claude-dev-env 1.93.1 → 1.95.0

package/hooks/blocking/test_tdd_enforcer_scratchpad.py

@@ -0,0 +1,105 @@
+"""Tests for the session-scratchpad exemption wired into tdd_enforcer.main."""
+
+import importlib.util
+import io
+import json
+import os
+import sys
+import tempfile
+from pathlib import Path
+from types import ModuleType
+
+import pytest
+
+TDD_ENFORCER_PATH = Path(__file__).parent / "tdd_enforcer.py"
+FIXED_USER_ID = 5150
+WORKING_DIRECTORY = "/home/user/project"
+SESSION_ID = "tdd-session-987"
+PRODUCTION_CONTENT = "def fulfill_order():\n    return True\n"
+
+
+def _load_tdd_enforcer() -> ModuleType:
+    module_spec = importlib.util.spec_from_file_location(
+        "tdd_enforcer_scratchpad_under_test", TDD_ENFORCER_PATH
+    )
+    assert module_spec is not None and module_spec.loader is not None
+    loaded_module = importlib.util.module_from_spec(module_spec)
+    module_spec.loader.exec_module(loaded_module)
+    return loaded_module
+
+
+_TDD_ENFORCER = _load_tdd_enforcer()
+
+
+def _install_scratchpad_signals(monkeypatch: pytest.MonkeyPatch, temporary_root: Path) -> Path:
+    monkeypatch.setattr(os, "getuid", lambda: FIXED_USER_ID, raising=False)
+    monkeypatch.setattr(tempfile, "gettempdir", lambda: str(temporary_root))
+    mangled_working_directory = WORKING_DIRECTORY.replace("/", "-")
+    scratchpad_directory = (
+        temporary_root
+        / f"claude-{FIXED_USER_ID}"
+        / mangled_working_directory
+        / SESSION_ID
+        / "scratchpad"
+    )
+    scratchpad_directory.mkdir(parents=True)
+    return scratchpad_directory
+
+
+def _write_payload(target: Path) -> dict[str, object]:
+    return {
+        "tool_name": "Write",
+        "cwd": WORKING_DIRECTORY,
+        "session_id": SESSION_ID,
+        "tool_input": {"file_path": str(target), "content": PRODUCTION_CONTENT},
+    }
+
+
+def _run_main(
+    monkeypatch: pytest.MonkeyPatch, payload: dict[str, object]
+) -> tuple[int | None, str]:
+    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(payload)))
+    captured_stdout = io.StringIO()
+    monkeypatch.setattr(sys, "stdout", captured_stdout)
+    exit_code: int | None = None
+    try:
+        _TDD_ENFORCER.main()
+    except SystemExit as raised_exit:
+        raw_code = raised_exit.code
+        exit_code = raw_code if isinstance(raw_code, int) else None
+    return exit_code, captured_stdout.getvalue()
+
+
+def _decision_from(stdout_text: str) -> str | None:
+    if not stdout_text.strip():
+        return None
+    parsed = json.loads(stdout_text)
+    return parsed.get("hookSpecificOutput", {}).get("permissionDecision")
+
+
+def test_scratchpad_production_write_is_exempt_from_tdd_gate(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    scratchpad_directory = _install_scratchpad_signals(monkeypatch, tmp_path)
+    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
+    throwaway_script = scratchpad_directory / "one_off_probe.py"
+
+    exit_code, stdout_text = _run_main(monkeypatch, _write_payload(throwaway_script))
+
+    assert exit_code == 0
+    assert _decision_from(stdout_text) != "deny"
+
+
+def test_identical_non_scratchpad_write_is_still_blocked(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_scratchpad_signals(monkeypatch, tmp_path)
+    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
+    outside_directory = tmp_path / "project" / "orders"
+    outside_directory.mkdir(parents=True)
+    production_module = outside_directory / "one_off_probe.py"
+
+    exit_code, stdout_text = _run_main(monkeypatch, _write_payload(production_module))
+
+    assert exit_code == 0
+    assert _decision_from(stdout_text) == "deny"

package/hooks/blocking/test_verdict_directory_write_blocker.py

@@ -16,8 +16,18 @@ import subprocess
 import sys
 
 _HOOK_DIR = pathlib.Path(__file__).parent
+_HOOKS_DIR = _HOOK_DIR.parent
 if str(_HOOK_DIR) not in sys.path:
     sys.path.insert(0, str(_HOOK_DIR))
+if str(_HOOKS_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_DIR))
+
+from hooks_constants.bash_pre_tool_use_dispatcher_constants import (  # noqa: E402
+    ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+    ALL_BASH_HOSTED_HOOK_ENTRIES,
+    BASH_TOOL_NAME,
+    POWERSHELL_TOOL_NAME,
+)
 
 guard_spec = importlib.util.spec_from_file_location(
     "verdict_directory_write_blocker",
@@ -708,18 +718,43 @@ def _pretooluse_commands_for_matcher(matcher_substring: str) -> list[str]:
     return matching_commands
 
 
-def test_guard_is_registered_on_bash() -> None:
+_VERDICT_GUARD_SCRIPT_RELATIVE_PATH = "blocking/verdict_directory_write_blocker.py"
+_BASH_DISPATCHER_BASENAME = "bash_pre_tool_use_dispatcher.py"
+
+
+def _verdict_guard_hosted_entries() -> list:
+    return [
+        each_entry
+        for each_entry in ALL_BASH_HOSTED_HOOK_ENTRIES
+        if each_entry.script_relative_path == _VERDICT_GUARD_SCRIPT_RELATIVE_PATH
+    ]
+
+
+def _assert_bash_dispatcher_registered_for_matcher(matcher_substring: str) -> None:
+    matching_commands = _pretooluse_commands_for_matcher(matcher_substring)
     assert any(
-        "verdict_directory_write_blocker.py" in each_command
-        for each_command in _pretooluse_commands_for_matcher("Bash")
+        _BASH_DISPATCHER_BASENAME in each_command
+        for each_command in matching_commands
+    ), (
+        f"bash_pre_tool_use_dispatcher.py must be registered on matcher containing "
+        f"{matcher_substring!r}; commands={matching_commands!r}"
     )
 
 
+def test_guard_is_registered_on_bash() -> None:
+    _assert_bash_dispatcher_registered_for_matcher("Bash")
+    matching_entries = _verdict_guard_hosted_entries()
+    assert len(matching_entries) == 1
+    assert matching_entries[0].applicable_tool_names == ALL_BASH_AND_POWERSHELL_TOOL_NAMES
+    assert BASH_TOOL_NAME in matching_entries[0].applicable_tool_names
+
+
 def test_guard_is_registered_on_powershell() -> None:
-    assert any(
-        "verdict_directory_write_blocker.py" in each_command
-        for each_command in _pretooluse_commands_for_matcher("PowerShell")
-    )
+    _assert_bash_dispatcher_registered_for_matcher("PowerShell")
+    matching_entries = _verdict_guard_hosted_entries()
+    assert len(matching_entries) == 1
+    assert matching_entries[0].applicable_tool_names == ALL_BASH_AND_POWERSHELL_TOOL_NAMES
+    assert POWERSHELL_TOOL_NAME in matching_entries[0].applicable_tool_names
 
 
 def test_hook_subprocess_imports_real_config_when_parent_holds_shadowing_config(

package/hooks/hooks_constants/CLAUDE.md

@@ -32,13 +32,14 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `dynamic_stderr_handler.py` | `DynamicStderrHandler` — a logging handler that resolves `sys.stderr` at emit time (for testability) |
 | `gh_pr_author_swap_constants.py` | Constants for the PR-author swap enforcement hooks |
 | `hardcoded_user_path_constants.py` | Patterns for detecting hardcoded home-directory paths |
+| `harness_scratchpad_constants.py` | Fixed path components (`claude-` user-directory prefix, separator replacement, `scratchpad` leaf name) and payload keys that rebuild the harness session scratchpad directory for the code-rules and TDD gate exemptions |
 | `hook_block_logger.py` | `log_hook_block()` — shared fail-safe logger every blocking hook calls to append a JSON record of each block decision to `~/.claude/logs/hook-blocks.log` |
 | `hook_log_extractor_constants.py` | Neon table name, offset state file path, timeouts, and outcome-type mapping for the hook-log extractor |
 | `hook_prose_detector_consistency_constants.py` | Trigger patterns and corrective messages for the hook-prose consistency checker |
 | `hosted_hook_runner.py` | `run_hook_capturing_output()` — shared runner that runs one dispatcher-hosted hook in-process via runpy and returns its captured stdout and crash flag |
 | `inline_tuple_string_magic_constants.py` | Patterns for detecting magic strings in inline tuple literals |
 | `js_conventions_constants.py` | Banned identifier set, boolean-prefix pattern, and declaration/JSDoc patterns for the JavaScript convention checks |
-| `local_identity.py` | Loader for the NAS host, ssh user, and ssh port the ssh enforcer guards, resolved from the `CLAUDE_NAS_*` env vars or `~/.claude/local-identity.json` with placeholder defaults; also composes the enforcer's two deny messages that quote those values |
+| `local_identity.py` | Loader for local machine values: NAS host, ssh user, and ssh port the ssh enforcer guards (`CLAUDE_NAS_*` / `~/.claude/local-identity.json` with placeholder defaults), plus the PII commit-scan exempt-repo slug set (`CLAUDE_PII_EXEMPT_REPOS` / `pii_exempt_repositories`); also composes the ssh enforcer's two deny messages that quote the NAS values |
 | `messages.py` | Short user-facing notice strings shown when a Stop hook redirects agent behavior |
 | `multi_edit_reconstruction.py` | `apply_edits()` / `edits_for_tool()` — shared helpers that reconstruct the post-edit content of an Edit or MultiEdit, imported by the blockers that judge post-edit content |
 | `nas_ssh_binary_enforcer_constants.py` | Bash tool name, ssh-family basenames, OpenSSH binary path suffixes, launcher-wrapper set, shell control-operator tokens and split pattern, leading-assignment and duration patterns, and the batch-mode pattern for the NAS ssh binary enforcer |
@@ -60,6 +61,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `python_style_checks_constants.py` | Command-line argument count and blank-line count between top-level functions for the style validator |
 | `reviewer_spawn_gate_constants.py` | Bash tool name, the sentinel marker, the Copilot and Bugbot trigger markers, the availability-script relative path and override env-var name, and the deny-message template for the reviewer-spawn gate |
 | `send_user_file_open_locally_blocker_constants.py` | Tool name, proactive status, and the block message for the open-locally attach blocker |
+| `sensitive_file_protector_constants.py` | Sensitive filename patterns, the committed-template suffixes that earn an exemption, the write/edit tool names, and the deny decision and message template for `sensitive_file_protector` |
 | `session_edit_stage_gate_constants.py` | Tracker filename prefix/suffix, JSON payload key, edit tool name set, session-id sanitize pattern, lock filename suffix and lock-acquire timing, git diff command, commit flag escapes, and deny-message template shared by the session edit stage gate trio |
 | `session_env_cleanup_constants.py` | Stale-age threshold and directory names for the session-env cleanup hook |
 | `session_handoff_blocker_constants.py` | Trigger phrases for the session-handoff blocker |
@@ -85,5 +87,5 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 - Hooks import from this package with `from hooks_constants.<module> import <CONSTANT>`.
 - Tests for these modules live beside them as `test_<module>.py`. Run with `python -m pytest hooks_constants/test_<name>.py`.
 - `dynamic_stderr_handler.py`, `pre_tool_use_stdin.py`, `multi_edit_reconstruction.py`, `hosted_hook_runner.py`, and `text_stripping.py` are utility modules (not pure constants) but live here because they are shared across many hooks.
-- `local_identity.py` is a loader: it reads the environment or `~/.claude/local-identity.json` to resolve the private NAS values, keeping a committed placeholder default.
+- `local_identity.py` is a loader: it reads the environment or `~/.claude/local-identity.json` to resolve private NAS values (with committed placeholder defaults) and the PII commit-scan exempt-repo slug set (`CLAUDE_PII_EXEMPT_REPOS` / `pii_exempt_repositories`).
 

package/hooks/hooks_constants/code_rules_path_utils_constants.py

@@ -22,8 +22,6 @@ ALL_CONFIG_DIRECTORY_NAMES = frozenset(
         "pr_converge_skill_constants",
         "pr_converge_scripts_constants",
         "bugteam_scripts_constants",
-        "implement_scripts_constants",
-        "log_audit_constants",
         "usage_pause_constants",
         "dev_env_scripts_constants",
     }

package/hooks/hooks_constants/harness_scratchpad_constants.py

@@ -0,0 +1,17 @@
+"""Constants for resolving the Claude Code harness session scratchpad directory.
+
+The harness gives each session a throwaway scratch directory it announces in
+the session's system prompt, laid out as
+``<tempdir>/claude-<uid>/<mangled-cwd>/<session-id>/scratchpad``. These constants
+name the fixed path components the code-rules and TDD gates read to rebuild that
+directory from the signals a hook process can see.
+
+The exemption is POSIX-only: without ``os.getuid`` (Windows) it never fires,
+so full enforcement stays in place there.
+"""
+
+HARNESS_SCRATCHPAD_USER_DIRECTORY_PREFIX: str = "claude-"
+HARNESS_SCRATCHPAD_PATH_SEPARATOR_REPLACEMENT: str = "-"
+HARNESS_SCRATCHPAD_LEAF_DIRECTORY_NAME: str = "scratchpad"
+HOOK_PAYLOAD_SESSION_ID_KEY: str = "session_id"
+HOOK_PAYLOAD_WORKING_DIRECTORY_KEY: str = "cwd"

package/hooks/hooks_constants/local_identity.py

@@ -1,19 +1,23 @@
-"""Resolve the NAS host, ssh user, and ssh port for the NAS ssh enforcer hook.
+"""Resolve local identity values for NAS ssh and PII exempt-repo hooks.
 
-The enforcer ships into ``~/.claude/`` and cannot read a repository file, so it
-reads the real NAS values from the environment or a git-ignored file in the
-Claude home directory, and it composes the two deny messages that quote those
-values. The committed defaults are placeholders.
+The enforcer hooks ship into ``~/.claude/`` and cannot read a repository file,
+so they read real machine values from the environment or a git-ignored file in
+the Claude home directory. This module supplies NAS host/user/port, the two
+NAS deny messages that quote those values, and the owner/repo slug set used by
+``pii_exempt_repository_slugs`` (``CLAUDE_PII_EXEMPT_REPOS`` /
+``pii_exempt_repositories``). The committed NAS defaults are placeholders.
 
 ::
 
-    CLAUDE_NAS_HOST set to a host   ->  nas_host() returns that host
-    CLAUDE_NAS_SSH_PORT set to 2200 ->  nas_ssh_port() returns 2200
-    (env unset, no file)            ->  nas_host() == "nas.example.local"
-                                        nas_ssh_port() == 22
+    CLAUDE_NAS_HOST set to a host              ->  nas_host() returns that host
+    CLAUDE_NAS_SSH_PORT set to 2200            ->  nas_ssh_port() returns 2200
+    CLAUDE_PII_EXEMPT_REPOS="Owner/repo"       ->  {"owner/repo"}
+    (env unset, no file)                       ->  nas_host() == "nas.example.local"
+                                                   nas_ssh_port() == 22
+                                                   pii_exempt_repository_slugs() == frozenset()
 
-Each value comes from its ``CLAUDE_NAS_*`` environment variable, then
-``~/.claude/local-identity.json``, then the placeholder default.
+Each value comes from its environment variable, then
+``~/.claude/local-identity.json``, then the placeholder default (NAS only).
 """
 
 from __future__ import annotations
@@ -23,6 +27,9 @@ import os
 from pathlib import Path
 
 NAS_HOST_ENV_VAR = "CLAUDE_NAS_HOST"
+PII_EXEMPT_REPOS_ENV_VAR = "CLAUDE_PII_EXEMPT_REPOS"
+PII_EXEMPT_REPOS_JSON_KEY = "pii_exempt_repositories"
+PII_EXEMPT_REPOS_SEPARATOR = ","
 NAS_SSH_USER_ENV_VAR = "CLAUDE_NAS_SSH_USER"
 NAS_SSH_PORT_ENV_VAR = "CLAUDE_NAS_SSH_PORT"
 NAS_JSON_KEY = "nas"
@@ -42,7 +49,7 @@ def _local_identity_file_path() -> Path:
     return Path.home() / CLAUDE_HOME_DIRECTORY_NAME / LOCAL_IDENTITY_FILE_NAME
 
 
-def _nas_section_from_local_file() -> dict[str, object]:
+def _identity_dictionary_from_local_file() -> dict[str, object]:
     identity_path = _local_identity_file_path()
     if not identity_path.is_file():
         return {}
@@ -50,12 +57,55 @@ def _nas_section_from_local_file() -> dict[str, object]:
         parsed_identity = json.loads(identity_path.read_text(encoding="utf-8"))
     except (OSError, ValueError, UnicodeDecodeError):
         return {}
-    if not isinstance(parsed_identity, dict):
-        return {}
-    nas_section = parsed_identity.get(NAS_JSON_KEY, {})
+    return parsed_identity if isinstance(parsed_identity, dict) else {}
+
+
+def _nas_section_from_local_file() -> dict[str, object]:
+    nas_section = _identity_dictionary_from_local_file().get(NAS_JSON_KEY, {})
     return nas_section if isinstance(nas_section, dict) else {}
 
 
+def _normalized_slug_set(all_raw_slugs: list[object]) -> frozenset[str]:
+    return frozenset(
+        each_slug.strip().lower()
+        for each_slug in all_raw_slugs
+        if isinstance(each_slug, str) and each_slug.strip()
+    )
+
+
+def pii_exempt_repository_slugs() -> frozenset[str]:
+    """Return owner/repo slugs whose commits skip the staged PII scan.
+
+    ::
+
+        CLAUDE_PII_EXEMPT_REPOS="Owner/repo-a, Other/b"  ->  {"owner/repo-a", "other/b"}
+        CLAUDE_PII_EXEMPT_REPOS=" , , " + file lists A   ->  {"a"}  (whitespace falls through)
+        (env unset, file lists ["Owner/repo-a"])         ->  {"owner/repo-a"}
+        (env unset, no file)                             ->  frozenset()
+
+    A non-empty environment variable (comma-separated) wins. When the variable
+    is unset or normalizes to no slugs, the ``pii_exempt_repositories`` list in
+    the git-ignored ``~/.claude/local-identity.json`` is used. Slugs are
+    lowercased so matching is case-insensitive.
+
+    Returns:
+        Lowercased ``owner/repo`` slugs exempt from staged-commit PII scanning.
+    """
+    slugs_from_environment = os.environ.get(PII_EXEMPT_REPOS_ENV_VAR)
+    if slugs_from_environment is not None:
+        normalized_environment_slugs = _normalized_slug_set(
+            list(slugs_from_environment.split(PII_EXEMPT_REPOS_SEPARATOR))
+        )
+        if normalized_environment_slugs:
+            return normalized_environment_slugs
+    stored_slugs = _identity_dictionary_from_local_file().get(
+        PII_EXEMPT_REPOS_JSON_KEY
+    )
+    if not isinstance(stored_slugs, list):
+        return frozenset()
+    return _normalized_slug_set(stored_slugs)
+
+
 def nas_host() -> str:
     """Return the NAS host the ssh enforcer guards.
 

package/hooks/hooks_constants/pii_prevention_constants.py

@@ -187,6 +187,22 @@ ALL_STAGED_FILES_COMMAND: tuple[str, ...] = (
 ALL_STAGED_BLOB_SHOW_COMMAND_PREFIX: tuple[str, ...] = ("git", "show")
 STAGED_BLOB_PREFIX: str = ":"
 
+ALL_GIT_ORIGIN_URL_COMMAND: tuple[str, ...] = (
+    "git",
+    "config",
+    "--get",
+    "remote.origin.url",
+)
+GIT_URL_SUFFIX: str = ".git"
+GITHUB_COM_HOST: str = "github.com"
+ALL_NETWORK_GIT_URL_SCHEMES: frozenset[str] = frozenset({"http", "https", "ssh"})
+SCP_STYLE_PATH_SEPARATOR: str = ":"
+USERINFO_HOST_SEPARATOR: str = "@"
+URL_SCHEME_SEPARATOR: str = "://"
+WINDOWS_PATH_SEPARATOR: str = "\\"
+POSIX_PATH_SEPARATOR: str = "/"
+MINIMUM_OWNER_REPO_SEGMENT_COUNT: int = 2
+
 BODY_FILE_ENCODING: str = "utf-8"
 NULL_BYTE_MARKER: bytes = b"\x00"
 MESSAGE_LINE_SEPARATOR: str = "\n"

package/hooks/hooks_constants/plain_language_blocker_constants.py

@@ -289,6 +289,11 @@ MARKDOWN_EXTENSION: str = ".md"
 ASK_USER_QUESTION_TOOL_NAME: str = "AskUserQuestion"
 ALL_WRITE_EDIT_TOOL_NAMES: frozenset[str] = frozenset({"Write", "Edit", "MultiEdit"})
 
+DOT_CLAUDE_DIRECTORY_NAME: str = ".claude"
+PROJECT_ALLOWLIST_FILENAME: str = "plain-language-allow.json"
+PROJECT_ROOT_WALK_LIMIT: int = 40
+REPOSITORY_MARKER_NAME: str = ".git"
+
 USER_FACING_PLAIN_LANGUAGE_NOTICE: str = (
     "Plain-language check: replace each flagged formal word with the simpler "
     "word named in the reason."

package/hooks/hooks_constants/pr_description_enforcer_constants.py

@@ -121,6 +121,7 @@ DEFAULT_READABILITY_THRESHOLDS: ReadabilityThresholds = ReadabilityThresholds(
 __all__ = [
     "ALL_HEAVY_OPENING_HEADERS",
     "ALL_HEAVY_TESTING_HEADERS",
+    "ALL_PR_NUMBER_BEARING_GH_PR_SUBCOMMANDS",
     "ALL_READABILITY_CLI_FLAG_TOKENS",
     "ATOMIC_WRITE_TEMP_SUFFIX",
     "BLOCKQUOTE_LINE_PATTERN",
@@ -135,7 +136,6 @@ __all__ = [
     "FLESCH_SYLLABLES_PER_WORD_COEFFICIENT",
     "FLESCH_WORDS_PER_SENTENCE_COEFFICIENT",
     "GH_PR_COMMAND_MIN_TOKEN_COUNT",
-    "ALL_PR_NUMBER_BEARING_GH_PR_SUBCOMMANDS",
     "HEADING_LINE_PATTERN",
     "HEAVY_MIN_BODY_CHARS_FOR_CLASSIFICATION",
     "HEAVY_SHAPE",

package/hooks/hooks_constants/sensitive_file_protector_constants.py

@@ -0,0 +1,42 @@
+"""Constants for the ``sensitive_file_protector`` PreToolUse hook.
+
+The hook denies a Write or Edit whose target basename names a live secret or a
+lock file, and steps aside for a placeholders-only committed template.
+"""
+
+from __future__ import annotations
+
+ALL_SENSITIVE_PATTERNS = (
+    ".env",
+    ".env.*",
+    "*.env",
+    "*.pem",
+    "*.key",
+    "*.p12",
+    "*.pfx",
+    "credentials.json",
+    "secrets.json",
+    "id_rsa",
+    "id_ed25519",
+    "package-lock.json",
+    "yarn.lock",
+    "Pipfile.lock",
+    "poetry.lock",
+    "pnpm-lock.yaml",
+    "composer.lock",
+)
+
+ALL_TEMPLATE_SUFFIXES = (".example", ".sample", ".template")
+
+ALL_WRITE_EDIT_TOOLS = ("Write", "Edit")
+
+HOOK_SCRIPT_NAME = "sensitive_file_protector.py"
+
+HOOK_EVENT_NAME = "PreToolUse"
+
+DENY_DECISION = "deny"
+
+DENY_REASON_TEMPLATE = (
+    "BLOCKED: Sensitive file '{filename}' (pattern: '{matched_pattern}'). "
+    "Edit manually outside Claude Code."
+)

package/hooks/hooks_constants/test_local_identity.py

@@ -66,6 +66,74 @@ class TestNasValuesPlaceholderDefault:
                 assert local_identity.nas_ssh_port() == 22
 
 
+class TestPiiExemptRepositorySlugs:
+    def should_read_slugs_from_the_environment_lowercased(self) -> None:
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_PII_EXEMPT_REPOS": "ExemptOwner/exempt-repo, Other/Repo"},
+            clear=False,
+        ):
+            slugs = local_identity.pii_exempt_repository_slugs()
+            assert slugs == frozenset({"exemptowner/exempt-repo", "other/repo"})
+
+    def should_read_slugs_from_the_local_identity_file(self, tmp_path: Path) -> None:
+        claude_home = tmp_path / ".claude"
+        claude_home.mkdir()
+        (claude_home / "local-identity.json").write_text(
+            json.dumps({"pii_exempt_repositories": ["FileOwner/file-repo"]}),
+            encoding="utf-8",
+        )
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("CLAUDE_PII_EXEMPT_REPOS", None)
+            with patch.object(Path, "home", return_value=tmp_path):
+                slugs = local_identity.pii_exempt_repository_slugs()
+                assert slugs == frozenset({"fileowner/file-repo"})
+
+    def should_return_an_empty_set_when_no_env_and_no_file(
+        self, tmp_path: Path
+    ) -> None:
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("CLAUDE_PII_EXEMPT_REPOS", None)
+            with patch.object(Path, "home", return_value=tmp_path):
+                assert local_identity.pii_exempt_repository_slugs() == frozenset()
+
+    def should_prefer_environment_slugs_over_local_identity_file(
+        self, tmp_path: Path
+    ) -> None:
+        claude_home = tmp_path / ".claude"
+        claude_home.mkdir()
+        (claude_home / "local-identity.json").write_text(
+            json.dumps({"pii_exempt_repositories": ["FileOwner/file-repo"]}),
+            encoding="utf-8",
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_PII_EXEMPT_REPOS": "EnvOwner/env-repo"},
+            clear=False,
+        ):
+            with patch.object(Path, "home", return_value=tmp_path):
+                slugs = local_identity.pii_exempt_repository_slugs()
+                assert slugs == frozenset({"envowner/env-repo"})
+
+    def should_fall_through_to_json_when_environment_is_whitespace_only(
+        self, tmp_path: Path
+    ) -> None:
+        claude_home = tmp_path / ".claude"
+        claude_home.mkdir()
+        (claude_home / "local-identity.json").write_text(
+            json.dumps({"pii_exempt_repositories": ["FileOwner/file-repo"]}),
+            encoding="utf-8",
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_PII_EXEMPT_REPOS": " , , "},
+            clear=False,
+        ):
+            with patch.object(Path, "home", return_value=tmp_path):
+                slugs = local_identity.pii_exempt_repository_slugs()
+                assert slugs == frozenset({"fileowner/file-repo"})
+
+
 class TestDenyMessagesQuoteTheResolvedHost:
     def should_include_the_resolved_host_and_port_in_the_bare_binary_message(
         self,

package/hooks/pyproject.toml

@@ -9,10 +9,24 @@
 mypy_path = "."
 python_version = "3.13"
 ignore_missing_imports = true
-warn_unused_ignores = true
+warn_unused_ignores = false
 warn_redundant_casts = true
 no_implicit_optional = true
 strict_equality = true
+exclude = [
+    "validators/test_files/",
+    "test_.*\\.py$",
+    ".*/test_.*\\.py$",
+    # One-line mypy fixes re-surface whole-file CODE_RULES debt at pre-commit (#51).
+    "abbreviation_checks\\.py$",
+    "git_checks\\.py$",
+    "exempt_paths\\.py$",
+    "code_rules_typeddict_stub\\.py$",
+    "validators/exempt_paths\\.py$",
+    "validators/abbreviation_checks\\.py$",
+    "validators/git_checks\\.py$",
+    "blocking/code_rules_typeddict_stub\\.py$",
+]
 
 [[tool.mypy.overrides]]
 module = "tests.*"
@@ -26,6 +40,7 @@ extend-exclude = [
     ".claude",
     "node_modules",
     "__pycache__",
+    "validators/test_files",
 ]
 
 [tool.ruff.lint]
@@ -39,16 +54,72 @@ select = [
     "SIM",
     "PL",
 ]
+# Gate-restore (#51): principled + pure-style ignores. Non-negotiable defect
+# classes stay selected; residual hits live under per-file-ignores where a
+# one-line fix is blocked by whole-file CODE_RULES pre-commit debt.
 ignore = [
     "E501",
+    "E402",
+    "UP038",
+    "UP006",
+    "UP007",
+    "UP015",
+    "UP017",
+    "UP020",
+    "UP024",
+    "UP035",
+    "UP045",
+    "I001",
+    "B009",
+    "F541",
+    "PLR0911",
+    "PLR0912",
     "PLR0913",
+    "PLR0915",
+    "PLR1714",
     "PLR2004",
+    "PLR5501",
+    "PLC0414",
+    "PLC0415",
+    "SIM101",
+    "SIM102",
+    "SIM103",
+    "SIM105",
+    "SIM109",
+    "SIM110",
+    "SIM113",
+    "SIM114",
+    "SIM117",
+    "SIM300",
 ]
 
 [tool.ruff.lint.per-file-ignores]
-"test_*.py" = ["B011", "PLR2004"]
-"*_test.py" = ["B011", "PLR2004"]
-"conftest.py" = ["B011"]
+"advisory/refactor_guard.py" = ["F401", "PLW1510"]
+"blocking/block_main_commit.py" = ["PLW1510"]
+"blocking/code_rules_boolean_mustcheck.py" = ["B905"]
+"blocking/code_rules_mock_completeness.py" = ["B007"]
+"blocking/code_rules_optional_params.py" = ["B905"]
+"blocking/code_rules_shared.py" = ["B905"]
+"blocking/code_rules_test_assertions.py" = ["B905"]
+"blocking/code_rules_typeddict_stub.py" = ["B905"]
+"blocking/pii_prevention_blocker.py" = ["PLW1510", "B018"]
+"blocking/pr_description_command_parser.py" = ["B904"]
+"blocking/precommit_code_rules_gate.py" = ["PLW1510"]
+"diagnostic/hook_log_extractor.py" = ["SIM115"]
+"git-hooks/post_commit.py" = ["F401", "PLW1510"]
+"hooks_constants/banned_identifiers_constants.py" = ["B033"]
+"session/plugin_data_dir_cleanup.py" = ["F401"]
+"validation/mypy_validator.py" = ["PLW1510"]
+"validators/exempt_paths.py" = ["F401"]
+"validators/health_check.py" = ["PLW1510"]
+"validators/mypy_integration.py" = ["PLW1510"]
+"validators/python_style_checks.py" = ["B905"]
+"validators/ruff_integration.py" = ["PLW1510"]
+"validators/run_all_validators.py" = ["PLW1510"]
+"workflow/auto_formatter.py" = ["PLW1510"]
+"test_*.py" = ["B011", "PLR2004", "F401", "F841", "PLW1510", "B905", "B033", "SIM115", "B007", "B018", "B904"]
+"*_test.py" = ["B011", "PLR2004", "F401", "F841", "PLW1510", "B905", "B033", "SIM115", "B007", "B018", "B904"]
+"conftest.py" = ["B011", "F401", "F841", "PLW1510"]
 
 [tool.coverage.run]
 branch = true

package/hooks/validators/CLAUDE.md

@@ -12,6 +12,7 @@ A library of check modules used by the validation hooks. Each module focuses on
 | `output_formatter.py` | Formats `Violation` lists into human-readable output |
 | `run_all_validators.py` | Entry point — runs every check module and aggregates results |
 | `health_check.py` | Verifies that all validator dependencies (ruff, mypy) are reachable |
+| `python_style_helpers.py` | Shared source-line splitting and function-discovery helpers imported by `python_style_checks.py` |
 
 ## Check modules
 
@@ -33,7 +34,6 @@ A library of check modules used by the validation hooks. Each module focuses on
 | `todo_checks.py` | TODO/FIXME markers without an associated issue reference |
 | `type_safety_checks.py` | Type-safety rules (no `Any`, no `cast`, no `# type: ignore`) |
 | `useless_test_checks.py` | Tests that check only existence or constant values |
-| `verify_paths.py` | Validates that file paths referenced in code actually exist |
 
 ## Subdirectory
 

package/hooks/validators/README.md

@@ -2,6 +2,8 @@
 
 AST-based Python style checks for code quality enforcement.
 
+The checks live in `python_style_checks.py`; the shared source-line splitting and function-discovery helpers they build on live in `python_style_helpers.py`.
+
 ## Checks Implemented
 
 1. **Imports at top** - All import statements must be at the top of the file