claude-dev-env 1.59.0 → 1.61.0

package/hooks/blocking/verifier_verdict_minter.py

@@ -0,0 +1,221 @@
+"""SubagentStop hook: mint a commit-gate verdict when code-verifier finishes.
+
+Only this hook writes verdict files — the main session is denied writes to
+the verdict directory, so a session cannot fabricate a passing verdict. The
+SubagentStop payload names the stopping subagent's own transcript
+(``agent_transcript_path``), which sits beside a harness-written
+``agent-<id>.meta.json`` sidecar naming the spawning ``agentType``. The hook
+reads that type from the sidecar, so it resolves identically in interactive,
+background, and worktree-switched sessions. When that type is
+``code-verifier``, the hook pulls the verdict block out of the agent's own
+transcript (``agent_transcript_path``); the main session writes neither that
+transcript nor the sidecar, so text it prints can never mint — recomputes the
+live change-surface hash for the session repository, and writes the verdict
+bound to that hash. The companion ``verified_commit_gate.py`` (PreToolUse)
+then allows ``git commit`` / ``git push`` only while the work tree still
+matches the verified state.
+
+The verifier's final message must end with a fenced block::
+
+    ```verdict
+    {"all_pass": true, "findings": []}
+    ```
+
+A missing or unparseable block mints nothing, which leaves the gate closed.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+from pathlib import Path
+
+blocking_directory = str(Path(__file__).resolve().parent)
+if blocking_directory not in sys.path:
+    sys.path.insert(0, blocking_directory)
+
+from config.verified_commit_constants import MINTING_AGENT_TYPE
+from verification_verdict_store import (
+    branch_surface_manifest,
+    manifest_sha256,
+    resolve_merge_base,
+    resolve_repo_root,
+    write_verdict,
+)
+
+
+def assistant_text_blocks(transcript_path: str) -> list[str]:
+    """Collect every assistant text block from a transcript JSONL file.
+
+    Args:
+        transcript_path: Path to the subagent's transcript.
+
+    Returns:
+        The text of each assistant content block, in transcript order;
+        empty when the file is missing or holds no assistant text.
+    """
+    collected_blocks: list[str] = []
+    try:
+        transcript_lines = (
+            Path(transcript_path).read_text(encoding="utf-8", errors="replace").splitlines()
+        )
+    except OSError:
+        return collected_blocks
+    for each_line in transcript_lines:
+        try:
+            transcript_entry = json.loads(each_line)
+        except json.JSONDecodeError:
+            continue
+        if not isinstance(transcript_entry, dict):
+            continue
+        if transcript_entry.get("type") != "assistant":
+            continue
+        message_body = transcript_entry.get("message")
+        if not isinstance(message_body, dict):
+            continue
+        content_blocks = message_body.get("content")
+        if not isinstance(content_blocks, list):
+            continue
+        for each_block in content_blocks:
+            if isinstance(each_block, dict) and each_block.get("type") == "text":
+                block_text = each_block.get("text")
+                if isinstance(block_text, str):
+                    collected_blocks.append(block_text)
+    return collected_blocks
+
+
+def last_verdict_in_blocks(all_text_blocks: list[str]) -> dict | None:
+    """Extract the final verdict fence from assistant text blocks.
+
+    Args:
+        all_text_blocks: Assistant text blocks in transcript order.
+
+    Returns:
+        The parsed verdict mapping carrying a boolean ``all_pass`` and a
+        list ``findings``, or None when no block holds a wellformed fence.
+    """
+    verdict_fence_pattern = re.compile(r"```verdict\s*\n(.*?)```", re.DOTALL)
+    fence_bodies: list[str] = []
+    for each_block in all_text_blocks:
+        fence_bodies.extend(verdict_fence_pattern.findall(each_block))
+    for each_fence_body in reversed(fence_bodies):
+        try:
+            verdict_record = json.loads(each_fence_body)
+        except json.JSONDecodeError:
+            continue
+        if not isinstance(verdict_record, dict):
+            continue
+        if not isinstance(verdict_record.get("all_pass"), bool):
+            continue
+        if not isinstance(verdict_record.get("findings"), list):
+            continue
+        return verdict_record
+    return None
+
+
+def _agent_type_from_meta_sidecar(agent_transcript_path: str) -> str | None:
+    """Read the spawning agentType from a subagent transcript's sidecar.
+
+    Each subagent transcript ``agent-<id>.jsonl`` sits beside a harness-written
+    ``agent-<id>.meta.json`` naming the spawning ``agentType``. Reading the type
+    from this sidecar binds it to the stopping subagent itself, so it resolves
+    identically in interactive, background, and worktree-switched sessions and
+    needs no parent-transcript scan or flush retry.
+
+    Args:
+        agent_transcript_path: The stopping subagent's own transcript path from
+            the SubagentStop payload.
+
+    Returns:
+        The recorded ``agentType``, or None when the path is empty, the sidecar
+        is absent or cannot be read or parsed, it does not hold a JSON object,
+        or it names no string ``agentType``.
+    """
+    if not agent_transcript_path:
+        return None
+    transcript_file = Path(agent_transcript_path)
+    sidecar_file = transcript_file.with_name(f"{transcript_file.stem}.meta.json")
+    try:
+        sidecar_record = json.loads(sidecar_file.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError):
+        return None
+    if not isinstance(sidecar_record, dict):
+        return None
+    recorded_type = sidecar_record.get("agentType")
+    return recorded_type if isinstance(recorded_type, str) else None
+
+
+def resolved_subagent_type(subagent_stop_payload: dict) -> str | None:
+    """Recover the spawning agent type for a SubagentStop payload.
+
+    The stopping subagent's own transcript (``agent_transcript_path``) sits
+    beside a harness-written ``agent-<id>.meta.json`` sidecar naming its
+    ``agentType``. Reading the type from that sidecar binds it to the subagent
+    itself, so it resolves the same across interactive, background, and
+    worktree-switched sessions.
+
+    Args:
+        subagent_stop_payload: The SubagentStop hook payload.
+
+    Returns:
+        The agent type this subagent was spawned with, or None when the
+        ``agent_transcript_path`` is empty, the sidecar is absent or cannot be
+        read or parsed, it does not hold a JSON object, or it names no string
+        ``agentType``.
+    """
+    return _agent_type_from_meta_sidecar(
+        subagent_stop_payload.get("agent_transcript_path", "")
+    )
+
+
+def mint_for_payload(subagent_stop_payload: dict) -> Path | None:
+    """Mint a verdict file for a code-verifier stop event.
+
+    Args:
+        subagent_stop_payload: The SubagentStop hook payload.
+
+    Returns:
+        The verdict file path when minted; None when the payload is not a
+        code-verifier stop, the transcript holds no verdict, or the
+        session directory is not a work tree with an upstream base.
+    """
+    if resolved_subagent_type(subagent_stop_payload) != MINTING_AGENT_TYPE:
+        return None
+    agent_transcript_path = subagent_stop_payload.get("agent_transcript_path", "")
+    if not agent_transcript_path:
+        return None
+    verdict_record = last_verdict_in_blocks(assistant_text_blocks(agent_transcript_path))
+    if verdict_record is None:
+        return None
+    repo_root = resolve_repo_root(subagent_stop_payload.get("cwd", "."))
+    if repo_root is None:
+        return None
+    merge_base_sha = resolve_merge_base(repo_root)
+    if merge_base_sha is None:
+        return None
+    surface_manifest_text = branch_surface_manifest(repo_root, merge_base_sha)
+    if surface_manifest_text is None:
+        return None
+    return write_verdict(
+        repo_root,
+        manifest_sha256(surface_manifest_text),
+        verdict_record["all_pass"],
+        verdict_record["findings"],
+        str(subagent_stop_payload.get("agent_id", "")),
+    )
+
+
+def main() -> None:
+    """Read the SubagentStop payload and mint a verdict when one applies."""
+    try:
+        subagent_stop_payload = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        return
+    if not isinstance(subagent_stop_payload, dict):
+        return
+    mint_for_payload(subagent_stop_payload)
+
+
+if __name__ == "__main__":
+    main()

package/hooks/diagnostic/test_hook_log_extractor.py

@@ -82,7 +82,7 @@ def _make_blocking_line(
     hook_event: str = "PreToolUse",
     tool_use_id: str = "toolu_002",
     blocking_message: str = "blocked for reason",
-    command: str = "python C:/Users/jon/.claude/hooks/blocking/content_search_to_zoekt_redirector.py",
+    command: str = "python C:/Users/jon/.claude/hooks/blocking/block_main_commit.py",
     timestamp: str = "2026-04-24T13:32:54.293Z",
     cwd: str = "Y:\\Projects\\repo",
     git_branch: str = "main",
@@ -640,7 +640,7 @@ def test_run_summary_prints_table_when_rows_returned(
 ) -> None:
     fake_cursor = MagicMock()
     fake_cursor.fetchall.return_value = [
-        ("content_search_to_zoekt_redirector.py", "blocking", 7, "Bash(grep foo)"),
+        ("block_main_commit.py", "blocking", 7, "Bash(git commit)"),
     ]
     fake_connection = MagicMock()
     fake_connection.cursor.return_value.__enter__.return_value = fake_cursor
@@ -652,7 +652,7 @@ def test_run_summary_prints_table_when_rows_returned(
 
     captured = capsys.readouterr()
     assert exit_code == 0
-    assert "content_search_to_zoekt_redirector.py" in captured.out
+    assert "block_main_commit.py" in captured.out
     assert "blocking" in captured.out
     assert "7" in captured.out
 

package/hooks/hooks.json

@@ -54,6 +54,11 @@
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/hook_prose_detector_consistency.py",
             "timeout": 10
+          },
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/verified_commit_message_accuracy_blocker.py",
+            "timeout": 10
           }
         ]
       },
@@ -118,7 +123,7 @@
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/precommit_code_rules_gate.py",
-            "timeout": 30
+            "timeout": 150
           },
           {
             "type": "command",
@@ -144,6 +149,31 @@
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/gh_pr_author_enforcer.py",
             "timeout": 30
+          },
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/verified_commit_gate.py",
+            "timeout": 15
+          },
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/verdict_directory_write_blocker.py",
+            "timeout": 10
+          }
+        ]
+      },
+      {
+        "matcher": "PowerShell",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/verified_commit_gate.py",
+            "timeout": 15
+          },
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/verdict_directory_write_blocker.py",
+            "timeout": 10
           }
         ]
       },
@@ -247,6 +277,18 @@
         ]
       }
     ],
+    "SubagentStop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/verifier_verdict_minter.py",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
     "SessionEnd": [
       {
         "matcher": "",

package/hooks/hooks_constants/blocking_check_limits.py

@@ -20,6 +20,7 @@ MAX_DOCSTRING_ARGS_SIGNATURE_ISSUES: int = 5
 MAX_IGNORED_MUST_CHECK_RETURN_ISSUES: int = 5
 MAX_TYPE_ESCAPE_HATCH_ISSUES: int = 5
 MAX_THIN_WRAPPER_ISSUES: int = 1
+MAX_ZERO_PAYLOAD_ALIAS_ISSUES: int = 3
 MAX_LOGGING_FSTRING_ISSUES: int = 3
 MAX_WINDOWS_API_NONE_ISSUES: int = 3
 MAX_E2E_TEST_NAMING_ISSUES: int = 3

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -124,6 +124,12 @@ KNOWN_PYTEST_FIXTURE_ANNOTATION_MESSAGE_SUFFIX: str = (
     "(CODE_RULES §6; pytest builtin fixture reference "
     "https://docs.pytest.org/en/stable/reference/fixtures.html)"
 )
+UNUSED_PYTEST_FIXTURE_PARAMETER_MESSAGE_SUFFIX: str = (
+    "known pytest fixture parameter is declared but never referenced in the "
+    "function body; pytest still materializes its setup, so drop the unused "
+    "parameter (pytest builtin fixture reference "
+    "https://docs.pytest.org/en/stable/reference/fixtures.html)"
+)
 ALL_LOOP_INDEX_LETTER_EXEMPTIONS: frozenset[str] = frozenset({"i", "j", "k", "_"})
 EACH_PREFIX = "each_"
 BARE_EACH_TOKEN = "each"

package/hooks/hooks_constants/dead_module_constant_constants.py

@@ -0,0 +1,20 @@
+"""Constants for the dead module-level constant detector in ``code_rules_enforcer``.
+
+Lives under the hooks-tree ``hooks_constants`` package so module-level
+UPPER_SNAKE constants satisfy the CODE_RULES "constants live in config"
+requirement and share a home with the other hook-tree configuration.
+"""
+
+PYTHON_SOURCE_SUFFIX: str = ".py"
+DUNDER_INIT_FILENAME: str = "__init__.py"
+CONSTANTS_MODULE_SUFFIX: str = "_constants.py"
+CONFIG_DIRECTORY_SEGMENT: str = "config"
+DUNDER_ALL_NAME: str = "__all__"
+MINIMUM_UPPER_SNAKE_LENGTH: int = 2
+MAX_DEAD_MODULE_CONSTANT_ISSUES: int = 25
+MAX_SCAN_ROOT_FILE_COUNT: int = 2000
+DEAD_MODULE_CONSTANT_GUIDANCE: str = (
+    "module-level constant is defined here but never imported or read by any"
+    " module in the enclosing package tree - remove the constant, or reference it"
+    " where its value is needed (CODE_RULES §9.8)"
+)

package/hooks/hooks_constants/destructive_command_segment_constants.py

@@ -41,6 +41,7 @@ ALL_INTERPRETER_AND_WRAPPER_COMMANDS: frozenset[str] = frozenset(
         "su",
         "env",
         "xargs",
+        "parallel",
         "awk",
         "gawk",
         "mawk",
@@ -66,6 +67,12 @@ ALL_REMOTE_AND_PROGRAM_STRING_EXECUTORS: frozenset[str] = frozenset(
     }
 )
 ALL_STRING_ARGUMENT_EXECUTION_FLAGS: frozenset[str] = frozenset({"-c", "-e"})
+FIND_PROGRAM_NAME: str = "find"
+ALL_FIND_EXEC_ACTION_FLAGS: frozenset[str] = frozenset({"-exec", "-execdir"})
+ALL_FIND_EXEC_ACTION_TERMINATORS: frozenset[str] = frozenset({";", "+"})
+ALL_FIND_GLOBAL_OPTION_FLAGS_WITHOUT_VALUE: frozenset[str] = frozenset({"-H", "-L", "-P"})
+ALL_FIND_GLOBAL_OPTION_FLAGS_TAKING_A_VALUE: frozenset[str] = frozenset({"-D"})
+FIND_OPTIMIZATION_LEVEL_OPTION_PREFIX: str = "-O"
 ALL_BENIGN_COMPOUND_SEGMENT_COMMANDS: frozenset[str] = frozenset(
     {
         "echo",
@@ -176,3 +183,11 @@ ALL_LAUNCHER_OPTIONS_TAKING_SEPARATE_VALUE: frozenset[str] = frozenset(
     }
 )
 ALL_SUBSHELL_GROUPING_CHARACTERS: str = "({"
+ALL_KNOWN_TEMPORARY_ENVIRONMENT_VARIABLE_NAMES: frozenset[str] = frozenset(
+    {
+        "TEMP",
+        "TMP",
+        "TMPDIR",
+        "CLAUDE_JOB_DIR",
+    }
+)

package/hooks/hooks_constants/duplicate_function_body_constants.py

@@ -1,9 +1,14 @@
-"""Constants for the cross-file duplicate-function-body scan in ``code_rules_enforcer``.
+"""Constants for the duplicate-function-body scan in ``code_rules_enforcer``.
 
-The scan flags a top-level function whose body is structurally identical to a
-top-level function already defined in a sibling ``.py`` module in the same
-directory. This catches the Reuse-before-create / DRY violation where a helper
-is copy-pasted across several modules instead of imported from one shared home.
+The blocking scan flags a top-level function whose body is structurally identical
+to a top-level function already defined in a sibling ``.py`` module in the same
+directory. This catches the Reuse-before-create / DRY violation where a helper is
+copy-pasted across several modules instead of imported from one shared home.
+
+The ``CROSS_SKILL_*`` and ``SKILL*`` constants feed the non-blocking companion
+advisory: a helper copied between two skills' ``scripts`` directories, where a
+shared module would break independent install. That advisory names the source
+skill on stderr rather than denying the write.
 """
 
 MINIMUM_DUPLICATE_BODY_STATEMENTS: int = 3
@@ -15,3 +20,15 @@ DUPLICATE_BODY_GUIDANCE: str = (
     "extract a single shared helper (for example in hooks_constants/) and "
     "import it from both modules instead of copying it (Reuse before create / DRY)"
 )
+
+SKILLS_DIRECTORY_NAME: str = "skills"
+SKILL_SCRIPTS_DIRECTORY_NAME: str = "scripts"
+MAX_CROSS_SKILL_ADVISORY_ISSUES: int = 25
+CROSS_SKILL_ADVISORY_PREFIX: str = "[CODE_RULES advisory]"
+CROSS_SKILL_DUPLICATE_GUIDANCE: str = (
+    "two skill folders install on their own, so this copy is a defensible "
+    "skill-isolation tradeoff; a shared module would couple the skills and "
+    "break independent install. Confirm the copy is intentional, or for a "
+    "large or behavior-bearing body raise the choice through AskUserQuestion "
+    "(see the no-cross-skill-duplicate-helpers rule)"
+)

package/hooks/hooks_constants/orphan_css_class_constants.py

@@ -0,0 +1,40 @@
+"""Constants for the orphan-CSS-class check in code_rules_enforcer.
+
+A Python module that builds HTML emits ``class="..."`` attributes in string
+literals and pairs them with a ``<style>`` block whose selectors style those
+classes. When a class appears in the markup but no selector defines it, the
+markup carries a dead attribute or the style block is missing a rule. This
+module holds the patterns that pair the two halves and the package-scan
+budget that bounds the sibling read.
+"""
+
+import re
+
+__all__ = [
+    "CLASS_ATTRIBUTE_PATTERN",
+    "STYLE_BLOCK_PATTERN",
+    "CSS_CLASS_SELECTOR_PATTERN",
+    "PYTHON_MODULE_GLOB",
+    "MAX_ORPHAN_CSS_CLASS_ISSUES",
+    "MAX_SIBLING_MODULES_SCANNED",
+    "ORPHAN_CSS_CLASS_MESSAGE_SUFFIX",
+]
+
+CLASS_ATTRIBUTE_PATTERN: re.Pattern[str] = re.compile(r"""class\s*=\s*["']([^"']+)["']""")
+
+STYLE_BLOCK_PATTERN: re.Pattern[str] = re.compile(
+    r"<style[^>]*>(.*?)</style>", re.DOTALL | re.IGNORECASE
+)
+
+CSS_CLASS_SELECTOR_PATTERN: re.Pattern[str] = re.compile(r"\.(-?[_a-zA-Z][\w-]*)")
+
+PYTHON_MODULE_GLOB: str = "*.py"
+
+MAX_ORPHAN_CSS_CLASS_ISSUES: int = 10
+
+MAX_SIBLING_MODULES_SCANNED: int = 60
+
+ORPHAN_CSS_CLASS_MESSAGE_SUFFIX: str = (
+    "add a matching '.<class>' selector to the <style> block, "
+    "or drop the unused class attribute (CODE_RULES self-documenting markup)"
+)

package/hooks/hooks_constants/precommit_code_rules_gate_constants.py

@@ -8,7 +8,7 @@ from pathlib import Path
 
 GIT_DASH_C_COMMIT_PATTERN: str = r"git\s+-C\s+[\"']?[^\"';&|]+?[\"']?\s+commit\b"
 GIT_COMMAND_TIMEOUT_SECONDS: int = 5
-GATE_TIMEOUT_SECONDS: int = 25
+GATE_TIMEOUT_SECONDS: int = 120
 GATE_RELATIVE_PATH: Path = Path("_shared") / "pr-loop" / "scripts" / "code_rules_gate.py"
 ALL_STAGED_PYTHON_FILES_COMMAND: tuple[str, ...] = (
     "git",

package/hooks/validation/mypy_validator.py

@@ -69,13 +69,55 @@ def is_file_within_project(target_file: str, project_root: Path) -> bool:
         return False
 
 
-def build_mypy_command(relative_file_path: str) -> list[str]:
-    if IS_WINDOWS:
-        base_command = [sys.executable, "-m", "mypy"]
-    else:
-        base_command = ["mypy"]
+def discover_mypy_config(target_file: Path) -> Path | None:
+    """Return the nearest ancestor ``pyproject.toml`` that configures mypy.
+
+    Mypy applies a project's ``[tool.mypy]`` settings only when the config file
+    is on its invocation path; handing the discovered config to mypy lets a
+    check run from the repository root still honor the project's own import
+    resolution settings (such as ``ignore_missing_imports``) for a module that
+    imports its siblings by name. Reuses the validators-package walk-up so the
+    discovery logic lives in one place.
+
+    Args:
+        target_file: The Python file mypy will check.
+
+    Returns:
+        The nearest ancestor ``pyproject.toml`` declaring a ``[tool.mypy]``
+        table, or None when none exists above the file or the walk-up helper
+        cannot be imported.
+    """
+    validators_directory = os.path.join(
+        os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "validators"
+    )
+    if validators_directory not in sys.path:
+        sys.path.insert(0, validators_directory)
+    try:
+        integration_module = importlib.import_module("mypy_integration")
+    except ImportError:
+        return None
+    discovered_config = integration_module.find_pyproject_with_mypy_config(target_file)
+    return discovered_config if isinstance(discovered_config, Path) else None
+
+
+def build_mypy_command(relative_file_path: str, mypy_config_file: Path | None) -> list[str]:
+    """Build the mypy command line for one file.
 
-    return base_command + [
+    Args:
+        relative_file_path: The target file path relative to the project root.
+        mypy_config_file: The ``pyproject.toml`` to pass via ``--config-file``,
+            or None to let mypy fall back to its own config discovery.
+
+    Returns:
+        The full mypy argument vector, including the interpreter prefix on
+        Windows and the config file when one was discovered.
+    """
+    base_command = [sys.executable, "-m", "mypy"] if IS_WINDOWS else ["mypy"]
+
+    config_arguments = (
+        ["--config-file", str(mypy_config_file)] if mypy_config_file is not None else []
+    )
+    return base_command + config_arguments + [
         "--no-error-summary",
         "--show-error-codes",
         "--no-color",
@@ -84,8 +126,18 @@ def build_mypy_command(relative_file_path: str) -> list[str]:
 
 
 def run_mypy(target_file: str, project_root: str) -> tuple[int, str]:
+    """Run mypy on one file from the project root and return its result.
+
+    Args:
+        target_file: The absolute path of the file to type-check.
+        project_root: The directory mypy runs from.
+
+    Returns:
+        The mypy exit code paired with its combined stdout and stderr text.
+    """
     relative_file_path = os.path.relpath(target_file, project_root)
-    mypy_command = build_mypy_command(relative_file_path)
+    mypy_config_file = discover_mypy_config(Path(target_file))
+    mypy_command = build_mypy_command(relative_file_path, mypy_config_file)
 
     completed_process = subprocess.run(
         mypy_command,

package/hooks/validation/test_mypy_validator.py

@@ -0,0 +1,94 @@
+"""Behavior tests for the mypy_validator config-discovery fix.
+
+The hook runs mypy from the project root, so without handing mypy the project's
+own ``[tool.mypy]`` config a module that imports its siblings by name draws a
+spurious ``import-not-found`` error. These tests drive the real production
+functions: ``discover_mypy_config`` walks up to the nearest configuring
+``pyproject.toml`` and ``run_mypy`` passes it through so the project's
+``ignore_missing_imports`` setting applies.
+"""
+
+import importlib.util
+from pathlib import Path
+from types import ModuleType
+
+HOOK_PATH = Path(__file__).resolve().parent / "mypy_validator.py"
+
+MODULE_WITH_SIBLING_IMPORT = (
+    "from sibling_only_resolvable_at_runtime import value\n\nx: int = value\n"
+)
+TOOL_MYPY_PYPROJECT = "[tool.mypy]\nignore_missing_imports = true\n"
+NON_MYPY_PYPROJECT = "[tool.ruff]\nline-length = 100\n"
+
+
+def _load_validator() -> ModuleType:
+    spec = importlib.util.spec_from_file_location("mypy_validator_under_test", HOOK_PATH)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_discover_mypy_config_finds_nearest_tool_mypy_pyproject(tmp_path: Path) -> None:
+    validator = _load_validator()
+    (tmp_path / "pyproject.toml").write_text(TOOL_MYPY_PYPROJECT, encoding="utf-8")
+    nested_module = tmp_path / "package" / "module.py"
+    nested_module.parent.mkdir(parents=True)
+    nested_module.write_text("value: int = 1\n", encoding="utf-8")
+
+    discovered = validator.discover_mypy_config(nested_module)
+
+    assert discovered is not None
+    assert discovered.resolve() == (tmp_path / "pyproject.toml").resolve()
+
+
+def test_discover_mypy_config_returns_none_without_tool_mypy(tmp_path: Path) -> None:
+    validator = _load_validator()
+    (tmp_path / "pyproject.toml").write_text(NON_MYPY_PYPROJECT, encoding="utf-8")
+    standalone_module = tmp_path / "module.py"
+    standalone_module.write_text("value: int = 1\n", encoding="utf-8")
+
+    assert validator.discover_mypy_config(standalone_module) is None
+
+
+def test_build_mypy_command_includes_config_file_when_present(tmp_path: Path) -> None:
+    validator = _load_validator()
+    config_file = tmp_path / "pyproject.toml"
+
+    command = validator.build_mypy_command("package/module.py", config_file)
+
+    assert "--config-file" in command
+    assert command[command.index("--config-file") + 1] == str(config_file)
+    assert command[-1] == "package/module.py"
+
+
+def test_build_mypy_command_omits_config_file_when_absent(tmp_path: Path) -> None:
+    validator = _load_validator()
+
+    command = validator.build_mypy_command("package/module.py", None)
+
+    assert "--config-file" not in command
+    assert command[-1] == "package/module.py"
+
+
+def test_run_mypy_suppresses_sibling_import_error_with_tool_mypy_config(tmp_path: Path) -> None:
+    validator = _load_validator()
+    (tmp_path / "pyproject.toml").write_text(TOOL_MYPY_PYPROJECT, encoding="utf-8")
+    importer_module = tmp_path / "importer.py"
+    importer_module.write_text(MODULE_WITH_SIBLING_IMPORT, encoding="utf-8")
+
+    exit_code, output = validator.run_mypy(str(importer_module), str(tmp_path))
+
+    assert exit_code == 0, output
+    assert "import-not-found" not in output
+
+
+def test_run_mypy_reports_import_error_without_tool_mypy_config(tmp_path: Path) -> None:
+    validator = _load_validator()
+    importer_module = tmp_path / "importer.py"
+    importer_module.write_text(MODULE_WITH_SIBLING_IMPORT, encoding="utf-8")
+
+    exit_code, output = validator.run_mypy(str(importer_module), str(tmp_path))
+
+    assert exit_code != 0
+    assert "import-not-found" in output

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "1.59.0",
+    "version": "1.61.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {