claude-dev-env 2.18.0 → 2.20.0

package/hooks/git-hooks/post_commit.py

@@ -10,87 +10,196 @@ When you commit in a submodule, this hook:
 This prevents the "lost work" issue where submodule commits aren't tracked by parent.
 """
 
+from __future__ import annotations
+
 import subprocess
 import sys
+from enum import StrEnum
 from pathlib import Path
 
+from git_hooks_constants import GIT_COMMAND_SUCCESS_EXIT_CODE, GIT_EXECUTABLE_NAME
 
-def run_git(*args: str, cwd: Path | None = None) -> str:
-    """Run a git command and return output."""
-    result = subprocess.run(
-        ["git"] + list(args),
-        cwd=cwd,
-        check=False, capture_output=True,
-        text=True,
-    )
-    return result.stdout.strip()
+
+class ParentPointerStatus(StrEnum):
+    """States returned by a parent pointer update."""
+
+    UPDATED = "updated"
+    UNCHANGED = "unchanged"
+    FAILED = "failed"
+
+
+ParentPointerUpdate = tuple[ParentPointerStatus, str]
+
+
+def execute_git(
+    *arguments: str,
+    cwd: Path,
+) -> subprocess.CompletedProcess[str]:
+    """Run a Git command and return its completed process."""
+    try:
+        return subprocess.run(
+            [GIT_EXECUTABLE_NAME, *arguments],
+            cwd=cwd,
+            check=False,
+            capture_output=True,
+            text=True,
+        )
+    except OSError as error:
+        return subprocess.CompletedProcess(
+            [GIT_EXECUTABLE_NAME, *arguments],
+            1,
+            "",
+            str(error),
+        )
+
+
+def run_git(*arguments: str, cwd: Path) -> str:
+    """Run a successful Git command and return its trimmed standard output."""
+    command_result = execute_git(*arguments, cwd=cwd)
+    if command_result.returncode != GIT_COMMAND_SUCCESS_EXIT_CODE:
+        return ""
+    return command_result.stdout.strip()
+
+
+def run_git_from_current_directory(*arguments: str) -> str:
+    """Run a successful Git command from the hook's current directory."""
+    return run_git(*arguments, cwd=Path.cwd())
 
 
 def find_parent_repo(repo_dir: Path) -> Path | None:
-    """Find parent repo that has this as a submodule."""
-    repo_name = repo_dir.name
-    parent_dir = repo_dir.parent
+    """Return the Git superproject that owns the current repository."""
+    parent_path_text = run_git(
+        "rev-parse",
+        "--show-superproject-working-tree",
+        cwd=repo_dir,
+    )
+    if not parent_path_text:
+        return None
+
+    parent_path = Path(parent_path_text).resolve()
+    if not parent_path.is_dir():
+        return None
+    return parent_path
+
+
+def find_submodule_path(parent_repo: Path, repo_dir: Path) -> Path | None:
+    """Return the submodule path relative to its parent repository."""
+    try:
+        return repo_dir.resolve().relative_to(parent_repo.resolve())
+    except ValueError:
+        return None
+
 
-    while parent_dir != parent_dir.parent:
-        git_path = parent_dir / ".git"
-        gitmodules_path = parent_dir / ".gitmodules"
+def build_literal_pathspec(submodule_path: Path) -> str:
+    """Build a Git pathspec that treats every path character literally."""
+    return f":(literal){submodule_path.as_posix()}"
 
-        if git_path.exists() and gitmodules_path.exists():
-            try:
-                content = gitmodules_path.read_text()
-                if f"path = {repo_name}" in content:
-                    return parent_dir
-            except Exception:
-                pass
 
-        parent_dir = parent_dir.parent
+def get_git_failure_diagnostic(
+    command_result: subprocess.CompletedProcess[str],
+) -> str:
+    """Return the most useful diagnostic from a failed Git command."""
+    return command_result.stderr.strip() or command_result.stdout.strip()
 
-    return None
+
+def build_parent_commit_message(
+    repo_name: str,
+    commit_hash: str,
+    commit_message: str,
+) -> str:
+    """Build the parent commit message for a submodule pointer update."""
+    return (
+        f"chore: update {repo_name} submodule to {commit_hash}\n\n"
+        f"Submodule commit: {commit_message}\n\n"
+        "Co-Authored-By: Claude <noreply@anthropic.com>"
+    )
+
+
+def update_parent_pointer(
+    parent_repo: Path,
+    repo_dir: Path,
+    commit_hash: str,
+    commit_message: str,
+) -> ParentPointerUpdate:
+    """Commit the current submodule pointer in its parent repository."""
+    submodule_path = find_submodule_path(parent_repo, repo_dir)
+    if submodule_path is None:
+        return ParentPointerStatus.FAILED, "could not resolve the submodule path"
+
+    submodule_reference = build_literal_pathspec(submodule_path)
+    add_result = execute_git("add", "--", submodule_reference, cwd=parent_repo)
+    if add_result.returncode != GIT_COMMAND_SUCCESS_EXIT_CODE:
+        return ParentPointerStatus.FAILED, get_git_failure_diagnostic(add_result)
+
+    staged_difference = execute_git(
+        "diff",
+        "--cached",
+        "--quiet",
+        "--",
+        submodule_reference,
+        cwd=parent_repo,
+    )
+    if staged_difference.returncode == GIT_COMMAND_SUCCESS_EXIT_CODE:
+        return ParentPointerStatus.UNCHANGED, ""
+    if staged_difference.returncode != 1:
+        return ParentPointerStatus.FAILED, get_git_failure_diagnostic(staged_difference)
+
+    parent_commit_message = build_parent_commit_message(
+        repo_dir.name,
+        commit_hash,
+        commit_message,
+    )
+    commit_result = execute_git(
+        "commit",
+        "--only",
+        "-m",
+        parent_commit_message,
+        "--",
+        submodule_reference,
+        cwd=parent_repo,
+    )
+    if commit_result.returncode != GIT_COMMAND_SUCCESS_EXIT_CODE:
+        return ParentPointerStatus.FAILED, get_git_failure_diagnostic(commit_result)
+    return ParentPointerStatus.UPDATED, ""
 
 
 def main() -> int:
-    """Main hook logic."""
-    try:
-        repo_dir = Path(run_git("rev-parse", "--show-toplevel"))
-    except Exception:
+    """Update a parent repository after a submodule commit."""
+    repo_path_text = run_git_from_current_directory("rev-parse", "--show-toplevel")
+    if not repo_path_text:
         return 0
 
-    repo_name = repo_dir.name
+    repo_dir = Path(repo_path_text).resolve()
     parent_repo = find_parent_repo(repo_dir)
-
-    if not parent_repo:
+    if parent_repo is None:
         return 0
 
     commit_msg = run_git("log", "-1", "--pretty=%s", cwd=repo_dir)
-    commit_hash = run_git("rev-parse", "--short", "HEAD", cwd=repo_dir)
+    commit_hash = run_git("rev-parse", "HEAD", cwd=repo_dir)
+    short_commit_hash = run_git("rev-parse", "--short", "HEAD", cwd=repo_dir)
+    if not commit_hash or not short_commit_hash:
+        return 0
 
     print()
     print("=== Submodule Parent Update ===")
-    print(f"Submodule: {repo_name} @ {commit_hash}")
+    print(f"Submodule: {repo_dir.name} @ {short_commit_hash}")
     print(f"Parent:    {parent_repo}")
 
-    run_git("add", repo_name, cwd=parent_repo)
-
-    diff_result = subprocess.run(
-        ["git", "diff", "--cached", "--quiet"],
-        check=False, cwd=parent_repo,
+    parent_pointer_status, parent_pointer_diagnostic = update_parent_pointer(
+        parent_repo,
+        repo_dir,
+        commit_hash,
+        commit_msg,
     )
-
-    if diff_result.returncode == 0:
+    if parent_pointer_status is ParentPointerStatus.FAILED:
+        print("Parent update failed.")
+        if parent_pointer_diagnostic:
+            print(f"Git diagnostic: {parent_pointer_diagnostic}")
+        return 0
+    if parent_pointer_status is ParentPointerStatus.UNCHANGED:
         print("Parent already up to date.")
         return 0
 
-    full_commit_msg = f"""chore: update {repo_name} submodule to {commit_hash}
-
-Submodule commit: {commit_msg}
-
-Co-Authored-By: Claude <noreply@anthropic.com>"""
-
-    subprocess.run(
-        ["git", "commit", "-m", full_commit_msg],
-        check=False, cwd=parent_repo,
-    )
-
     print("Parent updated successfully.")
     print("================================")
     print()

package/hooks/git-hooks/pre_commit.py

@@ -1,10 +1,13 @@
 #!/usr/bin/env python3
-"""Git pre-commit hook: run the CODE_RULES gate over staged changes.
+"""Native Git pre-commit owner for staged CODE_RULES validation.
 
 Installed to the user's shared git-hooks directory via the claude-dev-env
 installer; git invokes this file as `pre-commit` (the installer strips the
 `_` and `.py` suffix when copying into the live hooks path).
 
+The Agent Bash commit surface records passive staged-surface evidence. This
+native hook invokes the shared gate and owns the staged commit decision.
+
 Exit codes:
   0 - staged changes pass the gate (or the gate is not installed locally).
   1 - staged changes introduce one or more blocking violations.
@@ -17,23 +20,24 @@ import subprocess
 import sys
 from pathlib import Path
 
+from gate_utils import is_safe_regular_file, resolve_gate_script_path
 from git_hooks_constants import (
     GATE_INFRASTRUCTURE_FAILURE_EXIT_CODE,
     GATE_SCRIPT_NOT_FOUND_MESSAGE,
+    IMMEDIATE_SCOPE_ARGUMENT,
     INVOKE_GATE_FAILURE_MESSAGE,
-    STAGED_SCOPE_ARGUMENT,
 )
-from gate_utils import is_safe_regular_file, resolve_gate_script_path
 
 
 def invoke_gate(gate_script_path: Path) -> int:
-    staged_scope_argument = STAGED_SCOPE_ARGUMENT
+    """Invoke the shared staged gate and return its exit code."""
+    immediate_scope_argument = IMMEDIATE_SCOPE_ARGUMENT
     invoke_gate_failure_message = INVOKE_GATE_FAILURE_MESSAGE
     gate_infrastructure_failure_exit_code = GATE_INFRASTRUCTURE_FAILURE_EXIT_CODE
     try:
         resolved_gate_path = gate_script_path.resolve(strict=True)
         completion = subprocess.run(
-            [sys.executable, str(resolved_gate_path), staged_scope_argument],
+            [sys.executable, str(resolved_gate_path), immediate_scope_argument],
             check=False,
         )
     except OSError as launch_error:

package/hooks/git-hooks/test_post_commit.py

@@ -0,0 +1,203 @@
+from __future__ import annotations
+
+import os
+import subprocess
+from pathlib import Path
+
+import post_commit
+import pytest
+from git_hooks_constants import GIT_EXECUTABLE_NAME
+
+
+def build_fixture_git_environment() -> dict[str, str]:
+    """Copy the process environment without inherited Git state overrides."""
+    return {
+        each_name: each_value
+        for each_name, each_value in os.environ.items()
+        if not each_name.upper().startswith("GIT_")
+    }
+
+
+def clear_inherited_git_environment(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Remove inherited Git state overrides from the current test process."""
+    for each_name in list(os.environ):
+        if each_name.upper().startswith("GIT_"):
+            monkeypatch.delenv(each_name, raising=False)
+
+
+def test_fixture_git_environment_preserves_process_execution_path(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """The fixture environment keeps PATH while removing Git overrides."""
+    monkeypatch.setenv("PATH", "fixture-execution-path")
+    monkeypatch.setenv("GIT_DIR", "unrelated-repository")
+
+    fixture_environment = build_fixture_git_environment()
+
+    assert fixture_environment["PATH"] == "fixture-execution-path"
+    assert all(not each_name.upper().startswith("GIT_") for each_name in fixture_environment)
+
+
+def run_fixture_git(repository_path: Path, *arguments: str) -> str:
+    """Run Git in a fixture repository and return standard output."""
+    completed_process = subprocess.run(
+        [GIT_EXECUTABLE_NAME, *arguments],
+        cwd=repository_path,
+        check=False,
+        capture_output=True,
+        text=True,
+        env=build_fixture_git_environment(),
+    )
+    assert completed_process.returncode == 0, completed_process.stderr
+    return completed_process.stdout.strip()
+
+
+def configure_fixture_identity(repository_path: Path) -> None:
+    """Configure a stable identity for a fixture repository."""
+    run_fixture_git(repository_path, "config", "user.name", "Fixture User")
+    run_fixture_git(
+        repository_path,
+        "config",
+        "user.email",
+        "fixture@example.invalid",
+    )
+    run_fixture_git(repository_path, "config", "commit.gpgsign", "false")
+    fixture_hooks_directory = repository_path / ".fixture-hooks"
+    fixture_hooks_directory.mkdir(exist_ok=True)
+    run_fixture_git(
+        repository_path,
+        "config",
+        "core.hooksPath",
+        str(fixture_hooks_directory),
+    )
+
+
+def initialize_fixture_repository(repository_path: Path) -> None:
+    """Create and configure a fixture Git repository."""
+    repository_path.mkdir()
+    run_fixture_git(repository_path, "init", "-b", "main")
+    configure_fixture_identity(repository_path)
+
+
+def test_native_submodule_commit_records_parent_pointer(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A real submodule commit creates the matching parent pointer commit."""
+    unrelated_repository = tmp_path / "unrelated-repository"
+    initialize_fixture_repository(unrelated_repository)
+    monkeypatch.setenv("GIT_DIR", str(unrelated_repository / ".git"))
+
+    source_repository = tmp_path / "source-repository"
+    parent_repository = tmp_path / "parent-repository"
+    initialize_fixture_repository(source_repository)
+    (source_repository / "README.md").write_text("fixture source\n", encoding="utf-8")
+    run_fixture_git(source_repository, "add", "README.md")
+    run_fixture_git(source_repository, "commit", "-m", "Create fixture source")
+
+    initialize_fixture_repository(parent_repository)
+    (parent_repository / "README.md").write_text("fixture parent\n", encoding="utf-8")
+    run_fixture_git(parent_repository, "add", "README.md")
+    run_fixture_git(parent_repository, "commit", "-m", "Create fixture parent")
+    run_fixture_git(
+        parent_repository,
+        "-c",
+        "protocol.file.allow=always",
+        "submodule",
+        "add",
+        str(source_repository),
+        "nested/sub[module]",
+    )
+    run_fixture_git(parent_repository, "commit", "-am", "Add fixture submodule")
+
+    submodule_repository = parent_repository / "nested" / "sub[module]"
+    configure_fixture_identity(submodule_repository)
+    (parent_repository / "staged-note.txt").write_text("keep staged\n", encoding="utf-8")
+    run_fixture_git(parent_repository, "add", "staged-note.txt")
+    (submodule_repository / "change.txt").write_text("fixture change\n", encoding="utf-8")
+    run_fixture_git(submodule_repository, "add", "change.txt")
+    run_fixture_git(submodule_repository, "commit", "-m", "Record fixture change")
+    clear_inherited_git_environment(monkeypatch)
+    monkeypatch.chdir(submodule_repository)
+    assert post_commit.main() == 0
+
+    submodule_commit_hash = run_fixture_git(submodule_repository, "rev-parse", "HEAD")
+    parent_commit_subject = run_fixture_git(parent_repository, "log", "-1", "--pretty=%s")
+    parent_commit_body = run_fixture_git(parent_repository, "log", "-1", "--pretty=%B")
+    recorded_pointer_hash = run_fixture_git(
+        parent_repository,
+        "rev-parse",
+        "HEAD:nested/sub[module]",
+    )
+
+    assert recorded_pointer_hash == submodule_commit_hash
+    assert parent_commit_subject == (
+        f"chore: update sub[module] submodule to {submodule_commit_hash}"
+    )
+    assert "Submodule commit: Record fixture change" in parent_commit_body
+    assert run_fixture_git(parent_repository, "status", "--short") == "A  staged-note.txt"
+
+
+def test_parent_update_returns_git_diagnostic_for_failed_add(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A failed parent add returns the Git diagnostic and literal pathspec."""
+    parent_repository = tmp_path / "parent-repository"
+    submodule_repository = parent_repository / "sub[module]"
+    submodule_repository.mkdir(parents=True)
+    recorded_commands: list[tuple[str, ...]] = []
+
+    def fail_git_add(*arguments: str, cwd: Path) -> subprocess.CompletedProcess[str]:
+        recorded_commands.append(arguments)
+        return subprocess.CompletedProcess(
+            ["git", *arguments],
+            1,
+            "",
+            "fatal: fixture add failure",
+        )
+
+    monkeypatch.setattr(post_commit, "execute_git", fail_git_add)
+
+    parent_update = post_commit.update_parent_pointer(
+        parent_repository,
+        submodule_repository,
+        "a" * 40,
+        "Fixture commit",
+    )
+
+    assert parent_update == (
+        post_commit.ParentPointerStatus.FAILED,
+        "fatal: fixture add failure",
+    )
+    assert recorded_commands == [("add", "--", ":(literal)sub[module]")]
+
+
+def test_main_prints_git_failure_diagnostic(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """The hook prints the Git diagnostic when the parent update fails."""
+    submodule_repository = tmp_path / "submodule"
+    parent_repository = tmp_path / "parent"
+    submodule_repository.mkdir()
+    parent_repository.mkdir()
+    monkeypatch.setattr(
+        post_commit,
+        "run_git_from_current_directory",
+        lambda *arguments: str(submodule_repository),
+    )
+    monkeypatch.setattr(post_commit, "find_parent_repo", lambda repo: parent_repository)
+    monkeypatch.setattr(post_commit, "run_git", lambda *arguments, cwd: "a" * 40)
+    monkeypatch.setattr(
+        post_commit,
+        "update_parent_pointer",
+        lambda *arguments: (
+            post_commit.ParentPointerStatus.FAILED,
+            "fatal: fixture commit failure",
+        ),
+    )
+
+    assert post_commit.main() == 0
+    assert "Git diagnostic: fatal: fixture commit failure" in capsys.readouterr().out

package/hooks/git-hooks/test_pre_commit.py

@@ -60,7 +60,7 @@ def test_main_propagates_passing_exit_code_from_gate(
     assert exit_code == 0
 
 
-def test_main_invokes_gate_with_staged_flag(
+def test_main_invokes_gate_with_immediate_flag(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
@@ -84,7 +84,7 @@ def test_main_invokes_gate_with_staged_flag(
     recorded_arguments = recorded_arguments_path.read_text(
         encoding="utf-8"
     ).splitlines()
-    assert recorded_arguments == ["--staged"]
+    assert recorded_arguments == ["--immediate"]
 
 
 def test_main_exits_two_when_invoke_gate_raises_oserror(

package/hooks/git-hooks/test_pre_push.py

@@ -1567,6 +1567,63 @@ def test_main_reads_default_branch_tracking_reference_when_origin_head_is_unset(
     assert exit_code == 0
 
 
+def test_main_selects_stdin_bases_for_new_and_existing_branch_pushes(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    repository, default_branch_tip, topic_branch_tip = _build_default_branch_repository(
+        tmp_path
+    )
+    recorded_arguments_path = tmp_path / "recorded_arguments.txt"
+    recording_gate_script_path = tmp_path / "recording_gate.py"
+    recording_gate_script_path.write_text(
+        "import pathlib, sys\n"
+        f'pathlib.Path(r"{recorded_arguments_path}").write_text('
+        "'\\n'.join(sys.argv[1:]), encoding='utf-8')\n"
+        "sys.exit(0)\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setenv("CODE_RULES_GATE_PATH", str(recording_gate_script_path))
+    monkeypatch.chdir(repository)
+    monkeypatch.setattr(
+        sys,
+        "stdin",
+        io.StringIO(
+            _push_stdin_line(
+                FEATURE_BRANCH_NAME,
+                topic_branch_tip,
+                FEATURE_BRANCH_NAME,
+                ALL_ZEROS_OBJECT_NAME,
+            )
+        ),
+    )
+
+    assert pre_push.main() == 0
+    assert recorded_arguments_path.read_text(encoding="utf-8").splitlines() == [
+        "--base",
+        git_hooks_constants.DEFAULT_REMOTE_BASE_REFERENCE,
+    ]
+
+    monkeypatch.setattr(
+        sys,
+        "stdin",
+        io.StringIO(
+            _push_stdin_line(
+                FEATURE_BRANCH_NAME,
+                topic_branch_tip,
+                FEATURE_BRANCH_NAME,
+                NON_ZERO_REMOTE_SHA_ONE,
+            )
+        ),
+    )
+
+    assert pre_push.main() == 0
+    assert recorded_arguments_path.read_text(encoding="utf-8").splitlines() == [
+        "--base",
+        default_branch_tip,
+    ]
+
+
 def test_main_skips_a_deletion_line_to_reach_the_branch_update(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,

package/hooks/hooks_constants/AGENTS.md

@@ -11,6 +11,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `ask_user_question_shape.py` | Pure AskUserQuestion lean-block shape analyzer: grades question and option-description prose against shared chat-detail markers and sentence/word caps with no hook I/O |
 | `banned_identifiers_constants.py` | The set of banned short identifiers and banned function-name prefixes |
 | `bash_pre_tool_use_dispatcher_constants.py` | Permission outcomes, tool-name sets, and the ordered hosted-hook roster for the Bash PreToolUse dispatcher (also covers PowerShell-shared gates) |
+| `pre_tool_use_dispatcher_constants.py` | Shared Write, Edit, and MultiEdit tool-name set and the ordered hosted-hook roster for the Write/Edit/MultiEdit PreToolUse dispatcher |
 | `blocking_check_limits.py` | Max issue counts and preview lengths for blocking hooks |
 | `bot_mention_comment_blocker_constants.py` | Patterns for detecting bot @-mentions in PR comments |
 | `claude_md_orphan_file_blocker_constants.py` | Table patterns, file extensions, scan budget, and block-message text for the CLAUDE.md orphan-file blocker |
@@ -24,6 +25,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `dead_config_field_constants.py` | Patterns for detecting unused `*Config` / `*Selectors` dataclass fields |
 | `dead_dataclass_field_constants.py` | Patterns for detecting unused dataclass fields |
 | `dead_module_constant_constants.py` | Patterns for detecting unexported `UPPER_SNAKE` constants in `*_constants.py` modules |
+| `destructive_command_environment_constants.py` | Environment keys and shared truthy values used by destructive-command hooks |
 | `destructive_command_segment_constants.py` | The list of destructive shell command patterns the blocker matches |
 | `docstring_rule_gate_count_blocker_constants.py` | Target rule basename, spelled-out-number lookup, count-clause and `check_*` validator patterns, and block-message text for the docstring-rule gate-count staleness blocker |
 | `duplicate_function_body_constants.py` | Hashing and comparison config for the duplicate-body check |
@@ -62,7 +64,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `python_style_checks_constants.py` | Command-line argument count and blank-line count between top-level functions for the style validator |
 | `ruff_integration_constants.py` | ``NO_COLOR`` / ``FORCE_COLOR`` environment variable names for plain ruff diagnostics |
 | `send_user_file_open_locally_blocker_constants.py` | Tool name, proactive status, and the block message for the open-locally attach blocker |
-| `sensitive_file_protector_constants.py` | Sensitive filename patterns, the committed-template suffixes that earn an exemption, the write/edit tool names, and the deny decision and message template for `sensitive_file_protector` |
+| `sensitive_file_protector_constants.py` | Sensitive filename patterns, committed-template suffixes that earn an exemption, and the deny decision and message template for `sensitive_file_protector` |
 | `session_edit_stage_gate_constants.py` | Tracker filename prefix/suffix, JSON payload key, edit tool name set, session-id sanitize pattern, lock filename suffix and lock-acquire timing, git diff command, commit flag escapes, and deny-message template shared by the session edit stage gate trio |
 | `session_env_cleanup_constants.py` | Stale-age threshold and directory names for the session-env cleanup hook |
 | `session_start_injector.py` | Pure SessionStart context injector: normalize `source` (`startup`/`resume`/`clear`/`compact`), honor enable/timeout, return structured injection results for starter hooks |

package/hooks/hooks_constants/atomic_file_writer_constants.py

@@ -0,0 +1,4 @@
+"""Constants for atomic hook-state text replacement."""
+
+TEXT_WRITE_MODE = "w"
+ATOMIC_WRITE_TEMPORARY_SUFFIX = ".tmp"

package/hooks/hooks_constants/banned_identifiers_constants.py

@@ -38,6 +38,7 @@ ALL_BANNED_NOUN_WORDS: frozenset[str] = frozenset(
         "temp",
     }
 )
+BANNED_NOUN_COMPATIBILITY_COMMENT: str = "# pragma: no-banned-noun"
 CAMEL_CASE_WORD_PATTERN: re.Pattern[str] = re.compile(
     r"[A-Z]+(?=[A-Z][a-z])|[A-Z]?[a-z]+|[A-Z]+"
 )

package/hooks/hooks_constants/blast_radius_constants.py

@@ -0,0 +1,14 @@
+"""Constants for the blast-radius declaration check."""
+
+BLAST_RADIUS_RUN_SUFFIX = "RunFatal"
+BLAST_RADIUS_ITEM_SUFFIX = "ItemBlocked"
+ALL_BLAST_RADIUS_SUFFIXES = (BLAST_RADIUS_RUN_SUFFIX, BLAST_RADIUS_ITEM_SUFFIX)
+
+MAX_BLAST_RADIUS_ISSUES = 20
+
+BLAST_RADIUS_MESSAGE_SUFFIX = (
+    "raises inside per-item work; name its blast radius by ending the type in "
+    f"{BLAST_RADIUS_RUN_SUFFIX} when the whole run stops, or {BLAST_RADIUS_ITEM_SUFFIX} "
+    "when this one item stops and the batch carries on. See "
+    "rules/failure-blast-radius.md."
+)

package/hooks/hooks_constants/destructive_command_environment_constants.py

@@ -0,0 +1,18 @@
+"""Environment keys and values used by destructive-command hooks."""
+
+from __future__ import annotations
+
+ALL_KNOWN_TEMPORARY_ENVIRONMENT_VARIABLE_NAMES: frozenset[str] = frozenset(
+    {
+        "TEMP",
+        "TMP",
+        "TMPDIR",
+        "CLAUDE_JOB_DIR",
+    }
+)
+ALL_TRUTHY_ENV_VALUES: frozenset[str] = frozenset({"1", "true", "yes", "on"})
+DESTRUCTIVE_DENY_MODE_ENV_VAR: str = "CLAUDE_DESTRUCTIVE_DENY_MODE"
+EPHEMERAL_AUTO_ALLOW_DISABLE_ENV_VAR: str = (
+    "CLAUDE_DESTRUCTIVE_DISABLE_EPHEMERAL_AUTO_ALLOW"
+)
+GH_REDIRECT_ACTIVE_ENV_VAR: str = "CLAUDE_GH_REDIRECT_ACTIVE"

package/hooks/hooks_constants/destructive_command_segment_constants.py

@@ -1,4 +1,4 @@
-"""Segment-splitting, command-name, and deny-mode constants for the destructive command blocker."""
+"""Segment-splitting and command-name constants for the destructive command blocker."""
 
 ALL_SHELL_CONTROL_OPERATOR_TOKENS: frozenset[str] = frozenset({"&&", "||", ";", "|&", "|", "&", "\n", "\r"})
 ALL_COMMAND_LAUNCHER_WRAPPER_COMMANDS: frozenset[str] = frozenset(
@@ -183,13 +183,3 @@ ALL_LAUNCHER_OPTIONS_TAKING_SEPARATE_VALUE: frozenset[str] = frozenset(
     }
 )
 ALL_SUBSHELL_GROUPING_CHARACTERS: str = "({"
-ALL_KNOWN_TEMPORARY_ENVIRONMENT_VARIABLE_NAMES: frozenset[str] = frozenset(
-    {
-        "TEMP",
-        "TMP",
-        "TMPDIR",
-        "CLAUDE_JOB_DIR",
-    }
-)
-DESTRUCTIVE_DENY_MODE_ENV_VAR: str = "CLAUDE_DESTRUCTIVE_DENY_MODE"
-ALL_TRUTHY_ENV_VALUES: frozenset[str] = frozenset({"1", "true", "yes", "on"})