inspect the parser behavior' },
+    });
+    assert.equal(tracked.status, 0, tracked.stderr);
+    const resumed = runHook(state, root, { ...session, hook_event_name: 'SessionStart', source: 'resume' });
+    assert.equal(resumed.status, 0, resumed.stderr);
+    assert.match(resumed.stdout, /Latest Tracked Tool/);
+    assert.match(resumed.stdout, /collaborationspawn_agent/);
+  });
+});
+
+test('Codex collaborationspawn_agent input does not create a pending todo', () => {
+  inHookFixture((root, hooks) => {
+    const state = path.join(hooks, 'state.cjs');
+    const session = { cwd: root, session_id: 'spawn-no-todo' };
+    const title = 'Inspect parser without creating a todo';
+    const tracked = runHook(state, root, {
+      ...session, hook_event_name: 'PostToolUse', tool_name: 'collaborationspawn_agent',
+      tool_input: { id: 'spawn-child', title },
+    });
+    assert.equal(tracked.status, 0, tracked.stderr);
+    const resumed = runHook(state, root, { ...session, hook_event_name: 'SessionStart', source: 'resume' });
+    assert.equal(resumed.status, 0, resumed.stderr);
+    assert.match(resumed.stdout, /Latest Tracked Tool/);
+    assert.match(resumed.stdout, /collaborationspawn_agent/);
+    const pending = resumed.stdout.match(/## What's Left\n([\s\S]*?)(?=\n## |$)/);
+    assert.ok(pending, 'the pending task section must be present');
+    assert.ok(!pending[1].includes(title), 'spawn metadata must not become a pending task');
+  });
+});
+
+test('Codex no commits allows Stop without done tasks and prints one reminder', () => {
+  inNoCommitCodexFixture(({ writePacket, gate, state }) => {
+    writePacket('auth', 'in_progress');
+    const stopped = gate();
+    assert.equal(stopped.status, 0, stopped.stderr);
+    assert.equal(stopped.stdout.trim(), '');
+    const prompted = state();
+    assert.equal(prompted.status, 0, prompted.stderr);
+    assert.match(prompted.stdout, /no commits/);
+    assert.equal(prompted.stdout.trim().split('\n').length, 1);
+    assert.doesNotMatch(prompted.stdout, /Spec tollgate unavailable/);
+  });
+});
+
+test('Codex no commits blocks a done task with first commit guidance', () => {
+  inNoCommitCodexFixture(({ writePacket, gate }) => {
+    writePacket('auth', 'done');
+    const result = gate();
+    assert.equal(result.status, 0, result.stderr);
+    const body = JSON.parse(result.stdout);
+    assert.equal(body.decision, 'block');
+    assert.match(body.reason, /first commit/);
+    assert.doesNotMatch(body.reason, /controlled failure/);
+  });
+});
+
+test('Codex no commits blocks two completed packets with first commit guidance', () => {
+  inNoCommitCodexFixture(({ writePacket, gate }) => {
+    for (const feature of ['auth', 'billing']) writePacket(feature, 'done');
+    const result = gate();
+    assert.equal(result.status, 0, result.stderr);
+    const body = JSON.parse(result.stdout);
+    assert.equal(body.decision, 'block');
+    assert.match(body.reason, /first commit/);
+    assert.doesNotMatch(body.reason, /controlled failure/);
+  });
+});
+
 function canonicalProcessTask(root, title, dependency = 'none') {
   const context = workflowRuntimeContext(root, 'auth', 'session-auth-state');
   return [
@@ -300,6 +502,57 @@ test('Codex Stop still blocks a recorded missing packet and reads a plan.md + sp
   });
 });
 
+test('Codex installed spec-state uses one snapshot for done task receipts', (t) => {
+  inInstalledProcessSpecStateFixture(({ feature, hooks, root, writeTask }) => {
+    const trace = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-codex-snapshot-count-'));
+    try {
+      const tasks = ['task-01-work.md', 'task-02-work.md'];
+      for (const name of tasks) writeTask(name, name, 'done');
+      writeTask('task-03-work.md', 'Task 03: work', 'in_progress');
+      const scripts = path.join(root, '.codex/scripts');
+      const provenance = require(path.join(scripts, 'provenance.cjs'));
+      const policy = require(path.join(scripts, 'workflow-policy.cjs'));
+      const receipt = require(path.join(scripts, 'spec-receipt.cjs'));
+      const context = provenance.deriveRuntimeContext({ projectRoot: root,
+        specsRoot: path.join(root, 'specs'), specFile: path.join(feature, 'plan.md'),
+        featureName: 'auth', runtimeSession: 'one-snapshot' });
+      for (const name of tasks) {
+        fs.appendFileSync(path.join(feature, name), [
+          '\n## Receipt', '', 'Verification: PASS', 'Command: node --test', 'Exit: 0',
+          `Base: ${context.base}`, `Head: ${context.head}`, '```text', '1 test passed', '```', '',
+        ].join('\n'));
+        assert.deepEqual(receipt.checkWorkflowTaskReceipt(feature, name, context, policy).failures, []);
+      }
+      const countFile = path.join(trace, 'git-status.txt');
+      const preload = path.join(trace, 'count.cjs');
+      fs.writeFileSync(preload, `
+const cp = require('node:child_process');
+const fs = require('node:fs');
+const path = require('node:path');
+for (const method of ['spawnSync', 'execFileSync']) {
+  const original = cp[method];
+  cp[method] = function(command, args, ...rest) {
+    if (path.basename(String(command)) === 'git' && Array.isArray(args) && args.includes('status'))
+      fs.appendFileSync(${JSON.stringify(countFile)}, 'status\\n');
+    return original.call(this, command, args, ...rest);
+  };
+}
+`);
+      const result = spawnSync(process.execPath, [path.join(hooks, 'spec-state.cjs')], {
+        cwd: root, encoding: 'utf8',
+        env: { ...process.env, NODE_OPTIONS: `${process.env.NODE_OPTIONS || ''} --require ${JSON.stringify(preload)}` },
+        input: JSON.stringify({ cwd: root, featureName: 'auth', hook_event_name: 'UserPromptSubmit',
+          session_id: 'one-snapshot', prompt: 'Continue specs/auth' }),
+      });
+      assert.equal(result.status, 0, result.stderr);
+      assert.match(result.stdout, /Spec state changed/);
+      const count = fs.readFileSync(countFile, 'utf8').trim().split('\n').length;
+      t.diagnostic(`Codex git status calls: ${count}`);
+      assert.ok(count > 0 && count <= 2, `git status calls: ${count}; expected at most 2`);
+    } finally { fs.rmSync(trace, { recursive: true, force: true }); }
+  });
+});
+
 test('Codex installed spec-state re-evaluates a standalone task when blocked becomes pending', () => {
   inInstalledProcessSpecStateFixture(({ findCacheFile, hooks, runState, writeTask }) => {
     writeTask('task-01-auth.md', 'Task 01: auth', 'blocked');
@@ -456,6 +709,534 @@ test('Codex resolver accepts unique legacy task numbers, rejects ambiguity, and
   });
 });
 
+test('Codex inspect still denies blocked reads when the configured specs path escapes', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+    const result = runHook(path.join(hooks, 'inspect-block.cjs'), root, {
+      cwd: root, hook_event_name: 'PreToolUse', tool_name: 'Read', tool_input: { file_path: 'dist/index.html' },
+    });
+    assert.equal(result.status, 2);
+    assert.match(result.stderr, /SCOPE LIMIT EXCEEDED/);
+  });
+});
+
+test('Codex rules still inject when the configured specs path escapes', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+    const result = runHook(path.join(hooks, 'rules.cjs'), root, {
+      cwd: root, hook_event_name: 'UserPromptSubmit', session_id: 'invalid-specs-rules',
+    });
+    assert.equal(result.status, 0);
+    assert.match(result.stdout, /## Rules/);
+    assert.ok(result.stdout.includes(`${fs.realpathSync(root)}/specs/`));
+  });
+});
+
+test('Codex rules wait for runtime before reserving the same session', () => {
+  inHookFixture((root, hooks) => {
+    const file = path.join(root, '.codex/runtime.json');
+    const payload = { cwd: root, hook_event_name: 'UserPromptSubmit', session_id: 'waiting-for-runtime' };
+    const hook = path.join(hooks, 'rules.cjs');
+    assert.equal(fs.existsSync(file), false);
+    const absent = runHook(hook, root, payload);
+    assert.equal(absent.status, 0);
+    assert.equal(absent.stdout, '');
+    fs.writeFileSync(file, JSON.stringify({ paths: { specs: 'specs' } }));
+    const present = runHook(hook, root, payload);
+    assert.equal(present.status, 0);
+    assert.match(present.stdout, /## Rules/);
+    assert.equal(runHook(hook, root, payload).stdout, '');
+  });
+});
+
+test('Codex secret guardrail runs from source with its shared keyword shim', () => {
+  const env = { ...process.env };
+  delete env.CLAUDE_PROJECT_DIR;
+  delete env.PROJECT_ROOT;
+  const result = spawnSync(process.execPath, [path.join(CODEX_HOOKS, 'secret-output-guardrail.cjs')], {
+    cwd: PACKAGE_ROOT, env, encoding: 'utf8', input: JSON.stringify({ prompt: 'Explain secret handling.' }),
+  });
+  assert.equal(result.status, 0);
+  assert.equal(result.stderr, '');
+  assert.match(result.stdout, /## Secret handling/);
+});
+
+test('Codex secret guardrail fails open without a keyword library or a stack', () => {
+  inHookFixture((root, hooks) => {
+    fs.unlinkSync(path.join(hooks, 'lib/secret-keywords.cjs'));
+    const result = runHook(path.join(hooks, 'secret-output-guardrail.cjs'), root, { prompt: 'Explain secret handling.' });
+    assert.equal(result.status, 0);
+    assert.equal(result.stdout, '');
+    assert.equal(result.stderr, '');
+    const rows = fs.readFileSync(path.join(hooks, '.logs/hook-log.jsonl'), 'utf8').trim().split('\n').map(line => JSON.parse(line));
+    assert.equal(rows.length, 1);
+    assert.equal(rows[0].hook, 'secret-output-guardrail');
+  });
+});
+
+for (const invalidSpecs of [false, true]) {
+  test(`Codex compact warns about pending confirmations${invalidSpecs ? ' with an invalid specs path' : ''}`, () => {
+    inHookFixture((root, hooks) => {
+      fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: invalidSpecs ? '../outside' : 'specs' } }));
+      const result = runHook(path.join(hooks, 'session.cjs'), root, {
+        cwd: root, hook_event_name: 'SessionStart', source: 'compact', session_id: 'compact-session',
+      });
+      assert.equal(result.status, 0);
+      assert.match(result.stdout, /Pending.*(?:confirmation|approval)/i);
+      assert.match(result.stdout, /(?:request|ask).*?(?:fresh|again|user)/i);
+    });
+  });
+}
+
+test('Codex compact clears its pending privacy request even with an invalid specs path', () => {
+  inHookFixture((root, hooks) => {
+    const privacy = require(path.join(hooks, 'lib/privacy-state.cjs'));
+    privacy.createPending({ projectRoot: root, sessionCwd: root, sessionId: 'compact-session', filePaths: ['.env'] });
+    const dir = path.join(hooks, '.privacy');
+    const pending = () => fs.readdirSync(dir).filter(name => name.startsWith('pending-'));
+    assert.equal(pending().length, 1);
+    fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+    const result = runHook(path.join(hooks, 'session.cjs'), root, {
+      cwd: root, hook_event_name: 'SessionStart', source: 'compact', session_id: 'compact-session',
+    });
+    assert.equal(result.status, 0);
+    assert.equal(pending().length, 0);
+  });
+});
+
+// Two privacy blocks racing on a fresh project both see no `.privacy` directory;
+// the second mkdir then meets the directory the first one made.
+test('Codex privacy records a request when another hook creates its state directory first', () => {
+  inHookFixture((root, hooks) => {
+    const privacy = require(path.join(hooks, 'lib/privacy-state.cjs'));
+    fs.mkdirSync(path.join(hooks, '.privacy'), { mode: 0o700 });
+    const existsSync = fs.existsSync;
+    fs.existsSync = target => (path.basename(String(target)) === '.privacy' ? false : existsSync(target));
+    let request;
+    try {
+      request = privacy.createPending({ projectRoot: root, sessionCwd: root, sessionId: 'race-session', filePaths: ['.env'] });
+    } finally {
+      fs.existsSync = existsSync;
+    }
+    assert.match(request.requestId, /^[a-f0-9]{24}$/);
+  });
+});
+
+test('Codex privacy denies when its state path is a regular file', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(hooks, '.privacy'), '');
+    const result = runHook(path.join(hooks, 'privacy-block.cjs'), root, {
+      cwd: root, session_id: 'file-state', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: 'cat .env' },
+    });
+    assert.equal(result.status, 0);
+    const output = JSON.parse(result.stdout).hookSpecificOutput;
+    assert.equal(output.permissionDecision, 'deny');
+    assert.match(output.permissionDecisionReason, /could not be evaluated safely/);
+  });
+});
+
+test('Codex compact releases only its own rules reservation', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.codex/runtime.json'), '{}');
+    const prompt = session_id => runHook(path.join(hooks, 'rules.cjs'), root, { cwd: root, hook_event_name: 'UserPromptSubmit', session_id });
+    for (const id of ['session-s', 'session-t']) {
+      assert.match(prompt(id).stdout, /## Rules/);
+      assert.equal(prompt(id).stdout, '');
+    }
+    const compact = runHook(path.join(hooks, 'session.cjs'), root, {
+      cwd: root, hook_event_name: 'SessionStart', source: 'compact', session_id: 'session-s',
+    });
+    assert.equal(compact.status, 0);
+    assert.match(prompt('session-s').stdout, /## Rules/);
+    assert.equal(prompt('session-t').stdout, '');
+  });
+});
+
+test('Codex precompact ignores empty stdin without recording a crash', () => {
+  inHookFixture((root, hooks) => {
+    const result = spawnSync(process.execPath, [path.join(hooks, 'precompact.cjs')], {
+      cwd: root, input: '', encoding: 'utf8',
+    });
+    assert.equal(result.status, 0);
+    assert.equal(result.stderr, '');
+    const file = path.join(hooks, '.logs/hook-log.jsonl');
+    const rows = fs.existsSync(file)
+      ? fs.readFileSync(file, 'utf8').trim().split('\n').filter(Boolean).map(line => JSON.parse(line))
+      : [];
+    assert.equal(rows.filter(row => row.hook === 'precompact' && row.status === 'crash').length, 0);
+  });
+});
+
+test('Codex precompact anchors are restored only to the matching session', () => {
+  inHookFixture((root, hooks) => {
+    const head = spawnSync('git', ['rev-parse', '--short', 'HEAD'], { cwd: root, encoding: 'utf8' }).stdout.trim();
+    const status = spawnSync('git', ['status', '--porcelain'], { cwd: root, encoding: 'utf8' });
+    assert.equal(status.status, 0);
+    const dirty = status.stdout.trim().split('\n').filter(Boolean).length;
+    const capture = runHook(path.join(hooks, 'precompact.cjs'), root, {
+      cwd: root, hook_event_name: 'PreCompact', trigger: 'auto', session_id: 'session-s',
+    });
+    assert.equal(capture.status, 0, capture.stderr);
+    const restart = session_id => runHook(path.join(hooks, 'session.cjs'), root, {
+      cwd: root, hook_event_name: 'SessionStart', source: 'compact', session_id,
+    });
+    const own = restart('session-s');
+    assert.equal(own.status, 0);
+    assert.match(own.stdout, /State before compaction/);
+    assert.ok(own.stdout.includes(`HEAD ${head}`));
+    assert.ok(own.stdout.includes(`${dirty} uncommitted path(s)`));
+    const other = restart('session-t');
+    assert.equal(other.status, 0);
+    assert.match(other.stdout, /Pending/i);
+    assert.doesNotMatch(other.stdout, /State before compaction/);
+  });
+});
+
+function sessionWithoutUpdateNetwork(root, hooks, session_id) {
+  const marker = path.join(root, 'update-network-attempted');
+  const preload = path.join(root, 'block-update-network.cjs');
+  fs.writeFileSync(preload, `require('https').get = () => {
+    require('fs').writeFileSync(${JSON.stringify(marker)}, 'attempted');
+    throw new Error('network disabled in update test');
+  };\n`);
+  const result = spawnSync(process.execPath, ['--require', preload, path.join(hooks, 'session.cjs')], {
+    cwd: root, encoding: 'utf8', input: JSON.stringify({ cwd: root, hook_event_name: 'SessionStart', source: 'startup', session_id }),
+  });
+  assert.equal(fs.existsSync(marker), false, 'the cached update check must not attempt a network request');
+  return result;
+}
+
+test('Codex SessionStart prints a newer cached CafeKit version', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.codex/cafekit.json'), JSON.stringify({ version: '1.2.3' }));
+    fs.writeFileSync(path.join(root, '.codex/.cafekit-update-cache.json'), JSON.stringify({ ts: Date.now(), latest: '1.3.0' }));
+    const result = sessionWithoutUpdateNetwork(root, hooks, 'cached-update');
+    assert.equal(result.status, 0);
+    assert.ok(result.stdout.includes('\n⚡ CafeKit update available: 1.2.3 → 1.3.0\n   Run: npx @haposoft/cafekit\n'));
+  });
+});
+
+test('Codex SessionStart stays silent about an equal cached CafeKit version', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.codex/cafekit.json'), JSON.stringify({ version: '1.2.3' }));
+    fs.writeFileSync(path.join(root, '.codex/.cafekit-update-cache.json'), JSON.stringify({ ts: Date.now(), latest: '1.2.3' }));
+    const result = sessionWithoutUpdateNetwork(root, hooks, 'equal-update');
+    assert.equal(result.status, 0);
+    assert.doesNotMatch(result.stdout, /CafeKit update available/);
+  });
+});
+
+test('Codex update failure still clears pending privacy for the session', () => {
+  inHookFixture((root, hooks) => {
+    const privacy = require(path.join(hooks, 'lib/privacy-state.cjs'));
+    privacy.createPending({ projectRoot: root, sessionCwd: root, sessionId: 'failed-update', filePaths: ['.env'] });
+    fs.writeFileSync(path.join(root, '.codex/cafekit.json'), JSON.stringify({ version: '1.2.3' }));
+    fs.writeFileSync(path.join(hooks, 'lib/update-check.cjs'), "module.exports = { checkCafeKitUpdate() { throw new Error('synthetic update failure'); } };\n");
+    const result = sessionWithoutUpdateNetwork(root, hooks, 'failed-update');
+    assert.equal(result.status, 0);
+    assert.equal(result.stderr, '');
+    const pending = fs.readdirSync(path.join(hooks, '.privacy')).filter(name => name.startsWith('pending-'));
+    assert.equal(pending.length, 0);
+  });
+});
+
+test('Codex Stop describes an escaping specs root as an invalid workflow packet', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+    const result = runHook(path.join(hooks, 'spec-gate.cjs'), root, {
+      cwd: root, session_id: 'invalid-root-message', hook_event_name: 'Stop', stop_hook_active: false,
+    });
+    assert.equal(result.status, 0);
+    const output = JSON.parse(result.stdout);
+    assert.equal(output.decision, 'block');
+    assert.match(output.reason, /^Completion gate: invalid workflow packet detected \(<specs>\):/);
+    assert.doesNotMatch(output.reason, /controlled failure/);
+  });
+});
+
+test('Codex spec-state shows detailed task status counts on its Phase line', () => {
+  inInstalledProcessSpecStateFixture(({ writeTask, runState }) => {
+    for (const [name, status] of [['task-01-active.md', 'in_progress'], ['task-02-next.md', 'pending'],
+      ['task-03-blocked.md', 'blocked'], ['task-04-later.md', 'pending']]) {
+      writeTask(name, name, status);
+    }
+    const result = runState();
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /^- Phase: .* \| Tasks: 0 done \/ 4 total \(1 in_progress, 2 pending, 1 blocked\)$/m);
+  });
+});
+
+function shortPrivacyFixture(check) {
+  return inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(root, '.env'), 'fixture\n');
+    fs.writeFileSync(path.join(root, 'credentials.json'), '{}\n');
+    const dir = path.join(hooks, '.privacy');
+    const session = 'short-approval-session';
+    const payload = (file = '.env', session_id = session) => ({ cwd: root, session_id,
+      hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: `cat ${file}` } });
+    const block = (file, id) => runHook(path.join(hooks, 'privacy-block.cjs'), root, payload(file, id));
+    const submit = (prompt, session_id = session, env = process.env) => spawnSync(process.execPath,
+      [path.join(hooks, 'privacy-approval.cjs')], { cwd: root, encoding: 'utf8', env,
+        input: JSON.stringify({ cwd: root, session_id, hook_event_name: 'UserPromptSubmit', prompt }) });
+    const files = prefix => fs.existsSync(dir) ? fs.readdirSync(dir).filter(name => name.startsWith(prefix)) : [];
+    const id = result => {
+      assert.equal(result.status, 0, result.stderr);
+      const reason = JSON.parse(result.stdout).hookSpecificOutput.permissionDecisionReason;
+      const match = reason.match(/APPROVE CAFEKIT PRIVACY ([a-f0-9]{24})/);
+      assert.ok(match, reason);
+      return match[1];
+    };
+    return check({ root, hooks, dir, session, payload, block, submit, files, id });
+  });
+}
+
+function asyncPrivacyBlock(fixture, file) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [path.join(fixture.hooks, 'privacy-block.cjs')], { cwd: fixture.root });
+    let stdout = '', stderr = '';
+    child.stdout.on('data', chunk => { stdout += chunk; });
+    child.stderr.on('data', chunk => { stderr += chunk; });
+    child.on('error', reject);
+    child.on('close', status => resolve({ status, stdout, stderr }));
+    child.stdin.end(JSON.stringify(fixture.payload(file)));
+  });
+}
+
+for (const [label, prompt] of [['y', 'y'], ['yes', 'yes'], ['title-case Vietnamese', 'Có'],
+  ['padded y', ' y '], ['decomposed Vietnamese', 'co\u0301'], ['uppercase Vietnamese', 'CÓ'], ['terminal newline', 'Y\r\n']]) {
+  test(`Codex short privacy approval accepts ${label} and reports granted paths`, () => shortPrivacyFixture(f => {
+    const denied = f.block();
+    const requestId = f.id(denied);
+    const sessionHash = crypto.createHash('sha256').update(f.session).digest('hex');
+    assert.deepEqual(f.files('short-'), [`short-${sessionHash}-${requestId}.json`]);
+    assert.match(denied.stdout, /y \(or yes \/ có\)/);
+    const result = f.submit(prompt);
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /User approved/);
+    assert.match(JSON.parse(result.stdout).hookSpecificOutput.additionalContext, /Tell the user.*\.env.*before reading/i);
+    assert.equal(f.files('token-').length, 1);
+    assert.equal(f.files('short-').length, 0);
+    assert.equal(f.block().stdout, '');
+    assert.equal(f.block().stdout, '', 'the one-hour grant remains reusable');
+  }));
+}
+
+test('Codex short privacy approval is cancelled by an intervening prompt', () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  assert.equal(f.submit('ok làm đi').status, 0);
+  const result = f.submit('y');
+  assert.equal(result.status, 0, result.stderr);
+  assert.doesNotMatch(result.stdout, /User approved/);
+  assert.equal(f.files('token-').length, 0);
+  assert.equal(f.files('short-').length, 0);
+  assert.match(f.block().stdout, /"permissionDecision":"deny"/);
+}));
+
+test('Codex short privacy approval stays in its session and requires pending state', () => shortPrivacyFixture(f => {
+  assert.equal(f.submit('y').status, 0);
+  assert.equal(f.files('token-').length, 0);
+  f.id(f.block());
+  assert.doesNotMatch(f.submit('y', 'another-session').stdout, /User approved/);
+  assert.equal(f.files('token-').length, 0);
+  assert.match(f.submit('y').stdout, /User approved/);
+}));
+
+for (const [label, prompt] of [['extra Vietnamese text', 'y nhé'], ['extra English text', 'yes please'],
+  ['repeated letter', 'yy'], ['fullwidth letter', 'ｙ'], ['zero-width suffix', 'y\u200b']]) {
+  test(`Codex short privacy approval rejects ${label}`, () => shortPrivacyFixture(f => {
+    f.id(f.block());
+    const result = f.submit(prompt);
+    assert.equal(result.status, 0, result.stderr);
+    assert.doesNotMatch(result.stdout, /User approved/);
+    assert.equal(f.files('token-').length, 0);
+    assert.equal(f.files('short-').length, 0);
+    assert.doesNotMatch(f.submit('y').stdout, /User approved/);
+  }));
+}
+
+test('Codex short privacy approval refuses two requests while the long phrase selects one', () => shortPrivacyFixture(f => {
+  const first = f.id(f.block());
+  f.id(f.block('credentials.json'));
+  const result = f.submit('y');
+  assert.equal(result.status, 0, result.stderr);
+  assert.doesNotMatch(result.stdout, /User approved/);
+  assert.equal(f.files('token-').length, 0);
+  assert.equal(f.files('short-').length, 0);
+  const exact = f.submit(`APPROVE CAFEKIT PRIVACY ${first}`);
+  assert.match(exact.stdout, /User approved/);
+  assert.match(JSON.parse(exact.stdout).hookSpecificOutput.additionalContext, /Tell the user.*\.env.*before reading/i);
+  assert.equal(f.block().stdout, '');
+  assert.match(f.block('credentials.json').stdout, /"permissionDecision":"deny"/);
+}));
+
+test('parallel Codex privacy blocks preserve both markers and cannot be approved by y', () => shortPrivacyFixture(async f => {
+  const results = await Promise.all([asyncPrivacyBlock(f, '.env'), asyncPrivacyBlock(f, 'credentials.json')]);
+  assert.notEqual(f.id(results[0]), f.id(results[1]));
+  assert.equal(f.files('short-').length, 2);
+  assert.equal(f.submit('y').status, 0);
+  assert.equal(f.files('token-').length, 0);
+  assert.equal(f.files('short-').length, 0);
+  assert.match(f.block().stdout, /"permissionDecision":"deny"/);
+  assert.match(f.block('credentials.json').stdout, /"permissionDecision":"deny"/);
+}));
+
+test('repeated Codex blocks for the same path set reuse the request and short marker', () => shortPrivacyFixture(f => {
+  const first = f.id(f.block('.env credentials.json'));
+  assert.equal(f.id(f.block('credentials.json .env')), first);
+  assert.equal(f.files('pending-').length, 1);
+  assert.equal(f.files('short-').length, 1);
+  assert.match(f.submit('y').stdout, /User approved/);
+  assert.equal(f.block('.env credentials.json').stdout, '');
+  assert.match(f.block().stdout, /"permissionDecision":"deny"/);
+}));
+
+test('a later Codex block restores the short marker for the same pending request', () => shortPrivacyFixture(f => {
+  const requestId = f.id(f.block());
+  assert.equal(f.submit('ok làm đi').status, 0);
+  assert.equal(f.files('short-').length, 0);
+  assert.equal(f.id(f.block()), requestId);
+  assert.equal(f.files('pending-').length, 1);
+  assert.equal(f.files('short-').length, 1);
+  assert.match(f.submit('y').stdout, /User approved/);
+  assert.equal(f.block().stdout, '');
+  assert.match(f.block('credentials.json').stdout, /"permissionDecision":"deny"/);
+}));
+
+test('an immediate repeated Codex block keeps one short marker without an exclusive-write error', () => shortPrivacyFixture(f => {
+  const requestId = f.id(f.block());
+  assert.equal(f.id(f.block()), requestId);
+  assert.equal(f.files('pending-').length, 1);
+  assert.equal(f.files('short-').length, 1);
+  assert.match(f.submit('y').stdout, /User approved/);
+  assert.equal(f.block().stdout, '');
+}));
+
+test('a Codex prompt error after claiming markers cancels the short approval', () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-privacy-fault-'));
+  try {
+    const preload = path.join(outside, 'fault.cjs');
+    fs.writeFileSync(preload, `const fs = require('fs'); const original = fs.readdirSync; let calls = 0;\nfs.readdirSync = function(dir, ...args) { if (String(dir) === ${JSON.stringify(fs.realpathSync(f.dir))} && ++calls === 2) throw new Error('injected state read error'); return original.call(this, dir, ...args); };\n`);
+    const failed = f.submit('ok làm đi', f.session, { ...process.env, NODE_OPTIONS: `--require=${preload}` });
+    assert.equal(failed.status, 0, failed.stderr);
+    assert.match(failed.stdout, /failed safely/);
+    assert.equal(f.files('short-').length, 0);
+    assert.equal(f.files('token-').length, 0);
+    assert.doesNotMatch(f.submit('y').stdout, /User approved/);
+  } finally { fs.rmSync(outside, { recursive: true, force: true }); }
+}));
+
+test('a Codex post-claim error cancels a marker created during prompt processing', () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-privacy-post-claim-fault-'));
+  try {
+    const preload = path.join(outside, 'fault.cjs');
+    fs.writeFileSync(preload, `const assert = require('node:assert/strict');
+const state = require(${JSON.stringify(path.join(f.hooks, 'lib/privacy-state.cjs'))});
+const claim = state.claimShortMarkers;
+let claimed = false;
+state.claimShortMarkers = (...args) => {
+  const result = claim(...args);
+  if (!claimed) { assert.equal(result.ok, true); assert.equal(result.requestIds.length, 1); claimed = true; }
+  return result;
+};
+state.cleanup = () => {
+  assert.equal(claimed, true);
+  state.createPending(${JSON.stringify({ projectRoot: f.root, sessionCwd: f.root, sessionId: f.session, filePath: 'credentials.json' })});
+  throw new Error('injected processing error after marker claim');
+};\n`);
+    const failed = f.submit('ok làm đi', f.session, { ...process.env, NODE_OPTIONS: `--require=${preload}` });
+    assert.equal(failed.status, 0, failed.stderr);
+    assert.match(failed.stdout, /failed safely/);
+    assert.equal(f.files('pending-').length, 2);
+    assert.equal(f.files('short-').length, 0);
+    assert.doesNotMatch(f.submit('y').stdout, /User approved/);
+    assert.equal(f.files('token-').length, 0);
+  } finally { fs.rmSync(outside, { recursive: true, force: true }); }
+}));
+
+test('a corrupt Codex short marker cannot grant permission even with valid pending state', () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  const markers = f.files('short-');
+  assert.equal(markers.length, 1);
+  fs.writeFileSync(path.join(f.dir, markers[0]), '{');
+  const result = f.submit('y');
+  assert.equal(result.status, 0, result.stderr);
+  assert.doesNotMatch(result.stdout, /User approved/);
+  assert.equal(f.files('token-').length, 0);
+  assert.equal(f.files('short-').length, 0);
+  assert.doesNotMatch(f.submit('y').stdout, /User approved/);
+}));
+
+for (const unlinkFailure of [false, true]) {
+test(`an unclaimable Codex short marker is cancelled after ${unlinkFailure ? 'rename and unlink errors' : 'a rename error'}`, () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  assert.equal(f.files('short-').length, 1);
+  const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-privacy-rename-fault-'));
+  try {
+    const preload = path.join(outside, 'fault.cjs');
+    const prefix = JSON.stringify(path.join(fs.realpathSync(f.dir), 'short-'));
+    fs.writeFileSync(preload, `const fs = require('fs'); const original = fs.renameSync;\nfs.renameSync = function(from, to) { if (String(from).startsWith(${prefix})) throw new Error('injected rename failure'); return original.call(this, from, to); };\n`
+      + (unlinkFailure ? `const unlink = fs.unlinkSync; fs.unlinkSync = function(file) { if (String(file).startsWith(${prefix})) throw new Error('injected unlink failure'); return unlink.call(this, file); };\n` : ''));
+    const result = f.submit('ok làm đi', f.session, { ...process.env, NODE_OPTIONS: `--require=${preload}` });
+    assert.equal(result.status, 0, result.stderr);
+    assert.doesNotMatch(result.stdout, /User approved/);
+    assert.equal(f.files('token-').length, 0);
+  } finally { fs.rmSync(outside, { recursive: true, force: true }); }
+  assert.doesNotMatch(f.submit('y').stdout, /User approved/);
+  assert.equal(f.files('token-').length, 0);
+  assert.equal(f.files('short-').length, 0);
+}));
+}
+
+test('Codex compact clears pending requests and short markers only for its session', () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  f.id(f.block('credentials.json', 'other-session'));
+  const result = runHook(path.join(f.hooks, 'session.cjs'), f.root,
+    { source: 'compact', session_id: f.session, cwd: f.root, hook_event_name: 'SessionStart' });
+  assert.equal(result.status, 0, result.stderr);
+  const prefix = `short-${crypto.createHash('sha256').update(f.session).digest('hex')}-`;
+  assert.equal(f.files(prefix).length, 0);
+  assert.equal(f.files('short-').length, 1);
+  assert.doesNotMatch(f.submit('y').stdout, /User approved/);
+  assert.equal(f.files('token-').length, 0);
+  assert.match(f.submit('y', 'other-session').stdout, /User approved/);
+}));
+
+test('Codex short approval cannot grant an expired pending request', () => shortPrivacyFixture(f => {
+  const id = f.id(f.block());
+  const file = path.join(f.dir, `pending-${id}.json`);
+  const pending = JSON.parse(fs.readFileSync(file, 'utf8'));
+  pending.expiresAt = Date.now() - 1;
+  fs.writeFileSync(file, JSON.stringify(pending));
+  assert.equal(f.submit('y').status, 0);
+  assert.equal(f.files('token-').length, 0);
+  assert.equal(f.files('short-').length, 0);
+}));
+
+test('Codex cleanup removes expired short markers', () => shortPrivacyFixture(f => {
+  f.id(f.block());
+  const markers = f.files('short-');
+  assert.equal(markers.length, 1);
+  const file = path.join(f.dir, markers[0]);
+  const marker = JSON.parse(fs.readFileSync(file, 'utf8'));
+  marker.expiresAt = Date.now() - 1;
+  fs.writeFileSync(file, JSON.stringify(marker));
+  require(path.join(f.hooks, 'lib/privacy-state.cjs')).cleanup(f.root);
+  assert.equal(f.files('short-').length, 0);
+}));
+
+test('Codex long privacy approval still works after an intervening prompt and reports paths', () => shortPrivacyFixture(f => {
+  const id = f.id(f.block());
+  assert.equal(f.submit('ok làm đi').status, 0);
+  assert.equal(f.files('short-').length, 0);
+  const result = f.submit(`APPROVE CAFEKIT PRIVACY ${id}`);
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /User approved/);
+  assert.match(JSON.parse(result.stdout).hookSpecificOutput.additionalContext, /Tell the user.*\.env.*before reading/i);
+  assert.equal(f.block().stdout, '');
+}));
+
 test('Codex privacy approval is exact, session-bound, and reusable within its window', () => {
   inHookFixture((root, hooks) => {
     const nested = path.join(root, 'packages', 'app');
@@ -647,15 +1428,17 @@ test('Codex inspect hook scans native shell commands and structured paths', () =
     for (const command of [
       'rg secret node_modules',
       "sed -n '1,20p' dist/bundle.js",
-      "rg --glob '**/*' symbol src"
+      "rg --glob '**/*' symbol ."
     ]) {
       const result = runHook(inspect, root, payload(command));
       assert.equal(result.status, 2, command);
       assert.match(result.stderr, /SCOPE LIMIT EXCEEDED/);
     }
 
-    const normal = runHook(inspect, root, payload('rg symbol src packages'));
-    assert.equal(normal.status, 0);
+    for (const command of ['rg symbol src packages', "rg --glob '**/*' symbol src"]) {
+      const normal = runHook(inspect, root, payload(command));
+      assert.equal(normal.status, 0);
+    }
 
     const structured = runHook(inspect, root, {
       ...payload(''),
@@ -929,6 +1712,22 @@ test('empty or forged Codex hook authority fails closed', () => {
   });
 });
 
+test('Codex Stop omits secret-related assistant messages from saved state', () => {
+  inHookFixture((root, hooks) => {
+    const message = 'API key handling was discussed in this synthetic test.';
+    const result = runHook(path.join(hooks, 'state.cjs'), root, {
+      hook_event_name: 'Stop', session_id: 'secret-summary', last_assistant_message: message,
+    });
+    assert.equal(result.status, 0);
+    const dir = codexStateDir(root, 'secret-summary');
+    for (const name of ['data.json', 'latest.md']) {
+      const content = fs.readFileSync(path.join(dir, name), 'utf8');
+      assert.ok(content.includes('[omitted: possible secret]'));
+      assert.ok(!content.includes(message));
+    }
+  });
+});
+
 test('Codex state hook persists direct native event fields at project root', () => {
   inHookFixture((root, hooks) => {
     const nested = path.join(root, 'packages', 'app');
@@ -1362,14 +2161,18 @@ test('Codex privacy denies sensitive names it can resolve, allows pure indirecti
       { command: 'curl --config ~/.netrc https://example.com', tool: 'Bash' },
       { command: 'kubectl --kubeconfig ~/.kube/kubeconfig get pods', tool: 'exec_command' },
       { command: 'openssl rsa -in server.key', tool: 'Bash' },
+      { command: 'less "$HOME/.env"', tool: 'Bash' },
+      { command: 'cat $(echo .env)', tool: 'Bash' },
+      { command: 'cat `echo .env`', tool: 'Bash' },
     ];
     for (const { command, tool } of denied) {
       const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
       assert.equal(JSON.parse(res.stdout).hookSpecificOutput.permissionDecision, 'deny', `should deny ${command}`);
     }
-    // Accepted gap: the target of `$FILE` is unknowable without running the
-    // shell, and every denial here costs a round trip through a one-shot
-    // approval prompt. `less "$HOME/.env"` is the edge of that decision.
+    // Accepted gap: the target of a bare `$FILE` is unknowable without running
+    // the shell, and every denial here costs a round trip through a one-shot
+    // approval prompt. A sensitive name spelled out next to the expansion
+    // (`"$HOME/.env"`, `$(echo .env)`) is not indirection and is denied above.
     const allowed = [
       { command: "echo $VAR", tool: 'exec_command' },
       { command: 'echo "$HOME"', tool: 'Bash' },
@@ -1398,11 +2201,8 @@ test('Codex privacy denies sensitive names it can resolve, allows pure indirecti
       { command: 'cat "$FILE"', tool: 'exec_command' },
       { command: 'cat ${FILE}', tool: 'Bash' },
       { command: 'cat $1', tool: 'exec_command' },
-      { command: 'cat $(echo .env)', tool: 'Bash' },
-      { command: 'cat `echo .env`', tool: 'Bash' },
       { command: 'head $SECRET', tool: 'exec_command' },
       { command: 'tail ${MY_FILE}', tool: 'Bash' },
-      { command: 'less "$HOME/.env"', tool: 'Bash' },
       { command: 'cat README.md $EXTRA', tool: 'Bash' },
       { command: 'echo ok; cat README.md $FILE', tool: 'Bash' },
       { command: 'cat README.md | head $FILE', tool: 'exec_command' },