@haposoft/cafekit 0.18.1 → 0.18.3

package/bin/__tests__/codex-implicit-policy.test.js

@@ -0,0 +1,160 @@
+// Codex ignores the `disable-model-invocation` key that keeps a skill explicit-only on Claude Code. Its own
+// mechanism is `agents/openai.yaml` beside SKILL.md with `policy.allow_implicit_invocation: false`. These cases
+// pin that the Codex install writes that file for every explicit-only skill through the ownership-aware writer
+// (so upgrades and removals stay clean), writes it for no other skill, and that the catalog never lists such a skill.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const test = require('node:test');
+const { spawnSync } = require('node:child_process');
+
+const { PLATFORMS } = require('../lib/context');
+const manifestLib = require('../lib/manifest');
+const { removeSkill } = require('../phases/skill-inventory');
+
+const PACKAGE_ROOT = path.join(__dirname, '..', '..');
+const INSTALLER = path.join(PACKAGE_ROOT, 'bin/install.js');
+const SOURCE_SKILLS = path.join(PACKAGE_ROOT, 'src/claude/skills');
+const POLICY = 'policy:\n  allow_implicit_invocation: false\n';
+
+const explicitOnly = fs.readdirSync(SOURCE_SKILLS)
+  .filter((name) => fs.existsSync(path.join(SOURCE_SKILLS, name, 'SKILL.md')))
+  .filter((name) => /^disable-model-invocation:\s*(["']?)true\1\s*$/m.test(
+    fs.readFileSync(path.join(SOURCE_SKILLS, name, 'SKILL.md'), 'utf8').split(/^---\s*$/m)[1] || ''));
+
+function install(root, platform) {
+  const result = spawnSync(process.execPath, [INSTALLER, '--platform', platform, '--yes'],
+    { cwd: root, encoding: 'utf8', env: { ...process.env, PATH: '/usr/bin:/bin' } });
+  assert.equal(result.status, 0, result.stderr || result.stdout);
+  return result;
+}
+
+function withTempProject(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-policy-'));
+  const previous = process.cwd();
+  try {
+    assert.equal(spawnSync('git', ['-C', root, 'init', '-q']).status, 0);
+    process.chdir(root);
+    return run(root);
+  } finally {
+    process.chdir(previous);
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+const policyFile = (root, skill) => path.join(root, '.agents/skills', skill, 'agents/openai.yaml');
+const ownershipKey = (root, file) => path.relative(path.join(root, PLATFORMS.codex.ownership?.recordRoot || PLATFORMS.codex.folder), file).replace(/\\/g, '/');
+const readOwnership = (root) => JSON.parse(fs.readFileSync(path.join(root, PLATFORMS.codex.folder, manifestLib.MANIFEST_FILE), 'utf8'));
+const writeOwnership = (root, data) => fs.writeFileSync(path.join(root, PLATFORMS.codex.folder, manifestLib.MANIFEST_FILE), JSON.stringify(data, null, 2));
+
+function catalog(root, script, skillsRoot) {
+  const result = spawnSync(process.execPath, [path.join(root, script), '--json', '--root', path.join(root, skillsRoot)],
+    { cwd: root, encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  return JSON.parse(result.stdout);
+}
+
+test('the explicit-only skills are vibe and adv', () => {
+  assert.deepEqual(explicitOnly.sort(), ['adv', 'vibe']);
+});
+
+test('a Codex install writes the policy file for every explicit-only skill, owned, and for no other skill', () => {
+  withTempProject((root) => {
+    install(root, 'codex');
+    const ownership = readOwnership(root);
+    for (const skill of explicitOnly) {
+      const file = policyFile(root, skill);
+      assert.equal(fs.readFileSync(file, 'utf8'), POLICY, skill);
+      assert.equal(ownership.files[ownershipKey(root, file)]?.sha256, manifestLib.hashFile(file), `${skill} policy is not owned`);
+    }
+    const others = fs.readdirSync(path.join(root, '.agents/skills')).filter((name) => !explicitOnly.includes(name));
+    assert.ok(others.length > 10);
+    for (const skill of others) assert.equal(fs.existsSync(policyFile(root, skill)), false, skill);
+  });
+});
+
+test('reinstalling keeps the policy bytes and its ownership record unchanged', () => {
+  withTempProject((root) => {
+    install(root, 'codex');
+    const before = explicitOnly.map((skill) => readOwnership(root).files[ownershipKey(root, policyFile(root, skill))]?.sha256);
+    install(root, 'codex');
+    const after = explicitOnly.map((skill) => readOwnership(root).files[ownershipKey(root, policyFile(root, skill))]?.sha256);
+    assert.deepEqual(after, before);
+    for (const skill of explicitOnly) assert.equal(fs.readFileSync(policyFile(root, skill), 'utf8'), POLICY);
+  });
+});
+
+test('an owned policy file under a skill that dropped the key is removed on upgrade; a user-created one stays', () => {
+  withTempProject((root) => {
+    install(root, 'codex');
+    // An earlier release that marked ask explicit-only would have written and owned this file.
+    const owned = policyFile(root, 'ask');
+    fs.mkdirSync(path.dirname(owned), { recursive: true });
+    fs.writeFileSync(owned, POLICY);
+    const data = readOwnership(root);
+    data.files[ownershipKey(root, owned)] = { sha256: manifestLib.hashFile(owned), version: 'old' };
+    writeOwnership(root, data);
+    // A file the user wrote is never ours to delete.
+    const userFile = policyFile(root, 'debug');
+    fs.mkdirSync(path.dirname(userFile), { recursive: true });
+    fs.writeFileSync(userFile, POLICY);
+
+    install(root, 'codex');
+    assert.equal(fs.existsSync(owned), false, 'owned stale policy survived the upgrade');
+    assert.equal(readOwnership(root).files[ownershipKey(root, owned)], undefined, 'stale policy stayed in the manifest');
+    assert.equal(fs.readFileSync(userFile, 'utf8'), POLICY, 'user-created policy was removed');
+  });
+});
+
+test('a user edit to the policy file is preserved on upgrade', () => {
+  withTempProject((root) => {
+    install(root, 'codex');
+    const file = policyFile(root, 'vibe');
+    const edited = 'policy:\n  allow_implicit_invocation: true\n';
+    fs.writeFileSync(file, edited);
+    install(root, 'codex');
+    assert.equal(fs.readFileSync(file, 'utf8'), edited);
+  });
+});
+
+test('removing an explicit-only skill removes its whole tree, the policy file included', () => {
+  withTempProject((root) => {
+    install(root, 'codex');
+    const ctx = {
+      ownership: { [PLATFORMS.codex.folder]: readOwnership(root) },
+      trackers: { codex: manifestLib.createTracker(PLATFORMS.codex.folder, 'next', PLATFORMS.codex.ownership) },
+      dryRun: false,
+      ui: { warn() {}, detail() {} },
+      results: { updated: 0, preserved: 0, preservedFiles: [] }
+    };
+    removeSkill(ctx, 'codex', 'vibe');
+    assert.deepEqual(ctx.results.preservedFiles, []);
+    assert.equal(fs.existsSync(path.join(root, '.agents/skills/vibe')), false);
+  });
+});
+
+test('a Claude install writes no policy file', () => {
+  withTempProject((root) => {
+    install(root, 'claude');
+    for (const skill of fs.readdirSync(path.join(root, '.claude/skills'))) {
+      assert.equal(fs.existsSync(path.join(root, '.claude/skills', skill, 'agents/openai.yaml')), false, skill);
+    }
+  });
+});
+
+test('neither runtime catalog lists an explicit-only skill, and both still list the others', () => {
+  withTempProject((root) => {
+    install(root, 'claude,codex');
+    for (const [script, skillsRoot] of [['.codex/scripts/generate-skill-catalog.cjs', '.agents/skills'],
+      ['.claude/scripts/generate-skill-catalog.cjs', '.claude/skills']]) {
+      const parsed = catalog(root, script, skillsRoot);
+      const ids = parsed.skills.map((skill) => skill.public_id);
+      for (const skill of explicitOnly) {
+        assert.equal(ids.includes(`cf:${skill}`), false, `${script} lists cf:${skill}`);
+        assert.ok(parsed.diagnostics.some((item) => item.directory === skill && item.code === 'explicit_only'), `${script}: ${skill}`);
+      }
+      assert.ok(ids.includes('cf:ask') && ids.includes('cf:specs'), script);
+    }
+  });
+});

package/bin/__tests__/codex-native-hook-boundaries.test.js

@@ -0,0 +1,136 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+const SOURCE = path.resolve(__dirname, '../../src');
+
+function fixture(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-native-boundaries-'));
+  const hooks = path.join(root, '.codex/hooks');
+  try {
+    fs.cpSync(path.join(SOURCE, 'codex/hooks'), hooks, { recursive: true });
+    for (const name of ['runtime-path-safety', 'privacy-command-analysis', 'privacy-paths', 'secret-keywords', 'inspect-paths', 'update-check']) {
+      fs.copyFileSync(path.join(SOURCE, `claude/hooks/lib/${name}.cjs`), path.join(hooks, `lib/${name}.cjs`));
+    }
+    fs.cpSync(path.join(SOURCE, 'claude/scripts'), path.join(root, '.codex/scripts'), { recursive: true });
+    fs.writeFileSync(path.join(root, '.gitignore'), '.codex/\n');
+    for (const args of [['init', '-q'], ['config', 'user.email', 'probe@example.invalid'], ['config', 'user.name', 'Probe'], ['add', '.gitignore'], ['commit', '-qm', 'base']]) {
+      assert.equal(spawnSync('git', ['-C', root, ...args]).status, 0);
+    }
+    const hook = (name, payload = {}) => spawnSync(process.execPath, [path.join(hooks, `${name}.cjs`)], {
+      cwd: root, input: JSON.stringify({ cwd: root, session_id: 'a', ...payload }), encoding: 'utf8',
+    });
+    run({ root, hooks, hook });
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+}
+function task(root, name, status = 'pending', receipt = '') {
+  const dir = path.join(root, 'specs/demo'); fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(dir, 'plan.md'), '# Plan\nSpecs-Contract: process-first-ready-v1\n');
+  fs.writeFileSync(path.join(dir, name), `# Task\nStatus: ${status}\n## Dependencies\n- none\n## Verification Plan\n- Command: node --test\n${receipt}`);
+}
+
+test('privacy walks nested operation arrays but ignores prose', () => fixture(({ hook }) => {
+  for (const tool_input of [{ operations: [{ path: 'credentials.json' }] }, { operations: [[{ file_path: 'credentials.json' }]] }, { paths: ['credentials.json'] }]) {
+    const result = hook('privacy-block', { tool_name: 'mcp__files__read', tool_input });
+    assert.match(result.stdout, /APPROVE CAFEKIT PRIVACY/);
+    assert.match(JSON.parse(result.stdout).hookSpecificOutput.permissionDecisionReason, /y \(or yes \/ có\)/);
+  }
+  assert.equal(hook('privacy-block', { tool_name: 'mcp__files__read', tool_input: { messages: ['credentials.json', { text: 'credentials.json' }] } }).stdout, '');
+}));
+
+test('privacy-block allows ls when configured specs escapes the project', () => fixture(({ root, hook }) => {
+  fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+  const result = hook('privacy-block', { tool_name: 'Bash', tool_input: { command: 'ls' } });
+  assert.equal(result.status, 0);
+  assert.equal(result.stdout, '');
+}));
+
+test('privacy-block issues approval for a sensitive read when configured specs escapes the project', () => fixture(({ root, hook }) => {
+  fs.writeFileSync(path.join(root, '.env'), '');
+  fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+  const result = hook('privacy-block', { tool_name: 'Bash', tool_input: { command: 'cat .env' } });
+  assert.equal(result.status, 0);
+  const output = JSON.parse(result.stdout).hookSpecificOutput;
+  assert.equal(output.permissionDecision, 'deny');
+  assert.match(output.permissionDecisionReason, /APPROVE CAFEKIT PRIVACY [a-f0-9]{24}/);
+  assert.match(output.permissionDecisionReason, /y \(or yes \/ có\)/);
+}));
+
+test('privacy-approval grants a pending read when configured specs escapes the project', () => fixture(({ root, hook }) => {
+  fs.writeFileSync(path.join(root, '.env'), '');
+  const payload = { tool_name: 'Bash', tool_input: { command: 'cat .env' } };
+  const pending = hook('privacy-block', payload);
+  assert.equal(pending.status, 0);
+  const approval = pending.stdout.match(/APPROVE CAFEKIT PRIVACY [a-f0-9]{24}/);
+  assert.ok(approval, 'the sensitive read must issue a pending approval');
+  fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs: '../outside' } }));
+  const granted = hook('privacy-approval', { prompt: approval[0] });
+  assert.equal(granted.status, 0);
+  assert.match(granted.stdout, /User approved the pending sensitive access/);
+  const allowed = hook('privacy-block', payload);
+  assert.equal(allowed.status, 0);
+  assert.equal(allowed.stdout, '');
+}));
+
+test('session startup revokes only its own pending requests and grants', () => fixture(({ root, hooks, hook }) => {
+  const privacy = require(path.join(hooks, 'lib/privacy-state.cjs'));
+  const request = { projectRoot: root, sessionCwd: root, sessionId: 'a', filePath: 'credentials.json' };
+  const grant = privacy.createPending(request);
+  assert.equal(privacy.approvePending({ ...request, requestId: grant.requestId }).ok, true);
+  const pending = privacy.createPending(request);
+  for (const session_id of ['b', undefined]) {
+    assert.equal(hook('session', { session_id, hook_event_name: 'SessionStart', source: 'compact' }).status, 0);
+    assert.equal(privacy.hasGrant(request), true);
+    assert.ok(fs.existsSync(path.join(hooks, `.privacy/pending-${pending.requestId}.json`)));
+  }
+  assert.equal(hook('session', { hook_event_name: 'SessionStart', source: 'resume' }).status, 0);
+  assert.equal(privacy.hasGrant(request), false);
+  assert.equal(privacy.approvePending({ ...request, requestId: pending.requestId }).ok, false);
+}));
+
+test('cache persistence failure does not replace receipt authority', () => fixture(({ root, hooks, hook }) => {
+  task(root, 'task-01-work.md');
+  fs.mkdirSync(path.join(hooks, '.logs/spec-gate-last.json'), { recursive: true });
+  assert.equal(hook('spec-gate', { hook_event_name: 'Stop' }).stdout, '');
+  task(root, 'task-01-work.md', 'done');
+  const result = hook('spec-gate', { hook_event_name: 'Stop', explicitFeature: 'demo' });
+  assert.match(JSON.parse(result.stdout).reason, /lack a verification receipt/);
+  assert.doesNotMatch(result.stdout, /EISDIR|controlled failure/);
+  fs.writeFileSync(path.join(root, '.codex/runtime.json'), '{"spec":{"completion_gate":false}}');
+  assert.match(hook('spec-gate', { hook_event_name: 'Stop' }).stdout, /no completion-gate bypass/);
+}));
+
+test('build output directories are allowed while inspection commands stay blocked', () => fixture(({ hook }) => {
+  for (const command of ['vite build --outDir ./dist', 'tsc --outDir ./build', 'npm run build -- --outDir ./dist', 'cargo build --target-dir ./target']) {
+    assert.equal(hook('inspect-block', { tool_name: 'exec_command', tool_input: { command } }).status, 0, command);
+  }
+  for (const command of ['cat dist/index.js', 'find ./dist', 'grep x dist/index.js', 'vite build --outDir ./dist && cat dist/index.js', 'npm exec cat ./dist/index.js', 'vite build --outDir ./dist $(cat dist/index.js)']) {
+    assert.equal(hook('inspect-block', { tool_name: 'exec_command', tool_input: { command } }).status, 2, command);
+  }
+  assert.equal(hook('inspect-block', { tool_input: { path: './dist/index.js' } }).status, 2);
+}));
+
+test('one gate invocation captures one stable snapshot for multiple receipts and rechecks next run', () => fixture(({ root, hook }) => {
+  task(root, 'task-06-pending.md');
+  const provenanceFile = path.join(root, '.codex/scripts/provenance.cjs');
+  const trace = path.join(root, '.codex/manifest-count');
+  fs.writeFileSync(provenanceFile, fs.readFileSync(provenanceFile, 'utf8').replace('function manifest(root, specsRoot) {', `function manifest(root, specsRoot) { fs.appendFileSync(${JSON.stringify(trace)}, 'x');`));
+  const provenance = require(provenanceFile);
+  const context = provenance.deriveRuntimeContext({ projectRoot: root, specsRoot: path.join(root, 'specs'), specFile: path.join(root, 'specs/demo/plan.md'), featureName: 'demo', runtimeSession: 'a' });
+  const receipt = `## Receipt\nVerification: PASS\nCommand: node --test\nExit: 0\nBase: ${context.base}\nHead: ${context.head}\n\`\`\`text\nnode --test\n1 test passed\n\`\`\`\n`;
+  for (let n = 1; n <= 5; n += 1) task(root, `task-0${n}-work.md`, 'done', receipt);
+  for (const args of [['add', 'specs'], ['commit', '-qm', 'packet']]) assert.equal(spawnSync('git', ['-C', root, ...args]).status, 0);
+  fs.writeFileSync(trace, '');
+  assert.equal(hook('spec-gate', { hook_event_name: 'Stop' }).stdout, '');
+  assert.equal(fs.readFileSync(trace, 'utf8').length, 2);
+  fs.writeFileSync(path.join(root, 'changed.js'), 'changed');
+  fs.appendFileSync(path.join(root, 'specs/demo/task-01-work.md'), '\n');
+  const blocked = hook('spec-gate', { hook_event_name: 'Stop' }).stdout;
+  assert.match(blocked, /provenance/);
+  assert.match(blocked, /lines are present but are not the pair/);
+  assert.equal(fs.readFileSync(trace, 'utf8').length, 4);
+}));