claude-dev-env 2.4.0 → 2.7.0

package/hooks/blocking/verifier_verdict_minter.py

@@ -1,280 +1,280 @@
-"""SubagentStop hook: mint a commit-gate verdict when code-verifier finishes.
-
-Only this hook writes verdict files — the main session is denied writes to
-the verdict directory, so a session cannot fabricate a passing verdict. The
-SubagentStop payload names the stopping subagent's own transcript
-(``agent_transcript_path``), which sits beside a harness-written
-``agent-<id>.meta.json`` sidecar naming the spawning ``agentType``. The hook
-reads that type from the sidecar, so it resolves identically in interactive,
-background, and worktree-switched sessions; only the harness writes the
-sidecar, so the type it records cannot be forged. When that type is
-``code-verifier``, the hook pulls the verdict block out of the agent's own
-transcript (``agent_transcript_path``), recomputes the live change-surface
-hash for the session repository, and writes the verdict bound to that hash.
-The companion ``verified_commit_gate.py`` (PreToolUse) then allows ``git
-commit`` / ``git push`` only while the work tree still matches the verified
-state.
-
-The verifier's final message must end with a fenced block::
-
-    ```verdict
-    {"all_pass": true, "findings": []}
-    ```
-
-A missing or unparseable block mints nothing, which leaves the gate closed.
-"""
-
-from __future__ import annotations
-
-import json
-import re
-import sys
-from pathlib import Path
-
-blocking_directory = str(Path(__file__).resolve().parent)
-if blocking_directory not in sys.path:
-    sys.path.insert(0, blocking_directory)
-
-from verified_commit_config_bootstrap import (  # noqa: E402
-    register_verified_commit_constants,
-)
-
-register_verified_commit_constants()
-
-from config.verified_commit_constants import (
-    MINTING_AGENT_TYPE,
-    VERDICT_KEY_MANIFEST_SHA256,
-)
-from verification_verdict_store import (
-    branch_surface_manifest,
-    empty_surface_hash,
-    manifest_sha256,
-    resolve_merge_base,
-    resolve_repo_root,
-    write_verdict,
-)
-
-
-def assistant_text_blocks(transcript_path: str) -> list[str]:
-    """Collect every assistant text block from a transcript JSONL file.
-
-    Args:
-        transcript_path: Path to the subagent's transcript.
-
-    Returns:
-        The text of each assistant content block, in transcript order;
-        empty when the file is missing or holds no assistant text.
-    """
-    collected_blocks: list[str] = []
-    try:
-        transcript_lines = (
-            Path(transcript_path).read_text(encoding="utf-8", errors="replace").splitlines()
-        )
-    except OSError:
-        return collected_blocks
-    for each_line in transcript_lines:
-        try:
-            transcript_entry = json.loads(each_line)
-        except json.JSONDecodeError:
-            continue
-        if not isinstance(transcript_entry, dict):
-            continue
-        if transcript_entry.get("type") != "assistant":
-            continue
-        message_body = transcript_entry.get("message")
-        if not isinstance(message_body, dict):
-            continue
-        content_blocks = message_body.get("content")
-        if not isinstance(content_blocks, list):
-            continue
-        for each_block in content_blocks:
-            if isinstance(each_block, dict) and each_block.get("type") == "text":
-                block_text = each_block.get("text")
-                if isinstance(block_text, str):
-                    collected_blocks.append(block_text)
-    return collected_blocks
-
-
-def last_verdict_in_blocks(all_text_blocks: list[str]) -> dict | None:
-    """Extract the final verdict fence from assistant text blocks.
-
-    Args:
-        all_text_blocks: Assistant text blocks in transcript order.
-
-    Returns:
-        The parsed verdict mapping carrying a boolean ``all_pass`` and a
-        list ``findings``, or None when no block holds a wellformed fence.
-    """
-    verdict_fence_pattern = re.compile(r"```verdict\s*\n(.*?)```", re.DOTALL)
-    fence_bodies: list[str] = []
-    for each_block in all_text_blocks:
-        fence_bodies.extend(verdict_fence_pattern.findall(each_block))
-    for each_fence_body in reversed(fence_bodies):
-        try:
-            verdict_record = json.loads(each_fence_body)
-        except json.JSONDecodeError:
-            continue
-        if not isinstance(verdict_record, dict):
-            continue
-        if not isinstance(verdict_record.get("all_pass"), bool):
-            continue
-        if not isinstance(verdict_record.get("findings"), list):
-            continue
-        return verdict_record
-    return None
-
-
-def _agent_type_from_meta_sidecar(agent_transcript_path: str) -> str | None:
-    """Read the spawning agentType from a subagent transcript's sidecar.
-
-    Each subagent transcript ``agent-<id>.jsonl`` sits beside a harness-written
-    ``agent-<id>.meta.json`` naming the spawning ``agentType``. Reading the type
-    from this sidecar binds it to the stopping subagent itself, so it resolves
-    identically in interactive, background, and worktree-switched sessions and
-    needs no parent-transcript scan or flush retry. Only the harness writes this
-    sidecar, so a session cannot forge the type it reports.
-
-    Args:
-        agent_transcript_path: The stopping subagent's own transcript path from
-            the SubagentStop payload.
-
-    Returns:
-        The recorded ``agentType``, or None when the path is empty, the sidecar
-        is absent, unreadable, or unparseable, it does not hold a JSON object,
-        or it names no string ``agentType``.
-    """
-    if not agent_transcript_path:
-        return None
-    transcript_file = Path(agent_transcript_path)
-    sidecar_file = transcript_file.with_name(f"{transcript_file.stem}.meta.json")
-    try:
-        sidecar_record = json.loads(sidecar_file.read_text(encoding="utf-8"))
-    except (OSError, UnicodeDecodeError, json.JSONDecodeError):
-        return None
-    if not isinstance(sidecar_record, dict):
-        return None
-    recorded_type = sidecar_record.get("agentType")
-    return recorded_type if isinstance(recorded_type, str) else None
-
-
-def resolved_subagent_type(subagent_stop_payload: dict) -> str | None:
-    """Recover the spawning agent type for a SubagentStop payload.
-
-    The stopping subagent's own transcript (``agent_transcript_path``) sits
-    beside a harness-written ``agent-<id>.meta.json`` sidecar naming its
-    ``agentType``. The type comes solely from that sidecar, which only the
-    harness writes — the main session can neither write the sidecar nor forge
-    the agentType it records. A verdict fence in the transcript is never used to
-    infer the type, because the main session controls the prompt of any
-    Agent-tool subagent it spawns and could instruct one to print such a fence.
-
-    Args:
-        subagent_stop_payload: The SubagentStop hook payload.
-
-    Returns:
-        The agent type the sidecar records, or None when the
-        ``agent_transcript_path`` is empty, the sidecar is absent, unreadable,
-        or unparseable, it does not hold a JSON object, or it names no string
-        ``agentType``.
-    """
-    return _agent_type_from_meta_sidecar(
-        subagent_stop_payload.get("agent_transcript_path", "")
-    )
-
-
-def _attested_or_recomputed_hash(verdict_record: dict, repo_root: str) -> str | None:
-    """Choose the surface hash the minted verdict binds to.
-
-    A code-verifier that verifies a work tree other than the stop event's cwd
-    attests the surface it checked by emitting ``manifest_sha256`` in its
-    verdict fence (computed against the verified work tree via the
-    ``--manifest-hash`` CLI). Binding the minted verdict to that attested hash
-    keeps the verdict tied to the code actually verified rather than the
-    subagent's cwd, so a verdict earned for one work tree clears a commit in a
-    sibling work tree of the same surface. When the fence attests no hash, the
-    minter recomputes one from the cwd work tree, which is correct whenever the
-    verifier ran in the work tree it verified.
-
-    Returns None (mints nothing) in two empty-surface cases:
-
-    - The attested hash equals ``empty_surface_hash()`` — the verifier called
-      the store CLI on a wrong (empty) work tree and the hash it got back
-      represents nothing.
-    - The recompute branch produces an empty manifest — the cwd work tree also
-      has no changed or untracked files versus the merge base.
-
-    Args:
-        verdict_record: The parsed verdict fence from the verifier transcript.
-        repo_root: The work-tree root resolved from the stop event's cwd, used
-            for the recompute fallback.
-
-    Returns:
-        The attested ``manifest_sha256`` when the fence carries a non-empty
-        string one that is not the empty-surface sentinel; the cwd work tree's
-        recomputed surface hash when the fence attests nothing and the surface
-        is non-empty; or None when the attested hash is the empty-surface
-        sentinel, the surface manifest is empty, or no upstream base resolves.
-    """
-    attested_manifest_sha256 = verdict_record.get(VERDICT_KEY_MANIFEST_SHA256)
-    if isinstance(attested_manifest_sha256, str) and attested_manifest_sha256:
-        if attested_manifest_sha256 == empty_surface_hash():
-            return None
-        return attested_manifest_sha256
-    merge_base_sha = resolve_merge_base(repo_root)
-    if merge_base_sha is None:
-        return None
-    surface_manifest_text = branch_surface_manifest(repo_root, merge_base_sha)
-    if not surface_manifest_text:
-        return None
-    return manifest_sha256(surface_manifest_text)
-
-
-def mint_for_payload(subagent_stop_payload: dict) -> Path | None:
-    """Mint a verdict file for a code-verifier stop event.
-
-    Args:
-        subagent_stop_payload: The SubagentStop hook payload.
-
-    Returns:
-        The verdict file path when minted; None when the payload is not a
-        code-verifier stop, the transcript holds no verdict, the cwd is not a
-        work tree, or — for a verdict that attests no ``manifest_sha256`` of
-        its own — that work tree has no upstream base to recompute the surface
-        hash from.
-    """
-    if resolved_subagent_type(subagent_stop_payload) != MINTING_AGENT_TYPE:
-        return None
-    agent_transcript_path = subagent_stop_payload.get("agent_transcript_path", "")
-    if not agent_transcript_path:
-        return None
-    verdict_record = last_verdict_in_blocks(assistant_text_blocks(agent_transcript_path))
-    if verdict_record is None:
-        return None
-    repo_root = resolve_repo_root(subagent_stop_payload.get("cwd", "."))
-    if repo_root is None:
-        return None
-    bound_manifest_sha256 = _attested_or_recomputed_hash(verdict_record, repo_root)
-    if bound_manifest_sha256 is None:
-        return None
-    return write_verdict(
-        repo_root,
-        bound_manifest_sha256,
-        verdict_record["all_pass"],
-        verdict_record["findings"],
-        str(subagent_stop_payload.get("agent_id", "")),
-    )
-
-
-def main() -> None:
-    """Read the SubagentStop payload and mint a verdict when one applies."""
-    try:
-        subagent_stop_payload = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        return
-    if not isinstance(subagent_stop_payload, dict):
-        return
-    mint_for_payload(subagent_stop_payload)
-
-
-if __name__ == "__main__":
-    main()
+"""SubagentStop hook: mint a commit-gate verdict when code-verifier finishes.
+
+Only this hook writes verdict files — the main session is denied writes to
+the verdict directory, so a session cannot fabricate a passing verdict. The
+SubagentStop payload names the stopping subagent's own transcript
+(``agent_transcript_path``), which sits beside a harness-written
+``agent-<id>.meta.json`` sidecar naming the spawning ``agentType``. The hook
+reads that type from the sidecar, so it resolves identically in interactive,
+background, and worktree-switched sessions; only the harness writes the
+sidecar, so the type it records cannot be forged. When that type is
+``code-verifier``, the hook pulls the verdict block out of the agent's own
+transcript (``agent_transcript_path``), recomputes the live change-surface
+hash for the session repository, and writes the verdict bound to that hash.
+The companion ``verified_commit_gate.py`` (PreToolUse) then allows ``git
+commit`` / ``git push`` only while the work tree still matches the verified
+state.
+
+The verifier's final message must end with a fenced block::
+
+    ```verdict
+    {"all_pass": true, "findings": []}
+    ```
+
+A missing or unparseable block mints nothing, which leaves the gate closed.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+from pathlib import Path
+
+blocking_directory = str(Path(__file__).resolve().parent)
+if blocking_directory not in sys.path:
+    sys.path.insert(0, blocking_directory)
+
+from verified_commit_config_bootstrap import (  # noqa: E402
+    register_verified_commit_constants,
+)
+
+register_verified_commit_constants()
+
+from config.verified_commit_constants import (
+    MINTING_AGENT_TYPE,
+    VERDICT_KEY_MANIFEST_SHA256,
+)
+from verification_verdict_store import (
+    branch_surface_manifest,
+    empty_surface_hash,
+    manifest_sha256,
+    resolve_merge_base,
+    resolve_repo_root,
+    write_verdict,
+)
+
+
+def assistant_text_blocks(transcript_path: str) -> list[str]:
+    """Collect every assistant text block from a transcript JSONL file.
+
+    Args:
+        transcript_path: Path to the subagent's transcript.
+
+    Returns:
+        The text of each assistant content block, in transcript order;
+        empty when the file is missing or holds no assistant text.
+    """
+    collected_blocks: list[str] = []
+    try:
+        transcript_lines = (
+            Path(transcript_path).read_text(encoding="utf-8", errors="replace").splitlines()
+        )
+    except OSError:
+        return collected_blocks
+    for each_line in transcript_lines:
+        try:
+            transcript_entry = json.loads(each_line)
+        except json.JSONDecodeError:
+            continue
+        if not isinstance(transcript_entry, dict):
+            continue
+        if transcript_entry.get("type") != "assistant":
+            continue
+        message_body = transcript_entry.get("message")
+        if not isinstance(message_body, dict):
+            continue
+        content_blocks = message_body.get("content")
+        if not isinstance(content_blocks, list):
+            continue
+        for each_block in content_blocks:
+            if isinstance(each_block, dict) and each_block.get("type") == "text":
+                block_text = each_block.get("text")
+                if isinstance(block_text, str):
+                    collected_blocks.append(block_text)
+    return collected_blocks
+
+
+def last_verdict_in_blocks(all_text_blocks: list[str]) -> dict | None:
+    """Extract the final verdict fence from assistant text blocks.
+
+    Args:
+        all_text_blocks: Assistant text blocks in transcript order.
+
+    Returns:
+        The parsed verdict mapping carrying a boolean ``all_pass`` and a
+        list ``findings``, or None when no block holds a wellformed fence.
+    """
+    verdict_fence_pattern = re.compile(r"```verdict\s*\n(.*?)```", re.DOTALL)
+    fence_bodies: list[str] = []
+    for each_block in all_text_blocks:
+        fence_bodies.extend(verdict_fence_pattern.findall(each_block))
+    for each_fence_body in reversed(fence_bodies):
+        try:
+            verdict_record = json.loads(each_fence_body)
+        except json.JSONDecodeError:
+            continue
+        if not isinstance(verdict_record, dict):
+            continue
+        if not isinstance(verdict_record.get("all_pass"), bool):
+            continue
+        if not isinstance(verdict_record.get("findings"), list):
+            continue
+        return verdict_record
+    return None
+
+
+def _agent_type_from_meta_sidecar(agent_transcript_path: str) -> str | None:
+    """Read the spawning agentType from a subagent transcript's sidecar.
+
+    Each subagent transcript ``agent-<id>.jsonl`` sits beside a harness-written
+    ``agent-<id>.meta.json`` naming the spawning ``agentType``. Reading the type
+    from this sidecar binds it to the stopping subagent itself, so it resolves
+    identically in interactive, background, and worktree-switched sessions and
+    needs no parent-transcript scan or flush retry. Only the harness writes this
+    sidecar, so a session cannot forge the type it reports.
+
+    Args:
+        agent_transcript_path: The stopping subagent's own transcript path from
+            the SubagentStop payload.
+
+    Returns:
+        The recorded ``agentType``, or None when the path is empty, the sidecar
+        is absent, unreadable, or unparseable, it does not hold a JSON object,
+        or it names no string ``agentType``.
+    """
+    if not agent_transcript_path:
+        return None
+    transcript_file = Path(agent_transcript_path)
+    sidecar_file = transcript_file.with_name(f"{transcript_file.stem}.meta.json")
+    try:
+        sidecar_record = json.loads(sidecar_file.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError):
+        return None
+    if not isinstance(sidecar_record, dict):
+        return None
+    recorded_type = sidecar_record.get("agentType")
+    return recorded_type if isinstance(recorded_type, str) else None
+
+
+def resolved_subagent_type(subagent_stop_payload: dict) -> str | None:
+    """Recover the spawning agent type for a SubagentStop payload.
+
+    The stopping subagent's own transcript (``agent_transcript_path``) sits
+    beside a harness-written ``agent-<id>.meta.json`` sidecar naming its
+    ``agentType``. The type comes solely from that sidecar, which only the
+    harness writes — the main session can neither write the sidecar nor forge
+    the agentType it records. A verdict fence in the transcript is never used to
+    infer the type, because the main session controls the prompt of any
+    Agent-tool subagent it spawns and could instruct one to print such a fence.
+
+    Args:
+        subagent_stop_payload: The SubagentStop hook payload.
+
+    Returns:
+        The agent type the sidecar records, or None when the
+        ``agent_transcript_path`` is empty, the sidecar is absent, unreadable,
+        or unparseable, it does not hold a JSON object, or it names no string
+        ``agentType``.
+    """
+    return _agent_type_from_meta_sidecar(
+        subagent_stop_payload.get("agent_transcript_path", "")
+    )
+
+
+def _attested_or_recomputed_hash(verdict_record: dict, repo_root: str) -> str | None:
+    """Choose the surface hash the minted verdict binds to.
+
+    A code-verifier that verifies a work tree other than the stop event's cwd
+    attests the surface it checked by emitting ``manifest_sha256`` in its
+    verdict fence (computed against the verified work tree via the
+    ``--manifest-hash`` CLI). Binding the minted verdict to that attested hash
+    keeps the verdict tied to the code actually verified rather than the
+    subagent's cwd, so a verdict earned for one work tree clears a commit in a
+    sibling work tree of the same surface. When the fence attests no hash, the
+    minter recomputes one from the cwd work tree, which is correct whenever the
+    verifier ran in the work tree it verified.
+
+    Returns None (mints nothing) in two empty-surface cases:
+
+    - The attested hash equals ``empty_surface_hash()`` — the verifier called
+      the store CLI on a wrong (empty) work tree and the hash it got back
+      represents nothing.
+    - The recompute branch produces an empty manifest — the cwd work tree also
+      has no changed or untracked files versus the merge base.
+
+    Args:
+        verdict_record: The parsed verdict fence from the verifier transcript.
+        repo_root: The work-tree root resolved from the stop event's cwd, used
+            for the recompute fallback.
+
+    Returns:
+        The attested ``manifest_sha256`` when the fence carries a non-empty
+        string one that is not the empty-surface sentinel; the cwd work tree's
+        recomputed surface hash when the fence attests nothing and the surface
+        is non-empty; or None when the attested hash is the empty-surface
+        sentinel, the surface manifest is empty, or no upstream base resolves.
+    """
+    attested_manifest_sha256 = verdict_record.get(VERDICT_KEY_MANIFEST_SHA256)
+    if isinstance(attested_manifest_sha256, str) and attested_manifest_sha256:
+        if attested_manifest_sha256 == empty_surface_hash():
+            return None
+        return attested_manifest_sha256
+    merge_base_sha = resolve_merge_base(repo_root)
+    if merge_base_sha is None:
+        return None
+    surface_manifest_text = branch_surface_manifest(repo_root, merge_base_sha)
+    if not surface_manifest_text:
+        return None
+    return manifest_sha256(surface_manifest_text)
+
+
+def mint_for_payload(subagent_stop_payload: dict) -> Path | None:
+    """Mint a verdict file for a code-verifier stop event.
+
+    Args:
+        subagent_stop_payload: The SubagentStop hook payload.
+
+    Returns:
+        The verdict file path when minted; None when the payload is not a
+        code-verifier stop, the transcript holds no verdict, the cwd is not a
+        work tree, or — for a verdict that attests no ``manifest_sha256`` of
+        its own — that work tree has no upstream base to recompute the surface
+        hash from.
+    """
+    if resolved_subagent_type(subagent_stop_payload) != MINTING_AGENT_TYPE:
+        return None
+    agent_transcript_path = subagent_stop_payload.get("agent_transcript_path", "")
+    if not agent_transcript_path:
+        return None
+    verdict_record = last_verdict_in_blocks(assistant_text_blocks(agent_transcript_path))
+    if verdict_record is None:
+        return None
+    repo_root = resolve_repo_root(subagent_stop_payload.get("cwd", "."))
+    if repo_root is None:
+        return None
+    bound_manifest_sha256 = _attested_or_recomputed_hash(verdict_record, repo_root)
+    if bound_manifest_sha256 is None:
+        return None
+    return write_verdict(
+        repo_root,
+        bound_manifest_sha256,
+        verdict_record["all_pass"],
+        verdict_record["findings"],
+        str(subagent_stop_payload.get("agent_id", "")),
+    )
+
+
+def main() -> None:
+    """Read the SubagentStop payload and mint a verdict when one applies."""
+    try:
+        subagent_stop_payload = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        return
+    if not isinstance(subagent_stop_payload, dict):
+        return
+    mint_for_payload(subagent_stop_payload)
+
+
+if __name__ == "__main__":
+    main()

package/hooks/git-hooks/CLAUDE.md

@@ -8,12 +8,15 @@ Native git hooks that run outside the Claude Code lifecycle — invoked directly
 |---|---|---|
 | `pre_commit.py` | `pre-commit` | Runs the CODE_RULES gate (`precommit_code_rules_gate.py`) over staged changes; exits 1 when any staged file has a blocking violation |
 | `pre_push.py` | `pre-push` | Blocks a push that would land a non-`main` local branch onto remote `main` (or `master`), then runs the CODE_RULES gate over the commits about to be pushed |
+| `pre_push_base_reference.py` | — | Resolves the gate base for `pre_push.py`: reads the pushed remote name from git's arguments, then names that remote's default branch from its symbolic ref or its candidate default branches |
 | `post_commit.py` | `post-commit` | Runs after a commit lands; performs any post-commit bookkeeping |
 | `gate_utils.py` | — | Shared helpers: resolves the gate script path, checks that the path is a safe regular file |
 | `test_config.py` | — | Test configuration helpers |
 | `test_gate_utils.py` | — | Tests for `gate_utils.py` |
 | `test_pre_commit.py` | — | Tests for `pre_commit.py` |
 | `test_pre_push.py` | — | Tests for `pre_push.py` |
+| `test_pre_push_base_reference.py` | — | Tests for the gate base resolution in `pre_push.py` |
+| `conftest.py` | — | Puts this directory on `sys.path` and clears cached `config` modules, so each test module imports the hooks at the top of the file |
 
 ## Subdirectory
 

package/hooks/git-hooks/conftest.py

@@ -0,0 +1,30 @@
+"""Put this directory on ``sys.path`` before the git-hook test modules import.
+
+The git-hook entry points sit beside their constants package rather than inside
+an installed package, so ``import pre_push`` resolves only once this directory
+leads ``sys.path``. Pytest loads a conftest before the test modules it covers,
+so doing the insertion here lets each test module import the hooks at the top
+of the file.
+"""
+
+from __future__ import annotations
+
+import importlib
+import sys
+from pathlib import Path
+
+
+_GIT_HOOKS_DIRECTORY_STRING = str(Path(__file__).resolve().parent)
+_CONFIG_PACKAGE_NAME = "config"
+_CONFIG_PACKAGE_PREFIX = "config."
+
+while _GIT_HOOKS_DIRECTORY_STRING in sys.path:
+    sys.path.remove(_GIT_HOOKS_DIRECTORY_STRING)
+sys.path.insert(0, _GIT_HOOKS_DIRECTORY_STRING)
+
+for each_module_name in list(sys.modules):
+    if each_module_name == _CONFIG_PACKAGE_NAME or each_module_name.startswith(
+        _CONFIG_PACKAGE_PREFIX
+    ):
+        del sys.modules[each_module_name]
+importlib.invalidate_caches()

package/hooks/git-hooks/gate_utils.py

@@ -7,10 +7,10 @@ import stat
 from pathlib import Path
 
 from git_hooks_constants import (
+    ALL_GATE_SCRIPT_RELATIVE_PATH,
     CLAUDE_HOME_DEFAULT_SUBDIRECTORY,
     CLAUDE_HOME_ENV_VAR,
     GATE_PATH_OVERRIDE_ENV_VAR,
-    GATE_SCRIPT_RELATIVE_PATH,
 )
 
 
@@ -34,7 +34,7 @@ def resolve_gate_script_path() -> tuple[Path, Path | None]:
         claude_home_directory = Path(claude_home_override).resolve()
     else:
         claude_home_directory = Path.home() / CLAUDE_HOME_DEFAULT_SUBDIRECTORY
-    gate_path = claude_home_directory.joinpath(*GATE_SCRIPT_RELATIVE_PATH)
+    gate_path = claude_home_directory.joinpath(*ALL_GATE_SCRIPT_RELATIVE_PATH)
     return gate_path, None