claude-dev-env 1.74.0 → 1.76.0

package/hooks/blocking/test_code_rules_logging_printf_tokens.py

@@ -0,0 +1,134 @@
+"""Tests for the printf-token check on str.format-logger (automation_logging) calls."""
+
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+from types import ModuleType
+
+ENFORCER_FILENAME = "code_rules_enforcer.py"
+ENFORCER_MODULE_NAME = "code_rules_enforcer_printf_under_test"
+PRODUCTION_FILE_PATH = "shared_utils/web_automation/sample.py"
+TEST_FILE_PATH = "shared_utils/web_automation/tests/test_sample.py"
+FORMAT_LOGGER_IMPORT = (
+    "from shared_utils.automation_logging import log_error, log_info, log_debug\n"
+)
+
+
+def load_enforcer_module() -> ModuleType:
+    enforcer_path = Path(__file__).parent / ENFORCER_FILENAME
+    module_spec = importlib.util.spec_from_file_location(ENFORCER_MODULE_NAME, enforcer_path)
+    assert module_spec is not None
+    assert module_spec.loader is not None
+    enforcer_module = importlib.util.module_from_spec(module_spec)
+    module_spec.loader.exec_module(enforcer_module)
+    return enforcer_module
+
+
+enforcer = load_enforcer_module()
+
+
+def test_should_flag_percent_s_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_error("Skipping %s after error: %s", name, err)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1
+    assert "printf token" in issues[0]
+
+
+def test_should_flag_percent_d_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_debug("attempt %d of %d", index, total)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1
+
+
+def test_should_allow_brace_placeholders_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_info("Processing {} of {}", index, total)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_ignore_percent_token_without_format_logger_import() -> None:
+    source = 'log_error("Skipping %s", name)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_ignore_attribute_style_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'logger.info("delivered %s", message_id)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_inspect_message_literal_not_argument_value() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_info("status: {}", "100%s done")\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_exempt_test_files() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_error("Skipping %s", name)\n'
+    issues = enforcer.check_logging_printf_tokens(source, TEST_FILE_PATH)
+    assert issues == []
+
+
+def test_should_resolve_aliased_format_logger_import() -> None:
+    source = (
+        "from shared_utils.automation_logging import log_error as report_error\n"
+        + 'report_error("failed %s", name)\n'
+    )
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1
+
+
+def test_should_allow_token_bearing_message_with_no_format_args() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_info("Use %s for string substitution")\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_allow_documentation_style_token_message_with_no_args() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_warning("avoid %s-style tokens here")\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_allow_percent_adjacent_to_word_in_format_message() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_info("memory 80%free now", host)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_allow_doubled_percent_in_format_message() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_info("100%% done", host)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_allow_trailing_percent_in_format_message() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_info("100% done", host)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_flag_width_token_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_error("item %5d", index)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1
+
+
+def test_should_flag_precision_token_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_error("took %0.2f sec", elapsed)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1
+
+
+def test_should_flag_float_general_token_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_error("ratio %g", ratio)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1
+
+
+def test_should_flag_scientific_token_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_error("value %e", measurement)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1

package/hooks/blocking/test_code_verifier_spawn_preflight_gate.py

@@ -342,6 +342,22 @@ def test_real_code_rules_violation_on_added_line_denies(tmp_path: Path) -> None:
     assert "Line " in reason
 
 
+def test_committed_on_branch_violation_with_clean_working_tree_denies(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    initialize_repository(repository_root)
+    run_git(repository_root, "checkout", "-b", "feature")
+    commit_file(repository_root, "committed.py", VIOLATING_MODULE_SOURCE, "commit violation")
+    status_output = run_git(repository_root, "status", "--porcelain")
+    assert status_output == "", "working tree must be clean so the deny comes from the committed line"
+    payload = write_agent_payload("code-verifier", "verify the change", repository_root)
+    result = run_hook(payload, repository_root)
+    assert not is_allow(result)
+    reason = deny_reason(result)
+    assert "committed.py" in reason
+    assert "Line " in reason
+
+
 def test_preexisting_violation_on_untouched_line_allows(tmp_path: Path) -> None:
     repository_root = tmp_path / "repo"
     repository_root.mkdir()

package/hooks/blocking/test_duplicate_rmtree_helper_blocker.py

@@ -0,0 +1,328 @@
+"""Unit tests for duplicate_rmtree_helper_blocker PreToolUse hook."""
+
+import importlib.util
+import io
+import json
+import pathlib
+import sys
+from contextlib import redirect_stderr, redirect_stdout
+
+_HOOK_DIR = pathlib.Path(__file__).parent
+if str(_HOOK_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIR))
+_HOOKS_ROOT = _HOOK_DIR.parent
+if str(_HOOKS_ROOT) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_ROOT))
+
+hook_spec = importlib.util.spec_from_file_location(
+    "duplicate_rmtree_helper_blocker",
+    _HOOK_DIR / "duplicate_rmtree_helper_blocker.py",
+)
+assert hook_spec is not None
+assert hook_spec.loader is not None
+hook_module = importlib.util.module_from_spec(hook_spec)
+hook_spec.loader.exec_module(hook_module)
+
+payload_defines_sanctioned_helper = hook_module.payload_defines_sanctioned_helper
+path_is_exempt = hook_module.path_is_exempt
+extract_payload_text = hook_module.extract_payload_text
+
+COPIED_TRIO = (
+    "def _strip_read_only_and_retry(removal_function, target_path, *_exc_info):\n"
+    "    try:\n"
+    "        os.chmod(target_path, stat.S_IWRITE)\n"
+    "        removal_function(target_path)\n"
+    "    except OSError:\n"
+    "        pass\n\n\n"
+    "_rmtree_supports_onexc = 'onexc' in inspect.signature(shutil.rmtree).parameters\n\n\n"
+    "def _force_remove_tree(target_path):\n"
+    "    if _rmtree_supports_onexc:\n"
+    "        shutil.rmtree(target_path, onexc=_strip_read_only_and_retry)\n"
+)
+
+
+def test_detects_strip_read_only_definition() -> None:
+    assert payload_defines_sanctioned_helper(
+        "def _strip_read_only_and_retry(removal_function, target_path, *_exc_info):\n    pass"
+    )
+
+
+def test_detects_force_remove_tree_definition() -> None:
+    assert payload_defines_sanctioned_helper(
+        "def _force_remove_tree(target_path: Path) -> None:\n    pass"
+    )
+
+
+def test_detects_force_rmtree_definition() -> None:
+    assert payload_defines_sanctioned_helper(
+        "def force_rmtree(target_path: str) -> None:\n    pass"
+    )
+
+
+def test_detects_indented_method_definition() -> None:
+    assert payload_defines_sanctioned_helper(
+        "class FileTools:\n    def _strip_read_only_and_retry(self, fn, path):\n        pass"
+    )
+
+
+def test_detects_copied_trio_block() -> None:
+    assert payload_defines_sanctioned_helper(COPIED_TRIO)
+
+
+def test_allows_import_of_shared_helper() -> None:
+    assert not payload_defines_sanctioned_helper(
+        "from shared_utils.web_automation.utils.windows_filesystem import force_rmtree"
+    )
+
+
+def test_allows_call_site_without_definition() -> None:
+    assert not payload_defines_sanctioned_helper("force_rmtree(staging_directory)")
+
+
+def test_allows_helper_name_inside_string_literal() -> None:
+    corrective_message = (
+        '    "    def _strip_read_only_and_retry(removal_function, target_path):\\n"'
+    )
+    assert not payload_defines_sanctioned_helper(corrective_message)
+
+
+def test_allows_helper_definition_inside_triple_quoted_string() -> None:
+    documentation_snippet = (
+        'EXAMPLE = """\\\n'
+        'def _strip_read_only_and_retry(removal_function, target_path, *_exc_info):\n'
+        '    pass\n'
+        '"""\n'
+    )
+    assert not payload_defines_sanctioned_helper(documentation_snippet)
+
+
+def test_allows_force_rmtree_definition_inside_triple_quoted_string() -> None:
+    documentation_snippet = (
+        "snippet = '''\n"
+        "def force_rmtree(target_path: str) -> None:\n"
+        "    pass\n"
+        "'''\n"
+    )
+    assert not payload_defines_sanctioned_helper(documentation_snippet)
+
+
+def test_detects_real_definition_following_triple_quoted_docstring() -> None:
+    module_text = (
+        '"""Module docstring."""\n'
+        'def force_rmtree(target_path: str) -> None:\n'
+        '    pass\n'
+    )
+    assert payload_defines_sanctioned_helper(module_text)
+
+
+def test_detects_real_definition_between_two_triple_quoted_strings() -> None:
+    module_text = (
+        '"""Leading docstring."""\n'
+        'def _force_remove_tree(target_path: str) -> None:\n'
+        '    pass\n'
+        '"""Trailing docstring."""\n'
+    )
+    assert payload_defines_sanctioned_helper(module_text)
+
+
+def test_allows_unrelated_definition() -> None:
+    assert not payload_defines_sanctioned_helper("def categorize_and_move(theme_folder):\n    pass")
+
+
+def test_path_exempts_blocker_source() -> None:
+    assert path_is_exempt("packages/x/hooks/blocking/windows_rmtree_blocker.py")
+    assert path_is_exempt("packages/x/hooks/blocking/duplicate_rmtree_helper_blocker.py")
+
+
+def test_path_exempts_shared_helper_module() -> None:
+    assert path_is_exempt("shared_utils/web_automation/utils/windows_filesystem.py")
+
+
+def test_path_exempts_existing_session_env_cleanup_definition_site() -> None:
+    assert path_is_exempt("packages/claude-dev-env/hooks/session/session_env_cleanup.py")
+
+
+def test_path_exempts_existing_md_to_html_test_support_definition_site() -> None:
+    assert path_is_exempt(
+        "packages/claude-dev-env/hooks/blocking/_md_to_html_blocker_test_support.py"
+    )
+
+
+def test_path_exempts_existing_teardown_worktrees_definition_site() -> None:
+    assert path_is_exempt(
+        "packages/claude-dev-env/skills/_shared/pr-loop/scripts/teardown_worktrees.py"
+    )
+
+
+def test_main_allows_full_file_write_of_existing_definition_site() -> None:
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "Write",
+            "tool_input": {
+                "file_path": "packages/claude-dev-env/hooks/session/session_env_cleanup.py",
+                "content": COPIED_TRIO,
+            },
+        }
+    )
+    assert exit_code == 0
+    assert stdout_text == ""
+
+
+def test_path_exempts_test_file_prefix() -> None:
+    assert path_is_exempt("hooks/blocking/test_duplicate_rmtree_helper_blocker.py")
+
+
+def test_path_exempts_test_file_suffix() -> None:
+    assert path_is_exempt("shared_utils/something_test.py")
+
+
+def test_path_does_not_exempt_production_module() -> None:
+    assert not path_is_exempt(
+        "shared_utils/samsung_utils/cert_failure_processor/failure_categorizer.py"
+    )
+
+
+def test_path_does_not_exempt_filename_containing_exempt_fragment() -> None:
+    assert not path_is_exempt("packages/x/not_windows_filesystem.py")
+    assert not path_is_exempt("packages/x/my_windows_filesystem.py")
+
+
+def test_path_does_not_exempt_backslash_path_with_containing_fragment() -> None:
+    assert not path_is_exempt("packages\\x\\not_windows_filesystem.py")
+
+
+def test_extract_payload_text_reads_write_content() -> None:
+    extracted = extract_payload_text("Write", {"file_path": "foo.py", "content": "abc"})
+    assert extracted == ("foo.py", "abc")
+
+
+def test_extract_payload_text_reads_edit_new_string() -> None:
+    extracted = extract_payload_text("Edit", {"file_path": "foo.py", "new_string": "abc"})
+    assert extracted == ("foo.py", "abc")
+
+
+def test_extract_payload_text_returns_empty_for_non_python_file() -> None:
+    extracted = extract_payload_text("Write", {"file_path": "notes.md", "content": COPIED_TRIO})
+    assert extracted == ("notes.md", "")
+
+
+def test_extract_payload_text_returns_empty_for_unknown_tool() -> None:
+    extracted = extract_payload_text("Read", {"file_path": "foo.py"})
+    assert extracted == ("", "")
+
+
+def _run_hook_with_stdin_text(stdin_text: str) -> tuple[str, str, int]:
+    captured_stdout = io.StringIO()
+    captured_stderr = io.StringIO()
+    exit_code = 0
+    sys.stdin = io.StringIO(stdin_text)
+    try:
+        with redirect_stdout(captured_stdout), redirect_stderr(captured_stderr):
+            try:
+                hook_module.main()
+            except SystemExit as exit_signal:
+                raw_exit_code = exit_signal.code
+                exit_code = raw_exit_code if isinstance(raw_exit_code, int) else 0
+    finally:
+        sys.stdin = sys.__stdin__
+    return captured_stdout.getvalue(), captured_stderr.getvalue(), exit_code
+
+
+def _run_hook(hook_input: dict) -> tuple[str, int]:
+    stdout_text, _stderr_text, exit_code = _run_hook_with_stdin_text(json.dumps(hook_input))
+    return stdout_text, exit_code
+
+
+def test_main_blocks_local_trio_copy_in_production_module() -> None:
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "Write",
+            "tool_input": {
+                "file_path": (
+                    "shared_utils/samsung_utils/cert_failure_processor/failure_categorizer.py"
+                ),
+                "content": COPIED_TRIO,
+            },
+        }
+    )
+    assert exit_code == 0
+    response_payload = json.loads(stdout_text)
+    decision_block = response_payload["hookSpecificOutput"]
+    assert decision_block["permissionDecision"] == "deny"
+    assert "duplicate-rmtree-helper" in decision_block["permissionDecisionReason"]
+
+
+def test_main_allows_import_of_shared_helper() -> None:
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "Write",
+            "tool_input": {
+                "file_path": "shared_utils/samsung_utils/cleanup.py",
+                "content": (
+                    "from shared_utils.web_automation.utils.windows_filesystem import "
+                    "force_rmtree\n\nforce_rmtree(path)\n"
+                ),
+            },
+        }
+    )
+    assert exit_code == 0
+    assert stdout_text == ""
+
+
+def test_main_allows_definition_in_shared_helper_module() -> None:
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "Write",
+            "tool_input": {
+                "file_path": "shared_utils/web_automation/utils/windows_filesystem.py",
+                "content": COPIED_TRIO,
+            },
+        }
+    )
+    assert exit_code == 0
+    assert stdout_text == ""
+
+
+def test_main_allows_definition_in_test_file() -> None:
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "Write",
+            "tool_input": {
+                "file_path": "shared_utils/test_windows_filesystem.py",
+                "content": COPIED_TRIO,
+            },
+        }
+    )
+    assert exit_code == 0
+    assert stdout_text == ""
+
+
+def test_main_passes_through_non_python_file() -> None:
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "Write",
+            "tool_input": {"file_path": "docs/cleanup.md", "content": COPIED_TRIO},
+        }
+    )
+    assert exit_code == 0
+    assert stdout_text == ""
+
+
+def test_main_passes_through_unrelated_tool() -> None:
+    stdout_text, exit_code = _run_hook({"tool_name": "Read", "tool_input": {"file_path": "foo.py"}})
+    assert exit_code == 0
+    assert stdout_text == ""
+
+
+def test_main_with_empty_stdin_exits_silently() -> None:
+    stdout_text, stderr_text, exit_code = _run_hook_with_stdin_text("")
+    assert exit_code == 0
+    assert stdout_text == ""
+    assert stderr_text == ""
+
+
+def test_main_with_invalid_json_stdin_exits_silently() -> None:
+    stdout_text, stderr_text, exit_code = _run_hook_with_stdin_text("{broken")
+    assert exit_code == 0
+    assert stdout_text == ""
+    assert stderr_text == ""

package/hooks/blocking/test_hedging_language_blocker.py

@@ -17,6 +17,12 @@ if _HOOKS_ROOT not in sys.path:
     sys.path.insert(0, _HOOKS_ROOT)
 import hedging_language_blocker
 from hooks_constants.messages import USER_FACING_NOTICE
+from hooks_constants.text_stripping import strip_code_and_quotes
+
+
+def test_blocker_uses_shared_strip_code_and_quotes() -> None:
+    assert hedging_language_blocker.strip_code_and_quotes is strip_code_and_quotes
+
 
 RESEARCH_MODE_SKILL_BODY_MARKER = "Three anti-hallucination constraints are ALWAYS active."
 HEDGING_MESSAGE = "This is likely correct."

package/hooks/blocking/test_intent_only_ending_blocker.py

@@ -16,6 +16,11 @@ if _HOOKS_ROOT not in sys.path:
     sys.path.insert(0, _HOOKS_ROOT)
 import intent_only_ending_blocker
 from hooks_constants.messages import USER_FACING_INTENT_ENDING_NOTICE
+from hooks_constants.text_stripping import strip_code_and_quotes
+
+def test_blocker_uses_shared_strip_code_and_quotes() -> None:
+    assert intent_only_ending_blocker.strip_code_and_quotes is strip_code_and_quotes
+
 
 INTENT_ENDING_MESSAGE = "I'll now run the test suite and fix any failures that come up."
 NEXT_STEPS_MESSAGE = "Next steps:"

package/hooks/blocking/test_pre_tool_use_dispatcher.py

@@ -26,6 +26,7 @@ if _HOOKS_DIR not in sys.path:
 
 from hooks_constants.pre_tool_use_dispatcher_constants import (  # noqa: E402, I001
     ALL_HOSTED_HOOK_ENTRIES,
+    BLOCKING_CRASH_DENY_REASON,
     BLOCKING_CRASH_EXIT_CODE,
     DENY_DECISION,
     EDIT_TOOL_NAME,
@@ -485,6 +486,52 @@ def test_aggregate_exit_code_two_signals_deny() -> None:
     )
 
 
+def test_aggregate_blocking_hook_crash_surfaces_a_deny() -> None:
+    """A crash in a blocking hook surfaces a deny with the crash reason.
+
+    When a blocking hook raises a non-SystemExit exception before emitting any
+    output, the aggregator must still deny so a bad write does not silently
+    pass. The deny reason must be the BLOCKING_CRASH_DENY_REASON constant.
+    """
+    all_results = [
+        HostedHookResult(
+            exit_code=0,
+            captured_stdout="",
+            did_crash=True,
+            is_blocking=True,
+        )
+    ]
+    decision = aggregate_hosted_hook_results(all_results)
+    assert decision.should_deny, "a blocking hook crash must surface a deny"
+    assert decision.all_deny_reasons, (
+        "the deny reasons list must be non-empty after a blocking hook crash"
+    )
+    assert BLOCKING_CRASH_DENY_REASON in decision.all_deny_reasons, (
+        "the deny reason from a blocking hook crash must be BLOCKING_CRASH_DENY_REASON.\n"
+        f"Got: {decision.all_deny_reasons!r}"
+    )
+
+
+def test_aggregate_non_blocking_hook_crash_does_not_deny() -> None:
+    """A crash in a non-blocking hook does not change an allow to a deny.
+
+    A hosted hook carrying is_blocking=False must not surface a deny when it
+    crashes — the aggregated decision stays allow.
+    """
+    all_results = [
+        HostedHookResult(
+            exit_code=0,
+            captured_stdout="",
+            did_crash=True,
+            is_blocking=False,
+        )
+    ]
+    decision = aggregate_hosted_hook_results(all_results)
+    assert not decision.should_deny, (
+        "a non-blocking hook crash must not change an allow to a deny"
+    )
+
+
 def test_aggregate_exit_code_zero_with_no_output_allows() -> None:
     """A HostedHookResult with exit_code 0 and empty stdout signals allow.
 
@@ -585,16 +632,16 @@ def test_dispatcher_write_applies_both_groups() -> None:
     assert "blocking/plain_language_blocker.py" in all_write_script_paths, (
         "plain_language_blocker (Group B) must be in Write applicable set"
     )
-    assert len(all_write_entries) == 17, (
-        f"Write tool must apply to all 17 hosted hooks, got {len(all_write_entries)}"
+    assert len(all_write_entries) == 18, (
+        f"Write tool must apply to all 18 hosted hooks, got {len(all_write_entries)}"
     )
 
 
 def test_dispatcher_edit_applies_both_groups() -> None:
     """Edit tool triggers both Group A and Group B hooks through the dispatcher."""
     all_edit_entries = _applicable_entries_for_tool(EDIT_TOOL_NAME)
-    assert len(all_edit_entries) == 17, (
-        f"Edit tool must apply to all 17 hosted hooks, got {len(all_edit_entries)}"
+    assert len(all_edit_entries) == 18, (
+        f"Edit tool must apply to all 18 hosted hooks, got {len(all_edit_entries)}"
     )
 
 
@@ -613,7 +660,7 @@ def test_proceed_after_run_all_validators_removal_allows() -> None:
     it was never a PreToolUse hook and never hosted by the PreToolUse dispatcher.
     A Python Write payload that run_all_validators would have flagged (mypy errors, for
     instance) still produces ALLOW from the PreToolUse dispatcher because the PreToolUse
-    dispatcher covers only its 17 hosted blocking hooks — none of which includes the
+    dispatcher covers only its 18 hosted blocking hooks — none of which includes the
     validators runner.
     """
     python_content_with_type_error = (

package/hooks/blocking/test_question_to_user_enforcer.py

@@ -14,7 +14,9 @@ if _HOOKS_DIR not in sys.path:
     sys.path.insert(0, _HOOKS_DIR)
 if _HOOKS_ROOT not in sys.path:
     sys.path.insert(0, _HOOKS_ROOT)
+import question_to_user_enforcer
 from hooks_constants.messages import USER_FACING_ASKUSERQUESTION_NOTICE
+from hooks_constants.text_stripping import strip_code_and_quotes
 
 CLEAN_DECLARATIVE_MESSAGE = "I applied the rename across both files. The tests pass."
 TRAILING_QUESTION_MESSAGE = (
@@ -68,6 +70,10 @@ def run_hook_with_message(assistant_message: str) -> subprocess.CompletedProcess
     return run_hook_with_payload({"last_assistant_message": assistant_message})
 
 
+def test_blocker_uses_shared_strip_code_and_quotes() -> None:
+    assert question_to_user_enforcer.strip_code_and_quotes is strip_code_and_quotes
+
+
 def test_clean_declarative_message_passes_through():
     completed_process = run_hook_with_message(CLEAN_DECLARATIVE_MESSAGE)
     assert completed_process.returncode == 0

package/hooks/blocking/test_session_handoff_blocker.py

@@ -16,6 +16,12 @@ if _HOOKS_ROOT not in sys.path:
     sys.path.insert(0, _HOOKS_ROOT)
 import session_handoff_blocker
 from hooks_constants.messages import USER_FACING_CONTEXT_REASSURANCE_NOTICE
+from hooks_constants.text_stripping import strip_code_and_quotes
+
+
+def test_blocker_uses_shared_strip_code_and_quotes() -> None:
+    assert session_handoff_blocker.strip_code_and_quotes is strip_code_and_quotes
+
 
 NEW_SESSION_PROPOSAL_MESSAGE = (
     "I recommend we continue this in a fresh session to keep things manageable."