claude-dev-env 7.0.0 → 7.2.0

package/bin/cde.test.mjs

@@ -7,6 +7,7 @@ import test from "node:test";
 
 import {
     buildLintCommand,
+    buildVerifyCommand,
     createHelpText,
     findPython,
     main,
@@ -43,6 +44,8 @@ test("help describes lint source modes", () => {
     assert.match(helpText, /--base/);
     assert.match(helpText, /--repository/);
     assert.match(helpText, /--text-as/);
+    assert.match(helpText, /cde verify/);
+    assert.match(helpText, /--manifest/);
 });
 
 
@@ -67,6 +70,51 @@ test("forwards lint arguments to the python command without a shell", () => {
 });
 
 
+test("forwards verification arguments to the authoritative python command", () => {
+    const command = buildVerifyCommand("python-test", [
+        "--manifest",
+        "manifest with spaces.json",
+        "--repo",
+        "repo with spaces",
+        "--base",
+        "base-sha",
+        "--output",
+        "report.json",
+    ]);
+    assert.equal(command.executable, "python-test");
+    assert.match(command.arguments[0], /scripts[\\/]local_verification[\\/]cli\.py$/);
+    assert.deepEqual(command.arguments.slice(1), [
+        "--manifest",
+        "manifest with spaces.json",
+        "--repo",
+        "repo with spaces",
+        "--base",
+        "base-sha",
+        "--output",
+        "report.json",
+    ]);
+});
+
+
+test("dispatches verify without changing forwarded arguments", async () => {
+    let receivedCommand;
+    const exitCode = await main(
+        ["verify", "--python", "python-test", "--manifest", "manifest.json"],
+        {
+            findPython: async () => "unused-python",
+            runCommand: async (command) => {
+                receivedCommand = command;
+                return 0;
+            },
+        },
+    );
+    assert.equal(exitCode, 0);
+    assert.equal(receivedCommand.executable, "python-test");
+    assert.match(receivedCommand.arguments[0], /local_verification[\\/]cli\.py$/);
+    assert.deepEqual(receivedCommand.arguments.slice(1), ["--manifest", "manifest.json"]);
+});
+
+
 test("strips the launcher python override from forwarded arguments", async () => {
     let receivedCommand;
     const exitCode = await main(["lint", "--python", "python-test", "--staged"], {

package/bin/ever-shipped-skills.mjs

@@ -1,23 +1,3 @@
-/**
- * The top-level skill directory names this package has ever shipped.
- *
- * The installer subtracts the skills the current package installs from this set
- * to learn which shipped skills have retired, so a full reinstall can remove a
- * retired skill left behind under ~/.agents/skills. Because the current set is
- * subtracted at runtime, restoring a retired skill to the package protects it
- * automatically — it re-enters the installed set and drops out of the retired
- * set on the next install.
- *
- * The list is a committed literal rather than a git query, because a user
- * installs from the npm tarball, which carries no source-repo history. Refresh
- * it by running, from the repository root:
- *
- *   git log --all --pretty=format: --name-only -- \
- *     'packages/claude-dev-env/.agents/skills/*\/SKILL.md' \
- *     'packages/claude-dev-env/skills/*\/SKILL.md' | sort -u
- *
- * and pasting each distinct top-level skill directory name below.
- */
 export const EVER_SHIPPED_SKILL_NAMES = new Set([
     'agent-prompt',
     'anthropic-plan',
@@ -109,6 +89,7 @@ export const EVER_SHIPPED_SKILL_NAMES = new Set([
     'reviewer-gates',
     'reviews',
     'run-claude-dev-env',
+    'session-continuity',
     'session-log',
     'session-tidy',
     'pr-shared-extraction',
@@ -127,4 +108,5 @@ export const EVER_SHIPPED_SKILL_NAMES = new Set([
     'update',
     'usage-pause',
     'verified-build',
+    'windows-scheduled-task',
 ]);

package/bin/ever-shipped-skills.test.mjs

@@ -36,3 +36,11 @@ test('EVER_SHIPPED_SKILL_NAMES retains the explicit test runner', () => {
 test('EVER_SHIPPED_SKILL_NAMES includes the pull request skill', () => {
     assert.equal(EVER_SHIPPED_SKILL_NAMES.has('pull-request'), true);
 });
+
+test('EVER_SHIPPED_SKILL_NAMES includes the windows scheduled task skill', () => {
+    assert.equal(EVER_SHIPPED_SKILL_NAMES.has('windows-scheduled-task'), true);
+});
+
+test('EVER_SHIPPED_SKILL_NAMES includes the session continuity companion', () => {
+    assert.equal(EVER_SHIPPED_SKILL_NAMES.has('session-continuity'), true);
+});

package/bin/expand_home_directory_tokens.mjs

@@ -1,9 +1,8 @@
 /**
- * Install-time expansion of $HOME / ${HOME} / ~/ in settings.json commands.
+ * Expand $HOME, ${HOME}, and ~/ in settings.json commands at install time.
  *
- * Hosts that require referenced env vars at hook load time (for example a third-party host)
- * skip the hook when HOME is unset — common on Windows — so the installer
- * rewrites residual tokens to absolute home paths.
+ * Some hosts skip a hook when HOME is unset, which is common on Windows.
+ * The installer rewrites leftover tokens to absolute home paths.
  */
 
 /**
@@ -34,7 +33,7 @@ export function expandHomeDirectoryTokens(commandString, homeDirectory) {
         () => normalizedHome,
     );
     expandedCommand = expandedCommand.replace(
-        /(^|[\s"'=])~\//g,
+        /(^|[\s"'=;(])~\//g,
         (_fullMatch, boundary) => `${boundary}${normalizedHome}/`,
     );
     return expandedCommand;

package/bin/expand_home_directory_tokens.test.mjs

@@ -0,0 +1,128 @@
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+
+import {
+    expandHomeDirectoryTokens,
+    expandHomeDirectoryTokensInSettings,
+} from './expand_home_directory_tokens.mjs';
+
+
+test('expandHomeDirectoryTokens expands $HOME, ${HOME}, and ~/', () => {
+    assert.equal(
+        expandHomeDirectoryTokens(
+            'python $HOME/.claude/hooks/session/fix_worktree_hookspath.py',
+            'C:\\Users\\x',
+        ),
+        'python C:/Users/x/.claude/hooks/session/fix_worktree_hookspath.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('python ${HOME}/.claude/hooks/a.py', '/home/x'),
+        'python /home/x/.claude/hooks/a.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('python ~/.claude/hooks/a.py', '/home/x'),
+        'python /home/x/.claude/hooks/a.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('echo $HOMEPATH', 'C:/Users/x'),
+        'echo $HOMEPATH',
+    );
+});
+
+
+test('expandHomeDirectoryTokens inserts dollar characters in home paths literally', () => {
+    const homeWithReplaceMetacharacters = 'C:/Users/$&evil$1';
+    assert.equal(
+        expandHomeDirectoryTokens('python $HOME/.claude/a.py', homeWithReplaceMetacharacters),
+        'python C:/Users/$&evil$1/.claude/a.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('python ${HOME}/.claude/a.py', homeWithReplaceMetacharacters),
+        'python C:/Users/$&evil$1/.claude/a.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('python ~/.claude/a.py', homeWithReplaceMetacharacters),
+        'python C:/Users/$&evil$1/.claude/a.py',
+    );
+});
+
+
+test('expandHomeDirectoryTokens expands ${HOME} before $HOME so braces stay intact', () => {
+    assert.equal(
+        expandHomeDirectoryTokens('python ${HOME}/.claude/a.py', '/home/x'),
+        'python /home/x/.claude/a.py',
+    );
+});
+
+
+test('expandHomeDirectoryTokens strips trailing slashes from the home directory', () => {
+    assert.equal(
+        expandHomeDirectoryTokens('python $HOME/.claude/a.py', 'C:/Users/x/'),
+        'python C:/Users/x/.claude/a.py',
+    );
+});
+
+
+test('expandHomeDirectoryTokensInSettings skips non-array hook event values', () => {
+    const settings = {
+        hooks: {
+            SessionStart: 'not-an-array',
+            PreToolUse: [
+                {
+                    matcher: 'Write',
+                    hooks: [{ type: 'command', command: 'python $HOME/.claude/hooks/a.py' }],
+                },
+            ],
+        },
+    };
+    expandHomeDirectoryTokensInSettings(settings, 'C:/Users/x');
+    assert.equal(settings.hooks.SessionStart, 'not-an-array');
+    assert.equal(
+        settings.hooks.PreToolUse[0].hooks[0].command,
+        'python C:/Users/x/.claude/hooks/a.py',
+    );
+});
+
+
+test('expandHomeDirectoryTokensInSettings rewrites hooks and statusLine', () => {
+    const settings = {
+        hooks: {
+            SessionStart: [
+                {
+                    matcher: '',
+                    hooks: [
+                        {
+                            type: 'command',
+                            command: 'python $HOME/.claude/hooks/session/fix_worktree_hookspath.py',
+                        },
+                    ],
+                },
+            ],
+        },
+        statusLine: {
+            type: 'command',
+            command: 'python "$HOME/.claude/statusline-command.py"',
+        },
+    };
+    expandHomeDirectoryTokensInSettings(settings, 'C:/Users/x');
+    assert.equal(
+        settings.hooks.SessionStart[0].hooks[0].command,
+        'python C:/Users/x/.claude/hooks/session/fix_worktree_hookspath.py',
+    );
+    assert.equal(
+        settings.statusLine.command,
+        'python "C:/Users/x/.claude/statusline-command.py"',
+    );
+});
+
+
+test('expandHomeDirectoryTokens expands a tilde path that follows a semicolon or an opening parenthesis', () => {
+    assert.equal(
+        expandHomeDirectoryTokens('cd /repo;~/.claude/hooks/x.py', '/home/x'),
+        'cd /repo;/home/x/.claude/hooks/x.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('(~/.claude/hooks/x.py)', '/home/x'),
+        '(/home/x/.claude/hooks/x.py)',
+    );
+});

package/bin/git_hooks_installer.mjs

@@ -6,6 +6,7 @@ import { join } from 'node:path';
 export const KNOWN_GIT_HOOK_NAMES = Object.freeze([
     'pre-commit',
     'pre-push',
+    'post-commit',
 ]);
 
 export const SHIM_DOCSTRING = (
@@ -72,6 +73,12 @@ function deriveModuleNameFromGitNativeHookName(gitNativeHookName) {
 
 function buildShimContent(pythonModuleName) {
     const shimContentHeader = '#!/usr/bin/env python3\n';
+    const failureMessage = JSON.stringify(
+        `claude-dev-env: advisory hook ${pythonModuleName} failed: `,
+    );
+    const nonzeroMessage = JSON.stringify(
+        `claude-dev-env: advisory hook ${pythonModuleName} returned non-zero: `,
+    );
     return (
         shimContentHeader
         + `"""${SHIM_DOCSTRING}"""\n`
@@ -82,9 +89,21 @@ function buildShimContent(pythonModuleName) {
         + 'if str(shim_directory) not in sys.path:\n'
         + '    sys.path.insert(0, str(shim_directory))\n'
         + '\n'
-        + `import ${pythonModuleName}\n`
-        + '\n'
-        + `sys.exit(${pythonModuleName}.main())\n`
+        + 'try:\n'
+        + `    import ${pythonModuleName}\n`
+        + `    advisory_exit_code = ${pythonModuleName}.main()\n`
+        + 'except SystemExit as advisory_system_exit:\n'
+        + '    if advisory_system_exit.code == 130:\n'
+        + '        raise\n'
+        + '    if advisory_system_exit.code not in (None, 0):\n'
+        + `        print(${failureMessage} + str(advisory_system_exit), file=sys.stderr)\n`
+        + '    sys.exit(0)\n'
+        + 'except Exception as advisory_error:\n'
+        + `    print(${failureMessage} + str(advisory_error), file=sys.stderr)\n`
+        + '    sys.exit(0)\n'
+        + 'if advisory_exit_code:\n'
+        + `    print(${nonzeroMessage} + str(advisory_exit_code), file=sys.stderr)\n`
+        + 'sys.exit(0)\n'
     );
 }
 

package/bin/git_hooks_installer.test.mjs

@@ -1,6 +1,7 @@
 import { test } from 'node:test';
 import { strict as assert } from 'node:assert';
-import { mkdtempSync, rmSync, existsSync, readFileSync, mkdirSync, statSync, symlinkSync } from 'node:fs';
+import { mkdtempSync, rmSync, existsSync, readFileSync, mkdirSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import { execFileSync, spawnSync } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
@@ -58,16 +59,16 @@ test('writeAllGitHookShims creates one shim per known hook name', () => {
 });
 
 
-test('known git hooks exclude post-commit', () => {
-    assert.equal(KNOWN_GIT_HOOK_NAMES.includes('post-commit'), false);
+test('known git hooks include post-commit for current-head notices', () => {
+    assert.deepEqual(KNOWN_GIT_HOOK_NAMES, ['pre-commit', 'pre-push', 'post-commit']);
 });
 
 
-test('writeAllGitHookShims does not create a post-commit shim', () => {
+test('writeAllGitHookShims creates the post-commit shim', () => {
     const { temporaryRoot, gitHooksDirectory } = makeTemporaryGitHooksDirectory();
     try {
         writeAllGitHookShims({ gitHooksDirectory });
-        assert.equal(existsSync(join(gitHooksDirectory, 'post-commit')), false);
+        assert.equal(existsSync(join(gitHooksDirectory, 'post-commit')), true);
     } finally {
         rmSync(temporaryRoot, { recursive: true, force: true });
     }
@@ -221,3 +222,156 @@ test('writeGitHookShim rejects hooks directory that is a symlink (loopP5c-5)', (
     }
 });
 
+
+test('generated advisory shims keep temporary Git commit and push available after module failure', () => {
+    const { temporaryRoot, gitHooksDirectory } = makeTemporaryGitHooksDirectory();
+    const repositoryRoot = join(temporaryRoot, 'repository');
+    const bareRepositoryRoot = join(temporaryRoot, 'remote.git');
+    const targetRemote = 'https://github.com/JonEcho/python-automation.git';
+    try {
+        writeFileSync(
+            join(gitHooksDirectory, 'broken_advisory.py'),
+            'def main():\n    raise RuntimeError("advisory failure")\n',
+        );
+        writeGitHookShim({
+            gitHooksDirectory,
+            gitNativeHookName: 'pre-commit',
+            pythonModuleName: 'broken_advisory',
+        });
+        writeGitHookShim({
+            gitHooksDirectory,
+            gitNativeHookName: 'pre-push',
+            pythonModuleName: 'broken_advisory',
+        });
+        mkdirSync(repositoryRoot);
+        execFileSync('git', ['init', '--initial-branch=main', '--quiet'], { cwd: repositoryRoot });
+        execFileSync('git', ['config', 'user.email', 'test@example.invalid'], { cwd: repositoryRoot });
+        execFileSync('git', ['config', 'user.name', 'Verification Test'], { cwd: repositoryRoot });
+        execFileSync('git', ['config', 'core.hooksPath', gitHooksDirectory], { cwd: repositoryRoot });
+        writeFileSync(join(repositoryRoot, 'README.md'), 'check\n');
+        execFileSync('git', ['add', 'README.md'], { cwd: repositoryRoot });
+
+        const commitResult = spawnSync('git', ['commit', '-m', 'initial'], {
+            cwd: repositoryRoot,
+            encoding: 'utf8',
+        });
+        assert.equal(commitResult.status, 0);
+        assert.match(commitResult.stderr, /advisory hook broken_advisory failed: advisory failure/);
+
+        execFileSync('git', ['init', '--bare', '--quiet', bareRepositoryRoot], { cwd: temporaryRoot });
+        execFileSync('git', ['remote', 'add', 'origin', targetRemote], { cwd: repositoryRoot });
+        execFileSync('git', ['config', `url.${bareRepositoryRoot}.insteadOf`, targetRemote], {
+            cwd: repositoryRoot,
+        });
+        const pushResult = spawnSync('git', ['push', 'origin', 'main'], {
+            cwd: repositoryRoot,
+            encoding: 'utf8',
+        });
+        assert.equal(pushResult.status, 0);
+        assert.match(pushResult.stderr, /advisory hook broken_advisory failed: advisory failure/);
+    } finally {
+        rmSync(temporaryRoot, { recursive: true, force: true });
+    }
+});
+
+
+test('generated advisory shim turns a nonzero module return into a success with a warning', () => {
+    const { temporaryRoot, gitHooksDirectory } = makeTemporaryGitHooksDirectory();
+    try {
+        writeFileSync(
+            join(gitHooksDirectory, 'nonzero_advisory.py'),
+            'def main():\n    return 1\n',
+        );
+        const shimPath = writeGitHookShim({
+            gitHooksDirectory,
+            gitNativeHookName: 'pre-commit',
+            pythonModuleName: 'nonzero_advisory',
+        });
+        const shimResult = spawnSync('python', [shimPath], {
+            encoding: 'utf8',
+        });
+        assert.equal(shimResult.status, 0);
+        assert.match(shimResult.stderr, /advisory hook nonzero_advisory returned non-zero: 1/);
+    } finally {
+        rmSync(temporaryRoot, { recursive: true, force: true });
+    }
+});
+
+
+function runGeneratedAdvisoryModule(pythonModuleName, moduleSource) {
+    const { temporaryRoot, gitHooksDirectory } = makeTemporaryGitHooksDirectory();
+    try {
+        if (moduleSource !== null) {
+            writeFileSync(join(gitHooksDirectory, pythonModuleName + '.py'), moduleSource);
+        }
+        const shimPath = writeGitHookShim({
+            gitHooksDirectory,
+            gitNativeHookName: 'pre-commit',
+            pythonModuleName,
+        });
+        return spawnSync('python', [shimPath], {
+            encoding: 'utf8',
+        });
+    } finally {
+        rmSync(temporaryRoot, { recursive: true, force: true });
+    }
+}
+
+
+test('generated advisory shim reports a missing module and succeeds', () => {
+    const shimResult = runGeneratedAdvisoryModule('missing_advisory', null);
+    assert.equal(shimResult.status, 0);
+    assert.match(shimResult.stderr, /advisory hook missing_advisory failed: No module named/);
+});
+
+
+test('generated advisory shim reports a syntax error and succeeds', () => {
+    const shimResult = runGeneratedAdvisoryModule(
+        'broken_syntax',
+        'def main(:\n    return 1\n',
+    );
+    assert.equal(shimResult.status, 0);
+    assert.match(shimResult.stderr, /advisory hook broken_syntax failed:/);
+});
+
+
+test('generated advisory shim reports ordinary SystemExit and succeeds', () => {
+    const shimResult = runGeneratedAdvisoryModule(
+        'ordinary_exit',
+        'def main():\n    raise SystemExit(1)\n',
+    );
+    assert.equal(shimResult.status, 0);
+    assert.match(shimResult.stderr, /advisory hook ordinary_exit failed: 1/);
+});
+
+
+test('generated advisory shim treats successful SystemExit as silent success', () => {
+    for (const [pythonModuleName, moduleSource] of [
+        ['zero_exit', 'def main():\n    raise SystemExit(0)\n'],
+        ['empty_exit', 'def main():\n    raise SystemExit()\n'],
+    ]) {
+        const shimResult = runGeneratedAdvisoryModule(pythonModuleName, moduleSource);
+        assert.equal(shimResult.status, 0);
+        assert.equal(shimResult.stderr, '');
+    }
+});
+
+
+test('generated advisory shim preserves cancellation SystemExit 130', () => {
+    const shimResult = runGeneratedAdvisoryModule(
+        'cancelled_exit',
+        'def main():\n    raise SystemExit(130)\n',
+    );
+    assert.equal(shimResult.status, 130);
+    assert.doesNotMatch(shimResult.stderr, /advisory hook cancelled_exit/);
+});
+
+
+test('generated advisory shim preserves KeyboardInterrupt cancellation', () => {
+    const shimResult = runGeneratedAdvisoryModule(
+        'keyboard_cancel',
+        'def main():\n    raise KeyboardInterrupt()\n',
+    );
+    assert.notEqual(shimResult.status, 0);
+    assert.match(shimResult.stderr, /KeyboardInterrupt/);
+});

package/bin/install-session-continuity.mjs

@@ -0,0 +1,88 @@
+import { existsSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const supportedHosts = ['claude', 'codex', 'cursor'];
+
+export function continuityHookConfiguration(host, script) {
+    if (!supportedHosts.includes(host)) throw new Error(`Unsupported host ${host}`);
+    if (/[\r\n"`$%]/.test(script)) throw new Error('Hook script path contains shell expansion characters');
+    const command = `node "${script.replace(/\\/g, '/')}" hook ${host}`;
+    if (host === 'cursor') {
+        return Object.fromEntries(['sessionStart', 'beforeSubmitPrompt', 'preCompact', 'postToolUse'].map(event => [event, [{ command }]]));
+    }
+    const events = host === 'claude' ? ['UserPromptSubmit', 'UserPromptExpansion', 'SessionStart'] : ['UserPromptSubmit', 'SessionStart'];
+    return Object.fromEntries(events.map(event => [event, [{
+        ...(event === 'SessionStart' ? { matcher: host === 'claude' ? 'startup|resume|compact|clear|fork' : 'startup|resume|compact|clear' } : {}),
+        ...(event === 'UserPromptExpansion' ? { matcher: '^(pstack:)?poteto-mode$|^(claude-dev-env:)?session-continuity$' } : {}),
+        hooks: [{ type: 'command', command, timeout: 10 }],
+    }]]));
+}
+
+export function mergeContinuityHooks(existing, host, script) {
+    const additions = continuityHookConfiguration(host, script);
+    const mergedConfiguration = structuredClone(existing);
+    if (host === 'cursor') mergedConfiguration.version = 1;
+    mergedConfiguration.hooks ||= {};
+    for (const [event, groups] of Object.entries(additions)) {
+        const current = mergedConfiguration.hooks[event] || [];
+        const command = host === 'cursor' ? groups[0].command : groups[0].hooks[0].command;
+        for (const entry of current) {
+            for (const hook of entry.hooks || [entry]) {
+                if (hook.command?.includes('/session-continuity/continuity.mjs') && hook.command !== command) {
+                    throw new Error('Another continuity installation owns this host config. Select its profile or remove that installation explicitly.');
+                }
+            }
+        }
+        const kept = current.flatMap(entry => {
+            if (host === 'cursor') return entry.command === command ? [] : [entry];
+            const hooks = (entry.hooks || []).filter(hook => hook.command !== command);
+            return hooks.length ? [{ ...entry, hooks }] : [];
+        });
+        mergedConfiguration.hooks[event] = kept.concat(groups);
+    }
+    return mergedConfiguration;
+}
+
+async function main() {
+    const requested = process.argv.slice(2);
+    const selected = requested.length ? requested : supportedHosts;
+    const unsupported = selected.find(host => !supportedHosts.includes(host));
+    if (unsupported) throw new Error(`Unsupported host ${unsupported}`);
+    const { resolveInstallRoot } = await import('./resolve-install-root.mjs');
+    const roots = resolveInstallRoot();
+    const script = join(roots.skillsInstallDirectory, 'session-continuity', 'continuity.mjs');
+    if (!existsSync(script) || !existsSync(join(dirname(script), 'SKILL.md'))) {
+        throw new Error('Run the full claude-dev-env installer from this checkout first so the companion is in the canonical agents home.');
+    }
+    const paths = {
+        claude: join(roots.managedRoot, 'settings.json'),
+        codex: join(dirname(roots.codexRulesInstallDirectory), 'hooks.json'),
+        cursor: join(roots.cursorInstallDirectory, 'hooks.json'),
+    };
+    const plans = selected.map(host => {
+        const path = paths[host];
+        if (!existsSync(dirname(path))) throw new Error(`Host config directory is absent: ${dirname(path)}`);
+        const existing = existsSync(path) ? readFileSync(path, 'utf8') : null;
+        return { path, existing, content: JSON.stringify(mergeContinuityHooks(existing ? JSON.parse(existing) : {}, host, script), null, 2) + '\n' };
+    });
+    for (const plan of plans) {
+        if (plan.existing === plan.content) { console.log(`Already configured: ${plan.path}`); continue; }
+        if (plan.existing !== null) {
+            const backup = `${plan.path}.before-session-continuity`;
+            if (!existsSync(backup)) writeFileSync(backup, plan.existing, { flag: 'wx', mode: 0o600 });
+        }
+        const current = existsSync(plan.path) ? readFileSync(plan.path, 'utf8') : null;
+        if (current !== plan.existing) throw new Error(`Config changed during setup: ${plan.path}. Rerun setup.`);
+        const temporary = `${plan.path}.continuity-${process.pid}.tmp`;
+        writeFileSync(temporary, plan.content, { flag: 'wx', mode: 0o600 });
+        renameSync(temporary, plan.path);
+        if (readFileSync(plan.path, 'utf8') !== plan.content) throw new Error(`Config read-back mismatch: ${plan.path}`);
+        console.log(`Configured and read back: ${plan.path}`);
+    }
+    console.log('Review and trust the new hooks in each host.');
+}
+
+if (process.argv[1] && resolve(realpathSync(process.argv[1])) === fileURLToPath(import.meta.url)) {
+    main().catch(error => { console.error(error.message); process.exitCode = 1; });
+}

package/bin/install-session-continuity.test.mjs

@@ -0,0 +1,55 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { continuityHookConfiguration, mergeContinuityHooks } from './install-session-continuity.mjs';
+
+test('setup preserves other hooks and settings, is idempotent, and rejects competing profiles', () => {
+    const existing = { permissions: { deny: ['secret'] }, hooks: { SessionStart: [{ hooks: [{ type: 'command', command: 'existing-hook' }] }] } };
+    const script = '/home/jon/.agents/skills/session-continuity/continuity.mjs';
+    const first = mergeContinuityHooks(existing, 'claude', script);
+    assert.deepEqual(mergeContinuityHooks(first, 'claude', script), first);
+    assert.deepEqual(first.permissions, existing.permissions);
+    assert.equal(first.hooks.SessionStart[0].hooks[0].command, 'existing-hook');
+    assert.equal(existing.hooks.SessionStart.length, 1);
+    assert.throws(() => mergeContinuityHooks(first, 'claude', '/other/session-continuity/continuity.mjs'), /Another continuity installation/);
+    assert.throws(() => continuityHookConfiguration('claude', '/path/with$expansion/continuity.mjs'), /expansion/);
+});
+
+test('Cursor setup keeps other hooks, sets the file version, and stays idempotent', () => {
+    const existing = { hooks: { beforeShellExecution: [{ command: 'existing' }] } };
+    const script = '/home/jon/.agents/skills/session-continuity/continuity.mjs';
+    const first = mergeContinuityHooks(existing, 'cursor', script);
+    assert.equal(first.version, 1);
+    assert.equal(first.hooks.beforeShellExecution[0].command, 'existing');
+    assert.deepEqual(mergeContinuityHooks(first, 'cursor', script), first);
+    assert.equal(existing.hooks.beforeShellExecution.length, 1);
+    assert.throws(() => mergeContinuityHooks(first, 'cursor', '/other/session-continuity/continuity.mjs'), /Another continuity installation/);
+});
+
+test('Cursor setup registers only documented context-carrying events', () => {
+    const configuration = continuityHookConfiguration('cursor', '/home/jon/.agents/skills/session-continuity/continuity.mjs');
+    assert.deepEqual(Object.keys(configuration), ['sessionStart', 'beforeSubmitPrompt', 'preCompact', 'postToolUse']);
+    for (const entries of Object.values(configuration)) {
+        assert.equal(entries.length, 1);
+        assert.equal(entries[0].command, 'node "/home/jon/.agents/skills/session-continuity/continuity.mjs" hook cursor');
+    }
+});
+
+for (const host of ['claude', 'codex']) {
+    test(`${host}: setup registers only documented context-loading events`, () => {
+        const configuration = continuityHookConfiguration(host, '/home/jon/.agents/skills/session-continuity/continuity.mjs');
+        const expected = host === 'claude'
+            ? ['UserPromptSubmit', 'UserPromptExpansion', 'SessionStart']
+            : ['UserPromptSubmit', 'SessionStart'];
+        assert.deepEqual(Object.keys(configuration), expected);
+        for (const groups of Object.values(configuration)) {
+            assert.equal(groups.length, 1);
+            assert.equal(groups[0].hooks[0].type, 'command');
+            assert.equal(groups[0].hooks[0].command, `node "/home/jon/.agents/skills/session-continuity/continuity.mjs" hook ${host}`);
+        }
+        assert.equal(new RegExp(configuration.SessionStart[0].matcher).test('compact'), true);
+        if (host === 'claude') {
+            assert.equal(new RegExp(configuration.UserPromptExpansion[0].matcher).test('pstack:poteto-mode'), true);
+            assert.equal(new RegExp(configuration.UserPromptExpansion[0].matcher).test('explain-poteto-mode'), false);
+        }
+    });
+}

package/bin/install.codex-rules.test.mjs

@@ -185,7 +185,7 @@ test('the shipped Codex rules file has no production-scanner home-path findings'
     );
 });
 
-test('--only journal skips Codex rules; --only core copies them', () => {
+test('--only journal is rejected before Codex rules change; --only core copies them', () => {
     const homeDirectory = mkdtempSync(join(tmpdir(), 'cdev-codex-groups-'));
     try {
         const installedRulesPath = join(
@@ -194,7 +194,10 @@ test('--only journal skips Codex rules; --only core copies them', () => {
             CODEX_RULES_DIRECTORY_NAME,
             CODEX_RULES_SHIPPED_FILE_NAME,
         );
-        runInstaller(homeDirectory, ['--only', 'journal']);
+        assert.throws(
+            () => runInstaller(homeDirectory, ['--only', 'journal']),
+            error => error.status === 1 && /Unknown group\(s\): journal/.test(error.stderr),
+        );
         assert.equal(existsSync(installedRulesPath), false);
 
         runInstaller(homeDirectory, ['--only', 'core']);