claude-dev-env 7.5.0 → 7.6.1

package/bin/install.mjs

@@ -34,7 +34,7 @@ import {
     CURSOR_SYNC_SCRIPT_FILE_NAME,
     CURSOR_RULES_DIRECTORY_NAME,
     PSTACK_MODEL_RULE_FILE_NAME,
-    PSTACK_CODEX_MODEL_PREFERENCES_FILE_NAME,
+    PSTACK_SEEDED_MODEL_PREFERENCES_FILE_NAMES,
     WINDOWS_PYTHON_LAUNCHER_COMMAND,
     PYTHON_PROBE_TIMEOUT_MILLISECONDS,
 } from './install-constants.mjs';
@@ -44,6 +44,11 @@ import {
     refreshPstackPluginManifest,
 } from '../scripts/refresh_pstack_plugin_skills.mjs';
 import { installPstack } from './pstack.mjs';
+import {
+    configureContinuityHosts,
+    continuityHostConfigurationPaths,
+    removeContinuityHooks,
+} from './install-session-continuity.mjs';
 import {
     resolveInstallRoot,
     parseExplicitTargetFromArgv,
@@ -491,17 +496,10 @@ export function refreshInstalledPstackPluginManifest(
     return join(pluginRoot, PSTACK_PLUGIN_MANIFEST_RELATIVE_PATH);
 }
 
-function seedCodexPstackPreferences() {
+function seedPstackPreferences(preferenceFileName) {
     const preferenceDirectory = join(AGENTS_HOME, CURSOR_RULES_DIRECTORY_NAME);
-    const preferencePath = join(
-        preferenceDirectory,
-        PSTACK_CODEX_MODEL_PREFERENCES_FILE_NAME,
-    );
-    const preferenceSource = join(
-        PACKAGE_ROOT,
-        'bin',
-        PSTACK_CODEX_MODEL_PREFERENCES_FILE_NAME,
-    );
+    const preferencePath = join(preferenceDirectory, preferenceFileName);
+    const preferenceSource = join(PACKAGE_ROOT, 'bin', preferenceFileName);
     mkdirSync(preferenceDirectory, { recursive: true });
     try {
         copyFileSync(
@@ -516,6 +514,63 @@ function seedCodexPstackPreferences() {
     }
 }
 
+/**
+ * Registers the session-continuity companion in each host configuration this
+ * install root resolves. Without this step the companion ships to the agents
+ * home but no host ever calls it, so Poteto Mode only activates when someone
+ * remembers a second setup command.
+ *
+ * A competing profile's registration, or an unwritable host configuration, is
+ * reported and leaves the rest of the install intact.
+ *
+ * @returns {string[]} The host configuration paths this run registered.
+ */
+function registerSessionContinuityHooks() {
+    const configurationPaths = continuityHostConfigurationPaths(INSTALL_ROOT_RESOLUTION);
+    const hosts = Object.keys(configurationPaths)
+        .filter(host => existsSync(dirname(configurationPaths[host])));
+    if (hosts.length === 0) return [];
+    try {
+        const results = configureContinuityHosts(INSTALL_ROOT_RESOLUTION, hosts);
+        for (const result of results) {
+            const state = result.changed ? 'registered' : 'already registered';
+            console.log(`  Session continuity: ${state} in ${result.path}`);
+        }
+        return results.map(result => result.path);
+    } catch (registrationError) {
+        console.warn(
+            `  Warning: session-continuity hooks were not registered (${registrationError.message}) — `
+            + 'run bin/install-session-continuity.mjs once the cause is resolved.',
+        );
+        return [];
+    }
+}
+
+/**
+ * Removes the companion's registrations from the Codex and Cursor hook files
+ * during an uninstall. The Claude settings.json copy is pruned inside the
+ * settings block, which owns that file's single write.
+ *
+ * Each host this installer registered is a host it has to clean, or the host
+ * keeps calling a script the uninstall deleted.
+ *
+ * @returns {string[]} The host configuration paths this run changed.
+ */
+function removeSessionContinuityHooksFromOtherHosts() {
+    const configurationPaths = continuityHostConfigurationPaths(INSTALL_ROOT_RESOLUTION);
+    const changedPaths = [];
+    for (const host of ['codex', 'cursor']) {
+        const configurationPath = configurationPaths[host];
+        if (!existsSync(configurationPath)) continue;
+        const configuration = JSON.parse(readFileSync(configurationPath, 'utf8'));
+        if (removeContinuityHooks(configuration) === 0) continue;
+        writeFileSync(configurationPath, JSON.stringify(configuration, null, 2) + '\n');
+        changedPaths.push(configurationPath);
+        console.log(`  Session continuity: hook registrations removed from ${configurationPath}`);
+    }
+    return changedPaths;
+}
+
 /**
  * Formats an absolute interpreter path as a settings.json hook command prefix:
  * forward-slash separators, double-quoted when the path contains a space so the
@@ -2756,10 +2811,12 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
         copyFileSync(pstackRuleSource, sharedRulePath);
         allInstalledFiles.push(sharedRulePath);
         syncWrittenPaths(allInstalledFiles);
-        const seededPreferencePath = seedCodexPstackPreferences();
-        if (seededPreferencePath) {
-            allInstalledFiles.push(seededPreferencePath);
-            allUserOwnedPreferencePaths.add(seededPreferencePath);
+        for (const eachPreferenceFileName of PSTACK_SEEDED_MODEL_PREFERENCES_FILE_NAMES) {
+            const seededPreferencePath = seedPstackPreferences(eachPreferenceFileName);
+            if (seededPreferencePath) {
+                allInstalledFiles.push(seededPreferencePath);
+                allUserOwnedPreferencePaths.add(seededPreferencePath);
+            }
         }
         syncWrittenPaths(allInstalledFiles);
     }
@@ -2927,6 +2984,9 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
         console.log(`  \u2713 ${relative(CLAUDE_HOME, agentsHubDest)} (canonical guidance)`);
     }
     const isFullInstall = !selectedGroups;
+    if (isFullInstall && shouldInstallAnyHooks) {
+        summary.sessionContinuity = { configuredPaths: registerSessionContinuityHooks() };
+    }
     const didPruneRun = isFullInstall && UNRESOLVED_DEPENDENCY_NAMES.length === 0;
     let failedPrunePaths = [];
     let stalePrunedTotal = 0;
@@ -3144,6 +3204,10 @@ function executeUninstallPlan(plan, helpers = {}) {
             pruneManagedHooksFromSettings(settings, managedHookRelativePaths);
             didSettingsChange = true;
             console.log('  Hook entries removed from settings.json');
+            const removedContinuityCount = removeContinuityHooks(settings);
+            if (removedContinuityCount > 0) {
+                console.log(`  Session continuity: ${removedContinuityCount} hook registration(s) removed from settings.json`);
+            }
         }
         const managedDenyFromPlan = plan.managedPermissionDenyEntries.length > 0
             ? plan.managedPermissionDenyEntries
@@ -3161,6 +3225,7 @@ function executeUninstallPlan(plan, helpers = {}) {
             writeFileSync(plan.settingsPath, JSON.stringify(settings, null, 4) + '\n');
         }
     }
+    removeSessionContinuityHooksFromOtherHosts();
     throwIfFault(FAULT_PHASES.AFTER_SETTINGS_WRITE);
 
     unsetGlobalGitHooksPathIfOurs();

package/bin/install.test.mjs

@@ -3088,3 +3088,60 @@ test('--no-pstack leaves the pstack store absent', t => {
         assert.equal(existsSync(join(homeDirectory, '.claude', 'pstack')), false);
     });
 });
+
+function runContinuityInstaller(homeDirectory, extraArguments) {
+    return execFileSync('node', [PSTACK_TEST_INSTALLER_PATH, ...extraArguments], {
+        cwd: dirname(PSTACK_TEST_PACKAGE_ROOT),
+        encoding: 'utf8',
+        env: {
+            ...process.env,
+            CDE_INSTALL_PSTACK: '0',
+            HOME: homeDirectory,
+            USERPROFILE: homeDirectory,
+            GIT_CONFIG_GLOBAL: join(homeDirectory, '.gitconfig'),
+            CODEX_HOME: join(homeDirectory, '.codex'),
+        },
+    });
+}
+
+function continuityCommandCount(configurationPath) {
+    if (!existsSync(configurationPath)) return 0;
+    const configuration = JSON.parse(readFileSync(configurationPath, 'utf8'));
+    const allCommands = Object.values(configuration.hooks || {})
+        .flat()
+        .flatMap(entry => (entry.hooks ? entry.hooks.map(eachHook => eachHook.command) : [entry.command]));
+    return allCommands.filter(
+        eachCommand => typeof eachCommand === 'string'
+            && eachCommand.includes('session-continuity/continuity.mjs'),
+    ).length;
+}
+
+test('a full install registers the session-continuity companion in every host, and uninstall takes it back out', t => {
+    const homeDirectory = mkdtempSync(join(tmpdir(), 'cdev-continuity-install-'));
+    t.after(() => rmSync(homeDirectory, { recursive: true, force: true }));
+    const allConfigurationPaths = [
+        join(homeDirectory, '.claude', 'settings.json'),
+        join(homeDirectory, '.codex', 'hooks.json'),
+        join(homeDirectory, '.cursor', 'hooks.json'),
+    ];
+
+    runContinuityInstaller(homeDirectory, []);
+
+    for (const configurationPath of allConfigurationPaths) {
+        assert.equal(
+            continuityCommandCount(configurationPath) > 0,
+            true,
+            `the install registers the companion in ${configurationPath} without a second setup command`,
+        );
+    }
+
+    runContinuityInstaller(homeDirectory, ['--uninstall']);
+
+    for (const configurationPath of allConfigurationPaths) {
+        assert.equal(
+            continuityCommandCount(configurationPath),
+            0,
+            `uninstall leaves no registration in ${configurationPath} pointing at a removed script`,
+        );
+    }
+});

package/bin/pstack-model-preferences.claude.json

@@ -0,0 +1,23 @@
+{
+    "host": "claude",
+    "modelsByRole": {
+        "feature, refactoring": ["opus"],
+        "bug-fix": ["opus"],
+        "perf-issue": ["fable"],
+        "hillclimb": ["fable"],
+        "judgment and prose": ["fable"],
+        "hardest tasks": ["fable"],
+        "how explorer": ["sonnet"],
+        "how explainer": ["opus"],
+        "how critics": ["sonnet", "opus", "fable"],
+        "why investigators": ["sonnet"],
+        "why synthesizer": ["fable"],
+        "reflect tooling": ["opus"],
+        "reflect judgment, divergent, synthesizer": ["fable"],
+        "arena runners": ["sonnet", "opus", "fable"],
+        "arena cross-judge pool": ["opus", "fable"],
+        "swarm workers": ["sonnet"],
+        "architect runners": ["opus", "fable"],
+        "interrogate reviewers": ["sonnet", "opus", "fable"]
+    }
+}

package/hooks/advisory/pr_done_reminder.py

@@ -36,6 +36,12 @@ import subprocess
 import sys
 from pathlib import Path
 
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 try:
     _hooks_root_directory = str(Path(__file__).resolve().parent.parent)
     if _hooks_root_directory not in sys.path:
@@ -294,6 +300,7 @@ def _probe_pull_request(cwd: str) -> str | None:
             errors="replace",
             timeout=GH_PR_VIEW_TIMEOUT_SECONDS,
             check=False,
+            creationflags=hidden_window_creation_flags(),
         )
     except (OSError, subprocess.TimeoutExpired):
         return None

package/hooks/advisory/refactor_guard.py

@@ -11,6 +11,12 @@ import sys
 from collections import Counter
 from pathlib import Path
 
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 try:
     hooks_root_directory = str(Path(__file__).resolve().parent.parent)
     if hooks_root_directory not in sys.path:
@@ -62,6 +68,7 @@ def _read_added_lines_from_git(all_git_arguments: tuple[str, ...], file_path: st
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=working_directory,
             env=_git_environment(),
+            creationflags=hidden_window_creation_flags(),
         )
     except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
         return []
@@ -106,6 +113,7 @@ def is_new_file(file_path: str) -> bool:
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=working_directory,
             env=_git_environment(),
+            creationflags=hidden_window_creation_flags(),
         )
     except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
         return False

package/hooks/advisory/test_pr_done_reminder.py

@@ -28,6 +28,10 @@ except ImportError as import_error:
     ) from import_error
 
 
+WINDOWS_NO_WINDOW_FLAG = 0x08000000
+EXPECTED_HIDDEN_WINDOW_FLAGS = WINDOWS_NO_WINDOW_FLAG if sys.platform == "win32" else 0
+
+
 _CLEAN_PR_OBJECT: dict[str, object] = {
     "number": 42,
     "url": "https://github.com/acme/widgets/pull/42",
@@ -248,3 +252,20 @@ def test_main_should_stay_quiet_on_any_other_gh_failure(
 
     assert _run_main(monkeypatch, capsys, _payload("git push"), gh_down) == ""
 
+
+
+def test_gh_probe_should_start_without_a_console_window(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    all_recorded_keyword_arguments: dict[str, object] = {}
+
+    def _record(*args: object, **kwargs: object) -> subprocess.CompletedProcess[str]:
+        del args
+        all_recorded_keyword_arguments.update(kwargs)
+        return subprocess.CompletedProcess(
+            [], 0, stdout=json.dumps(_CLEAN_PR_OBJECT), stderr=""
+        )
+
+    _run_main(monkeypatch, capsys, _payload("git push"), _record)
+
+    assert all_recorded_keyword_arguments["creationflags"] == EXPECTED_HIDDEN_WINDOW_FLAGS

package/hooks/advisory/test_refactor_guard.py

@@ -9,9 +9,12 @@ return no added lines, so a qualifying rename is eligible without fixture setup.
 
 from __future__ import annotations
 
+import subprocess
 import sys
 from pathlib import Path
 
+import pytest
+
 try:
     _ADVISORY_DIRECTORY = Path(__file__).resolve().parent
     if str(_ADVISORY_DIRECTORY) not in sys.path:
@@ -25,6 +28,10 @@ except ImportError as import_error:
     ) from import_error
 
 
+WINDOWS_NO_WINDOW_FLAG = 0x08000000
+EXPECTED_HIDDEN_WINDOW_FLAGS = WINDOWS_NO_WINDOW_FLAG if sys.platform == "win32" else 0
+
+
 def _multi_edit_payload(file_path: str, all_edits: list[dict[str, str]]) -> dict[str, object]:
     return {
         "tool_name": "MultiEdit",
@@ -85,3 +92,36 @@ def test_multi_edit_returns_none_when_no_edit_qualifies(tmp_path: Path) -> None:
     )
 
     assert refactor_guard._multi_edit_refactor_advisory_description(payload) is None
+
+
+def _record_creation_flags(
+    monkeypatch: pytest.MonkeyPatch, standard_output: str
+) -> dict[str, object]:
+    all_recorded_keyword_arguments: dict[str, object] = {}
+
+    def _record(*args: object, **kwargs: object) -> subprocess.CompletedProcess[str]:
+        del args
+        all_recorded_keyword_arguments.update(kwargs)
+        return subprocess.CompletedProcess([], 0, stdout=standard_output, stderr="")
+
+    monkeypatch.setattr(refactor_guard.subprocess, "run", _record)
+    return all_recorded_keyword_arguments
+
+
+def test_git_diff_should_start_without_a_console_window(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    all_recorded_keyword_arguments = _record_creation_flags(monkeypatch, "+added line\n")
+
+    refactor_guard.get_git_diff_added_lines(str(tmp_path / "module.py"))
+
+    assert all_recorded_keyword_arguments["creationflags"] == EXPECTED_HIDDEN_WINDOW_FLAGS
+
+
+def test_untracked_probe_should_start_without_a_console_window(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    all_recorded_keyword_arguments = _record_creation_flags(monkeypatch, "module.py\n")
+
+    assert refactor_guard.is_new_file(str(tmp_path / "module.py")) is True
+    assert all_recorded_keyword_arguments["creationflags"] == EXPECTED_HIDDEN_WINDOW_FLAGS

package/hooks/blocking/block_main_commit.py

@@ -23,6 +23,8 @@ if _hooks_dir not in sys.path:
 
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 GIT_COMMAND_TIMEOUT_SECONDS = 5
 PROTECTED_BRANCHES = ("main", "master")
 PROTECTED_REMOTE_PATTERNS: list[str] = []
@@ -111,6 +113,7 @@ def get_branch_at_directory(working_dir: str | None = None) -> str | None:
             text=True,
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=working_dir,
+            creationflags=hidden_window_creation_flags(),
         )
         if completed_process.returncode == 0:
             return completed_process.stdout.strip()
@@ -130,6 +133,7 @@ def is_protected_repo(working_dir: str | None = None) -> bool:
             text=True,
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=working_dir,
+            creationflags=hidden_window_creation_flags(),
         )
         if completed_process.returncode == 0:
             remote_url = completed_process.stdout.strip()

package/hooks/blocking/code_rules_comments.py

@@ -30,6 +30,7 @@ from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
     ALL_TOKEN_ANCHORED_EXEMPT_COMMENT_BODIES,
     CHAINED_INLINE_COMMENT_PATTERN,
     MAX_COMMENT_ISSUES,
+    STEALTH_KEEP_COMMENT_MARKER,
 )
 _javascript_comment_scanner = importlib.import_module("javascript_comment_scanner")
 extract_javascript_comment_occurrences = (
@@ -152,10 +153,36 @@ def _python_comment_occurrences(
     return all_occurrences, True
 
 
+def _is_stealth_keep_occurrence(comment_text: str) -> bool:
+    """Return True for a ``# STEALTH: Keep`` occurrence.
+
+    ``STEALTH: Keep`` is meant to be freely added and to survive edits to
+    the line it sits on, unlike ``noqa`` or ``TODO``, which AGENTS.md
+    requires to be removed rather than added or justified. It is excluded
+    here rather than through the shared exempt-marker set that
+    ``check_comment_changes`` deliberately still blocks on add.
+    """
+    return comment_text.startswith("#") and comment_text[1:].lstrip().startswith(
+        STEALTH_KEEP_COMMENT_MARKER
+    )
+
+
+def _without_stealth_keep_occurrences(
+    all_occurrences: list[tuple[str, int, bool]]
+) -> list[tuple[str, int, bool]]:
+    return [
+        each_occurrence
+        for each_occurrence in all_occurrences
+        if not _is_stealth_keep_occurrence(each_occurrence[0])
+    ]
+
+
 def check_comment_changes(old_content: str, new_content: str, file_path: str) -> list[str]:
     """Check for comment additions or removals between old and new content.
 
-    Inline and standalone comments are blocking findings when added.
+    Inline and standalone comments are blocking findings when added, except
+    ``STEALTH: Keep`` occurrences, which are excluded entirely so the marker
+    can be added and can persist across edits to its line.
     Existing comments can be removed when the touched code no longer needs them.
 
     When the file is Python and either *old_content* or *new_content* cannot
@@ -178,6 +205,9 @@ def check_comment_changes(old_content: str, new_content: str, file_path: str) ->
         old_occurrences = extract_javascript_comment_occurrences(old_content, True)
         new_occurrences = extract_javascript_comment_occurrences(new_content, True)
 
+    old_occurrences = _without_stealth_keep_occurrences(old_occurrences)
+    new_occurrences = _without_stealth_keep_occurrences(new_occurrences)
+
     old_occurrence_counts = Counter(
         (each_text, is_inline)
         for each_text, _line_number, is_inline in old_occurrences
@@ -264,6 +294,8 @@ def _retained_comment_issues(
     (old_occurrences, old_tokenize_ok), (new_occurrences, new_tokenize_ok) = (_comment_occurrences(old_content, file_path, True), _comment_occurrences(new_content, file_path, True))
     if not (old_tokenize_ok and new_tokenize_ok):
         return []
+    old_occurrences = _without_stealth_keep_occurrences(old_occurrences)
+    new_occurrences = _without_stealth_keep_occurrences(new_occurrences)
     all_changed_lines, all_deleted_lines, old_line_by_new_line = _line_diff_data(old_content, new_content)
     old_line_by_key = {
         each_key: [each_line for each_text, each_line, each_is_inline in old_occurrences if (each_text, each_is_inline) == each_key]
@@ -346,12 +378,14 @@ def _is_exempt_python_comment(comment_token: tokenize.TokenInfo) -> bool:
     token-anchored directive body never legitimately carries a ``#``
     (noqa codes, pylint symbols, and pragma directives contain none), so
     any inner ``#`` reliably marks chained prose. Free-form markers
-    (``type:``, ``TODO``, ``FIXME``, ``HACK``, ``XXX``) accept any
-    trailing prose:
+    (``type:``, ``TODO``, ``FIXME``, ``HACK``, ``XXX``, ``STEALTH: Keep``)
+    accept any trailing prose:
     ``# type:`` participates in the documented justification
     convention enforced by ``check_type_escape_hatches`` (which
-    requires a trailing reason), and the TODO-family markers carry
-    annotation text by convention.
+    requires a trailing reason), the TODO-family markers carry
+    annotation text by convention, and ``STEALTH: Keep`` is the
+    acknowledged-bypass marker the CDP runtime-usage scanner reads
+    from the flagged line together with its reason.
     """
     comment_string = comment_token.string
     if comment_string.startswith("#!") and comment_token.start == (1, 0):

package/hooks/blocking/pii_prevention_blocker_parts/repository_exemption.py

@@ -16,6 +16,8 @@ import sys
 from pathlib import Path
 from urllib.parse import urlparse
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 try:
     _blocking_directory = str(Path(__file__).resolve().parent.parent)
     _hooks_directory = str(Path(__file__).resolve().parent.parent.parent)
@@ -186,6 +188,7 @@ def _repository_origin_slug(repository_root: Path) -> str | None:
             text=True,
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=str(repository_root),
+            creationflags=hidden_window_creation_flags(),
         )
     except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
         return None

package/hooks/blocking/precommit_code_rules_gate.py

@@ -18,6 +18,8 @@ from hooks_constants.precommit_code_rules_gate_constants import (  # noqa: E402
     GIT_COMMAND_TIMEOUT_SECONDS,
 )
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 def resolve_repository_root(working_directory: str | None) -> Path | None:
     """Resolve the Git repository root for a directory.
@@ -36,6 +38,7 @@ def resolve_repository_root(working_directory: str | None) -> Path | None:
             text=True,
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=working_directory,
+            creationflags=hidden_window_creation_flags(),
         )
     except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
         return None

package/hooks/blocking/tdd_enforcer_parts/content_analysis.py

@@ -30,6 +30,10 @@ def _safe_constant_attribute_calls() -> frozenset[tuple[str, str]]:
     return frozenset({("re", "compile")})
 
 
+def _safe_string_literal_methods() -> frozenset[str]:
+    return frozenset({"join"})
+
+
 def _node_is_unsafe_construct(subnode: ast.AST) -> bool:
     return isinstance(
         subnode,
@@ -37,7 +41,18 @@ def _node_is_unsafe_construct(subnode: ast.AST) -> bool:
     )
 
 
+def _is_safe_string_literal_method_call(function_node: ast.Attribute) -> bool:
+    receiver = function_node.value
+    return (
+        isinstance(receiver, ast.Constant)
+        and isinstance(receiver.value, str)
+        and function_node.attr in _safe_string_literal_methods()
+    )
+
+
 def _attribute_call_is_unsafe(function_node: ast.Attribute) -> bool:
+    if _is_safe_string_literal_method_call(function_node):
+        return False
     if not isinstance(function_node.value, ast.Name):
         return True
     pair = (function_node.value.id, function_node.attr)
@@ -56,9 +71,10 @@ def _call_is_unsafe(call_node: ast.Call) -> bool:
 def _rhs_has_unsafe_call(rhs_node: ast.AST) -> bool:
     """Return True when a constant's value contains a non-allowlisted call.
 
-    Safe calls are value constructors (``Path(...)``, ``re.compile(...)``) that
-    build objects without side effects; any other call or a comprehension reads
-    as import-time behavior.
+    Safe calls are value constructors (``Path(...)``, ``re.compile(...)``) and
+    a pure string-literal method call (``"|".join(...)``) that build objects
+    without side effects; any other call or a comprehension reads as
+    import-time behavior.
 
     Args:
         rhs_node: The assignment's right-hand-side expression node.

package/hooks/blocking/tdd_enforcer_parts/git_tracking.py

@@ -29,6 +29,8 @@ from tdd_enforcer_parts.config.tdd_enforcer_constants import (
     GIT_PATHSPEC_SEPARATOR,
 )
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 def _git_ls_files_command(file_name: str) -> list[str]:
     return [GIT_EXECUTABLE_NAME, GIT_LS_FILES_SUBCOMMAND, GIT_PATHSPEC_SEPARATOR, file_name]
@@ -57,6 +59,7 @@ def _git_tracks_path(path: Path) -> bool:
             text=True,
             check=False,
             timeout=GIT_LS_FILES_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
     except (OSError, subprocess.SubprocessError):
         return False
@@ -80,6 +83,7 @@ def _working_tree_differs_from_head(path: Path) -> bool:
             text=True,
             check=False,
             timeout=GIT_DIFF_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
     except (OSError, subprocess.SubprocessError):
         return True

package/hooks/blocking/tdd_enforcer_parts/tests/test_content_analysis.py

@@ -12,6 +12,31 @@ def test_constants_only_rejects_function_definition() -> None:
     assert content_analysis._is_constants_only_python_content("def f():\n    return 1\n") is False
 
 
+def test_constants_only_accepts_join_on_a_string_literal_inside_re_compile() -> None:
+    content = (
+        '"""doc."""\n'
+        "import re\n"
+        "NAMES = ('one', 'two')\n"
+        'PATTERN = re.compile("(" + "|".join(NAMES) + ")")\n'
+    )
+    assert content_analysis._is_constants_only_python_content(content) is True
+
+
+def test_constants_only_rejects_join_on_a_non_literal_receiver() -> None:
+    content = (
+        '"""doc."""\n'
+        'SEPARATOR = "|"\n'
+        'NAMES = ("one", "two")\n'
+        "PATTERN = SEPARATOR.join(NAMES)\n"
+    )
+    assert content_analysis._is_constants_only_python_content(content) is False
+
+
+def test_constants_only_rejects_a_non_allowlisted_method_on_a_string_literal() -> None:
+    content = '"""doc."""\nSHOUT = "hi".upper()\n'
+    assert content_analysis._is_constants_only_python_content(content) is False
+
+
 def test_post_edit_import_only_allows_import_removal() -> None:
     existing = "import os\n\ndef run(): return 1\n"
     tool_input = {"old_string": "import os\n", "new_string": ""}

package/hooks/blocking/test_code_rules_enforcer_comment_string_awareness.py

@@ -133,6 +133,33 @@ def test_check_comment_changes_allows_comment_removal_without_advisory(
     assert captured.err == ""
 
 
+def test_check_comment_changes_does_not_flag_added_stealth_keep_marker() -> None:
+    old_content = "x = 1\n"
+    new_content = "x = 1  # STEALTH: Keep -- reason\n"
+    issues = code_rules_enforcer.check_comment_changes(old_content, new_content, "foo.py")
+    assert issues == []
+
+
+def test_check_comment_changes_does_not_flag_stealth_keep_retained_on_touched_line() -> None:
+    old_content = "x = 1  # STEALTH: Keep -- reason\n"
+    new_content = "x = 2  # STEALTH: Keep -- reason\n"
+    issues = code_rules_enforcer.check_comment_changes(old_content, new_content, "foo.py")
+    assert issues == []
+
+
+@pytest.mark.parametrize(
+    "each_marker",
+    ("# noqa: E501", "# type: ignore[misc]", "# TODO: revisit", "# FIXME: revisit"),
+)
+def test_check_comment_changes_still_flags_other_added_directive_markers(
+    each_marker: str,
+) -> None:
+    old_content = "x = 1\n"
+    new_content = f"x = 1  {each_marker}\n"
+    issues = code_rules_enforcer.check_comment_changes(old_content, new_content, "foo.py")
+    assert any("comment added" in each_issue.lower() for each_issue in issues)
+
+
 def test_python_check_should_exempt_directive_without_space_after_hash() -> None:
     for each_directive in ("#noqa", "#type: ignore", "#pylint: disable", "#pragma: no cover"):
         content = f"{each_directive}\n"