claude-dev-env 2.19.0 → 2.20.0

package/hooks/blocking/test_destructive_command_blocker_deny_mode.py

@@ -18,6 +18,7 @@ if str(_BLOCKING_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(_BLOCKING_DIRECTORY))
 
 SCRIPT_PATH = _BLOCKING_DIRECTORY / "destructive_command_blocker.py"
+DISPATCHER_PATH = _BLOCKING_DIRECTORY / "bash_pre_tool_use_dispatcher.py"
 
 import _path_setup  # noqa: E402, F401
 
@@ -28,12 +29,13 @@ from test_hook_subprocess_support import (  # noqa: E402
 
 
 def _run_hook_with_environment(
+    hook_script_path: Path,
     command: str,
     environment_update_by_name: dict[str, str],
     temporary_home_directory: Path,
 ) -> subprocess.CompletedProcess[str]:
     return run_hook_as_subprocess(
-        hook_script_path=SCRIPT_PATH,
+        hook_script_path=hook_script_path,
         payload_text=build_bash_payload(command),
         working_directory=temporary_home_directory,
         home_directory=temporary_home_directory,
@@ -42,21 +44,62 @@ def _run_hook_with_environment(
     )
 
 
+def _assert_terminal_response(
+    completed_hook: subprocess.CompletedProcess[str],
+    expected_permission_decision: str,
+    expected_permission_reason: str,
+) -> None:
+    assert completed_hook.returncode == 0
+    assert completed_hook.stderr == ""
+    assert json.loads(completed_hook.stdout) == {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": expected_permission_decision,
+            "permissionDecisionReason": expected_permission_reason,
+        }
+    }
+
+
 def test_rm_rf_denies_when_deny_mode_env_is_set(tmp_path: Path) -> None:
     completed_hook = _run_hook_with_environment(
+        SCRIPT_PATH,
         "rm -rf /var/log/myapp",
         {"CLAUDE_DESTRUCTIVE_DENY_MODE": "1"},
         tmp_path,
     )
-    hook_decision_by_field = json.loads(completed_hook.stdout)
-
-    assert hook_decision_by_field["hookSpecificOutput"]["permissionDecision"] == "deny"
-    assert "rm -rf" in hook_decision_by_field["hookSpecificOutput"]["permissionDecisionReason"]
+    _assert_terminal_response(
+        completed_hook,
+        "deny",
+        "DESTRUCTIVE: rm -rf (destructive recursive forced delete). "
+        "Blocked in deny mode.",
+    )
 
 
 def test_rm_rf_asks_when_deny_mode_env_is_absent(tmp_path: Path) -> None:
-    completed_hook = _run_hook_with_environment("rm -rf /var/log/myapp", {}, tmp_path)
-    hook_decision_by_field = json.loads(completed_hook.stdout)
+    completed_hook = _run_hook_with_environment(
+        SCRIPT_PATH,
+        "rm -rf /var/log/myapp",
+        {},
+        tmp_path,
+    )
+    _assert_terminal_response(
+        completed_hook,
+        "ask",
+        "DESTRUCTIVE: rm -rf (destructive recursive forced delete). "
+        "Requires explicit user approval.",
+    )
+
 
-    assert hook_decision_by_field["hookSpecificOutput"]["permissionDecision"] == "ask"
-    assert "rm -rf" in hook_decision_by_field["hookSpecificOutput"]["permissionDecisionReason"]
+def test_dispatcher_short_circuits_on_destructive_deny(tmp_path: Path) -> None:
+    completed_dispatcher = _run_hook_with_environment(
+        DISPATCHER_PATH,
+        "rm -rf /var/log/myapp",
+        {"CLAUDE_DESTRUCTIVE_DENY_MODE": "1"},
+        tmp_path,
+    )
+    _assert_terminal_response(
+        completed_dispatcher,
+        "deny",
+        "DESTRUCTIVE: rm -rf (destructive recursive forced delete). "
+        "Blocked in deny mode.",
+    )

package/hooks/blocking/test_destructive_command_blocker_patterns.py

@@ -0,0 +1,133 @@
+"""Production-subprocess coverage for destructive command patterns."""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+import pytest
+
+_BLOCKING_DIRECTORY = Path(__file__).resolve().parent
+if str(_BLOCKING_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_BLOCKING_DIRECTORY))
+
+import _path_setup  # noqa: E402, F401
+
+from hooks_constants.destructive_command_environment_constants import (  # noqa: E402
+    DESTRUCTIVE_DENY_MODE_ENV_VAR,
+    EPHEMERAL_AUTO_ALLOW_DISABLE_ENV_VAR,
+)
+from test_hook_subprocess_support import (  # noqa: E402
+    build_bash_payload,
+    run_hook_as_subprocess,
+)
+
+SCRIPT_PATH = _BLOCKING_DIRECTORY / "destructive_command_blocker.py"
+ALL_DESTRUCTIVE_ENVIRONMENT_NAMES = (
+    DESTRUCTIVE_DENY_MODE_ENV_VAR,
+    EPHEMERAL_AUTO_ALLOW_DISABLE_ENV_VAR,
+)
+
+
+def _run_hook(
+    command: str,
+    working_directory: Path,
+    home_directory: Path,
+) -> subprocess.CompletedProcess[str]:
+    return run_hook_as_subprocess(
+        hook_script_path=SCRIPT_PATH,
+        payload_text=build_bash_payload(command),
+        working_directory=working_directory,
+        home_directory=home_directory,
+        all_environment_names_to_remove=ALL_DESTRUCTIVE_ENVIRONMENT_NAMES,
+    )
+
+
+@pytest.mark.parametrize(
+    ("command", "reason_fragment"),
+    [
+        ("rm -rf /var/log/myapp", "rm -rf"),
+        ("rm --recursive --force /var/log/myapp", "rm --recursive --force"),
+        ("rm -r /", "rm -r on broad path"),
+        ("mkfs.ext4 /dev/sda1", "mkfs"),
+        ("dd if=/tmp/disk.img of=/dev/sda", "dd raw disk write"),
+        ("git reset --hard HEAD~1", "git reset --hard"),
+        ("git push --force origin main", "git push --force"),
+        ("git push -f origin main", "git push -f"),
+        ("git clean -fd", "git clean -fd"),
+        ("git clean -f", "git clean -f"),
+        ("psql -c 'DROP TABLE users'", "DROP TABLE"),
+        ("psql -c 'DROP DATABASE app'", "DROP DATABASE"),
+        ("psql -c 'TRUNCATE TABLE users'", "TRUNCATE TABLE"),
+        ("git commit --no-verify", "git --no-verify"),
+        ("git commit --no-gpg-sign", "git --no-gpg-sign"),
+        ("git -c commit.gpgsign=false commit", "commit.gpgsign=false"),
+    ],
+)
+def test_protected_command_asks_for_approval(
+    command: str,
+    reason_fragment: str,
+    tmp_path: Path,
+) -> None:
+    filesystem_root = Path(Path.cwd().anchor)
+    completed_hook = _run_hook(command, filesystem_root, tmp_path)
+
+    hook_decision_payload = json.loads(completed_hook.stdout)
+    assert completed_hook.returncode == 0
+    assert completed_hook.stderr == ""
+    assert hook_decision_payload["hookSpecificOutput"]["hookEventName"] == "PreToolUse"
+    assert hook_decision_payload["hookSpecificOutput"]["permissionDecision"] == "ask"
+    assert reason_fragment in hook_decision_payload["hookSpecificOutput"][
+        "permissionDecisionReason"
+    ]
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "git status --short",
+        "rm -rf /tmp/destructive-command-blocker/build",
+        "rm -rf /project/worktrees/feature/build",
+        "git push --force origin claude/fix-hook-test",
+    ],
+)
+def test_permitted_command_exits_silently(command: str, tmp_path: Path) -> None:
+    completed_hook = _run_hook(command, tmp_path, tmp_path)
+
+    assert completed_hook.returncode == 0
+    assert completed_hook.stdout == ""
+    assert completed_hook.stderr == ""
+
+
+def test_ephemeral_rm_exits_silently_when_parent_disables_auto_allow(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    monkeypatch.setenv(EPHEMERAL_AUTO_ALLOW_DISABLE_ENV_VAR, "1")
+
+    with tempfile.TemporaryDirectory(
+        dir=tmp_path,
+        prefix="destructive command blocker ",
+    ) as ephemeral_directory_path:
+        completed_hook = _run_hook(
+            f'rm -rf "{ephemeral_directory_path}"',
+            tmp_path,
+            tmp_path,
+        )
+
+        assert completed_hook.returncode == 0
+        assert completed_hook.stdout == ""
+        assert completed_hook.stderr == ""
+
+
+def test_git_reset_hard_in_ephemeral_project_exits_silently(
+    tmp_path: Path,
+) -> None:
+    completed_hook = _run_hook("git reset --hard HEAD~1", tmp_path, tmp_path)
+
+    assert completed_hook.returncode == 0
+    assert completed_hook.stdout == ""
+    assert completed_hook.stderr == ""

package/hooks/blocking/test_precommit_code_rules_gate_native_owner.py

@@ -7,6 +7,8 @@ native path runs the staged gate and controls the commit.
 
 from __future__ import annotations
 
+from collections.abc import Iterator
+from contextlib import contextmanager
 import json
 import shutil
 import stat
@@ -66,7 +68,7 @@ def write_gate_script(gate_path: Path, marker_path: Path, exit_code: int) -> Non
     )
 
 
-def install_native_pre_commit(repository_root: Path, hooks_path: Path) -> None:
+def install_native_pre_commit(hooks_path: Path) -> None:
     """Install the native pre-commit module and its self-contained imports."""
     hooks_path.mkdir()
     shutil.copyfile(PRE_COMMIT_SOURCE_PATH, hooks_path / "pre_commit.py")
@@ -87,7 +89,47 @@ def install_native_pre_commit(repository_root: Path, hooks_path: Path) -> None:
         encoding="utf-8",
     )
     pre_commit_path.chmod(pre_commit_path.stat().st_mode | stat.S_IXUSR)
-    run_git(repository_root, "config", "core.hooksPath", str(hooks_path))
+
+
+def configured_hooks_path(repository_root: Path) -> str | None:
+    """Return the repository-local hooks path when one is configured."""
+    completed_config = run_git(
+        repository_root,
+        "config",
+        "--local",
+        "--get",
+        "core.hooksPath",
+        check=False,
+    )
+    if completed_config.returncode != 0:
+        return None
+    return completed_config.stdout.strip()
+
+
+def restore_hooks_path(repository_root: Path, prior_hooks_path: str | None) -> None:
+    """Restore the repository-local hooks path captured before a benchmark."""
+    if prior_hooks_path is None:
+        run_git(
+            repository_root,
+            "config",
+            "--local",
+            "--unset-all",
+            "core.hooksPath",
+            check=False,
+        )
+        return
+    run_git(repository_root, "config", "--local", "core.hooksPath", prior_hooks_path)
+
+
+@contextmanager
+def temporary_hooks_path(repository_root: Path, benchmark_hooks_path: Path) -> Iterator[None]:
+    """Apply a benchmark hooks path and restore the prior local setting."""
+    prior_hooks_path = configured_hooks_path(repository_root)
+    run_git(repository_root, "config", "--local", "core.hooksPath", str(benchmark_hooks_path))
+    try:
+        yield
+    finally:
+        restore_hooks_path(repository_root, prior_hooks_path)
 
 
 def stage_module(repository_root: Path) -> None:
@@ -155,14 +197,38 @@ def test_installed_native_pre_commit_controls_staged_gate_decision(
     """The native Git hook runs the staged gate and returns its commit decision."""
     initialize_repository(tmp_path)
     native_hooks_path = tmp_path / "native_hooks"
-    install_native_pre_commit(tmp_path, native_hooks_path)
+    install_native_pre_commit(native_hooks_path)
     stage_module(tmp_path)
     gate_marker_path = tmp_path / "native_gate_invocation.txt"
     gate_path = tmp_path / "native_gate.py"
     write_gate_script(gate_path, gate_marker_path, gate_exit_code)
     monkeypatch.setenv("CODE_RULES_GATE_PATH", str(gate_path))
 
-    completed_commit = run_native_commit(tmp_path)
+    with temporary_hooks_path(tmp_path, native_hooks_path):
+        completed_commit = run_native_commit(tmp_path)
 
     assert completed_commit.returncode == expected_commit_exit_code
-    assert gate_marker_path.read_text(encoding="utf-8") == "--staged"
+    assert gate_marker_path.read_text(encoding="utf-8") == "--immediate"
+
+
+def test_temporary_hooks_path_restores_shared_worktree_config_on_timeout(
+    tmp_path: Path,
+) -> None:
+    initialize_repository(tmp_path)
+    supported_hooks_path = tmp_path / "supported_hooks"
+    supported_hooks_path.mkdir()
+    run_git(tmp_path, "config", "--local", "core.hooksPath", str(supported_hooks_path))
+    unrelated_worktree = tmp_path.parent / "unrelated_worktree"
+    run_git(tmp_path, "worktree", "add", "--detach", str(unrelated_worktree))
+    benchmark_hooks_path = tmp_path / "benchmark_hooks"
+    benchmark_hooks_path.mkdir()
+
+    try:
+        with pytest.raises(subprocess.TimeoutExpired):
+            with temporary_hooks_path(tmp_path, benchmark_hooks_path):
+                raise subprocess.TimeoutExpired("benchmark", 1)
+
+        assert configured_hooks_path(tmp_path) == str(supported_hooks_path)
+        assert configured_hooks_path(unrelated_worktree) == str(supported_hooks_path)
+    finally:
+        run_git(tmp_path, "worktree", "remove", "--force", str(unrelated_worktree))

package/hooks/git-hooks/AGENTS.md

@@ -6,7 +6,7 @@ Native git hooks that run outside the Claude Code lifecycle — invoked directly
 
 | File | Git hook | What it does |
 |---|---|---|
-| `pre_commit.py` | `pre-commit` | Runs the CODE_RULES gate (`precommit_code_rules_gate.py`) over staged changes; exits 1 when any staged file has a blocking violation |
+| `pre_commit.py` | `pre-commit` | Runs immediate CODE_RULES and terminology validation over staged changes; exits 1 when any staged file has a blocking violation. CI runs package tests for package Python changes. |
 | `pre_push.py` | `pre-push` | Blocks a push that would land a non-`main` local branch onto remote `main` (or `master`), then runs the CODE_RULES gate. An existing branch's gate base is the merge base with the remote default branch; the gate process still diffs that base against checkout HEAD, so the surface matches the pushed tip only when HEAD is that tip. |
 | `pre_push_base_reference.py` | — | Resolves a usable gate base for `pre_push.py`: reads the pushed remote name from git's arguments, then turns a symbolic default-branch head into a reference that git can resolve |
 | `post_commit.py` | `post-commit` | Runs after a commit lands; performs any post-commit bookkeeping |

package/hooks/git-hooks/git_hooks_constants/__init__.py

@@ -10,6 +10,7 @@ import ...`` resolve against this file both inside the repo and under
 from __future__ import annotations
 
 STAGED_SCOPE_ARGUMENT: str = "--staged"
+IMMEDIATE_SCOPE_ARGUMENT: str = "--immediate"
 BASE_REFERENCE_ARGUMENT: str = "--base"
 DEFAULT_REMOTE_BASE_REFERENCE: str = "origin/HEAD"
 ALL_ZEROS_OBJECT_NAME_CHARACTER: str = "0"

package/hooks/git-hooks/post_commit.py

@@ -10,87 +10,196 @@ When you commit in a submodule, this hook:
 This prevents the "lost work" issue where submodule commits aren't tracked by parent.
 """
 
+from __future__ import annotations
+
 import subprocess
 import sys
+from enum import StrEnum
 from pathlib import Path
 
+from git_hooks_constants import GIT_COMMAND_SUCCESS_EXIT_CODE, GIT_EXECUTABLE_NAME
 
-def run_git(*args: str, cwd: Path | None = None) -> str:
-    """Run a git command and return output."""
-    result = subprocess.run(
-        ["git"] + list(args),
-        cwd=cwd,
-        check=False, capture_output=True,
-        text=True,
-    )
-    return result.stdout.strip()
+
+class ParentPointerStatus(StrEnum):
+    """States returned by a parent pointer update."""
+
+    UPDATED = "updated"
+    UNCHANGED = "unchanged"
+    FAILED = "failed"
+
+
+ParentPointerUpdate = tuple[ParentPointerStatus, str]
+
+
+def execute_git(
+    *arguments: str,
+    cwd: Path,
+) -> subprocess.CompletedProcess[str]:
+    """Run a Git command and return its completed process."""
+    try:
+        return subprocess.run(
+            [GIT_EXECUTABLE_NAME, *arguments],
+            cwd=cwd,
+            check=False,
+            capture_output=True,
+            text=True,
+        )
+    except OSError as error:
+        return subprocess.CompletedProcess(
+            [GIT_EXECUTABLE_NAME, *arguments],
+            1,
+            "",
+            str(error),
+        )
+
+
+def run_git(*arguments: str, cwd: Path) -> str:
+    """Run a successful Git command and return its trimmed standard output."""
+    command_result = execute_git(*arguments, cwd=cwd)
+    if command_result.returncode != GIT_COMMAND_SUCCESS_EXIT_CODE:
+        return ""
+    return command_result.stdout.strip()
+
+
+def run_git_from_current_directory(*arguments: str) -> str:
+    """Run a successful Git command from the hook's current directory."""
+    return run_git(*arguments, cwd=Path.cwd())
 
 
 def find_parent_repo(repo_dir: Path) -> Path | None:
-    """Find parent repo that has this as a submodule."""
-    repo_name = repo_dir.name
-    parent_dir = repo_dir.parent
+    """Return the Git superproject that owns the current repository."""
+    parent_path_text = run_git(
+        "rev-parse",
+        "--show-superproject-working-tree",
+        cwd=repo_dir,
+    )
+    if not parent_path_text:
+        return None
+
+    parent_path = Path(parent_path_text).resolve()
+    if not parent_path.is_dir():
+        return None
+    return parent_path
+
+
+def find_submodule_path(parent_repo: Path, repo_dir: Path) -> Path | None:
+    """Return the submodule path relative to its parent repository."""
+    try:
+        return repo_dir.resolve().relative_to(parent_repo.resolve())
+    except ValueError:
+        return None
+
 
-    while parent_dir != parent_dir.parent:
-        git_path = parent_dir / ".git"
-        gitmodules_path = parent_dir / ".gitmodules"
+def build_literal_pathspec(submodule_path: Path) -> str:
+    """Build a Git pathspec that treats every path character literally."""
+    return f":(literal){submodule_path.as_posix()}"
 
-        if git_path.exists() and gitmodules_path.exists():
-            try:
-                content = gitmodules_path.read_text()
-                if f"path = {repo_name}" in content:
-                    return parent_dir
-            except Exception:
-                pass
 
-        parent_dir = parent_dir.parent
+def get_git_failure_diagnostic(
+    command_result: subprocess.CompletedProcess[str],
+) -> str:
+    """Return the most useful diagnostic from a failed Git command."""
+    return command_result.stderr.strip() or command_result.stdout.strip()
 
-    return None
+
+def build_parent_commit_message(
+    repo_name: str,
+    commit_hash: str,
+    commit_message: str,
+) -> str:
+    """Build the parent commit message for a submodule pointer update."""
+    return (
+        f"chore: update {repo_name} submodule to {commit_hash}\n\n"
+        f"Submodule commit: {commit_message}\n\n"
+        "Co-Authored-By: Claude <noreply@anthropic.com>"
+    )
+
+
+def update_parent_pointer(
+    parent_repo: Path,
+    repo_dir: Path,
+    commit_hash: str,
+    commit_message: str,
+) -> ParentPointerUpdate:
+    """Commit the current submodule pointer in its parent repository."""
+    submodule_path = find_submodule_path(parent_repo, repo_dir)
+    if submodule_path is None:
+        return ParentPointerStatus.FAILED, "could not resolve the submodule path"
+
+    submodule_reference = build_literal_pathspec(submodule_path)
+    add_result = execute_git("add", "--", submodule_reference, cwd=parent_repo)
+    if add_result.returncode != GIT_COMMAND_SUCCESS_EXIT_CODE:
+        return ParentPointerStatus.FAILED, get_git_failure_diagnostic(add_result)
+
+    staged_difference = execute_git(
+        "diff",
+        "--cached",
+        "--quiet",
+        "--",
+        submodule_reference,
+        cwd=parent_repo,
+    )
+    if staged_difference.returncode == GIT_COMMAND_SUCCESS_EXIT_CODE:
+        return ParentPointerStatus.UNCHANGED, ""
+    if staged_difference.returncode != 1:
+        return ParentPointerStatus.FAILED, get_git_failure_diagnostic(staged_difference)
+
+    parent_commit_message = build_parent_commit_message(
+        repo_dir.name,
+        commit_hash,
+        commit_message,
+    )
+    commit_result = execute_git(
+        "commit",
+        "--only",
+        "-m",
+        parent_commit_message,
+        "--",
+        submodule_reference,
+        cwd=parent_repo,
+    )
+    if commit_result.returncode != GIT_COMMAND_SUCCESS_EXIT_CODE:
+        return ParentPointerStatus.FAILED, get_git_failure_diagnostic(commit_result)
+    return ParentPointerStatus.UPDATED, ""
 
 
 def main() -> int:
-    """Main hook logic."""
-    try:
-        repo_dir = Path(run_git("rev-parse", "--show-toplevel"))
-    except Exception:
+    """Update a parent repository after a submodule commit."""
+    repo_path_text = run_git_from_current_directory("rev-parse", "--show-toplevel")
+    if not repo_path_text:
         return 0
 
-    repo_name = repo_dir.name
+    repo_dir = Path(repo_path_text).resolve()
     parent_repo = find_parent_repo(repo_dir)
-
-    if not parent_repo:
+    if parent_repo is None:
         return 0
 
     commit_msg = run_git("log", "-1", "--pretty=%s", cwd=repo_dir)
-    commit_hash = run_git("rev-parse", "--short", "HEAD", cwd=repo_dir)
+    commit_hash = run_git("rev-parse", "HEAD", cwd=repo_dir)
+    short_commit_hash = run_git("rev-parse", "--short", "HEAD", cwd=repo_dir)
+    if not commit_hash or not short_commit_hash:
+        return 0
 
     print()
     print("=== Submodule Parent Update ===")
-    print(f"Submodule: {repo_name} @ {commit_hash}")
+    print(f"Submodule: {repo_dir.name} @ {short_commit_hash}")
     print(f"Parent:    {parent_repo}")
 
-    run_git("add", repo_name, cwd=parent_repo)
-
-    diff_result = subprocess.run(
-        ["git", "diff", "--cached", "--quiet"],
-        check=False, cwd=parent_repo,
+    parent_pointer_status, parent_pointer_diagnostic = update_parent_pointer(
+        parent_repo,
+        repo_dir,
+        commit_hash,
+        commit_msg,
     )
-
-    if diff_result.returncode == 0:
+    if parent_pointer_status is ParentPointerStatus.FAILED:
+        print("Parent update failed.")
+        if parent_pointer_diagnostic:
+            print(f"Git diagnostic: {parent_pointer_diagnostic}")
+        return 0
+    if parent_pointer_status is ParentPointerStatus.UNCHANGED:
         print("Parent already up to date.")
         return 0
 
-    full_commit_msg = f"""chore: update {repo_name} submodule to {commit_hash}
-
-Submodule commit: {commit_msg}
-
-Co-Authored-By: Claude <noreply@anthropic.com>"""
-
-    subprocess.run(
-        ["git", "commit", "-m", full_commit_msg],
-        check=False, cwd=parent_repo,
-    )
-
     print("Parent updated successfully.")
     print("================================")
     print()

package/hooks/git-hooks/pre_commit.py

@@ -24,20 +24,20 @@ from gate_utils import is_safe_regular_file, resolve_gate_script_path
 from git_hooks_constants import (
     GATE_INFRASTRUCTURE_FAILURE_EXIT_CODE,
     GATE_SCRIPT_NOT_FOUND_MESSAGE,
+    IMMEDIATE_SCOPE_ARGUMENT,
     INVOKE_GATE_FAILURE_MESSAGE,
-    STAGED_SCOPE_ARGUMENT,
 )
 
 
 def invoke_gate(gate_script_path: Path) -> int:
     """Invoke the shared staged gate and return its exit code."""
-    staged_scope_argument = STAGED_SCOPE_ARGUMENT
+    immediate_scope_argument = IMMEDIATE_SCOPE_ARGUMENT
     invoke_gate_failure_message = INVOKE_GATE_FAILURE_MESSAGE
     gate_infrastructure_failure_exit_code = GATE_INFRASTRUCTURE_FAILURE_EXIT_CODE
     try:
         resolved_gate_path = gate_script_path.resolve(strict=True)
         completion = subprocess.run(
-            [sys.executable, str(resolved_gate_path), staged_scope_argument],
+            [sys.executable, str(resolved_gate_path), immediate_scope_argument],
             check=False,
         )
     except OSError as launch_error: