claude-dev-env 4.2.0 → 7.0.0

package/hooks/git-hooks/test_native_policy_commit.py

@@ -0,0 +1,87 @@
+"""Exercise the native Git commit boundary in disposable repositories."""
+
+from __future__ import annotations
+
+import json
+import shlex
+import subprocess
+import sys
+from pathlib import Path
+
+import pre_commit
+import pytest
+from test_pre_commit import _git, _stage
+from test_pre_commit import repository_root as repository_root
+
+
+@pytest.fixture()
+def installed_native_hook(
+    repository_root: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> Path:
+    """Install a native fixture shim pointing to the actual pre-commit owner."""
+    hook_directory = repository_root / ".git" / "fixture-native-hooks"
+    hook_directory.mkdir()
+    hook_path = hook_directory / "pre-commit"
+    command = " ".join(
+        shlex.quote(each_argument)
+        for each_argument in (sys.executable, str(Path(pre_commit.__file__).resolve()))
+    )
+    hook_path.write_text(f"#!/bin/sh\nexec {command}\n", encoding="utf-8")
+    hook_path.chmod(0o755)
+    _git(repository_root, "config", "core.hooksPath", str(hook_directory))
+    monkeypatch.setenv("CODE_RULES_GATE_PATH", str(repository_root / "missing-legacy-gate.py"))
+    return repository_root
+
+
+def test_valid_commit_passes_the_installed_native_hook(installed_native_hook: Path) -> None:
+    before = _git(installed_native_hook, "rev-parse", "HEAD")
+    _stage(installed_native_hook, "docs/config.md", "The API uses port 8080.\n")
+    _git(installed_native_hook, "commit", "-m", "valid fixture")
+    assert _git(installed_native_hook, "rev-parse", "HEAD") != before
+
+
+def _assert_write_proceeds(repository_root: Path, relative_path: str, content: str) -> None:
+    """Exercise the actual dispatcher before attempting the staged commit."""
+    hooks_root = Path(pre_commit.__file__).resolve().parent.parent
+    payload = {
+        "tool_name": "Write",
+        "cwd": str(repository_root),
+        "tool_input": {
+            "file_path": str(repository_root / relative_path),
+            "content": content,
+        },
+    }
+    edit_result = subprocess.run(
+        [sys.executable, str(hooks_root / "blocking/pre_tool_use_dispatcher.py")],
+        cwd=repository_root,
+        input=json.dumps(payload),
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=90,
+    )
+    assert edit_result.returncode == 0, edit_result.stderr
+    edit_output = json.loads(edit_result.stdout or "{}")
+    assert edit_output.get("hookSpecificOutput", {}).get("permissionDecision") != "deny"
+
+
+def test_retired_write_check_allows_edit_but_local_commit_catches_violation(
+    installed_native_hook: Path,
+) -> None:
+    relative_path = "docs/config.md"
+    content = "Previously set via env var.\n"
+    _assert_write_proceeds(installed_native_hook, relative_path, content)
+    before = _git(installed_native_hook, "rev-parse", "HEAD")
+    _stage(installed_native_hook, relative_path, content)
+    commit_result = subprocess.run(
+        ["git", "commit", "-m", "invalid fixture"],
+        cwd=installed_native_hook,
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=240,
+    )
+    assert commit_result.returncode != 0
+    assert "state-description" in commit_result.stdout + commit_result.stderr
+    assert _git(installed_native_hook, "rev-parse", "HEAD") == before

package/hooks/git-hooks/test_pre_commit.py

@@ -1,10 +1,16 @@
 from __future__ import annotations
 
+import json
+import os
+import subprocess
+import sys
 from pathlib import Path
 
 import pre_commit
 import pytest
 
+from git_hooks_constants.staged_policy_lint import POLICY_LINT_TIMEOUT_SECONDS
+
 
 def make_gate_script_returning(exit_code: int, target_path: Path) -> Path:
     target_path.write_text(
@@ -170,3 +176,243 @@ def test_invoke_gate_uses_resolved_path(
     assert exit_code == 0
     executed_path = recorded_path_file.read_text(encoding="utf-8")
     assert executed_path == str(resolved_path)
+
+
+RMTREE_FIXTURE_KEYWORD = "ignore_errors"
+ALL_RULE_FIXTURES = (
+    (
+        "code-rules",
+        "src/worker.py",
+        "from typing import Any\n\ndef worker() -> Any:\n    return None\n",
+    ),
+    (
+        "test-pairing",
+        "src/feature.py",
+        "def work() -> None:\n    pass\n",
+    ),
+    (
+        "rmtree-safety",
+        "src/cleanup.py",
+        f"import shutil\nshutil.rmtree('fixture', {RMTREE_FIXTURE_KEYWORD}=True)\n",
+    ),
+    (
+        "state-description",
+        "docs/config.md",
+        "# Config\n\nPreviously set via env var.\n",
+    ),
+    (
+        "subprocess-budget",
+        "src/timing.py",
+        "import subprocess\n"
+        "PYTHON_FORMAT_TIMEOUT_SECONDS = 12\n"
+        "GIT_CHECK_TIMEOUT_SECONDS = 5\n"
+        "def worst_case_python_format_seconds() -> int:\n"
+        "    fix_phase_seconds = PYTHON_FORMAT_TIMEOUT_SECONDS\n"
+        "    format_phase_seconds = PYTHON_FORMAT_TIMEOUT_SECONDS\n"
+        "    return fix_phase_seconds + format_phase_seconds\n"
+        "def is_untracked_in_git(file_path: str) -> bool:\n"
+        "    git_check = subprocess.run(['git', 'ls-files', file_path], "
+        "timeout=GIT_CHECK_TIMEOUT_SECONDS)\n"
+        "    return git_check.returncode != 0\n"
+        "def run_format(file_path: str) -> None:\n"
+        "    subprocess.run(['ruff', 'format', file_path], "
+        "timeout=PYTHON_FORMAT_TIMEOUT_SECONDS)\n"
+        "def main(file_path: str) -> None:\n"
+        "    if is_untracked_in_git(file_path):\n"
+        "        return\n"
+        "    run_format(file_path)\n",
+    ),
+    (
+        "hook-prose-consistency",
+        "hooks/hooks_constants/probe_constants.py",
+        'CORRECTIVE_MESSAGE = "appears as a path or output-key segment"\n',
+    ),
+    (
+        "workflow-substitution",
+        "scripts/sample.workflow.js",
+        "For EACH candidate i, build a bible dir cand_i per the contract.\n"
+        "   & ${PY} compose.py --out ${args.work_dir}\\\\cand_i\\\\sample.png "
+        "--glow <candidate glow_hex>\n"
+        'Return: {key: "cand_i", name, sample_png}\n',
+    ),
+)
+
+
+def _git(repository_root: Path, *all_arguments: str) -> str:
+    completed = subprocess.run(
+        ["git", *all_arguments],
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+        text=True,
+        timeout=30,
+    )
+    return completed.stdout.strip()
+
+
+@pytest.fixture()
+def repository_root(
+    tmp_path_factory: pytest.TempPathFactory, monkeypatch: pytest.MonkeyPatch,
+) -> Path:
+    """Create a repository with private Git configuration and no inherited hooks."""
+    tmp_path = tmp_path_factory.mktemp("policy-fixture")
+    home_directory = tmp_path / "home"
+    home_directory.mkdir()
+    monkeypatch.setenv("HOME", str(home_directory))
+    monkeypatch.setenv("USERPROFILE", str(home_directory))
+    monkeypatch.setenv("GIT_CONFIG_GLOBAL", os.devnull)
+    monkeypatch.setenv("GIT_CONFIG_NOSYSTEM", "1")
+    monkeypatch.delenv("GIT_INDEX_FILE", raising=False)
+    monkeypatch.delenv("GIT_DIR", raising=False)
+    monkeypatch.delenv("GIT_WORK_TREE", raising=False)
+    root = tmp_path / "repository"
+    root.mkdir()
+    _git(root, "init")
+    _git(root, "config", "core.hooksPath", str(tmp_path / "disabled-fixture-hooks"))
+    _git(root, "config", "user.name", "Fixture")
+    _git(root, "config", "user.email", "fixture@example.com")
+    _git(root, "commit", "--allow-empty", "-m", "fixture base")
+    monkeypatch.chdir(root)
+    return root
+
+
+def _stage(repository_root: Path, relative_path: str, content: str) -> Path:
+    file_path = repository_root / relative_path
+    file_path.parent.mkdir(parents=True, exist_ok=True)
+    file_path.write_text(content, encoding="utf-8")
+    _git(repository_root, "add", "--", relative_path)
+    return file_path
+
+
+def _lint_report(repository_root: Path) -> tuple[int, dict[str, object]]:
+    completed = subprocess.run(
+        [
+            sys.executable,
+            str(pre_commit.resolve_policy_lint_script_path()),
+            "--staged",
+            "--format",
+            "json",
+        ],
+        cwd=repository_root,
+        check=False,
+        capture_output=True,
+        text=True,
+        timeout=POLICY_LINT_TIMEOUT_SECONDS,
+    )
+    assert completed.stderr == "", completed.stderr
+    return completed.returncode, json.loads(completed.stdout)
+
+
+@pytest.mark.parametrize(("rule_id", "relative_path", "content"), ALL_RULE_FIXTURES)
+def test_real_staged_linter_catches_each_replaced_rule(
+    repository_root: Path,
+    rule_id: str,
+    relative_path: str,
+    content: str,
+) -> None:
+    _stage(repository_root, relative_path, content)
+    exit_code, report = _lint_report(repository_root)
+    assert exit_code == 1, report
+    assert report["failed_rules"] == [], report
+    all_diagnostics = report["diagnostics"]
+    assert isinstance(all_diagnostics, list)
+    assert rule_id in {each["rule_id"] for each in all_diagnostics}, report
+
+
+def _stage_valid_pair(repository_root: Path, relative_path: str) -> None:
+    source_path = Path(relative_path)
+    clean_content = {
+        ".py": (
+            "def is_ready() -> bool:\n"
+            '    """Report readiness.\n\n'
+            "    Returns:\n        True for the fixture.\n"
+            '    """\n'
+            "    return True\n"
+        ),
+        ".js": "export const isEnabled = true;\n",
+        ".md": "# Config\n\nThe API uses port 8080.\n",
+    }[source_path.suffix]
+    _stage(repository_root, relative_path, clean_content)
+    paired_name = (
+        f"test_{source_path.stem}.py"
+        if source_path.suffix == ".py"
+        else f"{source_path.stem}.test{source_path.suffix}"
+    )
+    paired_content = (
+        f"from {source_path.stem} import is_ready\n\n"
+        "def test_is_ready() -> None:\n    assert is_ready()\n"
+        if source_path.suffix == ".py"
+        else ""
+    )
+    _stage(repository_root, (source_path.parent / paired_name).as_posix(), paired_content)
+
+
+@pytest.mark.parametrize(("rule_id", "relative_path", "content"), ALL_RULE_FIXTURES)
+def test_valid_paired_content_passes_the_real_local_commit_linter(
+    repository_root: Path,
+    rule_id: str,
+    relative_path: str,
+    content: str,
+) -> None:
+    _stage_valid_pair(repository_root, relative_path)
+    assert pre_commit.run_staged_policy_lint() == 0
+
+
+def test_unstaged_fix_does_not_hide_staged_violation(repository_root: Path) -> None:
+    target = _stage(repository_root, "docs/config.md", "Previously set via env var.\n")
+    target.write_text("The API uses port 8080.\n", encoding="utf-8")
+    assert pre_commit.run_staged_policy_lint() == 1
+
+
+def test_alternate_git_index_is_checked(
+    repository_root: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    alternate_index = repository_root / ".git" / "alternate-index"
+    monkeypatch.setenv("GIT_INDEX_FILE", str(alternate_index))
+    _git(repository_root, "read-tree", "HEAD")
+    _stage(repository_root, "docs/config.md", "Previously set via env var.\n")
+    assert pre_commit.run_staged_policy_lint() == 1
+    monkeypatch.delenv("GIT_INDEX_FILE")
+    assert pre_commit.run_staged_policy_lint() == 0
+
+
+def test_missing_linter_does_not_allow_commit(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(
+        pre_commit, "resolve_policy_lint_script_path", lambda: tmp_path / "missing.py"
+    )
+    assert pre_commit.main() == 2
+
+
+@pytest.mark.parametrize("exit_code", (1, 2, 3))
+def test_linter_failure_reaches_git_before_legacy_gate(
+    monkeypatch: pytest.MonkeyPatch,
+    exit_code: int,
+) -> None:
+    monkeypatch.setattr(pre_commit, "run_staged_policy_lint", lambda: exit_code)
+    all_gate_calls: list[object] = []
+    monkeypatch.setattr(
+        pre_commit,
+        "resolve_gate_script_path",
+        lambda: all_gate_calls.append("unexpected gate"),
+    )
+    assert pre_commit.main() == exit_code
+    assert all_gate_calls == []
+
+
+def test_timeout_is_an_infrastructure_failure(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    script_path = tmp_path / "lint.py"
+    script_path.write_text("", encoding="utf-8")
+    monkeypatch.setattr(pre_commit, "resolve_policy_lint_script_path", lambda: script_path)
+
+    def timed_out(*all_arguments: object, **all_options: object) -> object:
+        raise subprocess.TimeoutExpired("lint fixture", POLICY_LINT_TIMEOUT_SECONDS)
+
+    monkeypatch.setattr(pre_commit.subprocess, "run", timed_out)
+    assert pre_commit.run_staged_policy_lint() == 2

package/hooks/hooks.json

@@ -45,11 +45,6 @@
       {
         "matcher": "mcp__plugin_github_github__.*",
         "hooks": [
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/volatile_path_in_post_blocker.py",
-            "timeout": 10
-          },
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/pii_prevention_blocker.py",
@@ -149,11 +144,6 @@
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/session_env_cleanup.py",
             "timeout": 10
           },
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/gh_pr_author_session_cleanup.py",
-            "timeout": 30
-          },
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/session_edit_tracker_cleanup.py",
@@ -251,16 +241,11 @@
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/workflow/investigation_tracker_reset.py",
             "timeout": 30
-          },
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/observability/pr_description_writer_spawn_tracker.py",
-            "timeout": 30
           }
         ]
       },
       {
-        "matcher": "Bash",
+        "matcher": "Bash|PowerShell",
         "hooks": [
           {
             "type": "command",

package/hooks/hooks_constants/bash_post_call_dispatcher_constants.py

@@ -10,13 +10,25 @@ no second copy of either.
 from __future__ import annotations
 
 from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
+    ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
     ALL_BASH_ONLY_TOOL_NAMES,
     BashHostedHookEntry,
 )
 
-__all__ = ["ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES"]
+__all__ = [
+    "ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES",
+    "POST_TOOL_USE_HOOK_EVENT_NAME",
+    "HOOK_SPECIFIC_OUTPUT_KEY",
+    "ADDITIONAL_CONTEXT_KEY",
+    "ADDITIONAL_CONTEXT_JOIN_SEPARATOR",
+]
 
 ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
-    BashHostedHookEntry("blocking/gh_pr_author_restore.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("observability/test_failure_recorder.py", ALL_BASH_ONLY_TOOL_NAMES),
+    BashHostedHookEntry("advisory/pr_done_reminder.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES),
 )
+
+POST_TOOL_USE_HOOK_EVENT_NAME: str = "PostToolUse"
+HOOK_SPECIFIC_OUTPUT_KEY: str = "hookSpecificOutput"
+ADDITIONAL_CONTEXT_KEY: str = "additionalContext"
+ADDITIONAL_CONTEXT_JOIN_SEPARATOR: str = "\n\n"

package/hooks/hooks_constants/bash_pre_tool_use_dispatcher_constants.py

@@ -56,7 +56,6 @@ class BashHostedHookEntry:
 
 ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
     BashHostedHookEntry("blocking/destructive_command_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry("blocking/gh_body_arg_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/shell_substitution_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/piped_pytest_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry(
@@ -65,15 +64,8 @@ ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
     ),
     BashHostedHookEntry("blocking/unscoped_search_blocker.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES),
     BashHostedHookEntry("blocking/nas_ssh_binary_enforcer.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry("blocking/volatile_path_in_post_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/pii_prevention_blocker.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES),
-    BashHostedHookEntry("blocking/conventional_pr_title_gate.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/block_main_commit.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/session_edit_stage_gate.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry("blocking/test_preflight_check.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/windows_rmtree_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry("blocking/gh_pr_author_enforcer.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry(
-        "blocking/pr_description_writer_gate.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES
-    ),
 )

package/hooks/hooks_constants/gh_post_body_texts_constants.py

@@ -0,0 +1,12 @@
+"""Configuration constants for GitHub post body extraction."""
+
+ALL_GH_POST_SUBCOMMANDS: dict[str, frozenset[str]] = {
+    "issue": frozenset({"comment", "create", "edit"}),
+    "pr": frozenset({"comment", "create", "edit", "review"}),
+}
+ALL_MCP_BODY_PARAM_NAMES: tuple[str, ...] = ("body", "comment")
+BODY_FILE_ENCODING = "utf-8"
+BODY_FLAG_WITH_VALUE_STEP = 2
+GH_COMMAND_NAME = "gh"
+MINIMUM_POST_SUBCOMMAND_TOKEN_COUNT = 2
+TOKEN_JOIN_SEPARATOR = " "

package/hooks/hooks_constants/pr_done_reminder_constants.py

@@ -0,0 +1,98 @@
+"""Constants for the PR done-checklist context reminder.
+
+The reminder is a PostToolUse observer on Bash. It never blocks. After a
+successful ``git push`` or ``gh pr create`` it probes the branch's pull request
+through ``gh`` and adds one loud checklist to the agent's context.
+"""
+
+from __future__ import annotations
+
+__all__ = [
+    "GIT_PROGRAM_NAME",
+    "GIT_PUSH_SUBCOMMAND",
+    "GH_PROGRAM_NAME",
+    "GH_PR_SUBCOMMAND",
+    "GH_PR_CREATE_ACTION",
+    "ALL_GIT_OPTIONS_WITH_VALUE",
+    "ALL_POWERSHELL_PROGRAM_NAMES",
+    "ALL_POWERSHELL_COMMAND_FLAGS",
+    "ALL_GH_PR_VIEW_ARGUMENTS",
+    "GH_PR_VIEW_TIMEOUT_SECONDS",
+    "NO_PULL_REQUEST_MARKER",
+    "EXIT_CODE_ERROR_PREFIX",
+    "DONE_LABEL_NAME",
+    "MERGEABLE_CLEAN_VALUE",
+    "MERGEABLE_CONFLICTING_VALUE",
+    "MERGEABLE_UNKNOWN_VALUE",
+    "ALL_FAILING_CHECK_CONCLUSIONS",
+    "ALL_PASSING_CHECK_CONCLUSIONS",
+    "CHECK_COMPLETED_STATUS",
+    "STATUS_CONTEXT_STATE_KEY",
+    "REMINDER_HEADER",
+    "REMINDER_FOOTER",
+    "REMINDER_LINE_SEPARATOR",
+    "ALL_REMINDER_HINTS_BY_MERGEABLE",
+    "VERDICT_DONE",
+    "VERDICT_NOT_DONE",
+    "NO_PULL_REQUEST_REMINDER",
+    "RECHECK_COMMAND_TEMPLATE",
+    "ADD_LABEL_COMMAND_TEMPLATE",
+]
+
+GIT_PROGRAM_NAME: str = "git"
+GIT_PUSH_SUBCOMMAND: str = "push"
+GH_PROGRAM_NAME: str = "gh"
+GH_PR_SUBCOMMAND: str = "pr"
+GH_PR_CREATE_ACTION: str = "create"
+ALL_GIT_OPTIONS_WITH_VALUE: frozenset[str] = frozenset({"-C", "-c"})
+ALL_POWERSHELL_PROGRAM_NAMES: frozenset[str] = frozenset(
+    {"pwsh", "pwsh.exe", "powershell", "powershell.exe"}
+)
+ALL_POWERSHELL_COMMAND_FLAGS: frozenset[str] = frozenset({"-command", "-c"})
+
+ALL_GH_PR_VIEW_ARGUMENTS: tuple[str, ...] = (
+    "gh",
+    "pr",
+    "view",
+    "--json",
+    "number,url,isDraft,mergeable,mergeStateStatus,statusCheckRollup,labels",
+)
+GH_PR_VIEW_TIMEOUT_SECONDS: int = 20
+NO_PULL_REQUEST_MARKER: str = "no pull requests found"
+EXIT_CODE_ERROR_PREFIX: str = "Error: Exit code "
+
+DONE_LABEL_NAME: str = "done"
+
+MERGEABLE_CLEAN_VALUE: str = "MERGEABLE"
+MERGEABLE_CONFLICTING_VALUE: str = "CONFLICTING"
+MERGEABLE_UNKNOWN_VALUE: str = "UNKNOWN"
+
+ALL_FAILING_CHECK_CONCLUSIONS: frozenset[str] = frozenset(
+    {"FAILURE", "ERROR", "CANCELLED", "TIMED_OUT", "ACTION_REQUIRED", "STARTUP_FAILURE"}
+)
+ALL_PASSING_CHECK_CONCLUSIONS: frozenset[str] = frozenset({"SUCCESS", "NEUTRAL", "SKIPPED"})
+CHECK_COMPLETED_STATUS: str = "COMPLETED"
+STATUS_CONTEXT_STATE_KEY: str = "state"
+
+REMINDER_HEADER: str = "=== PR DONE CHECKLIST (context reminder, never a block) ==="
+REMINDER_FOOTER: str = "A PR is done only when every line above is clean."
+REMINDER_LINE_SEPARATOR: str = "\n"
+ALL_REMINDER_HINTS_BY_MERGEABLE: dict[str, str] = {
+    MERGEABLE_CLEAN_VALUE: "no conflicts with the base branch",
+    MERGEABLE_CONFLICTING_VALUE: (
+        "CONFLICTS with the base branch. Merge origin/main into this branch, "
+        "resolve every conflict, run the tests, push again."
+    ),
+    MERGEABLE_UNKNOWN_VALUE: "GitHub is still computing. Re-run the re-check command in a minute.",
+}
+VERDICT_DONE: str = "DONE. Add the label now:"
+VERDICT_NOT_DONE: str = "NOT DONE. Do not add the done label yet."
+NO_PULL_REQUEST_REMINDER: str = (
+    "=== PR DONE CHECKLIST (context reminder, never a block) ===\n"
+    "No open pull request found for this branch. Open a draft PR with gh pr create --draft.\n"
+    "A branch is done only when its PR has clean CI, no merge conflicts, and the done label."
+)
+RECHECK_COMMAND_TEMPLATE: str = (
+    "gh pr view {number} --json mergeable,mergeStateStatus,statusCheckRollup,labels"
+)
+ADD_LABEL_COMMAND_TEMPLATE: str = "gh pr edit {number} --add-label {label}"

package/hooks/hooks_constants/pre_tool_use_dispatcher_constants.py

@@ -1,8 +1,9 @@
 """Constants for the PreToolUse dispatcher that hosts Write/Edit/MultiEdit hooks.
 
-Holds the ordered hosted-hook list with per-hook applicable-tool sets, the
-special exit codes, the deny decision string, and the hook-event name. The
-dispatcher imports each of these by name.
+The roster keeps action-boundary checks, repository checks, and checks without
+a proven local replacement. File-policy rules with a staged replacement run
+through cde lint in native pre-commit. Their detectors stay importable for that
+linter. Bash cleanup protection uses its own roster.
 """
 
 from __future__ import annotations
@@ -55,14 +56,10 @@ ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES: frozenset[str] = frozenset(
     ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES | {APPLY_PATCH_TOOL_NAME}
 )
 
-# apply_patch reaches this narrower roster: the gates whose miss causes immediate
-# harm, plus the TDD gate and the edit tracker. It stays off the full lint surface.
 ALL_IMMEDIATE_HARM_SCRIPT_PATHS: tuple[str, ...] = (
     "blocking/pii_prevention_blocker.py",
     "blocking/sensitive_file_protector.py",
     "blocking/write_existing_file_blocker.py",
-    "blocking/code_rules_enforcer.py",
-    "blocking/tdd_enforcer.py",
 )
 
 
@@ -71,19 +68,18 @@ STATE_DESCRIPTION_BLOCKER_MODULE_NAME = "state_description_blocker"
 
 @dataclass(frozen=True)
 class HostedHookEntry:
-    """A single hosted hook with its applicable-tools constraint and blocking flag.
+    """One hosted hook, the tools it applies to, and whether a crash blocks.
 
     Attributes:
         script_relative_path: Hook path relative to the hooks/ directory.
         applicable_tool_names: Tool names this hook applies to. The dispatcher
             skips the hook when the payload's tool is not in this set.
-        is_blocking: True when a crash surfaces a blocking signal; False when the
+        is_blocking: True when a crash is a blocking signal. False when the
             hook is advisory and a crash stays silent.
-        native_module_name: The importable module name whose evaluate function
-            the dispatcher calls in-process for this hook, or None when the hook
-            runs via runpy under __main__. The named module exposes a function
-            named `evaluate` taking the payload dict and returning a deny-reason
-            string or None.
+        native_module_name: Importable module whose evaluate function the
+            dispatcher calls in-process, or None when the hook runs via runpy
+            under __main__. evaluate takes the payload dict and returns a
+            deny-reason string or None.
     """
 
     script_relative_path: str
@@ -109,39 +105,10 @@ ALL_HOSTED_HOOK_ENTRIES: tuple[HostedHookEntry, ...] = (
         script_relative_path="validation/hook_format_validator.py",
         applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
     ),
-    HostedHookEntry(
-        script_relative_path="blocking/code_rules_enforcer.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES,
-    ),
-    HostedHookEntry(
-        script_relative_path="blocking/tdd_enforcer.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES,
-    ),
-    HostedHookEntry(
-        script_relative_path="blocking/windows_rmtree_blocker.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
-    ),
     HostedHookEntry(
         script_relative_path="blocking/duplicate_rmtree_helper_blocker.py",
         applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
     ),
-    HostedHookEntry(
-        script_relative_path="blocking/state_description_blocker.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
-        native_module_name=STATE_DESCRIPTION_BLOCKER_MODULE_NAME,
-    ),
-    HostedHookEntry(
-        script_relative_path="blocking/subprocess_budget_completeness.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
-    ),
-    HostedHookEntry(
-        script_relative_path="blocking/hook_prose_detector_consistency.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
-    ),
-    HostedHookEntry(
-        script_relative_path="blocking/workflow_substitution_slot_blocker.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
-    ),
     HostedHookEntry(
         script_relative_path="blocking/claude_md_orphan_file_blocker.py",
         applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,