claude-dev-env 8.101.0 → 8.102.0

package/bin/codex-trimmed-sol.test.mjs

@@ -35,6 +35,7 @@ function installInScratchHome(homeDirectory, argumentsList = [], environment = {
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
             CLAUDE_DEV_ENV_INSTALL_FAULT: undefined,
             HOME: homeDirectory,
             USERPROFILE: homeDirectory,

package/bin/install-pstack-plugin.mjs

@@ -59,6 +59,27 @@ export const SUBAGENT_MODELS_PLUGIN_SPEC = Object.freeze({
     optOutVariable: 'CDE_INSTALL_SUBAGENT_MODELS',
 });
 
+/**
+ * Anthropic's security-guidance plugin, which reviews each edit, turn, and
+ * commit an agent makes for security problems.
+ *
+ * Its marketplace holds every official Anthropic plugin and may supply other
+ * plugins the user installed, so the install never removes that marketplace
+ * to rebuild it.
+ */
+export const SECURITY_GUIDANCE_PLUGIN_SPEC = Object.freeze({
+    name: 'security-guidance',
+    label: 'Security-guidance',
+    marketplaceRepository: 'anthropics/claude-plugins-official',
+    marketplaceName: 'claude-plugins-official',
+    sparsePaths: Object.freeze([]),
+    pluginIdentifier: 'security-guidance@claude-plugins-official',
+    hosts: Object.freeze(['claude']),
+    optOutFlag: '--no-security-guidance',
+    optOutVariable: 'CDE_INSTALL_SECURITY_GUIDANCE',
+    sharesMarketplace: true,
+});
+
 const HOST_DEFINITIONS = Object.freeze({
     claude: Object.freeze({
         executable: 'claude',
@@ -303,7 +324,8 @@ function lockedFolderDetail(allSpecs, host, homeDirectory, errorText, findLocker
     }).join('');
 }
 
-const REBUILD_REQUIRED_PATTERN = /doesn't match its extraKnownMarketplaces entry|Source path does not exist/;
+const MARKETPLACE_SOURCE_MISMATCH_PATTERN = /doesn't match its extraKnownMarketplaces entry/;
+const REBUILD_REQUIRED_PATTERN = new RegExp(`${MARKETPLACE_SOURCE_MISMATCH_PATTERN.source}|Source path does not exist`);
 
 function commandFailureDetail(outcome) {
     return singleLineDetail(outcome.stderr) || singleLineDetail(outcome.stdout)
@@ -356,7 +378,25 @@ function installForHost(allSpecs, host, homeDirectory, environment, runCommand,
             return { host, executable, status: 'installed', warning: null };
         }
         const refreshOutput = `${refreshOutcome.outcome.stderr ?? ''}\n${refreshOutcome.outcome.stdout ?? ''}`;
-        if (!REBUILD_REQUIRED_PATTERN.test(refreshOutput)) {
+        const marketplaceIsShared = allSpecs.some(eachSpec => eachSpec.sharesMarketplace);
+        const sourceMismatchOnAdd = refreshOutcome.commandArguments === plan.refreshCommands[0]
+            && MARKETPLACE_SOURCE_MISMATCH_PATTERN.test(refreshOutput);
+        if (marketplaceIsShared && sourceMismatchOnAdd) {
+            const knownMarketplacePlan = { ...plan, refreshCommands: plan.refreshCommands.slice(1) };
+            const knownMarketplaceOutcome = refreshInPlace(
+                knownMarketplacePlan, executable, commandEnvironment, runCommand,
+            );
+            if (knownMarketplaceOutcome.state === 'refreshed') {
+                removeOrphanedVersionsForHost(allSpecs, host, homeDirectory);
+                return { host, executable, status: 'installed', warning: null };
+            }
+            if (knownMarketplaceOutcome.state === 'absent') return absentHostOutcome(allSpecs, host, executable);
+            return failedCommandOutcome(
+                allSpecs, host, homeDirectory, executable,
+                knownMarketplaceOutcome.commandArguments, knownMarketplaceOutcome.outcome, findLockers,
+            );
+        }
+        if (marketplaceIsShared || !REBUILD_REQUIRED_PATTERN.test(refreshOutput)) {
             return failedCommandOutcome(
                 allSpecs, host, homeDirectory, executable,
                 refreshOutcome.commandArguments, refreshOutcome.outcome, findLockers,
@@ -418,7 +458,12 @@ export function restartNotice(allSpecs, allInstalledHosts) {
  * back to the clean install Codex always runs: it removes every plugin in the
  * set and then the marketplace, so an older version never survives beside the
  * new one, and adds them again. A removal that finds nothing to remove exits
- * non-zero on a fresh home, and the install goes on.
+ * non-zero on a fresh home, and the install goes on. A spec that marks its
+ * marketplace as shared skips the rebuild, because removing that marketplace
+ * would uninstall plugins this run does not own. When the shared marketplace
+ * is already known under another source, the add fails on the mismatch and
+ * the host runs the rest of the refresh against the known entry; any other
+ * refresh failure reports the host failed.
  * Before each Claude marketplace add, the install deletes the half-made clone
  * folder an interrupted earlier add left, so the add starts in an empty slot.
  *

package/bin/install-pstack-plugin.test.mjs

@@ -9,6 +9,7 @@ import {
     PSTACK_PLUGIN_IDENTIFIER,
     ALL_RETIRED_PLUGIN_SPECS,
     PSTACK_PLUGIN_SPEC,
+    SECURITY_GUIDANCE_PLUGIN_SPEC,
     SUBAGENT_MODELS_PLUGIN_SPEC,
     USAGE_WRAPUP_PLUGIN_SPEC,
     hostCommandInvocation,
@@ -584,4 +585,60 @@ test('a run that installs nothing prints no restart notice', () => {
     assert.equal(outcome.status, 'skipped');
     assert.deepEqual(allLoggedLines, []);
     assert.equal(outcome.restartNotice, null);
-});
+});
+
+test('should install security-guidance from the official marketplace on Claude only', () => {
+    const runner = recordingRunner();
+    const outcome = installMarketplacePlugins([SECURITY_GUIDANCE_PLUGIN_SPEC], ROOTS, runner);
+    assert.equal(outcome.status, 'installed');
+    assert.deepEqual(outcome.hosts.map(host => host.host), ['claude']);
+    assert.deepEqual(runner.calls.map(call => [call.executable, ...call.commandArguments]), [
+        ['claude', 'plugin', 'marketplace', 'add', 'anthropics/claude-plugins-official'],
+        ['claude', 'plugin', 'marketplace', 'update', 'claude-plugins-official'],
+        ['claude', 'plugin', 'install', 'security-guidance@claude-plugins-official'],
+        ['claude', 'plugin', 'update', 'security-guidance@claude-plugins-official'],
+    ]);
+    assert.equal(runner.calls[0].environment.CLAUDE_CONFIG_DIR, ROOTS.claudeRoot);
+});
+
+test('should install against an official marketplace already known under another source', () => {
+    const runner = recordingRunner((executable, commandArguments) => (
+        commandArguments[2] === 'add'
+            ? { status: 1, stderr: "its source doesn't match its extraKnownMarketplaces entry" }
+            : { status: 0, stderr: '' }));
+    const outcome = installMarketplacePlugins([SECURITY_GUIDANCE_PLUGIN_SPEC], ROOTS, runner);
+    assert.equal(outcome.status, 'installed');
+    assert.deepEqual(runner.calls.map(call => call.commandArguments), [
+        ['plugin', 'marketplace', 'add', 'anthropics/claude-plugins-official'],
+        ['plugin', 'marketplace', 'update', 'claude-plugins-official'],
+        ['plugin', 'install', 'security-guidance@claude-plugins-official'],
+        ['plugin', 'update', 'security-guidance@claude-plugins-official'],
+    ]);
+});
+
+test('should leave the shared official marketplace in place when its refresh needs a rebuild', () => {
+    const runner = recordingRunner((executable, commandArguments) => (
+        commandArguments[1] === 'install'
+            ? { status: 1, stderr: 'Source path does not exist: plugins/security-guidance' }
+            : { status: 0, stderr: '' }));
+    const outcome = installMarketplacePlugins([SECURITY_GUIDANCE_PLUGIN_SPEC], ROOTS, runner);
+    assert.equal(outcome.status, 'failed');
+    assert.match(outcome.warning, /Source path does not exist/);
+    assert.equal(
+        runner.calls.some(call => call.commandArguments.includes('remove') || call.commandArguments.includes('uninstall')),
+        false,
+    );
+});
+
+test('should turn off only security-guidance with its opt-out flag or variable', () => {
+    assert.equal(shouldInstallMarketplacePlugin(SECURITY_GUIDANCE_PLUGIN_SPEC, [], {}), true);
+    assert.equal(shouldInstallMarketplacePlugin(SECURITY_GUIDANCE_PLUGIN_SPEC, ['--no-security-guidance'], {}), false);
+    assert.equal(
+        shouldInstallMarketplacePlugin(SECURITY_GUIDANCE_PLUGIN_SPEC, [], { CDE_INSTALL_SECURITY_GUIDANCE: '0' }),
+        false,
+    );
+    assert.equal(
+        shouldInstallMarketplacePlugin(PSTACK_PLUGIN_SPEC, ['--no-security-guidance'], { CDE_INSTALL_SECURITY_GUIDANCE: '0' }),
+        true,
+    );
+});

package/bin/install.agents-home.test.mjs

@@ -56,6 +56,7 @@ function runInstaller(homeDirectory, extraArguments, environmentOverrides = {})
         CDE_INSTALL_DEEPSTACK: '0',
         CDE_INSTALL_USAGE_WRAPUP: '0',
         CDE_INSTALL_SUBAGENT_MODELS: '0',
+        CDE_INSTALL_SECURITY_GUIDANCE: '0',
         HOME: homeDirectory,
         USERPROFILE: homeDirectory,
         GIT_CONFIG_GLOBAL: join(homeDirectory, '.gitconfig'),

package/bin/install.codex-rules.test.mjs

@@ -62,6 +62,7 @@ function runInstaller(homeDirectory, extraArguments) {
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
             HOME: homeDirectory,
             USERPROFILE: homeDirectory,
             GIT_CONFIG_GLOBAL: join(homeDirectory, '.gitconfig'),
@@ -95,6 +96,7 @@ function scanTextWithProductionPiiScanner(scannedText) {
                     CDE_INSTALL_DEEPSTACK: '0',
                     CDE_INSTALL_USAGE_WRAPUP: '0',
                     CDE_INSTALL_SUBAGENT_MODELS: '0',
+                    CDE_INSTALL_SECURITY_GUIDANCE: '0',
                     PYTHONPATH: BLOCKING_HOOKS_DIRECTORY,
                     CLAUDE_LOCAL_IDENTITY_PATH: join(
                         temporaryDirectory,

package/bin/install.cursor-rules.test.mjs

@@ -36,6 +36,7 @@ function runInstaller(homeDirectory, extraArguments, environmentOverrides = {})
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
             HOME: homeDirectory,
             USERPROFILE: homeDirectory,
             CODEX_HOME: join(homeDirectory, '.codex'),

package/bin/install.mjs

@@ -58,6 +58,7 @@ import {
 import {
     ALL_RETIRED_PLUGIN_SPECS,
     PSTACK_PLUGIN_SPEC,
+    SECURITY_GUIDANCE_PLUGIN_SPEC,
     SUBAGENT_MODELS_PLUGIN_SPEC,
     USAGE_WRAPUP_PLUGIN_SPEC,
     installMarketplacePlugins,
@@ -3121,6 +3122,13 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
         summary.repositoryPlugins = repositoryPlugins;
         printPluginHostOutcomes(allRepositoryPluginSpecs, repositoryPlugins);
     }
+    if (!selectedGroups && shouldInstallMarketplacePlugin(SECURITY_GUIDANCE_PLUGIN_SPEC)) {
+        const securityGuidancePlugin = installMarketplacePlugins([SECURITY_GUIDANCE_PLUGIN_SPEC], {
+            claudeRoot: CLAUDE_HOME,
+        });
+        summary.securityGuidancePlugin = securityGuidancePlugin;
+        printPluginHostOutcomes([SECURITY_GUIDANCE_PLUGIN_SPEC], securityGuidancePlugin);
+    }
     if (!selectedGroups) {
         const packageGuidancePath = writeCodexPackageGuidance(
             INSTALL_ROOT_RESOLUTION.codexHomeDirectory,
@@ -3686,6 +3694,7 @@ Usage:
   npx ${PACKAGE_NAME} --no-deepstack  Full install without the DeepStack plugin (also CDE_INSTALL_DEEPSTACK=0)
   npx ${PACKAGE_NAME} --no-usage-wrapup  Full install without the usage-wrapup plugin (also CDE_INSTALL_USAGE_WRAPUP=0)
   npx ${PACKAGE_NAME} --no-subagent-models  Full install without the subagent-models plugin (also CDE_INSTALL_SUBAGENT_MODELS=0)
+  npx ${PACKAGE_NAME} --no-security-guidance  Full install without Anthropic's security-guidance plugin (also CDE_INSTALL_SECURITY_GUIDANCE=0)
   npx ${PACKAGE_NAME} --uninstall  Remove installed files from the selected root
   npx ${PACKAGE_NAME} --help       Show this help
 

package/bin/install.pr-visual.test.mjs

@@ -22,7 +22,7 @@ test('packed full and core installs ship the runnable PR visual skill to the sha
             const homeDirectory = join(sandbox, `home-${eachIndex}`);
             execFileSync(process.execPath, [join(packaged, 'bin/install.mjs'), ...eachArguments], {
                 encoding: 'utf8',
-                env: { ...process.env, CLAUDE_CONFIG_DIR: undefined, LLM_SETTINGS_PROFILES_ROOT: undefined, HOME: homeDirectory, USERPROFILE: homeDirectory, CODEX_HOME: join(homeDirectory, '.codex'), GIT_CONFIG_GLOBAL: join(homeDirectory, '.gitconfig'), CDE_INSTALL_PSTACK: '0', CDE_INSTALL_DEEPSTACK: '0', CDE_INSTALL_USAGE_WRAPUP: '0', CDE_INSTALL_SUBAGENT_MODELS: '0', CDE_INSTALL_DEEPEN_FIRST_PROMPT: '0' },
+                env: { ...process.env, CLAUDE_CONFIG_DIR: undefined, LLM_SETTINGS_PROFILES_ROOT: undefined, HOME: homeDirectory, USERPROFILE: homeDirectory, CODEX_HOME: join(homeDirectory, '.codex'), GIT_CONFIG_GLOBAL: join(homeDirectory, '.gitconfig'), CDE_INSTALL_PSTACK: '0', CDE_INSTALL_DEEPSTACK: '0', CDE_INSTALL_USAGE_WRAPUP: '0', CDE_INSTALL_SUBAGENT_MODELS: '0', CDE_INSTALL_SECURITY_GUIDANCE: '0', CDE_INSTALL_DEEPEN_FIRST_PROMPT: '0' },
             });
             const installed = join(homeDirectory, ...SKILL_PATH_SEGMENTS);
             for (const eachFile of REQUIRED_FILES) assert.deepEqual(readFileSync(join(installed, eachFile)), readFileSync(join(packaged, ...SKILL_PATH_SEGMENTS, eachFile)));

package/bin/install.prune.test.mjs

@@ -266,6 +266,7 @@ function resolveInstallerInvocation(homeDirectory) {
         CDE_INSTALL_DEEPSTACK: '0',
         CDE_INSTALL_USAGE_WRAPUP: '0',
         CDE_INSTALL_SUBAGENT_MODELS: '0',
+        CDE_INSTALL_SECURITY_GUIDANCE: '0',
         HOME: homeDirectory,
         USERPROFILE: homeDirectory,
         GIT_CONFIG_GLOBAL: join(homeDirectory, '.gitconfig'),

package/bin/install.question-presentation.test.mjs

@@ -28,6 +28,7 @@ function installInScratchHome(homeDirectory, argumentsList = [], extraEnvironmen
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
             HOME: homeDirectory,
             USERPROFILE: homeDirectory,
             CODEX_HOME: join(homeDirectory, '.codex'),
@@ -185,6 +186,7 @@ test('a successful pstack install omits the retired skill block and gains the qu
         CDE_INSTALL_DEEPSTACK: '0',
         CDE_INSTALL_USAGE_WRAPUP: '0',
         CDE_INSTALL_SUBAGENT_MODELS: '0',
+        CDE_INSTALL_SECURITY_GUIDANCE: '0',
         CDE_CODEX_EXECUTABLE: commandPath,
         CDE_CLAUDE_EXECUTABLE: commandPath,
     });
@@ -214,6 +216,7 @@ test('enabling pstack after a pstack-off install preserves question guidance', (
         CDE_INSTALL_DEEPSTACK: '0',
         CDE_INSTALL_USAGE_WRAPUP: '0',
         CDE_INSTALL_SUBAGENT_MODELS: '0',
+        CDE_INSTALL_SECURITY_GUIDANCE: '0',
         CDE_CODEX_EXECUTABLE: commandPath,
         CDE_CLAUDE_EXECUTABLE: commandPath,
     });
@@ -244,6 +247,7 @@ test('a failed pstack transition restores question-only guidance and removes its
         CDE_INSTALL_DEEPSTACK: '0',
         CDE_INSTALL_USAGE_WRAPUP: '0',
         CDE_INSTALL_SUBAGENT_MODELS: '0',
+        CDE_INSTALL_SECURITY_GUIDANCE: '0',
         CDE_CODEX_EXECUTABLE: commandPath,
         CDE_CLAUDE_EXECUTABLE: commandPath,
         CLAUDE_DEV_ENV_INSTALL_FAULT: 'after_file_staging',

package/bin/install.settings-defaults.test.mjs

@@ -74,6 +74,7 @@ function runInstallerInSandbox(sandboxHome, installerArguments = []) {
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
             HOME: sandboxHome,
             USERPROFILE: sandboxHome,
             GIT_CONFIG_GLOBAL: gitConfigGlobal,

package/bin/install.shared-settings.test.mjs

@@ -34,6 +34,7 @@ function installEnvironment(homeDirectory) {
         CDE_INSTALL_DEEPSTACK: '0',
         CDE_INSTALL_USAGE_WRAPUP: '0',
         CDE_INSTALL_SUBAGENT_MODELS: '0',
+        CDE_INSTALL_SECURITY_GUIDANCE: '0',
     };
 }
 

package/bin/install.test.mjs

@@ -3050,6 +3050,7 @@ test('a failed update preserves an existing skills lookup pointer', () => {
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
         };
         const argumentsForCoreInstall = [PSTACK_TEST_INSTALLER_PATH, '--only', 'core'];
         const firstRun = spawnSync(process.execPath, argumentsForCoreInstall, {
@@ -3104,6 +3105,7 @@ function runPstackInstaller(homeDirectory, extraArguments, environmentOverrides
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
             ...environmentOverrides,
         },
     });
@@ -3529,6 +3531,54 @@ for (const [caseName, extraArguments, environmentOverrides] of [
     });
 }
 
+test('should install security-guidance from the official marketplace on a full install', t => {
+    const sandbox = pstackPluginSandbox(t);
+
+    const installerOutput = runPstackInstaller(sandbox.homeDirectory, ['--no-pstack'], {
+        ...sandbox.environment,
+        CDE_INSTALL_SECURITY_GUIDANCE: '1',
+    });
+
+    assert.deepEqual(sandbox.recordedCommands(), [
+        'claude plugin marketplace add anthropics/claude-plugins-official',
+        'claude plugin marketplace update claude-plugins-official',
+        'claude plugin install security-guidance@claude-plugins-official',
+        'claude plugin update security-guidance@claude-plugins-official',
+    ]);
+    assert.match(installerOutput, /Security-guidance \(claude\): installed/);
+});
+
+for (const [caseName, extraArguments, environmentOverrides] of [
+    ['--no-security-guidance', ['--no-security-guidance'], { CDE_INSTALL_SECURITY_GUIDANCE: '1' }],
+    ['CDE_INSTALL_SECURITY_GUIDANCE=0', [], { CDE_INSTALL_SECURITY_GUIDANCE: '0' }],
+    ['an --only run', ['--only', 'core'], { CDE_INSTALL_SECURITY_GUIDANCE: '1' }],
+]) {
+    test(`should skip security-guidance on ${caseName}`, t => {
+        const sandbox = pstackPluginSandbox(t);
+
+        const installerOutput = runPstackInstaller(sandbox.homeDirectory, extraArguments, {
+            ...sandbox.environment,
+            ...environmentOverrides,
+        });
+
+        assert.equal(
+            sandbox.recordedCommands().some(eachCommand => eachCommand.includes('security-guidance')),
+            false,
+        );
+        assert.doesNotMatch(installerOutput, /Security-guidance \(/);
+    });
+}
+
+test('should name the security-guidance opt-out in the help output', () => {
+    const helpRun = spawnSync(process.execPath, [PSTACK_TEST_INSTALLER_PATH, '--help'], {
+        encoding: 'utf8',
+        env: process.env,
+    });
+
+    assert.equal(helpRun.status, 0, helpRun.stderr);
+    assert.match(helpRun.stdout, /--no-security-guidance .*CDE_INSTALL_SECURITY_GUIDANCE=0/);
+});
+
 test('should name the subagent-models opt-out in the help output', () => {
     const helpRun = spawnSync(process.execPath, [PSTACK_TEST_INSTALLER_PATH, '--help'], {
         encoding: 'utf8',
@@ -3623,6 +3673,7 @@ function installWithGlobalPrefix(context, globalPrefix) {
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
             HOME: homeDirectory,
             USERPROFILE: homeDirectory,
             APPDATA: join(homeDirectory, 'AppData', 'Roaming'),
@@ -3679,6 +3730,7 @@ test('install adds the open-tasks Stop gate to every profile with its own settin
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
             HOME: homeDirectory,
             USERPROFILE: homeDirectory,
             CODEX_HOME: join(homeDirectory, '.codex'),
@@ -3721,6 +3773,7 @@ test('a profile settings.json that is not valid JSON is left alone and named und
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
             HOME: homeDirectory,
             USERPROFILE: homeDirectory,
             CODEX_HOME: join(homeDirectory, '.codex'),
@@ -3766,6 +3819,7 @@ test('uninstall stops before changing anything while a profile settings.json tha
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
             HOME: homeDirectory,
             USERPROFILE: homeDirectory,
             CODEX_HOME: join(homeDirectory, '.codex'),

package/bin/install.transaction.test.mjs

@@ -91,6 +91,7 @@ test('capture and restore recover settings, manifest, files, and hooksPath', ()
         CDE_INSTALL_DEEPSTACK: '0',
         CDE_INSTALL_USAGE_WRAPUP: '0',
         CDE_INSTALL_SUBAGENT_MODELS: '0',
+        CDE_INSTALL_SECURITY_GUIDANCE: '0',
         HOME: box.root,
         USERPROFILE: box.root,
         GIT_CONFIG_GLOBAL: gitConfigPath,
@@ -157,6 +158,7 @@ test('capture and restore recover an additional host settings file', () => {
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
             HOME: box.root,
             USERPROFILE: box.root,
             GIT_CONFIG_GLOBAL: gitConfigPath,
@@ -196,6 +198,7 @@ test('runWithInstallTransaction restores prior state on injected fault', () => {
         CDE_INSTALL_DEEPSTACK: '0',
         CDE_INSTALL_USAGE_WRAPUP: '0',
         CDE_INSTALL_SUBAGENT_MODELS: '0',
+        CDE_INSTALL_SECURITY_GUIDANCE: '0',
         HOME: box.root,
         USERPROFILE: box.root,
         GIT_CONFIG_GLOBAL: gitConfigPath,
@@ -254,6 +257,7 @@ test('runWithInstallTransaction commits and discards journal on success', () =>
             CDE_INSTALL_DEEPSTACK: '0',
             CDE_INSTALL_USAGE_WRAPUP: '0',
             CDE_INSTALL_SUBAGENT_MODELS: '0',
+            CDE_INSTALL_SECURITY_GUIDANCE: '0',
             HOME: box.root,
             USERPROFILE: box.root,
             GIT_CONFIG_GLOBAL: gitConfigPath,
@@ -301,6 +305,7 @@ function runInstaller(homeDirectory, extraArguments, options = {}) {
         CDE_INSTALL_DEEPSTACK: '0',
         CDE_INSTALL_USAGE_WRAPUP: '0',
         CDE_INSTALL_SUBAGENT_MODELS: '0',
+        CDE_INSTALL_SECURITY_GUIDANCE: '0',
         HOME: homeDirectory,
         USERPROFILE: homeDirectory,
         GIT_CONFIG_GLOBAL: join(homeDirectory, '.gitconfig'),
@@ -338,6 +343,7 @@ test('a later install fault removes newly seeded Codex pstack files', () => {
                 CDE_INSTALL_DEEPSTACK: '0',
                 CDE_INSTALL_USAGE_WRAPUP: '0',
                 CDE_INSTALL_SUBAGENT_MODELS: '0',
+                CDE_INSTALL_SECURITY_GUIDANCE: '0',
                 CDE_CODEX_EXECUTABLE: codexCommandPath,
             },
         });
@@ -485,6 +491,7 @@ test('installer fault after_git_config restores prior core.hooksPath', () => {
                 CDE_INSTALL_DEEPSTACK: '0',
                 CDE_INSTALL_USAGE_WRAPUP: '0',
                 CDE_INSTALL_SUBAGENT_MODELS: '0',
+                CDE_INSTALL_SECURITY_GUIDANCE: '0',
                 HOME: homeDirectory,
                 USERPROFILE: homeDirectory,
                 GIT_CONFIG_GLOBAL: gitConfigPath,
@@ -506,6 +513,7 @@ test('installer fault after_git_config restores prior core.hooksPath', () => {
                 CDE_INSTALL_DEEPSTACK: '0',
                 CDE_INSTALL_USAGE_WRAPUP: '0',
                 CDE_INSTALL_SUBAGENT_MODELS: '0',
+                CDE_INSTALL_SECURITY_GUIDANCE: '0',
                 HOME: homeDirectory,
                 USERPROFILE: homeDirectory,
                 GIT_CONFIG_GLOBAL: gitConfigPath,

package/bin/install.uninstall-transaction.test.mjs

@@ -77,6 +77,7 @@ function runInstaller(homeDirectory, extraArguments, options = {}) {
         CDE_INSTALL_DEEPSTACK: '0',
         CDE_INSTALL_USAGE_WRAPUP: '0',
         CDE_INSTALL_SUBAGENT_MODELS: '0',
+        CDE_INSTALL_SECURITY_GUIDANCE: '0',
         HOME: homeDirectory,
         USERPROFILE: homeDirectory,
         GIT_CONFIG_GLOBAL: join(homeDirectory, '.gitconfig'),
@@ -315,6 +316,7 @@ test('uninstall fault after_git_config restores prior core.hooksPath', () => {
                 CDE_INSTALL_DEEPSTACK: '0',
                 CDE_INSTALL_USAGE_WRAPUP: '0',
                 CDE_INSTALL_SUBAGENT_MODELS: '0',
+                CDE_INSTALL_SECURITY_GUIDANCE: '0',
                 HOME: homeDirectory,
                 USERPROFILE: homeDirectory,
                 GIT_CONFIG_GLOBAL: gitConfigPath,

package/bin/install.update-keeps-hooks.test.mjs

@@ -28,6 +28,7 @@ function installerEnvironment(homeDirectory) {
         CDE_INSTALL_DEEPSTACK: '0',
         CDE_INSTALL_USAGE_WRAPUP: '0',
         CDE_INSTALL_SUBAGENT_MODELS: '0',
+        CDE_INSTALL_SECURITY_GUIDANCE: '0',
         HOME: homeDirectory,
         USERPROFILE: homeDirectory,
         GIT_CONFIG_GLOBAL: join(homeDirectory, '.gitconfig'),

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.101.0",
+    "version": "8.102.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {