claude-dev-env 7.0.0 → 7.2.0

package/hooks/blocking/write_existing_file_blocker.py

@@ -1,124 +0,0 @@
-#!/usr/bin/env python3
-"""PreToolUse hook — blocks Write and apply_patch "Add File" onto an existing target.
-
-Agents should use Edit for modifying existing files, and an apply_patch
-"Update File" section rather than "Add File" for a path that already exists.
-Exemptions: Jupyter notebooks (.ipynb) and files in ~/.claude/hooks/ (standalone scripts).
-
-MultiEdit carries no create-or-clobber path this hook needs to guard: every
-MultiEdit edit must match an ``old_string`` already present in the target file,
-so a MultiEdit can never introduce content nobody read the way a blind Write or
-an apply_patch "Add File" can. This hook allows MultiEdit unconditionally.
-"""
-
-import json
-import os
-import sys
-from pathlib import Path
-
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-try:
-    from codex_apply_patch import (
-        CODEX_ADD_OPERATION,
-        CodexPatchError,
-        codex_patch_operation_targets,
-        payload_patch_command,
-    )
-    from hooks_constants.hook_block_logger import log_hook_block
-    from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
-    from hooks_constants.pre_tool_use_dispatcher_constants import APPLY_PATCH_TOOL_NAME
-    from sensitive_file_protector import build_deny_response
-except ImportError as import_error:
-    raise ImportError(
-        "write_existing_file_blocker: cannot import its sibling modules; "
-        "ensure the hooks directory is importable."
-    ) from import_error
-
-JUPYTER_EXTENSION = ".ipynb"
-HOOKS_DIRECTORY = os.path.normpath(os.path.expanduser("~/.claude/hooks"))
-
-
-def is_jupyter_notebook(file_path: str) -> bool:
-    return file_path.lower().endswith(JUPYTER_EXTENSION)
-
-
-def is_inside_hooks_directory(file_path: str) -> bool:
-    normalized_path = os.path.normpath(file_path)
-    return normalized_path.startswith(HOOKS_DIRECTORY)
-
-
-def _apply_patch_add_deny(payload: dict, tool_input: dict) -> tuple[str, str] | None:
-    """Return (deny_reason, offending_path) for an apply_patch 'Add File' onto an existing path."""
-    command, working_directory = payload_patch_command(payload, tool_input)
-    if not command:
-        return None
-    try:
-        all_operation_targets = codex_patch_operation_targets(command, working_directory)
-    except CodexPatchError:
-        return None
-    for each_operation, each_target_path in all_operation_targets:
-        if each_operation != CODEX_ADD_OPERATION:
-            continue
-        if os.path.exists(each_target_path):
-            deny_reason = (
-                f"BLOCKED: apply_patch 'Add File' on existing file {each_target_path}. "
-                "Use an 'Update File' section instead."
-            )
-            return deny_reason, each_target_path
-    return None
-
-
-def _write_onto_existing_file_deny(tool_input: dict) -> tuple[str, str] | None:
-    """Return (deny_reason, offending_path) for a Write onto an existing target."""
-    target_file_path = tool_input.get("file_path", "")
-    if not target_file_path:
-        return None
-    if is_jupyter_notebook(target_file_path):
-        return None
-    if is_inside_hooks_directory(target_file_path):
-        return None
-    if not os.path.exists(target_file_path):
-        return None
-    deny_reason = f"BLOCKED: Write on existing file {target_file_path}. Use Edit tool instead."
-    return deny_reason, target_file_path
-
-
-def _resolve_deny(tool_name: str, payload: dict, tool_input: dict) -> tuple[str, str] | None:
-    """Return (deny_reason, offending_path) for the payload, or None to allow."""
-    if tool_name == APPLY_PATCH_TOOL_NAME:
-        return _apply_patch_add_deny(payload, tool_input)
-    if tool_name != "Write":
-        return None
-    return _write_onto_existing_file_deny(tool_input)
-
-
-def main() -> None:
-    input_payload = read_hook_input_dictionary_from_stdin()
-    if input_payload is None:
-        sys.exit(0)
-
-    raw_tool_name = input_payload.get("tool_name", "")
-    raw_tool_input = input_payload.get("tool_input", {})
-    tool_name = raw_tool_name if isinstance(raw_tool_name, str) else ""
-    tool_input = raw_tool_input if isinstance(raw_tool_input, dict) else {}
-
-    resolved_deny = _resolve_deny(tool_name, input_payload, tool_input)
-    if resolved_deny is None:
-        sys.exit(0)
-    deny_reason, offending_path = resolved_deny
-
-    log_hook_block(
-        calling_hook_name="write_existing_file_blocker.py",
-        hook_event="PreToolUse",
-        block_reason=deny_reason,
-        offending_input_preview=offending_path,
-    )
-    print(json.dumps(build_deny_response(deny_reason)))
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()

package/hooks/hooks_constants/bot_mention_comment_blocker_constants.py

@@ -1,19 +0,0 @@
-"""Configuration constants for the bot_mention_comment_blocker PreToolUse hook."""
-
-TOOL_NAME: str = "mcp__plugin_github_github__add_issue_comment"
-
-CURSOR_MENTION_TOKEN: str = "@cursor"
-COPILOT_MENTION_TOKEN: str = "@copilot"
-
-CORRECTIVE_MESSAGE_CURSOR: str = (
-    "BLOCKED [bot-mention]: Invalid comment. "
-    "Post exactly ``bugbot run`` with no other text as your issue comment "
-    "to trigger Bugbot."
-)
-
-CORRECTIVE_MESSAGE_COPILOT: str = (
-    "BLOCKED [bot-mention]: Invalid comment. "
-    "To request a Copilot review, use the GitHub REST API:\n"
-    "  gh api --method POST repos/<owner>/<repo>/pulls/<number>/requested_reviewers \\\n"
-    "    -f 'reviewers[]=copilot-pull-request-reviewer[bot]'"
-)

package/hooks/hooks_constants/cursor_cli_python_misfire_blocker_constants.py

@@ -1,79 +0,0 @@
-"""Constants for the Cursor-vs-Python gate misfire PreToolUse blocker.
-
-Blocks Shell commands that launch Cursor's CLI or GUI binary against a Python
-script with code-rules-gate flags. That path feeds unknown options into
-Cursor's main process ``resolveArgs``, where ``console.warn`` on a closed pipe
-raises an EPIPE error dialog and still opens the script as an editor path.
-"""
-
-from __future__ import annotations
-
-import re
-
-__all__ = [
-    "ALL_SUPPORTED_TOOL_NAMES",
-    "BASH_TOOL_NAME",
-    "POWERSHELL_TOOL_NAME",
-    "TOOL_NAME_KEY",
-    "TOOL_INPUT_KEY",
-    "COMMAND_KEY",
-    "HOOK_SPECIFIC_OUTPUT_KEY",
-    "HOOK_EVENT_NAME_KEY",
-    "HOOK_EVENT_NAME",
-    "PERMISSION_DECISION_KEY",
-    "DENY_DECISION",
-    "PERMISSION_DECISION_REASON_KEY",
-    "CALLING_HOOK_NAME",
-    "CURSOR_LAUNCH_PATTERN",
-    "GATE_SCRIPT_PATTERN",
-    "GATE_FLAG_PATTERN",
-    "PYTHON_PATH_PATTERN",
-    "CORRECTIVE_MESSAGE",
-]
-
-BASH_TOOL_NAME = "Bash"
-POWERSHELL_TOOL_NAME = "PowerShell"
-ALL_SUPPORTED_TOOL_NAMES: frozenset[str] = frozenset(
-    {BASH_TOOL_NAME, POWERSHELL_TOOL_NAME}
-)
-
-TOOL_NAME_KEY = "tool_name"
-TOOL_INPUT_KEY = "tool_input"
-COMMAND_KEY = "command"
-
-HOOK_SPECIFIC_OUTPUT_KEY = "hookSpecificOutput"
-HOOK_EVENT_NAME_KEY = "hookEventName"
-HOOK_EVENT_NAME = "PreToolUse"
-PERMISSION_DECISION_KEY = "permissionDecision"
-DENY_DECISION = "deny"
-PERMISSION_DECISION_REASON_KEY = "permissionDecisionReason"
-
-CALLING_HOOK_NAME = "cursor_cli_python_misfire_blocker.py"
-
-CURSOR_LAUNCH_PATTERN = re.compile(
-    r"(?i)"
-    r"(?:"
-    r"(?:^|[\s;&|])(?:cursor(?:\.cmd|\.exe)?)(?=\s|[\"']|$)"
-    r"|"
-    r"[\\/](?:cursor(?:\.cmd|\.exe)?)(?=\s|[\"']|$)"
-    r")"
-)
-GATE_SCRIPT_PATTERN = re.compile(r"(?i)code_rules_gate\.py\b")
-GATE_FLAG_PATTERN = re.compile(
-    r"(?i)(?:^|[\s,\"'])(?:--base|--staged|--repo-root|--only-under)"
-    r"(?:\s|=|$|[\"'])"
-)
-PYTHON_PATH_PATTERN = re.compile(r"(?i)\.py(?:\s|$|['\":])")
-
-CORRECTIVE_MESSAGE = (
-    "BLOCKED [cursor-python-misfire]: Cursor's CLI/GUI was invoked against a "
-    "Python script with code-rules-gate flags. Cursor treats those flags as "
-    "unknown options, warns on a closed pipe, and raises an EPIPE error dialog "
-    "while still opening the script as an editor path.\n\n"
-    "To run the gate:\n"
-    "  python <path-to>/code_rules_gate.py --base origin/main\n\n"
-    "To open a file on screen in its native Windows app:\n"
-    "  Invoke-Item -LiteralPath '<path>'\n\n"
-    "Do not pass --base, --staged, --repo-root, or --only-under to cursor / "
-    "Cursor.exe."
-)

package/hooks/hooks_constants/fable_spawn_gate_constants.py

@@ -1,61 +0,0 @@
-"""Constants for the fable-tier subagent spawn gate.
-
-The gate denies an ``Agent`` or ``Task`` spawn at the fable tier whose
-``prompt`` lacks ``FABLE_SPAWN_AUTHORIZATION_MARKER``. ``DENY_REASON`` points
-at the protocol document rather than quoting the token, so pasting a denial
-into a retry prompt authorizes nothing.
-``MODEL_SEGMENT_SPLIT_PATTERN`` finds that tier in a full model id too::
-
-    fable           -> ['fable']                  flag: fable tier
-    claude-fable-5  -> ['claude', 'fable', '5']   flag: fable tier
-    claude-sonnet-4 -> ['claude', 'sonnet', '4']  ok:   another tier
-
-Every literal the gate body reads lives here. ``AGENT_TOOL_NAME`` and
-``TASK_TOOL_NAME`` name the spawn tools the gate evaluates.
-"""
-
-from __future__ import annotations
-
-import re
-
-AGENT_TOOL_NAME: str = "Agent"
-TASK_TOOL_NAME: str = "Task"
-
-ALL_SPAWN_TOOL_NAMES: frozenset[str] = frozenset({AGENT_TOOL_NAME, TASK_TOOL_NAME})
-
-FABLE_MODEL_ALIAS: str = "fable"
-MODEL_SEGMENT_SPLIT_PATTERN: re.Pattern[str] = re.compile(r"[^a-z0-9]+")
-FABLE_SPAWN_AUTHORIZATION_MARKER: str = "FABLE-SPAWN-AUTHORIZED"
-ADVISOR_PROTOCOL_DOCUMENT_PATH: str = "_shared/advisor/advisor-protocol.md"
-
-TOOL_NAME_FIELD_NAME: str = "tool_name"
-TOOL_INPUT_FIELD_NAME: str = "tool_input"
-MODEL_FIELD_NAME: str = "model"
-PROMPT_FIELD_NAME: str = "prompt"
-
-CALLING_HOOK_NAME: str = "fable_spawn_gate.py"
-HOOK_EVENT_NAME: str = "PreToolUse"
-
-DENY_REASON: str = (
-    "BLOCKED [fable-spawn-gate]: this subagent spawn names the fable tier in "
-    "its model field and carries no authorization marker. To authorize a "
-    f"fable bind, put the token named in {ADVISOR_PROTOCOL_DOCUMENT_PATH} as "
-    "plain text in the spawn prompt (substring match). Otherwise set model "
-    "to opus, sonnet, or haiku. The gate checks only model tier and marker "
-    "presence — it does not verify which session placed the token."
-)
-
-DENY_ADDITIONAL_CONTEXT: str = (
-    "[fable-spawn-gate] This Agent/Task spawn was denied: the model field "
-    "names the fable tier and the spawn prompt carries no authorization "
-    "marker. Preferred recovery: re-spawn at model opus, or an "
-    "opus-equivalent tier (sonnet/haiku when opus is unavailable) — those "
-    "tiers need no marker. Authorized fable bind only: put the token named "
-    f"in {ADVISOR_PROTOCOL_DOCUMENT_PATH} as plain text in the spawn prompt "
-    "(substring match), then retry. The gate checks only model tier and "
-    "marker presence. Do not paste this denial into a retry prompt — it "
-    "does not authorize the spawn."
-)
-
-DENY_PREVIEW_TEMPLATE: str = "model={model_text} marker_present=False"
-MAXIMUM_PREVIEW_MODEL_LENGTH: int = 40

package/hooks/hooks_constants/luna_fast_mode_gate_constants.py

@@ -1,45 +0,0 @@
-"""Constants for the Codex Luna fast-mode spawn gate.
-
-The gate checks the model and service tier fields on Agent, Task, and native
-Codex multi-agent spawn calls. Agent and Task require exact ``fast``. Native
-Codex accepts exact ``fast`` or ``priority`` for Luna models.
-"""
-
-from __future__ import annotations
-
-import re
-
-AGENT_TOOL_NAME: str = "Agent"
-TASK_TOOL_NAME: str = "Task"
-CODEX_AGENT_TOOL_NAME: str = "multi_agent_v1__spawn_agent"
-ALL_SPAWN_TOOL_NAMES: frozenset[str] = frozenset(
-    {AGENT_TOOL_NAME, TASK_TOOL_NAME, CODEX_AGENT_TOOL_NAME}
-)
-
-LUNA_MODEL_ALIAS: str = "luna"
-FAST_SERVICE_TIER: str = "fast"
-PRIORITY_SERVICE_TIER: str = "priority"
-MODEL_SEGMENT_SPLIT_PATTERN: re.Pattern[str] = re.compile(r"[^a-z0-9]+")
-
-TOOL_NAME_FIELD_NAME: str = "tool_name"
-TOOL_INPUT_FIELD_NAME: str = "tool_input"
-MODEL_FIELD_NAME: str = "model"
-SERVICE_TIER_FIELD_NAME: str = "service_tier"
-
-CALLING_HOOK_NAME: str = "luna_fast_mode_gate.py"
-HOOK_EVENT_NAME: str = "PreToolUse"
-
-DENY_REASON: str = (
-    "BLOCKED [luna-fast-mode-gate]: Agent and Task Luna spawns require "
-    "service_tier fast. Native Codex Luna spawns require service_tier fast "
-    "or priority. Retry with an allowed service_tier."
-)
-
-DENY_ADDITIONAL_CONTEXT: str = (
-    "[luna-fast-mode-gate] Agent and Task Luna spawns require service_tier "
-    "fast. Native Codex Luna spawns accept service_tier fast or priority. "
-    "Retry with an allowed service_tier."
-)
-
-DENY_PREVIEW_TEMPLATE: str = "model={model_text} service_tier={service_tier_text}"
-MAXIMUM_PREVIEW_FIELD_LENGTH: int = 40

package/hooks/hooks_constants/nas_ssh_binary_enforcer_constants.py

@@ -1,20 +0,0 @@
-"""Constants for the NAS ssh binary enforcer hook.
-
-Holds the Bash tool name, the ssh-family command basenames, the Windows OpenSSH
-binary path suffixes, and the batch-mode pattern. Segment splitting and
-leading-program resolution come from ``shell_command_segments``.
-"""
-
-import re
-
-BASH_TOOL_NAME = "Bash"
-
-ALL_SSH_FAMILY_COMMAND_BASENAMES = frozenset(
-    {"ssh", "scp", "sftp", "ssh.exe", "scp.exe", "sftp.exe"}
-)
-ALL_OPENSSH_BINARY_PATH_SUFFIXES = (
-    "/openssh/ssh.exe",
-    "/openssh/scp.exe",
-    "/openssh/sftp.exe",
-)
-BATCH_MODE_PATTERN = re.compile(r"batchmode\s*=\s*yes", re.IGNORECASE)

package/hooks/hooks_constants/orchestrator_refresh_reschedule_gate_constants.py

@@ -1,57 +0,0 @@
-"""Constants for the orchestrator-refresh ScheduleWakeup reschedule gate."""
-
-from __future__ import annotations
-
-SCHEDULE_WAKEUP_TOOL_NAME = "ScheduleWakeup"
-CRON_CREATE_TOOL_NAME = "CronCreate"
-ALL_SCHEDULE_TOOL_NAMES: frozenset[str] = frozenset(
-    {
-        SCHEDULE_WAKEUP_TOOL_NAME,
-        CRON_CREATE_TOOL_NAME,
-    }
-)
-
-ORCHESTRATOR_REFRESH_PROMPT_TOKEN = "/orchestrator-refresh"
-RUN_SLUG_PROMPT_FLAG = "--run-slug"
-RUN_SLUG_PROMPT_VALUE_PATTERN = r"(?:=\s*|\s+)([^\s]+)"
-PROMPT_FIELD_NAME = "prompt"
-TOOL_NAME_FIELD_NAME = "tool_name"
-TOOL_INPUT_FIELD_NAME = "tool_input"
-CWD_FIELD_NAME = "cwd"
-
-REASON_CRON_CREATE_FORBIDDEN = "cron_create_forbidden"
-
-DENY_REASON_TEMPLATE = (
-    "BLOCKED: orchestrator-refresh re-arm denied ({reason}). "
-    "Use one-shot delayed wake only (never CronCreate / never recurring). "
-    "At most one re-arm slot: begin-firing at refresh start; "
-    "should-reschedule then create then claim-rearm (never claim before "
-    "ScheduleWakeup). Status must be active: "
-    "python skills/orchestrator/scripts/status_gate.py set "
-    "--status active. When finished: --status done. Never re-arm an idle loop."
-)
-
-CALLING_HOOK_NAME = "orchestrator_refresh_reschedule_gate.py"
-HOOK_EVENT_NAME = "PreToolUse"
-
-ALL_PACKAGE_AGENTS_SKILL_SCRIPTS_RELATIVE_PARTS: tuple[str, ...] = (
-    ".agents",
-    "skills",
-    "orchestrator",
-    "scripts",
-)
-"""Package-source path of orchestrator status_gate.py under the agents home."""
-
-ALL_SKILL_SCRIPTS_RELATIVE_PARTS: tuple[str, ...] = (
-    "skills",
-    "orchestrator",
-    "scripts",
-)
-"""Package-root path of orchestrator status_gate.py for a dependency layout."""
-PLUGIN_ROOT_ENV_VAR = "CLAUDE_PLUGIN_ROOT"
-ALL_HOME_SKILLS_RELATIVE_PARTS: tuple[str, ...] = (
-    ".claude",
-    "skills",
-    "orchestrator",
-    "scripts",
-)

package/hooks/hooks_constants/send_user_file_open_locally_blocker_constants.py

@@ -1,17 +0,0 @@
-"""Configuration constants for the send_user_file_open_locally_blocker PreToolUse hook."""
-
-TOOL_NAME: str = "SendUserFile"
-
-PROACTIVE_STATUS: str = "proactive"
-
-CORRECTIVE_MESSAGE: str = (
-    "BLOCKED [open-locally]: SendUserFile attaches a file to the session, which "
-    "does not let the user see it while they are at the terminal. Open the file on "
-    "screen with its native Windows app:\n"
-    "  Invoke-Item -LiteralPath '<path>'\n"
-    "Open every path the user named. Do not launch Cursor.exe or cursor.cmd to open "
-    "a file — unknown flags on that path raise an EPIPE error dialog in Cursor's "
-    "main process.\n"
-    "The one allowed attach is a phone push: when the user has stepped away and you "
-    'want the file to reach their phone, call SendUserFile with status "proactive".'
-)

package/hooks/hooks_constants/sensitive_file_protector_constants.py

@@ -1,40 +0,0 @@
-"""Constants for the ``sensitive_file_protector`` PreToolUse hook.
-
-The hook denies a Write, Edit, or MultiEdit whose target basename names a live
-secret or a lock file, and steps aside for a placeholders-only committed template.
-"""
-
-from __future__ import annotations
-
-ALL_SENSITIVE_PATTERNS = (
-    ".env",
-    ".env.*",
-    "*.env",
-    "*.pem",
-    "*.key",
-    "*.p12",
-    "*.pfx",
-    "credentials.json",
-    "secrets.json",
-    "id_rsa",
-    "id_ed25519",
-    "package-lock.json",
-    "yarn.lock",
-    "Pipfile.lock",
-    "poetry.lock",
-    "pnpm-lock.yaml",
-    "composer.lock",
-)
-
-ALL_TEMPLATE_SUFFIXES = (".example", ".sample", ".template")
-
-HOOK_SCRIPT_NAME = "sensitive_file_protector.py"
-
-HOOK_EVENT_NAME = "PreToolUse"
-
-DENY_DECISION = "deny"
-
-DENY_REASON_TEMPLATE = (
-    "BLOCKED: Sensitive file '{filename}' (pattern: '{matched_pattern}'). "
-    "Edit manually outside Claude Code."
-)

package/hooks/hooks_constants/session_handoff_blocker_constants.py

@@ -1,10 +0,0 @@
-"""Shared compiled patterns for the session_handoff_blocker hook."""
-
-import re
-
-FIRST_PERSON_SUBJECT_PATTERN = re.compile(
-    r"\b(?:i['’]?m|i['’]?ll|i\s+will|i\s+am|i\s+need\s+to|i\s+should"
-    r"|i\s+recommend|i\s+suggest|let\s+me|let['’]?s"
-    r"|we\s+(?:should|can|could)|we['’]?ll|we\s+are|we\s+will)\b",
-    re.IGNORECASE,
-)

package/hooks/hooks_constants/shell_substitution_blocker_constants.py

@@ -1,80 +0,0 @@
-"""Constants for the shell-substitution PreToolUse Bash blocker.
-
-Holds the tool name, the payload keys, the four detection patterns, the deny
-decision shape, and the corrective message. The hook imports these so no
-single-use constant sits at its file scope.
-"""
-
-from __future__ import annotations
-
-import re
-
-__all__ = [
-    "BASH_TOOL_NAME",
-    "TOOL_NAME_KEY",
-    "TOOL_INPUT_KEY",
-    "COMMAND_KEY",
-    "HOOK_SPECIFIC_OUTPUT_KEY",
-    "HOOK_EVENT_NAME_KEY",
-    "HOOK_EVENT_NAME",
-    "PERMISSION_DECISION_KEY",
-    "DENY_DECISION",
-    "PERMISSION_DECISION_REASON_KEY",
-    "DOLLAR_PAREN_PATTERN",
-    "EVEN_BACKSLASH_BACKTICK_PATTERN",
-    "PROCESS_SUBSTITUTION_PATTERN",
-    "SINGLE_QUOTED_RUN_PATTERN",
-    "STRIPPED_RUN_REPLACEMENT",
-    "COMMAND_LINE_SEPARATOR",
-    "BACKSLASH_CHARACTER",
-    "SINGLE_QUOTE_CHARACTER",
-    "DOUBLE_QUOTE_CHARACTER",
-    "NO_TERMINATOR_INDEX",
-    "CORRECTIVE_MESSAGE",
-]
-
-BASH_TOOL_NAME = "Bash"
-
-TOOL_NAME_KEY = "tool_name"
-TOOL_INPUT_KEY = "tool_input"
-COMMAND_KEY = "command"
-
-HOOK_SPECIFIC_OUTPUT_KEY = "hookSpecificOutput"
-HOOK_EVENT_NAME_KEY = "hookEventName"
-HOOK_EVENT_NAME = "PreToolUse"
-PERMISSION_DECISION_KEY = "permissionDecision"
-DENY_DECISION = "deny"
-PERMISSION_DECISION_REASON_KEY = "permissionDecisionReason"
-
-DOLLAR_PAREN_PATTERN = re.compile(r"\$\(")
-OPEN_PAREN_CHARACTER = "("
-CLOSE_PAREN_CHARACTER = ")"
-PAREN_DEPTH_AFTER_DOUBLE_OPEN = 2
-EVEN_BACKSLASH_BACKTICK_PATTERN = re.compile(r"(?<!\\)(?:\\\\)*`")
-PROCESS_SUBSTITUTION_PATTERN = re.compile(r"[<>]\(")
-SINGLE_QUOTED_RUN_PATTERN = re.compile(r"'[^']*'")
-STRIPPED_RUN_REPLACEMENT = ""
-COMMAND_LINE_SEPARATOR = "\n"
-BACKSLASH_CHARACTER = "\\"
-SINGLE_QUOTE_CHARACTER = "'"
-DOUBLE_QUOTE_CHARACTER = '"'
-NO_TERMINATOR_INDEX = -1
-
-CORRECTIVE_MESSAGE = (
-    "BLOCKED [shell-substitution]: command contains $(...), backtick, or "
-    "<(...)/>(...) process substitution, which forces a permission prompt "
-    "because the Claude Code allowlist matcher does not descend into "
-    "substitutions.\n\n"
-    "Fix: split into two Bash tool calls, or rewrite without substitution.\n"
-    '  cd X && echo "$(git rev-parse HEAD)"\n'
-    "becomes either two calls:\n"
-    "  1) cd X\n"
-    "  2) git rev-parse HEAD\n"
-    "or one substitution-free call:\n"
-    "  git -C X rev-parse HEAD\n\n"
-    "Process substitution example:\n"
-    "  diff <(cat a) <(cat b)\n"
-    "becomes two separate Bash calls to `cat a` and `cat b`, with the diff "
-    "performed on the captured outputs.\n\n"
-    "See `shell-invocation.md` in the rules directory for full guidance."
-)