@haposoft/cafekit 0.18.1 → 0.18.3

package/src/codex/hooks/lib/spec-session-touch.cjs

@@ -0,0 +1,100 @@
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { packetAt, namedPackets, explicitFailure } = require('./spec-touch.cjs');
+const { atomicWrite, assertConfiguredSpecsPath, hookStateDir } = require('./hook-context.cjs');
+
+function sessionIdentity(payload) {
+  return [payload.session_id, payload.sessionId, payload.sessionID, payload.session?.id]
+    .find((value) => typeof value === 'string' && value.trim()) || null;
+}
+
+function patchPaths(command) {
+  if (typeof command !== 'string') return [];
+  const lines = command.trim().split(/\r?\n/);
+  if (lines.shift() !== '*** Begin Patch' || lines.pop() !== '*** End Patch') return [];
+  const paths = [];
+  let operation = null;
+  let body = false;
+  for (const line of lines) {
+    const header = line.match(/^\*\*\* (Add|Update|Delete) File: (.+)$/);
+    if (header) {
+      if (operation && operation !== 'Delete' && !body) return [];
+      operation = header[1]; body = operation === 'Delete';
+      paths.push(header[2]);
+    } else if (/^\*\*\* Move to: .+/.test(line) && operation === 'Update' && !body) {
+      paths.push(line.slice('*** Move to: '.length));
+    } else if (operation === 'Add' && /^\+/.test(line)) {
+      body = true;
+    } else if (operation === 'Update' && /^(?:@@|[ +\-]|\*\*\* End of File$)/.test(line)) {
+      body = true;
+    } else {
+      return [];
+    }
+  }
+  return operation && body ? paths : [];
+}
+
+function responseText(response) {
+  if (typeof response === 'string') return response;
+  if (!response || typeof response !== 'object') return '';
+  const value = response.output ?? response.result ?? response.message ?? response.content;
+  if (typeof value === 'string') return value;
+  return Array.isArray(value) ? value.map((item) => item?.text || '').join('\n') : '';
+}
+
+function successfulMutation(payload) {
+  const response = payload.tool_response;
+  if (payload.hook_event_name !== 'PostToolUse' || explicitFailure(payload) || response == null) return false;
+  const text = responseText(response).trim();
+  if (/^(?:error\b|failed\b|failure\b|apply_patch verification failed)/im.test(text)) return false;
+  // Contract: github.com/openai/codex/blob/main/codex-rs/core/src/tools/context.rs
+  // Native ApplyPatchToolOutput emits a string summary to PostToolUse, whereas its
+  // code-mode return is {}. Unknown/empty output is not observed successful mutation.
+  const nativeSuccess = /^Success\. Updated the following files:\r?\n[AMD] .+/m.test(text);
+  if (payload.tool_name === 'apply_patch') return nativeSuccess;
+  return nativeSuccess || response?.ok === true || response?.success === true
+    || /^(?:success\b|.*\bupdated successfully[.!]?\s*$)/i.test(text);
+}
+
+function mutationPaths(payload) {
+  if (!successfulMutation(payload)) return [];
+  const input = payload.tool_input || {};
+  if (payload.tool_name === 'apply_patch') return patchPaths(input.command);
+  if (!['Edit', 'Write', 'MultiEdit'].includes(payload.tool_name)) return [];
+  return [input.file_path, input.path, ...(Array.isArray(input.edits) ? input.edits.map((edit) => edit?.file_path || edit?.path) : [])]
+    .filter((value) => typeof value === 'string');
+}
+
+function touchSession(payload, context) {
+  const sessionId = sessionIdentity(payload);
+  const specsRoot = assertConfiguredSpecsPath(context.projectRoot, context.runtime);
+  if (!sessionId) return { sessionId, names: [], touched: [], specsRoot };
+  const key = crypto.createHash('sha256').update(`${context.projectRoot}\0${sessionId}`).digest('hex');
+  const file = path.join(hookStateDir(context.projectRoot), `spec-touched-${key}.json`);
+  let previous = [];
+  try { previous = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { /* first touch */ }
+  const touched = new Set(Array.isArray(previous) ? previous.filter((name) => typeof name === 'string') : []);
+  let names;
+  if (payload.hook_event_name === 'PostToolUse') {
+    names = mutationPaths(payload).map((value) => packetAt(value, specsRoot, context.sessionCwd)).filter(Boolean);
+  } else {
+    let packets = [];
+    try { packets = fs.readdirSync(specsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name); } catch { /* absent root */ }
+    names = namedPackets(payload.prompt || payload.user_prompt, packets, specsRoot, context.projectRoot);
+    const feature = payload.explicitFeature ?? payload.featureName ?? payload.feature;
+    if (typeof feature === 'string' && feature.trim() && !/[\\/]/.test(feature) && !['.', '..', '_shared'].includes(feature)) names.push(feature);
+    const explicitPath = payload.explicitPath ?? payload.specPath ?? payload.spec_path ?? payload.featurePath;
+    const fromPath = packetAt(explicitPath, specsRoot, context.projectRoot);
+    if (fromPath) names.push(fromPath);
+  }
+  for (const name of names) touched.add(name);
+  if (names.length) {
+    try { atomicWrite(file, `${JSON.stringify([...touched].sort())}\n`); } catch { /* no shared fallback */ }
+  }
+  return { sessionId, names: [...new Set(names)], touched: [...touched], specsRoot };
+}
+
+module.exports = { touchSession, sessionIdentity };

package/src/codex/hooks/lib/spec-touch.cjs

@@ -0,0 +1,3 @@
+'use strict';
+
+module.exports = require('../../../claude/hooks/lib/spec-touch.cjs');

package/src/codex/hooks/lib/state-store.cjs

@@ -4,7 +4,7 @@ const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const { execFileSync } = require('child_process');
-const { atomicWrite } = require('./hook-context.cjs');
+const { atomicWrite, pluginRoot, pluginProjectDir } = require('./hook-context.cjs');
 
 const MAX_ARCHIVES = 5;
 const MAX_AGENTS = 3;
@@ -18,9 +18,10 @@ function sessionKey(sessionId) {
 
 function stateDir(projectRoot, sessionId) {
   const key = sessionKey(sessionId);
-  return key
-    ? path.join(projectRoot, '.codex', 'session-state', key)
-    : null;
+  if (!key) return null;
+  return pluginRoot()
+    ? path.join(pluginProjectDir(projectRoot, 'session-state'), key)
+    : path.join(projectRoot, '.codex', 'session-state', key);
 }
 
 function acquireLock(dir) {

package/src/codex/hooks/lib/update-check.cjs

@@ -0,0 +1 @@
+module.exports = require('../../../claude/hooks/lib/update-check.cjs');

package/src/codex/hooks/precompact.cjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+'use strict';
+
+const crypto = require('crypto');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { atomicWrite, hookStateDir, logCrash, readPayload, resolveProjectRoot } = require('./lib/hook-context.cjs');
+
+function gitLine(projectRoot, args) {
+  try {
+    return execFileSync('git', args, {
+      cwd: projectRoot, encoding: 'utf8', timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim() || null;
+  } catch { return null; }
+}
+
+try {
+  const payload = readPayload();
+  if (!payload) process.exit(0);
+  const sessionId = [payload.session_id, payload.sessionId, payload.sessionID, payload.session?.id]
+    .find(value => typeof value === 'string' && value.trim());
+  if (!sessionId) process.exit(0);
+  const projectRoot = resolveProjectRoot(payload);
+  const status = gitLine(projectRoot, ['status', '--porcelain']);
+  // These anchors are re-derivable facts, never proof or authorization.
+  const record = {
+    captured_at: new Date().toISOString(),
+    session_id: sessionId,
+    trigger: typeof payload.trigger === 'string' ? payload.trigger : null,
+    project_root: projectRoot,
+    branch: gitLine(projectRoot, ['rev-parse', '--abbrev-ref', 'HEAD']),
+    head: gitLine(projectRoot, ['rev-parse', '--short', 'HEAD']),
+    dirty_count: status === null ? null : status.split('\n').filter(line => line.trim()).length,
+  };
+  const key = crypto.createHash('sha256').update(sessionId).digest('hex');
+  atomicWrite(path.join(hookStateDir(projectRoot), `compact-recovery-${key}.json`), `${JSON.stringify(record)}\n`);
+} catch (error) {
+  if (error.message === 'hook payload is empty') process.exit(0);
+  logCrash('precompact', error);
+}

package/src/codex/hooks/privacy-approval.cjs

@@ -1,16 +1,6 @@
 #!/usr/bin/env node
 'use strict';
 
-const {
-  APPROVAL_PREFIX,
-  approvePending,
-  cleanup
-} = require('./lib/privacy-state.cjs');
-const {
-  getHookContext,
-  readPayload
-} = require('./lib/hook-context.cjs');
-
 function context(message) {
   process.stdout.write(`${JSON.stringify({
     hookSpecificOutput: {
@@ -20,10 +10,20 @@ function context(message) {
   })}\n`);
 }
 
+let projectRoot, sessionId, state;
 try {
+  const { resolveProjectRoot, readPayload } = require('./lib/hook-context.cjs');
   const data = readPayload();
   if (!data) process.exit(0);
-  const { projectRoot } = getHookContext(data);
+  projectRoot = resolveProjectRoot(data);
+  sessionId = data.session_id;
+  let claimed = { ok: false, requestIds: [] };
+  try {
+    state = require('./lib/privacy-state.cjs');
+    claimed = state.claimShortMarkers(projectRoot, sessionId);
+  } catch { /* the outer catch retries invalidation, never approval */ }
+  if (!claimed.ok) throw new Error('Short approval markers could not be claimed safely');
+  const { APPROVAL_PREFIX, approvePending, cleanup } = state;
   // A pasted prompt arrives with whatever whitespace the terminal added around
   // it. Rejecting on a trailing newline made the approval look broken while the
   // id it named was still perfectly valid; the exactness that matters is the
@@ -31,20 +31,25 @@ try {
   const prompt = String(data.prompt || '').trim();
   cleanup(projectRoot);
 
-  if (!prompt.startsWith(APPROVAL_PREFIX)) process.exit(0);
-  if (!data.session_id) {
+  const shortApproval = new Set(['y', 'yes', 'có']).has(prompt.normalize('NFC').toLowerCase());
+  if (!shortApproval && !prompt.startsWith(APPROVAL_PREFIX)) process.exit(0);
+  if (typeof sessionId !== 'string' || !sessionId.trim()) {
     context('CafeKit privacy approval rejected: this hook invocation had no Codex session ID.');
     process.exit(0);
   }
-  const requestId = prompt.slice(APPROVAL_PREFIX.length);
-  if (`${APPROVAL_PREFIX}${requestId}` !== prompt || !/^[a-f0-9]{24}$/.test(requestId)) {
+  let requestId;
+  if (shortApproval) {
+    if (claimed.requestIds.length !== 1) process.exit(0);
+    requestId = claimed.requestIds[0];
+  } else requestId = prompt.slice(APPROVAL_PREFIX.length);
+  if (!/^[a-f0-9]{24}$/.test(requestId)) {
     context('CafeKit privacy approval rejected: the prompt did not exactly match a pending request.');
     process.exit(0);
   }
 
   const result = approvePending({
     projectRoot,
-    sessionId: data.session_id,
+    sessionId,
     requestId
   });
   if (!result.ok) {
@@ -54,10 +59,16 @@ try {
 
   context(
     `User approved the pending sensitive access (${result.displayName}). ` +
-    `The grant is session-bound, bound to exactly those paths, and expires in one hour.`
+    `The grant is session-bound, bound to exactly those paths, and expires in one hour. ` +
+    `Tell the user which paths were just granted (${result.displayName}) before reading them.`
   );
   process.exit(0);
 } catch {
+  try {
+    if (projectRoot && typeof sessionId === 'string' && sessionId.trim()) {
+      (state || require('./lib/privacy-state.cjs')).claimShortMarkers(projectRoot, sessionId);
+    }
+  } catch { /* no approval follows an invalidation failure */ }
   context('CafeKit privacy approval failed safely; no token was issued.');
   process.exit(0);
 }

package/src/codex/hooks/privacy-block.cjs

@@ -1,218 +1,6 @@
 #!/usr/bin/env node
 'use strict';
 
-const fs = require('fs');
-const path = require('path');
-const {
-  APPROVAL_PREFIX,
-  createPending,
-  hasGrant
-} = require('./lib/privacy-state.cjs');
-const {
-  getHookContext,
-  readPayload
-} = require('./lib/hook-context.cjs');
-const { commandAccess } = require('./lib/privacy-command-analysis.cjs');
-
-const RESTRICTED = [
-  /^\.env(?:[.\[*?{]|$)/i,
-  /^credentials/i,
-  /secrets?\.(ya?ml|json)$/i,
-  /\.pem$/i,
-  /\.key$/i,
-  /\.p12$/i,
-  /\.pfx$/i,
-  /^id_(rsa|ed25519|ecdsa|dsa)$/i,
-  /\.netrc$/i,
-  /\.pgpass$/i,
-  /kubeconfig/i,
-  /\.keystore$/i,
-  /\.jks$/i,
-  /auth\.json$/i,
-  /token(s)?\.json$/i
-];
-
-const EXEMPT = [/\.env\.(example|sample|template|test)$/i];
-
-function isPathKey(key) {
-  return /^(?:file_?paths?|paths?|search_?paths?|director(?:y|ies)|cwd|root|locations?)$/i
-    .test(key);
-}
-
-function matchesAny(filePath, rules) {
-  const base = path.basename(filePath);
-  return rules.some((rule) => rule.test(base) || rule.test(filePath));
-}
-
-function isSafe(filePath) {
-  return matchesAny(filePath, EXEMPT);
-}
-
-function isSensitive(filePath) {
-  return matchesAny(filePath, RESTRICTED);
-}
-
-function resolveTarget(filePath, cwd) {
-  try {
-    const requested = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
-    return fs.realpathSync(requested);
-  } catch {
-    return null;
-  }
-}
-
-/**
- * When realpath fails, check whether the requested path is a symlink (or chain)
- * whose lexical target is sensitive. Dangling link to protected target -> true (fail-closed deny);
- * dangling benign link or link to allowed example/template -> false (allow).
- * Limit hops to avoid loops; malformed/looping -> fail closed.
- * TOCTOU note: check and use are not atomic; target could be swapped between this check and the actual read.
- * This is a best-effort guardrail, not an arbitrary-shell security boundary. For strong isolation use OS sandbox.
- */
-function isSymlinkToSensitive(filePath, cwd) {
-  try {
-    const requested = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
-    let current = requested;
-    let hops = 0;
-    const MAX_HOPS = 8;
-    while (hops < MAX_HOPS) {
-      let stat;
-      try {
-        stat = fs.lstatSync(current);
-      } catch {
-        return false;
-      }
-      if (!stat.isSymbolicLink()) return false;
-      let linkTarget;
-      try {
-        linkTarget = fs.readlinkSync(current);
-      } catch {
-        return true;
-      }
-      if (isSensitive(linkTarget) && !isSafe(linkTarget)) return true;
-      if (isSafe(linkTarget)) return false;
-      const next = path.isAbsolute(linkTarget) ? linkTarget : path.resolve(path.dirname(current), linkTarget);
-      if (next === current) return true;
-      try {
-        const real = fs.realpathSync(next);
-        if (isSensitive(real) && !isSafe(real)) return true;
-        if (isSafe(real)) return false;
-        return false;
-      } catch {
-        current = next;
-        hops += 1;
-        continue;
-      }
-    }
-    return true;
-  } catch {
-    return true;
-  }
-}
-
-function extractCommandPaths(command) {
-  // The analyzer parses the command and returns the operands of every reading
-  // command it recognises, nested shells and `find -exec` included. Treating
-  // every unresolved expansion as sensitive, as this did before, denied
-  // `cat $FILE`, `wc -l *.cjs` and `cat ~/.zshrc` alike -- and every denial here
-  // costs a round trip through a one-shot approval prompt.
-  // A heredoc whose delimiter is quoted (<<'BODY') is inert: the shell expands
-  // nothing inside it, so no word in the body is ever read. The analyzer has no
-  // notion of heredocs and parses the body as shell, so prose that quotes a
-  // command -- a PR body carrying `cat .env` in backticks -- came back as a real
-  // command substitution. Blank those bodies out first. An unquoted delimiter
-  // (<<BODY) does expand, so it is left to the analyzer.
-  const scrubbed = String(command).replace(
-    /(<<-?[ \t]*)(['"])([A-Za-z_]\w*)\2[^\n]*\n[\s\S]*?\n[ \t]*\3\b/g,
-    '$1$2$3$2'
-  );
-
-  const paths = new Set(commandAccess(scrubbed).paths);
-
-  // Two shapes the analyzer cannot return. It drops any word carrying an
-  // expansion, so `~/.ssh/id_rsa` and `certs/*.pem` still have to be matched by
-  // name. And it only walks commands it recognises, so an unknown tool handed a
-  // secret through a file-shaped option, such as
-  // `docker compose --env-file .env`, is invisible to it.
-  const FILE_OPTION = /^--?[\w-]*(?:file|config|key|cert|identity)$/i;
-  const tokens = scrubbed.split(/[\s|;&<>"'()`]+/);
-  for (let index = 0; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    const shaped = /^~|[*?[{]/.test(token);
-    const optionFed = index > 0 && FILE_OPTION.test(tokens[index - 1]);
-    if (!shaped && !optionFed) continue;
-    const value = token.replace(/^~/, '').replace(/^["'()`]+|["'(),]+$/g, '');
-    if (value && isSensitive(value) && !isSafe(value)) paths.add(value);
-  }
-
-  return [...paths];
-}
-
-function extractPatchPaths(patch) {
-  return [...String(patch).matchAll(
-    /^\*\*\* (?:(?:Add|Update|Delete) File:|Move to:)\s+(.+)$/gm
-  )]
-    .map((match) => match[1].trim())
-    .filter(Boolean);
-}
-
-function shellInput(input) {
-  if (typeof input?.command === 'string') return input.command;
-  if (typeof input?.cmd === 'string') return input.cmd;
-  return '';
-}
-
-function patchInput(input) {
-  if (typeof input === 'string') return input;
-  for (const key of ['command', 'patch', 'input']) {
-    if (typeof input?.[key] === 'string') return input[key];
-  }
-  return '';
-}
-
-function collectPathValues(value, key, out) {
-  if (typeof value === 'string' && isPathKey(key)) {
-    out.push(value);
-    return;
-  }
-  if (Array.isArray(value)) {
-    if (isPathKey(key)) out.push(...value.filter((item) => typeof item === 'string'));
-    return;
-  }
-  if (!value || typeof value !== 'object') return;
-  for (const [childKey, childValue] of Object.entries(value)) {
-    collectPathValues(childValue, childKey, out);
-  }
-}
-
-function extractPaths(toolName, input) {
-  const paths = [];
-  collectPathValues(input, '', paths);
-  const normalizedTool = String(toolName).toLowerCase();
-  if (['bash', 'exec_command', 'shell'].includes(normalizedTool)) {
-    paths.push(...extractCommandPaths(shellInput(input)));
-  } else if (['apply_patch', 'edit', 'write'].includes(normalizedTool)) {
-    paths.push(...extractPatchPaths(patchInput(input)));
-  }
-  return [...new Set(paths.filter(Boolean))];
-}
-
-function sensitiveRequest(filePath, cwd) {
-  const target = resolveTarget(filePath, cwd);
-  if (target) {
-    if (isSensitive(target) && !isSafe(target)) return true;
-    if (isSafe(target)) return false;
-  } else {
-    if (isSymlinkToSensitive(filePath, cwd)) return true;
-  }
-  return !isSafe(filePath) && isSensitive(filePath);
-}
-
-function sensitivePaths(toolName, input, cwd) {
-  return extractPaths(toolName, input)
-    .filter((filePath) => sensitiveRequest(filePath, cwd));
-}
-
 function deny(reason) {
   process.stdout.write(`${JSON.stringify({
     hookSpecificOutput: {
@@ -224,10 +12,16 @@ function deny(reason) {
 }
 
 try {
+  const { APPROVAL_PREFIX, createPending, hasGrant } = require('./lib/privacy-state.cjs');
+  const { pluginRoot, resolveProjectRoot, readRuntime, resolveSessionCwd, readPayload } = require('./lib/hook-context.cjs');
+  const { sensitivePaths } = require('./lib/privacy-paths.cjs');
   const data = readPayload();
   if (!data) process.exit(0);
-  const { projectRoot, sessionCwd, runtime } = getHookContext(data);
-  if (runtime.privacyBlock === false) process.exit(0);
+  const projectRoot = resolveProjectRoot(data);
+  const runtime = readRuntime(projectRoot);
+  const sessionCwd = resolveSessionCwd(data);
+  // A plugin is trusted once for every repository, so a repository cannot switch it off.
+  if (runtime.privacyBlock === false && !pluginRoot()) process.exit(0);
 
   const filePaths = sensitivePaths(data.tool_name || '', data.tool_input || {}, sessionCwd);
   const effectivePaths = filePaths;
@@ -250,8 +44,9 @@ try {
   const pending = createPending(grantInput);
   deny(
     `Sensitive file access denied: ${pending.displayName}. ` +
-    `To approve access to exactly these paths for the next hour of this Codex ` +
-    `session, send this exact user prompt: ` +
+    `To allow exactly these paths for one hour of this Codex session, the user replies ` +
+    `y (or yes / có) as their very next message; any other reply cancels that shortcut, ` +
+    `and it only works while this is the only pending request. Fallback exact prompt: ` +
     `${APPROVAL_PREFIX}${pending.requestId}`
   );
   process.exit(0);

package/src/codex/hooks/rules.cjs

@@ -1,40 +1,15 @@
 'use strict';
 
-const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const {
-  getHookContext,
-  hookStateDir,
+  pluginRoot,
+  resolveProjectRoot,
   logCrash,
   readPayload,
   resolveProjectPath
 } = require('./lib/hook-context.cjs');
-
-function reservationFile(projectRoot, sessionId) {
-  const key = crypto.createHash('sha256')
-    .update(String(sessionId || 'unknown'))
-    .digest('hex')
-    .slice(0, 16);
-  return path.join(hookStateDir(projectRoot), `rules-${key}.json`);
-}
-
-/** Reserve one injection slot per session. Returns null on reservation errors. */
-function reserveSession(projectRoot, sessionId) {
-  if (!sessionId) return null;
-  try {
-    const file = reservationFile(projectRoot, sessionId);
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    fs.writeFileSync(file, JSON.stringify({ sessionId: String(sessionId) }), {
-      encoding: 'utf8',
-      flag: 'wx',
-      mode: 0o600
-    });
-    return true;
-  } catch (error) {
-    return error.code === 'EEXIST' ? false : null;
-  }
-}
+const { reserveSession } = require('./lib/rules-reservation.cjs');
 
 /**
  * Body of the output style for `codingLevel`, or null.
@@ -46,7 +21,8 @@ function reserveSession(projectRoot, sessionId) {
 function readCodingStyle(projectRoot, level) {
   if (!Number.isInteger(level) || level < 0 || level > 5) return null;
   try {
-    const dir = path.join(projectRoot, '.codex', 'output-styles');
+    // The plugin ships the styles in its own tree; an npx install copies them into .codex.
+    const dir = pluginRoot() ? path.join(pluginRoot(), 'output-styles') : path.join(projectRoot, '.codex', 'output-styles');
     const match = fs.readdirSync(dir).find((name) => name.startsWith(`coding-level-${level}-`));
     if (!match) return null;
     const raw = fs.readFileSync(path.join(dir, match), 'utf8');
@@ -70,13 +46,17 @@ function readRuntime(projectRoot) {
 try {
   const payload = readPayload();
   if (!payload) process.exit(0);
-  const { projectRoot } = getHookContext(payload);
-  if (reserveSession(projectRoot, payload.session_id) !== true) process.exit(0);
-  const runtime = readRuntime(projectRoot);
+  const projectRoot = resolveProjectRoot(payload);
+  // An npx install always writes runtime.json; under the plugin it is optional.
+  const runtime = readRuntime(projectRoot) || (pluginRoot() ? {} : null);
   if (runtime === null) process.exit(0);
+  if (reserveSession(projectRoot, payload.session_id) !== true) process.exit(0);
 
-  const respondLang = runtime.locale?.responseLanguage || '';
-  const thinkLang = runtime.locale?.thinkingLanguage || (respondLang ? 'en' : '');
+  // Under the plugin a cloned repository's runtime.json reaches model context, so its
+  // locale strings are reduced to one short plain line; npx keeps them as written.
+  const clean = pluginRoot() ? require('./lib/plugin-options.cjs').sanitizeLine : (value) => value;
+  const respondLang = clean(runtime.locale?.responseLanguage || '');
+  const thinkLang = clean(runtime.locale?.thinkingLanguage || '') || (respondLang ? 'en' : '');
   const plansPath = resolveProjectPath(projectRoot, runtime.paths?.plans, 'plans');
   const docsPath = resolveProjectPath(projectRoot, runtime.paths?.docs, 'docs');
   const specsPath = resolveProjectPath(projectRoot, runtime.paths?.specs, 'specs');

package/src/codex/hooks/secret-output-guardrail.cjs

@@ -15,9 +15,9 @@
  */
 
 const { logCrash, readPayload } = require('./lib/hook-context.cjs');
-const { REMINDER, containsSecretKeyword } = require('./lib/secret-keywords.cjs');
 
 try {
+  const { REMINDER, containsSecretKeyword } = require('./lib/secret-keywords.cjs');
   const payload = readPayload();
   if (!payload) process.exit(0);