claude-dev-env 2.5.0 → 2.7.0

package/hooks/hooks.json

@@ -202,18 +202,6 @@
         ]
       }
     ],
-    "SubagentStop": [
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/verifier_verdict_minter.py",
-            "timeout": 30
-          }
-        ]
-      }
-    ],
     "SessionEnd": [
       {
         "matcher": "",

package/hooks/hooks_constants/CLAUDE.md

@@ -31,6 +31,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `duplicate_function_body_constants.py` | Hashing and comparison config for the duplicate-body check |
 | `duplicate_rmtree_helper_blocker_constants.py` | Sanctioned Windows-safe rmtree helper names, the definition pattern, and the exempt-path set for the duplicate-rmtree-helper blocker |
 | `dynamic_stderr_handler.py` | `DynamicStderrHandler` — a logging handler that resolves `sys.stderr` at emit time (for testability) |
+| `eli11_reply_enforcer_constants.py` | Reply-shape thresholds (word cap, enforced word floor, bullet cap, lead-line window, per-line word cap, over-packed line cap), the `Long form:` escape prefix, the bullet / numbered-step / table-row / link-target / word patterns, the imperative instruction verbs, and the user-facing notice for the ELI11 reply-shape Stop hook |
 | `gh_pr_author_swap_constants.py` | Constants for the PR-author swap enforcement hooks |
 | `hardcoded_user_path_constants.py` | Patterns for detecting hardcoded home-directory paths |
 | `harness_scratchpad_constants.py` | Fixed path components (`claude` / `claude-` user-directory name and prefix, `scratchpad` leaf name), the PreToolUse session-id payload key, and the `CLAUDE_CODE_SESSION_ID` environment variable name that the code-rules and TDD gates use to recognize an existing harness session scratchpad directory |
@@ -45,7 +46,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `multi_edit_reconstruction.py` | `apply_edits()` / `edits_for_tool()` — shared helpers that reconstruct the post-edit content of an Edit or MultiEdit, imported by the blockers that judge post-edit content |
 | `mypy_integration_constants.py` | Path markers (``.git``, ``.py``, ``pyproject.toml``) for mypy project-root resolution |
 | `mypy_validator_cache_constants.py` | Cache paths and tunables for the mypy_validator per-session caches |
-| `nas_ssh_binary_enforcer_constants.py` | Bash tool name, ssh-family basenames, OpenSSH binary path suffixes, launcher-wrapper set, shell control-operator tokens and split pattern, leading-assignment and duration patterns, and the batch-mode pattern for the NAS ssh binary enforcer |
+| `nas_ssh_binary_enforcer_constants.py` | Bash tool name, ssh-family basenames, OpenSSH binary path suffixes, and the batch-mode pattern for the NAS ssh binary enforcer; segment helpers come from `shell_command_segments.py` |
 | `open_questions_in_plans_blocker_constants.py` | Patterns for detecting unresolved open questions in plan documents |
 | `orphan_css_class_constants.py` | Scan radius and selector patterns for the orphan-CSS-class check |
 | `package_inventory_stale_blocker_constants.py` | Inventory document names, production code extensions, backtick token pattern, smallest inventory size, exempt names, scan budget, and block-message text for the package-inventory stale-entry blocker |
@@ -71,6 +72,8 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `session_env_cleanup_constants.py` | Stale-age threshold and directory names for the session-env cleanup hook |
 | `session_handoff_blocker_constants.py` | Trigger phrases for the session-handoff blocker |
 | `setup_project_paths_constants.py` | Encoding policy, BOM marker, and registry meta-key used across multiple hooks |
+| `shell_command_segments.py` | Shell tokenization helpers shared by the segment-walking blockers: segment splitting on control operators, a segment's effective leading program, and a token's basename |
+| `shell_substitution_blocker_constants.py` | Tool name, payload keys, the four substitution-detection patterns, the deny decision shape, and the corrective message for the shell-substitution blocker |
 | `stale_comment_reference_blocker_constants.py` | Identifier pattern, comment stopwords, and denial text for the stale-comment-reference blocker |
 | `state_description_blocker_constants.py` | The set of historical/comparative phrases the state-description blocker rejects, plus the docstring-extraction and mention-span patterns for its Python docstring scan |
 | `stop_dispatcher_constants.py` | Ordered hosted-hook roster and Stop block payload field names for the Stop-chain dispatcher |
@@ -81,6 +84,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `task_list_loop_starter_constants.py` | The one-line task-list instruction and the full session-start directive text for the task-list loop starter hook |
 | `test_layout_constants.py` | The named constants for the test-layout write-time checks |
 | `text_stripping.py` | `strip_code_and_quotes()` — shared helper that removes fenced code blocks, inline code, and blockquotes from prose, imported by the Stop-hook prose blockers |
+| `unscoped_search_blocker_constants.py` | Tool names, `find` and listing program basenames, Get-ChildItem option sets, unscoped-root patterns, the flag/value token stride, and the deny message for the unscoped-search blocker |
 | `unused_module_import_constants.py` | Patterns for detecting unused module-level imports |
 | `volatile_path_in_post_blocker_constants.py` | Volatile path markers, affected `gh` post subcommands, MCP body param names, and the corrective message for the volatile-path post blocker |
 | `windows_rmtree_blocker_constants.py` | The unsafe `shutil.rmtree` pattern and the safe replacement pattern |

package/hooks/hooks_constants/bash_pre_tool_use_dispatcher_constants.py

@@ -56,6 +56,10 @@ ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
     BashHostedHookEntry("blocking/es_exe_path_rewriter.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/destructive_command_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/gh_body_arg_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
+    BashHostedHookEntry("blocking/shell_substitution_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
+    BashHostedHookEntry(
+        "blocking/unscoped_search_blocker.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES
+    ),
     BashHostedHookEntry("blocking/nas_ssh_binary_enforcer.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/volatile_path_in_post_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry(
@@ -71,10 +75,6 @@ ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
     BashHostedHookEntry("blocking/convergence_gate_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/windows_rmtree_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/gh_pr_author_enforcer.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry("blocking/verified_commit_gate.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES),
-    BashHostedHookEntry(
-        "blocking/verdict_directory_write_blocker.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES
-    ),
     BashHostedHookEntry("blocking/code_review_push_gate.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES),
     BashHostedHookEntry(
         "blocking/code_review_pr_create_gate.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES

package/hooks/hooks_constants/eli11_reply_enforcer_constants.py

@@ -0,0 +1,101 @@
+"""Tunables for the eli11_reply_enforcer Stop hook.
+
+::
+
+    NUMBERED_STEP_PATTERN
+        ok:   "1. Run the script"      flag: "1.5% of hosts still fail."
+    ALL_IMPERATIVE_OBJECT_LEAD_WORDS
+        ok:   "Run the migration"      flag: "Run time stays under a second"
+
+Holds the reply-shape thresholds the `eli11-replies` rule names, the compiled
+patterns that read a reply's structure, the closed sets naming an instruction
+verb and its object, and the notice the hook shows when it blocks.
+"""
+
+import re
+
+__all__ = [
+    "ACTION_FIRST_LEAD_LINE_COUNT",
+    "ALL_IMPERATIVE_INSTRUCTION_VERBS",
+    "ALL_IMPERATIVE_OBJECT_LEAD_WORDS",
+    "ALPHABETIC_WORD_PATTERN",
+    "BULLET_LINE_PATTERN",
+    "COUNTABLE_WORD_PATTERN",
+    "IMPERATIVE_OBJECT_TOKEN_PATTERN",
+    "LINK_TARGET_PATTERN",
+    "LIST_MARKER_PREFIX_PATTERN",
+    "LONG_FORM_ESCAPE_PREFIX",
+    "MARKDOWN_LEAD_MARKER_PATTERN",
+    "MAXIMUM_BULLET_LINE_COUNT",
+    "MAXIMUM_OVERPACKED_LINE_COUNT",
+    "MAXIMUM_REPLY_WORD_COUNT",
+    "MAXIMUM_WORDS_PER_LINE",
+    "MINIMUM_ENFORCED_WORD_COUNT",
+    "NUMBERED_STEP_PATTERN",
+    "TABLE_ROW_PATTERN",
+    "TARGET_BULLET_LINE_COUNT",
+    "USER_FACING_ELI11_NOTICE",
+    "VIOLATION_SEPARATOR",
+]
+
+MAXIMUM_REPLY_WORD_COUNT = 120
+MINIMUM_ENFORCED_WORD_COUNT = 60
+MAXIMUM_BULLET_LINE_COUNT = 6
+TARGET_BULLET_LINE_COUNT = 3
+ACTION_FIRST_LEAD_LINE_COUNT = 6
+MAXIMUM_WORDS_PER_LINE = 20
+MAXIMUM_OVERPACKED_LINE_COUNT = 2
+
+LONG_FORM_ESCAPE_PREFIX = "long form:"
+VIOLATION_SEPARATOR = "; "
+USER_FACING_ELI11_NOTICE = "Agent wrote a long reply - rewriting it short..."
+
+TABLE_ROW_PATTERN = re.compile(r"^[ \t]*\|.*\|[ \t]*$", re.MULTILINE)
+LINK_TARGET_PATTERN = re.compile(r"(?:https?://|www\.)\S+", re.IGNORECASE)
+COUNTABLE_WORD_PATTERN = re.compile(r"\S*[A-Za-z0-9]\S*")
+ALPHABETIC_WORD_PATTERN = re.compile(r"[A-Za-z][A-Za-z'’-]*")
+BULLET_LINE_PATTERN = re.compile(r"^[ \t]*[-*+][ \t]+\S")
+NUMBERED_STEP_PATTERN = re.compile(r"^[ \t]*(?:\*\*)?\d{1,2}[.)](?:\*\*)?[ \t]+\S")
+LIST_MARKER_PREFIX_PATTERN = re.compile(
+    r"^[ \t]*(?:[-*+][ \t]+|(?:\*\*)?\d{1,2}[.)][ \t]*)?(?:\*\*)?"
+)
+MARKDOWN_LEAD_MARKER_PATTERN = re.compile(r"^(?:[ \t]*(?:>+|#{1,6}|\*\*|__|\*|_))+[ \t]*")
+
+ALL_IMPERATIVE_INSTRUCTION_VERBS = (
+    "click",
+    "copy",
+    "delete",
+    "do",
+    "download",
+    "install",
+    "merge",
+    "open",
+    "paste",
+    "restart",
+    "run",
+    "save",
+)
+
+ALL_IMPERATIVE_OBJECT_LEAD_WORDS = (
+    "a",
+    "all",
+    "an",
+    "any",
+    "both",
+    "each",
+    "every",
+    "into",
+    "it",
+    "my",
+    "our",
+    "that",
+    "the",
+    "them",
+    "these",
+    "this",
+    "those",
+    "to",
+    "your",
+)
+
+IMPERATIVE_OBJECT_TOKEN_PATTERN = re.compile(r"^\d|[`/\\]|\.[A-Za-z]{1,4}$")

package/hooks/hooks_constants/nas_ssh_binary_enforcer_constants.py

@@ -1,9 +1,8 @@
 """Constants for the NAS ssh binary enforcer hook.
 
 Holds the Bash tool name, the ssh-family command basenames, the Windows OpenSSH
-binary path suffixes, the launcher-wrapper set, the shell control-operator tokens
-and their split pattern, the leading-assignment and launcher-duration patterns,
-and the batch-mode pattern.
+binary path suffixes, and the batch-mode pattern. Segment splitting and
+leading-program resolution come from ``shell_command_segments``.
 """
 
 import re
@@ -18,9 +17,4 @@ ALL_OPENSSH_BINARY_PATH_SUFFIXES = (
     "/openssh/scp.exe",
     "/openssh/sftp.exe",
 )
-ALL_LAUNCHER_WRAPPER_COMMANDS = frozenset({"timeout", "nohup", "nice", "stdbuf", "setsid", "env"})
-ALL_SHELL_CONTROL_OPERATOR_TOKENS = frozenset({"&&", "||", ";", "|", "&", "|&"})
-CONTROL_OPERATOR_SPLIT_PATTERN = re.compile(r"(&&|\|\||;|\|&|\||(?<!>)&(?!>))")
-LEADING_ASSIGNMENT_PATTERN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=")
-LAUNCHER_DURATION_PATTERN = re.compile(r"^\d+[a-z]*$", re.IGNORECASE)
 BATCH_MODE_PATTERN = re.compile(r"batchmode\s*=\s*yes", re.IGNORECASE)

package/hooks/hooks_constants/shell_command_segments.py

@@ -0,0 +1,82 @@
+"""Shared shell-command segment helpers for Bash PreToolUse blockers.
+
+Tokenizes a command into simple-command segments on control operators and finds
+each segment's effective leading program after env assignments and launcher
+wrappers. NAS ssh enforcement and unscoped-search blocking both need this
+shape, so one module owns it.
+"""
+
+from __future__ import annotations
+
+import re
+
+__all__ = [
+    "ALL_LAUNCHER_WRAPPER_COMMANDS",
+    "ALL_SHELL_CONTROL_OPERATOR_TOKENS",
+    "CONTROL_OPERATOR_SPLIT_PATTERN",
+    "LEADING_ASSIGNMENT_PATTERN",
+    "LAUNCHER_DURATION_PATTERN",
+    "token_basename",
+    "split_into_segments",
+    "effective_leading_program",
+]
+
+ALL_LAUNCHER_WRAPPER_COMMANDS: frozenset[str] = frozenset(
+    {"timeout", "nohup", "nice", "stdbuf", "setsid", "env"}
+)
+ALL_SHELL_CONTROL_OPERATOR_TOKENS: frozenset[str] = frozenset(
+    {"&&", "||", ";", "|", "&", "|&"}
+)
+CONTROL_OPERATOR_SPLIT_PATTERN = re.compile(r"(&&|\|\||;|\|&|\||(?<!>)&(?!>))")
+LEADING_ASSIGNMENT_PATTERN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=")
+LAUNCHER_DURATION_PATTERN = re.compile(r"^\d+[a-z]*$", re.IGNORECASE)
+
+
+def token_basename(token: str) -> str:
+    """Return the lowercased basename of a path-or-command token."""
+    return token.replace("\\", "/").rsplit("/", 1)[-1].lower()
+
+
+def split_into_segments(all_command_tokens: list[str]) -> list[list[str]]:
+    """Split tokens into simple-command segments on shell control operators.
+
+    Glued operators on a single token are exploded first, then the stream is
+    cut on ``&&`` / ``||`` / ``;`` / ``|`` / ``&`` / ``|&``.
+    """
+    all_exploded_tokens: list[str] = []
+    for each_token in all_command_tokens:
+        for each_fragment in CONTROL_OPERATOR_SPLIT_PATTERN.split(each_token):
+            if each_fragment:
+                all_exploded_tokens.append(each_fragment)
+    all_segments: list[list[str]] = []
+    current_segment: list[str] = []
+    for each_token in all_exploded_tokens:
+        if each_token in ALL_SHELL_CONTROL_OPERATOR_TOKENS:
+            all_segments.append(current_segment)
+            current_segment = []
+            continue
+        current_segment.append(each_token)
+    all_segments.append(current_segment)
+    return all_segments
+
+
+def effective_leading_program(all_segment_tokens: list[str]) -> str | None:
+    """Return the effective program token after assignments and launcher wrappers.
+
+    Skips ``VAR=value`` prefixes and known launchers (``timeout``, ``env``, …)
+    plus their flags and duration arguments. Returns None when no program token
+    remains.
+    """
+    has_seen_launcher_wrapper = False
+    for each_token in all_segment_tokens:
+        if LEADING_ASSIGNMENT_PATTERN.match(each_token):
+            continue
+        if token_basename(each_token) in ALL_LAUNCHER_WRAPPER_COMMANDS:
+            has_seen_launcher_wrapper = True
+            continue
+        if has_seen_launcher_wrapper and (
+            each_token.startswith("-") or LAUNCHER_DURATION_PATTERN.match(each_token)
+        ):
+            continue
+        return each_token
+    return None

package/hooks/hooks_constants/shell_substitution_blocker_constants.py

@@ -0,0 +1,67 @@
+"""Constants for the shell-substitution PreToolUse Bash blocker.
+
+Holds the tool name, the payload keys, the four detection patterns, the deny
+decision shape, and the corrective message. The hook imports these so no
+single-use constant sits at its file scope.
+"""
+
+from __future__ import annotations
+
+import re
+
+__all__ = [
+    "BASH_TOOL_NAME",
+    "TOOL_NAME_KEY",
+    "TOOL_INPUT_KEY",
+    "COMMAND_KEY",
+    "HOOK_SPECIFIC_OUTPUT_KEY",
+    "HOOK_EVENT_NAME_KEY",
+    "HOOK_EVENT_NAME",
+    "PERMISSION_DECISION_KEY",
+    "DENY_DECISION",
+    "PERMISSION_DECISION_REASON_KEY",
+    "DOLLAR_PAREN_PATTERN",
+    "EVEN_BACKSLASH_BACKTICK_PATTERN",
+    "PROCESS_SUBSTITUTION_PATTERN",
+    "SINGLE_QUOTED_RUN_PATTERN",
+    "STRIPPED_RUN_REPLACEMENT",
+    "CORRECTIVE_MESSAGE",
+]
+
+BASH_TOOL_NAME = "Bash"
+
+TOOL_NAME_KEY = "tool_name"
+TOOL_INPUT_KEY = "tool_input"
+COMMAND_KEY = "command"
+
+HOOK_SPECIFIC_OUTPUT_KEY = "hookSpecificOutput"
+HOOK_EVENT_NAME_KEY = "hookEventName"
+HOOK_EVENT_NAME = "PreToolUse"
+PERMISSION_DECISION_KEY = "permissionDecision"
+DENY_DECISION = "deny"
+PERMISSION_DECISION_REASON_KEY = "permissionDecisionReason"
+
+DOLLAR_PAREN_PATTERN = re.compile(r"\$\((?!\()")
+EVEN_BACKSLASH_BACKTICK_PATTERN = re.compile(r"(?<!\\)(?:\\\\)*`")
+PROCESS_SUBSTITUTION_PATTERN = re.compile(r"[<>]\(")
+SINGLE_QUOTED_RUN_PATTERN = re.compile(r"'[^']*'")
+STRIPPED_RUN_REPLACEMENT = ""
+
+CORRECTIVE_MESSAGE = (
+    "BLOCKED [shell-substitution]: command contains $(...), backtick, or "
+    "<(...)/>(...) process substitution, which forces a permission prompt "
+    "because the Claude Code allowlist matcher does not descend into "
+    "substitutions.\n\n"
+    "Fix: split into two Bash tool calls, or rewrite without substitution.\n"
+    '  cd X && echo "$(git rev-parse HEAD)"\n'
+    "becomes either two calls:\n"
+    "  1) cd X\n"
+    "  2) git rev-parse HEAD\n"
+    "or one substitution-free call:\n"
+    "  git -C X rev-parse HEAD\n\n"
+    "Process substitution example:\n"
+    "  diff <(cat a) <(cat b)\n"
+    "becomes two separate Bash calls to `cat a` and `cat b`, with the diff "
+    "performed on the captured outputs.\n\n"
+    "See `shell-invocation.md` in the rules directory for full guidance."
+)

package/hooks/hooks_constants/stop_dispatcher_constants.py

@@ -22,5 +22,6 @@ ALL_STOP_HOSTED_HOOK_PATHS: tuple[str, ...] = (
     "blocking/question_to_user_enforcer.py",
     "blocking/intent_only_ending_blocker.py",
     "blocking/session_handoff_blocker.py",
+    "blocking/eli11_reply_enforcer.py",
     "diagnostic/hook_log_stop_wrapper.py",
 )

package/hooks/hooks_constants/test_bash_pre_tool_use_dispatcher_constants.py

@@ -25,6 +25,8 @@ _EXPECTED_BASH_ORDER = (
     "blocking/es_exe_path_rewriter.py",
     "blocking/destructive_command_blocker.py",
     "blocking/gh_body_arg_blocker.py",
+    "blocking/shell_substitution_blocker.py",
+    "blocking/unscoped_search_blocker.py",
     "blocking/nas_ssh_binary_enforcer.py",
     "blocking/volatile_path_in_post_blocker.py",
     "blocking/pii_prevention_blocker.py",
@@ -38,17 +40,14 @@ _EXPECTED_BASH_ORDER = (
     "blocking/convergence_gate_blocker.py",
     "blocking/windows_rmtree_blocker.py",
     "blocking/gh_pr_author_enforcer.py",
-    "blocking/verified_commit_gate.py",
-    "blocking/verdict_directory_write_blocker.py",
     "blocking/code_review_push_gate.py",
     "blocking/code_review_pr_create_gate.py",
     "blocking/code_review_stamp_directory_write_blocker.py",
 )
 
 _POWERSHELL_APPLICABLE = (
+    "blocking/unscoped_search_blocker.py",
     "blocking/pii_prevention_blocker.py",
-    "blocking/verified_commit_gate.py",
-    "blocking/verdict_directory_write_blocker.py",
     "blocking/code_review_push_gate.py",
     "blocking/code_review_pr_create_gate.py",
     "blocking/code_review_stamp_directory_write_blocker.py",
@@ -69,8 +68,8 @@ def test_every_hook_applies_to_the_bash_tool() -> None:
         assert BASH_TOOL_NAME in each_entry.applicable_tool_names
 
 
-def test_powershell_applicable_hooks_include_pii_and_verified_commit_pair() -> None:
-    """PowerShell runs the PII gate plus the verified-commit pair."""
+def test_powershell_applicable_hooks_include_the_shared_gates() -> None:
+    """PowerShell runs the unscoped-search and PII gates plus the review family."""
     powershell_hooks = tuple(
         each_entry.script_relative_path
         for each_entry in ALL_BASH_HOSTED_HOOK_ENTRIES

package/hooks/hooks_constants/test_stop_dispatcher_constants.py

@@ -16,6 +16,7 @@ _EXPECTED_STOP_ORDER = (
     "blocking/question_to_user_enforcer.py",
     "blocking/intent_only_ending_blocker.py",
     "blocking/session_handoff_blocker.py",
+    "blocking/eli11_reply_enforcer.py",
     "diagnostic/hook_log_stop_wrapper.py",
 )
 

package/hooks/hooks_constants/unscoped_search_blocker_constants.py

@@ -0,0 +1,153 @@
+"""Constants for the unscoped-search PreToolUse Bash/PowerShell blocker.
+
+Holds tool names, program basenames, Get-ChildItem option sets, the clustered
+short-option pattern, unscoped root patterns (drive root, posix root alias, UNC
+share root), the shared flag/value token stride, and the deny message. Find
+global option flags reuse ``destructive_command_segment_constants`` so both find
+parsers stay on one set.
+"""
+
+from __future__ import annotations
+
+import re
+
+from hooks_constants.destructive_command_segment_constants import (
+    ALL_FIND_GLOBAL_OPTION_FLAGS_TAKING_A_VALUE,
+    ALL_FIND_GLOBAL_OPTION_FLAGS_WITHOUT_VALUE,
+    FIND_OPTIMIZATION_LEVEL_OPTION_PREFIX,
+)
+
+__all__ = [
+    "BASH_TOOL_NAME",
+    "POWERSHELL_TOOL_NAME",
+    "ALL_SUPPORTED_TOOL_NAMES",
+    "ALL_FIND_PROGRAM_BASENAMES",
+    "ALL_POWERSHELL_LISTING_PROGRAM_BASENAMES",
+    "ALL_UNIX_LS_PROGRAM_BASENAMES",
+    "ALL_LISTING_PROGRAM_BASENAMES",
+    "ALL_FIND_GLOBAL_OPTION_FLAGS_WITHOUT_VALUE",
+    "ALL_FIND_GLOBAL_OPTION_FLAGS_TAKING_A_VALUE",
+    "FIND_OPTIMIZATION_LEVEL_OPTION_PREFIX",
+    "FLAG_AND_VALUE_TOKEN_STRIDE",
+    "ALL_FIND_EXPRESSION_INTRODUCER_TOKENS",
+    "ALL_POWERSHELL_RECURSE_FLAGS",
+    "ALL_UNIX_LS_RECURSE_FLAGS",
+    "UNIX_LS_RECURSE_SHORT_OPTION_LETTER",
+    "CLUSTERED_SHORT_OPTION_PATTERN",
+    "ALL_POWERSHELL_RECURSE_FLAG_PREFIXES",
+    "ALL_POWERSHELL_PATH_FLAGS",
+    "ALL_POWERSHELL_PATH_FLAG_PREFIXES",
+    "ALL_TRUTHY_RECURSE_COLON_VALUES",
+    "ALL_STRING_EXECUTING_SHELL_BASENAMES",
+    "ALL_STRING_EXEC_COMMAND_FLAGS",
+    "ALL_UNSCOPED_HOME_LITERALS_CASEFOLD",
+    "GIT_BASH_DRIVE_ROOT_PATTERN",
+    "WINDOWS_DRIVE_ROOT_PATTERN",
+    "POSIX_ROOT_ALIAS_PATTERN",
+    "UNC_SHARE_ROOT_PATTERN",
+    "HOOK_EVENT_NAME",
+    "DENY_DECISION",
+    "CALLING_HOOK_NAME",
+    "CORRECTIVE_MESSAGE",
+]
+
+BASH_TOOL_NAME = "Bash"
+POWERSHELL_TOOL_NAME = "PowerShell"
+ALL_SUPPORTED_TOOL_NAMES: frozenset[str] = frozenset(
+    {BASH_TOOL_NAME, POWERSHELL_TOOL_NAME}
+)
+
+ALL_FIND_PROGRAM_BASENAMES: frozenset[str] = frozenset({"find", "find.exe"})
+ALL_POWERSHELL_LISTING_PROGRAM_BASENAMES: frozenset[str] = frozenset(
+    {"get-childitem", "gci", "dir"}
+)
+ALL_UNIX_LS_PROGRAM_BASENAMES: frozenset[str] = frozenset({"ls", "ls.exe"})
+ALL_LISTING_PROGRAM_BASENAMES: frozenset[str] = (
+    ALL_POWERSHELL_LISTING_PROGRAM_BASENAMES | ALL_UNIX_LS_PROGRAM_BASENAMES
+)
+
+FLAG_AND_VALUE_TOKEN_STRIDE = 2
+ALL_FIND_EXPRESSION_INTRODUCER_TOKENS: frozenset[str] = frozenset({"!", "(", ")"})
+
+ALL_POWERSHELL_RECURSE_FLAGS: frozenset[str] = frozenset(
+    {"-recurse", "-r", "-rec", "/s"}
+)
+ALL_UNIX_LS_RECURSE_FLAGS: frozenset[str] = frozenset({"-R", "--recursive"})
+UNIX_LS_RECURSE_SHORT_OPTION_LETTER = "R"
+CLUSTERED_SHORT_OPTION_PATTERN = re.compile(r"^-[A-Za-z]+$")
+ALL_POWERSHELL_RECURSE_FLAG_PREFIXES: tuple[str, ...] = (
+    "-recurse:",
+    "-r:",
+)
+ALL_POWERSHELL_PATH_FLAGS: frozenset[str] = frozenset(
+    {"-path", "-literalpath", "-lp"}
+)
+ALL_POWERSHELL_PATH_FLAG_PREFIXES: tuple[str, ...] = (
+    "-path:",
+    "-literalpath:",
+    "-lp:",
+)
+ALL_TRUTHY_RECURSE_COLON_VALUES: frozenset[str] = frozenset(
+    {"$true", "true", "1", "yes", "on"}
+)
+
+ALL_STRING_EXECUTING_SHELL_BASENAMES: frozenset[str] = frozenset(
+    {
+        "bash",
+        "bash.exe",
+        "sh",
+        "sh.exe",
+        "pwsh",
+        "pwsh.exe",
+        "powershell",
+        "powershell.exe",
+    }
+)
+ALL_STRING_EXEC_COMMAND_FLAGS: frozenset[str] = frozenset(
+    {"-c", "-lc", "-command", "-encodedcommand"}
+)
+
+_ALL_UNSCOPED_HOME_LITERALS: frozenset[str] = frozenset(
+    {
+        "~",
+        "~/",
+        "~\\",
+        "$HOME",
+        "$HOME/",
+        "$HOME\\",
+        "${HOME}",
+        "${HOME}/",
+        "${HOME}\\",
+        "%USERPROFILE%",
+        "%USERPROFILE%\\",
+        "%USERPROFILE%/",
+        "$env:USERPROFILE",
+        "$env:USERPROFILE\\",
+        "$env:USERPROFILE/",
+        "$env:HOME",
+        "$env:HOME\\",
+        "$env:HOME/",
+    }
+)
+ALL_UNSCOPED_HOME_LITERALS_CASEFOLD: frozenset[str] = frozenset(
+    each_literal.casefold() for each_literal in _ALL_UNSCOPED_HOME_LITERALS
+)
+
+GIT_BASH_DRIVE_ROOT_PATTERN = re.compile(r"^/[a-zA-Z]/?$")
+WINDOWS_DRIVE_ROOT_PATTERN = re.compile(r"^[a-zA-Z]:[\\/]*$")
+POSIX_ROOT_ALIAS_PATTERN = re.compile(r"^/(?:\.|/)*$")
+UNC_SHARE_ROOT_PATTERN = re.compile(r"^//[^/]+/[^/]+/*$")
+
+HOOK_EVENT_NAME = "PreToolUse"
+DENY_DECISION = "deny"
+CALLING_HOOK_NAME = "unscoped_search_blocker.py"
+
+CORRECTIVE_MESSAGE = (
+    "Unscoped filesystem search blocked. Never start find/Get-ChildItem at `/`, "
+    "a drive root (`/c`, `C:\\`), bare home (`~`, `$HOME`), or a network share "
+    "root (`\\\\server\\share`). Scope the walk to a project or worktree path "
+    "(for example `find . -name '*.py'` or "
+    "`find packages/claude-dev-env -iname code_rules_gate.py`). On Windows prefer "
+    "es.exe with a path scope, or the Grep/Glob tools. Batch shell work; avoid "
+    "parallel full-tree searches that contend for the shell and lock the host."
+)

package/package.json

@@ -1,10 +1,11 @@
 {
     "name": "claude-dev-env",
-    "version": "2.5.0",
+    "version": "2.7.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {
-        "claude-dev-env": "bin/install.mjs"
+        "claude-dev-env": "bin/install.mjs",
+        "codex-compat": "bin/codex-compat.mjs"
     },
     "scripts": {
         "test": "node --test \"bin/*.test.mjs\" \"skills/**/*.test.mjs\""
@@ -19,6 +20,7 @@
         "hooks/",
         "system-prompts/",
         "scripts/",
+        "codex-capability-map.json",
         "_shared/",
         "audit-rubrics/",
         "CLAUDE.md",