claude-dev-env 2.18.0 → 2.20.0

package/hooks/blocking/code_rules_banned_identifiers.py

@@ -1,7 +1,9 @@
 """Banned identifier, banned noun-word, and banned function-prefix naming checks."""
 
 import ast
+import io
 import sys
+import tokenize
 from pathlib import Path
 
 _blocking_directory = str(Path(__file__).resolve().parent)
@@ -30,6 +32,7 @@ from hooks_constants.banned_identifiers_constants import (  # noqa: E402
     ALL_BANNED_NOUN_WORDS,
     BANNED_IDENTIFIER_MESSAGE_SUFFIX,
     BANNED_IDENTIFIER_SKIP_ADVISORY,
+    BANNED_NOUN_COMPATIBILITY_COMMENT,
     BANNED_NOUN_WORD_MESSAGE_SUFFIX,
     CAMEL_CASE_WORD_PATTERN,
     MAX_BANNED_IDENTIFIER_ISSUES,
@@ -235,8 +238,31 @@ def _is_dunder_name(identifier: str) -> bool:
     return identifier.startswith("__") and identifier.endswith("__")
 
 
+def _collect_annotated_public_definition_lines(
+    content: str, parsed_tree: ast.AST
+) -> frozenset[int]:
+    all_annotation_lines: set[int] = set()
+    try:
+        for each_token in tokenize.generate_tokens(io.StringIO(content).readline):
+            if each_token.type != tokenize.COMMENT:
+                continue
+            if each_token.string.strip() == BANNED_NOUN_COMPATIBILITY_COMMENT:
+                all_annotation_lines.add(each_token.start[0])
+    except (IndentationError, SyntaxError, tokenize.TokenError):
+        return frozenset()
+
+    return frozenset(
+        each_node.lineno
+        for each_node in ast.walk(parsed_tree)
+        if isinstance(each_node, (ast.FunctionDef, ast.AsyncFunctionDef))
+        and not each_node.name.startswith("_")
+        and each_node.lineno in all_annotation_lines
+    )
+
+
 def _collect_banned_noun_word_bindings(
     parsed_tree: ast.AST,
+    all_annotated_public_definition_lines: frozenset[int],
 ) -> list[tuple[str, int, int, str]]:
     """Yield ``(identifier, lineno, col_offset, banned_word)`` for each binding.
 
@@ -248,7 +274,14 @@ def _collect_banned_noun_word_bindings(
     flagged_bindings: list[tuple[str, int, int, str]] = []
     seen_keys: set[tuple[str, int, int]] = set()
 
-    def record(name: str, lineno: int, col_offset: int) -> None:
+    def record(
+        name: str,
+        lineno: int,
+        col_offset: int,
+        is_annotated_public_definition: bool = False,
+    ) -> None:
+        if is_annotated_public_definition:
+            return
         if name in ALL_BANNED_IDENTIFIERS:
             return
         if _is_dunder_name(name):
@@ -282,11 +315,24 @@ def _collect_banned_noun_word_bindings(
             for each_name_node in _collect_target_names(each_node.optional_vars):
                 record(each_name_node.id, each_name_node.lineno, each_name_node.col_offset)
         elif isinstance(each_node, (ast.FunctionDef, ast.AsyncFunctionDef)):
-            record(each_node.name, each_node.lineno, each_node.col_offset)
+            is_annotated_public_definition = (
+                each_node.lineno in all_annotated_public_definition_lines
+            )
+            record(
+                each_node.name,
+                each_node.lineno,
+                each_node.col_offset,
+                is_annotated_public_definition,
+            )
             for each_arg in _collect_annotated_arguments(each_node):
                 if each_arg.arg in ALL_SELF_AND_CLS_PARAMETER_NAMES:
                     continue
-                record(each_arg.arg, each_arg.lineno, each_arg.col_offset)
+                record(
+                    each_arg.arg,
+                    each_arg.lineno,
+                    each_arg.col_offset,
+                    is_annotated_public_definition,
+                )
         elif isinstance(each_node, ast.ClassDef):
             record(each_node.name, each_node.lineno, each_node.col_offset)
         elif isinstance(each_node, (ast.Import, ast.ImportFrom)):
@@ -368,9 +414,14 @@ def check_banned_noun_word_boundary(
     except SyntaxError:
         return []
 
+    all_annotated_public_definition_lines = _collect_annotated_public_definition_lines(
+        content, parsed_tree
+    )
     single_line_span = 1
     all_violations_in_walk_order: list[tuple[range, str]] = []
-    for each_name, each_lineno, _, each_word in _collect_banned_noun_word_bindings(parsed_tree):
+    for each_name, each_lineno, _, each_word in _collect_banned_noun_word_bindings(
+        parsed_tree, all_annotated_public_definition_lines
+    ):
         span_range = range(each_lineno, each_lineno + single_line_span)
         span_fragment = BANNED_NOUN_SPAN_FRAGMENT_TEMPLATE.format(
             definition_line=each_lineno, line_span=single_line_span

package/hooks/blocking/code_rules_blast_radius.py

@@ -0,0 +1,194 @@
+"""Blast-radius check: a raise inside per-item work must name what it stops."""
+
+import ast
+import sys
+from collections.abc import Iterator
+from pathlib import Path
+
+_blocking_directory = str(Path(__file__).resolve().parent)
+_hooks_directory = str(Path(__file__).resolve().parent.parent)
+if _blocking_directory not in sys.path:
+    sys.path.insert(0, _blocking_directory)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+from code_rules_shared import (  # noqa: E402
+    is_hook_infrastructure,
+    is_test_file,
+)
+
+from hooks_constants.blast_radius_constants import (  # noqa: E402
+    ALL_BLAST_RADIUS_SUFFIXES,
+    BLAST_RADIUS_MESSAGE_SUFFIX,
+    MAX_BLAST_RADIUS_ISSUES,
+)
+
+
+def _raised_type_name(raise_node: ast.Raise) -> str | None:
+    """Return the name of the exception type a raise statement constructs.
+
+    Args:
+        raise_node: The raise statement to read.
+
+    Returns:
+        The exception type name. A ``None`` return classifies bare re-raises and
+        alternate AST forms.
+    """
+    raised = raise_node.exc
+    if raised is None:
+        return None
+    if isinstance(raised, ast.Call):
+        raised = raised.func
+    if isinstance(raised, ast.Name):
+        return raised.id
+    if isinstance(raised, ast.Attribute):
+        return raised.attr
+    return None
+
+
+def _declares_blast_radius(type_name: str) -> bool:
+    """Report whether an exception type name states what its failure stops.
+
+    Args:
+        type_name: The exception type name to inspect.
+
+    Returns:
+        ``True`` when the name ends in a recognized blast-radius suffix.
+    """
+    return any(type_name.endswith(each_suffix) for each_suffix in ALL_BLAST_RADIUS_SUFFIXES)
+
+
+def _handler_type_names(handler: ast.ExceptHandler) -> list[str]:
+    """Return named exception types caught by one except clause."""
+    caught = handler.type
+    if caught is None:
+        return []
+    all_caught = caught.elts if isinstance(caught, ast.Tuple) else [caught]
+    return [
+        each_caught.id
+        for each_caught in all_caught
+        if isinstance(each_caught, ast.Name)
+    ] + [
+        each_caught.attr
+        for each_caught in all_caught
+        if isinstance(each_caught, ast.Attribute)
+    ]
+
+
+def _handler_names_blast_radius_type(handler: ast.ExceptHandler) -> bool:
+    """Report whether an except clause catches a blast-radius-declaring type.
+
+    Args:
+        handler: The except clause to inspect.
+
+    Returns:
+        ``True`` when any caught type name carries a blast-radius suffix.
+    """
+    return any(_declares_blast_radius(each_name) for each_name in _handler_type_names(handler))
+
+
+def _handler_matches_raise(handler: ast.ExceptHandler, type_name: str | None) -> bool:
+    """Report whether a handler corresponds to the raise it encloses."""
+    all_handler_names = _handler_type_names(handler)
+    if type_name is None:
+        return _handler_names_blast_radius_type(handler)
+    return type_name in all_handler_names
+
+
+def _walk_loop_body(node: ast.AST) -> Iterator[ast.AST]:
+    """Walk loop statements without entering nested definition scopes."""
+    for each_child in ast.iter_child_nodes(node):
+        if isinstance(
+            each_child,
+            (ast.AsyncFunctionDef, ast.ClassDef, ast.FunctionDef, ast.Lambda),
+        ):
+            continue
+        yield each_child
+        yield from _walk_loop_body(each_child)
+
+
+def _boundary_guarded_raise_lines(tree: ast.Module) -> set[int]:
+    """Collect raise lines already sitting inside a blast-radius boundary.
+
+    Args:
+        tree: The parsed module to walk.
+
+    Returns:
+        The line numbers of raise statements enclosed by a try whose handlers
+        name a blast-radius-declaring type.
+    """
+    all_guarded: set[int] = set()
+    for each_node in ast.walk(tree):
+        if not isinstance(each_node, ast.Try):
+            continue
+        for each_body_node in each_node.body:
+            for each_inner in ast.walk(each_body_node):
+                if isinstance(each_inner, ast.Raise) and any(
+                    _handler_matches_raise(each_handler, _raised_type_name(each_inner))
+                    for each_handler in each_node.handlers
+                ):
+                    all_guarded.add(each_inner.lineno)
+    return all_guarded
+
+
+def _per_item_raise_nodes(tree: ast.Module) -> list[ast.Raise]:
+    """Collect raise statements that sit inside a loop body.
+
+    A raise reached through per-item iteration ends every remaining item by
+    default. A declared radius identifies the intended scope, so each raise
+    in this path benefits from an explicit name.
+
+    Args:
+        tree: The parsed module to walk.
+
+    Returns:
+        Every raise statement found under a for or while loop body.
+    """
+    all_raises: list[ast.Raise] = []
+    for each_node in ast.walk(tree):
+        if not isinstance(each_node, (ast.For, ast.AsyncFor, ast.While)):
+            continue
+        for each_inner in _walk_loop_body(each_node):
+            if isinstance(each_inner, ast.Raise):
+                all_raises.append(each_inner)
+    return all_raises
+
+
+def check_blast_radius_declared(content: str, file_path: str) -> list[str]:
+    """Check that raises inside per-item work name their stopping scope.
+
+    A raise reached through a loop body ends the whole batch by default, so a
+    one-item defect discards every item that already succeeded. Naming the type
+    ``*RunFatal`` or ``*ItemBlocked`` states the intent, and a boundary catching
+    a declared type already handles it.
+
+    Args:
+        content: The file body to inspect.
+        file_path: The path the body will be written to.
+
+    Returns:
+        One advisory line per raise that needs a declared blast radius, capped
+        at the configured maximum.
+    """
+    if is_test_file(file_path) or is_hook_infrastructure(file_path):
+        return []
+
+    try:
+        parsed_tree = ast.parse(content)
+    except SyntaxError:
+        return []
+
+    all_guarded_lines = _boundary_guarded_raise_lines(parsed_tree)
+    all_issues: list[str] = []
+    all_reported_lines: set[int] = set()
+    for each_raise in _per_item_raise_nodes(parsed_tree):
+        if each_raise.lineno in all_guarded_lines or each_raise.lineno in all_reported_lines:
+            continue
+        type_name = _raised_type_name(each_raise)
+        if type_name is None or _declares_blast_radius(type_name):
+            continue
+        all_reported_lines.add(each_raise.lineno)
+        all_issues.append(f"Line {each_raise.lineno}: {type_name} {BLAST_RADIUS_MESSAGE_SUFFIX}")
+        if len(all_issues) >= MAX_BLAST_RADIUS_ISSUES:
+            break
+    return all_issues

package/hooks/blocking/code_rules_enforcer.py

@@ -41,6 +41,9 @@ from code_rules_banned_identifiers import (  # noqa: E402
     check_banned_noun_word_boundary,
     check_banned_prefixes,
 )
+from code_rules_blast_radius import (  # noqa: E402
+    check_blast_radius_declared,
+)
 from code_rules_boolean_mustcheck import (  # noqa: E402
     check_boolean_naming,
     check_ignored_must_check_return,
@@ -295,6 +298,15 @@ def validate_content(
                 defer_scope_to_caller,
             )
         )
+        all_issues.extend(
+            _fragment_or_deferred_check(
+                check_blast_radius_declared,
+                old_content,
+                content,
+                file_path,
+                defer_scope_to_caller,
+            )
+        )
         all_issues.extend(check_fstring_structural_literals(content, file_path))
         all_issues.extend(check_constants_outside_config(content, file_path))
         all_issues.extend(check_config_duplicate_path_anchor(content, file_path))

package/hooks/blocking/code_rules_enforcer_test_support.py

@@ -0,0 +1,92 @@
+"""Shared entrypoint helpers for code-rules enforcer behavior tests."""
+
+from __future__ import annotations
+
+import io
+import json
+import os
+import subprocess
+import sys
+from collections.abc import Callable
+from pathlib import Path
+
+
+_ENFORCER_SCRIPT_PATH = Path(__file__).with_name("code_rules_enforcer.py")
+
+
+def build_write_payload(file_path: str, content: str) -> str:
+    """Build the JSON payload sent by a Write tool call."""
+    return json.dumps(
+        {
+            "tool_name": "Write",
+            "tool_input": {"file_path": file_path, "content": content},
+        }
+    )
+
+
+def run_serialized_payload_entrypoint(
+    entrypoint: Callable[[list[str]], None],
+    serialized_payload: str,
+) -> tuple[str, int | None]:
+    """Run a callable hook entrypoint with a serialized stdin payload."""
+    input_stream = io.StringIO(serialized_payload)
+    captured_stream = io.StringIO()
+    original_stdin = sys.stdin
+    original_stdout = sys.stdout
+    exit_code: int | None = None
+    try:
+        sys.stdin = input_stream
+        sys.stdout = captured_stream
+        entrypoint([])
+    except SystemExit as each_exit:
+        raw_code = each_exit.code
+        exit_code = raw_code if isinstance(raw_code, int) else None
+    finally:
+        sys.stdin = original_stdin
+        sys.stdout = original_stdout
+    return captured_stream.getvalue(), exit_code
+
+
+def run_write_entrypoint(
+    entrypoint: Callable[[list[str]], None],
+    file_path: str,
+    content: str,
+) -> tuple[str, int]:
+    """Drive a real hook entrypoint with a Write payload and capture stdout."""
+    captured_stdout, exit_code = run_serialized_payload_entrypoint(
+        entrypoint, build_write_payload(file_path, content)
+    )
+    return captured_stdout, int(exit_code or 0)
+
+
+def run_enforcer_cli(
+    script_path: Path,
+    all_arguments: list[str],
+    extra_environment_by_name: dict[str, str] | None,
+) -> subprocess.CompletedProcess[str]:
+    """Run an enforcer script through its real command-line entrypoint."""
+    subprocess_environment: dict[str, str] | None = None
+    if extra_environment_by_name is not None:
+        subprocess_environment = os.environ.copy()
+        subprocess_environment.update(extra_environment_by_name)
+    return subprocess.run(
+        [sys.executable, str(script_path), *all_arguments],
+        stdin=subprocess.DEVNULL,
+        capture_output=True,
+        text=True,
+        check=False,
+        env=subprocess_environment,
+    )
+
+
+def run_precheck(
+    candidate_path: Path,
+    target_path: str,
+    extra_environment_by_name: dict[str, str] | None,
+) -> subprocess.CompletedProcess[str]:
+    """Run an enforcer script through its real precheck command."""
+    return run_enforcer_cli(
+        _ENFORCER_SCRIPT_PATH,
+        ["--check", str(candidate_path), "--as", target_path],
+        extra_environment_by_name,
+    )

package/hooks/blocking/destructive_command_blocker.py

@@ -20,12 +20,16 @@ from hooks_constants.convergence_branch_constants import (  # noqa: E402
     CONVERGENCE_FORCE_PUSH_DETECTION_PATTERN,
 )
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.destructive_command_segment_constants import (  # noqa: E402
-    ALL_BENIGN_COMPOUND_SEGMENT_COMMANDS,
-    ALL_COMMAND_LAUNCHER_WRAPPER_COMMANDS,
+from hooks_constants.destructive_command_environment_constants import (  # noqa: E402
     ALL_KNOWN_TEMPORARY_ENVIRONMENT_VARIABLE_NAMES,
     ALL_TRUTHY_ENV_VALUES,
     DESTRUCTIVE_DENY_MODE_ENV_VAR,
+    EPHEMERAL_AUTO_ALLOW_DISABLE_ENV_VAR,
+    GH_REDIRECT_ACTIVE_ENV_VAR,
+)
+from hooks_constants.destructive_command_segment_constants import (  # noqa: E402
+    ALL_BENIGN_COMPOUND_SEGMENT_COMMANDS,
+    ALL_COMMAND_LAUNCHER_WRAPPER_COMMANDS,
     ALL_FILE_WRITING_OUTPUT_FLAGS_BY_BENIGN_PROGRAM,
     ALL_FIND_EXEC_ACTION_FLAGS,
     ALL_FIND_EXEC_ACTION_TERMINATORS,
@@ -57,7 +61,6 @@ from hooks_constants.destructive_command_segment_constants import (  # noqa: E40
 )
 
 CLAUDE_DIRECTORY_PATH = os.path.normpath(os.path.expanduser("~/.claude"))
-GH_REDIRECT_ACTIVE_ENV_VAR = "CLAUDE_GH_REDIRECT_ACTIVE"
 
 
 def gh_redirect_is_active() -> bool:
@@ -87,9 +90,7 @@ def directory_is_ephemeral(directory_path: str) -> bool:
     Returns:
         True when the directory belongs to the ephemeral auto-allow namespace.
     """
-    ephemeral_auto_allow_disabled_env_var = "CLAUDE_DESTRUCTIVE_DISABLE_EPHEMERAL_AUTO_ALLOW"
-    truthy_string_values = frozenset({"1", "true", "yes", "on"})
-    if os.environ.get(ephemeral_auto_allow_disabled_env_var, "").strip().lower() in truthy_string_values:
+    if os.environ.get(EPHEMERAL_AUTO_ALLOW_DISABLE_ENV_VAR, "").strip().lower() in ALL_TRUTHY_ENV_VALUES:
         return False
     forward_slash_normalized_directory_path = os.path.normpath(directory_path).replace("\\", "/").lower()
     all_worktree_path_segments = ("/worktrees/", "/worktree/")

package/hooks/blocking/pre_tool_use_dispatcher.py

@@ -486,16 +486,20 @@ def _emit_allow_decision(decision: DispatcherDecision) -> None:
 
     Matches the shape a standalone hosted hook emits when it auto-approves the
     write, so a write a hosted hook allows explicitly is auto-approved under the
-    dispatcher rather than falling back to the default permission flow. When a
-    hook also carried an advisory systemMessage,
-    that notice rides on the allow payload without denying.
+    dispatcher rather than falling back to the default permission flow. Advisory
+    systemMessage and additionalContext fields ride on the allow payload.
     """
+    allow_hook_specific: dict[str, object] = {
+        "hookEventName": HOOK_EVENT_NAME,
+        "permissionDecision": ALLOW_DECISION,
+    }
     allow_payload: dict[str, object] = {
-        "hookSpecificOutput": {
-            "hookEventName": HOOK_EVENT_NAME,
-            "permissionDecision": ALLOW_DECISION,
-        }
+        "hookSpecificOutput": allow_hook_specific,
     }
+    if decision.all_additional_context:
+        allow_hook_specific["additionalContext"] = CONTEXT_JOIN_SEPARATOR.join(
+            decision.all_additional_context
+        )
     if decision.all_system_messages:
         allow_payload["systemMessage"] = SYSTEM_MESSAGE_JOIN_SEPARATOR.join(
             decision.all_system_messages

package/hooks/blocking/precommit_code_rules_gate.py

@@ -1,40 +1,26 @@
-"""PreToolUse hook that runs the staged CODE_RULES gate before git commit.
+"""PreToolUse hook that passes Git commit validation to Git hooks.
 
 Intercepts Bash `git commit` invocations (including `git -C <path> commit`),
-resolves the repository root, and runs the shared code_rules_gate engine in
-``--staged`` mode over the staged files. A commit that would introduce
-CODE_RULES violations is denied with the gate's file:line report so the
-violations surface before the commit instead of stalling converge loops at
-commit time. Non-commit commands, repositories with no staged Python files,
-and clean staged changes pass through silently. A gate-engine failure denies
-the commit with the failure detail — the gate never fails open.
+emits neutral evidence, and returns control to Git. Configured Git hooks
+receive the commit at the commit boundary.
 """
 
-import json
 import re
 import subprocess
 import sys
 from pathlib import Path
 
-_blocking_dir = str(Path(__file__).resolve().parent)
-if _blocking_dir not in sys.path:
-    sys.path.insert(0, _blocking_dir)
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
+_hooks_directory = str(Path(__file__).resolve().parent.parent)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
 
 from block_main_commit import (  # noqa: E402
-    extract_git_working_directory,
     is_commit_command,
     parse_bash_command_from_stdin,
-    resolve_directory,
 )
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+
 from hooks_constants.precommit_code_rules_gate_constants import (  # noqa: E402
     ALL_GIT_REPOSITORY_ROOT_COMMAND,
-    ALL_STAGED_PYTHON_FILES_COMMAND,
-    GATE_RELATIVE_PATH,
-    GATE_TIMEOUT_SECONDS,
     GIT_COMMAND_TIMEOUT_SECONDS,
     GIT_DASH_C_COMMIT_PATTERN,
 )
@@ -59,20 +45,19 @@ def is_git_commit_invocation(bash_command: str) -> bool:
 
 
 def resolve_repository_root(working_directory: str | None) -> Path | None:
-    """Resolve the git repository root for the commit's working directory.
+    """Resolve the Git repository root for a directory.
 
     Args:
-        working_directory: Directory the commit runs in, or None for the
-            hook's current working directory.
+        working_directory: Directory inside the repository.
 
     Returns:
-        The repository root path, or None when the directory is not inside
-        a git repository or git is unavailable.
+        Repository root. Returns None when Git cannot resolve the directory.
     """
     try:
         completed_process = subprocess.run(
             list(ALL_GIT_REPOSITORY_ROOT_COMMAND),
-            check=False, capture_output=True,
+            check=False,
+            capture_output=True,
             text=True,
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=working_directory,
@@ -87,122 +72,12 @@ def resolve_repository_root(working_directory: str | None) -> Path | None:
     return Path(top_level_text)
 
 
-def list_staged_python_files(repository_root: Path) -> list[str]:
-    """List repository-relative paths of staged Python files.
-
-    Args:
-        repository_root: Repository root used as the git working directory.
-
-    Returns:
-        Repository-relative paths of Python files staged for add, copy,
-        modify, or rename. Empty when the listing command fails — the
-        caller then allows the commit because git itself will surface the
-        repository problem.
-    """
-    try:
-        completed_process = subprocess.run(
-            list(ALL_STAGED_PYTHON_FILES_COMMAND),
-            check=False, capture_output=True,
-            text=True,
-            timeout=GIT_COMMAND_TIMEOUT_SECONDS,
-            cwd=str(repository_root),
-        )
-    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
-        return []
-    if completed_process.returncode != 0:
-        return []
-    return [
-        each_line.strip()
-        for each_line in completed_process.stdout.splitlines()
-        if each_line.strip()
-    ]
-
-
-def run_staged_gate(repository_root: Path) -> tuple[int, str]:
-    """Run the shared code_rules_gate engine in staged mode.
-
-    Args:
-        repository_root: Repository root passed to the gate's --repo-root
-            and used as the gate subprocess working directory, so relative
-            paths the gate's checks resolve land in the committing worktree
-            rather than the hook's own working directory.
-
-    Returns:
-        Tuple of the gate exit code and its stderr report. A missing gate
-        script or a gate timeout returns a non-zero code with an
-        explanatory message so the commit is denied rather than waved
-        through on infrastructure failure.
-    """
-    gate_path = Path(__file__).resolve().parents[2] / GATE_RELATIVE_PATH
-    if not gate_path.is_file():
-        return 1, f"precommit_code_rules_gate: gate engine missing at {gate_path}"
-    try:
-        completed_process = subprocess.run(
-            [
-                sys.executable,
-                str(gate_path),
-                "--repo-root",
-                str(repository_root),
-                "--staged",
-            ],
-            check=False, capture_output=True,
-            text=True,
-            encoding="utf-8",
-            errors="replace",
-            timeout=GATE_TIMEOUT_SECONDS,
-            cwd=str(repository_root),
-        )
-    except subprocess.TimeoutExpired:
-        return 1, (
-            f"precommit_code_rules_gate: gate engine timed out after {GATE_TIMEOUT_SECONDS}s"
-        )
-    return completed_process.returncode, completed_process.stderr
-
-
-def build_denial_response(gate_report: str) -> dict:
-    """Build the PreToolUse deny payload carrying the gate report.
-
-    Args:
-        gate_report: The gate's stderr report listing file:line violations.
-
-    Returns:
-        The hookSpecificOutput deny mapping for the PreToolUse protocol.
-    """
-    denial_reason = (
-        f"BLOCKED: staged files violate CODE_RULES; fix before committing.\n{gate_report.strip()}"
-    )
-    return {
-        "hookSpecificOutput": {
-            "hookEventName": "PreToolUse",
-            "permissionDecision": "deny",
-            "permissionDecisionReason": denial_reason,
-        }
-    }
-
-
 def main() -> None:
-    """Gate git commits on the staged CODE_RULES report."""
+    """Pass Git commit validation through to configured Git hooks."""
     bash_command = parse_bash_command_from_stdin()
     if not is_git_commit_invocation(bash_command):
         sys.exit(0)
-    working_directory = resolve_directory(extract_git_working_directory(bash_command))
-    repository_root = resolve_repository_root(working_directory)
-    if repository_root is None:
-        sys.exit(0)
-    if not list_staged_python_files(repository_root):
-        sys.exit(0)
-    gate_exit_code, gate_report = run_staged_gate(repository_root)
-    if gate_exit_code == 0:
-        sys.exit(0)
-    denial = build_denial_response(gate_report)
-    log_hook_block(
-        calling_hook_name="precommit_code_rules_gate.py",
-        hook_event="PreToolUse",
-        block_reason=denial["hookSpecificOutput"]["permissionDecisionReason"],
-        tool_name="Bash",
-        offending_input_preview=bash_command,
-    )
-    print(json.dumps(denial))
+    sys.stderr.write("Git commit proceeds to configured Git hooks.\n")
     sys.exit(0)