claude-dev-env 1.94.0 → 2.0.0

package/hooks/blocking/tests/test_repository_exemption.py

@@ -0,0 +1,105 @@
+"""Behavioral tests for the moved repository-exemption helpers.
+
+Covers the origin-URL slug parser and the per-repository exemption decision::
+
+    https://github.com/Owner/Repo.git   ->  owner/repo
+    https://evil.test/Owner/Repo.git    ->  None
+    ok:   origin slug in CLAUDE_PII_EXEMPT_REPOS  ->  exempt (True)
+    flag: origin slug absent from the exempt set  ->  scanned (False)
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+from pathlib import Path
+
+import pytest
+from pii_prevention_blocker_parts.repository_exemption import (
+    _is_repository_exempt_from_pii_scan,
+    _owner_repo_slug_from_origin_url,
+    repository_allowlisted_values,
+)
+
+_ALLOWED_VALUE = "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
+
+
+def _write_allowlist_identity(identity_path: Path, slug: str) -> None:
+    identity_path.write_text(
+        json.dumps({"pii_allowlisted_values": {slug: [_ALLOWED_VALUE]}}),
+        encoding="utf-8",
+    )
+
+
+def test_repository_allowlisted_values_returns_the_mapped_values(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, "AllowOwner/allow-repo")
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, "AllowOwner/allow-repo")
+    assert repository_allowlisted_values(repository_root) == frozenset({_ALLOWED_VALUE})
+
+
+def test_repository_allowlisted_values_empty_for_an_unmapped_repo(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, "AllowOwner/allow-repo")
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, "OtherOwner/other-repo")
+    assert repository_allowlisted_values(repository_root) == frozenset()
+
+
+def test_github_https_origin_yields_lowercased_owner_repo_slug() -> None:
+    assert _owner_repo_slug_from_origin_url("https://github.com/Owner/Repo.git") == "owner/repo"
+
+
+def test_github_ssh_origin_yields_lowercased_owner_repo_slug() -> None:
+    assert _owner_repo_slug_from_origin_url("git@github.com:Owner/Repo.git") == "owner/repo"
+
+
+def test_spoofed_host_origin_yields_no_slug() -> None:
+    assert _owner_repo_slug_from_origin_url("https://evil.test/Owner/Repo.git") is None
+
+
+def _init_repo_with_github_origin(repository_root: Path, origin_slug: str) -> None:
+    repository_root.mkdir(parents=True, exist_ok=True)
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    origin_url = "https://github.com/" + origin_slug + ".git"
+    subprocess.run(
+        ["git", "remote", "add", "origin", origin_url],
+        cwd=repository_root,
+        check=True,
+    )
+
+
+def test_repository_with_exempt_origin_is_exempt(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setenv("CLAUDE_PII_EXEMPT_REPOS", "ExemptOwner/exempt-repo")
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, "ExemptOwner/exempt-repo")
+    assert _is_repository_exempt_from_pii_scan(repository_root) is True
+
+
+def test_repository_with_unlisted_origin_is_scanned(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setenv("CLAUDE_PII_EXEMPT_REPOS", "ExemptOwner/exempt-repo")
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, "OtherOwner/other-repo")
+    assert _is_repository_exempt_from_pii_scan(repository_root) is False
+
+
+def test_repository_without_origin_is_never_exempt(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    assert _is_repository_exempt_from_pii_scan(repository_root) is False
+
+
+def test_owner_repo_slug_strips_a_trailing_slash_origin() -> None:
+    assert _owner_repo_slug_from_origin_url("https://github.com/Owner/Repo/") == "owner/repo"

package/hooks/blocking/tests/test_repository_resolution.py

@@ -0,0 +1,108 @@
+"""Behavioral tests for the commit repository-path resolution helpers.
+
+Covers reading the repository a commit command targets, so the staged PII scan
+runs against the named path rather than the session working directory::
+
+    git -C /a -C sub commit   ->  /a/sub   (multiple -C compose)
+    git -C /a/b -C /c/d commit ->  /c/d    (a later absolute -C resets)
+    cd "/my repo" && git commit ->  /my repo (quoted cd path, shlex-parsed)
+    git commit                 ->  None     (runs in the session cwd)
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from pii_prevention_blocker_parts.repository_resolution import (
+    compose_command_working_directory,
+    expand_user_directory,
+    refusal_reason_for_unresolved_repository,
+)
+
+
+def test_single_absolute_dash_c_is_the_target() -> None:
+    assert compose_command_working_directory("git -C /repo commit -m x") == "/repo"
+
+
+def test_relative_dash_c_composes_onto_a_leading_absolute_dash_c() -> None:
+    composed = compose_command_working_directory("git -C /a -C sub commit -m x")
+    assert composed is not None
+    assert Path(composed) == Path("/a") / "sub"
+
+
+def test_later_absolute_dash_c_resets_the_composition() -> None:
+    assert compose_command_working_directory("git -C /a/b -C /c/d commit -m x") == "/c/d"
+
+
+def test_quoted_dash_c_with_spaces_is_read_whole() -> None:
+    assert compose_command_working_directory('git -C "/my repo" commit -m x') == "/my repo"
+
+
+def test_leading_cd_supplies_the_target_when_no_dash_c() -> None:
+    assert compose_command_working_directory("cd /work/repo && git commit -m x") == "/work/repo"
+
+
+def test_quoted_cd_path_with_spaces_is_read_whole() -> None:
+    assert compose_command_working_directory('cd "/my repo" && git commit -m x') == "/my repo"
+
+
+def test_plain_commit_names_no_target() -> None:
+    assert compose_command_working_directory("git commit -m x") is None
+
+
+def test_expand_user_directory_expands_tilde() -> None:
+    expanded = expand_user_directory("~/repo")
+    assert expanded is not None
+    assert not expanded.startswith("~")
+    assert Path(expanded).name == "repo"
+
+
+def test_expand_user_directory_passes_none_through() -> None:
+    assert expand_user_directory(None) is None
+
+
+def test_refusal_names_the_attempted_path() -> None:
+    reason = refusal_reason_for_unresolved_repository("/gone/repo")
+    assert "repository root" in reason
+    assert "/gone/repo" in reason
+
+
+def test_refusal_names_the_session_cwd_when_no_path_given() -> None:
+    reason = refusal_reason_for_unresolved_repository(None)
+    assert "repository root" in reason
+    assert "session working directory" in reason
+
+
+def test_windows_git_exe_dash_c_is_the_target() -> None:
+    assert (
+        compose_command_working_directory(r'git.exe -C "/srv/repo" commit -m x')
+        == "/srv/repo"
+    )
+
+
+def test_leading_cd_with_git_exe_supplies_the_target() -> None:
+    assert (
+        compose_command_working_directory("cd /work/repo && git.exe commit -m x")
+        == "/work/repo"
+    )
+
+
+def test_leading_pushd_with_git_exe_supplies_the_target() -> None:
+    assert (
+        compose_command_working_directory("pushd /work/repo; git.exe commit -m x")
+        == "/work/repo"
+    )
+
+
+def test_quoted_cd_path_with_git_exe_is_read_whole() -> None:
+    assert (
+        compose_command_working_directory('cd "/my repo" && git.exe commit -m x')
+        == "/my repo"
+    )
+
+
+def test_dash_c_wins_over_leading_cd() -> None:
+    assert (
+        compose_command_working_directory("cd /ignored && git -C /named commit -m x")
+        == "/named"
+    )

package/hooks/diagnostic/hook_log_extractor.py

@@ -309,7 +309,7 @@ class AttachmentRecordIterator:
 
     def __iter__(self) -> Iterator[tuple[dict[str, object], int, int]]:
         try:
-            jsonl_file_handle = io.open(self._jsonl_file_path, "rb")
+            jsonl_file_handle = io.open(self._jsonl_file_path, "rb")  # noqa: SIM115
         except (FileNotFoundError, OSError):
             self.final_line_number = self._start_line_number
             self.final_byte_offset = self._start_offset
@@ -419,14 +419,13 @@ def save_offsets(
     state_file_parent = os.path.dirname(state_file_path)
     if state_file_parent:
         os.makedirs(state_file_parent, exist_ok=True)
-    temporary_file_handle = tempfile.NamedTemporaryFile(
+    with tempfile.NamedTemporaryFile(
         mode="w",
         encoding="utf-8",
         dir=state_file_parent or None,
         delete=False,
-    )
-    temporary_file_path = temporary_file_handle.name
-    try:
+    ) as temporary_file_handle:
+        temporary_file_path = temporary_file_handle.name
         try:
             json.dump(
                 offset_by_jsonl_path,
@@ -436,8 +435,14 @@ def save_offsets(
             )
             temporary_file_handle.flush()
             os.fsync(temporary_file_handle.fileno())
-        finally:
+        except Exception:
             temporary_file_handle.close()
+            try:
+                os.unlink(temporary_file_path)
+            except OSError:
+                pass
+            raise
+    try:
         os.replace(temporary_file_path, state_file_path)
     except Exception:
         try:
@@ -468,15 +473,12 @@ def _acquire_offsets_lock(state_file_path: str) -> Iterator[None]:
     lock_parent_directory = os.path.dirname(lock_file_path)
     if lock_parent_directory:
         os.makedirs(lock_parent_directory, exist_ok=True)
-    lock_file_handle = io.open(lock_file_path, "a+", encoding="utf-8")
-    try:
+    with io.open(lock_file_path, "a+", encoding="utf-8") as lock_file_handle:
         _lock_file_handle_blocking(lock_file_handle)
         try:
             yield
         finally:
             _unlock_file_handle(lock_file_handle)
-    finally:
-        lock_file_handle.close()
 
 
 def _lock_file_handle_blocking(lock_file_handle: IO[str]) -> None:

package/hooks/git-hooks/post_commit.py

@@ -10,7 +10,6 @@ When you commit in a submodule, this hook:
 This prevents the "lost work" issue where submodule commits aren't tracked by parent.
 """
 
-import os
 import subprocess
 import sys
 from pathlib import Path
@@ -21,7 +20,7 @@ def run_git(*args: str, cwd: Path | None = None) -> str:
     result = subprocess.run(
         ["git"] + list(args),
         cwd=cwd,
-        capture_output=True,
+        check=False, capture_output=True,
         text=True,
     )
     return result.stdout.strip()
@@ -74,7 +73,7 @@ def main() -> int:
 
     diff_result = subprocess.run(
         ["git", "diff", "--cached", "--quiet"],
-        cwd=parent_repo,
+        check=False, cwd=parent_repo,
     )
 
     if diff_result.returncode == 0:
@@ -89,7 +88,7 @@ Co-Authored-By: Claude <noreply@anthropic.com>"""
 
     subprocess.run(
         ["git", "commit", "-m", full_commit_msg],
-        cwd=parent_repo,
+        check=False, cwd=parent_repo,
     )
 
     print("Parent updated successfully.")

package/hooks/hooks_constants/CLAUDE.md

@@ -32,13 +32,14 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `dynamic_stderr_handler.py` | `DynamicStderrHandler` — a logging handler that resolves `sys.stderr` at emit time (for testability) |
 | `gh_pr_author_swap_constants.py` | Constants for the PR-author swap enforcement hooks |
 | `hardcoded_user_path_constants.py` | Patterns for detecting hardcoded home-directory paths |
+| `harness_scratchpad_constants.py` | Fixed path components (`claude-` user-directory prefix, separator replacement, `scratchpad` leaf name) and payload keys that rebuild the harness session scratchpad directory for the code-rules and TDD gate exemptions |
 | `hook_block_logger.py` | `log_hook_block()` — shared fail-safe logger every blocking hook calls to append a JSON record of each block decision to `~/.claude/logs/hook-blocks.log` |
 | `hook_log_extractor_constants.py` | Neon table name, offset state file path, timeouts, and outcome-type mapping for the hook-log extractor |
 | `hook_prose_detector_consistency_constants.py` | Trigger patterns and corrective messages for the hook-prose consistency checker |
 | `hosted_hook_runner.py` | `run_hook_capturing_output()` — shared runner that runs one dispatcher-hosted hook in-process via runpy and returns its captured stdout and crash flag |
 | `inline_tuple_string_magic_constants.py` | Patterns for detecting magic strings in inline tuple literals |
 | `js_conventions_constants.py` | Banned identifier set, boolean-prefix pattern, and declaration/JSDoc patterns for the JavaScript convention checks |
-| `local_identity.py` | Loader for local machine values: NAS host, ssh user, and ssh port the ssh enforcer guards (`CLAUDE_NAS_*` / `~/.claude/local-identity.json` with placeholder defaults), plus the PII commit-scan exempt-repo slug set (`CLAUDE_PII_EXEMPT_REPOS` / `pii_exempt_repositories`); also composes the ssh enforcer's two deny messages that quote the NAS values |
+| `local_identity.py` | Loader for local machine values: NAS host, ssh user, and ssh port the ssh enforcer guards (`CLAUDE_NAS_*` / `~/.claude/local-identity.json` with placeholder defaults), the PII commit-scan exempt-repo slug set (`CLAUDE_PII_EXEMPT_REPOS` / `pii_exempt_repositories`), and the per-repository allowlisted-values mapping (`pii_allowlisted_values`, keyed by owner/repo slug) read from the git-ignored local file whose path `CLAUDE_LOCAL_IDENTITY_PATH` may point elsewhere; also composes the ssh enforcer's two deny messages that quote the NAS values |
 | `messages.py` | Short user-facing notice strings shown when a Stop hook redirects agent behavior |
 | `multi_edit_reconstruction.py` | `apply_edits()` / `edits_for_tool()` — shared helpers that reconstruct the post-edit content of an Edit or MultiEdit, imported by the blockers that judge post-edit content |
 | `nas_ssh_binary_enforcer_constants.py` | Bash tool name, ssh-family basenames, OpenSSH binary path suffixes, launcher-wrapper set, shell control-operator tokens and split pattern, leading-assignment and duration patterns, and the batch-mode pattern for the NAS ssh binary enforcer |
@@ -60,6 +61,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `python_style_checks_constants.py` | Command-line argument count and blank-line count between top-level functions for the style validator |
 | `reviewer_spawn_gate_constants.py` | Bash tool name, the sentinel marker, the Copilot and Bugbot trigger markers, the availability-script relative path and override env-var name, and the deny-message template for the reviewer-spawn gate |
 | `send_user_file_open_locally_blocker_constants.py` | Tool name, proactive status, and the block message for the open-locally attach blocker |
+| `sensitive_file_protector_constants.py` | Sensitive filename patterns, the committed-template suffixes that earn an exemption, the write/edit tool names, and the deny decision and message template for `sensitive_file_protector` |
 | `session_edit_stage_gate_constants.py` | Tracker filename prefix/suffix, JSON payload key, edit tool name set, session-id sanitize pattern, lock filename suffix and lock-acquire timing, git diff command, commit flag escapes, and deny-message template shared by the session edit stage gate trio |
 | `session_env_cleanup_constants.py` | Stale-age threshold and directory names for the session-env cleanup hook |
 | `session_handoff_blocker_constants.py` | Trigger phrases for the session-handoff blocker |
@@ -85,5 +87,5 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 - Hooks import from this package with `from hooks_constants.<module> import <CONSTANT>`.
 - Tests for these modules live beside them as `test_<module>.py`. Run with `python -m pytest hooks_constants/test_<name>.py`.
 - `dynamic_stderr_handler.py`, `pre_tool_use_stdin.py`, `multi_edit_reconstruction.py`, `hosted_hook_runner.py`, and `text_stripping.py` are utility modules (not pure constants) but live here because they are shared across many hooks.
-- `local_identity.py` is a loader: it reads the environment or `~/.claude/local-identity.json` to resolve private NAS values (with committed placeholder defaults) and the PII commit-scan exempt-repo slug set (`CLAUDE_PII_EXEMPT_REPOS` / `pii_exempt_repositories`).
+- `local_identity.py` is a loader: it reads the environment or `~/.claude/local-identity.json` (its path overridable via `CLAUDE_LOCAL_IDENTITY_PATH`) to resolve private NAS values (with committed placeholder defaults), the PII commit-scan exempt-repo slug set (`CLAUDE_PII_EXEMPT_REPOS` / `pii_exempt_repositories`), and the per-repository allowlisted-values mapping (`pii_allowlisted_values`).
 

package/hooks/hooks_constants/banned_identifiers_constants.py

@@ -22,7 +22,6 @@ ALL_BANNED_IDENTIFIERS: frozenset[str] = frozenset(
         "cnt",
         "btn",
         "idx",
-        "tmp",
         "msg",
         "elem",
         "val",

package/hooks/hooks_constants/code_rules_path_utils_constants.py

@@ -10,7 +10,6 @@ module.
 
 from __future__ import annotations
 
-
 ALL_CONFIG_DIRECTORY_NAMES = frozenset(
     {
         "anthropic_plan_scripts_constants",
@@ -23,6 +22,7 @@ ALL_CONFIG_DIRECTORY_NAMES = frozenset(
         "pr_converge_scripts_constants",
         "bugteam_scripts_constants",
         "usage_pause_constants",
+        "codex_review_scripts_constants",
         "dev_env_scripts_constants",
     }
 )

package/hooks/hooks_constants/harness_scratchpad_constants.py

@@ -0,0 +1,17 @@
+"""Constants for resolving the Claude Code harness session scratchpad directory.
+
+The harness gives each session a throwaway scratch directory it announces in
+the session's system prompt, laid out as
+``<tempdir>/claude-<uid>/<mangled-cwd>/<session-id>/scratchpad``. These constants
+name the fixed path components the code-rules and TDD gates read to rebuild that
+directory from the signals a hook process can see.
+
+The exemption is POSIX-only: without ``os.getuid`` (Windows) it never fires,
+so full enforcement stays in place there.
+"""
+
+HARNESS_SCRATCHPAD_USER_DIRECTORY_PREFIX: str = "claude-"
+HARNESS_SCRATCHPAD_PATH_SEPARATOR_REPLACEMENT: str = "-"
+HARNESS_SCRATCHPAD_LEAF_DIRECTORY_NAME: str = "scratchpad"
+HOOK_PAYLOAD_SESSION_ID_KEY: str = "session_id"
+HOOK_PAYLOAD_WORKING_DIRECTORY_KEY: str = "cwd"

package/hooks/hooks_constants/local_identity.py

@@ -27,9 +27,11 @@ import os
 from pathlib import Path
 
 NAS_HOST_ENV_VAR = "CLAUDE_NAS_HOST"
+LOCAL_IDENTITY_PATH_ENV_VAR = "CLAUDE_LOCAL_IDENTITY_PATH"
 PII_EXEMPT_REPOS_ENV_VAR = "CLAUDE_PII_EXEMPT_REPOS"
 PII_EXEMPT_REPOS_JSON_KEY = "pii_exempt_repositories"
 PII_EXEMPT_REPOS_SEPARATOR = ","
+PII_ALLOWLISTED_VALUES_JSON_KEY = "pii_allowlisted_values"
 NAS_SSH_USER_ENV_VAR = "CLAUDE_NAS_SSH_USER"
 NAS_SSH_PORT_ENV_VAR = "CLAUDE_NAS_SSH_PORT"
 NAS_JSON_KEY = "nas"
@@ -46,6 +48,9 @@ NAS_SSH_RULE_REFERENCE = "~/.claude/rules/nas-ssh-invocation.md"
 
 
 def _local_identity_file_path() -> Path:
+    path_override = os.environ.get(LOCAL_IDENTITY_PATH_ENV_VAR)
+    if path_override:
+        return Path(path_override)
     return Path.home() / CLAUDE_HOME_DIRECTORY_NAME / LOCAL_IDENTITY_FILE_NAME
 
 
@@ -73,13 +78,22 @@ def _normalized_slug_set(all_raw_slugs: list[object]) -> frozenset[str]:
     )
 
 
+def _environment_exempt_slugs() -> frozenset[str]:
+    """Return the exempt slugs named by ``CLAUDE_PII_EXEMPT_REPOS``, or empty."""
+    slugs_from_environment = os.environ.get(PII_EXEMPT_REPOS_ENV_VAR)
+    if slugs_from_environment is None:
+        return frozenset()
+    return _normalized_slug_set(
+        list(slugs_from_environment.split(PII_EXEMPT_REPOS_SEPARATOR))
+    )
+
+
 def pii_exempt_repository_slugs() -> frozenset[str]:
     """Return owner/repo slugs whose commits skip the staged PII scan.
 
     ::
 
         CLAUDE_PII_EXEMPT_REPOS="Owner/repo-a, Other/b"  ->  {"owner/repo-a", "other/b"}
-        CLAUDE_PII_EXEMPT_REPOS=" , , " + file lists A   ->  {"a"}  (whitespace falls through)
         (env unset, file lists ["Owner/repo-a"])         ->  {"owner/repo-a"}
         (env unset, no file)                             ->  frozenset()
 
@@ -91,13 +105,9 @@ def pii_exempt_repository_slugs() -> frozenset[str]:
     Returns:
         Lowercased ``owner/repo`` slugs exempt from staged-commit PII scanning.
     """
-    slugs_from_environment = os.environ.get(PII_EXEMPT_REPOS_ENV_VAR)
-    if slugs_from_environment is not None:
-        normalized_environment_slugs = _normalized_slug_set(
-            list(slugs_from_environment.split(PII_EXEMPT_REPOS_SEPARATOR))
-        )
-        if normalized_environment_slugs:
-            return normalized_environment_slugs
+    environment_slugs = _environment_exempt_slugs()
+    if environment_slugs:
+        return environment_slugs
     stored_slugs = _identity_dictionary_from_local_file().get(
         PII_EXEMPT_REPOS_JSON_KEY
     )
@@ -106,6 +116,47 @@ def pii_exempt_repository_slugs() -> frozenset[str]:
     return _normalized_slug_set(stored_slugs)
 
 
+def _normalized_allowlisted_values(all_raw_values: object) -> frozenset[str]:
+    """Return the non-empty string members of a raw values list, or empty."""
+    if not isinstance(all_raw_values, list):
+        return frozenset()
+    return frozenset(
+        each_value
+        for each_value in all_raw_values
+        if isinstance(each_value, str) and each_value
+    )
+
+
+def pii_allowlisted_values_by_repository() -> dict[str, frozenset[str]]:
+    """Return the exact literal values each repository allows past the PII scan.
+
+    ::
+
+        file {"Owner/Repo": ["user@example.com"]}  ->  {"owner/repo": {"user@example.com"}}
+        (env unset, no file, or bad json)          ->  {}
+
+    Keyed by lowercased ``owner/repo`` slug so matching is case-insensitive; the
+    values stay exact. The mapping lives under ``pii_allowlisted_values`` in the
+    git-ignored ``~/.claude/local-identity.json`` so a private repository's real
+    fixture addresses stay out of this published tree.
+
+    Returns:
+        Lowercased ``owner/repo`` slug to the frozenset of exact allowed values.
+    """
+    stored_mapping = _identity_dictionary_from_local_file().get(
+        PII_ALLOWLISTED_VALUES_JSON_KEY
+    )
+    if not isinstance(stored_mapping, dict):
+        return {}
+    all_values_by_slug: dict[str, frozenset[str]] = {}
+    for each_raw_slug, each_raw_values in stored_mapping.items():
+        normalized_slug = each_raw_slug.strip().lower() if isinstance(each_raw_slug, str) else ""
+        allowlisted_values = _normalized_allowlisted_values(each_raw_values)
+        if normalized_slug and allowlisted_values:
+            all_values_by_slug[normalized_slug] = allowlisted_values
+    return all_values_by_slug
+
+
 def nas_host() -> str:
     """Return the NAS host the ssh enforcer guards.
 

package/hooks/hooks_constants/pii_prevention_constants.py

@@ -293,12 +293,6 @@ STAGED_LIST_FAILURE_REASON: str = (
     "(git diff --cached failed). Refuse commit until the index is readable."
 )
 
-REPOSITORY_ROOT_UNRESOLVED_REASON: str = (
-    "BLOCKED [pii_prevention_blocker]: could not resolve the git repository root "
-    "for a commit command (not a git work tree, git missing, or bad -C path). "
-    "Refuse commit until the repository root is resolvable."
-)
-
 STAGED_BLOB_UNSCANNABLE_REASON_TEMPLATE: str = (
     "BLOCKED [pii_prevention_blocker]: staged file '{relative_path}' could not be "
     "scanned for PII ({reason}). Refuse commit, shrink the blob, or keep binary "

package/hooks/hooks_constants/plain_language_blocker_constants.py

@@ -289,6 +289,11 @@ MARKDOWN_EXTENSION: str = ".md"
 ASK_USER_QUESTION_TOOL_NAME: str = "AskUserQuestion"
 ALL_WRITE_EDIT_TOOL_NAMES: frozenset[str] = frozenset({"Write", "Edit", "MultiEdit"})
 
+DOT_CLAUDE_DIRECTORY_NAME: str = ".claude"
+PROJECT_ALLOWLIST_FILENAME: str = "plain-language-allow.json"
+PROJECT_ROOT_WALK_LIMIT: int = 40
+REPOSITORY_MARKER_NAME: str = ".git"
+
 USER_FACING_PLAIN_LANGUAGE_NOTICE: str = (
     "Plain-language check: replace each flagged formal word with the simpler "
     "word named in the reason."

package/hooks/hooks_constants/sensitive_file_protector_constants.py

@@ -0,0 +1,42 @@
+"""Constants for the ``sensitive_file_protector`` PreToolUse hook.
+
+The hook denies a Write or Edit whose target basename names a live secret or a
+lock file, and steps aside for a placeholders-only committed template.
+"""
+
+from __future__ import annotations
+
+ALL_SENSITIVE_PATTERNS = (
+    ".env",
+    ".env.*",
+    "*.env",
+    "*.pem",
+    "*.key",
+    "*.p12",
+    "*.pfx",
+    "credentials.json",
+    "secrets.json",
+    "id_rsa",
+    "id_ed25519",
+    "package-lock.json",
+    "yarn.lock",
+    "Pipfile.lock",
+    "poetry.lock",
+    "pnpm-lock.yaml",
+    "composer.lock",
+)
+
+ALL_TEMPLATE_SUFFIXES = (".example", ".sample", ".template")
+
+ALL_WRITE_EDIT_TOOLS = ("Write", "Edit")
+
+HOOK_SCRIPT_NAME = "sensitive_file_protector.py"
+
+HOOK_EVENT_NAME = "PreToolUse"
+
+DENY_DECISION = "deny"
+
+DENY_REASON_TEMPLATE = (
+    "BLOCKED: Sensitive file '{filename}' (pattern: '{matched_pattern}'). "
+    "Edit manually outside Claude Code."
+)