@haposoft/cafekit 0.18.2 → 0.18.4

package/bin/__tests__/migrate-merged.test.js

@@ -0,0 +1,269 @@
+'use strict';
+
+const { test, before, after } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const { planManifestFiles } = require('../lib/migrate-plan');
+const { planMergedFiles, renderMergedPlan } = require('../lib/migrate-merged');
+const { managedHandlerScript } = require('../phases/codex-hooks');
+
+const INSTALLER = path.join(__dirname, '../install.js');
+const SETTINGS_TEMPLATE = require('../../src/claude/settings/settings.json');
+const TEMPLATE_COMMANDS = new Set(Object.values(SETTINGS_TEMPLATE.hooks).flat().flatMap((group) => group.hooks.map((handler) => handler.command)));
+const USER_LINT = 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/user-lint.cjs"';
+
+let work;
+let pristine;
+let fixture;
+let codexOnly;
+
+function copyRepo(from, name) {
+  const target = path.join(work, name, 'repo');
+  fs.cpSync(from, target, { recursive: true, verbatimSymlinks: true });
+  return target;
+}
+
+function install(repo, platforms) {
+  fs.mkdirSync(repo, { recursive: true });
+  spawnSync('git', ['init', '-q'], { cwd: repo });
+  // The installer writes into its cwd, so it must run inside the temp repository.
+  const run = spawnSync(process.execPath, [INSTALLER, '--platform', platforms, '--with-document-skills', '-y'], {
+    cwd: repo,
+    env: { ...process.env, HOME: path.join(work, 'home'), CI: '1' },
+    encoding: 'utf8'
+  });
+  assert.equal(run.status, 0, run.stderr || run.stdout);
+}
+
+function applyPlan(repo, manifest, merged) {
+  for (const entry of manifest.entries.filter((item) => item.action === 'remove')) fs.rmSync(path.join(repo, entry.path));
+  for (const file of merged.files) {
+    if (file.action === 'write') fs.writeFileSync(path.join(repo, file.path), file.after);
+    if (file.action === 'remove') fs.rmSync(path.join(repo, file.path));
+  }
+}
+
+function plan(repo) {
+  const manifest = planManifestFiles(repo);
+  return { manifest, merged: planMergedFiles(repo, manifest) };
+}
+
+const fileOf = (merged, rel) => merged.files.find((file) => file.path === rel);
+const handlers = (config) => Object.values(config.hooks || {}).flat().flatMap((group) => group.hooks);
+
+before(() => {
+  work = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ck-migrate-merged-')));
+  fs.mkdirSync(path.join(work, 'home'));
+  pristine = path.join(work, 'pristine', 'repo');
+  install(pristine, 'claude,codex');
+  codexOnly = path.join(work, 'codex-only', 'repo');
+  install(codexOnly, 'codex');
+
+  fixture = copyRepo(pristine, 'fixture');
+  const settingsFile = path.join(fixture, '.claude/settings.json');
+  const settings = JSON.parse(fs.readFileSync(settingsFile, 'utf8'));
+  settings.hooks.PreToolUse.push({ matcher: 'Edit', hooks: [{ type: 'command', command: USER_LINT }] });
+  fs.writeFileSync(settingsFile, JSON.stringify(settings, null, 2));
+  fs.writeFileSync(path.join(fixture, '.claude/hooks/user-lint.cjs'), 'process.exit(0);\n');
+
+  const hooksFile = path.join(fixture, '.codex/hooks.json');
+  const hooks = JSON.parse(fs.readFileSync(hooksFile, 'utf8'));
+  hooks.hooks.Stop.push({ hooks: [{ type: 'command', command: `node '${path.join(fixture, '.codex/hooks/my.cjs')}'` }] });
+  fs.writeFileSync(hooksFile, JSON.stringify(hooks, null, 2));
+  fs.writeFileSync(path.join(fixture, '.codex/hooks/my.cjs'), 'process.exit(0);\n');
+
+  const agentsFile = path.join(fixture, 'AGENTS.md');
+  fs.writeFileSync(agentsFile, `# Team rules before\n\n${fs.readFileSync(agentsFile, 'utf8')}\n## Team notes after\n`);
+  const gitignoreFile = path.join(fixture, '.gitignore');
+  fs.writeFileSync(gitignoreFile, fs.readFileSync(gitignoreFile, 'utf8').replace('.agents/\n', '.agents/\nmy-local-secrets.txt\n'));
+  fs.writeFileSync(path.join(fixture, '.claude/.env'), 'TOKEN=[redacted]\n');
+});
+
+after(() => fs.rmSync(work, { recursive: true, force: true }));
+
+test('claude-user-hook-kept: a user hook script and its registration survive', () => {
+  const { manifest, merged } = plan(fixture);
+  const settings = JSON.parse(fileOf(merged, '.claude/settings.json').after);
+  assert.ok(handlers(settings).some((handler) => handler.command === USER_LINT));
+  assert.ok(manifest.untracked.includes('.claude/hooks/user-lint.cjs'));
+});
+
+test('cafekit-handlers-dropped: no CafeKit handler and no empty container remain', () => {
+  const { merged } = plan(fixture);
+  const settingsFile = fileOf(merged, '.claude/settings.json');
+  assert.equal(settingsFile.action, 'write');
+  const settings = JSON.parse(settingsFile.after);
+  assert.deepEqual(handlers(settings).map((handler) => handler.command), [USER_LINT]);
+  assert.ok(!handlers(settings).some((handler) => TEMPLATE_COMMANDS.has(handler.command)));
+  for (const config of [settings, JSON.parse(fileOf(merged, '.codex/hooks.json').after)]) {
+    for (const [event, groups] of Object.entries(config.hooks || {})) {
+      assert.ok(groups.length > 0, `${event} left empty`);
+      for (const group of groups) assert.ok(group.hooks.length > 0, `${event} group left empty`);
+    }
+    assert.ok(!handlers(config).some((handler) => managedHandlerScript(handler)));
+  }
+  // Without user hooks nothing is left for Codex, so its hooks.json goes.
+  assert.equal(fileOf(plan(pristine).merged, '.codex/hooks.json').action, 'remove');
+});
+
+test('dangling-handler-reported: a kept handler that still runs a removed hook is reported', () => {
+  const repo = copyRepo(fixture, 'dangling');
+  const settingsFile = path.join(repo, '.claude/settings.json');
+  const settings = JSON.parse(fs.readFileSync(settingsFile, 'utf8'));
+  const strict = 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/privacy-block.cjs" --strict';
+  settings.hooks.Stop.push({ hooks: [{ type: 'command', command: strict }] });
+  fs.writeFileSync(settingsFile, JSON.stringify(settings, null, 2));
+  const { merged } = plan(repo);
+  assert.ok(handlers(JSON.parse(fileOf(merged, '.claude/settings.json').after)).some((handler) => handler.command === strict));
+  assert.ok(merged.reports.some((report) => report.includes('privacy-block.cjs') && report.includes('still runs')));
+});
+
+test('statusline-rule: the status line goes only with status.cjs', () => {
+  const { merged } = plan(fixture);
+  assert.equal(JSON.parse(fileOf(merged, '.claude/settings.json').after).statusLine, undefined);
+  assert.ok(merged.reports.some((report) => report.includes('/cf:setup-statusline')));
+
+  const edited = copyRepo(fixture, 'status-edited');
+  fs.appendFileSync(path.join(edited, '.claude/status.cjs'), '\n// my tweak\n');
+  const kept = plan(edited).merged;
+  assert.deepEqual(JSON.parse(fileOf(kept, '.claude/settings.json').after).statusLine, SETTINGS_TEMPLATE.statusLine);
+  assert.ok(!kept.reports.some((report) => report.includes('/cf:setup-statusline')));
+});
+
+test('outputstyle-unchanged: the selected output style stays as written', () => {
+  const { merged } = plan(fixture);
+  const settingsFile = fileOf(merged, '.claude/settings.json');
+  assert.equal(JSON.parse(settingsFile.after).outputStyle, JSON.parse(settingsFile.before).outputStyle);
+});
+
+test('codex-standdown-reported: a user handler under .codex/hooks survives and is reported', () => {
+  const { merged } = plan(fixture);
+  const hooksFile = fileOf(merged, '.codex/hooks.json');
+  const commands = handlers(JSON.parse(hooksFile.after)).map((handler) => handler.command);
+  const user = `node '${path.join(fixture, '.codex/hooks/my.cjs')}'`;
+  assert.deepEqual(commands, [user]);
+  assert.deepEqual(hooksFile.standDown, [user]);
+  assert.ok(merged.reports.some((report) => report.includes('keeps standing down') && report.includes('my.cjs')));
+  assert.deepEqual(fileOf(plan(pristine).merged, '.codex/hooks.json').standDown, []);
+
+  // Like the runtime check, a handler script that links out of .codex/hooks does not count.
+  const linked = copyRepo(fixture, 'linked-handler');
+  const outside = path.join(work, 'linked-handler', 'my.cjs');
+  fs.renameSync(path.join(linked, '.codex/hooks/my.cjs'), outside);
+  fs.symlinkSync(outside, path.join(linked, '.codex/hooks/my.cjs'));
+  const linkedHooks = JSON.parse(fs.readFileSync(path.join(linked, '.codex/hooks.json'), 'utf8'));
+  for (const group of linkedHooks.hooks.Stop) for (const handler of group.hooks) handler.command = handler.command.replace(fixture, linked);
+  fs.writeFileSync(path.join(linked, '.codex/hooks.json'), JSON.stringify(linkedHooks));
+  assert.deepEqual(fileOf(plan(linked).merged, '.codex/hooks.json').standDown, []);
+});
+
+test('agents-import-kept: AGENTS.md keeps the user text and CLAUDE.md keeps importing it', () => {
+  const { merged } = plan(fixture);
+  const agents = fileOf(merged, 'AGENTS.md');
+  assert.equal(agents.action, 'write');
+  assert.match(agents.after, /^# Team rules before/);
+  assert.match(agents.after, /## Team notes after\n$/);
+  assert.doesNotMatch(agents.after, /CAFEKIT/);
+  assert.ok(merged.reports.some((report) => report.includes('response-language')));
+  const claude = fileOf(merged, 'CLAUDE.md');
+  assert.equal(claude.action, 'write');
+  assert.match(claude.after, /^@AGENTS\.md$/m);
+  assert.doesNotMatch(claude.after, /CAFEKIT/);
+  // Removing a block keeps the user's indentation and the file's own line endings.
+  const crlf = copyRepo(fixture, 'crlf');
+  const crlfFile = path.join(crlf, 'AGENTS.md');
+  fs.writeFileSync(crlfFile, `${fs.readFileSync(path.join(pristine, 'AGENTS.md'), 'utf8')}\n    indented code\n`.replace(/\n/g, '\r\n'));
+  const crlfAfter = fileOf(plan(crlf).merged, 'AGENTS.md').after;
+  assert.equal(crlfAfter, '    indented code\r\n');
+
+  // With no user text anywhere both files go.
+  assert.equal(fileOf(plan(pristine).merged, 'AGENTS.md').action, 'remove');
+  assert.equal(fileOf(plan(pristine).merged, 'CLAUDE.md').action, 'remove');
+});
+
+test('env-stays-ignored: after the planned removals .claude/.env is still ignored', () => {
+  const repo = copyRepo(fixture, 'applied');
+  // Only the root `.claude/` line covers this file; the nested .claude/.gitignore does not.
+  fs.writeFileSync(path.join(repo, '.claude/team-notes.txt'), 'notes\n');
+  const { manifest, merged } = plan(repo);
+  applyPlan(repo, manifest, merged);
+  // The developer's own global ignore file must not decide the result.
+  const env = { ...process.env, HOME: path.join(work, 'home'), XDG_CONFIG_HOME: path.join(work, 'home'), GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' };
+  const ignored = (at, rel) => spawnSync('git', ['check-ignore', '-q', rel], { cwd: at, env }).status === 0;
+  assert.ok(ignored(repo, '.claude/.env'));
+  assert.ok(ignored(repo, '.claude/team-notes.txt'));
+  assert.ok(ignored(repo, 'my-local-secrets.txt'));
+
+  // A folder migrate leaves alone keeps its line: here no Claude install exists at all.
+  const onlyCodex = copyRepo(codexOnly, 'codex-only-applied');
+  fs.mkdirSync(path.join(onlyCodex, '.claude'));
+  fs.writeFileSync(path.join(onlyCodex, '.claude/.env'), 'TOKEN=[redacted]\n');
+  const codexPlan = plan(onlyCodex);
+  assert.equal(codexPlan.manifest.platforms.claude.status, 'absent');
+  applyPlan(onlyCodex, codexPlan.manifest, codexPlan.merged);
+  assert.ok(ignored(onlyCodex, '.claude/.env'));
+
+  // ...and here the Claude install is refused, so its whole folder stays.
+  const refused = copyRepo(fixture, 'claude-refused');
+  fs.writeFileSync(path.join(refused, '.claude/cafekit-manifest.json'), '{ "files": ');
+  fs.writeFileSync(path.join(refused, '.claude/team-notes.txt'), 'notes\n');
+  const refusedPlan = plan(refused);
+  assert.equal(refusedPlan.manifest.platforms.claude.status, 'refused');
+  assert.ok(!fileOf(refusedPlan.merged, '.gitignore').removedLines.includes('.claude/'));
+  applyPlan(refused, refusedPlan.manifest, refusedPlan.merged);
+  assert.ok(ignored(refused, '.claude/team-notes.txt'));
+});
+
+test('gitignore-user-line-kept: a user line right after the CafeKit block stays', () => {
+  const { merged } = plan(fixture);
+  const gitignore = fileOf(merged, '.gitignore');
+  const lines = gitignore.after.split('\n');
+  assert.ok(lines.includes('my-local-secrets.txt'));
+  for (const kept of ['.cafekit-backup/', '.cafekit.lock', 'specs/_shared/', '.omp/', 'plans/*', '.claude/']) assert.ok(lines.includes(kept), kept);
+
+  // Once nothing stays under .agents/, only its line leaves the block.
+  const repo = copyRepo(fixture, 'agents-gone');
+  const manifest = planManifestFiles(repo);
+  for (const entry of manifest.entries) {
+    if (entry.path.startsWith('.agents/')) Object.assign(entry, { action: 'remove', reason: null });
+  }
+  const gone = fileOf(planMergedFiles(repo, manifest), '.gitignore');
+  assert.deepEqual(gone.removedLines, ['.agents/']);
+  assert.ok(gone.after.split('\n').includes('my-local-secrets.txt'));
+});
+
+test('omp-refused: a repository with an omp install is refused', () => {
+  const repo = copyRepo(fixture, 'omp');
+  fs.mkdirSync(path.join(repo, '.omp'));
+  fs.writeFileSync(path.join(repo, '.omp/cafekit-manifest.json'), '{"files":{}}');
+  const { merged } = plan(repo);
+  assert.match(merged.refused, /^omp/);
+  assert.match(renderMergedPlan(merged), /Refused — omp/);
+  assert.ok(merged.reports.some((report) => report.includes('Grok')));
+});
+
+test('markers-unparsed: duplicated or unbalanced markers leave the file untouched', () => {
+  const repo = copyRepo(fixture, 'markers');
+  const agentsFile = path.join(repo, 'AGENTS.md');
+  fs.appendFileSync(agentsFile, '\n<!-- CAFEKIT CORE START -->\n');
+  const claudeFile = path.join(repo, 'CLAUDE.md');
+  fs.writeFileSync(claudeFile, fs.readFileSync(claudeFile, 'utf8').replace('<!-- CAFEKIT CLAUDE END -->', ''));
+  const { merged } = plan(repo);
+  for (const rel of ['AGENTS.md', 'CLAUDE.md']) {
+    const file = fileOf(merged, rel);
+    assert.equal(file.action, 'unparsed', rel);
+    assert.equal(file.after, file.before, rel);
+  }
+
+  const broken = copyRepo(fixture, 'broken-json');
+  fs.writeFileSync(path.join(broken, '.claude/settings.json'), '{ "hooks": ');
+  const result = plan(broken);
+  assert.equal(fileOf(result.merged, '.claude/settings.json').action, 'unparsed');
+  // An unparsable settings file may register any hook script or the status line, so none of them goes.
+  assert.ok(result.manifest.entries.filter((entry) => entry.path.startsWith('.claude/hooks/')).every((entry) => entry.action !== 'remove'));
+  assert.equal(result.manifest.entries.find((entry) => entry.path === '.claude/status.cjs').action, 'keep');
+});

package/bin/__tests__/migrate-plan.test.js

@@ -0,0 +1,271 @@
+'use strict';
+
+const { test, before, after } = require('node:test');
+const assert = require('node:assert/strict');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const { planManifestFiles, renderManifestPlan } = require('../lib/migrate-plan');
+const { EXCLUDED_SKILLS, EXCLUDED_AGENTS } = require('../lib/plugin-inventory');
+const { codexAgentName } = require('../lib/codex-install');
+const { sha256 } = require('../lib/manifest');
+
+const INSTALLER = path.join(__dirname, '../install.js');
+const DOCUMENT_SKILLS = require('../../src/claude/migration-manifest.json').skills.bundles.documentSkills;
+const NPX_ONLY_SKILLS = [...EXCLUDED_SKILLS, ...DOCUMENT_SKILLS];
+
+let work;
+let pristine;
+
+function copyFixture(name) {
+  const target = path.join(work, name, 'repo');
+  fs.cpSync(pristine, target, { recursive: true, verbatimSymlinks: true });
+  return target;
+}
+
+function treeHash(root) {
+  const hash = crypto.createHash('sha256');
+  const visit = (rel) => {
+    const abs = path.join(root, rel);
+    const stat = fs.lstatSync(abs);
+    if (stat.isSymbolicLink()) hash.update(`L ${rel} ${fs.readlinkSync(abs)}\n`);
+    else if (stat.isDirectory()) for (const name of fs.readdirSync(abs).sort()) visit(path.join(rel, name));
+    else hash.update(`F ${rel} ${sha256(fs.readFileSync(abs))}\n`);
+  };
+  visit('.');
+  return hash.digest('hex');
+}
+
+const byPath = (plan) => new Map(plan.entries.map((entry) => [entry.path, entry]));
+const ofPlatform = (plan, platform) => plan.entries.filter((entry) => entry.platform === platform);
+
+before(() => {
+  work = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ck-migrate-plan-')));
+  pristine = path.join(work, 'pristine', 'repo');
+  fs.mkdirSync(pristine, { recursive: true });
+  fs.mkdirSync(path.join(work, 'home'));
+  spawnSync('git', ['init', '-q'], { cwd: pristine });
+  // The installer writes into its cwd, so it must run inside the temp repository.
+  const run = spawnSync(process.execPath, [INSTALLER, '--platform', 'claude,codex', '--with-document-skills', '-y'], {
+    cwd: pristine,
+    env: { ...process.env, HOME: path.join(work, 'home'), CI: '1' },
+    encoding: 'utf8'
+  });
+  assert.equal(run.status, 0, run.stderr || run.stdout);
+});
+
+after(() => fs.rmSync(work, { recursive: true, force: true }));
+
+test('pristine-removed-count: every Codex key is removed except runtime, npx-only, required and ignore files', () => {
+  const plan = planManifestFiles(pristine);
+  const keys = Object.keys(JSON.parse(fs.readFileSync(path.join(pristine, '.codex/cafekit-manifest.json'), 'utf8')).files);
+  const codex = ofPlatform(plan, 'codex');
+  assert.equal(codex.length, keys.length);
+  // Codex keys are relative to the repository root, not to .codex/.
+  assert.deepEqual(codex.map((entry) => entry.path).sort(), [...keys].sort());
+
+  const npxOnly = keys.filter((key) => NPX_ONLY_SKILLS.some((name) => key.startsWith(`.agents/skills/${name}/`))
+    || EXCLUDED_AGENTS.some((name) => key === `.codex/agents/${codexAgentName(name)}.toml`));
+  const runtime = keys.filter((key) => key === '.codex/runtime.json' || key === '.codex/runtime.schema.json');
+  const counted = (reason) => codex.filter((entry) => entry.reason === reason).length;
+  assert.equal(counted('npx-only'), npxOnly.length);
+  assert.equal(counted('runtime'), runtime.length);
+  for (const entry of codex.filter((item) => item.action !== 'remove')) {
+    assert.ok(['runtime', 'npx-only', 'required-by-kept', 'protects-kept'].includes(entry.reason), `${entry.path}: ${entry.reason}`);
+  }
+  const removed = codex.filter((entry) => entry.action === 'remove').length;
+  assert.equal(removed, keys.length - runtime.length - npxOnly.length - counted('required-by-kept') - counted('protects-kept'));
+  assert.ok(removed > 100, `only ${removed} Codex files removed`);
+
+  for (const entry of ofPlatform(plan, 'claude')) {
+    if (entry.action === 'remove') continue;
+    assert.ok(['runtime', 'npx-only', 'required-by-kept', 'protects-kept'].includes(entry.reason), `${entry.path}: ${entry.reason}`);
+  }
+  assert.deepEqual(plan.untracked, []);
+});
+
+test('runtime-kept: runtime.json and its schema stay for both platforms', () => {
+  const entries = byPath(planManifestFiles(pristine));
+  for (const rel of ['.claude/runtime.json', '.claude/runtime.schema.json', '.codex/runtime.json', '.codex/runtime.schema.json']) {
+    assert.equal(entries.get(rel).action, 'keep', rel);
+    assert.equal(entries.get(rel).reason, 'runtime', rel);
+  }
+});
+
+test('npx-only-kept: skills and agents no plugin ships stay whole', () => {
+  const plan = planManifestFiles(pristine);
+  for (const name of ['chrome-devtools', 'ui-ux', 'ui-ux-pro-max']) {
+    for (const prefix of [`.claude/skills/${name}/`, `.agents/skills/${name}/`]) {
+      const members = plan.entries.filter((entry) => entry.path.startsWith(prefix));
+      assert.ok(members.length > 0, prefix);
+      assert.ok(members.every((entry) => entry.reason === 'npx-only'), prefix);
+    }
+  }
+  const entries = byPath(plan);
+  assert.equal(entries.get('.claude/agents/ui-ux-designer.md').reason, 'npx-only');
+  assert.equal(entries.get('.codex/agents/ui_ux_designer.toml').reason, 'npx-only');
+  assert.equal(entries.get('.claude/agents/debugger.md').action, 'remove');
+});
+
+test('kept-skill-deps-kept: shared files a kept skill names stay, transitively', () => {
+  const entries = byPath(planManifestFiles(pristine));
+  for (const rel of ['.claude/scripts/validate-docs.cjs', '.claude/scripts/validate-docs-reconstruct.cjs', '.claude/hooks/docs-sync.cjs',
+    '.codex/scripts/validate-docs.cjs', '.codex/hooks/docs-sync.cjs']) {
+    assert.equal(entries.get(rel).reason, 'required-by-kept', rel);
+  }
+  // docs-sync.cjs requires ./lib/config.cjs, which requires ./runtime-dir.cjs.
+  assert.equal(entries.get('.claude/hooks/lib/config.cjs').reason, 'required-by-kept');
+  assert.equal(entries.get('.claude/hooks/lib/runtime-dir.cjs').reason, 'required-by-kept');
+  assert.equal(entries.get('.claude/scripts/provenance.cjs').action, 'remove');
+
+  // A user hook or skill the plugins do not replace keeps what it requires or runs.
+  const repo = copyFixture('user-deps');
+  fs.writeFileSync(path.join(repo, '.claude/hooks/my-hook.cjs'), "require('./lib/project-root.cjs');\n");
+  fs.mkdirSync(path.join(repo, '.claude/skills/my-skill'));
+  fs.writeFileSync(path.join(repo, '.claude/skills/my-skill/SKILL.md'), 'Run `node .claude\\scripts\\spec-receipt.cjs`.\n');
+  fs.mkdirSync(path.join(repo, '.claude/hooks/.logs'));
+  fs.writeFileSync(path.join(repo, '.claude/hooks/.logs/run.log'), 'ran .claude/scripts/workflow-policy.cjs\n');
+  const linkedSkill = path.join(work, 'user-deps', 'linked-skill');
+  fs.mkdirSync(linkedSkill);
+  fs.writeFileSync(path.join(linkedSkill, 'SKILL.md'), 'Run `node .claude/scripts/scan-staged-secrets.cjs`.\n');
+  fs.symlinkSync(linkedSkill, path.join(repo, '.claude/skills/linked-skill'), 'dir');
+  fs.writeFileSync(path.join(repo, '.claude/settings.local.json'),
+    JSON.stringify({ hooks: { Stop: [{ hooks: [{ type: 'command', command: 'node .claude\\hooks\\spec-gate.cjs' }] }] } }));
+  fs.writeFileSync(path.join(linkedSkill, 'agent.md'), 'Uses `.claude/scripts/setup-statusline.cjs`.\n');
+  fs.symlinkSync(path.join(linkedSkill, 'agent.md'), path.join(repo, '.claude/agents/my-agent.md'));
+  fs.writeFileSync(path.join(repo, '.claude/skills/scout/.DS_Store'), '');
+  const user = byPath(planManifestFiles(repo));
+  assert.equal(user.get('.claude/scripts/scan-staged-secrets.cjs').reason, 'required-by-kept');
+  assert.equal(user.get('.claude/hooks/spec-gate.cjs').reason, 'required-by-kept');
+  assert.equal(user.get('.claude/scripts/setup-statusline.cjs').reason, 'required-by-kept');
+  assert.equal(user.get('.claude/skills/scout/SKILL.md').action, 'remove');
+  assert.equal(user.get('.claude/hooks/lib/project-root.cjs').reason, 'required-by-kept');
+  assert.equal(user.get('.claude/scripts/spec-receipt.cjs').reason, 'required-by-kept');
+  assert.equal(user.get('.claude/scripts/workflow-policy.cjs').action, 'remove');
+});
+
+test('selected-style-kept: the output style chosen in settings.json stays', () => {
+  const settings = JSON.parse(fs.readFileSync(path.join(pristine, '.claude/settings.json'), 'utf8'));
+  assert.ok(settings.outputStyle, 'fixture selects an output style');
+  const plan = planManifestFiles(pristine);
+  const styles = plan.entries.filter((entry) => entry.path.startsWith('.claude/output-styles/'));
+  const kept = styles.filter((entry) => entry.action === 'keep');
+  assert.equal(kept.length, 1);
+  assert.equal(kept[0].reason, 'required-by-kept');
+  assert.match(fs.readFileSync(path.join(pristine, kept[0].path), 'utf8'), new RegExp(`^name: ${settings.outputStyle.replace(/[()]/g, '\\$&')}$`, 'm'));
+  assert.ok(styles.filter((entry) => entry.action === 'remove').length >= 1);
+
+  // /output-style writes the choice to settings.local.json, which overrides settings.json.
+  const repo = copyFixture('local-style');
+  fs.writeFileSync(path.join(repo, '.claude/settings.local.json'), JSON.stringify({ outputStyle: 'ELI5 Mode (Level 0)' }));
+  const local = byPath(planManifestFiles(repo));
+  assert.equal(local.get('.claude/output-styles/coding-level-0-eli5.md').reason, 'required-by-kept');
+  assert.equal(local.get(kept[0].path).reason, 'required-by-kept');
+});
+
+test('modified-group-kept: an edited skill stays whole with every shared file it names', () => {
+  const repo = copyFixture('modified');
+  const skillFile = path.join(repo, '.claude/skills/specs/SKILL.md');
+  fs.appendFileSync(skillFile, '\nRun `node .claude/scripts/provenance.cjs` before closing.\n');
+  const plan = planManifestFiles(repo);
+  const members = plan.entries.filter((entry) => entry.path.startsWith('.claude/skills/specs/'));
+  assert.ok(members.length > 1);
+  assert.equal(members.find((entry) => entry.path === '.claude/skills/specs/SKILL.md').reason, 'modified');
+  for (const entry of members.filter((item) => item.path !== '.claude/skills/specs/SKILL.md')) assert.equal(entry.reason, 'group-kept', entry.path);
+  assert.equal(byPath(plan).get('.claude/scripts/provenance.cjs').reason, 'required-by-kept');
+  // The Codex copy of the same skill is untouched and still goes.
+  assert.ok(plan.entries.filter((entry) => entry.path.startsWith('.agents/skills/specs/')).every((entry) => entry.action === 'remove'));
+
+  // A user file added inside an installed skill folder keeps that skill whole.
+  const notes = copyFixture('notes');
+  fs.writeFileSync(path.join(notes, '.claude/skills/debug/my-notes.md'), 'team notes\n');
+  const withNotes = planManifestFiles(notes);
+  assert.ok(withNotes.untracked.includes('.claude/skills/debug/my-notes.md'));
+  assert.ok(withNotes.entries.filter((entry) => entry.path.startsWith('.claude/skills/debug/')).every((entry) => entry.reason === 'group-kept'));
+});
+
+test('symlinked-kept: a symlinked skill folder is kept and its target is never planned', () => {
+  const repo = copyFixture('symlinked');
+  const outside = path.join(work, 'symlinked', 'outside-debug');
+  fs.cpSync(path.join(repo, '.agents/skills/debug'), outside, { recursive: true });
+  fs.rmSync(path.join(repo, '.agents/skills/debug'), { recursive: true });
+  fs.symlinkSync(outside, path.join(repo, '.agents/skills/debug'), 'dir');
+  const plan = planManifestFiles(repo);
+  const members = plan.entries.filter((entry) => entry.path.startsWith('.agents/skills/debug/'));
+  assert.ok(members.length > 0);
+  assert.ok(members.every((entry) => entry.action === 'keep' && entry.reason === 'symlinked'));
+  for (const entry of plan.entries.filter((item) => item.action === 'remove')) {
+    assert.ok(!fs.realpathSync(path.join(repo, entry.path)).startsWith(outside), entry.path);
+  }
+  assert.ok(!plan.untracked.some((rel) => rel.startsWith('.agents/skills/debug')));
+
+  // A link back into the repository keeps the files it reaches.
+  const inRepo = copyFixture('in-repo-link');
+  fs.rmSync(path.join(inRepo, '.agents/skills/debug'), { recursive: true });
+  fs.symlinkSync(path.join(inRepo, '.claude/skills/debug'), path.join(inRepo, '.agents/skills/debug'), 'dir');
+  const linked = planManifestFiles(inRepo);
+  assert.ok(linked.entries.filter((entry) => entry.path.startsWith('.claude/skills/debug/')).every((entry) => entry.action === 'keep'));
+
+  const linkedFolder = copyFixture('linked-folder');
+  const codexCopy = path.join(work, 'linked-folder', 'codex-real');
+  fs.renameSync(path.join(linkedFolder, '.codex'), codexCopy);
+  fs.symlinkSync(codexCopy, path.join(linkedFolder, '.codex'), 'dir');
+  const refused = planManifestFiles(linkedFolder);
+  assert.equal(refused.platforms.codex.status, 'refused');
+  assert.ok(ofPlatform(refused, 'codex').length === 0);
+});
+
+test('outside-root-kept: a manifest key that leaves the platform folders is never removed', () => {
+  const repo = copyFixture('outside');
+  const outsideFile = path.join(work, 'outside', 'outside.txt');
+  fs.writeFileSync(outsideFile, 'not CafeKit\n');
+  const manifestFile = path.join(repo, '.claude/cafekit-manifest.json');
+  const manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf8'));
+  // Claude keys resolve against .claude/, so ../../outside.txt is the repository's parent.
+  manifest.files['../../outside.txt'] = { sha256: sha256(fs.readFileSync(outsideFile)), version: '0.18.2' };
+  fs.writeFileSync(manifestFile, JSON.stringify(manifest, null, 2));
+  const entry = planManifestFiles(repo).entries.find((item) => item.key === '../../outside.txt');
+  assert.equal(entry.action, 'keep');
+  assert.equal(entry.reason, 'outside-root');
+});
+
+test('corrupt-manifest-refused: a manifest that does not parse plans nothing for its platform', () => {
+  const repo = copyFixture('corrupt');
+  fs.writeFileSync(path.join(repo, '.codex/cafekit-manifest.json'), '{ "files": ');
+  const plan = planManifestFiles(repo);
+  assert.equal(plan.platforms.codex.status, 'refused');
+  assert.equal(ofPlatform(plan, 'codex').length, 0);
+  assert.equal(plan.platforms.claude.status, 'planned');
+});
+
+test('unmanaged-reported: cafekit.json without a manifest is reported and nothing is planned', () => {
+  const repo = copyFixture('unmanaged');
+  fs.rmSync(path.join(repo, '.claude/cafekit-manifest.json'));
+  const plan = planManifestFiles(repo);
+  assert.equal(plan.platforms.claude.status, 'unmanaged');
+  assert.equal(ofPlatform(plan, 'claude').length, 0);
+  assert.match(renderManifestPlan(plan), /Claude Code \(\.claude\/\): unmanaged/);
+});
+
+test('untracked-listed: user files in the platform folders are listed and kept', () => {
+  const repo = copyFixture('untracked');
+  fs.mkdirSync(path.join(repo, '.claude/skills/my-skill'));
+  fs.writeFileSync(path.join(repo, '.claude/skills/my-skill/SKILL.md'), '---\nname: my-skill\n---\n');
+  fs.writeFileSync(path.join(repo, '.claude/.env'), 'TOKEN=[redacted]\n');
+  const plan = planManifestFiles(repo);
+  assert.ok(plan.untracked.includes('.claude/skills/my-skill/'), plan.untracked.join(', '));
+  assert.ok(plan.untracked.includes('.claude/.env'));
+  assert.equal(byPath(plan).get('.claude/.gitignore').reason, 'protects-kept');
+  assert.match(renderManifestPlan(plan), /\.claude\/skills\/my-skill\//);
+});
+
+test('writes-nothing: planning leaves the repository bytes unchanged', () => {
+  const repo = copyFixture('readonly');
+  const beforeHash = treeHash(repo);
+  const plan = planManifestFiles(repo);
+  renderManifestPlan(plan);
+  assert.equal(treeHash(repo), beforeHash);
+});

package/bin/__tests__/omp-bridge.test.js

@@ -14,7 +14,7 @@ const path = require('node:path');
 const { test } = require('node:test');
 
 const PACKAGE_ROOT = path.join(__dirname, '../..');
-const BRIDGE = path.join(PACKAGE_ROOT, 'src/omp/extensions/cafekit-bridge.mjs');
+const BRIDGE = path.join(PACKAGE_ROOT, 'src/omp/extensions/cafekit-bridge.js');
 const SETTINGS = require(path.join(PACKAGE_ROOT, 'src/claude/settings/settings.json'));
 const MANIFEST = require(path.join(PACKAGE_ROOT, 'src/claude/migration-manifest.json'));
 
@@ -149,10 +149,14 @@ test('a crashing or missing gate blocks on gating events instead of silently all
     fs.writeFileSync(path.join(dir, 'privacy-block.cjs'), 'throw new Error("boom");');
     fs.writeFileSync(path.join(dir, 'inspect-block.cjs'), 'process.exit(0);');
     const crash = await bridge.runEvent('tool_call', { toolName: 'bash', input: { command: 'ls' } }, { cwd: dir }, { dir });
-    // A bare exit 1 with no verdict is an allow under the hooks' own contract. Real gates
-    // never surface a crash this way: the fork's privacy-block catch-all converts its own
-    // errors into a deny, which the fork tests pin separately.
-    assert.equal(crash.block, false, 'exit 1 with no verdict is an allow per the hooks\' own contract');
+    // A gate that dies without a verdict (a broken node shim exits 1 the same way) must not
+    // read as an allow on a gating event.
+    assert.equal(crash.block, true, 'exit 1 with no verdict blocks a gating event');
+    assert.match(crash.reason, /privacy-block\.cjs exited with code 1/);
+    fs.writeFileSync(path.join(dir, 'state.cjs'), 'process.exit(1);');
+    fs.writeFileSync(path.join(dir, 'spec-state.cjs'), 'process.exit(1);');
+    const passive = await bridge.runEvent('tool_result', { toolName: 'bash', input: {} }, { cwd: dir }, { dir });
+    assert.equal(passive.block, false, 'a non-gating event still skips a failing hook');
     const missing = await bridge.runEvent('tool_call', { toolName: 'bash', input: { command: 'ls' } }, { cwd: dir }, { dir: path.join(dir, 'nowhere') });
     assert.equal(missing.block, true, 'a gate that is not installed must be loud, not a silent allow');
     assert.match(missing.reason, /not installed/);
@@ -223,3 +227,75 @@ test('an omp edit inside a packet scopes the tollgate to it', async () => {
     assert.doesNotMatch(other.inject, /Multiple active specs|Spec state changed/, "another omp session's touch does not leak");
   } finally { fs.rmSync(root, { recursive: true, force: true }); }
 });
+
+test('under Bun the hooks run with an absolute node outside the project', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-node-'));
+  try {
+    const outside = path.join(root, 'outside');
+    const inside = path.join(root, 'project', 'node_modules', '.bin');
+    for (const dir of [outside, inside]) {
+      fs.mkdirSync(dir, { recursive: true });
+      fs.writeFileSync(path.join(dir, 'node'), '#!/bin/sh\n');
+      fs.chmodSync(path.join(dir, 'node'), 0o755);
+    }
+    const cwd = path.join(root, 'project');
+    const pick = (PATH) => bridge.hookRunner({ cwd, env: { PATH }, bun: '1.4.3', platform: 'darwin' });
+    assert.deepEqual(pick(`${inside}:${outside}`), { command: path.join(outside, 'node') }, 'a node inside the project is skipped');
+    assert.match(pick('.:node_modules/.bin').error, /node was not found/, 'relative PATH entries are skipped');
+    assert.deepEqual(bridge.hookRunner({ cwd, env: { PATH: '' }, bun: undefined }), { command: process.execPath }, 'under node the running node is used');
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});
+
+test('without a usable node under Bun a gating event blocks and names node', async () => {
+  const saved = { bun: process.versions.bun, PATH: process.env.PATH };
+  try {
+    Object.defineProperty(process.versions, 'bun', { value: '1.4.3', configurable: true, writable: true });
+    process.env.PATH = '';
+    const r = await bridge.runEvent('tool_call', { toolName: 'bash', input: { command: 'ls' } }, { cwd: os.tmpdir() }, { dir: HOOKS });
+    assert.equal(r.block, true);
+    assert.match(r.reason, /node was not found on PATH/);
+  } finally {
+    if (saved.bun === undefined) delete process.versions.bun;
+    else process.versions.bun = saved.bun;
+    process.env.PATH = saved.PATH;
+  }
+});
+
+function touchedIn(hooks, session) {
+  const crypto = require('node:crypto');
+  const file = path.join(hooks, '.logs', `spec-touched-${crypto.createHash('sha256').update(session).digest('hex')}.json`);
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return []; }
+}
+
+test('multi-file edits and ast_edit record every packet they changed', async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-omp-paths-'));
+  try {
+    const hooks = composeOmp(root);
+    for (const name of ['alpha', 'beta', 'gamma']) ompPacket(root, name);
+    const ctx = (id) => ({ cwd: root, sessionManager: { getSessionId: () => id } });
+
+    // omp adds `paths` for a hashline edit with several file headers and no single `path`.
+    await bridge.runEvent('tool_result', {
+      toolName: 'edit', isError: false, content: [],
+      input: { input: '[specs/alpha/plan.md#AAAA]\nPUT >2:\n+x\n[specs/beta/plan.md#BBBB]\nPUT >2:\n+y', paths: ['specs/alpha/plan.md', 'specs/beta/plan.md'] },
+    }, ctx('omp-multi'), { dir: hooks });
+    assert.deepEqual(touchedIn(hooks, 'omp-multi'), ['alpha', 'beta']);
+
+    // ast_edit names globs; only the files it reports changing count, and a glob never does.
+    await bridge.runEvent('tool_result', {
+      toolName: 'ast_edit', isError: false, content: [],
+      input: { ops: [{ pat: 'a', out: 'b' }], paths: ['specs/**'] },
+      details: { fileChanges: [{ path: path.join(root, 'specs', 'gamma', 'plan.md'), count: 1 }] },
+    }, ctx('omp-ast'), { dir: hooks });
+    assert.deepEqual(touchedIn(hooks, 'omp-ast'), ['gamma']);
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});
+
+test('the bridge passes edit result paths but not the file contents', () => {
+  const payload = bridge.shapePayload('tool_result', {
+    toolName: 'edit', input: { path: 'a.md' }, content: [], isError: false,
+    details: { path: '/abs/a.md', oldText: 'old body', newText: 'new body', perFileResults: [{ path: '/abs/b.md', oldText: 'x' }], fileChanges: [{ path: '/abs/c.md', count: 2 }] },
+  }, { cwd: '/tmp/project' });
+  assert.deepEqual(payload.tool_response.details, { path: '/abs/a.md', perFileResults: [{ path: '/abs/b.md' }], fileChanges: [{ path: '/abs/c.md' }] });
+  assert.doesNotMatch(JSON.stringify(payload), /old body|new body/);
+});