claude-dev-env 7.5.0 → 7.6.1

package/hooks/validators/run_all_validators.py

@@ -60,6 +60,8 @@ from hooks_constants.multi_edit_reconstruction import (
     edits_for_tool,
 )
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 VALIDATORS_DIR = Path(__file__).parent
 hooks_dir = VALIDATORS_DIR.parent
 package_name = VALIDATORS_DIR.name
@@ -131,6 +133,7 @@ def invoke_validator_module(module_stem: str, forwarded_file_paths: List[str]) -
         text=True,
         cwd=working_directory_string,
         env=environment,
+        creationflags=hidden_window_creation_flags(),
     )
 
 
@@ -160,6 +163,7 @@ def run_validators_entrypoint_subprocess(
         cwd=working_directory_string,
         env=environment,
         input=stdin_text,
+        creationflags=hidden_window_creation_flags(),
     )
 
 
@@ -347,6 +351,7 @@ def get_project_root() -> Optional[Path]:
         ["git", "-C", str(hooks_dir), "rev-parse", "--show-toplevel"],
         capture_output=True,
         text=True,
+        creationflags=hidden_window_creation_flags(),
     )
     if completed_git_lookup.returncode == 0:
         return Path(completed_git_lookup.stdout.strip())
@@ -674,6 +679,7 @@ def get_changed_files() -> List[Path]:
         ["git", "diff", "--cached", "--name-only"],
         capture_output=True,
         text=True,
+        creationflags=hidden_window_creation_flags(),
     )
 
     files = result.stdout.strip().split("\n") if result.stdout.strip() else []
@@ -684,6 +690,7 @@ def get_changed_files() -> List[Path]:
             ["git", "diff", "--name-only", "HEAD~1"],
             capture_output=True,
             text=True,
+            creationflags=hidden_window_creation_flags(),
         )
         files = result.stdout.strip().split("\n") if result.stdout.strip() else []
 

package/hooks/validators/subprocess_window_access.py

@@ -0,0 +1,41 @@
+"""Reach the hidden-window helpers from the scripts this directory deploys.
+
+The installer copies this directory into a profile that holds no installed
+Python distribution, and this repository's own tests run the deployed scripts
+under ``python -S -E``, which hides every installed package from the child
+process. On both routes ``hooks_constants`` is reachable only through the
+deployed ``hooks`` directory, so this module puts that directory on
+``sys.path`` and re-exports the helpers a caller asks for::
+
+    from subprocess_window_access import hidden_window_creation_flags
+
+The directory goes on the end of ``sys.path``. ``PathFinder`` runs ahead of
+every editable-install finder, so a trailing entry still selects the deployed
+copy, and the head of ``sys.path`` stays exactly as the caller left it. A
+caller that prepended its own roots keeps them first.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_subprocess_window_hooks_directory = str(
+    Path(__file__).resolve().parents[2] / "hooks"
+)
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import (
+    HiddenWindowStartupInfo,
+    detached_hidden_window_creation_flags,
+    hidden_window_creation_flags,
+    inherited_stream_startup_info,
+)
+
+__all__ = [
+    "HiddenWindowStartupInfo",
+    "detached_hidden_window_creation_flags",
+    "hidden_window_creation_flags",
+    "inherited_stream_startup_info",
+]

package/hooks/workflow/auto_formatter.py

@@ -14,6 +14,12 @@ from collections.abc import Mapping
 from pathlib import Path
 from types import ModuleType
 
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 NOTIFICATION_UTILS_DIRECTORY = os.path.join(
     os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "notification"
 )
@@ -118,6 +124,7 @@ def is_untracked_in_git(file_path: str) -> bool:
             cwd=containing_directory,
             timeout=GIT_LS_FILES_TIMEOUT_SECONDS,
             env=_build_git_command_environment(),
+            creationflags=hidden_window_creation_flags(),
         )
         return git_check.returncode != 0
     except (FileNotFoundError, subprocess.TimeoutExpired):
@@ -198,6 +205,7 @@ def _run_command(
             capture_output=True,
             text=True,
             timeout=timeout_seconds,
+            creationflags=hidden_window_creation_flags(),
         )
     except FileNotFoundError:
         return None, False

package/hooks/workflow/test_auto_formatter.py

@@ -35,6 +35,8 @@ HOOKS_JSON_PATH = os.path.join(HOOKS_DIRECTORY_PATH, "hooks.json")
 POST_TOOL_USE_DISPATCHER_COMMAND_FRAGMENT = "validation/post_tool_use_dispatcher.py"
 UNUSED_IMPORT_SOURCE = "import os\n\n\nVALUE = 1\n"
 HOOK_RUN_TIMEOUT_SECONDS = 60
+WINDOWS_NO_WINDOW_FLAG = 0x08000000
+EXPECTED_HIDDEN_WINDOW_FLAGS = WINDOWS_NO_WINDOW_FLAG if sys.platform == "win32" else 0
 
 
 def build_fixture_git_environment() -> dict[str, str]:
@@ -415,3 +417,40 @@ class TestPythonFormatTimeoutBudget:
         budgeted_total = auto_formatter_module.budgeted_python_format_seconds()
 
         assert budgeted_total < _registered_auto_formatter_timeout()
+
+
+def _record_creation_flags(
+    auto_formatter_module: ModuleType, monkeypatch: pytest.MonkeyPatch
+) -> dict[str, object]:
+    all_recorded_keyword_arguments: dict[str, object] = {}
+
+    def _record(*args: object, **kwargs: object) -> subprocess.CompletedProcess[str]:
+        del args
+        all_recorded_keyword_arguments.update(kwargs)
+        return subprocess.CompletedProcess([], 1, stdout="", stderr="")
+
+    monkeypatch.setattr(auto_formatter_module.subprocess, "run", _record)
+    return all_recorded_keyword_arguments
+
+
+def test_untracked_probe_should_start_without_a_console_window(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    auto_formatter_module = _load_auto_formatter_module()
+    all_recorded_keyword_arguments = _record_creation_flags(auto_formatter_module, monkeypatch)
+
+    assert auto_formatter_module.is_untracked_in_git(str(tmp_path / "module.py")) is True
+    assert all_recorded_keyword_arguments["creationflags"] == EXPECTED_HIDDEN_WINDOW_FLAGS
+
+
+def test_formatter_command_should_start_without_a_console_window(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    auto_formatter_module = _load_auto_formatter_module()
+    all_recorded_keyword_arguments = _record_creation_flags(auto_formatter_module, monkeypatch)
+
+    auto_formatter_module._run_command(
+        ["ruff", "format"], str(tmp_path / "module.py"), HOOK_RUN_TIMEOUT_SECONDS
+    )
+
+    assert all_recorded_keyword_arguments["creationflags"] == EXPECTED_HIDDEN_WINDOW_FLAGS

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "7.5.0",
+    "version": "7.6.1",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/rules/pstack-models.md

@@ -28,9 +28,10 @@ The file contains this shape:
 ```
 
 Offer only model IDs the active native tool accepts. Keep the user's order.
-Treat `inherit-parent` and `auto` as parent inheritance, not model IDs. A
-different host starts with its own confirmed choices. It never copies the Codex
-preference file.
+Treat `inherit-parent` and `auto` as parent inheritance, not model IDs. A full
+install seeds the Claude file and the Codex file from the package when a host
+file is absent, and leaves an existing file untouched. A different host never
+copies another host's preference file.
 
 ## Selection before every delegation
 

package/scripts/automatic_advisory/checkout.py

@@ -10,7 +10,14 @@ from .config.constants import (
     GIT_EXECUTABLE,
 )
 from .model import AdvisoryRegistration, LocalCheckout
-from .window_flags import hidden_window_creation_flags
+
+import sys
+
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
 
 
 def read_local_checkout(checkout_path: Path) -> LocalCheckout:

package/scripts/automatic_advisory/cli.py

@@ -38,7 +38,14 @@ from automatic_advisory.runner import (
     AdvisoryGitHub,
     AutomaticAdvisoryRunner,
 )
-from automatic_advisory.window_flags import detached_poller_creation_flags
+
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import (
+    detached_hidden_window_creation_flags,
+)
 
 
 def build_parser() -> argparse.ArgumentParser:
@@ -134,7 +141,6 @@ def start_polling(settings_path: Path) -> int:
     Returns:
         Zero after the child process starts.
     """
-    process_flags = detached_poller_creation_flags()
     resolved_settings_path = settings_path.resolve()
     subprocess.Popen(
         (
@@ -148,7 +154,7 @@ def start_polling(settings_path: Path) -> int:
         stdin=subprocess.DEVNULL,
         stdout=subprocess.DEVNULL,
         stderr=subprocess.DEVNULL,
-        creationflags=process_flags,
+        creationflags=detached_hidden_window_creation_flags(),
         start_new_session=True,
     )
     return SUCCESS_EXIT_CODE

package/scripts/automatic_advisory/config/constants.py

@@ -75,8 +75,6 @@ WINDOWS_EXTENDED_LIMIT_INFORMATION_CLASS = 9
 WINDOWS_JOB_KILL_ON_CLOSE_LIMIT = 0x2000
 DEFAULT_CLONE_URL_SUFFIX = ".git"
 POLL_LOCK_DIRECTORY_NAME = ".poll-process"
-CREATE_NEW_PROCESS_GROUP_ATTRIBUTE = "CREATE_NEW_PROCESS_GROUP"
-CREATE_NO_WINDOW_ATTRIBUTE = "CREATE_NO_WINDOW"
 CHILD_MANIFEST_FLAG = "--manifest"
 CHILD_REPOSITORY_FLAG = "--repo"
 CHILD_BASE_FLAG = "--base"

package/scripts/automatic_advisory/execution.py

@@ -26,7 +26,6 @@ from .config.constants import (
 )
 from .config.timing import CHILD_CLEANUP_TIMEOUT_SECONDS
 from .model import AdvisoryRegistration, ChildOutcome
-from .window_flags import hidden_window_creation_flags
 from .windows_job import (
     _assign_process,
     _close_handle,
@@ -34,6 +33,12 @@ from .windows_job import (
     _terminate_job,
 )
 
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 @dataclass(frozen=True)
 class OwnedChildProcess:
@@ -165,6 +170,7 @@ def _start_posix_child(
             text=True,
             env=all_child_environment,
             start_new_session=True,
+            creationflags=hidden_window_creation_flags(),
         )
     except OSError:
         return None

package/scripts/automatic_advisory/git.py

@@ -17,7 +17,15 @@ from .config.constants import (
 )
 from .config.timing import GIT_FETCH_TIMEOUT_SECONDS
 from .model import AdvisoryRegistration
-from .window_flags import hidden_window_creation_flags
+
+import sys
+from pathlib import Path
+
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
 
 
 def _fetch_base(

package/scripts/automatic_advisory/process_host.py

@@ -8,6 +8,8 @@ from pr_verification.config.constants import INCOMPLETE_EXIT_CODE
 
 from .config.constants import WINDOWS_PROCESS_START_SIGNAL
 
+from subprocess_window_access import inherited_stream_startup_info
+
 
 def run_owned_child(all_arguments: Sequence[str]) -> int:
     """Wait for ownership, then run the advisory child.
@@ -24,6 +26,7 @@ def run_owned_child(all_arguments: Sequence[str]) -> int:
         tuple(all_arguments),
         shell=False,
         check=False,
+        startupinfo=inherited_stream_startup_info(),
     )
     return completed_process.returncode
 

package/scripts/claude_chain_runner.py

@@ -131,6 +131,8 @@ from dev_env_scripts_constants.claude_chain_constants import (
     UTF8_ENCODING,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 def _decode_captured_stream(raw_bytes: bytes, encoding: str, errors: str) -> str:
     """Decode captured *raw_bytes* with ``text=True`` universal-newline semantics.
@@ -222,6 +224,7 @@ def _run_captured_subprocess(
                     else None
                 ),
                 input=input_bytes,
+                creationflags=hidden_window_creation_flags(),
             )
         except subprocess.TimeoutExpired as timeout_error:
             _attach_partial_timeout_streams(

package/scripts/gh_artifact_upload.py

@@ -41,6 +41,8 @@ from dev_env_scripts_constants.gh_artifact_upload_constants import (
     UTF8_ENCODING,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 class ArtifactUploadError(Exception):
     """Raised when creating the release or uploading the asset fails."""
@@ -53,6 +55,7 @@ def _run_gh(all_arguments: list[str]) -> subprocess.CompletedProcess[str]:
         text=True,
         encoding=UTF8_ENCODING,
         check=False,
+        creationflags=hidden_window_creation_flags(),
     )
 
 

package/scripts/grok_headless_runner.py

@@ -85,6 +85,8 @@ from process_tree_kill import (  # noqa: E402
     terminate_process_tree,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 runner_popen = subprocess.Popen
 
 
@@ -361,6 +363,7 @@ def _invoke_process(
             encoding=UTF8_ENCODING,
             errors=UTF8_DECODE_ERRORS,
             start_new_session=should_start_new_session(),
+            creationflags=hidden_window_creation_flags(),
         )
     except FileNotFoundError:
         return _missing_binary_outcome()

package/scripts/grok_patch_artifacts.py

@@ -27,6 +27,8 @@ from dev_env_scripts_constants.grok_run_ledger_constants import (
     UTF8_ENCODING,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 def compute_sha256_hex(content: bytes) -> str:
     """Return the hex SHA-256 digest of raw bytes.
@@ -58,11 +60,13 @@ def extract_worktree_diff(
         ["git", "-C", str(worktree_path), "diff", base_sha],
         text=True,
         encoding=UTF8_ENCODING,
+        creationflags=hidden_window_creation_flags(),
     )
     changed_paths_listing = subprocess.check_output(
         ["git", "-C", str(worktree_path), "diff", "--name-only", base_sha],
         text=True,
         encoding=UTF8_ENCODING,
+        creationflags=hidden_window_creation_flags(),
     )
     changed_paths = tuple(
         each_line.strip()

package/scripts/grok_worker_preflight.py

@@ -90,6 +90,8 @@ from dev_env_scripts_constants.grok_worker_constants import (
     UTF8_ENCODING,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 preflight_which = shutil.which
 preflight_subprocess_runner = subprocess.run
 preflight_time = time.time
@@ -259,6 +261,7 @@ def _run_grok_command(
             errors=UTF8_DECODE_ERRORS,
             timeout=timeout_seconds,
             check=False,
+            creationflags=hidden_window_creation_flags(),
         )
     except OSError:
         return None

package/scripts/invoke_code_review.py

@@ -104,6 +104,8 @@ from dev_env_scripts_constants.timing import (  # noqa: E402
     DEFAULT_CODE_REVIEW_TIMEOUT_SECONDS,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 @dataclass(frozen=True)
 class CodeReviewOutcome:
@@ -265,6 +267,7 @@ def is_working_tree_dirty(working_directory: Path) -> bool:
         capture_output=True,
         text=True,
         check=False,
+        creationflags=hidden_window_creation_flags(),
     )
     if completion.returncode != 0:
         return True

package/scripts/local_verification/command_runner.py

@@ -11,6 +11,8 @@ from .config import (
 )
 from .model import CommandCapture
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 def run_command(
     all_arguments: tuple[str, ...], check_directory: Path, timeout_seconds: float
@@ -73,6 +75,7 @@ def _run_subprocess(
         encoding=UTF8_ENCODING,
         errors="replace",
         timeout=timeout_seconds,
+        creationflags=hidden_window_creation_flags(),
     )
 
 

package/scripts/local_verification/git_state.py

@@ -23,6 +23,8 @@ from .config import (
 )
 from .config.timing import GIT_METADATA_TIMEOUT_SECONDS
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 @dataclass(frozen=True)
 class CandidateSnapshot:
@@ -82,6 +84,7 @@ def _run_git_bytes(
             capture_output=True,
             check=False,
             timeout=GIT_METADATA_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
     except (OSError, subprocess.SubprocessError):
         return None

package/scripts/policy_lint/adapter_detectors.py

@@ -4,6 +4,7 @@ from collections.abc import Iterable
 from contextlib import redirect_stderr, redirect_stdout
 from io import StringIO
 from pathlib import Path, PurePosixPath
+from types import ModuleType
 
 from . import adapter_support
 from .config import constants
@@ -118,10 +119,49 @@ def validator_diagnostics(
     return adapter_support._diagnostics_for_messages(document, "validators", all_messages)
 
 
+def _is_untouched_function(
+    message: str, all_changed_lines: frozenset[int], scoping_module: ModuleType
+) -> bool:
+    span_range = scoping_module.function_length_span_range(message)
+    return span_range is not None and all_changed_lines.isdisjoint(span_range)
+
+
+def _change_scoped_messages(
+    all_messages: Iterable[str],
+    document: Document,
+    load_pr_loop_module: adapter_support.HookModuleLoader,
+) -> tuple[str, ...]:
+    """Drop function-length messages for functions the change never touched.
+
+    ::
+
+        an import added above an existing long ``main`` -> dropped
+        a statement added inside that ``main``          -> kept
+
+    Args:
+        all_messages: Every message the code-rule engine returned.
+        document: Current document and the lines this change touched.
+        load_pr_loop_module: Loader for the shared pull-request-loop scripts.
+
+    Returns:
+        The messages that remain in scope for this change.
+    """
+    all_changed_lines = document.changed_lines
+    if all_changed_lines is None:
+        return tuple(all_messages)
+    scoping_module = load_pr_loop_module(constants.VIOLATION_SCOPING_MODULE_NAME)
+    return tuple(
+        each_message
+        for each_message in all_messages
+        if not _is_untouched_function(each_message, all_changed_lines, scoping_module)
+    )
+
+
 def code_rule_diagnostics(
     document: Document,
     repository_root: Path,
     load_module: adapter_support.HookModuleLoader,
+    load_pr_loop_module: adapter_support.HookModuleLoader,
 ) -> tuple[Diagnostic, ...]:
     """Run the code-rule engine on one document.
 
@@ -129,9 +169,10 @@ def code_rule_diagnostics(
         document: Current text and optional prior text.
         repository_root: Request repository root for sibling-file resolution.
         load_module: Hook module loader.
+        load_pr_loop_module: Loader for the shared pull-request-loop scripts.
 
     Returns:
-        Diagnostics from the code-rule engine.
+        Diagnostics from the code-rule engine, scoped to the change.
     """
     absolute_path = adapter_support._document_path(repository_root, document)
     legacy_module = load_module("blocking.code_rules_enforcer")
@@ -146,7 +187,12 @@ def code_rule_diagnostics(
             sibling_directory=absolute_path.parent,
             include_comment_policy=True,
         )
-    return adapter_support._diagnostics_for_messages(document, "code-rules", all_messages)
+    all_scoped_messages = _change_scoped_messages(
+        all_messages, document, load_pr_loop_module
+    )
+    return adapter_support._diagnostics_for_messages(
+        document, "code-rules", all_scoped_messages
+    )
 
 
 def state_description_diagnostics(