@haposoft/cafekit 0.18.2 → 0.18.4

package/bin/__tests__/codex-plugin-build.test.js

@@ -0,0 +1,230 @@
+'use strict';
+
+const { test, before, after } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const REPO = path.resolve(__dirname, '../../../..');
+const SRC = path.resolve(__dirname, '../../src');
+const SCRIPT = path.resolve(__dirname, '../../scripts/build-codex-plugin.mjs');
+let lib;
+let claudeLib;
+let work;
+let tree;
+
+function walk(root, base = root) {
+  return fs.readdirSync(root, { withFileTypes: true }).flatMap((entry) => {
+    const full = path.join(root, entry.name);
+    return entry.isDirectory() ? walk(full, base) : [path.relative(base, full)];
+  });
+}
+
+before(async () => {
+  lib = await import(SCRIPT);
+  claudeLib = await import(path.resolve(__dirname, '../../scripts/build-claude-plugin.mjs'));
+  work = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-codex-plugin-build-'));
+  tree = lib.build(path.join(work, 'cf-codex'));
+});
+
+after(() => fs.rmSync(work, { recursive: true, force: true }));
+
+test('inventory-and-policy: the Claude plugin skill list, Codex names, and explicit-only policies', () => {
+  const skills = fs.readdirSync(path.join(tree, 'skills')).sort();
+  // The Claude plugin's skills plus the Codex-only ones.
+  assert.deepEqual(skills, [...claudeLib.inScopeSkills(), ...lib.CODEX_ONLY_SKILLS].sort());
+  const { isExplicitOnlySkill, CODEX_POLICY_FILE, CODEX_EXPLICIT_ONLY_POLICY } = require('../phases/copy-payload');
+  for (const skill of skills) {
+    const text = fs.readFileSync(path.join(tree, 'skills', skill, 'SKILL.md'), 'utf8');
+    assert.match(text, new RegExp(`^---\\nname: cf-${skill}\\n`), `${skill} keeps the installer's Codex name`);
+    const policy = path.join(tree, 'skills', skill, CODEX_POLICY_FILE);
+    const skillSource = lib.CODEX_ONLY_SKILLS.includes(skill) ? path.join(SRC, 'codex/plugin/skills', skill) : path.join(SRC, 'claude/skills', skill);
+    if (isExplicitOnlySkill(skillSource)) {
+      assert.equal(fs.readFileSync(policy, 'utf8'), CODEX_EXPLICIT_ONLY_POLICY, `${skill} policy`);
+    } else {
+      assert.ok(!fs.existsSync(policy), `${skill} has an unexpected policy file`);
+    }
+  }
+});
+
+test('path-allowlist: Markdown reaches plugin files through {CAFEKIT_ROOT}, never an install path', () => {
+  const offenders = [];
+  for (const file of walk(tree).filter((f) => f.endsWith('.md'))) {
+    const text = fs.readFileSync(path.join(tree, file), 'utf8');
+    if (/\.codex[/\\](skills|references|scripts|rules|hooks|output-styles)\b/.test(text)) offenders.push(`${file}: .codex runtime path`);
+    if (/\.agents[/\\]skills\b/.test(text)) offenders.push(`${file}: .agents/skills path`);
+    if (/(?<!~\/)\.codex\/agents\//.test(text)) offenders.push(`${file}: project .codex/agents path`);
+    if (/\.claude[/\\](skills|references|scripts|rules)\b/.test(text)) offenders.push(`${file}: .claude runtime path`);
+    if (/\{CAFEKIT_ROOT\}\/scripts\//.test(text)) offenders.push(`${file}: script reached by path instead of {cafekit:<name>}`);
+    for (const [, rel] of text.matchAll(/\{CAFEKIT_ROOT\}\/([^\s`'")]+)/g)) {
+      const target = rel.replace(/[.,:;]+$/, '');
+      if (/[<*]/.test(target)) continue;
+      if (!fs.existsSync(path.join(tree, target))) offenders.push(`${file}: {CAFEKIT_ROOT}/${target} does not exist`);
+    }
+  }
+  assert.deepEqual(offenders, []);
+  const commands = lib.scriptCommands(tree);
+  assert.ok(commands.includes('provenance'), 'provenance is not in the command table');
+  for (const name of commands) assert.ok(fs.existsSync(path.join(tree, 'scripts', `${name}.cjs`)), `${name} has no script`);
+});
+
+test('manifest-and-marketplace: plugin.json and the repo marketplace carry the keys Codex reads', () => {
+  const manifest = JSON.parse(fs.readFileSync(path.join(tree, '.codex-plugin/plugin.json'), 'utf8'));
+  assert.equal(manifest.name, 'cf');
+  assert.equal(manifest.version, require('../../package.json').version);
+  for (const key of ['description', 'author', 'license', 'interface']) assert.ok(manifest[key], `plugin.json lacks ${key}`);
+  const market = lib.marketplace();
+  assert.equal(typeof market.name, 'string');
+  const entry = market.plugins.find((p) => p.name === 'cf');
+  assert.deepEqual(entry.source, { source: 'local', path: './plugins/cf-codex' });
+  assert.ok(entry.policy?.installation && entry.policy?.authentication && entry.category, 'entry lacks policy or category');
+});
+
+test('marketplace-not-ignored: git can commit .agents/plugins/marketplace.json', () => {
+  // --no-index: a tracked file would otherwise always read as not ignored.
+  const run = spawnSync('git', ['check-ignore', '-q', '--no-index', '.agents/plugins/marketplace.json'], { cwd: REPO });
+  assert.equal(run.status, 1, 'the marketplace file is ignored by git');
+  const skills = spawnSync('git', ['check-ignore', '-q', '--no-index', '.agents/skills/specs/SKILL.md'], { cwd: REPO });
+  assert.equal(skills.status, 0, 'npx-installed .agents/skills must stay ignored');
+  // A reinstall must not append `.agents/` after `!.agents/plugins/` and hide the marketplace again.
+  const { hasPattern } = require('../phases/root-config');
+  assert.ok(hasPattern(['.agents/*', '!.agents/plugins/'], '.agents/'));
+});
+
+test('claude-marketplace-guard: the Codex marketplace never points at the Claude plugin tree', () => {
+  const entry = lib.marketplace().plugins.find((p) => p.name === 'cf');
+  assert.notEqual(path.normalize(entry.source.path), path.normalize('./plugins/cf'));
+  assert.ok(!fs.existsSync(path.join(REPO, 'plugins/cf/.codex-plugin')), 'the Claude tree must not carry a Codex manifest');
+});
+
+test('check-detects-drift: --check fails after one byte changes in a fresh copy', () => {
+  const copy = lib.build(path.join(work, 'copy'));
+  const clean = spawnSync('node', [SCRIPT, '--check', copy], { encoding: 'utf8' });
+  assert.equal(clean.status, 0, clean.stderr);
+  fs.appendFileSync(path.join(copy, 'skills/specs/SKILL.md'), 'x');
+  const drift = spawnSync('node', [SCRIPT, '--check', copy], { encoding: 'utf8' });
+  assert.equal(drift.status, 1);
+  assert.match(drift.stderr, /changed skills\/specs\/SKILL\.md/);
+});
+
+// ── Runtime and hooks.json ─────────────────────────────────────────────────────
+
+const RUNTIME_DIRS = ['hooks', 'rules', 'output-styles'];
+
+function npxInstall() {
+  const repo = fs.mkdtempSync(path.join(work, 'npx-'));
+  spawnSync('git', ['init', '-q'], { cwd: repo });
+  const run = spawnSync('node', [path.resolve(__dirname, '../install.js'), '--platform', 'codex', '-y'], {
+    cwd: repo, encoding: 'utf8', env: { ...process.env, HOME: fs.mkdtempSync(path.join(work, 'home-')) },
+  });
+  assert.equal(run.status, 0, run.stderr || run.stdout);
+  return repo;
+}
+
+function runtimeFiles(root) {
+  return RUNTIME_DIRS.flatMap((dir) => (fs.existsSync(path.join(root, dir)) ? walk(path.join(root, dir)).map((f) => `${dir}/${f}`) : []))
+    .concat(fs.existsSync(path.join(root, 'runtime.schema.json')) ? ['runtime.schema.json'] : [])
+    .filter((f) => f !== 'hooks/hooks.json' && !f.includes('/.logs/'))
+    .sort();
+}
+
+test('runtime-matches-npx: the plugin runtime holds the same files and bytes as an npx Codex install', () => {
+  const installed = path.join(npxInstall(), '.codex');
+  const expected = runtimeFiles(installed);
+  assert.deepEqual(runtimeFiles(tree), expected);
+  for (const file of expected) {
+    assert.ok(fs.readFileSync(path.join(tree, file)).equals(fs.readFileSync(path.join(installed, file))), `${file} differs from the npx install`);
+  }
+});
+
+test('requires-resolve: every relative require in the plugin hooks resolves inside the tree', () => {
+  const missing = [];
+  for (const file of walk(path.join(tree, 'hooks')).filter((f) => f.endsWith('.cjs'))) {
+    const full = path.join(tree, 'hooks', file);
+    for (const [, spec] of fs.readFileSync(full, 'utf8').matchAll(/require\(\s*['"](\.{1,2}\/[^'"]+)['"]\s*\)/g)) {
+      const target = path.resolve(path.dirname(full), spec);
+      if (![target, `${target}.cjs`, `${target}.js`].some((t) => fs.existsSync(t))) missing.push(`hooks/${file} → ${spec}`);
+    }
+  }
+  assert.deepEqual(missing, []);
+});
+
+function pluginHandlers() {
+  const { hooks } = JSON.parse(fs.readFileSync(path.join(tree, 'hooks/hooks.json'), 'utf8'));
+  return Object.entries(hooks).flatMap(([event, groups]) => groups.flatMap((group) => group.hooks.map((h) => ({ event, ...h }))));
+}
+
+test('hook-commands-fallback: every plugin hook has a POSIX command with a node PATH fallback and a Windows command', () => {
+  const template = JSON.parse(fs.readFileSync(path.join(SRC, 'codex/hooks.json'), 'utf8')).hooks;
+  const handlers = pluginHandlers();
+  // The template's runtime hooks plus the one plugin-only SessionStart hook.
+  const pluginOnly = handlers.filter((h) => h.command.includes('/plugin/hooks/'));
+  assert.deepEqual(pluginOnly.map((h) => h.event), ['SessionStart']);
+  assert.equal(handlers.length - pluginOnly.length, Object.values(template).flat().flatMap((g) => g.hooks).length);
+  for (const handler of handlers) {
+    const [, dir, script] = handler.command.match(/((?:plugin\/)?hooks)\/([a-z0-9-]+\.cjs)"$/) || [];
+    assert.ok(script && fs.existsSync(path.join(tree, dir, script)), `bad command ${handler.command}`);
+    assert.match(handler.command, /^PATH="\$PATH":'[^']+'(:'[^']+')* node "\$\{PLUGIN_ROOT\}\/(plugin\/)?hooks\/[a-z0-9-]+\.cjs"$/);
+    assert.equal(typeof handler.commandWindows, 'string');
+    assert.ok(handler.commandWindows.includes(script) && handler.commandWindows.includes('PLUGIN_ROOT'), handler.commandWindows);
+  }
+});
+
+test('no-build-machine-paths: hooks.json names no absolute path of the machine that built it', () => {
+  const text = fs.readFileSync(path.join(tree, 'hooks/hooks.json'), 'utf8');
+  for (const local of [REPO, os.homedir(), path.dirname(process.execPath)]) assert.ok(!text.includes(local), `hooks.json contains ${local}`);
+  const windows = pluginHandlers()[0].commandWindows;
+  const decoded = spawnSync('node', ['-e', `${windows.replace(/^node -e "|"$/g, '').replace(/require\('module'\)\.runMain\(\)/, 'console.log(process.argv[1])')}`], {
+    encoding: 'utf8', env: { ...process.env, PLUGIN_ROOT: path.join(work, 'win-root') },
+  });
+  assert.equal(decoded.stdout.trim(), path.join(work, 'win-root', 'hooks', pluginHandlers()[0].command.match(/hooks\/([a-z0-9-]+\.cjs)"$/)[1]));
+});
+
+test('npx-hook-commands-unchanged: the npx install still gets absolute project launchers', () => {
+  const repo = npxInstall();
+  const { hooks } = JSON.parse(fs.readFileSync(path.join(repo, '.codex/hooks.json'), 'utf8'));
+  for (const handler of Object.values(hooks).flat().flatMap((g) => g.hooks)) {
+    assert.match(handler.command, /node '[^']+\/\.codex\/hooks\/[a-z0-9-]+\.cjs'$/);
+    assert.ok(handler.command.includes(fs.realpathSync(repo)));
+    assert.ok(!handler.command.includes('PLUGIN_ROOT'));
+    const encoded = handler.commandWindows.split(' ').pop();
+    assert.ok(Buffer.from(encoded, 'base64url').toString('utf8').startsWith(path.join(fs.realpathSync(repo), '.codex', 'hooks')), 'npx Windows launcher lost its project path');
+  }
+});
+
+const SAMPLE_PAYLOADS = {
+  SessionStart: { source: 'startup' },
+  UserPromptSubmit: { prompt: 'hello' },
+  PreToolUse: { tool_name: 'Bash', tool_input: { command: 'ls' } },
+  PermissionRequest: { tool_name: 'Bash', tool_input: { command: 'ls' } },
+  PostToolUse: { tool_name: 'apply_patch', tool_input: { command: '' }, tool_response: {} },
+  Stop: { stop_hook_active: false },
+  SubagentStart: { agent_type: 'debugger' },
+  SubagentStop: { agent_type: 'debugger', stop_hook_active: false },
+  PreCompact: { trigger: 'manual' },
+};
+
+test('hook-smoke: every generated plugin launcher runs its hook to exit 0 without a crash log', () => {
+  // A private root holding the tree, so every crash log a hook writes lands under it.
+  const sandbox = fs.mkdtempSync(path.join(work, 'smoke-'));
+  const smokeTree = lib.build(path.join(sandbox, 'plugin', 'cf-codex'));
+  const repo = path.join(sandbox, 'repo');
+  fs.mkdirSync(repo);
+  spawnSync('git', ['init', '-q'], { cwd: repo });
+  const data = path.join(sandbox, 'data');
+  const failures = [];
+  for (const handler of pluginHandlers()) {
+    const payload = { session_id: 'codex-smoke', hook_event_name: handler.event, cwd: repo, ...(SAMPLE_PAYLOADS[handler.event] || {}) };
+    const run = spawnSync('sh', ['-c', handler.command], {
+      cwd: repo, input: JSON.stringify(payload), encoding: 'utf8', timeout: 20000,
+      env: { ...process.env, HOME: path.join(sandbox, 'home'), PLUGIN_ROOT: smokeTree, PLUGIN_DATA: data, CLAUDE_PLUGIN_ROOT: smokeTree, CLAUDE_PLUGIN_DATA: data },
+    });
+    if (run.status !== 0) failures.push(`${handler.event} ${handler.command}: exit ${run.status} ${run.stderr.slice(0, 200)}`);
+  }
+  const crashLogs = walk(sandbox).filter((f) => f.endsWith('hook-log.jsonl'))
+    .filter((f) => /"status":"crash"/.test(fs.readFileSync(path.join(sandbox, f), 'utf8')));
+  for (const log of crashLogs) failures.push(`crash logged in ${log}: ${fs.readFileSync(path.join(sandbox, log), 'utf8').slice(0, 200)}`);
+  assert.deepEqual(failures, []);
+});

package/bin/__tests__/codex-plugin-context.test.js

@@ -0,0 +1,135 @@
+'use strict';
+
+// The Codex plugin cannot ship AGENTS.md and Codex substitutes nothing in skill text, so
+// a plugin-only SessionStart hook injects the CafeKit core and defines {CAFEKIT_ROOT}
+// and the {cafekit:<name>} commands. The npx install must never receive that hook.
+
+const { test, before, after } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const SCRIPTS = path.resolve(__dirname, '../../scripts');
+const INSTALL = path.resolve(__dirname, '../install.js');
+const ROOT_LENGTH = 120;
+let work;
+let lib;
+let tree;
+
+before(async () => {
+  work = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ck-codex-context-')));
+  lib = await import(path.join(SCRIPTS, 'build-codex-plugin.mjs'));
+  // A plugin root of exactly ROOT_LENGTH characters, the size the core budget assumes.
+  const pad = ROOT_LENGTH - work.length - '/cf-codex'.length - 1;
+  assert.ok(pad > 0, `temp directory too long: ${work}`);
+  tree = lib.build(path.join(work, 'p'.repeat(pad), 'cf-codex'));
+  assert.equal(tree.length, ROOT_LENGTH);
+});
+
+after(() => fs.rmSync(work, { recursive: true, force: true }));
+
+function hook(root, { cwd = work, env = {} } = {}) {
+  const base = { ...process.env, HOME: path.join(work, 'home'), PLUGIN_DATA: path.join(work, 'data'), CLAUDE_PLUGIN_DATA: path.join(work, 'data') };
+  delete base.PLUGIN_ROOT; delete base.CLAUDE_PLUGIN_ROOT;
+  const fullEnv = { ...base, ...(root ? { PLUGIN_ROOT: root, CLAUDE_PLUGIN_ROOT: root } : {}), ...env };
+  const script = path.join(root || tree, 'plugin/hooks/plugin-context.cjs');
+  return spawnSync('node', [script], { cwd, encoding: 'utf8', env: fullEnv, input: JSON.stringify({ session_id: 'ctx', hook_event_name: 'SessionStart', source: 'startup', cwd }) });
+}
+
+function context(root = tree, options) {
+  const result = hook(root, options);
+  assert.equal(result.status, 0, result.stderr);
+  return JSON.parse(result.stdout).hookSpecificOutput.additionalContext;
+}
+
+test('emits-session-start-json: the hook prints the SessionStart JSON Codex reads, registered for every source', () => {
+  const result = hook(tree);
+  assert.equal(result.status, 0, result.stderr);
+  const output = JSON.parse(result.stdout);
+  assert.equal(output.hookSpecificOutput.hookEventName, 'SessionStart');
+  assert.equal(typeof output.hookSpecificOutput.additionalContext, 'string');
+  const { hooks } = JSON.parse(fs.readFileSync(path.join(tree, 'hooks/hooks.json'), 'utf8'));
+  const group = hooks.SessionStart.find((g) => g.hooks.some((h) => h.command.includes('/plugin/hooks/plugin-context.cjs')));
+  assert.ok(group, 'plugin-context is not registered on SessionStart');
+  assert.deepEqual(group.matcher.split('|').sort(), ['clear', 'compact', 'resume', 'startup']);
+  assert.match(group.hooks[0].commandWindows, /'plugin','hooks','plugin-context\.cjs'/);
+});
+
+test('core-under-10000-chars: with a 120-character plugin root the injected text stays within the host cap', () => {
+  const text = context();
+  assert.ok(text.length <= 10000, `${text.length} characters`);
+});
+
+test('marker-in-first-2000: the core marker sits in the first 2000 characters', () => {
+  const index = context().indexOf('CAFEKIT-CODEX-CORE-LOADED');
+  assert.ok(index >= 0 && index < 2000, `marker at ${index}`);
+});
+
+test('command-table-complete: every recorded script has one absolute command that runs', () => {
+  const text = context();
+  const names = lib.scriptCommands(tree);
+  assert.ok(names.length > 0);
+  const table = [...text.matchAll(/^ {2}- `\{cafekit:([A-Za-z0-9-]+)\}`: `(.+)`$/gm)];
+  assert.deepEqual(table.map(([, name]) => name), names);
+  assert.ok(!/\{cafekit:[A-Za-z0-9-]+\}/.test(text.replace(/^ {2}- `\{cafekit:[^\n]*$/gm, '')), 'a command is named outside the table');
+  const scratch = fs.mkdtempSync(path.join(work, 'run-'));
+  for (const [, name, command] of table) {
+    assert.match(command, new RegExp(`^node '${tree.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}/scripts/${name}\\.cjs'$`));
+    const run = spawnSync('sh', ['-c', `${command} --help`], { cwd: scratch, encoding: 'utf8', input: '' });
+    assert.ok([0, 1, 2].includes(run.status), `${name}: exit ${run.status}`);
+    assert.doesNotMatch(run.stderr, /Cannot find module|MODULE_NOT_FOUND/, name);
+  }
+});
+
+test('rule-paths-exist: the root, the rules directory and every rules file named in the core exist', () => {
+  const text = context();
+  assert.match(text, new RegExp(`means \`${tree.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\``));
+  const section = text.slice(text.indexOf('## Detailed rules'));
+  const dir = section.match(/`([^`]+\/rules)\/`/)[1];
+  assert.equal(dir, path.join(tree, 'rules'));
+  const files = [...section.matchAll(/`([a-z-]+\.md)`/g)].map(([, f]) => f);
+  assert.ok(files.length >= 9, files.join(', '));
+  for (const file of files) assert.ok(fs.existsSync(path.join(dir, file)), file);
+  assert.doesNotMatch(text, /\{CAFEKIT_ROOT\}\//, 'an unresolved root token remains');
+});
+
+test('dollar-in-root: a plugin root containing `$&` is injected literally', () => {
+  const root = path.join(work, 'dollar-$&-root', 'cf-codex');
+  fs.cpSync(tree, root, { recursive: true });
+  const text = context(root);
+  assert.ok(text.includes(`means \`${root}\``));
+  assert.ok(text.includes(`node '${root}/scripts/provenance.cjs'`));
+});
+
+test('silent-without-plugin-root: without a plugin root, or with one inherited from elsewhere, the hook prints nothing', () => {
+  for (const env of [{}, { PLUGIN_ROOT: work, CLAUDE_PLUGIN_ROOT: work }]) {
+    const result = hook(null, { env });
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(result.stdout, '');
+  }
+});
+
+function walk(root) {
+  if (!fs.existsSync(root)) return [];
+  return fs.readdirSync(root, { withFileTypes: true }).flatMap((entry) => {
+    const full = path.join(root, entry.name);
+    return entry.isDirectory() ? walk(full) : [full];
+  });
+}
+
+test('npx-install-lacks-plugin-hook: an npx Codex install neither ships nor calls the plugin hook, and the plugin stands down beside it', () => {
+  const repo = path.join(work, 'npx-repo');
+  fs.mkdirSync(repo);
+  spawnSync('git', ['init', '-q'], { cwd: repo });
+  const install = spawnSync('node', [INSTALL, '--platform', 'codex', '-y'], { cwd: repo, encoding: 'utf8', env: { ...process.env, HOME: path.join(work, 'npx-home') } });
+  assert.equal(install.status, 0, install.stderr || install.stdout);
+  const installed = walk(repo).filter((f) => !f.includes(`${path.sep}.git${path.sep}`));
+  assert.deepEqual(installed.filter((f) => /plugin-context\.cjs$|script-commands\.json$/.test(f)), []);
+  assert.ok(!installed.some((f) => fs.readFileSync(f).includes('CAFEKIT-CODEX-CORE-LOADED')), 'the plugin core reached the npx install');
+  assert.doesNotMatch(fs.readFileSync(path.join(repo, '.codex/hooks.json'), 'utf8'), /plugin-context/);
+  const beside = hook(tree, { cwd: repo });
+  assert.equal(beside.status, 0, beside.stderr);
+  assert.equal(beside.stdout, '');
+});

package/bin/__tests__/codex-plugin-hooks.test.js

@@ -0,0 +1,220 @@
+'use strict';
+
+const { test, before, after } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { spawnSync } = require('node:child_process');
+
+const BUILD = path.resolve(__dirname, '../../scripts/build-codex-plugin.mjs');
+const INSTALL = path.resolve(__dirname, '../install.js');
+const UID = typeof process.getuid === 'function' ? process.getuid() : 'user';
+let lib;
+let work;
+let tree;
+let handlers;
+
+function walk(root) {
+  if (!fs.existsSync(root)) return [];
+  return fs.readdirSync(root, { withFileTypes: true }).flatMap((entry) => {
+    const full = path.join(root, entry.name);
+    return entry.isDirectory() ? [`${full}/`, ...walk(full)] : [full];
+  }).sort();
+}
+
+function git(cwd, ...args) {
+  const run = spawnSync('git', ['-c', 'user.email=t@t', '-c', 'user.name=t', ...args], { cwd, encoding: 'utf8' });
+  assert.equal(run.status, 0, run.stderr);
+  return run.stdout.trim();
+}
+
+function repo(name, setup = () => {}) {
+  const dir = path.join(work, name);
+  fs.mkdirSync(dir, { recursive: true });
+  git(dir, 'init', '-q');
+  fs.writeFileSync(path.join(dir, 'README.md'), '# demo\n');
+  fs.writeFileSync(path.join(dir, '.env'), 'EXAMPLE=placeholder\n');
+  setup(dir);
+  git(dir, 'add', '-A');
+  git(dir, 'commit', '-qm', 'fixture');
+  return dir;
+}
+
+function packet(dir, status) {
+  fs.mkdirSync(path.join(dir, 'specs/demo'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'specs/demo/plan.md'), '# Demo\nSpecs-Contract: process-first-ready-v1\n\n## Tasks\n| # | Task | Status |\n|---|---|---|\n| 01 | Demo | pending |\n');
+  fs.writeFileSync(path.join(dir, 'specs/demo/task-01-demo.md'), `# Task 01 — Demo\n\nStatus: ${status}\n\n## Dependencies\n- none\n\n## Verification Plan\n- Command: \`test -f README.md\`\n\n## Receipt\n`);
+}
+
+function handler(event, script) {
+  const found = handlers.find((h) => h.event === event && h.command.includes(`/hooks/${script}"`));
+  assert.ok(found, `no ${event} handler for ${script}`);
+  return found.command;
+}
+
+// Runs one plugin hook through its generated launcher, the way Codex starts it.
+function run(event, script, cwd, payload = {}, env = {}) {
+  const result = spawnSync('sh', ['-c', handler(event, script)], {
+    cwd,
+    input: JSON.stringify({ session_id: 'plugin-hooks-test', hook_event_name: event, cwd, ...payload }),
+    encoding: 'utf8',
+    timeout: 20000,
+    env: { ...process.env, HOME: path.join(work, 'home'), PLUGIN_ROOT: tree, CLAUDE_PLUGIN_ROOT: tree, PLUGIN_DATA: path.join(work, 'data'), CLAUDE_PLUGIN_DATA: path.join(work, 'data'), ...env },
+  });
+  return result;
+}
+
+const ALL = [
+  ['SessionStart', 'session.cjs', { source: 'startup' }],
+  ['UserPromptSubmit', 'rules.cjs', { prompt: 'hello' }],
+  ['PreToolUse', 'privacy-block.cjs', { tool_name: 'Bash', tool_input: { command: 'ls' } }],
+  ['PreToolUse', 'inspect-block.cjs', { tool_name: 'Bash', tool_input: { command: 'ls' } }],
+  ['PostToolUse', 'spec-state.cjs', { tool_name: 'apply_patch', tool_input: { command: '' }, tool_response: {} }],
+  ['PreCompact', 'precompact.cjs', { trigger: 'manual' }],
+  ['Stop', 'spec-gate.cjs', { stop_hook_active: false }],
+  ['Stop', 'state.cjs', { stop_hook_active: false }],
+];
+
+before(async () => {
+  lib = await import(BUILD);
+  work = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-codex-plugin-hooks-'));
+  tree = lib.build(path.join(work, 'plugin', 'cf-codex'));
+  const { hooks } = JSON.parse(fs.readFileSync(path.join(tree, 'hooks/hooks.json'), 'utf8'));
+  handlers = Object.entries(hooks).flatMap(([event, groups]) => groups.flatMap((g) => g.hooks.map((h) => ({ event, ...h }))));
+});
+
+after(() => fs.rmSync(work, { recursive: true, force: true }));
+
+test('gate-blocks-in-payload-repo: Stop blocks a done task without a receipt in the payload repository', () => {
+  const dir = repo('gate', (d) => packet(d, 'done'));
+  const result = run('Stop', 'spec-gate.cjs', dir, { stop_hook_active: false });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /"decision":"block"/);
+  assert.match(result.stdout, /task-01-demo\.md/);
+});
+
+test('privacy-uses-payload-repo: reading the payload repository .env is denied and the approval is keyed to it', () => {
+  const dir = repo('privacy');
+  const data = path.join(work, 'privacy-data');
+  const result = run('PreToolUse', 'privacy-block.cjs', dir, { tool_name: 'Bash', tool_input: { command: 'cat .env' } }, { PLUGIN_DATA: data, CLAUDE_PLUGIN_DATA: data });
+  assert.match(result.stdout, /"permissionDecision":"deny"/);
+  const key = crypto.createHash('sha256').update(fs.realpathSync(dir)).digest('hex').slice(0, 16);
+  assert.ok(walk(path.join(data, 'projects', key, 'privacy')).some((p) => !p.endsWith('/')), 'no pending approval stored for this repository');
+});
+
+test('nothing-written-outside-data: every hook leaves the repository, the plugin tree and its parent unchanged', () => {
+  const dir = repo('clean', (d) => fs.mkdirSync(path.join(d, '.codex')) || fs.writeFileSync(path.join(d, '.codex/runtime.json'), '{}\n'));
+  const data = path.join(work, 'clean-data');
+  // Git's own .git/ files (an index refresh, a lock left by a timed-out git call) are not
+  // CafeKit state, so the working tree is compared and git must report it clean.
+  const worktree = () => walk(dir).filter((p) => !p.startsWith(path.join(dir, '.git') + path.sep) && p !== `${path.join(dir, '.git')}/`);
+  const before = [worktree(), walk(path.join(work, 'plugin'))];
+  for (const [event, script, payload] of ALL) {
+    const result = run(event, script, dir, payload, { PLUGIN_DATA: data, CLAUDE_PLUGIN_DATA: data });
+    assert.equal(result.status, 0, `${script}: ${result.stderr}`);
+  }
+  assert.deepEqual([worktree(), walk(path.join(work, 'plugin'))], before);
+  assert.equal(git(dir, 'status', '--porcelain'), '', 'the hooks left changes in the repository');
+  assert.ok(walk(data).some((p) => !p.endsWith('/')), 'no state under PLUGIN_DATA');
+});
+
+test('tmp-root-0700: without PLUGIN_DATA, state goes to a private per-user temp directory', () => {
+  const dir = repo('tmp');
+  const tmp = fs.mkdtempSync(path.join(work, 'tmp-'));
+  for (const [event, script, payload] of ALL) run(event, script, dir, payload, { PLUGIN_DATA: '', CLAUDE_PLUGIN_DATA: '', TMPDIR: tmp });
+  const root = path.join(tmp, `cafekit-codex-plugin-${UID}`);
+  assert.ok(fs.lstatSync(root).isDirectory());
+  assert.equal(fs.statSync(root).mode & 0o777, 0o700);
+});
+
+test('foreign-tmp-fail-closed: a temp state root this user does not safely own makes privacy deny', () => {
+  const dir = repo('foreign');
+  const tmp = fs.mkdtempSync(path.join(work, 'tmp-foreign-'));
+  const elsewhere = fs.mkdtempSync(path.join(work, 'elsewhere-'));
+  fs.symlinkSync(elsewhere, path.join(tmp, `cafekit-codex-plugin-${UID}`));
+  const result = run('PreToolUse', 'privacy-block.cjs', dir, { tool_name: 'Bash', tool_input: { command: 'cat .env' } }, { PLUGIN_DATA: '', CLAUDE_PLUGIN_DATA: '', TMPDIR: tmp });
+  assert.match(result.stdout, /"permissionDecision":"deny"/);
+  assert.deepEqual(walk(elsewhere), [], 'state was written through the planted symlink');
+});
+
+test('no-npx-notice: the plugin session hook prints no npx update notice and keeps the update cache', () => {
+  const dir = repo('notice', (d) => {
+    fs.mkdirSync(path.join(d, '.codex'));
+    fs.writeFileSync(path.join(d, '.codex/cafekit.json'), JSON.stringify({ version: '0.0.1' }));
+  });
+  const cache = path.join(dir, '.codex/.cafekit-update-cache.json');
+  const bytes = JSON.stringify({ ts: Date.now(), latest: '99.0.0' });
+  fs.writeFileSync(cache, bytes);
+  const result = run('SessionStart', 'session.cjs', dir, { source: 'startup' });
+  assert.equal(result.status, 0, result.stderr);
+  assert.doesNotMatch(result.stdout, /npx @haposoft\/cafekit/);
+  assert.equal(fs.readFileSync(cache, 'utf8'), bytes);
+});
+
+test('defaults-without-runtime: without .codex/runtime.json the rules hook still injects the repository paths', () => {
+  const dir = repo('defaults');
+  const result = run('UserPromptSubmit', 'rules.cjs', dir, { prompt: 'hello', session_id: 'defaults-session' });
+  assert.equal(result.status, 0, result.stderr);
+  assert.ok(result.stdout.includes(path.join(fs.realpathSync(dir), 'specs')), result.stdout);
+});
+
+function npxRepo(name) {
+  const dir = repo(name);
+  const install = spawnSync('node', [INSTALL, '--platform', 'codex', '-y'], { cwd: dir, encoding: 'utf8', env: { ...process.env, HOME: path.join(work, `home-${name}`) } });
+  assert.equal(install.status, 0, install.stderr || install.stdout);
+  return dir;
+}
+
+test('silent-beside-npx: with the npx Codex hooks active in the repository, plugin hooks stand down and say so once', () => {
+  const dir = npxRepo('beside');
+  const session = run('SessionStart', 'session.cjs', dir, { source: 'startup' });
+  assert.equal(session.status, 0, session.stderr);
+  assert.match(session.stdout, /CafeKit plugin is idle/);
+  assert.match(session.stdout, /\$cf-/, 'the notice names the duplicate skills');
+  assert.match(session.stdout, /trusted in \/hooks/, 'the notice says the gates depend on trusting the npx hooks');
+  assert.ok(session.stdout.includes('npx @haposoft/cafekit@latest migrate'), 'the notice names the migrate command with @latest');
+  const privacy = run('PreToolUse', 'privacy-block.cjs', dir, { tool_name: 'Bash', tool_input: { command: 'cat .env' } });
+  assert.equal(privacy.status, 0);
+  assert.equal(privacy.stdout, '', 'the plugin hook acted beside the npx hooks');
+  const rules = run('UserPromptSubmit', 'rules.cjs', dir, { prompt: 'hi', session_id: 'beside-rules' });
+  assert.equal(rules.stdout, '');
+});
+
+test('planted-hooks-json-keeps-gates: a hooks.json without real npx hooks behind it does not switch the plugin off', () => {
+  const cases = {
+    planted: { description: 'x /.codex/hooks/ x', hooks: {} },
+    foreignMachine: { hooks: { PreToolUse: [{ hooks: [{ type: 'command', command: "node '/Users/someone-else/project/.codex/hooks/privacy-block.cjs'" }] }] } },
+    relativeScript: { hooks: { PreToolUse: [{ hooks: [{ type: 'command', command: "node './.codex/hooks/noop.cjs'" }] }] } },
+  };
+  // Absolute paths that still reach the repository's own hooks only through `..` or a
+  // symlinked alias; on Linux /proc/self/cwd does the same through the hook's cwd.
+  const alias = path.join(work, 'planted-alias-link');
+  const command = (script) => ({ hooks: { PreToolUse: [{ hooks: [{ type: 'command', command: `node '${script}'` }] }] } });
+  cases.dotDot = (d) => command(`${fs.realpathSync(d)}/.codex/hooks/../hooks/noop.cjs`);
+  cases.symlinkAlias = (d) => { fs.symlinkSync(fs.realpathSync(d), alias); return command(`${alias}/.codex/hooks/noop.cjs`); };
+  for (const [name, entry] of Object.entries(cases)) {
+    const dir = repo(`planted-${name}`, (d) => {
+      const config = typeof entry === 'function' ? entry(d) : entry;
+      fs.mkdirSync(path.join(d, '.codex/hooks'), { recursive: true });
+      fs.writeFileSync(path.join(d, '.codex/hooks/noop.cjs'), '\n');
+      fs.writeFileSync(path.join(d, '.codex/hooks.json'), JSON.stringify(config));
+    });
+    const result = run('PreToolUse', 'privacy-block.cjs', dir, { tool_name: 'Bash', tool_input: { command: 'cat .env' } });
+    assert.match(result.stdout, /"permissionDecision":"deny"/, `${name}: the plugin stood down`);
+  }
+});
+
+test('npx-installed-tree: npx-installed hooks keep their behavior, even with a plugin root inherited from the parent', () => {
+  const dir = npxRepo('npx');
+  for (const inherited of [false, true]) {
+    const env = { ...process.env, HOME: path.join(work, 'home-npx') };
+    delete env.PLUGIN_ROOT; delete env.CLAUDE_PLUGIN_ROOT; delete env.PLUGIN_DATA; delete env.CLAUDE_PLUGIN_DATA;
+    if (inherited) Object.assign(env, { PLUGIN_ROOT: tree, CLAUDE_PLUGIN_ROOT: tree });
+    const payload = { session_id: `npx-${inherited}`, hook_event_name: 'PreToolUse', cwd: dir, tool_name: 'Bash', tool_input: { command: 'cat .env' } };
+    const result = spawnSync('node', [path.join(dir, '.codex/hooks/privacy-block.cjs')], { cwd: dir, input: JSON.stringify(payload), encoding: 'utf8', env });
+    assert.match(result.stdout, /"permissionDecision":"deny"/, `inherited=${inherited}`);
+    assert.ok(fs.existsSync(path.join(dir, '.codex/hooks/.privacy')), 'npx privacy state left its project location');
+  }
+});

package/bin/__tests__/codex-quiet-hooks.test.js

@@ -7,19 +7,13 @@ const os = require('node:os');
 const path = require('node:path');
 const { spawnSync } = require('node:child_process');
 const { test } = require('node:test');
+const { installCodexHookRuntime } = require('./codex-hook-runtime-fixture.cjs');
 const SOURCE = path.resolve(__dirname, '../../src');
 
 function fixture({ specs = 'specs', packets = ['auth-flow'] } = {}) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-codex-quiet-'));
   const hooks = path.join(root, '.codex/hooks');
-  fs.cpSync(path.join(SOURCE, 'codex/hooks'), hooks, { recursive: true });
-  for (const name of ['privacy-paths.cjs', 'privacy-command-analysis.cjs']) {
-    fs.copyFileSync(path.join(SOURCE, 'claude/hooks/lib', name), path.join(hooks, 'lib', name));
-  }
-  fs.copyFileSync(path.join(SOURCE, 'claude/hooks/lib/spec-touch.cjs'), path.join(hooks, 'lib/spec-touch.cjs'));
-  fs.copyFileSync(path.join(SOURCE, 'claude/hooks/lib/secret-keywords.cjs'), path.join(hooks, 'lib/secret-keywords.cjs'));
-  fs.copyFileSync(path.join(SOURCE, 'claude/hooks/lib/update-check.cjs'), path.join(hooks, 'lib/update-check.cjs'));
-  fs.copyFileSync(path.join(SOURCE, 'claude/hooks/lib/runtime-path-safety.cjs'), path.join(hooks, 'lib/runtime-path-safety.cjs'));
+  installCodexHookRuntime(root);
   fs.cpSync(path.join(SOURCE, 'claude/scripts'), path.join(root, '.codex/scripts'), { recursive: true });
   fs.writeFileSync(path.join(root, '.codex/runtime.json'), JSON.stringify({ paths: { specs } }));
   fs.writeFileSync(path.join(root, '.gitignore'), '.codex/\n');