claude-dev-env 1.92.0 → 1.93.0

package/bin/expand_home_directory_tokens.mjs

@@ -0,0 +1,75 @@
+/**
+ * Install-time expansion of $HOME / ${HOME} / ~/ in settings.json commands.
+ *
+ * Hosts that require referenced env vars at hook load time (for example Grok)
+ * skip the hook when HOME is unset — common on Windows — so the installer
+ * rewrites residual tokens to absolute home paths.
+ */
+
+/**
+ * Expands $HOME, ${HOME}, and ~/ in a command string to an absolute home directory
+ * using forward slashes.
+ *
+ * Replacement uses split/join and function replacers so a home path that contains
+ * `$` (for example `$&` or `$1`) is inserted literally and is never treated as a
+ * String.prototype.replace special pattern.
+ *
+ * ::
+ *
+ *     expandHomeDirectoryTokens('python $HOME/a.py', 'C:\\Users\\x')
+ *     # -> 'python C:/Users/x/a.py'
+ *
+ *     expandHomeDirectoryTokens('python $HOME/a.py', 'C:/Users/$&evil')
+ *     # -> 'python C:/Users/$&evil/a.py'  (literal dollars, not regex rewrite)
+ *
+ * @param {string} commandString Hook or statusLine command text.
+ * @param {string} homeDirectory Absolute home directory (any path separators).
+ * @returns {string} Command with home tokens expanded.
+ */
+export function expandHomeDirectoryTokens(commandString, homeDirectory) {
+    const normalizedHome = homeDirectory.replace(/\\/g, '/').replace(/\/+$/, '');
+    let expandedCommand = commandString.split('${HOME}').join(normalizedHome);
+    expandedCommand = expandedCommand.replace(
+        /(?<![A-Za-z0-9_])\$HOME\b/g,
+        () => normalizedHome,
+    );
+    expandedCommand = expandedCommand.replace(
+        /(^|[\s"'=])~\//g,
+        (_fullMatch, boundary) => `${boundary}${normalizedHome}/`,
+    );
+    return expandedCommand;
+}
+
+/**
+ * Expands home-directory tokens in every settings.json hook command and in the
+ * optional statusLine command so residual $HOME entries from older installs
+ * become absolute paths and no longer require HOME at hook load time.
+ *
+ * @param {object} settings The parsed settings.json object (mutated in place).
+ * @param {string} homeDirectory Absolute home directory (any path separators).
+ * @returns {void}
+ */
+export function expandHomeDirectoryTokensInSettings(settings, homeDirectory) {
+    if (settings.hooks) {
+        for (const matcherGroups of Object.values(settings.hooks)) {
+            if (!Array.isArray(matcherGroups)) continue;
+            for (const eachGroup of matcherGroups) {
+                if (!eachGroup || !Array.isArray(eachGroup.hooks)) continue;
+                for (const eachHook of eachGroup.hooks) {
+                    if (typeof eachHook.command === 'string') {
+                        eachHook.command = expandHomeDirectoryTokens(
+                            eachHook.command,
+                            homeDirectory,
+                        );
+                    }
+                }
+            }
+        }
+    }
+    if (settings.statusLine && typeof settings.statusLine.command === 'string') {
+        settings.statusLine.command = expandHomeDirectoryTokens(
+            settings.statusLine.command,
+            homeDirectory,
+        );
+    }
+}

package/bin/install.mjs

@@ -8,6 +8,7 @@ import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 import { installAllGitHooks } from './git_hooks_installer.mjs';
 import { installMypyIniForClaudeHooks } from './install_mypy_ini.mjs';
+import { expandHomeDirectoryTokensInSettings } from './expand_home_directory_tokens.mjs';
 
 const CLAUDE_HOME = join(homedir(), '.claude');
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
@@ -18,6 +19,10 @@ const packageRequire = createRequire(import.meta.url);
 
 export const CONTENT_DIRECTORIES = ['rules', 'docs', 'commands', 'agents', 'system-prompts', 'scripts', '_shared', 'audit-rubrics'];
 
+export const CORE_INCLUDE_DIRECTORIES = [
+    'rules', 'docs', 'commands', 'agents', 'audit-rubrics', '_shared', 'scripts',
+];
+
 export function collectPackageSourceConflicts(packageDirectory) {
     const gitConflictStatusCodes = new Set(['DD', 'AU', 'UD', 'UA', 'DU', 'AA', 'UU']);
     const porcelainStatusLineMinLength = 4;
@@ -147,12 +152,13 @@ const INSTALL_GROUPS = {
     core: {
         description: 'Development standards, hooks, agents, commands',
         skills: [
-            'team-advisor', 'team-advisor-refresh',
+            'orchestrator', 'orchestrator-refresh', 'team-advisor',
             'anthropic-plan', 'everything-search',
             'pr-review-responder',
+            'privacy-hygiene',
             'recall', 'remember', 'task-build', 'verified-build'
         ],
-        includeDirectories: ['rules', 'docs', 'commands', 'agents', 'audit-rubrics'],
+        includeDirectories: CORE_INCLUDE_DIRECTORIES,
         includeAllHooks: true,
     },
     journal: {
@@ -507,17 +513,21 @@ function pruneManagedHooksFromEvent(settings, eventType, managedHookRelativePath
  * pruning every prior managed hook (standalone script or inline validators
  * runner) from each event's existing matcher groups before appending the freshly
  * rewritten copies so repeated merges stay idempotent and a managed hook moved to
- * a new matcher group does not double-run. User-authored hooks are preserved
- * untouched.
+ * a new matcher group does not double-run. User-authored hooks are preserved as
+ * entries, but residual $HOME / ${HOME} / ~/ tokens in every hook and statusLine
+ * command are expanded to absolute home paths so hosts that require referenced
+ * env vars at load time (Grok on Windows) can execute them.
  *
  * @param {object} settings The parsed settings.json object (mutated in place).
  * @param {{hooks: object}} hooksConfig Parsed hooks.json.
- * @param {string} pluginRootDir Directory ${CLAUDE_PLUGIN_ROOT} resolves to.
+ * @param {string} pluginRootDir Directory ${CLAUDE_PLUGIN_ROOT} resolves to
+ *   (the installer's `~/.claude` root; home is its parent directory).
  * @param {string} pythonCommand Interpreter command that replaces python3.
  * @returns {number} Count of matcher groups merged.
  */
 export function mergeHooksIntoSettings(settings, hooksConfig, pluginRootDir, pythonCommand) {
     const managedHookRelativePaths = managedHookScriptRelativePaths(hooksConfig);
+    const pluginRootForward = pluginRootDir.replace(/\\/g, '/');
     if (!settings.hooks) settings.hooks = {};
     let groupCount = 0;
     for (const [eventType, matcherGroups] of Object.entries(hooksConfig.hooks)) {
@@ -526,8 +536,11 @@ export function mergeHooksIntoSettings(settings, hooksConfig, pluginRootDir, pyt
         for (const sourceGroup of matcherGroups) {
             const rewrittenHooks = sourceGroup.hooks.map(hook => {
                 let command = hook.command;
-                command = command.replace(/\$\{CLAUDE_PLUGIN_ROOT\}/g, pluginRootDir.replace(/\\/g, '/'));
-                command = command.replace(/^python3\b/, pythonCommand);
+                command = command.replace(
+                    /\$\{CLAUDE_PLUGIN_ROOT\}/g,
+                    () => pluginRootForward,
+                );
+                command = command.replace(/^python3\b/, () => pythonCommand);
                 return { ...hook, command };
             });
             const existingIndex = settings.hooks[eventType].findIndex(
@@ -548,6 +561,7 @@ export function mergeHooksIntoSettings(settings, hooksConfig, pluginRootDir, pyt
             groupCount++;
         }
     }
+    expandHomeDirectoryTokensInSettings(settings, dirname(pluginRootDir));
     return groupCount;
 }
 

package/bin/install.test.mjs

@@ -9,6 +9,7 @@ import { pathToFileURL } from 'node:url';
 import {
     collectPackageSourceConflicts,
     CONTENT_DIRECTORIES,
+    CORE_INCLUDE_DIRECTORIES,
     FOLDED_HOOK_RELATIVE_PATHS,
     POST_FOLDED_HOOK_RELATIVE_PATHS,
     pythonCandidatesForPlatform,
@@ -21,6 +22,10 @@ import {
     mergeHooksIntoSettings,
     pruneManagedHooksFromSettings,
 } from './install.mjs';
+import {
+    expandHomeDirectoryTokens,
+    expandHomeDirectoryTokensInSettings,
+} from './expand_home_directory_tokens.mjs';
 
 
 function createTemporaryGitRepository() {
@@ -150,6 +155,18 @@ test('CONTENT_DIRECTORIES includes _shared so installer copies _shared/pr-loop/
 });
 
 
+test('core includeDirectories ships _shared and scripts for advisor protocol and CLI fallback', () => {
+    assert.ok(
+        CORE_INCLUDE_DIRECTORIES.includes('_shared'),
+        '_shared must ship with --only core so advisor-protocol.md lands for team-advisor/orchestrator',
+    );
+    assert.ok(
+        CORE_INCLUDE_DIRECTORIES.includes('scripts'),
+        'scripts must ship with --only core so claude_chain_runner.py is available for advisor CLI fallback',
+    );
+});
+
+
 test('CONTENT_DIRECTORIES includes audit-rubrics so installer copies category rubrics and prompts to ~/.claude/audit-rubrics/', () => {
     assert.ok(
         CONTENT_DIRECTORIES.includes('audit-rubrics'),
@@ -214,7 +231,7 @@ test('isWindowsStorePythonStub flags the Microsoft Store WindowsApps alias paths
         true,
     );
     assert.equal(
-        isWindowsStorePythonStub('C:/Users/jon/AppData/Local/Microsoft/WindowsApps/python.exe'),
+        isWindowsStorePythonStub('C:/Users/example/AppData/Local/Microsoft/WindowsApps/python.exe'),
         true,
     );
 });
@@ -239,6 +256,199 @@ test('interpreterCommandFromPath quotes an interpreter path that contains a spac
 });
 
 
+test('expandHomeDirectoryTokens expands $HOME, ${HOME}, and ~/', () => {
+    assert.equal(
+        expandHomeDirectoryTokens(
+            'python $HOME/.claude/hooks/session/fix_worktree_hookspath.py',
+            'C:\\Users\\x',
+        ),
+        'python C:/Users/x/.claude/hooks/session/fix_worktree_hookspath.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('python ${HOME}/.claude/hooks/a.py', '/home/x'),
+        'python /home/x/.claude/hooks/a.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('python ~/.claude/hooks/a.py', '/home/x'),
+        'python /home/x/.claude/hooks/a.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('echo $HOMEPATH', 'C:/Users/x'),
+        'echo $HOMEPATH',
+    );
+});
+
+
+test('expandHomeDirectoryTokens inserts dollar characters in home paths literally', () => {
+    const homeWithReplaceMetacharacters = 'C:/Users/$&evil$1';
+    assert.equal(
+        expandHomeDirectoryTokens('python $HOME/.claude/a.py', homeWithReplaceMetacharacters),
+        'python C:/Users/$&evil$1/.claude/a.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('python ${HOME}/.claude/a.py', homeWithReplaceMetacharacters),
+        'python C:/Users/$&evil$1/.claude/a.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('python ~/.claude/a.py', homeWithReplaceMetacharacters),
+        'python C:/Users/$&evil$1/.claude/a.py',
+    );
+});
+
+
+test('expandHomeDirectoryTokens expands ${HOME} before $HOME so braces stay intact', () => {
+    assert.equal(
+        expandHomeDirectoryTokens('python ${HOME}/.claude/a.py', '/home/x'),
+        'python /home/x/.claude/a.py',
+    );
+});
+
+
+test('expandHomeDirectoryTokens strips trailing slashes from the home directory', () => {
+    assert.equal(
+        expandHomeDirectoryTokens('python $HOME/.claude/a.py', 'C:/Users/x/'),
+        'python C:/Users/x/.claude/a.py',
+    );
+});
+
+
+test('expandHomeDirectoryTokensInSettings skips non-array hook event values', () => {
+    const settings = {
+        hooks: {
+            SessionStart: 'not-an-array',
+            PreToolUse: [
+                {
+                    matcher: 'Write',
+                    hooks: [{ type: 'command', command: 'python $HOME/.claude/hooks/a.py' }],
+                },
+            ],
+        },
+    };
+    expandHomeDirectoryTokensInSettings(settings, 'C:/Users/x');
+    assert.equal(settings.hooks.SessionStart, 'not-an-array');
+    assert.equal(
+        settings.hooks.PreToolUse[0].hooks[0].command,
+        'python C:/Users/x/.claude/hooks/a.py',
+    );
+});
+
+
+test('expandHomeDirectoryTokensInSettings rewrites hooks and statusLine', () => {
+    const settings = {
+        hooks: {
+            SessionStart: [
+                {
+                    matcher: '',
+                    hooks: [
+                        {
+                            type: 'command',
+                            command: 'python $HOME/.claude/hooks/session/fix_worktree_hookspath.py',
+                        },
+                    ],
+                },
+            ],
+        },
+        statusLine: {
+            type: 'command',
+            command: 'python "$HOME/.claude/statusline-command.py"',
+        },
+    };
+    expandHomeDirectoryTokensInSettings(settings, 'C:/Users/x');
+    assert.equal(
+        settings.hooks.SessionStart[0].hooks[0].command,
+        'python C:/Users/x/.claude/hooks/session/fix_worktree_hookspath.py',
+    );
+    assert.equal(
+        settings.statusLine.command,
+        'python "C:/Users/x/.claude/statusline-command.py"',
+    );
+});
+
+
+test('mergeHooksIntoSettings expands residual $HOME in preserved user hooks', () => {
+    const hooksConfig = {
+        hooks: {
+            SessionStart: [
+                {
+                    matcher: '',
+                    hooks: [
+                        {
+                            type: 'command',
+                            command: 'python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/session_env_cleanup.py',
+                        },
+                    ],
+                },
+            ],
+        },
+    };
+    const settings = {
+        hooks: {
+            SessionStart: [
+                {
+                    matcher: '',
+                    hooks: [
+                        {
+                            type: 'command',
+                            command: 'python $HOME/.claude/hooks/session/fix_worktree_hookspath.py',
+                        },
+                    ],
+                },
+            ],
+        },
+    };
+    mergeHooksIntoSettings(settings, hooksConfig, 'C:/Users/x/.claude', 'C:/Python313/python.exe');
+    const allCommands = settings.hooks.SessionStart[0].hooks.map(eachHook => eachHook.command);
+    assert.ok(
+        allCommands.includes(
+            'python C:/Users/x/.claude/hooks/session/fix_worktree_hookspath.py',
+        ),
+    );
+    assert.ok(
+        allCommands.includes(
+            'C:/Python313/python.exe C:/Users/x/.claude/hooks/session/session_env_cleanup.py',
+        ),
+    );
+    for (const eachCommand of allCommands) {
+        assert.equal(eachCommand.includes('$HOME'), false);
+        assert.equal(eachCommand.includes('${HOME}'), false);
+    }
+});
+
+
+test('mergeHooksIntoSettings inserts dollar characters in plugin root and interpreter literally', () => {
+    const pluginRootWithReplaceMetacharacters = 'C:/Users/$&evil$1/.claude';
+    const pythonWithReplaceMetacharacters = 'C:/Users/$&evil$1/Python/python.exe';
+    const hooksConfig = {
+        hooks: {
+            SessionStart: [
+                {
+                    matcher: '',
+                    hooks: [
+                        {
+                            type: 'command',
+                            command: 'python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/session_env_cleanup.py',
+                        },
+                    ],
+                },
+            ],
+        },
+    };
+    const settings = {};
+    mergeHooksIntoSettings(
+        settings,
+        hooksConfig,
+        pluginRootWithReplaceMetacharacters,
+        pythonWithReplaceMetacharacters,
+    );
+    const rewrittenCommand = settings.hooks.SessionStart[0].hooks[0].command;
+    assert.equal(
+        rewrittenCommand,
+        'C:/Users/$&evil$1/Python/python.exe C:/Users/$&evil$1/.claude/hooks/session/session_env_cleanup.py',
+    );
+    assert.equal(rewrittenCommand.includes('${CLAUDE_PLUGIN_ROOT}'), false);
+});
+
+
 test('mergeHooksIntoSettings substitutes a quoted absolute interpreter path for the python3 prefix', () => {
     const hooksConfig = {
         hooks: {
@@ -374,14 +584,14 @@ test('commandReferencesManagedHook matches managed scripts written with $HOME, ~
     assert.ok(commandReferencesManagedHook('python $HOME/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
     assert.ok(commandReferencesManagedHook('python ~/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
     assert.ok(commandReferencesManagedHook('python ${HOME}/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
-    assert.ok(commandReferencesManagedHook('py -3 C:/Users/jonlo/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
-    assert.ok(commandReferencesManagedHook('python /Users/jon/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
+    assert.ok(commandReferencesManagedHook('py -3 C:/Users/example/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
+    assert.ok(commandReferencesManagedHook('python /Users/example/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
 });
 
 
 test('commandReferencesManagedHook matches Windows backslash paths', () => {
     const managedPaths = new Set(['blocking/hedging_language_blocker.py']);
-    assert.ok(commandReferencesManagedHook('py -3 C:\\Users\\jonlo\\.claude\\hooks\\blocking\\hedging_language_blocker.py', managedPaths));
+    assert.ok(commandReferencesManagedHook('py -3 C:\\Users\\example\\.claude\\hooks\\blocking\\hedging_language_blocker.py', managedPaths));
 });
 
 
@@ -414,7 +624,7 @@ test('commandReferencesManagedHook matches a managed script followed by a whites
 test('commandReferencesManagedHook matches the rewritten inline validators-runner hook that carries no script tail', () => {
     const managedPaths = new Set(['blocking/code_rules_enforcer.py']);
     const rewrittenInlineCommand =
-        "py -3 -c \"import sys; sys.path.insert(0, r'C:/Users/jonlo/.claude/hooks'); from validators.run_all_validators import main; sys.exit(main())\"";
+        "py -3 -c \"import sys; sys.path.insert(0, r'C:/Users/example/.claude/hooks'); from validators.run_all_validators import main; sys.exit(main())\"";
     assert.ok(commandReferencesManagedHook(rewrittenInlineCommand, managedPaths));
 });
 
@@ -462,7 +672,7 @@ test('mergeHooksIntoSettings is idempotent for the inline -c validators hook acr
         },
     };
     const settings = {};
-    const pluginRootDir = 'C:/Users/jonlo/.claude';
+    const pluginRootDir = 'C:/Users/example/.claude';
 
     mergeHooksIntoSettings(settings, hooksConfig, pluginRootDir, 'py -3');
     mergeHooksIntoSettings(settings, hooksConfig, pluginRootDir, 'py -3');
@@ -499,8 +709,8 @@ test('mergeHooksIntoSettings preserves user hooks in a managed matcher group acr
         },
     };
 
-    mergeHooksIntoSettings(settings, hooksConfig, 'C:/Users/jonlo/.claude', 'py -3');
-    mergeHooksIntoSettings(settings, hooksConfig, 'C:/Users/jonlo/.claude', 'py -3');
+    mergeHooksIntoSettings(settings, hooksConfig, 'C:/Users/example/.claude', 'py -3');
+    mergeHooksIntoSettings(settings, hooksConfig, 'C:/Users/example/.claude', 'py -3');
 
     const writeEditGroup = settings.hooks.PreToolUse.find(group => group.matcher === 'Write|Edit');
     const userHookSurvivors = writeEditGroup.hooks.filter(hook => hook.command === userHookCommand);
@@ -540,7 +750,7 @@ test('pruneManagedHooksFromSettings removes managed hooks in every home-path and
                     hooks: [
                         { command: 'python $HOME/.claude/hooks/notification/attention_needed_notify.py', timeout: 15 },
                         { command: 'python ${HOME}/.claude/hooks/notification/attention_needed_notify.py', timeout: 15 },
-                        { command: 'py -3 C:\\Users\\jonlo\\.claude\\hooks\\notification\\attention_needed_notify.py', timeout: 15 },
+                        { command: 'py -3 C:\\Users\\example\\.claude\\hooks\\notification\\attention_needed_notify.py', timeout: 15 },
                         { command: userHookCommand, timeout: 5 },
                     ],
                 },
@@ -637,7 +847,7 @@ test('purge set sourced from package hooks.json prunes standalone managed script
                     {
                         matcher: 'Write|Edit',
                         hooks: [
-                            { command: 'py -3 C:\\Users\\jonlo\\.claude\\hooks\\blocking\\code_rules_enforcer.py', timeout: 30 },
+                            { command: 'py -3 C:\\Users\\example\\.claude\\hooks\\blocking\\code_rules_enforcer.py', timeout: 30 },
                             { command: userHookCommand, timeout: 5 },
                         ],
                     },

package/hooks/CLAUDE.md

@@ -14,7 +14,7 @@ Python hook scripts wired into Claude Code's lifecycle via `settings.json`. Each
 | `diagnostic/queries/` | Parameterized SQL queries for inspecting blocked commands |
 | `git-hooks/` | Native git hooks (`pre-commit`, `pre-push`, `post-commit`) installed via the git-hooks path |
 | `git-hooks/git_hooks_constants/` | Shared constants for the git-hook scripts |
-| `hooks_constants/` | Shared constant modules imported by multiple hooks across this tree |
+| `hooks_constants/` | Shared constant modules imported by multiple hooks across this tree (includes `pii_prevention_constants.py` for personal-data and secret scan patterns) |
 | `lifecycle/` | Hooks that run at session or config-change boundaries |
 | `observability/` | PostToolUse hooks that record agent behavior for diagnostics |
 | `session/` | SessionStart and SessionEnd hooks for per-session cleanup |

package/hooks/blocking/CLAUDE.md

@@ -50,6 +50,7 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `code_rules_shared.py` | Shared dataclasses and helpers used by multiple check modules |
 | `code_rules_string_magic.py` | Magic string detection with masking and f-string support; whitespace-only indentation literals in function bodies |
 | `code_rules_test_assertions.py` | Test assertion style rules |
+| `code_rules_test_layout.py` | Dead scaffolding in a test module: a private module constant read by no other line, and an unused parameter on a private test helper |
 | `code_rules_test_branching_except.py` | No bare or broad `except` in test branches |
 | `code_rules_test_isolation.py` | Tests must not rely on home-dir or temp-dir side effects |
 | `code_rules_type_escape.py` | No `Any` imports, `cast()`, or `# type: ignore` outside boundary files |
@@ -78,8 +79,10 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `hook_prose_detector_consistency.py` | PreToolUse (Write/Edit) | Hook docstrings/messages that claim a trigger the detector cannot fire on |
 | `intent_only_ending_blocker.py` | Stop | Responses that end on a plan or intent without doing the work |
 | `open_questions_in_plans_blocker.py` | PreToolUse (Write/Edit) | Plan documents with unresolved open questions |
-| `nas_ssh_binary_enforcer.py` | PreToolUse (Bash) | A bare `ssh`/`scp`/`sftp` command word targeting the NAS at `192.168.1.100` (Git Bash's MSYS ssh stalls on an interactive password prompt), or the full `System32/OpenSSH` binary to that host without `-o BatchMode=yes` |
+| `nas_ssh_binary_enforcer.py` | PreToolUse (Bash) | A bare `ssh`/`scp`/`sftp` command word targeting the NAS (Git Bash's MSYS ssh stalls on an interactive password prompt), or the full `System32/OpenSSH` binary to that host without `-o BatchMode=yes` |
 | `package_inventory_stale_blocker.py` | PreToolUse (Write) | A new production code file created in a directory whose `README.md`/`CLAUDE.md` inventory (or a parent skill's `SKILL.md` Layout table mapping the `scripts/` subdirectory) names two or more sibling files but no entry for the new file |
+| `pii_prevention_blocker.py` | PreToolUse (Write/Edit/MultiEdit/Bash/PowerShell/MCP GitHub) | Content that carries high-confidence personal data or secrets (real emails, home-dir paths, private IPs, credential material) on write, durable GitHub posts, or staged commit paths |
+| `pii_scanner.py` | library | Pure text scanners shared by `pii_prevention_blocker.py` |
 | `plain_language_blocker.py` | PreToolUse (Write/Edit/AskUserQuestion) | Heavy or jargon words in user-facing prose |
 | `pr_converge_bugteam_enforcer.py` | PreToolUse | Enforces that bugteam runs in parallel with bugbot in pr-converge loops |
 | `pr_description_enforcer.py` | PreToolUse (Bash) | `gh pr create`/`edit`/`comment` bodies that fail the Anthropic claude-code style audit, proof-shaped `gh pr comment` bodies missing proof-of-work parts, and `gh pr ready` while the PR carries no passing proof comment |

package/hooks/blocking/_path_setup.py

@@ -0,0 +1,13 @@
+"""Add the hooks directory to sys.path for sibling entry-point dispatchers.
+
+Importing this module inserts the hooks directory (this file's parent's parent)
+at the front of sys.path so a dispatcher that runs as a standalone script from
+blocking/ can import hooks_constants with every import kept at module top.
+"""
+
+import sys
+from pathlib import Path
+
+_hooks_directory = str(Path(__file__).resolve().parent.parent)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)