claude-dev-env 1.82.0 → 1.84.0

package/skills/bugteam/reference/audit-contract.md

@@ -1,163 +0,0 @@
-# Audit contract
-
-Shared output schema and audit-loop contract used by `/bugteam`, `/qbug`, `/findbugs`, and `/fixbugs`. Changing a shape here is a breaking change for every consuming skill.
-
-## Contents
-
-- Finding schema (Shape A, Shape B)
-- Adversarial second pass
-- Haiku secondary auditor
-- Post-fix self-audit
-- Persistence (loop-<L>-audit.json, loop-<L>-diagnostics.json)
-
-## Finding schema
-
-Each finding an audit produces MUST be one of exactly two shapes.
-
-### Shape A — structured finding
-
-```json
-{
-  "id": "loop<L>-<K>",
-  "file": "path/relative/to/repo/root.py",
-  "line": 123,
-  "category": "A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P",
-  "severity": "P0 | P1 | P2",
-  "excerpt": "verbatim code snippet from the offending line(s)",
-  "failure_mode": "one sentence describing what goes wrong and when",
-  "evidence_files": ["additional/files/opened.py"]
-}
-```
-
-`id` is `loop<L>-<K>` where `L` is the loop counter (1-based) and `K` is the 1-based index within the loop. For `/findbugs` which runs once, use `find<K>`.
-
-### Shape B — structured proof-of-absence
-
-Used when an audit investigates a category and does NOT find a bug. Bare "verified clean" claims are REJECTED because they hide shallow reading.
-
-```json
-{
-  "category": "A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P",
-  "files_opened": ["file1.py", "file2.py"],
-  "lines_quoted": [
-    {"file": "file1.py", "line": 88, "text": "verbatim line content"}
-  ],
-  "adversarial_probes": [
-    "what failure mode was tested for and how it was ruled out"
-  ]
-}
-```
-
-Every category an audit touches MUST have either at least one Shape A finding OR at least one Shape B proof-of-absence entry. A category with neither is a protocol violation.
-
-### Example — Shape A
-
-```json
-{
-  "id": "loop1-1",
-  "file": "scripts/db/neon.py",
-  "line": 43,
-  "category": "C",
-  "severity": "P1",
-  "excerpt": "load_dotenv(env_path, override=False)",
-  "failure_mode": "Called on every connect() — repeats file I/O per connection in scripts that open multiple short-lived connections.",
-  "evidence_files": ["scripts/db/neon.py", "scripts/update_new_releases.py"]
-}
-```
-
-### Example — Shape B
-
-```json
-{
-  "category": "H",
-  "files_opened": ["scripts/db/neon.py", "scripts/db/config.py"],
-  "lines_quoted": [
-    {"file": "scripts/db/neon.py", "line": 30, "text": "dsn = os.environ.get(\"DATABASE_URL\")"}
-  ],
-  "adversarial_probes": [
-    "Checked whether DATABASE_URL is interpolated into a shell — it is passed to psycopg.connect() directly with no shell involvement.",
-    "Checked whether the env path is user-controlled — it is derived from a fixed Y: drive constant, not user input."
-  ]
-}
-```
-
-## Adversarial second pass
-
-After the primary finding list is complete, every audit runs a second pass against itself with the prompt:
-
-> Assume your first pass missed at least 3 P1 bugs. Where are they?
-
-The audit must either produce new Shape A findings citing new file:line references not present in the first pass, or cite explicit Shape B adversarial-probe entries for each category it re-examined. An adversarial pass that returns "nothing new, confident first pass was complete" is REJECTED — produce evidence or findings, not confidence.
-
-For `/bugteam`, the single audit agent provides per-category coverage by walking all A–P rubrics in one invocation.
-
-## Merge rules
-
-When the LEAD combines findings from multiple sources (primary auditor, Haiku secondary auditor, adversarial pass), it applies these rules:
-
-- **De-dup key**: `(file, line, category)`. Two findings sharing the same `(file, line, category)` tuple are the same finding and collapse into one entry.
-- **Severity conflict**: max wins (`P0 > P1 > P2`). When sources disagree on severity for the same de-dup key, the merged entry keeps the highest severity.
-- **Unique-to-secondary findings**: added to the merged set with the secondary's severity and source annotation.
-- **Unique-to-primary findings**: kept as-is.
-- **Zero secondary findings**: primary set trusted; proceed.
-- **Malformed or non-parseable secondary output**: lead trusts the primary set and logs the event in `loop-<L>-diagnostics.json` under `haiku_findings` as `[{"parse_error": "<message>"}]`.
-
-## Post-fix self-audit
-
-Audit-and-fix skills (`/qbug`, `/bugteam`) MUST re-audit modified files between `py_compile` and `git add`. This catches fix-induced regressions in the same loop that introduced them rather than on loop N+1.
-
-Sequence:
-
-1. Capture pre-fix file contents for every file this FIX will touch.
-2. Apply edits.
-3. Run `py_compile` (or language-equivalent) on each modified file.
-4. Compute `fix_diff` against pre-fix contents for the modified set.
-5. Run `bugteam_code_rules_gate.py` with explicit paths for every modified file.
-6. Spawn a scoped audit of `fix_diff` with full A–P rigor, Shape A/B contract, adversarial pass, AND Haiku secondary in parallel (paranoid mode on post-fix).
-7. Any new findings become same-loop fix-targets. Internal iteration count increments by one.
-8. After 3 internal iterations with fresh findings each time, exit `stuck: post-fix audit not converging`.
-9. Only when `gate_findings` empty AND `post_fix_findings` empty: `git add`, commit, push.
-
-`converged` exit condition: `primary_audit_clean AND post_fix_audit_clean` for the committing loop.
-
-## De-dup and merge
-
-Findings from primary, adversarial, Haiku secondary, and post-fix passes are merged into a single deduped finding list before persistence.
-
-- **De-dup key:** `(file, line, category)`. Two findings sharing the same `(file, line, category)` tuple collapse into a single deduped entry.
-- **Severity conflict resolution:** `max wins`. When merged findings disagree on severity, the deduped entry carries the maximum severity (`P0 > P1 > P2`).
-- **Excerpt and failure_mode:** the deduped entry inherits these fields from the highest-severity contributing finding. Ties keep the first observed contributor.
-- **`evidence_files`:** the deduped entry carries the union of every contributor's `evidence_files`, deduplicated and sorted.
-
-The merged list lands in `loop-<L>-diagnostics.json` under both `merged` (one entry per contributing finding) and `deduped` (one entry per unique `(file, line, category)` tuple).
-
-## Persistence
-
-Every audit loop writes two JSON files under the skill's scoped temp directory (resolved via `tempfile.gettempdir()`):
-
-### `loop-<L>-audit.json`
-
-```json
-{
-  "findings": [],
-  "proof_of_absence": [],
-  "source": "primary | haiku | adversarial | merged"
-}
-```
-
-### `loop-<L>-diagnostics.json`
-
-```json
-{
-  "loop": 1,
-  "gate_findings": [],
-  "primary_findings": [],
-  "adversarial_findings": [],
-  "haiku_findings": [],
-  "post_fix_findings": [],
-  "merged": [],
-  "deduped": []
-}
-```
-
-All eight keys MUST be present. Missing keys break convergence debugging.

package/skills/bugteam/scripts/_bugteam_permissions_common.py

@@ -1,455 +0,0 @@
-"""Shared helpers for grant_project_claude_permissions and revoke_project_claude_permissions.
-
-Writes to ~/.claude/settings.json are atomic and permission-preserving: the
-target file's existing POSIX mode is captured, a sibling temp file is
-created via os.open with O_CREAT | O_EXCL and the preserved mode, content
-is written, then os.replace swaps it into place. Output is serialized with
-sort_keys=True for a stable on-disk layout; the first run on a hand-ordered
-settings file produces a one-time re-sort diff, subsequent writes are stable.
-"""
-
-import json
-import os
-import stat
-import sys
-from collections.abc import Callable
-from pathlib import Path
-from typing import NoReturn
-
-from bugteam_scripts_constants.claude_permissions_common_constants import (
-    ALL_TRUST_ENTRY_PROJECT_PATH_BOUNDARY_QUOTE_CHARACTERS,
-    ATOMIC_WRITE_TEMPORARY_SUFFIX,
-    DEFAULT_SETTINGS_FILE_MODE,
-    TEXT_FILE_ENCODING,
-)
-
-
-def exit_with_error(message: str) -> NoReturn:
-    print(f"Error: {message}", file=sys.stderr)
-    raise SystemExit(1)
-
-
-def path_contains_glob_metacharacters(candidate_path: str) -> bool:
-    """Check whether a path contains characters reserved for glob patterns.
-
-    Args:
-        candidate_path: The file path string to inspect.
-
-    Returns:
-        True when any glob metacharacter is present in the path.
-    """
-    glob_metacharacters_in_path: tuple[str, ...] = (
-        "*",
-        "?",
-        "[",
-        "]",
-        "(",
-        ")",
-        "{",
-        "}",
-        ",",
-    )
-    return any(
-        each_character in candidate_path
-        for each_character in glob_metacharacters_in_path
-    )
-
-
-def get_current_project_path() -> str:
-    """Return the normalized current working directory path.
-
-    Returns:
-        The cwd as a POSIX-style path string.
-
-    Raises:
-        ValueError: When the path contains glob metacharacters.
-    """
-    normalized_project_path = str(Path.cwd()).replace("\\", "/")
-    if path_contains_glob_metacharacters(normalized_project_path):
-        raise ValueError(
-            f"Current directory path contains glob metacharacters and cannot "
-            f"be used to build permission rules safely: {normalized_project_path}"
-        )
-    return normalized_project_path
-
-
-def build_permission_rule(tool_name: str, project_path: str) -> str:
-    return f"{tool_name}({project_path}/.claude/**)"
-
-
-def build_permission_rules(
-    project_path: str, all_permission_allow_tools: tuple[str, ...]
-) -> list[str]:
-    """Construct permission rule strings for each tool.
-
-    Args:
-        project_path: The POSIX-style project root path.
-        all_permission_allow_tools: Tool names to build rules for.
-
-    Returns:
-        List of permission rule strings for the given project path.
-    """
-    return [
-        build_permission_rule(each_tool, project_path)
-        for each_tool in all_permission_allow_tools
-    ]
-
-
-def build_agent_config_deny_rule(
-    tool_name: str, project_path: str, agent_config_path_pattern: str
-) -> str:
-    """Construct a deny rule for a single agent-config path pattern.
-
-    Args:
-        tool_name: The permission tool name (e.g., "Edit", "Write", "Read").
-        project_path: The POSIX-style project root path.
-        agent_config_path_pattern: The agent-config path pattern under .claude/.
-
-    Returns:
-        The deny rule string Claude Code matches against tool invocations.
-    """
-    return f"{tool_name}({project_path}/.claude/{agent_config_path_pattern})"
-
-
-def build_agent_config_deny_rules(
-    project_path: str,
-    all_permission_allow_tools: tuple[str, ...],
-    all_agent_config_path_patterns: tuple[str, ...],
-) -> list[str]:
-    """Construct deny rules covering every tool and pattern pair.
-
-    Args:
-        project_path: The POSIX-style project root path.
-        all_permission_allow_tools: Tool names to build deny rules for.
-        all_agent_config_path_patterns: Agent-config path patterns to deny under .claude/.
-
-    Returns:
-        List of deny rule strings, one per tool/pattern combination.
-    """
-    return [
-        build_agent_config_deny_rule(each_tool, project_path, each_pattern)
-        for each_tool in all_permission_allow_tools
-        for each_pattern in all_agent_config_path_patterns
-    ]
-
-
-def _is_project_path_token_at_word_boundary(
-    body_after_prefix: str, token_position: int
-) -> bool:
-    if token_position == 0:
-        return True
-    preceding_character = body_after_prefix[token_position - 1]
-    if preceding_character.isspace():
-        return True
-    return preceding_character in ALL_TRUST_ENTRY_PROJECT_PATH_BOUNDARY_QUOTE_CHARACTERS
-
-
-def is_trust_entry_for_project(
-    candidate_entry: object, project_path: str, prefix: str
-) -> bool:
-    """Detect whether an autoMode.environment entry is a trust entry for the project.
-
-    The predicate matches any string entry whose prefix matches the trust-entry
-    marker and that contains the project's .claude/** path token anchored on a
-    non-path boundary (the start of the body after the prefix, a whitespace
-    character, or a quote character). The boundary anchor prevents
-    cross-project false positives where the current project's path is a path
-    suffix of an unrelated entry's path. The exact wording after the prefix is
-    allowed to vary between template revisions.
-
-    Args:
-        candidate_entry: The autoMode.environment list value to inspect.
-        project_path: The POSIX-style project root path.
-        prefix: The literal prefix that marks a trust entry.
-
-    Returns:
-        True when the entry is a prior trust entry for this project.
-    """
-    if not isinstance(candidate_entry, str):
-        return False
-    if not candidate_entry.startswith(prefix):
-        return False
-    project_path_token = f"{project_path}/.claude/**"
-    body_after_prefix = candidate_entry[len(prefix):]
-    token_position = body_after_prefix.find(project_path_token)
-    while token_position != -1:
-        if _is_project_path_token_at_word_boundary(body_after_prefix, token_position):
-            return True
-        next_search_start = token_position + 1
-        token_position = body_after_prefix.find(project_path_token, next_search_start)
-    return False
-
-
-def remove_matching_entries_from_list(
-    all_target_list: list[object],
-    match_predicate: Callable[[object], bool],
-) -> int:
-    """Remove every entry from a list that satisfies the predicate.
-
-    Args:
-        all_target_list: The list to filter in place.
-        match_predicate: Function returning True for entries to remove.
-
-    Returns:
-        Number of entries removed.
-    """
-    original_length = len(all_target_list)
-    all_target_list[:] = [
-        each_value
-        for each_value in all_target_list
-        if not match_predicate(each_value)
-    ]
-    return original_length - len(all_target_list)
-
-
-def load_settings(settings_path: Path) -> dict[str, object]:
-    """Read and parse a JSON settings file from disk.
-
-    Args:
-        settings_path: Path to the JSON settings file.
-
-    Returns:
-        Parsed settings dictionary. Returns an empty dict when the file
-        does not exist.
-
-    Raises:
-        SystemExit: When the file exists but is not valid JSON, or when
-                    its root value is not a JSON object.
-    """
-    if not settings_path.exists():
-        return {}
-    parsed_settings: dict[str, object] = {}
-    try:
-        raw_text = settings_path.read_text(encoding=TEXT_FILE_ENCODING)
-    except OSError as read_error:
-        exit_with_error(f"Failed to read {settings_path}: {read_error}")
-    try:
-        parsed_settings = json.loads(raw_text)
-    except json.JSONDecodeError as decode_error:
-        exit_with_error(
-            f"Refusing to modify {settings_path}: existing file is not valid JSON "
-            f"({decode_error}). Fix or back up the file manually, then re-run."
-        )
-    if not isinstance(parsed_settings, dict):
-        exit_with_error(
-            f"Refusing to modify {settings_path}: existing file's root is "
-            f"{type(parsed_settings).__name__}, not a JSON object. Fix or back up "
-            f"the file manually, then re-run."
-        )
-    return parsed_settings
-
-
-def serialize_settings_to_json_text(all_settings: dict[str, object]) -> str:
-    """Serialize a settings dictionary to JSON text with stable formatting.
-
-    Args:
-        all_settings: The settings dictionary to serialize.
-
-    Returns:
-        Pretty-printed JSON string with sorted keys.
-    """
-    json_indent_width_columns: int = len("  ")
-    return json.dumps(
-        all_settings,
-        indent=json_indent_width_columns,
-        sort_keys=True,
-    )
-
-
-def get_mode_to_preserve(settings_path: Path) -> int:
-    """Return the file permission bits from an existing settings file.
-
-    Args:
-        settings_path: Path to the target settings file to stat.
-
-    Returns:
-        The permission bits from the file mode (lower portion).
-        Returns DEFAULT_SETTINGS_FILE_MODE when the file does not exist.
-    """
-    try:
-        stat_result = os.stat(settings_path)
-    except FileNotFoundError:
-        return DEFAULT_SETTINGS_FILE_MODE
-    except OSError as stat_error:
-        exit_with_error(f"Failed to stat {settings_path}: {stat_error}")
-    return stat.S_IMODE(stat_result.st_mode)
-
-
-def write_atomically_with_mode(
-    temporary_path: Path, serialized_content: str, file_mode: int
-) -> None:
-    """Create and write to a temporary file with the given mode.
-
-    Uses os.open with O_CREAT | O_EXCL to create the file securely,
-    then writes the serialized content. The caller is responsible for
-    replacing the target file with os.replace afterward.
-
-    Args:
-        temporary_path: Path for the temporary file (sibling of target).
-        serialized_content: The content to write to the temporary file.
-        file_mode: Unix permission bits for the new file (e.g., 0o600).
-
-    Raises:
-        OSError: When os.open or os.fdopen fails. The raw file descriptor
-            is closed before re-raising so the FD does not leak.
-        MemoryError: When os.fdopen runs out of buffer memory; the FD is
-            closed before re-raising.
-    """
-    file_descriptor = os.open(
-        str(temporary_path),
-        os.O_WRONLY | os.O_CREAT | os.O_EXCL,
-        file_mode,
-    )
-    try:
-        writer = os.fdopen(file_descriptor, "w", encoding=TEXT_FILE_ENCODING)
-    except (OSError, MemoryError):
-        os.close(file_descriptor)
-        try:
-            os.unlink(str(temporary_path))
-        except OSError:
-            pass
-        raise
-    with writer:
-        writer.write(serialized_content)
-
-
-def save_settings(settings_path: Path, all_settings: dict[str, object]) -> None:
-    """Write settings to a JSON file atomically with permission preservation.
-
-    Creates a temporary sibling file, writes content, then atomically
-    replaces the target. Cleans up the temporary file in a finally block.
-
-    Args:
-        settings_path: Path to the target settings JSON file.
-        all_settings: The settings dictionary to serialize and save.
-    """
-    settings_path.parent.mkdir(parents=True, exist_ok=True)
-    serialized_settings = serialize_settings_to_json_text(all_settings)
-    process_keyed_temporary_suffix = (
-        f"{ATOMIC_WRITE_TEMPORARY_SUFFIX}.{os.getpid()}"
-    )
-    temporary_path = settings_path.with_suffix(
-        settings_path.suffix + process_keyed_temporary_suffix
-    )
-    mode_to_preserve = get_mode_to_preserve(settings_path)
-    is_temp_owned_by_this_invocation = False
-    try:
-        try:
-            write_atomically_with_mode(
-                temporary_path, serialized_settings, mode_to_preserve
-            )
-            is_temp_owned_by_this_invocation = True
-            os.replace(str(temporary_path), str(settings_path))
-            is_temp_owned_by_this_invocation = False
-        except OSError as os_error:
-            exit_with_error(
-                f"Failed to write settings atomically to {settings_path}: {os_error}"
-            )
-    finally:
-        if is_temp_owned_by_this_invocation and temporary_path.exists():
-            try:
-                temporary_path.unlink()
-            except OSError as unlink_error:
-                print(
-                    f"Warning: could not remove temp file {temporary_path}: "
-                    f"{type(unlink_error).__name__}: {unlink_error}",
-                    file=sys.stderr,
-                )
-
-
-def append_if_missing(all_target_list: list[object], new_value: str) -> bool:
-    """Add a value to a list if it is not already present.
-
-    Args:
-        all_target_list: The list to potentially append to.
-        new_value: The string value to add if missing.
-
-    Returns:
-        True when the value was appended, False when it already existed.
-    """
-    if new_value in all_target_list:
-        return False
-    all_target_list.append(new_value)
-    return True
-
-
-def ensure_dict_section(
-    all_settings: dict[str, object], section_name: str
-) -> dict[str, object]:
-    """Return an existing dict section or create an empty one if absent.
-
-    A missing key and an explicit JSON null are treated identically: both
-    produce a fresh empty dict stored back into settings. Any other non-dict
-    value (string, list, number, bool) calls exit_with_error to avoid
-    overwriting user data.
-
-    Args:
-        all_settings: The parsed settings dictionary.
-        section_name: Key name of the section to retrieve or create.
-
-    Returns:
-        The existing or newly created section dictionary.
-    """
-    existing_section = all_settings.get(section_name)
-    if existing_section is None:
-        replacement_section: dict[str, object] = {}
-        all_settings[section_name] = replacement_section
-        return replacement_section
-    if not isinstance(existing_section, dict):
-        exit_with_error(
-            f"Refusing to modify settings key {section_name!r}: existing value "
-            f"is {type(existing_section).__name__}, not a JSON object. Fix or "
-            f"remove the key manually, then re-run."
-        )
-    return existing_section
-
-
-def ensure_list_entry(
-    all_section: dict[str, object], entry_name: str
-) -> list[object]:
-    """Return an existing list entry or create an empty one if absent.
-
-    A missing key and an explicit JSON null are treated identically: both
-    produce a fresh empty list stored back into the section. Any other
-    non-list value (string, dict, number, bool) calls exit_with_error to
-    avoid overwriting user data.
-
-    Args:
-        all_section: The parent dictionary section.
-        entry_name: Key name of the list entry to retrieve or create.
-
-    Returns:
-        The existing or newly created list entry.
-    """
-    existing_entry = all_section.get(entry_name)
-    if existing_entry is None:
-        replacement_entry: list[object] = []
-        all_section[entry_name] = replacement_entry
-        return replacement_entry
-    if not isinstance(existing_entry, list):
-        exit_with_error(
-            f"Refusing to modify settings entry {entry_name!r}: existing value "
-            f"is {type(existing_entry).__name__}, not a JSON array. Fix or "
-            f"remove the entry manually, then re-run."
-        )
-    return existing_entry
-
-
-def prune_empty_list_then_empty_section(
-    all_settings: dict[str, object], section_key: str, list_key: str
-) -> None:
-    """Remove an empty list key and its parent section if both are empty.
-
-    Args:
-        all_settings: The parsed settings dictionary to prune in place.
-        section_key: Key of the parent section to check.
-        list_key: Key of the list entry within the section.
-    """
-    section = all_settings.get(section_key)
-    if not isinstance(section, dict):
-        return
-    list_entry = section.get(list_key)
-    if isinstance(list_entry, list) and len(list_entry) == 0:
-        del section[list_key]
-    if len(section) == 0:
-        del all_settings[section_key]

package/skills/bugteam/scripts/bugteam_scripts_constants/claude_permissions_common_constants.py

@@ -1,69 +0,0 @@
-"""Configuration constants for claude_permissions_common shared helpers."""
-
-from __future__ import annotations
-
-TEXT_FILE_ENCODING: str = "utf-8"
-ALL_PERMISSION_ALLOW_TOOLS: tuple[str, ...] = ("Edit", "Write", "Read")
-ALL_AGENT_CONFIG_DENY_TOOLS: tuple[str, ...] = ("Edit", "Write", "Read", "Glob")
-ALL_AGENT_CONFIG_PATH_PATTERNS: tuple[str, ...] = (
-    "settings*.json",
-    "hooks/**",
-    "commands/**",
-    "agents/**",
-    "skills/**",
-    "mcp.json",
-    "CLAUDE.md",
-)
-AUTO_MODE_ENVIRONMENT_ENTRY_PREFIX: str = "Trusted local workspace:"
-
-
-def _describe_agent_config_pattern_for_humans(agent_config_path_pattern: str) -> str:
-    glob_suffix_under_directory = "/**"
-    file_name_for_special_phrasing = "mcp.json"
-    if agent_config_path_pattern.endswith(glob_suffix_under_directory):
-        directory_name = agent_config_path_pattern[
-            : -len(glob_suffix_under_directory)
-        ]
-        return f"anything under {directory_name}/"
-    if agent_config_path_pattern == file_name_for_special_phrasing:
-        return f"the {file_name_for_special_phrasing} file"
-    return agent_config_path_pattern
-
-
-def _build_agent_config_pattern_phrase(
-    all_agent_config_path_patterns: tuple[str, ...],
-) -> str:
-    all_described_patterns: list[str] = [
-        _describe_agent_config_pattern_for_humans(each_pattern)
-        for each_pattern in all_agent_config_path_patterns
-    ]
-    if len(all_described_patterns) <= 1:
-        return ", ".join(all_described_patterns)
-    leading_phrase_parts = ", ".join(all_described_patterns[:-1])
-    final_phrase_part = all_described_patterns[-1]
-    return f"{leading_phrase_parts}, and {final_phrase_part}"
-
-
-_AGENT_CONFIG_PATTERN_PHRASE: str = _build_agent_config_pattern_phrase(
-    ALL_AGENT_CONFIG_PATH_PATTERNS
-)
-
-AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE: str = (
-    f"Trusted local workspace: Files under {{project_path}}/.claude/** inherit "
-    f"the workspace's trust for Edit, Write, Read, and Glob operations EXCEPT "
-    f"for agent-config files: {_AGENT_CONFIG_PATTERN_PHRASE}. Edits to those "
-    f"agent-config files always require explicit per-edit user approval."
-)
-
-ALL_TRUST_ENTRY_PROJECT_PATH_BOUNDARY_QUOTE_CHARACTERS: tuple[str, ...] = ('"', "'")
-ATOMIC_WRITE_TEMPORARY_SUFFIX: str = ".tmp"
-GIT_DIRECTORY_MARKER: str = ".git"
-CLAUDE_DIRECTORY_MARKER: str = ".claude"
-CLAUDE_USER_SETTINGS_FILENAME: str = "settings.json"
-DEFAULT_SETTINGS_FILE_MODE: int = 0o600
-SETTINGS_PERMISSIONS_KEY: str = "permissions"
-SETTINGS_ALLOW_KEY: str = "allow"
-SETTINGS_DENY_KEY: str = "deny"
-SETTINGS_ADDITIONAL_DIRECTORIES_KEY: str = "additionalDirectories"
-SETTINGS_AUTO_MODE_KEY: str = "autoMode"
-SETTINGS_ENVIRONMENT_KEY: str = "environment"