@haposoft/cafekit 0.18.2 → 0.18.4

package/bin/__tests__/codex-hooks-ownership.test.js

@@ -79,17 +79,6 @@ function addUserHooks(root) {
   fs.writeFileSync(hooksPath(root), `${JSON.stringify(config, null, 2)}\n`);
 }
 
-test('a fresh install registers the precompact capture hook', () => {
-  inTempProject((root) => {
-    assert.ok(managedScripts().PreCompact?.includes('precompact.cjs'));
-    const result = install(root);
-    assert.equal(result.status, 0, result.stderr);
-    const scripts = (readHooks(root).hooks.PreCompact || []).flatMap(group => group.hooks || []).map(handler => hookScript(handler.command));
-    assert.ok(scripts.includes('precompact.cjs'));
-    assert.ok(fs.existsSync(path.join(root, '.codex/hooks/precompact.cjs')));
-  });
-});
-
 test('a fresh install registers every CafeKit hook under its own event', () => {
   inTempProject((root) => {
     const result = install(root);
@@ -103,7 +92,10 @@ test('a fresh install registers every CafeKit hook under its own event', () => {
         .filter(Boolean);
       for (const script of scripts) {
         assert.ok(registered.includes(script), `${script} missing from ${eventName}`);
+        assert.ok(fs.existsSync(path.join(root, '.codex/hooks', script)), `${script} not installed`);
       }
+      const template = JSON.parse(fs.readFileSync(TEMPLATE, 'utf8')).hooks[eventName];
+      assert.deepEqual(installed.hooks[eventName].map((group) => group.matcher), template.map((group) => group.matcher));
     }
   });
 });
@@ -119,6 +111,11 @@ test('a reinstall preserves user-added hooks instead of overwriting them', () =>
     const commands = allCommands(readHooks(root));
     assert.ok(commands.includes(USER_STOP_COMMAND), 'user Stop hook was erased by the reinstall');
     assert.ok(commands.includes(USER_PRETOOL_COMMAND), 'user PreToolUse hook was erased by the reinstall');
+    const after = readHooks(root).hooks;
+    const userGroup = (event, command) => after[event].find((group) => group.hooks.some((handler) => handler.command === command));
+    assert.deepEqual(userGroup('Stop', USER_STOP_COMMAND), { matcher: '*', hooks: [{ type: 'command', command: USER_STOP_COMMAND }] });
+    assert.deepEqual(userGroup('PreToolUse', USER_PRETOOL_COMMAND), { matcher: 'Bash', hooks: [{ type: 'command', command: USER_PRETOOL_COMMAND }] });
+    assert.doesNotMatch(second.stdout + second.stderr, /matcher preserved/);
   });
 });
 

package/bin/__tests__/codex-hooks.test.js

@@ -7,6 +7,7 @@ const os = require('node:os');
 const path = require('node:path');
 const { spawnSync, spawn } = require('node:child_process');
 const { test } = require('node:test');
+const { installCodexHookRuntime } = require('./codex-hook-runtime-fixture.cjs');
 
 const OLD_INSPECTION_MATCHER = 'Bash|exec_command|apply_patch|Edit|Write|Read|Glob|Grep|mcp__.*|shell';
 const NEW_INSPECTION_MATCHER = 'Bash|exec_command|shell|apply_patch|mcp__.*|collaborationspawn_agent|collaborationwait_agent';
@@ -44,31 +45,6 @@ test('upgrade preserves a mixed user group and warns', () => matcherFixture(f =>
   assert.ok(f.read().hooks.PreToolUse[0].hooks.some(h => h.command === 'echo user-owned'));
   assert.ok(f.warnings.some(line => /matcher.*preserv/i.test(line)));
 }));
-test('reinstall keeps purely user groups unchanged without matcher warnings', () => matcherFixture(f => {
-  const userPre = { matcher: 'Bash', hooks: [{ command: 'my-linter' }] };
-  const userPost = { hooks: [{ command: 'my-logger' }] };
-  f.config.hooks = { PreToolUse: [userPre], PostToolUse: [userPost] }; f.save();
-  const installs = Array.from({ length: 2 }, () => {
-    const result = spawnSync(process.execPath, [path.resolve(__dirname, '../install.js'), '--platform', 'codex', '-y'], {
-      cwd: f.root, encoding: 'utf8',
-    });
-    return { result, config: f.read() };
-  });
-  for (const { result, config } of installs) {
-    assert.equal(result.status, 0, result.stderr);
-    for (const [event, original] of [['PreToolUse', userPre], ['PostToolUse', userPost]]) {
-      const group = config.hooks[event].find(g => g.hooks.some(h => h.command === original.hooks[0].command));
-      assert.equal(JSON.stringify(group), JSON.stringify(original));
-    }
-    assert.doesNotMatch(result.stdout + result.stderr, /matcher preserved/);
-  }
-}));
-test('fresh hook registration uses every template matcher', () => matcherFixture(f => {
-  f.merge();
-  for (const [event, groups] of Object.entries(f.config.hooks)) {
-    assert.deepEqual(f.read().hooks[event].map(g => g.matcher), groups.map(g => g.matcher));
-  }
-}));
 test('upgrade preserves a user-selected managed matcher and warns', () => matcherFixture(f => {
   f.config.hooks.PreToolUse[0].matcher = 'Read|Grep'; f.save(); f.merge();
   assert.equal(f.read().hooks.PreToolUse[0].matcher, 'Read|Grep');
@@ -93,12 +69,18 @@ const { stateDir: codexStateDir } = require(
   path.join(CODEX_HOOKS, 'lib', 'state-store.cjs')
 );
 
+// A hook child that never exits must fail its test, not hang the whole suite.
+const HOOK_TIMEOUT_MS = 30000;
+
 function runHook(file, cwd, payload) {
-  return spawnSync(process.execPath, [file], {
+  const result = spawnSync(process.execPath, [file], {
     cwd,
     input: JSON.stringify(payload),
-    encoding: 'utf8'
+    encoding: 'utf8',
+    timeout: HOOK_TIMEOUT_MS
   });
+  assert.equal(result.error, undefined, `${path.basename(file)} did not exit: ${result.error?.message}`);
+  return result;
 }
 
 function runtimeContext(root, feature = 'auth', session = 'session-a') {
@@ -145,26 +127,7 @@ function inHookFixture(run, options = {}) {
   const hooks = path.join(root, '.codex', 'hooks');
   let deferred = false;
   try {
-    fs.cpSync(CODEX_HOOKS, hooks, { recursive: true });
-    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/spec-touch.cjs'), path.join(hooks, 'lib/spec-touch.cjs'));
-    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/secret-keywords.cjs'), path.join(hooks, 'lib/secret-keywords.cjs'));
-    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/update-check.cjs'), path.join(hooks, 'lib/update-check.cjs'));
-    fs.copyFileSync(
-      path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/inspect-paths.cjs'),
-      path.join(hooks, 'lib/inspect-paths.cjs'),
-    );
-    fs.copyFileSync(
-      path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/privacy-command-analysis.cjs'),
-      path.join(hooks, 'lib/privacy-command-analysis.cjs'),
-    );
-    fs.copyFileSync(
-      path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/privacy-paths.cjs'),
-      path.join(hooks, 'lib/privacy-paths.cjs'),
-    );
-    fs.copyFileSync(
-      path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/runtime-path-safety.cjs'),
-      path.join(hooks, 'lib/runtime-path-safety.cjs'),
-    );
+    installCodexHookRuntime(root);
     fs.mkdirSync(path.join(root, '.codex', 'scripts'), { recursive: true });
     if (options.policy !== 'missing') {
       if (options.policy === 'malformed') {
@@ -216,15 +179,7 @@ function inNoCommitCodexFixture(run) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-no-commit-'));
   const hooks = path.join(root, '.codex/hooks');
   try {
-    fs.cpSync(CODEX_HOOKS, hooks, { recursive: true });
-    for (const name of ['privacy-paths.cjs', 'privacy-command-analysis.cjs']) {
-      fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib', name), path.join(hooks, 'lib', name));
-    }
-    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/spec-touch.cjs'), path.join(hooks, 'lib/spec-touch.cjs'));
-    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/secret-keywords.cjs'), path.join(hooks, 'lib/secret-keywords.cjs'));
-    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/update-check.cjs'), path.join(hooks, 'lib/update-check.cjs'));
-    fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/lib/runtime-path-safety.cjs'),
-      path.join(hooks, 'lib/runtime-path-safety.cjs'));
+    installCodexHookRuntime(root);
     const scripts = path.join(root, '.codex/scripts');
     fs.mkdirSync(scripts, { recursive: true });
     for (const name of ['workflow-policy.cjs', 'provenance.cjs', 'spec-receipt.cjs', 'spec-resolver.cjs']) {
@@ -539,7 +494,7 @@ for (const method of ['spawnSync', 'execFileSync']) {
 }
 `);
       const result = spawnSync(process.execPath, [path.join(hooks, 'spec-state.cjs')], {
-        cwd: root, encoding: 'utf8',
+        cwd: root, encoding: 'utf8', timeout: HOOK_TIMEOUT_MS,
         env: { ...process.env, NODE_OPTIONS: `${process.env.NODE_OPTIONS || ''} --require ${JSON.stringify(preload)}` },
         input: JSON.stringify({ cwd: root, featureName: 'auth', hook_event_name: 'UserPromptSubmit',
           session_id: 'one-snapshot', prompt: 'Continue specs/auth' }),
@@ -754,7 +709,7 @@ test('Codex secret guardrail runs from source with its shared keyword shim', ()
   delete env.CLAUDE_PROJECT_DIR;
   delete env.PROJECT_ROOT;
   const result = spawnSync(process.execPath, [path.join(CODEX_HOOKS, 'secret-output-guardrail.cjs')], {
-    cwd: PACKAGE_ROOT, env, encoding: 'utf8', input: JSON.stringify({ prompt: 'Explain secret handling.' }),
+    cwd: PACKAGE_ROOT, env, encoding: 'utf8', timeout: HOOK_TIMEOUT_MS, input: JSON.stringify({ prompt: 'Explain secret handling.' }),
   });
   assert.equal(result.status, 0);
   assert.equal(result.stderr, '');
@@ -804,6 +759,37 @@ test('Codex compact clears its pending privacy request even with an invalid spec
   });
 });
 
+// Two privacy blocks racing on a fresh project both see no `.privacy` directory;
+// the second mkdir then meets the directory the first one made.
+test('Codex privacy records a request when another hook creates its state directory first', () => {
+  inHookFixture((root, hooks) => {
+    const privacy = require(path.join(hooks, 'lib/privacy-state.cjs'));
+    fs.mkdirSync(path.join(hooks, '.privacy'), { mode: 0o700 });
+    const existsSync = fs.existsSync;
+    fs.existsSync = target => (path.basename(String(target)) === '.privacy' ? false : existsSync(target));
+    let request;
+    try {
+      request = privacy.createPending({ projectRoot: root, sessionCwd: root, sessionId: 'race-session', filePaths: ['.env'] });
+    } finally {
+      fs.existsSync = existsSync;
+    }
+    assert.match(request.requestId, /^[a-f0-9]{24}$/);
+  });
+});
+
+test('Codex privacy denies when its state path is a regular file', () => {
+  inHookFixture((root, hooks) => {
+    fs.writeFileSync(path.join(hooks, '.privacy'), '');
+    const result = runHook(path.join(hooks, 'privacy-block.cjs'), root, {
+      cwd: root, session_id: 'file-state', hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: 'cat .env' },
+    });
+    assert.equal(result.status, 0);
+    const output = JSON.parse(result.stdout).hookSpecificOutput;
+    assert.equal(output.permissionDecision, 'deny');
+    assert.match(output.permissionDecisionReason, /could not be evaluated safely/);
+  });
+});
+
 test('Codex compact releases only its own rules reservation', () => {
   inHookFixture((root, hooks) => {
     fs.writeFileSync(path.join(root, '.codex/runtime.json'), '{}');
@@ -824,7 +810,7 @@ test('Codex compact releases only its own rules reservation', () => {
 test('Codex precompact ignores empty stdin without recording a crash', () => {
   inHookFixture((root, hooks) => {
     const result = spawnSync(process.execPath, [path.join(hooks, 'precompact.cjs')], {
-      cwd: root, input: '', encoding: 'utf8',
+      cwd: root, input: '', encoding: 'utf8', timeout: HOOK_TIMEOUT_MS,
     });
     assert.equal(result.status, 0);
     assert.equal(result.stderr, '');
@@ -869,7 +855,8 @@ function sessionWithoutUpdateNetwork(root, hooks, session_id) {
     throw new Error('network disabled in update test');
   };\n`);
   const result = spawnSync(process.execPath, ['--require', preload, path.join(hooks, 'session.cjs')], {
-    cwd: root, encoding: 'utf8', input: JSON.stringify({ cwd: root, hook_event_name: 'SessionStart', source: 'startup', session_id }),
+    cwd: root, encoding: 'utf8', timeout: HOOK_TIMEOUT_MS,
+    input: JSON.stringify({ cwd: root, hook_event_name: 'SessionStart', source: 'startup', session_id }),
   });
   assert.equal(fs.existsSync(marker), false, 'the cached update check must not attempt a network request');
   return result;
@@ -945,7 +932,7 @@ function shortPrivacyFixture(check) {
       hook_event_name: 'PreToolUse', tool_name: 'Bash', tool_input: { command: `cat ${file}` } });
     const block = (file, id) => runHook(path.join(hooks, 'privacy-block.cjs'), root, payload(file, id));
     const submit = (prompt, session_id = session, env = process.env) => spawnSync(process.execPath,
-      [path.join(hooks, 'privacy-approval.cjs')], { cwd: root, encoding: 'utf8', env,
+      [path.join(hooks, 'privacy-approval.cjs')], { cwd: root, encoding: 'utf8', env, timeout: HOOK_TIMEOUT_MS,
         input: JSON.stringify({ cwd: root, session_id, hook_event_name: 'UserPromptSubmit', prompt }) });
     const files = prefix => fs.existsSync(dir) ? fs.readdirSync(dir).filter(name => name.startsWith(prefix)) : [];
     const id = result => {
@@ -1651,6 +1638,7 @@ test('empty or forged Codex hook authority fails closed', () => {
         env: { ...process.env },
         input,
         encoding: 'utf8',
+        timeout: HOOK_TIMEOUT_MS,
       });
       assert.equal(result.status, 0, `${JSON.stringify(input)}: ${result.stderr}`);
       assert.equal(result.stderr, '');
@@ -2130,14 +2118,18 @@ test('Codex privacy denies sensitive names it can resolve, allows pure indirecti
       { command: 'curl --config ~/.netrc https://example.com', tool: 'Bash' },
       { command: 'kubectl --kubeconfig ~/.kube/kubeconfig get pods', tool: 'exec_command' },
       { command: 'openssl rsa -in server.key', tool: 'Bash' },
+      { command: 'less "$HOME/.env"', tool: 'Bash' },
+      { command: 'cat $(echo .env)', tool: 'Bash' },
+      { command: 'cat `echo .env`', tool: 'Bash' },
     ];
     for (const { command, tool } of denied) {
       const res = runHook(block, root, { cwd: root, session_id: 's1', hook_event_name: 'PreToolUse', tool_name: tool, tool_input: { command } });
       assert.equal(JSON.parse(res.stdout).hookSpecificOutput.permissionDecision, 'deny', `should deny ${command}`);
     }
-    // Accepted gap: the target of `$FILE` is unknowable without running the
-    // shell, and every denial here costs a round trip through a one-shot
-    // approval prompt. `less "$HOME/.env"` is the edge of that decision.
+    // Accepted gap: the target of a bare `$FILE` is unknowable without running
+    // the shell, and every denial here costs a round trip through a one-shot
+    // approval prompt. A sensitive name spelled out next to the expansion
+    // (`"$HOME/.env"`, `$(echo .env)`) is not indirection and is denied above.
     const allowed = [
       { command: "echo $VAR", tool: 'exec_command' },
       { command: 'echo "$HOME"', tool: 'Bash' },
@@ -2166,11 +2158,8 @@ test('Codex privacy denies sensitive names it can resolve, allows pure indirecti
       { command: 'cat "$FILE"', tool: 'exec_command' },
       { command: 'cat ${FILE}', tool: 'Bash' },
       { command: 'cat $1', tool: 'exec_command' },
-      { command: 'cat $(echo .env)', tool: 'Bash' },
-      { command: 'cat `echo .env`', tool: 'Bash' },
       { command: 'head $SECRET', tool: 'exec_command' },
       { command: 'tail ${MY_FILE}', tool: 'Bash' },
-      { command: 'less "$HOME/.env"', tool: 'Bash' },
       { command: 'cat README.md $EXTRA', tool: 'Bash' },
       { command: 'echo ok; cat README.md $FILE', tool: 'Bash' },
       { command: 'cat README.md | head $FILE', tool: 'exec_command' },
@@ -2358,7 +2347,37 @@ test('Codex hook-context canonicalizes symlink project root (regression)', () =>
   });
 });
 
-test('Codex resolver and state reject symlink escape', () => {
+test('Codex session state refuses a symlinked state path and writes nothing outside the project', () => {
+  inHookFixture((root, hooks) => {
+    const stateStore = require(path.join(hooks, 'lib', 'state-store.cjs'));
+    const sessionId = 'sess-symlink';
+    const dir = stateStore.stateDir(root, sessionId);
+    const sessionState = path.dirname(dir);
+    // A repository can commit either the shared state folder or one session folder as a link.
+    for (const link of [sessionState, dir]) {
+      const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'codex-state-outside-'));
+      try {
+        fs.rmSync(sessionState, { recursive: true, force: true });
+        fs.mkdirSync(path.dirname(link), { recursive: true });
+        fs.symlinkSync(outside, link);
+        let called = false;
+        const ok = stateStore.withStateLock(root, sessionId, (stateDir) => {
+          called = true;
+          stateStore.writeData(stateDir, { todos: [] });
+        });
+        assert.equal(ok, false, `${path.relative(root, link)} link must be refused`);
+        assert.equal(called, false);
+        assert.deepEqual(fs.readdirSync(outside), [], 'nothing may be written outside the project');
+      } finally {
+        fs.rmSync(sessionState, { recursive: true, force: true });
+        fs.rmSync(outside, { recursive: true, force: true });
+      }
+    }
+    assert.equal(stateStore.withStateLock(root, sessionId, () => {}), true, 'a plain state folder still locks');
+  });
+});
+
+test('Codex resolver rejects symlink escape', () => {
   inHookFixture((root, hooks) => {
     const specUtils = require(path.join(hooks, 'lib', 'spec-utils.cjs'));
     const resolverPath = path.join(root, '.codex', 'scripts', 'spec-resolver.cjs');
@@ -2386,23 +2405,6 @@ test('Codex resolver and state reject symlink escape', () => {
       );
       fs.rmSync(outsideScripts, { recursive: true, force: true });
     }
-    // State dir symlink escape: create symlink for session-state dir
-    const stateStore = require(path.join(hooks, 'lib', 'state-store.cjs'));
-    const sessionId = 'sess-symlink';
-    const dir = stateStore.stateDir(root, sessionId);
-    fs.mkdirSync(path.dirname(dir), { recursive: true });
-    // Create a symlink that points outside project
-    const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'outside-'));
-    try {
-      if (fs.existsSync(dir)) fs.rmSync(dir, { recursive: true, force: true });
-      fs.symlinkSync(outside, dir);
-      // withStateLock should handle symlink safely (no crash, no write outside)
-      const ok = stateStore.withStateLock(root, sessionId, () => {});
-      assert.equal(typeof ok, 'boolean');
-    } finally {
-      try { fs.unlinkSync(dir); } catch {}
-      fs.rmSync(outside, { recursive: true, force: true });
-    }
   });
 });
 

package/bin/__tests__/codex-implicit-policy.test.js

@@ -0,0 +1,160 @@
+// Codex ignores the `disable-model-invocation` key that keeps a skill explicit-only on Claude Code. Its own
+// mechanism is `agents/openai.yaml` beside SKILL.md with `policy.allow_implicit_invocation: false`. These cases
+// pin that the Codex install writes that file for every explicit-only skill through the ownership-aware writer
+// (so upgrades and removals stay clean), writes it for no other skill, and that the catalog never lists such a skill.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const test = require('node:test');
+const { spawnSync } = require('node:child_process');
+
+const { PLATFORMS } = require('../lib/context');
+const manifestLib = require('../lib/manifest');
+const { removeSkill } = require('../phases/skill-inventory');
+
+const PACKAGE_ROOT = path.join(__dirname, '..', '..');
+const INSTALLER = path.join(PACKAGE_ROOT, 'bin/install.js');
+const SOURCE_SKILLS = path.join(PACKAGE_ROOT, 'src/claude/skills');
+const POLICY = 'policy:\n  allow_implicit_invocation: false\n';
+
+const explicitOnly = fs.readdirSync(SOURCE_SKILLS)
+  .filter((name) => fs.existsSync(path.join(SOURCE_SKILLS, name, 'SKILL.md')))
+  .filter((name) => /^disable-model-invocation:\s*(["']?)true\1\s*$/m.test(
+    fs.readFileSync(path.join(SOURCE_SKILLS, name, 'SKILL.md'), 'utf8').split(/^---\s*$/m)[1] || ''));
+
+function install(root, platform) {
+  const result = spawnSync(process.execPath, [INSTALLER, '--platform', platform, '--yes'],
+    { cwd: root, encoding: 'utf8', env: { ...process.env, PATH: '/usr/bin:/bin' } });
+  assert.equal(result.status, 0, result.stderr || result.stdout);
+  return result;
+}
+
+function withTempProject(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-policy-'));
+  const previous = process.cwd();
+  try {
+    assert.equal(spawnSync('git', ['-C', root, 'init', '-q']).status, 0);
+    process.chdir(root);
+    return run(root);
+  } finally {
+    process.chdir(previous);
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+const policyFile = (root, skill) => path.join(root, '.agents/skills', skill, 'agents/openai.yaml');
+const ownershipKey = (root, file) => path.relative(path.join(root, PLATFORMS.codex.ownership?.recordRoot || PLATFORMS.codex.folder), file).replace(/\\/g, '/');
+const readOwnership = (root) => JSON.parse(fs.readFileSync(path.join(root, PLATFORMS.codex.folder, manifestLib.MANIFEST_FILE), 'utf8'));
+const writeOwnership = (root, data) => fs.writeFileSync(path.join(root, PLATFORMS.codex.folder, manifestLib.MANIFEST_FILE), JSON.stringify(data, null, 2));
+
+function catalog(root, script, skillsRoot) {
+  const result = spawnSync(process.execPath, [path.join(root, script), '--json', '--root', path.join(root, skillsRoot)],
+    { cwd: root, encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  return JSON.parse(result.stdout);
+}
+
+test('the explicit-only skills are adv, toaa and vibe', () => {
+  assert.deepEqual(explicitOnly.sort(), ['adv', 'toaa', 'vibe']);
+});
+
+test('a Codex install writes the policy file for every explicit-only skill, owned, and for no other skill', () => {
+  withTempProject((root) => {
+    install(root, 'codex');
+    const ownership = readOwnership(root);
+    for (const skill of explicitOnly) {
+      const file = policyFile(root, skill);
+      assert.equal(fs.readFileSync(file, 'utf8'), POLICY, skill);
+      assert.equal(ownership.files[ownershipKey(root, file)]?.sha256, manifestLib.hashFile(file), `${skill} policy is not owned`);
+    }
+    const others = fs.readdirSync(path.join(root, '.agents/skills')).filter((name) => !explicitOnly.includes(name));
+    assert.ok(others.length > 10);
+    for (const skill of others) assert.equal(fs.existsSync(policyFile(root, skill)), false, skill);
+  });
+});
+
+test('reinstalling keeps the policy bytes and its ownership record unchanged', () => {
+  withTempProject((root) => {
+    install(root, 'codex');
+    const before = explicitOnly.map((skill) => readOwnership(root).files[ownershipKey(root, policyFile(root, skill))]?.sha256);
+    install(root, 'codex');
+    const after = explicitOnly.map((skill) => readOwnership(root).files[ownershipKey(root, policyFile(root, skill))]?.sha256);
+    assert.deepEqual(after, before);
+    for (const skill of explicitOnly) assert.equal(fs.readFileSync(policyFile(root, skill), 'utf8'), POLICY);
+  });
+});
+
+test('an owned policy file under a skill that dropped the key is removed on upgrade; a user-created one stays', () => {
+  withTempProject((root) => {
+    install(root, 'codex');
+    // An earlier release that marked ask explicit-only would have written and owned this file.
+    const owned = policyFile(root, 'ask');
+    fs.mkdirSync(path.dirname(owned), { recursive: true });
+    fs.writeFileSync(owned, POLICY);
+    const data = readOwnership(root);
+    data.files[ownershipKey(root, owned)] = { sha256: manifestLib.hashFile(owned), version: 'old' };
+    writeOwnership(root, data);
+    // A file the user wrote is never ours to delete.
+    const userFile = policyFile(root, 'debug');
+    fs.mkdirSync(path.dirname(userFile), { recursive: true });
+    fs.writeFileSync(userFile, POLICY);
+
+    install(root, 'codex');
+    assert.equal(fs.existsSync(owned), false, 'owned stale policy survived the upgrade');
+    assert.equal(readOwnership(root).files[ownershipKey(root, owned)], undefined, 'stale policy stayed in the manifest');
+    assert.equal(fs.readFileSync(userFile, 'utf8'), POLICY, 'user-created policy was removed');
+  });
+});
+
+test('a user edit to the policy file is preserved on upgrade', () => {
+  withTempProject((root) => {
+    install(root, 'codex');
+    const file = policyFile(root, 'vibe');
+    const edited = 'policy:\n  allow_implicit_invocation: true\n';
+    fs.writeFileSync(file, edited);
+    install(root, 'codex');
+    assert.equal(fs.readFileSync(file, 'utf8'), edited);
+  });
+});
+
+test('removing an explicit-only skill removes its whole tree, the policy file included', () => {
+  withTempProject((root) => {
+    install(root, 'codex');
+    const ctx = {
+      ownership: { [PLATFORMS.codex.folder]: readOwnership(root) },
+      trackers: { codex: manifestLib.createTracker(PLATFORMS.codex.folder, 'next', PLATFORMS.codex.ownership) },
+      dryRun: false,
+      ui: { warn() {}, detail() {} },
+      results: { updated: 0, preserved: 0, preservedFiles: [] }
+    };
+    removeSkill(ctx, 'codex', 'vibe');
+    assert.deepEqual(ctx.results.preservedFiles, []);
+    assert.equal(fs.existsSync(path.join(root, '.agents/skills/vibe')), false);
+  });
+});
+
+test('a Claude install writes no policy file', () => {
+  withTempProject((root) => {
+    install(root, 'claude');
+    for (const skill of fs.readdirSync(path.join(root, '.claude/skills'))) {
+      assert.equal(fs.existsSync(path.join(root, '.claude/skills', skill, 'agents/openai.yaml')), false, skill);
+    }
+  });
+});
+
+test('neither runtime catalog lists an explicit-only skill, and both still list the others', () => {
+  withTempProject((root) => {
+    install(root, 'claude,codex');
+    for (const [script, skillsRoot] of [['.codex/scripts/generate-skill-catalog.cjs', '.agents/skills'],
+      ['.claude/scripts/generate-skill-catalog.cjs', '.claude/skills']]) {
+      const parsed = catalog(root, script, skillsRoot);
+      const ids = parsed.skills.map((skill) => skill.public_id);
+      for (const skill of explicitOnly) {
+        assert.equal(ids.includes(`cf:${skill}`), false, `${script} lists cf:${skill}`);
+        assert.ok(parsed.diagnostics.some((item) => item.directory === skill && item.code === 'explicit_only'), `${script}: ${skill}`);
+      }
+      assert.ok(ids.includes('cf:ask') && ids.includes('cf:specs'), script);
+    }
+  });
+});

package/bin/__tests__/codex-native-hook-boundaries.test.js

@@ -6,16 +6,14 @@ const os = require('node:os');
 const path = require('node:path');
 const { spawnSync } = require('node:child_process');
 const { test } = require('node:test');
+const { installCodexHookRuntime } = require('./codex-hook-runtime-fixture.cjs');
 const SOURCE = path.resolve(__dirname, '../../src');
 
 function fixture(run) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-native-boundaries-'));
   const hooks = path.join(root, '.codex/hooks');
   try {
-    fs.cpSync(path.join(SOURCE, 'codex/hooks'), hooks, { recursive: true });
-    for (const name of ['runtime-path-safety', 'privacy-command-analysis', 'privacy-paths', 'secret-keywords', 'inspect-paths', 'update-check']) {
-      fs.copyFileSync(path.join(SOURCE, `claude/hooks/lib/${name}.cjs`), path.join(hooks, `lib/${name}.cjs`));
-    }
+    installCodexHookRuntime(root);
     fs.cpSync(path.join(SOURCE, 'claude/scripts'), path.join(root, '.codex/scripts'), { recursive: true });
     fs.writeFileSync(path.join(root, '.gitignore'), '.codex/\n');
     for (const args of [['init', '-q'], ['config', 'user.email', 'probe@example.invalid'], ['config', 'user.name', 'Probe'], ['add', '.gitignore'], ['commit', '-qm', 'base']]) {