claude-dev-env 1.95.0 → 2.0.1

package/hooks/hooks_constants/local_identity.py

@@ -27,9 +27,11 @@ import os
 from pathlib import Path
 
 NAS_HOST_ENV_VAR = "CLAUDE_NAS_HOST"
+LOCAL_IDENTITY_PATH_ENV_VAR = "CLAUDE_LOCAL_IDENTITY_PATH"
 PII_EXEMPT_REPOS_ENV_VAR = "CLAUDE_PII_EXEMPT_REPOS"
 PII_EXEMPT_REPOS_JSON_KEY = "pii_exempt_repositories"
 PII_EXEMPT_REPOS_SEPARATOR = ","
+PII_ALLOWLISTED_VALUES_JSON_KEY = "pii_allowlisted_values"
 NAS_SSH_USER_ENV_VAR = "CLAUDE_NAS_SSH_USER"
 NAS_SSH_PORT_ENV_VAR = "CLAUDE_NAS_SSH_PORT"
 NAS_JSON_KEY = "nas"
@@ -46,6 +48,9 @@ NAS_SSH_RULE_REFERENCE = "~/.claude/rules/nas-ssh-invocation.md"
 
 
 def _local_identity_file_path() -> Path:
+    path_override = os.environ.get(LOCAL_IDENTITY_PATH_ENV_VAR)
+    if path_override:
+        return Path(path_override)
     return Path.home() / CLAUDE_HOME_DIRECTORY_NAME / LOCAL_IDENTITY_FILE_NAME
 
 
@@ -73,13 +78,22 @@ def _normalized_slug_set(all_raw_slugs: list[object]) -> frozenset[str]:
     )
 
 
+def _environment_exempt_slugs() -> frozenset[str]:
+    """Return the exempt slugs named by ``CLAUDE_PII_EXEMPT_REPOS``, or empty."""
+    slugs_from_environment = os.environ.get(PII_EXEMPT_REPOS_ENV_VAR)
+    if slugs_from_environment is None:
+        return frozenset()
+    return _normalized_slug_set(
+        list(slugs_from_environment.split(PII_EXEMPT_REPOS_SEPARATOR))
+    )
+
+
 def pii_exempt_repository_slugs() -> frozenset[str]:
     """Return owner/repo slugs whose commits skip the staged PII scan.
 
     ::
 
         CLAUDE_PII_EXEMPT_REPOS="Owner/repo-a, Other/b"  ->  {"owner/repo-a", "other/b"}
-        CLAUDE_PII_EXEMPT_REPOS=" , , " + file lists A   ->  {"a"}  (whitespace falls through)
         (env unset, file lists ["Owner/repo-a"])         ->  {"owner/repo-a"}
         (env unset, no file)                             ->  frozenset()
 
@@ -91,13 +105,9 @@ def pii_exempt_repository_slugs() -> frozenset[str]:
     Returns:
         Lowercased ``owner/repo`` slugs exempt from staged-commit PII scanning.
     """
-    slugs_from_environment = os.environ.get(PII_EXEMPT_REPOS_ENV_VAR)
-    if slugs_from_environment is not None:
-        normalized_environment_slugs = _normalized_slug_set(
-            list(slugs_from_environment.split(PII_EXEMPT_REPOS_SEPARATOR))
-        )
-        if normalized_environment_slugs:
-            return normalized_environment_slugs
+    environment_slugs = _environment_exempt_slugs()
+    if environment_slugs:
+        return environment_slugs
     stored_slugs = _identity_dictionary_from_local_file().get(
         PII_EXEMPT_REPOS_JSON_KEY
     )
@@ -106,6 +116,47 @@ def pii_exempt_repository_slugs() -> frozenset[str]:
     return _normalized_slug_set(stored_slugs)
 
 
+def _normalized_allowlisted_values(all_raw_values: object) -> frozenset[str]:
+    """Return the non-empty string members of a raw values list, or empty."""
+    if not isinstance(all_raw_values, list):
+        return frozenset()
+    return frozenset(
+        each_value
+        for each_value in all_raw_values
+        if isinstance(each_value, str) and each_value
+    )
+
+
+def pii_allowlisted_values_by_repository() -> dict[str, frozenset[str]]:
+    """Return the exact literal values each repository allows past the PII scan.
+
+    ::
+
+        file {"Owner/Repo": ["user@example.com"]}  ->  {"owner/repo": {"user@example.com"}}
+        (env unset, no file, or bad json)          ->  {}
+
+    Keyed by lowercased ``owner/repo`` slug so matching is case-insensitive; the
+    values stay exact. The mapping lives under ``pii_allowlisted_values`` in the
+    git-ignored ``~/.claude/local-identity.json`` so a private repository's real
+    fixture addresses stay out of this published tree.
+
+    Returns:
+        Lowercased ``owner/repo`` slug to the frozenset of exact allowed values.
+    """
+    stored_mapping = _identity_dictionary_from_local_file().get(
+        PII_ALLOWLISTED_VALUES_JSON_KEY
+    )
+    if not isinstance(stored_mapping, dict):
+        return {}
+    all_values_by_slug: dict[str, frozenset[str]] = {}
+    for each_raw_slug, each_raw_values in stored_mapping.items():
+        normalized_slug = each_raw_slug.strip().lower() if isinstance(each_raw_slug, str) else ""
+        allowlisted_values = _normalized_allowlisted_values(each_raw_values)
+        if normalized_slug and allowlisted_values:
+            all_values_by_slug[normalized_slug] = allowlisted_values
+    return all_values_by_slug
+
+
 def nas_host() -> str:
     """Return the NAS host the ssh enforcer guards.
 

package/hooks/hooks_constants/pii_prevention_constants.py

@@ -293,12 +293,6 @@ STAGED_LIST_FAILURE_REASON: str = (
     "(git diff --cached failed). Refuse commit until the index is readable."
 )
 
-REPOSITORY_ROOT_UNRESOLVED_REASON: str = (
-    "BLOCKED [pii_prevention_blocker]: could not resolve the git repository root "
-    "for a commit command (not a git work tree, git missing, or bad -C path). "
-    "Refuse commit until the repository root is resolvable."
-)
-
 STAGED_BLOB_UNSCANNABLE_REASON_TEMPLATE: str = (
     "BLOCKED [pii_prevention_blocker]: staged file '{relative_path}' could not be "
     "scanned for PII ({reason}). Refuse commit, shrink the blob, or keep binary "

package/hooks/hooks_constants/test_local_identity.py

@@ -8,9 +8,11 @@ import sys
 from pathlib import Path
 from unittest.mock import patch
 
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from hooks_constants import local_identity  # noqa: E402
+try:
+    from hooks_constants import local_identity
+except ImportError:
+    sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+    from hooks_constants import local_identity
 
 ALL_NAS_ENV_VARS = ("CLAUDE_NAS_HOST", "CLAUDE_NAS_SSH_USER", "CLAUDE_NAS_SSH_PORT")
 
@@ -134,6 +136,106 @@ class TestPiiExemptRepositorySlugs:
                 assert slugs == frozenset({"fileowner/file-repo"})
 
 
+class TestPiiAllowlistedValuesByRepository:
+    def test_reads_the_mapping_lowercasing_slugs_and_keeping_values_exact(
+        self, tmp_path: Path
+    ) -> None:
+        allowed_value = "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
+        identity_path = tmp_path / "local-identity.json"
+        identity_path.write_text(
+            json.dumps(
+                {"pii_allowlisted_values": {"Owner/Private-Repo": [allowed_value]}}
+            ),
+            encoding="utf-8",
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(identity_path)},
+            clear=False,
+        ):
+            values_by_slug = local_identity.pii_allowlisted_values_by_repository()
+            assert values_by_slug == {"owner/private-repo": frozenset({allowed_value})}
+
+    def test_returns_empty_mapping_when_the_file_is_missing(
+        self, tmp_path: Path
+    ) -> None:
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(tmp_path / "absent.json")},
+            clear=False,
+        ):
+            assert local_identity.pii_allowlisted_values_by_repository() == {}
+
+    def test_returns_empty_mapping_when_the_json_is_corrupt(
+        self, tmp_path: Path
+    ) -> None:
+        identity_path = tmp_path / "local-identity.json"
+        identity_path.write_text("{ not valid json", encoding="utf-8")
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(identity_path)},
+            clear=False,
+        ):
+            assert local_identity.pii_allowlisted_values_by_repository() == {}
+
+    def test_returns_empty_mapping_when_the_key_is_absent(
+        self, tmp_path: Path
+    ) -> None:
+        identity_path = tmp_path / "local-identity.json"
+        identity_path.write_text(
+            json.dumps({"nas": {"host": "10.0.0.5"}}), encoding="utf-8"
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(identity_path)},
+            clear=False,
+        ):
+            assert local_identity.pii_allowlisted_values_by_repository() == {}
+
+    def test_drops_blank_slugs_and_non_list_value_entries(
+        self, tmp_path: Path
+    ) -> None:
+        allowed_value = "keep.fixture" + "@" + "acme-corp" + ".example" + ".io"
+        identity_path = tmp_path / "local-identity.json"
+        identity_path.write_text(
+            json.dumps(
+                {
+                    "pii_allowlisted_values": {
+                        "  ": [allowed_value],
+                        "Owner/Repo": allowed_value,
+                        "Owner/Kept": [allowed_value, 7],
+                    }
+                }
+            ),
+            encoding="utf-8",
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(identity_path)},
+            clear=False,
+        ):
+            values_by_slug = local_identity.pii_allowlisted_values_by_repository()
+            assert values_by_slug == {"owner/kept": frozenset({allowed_value})}
+
+
+class TestLocalIdentityPathOverride:
+    def test_prefers_the_env_path_over_the_home_directory_file(
+        self, tmp_path: Path
+    ) -> None:
+        override_path = tmp_path / "override" / "local-identity.json"
+        override_path.parent.mkdir()
+        override_path.write_text(
+            json.dumps({"nas": {"host": "10.9.9.9"}}), encoding="utf-8"
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(override_path)},
+            clear=False,
+        ), patch.object(Path, "home", return_value=tmp_path):
+            _clear_nas_env()
+            assert local_identity.nas_host() == "10.9.9.9"
+
+
 class TestDenyMessagesQuoteTheResolvedHost:
     def should_include_the_resolved_host_and_port_in_the_bare_binary_message(
         self,

package/hooks/pyproject.toml

@@ -15,19 +15,18 @@ no_implicit_optional = true
 strict_equality = true
 exclude = [
     "validators/test_files/",
-    "test_.*\\.py$",
-    ".*/test_.*\\.py$",
-    # One-line mypy fixes re-surface whole-file CODE_RULES debt at pre-commit (#51).
-    "abbreviation_checks\\.py$",
-    "git_checks\\.py$",
-    "exempt_paths\\.py$",
-    "code_rules_typeddict_stub\\.py$",
-    "validators/exempt_paths\\.py$",
-    "validators/abbreviation_checks\\.py$",
-    "validators/git_checks\\.py$",
-    "blocking/code_rules_typeddict_stub\\.py$",
+    "test_",
+    "abbreviation_checks.py",
+    "git_checks.py",
+    "exempt_paths.py",
+    "code_rules_typeddict_stub.py",
 ]
 
+
+[[tool.mypy.overrides]]
+module = ["exempt_paths", "code_rules_path_utils", "gh_pr_author_enforcer"]
+warn_unused_ignores = false
+
 [[tool.mypy.overrides]]
 module = "tests.*"
 disallow_untyped_defs = false
@@ -54,9 +53,7 @@ select = [
     "SIM",
     "PL",
 ]
-# Gate-restore (#51): principled + pure-style ignores. Non-negotiable defect
-# classes stay selected; residual hits live under per-file-ignores where a
-# one-line fix is blocked by whole-file CODE_RULES pre-commit debt.
+# Principled + pure-style ignores (#51/#57). Non-negotiable defect classes stay selected.
 ignore = [
     "E501",
     "E402",
@@ -94,29 +91,9 @@ ignore = [
 ]
 
 [tool.ruff.lint.per-file-ignores]
-"advisory/refactor_guard.py" = ["F401", "PLW1510"]
-"blocking/block_main_commit.py" = ["PLW1510"]
-"blocking/code_rules_boolean_mustcheck.py" = ["B905"]
-"blocking/code_rules_mock_completeness.py" = ["B007"]
-"blocking/code_rules_optional_params.py" = ["B905"]
-"blocking/code_rules_shared.py" = ["B905"]
-"blocking/code_rules_test_assertions.py" = ["B905"]
-"blocking/code_rules_typeddict_stub.py" = ["B905"]
-"blocking/pii_prevention_blocker.py" = ["PLW1510", "B018"]
-"blocking/pr_description_command_parser.py" = ["B904"]
-"blocking/precommit_code_rules_gate.py" = ["PLW1510"]
-"diagnostic/hook_log_extractor.py" = ["SIM115"]
-"git-hooks/post_commit.py" = ["F401", "PLW1510"]
-"hooks_constants/banned_identifiers_constants.py" = ["B033"]
-"session/plugin_data_dir_cleanup.py" = ["F401"]
-"validation/mypy_validator.py" = ["PLW1510"]
-"validators/exempt_paths.py" = ["F401"]
-"validators/health_check.py" = ["PLW1510"]
-"validators/mypy_integration.py" = ["PLW1510"]
-"validators/python_style_checks.py" = ["B905"]
-"validators/ruff_integration.py" = ["PLW1510"]
+# Residual production carve-outs re-homed on #57 (gate friction on multi-line touch).
 "validators/run_all_validators.py" = ["PLW1510"]
-"workflow/auto_formatter.py" = ["PLW1510"]
+"validators/exempt_paths.py" = ["F401"]
 "test_*.py" = ["B011", "PLR2004", "F401", "F841", "PLW1510", "B905", "B033", "SIM115", "B007", "B018", "B904"]
 "*_test.py" = ["B011", "PLR2004", "F401", "F841", "PLW1510", "B905", "B033", "SIM115", "B007", "B018", "B904"]
 "conftest.py" = ["B011", "F401", "F841", "PLW1510"]

package/hooks/session/plugin_data_dir_cleanup.py

@@ -13,7 +13,6 @@ separate from the EEXIST fixes in v2.1.70-v2.1.72.
 """
 
 import os
-import sys
 
 PLUGINS_DATA_DIRECTORY = os.path.join(
     os.path.expanduser("~"), ".claude", "plugins", "data"

package/hooks/validation/mypy_validator.py

@@ -70,7 +70,7 @@ def discover_project_root(target_file: str) -> Path | None:
     try:
         completed_process = subprocess.run(
             ["git", "rev-parse", "--show-toplevel"],
-            capture_output=True,
+            check=False, capture_output=True,
             text=True,
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=str(Path(target_file).parent),
@@ -359,7 +359,7 @@ def run_mypy(target_file: str, project_root: str) -> tuple[int, str]:
 
     completed_process = subprocess.run(
         mypy_command,
-        capture_output=True,
+        check=False, capture_output=True,
         text=True,
         env=os.environ.copy(),
         timeout=MYPY_TIMEOUT_SECONDS,

package/hooks/validators/health_check.py

@@ -110,6 +110,7 @@ def check_optional_tool(tool_name: str) -> bool:
     try:
         result = subprocess.run(
             [tool_name, "--version"],
+            check=False,
             capture_output=True,
             text=True,
         )

package/hooks/validators/mypy_integration.py

@@ -18,6 +18,7 @@ def check_mypy_available() -> bool:
     try:
         result = subprocess.run(
             ["mypy", "--version"],
+            check=False,
             capture_output=True,
             text=True,
         )
@@ -85,6 +86,7 @@ def run_mypy_check(files: list[Path]) -> MypyResult:
     result = subprocess.run(
         ["mypy", *config_argument, "--ignore-missing-imports", "--no-error-summary"]
         + py_files,
+        check=False,
         capture_output=True,
         text=True,
     )

package/hooks/validators/ruff_integration.py

@@ -17,6 +17,7 @@ def check_ruff_available() -> bool:
     try:
         result = subprocess.run(
             ["ruff", "--version"],
+            check=False,
             capture_output=True,
             text=True,
         )
@@ -39,6 +40,7 @@ def run_ruff_check(files: list[Path]) -> RuffResult:
 
     result = subprocess.run(
         ["ruff", "check"] + py_files,
+        check=False,
         capture_output=True,
         text=True,
     )
@@ -61,6 +63,7 @@ def run_ruff_fix(files: list[Path]) -> RuffResult:
 
     result = subprocess.run(
         ["ruff", "check", "--fix"] + py_files,
+        check=False,
         capture_output=True,
         text=True,
     )

package/hooks/workflow/auto_formatter.py

@@ -48,6 +48,7 @@ PLUGIN_ROOT = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__
 HOOKS_DIR = os.path.join(PLUGIN_ROOT, "hooks") + os.sep
 PYTHON_FORMAT_TIMEOUT_SECONDS = 12
 JS_FORMAT_TIMEOUT_SECONDS = 30
+GIT_LS_FILES_TIMEOUT_SECONDS = 5
 PRETTIER_CONFIG_NAMES = {
     ".prettierrc",
     ".prettierrc.json",
@@ -99,10 +100,10 @@ def is_untracked_in_git(file_path: str) -> bool:
     try:
         git_check = subprocess.run(
             ["git", "ls-files", "--error-unmatch", file_path],
-            capture_output=True,
+            check=False, capture_output=True,
             text=True,
             cwd=containing_directory,
-            timeout=5,
+            timeout=GIT_LS_FILES_TIMEOUT_SECONDS,
         )
         return git_check.returncode != 0
     except (FileNotFoundError, subprocess.TimeoutExpired):
@@ -150,7 +151,7 @@ def main() -> None:
             [sys.executable, "-m", "black", file_path],
         ]:
             try:
-                format_run = subprocess.run(each_formatter_command, capture_output=True, text=True, timeout=PYTHON_FORMAT_TIMEOUT_SECONDS)
+                format_run = subprocess.run(each_formatter_command, check=False, capture_output=True, text=True, timeout=PYTHON_FORMAT_TIMEOUT_SECONDS)
                 if format_run.returncode == 0:
                     formatter_name = each_formatter_command[0] if each_formatter_command[0] != sys.executable else each_formatter_command[2]
                     send_format_notification(file_path, formatter_name)
@@ -165,7 +166,7 @@ def main() -> None:
         try:
             prettier_run = subprocess.run(
                 ["npx", "--yes", "prettier", "--write", file_path],
-                capture_output=True,
+                check=False, capture_output=True,
                 text=True,
                 timeout=JS_FORMAT_TIMEOUT_SECONDS,
             )

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "1.95.0",
+    "version": "2.0.1",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/CLAUDE.md

@@ -8,9 +8,13 @@ Utility scripts installed into `~/.claude/scripts/` by `bin/install.mjs`. Each s
 |---|---|
 | `claude_chain_runner.py` | Runs a `claude` invocation through a config-driven fallback chain (`~/.claude/claude-chain.json`): the leading binary serves the call, and only a usage-limit failure falls over to the next logged-in binary; usable as an imported module (`run_claude`) or a CLI. Copy `claude-chain.example.json` to `~/.claude/claude-chain.json` and list your binaries in fallback order |
 | `gh_artifact_upload.py` | Uploads a file to a repo's durable `artifacts` prerelease under a timestamped asset name and prints the permanent download URL a GitHub post can link |
+| `grok_headless_runner.py` | Runs one worker as headless `grok`: builds argv, mints a unique leader socket, captures streams, kills on timeout with grace, classifies ok/usage_limit/auth_failure/timeout/error; imported by `spawn_grok_batch.py` |
+| `grok_worker_preflight.py` | Soft gate for the headless grok tier: binary on PATH, `grok models` auth, install manifest + role agents, opt-in cached live ping; non-zero exit is fallthrough, not failure |
 | `setup_project_paths.py` | One-time bootstrap: discovers git repos via `es.exe` (Everything) and writes `~/.claude/project-paths.json`; never hardcodes scan roots |
+| `spawn_grok_batch.py` | Launches a fleet of headless grok workers from a JSON batch spec: gates once through the preflight, assembles each prompt from part files, staggers starts, runs each through `grok_headless_runner.py`, and emits one batch summary JSON |
 | `sweep_empty_dirs.py` | Deletes empty directories older than a configurable age under a given root; runs once (`--once`) or in continuous-watch mode |
 | `sync_to_cursor.py` | Entry point for syncing Claude rules to Cursor `.mdc` files; delegates to the `sync_to_cursor/` package |
+| `resolve_worker_spawn.py` | Dispatches a worker role through grok then claude fallback tiers (preflight, headless grok, `claude_agent_required` handoff, optional claude headless); protocol: [`../_shared/pr-loop/worker-spawn.md`](../_shared/pr-loop/worker-spawn.md) |
 
 ## PowerShell scripts
 

package/scripts/dev_env_scripts_constants/CLAUDE.md

@@ -6,11 +6,13 @@ Named constants for scripts in `scripts/`. Follows the project convention that t
 
 | File | Constants for |
 |---|---|
-| `timing.py` | `sweep_empty_dirs.py` — `DEFAULT_AGE_SECONDS` (smallest age before an empty directory is eligible for removal) and `DEFAULT_POLL_INTERVAL` (seconds between sweep passes in continuous-watch mode) |
-| `gh_artifact_upload_constants.py` | `gh_artifact_upload.py` — the `artifacts` release tag, title, and notes body, the GitHub CLI binary name, the asset-name timestamp format and template, the asset download URL template, the notes-file suffix, and the text encoding |
-| `claude_chain_constants.py` | `claude_chain_runner.py` — the chain config filename and home subdirectory, the usage-limit signature text, the per-binary status labels, the default timeout, CLI flag and separator tokens, config JSON keys, invalid-shape reason text, config-error and exhausted-chain message templates, and CLI exit codes |
+| `timing.py` | `sweep_empty_dirs.py` - `DEFAULT_AGE_SECONDS` (smallest age before an empty directory is eligible for removal) and `DEFAULT_POLL_INTERVAL` (seconds between sweep passes in continuous-watch mode); `spawn_grok_batch.py` - `WORKER_STAGGER_SECONDS` (seconds between staggered headless grok worker starts); `invoke_code_review.py` - `DEFAULT_CODE_REVIEW_TIMEOUT_SECONDS` (timeout for one headless `/code-review` chain run) |
+| `gh_artifact_upload_constants.py` | `gh_artifact_upload.py` - the `artifacts` release tag, title, and notes body, the GitHub CLI binary name, the asset-name timestamp format and template, the asset download URL template, the notes-file suffix, and the text encoding |
+| `claude_chain_constants.py` | `claude_chain_runner.py` - the chain config filename and home subdirectory, the usage-limit signature text, the per-binary status labels, the default timeout, CLI flag and separator tokens, config JSON keys, invalid-shape reason text, config-error and exhausted-chain message templates, and CLI exit codes |
+| `grok_worker_constants.py` | `grok_worker_preflight.py`, `grok_headless_runner.py`, and `spawn_grok_batch.py` - the `grok` binary name and CLI flags, model and subcommand tokens, leader-socket and scratch-file name parts, auth and usage-limit signature lists, outcome classifications, fallthrough reasons, tool-profile names and prompt headers, timeouts and turn caps (including launch-failure return code and post-kill grace), ping-cache keys and TTL, batch-spec and summary JSON keys, the prompt-part and report-stream join separators, and the CLI launch-error stderr prefix |
+| `code_review_constants.py` | `invoke_code_review.py` - the `/code-review high --fix` prompt, opus model alias, permission-mode flag and value, result mode and JSON keys, session-model CLI flag, git dirty-check tokens, and in-session return markers |
 | `__init__.py` | Empty package marker |
 
 ## Convention
 
-Every constant is `UPPER_SNAKE_CASE` with an explicit type annotation and a docstring. Scripts import from here rather than embedding literal values in their bodies.
+Every constant is `UPPER_SNAKE_CASE` with an explicit type annotation and a docstring. Scripts import from here rather than embedding literal values in their bodies.

package/scripts/dev_env_scripts_constants/code_review_constants.py

@@ -0,0 +1,71 @@
+"""Named constants for the host-aware `/code-review` invoker.
+
+`invoke_code_review.py` imports every scalar and structural constant it
+needs from this module (and shared flag tokens from
+`grok_worker_constants`) so the prompt, model alias, and JSON keys are
+never hardcoded twice.
+"""
+
+from __future__ import annotations
+
+CODE_REVIEW_SLASH_COMMAND: str = "/code-review"
+"""Built-in Claude Code slash command that runs the repository review."""
+
+CODE_REVIEW_EFFORT: str = "high"
+"""Effort level passed to the built-in review slash command."""
+
+CODE_REVIEW_FIX_FLAG: str = "--fix"
+"""Slash-command flag that applies automatic fixes for review findings."""
+
+CODE_REVIEW_PROMPT: str = (
+    f"{CODE_REVIEW_SLASH_COMMAND} {CODE_REVIEW_EFFORT} {CODE_REVIEW_FIX_FLAG}"
+)
+"""Single-turn prompt that runs the built-in review slash command with fixes."""
+
+CODE_REVIEW_MODEL_ALIAS: str = "opus"
+"""CLI `--model` short alias the review always pins to."""
+
+PERMISSION_MODE_FLAG: str = "--permission-mode"
+"""CLI flag that selects how the headless claude process handles tool permission prompts."""
+
+PERMISSION_MODE_BYPASS: str = "bypassPermissions"
+"""Permission-mode value that auto-approves tools for unattended chain runs."""
+
+MODE_IN_SESSION: str = "in_session"
+"""Result mode when the host is Claude and the session already runs opus."""
+
+MODE_CHAIN: str = "chain"
+"""Result mode when the helper spawns a headless claude chain for the review."""
+
+RESULT_KEY_MODE: str = "mode"
+"""JSON result key naming the review mode (`in_session` or `chain`)."""
+
+RESULT_KEY_SERVED_COMMAND: str = "served_command"
+"""JSON result key naming the chain binary that served the call, or null."""
+
+RESULT_KEY_RETURNCODE: str = "returncode"
+"""JSON result key holding the process return code from the chain run."""
+
+RESULT_KEY_DIRTY_TREE: str = "dirty_tree"
+"""JSON result key holding whether the working tree is dirty after the review."""
+
+CLI_SESSION_MODEL_FLAG: str = "--session-model"
+"""CLI flag naming the caller's current session model short alias."""
+
+GIT_BINARY: str = "git"
+"""Executable name resolved on PATH for working-tree dirty checks."""
+
+GIT_STATUS_SUBCOMMAND: str = "status"
+"""Git subcommand used to detect an uncommitted dirty working tree."""
+
+GIT_PORCELAIN_FLAG: str = "--porcelain"
+"""Git status flag that prints machine-readable dirty-path lines."""
+
+IN_SESSION_RETURNCODE: int = 0
+"""Return code reported when the helper hands the review back to the in-session skill."""
+
+HOST_PROFILE_ERROR_RETURNCODE: int = 1
+"""Return code when host-profile detection raises ValueError at the CLI boundary."""
+
+SUCCESSFUL_REVIEW_RETURNCODE: int = 0
+"""Return code required before a clean stamp may advance past CODE_REVIEW."""