claude-dev-env 1.95.0 → 2.0.0

package/hooks/blocking/tests/test_repository_resolution.py

@@ -0,0 +1,108 @@
+"""Behavioral tests for the commit repository-path resolution helpers.
+
+Covers reading the repository a commit command targets, so the staged PII scan
+runs against the named path rather than the session working directory::
+
+    git -C /a -C sub commit   ->  /a/sub   (multiple -C compose)
+    git -C /a/b -C /c/d commit ->  /c/d    (a later absolute -C resets)
+    cd "/my repo" && git commit ->  /my repo (quoted cd path, shlex-parsed)
+    git commit                 ->  None     (runs in the session cwd)
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from pii_prevention_blocker_parts.repository_resolution import (
+    compose_command_working_directory,
+    expand_user_directory,
+    refusal_reason_for_unresolved_repository,
+)
+
+
+def test_single_absolute_dash_c_is_the_target() -> None:
+    assert compose_command_working_directory("git -C /repo commit -m x") == "/repo"
+
+
+def test_relative_dash_c_composes_onto_a_leading_absolute_dash_c() -> None:
+    composed = compose_command_working_directory("git -C /a -C sub commit -m x")
+    assert composed is not None
+    assert Path(composed) == Path("/a") / "sub"
+
+
+def test_later_absolute_dash_c_resets_the_composition() -> None:
+    assert compose_command_working_directory("git -C /a/b -C /c/d commit -m x") == "/c/d"
+
+
+def test_quoted_dash_c_with_spaces_is_read_whole() -> None:
+    assert compose_command_working_directory('git -C "/my repo" commit -m x') == "/my repo"
+
+
+def test_leading_cd_supplies_the_target_when_no_dash_c() -> None:
+    assert compose_command_working_directory("cd /work/repo && git commit -m x") == "/work/repo"
+
+
+def test_quoted_cd_path_with_spaces_is_read_whole() -> None:
+    assert compose_command_working_directory('cd "/my repo" && git commit -m x') == "/my repo"
+
+
+def test_plain_commit_names_no_target() -> None:
+    assert compose_command_working_directory("git commit -m x") is None
+
+
+def test_expand_user_directory_expands_tilde() -> None:
+    expanded = expand_user_directory("~/repo")
+    assert expanded is not None
+    assert not expanded.startswith("~")
+    assert Path(expanded).name == "repo"
+
+
+def test_expand_user_directory_passes_none_through() -> None:
+    assert expand_user_directory(None) is None
+
+
+def test_refusal_names_the_attempted_path() -> None:
+    reason = refusal_reason_for_unresolved_repository("/gone/repo")
+    assert "repository root" in reason
+    assert "/gone/repo" in reason
+
+
+def test_refusal_names_the_session_cwd_when_no_path_given() -> None:
+    reason = refusal_reason_for_unresolved_repository(None)
+    assert "repository root" in reason
+    assert "session working directory" in reason
+
+
+def test_windows_git_exe_dash_c_is_the_target() -> None:
+    assert (
+        compose_command_working_directory(r'git.exe -C "/srv/repo" commit -m x')
+        == "/srv/repo"
+    )
+
+
+def test_leading_cd_with_git_exe_supplies_the_target() -> None:
+    assert (
+        compose_command_working_directory("cd /work/repo && git.exe commit -m x")
+        == "/work/repo"
+    )
+
+
+def test_leading_pushd_with_git_exe_supplies_the_target() -> None:
+    assert (
+        compose_command_working_directory("pushd /work/repo; git.exe commit -m x")
+        == "/work/repo"
+    )
+
+
+def test_quoted_cd_path_with_git_exe_is_read_whole() -> None:
+    assert (
+        compose_command_working_directory('cd "/my repo" && git.exe commit -m x')
+        == "/my repo"
+    )
+
+
+def test_dash_c_wins_over_leading_cd() -> None:
+    assert (
+        compose_command_working_directory("cd /ignored && git -C /named commit -m x")
+        == "/named"
+    )

package/hooks/diagnostic/hook_log_extractor.py

@@ -309,7 +309,7 @@ class AttachmentRecordIterator:
 
     def __iter__(self) -> Iterator[tuple[dict[str, object], int, int]]:
         try:
-            jsonl_file_handle = io.open(self._jsonl_file_path, "rb")
+            jsonl_file_handle = io.open(self._jsonl_file_path, "rb")  # noqa: SIM115
         except (FileNotFoundError, OSError):
             self.final_line_number = self._start_line_number
             self.final_byte_offset = self._start_offset
@@ -419,14 +419,13 @@ def save_offsets(
     state_file_parent = os.path.dirname(state_file_path)
     if state_file_parent:
         os.makedirs(state_file_parent, exist_ok=True)
-    temporary_file_handle = tempfile.NamedTemporaryFile(
+    with tempfile.NamedTemporaryFile(
         mode="w",
         encoding="utf-8",
         dir=state_file_parent or None,
         delete=False,
-    )
-    temporary_file_path = temporary_file_handle.name
-    try:
+    ) as temporary_file_handle:
+        temporary_file_path = temporary_file_handle.name
         try:
             json.dump(
                 offset_by_jsonl_path,
@@ -436,8 +435,14 @@ def save_offsets(
             )
             temporary_file_handle.flush()
             os.fsync(temporary_file_handle.fileno())
-        finally:
+        except Exception:
             temporary_file_handle.close()
+            try:
+                os.unlink(temporary_file_path)
+            except OSError:
+                pass
+            raise
+    try:
         os.replace(temporary_file_path, state_file_path)
     except Exception:
         try:
@@ -468,15 +473,12 @@ def _acquire_offsets_lock(state_file_path: str) -> Iterator[None]:
     lock_parent_directory = os.path.dirname(lock_file_path)
     if lock_parent_directory:
         os.makedirs(lock_parent_directory, exist_ok=True)
-    lock_file_handle = io.open(lock_file_path, "a+", encoding="utf-8")
-    try:
+    with io.open(lock_file_path, "a+", encoding="utf-8") as lock_file_handle:
         _lock_file_handle_blocking(lock_file_handle)
         try:
             yield
         finally:
             _unlock_file_handle(lock_file_handle)
-    finally:
-        lock_file_handle.close()
 
 
 def _lock_file_handle_blocking(lock_file_handle: IO[str]) -> None:

package/hooks/git-hooks/post_commit.py

@@ -10,7 +10,6 @@ When you commit in a submodule, this hook:
 This prevents the "lost work" issue where submodule commits aren't tracked by parent.
 """
 
-import os
 import subprocess
 import sys
 from pathlib import Path
@@ -21,7 +20,7 @@ def run_git(*args: str, cwd: Path | None = None) -> str:
     result = subprocess.run(
         ["git"] + list(args),
         cwd=cwd,
-        capture_output=True,
+        check=False, capture_output=True,
         text=True,
     )
     return result.stdout.strip()
@@ -74,7 +73,7 @@ def main() -> int:
 
     diff_result = subprocess.run(
         ["git", "diff", "--cached", "--quiet"],
-        cwd=parent_repo,
+        check=False, cwd=parent_repo,
     )
 
     if diff_result.returncode == 0:
@@ -89,7 +88,7 @@ Co-Authored-By: Claude <noreply@anthropic.com>"""
 
     subprocess.run(
         ["git", "commit", "-m", full_commit_msg],
-        cwd=parent_repo,
+        check=False, cwd=parent_repo,
     )
 
     print("Parent updated successfully.")

package/hooks/hooks_constants/CLAUDE.md

@@ -39,7 +39,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `hosted_hook_runner.py` | `run_hook_capturing_output()` — shared runner that runs one dispatcher-hosted hook in-process via runpy and returns its captured stdout and crash flag |
 | `inline_tuple_string_magic_constants.py` | Patterns for detecting magic strings in inline tuple literals |
 | `js_conventions_constants.py` | Banned identifier set, boolean-prefix pattern, and declaration/JSDoc patterns for the JavaScript convention checks |
-| `local_identity.py` | Loader for local machine values: NAS host, ssh user, and ssh port the ssh enforcer guards (`CLAUDE_NAS_*` / `~/.claude/local-identity.json` with placeholder defaults), plus the PII commit-scan exempt-repo slug set (`CLAUDE_PII_EXEMPT_REPOS` / `pii_exempt_repositories`); also composes the ssh enforcer's two deny messages that quote the NAS values |
+| `local_identity.py` | Loader for local machine values: NAS host, ssh user, and ssh port the ssh enforcer guards (`CLAUDE_NAS_*` / `~/.claude/local-identity.json` with placeholder defaults), the PII commit-scan exempt-repo slug set (`CLAUDE_PII_EXEMPT_REPOS` / `pii_exempt_repositories`), and the per-repository allowlisted-values mapping (`pii_allowlisted_values`, keyed by owner/repo slug) read from the git-ignored local file whose path `CLAUDE_LOCAL_IDENTITY_PATH` may point elsewhere; also composes the ssh enforcer's two deny messages that quote the NAS values |
 | `messages.py` | Short user-facing notice strings shown when a Stop hook redirects agent behavior |
 | `multi_edit_reconstruction.py` | `apply_edits()` / `edits_for_tool()` — shared helpers that reconstruct the post-edit content of an Edit or MultiEdit, imported by the blockers that judge post-edit content |
 | `nas_ssh_binary_enforcer_constants.py` | Bash tool name, ssh-family basenames, OpenSSH binary path suffixes, launcher-wrapper set, shell control-operator tokens and split pattern, leading-assignment and duration patterns, and the batch-mode pattern for the NAS ssh binary enforcer |
@@ -87,5 +87,5 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 - Hooks import from this package with `from hooks_constants.<module> import <CONSTANT>`.
 - Tests for these modules live beside them as `test_<module>.py`. Run with `python -m pytest hooks_constants/test_<name>.py`.
 - `dynamic_stderr_handler.py`, `pre_tool_use_stdin.py`, `multi_edit_reconstruction.py`, `hosted_hook_runner.py`, and `text_stripping.py` are utility modules (not pure constants) but live here because they are shared across many hooks.
-- `local_identity.py` is a loader: it reads the environment or `~/.claude/local-identity.json` to resolve private NAS values (with committed placeholder defaults) and the PII commit-scan exempt-repo slug set (`CLAUDE_PII_EXEMPT_REPOS` / `pii_exempt_repositories`).
+- `local_identity.py` is a loader: it reads the environment or `~/.claude/local-identity.json` (its path overridable via `CLAUDE_LOCAL_IDENTITY_PATH`) to resolve private NAS values (with committed placeholder defaults), the PII commit-scan exempt-repo slug set (`CLAUDE_PII_EXEMPT_REPOS` / `pii_exempt_repositories`), and the per-repository allowlisted-values mapping (`pii_allowlisted_values`).
 

package/hooks/hooks_constants/banned_identifiers_constants.py

@@ -22,7 +22,6 @@ ALL_BANNED_IDENTIFIERS: frozenset[str] = frozenset(
         "cnt",
         "btn",
         "idx",
-        "tmp",
         "msg",
         "elem",
         "val",

package/hooks/hooks_constants/code_rules_path_utils_constants.py

@@ -10,7 +10,6 @@ module.
 
 from __future__ import annotations
 
-
 ALL_CONFIG_DIRECTORY_NAMES = frozenset(
     {
         "anthropic_plan_scripts_constants",
@@ -23,6 +22,7 @@ ALL_CONFIG_DIRECTORY_NAMES = frozenset(
         "pr_converge_scripts_constants",
         "bugteam_scripts_constants",
         "usage_pause_constants",
+        "codex_review_scripts_constants",
         "dev_env_scripts_constants",
     }
 )

package/hooks/hooks_constants/local_identity.py

@@ -27,9 +27,11 @@ import os
 from pathlib import Path
 
 NAS_HOST_ENV_VAR = "CLAUDE_NAS_HOST"
+LOCAL_IDENTITY_PATH_ENV_VAR = "CLAUDE_LOCAL_IDENTITY_PATH"
 PII_EXEMPT_REPOS_ENV_VAR = "CLAUDE_PII_EXEMPT_REPOS"
 PII_EXEMPT_REPOS_JSON_KEY = "pii_exempt_repositories"
 PII_EXEMPT_REPOS_SEPARATOR = ","
+PII_ALLOWLISTED_VALUES_JSON_KEY = "pii_allowlisted_values"
 NAS_SSH_USER_ENV_VAR = "CLAUDE_NAS_SSH_USER"
 NAS_SSH_PORT_ENV_VAR = "CLAUDE_NAS_SSH_PORT"
 NAS_JSON_KEY = "nas"
@@ -46,6 +48,9 @@ NAS_SSH_RULE_REFERENCE = "~/.claude/rules/nas-ssh-invocation.md"
 
 
 def _local_identity_file_path() -> Path:
+    path_override = os.environ.get(LOCAL_IDENTITY_PATH_ENV_VAR)
+    if path_override:
+        return Path(path_override)
     return Path.home() / CLAUDE_HOME_DIRECTORY_NAME / LOCAL_IDENTITY_FILE_NAME
 
 
@@ -73,13 +78,22 @@ def _normalized_slug_set(all_raw_slugs: list[object]) -> frozenset[str]:
     )
 
 
+def _environment_exempt_slugs() -> frozenset[str]:
+    """Return the exempt slugs named by ``CLAUDE_PII_EXEMPT_REPOS``, or empty."""
+    slugs_from_environment = os.environ.get(PII_EXEMPT_REPOS_ENV_VAR)
+    if slugs_from_environment is None:
+        return frozenset()
+    return _normalized_slug_set(
+        list(slugs_from_environment.split(PII_EXEMPT_REPOS_SEPARATOR))
+    )
+
+
 def pii_exempt_repository_slugs() -> frozenset[str]:
     """Return owner/repo slugs whose commits skip the staged PII scan.
 
     ::
 
         CLAUDE_PII_EXEMPT_REPOS="Owner/repo-a, Other/b"  ->  {"owner/repo-a", "other/b"}
-        CLAUDE_PII_EXEMPT_REPOS=" , , " + file lists A   ->  {"a"}  (whitespace falls through)
         (env unset, file lists ["Owner/repo-a"])         ->  {"owner/repo-a"}
         (env unset, no file)                             ->  frozenset()
 
@@ -91,13 +105,9 @@ def pii_exempt_repository_slugs() -> frozenset[str]:
     Returns:
         Lowercased ``owner/repo`` slugs exempt from staged-commit PII scanning.
     """
-    slugs_from_environment = os.environ.get(PII_EXEMPT_REPOS_ENV_VAR)
-    if slugs_from_environment is not None:
-        normalized_environment_slugs = _normalized_slug_set(
-            list(slugs_from_environment.split(PII_EXEMPT_REPOS_SEPARATOR))
-        )
-        if normalized_environment_slugs:
-            return normalized_environment_slugs
+    environment_slugs = _environment_exempt_slugs()
+    if environment_slugs:
+        return environment_slugs
     stored_slugs = _identity_dictionary_from_local_file().get(
         PII_EXEMPT_REPOS_JSON_KEY
     )
@@ -106,6 +116,47 @@ def pii_exempt_repository_slugs() -> frozenset[str]:
     return _normalized_slug_set(stored_slugs)
 
 
+def _normalized_allowlisted_values(all_raw_values: object) -> frozenset[str]:
+    """Return the non-empty string members of a raw values list, or empty."""
+    if not isinstance(all_raw_values, list):
+        return frozenset()
+    return frozenset(
+        each_value
+        for each_value in all_raw_values
+        if isinstance(each_value, str) and each_value
+    )
+
+
+def pii_allowlisted_values_by_repository() -> dict[str, frozenset[str]]:
+    """Return the exact literal values each repository allows past the PII scan.
+
+    ::
+
+        file {"Owner/Repo": ["user@example.com"]}  ->  {"owner/repo": {"user@example.com"}}
+        (env unset, no file, or bad json)          ->  {}
+
+    Keyed by lowercased ``owner/repo`` slug so matching is case-insensitive; the
+    values stay exact. The mapping lives under ``pii_allowlisted_values`` in the
+    git-ignored ``~/.claude/local-identity.json`` so a private repository's real
+    fixture addresses stay out of this published tree.
+
+    Returns:
+        Lowercased ``owner/repo`` slug to the frozenset of exact allowed values.
+    """
+    stored_mapping = _identity_dictionary_from_local_file().get(
+        PII_ALLOWLISTED_VALUES_JSON_KEY
+    )
+    if not isinstance(stored_mapping, dict):
+        return {}
+    all_values_by_slug: dict[str, frozenset[str]] = {}
+    for each_raw_slug, each_raw_values in stored_mapping.items():
+        normalized_slug = each_raw_slug.strip().lower() if isinstance(each_raw_slug, str) else ""
+        allowlisted_values = _normalized_allowlisted_values(each_raw_values)
+        if normalized_slug and allowlisted_values:
+            all_values_by_slug[normalized_slug] = allowlisted_values
+    return all_values_by_slug
+
+
 def nas_host() -> str:
     """Return the NAS host the ssh enforcer guards.
 

package/hooks/hooks_constants/pii_prevention_constants.py

@@ -293,12 +293,6 @@ STAGED_LIST_FAILURE_REASON: str = (
     "(git diff --cached failed). Refuse commit until the index is readable."
 )
 
-REPOSITORY_ROOT_UNRESOLVED_REASON: str = (
-    "BLOCKED [pii_prevention_blocker]: could not resolve the git repository root "
-    "for a commit command (not a git work tree, git missing, or bad -C path). "
-    "Refuse commit until the repository root is resolvable."
-)
-
 STAGED_BLOB_UNSCANNABLE_REASON_TEMPLATE: str = (
     "BLOCKED [pii_prevention_blocker]: staged file '{relative_path}' could not be "
     "scanned for PII ({reason}). Refuse commit, shrink the blob, or keep binary "

package/hooks/hooks_constants/test_local_identity.py

@@ -8,9 +8,11 @@ import sys
 from pathlib import Path
 from unittest.mock import patch
 
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from hooks_constants import local_identity  # noqa: E402
+try:
+    from hooks_constants import local_identity
+except ImportError:
+    sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+    from hooks_constants import local_identity
 
 ALL_NAS_ENV_VARS = ("CLAUDE_NAS_HOST", "CLAUDE_NAS_SSH_USER", "CLAUDE_NAS_SSH_PORT")
 
@@ -134,6 +136,106 @@ class TestPiiExemptRepositorySlugs:
                 assert slugs == frozenset({"fileowner/file-repo"})
 
 
+class TestPiiAllowlistedValuesByRepository:
+    def test_reads_the_mapping_lowercasing_slugs_and_keeping_values_exact(
+        self, tmp_path: Path
+    ) -> None:
+        allowed_value = "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
+        identity_path = tmp_path / "local-identity.json"
+        identity_path.write_text(
+            json.dumps(
+                {"pii_allowlisted_values": {"Owner/Private-Repo": [allowed_value]}}
+            ),
+            encoding="utf-8",
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(identity_path)},
+            clear=False,
+        ):
+            values_by_slug = local_identity.pii_allowlisted_values_by_repository()
+            assert values_by_slug == {"owner/private-repo": frozenset({allowed_value})}
+
+    def test_returns_empty_mapping_when_the_file_is_missing(
+        self, tmp_path: Path
+    ) -> None:
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(tmp_path / "absent.json")},
+            clear=False,
+        ):
+            assert local_identity.pii_allowlisted_values_by_repository() == {}
+
+    def test_returns_empty_mapping_when_the_json_is_corrupt(
+        self, tmp_path: Path
+    ) -> None:
+        identity_path = tmp_path / "local-identity.json"
+        identity_path.write_text("{ not valid json", encoding="utf-8")
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(identity_path)},
+            clear=False,
+        ):
+            assert local_identity.pii_allowlisted_values_by_repository() == {}
+
+    def test_returns_empty_mapping_when_the_key_is_absent(
+        self, tmp_path: Path
+    ) -> None:
+        identity_path = tmp_path / "local-identity.json"
+        identity_path.write_text(
+            json.dumps({"nas": {"host": "10.0.0.5"}}), encoding="utf-8"
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(identity_path)},
+            clear=False,
+        ):
+            assert local_identity.pii_allowlisted_values_by_repository() == {}
+
+    def test_drops_blank_slugs_and_non_list_value_entries(
+        self, tmp_path: Path
+    ) -> None:
+        allowed_value = "keep.fixture" + "@" + "acme-corp" + ".example" + ".io"
+        identity_path = tmp_path / "local-identity.json"
+        identity_path.write_text(
+            json.dumps(
+                {
+                    "pii_allowlisted_values": {
+                        "  ": [allowed_value],
+                        "Owner/Repo": allowed_value,
+                        "Owner/Kept": [allowed_value, 7],
+                    }
+                }
+            ),
+            encoding="utf-8",
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(identity_path)},
+            clear=False,
+        ):
+            values_by_slug = local_identity.pii_allowlisted_values_by_repository()
+            assert values_by_slug == {"owner/kept": frozenset({allowed_value})}
+
+
+class TestLocalIdentityPathOverride:
+    def test_prefers_the_env_path_over_the_home_directory_file(
+        self, tmp_path: Path
+    ) -> None:
+        override_path = tmp_path / "override" / "local-identity.json"
+        override_path.parent.mkdir()
+        override_path.write_text(
+            json.dumps({"nas": {"host": "10.9.9.9"}}), encoding="utf-8"
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(override_path)},
+            clear=False,
+        ), patch.object(Path, "home", return_value=tmp_path):
+            _clear_nas_env()
+            assert local_identity.nas_host() == "10.9.9.9"
+
+
 class TestDenyMessagesQuoteTheResolvedHost:
     def should_include_the_resolved_host_and_port_in_the_bare_binary_message(
         self,

package/hooks/pyproject.toml

@@ -15,19 +15,18 @@ no_implicit_optional = true
 strict_equality = true
 exclude = [
     "validators/test_files/",
-    "test_.*\\.py$",
-    ".*/test_.*\\.py$",
-    # One-line mypy fixes re-surface whole-file CODE_RULES debt at pre-commit (#51).
-    "abbreviation_checks\\.py$",
-    "git_checks\\.py$",
-    "exempt_paths\\.py$",
-    "code_rules_typeddict_stub\\.py$",
-    "validators/exempt_paths\\.py$",
-    "validators/abbreviation_checks\\.py$",
-    "validators/git_checks\\.py$",
-    "blocking/code_rules_typeddict_stub\\.py$",
+    "test_",
+    "abbreviation_checks.py",
+    "git_checks.py",
+    "exempt_paths.py",
+    "code_rules_typeddict_stub.py",
 ]
 
+
+[[tool.mypy.overrides]]
+module = ["exempt_paths", "code_rules_path_utils", "gh_pr_author_enforcer"]
+warn_unused_ignores = false
+
 [[tool.mypy.overrides]]
 module = "tests.*"
 disallow_untyped_defs = false
@@ -54,9 +53,7 @@ select = [
     "SIM",
     "PL",
 ]
-# Gate-restore (#51): principled + pure-style ignores. Non-negotiable defect
-# classes stay selected; residual hits live under per-file-ignores where a
-# one-line fix is blocked by whole-file CODE_RULES pre-commit debt.
+# Principled + pure-style ignores (#51/#57). Non-negotiable defect classes stay selected.
 ignore = [
     "E501",
     "E402",
@@ -94,29 +91,9 @@ ignore = [
 ]
 
 [tool.ruff.lint.per-file-ignores]
-"advisory/refactor_guard.py" = ["F401", "PLW1510"]
-"blocking/block_main_commit.py" = ["PLW1510"]
-"blocking/code_rules_boolean_mustcheck.py" = ["B905"]
-"blocking/code_rules_mock_completeness.py" = ["B007"]
-"blocking/code_rules_optional_params.py" = ["B905"]
-"blocking/code_rules_shared.py" = ["B905"]
-"blocking/code_rules_test_assertions.py" = ["B905"]
-"blocking/code_rules_typeddict_stub.py" = ["B905"]
-"blocking/pii_prevention_blocker.py" = ["PLW1510", "B018"]
-"blocking/pr_description_command_parser.py" = ["B904"]
-"blocking/precommit_code_rules_gate.py" = ["PLW1510"]
-"diagnostic/hook_log_extractor.py" = ["SIM115"]
-"git-hooks/post_commit.py" = ["F401", "PLW1510"]
-"hooks_constants/banned_identifiers_constants.py" = ["B033"]
-"session/plugin_data_dir_cleanup.py" = ["F401"]
-"validation/mypy_validator.py" = ["PLW1510"]
-"validators/exempt_paths.py" = ["F401"]
-"validators/health_check.py" = ["PLW1510"]
-"validators/mypy_integration.py" = ["PLW1510"]
-"validators/python_style_checks.py" = ["B905"]
-"validators/ruff_integration.py" = ["PLW1510"]
+# Residual production carve-outs re-homed on #57 (gate friction on multi-line touch).
 "validators/run_all_validators.py" = ["PLW1510"]
-"workflow/auto_formatter.py" = ["PLW1510"]
+"validators/exempt_paths.py" = ["F401"]
 "test_*.py" = ["B011", "PLR2004", "F401", "F841", "PLW1510", "B905", "B033", "SIM115", "B007", "B018", "B904"]
 "*_test.py" = ["B011", "PLR2004", "F401", "F841", "PLW1510", "B905", "B033", "SIM115", "B007", "B018", "B904"]
 "conftest.py" = ["B011", "F401", "F841", "PLW1510"]

package/hooks/session/plugin_data_dir_cleanup.py

@@ -13,7 +13,6 @@ separate from the EEXIST fixes in v2.1.70-v2.1.72.
 """
 
 import os
-import sys
 
 PLUGINS_DATA_DIRECTORY = os.path.join(
     os.path.expanduser("~"), ".claude", "plugins", "data"

package/hooks/validation/mypy_validator.py

@@ -70,7 +70,7 @@ def discover_project_root(target_file: str) -> Path | None:
     try:
         completed_process = subprocess.run(
             ["git", "rev-parse", "--show-toplevel"],
-            capture_output=True,
+            check=False, capture_output=True,
             text=True,
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=str(Path(target_file).parent),
@@ -359,7 +359,7 @@ def run_mypy(target_file: str, project_root: str) -> tuple[int, str]:
 
     completed_process = subprocess.run(
         mypy_command,
-        capture_output=True,
+        check=False, capture_output=True,
         text=True,
         env=os.environ.copy(),
         timeout=MYPY_TIMEOUT_SECONDS,

package/hooks/validators/health_check.py

@@ -110,6 +110,7 @@ def check_optional_tool(tool_name: str) -> bool:
     try:
         result = subprocess.run(
             [tool_name, "--version"],
+            check=False,
             capture_output=True,
             text=True,
         )

package/hooks/validators/mypy_integration.py

@@ -18,6 +18,7 @@ def check_mypy_available() -> bool:
     try:
         result = subprocess.run(
             ["mypy", "--version"],
+            check=False,
             capture_output=True,
             text=True,
         )
@@ -85,6 +86,7 @@ def run_mypy_check(files: list[Path]) -> MypyResult:
     result = subprocess.run(
         ["mypy", *config_argument, "--ignore-missing-imports", "--no-error-summary"]
         + py_files,
+        check=False,
         capture_output=True,
         text=True,
     )

package/hooks/validators/ruff_integration.py

@@ -17,6 +17,7 @@ def check_ruff_available() -> bool:
     try:
         result = subprocess.run(
             ["ruff", "--version"],
+            check=False,
             capture_output=True,
             text=True,
         )
@@ -39,6 +40,7 @@ def run_ruff_check(files: list[Path]) -> RuffResult:
 
     result = subprocess.run(
         ["ruff", "check"] + py_files,
+        check=False,
         capture_output=True,
         text=True,
     )
@@ -61,6 +63,7 @@ def run_ruff_fix(files: list[Path]) -> RuffResult:
 
     result = subprocess.run(
         ["ruff", "check", "--fix"] + py_files,
+        check=False,
         capture_output=True,
         text=True,
     )