claude-dev-env 1.58.0 → 1.60.0

package/skills/update/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: update
-description: Fast-forwards a local git repository's main branch to a remote's main, after confirming both the local repo path and the source remote through AskUserQuestion. Fetches the chosen remote, checks that the move is a true fast-forward (never a force, never a merge commit), and updates main whether or not main is the checked-out branch. Use when the user says "/update", "update main", "fast-forward main", "sync main from origin", "pull latest main into <path>", or "bring main up to date". Triggers on "/update", "update main", "fast-forward main", "sync main".
+description: Fast-forwards a local git repository's main branch to a remote's main, after confirming both the local repo path and the source remote through AskUserQuestion. Fetches the chosen remote, checks that the move is a true fast-forward (never a force, never a merge commit), and updates main whether or not main is the checked-out branch. When main is not the checked-out branch, it then offers to switch the checkout to main so the update reaches the files on disk. Use when the user says "/update", "update main", "fast-forward main", "sync main from origin", "pull latest main into <path>", or "bring main up to date". Triggers on "/update", "update main", "fast-forward main", "sync main".
 ---
 
 # update
 
 ## Overview
 
-Fast-forwards the local `main` branch of a given repository to a chosen remote's `main`. The move is always a true fast-forward: the skill fetches the remote, checks that local `main` is an ancestor of the remote's `main`, and advances the ref. It never forces, never creates a merge commit, and never touches any branch other than `main`.
+Fast-forwards the local `main` branch of a given repository to a chosen remote's `main`. The move is always a true fast-forward: the skill fetches the remote, checks that local `main` is an ancestor of the remote's `main`, and advances the ref. It never forces, never creates a merge commit, and never rewrites any branch other than `main`. When `main` is not the checked-out branch, a final confirmed step offers to switch the checkout to `main` so the new commits reach the files on disk — the only branch switch the skill makes, and only after the operator approves it.
 
 The repository is whatever path the user gives as the `/update <path>` argument. With no argument, the default is the current repository's top level. Either way the path is confirmed before any write.
 
@@ -121,11 +121,42 @@ git -C "<path>" status --short
 - **Checked-out branch.** When a branch other than `main` is checked out, say so plainly: the fast-forward moves a ref only and no file on disk changes. Code that runs from this checkout comes from the checked-out branch, not from `main`.
 - **Dirty tracked files.** List every modified tracked file from `status --short`. Uncommitted edits sit on top of the checked-out branch and are what runs — flag them, because a ref update can neither see nor repair them. When the tree is clean, report "working tree clean".
 
+### Phase 5 — Offer to land `main` on disk
+
+A fast-forward of the `main` ref leaves the files on disk untouched when another branch is checked out. The new commits exist in the repo but not in the working tree — the gap Phase 4 reports. This phase offers to close it.
+
+Skip this phase and finish when the checked-out branch is already `main`: the new commits are already on disk.
+
+Otherwise, when the checked-out branch is not `main`, run two safety checks before offering a switch:
+
+1. **Tree clean of tracked changes.** Read `git -C "<path>" status --porcelain` and treat any line that does not start with `??` as a change to a tracked file. If any exist, do not offer the switch: report that `main` moved in the ref only, that switching would risk the uncommitted work, and stop. Never stash, reset, or discard. Untracked files (lines starting with `??`) are fine — they carry across a switch.
+2. **`main` free to check out.** Read `git -C "<path>" worktree list`. If another worktree holds `main`, an in-place switch is impossible; report that path and stop.
+
+When both checks pass, ask **one** `AskUserQuestion` — header "Get on disk":
+
+- Recommended first choice, "Switch checkout to main": `git -C "<path>" checkout main` puts the new commits on disk. The branch you were on keeps its commits and is left unchanged.
+- Second choice, "Stay on `<branch>`": leave the checkout where it is. The update stays in the `main` ref only and reaches disk later.
+
+On "Switch", run:
+
+```
+git -C "<path>" checkout main
+```
+
+If `checkout` reports it would overwrite untracked files, stop and report those paths — never pass `-f`, which would drop the operator's untracked file. On success, confirm the branch and the tip now on disk:
+
+```
+git -C "<path>" branch --show-current
+git -C "<path>" log --oneline -1
+```
+
+On "Stay", report that `main` is current in the ref and the new content reaches disk only after a later switch.
+
 ## Constraints (non-negotiable)
 
 - **Fast-forward only.** If the remote's `main` is not a descendant of local `main`, stop. Never `--force`, never `branch -f`, never a merge commit. Divergence is a job for `/rebase`.
 - **Always confirm both** the path and the source remote first, even when the path is given as an argument. Skipping a confirmation is not allowed — the confirmation is the point of this skill.
-- **Touch only `main`.** Never switch the repo's checked-out branch. The single exception is advancing `main` in place when `main` is already checked out.
+- **Switch the checkout only with approval.** The fast-forward itself touches the `main` ref alone. Switching the checked-out branch to `main` happens only in Phase 5, only after the operator approves the `AskUserQuestion`, only with a tree clean of tracked changes, and never with `-f`. The skill never switches to any branch but `main`.
 - **Never discard local work.** A dirty tree blocks the in-place fast-forward; stop and report rather than stash or reset.
 
 ## Gotchas
@@ -135,12 +166,13 @@ git -C "<path>" status --short
 - `<remote>/main` only moves after an explicit `git fetch`. Fetch inside every run; never compare against a remote-tracking ref left over from an earlier fetch.
 - `origin` is not always the source of truth. When a fork is `origin` and the canonical repo is another remote (often `upstream`), the confirmed remote should be the canonical one, not whichever is named `origin`.
 - Quote the path on every command — `git -C "<path>"` — so paths with spaces or a NAS drive letter survive.
-- "Up to date" describes the `main` ref, not the running code. A checkout deployed on a feature branch, or carrying uncommitted edits, runs that branch plus those edits regardless of where `main` points. Phase 4's checkout-state report exists so the operator sees that gap on every run.
+- "Up to date" describes the `main` ref, not the running code. A checkout deployed on a feature branch, or carrying uncommitted edits, runs that branch plus those edits regardless of where `main` points. Phase 4's checkout-state report exists so the operator sees that gap on every run, and Phase 5 offers to close it.
+- `git checkout main` carries untracked files across unchanged, but refuses with "untracked working tree files would be overwritten" when an untracked file sits at a path `main` tracks. Phase 5 reports those paths and stops rather than passing `-f`, which would drop the operator's untracked file.
 
 ## What this skill does NOT do
 
 - Does not push, open a PR, or change any branch other than `main`.
-- Does not create or switch feature branches — that is `/fresh-branch`.
+- Does not create feature branches, and switches only to `main` (Phase 5, with approval) — creating or switching to any other branch is `/fresh-branch`.
 - Does not reconcile a diverged `main` — that is `/rebase`.
 
 ## File index

package/system-prompts/software-engineer.xml

@@ -215,7 +215,7 @@
   Before spawning any Agent or Task tool invocation, verify context sufficiency. Confirm the
   specific files, directories, or codebase areas involved; the constraints that apply; what
   success looks like; and that the task is unambiguous enough to delegate. When any of those
-  is unknown, investigate first using Read, Glob, or Zoekt MCP for code search — or ask the user.
+  is unknown, investigate first using Read, Glob, or Grep for code search — or ask the user.
 
   After confirming context, use the /prompt-generator skill to produce a structured prompt.
   Feed it the task description and goal, target files and directories, constraints and
@@ -224,7 +224,7 @@
 
   When multiple tool calls are mutually independent, make all calls in a single response.
   Sequence calls only when a later call requires an earlier call's result. Reading three files:
-  call all three Read operations at once. Running independent searches: launch all Zoekt MCP
+  call all three Read operations at once. Running independent searches: launch all Grep
   and Glob calls simultaneously. Use real parameter values only. When uncertain whether calls are
   independent, run them sequentially.
 </agent_workflow>
@@ -356,10 +356,6 @@
   Use dedicated tools for file operations: Read for reading files, Edit for modifying existing
   files, Write for creating new files, and Glob for finding files by pattern.
 
-  For code-content search in Zoekt-indexed trees, use Zoekt MCP tools:
-  mcp__zoekt__search, mcp__zoekt__search_symbols, mcp__zoekt__find_references,
-  mcp__zoekt__file_content.
-
   For file discovery on Windows, use Everything via es.exe.
 
   Reserve Bash for system commands and terminal operations that require shell execution.

package/hooks/blocking/content_search_to_zoekt_redirector.py

@@ -1,59 +0,0 @@
-#!/usr/bin/env python3
-"""PreToolUse hook: deny Grep, Search, and shell search in indexed trees; steer to Zoekt MCP."""
-
-import json
-import os
-import sys
-
-from content_search_zoekt_bash_block_reason import block_reason_for_bash_command
-from content_search_zoekt_block_payload import build_block_payload
-from content_search_zoekt_indexed_paths import is_in_indexed_repo, is_specific_file
-from content_search_zoekt_redirect_guidance import (
-    get_zoekt_redirect_guidance,
-    get_zoekt_redirect_reason_brief,
-)
-
-
-def main() -> None:
-    try:
-        input_data = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        sys.exit(0)
-
-    tool_name = input_data.get("tool_name", "")
-    tool_input = input_data.get("tool_input", {})
-
-    content_search_tools = frozenset({"Grep", "Search"})
-    block_reason = None
-
-    if tool_name in content_search_tools:
-        pattern = tool_input.get("pattern", "")
-        path = tool_input.get("path", "")
-
-        if not path:
-            path = os.getcwd()
-
-        if is_specific_file(path):
-            sys.exit(0)
-
-        if is_in_indexed_repo(path):
-            block_reason = f"{tool_name}(pattern: \"{pattern}\", path: \"{path}\")"
-
-    elif tool_name == "Bash":
-        command = tool_input.get("command", "")
-        block_reason = block_reason_for_bash_command(command)
-
-    if block_reason is None:
-        sys.exit(0)
-    short_label = f"blocked {block_reason}; use Zoekt MCP"
-    payload = build_block_payload(
-        brief_label=short_label,
-        permission_decision_reason=get_zoekt_redirect_reason_brief(),
-        additional_context=get_zoekt_redirect_guidance(),
-    )
-    print(json.dumps(payload))
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()

package/hooks/blocking/content_search_zoekt_bash_block_reason.py

@@ -1,25 +0,0 @@
-"""Match Bash one-liners that act as content search (grep, rg, findstr, etc.)."""
-
-import re
-
-
-def block_reason_for_bash_command(command: str) -> str | None:
-    bash_content_search_patterns = (
-        (re.compile(r"^\s*grep\s", re.IGNORECASE), "grep"),
-        (re.compile(r"^\s*grep$", re.IGNORECASE), "grep"),
-        (re.compile(r"\|\s*grep\s", re.IGNORECASE), "piped grep"),
-        (re.compile(r"\|\s*grep$", re.IGNORECASE), "piped grep"),
-        (re.compile(r"^\s*rg\s", re.IGNORECASE), "ripgrep"),
-        (re.compile(r"^\s*rg$", re.IGNORECASE), "ripgrep"),
-        (re.compile(r"\|\s*rg\s", re.IGNORECASE), "piped ripgrep"),
-        (re.compile(r"^\s*findstr\s", re.IGNORECASE), "findstr"),
-        (re.compile(r"^\s*Select-String", re.IGNORECASE), "PowerShell Select-String"),
-        (re.compile(r"^\s*sls\s", re.IGNORECASE), "PowerShell sls"),
-        (re.compile(r"^\s*ack\s", re.IGNORECASE), "ack"),
-        (re.compile(r"^\s*ag\s", re.IGNORECASE), "silver searcher"),
-        (re.compile(r"^\s*git\s+grep\s", re.IGNORECASE), "git grep"),
-    )
-    for regex, command_name in bash_content_search_patterns:
-        if regex.search(command):
-            return f"Bash({command_name})"
-    return None

package/hooks/blocking/content_search_zoekt_block_payload.py

@@ -1,21 +0,0 @@
-"""JSON shape for Claude Code PreToolUse deny: hookSpecificOutput plus short systemMessage."""
-
-
-def build_block_payload(
-    brief_label: str,
-    permission_decision_reason: str,
-    additional_context: str | None = None,
-) -> dict:
-    destructive_gate_label_prefix = "[destructive-gate]"
-    hook_specific_output: dict = {
-        "hookEventName": "PreToolUse",
-        "permissionDecision": "deny",
-        "permissionDecisionReason": permission_decision_reason,
-    }
-    if additional_context is not None:
-        hook_specific_output["additionalContext"] = additional_context
-    return {
-        "hookSpecificOutput": hook_specific_output,
-        "systemMessage": f"{destructive_gate_label_prefix} {brief_label}",
-        "suppressOutput": True,
-    }

package/hooks/blocking/content_search_zoekt_indexed_paths.py

@@ -1,24 +0,0 @@
-"""Normalize paths and test membership under Zoekt-indexed roots (from env, JSON file, or defaults)."""
-
-import re
-
-
-def normalize_path(path: str) -> str:
-    return path.replace("\\", "/").lower()
-
-
-def is_specific_file(path: str) -> bool:
-    file_extension_pattern = re.compile(r"\.\w{1,10}$")
-    return bool(file_extension_pattern.search(path))
-
-
-def is_in_indexed_repo(path: str) -> bool:
-    from content_search_zoekt_indexed_roots_config import indexed_root_prefixes
-
-    norm = normalize_path(path)
-    if not norm.endswith("/"):
-        norm += "/"
-    for prefix in indexed_root_prefixes():
-        if norm.startswith(prefix):
-            return True
-    return False

package/hooks/blocking/content_search_zoekt_indexed_roots_config.py

@@ -1,131 +0,0 @@
-"""Resolve Zoekt-indexed filesystem roots from environment or JSON file (no built-in roots in this package)."""
-
-import json
-import os
-from functools import lru_cache
-from pathlib import Path
-
-from content_search_zoekt_indexed_paths import normalize_path
-
-
-def _environment_variable_indexed_roots() -> str:
-    return "ZOEKT_REDIRECT_INDEXED_ROOTS"
-
-
-def _environment_variable_roots_file() -> str:
-    return "ZOEKT_REDIRECT_INDEXED_ROOTS_FILE"
-
-
-def _json_object_roots_key() -> str:
-    return "roots"
-
-
-def _default_config_relative_parts() -> tuple[str, str]:
-    return (".claude", "zoekt-indexed-roots.json")
-
-
-def _built_in_fallback_roots() -> tuple[str, ...]:
-    return ()
-
-
-def _parse_json_roots_list(raw: str) -> list[str] | None:
-    try:
-        parsed = json.loads(raw)
-    except json.JSONDecodeError:
-        return None
-    if not isinstance(parsed, list):
-        return None
-    if not all(isinstance(item, str) for item in parsed):
-        return None
-    return list(parsed)
-
-
-def _config_file_path() -> Path:
-    override = os.environ.get(_environment_variable_roots_file())
-    if override is not None and override.strip() != "":
-        return Path(override).expanduser()
-    relative_dot_claude, relative_file_name = _default_config_relative_parts()
-    return Path.home() / relative_dot_claude / relative_file_name
-
-
-def _roots_from_json_file() -> list[str] | None:
-    path = _config_file_path()
-    if not path.is_file():
-        return None
-    try:
-        text = path.read_text(encoding="utf-8")
-    except OSError:
-        return None
-    try:
-        data = json.loads(text)
-    except json.JSONDecodeError:
-        return None
-    if not isinstance(data, dict):
-        return None
-    roots_key = _json_object_roots_key()
-    roots_value = data.get(roots_key)
-    if roots_value is None:
-        return None
-    if not isinstance(roots_value, list):
-        return None
-    if not all(isinstance(item, str) for item in roots_value):
-        return None
-    return list(roots_value)
-
-
-def _roots_from_environment_variable() -> list[str] | None:
-    variable_name = _environment_variable_indexed_roots()
-    if variable_name not in os.environ:
-        return None
-    raw = os.environ.get(variable_name, "")
-    if raw.strip() == "":
-        return []
-    parsed = _parse_json_roots_list(raw)
-    if parsed is None:
-        return None
-    return parsed
-
-
-def _expand_root_to_prefix_variants(root: str) -> list[str]:
-    trimmed = root.strip()
-    if trimmed == "":
-        return []
-    norm = normalize_path(trimmed)
-    if not norm.endswith("/"):
-        norm = norm + "/"
-    variants = [norm]
-    if len(norm) >= 3 and norm[1] == ":" and norm[0].isalpha() and norm[2] == "/":
-        drive_letter = norm[0]
-        remainder = norm[2:]
-        wsl_prefix = f"/mnt/{drive_letter}{remainder}"
-        if wsl_prefix not in variants:
-            variants.append(wsl_prefix)
-    return variants
-
-
-def _expand_all_roots(raw_roots: list[str]) -> tuple[str, ...]:
-    prefixes: list[str] = []
-    for root in raw_roots:
-        prefixes.extend(_expand_root_to_prefix_variants(root))
-    unique = frozenset(prefixes)
-    return tuple(sorted(unique, key=len, reverse=True))
-
-
-def _raw_roots_resolution_order() -> list[str]:
-    from_env = _roots_from_environment_variable()
-    if from_env is not None:
-        return from_env
-    from_file = _roots_from_json_file()
-    if from_file is not None:
-        return from_file
-    return list(_built_in_fallback_roots())
-
-
-@lru_cache(maxsize=1)
-def indexed_root_prefixes() -> tuple[str, ...]:
-    raw_roots = _raw_roots_resolution_order()
-    return _expand_all_roots(raw_roots)
-
-
-def clear_indexed_root_prefixes_cache() -> None:
-    indexed_root_prefixes.cache_clear()

package/hooks/blocking/content_search_zoekt_redirect_guidance.py

@@ -1,52 +0,0 @@
-"""Zoekt MCP usage and repo-to-disk path mapping for PreToolUse outputs."""
-
-
-def get_zoekt_redirect_reason_brief() -> str:
-    return (
-        "Use Zoekt MCP (e.g. mcp__zoekt__search) instead of Grep/Search in Zoekt-indexed trees."
-    )
-
-
-def worktree_path_filter_fragment() -> str:
-    return "\\.claude/worktrees/"
-
-
-def worktree_path_display_fragment() -> str:
-    return ".claude/worktrees/"
-
-
-def get_zoekt_redirect_guidance() -> str:
-    worktree_filter_fragment = worktree_path_filter_fragment()
-    worktree_display_fragment = worktree_path_display_fragment()
-    return (
-        "Use Zoekt MCP instead: mcp__zoekt__search(query=\"your pattern\"). "
-        "Supports regex, 'file:pattern' for file filtering, 'lang:py' for language. "
-        "Also available: mcp__zoekt__search_symbols, mcp__zoekt__find_references, mcp__zoekt__file_content. "
-        "Example: mcp__zoekt__search(query=\"verify_theme_assets file:\\.py$\")\n\n"
-        "WORKTREE NOISE: indexed trees include git worktrees under "
-        + worktree_display_fragment
-        + " that duplicate the same code across branches. By default append '-file:"
-        + worktree_filter_fragment
-        + "' to each query so results stay on the primary checkout. When the user explicitly "
-        "asks about a worktree, branch, or PR checkout, drop that exclusion or filter to it "
-        "positively, e.g. mcp__zoekt__search(query=\"your pattern file:"
-        + worktree_filter_fragment
-        + "<branch>/\").\n\n"
-        "INDEX FRESHNESS: the index trails just-written code — recent or unpushed commits sync and reindex "
-        "on a short delay, so a symbol you just added can be missing from Zoekt for a few minutes even though "
-        "it is on disk. Worktrees are fully indexed and retrievable with the positive 'file:"
-        + worktree_filter_fragment
-        + "<branch>/' filter above, but that same lag applies to anything freshly edited. When a Zoekt search "
-        "returns nothing for code you know exists on disk, do not treat it as absent: Grep a specific file "
-        "(a path ending in a file extension is exempt from this redirect) or read the file directly to confirm "
-        "current contents.\n\n"
-        "INDEX ROOTS (when Grep/Search in a tree is redirected): set ZOEKT_REDIRECT_INDEXED_ROOTS to a JSON array "
-        "of absolute paths, or ~/.claude/zoekt-indexed-roots.json as {\"roots\": [\"/abs/path/to/repo/\", ...]}. "
-        "Optional ZOEKT_REDIRECT_INDEXED_ROOTS_FILE points to a different JSON file. "
-        "WSL /mnt/<drive>/... prefixes are derived from Windows roots automatically. "
-        "This package ships no built-in roots (public repo); you must configure roots locally.\n\n"
-        "ZOEKT REPO LABEL -> LOCAL DISK (for editing files after a Zoekt hit): "
-        "keep the same directories in zoekt-indexed-roots.json as you index in Zoekt. "
-        "Example pattern only — yours will differ: if Zoekt shows \"acme-lib - src/foo.py\" and that repo "
-        "lives at /srv/checkout/acme-lib/ on your machine, edit /srv/checkout/acme-lib/src/foo.py."
-    )

package/hooks/blocking/test_content_search_to_zoekt_redirector_integration.py

@@ -1,61 +0,0 @@
-"""Subprocess integration tests for content-search-to-zoekt-redirector PreToolUse hook."""
-
-import json
-import pathlib
-import subprocess
-import sys
-import unittest
-from typing import Any
-
-
-class ContentSearchHookIntegrationTests(unittest.TestCase):
-    def test_bash_grep_command_emits_stdout_json_deny(self) -> None:
-        hook_directory = pathlib.Path(__file__).resolve().parent
-        if str(hook_directory) not in sys.path:
-            sys.path.insert(0, str(hook_directory))
-        from content_search_zoekt_redirect_guidance import (
-            get_zoekt_redirect_guidance,
-            get_zoekt_redirect_reason_brief,
-        )
-
-        hook_path = hook_directory / "content_search_to_zoekt_redirector.py"
-        destructive_gate_label_prefix = "[destructive-gate]"
-        destructive_gate_label_prefix_value = f"{destructive_gate_label_prefix} "
-        expected_decision = "deny"
-        hook_stdin_payload = json.dumps(
-            {"tool_name": "Bash", "tool_input": {"command": "grep foo bar"}},
-        )
-
-        completed = subprocess.run(
-            [sys.executable, str(hook_path)],
-            input=hook_stdin_payload,
-            capture_output=True,
-            text=True,
-            cwd=str(hook_directory),
-        )
-        self.assertEqual(completed.returncode, 0)
-        self.assertEqual(completed.stderr, "")
-        payload: dict[str, Any] = json.loads(completed.stdout)
-        self.assertTrue(
-            payload["systemMessage"].startswith(destructive_gate_label_prefix_value),
-        )
-        self.assertEqual(
-            payload["hookSpecificOutput"]["permissionDecisionReason"],
-            get_zoekt_redirect_reason_brief(),
-        )
-        self.assertEqual(
-            payload["hookSpecificOutput"]["additionalContext"],
-            get_zoekt_redirect_guidance(),
-        )
-        self.assertEqual(
-            payload["hookSpecificOutput"]["permissionDecision"],
-            expected_decision,
-        )
-        self.assertEqual(
-            payload["hookSpecificOutput"]["hookEventName"],
-            "PreToolUse",
-        )
-
-
-if __name__ == "__main__":
-    unittest.main()

package/hooks/blocking/test_content_search_to_zoekt_redirector_unit.py

@@ -1,92 +0,0 @@
-"""Unit tests for Zoekt redirector PreToolUse deny payload (build_block_payload)."""
-
-import json
-import pathlib
-import sys
-import unittest
-from typing import Any
-
-HOOK_DIRECTORY = pathlib.Path(__file__).resolve().parent
-if str(HOOK_DIRECTORY) not in sys.path:
-    sys.path.insert(0, str(HOOK_DIRECTORY))
-
-from content_search_zoekt_block_payload import build_block_payload
-from content_search_zoekt_redirect_guidance import (
-    get_zoekt_redirect_guidance,
-    get_zoekt_redirect_reason_brief,
-    worktree_path_display_fragment,
-    worktree_path_filter_fragment,
-)
-
-
-class BuildBlockPayloadTests(unittest.TestCase):
-    def test_payload_matches_pretooluse_contract(self) -> None:
-        destructive_gate_label_prefix = "[destructive-gate]"
-        payload: dict[str, Any] = build_block_payload("demo", "body")
-        prefix_with_space = f"{destructive_gate_label_prefix} "
-        self.assertTrue(payload["systemMessage"].startswith(prefix_with_space))
-        self.assertEqual(
-            payload["hookSpecificOutput"]["permissionDecisionReason"],
-            "body",
-        )
-        self.assertEqual(payload["hookSpecificOutput"]["permissionDecision"], "deny")
-        self.assertEqual(
-            payload["hookSpecificOutput"]["hookEventName"],
-            "PreToolUse",
-        )
-        self.assertEqual(payload["suppressOutput"], True)
-        self.assertNotIn("decision", payload)
-        self.assertNotIn("reason", payload)
-        self.assertNotIn("additionalContext", payload["hookSpecificOutput"])
-
-    def test_serialized_payload_under_documented_context_cap(self) -> None:
-        cap_characters = 10_000
-        payload = build_block_payload(
-            brief_label="blocked Bash(grep); use Zoekt MCP",
-            permission_decision_reason=get_zoekt_redirect_reason_brief(),
-            additional_context=get_zoekt_redirect_guidance(),
-        )
-        serialized = json.dumps(payload)
-        self.assertLessEqual(
-            len(serialized),
-            cap_characters,
-            msg="Hooks doc caps additionalContext/systemMessage/plain stdout injection at 10,000 characters",
-        )
-
-
-class RedirectGuidanceWorktreeTests(unittest.TestCase):
-    def test_guidance_defaults_to_excluding_worktrees(self) -> None:
-        guidance = get_zoekt_redirect_guidance()
-        expected_default_exclusion = f"-file:{worktree_path_filter_fragment()}"
-        self.assertIn(expected_default_exclusion, guidance)
-
-    def test_guidance_explains_how_to_search_a_worktree(self) -> None:
-        guidance = get_zoekt_redirect_guidance()
-        positive_filter_example = (
-            f'query="your pattern file:{worktree_path_filter_fragment()}<branch>/'
-        )
-        self.assertIn(positive_filter_example, guidance)
-        self.assertIn("worktree", guidance.lower())
-
-    def test_worktree_filter_fragment_is_a_regex_escaped_path(self) -> None:
-        self.assertEqual(worktree_path_filter_fragment(), "\\.claude/worktrees/")
-
-    def test_guidance_describes_worktree_path_unescaped_in_prose(self) -> None:
-        guidance = get_zoekt_redirect_guidance()
-        prose_substring = (
-            f"git worktrees under {worktree_path_display_fragment()} that"
-        )
-        self.assertIn(prose_substring, guidance)
-
-    def test_worktree_display_fragment_is_the_unescaped_path(self) -> None:
-        self.assertEqual(worktree_path_display_fragment(), ".claude/worktrees/")
-
-    def test_guidance_documents_index_freshness_escape_hatch(self) -> None:
-        guidance = get_zoekt_redirect_guidance()
-        self.assertIn("INDEX FRESHNESS:", guidance)
-        self.assertIn("exempt from this redirect", guidance)
-        self.assertIn("read the file directly", guidance)
-
-
-if __name__ == "__main__":
-    unittest.main()