@haposoft/cafekit 0.18.2 → 0.18.3

package/src/claude/hooks/lib/privacy-paths.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
 const { commandAccess } = require('./privacy-command-analysis.cjs');
 
@@ -116,7 +117,7 @@ function extractCommandPaths(command) {
   // (<<BODY) does expand, so it is left to the analyzer.
   const scrubbed = scrubCommand(command);
 
-  const paths = new Set(commandAccess(scrubbed).paths);
+  const paths = new Set(cachedAccess(scrubbed).paths);
 
   // Two shapes the analyzer cannot return. It drops any word carrying an
   // expansion, so `~/.ssh/id_rsa` and `certs/*.pem` still have to be matched by
@@ -137,14 +138,45 @@ function extractCommandPaths(command) {
   return [...paths];
 }
 
+// omp's edit modes name files in their own grammars: hashline headers `[path#TAG]` (tag
+// optional, path may be quoted) and `¶path`, a hashline `MV <dest>` move, and the sloppy
+// `*** Edit File:` header. The move destination is a write like any other.
+const PATCH_FILE_LINES = [
+  /^\*\*\* (?:(?:Add|Update|Delete) File:|Move to:)\s+(.+)$/gm,
+  /^[ \t]*\*{3}[ \t]+Edit[ \t]+File:[ \t]*(.+)$/gim,
+  /^\[(.+?)(?:#[0-9A-Fa-f]{4})?\]$/gm,
+  /^\u00b6(.+)$/gm,
+  /^[ \t]*MV[ \t]+(.+)$/gm,
+];
+
 function extractPatchPaths(patch) {
-  return [...String(patch).matchAll(
-    /^\*\*\* (?:(?:Add|Update|Delete) File:|Move to:)\s+(.+)$/gm
-  )]
-    .map((match) => match[1].trim())
+  const text = String(patch).replace(/^\uFEFF/, '').replace(/\r\n/g, '\n');
+  return PATCH_FILE_LINES.flatMap((pattern) => [...text.matchAll(pattern)])
+    .map((match) => match[1].trim().replace(/^(["'])(.*)\1$/, '$2').replace(/#[0-9A-Fa-f]{4}$/, ''))
     .filter(Boolean);
 }
 
+// omp's read takes `path:<selector>` (`raw`, `conflicts`, `img`, a line or range list);
+// the file is the part before it, so `.env:raw` is `.env`.
+const READ_SELECTOR = /:((?:raw|conflicts|img|-?\d+(?:[-+,.]\d+)*))$/i;
+
+function withoutSelectors(filePath) {
+  const variants = [];
+  let current = filePath;
+  for (let count = 0; count < 2 && READ_SELECTOR.test(current); count += 1) {
+    current = current.replace(READ_SELECTOR, '');
+    if (current) variants.push(current);
+  }
+  return variants;
+}
+
+// omp's eval runs code with no path argument; a quoted literal naming a secret file is the
+// only file reference the gate can see.
+function evalLiterals(input) {
+  const code = typeof input?.code === 'string' ? input.code : '';
+  return [...code.matchAll(/(["'`])((?:(?!\1)[^\\\n]|\\.)*)\1/g)].map((match) => match[2].trim()).filter(Boolean);
+}
+
 
 function shellInput(input) {
   const value = input?.command ?? input?.cmd;
@@ -163,7 +195,7 @@ function patchInput(input) {
 }
 
 function isPathKey(key, mcp) {
-  return /^(?:file_?paths?|paths?|search_?paths?|director(?:y|ies)|cwd|root|locations?|notebook_path|globs?)$/i.test(key)
+  return /^(?:file_?paths?|paths?|search_?paths?|director(?:y|ies)|cwd|root|locations?|notebook_path|globs?|rename)$/i.test(key)
     || (mcp && /path|file|dir|uri|source|dest|target/i.test(key));
 }
 
@@ -187,9 +219,14 @@ function extractPaths(toolName, input) {
   if (['bash', 'exec_command', 'shell'].includes(tool)) {
     paths.push(...extractCommandPaths(shellInput(input)));
   } else if (['apply_patch', 'edit', 'write'].includes(tool)) {
-    paths.push(...extractPatchPaths(patchInput(input)));
+    const patch = patchInput(input);
+    paths.push(...extractPatchPaths(patch));
+    // An edit whose text names no file cannot be judged, so it is not allowed through.
+    if (tool === 'edit' && patch.trim() && !paths.length) throw new Error('edit input names no file');
+  } else if (tool === 'eval') {
+    paths.push(...evalLiterals(input));
   }
-  return [...new Set(paths)];
+  return [...new Set(paths.flatMap((filePath) => [filePath, ...withoutSelectors(filePath)]))];
 }
 
 function sensitiveRequest(filePath, cwd) {
@@ -245,7 +282,7 @@ function protectedWrite(filePath, cwd) {
 }
 
 function extractWritePaths(tool, input) {
-  if (['bash', 'exec_command', 'shell'].includes(tool)) return commandAccess(scrubCommand(shellInput(input)));
+  if (['bash', 'exec_command', 'shell'].includes(tool)) return cachedAccess(scrubCommand(shellInput(input)));
   const paths = [];
   if (['write', 'edit', 'multiedit', 'notebookedit'].includes(tool) || tool.startsWith('mcp__')) {
     collectPathValues(input, '', paths, tool.startsWith('mcp__'));
@@ -260,9 +297,332 @@ function protectedUnknownWrite(filePath) {
     || ['.claude', '.codex', '.omp'].includes(parts.at(-1));
 }
 
+// Dynamic shell. One budget covers the whole command -- directory entries and stats, assignments resolved, and wall
+// time -- so a crafted command cannot outrun the hook's own timeout; running out of it asks rather than allows. Every
+// step below is linear in its input, and every loop that touches the disk checks the budget.
+const DYNAMIC_BUDGET = { entries: 4000, assignments: 100000, milliseconds: 250, globstarMilliseconds: 60, textLength: 16384, braceVariants: 64, braceGroups: 64 };
+const OVER_BUDGET = 'dynamic shell expansion over the check budget';
+const DECODED_READ = 'decoded input fed to a shell or reader';
+const UNRESOLVED = '\u0000';
+// Names a glob is tested against when its directory is unknown (after `cd "$D"`) or only its name is visible.
+const SENSITIVE_NAMES = ['.env', '.env.local', '.env.production', '.env.development', 'credentials', 'credentials.json',
+  'secrets.yml', 'secrets.yaml', 'secrets.json', 'server.pem', 'server.key', 'cert.p12', 'cert.pfx', 'id_rsa', 'id_ed25519',
+  'id_ecdsa', 'id_dsa', '.netrc', '.pgpass', 'kubeconfig', 'app.keystore', 'app.jks', 'auth.json', 'token.json', 'tokens.json'];
+
+const hasGlob = (text) => /[*?[]/.test(text);
+const overBudget = (budget) => {
+  if (budget.entries > DYNAMIC_BUDGET.entries || budget.assignments > DYNAMIC_BUDGET.assignments
+    || Date.now() > budget.deadline) budget.over = true;
+  return budget.over;
+};
+
+// One path segment of a shell glob: * and ? never cross '/', [..] is a class ([!..] negated, a-z ranges), and a name
+// starting with '.' only matches when the pattern starts with '.' too (bash without dotglob). Matching is the two-pointer
+// wildcard walk, so a pattern full of stars costs pattern x name steps, never exponential backtracking.
+const STAR = Symbol('star');
+const ANY = Symbol('any');
+function segmentMatcher(pattern) {
+  const tokens = [];
+  // Once one '[' finds no ']' after it, no later '[' can: they are all literal, and the rest is not scanned again.
+  let unclosed = false;
+  for (let index = 0; index < pattern.length; index += 1) {
+    const ch = pattern[index];
+    if (ch === '*') { if (tokens.at(-1) !== STAR) tokens.push(STAR); continue; }
+    if (ch === '?') { tokens.push(ANY); continue; }
+    if (ch === '[' && !unclosed) {
+      const negated = pattern[index + 1] === '!' || pattern[index + 1] === '^';
+      const open = index + (negated ? 2 : 1);
+      const close = classEnd(pattern, open);
+      if (close > 0) {
+        tokens.push(characterClass(pattern.slice(open, close), negated));
+        index = close;
+        continue;
+      }
+      unclosed = true;
+    }
+    tokens.push(ch);
+  }
+  const dot = pattern.startsWith('.');
+  return (name) => (dot || !name.startsWith('.')) && wildcardMatch(tokens, name);
+}
+
+// The ']' that closes a class opened before `open`: a ']' first in the class is a member, and a POSIX class
+// (`[:alpha:]`) inside it is skipped whole.
+function classEnd(pattern, open) {
+  for (let index = open; index < pattern.length; index += 1) {
+    if (pattern[index] === '[' && pattern[index + 1] === ':') {
+      const end = pattern.indexOf(':]', index + 2);
+      if (end > 0) { index = end + 1; continue; }
+    }
+    if (pattern[index] === ']' && index > open) return index;
+  }
+  return -1;
+}
+
+function characterClass(body, negated) {
+  // A POSIX class (`.e[[:alpha:]]v`) is taken to match any character, negated or not: it may ask more than the shell
+  // would match, never less.
+  if (body.includes('[:')) return () => true;
+  const ranges = [];
+  for (let index = 0; index < body.length; index += 1) {
+    if (body[index + 1] === '-' && index + 2 < body.length) { ranges.push([body[index], body[index + 2]]); index += 2; }
+    else ranges.push([body[index], body[index]]);
+  }
+  return (ch) => ranges.some(([low, high]) => low <= ch && ch <= high) !== negated;
+}
+
+function wildcardMatch(tokens, name) {
+  let token = 0;
+  let at = 0;
+  let star = -1;
+  let starAt = 0;
+  const one = (expected, ch) => expected === ANY || (typeof expected === 'function' ? expected(ch) : expected === ch);
+  while (at < name.length) {
+    if (token < tokens.length && tokens[token] !== STAR && one(tokens[token], name[at])) { token += 1; at += 1; continue; }
+    if (tokens[token] === STAR) { star = token; token += 1; starAt = at; continue; }
+    if (star < 0) return false;
+    token = star + 1;
+    starAt += 1;
+    at = starAt;
+  }
+  while (tokens[token] === STAR) token += 1;
+  return token === tokens.length;
+}
+
+// Ordinary names: a glob that also matches one of these (`*`, `*.json`) says nothing about secrets on its own.
+const ORDINARY_NAMES = ['README.md', 'package.json', 'index.js', 'main.ts', 'config.yaml', 'settings.yml', 'data.json',
+  'notes.txt', 'main.go', 'app.py', 'Makefile', 'style.css', 'index.html', 'image.png'];
+
+// Name-only judgement, used when the directory cannot be read: a literal secret name, or a glob aimed at secrets.
+const nameLooksSensitive = (pattern) => {
+  const base = pattern.split('/').pop();
+  if (!hasGlob(base)) return isSensitive(base) && !isSafe(base);
+  const matches = segmentMatcher(base);
+  return SENSITIVE_NAMES.some(matches) && !ORDINARY_NAMES.some(matches);
+};
+
+// $name, ${name}, ${name:-default} and ${name-default}; ~ at the start is HOME. Anything else that expands ($(...),
+// backticks, $1, $@, unknown variables) becomes UNRESOLVED. One left-to-right pass, and the output is capped: past the
+// cap the budget is spent.
+const BRACED = /^([A-Za-z_]\w*)(?::?[-=]([\s\S]*))?$/;
+function substitute(text, vars, budget) {
+  const home = process.env.HOME || os.homedir();
+  let out = '';
+  let close = -1;
+  const emit = (value) => {
+    if (value === null || out.length + value.length > DYNAMIC_BUDGET.textLength) { budget.over = true; return false; }
+    out += value;
+    return true;
+  };
+  for (let index = 0; index < text.length;) {
+    const ch = text[index];
+    const next = text[index + 1];
+    let value = ch;
+    let width = 1;
+    if (index === 0 && ch === '~' && (next === undefined || next === '/')) value = home;
+    else if (ch === '$' && next === '{') {
+      // The first '}' after this point; reused while it stays ahead, so `${${${…` is not rescanned for each '${'.
+      if (close !== Infinity && close < index + 2) close = text.indexOf('}', index + 2);
+      if (close < 0) close = Infinity;
+      if (close === Infinity) { value = UNRESOLVED; width = text.length - index; } else {
+        const match = BRACED.exec(text.slice(index + 2, close));
+        const name = match?.[1];
+        value = !match ? UNRESOLVED : vars.has(name) ? vars.get(name) : name === 'HOME' ? home
+          : match[2] !== undefined ? match[2] : UNRESOLVED;
+        width = close + 1 - index;
+      }
+    } else if (ch === '$' && next === '(' && text[index + 2] === ')') { value = UNRESOLVED; width = 3; }
+    else if ((ch === '<' || ch === '>') && next === '(' && text[index + 2] === ')') { value = UNRESOLVED; width = 3; }
+    else if (ch === '`' && next === '`') { value = UNRESOLVED; width = 2; }
+    else if (ch === '$' && next !== undefined && '@*#?$!-0123456789'.includes(next)) { value = UNRESOLVED; width = 2; }
+    if (!emit(value)) return '';
+    index += width;
+  }
+  return out;
+}
+
+// Assignments visible to an operand, outermost scope first, each value substituted with the ones before it. A value
+// past the text cap is kept as null, which spends the budget only if an operand actually uses it.
+const listIds = new WeakMap();
+let nextListId = 0;
+function resolveVars(scopes, budget, memo) {
+  // Operands of the same segment see the same assignments; resolve those once.
+  const key = scopes.map(({ list, count }) => {
+    if (!listIds.has(list)) listIds.set(list, nextListId++);
+    return `${listIds.get(list)}:${count}`;
+  }).join(',');
+  if (memo.has(key)) return memo.get(key);
+  const vars = new Map();
+  memo.set(key, vars);
+  for (const { list, count } of scopes) {
+    for (let index = 0; index < count; index += 1) {
+      budget.assignments += 1;
+      if (overBudget(budget)) return vars;
+      const { name, value } = list[index];
+      const probe = { over: false };
+      const resolved = value.length > DYNAMIC_BUDGET.textLength ? '' : substitute(value, vars, probe);
+      vars.set(name, value.length > DYNAMIC_BUDGET.textLength || probe.over ? null : resolved);
+    }
+  }
+  return vars;
+}
+
+// Brace expansion {a,b}: the first innermost group holding a comma, found in one scan; variants and group depth capped.
+function braces(text, budget, depth = 0) {
+  if (budget.over) return [];
+  if (depth > DYNAMIC_BUDGET.braceGroups) { budget.over = true; return []; }
+  let open = -1;
+  let comma = false;
+  let group = null;
+  for (let index = 0; index < text.length && !group; index += 1) {
+    const ch = text[index];
+    if (ch === '{') { open = index; comma = false; } else if (ch === ',' && open >= 0) comma = true;
+    else if (ch === '}' && open >= 0) { if (comma) group = [open, index]; open = -1; }
+  }
+  if (!group) return [text];
+  const [start, end] = group;
+  const out = [];
+  for (const part of text.slice(start + 1, end).split(',')) {
+    for (const rest of braces(text.slice(0, start) + part + text.slice(end + 1), budget, depth + 1)) {
+      out.push(rest);
+      if (out.length > DYNAMIC_BUDGET.braceVariants) { budget.over = true; return out; }
+    }
+    if (budget.over) return out;
+  }
+  return out;
+}
+
+// Expand a glob against the real directory tree. Every entry read and every literal segment stat-ed is charged to the
+// shared budget. `**` (zsh, bash globstar) walks every directory below, itself included, on a slice of its own: a tree
+// too big for that slice (`**/*.md` at a repository root, through node_modules) returns null, and the caller judges the
+// pattern by name instead of asking for every such command.
+function expandGlob(pattern, base, budget) {
+  if (!pattern.split('/').includes('**')) return expandParts(pattern, base, budget);
+  const slice = { entries: 0, assignments: 0, over: false,
+    deadline: Math.min(budget.deadline, Date.now() + DYNAMIC_BUDGET.globstarMilliseconds) };
+  const found = expandParts(pattern, base, slice);
+  if (slice.over) return null;
+  budget.entries += slice.entries;
+  return found;
+}
+
+function expandParts(pattern, base, budget) {
+  const absolute = pattern.startsWith('/');
+  let current = [absolute ? '/' : base];
+  const parts = pattern.split('/').filter((part, index) => part || index === 0 && !absolute);
+  for (const [index, part] of parts.entries()) {
+    if (!part) continue;
+    const last = index === parts.length - 1;
+    const next = [];
+    for (const directory of current) {
+      if (part === '**') { if (!walk(directory, next, last, budget)) return []; continue; }
+      if (!hasGlob(part)) {
+        budget.entries += 1;
+        if (overBudget(budget)) return [];
+        const joined = path.join(directory, part);
+        if (last || isDirectory(joined)) next.push(joined);
+        continue;
+      }
+      let entries;
+      try { entries = fs.readdirSync(directory, { withFileTypes: true }); } catch { continue; }
+      budget.entries += entries.length;
+      if (overBudget(budget)) return [];
+      const matches = segmentMatcher(part);
+      for (const entry of entries) {
+        if (Date.now() > budget.deadline) { budget.over = true; return []; }
+        if (!matches(entry.name)) continue;
+        const joined = path.join(directory, entry.name);
+        if (last || entry.isDirectory() || (entry.isSymbolicLink() && isDirectory(joined))) next.push(joined);
+      }
+    }
+    current = next;
+    if (!current.length || overBudget(budget)) return [];
+  }
+  return current;
+}
+
+// `**`: the directory and every non-hidden directory below it, or, as the last part, every non-hidden entry below.
+function walk(root, out, last, budget) {
+  const pending = [root];
+  if (!last) out.push(root);
+  while (pending.length) {
+    const directory = pending.pop();
+    let entries;
+    try { entries = fs.readdirSync(directory, { withFileTypes: true }); } catch { continue; }
+    budget.entries += entries.length;
+    if (overBudget(budget)) return false;
+    for (const entry of entries) {
+      if (entry.name.startsWith('.')) continue;
+      const joined = path.join(directory, entry.name);
+      if (entry.isDirectory()) { pending.push(joined); out.push(joined); } else if (last) out.push(joined);
+    }
+  }
+  return true;
+}
+
+function isDirectory(filePath) {
+  try { return fs.statSync(filePath).isDirectory(); } catch { return false; }
+}
+
+function dynamicSensitive(access, cwd) {
+  const found = [];
+  const budget = { entries: 0, assignments: 0, deadline: Date.now() + DYNAMIC_BUDGET.milliseconds, over: false };
+  if (access.decodedRead) found.push(DECODED_READ);
+  for (const name of access.pipeNames || []) {
+    if (name.length > DYNAMIC_BUDGET.textLength) budget.over = true;
+    if (overBudget(budget)) break;
+    if (nameLooksSensitive(name)) found.push(name);
+  }
+  const resolved = new Map();
+  for (const expansion of access.expansions || []) {
+    if (overBudget(budget)) break;
+    for (const literal of expansion.literals) if (isSensitive(literal) && !isSafe(literal)) found.push(literal);
+    if (expansion.text.length > DYNAMIC_BUDGET.textLength) { budget.over = true; break; }
+    const text = substitute(expansion.text, resolveVars(expansion.scopes || [], budget, resolved), budget);
+    for (const variant of braces(text, budget)) {
+      if (overBudget(budget)) break;
+      if (variant.includes(UNRESOLVED)) {
+        // `"$X/.env"`: whatever $X is, the name read is the literal tail. `.env$X`, `.en"$Y"v`: a name that starts with
+        // literal text reads, when the rest is empty, the name its literal parts spell. A name that starts with an
+        // unknown value (`$g.*`) says nothing about which file it is.
+        const tail = variant.slice(variant.lastIndexOf(UNRESOLVED) + 1);
+        if (tail.includes('/') && nameLooksSensitive(tail)) found.push(tail.replace(/^\/+/, ''));
+        const name = variant.slice(variant.lastIndexOf('/') + 1);
+        const joined = variant.split(UNRESOLVED).join('');
+        if (name && !name.startsWith(UNRESOLVED) && nameLooksSensitive(joined)) found.push(joined);
+        continue;
+      }
+      if (expansion.directory === null) {
+        if (nameLooksSensitive(variant)) found.push(variant);
+        continue;
+      }
+      const base = path.resolve(cwd, expansion.directory);
+      const candidates = hasGlob(variant) ? expandGlob(variant, base, budget) : [path.resolve(base, variant)];
+      if (candidates === null) {
+        if (nameLooksSensitive(variant)) found.push(variant);
+        continue;
+      }
+      for (const candidate of candidates) if (sensitiveRequest(candidate, cwd)) found.push(candidate);
+    }
+  }
+  if (budget.over) found.push(OVER_BUDGET);
+  return found;
+}
+
+// One hook call parses the same command for reads, writes and searches; parse it once.
+const accessCache = new Map();
+function cachedAccess(command) {
+  if (!accessCache.has(command)) {
+    if (accessCache.size >= 4) accessCache.clear();
+    accessCache.set(command, commandAccess(command));
+  }
+  return accessCache.get(command);
+}
+
 function sensitivePaths(toolName, input, cwd) {
   const paths = extractPaths(toolName, input).filter(filePath => sensitiveRequest(filePath, cwd));
   const tool = String(toolName).toLowerCase();
+  if (['bash', 'exec_command', 'shell'].includes(tool)) paths.push(...dynamicSensitive(cachedAccess(scrubCommand(shellInput(input))), cwd));
   const access = extractWritePaths(tool, input);
   paths.push(...access.writes.filter(filePath => protectedWrite(filePath, cwd)),
     ...access.unknownWrites.filter(protectedUnknownWrite));
@@ -273,7 +633,7 @@ function sensitivePaths(toolName, input, cwd) {
         .filter(glob => typeof glob === 'string' && glob),
     }]
     : ['bash', 'exec_command', 'shell'].includes(tool)
-      ? commandAccess(scrubCommand(shellInput(input))).searches : [];
+      ? cachedAccess(scrubCommand(shellInput(input))).searches : [];
   for (const search of searches) {
     if (!search.recursive) continue;
     // Negative globs and exclusion/type flags cannot prove a sensitive child is omitted.

package/src/claude/hooks/lib/spec-touch.cjs

@@ -64,4 +64,17 @@ function explicitFailure(payload) {
   return payload.success === false || failed(payload.tool_response);
 }
 
-module.exports = { canonicalTarget, packetAt, namedPackets, explicitFailure };
+/**
+ * Every file a write tool reports touching: the Claude `file_path`, omp's `path`/`paths`
+ * (omp derives them from an edit's file headers), and the files an omp result says it
+ * changed. A glob names no file, so it is skipped.
+ */
+function touchedPaths(payload) {
+  const input = payload.tool_input || {};
+  const details = (payload.tool_response && payload.tool_response.details) || {};
+  const values = [input.file_path, input.path, ...(Array.isArray(input.paths) ? input.paths : []), details.path,
+    ...[details.perFileResults, details.fileChanges].flatMap((list) => (Array.isArray(list) ? list.map((entry) => entry && entry.path) : []))];
+  return [...new Set(values.filter((value) => typeof value === 'string' && value.trim() && !/[*?[\]{}]/.test(value)))];
+}
+
+module.exports = { canonicalTarget, packetAt, namedPackets, explicitFailure, touchedPaths };

package/src/claude/hooks/plugin-context.cjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+/**
+ * Copyright (c) 2026 Haposoft. MIT License.
+ *
+ * SessionStart Hook — plugin-context.cjs (Claude Code plugin only)
+ *
+ * A plugin cannot ship CLAUDE.md or rules files as always-on context, so this
+ * hook injects the CafeKit core instructions as SessionStart additionalContext.
+ * The host caps that text at 10,000 characters; plugin/core.md is sized for it
+ * and points to the detailed rules files by absolute path.
+ *
+ * Registered only in the plugin's hooks.json; the npx install never runs it.
+ * Exit: 0 always (fail-open)
+ */
+
+try {
+  const fs = require('fs');
+  const path = require('path');
+
+  const os = require('os');
+
+  const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT;
+  if (!pluginRoot) process.exit(0);
+
+  function writeAtomic(file, text) {
+    const temp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(temp, text);
+    fs.renameSync(temp, file);
+  }
+
+  // A user statusLine cannot use ${CLAUDE_PLUGIN_ROOT}, which moves on every
+  // update, so keep a stable launcher in the data directory pointing at the
+  // current version, and record where it is for /cf:setup-statusline.
+  function writeStatuslineLauncher(root) {
+    const data = process.env.CLAUDE_PLUGIN_DATA;
+    if (!data || !path.isAbsolute(data)) return;
+    try {
+      const target = JSON.stringify(path.join(root, 'status.cjs'));
+      writeAtomic(path.join(data, 'status.cjs'), [
+        '#!/usr/bin/env node',
+        '// Written by the CafeKit plugin at session start; runs the installed version\'s statusline.',
+        '// A removed or replaced version prints nothing; a broken one still reports its error.',
+        `if (!require('fs').existsSync(${target})) process.exit(0);`,
+        `require(${target});`,
+        '',
+      ].join('\n'));
+      writeAtomic(path.join(os.homedir(), '.claude', 'cafekit-plugin-data'), `${data}\n`);
+    } catch { /* the statusline is optional; never fail the session for it */ }
+  }
+
+  try { fs.readFileSync(0, 'utf8'); } catch { /* the payload is not needed */ }
+
+  let core = fs.readFileSync(path.join(__dirname, '..', 'plugin', 'core.md'), 'utf8')
+    // A function replacement keeps `$&`-style sequences in the path literal.
+    .replaceAll('${CLAUDE_PLUGIN_ROOT}', () => pluginRoot);
+
+  // The npx install writes this section into CLAUDE.md; the plugin takes it from its option.
+  const address = require('./lib/plugin-options.cjs').pluginOption('address');
+  if (address) {
+    core += `\n## Addressing (Context Overflow Indicator)\n\nAlways address the user as ${JSON.stringify(address)} throughout the conversation. If you stop doing so, the context has been compacted or truncated; tell the user to consider \`/clear\`.\n`;
+  }
+
+  writeStatuslineLauncher(pluginRoot);
+
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: core },
+  }));
+  process.exit(0);
+} catch (e) {
+  try {
+    const fs = require('fs');
+    const p = require('path');
+    const d = require('./lib/hook-state-dir.cjs').hookStateDir();
+    if (!fs.existsSync(d)) fs.mkdirSync(d, { recursive: true });
+    fs.appendFileSync(p.join(d, 'hook-log.jsonl'),
+      JSON.stringify({ ts: new Date().toISOString(), hook: 'plugin-context', status: 'crash', error: e.message }) + '\n');
+  } catch (_) { /* logging must not fail the session */ }
+  process.exit(0);
+}

package/src/claude/hooks/privacy-block.cjs

@@ -55,7 +55,8 @@ try {
   const projectRoot = resolveProjectRoot(data);
   const runtime = readRuntime(projectRoot);
 
-  if (runtime.privacyBlock === false) process.exit(0);
+  // A plugin is trusted once for every repository, so a repository cannot switch it off.
+  if (runtime.privacyBlock === false && !require('./lib/plugin-options.cjs').isPlugin()) process.exit(0);
 
   const paths = sensitivePaths(toolName, toolInput, cwd);
   if (paths.length) askForPermission(`Sensitive file access requires approval: ${displayNames(paths)}`);

package/src/claude/hooks/rules.cjs

@@ -33,7 +33,10 @@ try {
   const payload   = normalizeHookPayload(JSON.parse(stdin));
   const sessionId = payload.session_id || null;
   const root = projectRoot(payload);
-  const runtime = readRuntime(root);
+  // An npx install always has runtime.json; under the plugin it is optional.
+  // Loaded only under the plugin, so npx installs need no extra hook file.
+  const plugin = process.env.CLAUDE_PLUGIN_ROOT ? require('./lib/plugin-options.cjs') : null;
+  const runtime = readRuntime(root) || (plugin ? {} : null);
   if (runtime === null) process.exit(0);
 
   // No session identity or reservation means no injection. Fail open.
@@ -41,7 +44,7 @@ try {
 
   // Language
   const thinkLang   = runtime.locale?.thinkingLanguage || '';
-  const respondLang = runtime.locale?.responseLanguage || '';
+  const respondLang = runtime.locale?.responseLanguage || (plugin ? plugin.pluginOption('response_language') : '');
   const effectThink = thinkLang || (respondLang ? 'en' : '');
 
   // Paths

package/src/claude/hooks/session.cjs

@@ -115,7 +115,10 @@ try {
   const runtime = readRuntime(cwd);
 
   // Check CafeKit update in parallel with project detection (async, fail-open).
-  const updateCheckPromise = checkCafeKitUpdate(runtimeDir(cwd)).catch(() => '');
+  // The plugin is updated by its marketplace, so an npx notice would be wrong there.
+  const updateCheckPromise = process.env.CLAUDE_PLUGIN_ROOT
+    ? Promise.resolve('')
+    : checkCafeKitUpdate(runtimeDir(cwd)).catch(() => '');
 
   // Project detection
   const projectType = runtime.project?.type !== 'auto'

package/src/claude/hooks/spec-state.cjs

@@ -14,7 +14,7 @@
 const fs = require('fs');
 const path = require('path');
 const { projectRoot } = require('./lib/project-root.cjs');
-const { packetAt, namedPackets, explicitFailure } = require('./lib/spec-touch.cjs');
+const { packetAt, namedPackets, explicitFailure, touchedPaths } = require('./lib/spec-touch.cjs');
 const { runtimeDirName, runtimeDir, runtimePath } = require('./lib/runtime-dir.cjs');
 
 function logCrash(error) {
@@ -119,9 +119,10 @@ try {
 
   if (payload.hook_event_name === 'PostToolUse') {
     // Record only; no resolve, no git, no tollgate cache.
-    if (touchFilter && specsRoot && !explicitFailure(payload) && /^(Edit|Write|MultiEdit)$/.test(payload.tool_name || '')) {
-      const name = packetAt(payload.tool_input && payload.tool_input.file_path, specsRoot, cwd);
-      if (name) addTouched([name]);
+    // omp's ast_edit keeps its own name: aliasing it to Edit would lift the inspect scope check.
+    if (touchFilter && specsRoot && !explicitFailure(payload) && /^(Edit|Write|MultiEdit|ast_edit)$/.test(payload.tool_name || '')) {
+      const names = touchedPaths(payload).map((value) => packetAt(value, specsRoot, cwd)).filter(Boolean);
+      if (names.length) addTouched(names);
     }
     process.exit(0);
   }

package/src/claude/hooks/state.cjs

@@ -86,7 +86,11 @@ try {
   function stateDir(cwd, sessionId, create = true) {
     try {
       let dir;
-      if (fs.existsSync(runtimeDir(cwd))) {
+      const pluginRoot = require('./lib/hook-state-dir.cjs').pluginStateRoot();
+      if (pluginRoot) {
+        const hash = crypto.createHash('md5').update(cwd).digest('hex').slice(0, 12);
+        dir = path.join(pluginRoot, 'session-states', hash);
+      } else if (fs.existsSync(runtimeDir(cwd))) {
         dir = runtimePath(cwd, 'session-state');
       } else {
         const hash = crypto.createHash('md5').update(cwd).digest('hex').slice(0, 12);

package/src/claude/migration-manifest.json

@@ -6,6 +6,7 @@
   },
   "skills": {
     "required": [
+      "adv",
       "agent-browser",
       "ask",
       "brainstorm",
@@ -23,6 +24,7 @@
       "test",
       "ui-ux",
       "ui-ux-pro-max",
+      "vibe",
       "web-testing"
     ],
     "bundles": {
@@ -51,7 +53,8 @@
       "spec-maker.md",
       "ui-ux-designer.md",
       "deployer.md",
-      "strategist.md"
+      "strategist.md",
+      "advisor.md"
     ]
   },
   "scripts": {
@@ -92,6 +95,7 @@
       "codex": ["agents/god_developer.toml"]
     },
     "runtimeFiles": [
+      "extensions/cafekit-bridge.mjs",
       "scripts/validate-spec-output.cjs",
       "scripts/spec-ground.cjs",
       "scripts/spec-authoring-digest.cjs",
@@ -170,6 +174,7 @@
       "hooks/lib/git.cjs",
       "hooks/lib/config.cjs",
       "hooks/lib/hook-state-dir.cjs",
+      "hooks/lib/plugin-options.cjs",
       "hooks/lib/runtime-dir.cjs",
       "hooks/lib/spec-touch.cjs",
       "hooks/lib/project-root.cjs",