claude-dev-env 1.41.0 → 1.43.0

package/scripts/sweep_empty_dirs.py

@@ -16,7 +16,7 @@ import os
 import sys
 import time
 
-from config.timing import DEFAULT_AGE_SECONDS, DEFAULT_POLL_INTERVAL
+from dev_env_scripts_constants.timing import DEFAULT_AGE_SECONDS, DEFAULT_POLL_INTERVAL
 
 
 def _positive_int(raw_argument: str) -> int:
@@ -42,6 +42,15 @@ def sweep(root: str, min_age_seconds: int) -> list[str]:
     Walks bottom-up so nested empty directories are cleaned from the leaves
     inward.  Relies on os.rmdir to fail harmlessly for non-empty directories
     instead of checking snapshotted subdirectory lists.
+
+    Args:
+        root: Root directory to walk; directories below the root are
+            candidates for removal.
+        min_age_seconds: Minimum age in seconds for a directory to qualify
+            for removal.
+
+    Returns:
+        Sorted list of directory paths that were removed during the sweep.
     """
 
     all_removed: list[str] = []

package/scripts/test_setup_project_paths.py

@@ -22,8 +22,8 @@ for each_sys_path_entry in (
 
 import setup_project_paths as setup
 import untracked_repo_detector as detector_module
-from config.project_paths_reader import registry_file_path
-from config.setup_project_paths_constants import (
+from hooks_constants.project_paths_reader import registry_file_path
+from hooks_constants.setup_project_paths_constants import (
     ABORTED_NOTHING_WRITTEN_MESSAGE,
     CONFIRMATION_PROMPT_TEXT,
     ES_EXE_FOLDERS_ONLY_QUERY_ARGUMENTS,

package/scripts/test_sweep_empty_dirs.py

@@ -15,10 +15,6 @@ _SCRIPTS_DIR = Path(os.path.abspath(__file__)).parent
 if str(_SCRIPTS_DIR) not in sys.path:
     sys.path.insert(0, str(_SCRIPTS_DIR))
 
-for _cached in list(sys.modules):
-    if _cached == "config" or _cached.startswith("config."):
-        del sys.modules[_cached]
-
 from sweep_empty_dirs import _build_parser, _positive_int, sweep  # noqa: E402
 
 _OLD_TIMESTAMP = time.time() - 300
@@ -53,7 +49,7 @@ def test_positive_int_rejects_non_integer() -> None:
 
 
 def test_build_parser_sets_age_default_from_timing_config() -> None:
-    """_build_parser uses DEFAULT_AGE_SECONDS from config.timing as --age default."""
+    """_build_parser uses DEFAULT_AGE_SECONDS from dev_env_scripts_constants.timing as --age default."""
     parser = _build_parser()
     default_age = parser.get_default("age")
     assert isinstance(default_age, int)
@@ -61,7 +57,7 @@ def test_build_parser_sets_age_default_from_timing_config() -> None:
 
 
 def test_build_parser_sets_interval_default_from_timing_config() -> None:
-    """_build_parser uses DEFAULT_POLL_INTERVAL from config.timing as --interval default."""
+    """_build_parser uses DEFAULT_POLL_INTERVAL from dev_env_scripts_constants.timing as --interval default."""
     parser = _build_parser()
     default_interval = parser.get_default("interval")
     assert isinstance(default_interval, int)

package/skills/_shared/pr-loop/scripts/_path_resolver.py

@@ -9,7 +9,7 @@ from __future__ import annotations
 import tempfile
 from pathlib import Path
 
-from config.path_resolver_constants import (
+from skills_pr_loop_constants.path_resolver_constants import (
     DIFF_PATCH_TEMPLATE,
     FIX_OUTCOME_XML_TEMPLATE,
     MULTI_PR_SLUG_TEMPLATE,

package/skills/_shared/pr-loop/scripts/build_audit_prompt.py

@@ -19,7 +19,7 @@ if str(_self_dir) not in sys.path:
     sys.path.insert(0, str(_self_dir))
 
 from _xml_utils import emit_pretty_xml
-from config.path_resolver_constants import (
+from skills_pr_loop_constants.path_resolver_constants import (
     ALL_AUDIT_CATEGORY_ENTRIES,
     ALL_AUDIT_CONSTRAINT_TEXTS,
 )

package/skills/_shared/pr-loop/scripts/build_fix_prompt.py

@@ -21,7 +21,7 @@ if str(_self_dir) not in sys.path:
 
 from _cli_utils import require_file
 from _xml_utils import emit_pretty_xml
-from config.path_resolver_constants import (
+from skills_pr_loop_constants.path_resolver_constants import (
     ALL_FIX_CONSTRAINT_TEXTS,
     ALL_FIX_EXECUTION_STEPS,
 )

package/skills/_shared/pr-loop/scripts/init_loop_state.py

@@ -20,7 +20,7 @@ from _path_resolver import (
     per_pr_workspace,
     resolve_run_temp_dir,
 )
-from config.path_resolver_constants import LOOP_STATE_JSON_INDENT
+from skills_pr_loop_constants.path_resolver_constants import LOOP_STATE_JSON_INDENT
 
 
 def create_loop_state(

package/skills/_shared/pr-loop/scripts/teardown_worktrees.py

@@ -24,7 +24,7 @@ if str(_self_dir) not in sys.path:
     sys.path.insert(0, str(_self_dir))
 
 from _path_resolver import per_pr_workspace
-from config.path_resolver_constants import ALL_PYTHON_ONEXC_VERSION
+from skills_pr_loop_constants.path_resolver_constants import ALL_PYTHON_ONEXC_VERSION
 
 
 def _remove_readonly_attribute(

package/skills/_shared/pr-loop/scripts/write_audit_outcomes.py

@@ -19,7 +19,7 @@ if str(_self_dir) not in sys.path:
 from _cli_utils import require_file
 from _path_resolver import outcome_xml_path
 from _xml_utils import emit_pretty_xml
-from config.path_resolver_constants import ALL_FINDING_BODY_ELEMENT_KEYS
+from skills_pr_loop_constants.path_resolver_constants import ALL_FINDING_BODY_ELEMENT_KEYS
 
 
 def build_audit_xml(
@@ -70,7 +70,7 @@ def _populate_findings(parent: Element, findings_data: list[dict[str, object]])
 
     Scalar finding fields become XML attributes on `<finding>`; the
     body fields named in `ALL_FINDING_BODY_ELEMENT_KEYS` (defined in
-    `packages/claude-dev-env/skills/_shared/pr-loop/scripts/config/path_resolver_constants.py`
+    `packages/claude-dev-env/skills/_shared/pr-loop/scripts/skills_pr_loop_constants/path_resolver_constants.py`
     and currently `("title", "excerpt", "description")`) become child elements.
     Nested dicts or lists in scalar slots are flattened to string form
     so attribute serialization stays well-defined.

package/skills/_shared/pr-loop/scripts/write_fix_outcomes.py

@@ -1,7 +1,7 @@
 """Validate status enum values and write <bugteam_fix> XML at the canonical path.
 
 Status enum (canonical source: `ALL_VALID_FIX_STATUSES` in
-`packages/claude-dev-env/skills/_shared/pr-loop/scripts/config/path_resolver_constants.py`):
+`packages/claude-dev-env/skills/_shared/pr-loop/scripts/skills_pr_loop_constants/path_resolver_constants.py`):
 fixed | could_not_address | hook_blocked | unverified_fixed.
 
 Each outcome's scalar fields become XML attributes on `<outcome>`; the
@@ -27,7 +27,7 @@ if str(_self_dir) not in sys.path:
 from _cli_utils import require_file
 from _path_resolver import fix_outcome_xml_path
 from _xml_utils import emit_pretty_xml
-from config.path_resolver_constants import (
+from skills_pr_loop_constants.path_resolver_constants import (
     ALL_FIX_OUTCOME_BODY_ELEMENT_KEYS,
     ALL_VALID_FIX_STATUSES,
 )

package/skills/bugteam/PROMPTS.md

@@ -108,7 +108,7 @@ cd into `<worktree_path>` before any git or file operation.
      teammate does NOT author the inline-comment body directly:
      `post_audit_thread.py` renders every body from
      `INLINE_COMMENT_BODY_TEMPLATE` (defined in
-     [`_shared/pr-loop/scripts/config/post_audit_thread_constants.py`](../../_shared/pr-loop/scripts/config/post_audit_thread_constants.py))
+     [`_shared/pr-loop/scripts/pr_loop_shared_constants/post_audit_thread_constants.py`](../../_shared/pr-loop/scripts/pr_loop_shared_constants/post_audit_thread_constants.py))
      — the template prepends `**[<severity>] <Skill> audit finding**`
      and renders the suggested-fix block, so a teammate who hand-formats
      a title or footer wastes the work.

package/skills/bugteam/SKILL.md

@@ -103,7 +103,7 @@ narrative) becomes `description`, and the suffix starting at `Fix:`
 When the agent omits the `Fix:` heading on a given finding, write the
 full `failure_mode` text to BOTH `description` and `fix_summary` so the
 script's body template (`INLINE_COMMENT_BODY_TEMPLATE` in
-[`_shared/pr-loop/scripts/config/post_audit_thread_constants.py`](../../_shared/pr-loop/scripts/config/post_audit_thread_constants.py))
+[`_shared/pr-loop/scripts/pr_loop_shared_constants/post_audit_thread_constants.py`](../../_shared/pr-loop/scripts/pr_loop_shared_constants/post_audit_thread_constants.py))
 still renders coherently. Set `side="RIGHT"` for every entry. On CLEAN,
 pass an empty array (`[]`) so the script posts an APPROVE review
 (GitHub stores it as `state=APPROVED`) with a "no findings" summary and

package/skills/bugteam/reference/github-pr-reviews.md

@@ -22,7 +22,7 @@ python "${CLAUDE_SKILL_DIR}/../../_shared/pr-loop/scripts/post_audit_thread.py"
 
 Capture `<head_sha>` via `git rev-parse HEAD` in the subagent cwd immediately before this call so the review attaches to the commit the audit actually scoped.
 
-`--findings-json` points to a JSON file whose root is a list of objects shaped `{path, line, side, severity, description, fix_summary}`. Build it from the merged Shape A findings: finding `file` → `path`. Each finding's `failure_mode` carries the full audit-to-fix handoff text per [`agents/code-quality-agent.md`](../../../agents/code-quality-agent.md); split `failure_mode` at the literal `Fix:` heading so the failure narrative becomes `description` and the suffix beginning at `Fix:` (including the trailing `Validation:` clause) becomes `fix_summary`. When a finding's `failure_mode` omits the `Fix:` heading, write the full text to BOTH `description` and `fix_summary` so the script's body template (`INLINE_COMMENT_BODY_TEMPLATE` in [`packages/claude-dev-env/_shared/pr-loop/scripts/config/post_audit_thread_constants.py`](../../../_shared/pr-loop/scripts/config/post_audit_thread_constants.py)) renders coherently. Set `side="RIGHT"` for every entry. On CLEAN the list is empty (`[]`); on DIRTY the list carries one entry per finding.
+`--findings-json` points to a JSON file whose root is a list of objects shaped `{path, line, side, severity, description, fix_summary}`. Build it from the merged Shape A findings: finding `file` → `path`. Each finding's `failure_mode` carries the full audit-to-fix handoff text per [`agents/code-quality-agent.md`](../../../agents/code-quality-agent.md); split `failure_mode` at the literal `Fix:` heading so the failure narrative becomes `description` and the suffix beginning at `Fix:` (including the trailing `Validation:` clause) becomes `fix_summary`. When a finding's `failure_mode` omits the `Fix:` heading, write the full text to BOTH `description` and `fix_summary` so the script's body template (`INLINE_COMMENT_BODY_TEMPLATE` in [`packages/claude-dev-env/_shared/pr-loop/scripts/pr_loop_shared_constants/post_audit_thread_constants.py`](../../../_shared/pr-loop/scripts/pr_loop_shared_constants/post_audit_thread_constants.py)) renders coherently. Set `side="RIGHT"` for every entry. On CLEAN the list is empty (`[]`); on DIRTY the list carries one entry per finding.
 
 The script handles retries internally — 1s / 4s / 16s backoff across four attempts (one initial plus three retries). Exit codes:
 

package/skills/bugteam/scripts/{_claude_permissions_common.py → _bugteam_permissions_common.py}

@@ -12,27 +12,17 @@ import json
 import os
 import stat
 import sys
+from collections.abc import Callable
 from pathlib import Path
 from typing import NoReturn
 
-_previously_cached_config = {}
-for each_cached_module_name in [
-    each_module_key
-    for each_module_key in list(sys.modules)
-    if each_module_key == "config" or each_module_key.startswith("config.")
-]:
-    _previously_cached_config[each_cached_module_name] = sys.modules.pop(
-        each_cached_module_name
-    )
-
-from config.claude_permissions_common_constants import (
+from bugteam_scripts_constants.claude_permissions_common_constants import (
+    ALL_TRUST_ENTRY_PROJECT_PATH_BOUNDARY_QUOTE_CHARACTERS,
     ATOMIC_WRITE_TEMPORARY_SUFFIX,
     DEFAULT_SETTINGS_FILE_MODE,
     TEXT_FILE_ENCODING,
 )
 
-sys.modules.update(_previously_cached_config)
-
 
 def exit_with_error(message: str) -> NoReturn:
     print(f"Error: {message}", file=sys.stderr)
@@ -105,6 +95,113 @@ def build_permission_rules(
     ]
 
 
+def build_agent_config_deny_rule(
+    tool_name: str, project_path: str, agent_config_path_pattern: str
+) -> str:
+    """Construct a deny rule for a single agent-config path pattern.
+
+    Args:
+        tool_name: The permission tool name (e.g., "Edit", "Write", "Read").
+        project_path: The POSIX-style project root path.
+        agent_config_path_pattern: The agent-config path pattern under .claude/.
+
+    Returns:
+        The deny rule string Claude Code matches against tool invocations.
+    """
+    return f"{tool_name}({project_path}/.claude/{agent_config_path_pattern})"
+
+
+def build_agent_config_deny_rules(
+    project_path: str,
+    all_permission_allow_tools: tuple[str, ...],
+    all_agent_config_path_patterns: tuple[str, ...],
+) -> list[str]:
+    """Construct deny rules covering every tool and pattern pair.
+
+    Args:
+        project_path: The POSIX-style project root path.
+        all_permission_allow_tools: Tool names to build deny rules for.
+        all_agent_config_path_patterns: Agent-config path patterns to deny under .claude/.
+
+    Returns:
+        List of deny rule strings, one per tool/pattern combination.
+    """
+    return [
+        build_agent_config_deny_rule(each_tool, project_path, each_pattern)
+        for each_tool in all_permission_allow_tools
+        for each_pattern in all_agent_config_path_patterns
+    ]
+
+
+def _is_project_path_token_at_word_boundary(
+    body_after_prefix: str, token_position: int
+) -> bool:
+    if token_position == 0:
+        return True
+    preceding_character = body_after_prefix[token_position - 1]
+    if preceding_character.isspace():
+        return True
+    return preceding_character in ALL_TRUST_ENTRY_PROJECT_PATH_BOUNDARY_QUOTE_CHARACTERS
+
+
+def is_trust_entry_for_project(
+    candidate_entry: object, project_path: str, prefix: str
+) -> bool:
+    """Detect whether an autoMode.environment entry is a trust entry for the project.
+
+    The predicate matches any string entry whose prefix matches the trust-entry
+    marker and that contains the project's .claude/** path token anchored on a
+    non-path boundary (the start of the body after the prefix, a whitespace
+    character, or a quote character). The boundary anchor prevents
+    cross-project false positives where the current project's path is a path
+    suffix of an unrelated entry's path. The exact wording after the prefix is
+    allowed to vary between template revisions.
+
+    Args:
+        candidate_entry: The autoMode.environment list value to inspect.
+        project_path: The POSIX-style project root path.
+        prefix: The literal prefix that marks a trust entry.
+
+    Returns:
+        True when the entry is a prior trust entry for this project.
+    """
+    if not isinstance(candidate_entry, str):
+        return False
+    if not candidate_entry.startswith(prefix):
+        return False
+    project_path_token = f"{project_path}/.claude/**"
+    body_after_prefix = candidate_entry[len(prefix):]
+    token_position = body_after_prefix.find(project_path_token)
+    while token_position != -1:
+        if _is_project_path_token_at_word_boundary(body_after_prefix, token_position):
+            return True
+        next_search_start = token_position + 1
+        token_position = body_after_prefix.find(project_path_token, next_search_start)
+    return False
+
+
+def remove_matching_entries_from_list(
+    all_target_list: list[object],
+    match_predicate: Callable[[object], bool],
+) -> int:
+    """Remove every entry from a list that satisfies the predicate.
+
+    Args:
+        all_target_list: The list to filter in place.
+        match_predicate: Function returning True for entries to remove.
+
+    Returns:
+        Number of entries removed.
+    """
+    original_length = len(all_target_list)
+    all_target_list[:] = [
+        each_value
+        for each_value in all_target_list
+        if not match_predicate(each_value)
+    ]
+    return original_length - len(all_target_list)
+
+
 def load_settings(settings_path: Path) -> dict[str, object]:
     """Read and parse a JSON settings file from disk.
 

package/skills/bugteam/scripts/bugteam_code_rules_gate.py

@@ -11,17 +11,7 @@ from pathlib import Path
 
 ValidateContentCallable = Callable[..., list[str]]
 
-_previously_cached_config = {}
-for each_cached_module_name in [
-    each_module_key
-    for each_module_key in list(sys.modules)
-    if each_module_key == "config" or each_module_key.startswith("config.")
-]:
-    _previously_cached_config[each_cached_module_name] = sys.modules.pop(
-        each_cached_module_name
-    )
-
-from config.bugteam_code_rules_gate_constants import (
+from bugteam_scripts_constants.bugteam_code_rules_gate_constants import (
     ALL_CODE_FILE_EXTENSIONS,
     ALL_COLUMN_MAGIC_FALSE_VALUES,
     ALL_GIT_DIFF_CACHED_ARGS,
@@ -34,8 +24,6 @@ from config.bugteam_code_rules_gate_constants import (
     VIOLATION_LINE_RAW_PATTERN,
 )
 
-sys.modules.update(_previously_cached_config)
-
 
 def hunk_header_pattern() -> re.Pattern[str]:
     return re.compile(HUNK_HEADER_RAW_PATTERN)

package/skills/bugteam/scripts/bugteam_fix_hookspath.py

@@ -5,22 +5,7 @@ import subprocess
 import sys
 from pathlib import Path
 
-parent_directory = str(Path(__file__).resolve().parent)
-try:
-    sys.path.remove(parent_directory)
-except ValueError:
-    pass
-if parent_directory not in sys.path:
-    sys.path.insert(0, parent_directory)
-
-for each_cached_module_name in [
-    each_module_key
-    for each_module_key in list(sys.modules)
-    if each_module_key == "config" or each_module_key.startswith("config.")
-]:
-    sys.modules.pop(each_cached_module_name, None)
-
-from config.bugteam_fix_hookspath_constants import (
+from bugteam_scripts_constants.bugteam_fix_hookspath_constants import (
     ALL_CANONICAL_HOOKS_DIRECTORY_COMPONENTS,
     ALL_GLOBAL_HOOKS_PATH_ARGUMENTS,
     ALL_HOME_ENV_VAR_NAMES,

package/skills/bugteam/scripts/bugteam_preflight.py

@@ -6,19 +6,13 @@ import subprocess
 import sys
 from pathlib import Path
 
-for each_cached_module_name in [
-    each_module_key
-    for each_module_key in list(sys.modules)
-    if each_module_key == "config" or each_module_key.startswith("config.")
-]:
-    sys.modules.pop(each_cached_module_name, None)
 _bugteam_scripts_directory = str(Path(__file__).absolute().parent)
 while _bugteam_scripts_directory in sys.path:
     sys.path.remove(_bugteam_scripts_directory)
 if _bugteam_scripts_directory not in sys.path:
     sys.path.insert(0, _bugteam_scripts_directory)
 
-from config.bugteam_preflight_constants import (
+from bugteam_scripts_constants.bugteam_preflight_constants import (
     ALL_DISCOVERY_IGNORE_DIRECTORIES,
     ALL_GIT_CONFIG_HOOKS_PATH_ARGUMENTS,
     ALL_PRE_COMMIT_ARGUMENTS,
@@ -35,12 +29,6 @@ from config.bugteam_preflight_constants import (
     PYTEST_INI_FILENAME,
 )
 
-for each_cached_module_name in [
-    each_module_key
-    for each_module_key in list(sys.modules)
-    if each_module_key == "config" or each_module_key.startswith("config.")
-]:
-    sys.modules.pop(each_cached_module_name, None)
 _shared_pr_loop_scripts_directory = (
     Path(__file__).absolute().parent
     / ".." / ".." / ".." / "_shared" / "pr-loop" / "scripts"

package/skills/bugteam/scripts/bugteam_scripts_constants/claude_permissions_common_constants.py

@@ -0,0 +1,69 @@
+"""Configuration constants for claude_permissions_common shared helpers."""
+
+from __future__ import annotations
+
+TEXT_FILE_ENCODING: str = "utf-8"
+ALL_PERMISSION_ALLOW_TOOLS: tuple[str, ...] = ("Edit", "Write", "Read")
+ALL_AGENT_CONFIG_DENY_TOOLS: tuple[str, ...] = ("Edit", "Write", "Read", "Glob")
+ALL_AGENT_CONFIG_PATH_PATTERNS: tuple[str, ...] = (
+    "settings*.json",
+    "hooks/**",
+    "commands/**",
+    "agents/**",
+    "skills/**",
+    "mcp.json",
+    "CLAUDE.md",
+)
+AUTO_MODE_ENVIRONMENT_ENTRY_PREFIX: str = "Trusted local workspace:"
+
+
+def _describe_agent_config_pattern_for_humans(agent_config_path_pattern: str) -> str:
+    glob_suffix_under_directory = "/**"
+    file_name_for_special_phrasing = "mcp.json"
+    if agent_config_path_pattern.endswith(glob_suffix_under_directory):
+        directory_name = agent_config_path_pattern[
+            : -len(glob_suffix_under_directory)
+        ]
+        return f"anything under {directory_name}/"
+    if agent_config_path_pattern == file_name_for_special_phrasing:
+        return f"the {file_name_for_special_phrasing} file"
+    return agent_config_path_pattern
+
+
+def _build_agent_config_pattern_phrase(
+    all_agent_config_path_patterns: tuple[str, ...],
+) -> str:
+    all_described_patterns: list[str] = [
+        _describe_agent_config_pattern_for_humans(each_pattern)
+        for each_pattern in all_agent_config_path_patterns
+    ]
+    if len(all_described_patterns) <= 1:
+        return ", ".join(all_described_patterns)
+    leading_phrase_parts = ", ".join(all_described_patterns[:-1])
+    final_phrase_part = all_described_patterns[-1]
+    return f"{leading_phrase_parts}, and {final_phrase_part}"
+
+
+_AGENT_CONFIG_PATTERN_PHRASE: str = _build_agent_config_pattern_phrase(
+    ALL_AGENT_CONFIG_PATH_PATTERNS
+)
+
+AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE: str = (
+    f"Trusted local workspace: Files under {{project_path}}/.claude/** inherit "
+    f"the workspace's trust for Edit, Write, Read, and Glob operations EXCEPT "
+    f"for agent-config files: {_AGENT_CONFIG_PATTERN_PHRASE}. Edits to those "
+    f"agent-config files always require explicit per-edit user approval."
+)
+
+ALL_TRUST_ENTRY_PROJECT_PATH_BOUNDARY_QUOTE_CHARACTERS: tuple[str, ...] = ('"', "'")
+ATOMIC_WRITE_TEMPORARY_SUFFIX: str = ".tmp"
+GIT_DIRECTORY_MARKER: str = ".git"
+CLAUDE_DIRECTORY_MARKER: str = ".claude"
+CLAUDE_USER_SETTINGS_FILENAME: str = "settings.json"
+DEFAULT_SETTINGS_FILE_MODE: int = 0o600
+SETTINGS_PERMISSIONS_KEY: str = "permissions"
+SETTINGS_ALLOW_KEY: str = "allow"
+SETTINGS_DENY_KEY: str = "deny"
+SETTINGS_ADDITIONAL_DIRECTORIES_KEY: str = "additionalDirectories"
+SETTINGS_AUTO_MODE_KEY: str = "autoMode"
+SETTINGS_ENVIRONMENT_KEY: str = "environment"