@raidiant/notifai 0.3.0 → 0.5.0

package/src/install-hooks.test.ts

@@ -27,6 +27,9 @@ import {
   codexLayerDir,
   codexProjectRoot,
   findInstallations,
+  codexHookIdentityHash,
+  codexTrustKey,
+  codexTrustProblems,
   handlerEvent,
   hookCommand,
   mergeHooks,
@@ -38,9 +41,10 @@ import {
 
 const SCRIPT = '/opt/notifai/dist/main.js'
 const EXEC = '/usr/local/bin/node'
+const ADAPTER = '/Users/test/.notifai/bin/hook-adapter'
 
 function ours(): HookConfig {
-  return buildHookConfig({ execPath: EXEC, scriptPath: SCRIPT, replyTimeoutSeconds: 240, graceSeconds: 0 })
+  return buildHookConfig({ adapterPath: ADAPTER })
 }
 
 describe('choice labels', () => {
@@ -71,21 +75,22 @@ describe('choice labels', () => {
 })
 
 describe('hook config', () => {
-  it('invokes the CLI by absolute path so a hook shell without our PATH still works', () => {
-    expect(hookCommand(EXEC, SCRIPT, 'stop')).toBe(`'${EXEC}' '${SCRIPT}' hook stop --owner notifai`)
+  it('invokes one stable adapter so a sparse hook PATH still works', () => {
+    expect(hookCommand(ADAPTER, 'stop')).toBe(`'${ADAPTER}' hook stop --owner notifai`)
   })
 
   it('single-quotes so a path cannot become a command', () => {
     // Double quotes still expand $() and backticks, so a checkout path with
     // shell syntax was execution on every hook event.
-    const cmd = hookCommand('/usr/bin/node', '/tmp/$(touch /tmp/pwned)/main.js', 'stop')
-    expect(cmd).toBe("'/usr/bin/node' '/tmp/$(touch /tmp/pwned)/main.js' hook stop --owner notifai")
-    expect(hookCommand('/usr/bin/node', "/it's/here.js", 'stop')).toContain(`'/it'\\''s/here.js'`)
+    const cmd = hookCommand('/tmp/$(touch /tmp/pwned)/hook-adapter', 'stop')
+    expect(cmd).toBe("'/tmp/$(touch /tmp/pwned)/hook-adapter' hook stop --owner notifai")
+    expect(hookCommand("/it's/here", 'stop')).toContain(`'/it'\\''s/here'`)
   })
 
-  it('gives blocking hooks headroom over our own wait, and SessionEnd almost none', () => {
-    const config = buildHookConfig({ execPath: EXEC, scriptPath: SCRIPT, replyTimeoutSeconds: 240, graceSeconds: 0 })
-    expect(config['Stop']?.[0]?.hooks[0]?.timeout).toBe(300)
+  it('uses one fixed blocking process budget rather than accepting mutable timing inputs', () => {
+    const config = buildHookConfig({ adapterPath: ADAPTER })
+    expect(config['Stop']?.[0]?.hooks[0]?.timeout).toBe(540)
+    expect(config['Stop']?.[0]?.hooks[0]?.async).toBeUndefined()
     // Claude Code caps UserPromptSubmit at 30s; Codex gives SessionEnd 1-3s.
     expect(config['UserPromptSubmit']?.[0]?.hooks[0]?.timeout).toBe(15)
     expect(config['SessionEnd']?.[0]?.hooks[0]?.timeout).toBe(3)
@@ -93,10 +98,7 @@ describe('hook config', () => {
 
   it('stamps the exact harness on every generated command', () => {
     const config = buildHookConfig({
-      execPath: EXEC,
-      scriptPath: SCRIPT,
-      replyTimeoutSeconds: 240,
-      graceSeconds: 0,
+      adapterPath: ADAPTER,
       harness: 'claude-code',
     })
     expect(
@@ -106,6 +108,56 @@ describe('hook config', () => {
         .every((handler) => handler.command.includes('--harness claude-code')),
     ).toBe(true)
   })
+
+  it('lets Codex own Stop timeout while keeping short fixed lifecycle budgets', () => {
+    const codex = buildHookConfig({ adapterPath: ADAPTER, harness: 'codex' })
+
+    expect(codex['UserPromptSubmit']?.[0]?.hooks[0]?.timeout).toBe(15)
+    expect(codex['SessionEnd']?.[0]?.hooks[0]?.timeout).toBe(3)
+    // Codex hashes the exact serialized definition into `trusted_hash`, so its
+    // Stop handler stays a bare blocking command: declaring a timeout would
+    // invalidate the user's approval and the handler would silently stop.
+    expect(codex['Stop']?.[0]?.hooks[0]).toEqual({
+      type: 'command',
+      command: hookCommand(ADAPTER, 'stop', 'codex'),
+    })
+  })
+
+  it('gives Claude Code an asynchronous Stop with an explicit waiter budget', () => {
+    const claude = buildHookConfig({ adapterPath: ADAPTER, harness: 'claude-code' })
+
+    // `async: true` is what frees the turn: the handler returns at once and the
+    // same process lives on as the waiter. The explicit timeout is what keeps
+    // that process alive — Claude kills a background hook at its own 600s
+    // default and reports nothing, so a wait near that boundary loses answers.
+    expect(claude['Stop']?.[0]?.hooks[0]).toEqual({
+      type: 'command',
+      command: hookCommand(ADAPTER, 'stop', 'claude-code'),
+      timeout: 3600,
+      async: true,
+    })
+    expect(claude['UserPromptSubmit']?.[0]?.hooks[0]?.async).toBeUndefined()
+    expect(claude['SessionEnd']?.[0]?.hooks[0]?.async).toBeUndefined()
+  })
+
+  it('leaves exactly one handler per event when an old blocking shape is reinstalled over', () => {
+    const old = mergeHooks({}, buildHookConfig({ adapterPath: ADAPTER }), SCRIPT)
+    const migrated = mergeHooks(
+      old.document,
+      buildHookConfig({ adapterPath: ADAPTER, harness: 'claude-code' }),
+      SCRIPT,
+    )
+
+    for (const event of ['UserPromptSubmit', 'Stop', 'SessionEnd']) {
+      const groups = migrated.document.hooks?.[event] ?? []
+      expect(groups.flatMap((group) => group.hooks)).toHaveLength(1)
+    }
+    expect(migrated.document.hooks?.['Stop']?.[0]?.hooks[0]).toMatchObject({
+      timeout: 3600,
+      async: true,
+    })
+    expect(migrated.replaced.sort()).toEqual(['SessionEnd', 'Stop', 'UserPromptSubmit'])
+  })
 })
 
 describe('merging into existing settings', () => {
@@ -130,11 +182,11 @@ describe('merging into existing settings', () => {
     const once = mergeHooks({}, ours(), SCRIPT)
     const twice = mergeHooks(
       once.document,
-      buildHookConfig({ execPath: EXEC, scriptPath: SCRIPT, replyTimeoutSeconds: 60, graceSeconds: 0 }),
+      buildHookConfig({ adapterPath: ADAPTER }),
       SCRIPT,
     )
     expect(twice.document.hooks?.['Stop']).toHaveLength(1)
-    expect(twice.document.hooks?.['Stop']?.[0]?.hooks[0]?.timeout).toBe(120)
+    expect(twice.document.hooks?.['Stop']?.[0]?.hooks[0]?.timeout).toBe(540)
     expect(twice.replaced).toContain('Stop')
   })
 
@@ -292,9 +344,9 @@ describe('upgrading past a dropped event', () => {
     const stale = {
       hooks: {
         PermissionRequest: [
-          { hooks: [{ type: 'command' as const, command: hookCommand(EXEC, SCRIPT, 'permission-request') }] },
+          { hooks: [{ type: 'command' as const, command: hookCommand(ADAPTER, 'permission-request') }] },
         ],
-        Stop: [{ hooks: [{ type: 'command' as const, command: hookCommand(EXEC, SCRIPT, 'stop') }] }],
+        Stop: [{ hooks: [{ type: 'command' as const, command: hookCommand(ADAPTER, 'stop') }] }],
       },
     }
 
@@ -311,7 +363,7 @@ describe('upgrading past a dropped event', () => {
         PermissionRequest: [
           {
             hooks: [
-              { type: 'command' as const, command: hookCommand(EXEC, SCRIPT, 'permission-request') },
+              { type: 'command' as const, command: hookCommand(ADAPTER, 'permission-request') },
               { type: 'command' as const, command: 'their-own-tool --check' },
             ],
           },
@@ -393,10 +445,49 @@ describe('finding what is installed', () => {
   it('reads the event a handler actually invokes, not the key it sits under', () => {
     // These diverge exactly when an upgrade drops an event, which is the case
     // worth detecting.
-    expect(handlerEvent(hookCommand(EXEC, SCRIPT, 'permission-request'))).toBe('permission-request')
+    expect(handlerEvent(hookCommand(ADAPTER, 'permission-request'))).toBe('permission-request')
     expect(handlerEvent('unrelated --tool')).toBeNull()
   })
 
+  it('detects when Codex still trusts an older definition of an installed hook', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-trust-'))
+    const codexHome = path.join(cwd, 'codex-home')
+    const hookFile = path.join(cwd, '.codex', 'hooks.json')
+    mkdirSync(path.dirname(hookFile), { recursive: true })
+    applyPlan(hookFile, { hooks: ours() })
+    const installations = findInstallations(cwd, { CODEX_HOME: codexHome })
+    const codex = installations.find((installation) => installation.harness === 'codex')
+    const stop = codex?.handlers.find((handler) => handler.event === 'Stop')
+    expect(stop).toBeDefined()
+
+    mkdirSync(codexHome, { recursive: true })
+    writeFileSync(
+      path.join(codexHome, 'config.toml'),
+      `[hooks.state.${JSON.stringify(codexTrustKey(codex!, stop!))}]\ntrusted_hash = "sha256:obsolete"\n`,
+    )
+
+    const stale = codexTrustProblems(installations, { CODEX_HOME: codexHome })
+    expect(stale).toHaveLength(3)
+    expect(stale).toEqual(expect.arrayContaining([expect.stringMatching(/Stop.*changed.*\/hooks/i)]))
+
+    writeFileSync(
+      path.join(codexHome, 'config.toml'),
+      `[hooks.state.${JSON.stringify(codexTrustKey(codex!, stop!))}]\ntrusted_hash = "${codexHookIdentityHash(stop!)}"\n`,
+    )
+    expect(codexTrustProblems(installations, { CODEX_HOME: codexHome })).toEqual([
+      expect.stringMatching(/UserPromptSubmit.*not trusted.*\/hooks/i),
+      expect.stringMatching(/SessionEnd.*not trusted.*\/hooks/i),
+    ])
+
+    writeFileSync(
+      path.join(codexHome, 'config.toml'),
+      `[hooks.state.${JSON.stringify(codexTrustKey(codex!, stop!))}]\ntrusted_hash = "${codexHookIdentityHash(stop!)}"\nenabled = false\n`,
+    )
+    expect(codexTrustProblems(installations, { CODEX_HOME: codexHome })).toEqual(
+      expect.arrayContaining([expect.stringMatching(/Stop.*disabled.*\/hooks/i)]),
+    )
+  })
+
 })
 
 /**
@@ -405,7 +496,7 @@ describe('finding what is installed', () => {
  * the harness ran both, and one question produced two notifications.
  */
 describe('two checkouts', () => {
-  const OTHER = '/Users/rafael/other-checkout/apps/cli/dist/main.js'
+  const OTHER = '/Users/rafael/notifai-public/apps/cli/dist/main.js'
 
   function documentWith(command: string): SettingsDocument {
     return { hooks: { Stop: [{ matcher: '*', hooks: [{ type: 'command', command, timeout: 300 }] }] } }
@@ -416,26 +507,26 @@ describe('two checkouts', () => {
   }
 
   it('replaces a handler another checkout installed instead of running beside it', () => {
-    const existing = documentWith(hookCommand(EXEC, OTHER, 'stop'))
+    const existing = documentWith(hookCommand('/other/notifai/hook-adapter', 'stop'))
     const merged = mergeHooks(
       existing,
-      buildHookConfig({ execPath: EXEC, scriptPath: SCRIPT, replyTimeoutSeconds: 240, graceSeconds: 0 }),
+      buildHookConfig({ adapterPath: ADAPTER }),
       SCRIPT,
     )
     const commands = stopCommands(merged.document)
     expect(commands.filter((c) => c.includes('hook stop'))).toHaveLength(1)
-    expect(commands[0]).toContain(SCRIPT)
-    expect(commands.join(' ')).not.toContain(OTHER)
+    expect(commands[0]).toContain(ADAPTER)
+    expect(commands.join(' ')).not.toContain('/other/notifai/hook-adapter')
   })
 
   it('uninstalls a handler another checkout installed', () => {
-    const removed = removeHooks(documentWith(hookCommand(EXEC, OTHER, 'stop')), SCRIPT)
+    const removed = removeHooks(documentWith(hookCommand('/other/notifai/hook-adapter', 'stop')), SCRIPT)
     expect(stopCommands(removed.document)).toHaveLength(0)
   })
 
   it('still recognises an install that predates the marker', () => {
-    // Same path, no marker: the form written by an older build.
-    const legacy = documentWith(`'${EXEC}' '${SCRIPT}' hook stop`)
+    // Different checkout, no marker: the form written by an older build.
+    const legacy = documentWith(`'${EXEC}' '${OTHER}' hook stop`)
     expect(stopCommands(removeHooks(legacy, SCRIPT).document)).toHaveLength(0)
   })
 
@@ -443,6 +534,11 @@ describe('two checkouts', () => {
     const foreign = documentWith('/usr/local/bin/my-own-thing --stop')
     expect(stopCommands(removeHooks(foreign, SCRIPT).document)).toHaveLength(1)
   })
+
+  it("preserves a foreign project's generic dist/main.js hook", () => {
+    const foreign = documentWith("'/usr/local/bin/node' '/opt/foreign/dist/main.js' hook stop")
+    expect(stopCommands(removeHooks(foreign, SCRIPT).document)).toHaveLength(1)
+  })
 })
 
 /**
@@ -451,8 +547,7 @@ describe('two checkouts', () => {
  */
 describe('the OpenCode adapter', () => {
   const source = opencodePluginSource({
-    execPath: EXEC,
-    scriptPath: SCRIPT,
+    adapterPath: ADAPTER,
     timeoutSeconds: 240,
   })
 
@@ -460,8 +555,9 @@ describe('the OpenCode adapter', () => {
     // The whole point: presence, escalation and retirement stay in the CLI.
     expect(source).toContain('"hook", event')
     expect(source).toContain('"--harness", "opencode"')
-    expect(source).toContain(JSON.stringify(SCRIPT))
-    expect(source).toContain(JSON.stringify(EXEC))
+    expect(source).toContain(JSON.stringify(ADAPTER))
+    expect(source).not.toContain(JSON.stringify(SCRIPT))
+    expect(source).not.toContain(JSON.stringify(EXEC))
   })
 
   it('wires the three question lifecycle joints and leaves permissions alone', () => {
@@ -504,27 +600,21 @@ describe('the OpenCode adapter', () => {
     expect(settingsFile('opencode', false, '/repo', {})).toContain('notifai.js')
   })
 
-  it('reports the build it will run, not its own path', () => {
-    // `doctor` asks every handler which build it invokes. A plugin is a module
-    // rather than a command line, so answering with the plugin's own path made
-    // an ordinary OpenCode install look like a second checkout and turned the
-    // duplicate check red on a healthy machine.
+  it('reports the same stable adapter identity as command-hook harnesses', () => {
     expect(opencodePluginTarget(source)).toEqual({
-      exec: EXEC,
-      script: SCRIPT,
+      adapter: ADAPTER,
       current: true,
       timeoutSeconds: 240,
     })
     expect(opencodePluginTarget(source.replace(/^const ADAPTER_VERSION = .*\n/m, ''))).toEqual({
-      exec: EXEC,
-      script: SCRIPT,
+      adapter: ADAPTER,
       current: false,
       timeoutSeconds: 240,
     })
     expect(opencodePluginTarget('export const SomeoneElse = () => ({})')).toBeNull()
     // Ours, but with the constants edited beyond recognition: no answer beats
     // a wrong one, since the caller compares these for equality.
-    expect(opencodePluginTarget(`${OPENCODE_PLUGIN_MARKER}\nconst EXEC = whatever\n`)).toBeNull()
+    expect(opencodePluginTarget(`${OPENCODE_PLUGIN_MARKER}\nconst ADAPTER = whatever\n`)).toBeNull()
   })
 })