claude-dev-env 2.12.0 → 2.14.0

package/hooks/blocking/code_rules_probe_chains.py

@@ -1,4 +1,8 @@
-"""Attribute-chain and os.environ alias-resolution primitives for the test-isolation check."""
+"""Attribute-chain and os.environ alias-resolution primitives.
+
+Serves the test-isolation check, and lends ``_dotted_attribute_chain`` to the
+dead-module-constant check's widened attribute-read scan.
+"""
 
 import ast
 import sys
@@ -143,7 +147,7 @@ def _attribute_chain_resolves_to_os_environ(
     return canonical_chain == OS_ENVIRON_DOTTED_NAME
 
 
-def _dotted_attribute_chain(attribute_node: ast.Attribute) -> str | None:
+def _dotted_attribute_chain(attribute_node: ast.expr) -> str | None:
     chain_parts: list[str] = []
     walker: ast.expr = attribute_node
     while isinstance(walker, ast.Attribute):

package/hooks/blocking/config/AGENTS.md

@@ -0,0 +1,10 @@
+# hooks/blocking/config
+
+A Python package that holds shared constants for blocking hooks. Opinionated prose-style gates import from here.
+
+## Key files
+
+| File | Contents |
+|---|---|
+| `__init__.py` | Declares this as a regular package (not a namespace package) so it resolves first on `sys.path` |
+| `prose_style_enforcement_constants.py` | `CLAUDE_PROSE_STYLE_ENFORCEMENT` opt-in (default off) for opinionated prose gates |

package/hooks/blocking/config/CLAUDE.md

@@ -1,22 +1 @@
-# hooks/blocking/config
-
-A Python package that holds shared constants for blocking hooks. Verified-commit gate modules and opinionated prose-style gates import from here.
-
-## Key files
-
-| File | Contents |
-|---|---|
-| `__init__.py` | Declares this as a regular package (not a namespace package) so it resolves first on `sys.path` |
-| `code_review_enforcement_constants.py` | Stamp and effort tunables for the code-review enforcement gates |
-| `prose_style_enforcement_constants.py` | `CLAUDE_PROSE_STYLE_ENFORCEMENT` opt-in (default off) for opinionated prose gates |
-| `verified_commit_constants.py` | All tunables for the gate: directory names, regex patterns for detecting verdict paths and obfuscation attempts, timeout values, git subcommand sets, bypass marker, and corrective messages |
-| `verified_commit_context_constants.py` | `VERIFY_SKIP_ADDITIONAL_CONTEXT`, the ``# verify-skip`` usage rule the gate attaches to a deny payload's `additionalContext` |
-| `verified_commit_gate_output_constants.py` | `PRE_TOOL_USE_HOOK_EVENT_NAME` and `DENY_PERMISSION_DECISION` (the deny payload's event name and decision string), `GATE_HOOK_MODULE_NAME` (the gate's own module name for block logging), and `REGEX_ALTERNATION_SEPARATOR` (the `\|` join for the directory-change verb alternation in `gated_invocations.py`) |
-
-## Key constants in `verified_commit_constants.py`
-
-- `VERIFICATION_BYPASS_MARKER` — the `# verify-skip` comment that exempts a single commit/push from the gate
-- `MINTING_AGENT_TYPE` — `"code-verifier"`, the agent type whose SubagentStop hook mints verdicts
-- `VERDICT_DIRECTORY_NAME` — `"verification"`, the directory under `~/.claude/` that holds verdict JSON files
-- `DOCS_ONLY_EXTENSIONS` — extensions (`.md`, `.txt`, images) whose changes are mechanically exempt from the gate
-- `CORRECTIVE_MESSAGE` / `VERDICT_DIRECTORY_GUARD_MESSAGE` — user-facing block messages
+@AGENTS.md

package/hooks/blocking/conventional_pr_title_gate.py

@@ -36,8 +36,6 @@ _hooks_dir = str(Path(__file__).resolve().parent.parent)
 if _hooks_dir not in sys.path:
     sys.path.insert(0, _hooks_dir)
 
-from verification_verdict_store import resolve_repo_root  # noqa: E402
-
 from blocking._gh_body_arg_utils import (  # noqa: E402
     all_value_flags,
     count_extra_tokens_to_skip_for_split_quoted_value,
@@ -68,6 +66,7 @@ from hooks_constants.conventional_pr_title_gate_constants import (  # noqa: E402
     YAML_LIST_ITEM_PREFIX,
 )
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+from hooks_constants.project_paths_reader import find_git_root as resolve_repo_root  # noqa: E402
 
 
 def _matches_gh_pr_title_subcommand(command: str) -> bool:

package/hooks/blocking/gh_pr_author_restore.py

@@ -36,6 +36,7 @@ if hooks_parent_directory not in sys.path:
     sys.path.insert(0, hooks_parent_directory)
 
 from _gh_pr_author_swap_utils import (  # noqa: E402
+    _build_restore_failure_message,
     _command_invokes_gh_pr_create_in_stripped,
     _delete_state_file,
     _preprocess_command_for_matching,
@@ -89,8 +90,12 @@ def main() -> None:
         _delete_state_file(state_file)
     else:
         _write_line(
-            f"[gh-pr-author-restore] failed to restore active gh account to {original_account!r}; "
-            f"state file {state_file} left in place so the SessionStart cleanup hook can retry",
+            _build_restore_failure_message(
+                "gh-pr-author-restore",
+                original_account,
+                state_file,
+                "state file",
+            ),
             sys.stderr,
         )
     sys.exit(0)

package/hooks/blocking/intent_only_ending_blocker.py

@@ -1,12 +1,10 @@
 #!/usr/bin/env python3
-"""
-Stop hook that blocks Claude responses ending on a promise about undone work.
+"""Stop hook that blocks a turn ending with a promise of future work.
 
-When a turn ends on a forward-looking statement of intent ("I'll now run the
-tests", "Let me implement the fix") instead of actually doing the work, the
-agent is forced to do the work now with tool calls, or - when genuinely blocked
-on input only the user can supply - route through AskUserQuestion and end
-cleanly. The rule name is long-horizon-autonomy.
+When a turn ends with a forward-looking statement of intent ("I'll now run the
+tests", "Let me implement the fix"), complete the work with tool calls during
+the turn. Route work requiring user-only input through AskUserQuestion. The
+rule name is long-horizon-autonomy.
 """
 
 import json
@@ -104,7 +102,7 @@ def find_intent_only_ending(text: str) -> bool:
 
 
 def main() -> None:
-    """Read the stop-hook payload and block turns that end on a promise of undone work."""
+    """Read the stop-hook payload and block turns that promise future work."""
     try:
         hook_input = json.load(sys.stdin)
     except json.JSONDecodeError:
@@ -125,14 +123,11 @@ def main() -> None:
         sys.exit(0)
 
     block_reason = (
-        "LONG-HORIZON-AUTONOMY GUARDRAIL: Your turn ends on a promise about work "
-        "that is not yet done, rather than doing it. Do the work NOW with tool calls "
-        "instead of describing what you are about to do.\n\n"
-        "If the work is genuinely blocked on input only the user can give, route the "
-        "ask through an AskUserQuestion tool call and end the turn cleanly. Otherwise, "
-        "carry out the stated action this turn.\n\n"
-        "You MUST re-output the complete response with the work actually performed, "
-        "per the long-horizon-autonomy rule."
+        "LONG-HORIZON-AUTONOMY GUARDRAIL: This turn ends with a promise of future "
+        "work. Complete that work with tool calls during this turn. Route questions "
+        "requiring user-only input through AskUserQuestion, then end the turn cleanly.\n\n"
+        "Re-output the complete response with the work performed, per the "
+        "long-horizon-autonomy rule."
     )
     block_response = {
         "decision": "block",

package/hooks/blocking/inventory_intent_records/AGENTS.md

@@ -0,0 +1,26 @@
+# inventory_intent_records
+
+The shared pending-intent store that lets `package_inventory_stale_blocker.py`
+and `claude_md_orphan_file_blocker.py` add a new file and its inventory row in
+one change, in either order. When one blocker denies, it records a note; the
+sibling blocker reads that note to allow the matching second write.
+
+## Modules
+
+| File | Purpose |
+|---|---|
+| `records.py` | Read, record, peek, and consume the per-session file and row intents; a missing or corrupt store reads as no notes |
+| `__init__.py` | Package marker |
+
+## Subdirectories
+
+| Entry | Description |
+|---|---|
+| `config/` | The records-file name shape, the freshness window, the list keys, and the note field names (`intent_records_constants.py`) |
+| `tests/` | pytest suite for the records store |
+
+## Running tests
+
+```bash
+python -m pytest packages/claude-dev-env/hooks/blocking/inventory_intent_records/tests/
+```

package/hooks/blocking/inventory_intent_records/CLAUDE.md

@@ -1,26 +1 @@
-# inventory_intent_records
-
-The shared pending-intent store that lets `package_inventory_stale_blocker.py`
-and `claude_md_orphan_file_blocker.py` add a new file and its inventory row in
-one change, in either order. When one blocker denies, it records a note; the
-sibling blocker reads that note to allow the matching second write.
-
-## Modules
-
-| File | Purpose |
-|---|---|
-| `records.py` | Read, record, peek, and consume the per-session file and row intents; a missing or corrupt store reads as no notes |
-| `__init__.py` | Package marker |
-
-## Subdirectories
-
-| Entry | Description |
-|---|---|
-| `config/` | The records-file name shape, the freshness window, the list keys, and the note field names (`intent_records_constants.py`) |
-| `tests/` | pytest suite for the records store |
-
-## Running tests
-
-```bash
-python -m pytest packages/claude-dev-env/hooks/blocking/inventory_intent_records/tests/
-```
+@AGENTS.md

package/hooks/blocking/package_inventory_stale_blocker_parts/AGENTS.md

@@ -0,0 +1,26 @@
+# package_inventory_stale_blocker_parts
+
+The concern modules `package_inventory_stale_blocker.py` wires together to block a
+new production file its package inventory omits. The entry hook imports them and
+re-exports their surface for the test suite.
+
+## Modules
+
+| File | Purpose |
+|---|---|
+| `inventory_detection.py` | Surveys a directory's `README.md`/`CLAUDE.md`/`SKILL.md`, collects the filenames they name, and reports whether a maintained inventory omits the file being written |
+| `decision.py` | Builds the deny payload naming the omitted file and closing with the retry hint, and emits the decision JSON |
+| `__init__.py` | Package marker |
+
+## Subdirectories
+
+| Entry | Description |
+|---|---|
+| `config/` | The retry hint the deny reason closes with and the inventory-name join separator (`inventory_blocker_constants.py`) |
+| `tests/` | pytest suite with one test module per module above |
+
+## Running tests
+
+```bash
+python -m pytest packages/claude-dev-env/hooks/blocking/package_inventory_stale_blocker_parts/tests/
+```

package/hooks/blocking/package_inventory_stale_blocker_parts/CLAUDE.md

@@ -1,26 +1 @@
-# package_inventory_stale_blocker_parts
-
-The concern modules `package_inventory_stale_blocker.py` wires together to block a
-new production file its package inventory omits. The entry hook imports them and
-re-exports their surface for the test suite.
-
-## Modules
-
-| File | Purpose |
-|---|---|
-| `inventory_detection.py` | Surveys a directory's `README.md`/`CLAUDE.md`/`SKILL.md`, collects the filenames they name, and reports whether a maintained inventory omits the file being written |
-| `decision.py` | Builds the deny payload naming the omitted file and closing with the retry hint, and emits the decision JSON |
-| `__init__.py` | Package marker |
-
-## Subdirectories
-
-| Entry | Description |
-|---|---|
-| `config/` | The retry hint the deny reason closes with and the inventory-name join separator (`inventory_blocker_constants.py`) |
-| `tests/` | pytest suite with one test module per module above |
-
-## Running tests
-
-```bash
-python -m pytest packages/claude-dev-env/hooks/blocking/package_inventory_stale_blocker_parts/tests/
-```
+@AGENTS.md

package/hooks/blocking/pii_prevention_blocker_parts/AGENTS.md

@@ -0,0 +1,24 @@
+# pii_prevention_blocker_parts
+
+The concern modules `pii_prevention_blocker.py` wires together. The entry hook
+imports them and re-exports their surface for the test suite.
+
+## Modules
+
+| File | Purpose |
+|---|---|
+| `repository_exemption.py` | Resolves a commit's origin owner/repo slug, decides whether the repository skips the staged PII scan, and resolves the exact values that repository allows past the scan |
+| `repository_resolution.py` | Reads the repository a commit command targets — composing multiple `-C` values and a leading `cd`/`pushd` — and builds the deny reason naming the path when the repository root does not resolve |
+| `__init__.py` | Package marker |
+
+## Subdirectories
+
+| Entry | Description |
+|---|---|
+| `config/` | The repository-resolution deny-message template and the session-cwd label (`repository_resolution_constants.py`) |
+
+## Running tests
+
+```bash
+python -m pytest packages/claude-dev-env/hooks/blocking/tests/
+```

package/hooks/blocking/pii_prevention_blocker_parts/CLAUDE.md

@@ -1,24 +1 @@
-# pii_prevention_blocker_parts
-
-The concern modules `pii_prevention_blocker.py` wires together. The entry hook
-imports them and re-exports their surface for the test suite.
-
-## Modules
-
-| File | Purpose |
-|---|---|
-| `repository_exemption.py` | Resolves a commit's origin owner/repo slug, decides whether the repository skips the staged PII scan, and resolves the exact values that repository allows past the scan |
-| `repository_resolution.py` | Reads the repository a commit command targets — composing multiple `-C` values and a leading `cd`/`pushd` — and builds the deny reason naming the path when the repository root does not resolve |
-| `__init__.py` | Package marker |
-
-## Subdirectories
-
-| Entry | Description |
-|---|---|
-| `config/` | The repository-resolution deny-message template and the session-cwd label (`repository_resolution_constants.py`) |
-
-## Running tests
-
-```bash
-python -m pytest packages/claude-dev-env/hooks/blocking/tests/
-```
+@AGENTS.md

package/hooks/blocking/send_user_file_open_locally_blocker.py

@@ -3,7 +3,7 @@
 
 SendUserFile attaches a file to the session. While the user is at the terminal
 (status "normal" or unset) an attach does not let them see the file — it must
-open on screen in its own viewer via Show-Asset.ps1. The one attach allowed
+open on screen in its native Windows app. The one attach allowed
 through is an away-from-desk phone push (status "proactive").
 """
 

package/hooks/blocking/stop_dispatcher.py

@@ -1,11 +1,11 @@
 #!/usr/bin/env python3
-"""Stop-hook dispatcher that hosts the six Stop-chain hooks in one process.
+"""Stop-hook dispatcher that hosts the Stop-chain blockers in one process.
 
 Reads the Stop payload from stdin once, runs each hosted hook in registration
 order via the shared hosted-hook runner, and emits the first block decision the
-chain produced. Later hooks still run so side-effect hooks (the log extractor
-wrapper) fire even when an earlier hook blocked. A single hosted hook crash
-fails open and does not suppress the remaining hooks.
+chain produced. Later hooks still run after an earlier block so every hosted
+hook gets a chance to run. A single hosted hook crash fails open and does not
+suppress the remaining hooks.
 """
 
 from __future__ import annotations

package/hooks/blocking/tdd_enforcer_parts/AGENTS.md

@@ -0,0 +1,30 @@
+# tdd_enforcer_parts
+
+The concern modules `tdd_enforcer.py` wires together to run the TDD gate. Each
+module owns one concern; the entry hook imports them and re-exports their
+surface for the test suite.
+
+## Modules
+
+| File | Purpose |
+|---|---|
+| `path_classification.py` | Classifies a write target (docs, tests, `.claude` trees) the gate skips, and extracts the written text from a Write, Edit, or MultiEdit payload |
+| `content_analysis.py` | Decides whether a payload is constants-only, and whether an Edit or MultiEdit merely removes or reorders imports |
+| `candidate_paths.py` | Resolves the candidate test files whose freshness can satisfy the gate for a production file |
+| `freshness.py` | Checks whether a candidate test was modified within the window and holds a real test function |
+| `git_tracking.py` | Detects a write that restores a git-tracked file absent on disk, so a remove-then-Write rewrite is exempt from the gate |
+| `decisions.py` | Builds the deny reason and writes the allow or deny decision JSON to stdout |
+| `__init__.py` | Package marker |
+
+## Subdirectories
+
+| Entry | Description |
+|---|---|
+| `config/` | The freshness window, the ancestor-walk limit, the git-tracking command tokens, the source-file extension sets, and the join separator (`tdd_enforcer_constants.py`) |
+| `tests/` | pytest suite with one test module per module above |
+
+## Running tests
+
+```bash
+python -m pytest packages/claude-dev-env/hooks/blocking/tdd_enforcer_parts/tests/
+```

package/hooks/blocking/tdd_enforcer_parts/CLAUDE.md

@@ -1,30 +1 @@
-# tdd_enforcer_parts
-
-The concern modules `tdd_enforcer.py` wires together to run the TDD gate. Each
-module owns one concern; the entry hook imports them and re-exports their
-surface for the test suite.
-
-## Modules
-
-| File | Purpose |
-|---|---|
-| `path_classification.py` | Classifies a write target (docs, tests, `.claude` trees) the gate skips, and extracts the written text from a Write, Edit, or MultiEdit payload |
-| `content_analysis.py` | Decides whether a payload is constants-only, and whether an Edit or MultiEdit merely removes or reorders imports |
-| `candidate_paths.py` | Resolves the candidate test files whose freshness can satisfy the gate for a production file |
-| `freshness.py` | Checks whether a candidate test was modified within the window and holds a real test function |
-| `git_tracking.py` | Detects a write that restores a git-tracked file absent on disk, so a remove-then-Write rewrite is exempt from the gate |
-| `decisions.py` | Builds the deny reason and writes the allow or deny decision JSON to stdout |
-| `__init__.py` | Package marker |
-
-## Subdirectories
-
-| Entry | Description |
-|---|---|
-| `config/` | The freshness window, the ancestor-walk limit, the git-tracking command tokens, the source-file extension sets, and the join separator (`tdd_enforcer_constants.py`) |
-| `tests/` | pytest suite with one test module per module above |
-
-## Running tests
-
-```bash
-python -m pytest packages/claude-dev-env/hooks/blocking/tdd_enforcer_parts/tests/
-```
+@AGENTS.md

package/hooks/blocking/test_bash_pre_tool_use_dispatcher.py

@@ -221,9 +221,6 @@ def test_powershell_selects_the_shared_hooks_in_registration_order() -> None:
     assert powershell_paths == [
         "blocking/unscoped_search_blocker.py",
         "blocking/pii_prevention_blocker.py",
-        "blocking/code_review_push_gate.py",
-        "blocking/code_review_pr_create_gate.py",
-        "blocking/code_review_stamp_directory_write_blocker.py",
     ]
 
 

package/hooks/blocking/test_code_rules_enforcer_banned_prefixes.py

@@ -1,6 +1,6 @@
 """Tests for check_banned_prefixes — flags function names with generic prefixes.
 
-CODE_RULES.md §5 / AGENTS.md "Naming → Function names use specific verbs:
+CODE_RULES.md §5 "Naming → Function names use specific verbs:
 parse_invoice, dispatch_event, migrate_schema. Generic prefixes to replace:
 handle_, process_, manage_, do_."
 

package/hooks/blocking/test_code_rules_enforcer_dead_module_constant.py

@@ -506,3 +506,174 @@ def test_dead_constant_stays_denied_on_every_attempt(neutral_root: Path) -> None
             "re-issue this write" in each_issue for each_issue in each_attempt
         ), f"A dead constant stays denied with the retry escape, got: {each_attempt}"
 
+
+ALIAS_CONSTANTS_BODY = 'BASE_PROMPTS_DIRECTORY_NAME = "prompts"\nSTYLE_SHEET_FILENAME = "style.css"\n'
+
+ALIASED_IMPORT_CONSUMER_BODY = (
+    "from style_guide_gen_constants.config import constants as sg\n"
+    "\n"
+    "def prompts_directory() -> str:\n"
+    "    return sg.BASE_PROMPTS_DIRECTORY_NAME\n"
+    "\n"
+    "def style_sheet() -> str:\n"
+    "    return sg.STYLE_SHEET_FILENAME\n"
+)
+
+
+def _build_alias_repository(
+    package_parent: Path,
+    consumer_directory: Path,
+    consumer_body: str,
+) -> Path:
+    package_directory = package_parent / "style_guide_gen_constants"
+    config_directory = package_directory / "config"
+    config_directory.mkdir(parents=True)
+    (package_directory / "__init__.py").write_text("", encoding="utf-8")
+    (config_directory / "__init__.py").write_text("", encoding="utf-8")
+    constants_path = config_directory / "constants.py"
+    constants_path.write_text(ALIAS_CONSTANTS_BODY, encoding="utf-8")
+    consumer_directory.mkdir(parents=True, exist_ok=True)
+    (consumer_directory / "style_guide_gen.py").write_text(consumer_body, encoding="utf-8")
+    return constants_path
+
+
+def test_does_not_flag_constant_read_through_an_aliased_module_import(
+    neutral_root: Path,
+) -> None:
+    constants_path = _build_alias_repository(
+        neutral_root,
+        neutral_root / "style_guide_gen_constants",
+        ALIASED_IMPORT_CONSUMER_BODY,
+    )
+    issues = _check(ALIAS_CONSTANTS_BODY, str(constants_path))
+    assert issues == [], (
+        f"A constant read as an attribute on an aliased module import stays live, got: {issues}"
+    )
+
+
+def test_does_not_flag_constant_read_through_an_alias_outside_the_package_tree(
+    neutral_root: Path,
+) -> None:
+    constants_path = _build_alias_repository(
+        neutral_root / "scripts",
+        neutral_root / "scripts",
+        ALIASED_IMPORT_CONSUMER_BODY,
+    )
+    issues = _check(ALIAS_CONSTANTS_BODY, str(constants_path))
+    assert issues == [], (
+        "A constant an aliased module import reads from outside the package tree "
+        f"stays live through the widened scan, got: {issues}"
+    )
+
+
+def test_does_not_flag_constant_read_through_an_unaliased_module_import_outside_the_tree(
+    neutral_root: Path,
+) -> None:
+    consumer_body = (
+        "from style_guide_gen_constants.config import constants\n"
+        "\n"
+        "def prompts_directory() -> str:\n"
+        "    return constants.BASE_PROMPTS_DIRECTORY_NAME\n"
+        "\n"
+        "def style_sheet() -> str:\n"
+        "    return constants.STYLE_SHEET_FILENAME\n"
+    )
+    constants_path = _build_alias_repository(
+        neutral_root / "scripts",
+        neutral_root / "scripts",
+        consumer_body,
+    )
+    issues = _check(ALIAS_CONSTANTS_BODY, str(constants_path))
+    assert issues == [], (
+        f"A constant read on an unaliased imported module object stays live, got: {issues}"
+    )
+
+
+def test_does_not_flag_constant_read_through_a_dotted_module_path_outside_the_tree(
+    neutral_root: Path,
+) -> None:
+    consumer_body = (
+        "import style_guide_gen_constants.config.constants\n"
+        "\n"
+        "def prompts_directory() -> str:\n"
+        "    return style_guide_gen_constants.config.constants.BASE_PROMPTS_DIRECTORY_NAME\n"
+        "\n"
+        "def style_sheet() -> str:\n"
+        "    return style_guide_gen_constants.config.constants.STYLE_SHEET_FILENAME\n"
+    )
+    constants_path = _build_alias_repository(
+        neutral_root / "scripts",
+        neutral_root / "scripts",
+        consumer_body,
+    )
+    issues = _check(ALIAS_CONSTANTS_BODY, str(constants_path))
+    assert issues == [], (
+        f"A constant read through the full dotted module path stays live, got: {issues}"
+    )
+
+
+def test_does_not_flag_constant_read_through_an_alias_in_a_sibling_tree(
+    neutral_root: Path,
+) -> None:
+    constants_body = 'CROSS_TREE_CONSTANT = "cross"\nLOCALLY_DEAD_CONSTANT = "dead"\n'
+    sibling_consumer_body = (
+        "from shared.theme_db.config import constants as theme_constants\n"
+        "\n"
+        "def tally() -> str:\n"
+        "    return theme_constants.CROSS_TREE_CONSTANT\n"
+    )
+    constants_path = _build_cross_tree_repository(
+        neutral_root, constants_body, sibling_consumer_body
+    )
+    issues = _check(constants_body, str(constants_path))
+    assert not any("CROSS_TREE_CONSTANT" in each_issue for each_issue in issues), (
+        "A constant a sibling tree reads as an attribute on an aliased module import "
+        f"must not be flagged, got: {issues}"
+    )
+    assert any("LOCALLY_DEAD_CONSTANT" in each_issue for each_issue in issues), (
+        f"A constant referenced nowhere in the repository stays flagged, got: {issues}"
+    )
+
+
+def _build_alias_collision_repository(
+    repository_root: Path,
+    promoter_constants_body: str,
+    harness_constants_body: str,
+    harness_consumer_body: str,
+) -> Path:
+    promoter_config = repository_root / "promoter" / "config"
+    promoter_config.mkdir(parents=True)
+    promoter_constants_path = promoter_config / "constants.py"
+    promoter_constants_path.write_text(promoter_constants_body, encoding="utf-8")
+    harness_config = repository_root / "harness" / "config"
+    harness_config.mkdir(parents=True)
+    (harness_config / "other_constants.py").write_text(harness_constants_body, encoding="utf-8")
+    (repository_root / "harness" / "lockfile.py").write_text(
+        harness_consumer_body, encoding="utf-8"
+    )
+    return promoter_constants_path
+
+
+def test_alias_attribute_read_on_an_unrelated_module_does_not_mask_a_dead_constant(
+    neutral_root: Path,
+) -> None:
+    promoter_constants_body = 'NEVER_READ_CONSTANT = "dead"\n'
+    harness_constants_body = 'NEVER_READ_CONSTANT = "twin"\n'
+    harness_consumer_body = (
+        "from harness.config import other_constants as oc\n"
+        "\n"
+        "def acquire() -> str:\n"
+        "    return oc.NEVER_READ_CONSTANT\n"
+    )
+    promoter_constants_path = _build_alias_collision_repository(
+        neutral_root,
+        promoter_constants_body,
+        harness_constants_body,
+        harness_consumer_body,
+    )
+    issues = _check(promoter_constants_body, str(promoter_constants_path))
+    assert any("NEVER_READ_CONSTANT" in each_issue for each_issue in issues), (
+        "A constant whose only same-named twin is read as an attribute on an "
+        f"unrelated aliased module must still be flagged dead, got: {issues}"
+    )
+

package/hooks/blocking/test_code_rules_enforcer_magic_allowlist.py

@@ -1,6 +1,6 @@
 """Tests for magic-value allowlist alignment with CODE_RULES §HOOK-ENFORCED.
 
-CODE_RULES.md and AGENTS.md both state that only
+CODE_RULES.md states that only
 0, 1, and -1 (plus their float forms 0.0, 1.0) are exempt from the
 magic-value check. Prior to this change, the hook silently allowed 2
 and 100 as well, making the hook more permissive than the written rule.

package/hooks/blocking/test_gh_pr_author_restore.py

@@ -422,7 +422,8 @@ def test_main_logs_high_level_failure_when_restore_switch_fails(
 
     assert exit_code == 0
     assert state_file.exists()
-    assert "[gh-pr-author-restore] failed to restore" in captured_streams.err
+    assert "[gh-pr-author-restore] Restore the gh account" in captured_streams.err
+    assert "gh account switch requires attention" in captured_streams.err
     assert "'jl-cmd'" in captured_streams.err
     assert str(state_file) in captured_streams.err
 

package/hooks/blocking/test_intent_only_ending_blocker.py

@@ -111,6 +111,10 @@ def test_intent_ending_message_emits_block_with_short_user_notice():
     assert parsed_response["systemMessage"] == USER_FACING_INTENT_ENDING_NOTICE
     assert parsed_response["suppressOutput"] is True
     assert "long-horizon-autonomy" in parsed_response["reason"]
+    assert "This turn ends with a promise of future work." in parsed_response["reason"]
+    assert "Complete that work with tool calls during this turn." in parsed_response[
+        "reason"
+    ]
 
 
 def test_next_steps_lead_in_emits_block():