claude-dev-env 7.0.0 → 7.2.0

package/hooks/blocking/question_to_user_enforcer.py

@@ -1,130 +0,0 @@
-#!/usr/bin/env python3
-"""
-Stop hook that blocks Claude responses asking the user questions in prose.
-
-User-directed questions must route through the AskUserQuestion tool so the user
-sees structured options with labels. When the final paragraph of the response
-ends with a question mark or contains a recognized preamble phrase
-("would you like", "should I", "do you want", "want me to", etc.), Claude is
-forced to re-output the response with the ask moved into an AskUserQuestion
-tool call.
-"""
-
-import json
-import re
-import sys
-from pathlib import Path
-
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.messages import USER_FACING_ASKUSERQUESTION_NOTICE  # noqa: E402
-from hooks_constants.text_stripping import strip_code_and_quotes  # noqa: E402
-
-
-def extract_final_paragraph(text: str) -> str:
-    """Return the last non-empty paragraph of the prose after stripping code and quotes."""
-    paragraph_split_pattern = re.compile(r"\n\s*\n")
-    prose_text = strip_code_and_quotes(text)
-    candidate_paragraphs = [
-        each_paragraph.strip()
-        for each_paragraph in paragraph_split_pattern.split(prose_text)
-        if each_paragraph.strip()
-    ]
-    if not candidate_paragraphs:
-        return ""
-    return candidate_paragraphs[-1]
-
-
-def find_user_directed_question_indicators(text: str) -> list[str]:
-    """Return indicator names for every user-directed question signal in the final paragraph."""
-    all_preamble_patterns = [
-        (re.compile(regex_text, re.IGNORECASE), display_name)
-        for regex_text, display_name in [
-            (r"\bwould\s+you\s+like\b", "would you like"),
-            (r"\bshould\s+i\b", "should i"),
-            (r"\bdo\s+you\s+want\b", "do you want"),
-            (r"\bwhich\s+would\s+you\s+prefer\b", "which would you prefer"),
-            (r"\blet\s+me\s+know\s+if\b", "let me know if"),
-            (r"\blet\s+me\s+know\s+which\b", "let me know which"),
-            (r"\blet\s+me\s+know\s+whether\b", "let me know whether"),
-            (r"\bplease\s+confirm\b", "please confirm"),
-            (r"\bplease\s+let\s+me\s+know\b", "please let me know"),
-            (r"\bwant\s+me\s+to\b", "want me to"),
-        ]
-    ]
-    terminal_question_mark_pattern = re.compile(r"\?[\s\"'\)\]\}]*\Z")
-    terminal_question_mark_indicator = "terminal question mark in final paragraph"
-
-    final_paragraph = extract_final_paragraph(text)
-    if not final_paragraph:
-        return []
-
-    matched_indicators: list[str] = []
-
-    if terminal_question_mark_pattern.search(final_paragraph.rstrip()):
-        matched_indicators.append(terminal_question_mark_indicator)
-
-    for each_pattern, each_display_name in all_preamble_patterns:
-        if (
-            each_pattern.search(final_paragraph)
-            and each_display_name not in matched_indicators
-        ):
-            matched_indicators.append(each_display_name)
-
-    return matched_indicators
-
-
-def main() -> None:
-    try:
-        hook_input = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        sys.exit(0)
-
-    if hook_input.get("stop_hook_active", False):
-        sys.exit(0)
-
-    assistant_message = hook_input.get("last_assistant_message", "")
-
-    if not assistant_message:
-        sys.exit(0)
-
-    matched_indicators = find_user_directed_question_indicators(assistant_message)
-
-    if not matched_indicators:
-        sys.exit(0)
-
-    formatted_indicator_list = ", ".join(
-        f'"{each_indicator}"' for each_indicator in matched_indicators
-    )
-
-    block_reason = (
-        f"ASKUSERQUESTION GUARDRAIL: Your response asks the user a question in prose "
-        f"(indicators: {formatted_indicator_list}). "
-        f"User-directed questions must route through the AskUserQuestion tool so the user "
-        f"sees structured options with labels.\n\n"
-        f"Re-output your response with the trailing question removed from prose and moved "
-        f"into an AskUserQuestion tool call. Rhetorical questions answered in the same "
-        f"paragraph are allowed; questions inside code fences, inline code, and blockquotes "
-        f"are ignored.\n\n"
-        f"You MUST re-output the complete, revised response with the correction applied."
-    )
-    block_response = {
-        "decision": "block",
-        "reason": block_reason,
-        "systemMessage": USER_FACING_ASKUSERQUESTION_NOTICE,
-        "suppressOutput": True,
-    }
-    log_hook_block(
-        calling_hook_name="question_to_user_enforcer.py",
-        hook_event="Stop",
-        block_reason=block_reason,
-    )
-    print(json.dumps(block_response))
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()

package/hooks/blocking/send_user_file_open_locally_blocker.py

@@ -1,71 +0,0 @@
-#!/usr/bin/env python3
-"""PreToolUse hook: block SendUserFile attaches that should open locally.
-
-SendUserFile attaches a file to the session. While the user is at the terminal
-(status "normal" or unset) an attach does not let them see the file — it must
-open on screen in its native Windows app. The corrective message names the
-``Invoke-Item -LiteralPath`` form. The one attach allowed through is an
-away-from-desk phone push (status "proactive").
-"""
-
-import json
-import sys
-from pathlib import Path
-
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.send_user_file_open_locally_blocker_constants import (  # noqa: E402
-    CORRECTIVE_MESSAGE,
-    PROACTIVE_STATUS,
-    TOOL_NAME,
-)
-
-
-def _should_block(status: str) -> bool:
-    """Return whether a SendUserFile call with this status should be denied.
-
-    Args:
-        status: The ``status`` field from the SendUserFile input. A proactive
-            phone push is allowed; every other value, including an empty one,
-            is a desk-side attach the user cannot see and is denied.
-    """
-    return status != PROACTIVE_STATUS
-
-
-def main() -> None:
-    try:
-        hook_input = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        sys.exit(0)
-
-    if hook_input.get("tool_name", "") != TOOL_NAME:
-        sys.exit(0)
-
-    tool_input = hook_input.get("tool_input") or {}
-    status = tool_input.get("status", "")
-    if not _should_block(status):
-        sys.exit(0)
-
-    deny_payload = {
-        "hookSpecificOutput": {
-            "hookEventName": "PreToolUse",
-            "permissionDecision": "deny",
-            "permissionDecisionReason": CORRECTIVE_MESSAGE,
-        }
-    }
-    log_hook_block(
-        calling_hook_name="send_user_file_open_locally_blocker.py",
-        hook_event="PreToolUse",
-        block_reason=CORRECTIVE_MESSAGE,
-        tool_name=TOOL_NAME,
-    )
-    print(json.dumps(deny_payload))
-    sys.stdout.flush()
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()

package/hooks/blocking/sensitive_file_protector.py

@@ -1,167 +0,0 @@
-#!/usr/bin/env python3
-"""Deny a Write, Edit, or MultiEdit whose target filename names a secret or a lock file.
-
-::
-
-    .env              flag: a live secrets file
-    .env.local        flag: a live per-machine secrets file
-    credentials.json  flag: a live credential file
-    id_ed25519        flag: a live private key
-    package-lock.json flag: regenerated by its package manager, never hand-edited
-
-    .env.example      ok: a placeholders-only template, committed on purpose
-    .env.sample       ok: the same shape, .sample spelling
-    .env.template     ok: the same shape, .template spelling
-    main.py           ok: ordinary source
-
-A basename whose FINAL suffix is ``.example``, ``.sample``, or ``.template``
-names a committed template, so the filename guard steps aside for it. The
-suffix has to come last: ``.env.example.bak`` is a copy of a live secrets
-file, not a template, and stays denied.
-
-The guard over a write's contents stays in force: the ``pii_prevention_blocker``
-hook scans what a write carries, so a template holding a real secret or a real
-email address is denied on its contents. The two hooks are layered, and this
-one rules on the filename alone.
-"""
-
-from __future__ import annotations
-
-import fnmatch
-import json
-import os
-import sys
-
-import _path_setup  # noqa: F401
-
-from codex_apply_patch import payload_patch_target_paths
-from hooks_constants.hook_block_logger import log_hook_block
-from hooks_constants.pre_tool_use_dispatcher_constants import (
-    ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES,
-    APPLY_PATCH_TOOL_NAME,
-)
-from hooks_constants.sensitive_file_protector_constants import (
-    ALL_SENSITIVE_PATTERNS,
-    ALL_TEMPLATE_SUFFIXES,
-    DENY_DECISION,
-    DENY_REASON_TEMPLATE,
-    HOOK_EVENT_NAME,
-    HOOK_SCRIPT_NAME,
-)
-
-
-def is_template_filename(filename: str) -> bool:
-    """Report whether a basename names a placeholders-only committed template.
-
-    ::
-
-        .env.example     -> True
-        .ENV.Template    -> True
-        .env.example.bak -> False
-        .env.local       -> False
-
-    Args:
-        filename: The basename of the file a Write, Edit, or MultiEdit targets.
-
-    Returns:
-        True when the basename's final suffix is a template suffix.
-    """
-    return filename.lower().endswith(ALL_TEMPLATE_SUFFIXES)
-
-
-def is_sensitive_file(file_path: str) -> str | None:
-    """Return the sensitive pattern a path's basename matches, or None.
-
-    Args:
-        file_path: The path the Write, Edit, or MultiEdit targets.
-
-    Returns:
-        The matched pattern, or None when the basename names a template or
-        matches no pattern.
-    """
-    filename = os.path.basename(file_path)
-    if is_template_filename(filename):
-        return None
-    for each_pattern in ALL_SENSITIVE_PATTERNS:
-        if fnmatch.fnmatch(filename.lower(), each_pattern.lower()):
-            return each_pattern
-    return None
-
-
-def build_deny_response(deny_reason: str) -> dict[str, dict[str, str]]:
-    """Wrap a deny reason in the PreToolUse decision payload Claude Code reads.
-
-    Args:
-        deny_reason: The operator-facing sentence explaining the denial.
-
-    Returns:
-        The hook decision dictionary carrying the deny permission decision.
-    """
-    return {
-        "hookSpecificOutput": {
-            "hookEventName": HOOK_EVENT_NAME,
-            "permissionDecision": DENY_DECISION,
-            "permissionDecisionReason": deny_reason,
-        }
-    }
-
-
-def deny_write(file_path: str, matched_pattern: str) -> None:
-    """Record the block in the hook-blocks log and emit the deny decision.
-
-    Args:
-        file_path: The path the Write, Edit, MultiEdit, or apply_patch targets.
-        matched_pattern: The sensitive pattern the basename matched.
-    """
-    deny_reason = DENY_REASON_TEMPLATE.format(
-        filename=os.path.basename(file_path),
-        matched_pattern=matched_pattern,
-    )
-    log_hook_block(
-        calling_hook_name=HOOK_SCRIPT_NAME,
-        hook_event=HOOK_EVENT_NAME,
-        block_reason=deny_reason,
-        offending_input_preview=file_path,
-    )
-    sys.stdout.write(json.dumps(build_deny_response(deny_reason)))
-
-
-def _deny_apply_patch_sensitive_target(hook_input: dict, tool_input: dict) -> None:
-    """Deny the first apply_patch target path whose basename names a sensitive file."""
-    for each_target_path in payload_patch_target_paths(hook_input, tool_input):
-        matched_pattern = is_sensitive_file(each_target_path)
-        if matched_pattern is not None:
-            deny_write(each_target_path, matched_pattern)
-            return
-
-
-def main() -> None:
-    """Deny the write when the stdin payload targets a sensitive filename."""
-    try:
-        hook_input = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        sys.exit(0)
-
-    tool_name = hook_input.get("tool_name", "")
-    tool_input = hook_input.get("tool_input", {})
-
-    if tool_name not in ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES:
-        sys.exit(0)
-
-    if tool_name == APPLY_PATCH_TOOL_NAME:
-        _deny_apply_patch_sensitive_target(hook_input, tool_input)
-        sys.exit(0)
-
-    file_path = tool_input.get("file_path", "")
-    if not file_path:
-        sys.exit(0)
-
-    matched_pattern = is_sensitive_file(file_path)
-    if matched_pattern is not None:
-        deny_write(file_path, matched_pattern)
-
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()