claude-dev-env 2.3.0 → 2.5.0

package/hooks/hooks_constants/orchestrator_refresh_reschedule_gate_constants.py

@@ -0,0 +1,48 @@
+"""Constants for the orchestrator-refresh ScheduleWakeup reschedule gate."""
+
+from __future__ import annotations
+
+SCHEDULE_WAKEUP_TOOL_NAME = "ScheduleWakeup"
+CRON_CREATE_TOOL_NAME = "CronCreate"
+ALL_SCHEDULE_TOOL_NAMES: frozenset[str] = frozenset(
+    {
+        SCHEDULE_WAKEUP_TOOL_NAME,
+        CRON_CREATE_TOOL_NAME,
+    }
+)
+
+ORCHESTRATOR_REFRESH_PROMPT_TOKEN = "/orchestrator-refresh"
+RUN_SLUG_PROMPT_FLAG = "--run-slug"
+RUN_SLUG_PROMPT_VALUE_PATTERN = r"(?:=\s*|\s+)([^\s]+)"
+PROMPT_FIELD_NAME = "prompt"
+TOOL_NAME_FIELD_NAME = "tool_name"
+TOOL_INPUT_FIELD_NAME = "tool_input"
+CWD_FIELD_NAME = "cwd"
+
+REASON_CRON_CREATE_FORBIDDEN = "cron_create_forbidden"
+
+DENY_REASON_TEMPLATE = (
+    "BLOCKED: orchestrator-refresh re-arm denied ({reason}). "
+    "Use one-shot delayed wake only (never CronCreate / never recurring). "
+    "At most one re-arm slot: begin-firing at refresh start; "
+    "should-reschedule then create then claim-rearm (never claim before "
+    "ScheduleWakeup). Status must be active: "
+    "python skills/orchestrator/scripts/status_gate.py set "
+    "--status active. When finished: --status done. Never re-arm an idle loop."
+)
+
+CALLING_HOOK_NAME = "orchestrator_refresh_reschedule_gate.py"
+HOOK_EVENT_NAME = "PreToolUse"
+
+ALL_SKILL_SCRIPTS_RELATIVE_PARTS: tuple[str, ...] = (
+    "skills",
+    "orchestrator",
+    "scripts",
+)
+PLUGIN_ROOT_ENV_VAR = "CLAUDE_PLUGIN_ROOT"
+ALL_HOME_SKILLS_RELATIVE_PARTS: tuple[str, ...] = (
+    ".claude",
+    "skills",
+    "orchestrator",
+    "scripts",
+)

package/hooks/hooks_constants/pr_description_proof_of_work_constants.py

@@ -22,8 +22,6 @@ GH_SLURP_FLAG: str = "--slurp"
 PR_COMMENTS_API_PATH_TEMPLATE: str = "repos/{{owner}}/{{repo}}/issues/{pr_number}/comments"
 ALL_PR_DIFF_SUBCOMMANDS: tuple[str, ...] = ("pr", "diff")
 PR_DIFF_NAME_ONLY_FLAG: str = "--name-only"
-ALL_PR_VIEW_NUMBER_ARGUMENTS: tuple[str, ...] = ("pr", "view", "--json", "number")
-PR_NUMBER_JSON_FIELD: str = "number"
 COMMENT_BODY_JSON_FIELD: str = "body"
 GH_COMMAND_TIMEOUT_SECONDS: int = 6
 MAX_DIFF_SCAN_CHARS: int = 200000
@@ -83,7 +81,6 @@ __all__ = [
     "ALL_HONEST_GAP_PHRASES",
     "ALL_PROOF_HEADING_KEYWORDS",
     "ALL_PR_DIFF_SUBCOMMANDS",
-    "ALL_PR_VIEW_NUMBER_ARGUMENTS",
     "ALL_VISUAL_FILE_SUFFIXES",
     "COMMENT_BODY_JSON_FIELD",
     "DIGIT_PATTERN",
@@ -104,7 +101,6 @@ __all__ = [
     "PROOF_PART_VISUAL_MESSAGE",
     "PR_COMMENTS_API_PATH_TEMPLATE",
     "PR_DIFF_NAME_ONLY_FLAG",
-    "PR_NUMBER_JSON_FIELD",
     "PR_READY_GATE_MESSAGE_TEMPLATE",
     "PR_READY_INVOCATION_PATTERN",
     "PR_READY_UNDO_FLAG",

package/hooks/hooks_constants/pre_tool_use_dispatcher_constants.py

@@ -80,6 +80,10 @@ ALL_HOSTED_HOOK_ENTRIES: tuple[HostedHookEntry, ...] = (
         script_relative_path="blocking/sensitive_file_protector.py",
         applicable_tool_names=ALL_WRITE_AND_EDIT_TOOL_NAMES,
     ),
+    HostedHookEntry(
+        script_relative_path="blocking/code_review_stamp_directory_write_blocker.py",
+        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
+    ),
     HostedHookEntry(
         script_relative_path="blocking/pii_prevention_blocker.py",
         applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,

package/hooks/hooks_constants/pyproject_config_discovery_constants.py

@@ -0,0 +1,16 @@
+"""Table names used when a validator resolves its config from a pyproject.toml.
+
+A ``pyproject.toml`` nests each tool's settings under ``[tool.<name>]``, so the
+top-level table key is ``tool`` and each tool matches its own name below it.
+These names live here so the discovery module carries no inline table literals.
+"""
+
+__all__ = [
+    "TOOL_TABLE_KEY",
+    "MYPY_TOOL_TABLE_NAME",
+    "RUFF_TOOL_TABLE_NAME",
+]
+
+TOOL_TABLE_KEY: str = "tool"
+MYPY_TOOL_TABLE_NAME: str = "mypy"
+RUFF_TOOL_TABLE_NAME: str = "ruff"

package/hooks/hooks_constants/ruff_integration_constants.py

@@ -0,0 +1,16 @@
+"""Environment variable names used when ruff emits plain diagnostics.
+
+The PreToolUse gate parses ``path:line:col:`` prefixes. Forcing ``NO_COLOR`` and
+clearing ``FORCE_COLOR`` keeps ANSI codes out of those fields so baseline
+scoping can locate each finding.
+"""
+
+__all__ = [
+    "FORCE_COLOR_ENVIRONMENT_VARIABLE_NAME",
+    "NO_COLOR_ENABLED_VALUE",
+    "NO_COLOR_ENVIRONMENT_VARIABLE_NAME",
+]
+
+NO_COLOR_ENVIRONMENT_VARIABLE_NAME: str = "NO_COLOR"
+FORCE_COLOR_ENVIRONMENT_VARIABLE_NAME: str = "FORCE_COLOR"
+NO_COLOR_ENABLED_VALUE: str = "1"

package/hooks/hooks_constants/test_bash_pre_tool_use_dispatcher_constants.py

@@ -40,12 +40,18 @@ _EXPECTED_BASH_ORDER = (
     "blocking/gh_pr_author_enforcer.py",
     "blocking/verified_commit_gate.py",
     "blocking/verdict_directory_write_blocker.py",
+    "blocking/code_review_push_gate.py",
+    "blocking/code_review_pr_create_gate.py",
+    "blocking/code_review_stamp_directory_write_blocker.py",
 )
 
 _POWERSHELL_APPLICABLE = (
     "blocking/pii_prevention_blocker.py",
     "blocking/verified_commit_gate.py",
     "blocking/verdict_directory_write_blocker.py",
+    "blocking/code_review_push_gate.py",
+    "blocking/code_review_pr_create_gate.py",
+    "blocking/code_review_stamp_directory_write_blocker.py",
 )
 
 
@@ -80,6 +86,24 @@ def test_powershell_hooks_carry_the_shared_tool_set() -> None:
             assert each_entry.applicable_tool_names == ALL_BASH_AND_POWERSHELL_TOOL_NAMES
 
 
+def test_code_review_gate_family_registered_for_bash_and_powershell() -> None:
+    """The three code-review shell gates run on both Bash and PowerShell."""
+    code_review_gate_paths = (
+        "blocking/code_review_push_gate.py",
+        "blocking/code_review_pr_create_gate.py",
+        "blocking/code_review_stamp_directory_write_blocker.py",
+    )
+    entry_by_path = {
+        each_entry.script_relative_path: each_entry
+        for each_entry in ALL_BASH_HOSTED_HOOK_ENTRIES
+    }
+    for each_gate_path in code_review_gate_paths:
+        assert each_gate_path in entry_by_path
+        assert entry_by_path[each_gate_path].applicable_tool_names == (
+            ALL_BASH_AND_POWERSHELL_TOOL_NAMES
+        )
+
+
 def test_every_roster_path_points_at_an_existing_hook() -> None:
     """Each roster path names a hook script present on disk, catching a typo."""
     hooks_root = Path(__file__).resolve().parent.parent

package/hooks/hooks_constants/test_pre_tool_use_dispatcher_constants.py

@@ -63,6 +63,12 @@ def test_duplicate_rmtree_helper_blocker_runs_via_runpy() -> None:
     assert entry.native_module_name is None
 
 
+def test_code_review_stamp_write_blocker_registered_for_all_file_tools() -> None:
+    entry = _entry_for("blocking/code_review_stamp_directory_write_blocker.py")
+    assert entry is not None
+    assert {"Write", "Edit", "MultiEdit"} <= entry.applicable_tool_names
+
+
 def test_windows_rmtree_blocker_still_registered() -> None:
     entry = _entry_for("blocking/windows_rmtree_blocker.py")
     assert entry is not None

package/hooks/hooks_constants/volatile_path_in_post_blocker_constants.py

@@ -19,9 +19,16 @@ ALL_GH_POST_SUBCOMMANDS: dict[str, frozenset[str]] = {
     "issue": frozenset({"create", "comment", "edit"}),
 }
 
-ALL_VOLATILE_PATH_MARKERS: tuple[str, ...] = (
+PATH_ANCHOR_CHARACTER: str = "/"
+
+PATH_SEGMENT_START_CHARACTERS: str = "_-"
+
+ALL_PATH_ANCHORED_VOLATILE_PATH_MARKERS: tuple[str, ...] = (
     ".claude-editor/jobs/",
     ".claude/worktrees/",
+)
+
+ALL_BARE_VOLATILE_PATH_MARKERS: tuple[str, ...] = (
     "appdata/local/temp",
     "/tmp/",
     "%temp%",

package/hooks/lifecycle/enter_worktree_origin_prefetch.py

@@ -1,146 +1,163 @@
-#!/usr/bin/env python3
-"""PreToolUse hook: fetch origin's default branch before EnterWorktree creates one.
-
-``EnterWorktree`` in its default ``fresh`` mode bases a new worktree on the
-locally cached ``refs/remotes/origin/<default-branch>`` ref and only runs
-``git fetch`` when that ref is missing entirely -- so a worktree created
-without a recent fetch silently starts behind the remote. This hook fetches
-that ref immediately before the tool resolves its base, so the ref it reads
-is current.
-
-::
-
-    EnterWorktree({})                              # tool_input has no "path"
-             |
-             v
-    this hook: git fetch origin <default-branch>   # best-effort, never blocks
-             |
-             v
-    EnterWorktree resolves refs/remotes/origin/<default-branch>  # now fresh
-
-The hook is a no-op when ``tool_input`` carries a ``path`` (switching into an
-already-existing worktree needs no fresh base) and always exits 0 -- a failed
-or slow fetch never blocks worktree creation.
-"""
-
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-from hooks_constants.enter_worktree_prefetch_constants import (  # noqa: E402
-    ENTER_WORKTREE_PATH_INPUT_KEY,
-    ENTER_WORKTREE_TOOL_NAME,
-    GIT_FETCH_TIMEOUT_SECONDS,
-    GIT_SYMBOLIC_REF_TIMEOUT_SECONDS,
-    ORIGIN_HEAD_SYMBOLIC_REF,
-    ORIGIN_REMOTE_NAME,
-    ORIGIN_REMOTE_REF_PREFIX,
-)
-
-
-def is_enter_worktree_creation(payload_by_field: dict[str, object]) -> bool:
-    """Return True when this hook invocation is an EnterWorktree creation call.
-
-    Args:
-        payload_by_field: The full PreToolUse hook payload (already JSON-parsed),
-            keyed by top-level field name.
-
-    Returns:
-        True when ``tool_name == "EnterWorktree"`` and ``tool_input`` carries
-        no ``path`` key. A ``path`` value means the call switches into an
-        already-existing worktree rather than creating one, so it is False
-        for that case and for every other tool.
-    """
-    if payload_by_field.get("tool_name", "") != ENTER_WORKTREE_TOOL_NAME:
-        return False
-    tool_input = payload_by_field.get("tool_input", {})
-    if not isinstance(tool_input, dict):
-        return True
-    return not tool_input.get(ENTER_WORKTREE_PATH_INPUT_KEY)
-
-
-def resolve_origin_default_branch(repo_directory: str) -> str | None:
-    """Return the branch name origin's HEAD points at, or None if unresolved.
-
-    Args:
-        repo_directory: Working directory to run ``git`` in.
-
-    Returns:
-        The branch name (for example ``"main"``) parsed from
-        ``refs/remotes/origin/HEAD``, or None when the symbolic ref is
-        unset, git is unavailable, or the command times out.
-    """
-    try:
-        completed_process = subprocess.run(
-            ["git", "symbolic-ref", ORIGIN_HEAD_SYMBOLIC_REF],
-            capture_output=True,
-            text=True,
-            timeout=GIT_SYMBOLIC_REF_TIMEOUT_SECONDS,
-            cwd=repo_directory,
-            check=False,
-        )
-    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
-        return None
-    if completed_process.returncode != 0:
-        return None
-    resolved_ref = completed_process.stdout.strip()
-    if not resolved_ref.startswith(ORIGIN_REMOTE_REF_PREFIX):
-        return None
-    return resolved_ref[len(ORIGIN_REMOTE_REF_PREFIX):]
-
-
-def fetch_origin_branch(repo_directory: str, branch_name: str) -> None:
-    """Best-effort ``git fetch origin <branch_name>``; never raises.
-
-    Args:
-        repo_directory: Working directory to run ``git`` in.
-        branch_name: Branch to fetch from the ``origin`` remote.
-    """
-    try:
-        subprocess.run(
-            ["git", "fetch", ORIGIN_REMOTE_NAME, branch_name],
-            capture_output=True,
-            text=True,
-            timeout=GIT_FETCH_TIMEOUT_SECONDS,
-            cwd=repo_directory,
-            check=False,
-        )
-    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
-        return
-
-
-def main() -> None:
-    """Entry point for the PreToolUse:EnterWorktree hook.
-
-    Reads the PreToolUse payload from stdin, and when it is an EnterWorktree
-    creation call, fetches origin's default branch in the session's ``cwd``
-    before returning. Always exits 0: a fetch failure self-heals on the next
-    fetch rather than blocking worktree creation.
-    """
-    try:
-        hook_payload = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        sys.exit(0)
-    if not isinstance(hook_payload, dict):
-        sys.exit(0)
-    if not is_enter_worktree_creation(hook_payload):
-        sys.exit(0)
-    repo_directory = hook_payload.get("cwd")
-    if not isinstance(repo_directory, str) or not repo_directory:
-        sys.exit(0)
-    default_branch = resolve_origin_default_branch(repo_directory)
-    if default_branch is None:
-        sys.exit(0)
-    fetch_origin_branch(repo_directory, default_branch)
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()
+#!/usr/bin/env python3
+"""PreToolUse hook: fetch origin's default branch before EnterWorktree creates one.
+
+``EnterWorktree`` in its default ``fresh`` mode bases a new worktree on the
+locally cached ``refs/remotes/origin/<default-branch>`` ref and only runs
+``git fetch`` when that ref is missing entirely -- so a worktree created
+without a recent fetch silently starts behind the remote. This hook fetches
+that ref immediately before the tool resolves its base, so the ref it reads
+is current.
+
+::
+
+    EnterWorktree({})                              # tool_input has no "path"
+             |
+             v
+    this hook: git fetch origin <default-branch>   # best-effort, never blocks
+             |
+             v
+    EnterWorktree resolves refs/remotes/origin/<default-branch>  # now fresh
+
+The hook is a no-op when ``tool_input`` carries a ``path`` (switching into an
+already-existing worktree needs no fresh base) and always exits 0 -- a failed
+or slow fetch never blocks worktree creation.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+_hooks_dir = str(Path(__file__).resolve().parent.parent)
+if _hooks_dir not in sys.path:
+    sys.path.insert(0, _hooks_dir)
+
+from hooks_constants.enter_worktree_prefetch_constants import (  # noqa: E402
+    ENTER_WORKTREE_PATH_INPUT_KEY,
+    ENTER_WORKTREE_TOOL_NAME,
+    GIT_FETCH_TIMEOUT_SECONDS,
+    GIT_SYMBOLIC_REF_TIMEOUT_SECONDS,
+    ORIGIN_HEAD_SYMBOLIC_REF,
+    ORIGIN_REMOTE_NAME,
+    ORIGIN_REMOTE_REF_PREFIX,
+)
+from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin  # noqa: E402
+
+
+def is_enter_worktree_creation(payload_by_field: dict[str, object]) -> bool:
+    """Return True when this hook invocation is an EnterWorktree creation call.
+
+    Args:
+        payload_by_field: The full PreToolUse hook payload (already JSON-parsed),
+            keyed by top-level field name.
+
+    Returns:
+        True when ``tool_name == "EnterWorktree"`` and ``tool_input`` carries
+        no ``path`` key. A ``path`` value means the call switches into an
+        already-existing worktree rather than creating one, so it is False
+        for that case and for every other tool.
+    """
+    if payload_by_field.get("tool_name", "") != ENTER_WORKTREE_TOOL_NAME:
+        return False
+    tool_input = payload_by_field.get("tool_input", {})
+    if not isinstance(tool_input, dict):
+        return True
+    return not tool_input.get(ENTER_WORKTREE_PATH_INPUT_KEY)
+
+
+def _run_git_quietly(
+    repo_directory: str,
+    all_git_arguments: list[str],
+    timeout_seconds: int,
+) -> subprocess.CompletedProcess[str] | None:
+    """Run ``git`` with the given arguments, or return None when it cannot run.
+
+    Args:
+        repo_directory: Working directory to run ``git`` in.
+        all_git_arguments: The git subcommand and its arguments, without the
+            leading ``"git"`` (for example ``["fetch", "origin", "main"]``).
+        timeout_seconds: Seconds to wait before abandoning the command.
+
+    Returns:
+        The completed process, or None when git is unavailable, the OS refuses
+        to start it, or the command exceeds ``timeout_seconds``.
+    """
+    try:
+        return subprocess.run(
+            ["git", *all_git_arguments],
+            capture_output=True,
+            text=True,
+            timeout=timeout_seconds,
+            cwd=repo_directory,
+            check=False,
+        )
+    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
+        return None
+
+
+def resolve_origin_default_branch(repo_directory: str) -> str | None:
+    """Return the branch name origin's HEAD points at, or None if unresolved.
+
+    Args:
+        repo_directory: Working directory to run ``git`` in.
+
+    Returns:
+        The branch name (for example ``"main"``) parsed from
+        ``refs/remotes/origin/HEAD``, or None when the symbolic ref is
+        unset, git is unavailable, or the command times out.
+    """
+    completed_process = _run_git_quietly(
+        repo_directory,
+        ["symbolic-ref", ORIGIN_HEAD_SYMBOLIC_REF],
+        GIT_SYMBOLIC_REF_TIMEOUT_SECONDS,
+    )
+    if completed_process is None:
+        return None
+    if completed_process.returncode != 0:
+        return None
+    resolved_ref = completed_process.stdout.strip()
+    if not resolved_ref.startswith(ORIGIN_REMOTE_REF_PREFIX):
+        return None
+    return resolved_ref[len(ORIGIN_REMOTE_REF_PREFIX):]
+
+
+def fetch_origin_branch(repo_directory: str, branch_name: str) -> None:
+    """Best-effort ``git fetch origin <branch_name>``; never raises.
+
+    Args:
+        repo_directory: Working directory to run ``git`` in.
+        branch_name: Branch to fetch from the ``origin`` remote.
+    """
+    _run_git_quietly(
+        repo_directory,
+        ["fetch", ORIGIN_REMOTE_NAME, branch_name],
+        GIT_FETCH_TIMEOUT_SECONDS,
+    )
+
+
+def main() -> None:
+    """Entry point for the PreToolUse:EnterWorktree hook.
+
+    Reads the PreToolUse payload from stdin, and when it is an EnterWorktree
+    creation call, fetches origin's default branch in the session's ``cwd``
+    before returning. Always exits 0: a fetch failure self-heals on the next
+    fetch rather than blocking worktree creation.
+    """
+    hook_payload = read_hook_input_dictionary_from_stdin()
+    if hook_payload is None:
+        sys.exit(0)
+    if not is_enter_worktree_creation(hook_payload):
+        sys.exit(0)
+    repo_directory = hook_payload.get("cwd")
+    if not isinstance(repo_directory, str) or not repo_directory:
+        sys.exit(0)
+    default_branch = resolve_origin_default_branch(repo_directory)
+    if default_branch is None:
+        sys.exit(0)
+    fetch_origin_branch(repo_directory, default_branch)
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()