claude-dev-env 7.0.0 → 7.2.0

package/.agents/skills/session-continuity/continuity.test.mjs

@@ -0,0 +1,373 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, utimesSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { spawn, spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+import { continuityHookConfiguration } from '../../../bin/install-session-continuity.mjs';
+
+const sourceDirectory = dirname(fileURLToPath(import.meta.url));
+const potetoText = '---\nname: Poteto Mode\n---\nPOTETO_SOURCE_EXPECTATION: prove the requested result.\n';
+const secondText = 'SECOND_SKILL_EXPECTATION: measure twice before changing files.\n';
+const sha256 = value => createHash('sha256').update(value).digest('hex');
+
+function fixture(t, host) {
+    const root = mkdtempSync(join(tmpdir(), 'continuity contract '));
+    t.after(() => rmSync(root, { recursive: true, force: true }));
+    const skill = join(root, '.agents', 'skills', 'session-continuity');
+    mkdirSync(skill, { recursive: true });
+    for (const file of ['SKILL.md', 'continuity.mjs']) copyFileSync(join(sourceDirectory, file), join(skill, file));
+    const poteto = join(root, '.agents', 'skills', 'pstack', 'poteto-mode', 'SKILL.md');
+    mkdirSync(dirname(poteto), { recursive: true });
+    writeFileSync(poteto, potetoText);
+    const second = join(root, 'second-skill.md');
+    writeFileSync(second, secondText);
+    const script = join(skill, 'continuity.mjs');
+    const configPath = join(root, host === 'claude' ? 'settings.json' : 'hooks.json');
+    writeFileSync(configPath, JSON.stringify({ ...(host === 'cursor' ? { version: 1 } : {}), hooks: continuityHookConfiguration(host, script) }));
+    const env = { ...process.env };
+    delete env.CDE_CONTINUITY_ROOT;
+    delete env.CDE_POTETO_SOURCE;
+    const pathFor = session => join(root, '.agents', 'state', 'session-continuity', host, `${sha256(session)}.json`);
+    const cli = (command, session, data, expectedStatus = 0) => {
+        const result = spawnSync(process.execPath, [script, command, host, session], { input: JSON.stringify(data || {}), encoding: 'utf8', env });
+        assert.equal(result.status, expectedStatus, result.stderr || result.stdout);
+        return expectedStatus ? result.stderr : JSON.parse(result.stdout);
+    };
+    const fire = (event, session, fields = {}) => {
+        const payload = { hook_event_name: event, cwd: root, ...(host === 'cursor' ? { conversation_id: session } : { session_id: session }), ...fields };
+        const config = JSON.parse(readFileSync(configPath, 'utf8'));
+        const groups = config.hooks[event] || [];
+        const matching = groups.filter(group => !group.matcher || new RegExp(group.matcher).test(event === 'SessionStart' ? fields.source : fields.command_name));
+        return matching.flatMap(group => (group.hooks || [group]).map(handler => {
+            const result = spawnSync(handler.command, { shell: true, input: JSON.stringify(payload), encoding: 'utf8', env });
+            assert.equal(result.status, 0, result.stderr);
+            return JSON.parse(result.stdout);
+        }));
+    };
+    const submit = (session, prompt) => fire('UserPromptSubmit', session, { prompt })[0];
+    const read = session => JSON.parse(readFileSync(pathFor(session), 'utf8'));
+    return { root, script, skill, poteto, second, pathFor, cli, fire, submit, read };
+}
+
+for (const host of ['claude', 'codex']) {
+    test(`${host}: configured invocation emits complete instructions, writes and reads back, restores without a path`, t => {
+        const f = fixture(t, host);
+        assert.equal(existsSync(f.pathFor('session-a')), false);
+        const prefix = host === 'codex' ? '$pstack:poteto-mode' : '/pstack:poteto-mode';
+        const prompt = `${prefix} for this entire session\nFinish the sample task. Keep changes local. Use second-skill for this task.`;
+        const output = f.submit('session-a', prompt);
+        assert.ok(output.systemMessage.includes(f.pathFor('session-a')));
+        const context = output.hookSpecificOutput.additionalContext;
+        assert.ok(context.includes(readFileSync(join(f.skill, 'SKILL.md'), 'utf8')));
+        assert.ok(context.includes(potetoText));
+        assert.ok(context.includes('Saved record read from disk:'));
+        let record = f.read('session-a');
+        assert.equal(record.requirements[0].scope, 'session');
+        assert.equal(record.requirements[0].source, f.poteto);
+        assert.equal(record.requirements[0].unavailable, null);
+        f.cli('update', 'session-a', {
+            expected_revision: record.revision, prompt_id: record.pending[0].id, quote: 'Finish the sample task.',
+            task: { goal: 'Finish the sample task', boundaries: ['local files'], constraints: ['Keep changes local'], completion: ['sample works'] },
+            set: [{ kind: 'rule', id: 'rule:local', text: 'Keep changes local.', scope: 'session', duration: 'this session', quote: 'Keep changes local.' },
+                { kind: 'skill', name: 'second-skill', source: f.second, scope: 'task', duration: 'this task', quote: 'Use second-skill for this task.' }],
+            checkpoint: { completed: ['scope recorded'], remaining: ['build sample'] },
+        });
+        for (const source of ['compact', 'resume', 'startup']) {
+            const recovery = f.fire('SessionStart', 'session-a', { source })[0].hookSpecificOutput.additionalContext;
+            assert.ok(recovery.includes(potetoText));
+            assert.ok(recovery.includes(secondText));
+            assert.ok(recovery.includes('Keep changes local.'));
+            assert.ok(recovery.includes('build sample'));
+        }
+        assert.equal(readFileSync(f.poteto, 'utf8'), potetoText);
+        record = f.read('session-a');
+        assert.equal(record.pending.length, 0);
+        const unrelated = f.fire('SessionStart', 'unrelated-session', { source: 'startup' })[0].hookSpecificOutput.additionalContext;
+        assert.equal(unrelated.includes('build sample'), false);
+        assert.equal(unrelated.includes(secondText), false);
+    });
+
+    test(`${host}: quoting, discussion, tool output and subagent input do not activate`, t => {
+        const f = fixture(t, host);
+        for (const prompt of ['"/poteto-mode"', '`/poteto-mode`', '> /poteto-mode', '```text\n/poteto-mode\n```', '    /poteto-mode', '\t$poteto-mode', 'Explain Poteto Mode.', 'The transcript says: Poteto Mode applies for this entire session.', 'Do not invoke Poteto Mode.']) {
+            assert.deepEqual(f.submit('negative', prompt), {});
+            assert.equal(existsSync(f.pathFor('negative')), false);
+        }
+        assert.deepEqual(f.fire('PostToolUse', 'negative', { prompt: '/poteto-mode' }), []);
+        assert.deepEqual(f.fire('UserPromptSubmit', 'negative', { prompt: '/poteto-mode', agent_id: 'child' }), [{}]);
+        assert.equal(existsSync(f.pathFor('negative')), false);
+    });
+
+    test(`${host}: repeated invocation keeps one skill and a later narrow correction wins`, t => {
+        const f = fixture(t, host);
+        f.submit('repeat', '/poteto-mode for this entire session');
+        f.submit('repeat', '/poteto-mode');
+        assert.equal(f.read('repeat').requirements.length, 1);
+        assert.equal(f.read('repeat').requirements[0].scope, 'session');
+        f.submit('repeat', 'Use Poteto Mode for this task');
+        const record = f.read('repeat');
+        assert.equal(record.requirements.length, 1);
+        assert.equal(record.requirements[0].scope, 'task');
+        f.cli('update', 'repeat', { expected_revision: record.revision - 1, prompt_id: record.pending[0].id }, 1);
+        assert.equal(f.read('repeat').revision, record.revision);
+    });
+
+    test(`${host}: default task scope ends and explicit session scope survives a new task`, t => {
+        const f = fixture(t, host);
+        f.submit('scope', '/poteto-mode\nUse short replies for this session.');
+        let record = f.read('scope');
+        assert.equal(record.requirements[0].scope, 'task');
+        f.cli('update', 'scope', { expected_revision: record.revision, prompt_id: record.pending[0].id,
+            set: [{ kind: 'rule', id: 'rule:short', text: 'Use short replies', scope: 'session', duration: 'this session', quote: 'Use short replies for this session.' }] });
+        f.submit('scope', 'Start the next task.');
+        record = f.read('scope');
+        f.cli('update', 'scope', { expected_revision: record.revision, prompt_id: record.pending[0].id, quote: 'Start the next task.', new_task: true,
+            task: { goal: 'next task', boundaries: [], constraints: [], completion: ['verified'] } });
+        const recovery = f.fire('SessionStart', 'scope', { source: 'compact' })[0].hookSpecificOutput.additionalContext;
+        assert.ok(recovery.includes('Use short replies'));
+        assert.equal(recovery.includes(potetoText), false);
+    });
+
+    test(`${host}: source changes are compared and missing sources never use remembered contents`, t => {
+        const f = fixture(t, host);
+        f.submit('source', '/poteto-mode');
+        writeFileSync(f.poteto, potetoText.replace('prove the requested result', 'inspect the current result'));
+        const changed = f.fire('SessionStart', 'source', { source: 'compact' })[0].hookSpecificOutput.additionalContext;
+        assert.ok(changed.includes('CHANGED skill'));
+        assert.ok(changed.includes('before_excerpt'));
+        assert.ok(changed.includes('inspect the current result'));
+        unlinkSync(f.poteto);
+        const missing = f.fire('SessionStart', 'source', { source: 'resume' })[0].hookSpecificOutput.additionalContext;
+        assert.ok(missing.includes('UNAVAILABLE skill'));
+        assert.equal(missing.includes('POTETO_SOURCE_EXPECTATION'), false);
+    });
+
+    test(`${host}: sessions in the same repository never select each other's newer record`, t => {
+        const f = fixture(t, host);
+        f.submit('a', '/poteto-mode for this task');
+        f.submit('b', '/poteto-mode for this entire session');
+        const old = new Date('2000-01-01');
+        utimesSync(f.pathFor('b'), old, old);
+        assert.notEqual(f.pathFor('a'), f.pathFor('b'));
+        assert.equal(f.cli('show', 'a').record.requirements[0].scope, 'task');
+        assert.equal(f.cli('show', 'b').record.requirements[0].scope, 'session');
+        assert.ok(f.fire('SessionStart', 'b', { source: 'resume' })[0].hookSpecificOutput.additionalContext.includes(f.pathFor('b')));
+    });
+
+    test(`${host}: deactivation survives compaction and restart; explicit invocation starts a fresh set`, t => {
+        const f = fixture(t, host);
+        f.submit('off', '/poteto-mode for this entire session');
+        const disabled = f.submit('off', '/session-continuity off');
+        assert.ok(disabled.systemMessage.includes('deactivated'));
+        if (host === 'claude') f.fire('UserPromptExpansion', 'off', { expansion_type: 'slash_command', command_name: 'session-continuity', prompt: '/session-continuity off' });
+        assert.equal(f.read('off').status, 'inactive');
+        assert.deepEqual(f.fire('SessionStart', 'off', { source: 'compact' }), [{}]);
+        assert.deepEqual(f.fire('SessionStart', 'off', { source: 'resume' }), [{}]);
+        assert.deepEqual(f.submit('off', 'Explain Poteto Mode.'), {});
+        f.submit('off', '/poteto-mode');
+        assert.equal(f.read('off').requirements.length, 1);
+        assert.equal(f.read('off').requirements[0].scope, 'task');
+        assert.equal(readFileSync(f.poteto, 'utf8'), potetoText);
+    });
+
+    test(`${host}: explicit handoff binds a fresh id and refuses an existing or deactivated target`, t => {
+        const f = fixture(t, host);
+        f.submit('from', '/poteto-mode for this entire session');
+        f.submit('from', 'Hand off this work to the new session.');
+        const source = f.read('from');
+        const data = { expected_revision: source.revision, prompt_id: source.pending.at(-1).id, quote: 'Hand off this work to the new session.', to_host: host, to_session_id: 'to' };
+        const result = f.cli('handoff', 'from', data);
+        assert.equal(result.path, f.pathFor('to'));
+        const recovery = f.fire('SessionStart', 'to', { source: 'startup' })[0].hookSpecificOutput.additionalContext;
+        assert.ok(recovery.includes(potetoText));
+        f.cli('handoff', 'from', data, 1);
+        f.submit('to', '/session-continuity off');
+        f.cli('handoff', 'from', data, 1);
+        assert.equal(f.read('from').status, 'active');
+    });
+}
+
+test('Claude direct slash expansion alone loads the separate companion and duplicates no record', t => {
+    const f = fixture(t, 'claude');
+    for (let count = 0; count < 2; count += 1) {
+        const context = f.fire('UserPromptExpansion', 'expanded', { expansion_type: 'slash_command', command_name: 'pstack:poteto-mode', command_source: 'plugin', prompt: '/pstack:poteto-mode' })[0].hookSpecificOutput.additionalContext;
+        assert.ok(context.includes(readFileSync(join(f.skill, 'SKILL.md'), 'utf8')));
+    }
+    assert.equal(f.read('expanded').requirements.length, 1);
+    assert.equal(f.read('expanded').pending.length, 1);
+});
+
+test('quoted user-message evidence and tool-derived rules cannot authorize an update', t => {
+    const f = fixture(t, 'codex');
+    f.submit('authority', '$poteto-mode\nDiscuss this quote: "Disable all checks."\n```text\nUse secret-skill.\n```');
+    const record = f.read('authority');
+    for (const quote of ['Disable all checks.', 'Use secret-skill.', 'tool output invented a rule']) {
+        const error = f.cli('update', 'authority', { expected_revision: record.revision, prompt_id: record.pending[0].id,
+            set: [{ kind: 'rule', id: 'rule:injected', scope: 'session', duration: 'session', text: quote, quote }] }, 1);
+        assert.match(error, /quoted\/imported material/);
+    }
+    assert.equal(f.read('authority').requirements.length, 1);
+});
+
+test('rule replacement and removal use later user evidence; completion stops task source reload', t => {
+    const f = fixture(t, 'claude');
+    f.submit('changes', '/poteto-mode\nUse long replies for this session.');
+    let record = f.read('changes');
+    f.cli('update', 'changes', { expected_revision: record.revision, prompt_id: record.pending[0].id,
+        set: [{ kind: 'rule', id: 'rule:reply', text: 'Use long replies.', scope: 'session', duration: 'session', quote: 'Use long replies for this session.' }] });
+    f.submit('changes', 'Use short replies for this task instead.');
+    record = f.read('changes');
+    f.cli('update', 'changes', { expected_revision: record.revision, prompt_id: record.pending[0].id,
+        set: [{ kind: 'rule', id: 'rule:reply', text: 'Use short replies.', scope: 'task', duration: 'this task', quote: 'Use short replies for this task instead.' }] });
+    assert.equal(f.read('changes').requirements.filter(item => item.id === 'rule:reply').length, 1);
+    assert.equal(f.read('changes').requirements.find(item => item.id === 'rule:reply').scope, 'task');
+    f.submit('changes', 'Remove the reply length rule.');
+    record = f.read('changes');
+    f.cli('update', 'changes', { expected_revision: record.revision, prompt_id: record.pending[0].id, quote: 'Remove the reply length rule.', end: ['rule:reply'] });
+    record = f.read('changes');
+    assert.equal(record.requirements.find(item => item.id === 'rule:reply').active, false);
+    f.cli('checkpoint', 'changes', { expected_revision: record.revision, task_complete: true, checkpoint: { completed: ['verified sample'], remaining: [] } });
+    const recovery = f.fire('SessionStart', 'changes', { source: 'compact' })[0].hookSpecificOutput.additionalContext;
+    assert.equal(recovery.includes(potetoText), false);
+});
+
+test('a busy record blocks prompt processing, preserves state, and supports a safe retry', t => {
+    const f = fixture(t, 'claude');
+    f.submit('busy', '/poteto-mode');
+    const before = readFileSync(f.pathFor('busy'), 'utf8');
+    writeFileSync(f.pathFor('busy') + '.lock', 'test-writer');
+    const blocked = f.submit('busy', 'Use short replies for this session.');
+    assert.equal(blocked.decision, 'block');
+    assert.match(blocked.reason, /Record busy/);
+    assert.equal(readFileSync(f.pathFor('busy'), 'utf8'), before);
+    unlinkSync(f.pathFor('busy') + '.lock');
+    f.submit('busy', 'Use short replies for this session.');
+    assert.equal(f.read('busy').pending.length, 2);
+});
+
+test('clear drops a reused host id rather than inheriting an unrelated task', t => {
+    const f = fixture(t, 'claude');
+    f.submit('clear', '/poteto-mode for this entire session\nKeep the sample local.');
+    const before = f.read('clear');
+    f.fire('SessionStart', 'clear', { source: 'clear' });
+    const record = f.read('clear');
+    assert.equal(record.status, 'active');
+    assert.notEqual(record.task.id, before.task.id);
+    assert.deepEqual(record.pending, []);
+    assert.deepEqual(record.requirements.map(entry => entry.id), ['skill:pstack:poteto-mode']);
+    assert.equal(record.requirements[0].automatic, true);
+});
+
+for (const host of ['claude', 'codex']) {
+    test(`${host}: session start and compaction activate Poteto Mode with no explicit invocation`, t => {
+        const f = fixture(t, host);
+        const started = f.fire('SessionStart', 'auto', { source: 'startup' })[0];
+        assert.ok(started.systemMessage.includes(f.pathFor('auto')));
+        assert.ok(started.hookSpecificOutput.additionalContext.includes(potetoText));
+        const record = f.read('auto');
+        assert.equal(record.requirements.length, 1);
+        assert.equal(record.requirements[0].scope, 'session');
+        assert.equal(record.requirements[0].automatic, true);
+        assert.equal(record.requirements[0].source, f.poteto);
+        assert.deepEqual(record.pending, []);
+        for (const source of ['compact', 'resume']) {
+            const later = f.fire('SessionStart', 'auto', { source })[0].hookSpecificOutput.additionalContext;
+            assert.ok(later.includes(potetoText));
+        }
+        assert.equal(f.read('auto').revision, record.revision);
+        f.submit('auto', '/session-continuity off');
+        assert.deepEqual(f.fire('SessionStart', 'auto', { source: 'compact' }), [{}]);
+        assert.deepEqual(f.fire('SessionStart', 'auto', { source: 'startup' }), [{}]);
+    });
+
+    test(`${host}: an unavailable Poteto source stops automatic activation without writing a record`, t => {
+        const f = fixture(t, host);
+        writeFileSync(f.poteto, '---\nname: Something Else\n---\n');
+        const started = f.fire('SessionStart', 'broken', { source: 'startup' })[0];
+        assert.match(started.systemMessage, /did not activate Poteto Mode/);
+        assert.equal(existsSync(f.pathFor('broken')), false);
+    });
+}
+
+test('cursor: session start injects Poteto Mode and compaction reloads it on the next tool result', t => {
+    const f = fixture(t, 'cursor');
+    const started = f.fire('sessionStart', 'cursor-a', { session_id: 'composer-1', composer_mode: 'agent' })[0];
+    assert.ok(started.additional_context.includes(potetoText));
+    assert.equal(f.read('cursor-a').requirements[0].automatic, true);
+    assert.deepEqual(f.fire('postToolUse', 'cursor-a', { tool_name: 'Shell' }), [{}]);
+    const compacting = f.fire('preCompact', 'cursor-a', { trigger: 'auto' })[0];
+    assert.ok(compacting.user_message.includes('Poteto Mode'));
+    assert.equal(f.read('cursor-a').reload_pending, true);
+    const reloaded = f.fire('postToolUse', 'cursor-a', { tool_name: 'Shell' })[0];
+    assert.ok(reloaded.additional_context.includes(potetoText));
+    assert.ok(reloaded.additional_context.includes(f.pathFor('cursor-a')));
+    assert.equal(f.read('cursor-a').reload_pending, false);
+    assert.deepEqual(f.fire('postToolUse', 'cursor-a', { tool_name: 'Shell' }), [{}]);
+});
+
+test('cursor: a prompt records evidence, never blocks submission, and reloads named skills after a tool result', t => {
+    const f = fixture(t, 'cursor');
+    f.fire('sessionStart', 'cursor-b', { session_id: 'composer-2' });
+    const submitted = f.fire('beforeSubmitPrompt', 'cursor-b', { prompt: 'Finish the sample task.', generation_id: 'gen-1' })[0];
+    assert.equal(submitted.continue, true);
+    assert.equal(f.read('cursor-b').pending.length, 1);
+    const invoked = f.fire('beforeSubmitPrompt', 'cursor-b', { prompt: '/poteto-mode for this entire session', generation_id: 'gen-2' })[0];
+    assert.equal(invoked.continue, true);
+    assert.equal(f.read('cursor-b').reload_pending, true);
+    assert.ok(f.fire('postToolUse', 'cursor-b', { tool_name: 'Read' })[0].additional_context.includes(potetoText));
+    const off = f.fire('beforeSubmitPrompt', 'cursor-b', { prompt: '/session-continuity off', generation_id: 'gen-3' })[0];
+    assert.equal(off.continue, true);
+    assert.equal(f.read('cursor-b').status, 'inactive');
+    assert.deepEqual(f.fire('sessionStart', 'cursor-b', { session_id: 'composer-2' }), [{}]);
+    assert.deepEqual(f.fire('preCompact', 'cursor-b', { trigger: 'manual' }), [{}]);
+});
+
+test('missing host identity and corrupt records produce visible recovery failures', t => {
+    const f = fixture(t, 'codex');
+    const missing = f.fire('UserPromptSubmit', '', { prompt: '$poteto-mode' })[0];
+    assert.equal(missing.decision, 'block');
+    f.submit('corrupt', '$poteto-mode');
+    writeFileSync(f.pathFor('corrupt'), '{bad json');
+    const failure = f.fire('SessionStart', 'corrupt', { source: 'resume' })[0];
+    assert.match(failure.systemMessage, /Session continuity failed/);
+    assert.match(failure.hookSpecificOutput.additionalContext, /Stop dependent work/);
+});
+
+for (const host of ['claude', 'codex']) {
+    test(`${host}: two simultaneous configured callbacks keep distinct session records`, async t => {
+        const f = fixture(t, host);
+        const configuration = continuityHookConfiguration(host, f.script);
+        const command = configuration.UserPromptSubmit[0].hooks[0].command;
+        const fire = (session, scope) => new Promise((resolve, reject) => {
+            const env = { ...process.env };
+            delete env.CDE_CONTINUITY_ROOT;
+            delete env.CDE_POTETO_SOURCE;
+            const child = spawn(command, { shell: true, env });
+            let stdout = '';
+            let stderr = '';
+            child.stdout.on('data', chunk => { stdout += chunk; });
+            child.stderr.on('data', chunk => { stderr += chunk; });
+            child.on('error', reject);
+            child.on('close', code => code ? reject(new Error(stderr)) : resolve(JSON.parse(stdout)));
+            child.stdin.end(JSON.stringify({ hook_event_name: 'UserPromptSubmit', session_id: session, cwd: f.root, prompt: `/poteto-mode for this ${scope}` }));
+        });
+        await Promise.all([fire('parallel-a', 'task'), fire('parallel-b', 'entire session')]);
+        assert.equal(f.read('parallel-a').requirements[0].scope, 'task');
+        assert.equal(f.read('parallel-b').requirements[0].scope, 'session');
+        assert.notEqual(f.pathFor('parallel-a'), f.pathFor('parallel-b'));
+    });
+}
+
+test('a new explicit invocation after task completion starts a distinct task without restoring ended rules', t => {
+    const f = fixture(t, 'claude');
+    f.submit('completed', '/poteto-mode');
+    const before = f.read('completed');
+    f.cli('checkpoint', 'completed', { expected_revision: before.revision, task_complete: true, checkpoint: { completed: ['verified'], remaining: [] } });
+    const output = f.submit('completed', '/poteto-mode');
+    assert.notEqual(f.read('completed').task.id, before.task.id);
+    assert.equal(f.read('completed').task.completed, false);
+    assert.ok(output.hookSpecificOutput.additionalContext.includes(potetoText));
+});

package/.agents/skills/syncing-submodules/scripts/test_sync_parent_pointer.py

@@ -74,10 +74,3 @@ def test_success_emits_one_json_record(
     assert exit_code == 0
     assert sync_record["status"] == "not_submodule"
     assert captured_error == ""
-
-
-def test_native_post_commit_source_and_test_are_removed() -> None:
-    hook_directory = Path(__file__).resolve().parents[4] / "hooks" / "git-hooks"
-
-    assert not (hook_directory / "post_commit.py").exists()
-    assert not (hook_directory / "test_post_commit.py").exists()

package/.agents/skills/windows-scheduled-task/SKILL.md

@@ -0,0 +1,153 @@
+---
+name: windows-scheduled-task
+description: >-
+  Register a repeating headless Windows scheduled task from PowerShell, with endless repetition, an S4U or Interactive principal, absolute action paths, and a documented teardown. Triggers: register a scheduled task, repeating task, headless task, S4U, Task Scheduler, RepetitionDuration, task will not register, scheduled task access denied, Unregister-ScheduledTask.
+---
+
+# Windows scheduled task
+
+## Contents
+
+- Principle
+- Gotchas
+- When this applies
+- Process
+- Endless repetition
+- Headless principal
+- Absolute paths in the action
+- Settings
+- Placement outside managed paths
+- Status
+- Removal and teardown
+- Self-modification warning
+- Verification
+- Files
+
+## Principle
+
+A registered task carries four decisions. How it repeats, which principal runs it, which absolute
+executable it starts, and where its target files sit. Settle all four at registration time, then
+prove the task by the artifact it changes.
+
+## Gotchas
+
+- `New-ScheduledTaskTrigger -RepetitionDuration ([TimeSpan]::MaxValue)` fails the task XML schema with `The task XML contains a value which is incorrectly formatted or out of range. (10,42):Duration:P99999999DT23H59M59S`.
+- `-LogonType S4U` requires an elevated shell. An unelevated `Register-ScheduledTask` ends with `Access is denied.`
+- Task Scheduler inherits none of the shell PATH. A bare executable name in the action fails at run time.
+- A helper under an installer-managed path deletes itself during an installer run.
+- `LastTaskResult: 0` from a run that took the idle branch says nothing about the branch that acts.
+
+## When this applies
+
+Use this skill for a repeating Windows task registered from PowerShell through the ScheduledTasks
+module. Register the task in an elevated shell when the task must run while the user is signed out.
+
+## Process
+
+1. Resolve every executable in the action with `Get-Command <name>` and read `.Source`.
+2. Read `files[]` in `~/.claude/.claude-dev-env-manifest.json` and pick a directory that list omits.
+3. Build the action with the absolute executable path and `-WindowStyle Hidden` inside the argument string.
+4. Build a `-Once` trigger with a repetition interval and no duration, then clear the duration on the trigger object.
+5. Build the settings set.
+6. Register with an S4U principal, catch the registration failure, and register with an Interactive principal.
+7. Report which principal the registered task holds.
+8. Drive the branch that does the work and read the artifact it changes.
+9. Document the removal command beside the task.
+
+## Endless repetition
+
+```powershell
+$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 30)
+$Trigger.Repetition.Duration = ''
+$Trigger.Repetition.StopAtDurationEnd = $false
+```
+
+An empty duration string on the trigger object registers a repetition that keeps firing. Build the
+trigger without a duration argument and set the two properties afterward.
+
+## Headless principal
+
+```powershell
+$Principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType S4U
+try {
+    Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Settings $Settings -Principal $Principal -Force -ErrorAction Stop
+    $PrincipalKind = 'S4U'
+} catch {
+    $Principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive
+    Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Settings $Settings -Principal $Principal -Force
+    $PrincipalKind = 'Interactive'
+}
+```
+
+S4U runs the task with no window whether or not the user is signed in, and its registration needs an
+elevated shell. The Interactive principal with `-WindowStyle Hidden` in the action runs windowless
+while the user is signed in. Report `$PrincipalKind` so the operator knows which one the task holds.
+
+## Absolute paths in the action
+
+```powershell
+$PwshPath = (Get-Command pwsh).Source
+$Action = New-ScheduledTaskAction -Execute $PwshPath -Argument "-NoProfile -WindowStyle Hidden -File ""$ScriptPath"""
+```
+
+Resolve each executable at registration time and store the absolute path in the action. Give the
+script an absolute path too.
+
+## Settings
+
+```powershell
+$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew -ExecutionTimeLimit (New-TimeSpan -Hours 1)
+```
+
+These settings keep the task firing on battery power, catch up a missed run, drop an overlapping
+start, and cap a hung run.
+
+## Placement outside managed paths
+
+The claude-dev-env installer records every managed path in `~/.claude/.claude-dev-env-manifest.json`
+under `files[]`, and `--update` removes those paths before it reinstalls from the package. A helper
+that a task starts from a managed directory disappears mid-run. Read `files[]`, then place the
+helper and its state files in a directory the manifest omits, such as a path under `<user home>`
+outside `~/.claude`.
+
+## Status
+
+```powershell
+$Info = Get-ScheduledTaskInfo -TaskName $TaskName
+$Info.LastRunTime
+$Info.LastTaskResult
+$Info.NextRunTime
+```
+
+## Removal and teardown
+
+```powershell
+Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false
+```
+
+Put this command in the same document that describes the task.
+
+## Self-modification warning
+
+A task that installs updates of the agent rules, hooks, and skills rewrites the running session
+instructions on a timer. A major upgrade can land mid-session while the agent holds the older text.
+Give the operator the teardown command, name the interval, and keep the interval wide enough for a
+session to finish between runs.
+
+## Verification
+
+A run that takes the idle branch reports `LastTaskResult: 0`, and that result covers the idle branch
+alone. Prove the acting branch: create the condition the task acts on, wait one interval, then read
+the artifact the task changes and its timestamp.
+
+## Files
+
+- `SKILL.md`. Registration rules, worked examples, status, and teardown.
+
+`packages/claude-dev-env/scripts/Install-SweepEmptyDirs.ps1` is the working model in this repository
+for the install, `-Remove`, and `-Status` parameter sets and symmetric teardown.
+
+```text
+windows-scheduled-task/
+└── SKILL.md
+```

package/bin/cde.mjs

@@ -6,17 +6,19 @@ import path from "node:path";
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const lintScriptPath = path.join(packageRoot, "scripts", "cde_lint.py");
+const verificationScriptPath = path.join(packageRoot, "scripts", "local_verification", "cli.py");
 const posixSignalStatusOffset = 128;
 const lintCommandName = "lint";
+const verifyCommandName = "verify";
 const pythonOptionName = "--python";
 const pythonEnvironmentName = "CDE_PYTHON";
 
 
 export function createHelpText() {
     return [
-        "Usage: cde lint [options]",
+        "Usage: cde <lint|verify> [options]",
         "",
-        "Run the policy linter. Source modes are mutually exclusive:",
+        "Run the policy linter with cde lint. Source modes are mutually exclusive:",
         "  --files PATH [PATH ...]  Current worktree files",
         "  --staged                 Staged index content",
         "  --base REVISION          Changes from a base revision",
@@ -29,6 +31,12 @@ export function createHelpText() {
         "  --python <command>       Python interpreter override",
         "  Exit 0 clean, 1 diagnostics, 2 invalid input or start failure, 3 failed rule",
         "",
+        "Run the required-check manifest with cde verify:",
+        "  --manifest PATH           JSON required-check manifest",
+        "  --repo PATH               Candidate repository root",
+        "  --base SHA                Trusted base revision",
+        "  --output PATH             JSON verification report",
+        "",
         "Python may also be selected with CDE_PYTHON.",
     ].join("\n");
 }
@@ -59,6 +67,14 @@ export function buildLintCommand(interpreter, forwardedArguments) {
 }
 
 
+export function buildVerifyCommand(interpreter, forwardedArguments) {
+    return {
+        executable: interpreter,
+        arguments: [verificationScriptPath, ...forwardedArguments],
+    };
+}
+
+
 function takePythonOverride(allArguments) {
     const remainingArguments = [];
     let interpreterOverride;
@@ -110,7 +126,7 @@ function statusCodeForSignal(signalName) {
 }
 
 
-export function runLintCommand(command, dependencies = {}) {
+function runChildCommand(command, failureMessage, dependencies = {}) {
     const runChild = dependencies.runChild ?? spawn;
     const processEmitter = dependencies.processEmitter ?? process;
     return new Promise((resolve) => {
@@ -122,14 +138,14 @@ export function runLintCommand(command, dependencies = {}) {
                 windowsHide: true,
             });
         } catch {
-            processEmitter.stderr.write("Unable to start the policy linter.\n");
+            processEmitter.stderr.write(`${failureMessage}\n`);
             resolve(2);
             return;
         }
         const detachSignals = attachSignalForwarding(childProcess, processEmitter);
         childProcess.on("error", () => {
             detachSignals();
-            processEmitter.stderr.write("Unable to start the policy linter.\n");
+            processEmitter.stderr.write(`${failureMessage}\n`);
             resolve(2);
         });
         childProcess.on("close", (exitCode, signalName) => {
@@ -144,12 +160,22 @@ export function runLintCommand(command, dependencies = {}) {
 }
 
 
+export function runLintCommand(command, dependencies = {}) {
+    return runChildCommand(command, "Unable to start the policy linter.", dependencies);
+}
+
+
+export function runVerifyCommand(command, dependencies = {}) {
+    return runChildCommand(command, "Unable to start verification.", dependencies);
+}
+
+
 export async function main(argumentsList = process.argv.slice(2), dependencies = {}) {
     if (argumentsList.length === 0 || argumentsList.includes("--help") || argumentsList.includes("-h")) {
         process.stdout.write(`${createHelpText()}\n`);
         return 0;
     }
-    if (argumentsList[0] !== lintCommandName) {
+    if (![lintCommandName, verifyCommandName].includes(argumentsList[0])) {
         process.stderr.write(`${createHelpText()}\n`);
         return 2;
     }
@@ -164,8 +190,10 @@ export async function main(argumentsList = process.argv.slice(2), dependencies =
         process.stderr.write("No usable Python interpreter found. Use --python or CDE_PYTHON.\n");
         return 2;
     }
-    const command = buildLintCommand(interpreter, remainingArguments);
-    const runCommand = dependencies.runCommand ?? runLintCommand;
+    const buildCommand = argumentsList[0] === lintCommandName ? buildLintCommand : buildVerifyCommand;
+    const command = buildCommand(interpreter, remainingArguments);
+    const runCommand = dependencies.runCommand
+        ?? (argumentsList[0] === lintCommandName ? runLintCommand : runVerifyCommand);
     return await runCommand(command, dependencies);
 }