claude-dev-env 7.0.0 → 7.1.0

package/hooks/validation/test_post_tool_use_dispatcher.py

@@ -1,30 +1,12 @@
-"""Golden differential and behavior tests for the PostToolUse dispatcher.
-
-The golden differential test runs a payload through every hosted PostToolUse
-hook as its own subprocess (the production path), records each hook's block
-decision, computes the expected aggregate, then runs the dispatcher on the same
-payload and asserts an equal block-or-allow decision and the union of reasons.
-
-Two focused tests pin the side-effecting behavior the dispatcher must not
-change: the formatter formats only on a Write of a file git does not yet track
-and never blocks; and the type-checker still blocks on a real type error when
-run through the dispatcher. Two more tests pin that non-block stdout from a
-side-effect hook survives on both the allow and block paths.
-
-Crash and early-exit tests exercise the aggregator directly: an early hook
-crash before mypy does not drop mypy's block, a non-blocking hook crash leaves
-the decision allow, and a blocking hook crash surfaces a block.
-"""
+"""Behavior tests for the nonblocking PostToolUse dispatcher roster."""
 
 from __future__ import annotations
 
-import importlib.util
 import json
 import os
 import subprocess
 import sys
 from pathlib import Path
-from types import ModuleType
 
 _HOOKS_DIR = str(Path(__file__).resolve().parent.parent)
 if _HOOKS_DIR not in sys.path:
@@ -56,34 +38,8 @@ _WRITE_TOOL_NAME = "Write"
 _EDIT_TOOL_NAME = "Edit"
 
 
-def _load_module(module_filename: str, module_directory: Path) -> ModuleType:
-    """Load a hook module by file path so its module-level constants are readable.
-
-    Args:
-        module_filename: The module filename to load.
-        module_directory: The directory holding the module.
-
-    Returns:
-        The loaded module object.
-    """
-    module_path = module_directory / module_filename
-    spec = importlib.util.spec_from_file_location(module_path.stem, module_path)
-    assert spec is not None and spec.loader is not None
-    loaded_module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(loaded_module)
-    return loaded_module
-
-
 def _resolve_extra_arguments(each_entry: PostHostedHookEntry) -> list[str]:
-    """Resolve a hook entry's relative argument paths to absolute argv values.
-
-    Args:
-        each_entry: The hosted hook entry whose extra arguments to resolve.
-
-    Returns:
-        The resolved argument list. The plugin-root placeholder resolves to the
-        plugin root absolute path; every other entry resolves relative to it.
-    """
+    """Resolve a hook entry's relative arguments against the plugin root."""
     resolved_arguments: list[str] = []
     for each_relative_path in each_entry.extra_argument_relative_paths:
         if each_relative_path == PLUGIN_ROOT_PLACEHOLDER:
@@ -94,17 +50,10 @@ def _resolve_extra_arguments(each_entry: PostHostedHookEntry) -> list[str]:
 
 
 def _environment_without_git_hook_variables() -> dict[str, str]:
-    """Return the process environment with git's hook-scoped variables removed.
-
-    Git exports variables such as GIT_DIR and GIT_INDEX_FILE to hook
-    processes. When this suite runs under a git hook (the pre-commit gate
-    replays staged test files), those variables leak into the hook
-    subprocesses and point their project discovery at the wrong checkout.
-    Stripping them restores the cwd-based discovery the hooks use in
-    production.
+    """Return the environment without variables Git adds to hook processes.
 
-    Returns:
-        A copy of the environment without any GIT_-prefixed variable.
+    Removing GIT_-prefixed variables keeps subprocess project discovery rooted in
+    the current checkout.
     """
     return {
         each_name: each_value
@@ -116,15 +65,7 @@ def _environment_without_git_hook_variables() -> dict[str, str]:
 def _run_hook_subprocess(
     each_entry: PostHostedHookEntry, payload_text: str
 ) -> subprocess.CompletedProcess[str]:
-    """Run one hosted hook script as a subprocess, returning the completed process.
-
-    Args:
-        each_entry: The hosted hook entry naming the script and its arguments.
-        payload_text: The JSON payload to send on stdin.
-
-    Returns:
-        The completed subprocess result with stdout and stderr captured.
-    """
+    """Run one hosted hook subprocess and capture its streams."""
     script_path = str(_HOOKS_ROOT / each_entry.script_relative_path)
     command = [sys.executable, script_path, *_resolve_extra_arguments(each_entry)]
     return subprocess.run(
@@ -139,14 +80,7 @@ def _run_hook_subprocess(
 
 
 def _run_dispatcher(payload_text: str) -> subprocess.CompletedProcess[str]:
-    """Run the PostToolUse dispatcher as a subprocess.
-
-    Args:
-        payload_text: The JSON payload to send on stdin.
-
-    Returns:
-        The completed subprocess result with stdout and stderr captured.
-    """
+    """Run the PostToolUse dispatcher and capture its streams."""
     return subprocess.run(
         [sys.executable, _DISPATCHER_SCRIPT, str(_PLUGIN_ROOT)],
         check=False,
@@ -159,16 +93,7 @@ def _run_dispatcher(payload_text: str) -> subprocess.CompletedProcess[str]:
 
 
 def _parse_block_decision(completed_process: subprocess.CompletedProcess[str]) -> tuple[bool, str]:
-    """Parse one hook's subprocess result into (is_block, reason_text).
-
-    Args:
-        completed_process: The completed subprocess from running a hook.
-
-    Returns:
-        A (is_block, reason_text) pair where is_block is True when the hook
-        emitted a PostToolUse block decision, and reason_text carries the
-        block reason.
-    """
+    """Parse a hook's subprocess output into a block flag and reason."""
     stdout_text = completed_process.stdout.strip()
     if not stdout_text:
         return False, ""
@@ -184,15 +109,7 @@ def _parse_block_decision(completed_process: subprocess.CompletedProcess[str]) -
 
 
 def _compute_expected_aggregate(payload_text: str) -> tuple[bool, list[str]]:
-    """Run each hosted hook individually and compute the expected aggregate.
-
-    Args:
-        payload_text: The JSON payload text to send to each hook.
-
-    Returns:
-        A (should_block, all_block_reasons) pair where should_block is True when
-        any hook blocks, and all_block_reasons collects every blocking reason.
-    """
+    """Run each hosted hook and return whether any blocked plus all reasons."""
     all_block_reasons: list[str] = []
     for each_entry in ALL_POST_HOSTED_HOOK_ENTRIES:
         completed_process = _run_hook_subprocess(each_entry, payload_text)
@@ -203,15 +120,7 @@ def _compute_expected_aggregate(payload_text: str) -> tuple[bool, list[str]]:
 
 
 def _write_payload(file_path: str, content: str) -> str:
-    """Build a Write tool payload JSON string.
-
-    Args:
-        file_path: The target file path.
-        content: The file content written.
-
-    Returns:
-        JSON-encoded payload string.
-    """
+    """Build a JSON payload for a Write tool call."""
     return json.dumps(
         {
             "tool_name": _WRITE_TOOL_NAME,
@@ -221,16 +130,7 @@ def _write_payload(file_path: str, content: str) -> str:
 
 
 def _edit_payload(file_path: str, old_string: str, new_string: str) -> str:
-    """Build an Edit tool payload JSON string.
-
-    Args:
-        file_path: The target file path.
-        old_string: The text replaced.
-        new_string: The replacement text.
-
-    Returns:
-        JSON-encoded payload string.
-    """
+    """Build a JSON payload for an Edit tool call."""
     return json.dumps(
         {
             "tool_name": _EDIT_TOOL_NAME,
@@ -269,60 +169,6 @@ def _assert_dispatcher_matches_individual_hooks(payload_text: str) -> None:
         )
 
 
-def _post_tool_use_dispatcher_harness_timeout_seconds() -> int:
-    """Return the PostToolUse dispatcher's harness timeout from hooks.json.
-
-    Returns:
-        The timeout the Write|Edit PostToolUse entry declares for the dispatcher.
-    """
-    hooks_json_path = _HOOKS_ROOT / "hooks.json"
-    parsed_hooks = json.loads(hooks_json_path.read_text(encoding="utf-8"))
-    for each_entry in parsed_hooks["hooks"]["PostToolUse"]:
-        for each_hook in each_entry["hooks"]:
-            if "post_tool_use_dispatcher.py" in each_hook["command"]:
-                return int(each_hook["timeout"])
-    raise AssertionError("PostToolUse dispatcher entry not found in hooks.json")
-
-
-def _hosted_hooks_worst_case_internal_seconds() -> int:
-    """Return the summed worst-case internal subprocess budget of the hosted hooks.
-
-    The hosted hooks run sequentially in one dispatcher process. The
-    type-checker and the formatter (its slower JS path) each carry their own
-    internal subprocess timeout; their sum is the dispatcher process's
-    worst-case runtime when each hook runs to its own ceiling.
-
-    Returns:
-        The summed worst-case internal subprocess seconds across the hosted hooks.
-    """
-    mypy_validator = _load_module("mypy_validator.py", _VALIDATION_DIR)
-    auto_formatter = _load_module("auto_formatter.py", _HOOKS_ROOT / "workflow")
-    slowest_formatter_seconds = max(
-        auto_formatter.PYTHON_FORMAT_TIMEOUT_SECONDS,
-        auto_formatter.JS_FORMAT_TIMEOUT_SECONDS,
-    )
-    return mypy_validator.MYPY_TIMEOUT_SECONDS + slowest_formatter_seconds
-
-
-def test_dispatcher_harness_timeout_clears_summed_hosted_hook_budgets() -> None:
-    """The dispatcher harness timeout exceeds the summed worst-case hosted-hook budget.
-
-    The hosted hooks run sequentially under one harness timeout. When the
-    harness timeout does not clear their summed worst-case internal budgets, a
-    near-full slow type-check run consumes the budget and the harness kills the
-    dispatcher before the formatter gets its turn. The harness timeout must
-    exceed the sum so every hosted hook runs to completion.
-    """
-    harness_timeout_seconds = _post_tool_use_dispatcher_harness_timeout_seconds()
-    summed_internal_seconds = _hosted_hooks_worst_case_internal_seconds()
-    assert harness_timeout_seconds > summed_internal_seconds, (
-        "PostToolUse dispatcher harness timeout "
-        f"({harness_timeout_seconds}s) must exceed the summed worst-case internal "
-        f"budgets of the hosted hooks ({summed_internal_seconds}s), or a slow "
-        "type-check run starves the formatter."
-    )
-
-
 def test_clean_edit_of_plain_text_allows() -> None:
     """Dispatcher allows an Edit of a non-Python plain-text file (no hook blocks)."""
     plain_text_path = str(_VALIDATION_DIR / "CLAUDE.md")
@@ -331,7 +177,7 @@ def test_clean_edit_of_plain_text_allows() -> None:
 
 
 def test_clean_write_of_nonexistent_path_allows() -> None:
-    """Dispatcher allows a Write whose path does not exist (mypy skips)."""
+    """Dispatcher allows a Write whose path does not exist (blocking_hook skips)."""
     missing_path = str(_VALIDATION_DIR / "does_not_exist_dispatcher_probe.txt")
     payload_text = _write_payload(missing_path, "hello world\n")
     _assert_dispatcher_matches_individual_hooks(payload_text)
@@ -364,56 +210,8 @@ def test_empty_payload_allows_fail_open() -> None:
     )
 
 
-def test_type_checker_still_blocks_on_type_error_through_dispatcher() -> None:
-    """The type-checker's block on a real type error survives through the dispatcher.
-
-    Writes a Python file with a genuine type error inside this repository so
-    mypy_validator discovers the project root and blocks, then runs the same
-    payload through the dispatcher and asserts the dispatcher emits the block.
-    """
-    type_error_file = _VALIDATION_DIR / "dispatcher_type_error_probe.py"
-    type_error_file.write_text(
-        "def add_one(value: int) -> int:\n    return value + 1\n\n\nadd_one('not an int')\n",
-        encoding="utf-8",
-    )
-    try:
-        payload_text = _write_payload(str(type_error_file), type_error_file.read_text())
-        direct_block, direct_reason = _parse_block_decision(
-            _run_hook_subprocess(ALL_POST_HOSTED_HOOK_ENTRIES[0], payload_text)
-        )
-        assert direct_block, (
-            "Precondition failed: mypy_validator did not block a real type error "
-            f"directly. Reason: {direct_reason!r}. Is mypy installed and the file "
-            "inside the git project?"
-        )
-        dispatcher_result = _run_dispatcher(payload_text)
-        dispatcher_is_block, dispatcher_reason = _parse_block_decision(dispatcher_result)
-        assert dispatcher_is_block, (
-            "Dispatcher must block when the type-checker blocks on a type error. "
-            f"Dispatcher stdout: {dispatcher_result.stdout!r}"
-        )
-        assert direct_reason in dispatcher_reason, (
-            "Dispatcher block reason must carry the type-checker's reason.\n"
-            f"Expected: {direct_reason!r}\n"
-            f"Dispatcher reason: {dispatcher_reason!r}"
-        )
-    finally:
-        type_error_file.unlink(missing_ok=True)
-
-
 def test_formatter_formats_only_untracked_write_and_never_blocks(tmp_path: Path) -> None:
-    """The formatter acts only on an untracked-file Write and never blocks.
-
-    Writes an unformatted Python file into a git repo at tmp_path so the file is
-    untracked, runs a Write payload through the dispatcher, and asserts the file
-    is formatted on disk and the dispatcher does not block. Then runs an Edit
-    payload for the same path and asserts the formatter leaves an unformatted
-    file untouched, proving the Write-untracked gate still holds through the
-    dispatcher.
-
-    Args:
-        tmp_path: Pytest temp directory hosting the throwaway git repository.
-    """
+    """Verify formatting applies to untracked Write payloads but not Edit payloads."""
     subprocess.run(
         ["git", "init", str(tmp_path)],
         check=True,
@@ -447,13 +245,7 @@ def test_formatter_formats_only_untracked_write_and_never_blocks(tmp_path: Path)
 
 
 def test_non_block_stdout_preserved_in_aggregator_allow_path() -> None:
-    """Aggregator preserves non-block hook stdout on the allow path.
-
-    A side-effect hook writes informational text to stdout without emitting a
-    block decision. The aggregator must carry that text into
-    all_non_block_stdout so the dispatcher can write it to the real stdout on
-    the allow path.
-    """
+    """Preserve informational stdout when the aggregate allows."""
     informational_text = "https://htmlpreview.github.io/?https://gist.github.com/abc/123"
     all_results = [
         PostHostedHookResult(captured_stdout="", did_crash=False, is_blocking=True),
@@ -473,23 +265,18 @@ def test_non_block_stdout_preserved_in_aggregator_allow_path() -> None:
 
 
 def test_non_block_stdout_preserved_in_aggregator_block_path() -> None:
-    """Aggregator preserves non-block hook stdout even when another hook blocks.
-
-    When mypy_validator blocks and a side-effect hook wrote informational
-    text, both the block reason and the informational text survive in the
-    aggregated decision so _emit_block_decision can forward both to stdout.
-    """
-    mypy_block_json = json.dumps({"decision": BLOCK_DECISION, "reason": "[MYPY] Type errors: x"})
+    """Preserve informational stdout when another hook blocks."""
+    blocking_hook_block_json = json.dumps({"decision": BLOCK_DECISION, "reason": "[BLOCKING_HOOK] Type errors: x"})
     informational_text = "https://htmlpreview.github.io/?https://gist.github.com/abc/456"
     all_results = [
-        PostHostedHookResult(captured_stdout=mypy_block_json, did_crash=False, is_blocking=True),
+        PostHostedHookResult(captured_stdout=blocking_hook_block_json, did_crash=False, is_blocking=True),
         PostHostedHookResult(
             captured_stdout=informational_text, did_crash=False, is_blocking=False
         ),
     ]
     aggregated_decision = aggregate_post_hosted_hook_results(all_results)
     assert aggregated_decision.should_block, (
-        "Aggregator must block when mypy_validator blocks"
+        "Aggregator must block when blocking_hook_validator blocks"
     )
     assert informational_text in aggregated_decision.all_non_block_stdout, (
         "Aggregator must preserve non-block hook stdout even on the block path.\n"
@@ -499,39 +286,29 @@ def test_non_block_stdout_preserved_in_aggregator_block_path() -> None:
 
 
 def test_early_hook_crash_does_not_drop_later_blocking_hook_block() -> None:
-    """A crash in an early hook does not prevent a later blocking hook's block.
-
-    Simulates a scenario where a non-blocking hook crashes before mypy_validator
-    runs and blocks. The aggregated decision must still block, proving the
-    dispatcher continues past a crash to collect all results.
-    """
-    mypy_block_json = json.dumps(
-        {"decision": BLOCK_DECISION, "reason": "[MYPY] Type errors: y"}
+    """Keep a later blocking hook's decision after an earlier hook crashes."""
+    blocking_hook_block_json = json.dumps(
+        {"decision": BLOCK_DECISION, "reason": "[BLOCKING_HOOK] Type errors: y"}
     )
     all_results = [
         PostHostedHookResult(captured_stdout="", did_crash=True, is_blocking=False),
         PostHostedHookResult(
-            captured_stdout=mypy_block_json, did_crash=False, is_blocking=True
+            captured_stdout=blocking_hook_block_json, did_crash=False, is_blocking=True
         ),
     ]
     aggregated_decision = aggregate_post_hosted_hook_results(all_results)
     assert aggregated_decision.should_block, (
-        "An early non-blocking hook crash must not prevent mypy_validator's block "
+        "An early non-blocking hook crash must not prevent blocking_hook_validator's block "
         "from reaching the aggregated decision"
     )
-    assert any("[MYPY]" in each_reason for each_reason in aggregated_decision.all_block_reasons), (
-        "The mypy block reason must survive in the aggregated decision.\n"
+    assert any("[BLOCKING_HOOK]" in each_reason for each_reason in aggregated_decision.all_block_reasons), (
+        "The blocking_hook block reason must survive in the aggregated decision.\n"
         f"Block reasons: {aggregated_decision.all_block_reasons!r}"
     )
 
 
 def test_non_blocking_hook_crash_leaves_decision_allow() -> None:
-    """A crash in a non-blocking hook does not change an allow to a block.
-
-    A side-effect hook such as auto_formatter carries is_blocking=False. Its
-    crash must not surface a blocking signal — the aggregated decision stays
-    allow.
-    """
+    """Keep the aggregate allowed after a nonblocking hook crashes."""
     all_results = [
         PostHostedHookResult(captured_stdout="", did_crash=True, is_blocking=False),
     ]
@@ -542,12 +319,7 @@ def test_non_blocking_hook_crash_leaves_decision_allow() -> None:
 
 
 def test_empty_reason_block_still_blocks_with_fallback_reason() -> None:
-    """A block decision carrying an empty reason still blocks with a fallback reason.
-
-    A blocking hook that emits decision=block with an empty reason string must
-    still block. The aggregator substitutes EMPTY_REASON_BLOCK_FALLBACK so the
-    block is not silently downgraded to allow.
-    """
+    """Use a fallback reason when a block decision has no reason."""
     empty_reason_block_json = json.dumps({"decision": BLOCK_DECISION, "reason": ""})
     all_results = [
         PostHostedHookResult(
@@ -567,50 +339,8 @@ def test_empty_reason_block_still_blocks_with_fallback_reason() -> None:
     )
 
 
-def test_block_path_emits_single_parseable_json_object_on_stdout() -> None:
-    """On the block path the dispatcher emits a single parseable JSON object on stdout.
-
-    Writes a Python file with a real type error inside this repository so
-    mypy_validator discovers the project root and blocks, then asserts the
-    dispatcher's whole stdout parses as one JSON block object — no leading
-    informational text mixed onto the same stream.
-    """
-    type_error_file = _VALIDATION_DIR / "dispatcher_block_stdout_probe.py"
-    type_error_file.write_text(
-        "def add_one(value: int) -> int:\n    return value + 1\n\n\nadd_one('not an int')\n",
-        encoding="utf-8",
-    )
-    try:
-        payload_text = _write_payload(str(type_error_file), type_error_file.read_text())
-        completed_direct = _run_hook_subprocess(ALL_POST_HOSTED_HOOK_ENTRIES[0], payload_text)
-        direct_block, _direct_reason = _parse_block_decision(completed_direct)
-        assert direct_block, (
-            "Precondition failed: mypy_validator did not block a real type error directly. "
-            "Is mypy installed and the file inside the git project?\n"
-            f"stdout: {completed_direct.stdout!r}\nstderr: {completed_direct.stderr!r}"
-        )
-
-        dispatcher_result = _run_dispatcher(payload_text)
-        parsed_stdout = json.loads(dispatcher_result.stdout.strip())
-        assert isinstance(parsed_stdout, dict), (
-            "Dispatcher stdout on the block path must be a single JSON object.\n"
-            f"Got: {dispatcher_result.stdout!r}"
-        )
-        assert parsed_stdout.get("decision") == BLOCK_DECISION, (
-            "The single JSON object on stdout must carry the block decision.\n"
-            f"Got: {parsed_stdout!r}"
-        )
-    finally:
-        type_error_file.unlink(missing_ok=True)
-
-
 def test_blocking_hook_crash_surfaces_a_block() -> None:
-    """A crash in a blocking hook surfaces a block with a crash reason.
-
-    When a blocking hook (such as mypy_validator) crashes before emitting any
-    output, the aggregator must still block so a bad write does not silently
-    pass. The block reason must reference the dispatcher's crash signal.
-    """
+    """Surface a block with a crash reason when a blocking hook crashes."""
     all_results = [
         PostHostedHookResult(captured_stdout="", did_crash=True, is_blocking=True),
     ]
@@ -630,3 +360,10 @@ def test_blocking_hook_crash_surfaces_a_block() -> None:
         "BLOCKING_CRASH_DENY_REASON constant.\n"
         f"Got: {aggregated_decision.all_block_reasons!r}"
     )
+
+def test_live_roster_contains_only_nonblocking_hooks() -> None:
+    assert ALL_POST_HOSTED_HOOK_ENTRIES
+    assert all(not each_entry.is_blocking for each_entry in ALL_POST_HOSTED_HOOK_ENTRIES)
+    assert tuple(each_entry.script_relative_path for each_entry in ALL_POST_HOSTED_HOOK_ENTRIES) == (
+        "workflow/auto_formatter.py",
+    )

package/hooks/validators/run_all_validators.py

@@ -914,7 +914,11 @@ def validate_proposed_file(
         temporary_file = _temporary_path_preserving_directory_signal(
             Path(temporary_directory), file_path
         )
-        temporary_file.write_text(proposed_content, encoding="utf-8")
+        temporary_file.write_text(
+            proposed_content,
+            encoding="utf-8",
+            newline="",
+        )
         resolved_config_source_path = (
             config_source_path
             if config_source_path is not None

package/hooks/validators/security_checks.py

@@ -26,7 +26,58 @@ SECRET_PATTERNS: frozenset[str] = frozenset({
 SQL_EXECUTE_PATTERN = re.compile(r"\.execute\s*\(\s*f['\"]|\.execute\s*\([^)]*\.format\(", re.IGNORECASE)
 
 
+def _normalize_metadata_name(metadata_text: str) -> str:
+    return "".join(
+        each_character for each_character in metadata_text.lower() if each_character.isalnum()
+    )
+
+
+def _is_schema_key_metadata(variable_name: str, literal_text: str) -> bool:
+    return variable_name == "token_key" and _normalize_metadata_name(literal_text) == "token"
+
+
+def _is_header_metadata(variable_name: str, literal_text: str) -> bool:
+    if not variable_name.endswith("_header"):
+        return False
+    header_name = variable_name.removesuffix("_header")
+    return _normalize_metadata_name(literal_text) == _normalize_metadata_name(header_name)
+
+
+def _is_endpoint_template_metadata(variable_name: str, literal_text: str) -> bool:
+    if not variable_name.endswith("_endpoint_template"):
+        return False
+    endpoint_template_pattern = re.compile(r"^/[A-Za-z0-9_{}./-]+$")
+    if endpoint_template_pattern.fullmatch(literal_text) is None or "{" not in literal_text:
+        return False
+    endpoint_name = variable_name.removesuffix("_endpoint_template")
+    normalized_endpoint = _normalize_metadata_name(literal_text)
+    return all(each_word in normalized_endpoint for each_word in endpoint_name.split("_"))
+
+
+def _is_resource_name_metadata(variable_name: str, literal_text: str) -> bool:
+    if not variable_name.endswith("_resource_name"):
+        return False
+    all_label_words = literal_text.lower().split()
+    resource_name = variable_name.removesuffix("_resource_name")
+    return (
+        len(all_label_words) > 1
+        and all(each_word.isalpha() for each_word in all_label_words)
+        and _normalize_metadata_name(all_label_words[-1]) == _normalize_metadata_name(resource_name)
+    )
+
+
+def _is_secret_metadata(variable_name: str, literal_text: str) -> bool:
+    if _is_schema_key_metadata(variable_name, literal_text):
+        return True
+    if _is_header_metadata(variable_name, literal_text):
+        return True
+    if _is_endpoint_template_metadata(variable_name, literal_text):
+        return True
+    return _is_resource_name_metadata(variable_name, literal_text)
+
+
 def check_hardcoded_secrets(tree: ast.AST, filename: str) -> List[Violation]:
+    MINIMUM_SECRET_LENGTH = 3
     violations: List[Violation] = []
 
     for node in ast.walk(tree):
@@ -35,8 +86,12 @@ def check_hardcoded_secrets(tree: ast.AST, filename: str) -> List[Violation]:
                 if isinstance(target, ast.Name):
                     var_name = target.id.lower()
                     if any(pattern in var_name for pattern in SECRET_PATTERNS):
-                        if isinstance(node.value, ast.Constant) and isinstance(node.value.value, str):
-                            if len(node.value.value) > 3:
+                        if isinstance(node.value, ast.Constant) and isinstance(
+                            node.value.value, str
+                        ):
+                            if len(node.value.value) > MINIMUM_SECRET_LENGTH and not _is_secret_metadata(
+                                var_name, node.value.value
+                            ):
                                 violations.append(
                                     Violation(
                                         filename,

package/hooks/validators/test_hook_timing_harness.py

@@ -51,7 +51,6 @@ def test_write_edit_hook_commands_reads_the_real_hooks_json_roster() -> None:
     all_commands = hook_timing_harness.write_edit_hook_commands(_HOOKS_JSON_PATH)
     all_labels = [each_label for each_label, _each_command in all_commands]
     assert all_labels == [
-        "run_all_validators",
         "pre_tool_use_dispatcher",
         "post_tool_use_dispatcher",
         "session_file_edit_tracker",
@@ -169,17 +168,15 @@ def test_run_hosted_command_once_milliseconds_drives_the_real_tracker() -> None:
 
 
 def test_measure_hosted_command_wall_times_covers_the_real_roster() -> None:
-    """A live run against the real hooks.json roster returns all four hooks.
+    """A live run against the real hooks.json roster returns all three hooks.
 
     Runs each registered command once against a real repository file,
-    including ``run_all_validators``, so this is the one place the suite pays
-    its full wall time to prove the roster end to end.
+    so this is the one place the suite pays its full wall time to prove the roster end to end.
     """
     all_wall_times_by_label = hook_timing_harness.measure_hosted_command_wall_times(
         _HOOKS_JSON_PATH, _PACKAGE_ROOT, _REAL_TARGET_FILE, 1
     )
     assert set(all_wall_times_by_label) == {
-        "run_all_validators",
         "pre_tool_use_dispatcher",
         "post_tool_use_dispatcher",
         "session_file_edit_tracker",

package/hooks/validators/test_run_all_validators_mutation_tool_parity.py

@@ -12,17 +12,12 @@ from pathlib import Path
 
 import pytest
 
-from hooks_constants.pre_tool_use_dispatcher_constants import (
-    ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES,
-)
-
 from .run_all_validators import run_validators_entrypoint_subprocess
 
 pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
 
 HOOKS_JSON_PATH = Path(__file__).resolve().parents[1] / "hooks.json"
 VALIDATORS_RUNNER_COMMAND_MARKER = "validators.run_all_validators"
-MATCHER_TOOL_NAME_SEPARATOR = "|"
 DENY_DECISION_FRAGMENT = '"permissionDecision": "deny"'
 MAGIC_VALUE_VALIDATOR_NAME = "Magic Values"
 
@@ -91,7 +86,7 @@ def write_clean_module(target_directory: Path, module_name: str) -> Path:
 
 
 class TestMutationToolRegistration:
-    def test_validators_gate_is_registered_on_every_mutation_tool(self) -> None:
+    def test_validators_gate_has_no_live_mutation_registration(self) -> None:
         hooks_document = json.loads(HOOKS_JSON_PATH.read_text(encoding="utf-8"))
         all_matchers = [
             each_group["matcher"]
@@ -99,11 +94,8 @@ class TestMutationToolRegistration:
             for each_hook in each_group.get("hooks", [])
             if VALIDATORS_RUNNER_COMMAND_MARKER in each_hook.get("command", "")
         ]
-        assert len(all_matchers) == 1, all_matchers
-        assert (
-            set(all_matchers[0].split(MATCHER_TOOL_NAME_SEPARATOR))
-            == ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES
-        )
+        assert all_matchers == [], all_matchers
+
 
 
 class TestMultiEditPayloadLane: