claude-dev-env 2.25.0 → 2.27.0

package/hooks/hooks_constants/session_start_injector.py

@@ -148,16 +148,23 @@ def inject_session_start_context(
     )
 
 
-def build_additional_context_payload(injection_result: InjectionResult) -> dict[str, str]:
+def build_additional_context_payload(
+    injection_result: InjectionResult,
+) -> dict[str, object]:
     """Return the SessionStart stdout object when context was injected.
 
     Args:
         injection_result: Result from inject_session_start_context.
 
     Returns:
-        ``{"additionalContext": ...}`` when injected, else empty dict.
+        ``{"hookSpecificOutput": {"hookEventName": "SessionStart", ...}}``
+        when injected, else an empty dict.
     """
     if not injection_result.is_context_injected:
         return {}
-    return {"additionalContext": injection_result.additional_context}
-
+    return {
+        "hookSpecificOutput": {
+            "hookEventName": "SessionStart",
+            "additionalContext": injection_result.additional_context,
+        }
+    }

package/hooks/hooks_constants/test_session_start_injector.py

@@ -143,7 +143,10 @@ def test_build_additional_context_payload_only_when_injected() -> None:
         is_context_injected=False,
     )
     assert build_additional_context_payload(injected) == {
-        "additionalContext": "hello"
+        "hookSpecificOutput": {
+            "hookEventName": "SessionStart",
+            "additionalContext": "hello",
+        }
     }
     assert build_additional_context_payload(empty) == {}
 
@@ -165,4 +168,3 @@ def test_default_injector_configuration_reads_env(
     monkeypatch.setenv(SESSION_START_INJECTOR_ENABLED_ENV_VAR, "off")
     configuration = default_injector_configuration()
     assert configuration.is_enabled is False
-

package/hooks/session/AGENTS.md

@@ -1,6 +1,6 @@
 # hooks/session
 
-SessionStart and SessionEnd hooks for per-session setup and cleanup: removing stale session and plugin-data directories at startup, detecting unregistered repositories, starting the session's task-list maintenance loop, injecting working-style guidance, and clearing PR-author swap state at shutdown. Also holds the UserPromptSubmit hook. It adds a style reminder to each message.
+SessionStart and SessionEnd hooks for per-session setup and cleanup: removing stale session and plugin-data directories at startup, starting the session's task-list maintenance loop, injecting working-style guidance, and clearing PR-author swap state at shutdown. Also holds the UserPromptSubmit hook. It adds a style reminder to each message.
 
 The working-style projection uses `~/.claude/rules/asd-ste100-language.md` for
 user-facing word choice, sentence style, tone, punctuation, and prose form.
@@ -13,7 +13,7 @@ user-facing word choice, sentence style, tone, punctuation, and prose form.
 | `gh_pr_author_session_cleanup.py` | SessionEnd | Clears any PR-author swap state left over from the current session |
 | `session_edit_tracker_cleanup.py` | SessionStart, SessionEnd | Deletes the tracker file for the running Claude Code conversation from the system temp directory — at start for a clean slate and at end for a clean exit. A tracker is read only by the conversation that wrote it, so a live idle tracker is kept while a peer cleans up |
 | `plugin_data_dir_cleanup.py` | SessionStart | Removes empty plugin data directories at startup to prevent `EEXIST` when Claude Code recreates them |
-| `untracked_repo_detector.py` | SessionStart | Detects when the session cwd is inside a git repository that is not registered in `~/.claude/project-paths.json` and logs a warning |
+| `untracked_repo_detector.py` | — | Retired legacy script; no longer registered |
 | `task_list_loop_starter.py` | SessionStart | Emits an `additionalContext` directive telling Claude to keep the task list current on a 10-minute cadence, starting the `/loop` skill when one is not already running. Writes nothing and runs no tools itself. |
 | `orchestrator_auto_starter.py` | SessionStart | Opt-in (`CLAUDE_ORCHESTRATOR_AUTO_STARTER_ENABLED`) consumer of the shared SessionStart injector; emits orchestrator skill context when enabled. Manual `/orchestrator` unchanged. |
 | `issue_tracker_session_starter.py` | SessionStart | Opt-in (`CLAUDE_ISSUE_TRACKER_SESSION_STARTER_ENABLED`) and repository-gated (git root in `~/.claude/project-paths.json`) issue-tracker skill context. |

package/hooks/session/issue_tracker_session_starter.py

@@ -93,7 +93,7 @@ def run_issue_tracker_session_starter(
     is_enabled: bool,
     is_repository_eligible: bool,
     timeout_milliseconds: int,
-) -> dict[str, str]:
+) -> dict[str, object]:
     """Return additionalContext when opt-in and repo gate both pass, else empty.
 
     Args:
@@ -103,7 +103,8 @@ def run_issue_tracker_session_starter(
         timeout_milliseconds: Injector timeout budget.
 
     Returns:
-        ``{"additionalContext": ...}`` when injected, else ``{}``.
+        ``{"hookSpecificOutput": {"hookEventName": "SessionStart", ...}}``
+        when injected, else ``{}``.
     """
     if not is_enabled or not is_repository_eligible:
         return {}

package/hooks/session/orchestrator_auto_starter.py

@@ -68,7 +68,7 @@ def run_orchestrator_auto_starter(
     payload_by_key: dict[str, object],
     is_enabled: bool,
     timeout_milliseconds: int,
-) -> dict[str, str]:
+) -> dict[str, object]:
     """Return additionalContext payload when opt-in injects, else empty dict.
 
     Args:
@@ -77,7 +77,8 @@ def run_orchestrator_auto_starter(
         timeout_milliseconds: Injector timeout budget.
 
     Returns:
-        ``{"additionalContext": ...}`` when injected, else ``{}``.
+        ``{"hookSpecificOutput": {"hookEventName": "SessionStart", ...}}``
+        when injected, else ``{}``.
     """
     if not is_enabled:
         return {}

package/hooks/session/task_list_loop_starter.py

@@ -29,7 +29,16 @@ def build_session_directive() -> str:
 
 def main() -> None:
     """Emit the task-list loop directive as SessionStart additionalContext."""
-    print(json.dumps({"additionalContext": build_session_directive()}))
+    print(
+        json.dumps(
+            {
+                "hookSpecificOutput": {
+                    "hookEventName": "SessionStart",
+                    "additionalContext": build_session_directive(),
+                }
+            }
+        )
+    )
 
 
 if __name__ == "__main__":

package/hooks/session/test_issue_tracker_session_starter.py

@@ -60,7 +60,9 @@ def test_enabled_eligible_startup_emits_directive() -> None:
     payload = run_issue_tracker_session_starter(
         {"source": "startup"}, True, True, DEFAULT_TIMEOUT
     )
-    assert payload["additionalContext"] == ISSUE_TRACKER_SESSION_START_DIRECTIVE
+    hook_output = payload["hookSpecificOutput"]
+    assert hook_output["hookEventName"] == "SessionStart"
+    assert hook_output["additionalContext"] == ISSUE_TRACKER_SESSION_START_DIRECTIVE
 
 
 def test_timeout_zero_emits_nothing() -> None:

package/hooks/session/test_orchestrator_auto_starter.py

@@ -51,13 +51,15 @@ def test_enabled_startup_emits_orchestrator_directive() -> None:
     payload = run_orchestrator_auto_starter(
         {"source": "startup"}, True, DEFAULT_TIMEOUT
     )
-    assert payload["additionalContext"] == ORCHESTRATOR_SESSION_START_DIRECTIVE
+    hook_output = payload["hookSpecificOutput"]
+    assert hook_output["hookEventName"] == "SessionStart"
+    assert hook_output["additionalContext"] == ORCHESTRATOR_SESSION_START_DIRECTIVE
 
 
 @pytest.mark.parametrize("source", ("startup", "resume", "clear", "compact"))
 def test_enabled_known_sources_emit_directive(source: str) -> None:
     payload = run_orchestrator_auto_starter({"source": source}, True, DEFAULT_TIMEOUT)
-    assert ORCHESTRATOR_SESSION_START_DIRECTIVE in payload.get("additionalContext", "")
+    assert ORCHESTRATOR_SESSION_START_DIRECTIVE in payload["hookSpecificOutput"]["additionalContext"]
 
 
 def test_enabled_unknown_source_emits_nothing() -> None:
@@ -81,7 +83,7 @@ def test_main_stdin_enabled_prints_json() -> None:
     )
     assert completed.returncode == 0
     parsed = json.loads(completed.stdout)
-    assert parsed["additionalContext"] == ORCHESTRATOR_SESSION_START_DIRECTIVE
+    assert parsed["hookSpecificOutput"]["additionalContext"] == ORCHESTRATOR_SESSION_START_DIRECTIVE
 
 
 def test_main_stdin_disabled_prints_nothing() -> None:

package/hooks/session/test_task_list_loop_starter.py

@@ -31,31 +31,33 @@ def _run_main() -> str:
 class TestSessionDirective:
     def test_main_emits_additional_context(self) -> None:
         emitted = json.loads(_run_main())
-        assert "additionalContext" in emitted
+        hook_output = emitted["hookSpecificOutput"]
+        assert hook_output["hookEventName"] == "SessionStart"
+        assert "additionalContext" in hook_output
 
     def test_directive_carries_the_one_line_instruction(self) -> None:
         emitted = json.loads(_run_main())
-        assert TASK_LIST_MAINTENANCE_INSTRUCTION in emitted["additionalContext"]
+        assert TASK_LIST_MAINTENANCE_INSTRUCTION in emitted["hookSpecificOutput"]["additionalContext"]
 
     def test_directive_names_the_ten_minute_cadence(self) -> None:
         emitted = json.loads(_run_main())
-        assert "10-minute" in emitted["additionalContext"]
+        assert "10-minute" in emitted["hookSpecificOutput"]["additionalContext"]
 
     def test_directive_names_the_loop_command(self) -> None:
         emitted = json.loads(_run_main())
-        assert "/loop 10m" in emitted["additionalContext"]
+        assert "/loop 10m" in emitted["hookSpecificOutput"]["additionalContext"]
 
     def test_directive_runs_the_instruction_immediately(self) -> None:
         emitted = json.loads(_run_main())
         assert "Run that instruction once immediately when starting the loop, then" in emitted[
-            "additionalContext"
-        ]
+            "hookSpecificOutput"
+        ]["additionalContext"]
 
     def test_directive_reuses_an_existing_loop(self) -> None:
         emitted = json.loads(_run_main())
         assert "Reuse the active task-list maintenance loop when available." in emitted[
-            "additionalContext"
-        ]
+            "hookSpecificOutput"
+        ]["additionalContext"]
 
     def test_build_session_directive_returns_the_shared_constant(self) -> None:
         assert starter.build_session_directive() == TASK_LIST_LOOP_DIRECTIVE

package/hooks/session/test_untracked_repo_detector.py

@@ -99,7 +99,9 @@ class TestUntrackedRepoDetection:
         stdout, _, _ = _run_main_with_cwd(str(repo_root), {})
         assert stdout.strip() != ""
         emitted = json.loads(stdout)
-        assert "additionalContext" in emitted
+        hook_output = emitted["hookSpecificOutput"]
+        assert hook_output["hookEventName"] == "SessionStart"
+        assert "additionalContext" in hook_output
 
     def test_emitted_context_names_the_detected_repo_path(self, tmp_path: Path) -> None:
         repo_root = tmp_path / "new-repo"
@@ -107,7 +109,7 @@ class TestUntrackedRepoDetection:
         (repo_root / ".git").mkdir()
         stdout, _, _ = _run_main_with_cwd(str(repo_root), {})
         emitted = json.loads(stdout)
-        context_text = emitted["additionalContext"]
+        context_text = emitted["hookSpecificOutput"]["additionalContext"]
         assert str(repo_root) in context_text
 
     def test_emitted_context_names_the_config_file_path(self, tmp_path: Path) -> None:
@@ -116,7 +118,7 @@ class TestUntrackedRepoDetection:
         (repo_root / ".git").mkdir()
         stdout, _, _ = _run_main_with_cwd(str(repo_root), {})
         emitted = json.loads(stdout)
-        context_text = emitted["additionalContext"]
+        context_text = emitted["hookSpecificOutput"]["additionalContext"]
         assert "project-paths.json" in context_text
 
     def test_emitted_context_instructs_claude_to_use_ask_user_question(
@@ -127,7 +129,7 @@ class TestUntrackedRepoDetection:
         (repo_root / ".git").mkdir()
         stdout, _, _ = _run_main_with_cwd(str(repo_root), {})
         emitted = json.loads(stdout)
-        context_text = emitted["additionalContext"]
+        context_text = emitted["hookSpecificOutput"]["additionalContext"]
         assert "AskUserQuestion" in context_text
 
     def test_emitted_context_states_hook_has_written_nothing(
@@ -138,7 +140,7 @@ class TestUntrackedRepoDetection:
         (repo_root / ".git").mkdir()
         stdout, _, _ = _run_main_with_cwd(str(repo_root), {})
         emitted = json.loads(stdout)
-        context_text = emitted["additionalContext"]
+        context_text = emitted["hookSpecificOutput"]["additionalContext"]
         assert (
             "written nothing" in context_text.lower()
             or "has not written" in context_text.lower()

package/hooks/session/test_working_style_prompt.py

@@ -30,15 +30,17 @@ def _run_main() -> str:
 class TestWorkingStylePrompt:
     def test_main_emits_additional_context(self) -> None:
         emitted = json.loads(_run_main())
-        assert "additionalContext" in emitted
+        hook_output = emitted["hookSpecificOutput"]
+        assert hook_output["hookEventName"] == "SessionStart"
+        assert "additionalContext" in hook_output
 
     def test_additional_context_matches_prompt_exactly(self) -> None:
         emitted = json.loads(_run_main())
-        assert emitted["additionalContext"] == WORKING_STYLE_PROMPT
+        assert emitted["hookSpecificOutput"]["additionalContext"] == WORKING_STYLE_PROMPT
 
     def test_emitted_prompt_contains_canonical_policy_and_scope_guidance(self) -> None:
         emitted = json.loads(_run_main())
-        prompt_text = emitted["additionalContext"]
+        prompt_text = emitted["hookSpecificOutput"]["additionalContext"]
         assert "Document each task in a location that remains easy to find later." in prompt_text
         assert "Deliver the requested work at its intended scope." in prompt_text
         assert "Use ELI5 for beginner framing, large visuals, minimal text" in prompt_text

package/hooks/session/untracked_repo_detector.py

@@ -64,7 +64,16 @@ def main() -> None:
         if registry_contains_path(known_registry, git_root):
             sys.exit(0)
         instruction = _build_confirm_instruction(git_root)
-        print(json.dumps({"additionalContext": instruction}))
+        print(
+            json.dumps(
+                {
+                    "hookSpecificOutput": {
+                        "hookEventName": "SessionStart",
+                        "additionalContext": instruction,
+                    }
+                }
+            )
+        )
     except Exception as e:
         _logger.error("%s", e)
     sys.exit(0)

package/hooks/session/working_style_prompt.py

@@ -31,7 +31,16 @@ def build_session_directive() -> str:
 
 def main() -> None:
     """Emit the working-style prompt as SessionStart additionalContext."""
-    print(json.dumps({"additionalContext": build_session_directive()}))
+    print(
+        json.dumps(
+            {
+                "hookSpecificOutput": {
+                    "hookEventName": "SessionStart",
+                    "additionalContext": build_session_directive(),
+                }
+            }
+        )
+    )
 
 
 if __name__ == "__main__":

package/hooks/validators/AGENTS.md

@@ -13,6 +13,7 @@ A library of check modules used by the validation hooks. Each module focuses on
 | `run_all_validators.py` | Entry point — runs every check module and aggregates results |
 | `health_check.py` | Verifies that all validator dependencies (ruff, mypy) are reachable |
 | `pyproject_config_discovery.py` | Shared walk-up primitive that resolves a tool's pyproject.toml config from an original target path, matching the `[tool.<name>]` table the tool owns |
+| `system_temporary_roots.py` | Shared membership for OS temp roots (`gettempdir` plus `TEMP` / `TMP` / `TMPDIR` / `RUNNER_TEMP`); mypy walk stop and PreToolUse staging both call it |
 | `python_style_helpers.py` | Shared source-line splitting and function-discovery helpers imported by `python_style_checks.py` |
 
 ## Check modules
@@ -25,7 +26,7 @@ A library of check modules used by the validation hooks. Each module focuses on
 | `file_structure_checks.py` | File-level structural rules (line count, module layout) |
 | `git_checks.py` | Git-state checks (untracked files, merge conflicts) |
 | `magic_value_checks.py` | Magic numbers and strings |
-| `mypy_integration.py` | Runs mypy and converts its output to `Violation` objects |
+| `mypy_integration.py` | Runs mypy and converts its output to `Violation` objects; stops project-root walks at the system temp directory; detached gate files skip followed imports and time out as a skip (passed) |
 | `pr_reference_checks.py` | PR references in commit messages and changelogs |
 | `python_antipattern_checks.py` | Python-specific anti-patterns (bare `except`, `Any`, etc.) |
 | `python_style_checks.py` | Python style rules (naming, imports, type hints) |

package/hooks/validators/conftest.py

@@ -6,9 +6,26 @@ from pathlib import Path
 
 VALIDATORS_DIRECTORY = Path(__file__).resolve().parent
 HOOKS_DIRECTORY = VALIDATORS_DIRECTORY.parent
+VALIDATORS_DIRECTORY_STRING = str(VALIDATORS_DIRECTORY)
+HOOKS_DIRECTORY_STRING = str(HOOKS_DIRECTORY)
 
-if str(VALIDATORS_DIRECTORY) not in sys.path:
-    sys.path.insert(0, str(VALIDATORS_DIRECTORY))
+for each_directory_string in (VALIDATORS_DIRECTORY_STRING, HOOKS_DIRECTORY_STRING):
+    if each_directory_string in sys.path:
+        sys.path.remove(each_directory_string)
+    sys.path.insert(0, each_directory_string)
 
-if str(HOOKS_DIRECTORY) not in sys.path:
-    sys.path.insert(0, str(HOOKS_DIRECTORY))
+for each_module_name in list(sys.modules):
+    if each_module_name != "hooks_constants" and not each_module_name.startswith(
+        "hooks_constants."
+    ):
+        continue
+    loaded_file = getattr(sys.modules[each_module_name], "__file__", None)
+    if loaded_file is None:
+        sys.modules.pop(each_module_name, None)
+        continue
+    try:
+        is_from_this_tree = Path(loaded_file).resolve().is_relative_to(HOOKS_DIRECTORY)
+    except (OSError, ValueError):
+        is_from_this_tree = False
+    if not is_from_this_tree:
+        sys.modules.pop(each_module_name, None)

package/hooks/validators/mypy_integration.py

@@ -1,6 +1,7 @@
 """Mypy integration for static type checking."""
 
 import contextlib
+import logging
 import subprocess
 import sys
 import tempfile
@@ -16,6 +17,7 @@ try:
         ancestor_directories,
         find_pyproject_configuring_tool,
     )
+    from system_temporary_roots import enclosing_system_temporary_root
 except ModuleNotFoundError:
     if _validators_directory not in sys.path:
         sys.path.insert(0, _validators_directory)
@@ -23,10 +25,15 @@ except ModuleNotFoundError:
         ancestor_directories,
         find_pyproject_configuring_tool,
     )
+    from system_temporary_roots import enclosing_system_temporary_root
 
 try:
     from hooks_constants.mypy_integration_constants import (
+        FOLLOW_IMPORTS_FLAG,
+        FOLLOW_IMPORTS_SKIP_VALUE,
         GIT_DIRECTORY_NAME,
+        MYPY_DETACHED_SUBPROCESS_TIMEOUT_SECONDS,
+        MYPY_DETACHED_TIMEOUT_SKIP_MESSAGE,
         PYPROJECT_FILENAME,
         PYTHON_SOURCE_SUFFIX,
     )
@@ -35,12 +42,18 @@ except ModuleNotFoundError:
     if _hooks_directory not in sys.path:
         sys.path.insert(0, _hooks_directory)
     from hooks_constants.mypy_integration_constants import (
+        FOLLOW_IMPORTS_FLAG,
+        FOLLOW_IMPORTS_SKIP_VALUE,
         GIT_DIRECTORY_NAME,
+        MYPY_DETACHED_SUBPROCESS_TIMEOUT_SECONDS,
+        MYPY_DETACHED_TIMEOUT_SKIP_MESSAGE,
         PYPROJECT_FILENAME,
         PYTHON_SOURCE_SUFFIX,
     )
     from hooks_constants.pyproject_config_discovery_constants import MYPY_TOOL_TABLE_NAME
 
+logger = logging.getLogger(__name__)
+
 
 @dataclass
 class MypyResult:
@@ -91,25 +104,33 @@ def find_module_resolution_root(starting_file: Path) -> Path | None:
     directory, so anchoring there binds ``config.*`` to the target file's own
     project and keeps a foreign ``config`` in the caller's directory out of scope.
 
+    The walk does not climb out of the system temp directory. A PreToolUse
+    staging copy lives under ``%TEMP%``, and a ``.git`` in the user home above
+    that temp root is not this file's project.
+
     ::
 
         target_repo/.git + target_repo/tools/x.py -> target_repo
-        /tmp/detached/x.py (no marker up-tree)      -> None
+        /tmp/detached/x.py (home .git above temp) -> None
+        flag: walk past %TEMP% into ~/.git        -> mypy cwd=home, hook timeout
 
     Args:
         starting_file: The file (or directory) the walk begins from.
 
     Returns:
         The nearest ancestor Path that holds ``.git`` or ``pyproject.toml``,
-        or ``None`` when no such ancestor exists.
+        or ``None`` when no such ancestor exists inside the walk limit.
     """
     git_entry_name = GIT_DIRECTORY_NAME
     pyproject_filename = PYPROJECT_FILENAME
+    enclosing_temporary_root = enclosing_system_temporary_root(starting_file)
     for each_candidate_directory in ancestor_directories(starting_file):
         has_git_entry = (each_candidate_directory / git_entry_name).exists()
         has_pyproject = (each_candidate_directory / pyproject_filename).is_file()
         if has_git_entry or has_pyproject:
             return each_candidate_directory
+        if each_candidate_directory == enclosing_temporary_root:
+            return None
     return None
 
 
@@ -123,7 +144,7 @@ def _first_module_resolution_root(all_py_files: list[str]) -> Path | None:
 
 
 @contextlib.contextmanager
-def mypy_working_directory(all_py_files: list[str]) -> Iterator[str]:
+def mypy_working_directory(resolution_root: Path | None) -> Iterator[str]:
     """Yield the working directory mypy resolves first-party imports from.
 
     ::
@@ -136,12 +157,12 @@ def mypy_working_directory(all_py_files: list[str]) -> Iterator[str]:
     no foreign top-level package leaks in.
 
     Args:
-        all_py_files: Absolute or relative paths of the Python files under check.
+        resolution_root: The first rooted target's project root, or ``None``
+            when every target is detached.
 
     Yields:
         A directory path string mypy should use as its working directory.
     """
-    resolution_root = _first_module_resolution_root(all_py_files)
     if resolution_root is not None:
         yield str(resolution_root)
         return
@@ -189,17 +210,55 @@ def _mypy_config_argument(
 def _run_mypy_subprocess(
     all_py_files: list[str], config_source_path: Path | None
 ) -> subprocess.CompletedProcess[str]:
-    """Run mypy over *all_py_files* from each file's own project root."""
+    """Run mypy over *all_py_files* from each file's own project root.
+
+    A detached file (no ``.git`` or ``pyproject.toml`` ancestor) is a PreToolUse
+    staging copy. Following imports there loads site-packages and sibling
+    modules and blows the 30-second hook budget, so that path skips followed
+    imports and bounds the subprocess.
+
+    ::
+
+        ok:   temp/vae_compile.py (no project root) -> --follow-imports skip
+        ok:   repo/tools/serialize_tool.py          -> default follow-imports
+        flag: temp/vae_compile.py follow=normal     -> torch stubs, hook timeout
+    """
+    follow_imports_flag = FOLLOW_IMPORTS_FLAG
+    follow_imports_skip_value = FOLLOW_IMPORTS_SKIP_VALUE
+    detached_timeout_seconds = MYPY_DETACHED_SUBPROCESS_TIMEOUT_SECONDS
+    detached_timeout_skip_message = MYPY_DETACHED_TIMEOUT_SKIP_MESSAGE
     config_argument = _mypy_config_argument(all_py_files, config_source_path)
-    with mypy_working_directory(all_py_files) as working_directory:
-        return subprocess.run(
-            ["mypy", *config_argument, "--ignore-missing-imports", "--no-error-summary"]
-            + all_py_files,
-            check=False,
-            capture_output=True,
-            text=True,
-            cwd=working_directory,
-        )
+    resolution_root = _first_module_resolution_root(all_py_files)
+    is_detached_target = resolution_root is None
+    follow_imports_arguments = (
+        [follow_imports_flag, follow_imports_skip_value] if is_detached_target else []
+    )
+    timeout_seconds = detached_timeout_seconds if is_detached_target else None
+    with mypy_working_directory(resolution_root) as working_directory:
+        try:
+            return subprocess.run(
+                [
+                    "mypy",
+                    *config_argument,
+                    *follow_imports_arguments,
+                    "--ignore-missing-imports",
+                    "--no-error-summary",
+                    *all_py_files,
+                ],
+                check=False,
+                capture_output=True,
+                text=True,
+                cwd=working_directory,
+                timeout=timeout_seconds,
+            )
+        except subprocess.TimeoutExpired:
+            logger.warning(detached_timeout_skip_message)
+            return subprocess.CompletedProcess(
+                args=["mypy"],
+                returncode=0,
+                stdout="",
+                stderr=detached_timeout_skip_message,
+            )
 
 
 def run_mypy_check(
@@ -208,7 +267,9 @@ def run_mypy_check(
     """Run mypy on files, resolving config from *config_source_path* when given.
 
     A given ``config_source_path`` walks ``--config-file`` up from the original
-    target rather than the staged copy's own ancestors.
+    target rather than the staged copy's own ancestors. A detached staging
+    file that hits the subprocess timeout returns passed, same as when mypy
+    is not installed, so the 30-second PreToolUse hook can still return.
     """
     if not all_files:
         return MypyResult(passed=True, output="No files to check", error_count=0)

package/hooks/validators/run_all_validators.py

@@ -23,10 +23,10 @@ from ._path_setup import hooks_directory_on_path  # noqa: F401
 from .config.directory_exemption_constants import (
     ALL_DIRECTORY_EXEMPTION_SEGMENT_NAMES,
     ALL_DIRECTORY_EXEMPTION_SUBSTRING_PATTERNS,
-    ALL_SYSTEM_TEMPORARY_ROOT_ENVIRONMENT_VARIABLE_NAMES,
 )
 from .health_check import get_system_health, get_validator_version, print_health_report
 from .mypy_integration import check_mypy_available, run_mypy_check
+from .system_temporary_roots import enclosing_system_temporary_root
 from .output_formatter import OutputFormatter, OutputMode, ValidatorResultDict
 from .python_style_checks import fix_file
 from .ruff_integration import check_ruff_available, run_ruff_check
@@ -788,32 +788,6 @@ def _escapes_temporary_root(path_part: str) -> bool:
     return part_as_path.is_absolute() or bool(part_as_path.anchor)
 
 
-def _all_system_temporary_roots() -> tuple[Path, ...]:
-    """Return resolved roots that count as system temporary directories.
-
-    ::
-
-        gettempdir() plus TEMP / TMP / TMPDIR / RUNNER_TEMP when set.
-
-    GitHub Actions puts pytest basetemp under ``RUNNER_TEMP``
-    (``/home/runner/work/_temp``) while ``tempfile.gettempdir()`` is ``/tmp``.
-    Both must count so pytest-shaped ``test_*`` parents disable substring
-    exemption matching during staging.
-    """
-    all_candidate_roots: list[str] = [tempfile.gettempdir()]
-    for each_environment_name in ALL_SYSTEM_TEMPORARY_ROOT_ENVIRONMENT_VARIABLE_NAMES:
-        environment_value = os.environ.get(each_environment_name)
-        if environment_value:
-            all_candidate_roots.append(environment_value)
-    all_resolved_roots: list[Path] = []
-    for each_candidate in all_candidate_roots:
-        try:
-            all_resolved_roots.append(Path(each_candidate).resolve())
-        except OSError:
-            continue
-    return tuple(all_resolved_roots)
-
-
 def _is_absolute_path_under_system_temporary_directory(file_path: str) -> bool:
     """Return True when *file_path* is absolute and resolves under an OS temp root.
 
@@ -840,14 +814,7 @@ def _is_absolute_path_under_system_temporary_directory(file_path: str) -> bool:
     destination_path = Path(file_path)
     if not destination_path.is_absolute():
         return False
-    try:
-        resolved_destination = destination_path.resolve()
-    except OSError:
-        return False
-    return any(
-        resolved_destination.is_relative_to(each_temporary_root)
-        for each_temporary_root in _all_system_temporary_roots()
-    )
+    return enclosing_system_temporary_root(destination_path) is not None
 
 
 def _directory_segment_signals_exemption(