claude-dev-env 7.5.0 → 7.6.0

package/scripts/grok_patch_artifacts.py

@@ -27,6 +27,8 @@ from dev_env_scripts_constants.grok_run_ledger_constants import (
     UTF8_ENCODING,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 def compute_sha256_hex(content: bytes) -> str:
     """Return the hex SHA-256 digest of raw bytes.
@@ -58,11 +60,13 @@ def extract_worktree_diff(
         ["git", "-C", str(worktree_path), "diff", base_sha],
         text=True,
         encoding=UTF8_ENCODING,
+        creationflags=hidden_window_creation_flags(),
     )
     changed_paths_listing = subprocess.check_output(
         ["git", "-C", str(worktree_path), "diff", "--name-only", base_sha],
         text=True,
         encoding=UTF8_ENCODING,
+        creationflags=hidden_window_creation_flags(),
     )
     changed_paths = tuple(
         each_line.strip()

package/scripts/grok_worker_preflight.py

@@ -90,6 +90,8 @@ from dev_env_scripts_constants.grok_worker_constants import (
     UTF8_ENCODING,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 preflight_which = shutil.which
 preflight_subprocess_runner = subprocess.run
 preflight_time = time.time
@@ -259,6 +261,7 @@ def _run_grok_command(
             errors=UTF8_DECODE_ERRORS,
             timeout=timeout_seconds,
             check=False,
+            creationflags=hidden_window_creation_flags(),
         )
     except OSError:
         return None

package/scripts/invoke_code_review.py

@@ -104,6 +104,8 @@ from dev_env_scripts_constants.timing import (  # noqa: E402
     DEFAULT_CODE_REVIEW_TIMEOUT_SECONDS,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 @dataclass(frozen=True)
 class CodeReviewOutcome:
@@ -265,6 +267,7 @@ def is_working_tree_dirty(working_directory: Path) -> bool:
         capture_output=True,
         text=True,
         check=False,
+        creationflags=hidden_window_creation_flags(),
     )
     if completion.returncode != 0:
         return True

package/scripts/local_verification/command_runner.py

@@ -11,6 +11,8 @@ from .config import (
 )
 from .model import CommandCapture
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 def run_command(
     all_arguments: tuple[str, ...], check_directory: Path, timeout_seconds: float
@@ -73,6 +75,7 @@ def _run_subprocess(
         encoding=UTF8_ENCODING,
         errors="replace",
         timeout=timeout_seconds,
+        creationflags=hidden_window_creation_flags(),
     )
 
 

package/scripts/local_verification/git_state.py

@@ -23,6 +23,8 @@ from .config import (
 )
 from .config.timing import GIT_METADATA_TIMEOUT_SECONDS
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 @dataclass(frozen=True)
 class CandidateSnapshot:
@@ -82,6 +84,7 @@ def _run_git_bytes(
             capture_output=True,
             check=False,
             timeout=GIT_METADATA_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
     except (OSError, subprocess.SubprocessError):
         return None

package/scripts/policy_lint/adapter_detectors.py

@@ -4,6 +4,7 @@ from collections.abc import Iterable
 from contextlib import redirect_stderr, redirect_stdout
 from io import StringIO
 from pathlib import Path, PurePosixPath
+from types import ModuleType
 
 from . import adapter_support
 from .config import constants
@@ -118,10 +119,49 @@ def validator_diagnostics(
     return adapter_support._diagnostics_for_messages(document, "validators", all_messages)
 
 
+def _is_untouched_function(
+    message: str, all_changed_lines: frozenset[int], scoping_module: ModuleType
+) -> bool:
+    span_range = scoping_module.function_length_span_range(message)
+    return span_range is not None and all_changed_lines.isdisjoint(span_range)
+
+
+def _change_scoped_messages(
+    all_messages: Iterable[str],
+    document: Document,
+    load_pr_loop_module: adapter_support.HookModuleLoader,
+) -> tuple[str, ...]:
+    """Drop function-length messages for functions the change never touched.
+
+    ::
+
+        an import added above an existing long ``main`` -> dropped
+        a statement added inside that ``main``          -> kept
+
+    Args:
+        all_messages: Every message the code-rule engine returned.
+        document: Current document and the lines this change touched.
+        load_pr_loop_module: Loader for the shared pull-request-loop scripts.
+
+    Returns:
+        The messages that remain in scope for this change.
+    """
+    all_changed_lines = document.changed_lines
+    if all_changed_lines is None:
+        return tuple(all_messages)
+    scoping_module = load_pr_loop_module(constants.VIOLATION_SCOPING_MODULE_NAME)
+    return tuple(
+        each_message
+        for each_message in all_messages
+        if not _is_untouched_function(each_message, all_changed_lines, scoping_module)
+    )
+
+
 def code_rule_diagnostics(
     document: Document,
     repository_root: Path,
     load_module: adapter_support.HookModuleLoader,
+    load_pr_loop_module: adapter_support.HookModuleLoader,
 ) -> tuple[Diagnostic, ...]:
     """Run the code-rule engine on one document.
 
@@ -129,9 +169,10 @@ def code_rule_diagnostics(
         document: Current text and optional prior text.
         repository_root: Request repository root for sibling-file resolution.
         load_module: Hook module loader.
+        load_pr_loop_module: Loader for the shared pull-request-loop scripts.
 
     Returns:
-        Diagnostics from the code-rule engine.
+        Diagnostics from the code-rule engine, scoped to the change.
     """
     absolute_path = adapter_support._document_path(repository_root, document)
     legacy_module = load_module("blocking.code_rules_enforcer")
@@ -146,7 +187,12 @@ def code_rule_diagnostics(
             sibling_directory=absolute_path.parent,
             include_comment_policy=True,
         )
-    return adapter_support._diagnostics_for_messages(document, "code-rules", all_messages)
+    all_scoped_messages = _change_scoped_messages(
+        all_messages, document, load_pr_loop_module
+    )
+    return adapter_support._diagnostics_for_messages(
+        document, "code-rules", all_scoped_messages
+    )
 
 
 def state_description_diagnostics(

package/scripts/policy_lint/adapter_pairing.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import ast
+from collections import Counter
 from pathlib import PurePosixPath
 
 from . import adapter_support
@@ -52,12 +53,19 @@ def _remove_docstrings(parsed_tree: ast.AST) -> None:
         _remove_docstrings(each_child)
 
 
-def _ast_without_docstrings(source_text: str) -> str | None:
+def _parsed_without_docstrings(source_text: str) -> ast.Module | None:
     try:
         parsed_tree = ast.parse(source_text)
-    except SyntaxError:
+    except (SyntaxError, ValueError):
         return None
     _remove_docstrings(parsed_tree)
+    return parsed_tree
+
+
+def _ast_without_docstrings(source_text: str) -> str | None:
+    parsed_tree = _parsed_without_docstrings(source_text)
+    if parsed_tree is None:
+        return None
     return ast.dump(parsed_tree, include_attributes=False)
 
 
@@ -71,6 +79,144 @@ def _is_docstring_only_python_document(document: Document) -> bool:
     return current_ast is not None and current_ast == prior_ast
 
 
+def _is_import_statement(node: object) -> bool:
+    return isinstance(node, (ast.Import, ast.ImportFrom))
+
+
+def _dumped_import_tally(all_nodes: list[object]) -> Counter[str]:
+    return Counter(
+        ast.dump(each_node, include_attributes=False)
+        for each_node in all_nodes
+        if isinstance(each_node, ast.AST) and _is_import_statement(each_node)
+    )
+
+
+def _matches_positional_list(
+    all_current_nodes: list[object], all_prior_nodes: list[object]
+) -> bool:
+    if len(all_current_nodes) != len(all_prior_nodes):
+        return False
+    return all(
+        _matches_field(each_current_node, each_prior_node)
+        for each_current_node, each_prior_node in zip(
+            all_current_nodes, all_prior_nodes, strict=True
+        )
+    )
+
+
+def _matches_statement_list(
+    all_current_nodes: list[object], all_prior_nodes: list[object]
+) -> bool:
+    if _dumped_import_tally(all_prior_nodes) - _dumped_import_tally(all_current_nodes):
+        return False
+    return _matches_positional_list(
+        [
+            each_node
+            for each_node in all_current_nodes
+            if not _is_import_statement(each_node)
+        ],
+        [
+            each_node
+            for each_node in all_prior_nodes
+            if not _is_import_statement(each_node)
+        ],
+    )
+
+
+def _is_statement_list(all_nodes: list[object]) -> bool:
+    return all(isinstance(each_node, ast.stmt) for each_node in all_nodes)
+
+
+def _matches_node_list(
+    all_current_nodes: list[object], all_prior_nodes: list[object]
+) -> bool:
+    if _is_statement_list(all_current_nodes) and _is_statement_list(all_prior_nodes):
+        return _matches_statement_list(all_current_nodes, all_prior_nodes)
+    return _matches_positional_list(all_current_nodes, all_prior_nodes)
+
+
+def _matches_field(current_field: object, prior_field: object) -> bool:
+    if isinstance(current_field, ast.AST) and isinstance(prior_field, ast.AST):
+        return _matches_node(current_field, prior_field)
+    if isinstance(current_field, list) and isinstance(prior_field, list):
+        return _matches_node_list(current_field, prior_field)
+    if type(current_field) is not type(prior_field):
+        return False
+    return bool(current_field == prior_field)
+
+
+def _matches_keyword(current_keyword: ast.keyword, prior_keyword: ast.keyword) -> bool:
+    return current_keyword.arg == prior_keyword.arg and _matches_node(
+        current_keyword.value, prior_keyword.value
+    )
+
+
+def _keywords_after_match(
+    all_candidate_keywords: list[ast.keyword], prior_keyword: ast.keyword
+) -> list[ast.keyword] | None:
+    for each_index, each_candidate_keyword in enumerate(all_candidate_keywords):
+        if _matches_keyword(each_candidate_keyword, prior_keyword):
+            return all_candidate_keywords[each_index + 1 :]
+    return None
+
+
+def _prior_keywords_survive(
+    all_current_keywords: list[ast.keyword], all_prior_keywords: list[ast.keyword]
+) -> bool:
+    all_remaining_keywords: list[ast.keyword] | None = list(all_current_keywords)
+    for each_prior_keyword in all_prior_keywords:
+        if all_remaining_keywords is None:
+            return False
+        all_remaining_keywords = _keywords_after_match(
+            all_remaining_keywords, each_prior_keyword
+        )
+    return all_remaining_keywords is not None
+
+
+def _mapping_unpacking_count(all_keywords: list[ast.keyword]) -> int:
+    return sum(1 for each_keyword in all_keywords if each_keyword.arg is None)
+
+
+def _matches_call(current_call: ast.Call, prior_call: ast.Call) -> bool:
+    if not _matches_node(current_call.func, prior_call.func):
+        return False
+    if not _matches_positional_list(list(current_call.args), list(prior_call.args)):
+        return False
+    if _mapping_unpacking_count(current_call.keywords) != _mapping_unpacking_count(
+        prior_call.keywords
+    ):
+        return False
+    return _prior_keywords_survive(
+        list(current_call.keywords), list(prior_call.keywords)
+    )
+
+
+def _matches_node(current_node: ast.AST, prior_node: ast.AST) -> bool:
+    if type(current_node) is not type(prior_node):
+        return False
+    if isinstance(current_node, ast.Call) and isinstance(prior_node, ast.Call):
+        return _matches_call(current_node, prior_node)
+    return all(
+        _matches_field(
+            getattr(current_node, each_field_name, None),
+            getattr(prior_node, each_field_name, None),
+        )
+        for each_field_name in current_node._fields
+    )
+
+
+def _is_import_and_keyword_addition_python_document(document: Document) -> bool:
+    if document.path.suffix.lower() != constants.PYTHON_SUFFIX:
+        return False
+    if document.prior_text is None:
+        return False
+    current_tree = _parsed_without_docstrings(document.text)
+    prior_tree = _parsed_without_docstrings(document.prior_text)
+    if current_tree is None or prior_tree is None:
+        return False
+    return _matches_node(current_tree, prior_tree)
+
+
 def _candidate_test_names(path: PurePosixPath) -> frozenset[str]:
     stem = path.stem
     suffix = path.suffix.lower()
@@ -157,6 +303,8 @@ def _is_unpaired_production(
         return False
     if _is_docstring_only_python_document(production_document):
         return False
+    if _is_import_and_keyword_addition_python_document(production_document):
+        return False
     return not _has_changed_test(production_path, all_changed_test_paths)
 
 

package/scripts/policy_lint/adapters.py

@@ -33,9 +33,13 @@ def _hooks_module(module_name: str) -> ModuleType:
 
 
 def _pr_loop_script_module(module_name: str) -> ModuleType:
+    marker_relative_path = (
+        module_name.replace(".", constants.POSIX_PATH_SEPARATOR)
+        + constants.PYTHON_SUFFIX
+    )
     scripts_directory = str(resolve_shared_scripts_directory(
         __file__, os.environ, constants.PR_LOOP_DIRECTORY_NAME,
-        f"{module_name}{constants.PYTHON_SUFFIX}", constants.SHARED_ROOT_PARENT_INDEX
+        marker_relative_path, constants.SHARED_ROOT_PARENT_INDEX
     ))
     if scripts_directory not in sys.path:
         sys.path.insert(0, scripts_directory)
@@ -72,7 +76,7 @@ def code_rule_diagnostics(
         Diagnostics from the code-rule engine.
     """
     return adapter_detectors.code_rule_diagnostics(
-        document, repository_root, _hooks_module
+        document, repository_root, _hooks_module, _pr_loop_script_module
     )
 
 
@@ -276,6 +280,25 @@ def accepts_python(document: Document) -> bool:
     return document.path.suffix.lower() == constants.PYTHON_SUFFIX
 
 
+def accepts_production_python(document: Document) -> bool:
+    """Return whether the document is Python outside the test tree.
+
+    The hook lane exempts a test module so a test can stage an undercounting
+    fixture freely. This gate reuses the hook lane's own ``is_test_file``
+    predicate, so the two lanes cannot drift on what counts as a test file.
+
+    Args:
+        document: Candidate document.
+
+    Returns:
+        True for a Python document whose path is not a test path.
+    """
+    if not accepts_python(document):
+        return False
+    shared_module = _hooks_module("blocking.code_rules_shared")
+    return not shared_module.is_test_file(f"/{document.path.as_posix()}")
+
+
 def accepts_code(document: Document) -> bool:
     """Return whether the document contains supported source code.
 
@@ -292,6 +315,21 @@ def accepts_markdown(document: Document) -> bool:
     return document.path.suffix.lower() in constants.ALL_MARKDOWN_SUFFIXES
 
 
+def _is_generated_document(document: Document) -> bool:
+    """Return whether a release tool writes the document from commit history.
+
+    A changelog is rebuilt from merged commit subjects, so its wording belongs
+    to the commits rather than to an author. Prose rules skip it.
+
+    Args:
+        document: Candidate document.
+
+    Returns:
+        True for a generated document name.
+    """
+    return document.path.name.lower() in constants.ALL_GENERATED_DOCUMENT_NAMES
+
+
 def accepts_source_or_markdown(document: Document) -> bool:
     """Return whether a state-description rule can inspect the document.
 
@@ -299,8 +337,10 @@ def accepts_source_or_markdown(document: Document) -> bool:
         document: Candidate document.
 
     Returns:
-        True for supported source or Markdown.
+        True for authored source or Markdown, and False for a generated document.
     """
+    if _is_generated_document(document):
+        return False
     return accepts_code(document) or accepts_markdown(document)
 
 
@@ -311,8 +351,10 @@ def accepts_stored_prompt(document: Document) -> bool:
         document: Candidate document.
 
     Returns:
-        True for Markdown in an instruction directory.
+        True for authored Markdown in an instruction directory.
     """
+    if _is_generated_document(document):
+        return False
     normalized_path = f"/{document.path.as_posix().lower()}"
     return accepts_markdown(document) and any(
         each_segment in normalized_path

package/scripts/policy_lint/config/approved_test_pairs.py

@@ -5,6 +5,31 @@ from pathlib import PurePosixPath
 APPROVED_TEST_PATHS_BY_PRODUCTION_PATH: dict[
     PurePosixPath, frozenset[PurePosixPath]
 ] = {
+    PurePosixPath("packages/claude-dev-env/bin/install-constants.mjs"): frozenset(
+        {
+            PurePosixPath("packages/claude-dev-env/bin/install.cursor-rules.test.mjs"),
+        }
+    ),
+    PurePosixPath("packages/claude-dev-env/bin/install.mjs"): frozenset(
+        {
+            PurePosixPath("packages/claude-dev-env/bin/install.cursor-rules.test.mjs"),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/hooks/blocking/code_rules_comments.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/hooks/blocking/test_code_rules_enforcer_comment_string_awareness.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/hooks/blocking/test_code_rules_enforcer_exempt_marker_chained.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/hooks/blocking/test_code_rules_enforcer_javascript_comments.py"
+            ),
+        }
+    ),
     PurePosixPath(
         "packages/claude-dev-env/hooks/git-hooks/verification_notice_context.py"
     ): frozenset(
@@ -152,15 +177,6 @@ APPROVED_TEST_PATHS_BY_PRODUCTION_PATH: dict[
             ),
         }
     ),
-    PurePosixPath(
-        "packages/claude-dev-env/scripts/automatic_advisory/window_flags.py"
-    ): frozenset(
-        {
-            PurePosixPath(
-                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_window_flags.py"
-            ),
-        }
-    ),
     PurePosixPath(
         "packages/claude-dev-env/scripts/automatic_advisory/windows_job.py"
     ): frozenset(

package/scripts/policy_lint/config/constants.py

@@ -34,6 +34,7 @@ RENAME_PATH_COUNT = 2
 PYTHON_SUFFIX = ".py"
 ALL_CODE_SUFFIXES = frozenset({".py", ".js", ".jsx", ".ts", ".tsx", ".mjs"})
 ALL_MARKDOWN_SUFFIXES = frozenset({".md", ".mdx"})
+ALL_GENERATED_DOCUMENT_NAMES = frozenset({"changelog.md"})
 ALL_STORED_PROMPT_SEGMENTS = (
     "/.agents/",
     "/commands/",
@@ -83,6 +84,8 @@ TERMINOLOGY_MESSAGE_GROUP = "message"
 
 PR_LOOP_DIRECTORY_NAME = "pr-loop"
 SHARED_ROOT_PARENT_INDEX = 2
+POSIX_PATH_SEPARATOR = "/"
+VIOLATION_SCOPING_MODULE_NAME = "code_rules_gate_parts.violation_scoping"
 
 RETIRED_HOOK_PROSE_RULE_ID = "retired-hook-prose"
 RULES_DIRECTORY_NAME = "rules"

package/scripts/policy_lint/registry.py

@@ -73,7 +73,7 @@ def _python_document_rules() -> tuple[model.Rule, ...]:
         ),
         build_document_rule(
             "subprocess-budget",
-            adapters.accepts_python,
+            adapters.accepts_production_python,
             adapters.subprocess_budget_diagnostics,
         ),
         build_document_rule(

package/scripts/policy_lint/selection_git.py

@@ -16,6 +16,14 @@ from .config.constants import (
     UTF8_ENCODING,
 )
 
+import sys
+
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 class GitSelectionError(ValueError):
     """Raised when Git cannot provide the requested source bytes."""
@@ -44,6 +52,7 @@ def git_bytes_for(repository_root: Path, all_arguments: tuple[str, ...]) -> byte
         capture_output=True,
         check=False,
         env=_git_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     if completed.returncode != 0:
         error_text = completed.stderr.decode(UTF8_ENCODING, errors="replace").strip()
@@ -69,6 +78,7 @@ def head_revision(repository_root: Path) -> str | None:
         capture_output=True,
         check=False,
         env=_git_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     if completed.returncode != 0:
         error_text = completed.stderr.decode(UTF8_ENCODING, errors="replace").strip()
@@ -125,6 +135,7 @@ def _read_blob_bytes(repository_root: Path, revision: str, relative_path: str) -
         capture_output=True,
         check=False,
         env=_git_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     if completed.returncode == 0:
         return completed.stdout

package/scripts/repository_checks/config/constants.py

@@ -131,5 +131,10 @@ ALL_TRACKED_SECRET_EXACT_EXEMPTIONS: frozenset[tuple[str, str, str]] = frozenset
             "home-path",
             "5d956228802fbd4a65af8fa7fb4183f5a9f8793dbe218877aefe887b905f726d",
         ),
+        (
+            "shared_utils/theme_assets/contracts/evidence/theme_editor_asset_resolution_master.oneui9.v1.json",
+            "home-path",
+            "ec69fe88e2f9d3f1ed3504532c7484120591cbec7ae6fda017b0f9ca57a3fc25",
+        ),
     )
 )

package/scripts/repository_checks/config/policy_document.py

@@ -0,0 +1,19 @@
+"""Repository policy document and exception-entry schema."""
+
+import re
+
+CONFIG_RELATIVE_PATH = "config/repository-policy.json"
+DIGEST_PATTERN = re.compile(r"[0-9a-f]{64}")
+FORBIDDEN_PATH_CHARACTERS = frozenset("\\:*?[]")
+ALL_ENTRY_FIELDS = frozenset({"path", "sha256", "reason"})
+ALL_FORBIDDEN_PATH_SEGMENTS = frozenset({"", ".", ".."})
+FIRST_PRINTABLE_CODEPOINT = 32
+VERSION_FIELD = "version"
+SUPPORTED_DOCUMENT_VERSION = 1
+EMAIL_EXEMPTIONS_FIELD = "email_exemptions"
+PATH_EXEMPTIONS_FIELD = "path_exemptions"
+ALL_EXEMPTION_FIELDS = frozenset({EMAIL_EXEMPTIONS_FIELD, PATH_EXEMPTIONS_FIELD})
+ALL_DOCUMENT_FIELDS = ALL_EXEMPTION_FIELDS | {VERSION_FIELD}
+EMAIL_EXEMPTION_SUBJECT = "Email exemption"
+PATH_EXEMPTION_SUBJECT = "Path exemption"
+EMAIL_CATEGORY = "email"