claude-dev-env 7.4.1 → 7.6.0

package/hooks/hooks_constants/test_pre_tool_use_allow_output.py

@@ -0,0 +1,27 @@
+"""Tests for the shared PreToolUse allow-with-rewrite stdout emitter."""
+
+from __future__ import annotations
+
+import json
+from io import StringIO
+from unittest.mock import patch
+
+from hooks_constants.pre_tool_use_allow_output import write_pre_tool_use_allow_to_stdout
+
+
+def _emitted_payload(updated_tool_input: dict[str, object]) -> dict[str, object]:
+    """Return the parsed payload the emitter wrote for one updated tool input."""
+    captured_stdout = StringIO()
+    with patch("sys.stdout", captured_stdout):
+        write_pre_tool_use_allow_to_stdout(updated_tool_input)
+    return json.loads(captured_stdout.getvalue())
+
+
+def test_emitter_writes_an_allow_decision_carrying_the_updated_input() -> None:
+    assert _emitted_payload({"command": "git status", "description": "check"}) == {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "allow",
+            "updatedInput": {"command": "git status", "description": "check"},
+        }
+    }

package/hooks/hooks_constants/test_subprocess_window.py

@@ -0,0 +1,128 @@
+"""Tests for the shared hidden-console creation flags."""
+
+import pathlib
+import subprocess
+import sys
+from typing import Any, Mapping
+
+import pytest
+
+_HOOKS_ROOT = pathlib.Path(__file__).resolve().parent.parent
+if str(_HOOKS_ROOT) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_ROOT))
+
+from hooks_constants.subprocess_window import (
+    detached_hidden_window_creation_flags,
+    hidden_window_creation_flags,
+    inherited_stream_startup_info,
+)
+
+WINDOWS_NO_WINDOW_FLAG = 0x08000000
+WINDOWS_NEW_PROCESS_GROUP_FLAG = 0x00000200
+WINDOWS_ONLY = pytest.mark.skipif(
+    sys.platform != "win32", reason="subprocess.STARTUPINFO exists only on Windows"
+)
+
+
+def test_windows_reports_the_hidden_console_flag(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.setattr(subprocess, "CREATE_NO_WINDOW", WINDOWS_NO_WINDOW_FLAG, raising=False)
+    assert hidden_window_creation_flags() == WINDOWS_NO_WINDOW_FLAG
+
+
+def test_other_platforms_report_no_creation_flags(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(sys, "platform", "linux")
+    assert hidden_window_creation_flags() == 0
+
+
+def test_windows_without_the_flag_attribute_reports_no_creation_flags(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.delattr(subprocess, "CREATE_NO_WINDOW", raising=False)
+    assert hidden_window_creation_flags() == 0
+
+
+def test_windows_detached_flags_add_a_new_process_group(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.setattr(subprocess, "CREATE_NO_WINDOW", WINDOWS_NO_WINDOW_FLAG, raising=False)
+    monkeypatch.setattr(
+        subprocess,
+        "CREATE_NEW_PROCESS_GROUP",
+        WINDOWS_NEW_PROCESS_GROUP_FLAG,
+        raising=False,
+    )
+    assert detached_hidden_window_creation_flags() == (
+        WINDOWS_NO_WINDOW_FLAG | WINDOWS_NEW_PROCESS_GROUP_FLAG
+    )
+
+
+def test_other_platforms_report_no_detached_creation_flags(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "linux")
+    assert detached_hidden_window_creation_flags() == 0
+
+
+def _captured_run_options(monkeypatch: pytest.MonkeyPatch) -> Mapping[str, Any]:
+    """Run one command through a patched subprocess.run and return its options."""
+    all_captured_options: dict[str, Any] = {}
+
+    def fake_run(*_all_arguments: Any, **all_options: Any) -> None:
+        all_captured_options.update(all_options)
+
+    monkeypatch.setattr(subprocess, "run", fake_run)
+    subprocess.run(
+        ["git", "status"],
+        creationflags=hidden_window_creation_flags(),
+    )
+    return all_captured_options
+
+
+def test_a_call_site_passes_the_hidden_flag_on_windows(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.setattr(subprocess, "CREATE_NO_WINDOW", WINDOWS_NO_WINDOW_FLAG, raising=False)
+    assert _captured_run_options(monkeypatch)["creationflags"] == WINDOWS_NO_WINDOW_FLAG
+
+
+def test_a_call_site_passes_the_default_flags_off_windows(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "linux")
+    assert _captured_run_options(monkeypatch)["creationflags"] == 0
+
+
+@WINDOWS_ONLY
+def test_windows_startup_info_asks_for_a_hidden_window(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    startup_information = inherited_stream_startup_info()
+    assert startup_information is not None
+    assert startup_information.dwFlags & subprocess.STARTF_USESHOWWINDOW
+    assert startup_information.wShowWindow == subprocess.SW_HIDE
+
+
+def test_other_platforms_report_no_startup_info(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(sys, "platform", "linux")
+    assert inherited_stream_startup_info() is None
+
+
+@WINDOWS_ONLY
+def test_a_stream_inheriting_call_site_passes_no_creation_flags(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    all_captured_options: dict[str, Any] = {}
+
+    def fake_run(*_all_arguments: Any, **all_options: Any) -> None:
+        all_captured_options.update(all_options)
+
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.setattr(subprocess, "run", fake_run)
+    subprocess.run(["python", "-m", "pytest"], startupinfo=inherited_stream_startup_info())
+    assert "creationflags" not in all_captured_options
+    assert all_captured_options["startupinfo"] is not None

package/hooks/lifecycle/enter_worktree_origin_prefetch.py

@@ -44,6 +44,8 @@ from hooks_constants.enter_worktree_prefetch_constants import (  # noqa: E402
 )
 from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin  # noqa: E402
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 def is_enter_worktree_creation(payload_by_field: dict[str, object]) -> bool:
     """Return True when this hook invocation is an EnterWorktree creation call.
@@ -91,6 +93,7 @@ def _run_git_quietly(
             timeout=timeout_seconds,
             cwd=repo_directory,
             check=False,
+            creationflags=hidden_window_creation_flags(),
         )
     except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
         return None

package/hooks/observability/test_failure_recorder.py

@@ -101,6 +101,9 @@ try:
     for each_bootstrap_directory in (_hooks_root_directory, _blocking_directory):
         if each_bootstrap_directory not in sys.path:
             sys.path.insert(0, each_bootstrap_directory)
+    from hooks_constants.bash_post_call_dispatcher_constants import (
+        EXIT_CODE_ERROR_PREFIX,
+    )
     from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
     from hooks_constants.test_failure_recorder_constants import (
         ALL_CHAINING_OPERATOR_SUBSTRINGS,
@@ -108,7 +111,6 @@ try:
         ALL_PYTEST_PROGRAM_BASENAMES,
         ALL_REDIRECTION_TOKENS,
         BASH_TOOL_NAME,
-        EXIT_CODE_ERROR_PREFIX,
         MODULE_RUN_FLAG,
         NODE_ID_FILE_PATH_SEPARATOR,
         OPTION_TOKEN_PREFIX,

package/hooks/validation/mypy_validator.py

@@ -57,6 +57,8 @@ from hooks_constants.mypy_validator_cache_constants import (  # noqa: E402
 )
 from json_file_reader import read_json_object  # noqa: E402
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 def load_notification_utils() -> ModuleType | None:
     try:
@@ -88,6 +90,7 @@ def discover_project_root(target_file: str) -> Path | None:
             text=True,
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=str(Path(target_file).parent),
+            creationflags=hidden_window_creation_flags(),
         )
         if completed_process.returncode != 0:
             return None
@@ -493,6 +496,7 @@ def run_mypy(target_file: str, project_root: str) -> tuple[int, str]:
         env=os.environ.copy(),
         timeout=MYPY_TIMEOUT_SECONDS,
         cwd=project_root,
+        creationflags=hidden_window_creation_flags(),
     )
 
     stdout_output = completed_process.stdout.strip()

package/hooks/validators/README.md

@@ -31,6 +31,7 @@ The checks live in `python_style_checks.py`. Shared source-line splitting, funct
 | `ruff_integration.py` | Ruff lint integration |
 | `run_all_validators.py` | Pre-push validator orchestration and report |
 | `security_checks.py` | Hardcoded-secret, SQL injection, and XSS checks |
+| `subprocess_window_access.py` | Deployed-path shim re-exporting the hidden-window helpers |
 | `system_temporary_roots.py` | System temp-root membership for staged copies |
 | `todo_checks.py` | TODO/FIXME tracking with issue-reference requirement |
 | `type_safety_checks.py` | Missing type hints and Any usage checks |

package/hooks/validators/git_checks.py

@@ -6,6 +6,8 @@ import sys
 from dataclasses import dataclass
 from typing import List
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 SUBPROCESS_TIMEOUT_SECONDS = 30
 
 
@@ -26,6 +28,7 @@ def get_current_branch() -> str:
             text=True,
             check=True,
             timeout=SUBPROCESS_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
         return result.stdout.strip()
     except (FileNotFoundError, subprocess.CalledProcessError, subprocess.TimeoutExpired):
@@ -55,6 +58,7 @@ def check_draft_pr_state() -> List[Violation]:
             text=True,
             check=True,
             timeout=SUBPROCESS_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
     except FileNotFoundError:
         return []

package/hooks/validators/health_check.py

@@ -16,6 +16,8 @@ from enum import StrEnum
 from pathlib import Path
 from typing import Dict, Optional
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 VALIDATOR_FILES = [
     "python_style_checks.py",
     "test_safety_checks.py",
@@ -144,6 +146,7 @@ def check_optional_tool(tool_name: str) -> bool:
             check=False,
             capture_output=True,
             text=True,
+            creationflags=hidden_window_creation_flags(),
         )
         return result.returncode == 0
     except FileNotFoundError:

package/hooks/validators/hook_timing_harness.py

@@ -41,6 +41,8 @@ from pathlib import Path
 from types import ModuleType
 from typing import TextIO
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 def _load_module_from_path(module_name: str, module_path: Path) -> ModuleType:
     """Load and execute the module found at module_path, under module_name.
@@ -197,6 +199,7 @@ def run_hosted_command_once_milliseconds(
         text=True,
         timeout=_harness_constants.SUBPROCESS_TIMEOUT_SECONDS,
         check=False,
+        creationflags=hidden_window_creation_flags(),
     )
     finished_at = time.perf_counter()
     return (finished_at - started_at) * 1000.0

package/hooks/validators/mypy_integration.py

@@ -9,6 +9,8 @@ from collections.abc import Iterator
 from dataclasses import dataclass
 from pathlib import Path
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 _validators_directory = str(Path(__file__).resolve().parent)
 _hooks_directory = str(Path(__file__).resolve().parent.parent)
 
@@ -66,6 +68,7 @@ def check_mypy_available() -> bool:
             check=False,
             capture_output=True,
             text=True,
+            creationflags=hidden_window_creation_flags(),
         )
         return result.returncode == 0
     except FileNotFoundError:
@@ -224,6 +227,7 @@ def _run_mypy_subprocess(
                 text=True,
                 cwd=working_directory,
                 timeout=timeout_seconds,
+                creationflags=hidden_window_creation_flags(),
             )
         except subprocess.TimeoutExpired:
             logger.warning(detached_timeout_skip_message)

package/hooks/validators/ruff_integration.py

@@ -6,6 +6,8 @@ import sys
 from dataclasses import dataclass
 from pathlib import Path
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 _validators_directory = str(Path(__file__).resolve().parent)
 _hooks_directory = str(Path(__file__).resolve().parent.parent)
 
@@ -53,6 +55,7 @@ def check_ruff_available() -> bool:
             check=False,
             capture_output=True,
             text=True,
+            creationflags=hidden_window_creation_flags(),
         )
         return result.returncode == 0
     except FileNotFoundError:
@@ -201,6 +204,7 @@ def _staged_ruff_result(
         input=staged_content,
         cwd=str(resolved_pyproject.parent),
         env=_ruff_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     return RuffResult(
         passed=result.returncode == 0,
@@ -247,6 +251,7 @@ def _run_native_ruff_check(
         capture_output=True,
         text=True,
         env=_ruff_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     return RuffResult(
         passed=result.returncode == 0,
@@ -308,6 +313,7 @@ def run_ruff_fix(all_files: list[Path]) -> RuffResult:
         capture_output=True,
         text=True,
         env=_ruff_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     return RuffResult(
         passed=result.returncode == 0,

package/hooks/validators/run_all_validators.py

@@ -60,6 +60,8 @@ from hooks_constants.multi_edit_reconstruction import (
     edits_for_tool,
 )
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 VALIDATORS_DIR = Path(__file__).parent
 hooks_dir = VALIDATORS_DIR.parent
 package_name = VALIDATORS_DIR.name
@@ -131,6 +133,7 @@ def invoke_validator_module(module_stem: str, forwarded_file_paths: List[str]) -
         text=True,
         cwd=working_directory_string,
         env=environment,
+        creationflags=hidden_window_creation_flags(),
     )
 
 
@@ -160,6 +163,7 @@ def run_validators_entrypoint_subprocess(
         cwd=working_directory_string,
         env=environment,
         input=stdin_text,
+        creationflags=hidden_window_creation_flags(),
     )
 
 
@@ -347,6 +351,7 @@ def get_project_root() -> Optional[Path]:
         ["git", "-C", str(hooks_dir), "rev-parse", "--show-toplevel"],
         capture_output=True,
         text=True,
+        creationflags=hidden_window_creation_flags(),
     )
     if completed_git_lookup.returncode == 0:
         return Path(completed_git_lookup.stdout.strip())
@@ -674,6 +679,7 @@ def get_changed_files() -> List[Path]:
         ["git", "diff", "--cached", "--name-only"],
         capture_output=True,
         text=True,
+        creationflags=hidden_window_creation_flags(),
     )
 
     files = result.stdout.strip().split("\n") if result.stdout.strip() else []
@@ -684,6 +690,7 @@ def get_changed_files() -> List[Path]:
             ["git", "diff", "--name-only", "HEAD~1"],
             capture_output=True,
             text=True,
+            creationflags=hidden_window_creation_flags(),
         )
         files = result.stdout.strip().split("\n") if result.stdout.strip() else []
 

package/hooks/validators/subprocess_window_access.py

@@ -0,0 +1,41 @@
+"""Reach the hidden-window helpers from the scripts this directory deploys.
+
+The installer copies this directory into a profile that holds no installed
+Python distribution, and this repository's own tests run the deployed scripts
+under ``python -S -E``, which hides every installed package from the child
+process. On both routes ``hooks_constants`` is reachable only through the
+deployed ``hooks`` directory, so this module puts that directory on
+``sys.path`` and re-exports the helpers a caller asks for::
+
+    from subprocess_window_access import hidden_window_creation_flags
+
+The directory goes on the end of ``sys.path``. ``PathFinder`` runs ahead of
+every editable-install finder, so a trailing entry still selects the deployed
+copy, and the head of ``sys.path`` stays exactly as the caller left it. A
+caller that prepended its own roots keeps them first.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_subprocess_window_hooks_directory = str(
+    Path(__file__).resolve().parents[2] / "hooks"
+)
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import (
+    HiddenWindowStartupInfo,
+    detached_hidden_window_creation_flags,
+    hidden_window_creation_flags,
+    inherited_stream_startup_info,
+)
+
+__all__ = [
+    "HiddenWindowStartupInfo",
+    "detached_hidden_window_creation_flags",
+    "hidden_window_creation_flags",
+    "inherited_stream_startup_info",
+]

package/hooks/workflow/auto_formatter.py

@@ -14,6 +14,12 @@ from collections.abc import Mapping
 from pathlib import Path
 from types import ModuleType
 
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 NOTIFICATION_UTILS_DIRECTORY = os.path.join(
     os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "notification"
 )
@@ -118,6 +124,7 @@ def is_untracked_in_git(file_path: str) -> bool:
             cwd=containing_directory,
             timeout=GIT_LS_FILES_TIMEOUT_SECONDS,
             env=_build_git_command_environment(),
+            creationflags=hidden_window_creation_flags(),
         )
         return git_check.returncode != 0
     except (FileNotFoundError, subprocess.TimeoutExpired):
@@ -198,6 +205,7 @@ def _run_command(
             capture_output=True,
             text=True,
             timeout=timeout_seconds,
+            creationflags=hidden_window_creation_flags(),
         )
     except FileNotFoundError:
         return None, False

package/hooks/workflow/test_auto_formatter.py

@@ -35,6 +35,8 @@ HOOKS_JSON_PATH = os.path.join(HOOKS_DIRECTORY_PATH, "hooks.json")
 POST_TOOL_USE_DISPATCHER_COMMAND_FRAGMENT = "validation/post_tool_use_dispatcher.py"
 UNUSED_IMPORT_SOURCE = "import os\n\n\nVALUE = 1\n"
 HOOK_RUN_TIMEOUT_SECONDS = 60
+WINDOWS_NO_WINDOW_FLAG = 0x08000000
+EXPECTED_HIDDEN_WINDOW_FLAGS = WINDOWS_NO_WINDOW_FLAG if sys.platform == "win32" else 0
 
 
 def build_fixture_git_environment() -> dict[str, str]:
@@ -415,3 +417,40 @@ class TestPythonFormatTimeoutBudget:
         budgeted_total = auto_formatter_module.budgeted_python_format_seconds()
 
         assert budgeted_total < _registered_auto_formatter_timeout()
+
+
+def _record_creation_flags(
+    auto_formatter_module: ModuleType, monkeypatch: pytest.MonkeyPatch
+) -> dict[str, object]:
+    all_recorded_keyword_arguments: dict[str, object] = {}
+
+    def _record(*args: object, **kwargs: object) -> subprocess.CompletedProcess[str]:
+        del args
+        all_recorded_keyword_arguments.update(kwargs)
+        return subprocess.CompletedProcess([], 1, stdout="", stderr="")
+
+    monkeypatch.setattr(auto_formatter_module.subprocess, "run", _record)
+    return all_recorded_keyword_arguments
+
+
+def test_untracked_probe_should_start_without_a_console_window(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    auto_formatter_module = _load_auto_formatter_module()
+    all_recorded_keyword_arguments = _record_creation_flags(auto_formatter_module, monkeypatch)
+
+    assert auto_formatter_module.is_untracked_in_git(str(tmp_path / "module.py")) is True
+    assert all_recorded_keyword_arguments["creationflags"] == EXPECTED_HIDDEN_WINDOW_FLAGS
+
+
+def test_formatter_command_should_start_without_a_console_window(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    auto_formatter_module = _load_auto_formatter_module()
+    all_recorded_keyword_arguments = _record_creation_flags(auto_formatter_module, monkeypatch)
+
+    auto_formatter_module._run_command(
+        ["ruff", "format"], str(tmp_path / "module.py"), HOOK_RUN_TIMEOUT_SECONDS
+    )
+
+    assert all_recorded_keyword_arguments["creationflags"] == EXPECTED_HIDDEN_WINDOW_FLAGS

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "7.4.1",
+    "version": "7.6.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/rules/ask-user-question-required.md

@@ -2,13 +2,13 @@
 
 Route every user-directed question through the `AskUserQuestion` tool — never a plain-text question in a response's final paragraph. Structure: concise `question`, `header` of 12 chars or fewer, 2-4 options (the UI adds the "Other" fallback), `multiSelect` only when choices genuinely combine.
 
-The `question_to_user_enforcer` Stop hook blocks a response whose final paragraph (after stripping code fences, inline code, and blockquotes) ends in a question mark or contains ask-phrases ("would you like", "should I", "let me know if", ...). Rhetorical questions answered in the same paragraph, and questions inside code or blockquotes, pass. `verify-before-asking` gates whether the question belongs to the user at all.
+No hook checks this. Read your own final paragraph before you send it. A paragraph that ends in a question mark, or that carries an ask-phrase such as "would you like", "should I", or "let me know if", belongs in an `AskUserQuestion` call instead. A rhetorical question answered in the same paragraph is fine, and so is a question inside code or a blockquote. `verify-before-asking` settles whether the question belongs to the user at all.
 
 ## The question block stays lean
 
 `AskUserQuestion` renders as one plain unformatted text block. Detail — plans, counts, tradeoffs, background — goes in chat text before the call. The block itself carries a lean question and short choices. When a choice needs formatting, an inline visualizer tool carries it.
 
-The `ask_user_question_shape_blocker` PreToolUse hook denies an `AskUserQuestion` call whose `question` text or whose `description` under any of the `options` carries chat detail:
+No hook denies an over-full block, so keep an `AskUserQuestion` call inside these caps yourself. They apply to the `question` text and to the `description` under any of the `options`:
 
 | What the block carries | Cap |
 |---|---|
@@ -28,4 +28,4 @@ Structure is read at block level on the raw text: a marker counts when it opens
 
 An inline code span — a path, a flag, a command the reader needs verbatim — weighs one word against either word cap on both fields, so a question naming `--dry-run` and a choice naming `C:\dev\gate.py` both pass. A span sits inside a line, so it never opens one with a marker.
 
-A sentence closes on `.`, `!`, or `?` followed by a capitalized word or by the end of the text. A word is any whitespace-separated token carrying a letter or a digit. The denial names each cap the block broke and sends the detail back to chat text.
+A sentence closes on `.`, `!`, or `?` followed by a capitalized word or by the end of the text. A word is any whitespace-separated token carrying a letter or a digit. When a block breaks a cap, move that detail back into chat text before the call.

package/rules/code-standards.md

@@ -2,7 +2,7 @@
 
 > **Canonical review contract:** [`CODE_RULES.md`](../docs/CODE_RULES.md) — the human and AI review contract for code quality, loaded on demand.
 > **Checked-in pointer:** [`.cursor/BUGBOT.md`](../../../.cursor/BUGBOT.md) — the file Cursor BugBot reads; it points at `CODE_RULES.md`.
-> **Production enforcement:** `hooks/blocking/code_rules_enforcer.py` — hand-maintained Write/Edit gates; each mechanical rule carries a synchronization test.
+> **Production enforcement.** The staged policy lint runs `hooks/blocking/code_rules_enforcer.py` over each changed file. No write-time hook runs it. Use `python packages/claude-dev-env/scripts/cde_lint.py --staged` before you commit, and CI runs the same lint against the merge base. Each mechanical rule carries a synchronization test.
 
 ## Policy surface map
 
@@ -10,7 +10,8 @@
 |---|---|---|
 | Contract | `docs/CODE_RULES.md` | Full review criteria for PR agents, loaded on demand |
 | Pointer | `.cursor/BUGBOT.md` | Checked-in file Cursor BugBot reads; points at `CODE_RULES.md` |
-| Enforcer | `hooks/blocking/code_rules_enforcer.py` | Hand-maintained blockers; not generated from the docs |
+| Enforcer | `hooks/blocking/code_rules_enforcer.py` | Hand-maintained checks the staged policy lint runs; not generated from the docs |
+| Lint | `scripts/cde_lint.py` | Runs the enforcer and the other policy rules over staged or changed files |
 | Session rules | `rules/*.md` | Runtime session policy (questions, tasks, shell) |
 
 Load `CODE_RULES.md` when reviewing a PR, resolving a policy conflict, or generating code. Prefer linking this ref over restating rules.

package/rules/confirm-implementation-forks.md

@@ -6,4 +6,6 @@ How to ask: plain language, one option per path with its tradeoff in the descrip
 
 Not a fork (just proceed): trivially reversible internal-only choices, anything the codebase / stated goal / an existing rule already determines (see `verify-before-asking`), or a single viable path.
 
+Naming a gap in chat is not surfacing a fork. Saying "no production path calls this yet" or "that is a follow-up" describes the fork; it does not ask it. Shipping code that nothing calls is a fork, because the alternative — wire the caller, or hold the change — changes the deliverable. Route it through `AskUserQuestion` before the merge, not into the closing summary after it.
+
 When an option you offered names a repair and the answer leaves it undone, write it down before the turn moves on: a todo entry, a `spawn_task` chip, or a filed issue. An answer of "no preference" settles which path you take now. It leaves the repair you found still waiting.