claude-dev-env 8.11.0 → 8.12.0

package/_shared/pr-loop/scripts/test_fix_pr_test_proof.py

@@ -1,7 +1,7 @@
 """Behavioral tests for the fix pull request test-proof check.
 
-Every case drives a git repository under ``tmp_path`` and a pytest subprocess,
-the same shape the CI job runs.
+Every case drives a git repository under ``tmp_path`` and a pytest or
+``node --test`` subprocess, the same shape the CI job runs.
 """
 
 from pathlib import Path
@@ -27,6 +27,18 @@ PROOF_TEST_TEXT = (
 ALWAYS_PASSING_TEST_TEXT = (
     "def test_nothing_in_particular() -> None:\n    assert True\n"
 )
+BUGGY_NODE_PRODUCTION_TEXT = "export function add(left, right) {\n    return left - right;\n}\n"
+FIXED_NODE_PRODUCTION_TEXT = "export function add(left, right) {\n    return left + right;\n}\n"
+NODE_PROOF_TEST_TEXT = (
+    "import { test } from 'node:test';\n"
+    "import { strict as assert } from 'node:assert';\n"
+    "import { add } from './calc.mjs';\n\n"
+    "test('add sums both operands', () => {\n    assert.equal(add(1, 2), 3);\n});\n"
+)
+NODE_ALWAYS_PASSING_TEST_TEXT = (
+    "import { test } from 'node:test';\n\n"
+    "test('nothing in particular', () => {});\n"
+)
 
 
 def _commit_files(repository_root: Path, all_file_texts: dict[str, str]) -> None:
@@ -48,6 +60,12 @@ def _repository_at_buggy_base(tmp_path: Path) -> tuple[Path, str]:
     return repository_root, _head_revision(repository_root)
 
 
+def _repository_at_buggy_node_base(tmp_path: Path) -> tuple[Path, str]:
+    repository_root = repository_with_root_pytest_config(tmp_path)
+    _commit_files(repository_root, {"bin/calc.mjs": BUGGY_NODE_PRODUCTION_TEXT})
+    return repository_root, _head_revision(repository_root)
+
+
 def _run_check(repository_root: Path, title: str, base_revision: str) -> int:
     return fix_pr_test_proof.main(
         [
@@ -82,7 +100,7 @@ def test_a_fix_with_no_changed_test_fails(
     _commit_files(repository_root, {"pkg/calc.py": FIXED_PRODUCTION_TEXT})
 
     assert _run_check(repository_root, "fix: sum operands", base_revision) == 1
-    assert "no Python test" in capsys.readouterr().err
+    assert "no Python or Node test" in capsys.readouterr().err
 
 
 def test_a_fix_whose_test_fails_on_base_and_passes_on_head_passes(
@@ -124,3 +142,45 @@ def test_a_fix_whose_changed_test_fails_on_head_fails(
 
     assert _run_check(repository_root, "fix: sum operands", base_revision) == 1
     assert "fails on the head" in capsys.readouterr().err
+
+
+def test_a_node_fix_whose_test_fails_on_base_and_passes_on_head_passes(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    repository_root, base_revision = _repository_at_buggy_node_base(tmp_path)
+    _commit_files(
+        repository_root,
+        {"bin/calc.mjs": FIXED_NODE_PRODUCTION_TEXT, "bin/calc.test.mjs": NODE_PROOF_TEST_TEXT},
+    )
+
+    assert _run_check(repository_root, "fix(bin): sum operands", base_revision) == 0
+    assert "fail on the base and pass on the head" in capsys.readouterr().out
+
+
+def test_a_node_fix_whose_changed_test_also_passes_on_base_fails(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    repository_root, base_revision = _repository_at_buggy_node_base(tmp_path)
+    _commit_files(
+        repository_root,
+        {
+            "bin/calc.mjs": FIXED_NODE_PRODUCTION_TEXT,
+            "bin/calc.test.mjs": NODE_ALWAYS_PASSING_TEST_TEXT,
+        },
+    )
+
+    assert _run_check(repository_root, "fix(bin): sum operands", base_revision) == 1
+    assert "passes on the base" in capsys.readouterr().err
+
+
+def test_a_node_fix_whose_changed_test_fails_on_head_fails(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    repository_root, base_revision = _repository_at_buggy_node_base(tmp_path)
+    _commit_files(
+        repository_root,
+        {"bin/calc.test.mjs": NODE_PROOF_TEST_TEXT, "bin/extra.mjs": "export const VALUE = 1;\n"},
+    )
+
+    assert _run_check(repository_root, "fix(bin): sum operands", base_revision) == 1
+    assert "fails on the head" in capsys.readouterr().err

package/bin/codex-skill-load-block.mjs

@@ -1,13 +1,29 @@
-import { lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { lstatSync, mkdirSync, readFileSync, readlinkSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
 
 export const SKILL_LOAD_BLOCK_START = '<!-- claude-dev-env skill load: start -->';
 export const SKILL_LOAD_BLOCK_END = '<!-- claude-dev-env skill load: end -->';
 export const SKILL_LOAD_INSTRUCTION = 'Load the pstack:poteto-mode skill before your first tool call or reply: '
     + 'open its SKILL.md from your skills list and follow it. This binds every Codex agent, '
     + 'including a helper started with spawn_agent, whatever its task message says.';
+export const PACKAGE_GUIDANCE_BLOCK_START = '<!-- claude-dev-env package guidance: start -->';
+export const PACKAGE_GUIDANCE_BLOCK_END = '<!-- claude-dev-env package guidance: end -->';
 
-const SKILL_LOAD_BLOCK = `${SKILL_LOAD_BLOCK_START}\n${SKILL_LOAD_INSTRUCTION}\n${SKILL_LOAD_BLOCK_END}\n`;
+const WINDOWS_LONG_PATH_PREFIX = '\\\\?\\';
+
+function managedBlock(blockStart, blockBody, blockEnd) {
+    const terminatedBody = blockBody.endsWith('\n') ? blockBody : `${blockBody}\n`;
+    return `${blockStart}\n${terminatedBody}${blockEnd}\n`;
+}
+
+function withBlockReplaced(guidanceText, blockStart, blockEnd, block) {
+    const startIndex = guidanceText.indexOf(blockStart);
+    const endIndex = startIndex === -1 ? -1 : guidanceText.indexOf(blockEnd, startIndex);
+    if (endIndex === -1) return null;
+    let afterBlockIndex = endIndex + blockEnd.length;
+    if (guidanceText[afterBlockIndex] === '\n') afterBlockIndex += 1;
+    return guidanceText.slice(0, startIndex) + block + guidanceText.slice(afterBlockIndex);
+}
 
 /**
  * Return the Codex guidance text with the package's skill-load block in it.
@@ -17,29 +33,61 @@ const SKILL_LOAD_BLOCK = `${SKILL_LOAD_BLOCK_START}\n${SKILL_LOAD_INSTRUCTION}\n
  * the text is replaced where it stands; otherwise the block goes first.
  */
 export function withSkillLoadBlock(guidanceText) {
-    const startIndex = guidanceText.indexOf(SKILL_LOAD_BLOCK_START);
-    const endIndex = startIndex === -1 ? -1 : guidanceText.indexOf(SKILL_LOAD_BLOCK_END, startIndex);
-    if (endIndex === -1) {
-        return guidanceText ? `${SKILL_LOAD_BLOCK}\n${guidanceText}` : SKILL_LOAD_BLOCK;
-    }
-    let afterBlockIndex = endIndex + SKILL_LOAD_BLOCK_END.length;
-    if (guidanceText[afterBlockIndex] === '\n') afterBlockIndex += 1;
-    return guidanceText.slice(0, startIndex) + SKILL_LOAD_BLOCK + guidanceText.slice(afterBlockIndex);
+    const block = managedBlock(SKILL_LOAD_BLOCK_START, SKILL_LOAD_INSTRUCTION, SKILL_LOAD_BLOCK_END);
+    const replacedText = withBlockReplaced(guidanceText, SKILL_LOAD_BLOCK_START, SKILL_LOAD_BLOCK_END, block);
+    if (replacedText !== null) return replacedText;
+    return guidanceText ? `${block}\n${guidanceText}` : block;
+}
+
+function withPackageGuidanceBlock(guidanceText, packageGuidanceText) {
+    const block = managedBlock(PACKAGE_GUIDANCE_BLOCK_START, packageGuidanceText, PACKAGE_GUIDANCE_BLOCK_END);
+    const replacedText = withBlockReplaced(
+        guidanceText,
+        PACKAGE_GUIDANCE_BLOCK_START,
+        PACKAGE_GUIDANCE_BLOCK_END,
+        block,
+    );
+    return replacedText ?? `${guidanceText}\n${block}`;
+}
+
+function comparablePath(filePath) {
+    const withoutPrefix = filePath.startsWith(WINDOWS_LONG_PATH_PREFIX)
+        ? filePath.slice(WINDOWS_LONG_PATH_PREFIX.length)
+        : filePath;
+    const resolvedPath = resolve(withoutPrefix);
+    return process.platform === 'win32' ? resolvedPath.toLowerCase() : resolvedPath;
+}
+
+function linksToPackageGuidance(agentsPath, allPackageGuidancePaths) {
+    const linkTarget = comparablePath(resolve(dirname(agentsPath), readlinkSync(agentsPath)));
+    return allPackageGuidancePaths.some(eachPath => comparablePath(eachPath) === linkTarget);
 }
 
 /**
- * Write the skill-load block into CODEX_HOME/AGENTS.md.
+ * Keep CODEX_HOME/AGENTS.md carrying the skill-load block.
+ *
+ * A symbolic link that points at the package guidance (the shared agents-home
+ * copy, or the retired copy under the Claude home) is replaced by a regular
+ * file holding the skill-load block and a package-guidance block, so Codex
+ * keeps both after the package moves its guidance. A file that already holds
+ * the package-guidance block gets the current guidance text. A link to any
+ * other file is left alone.
  *
- * Returns the file path when the file changed, and null when it already held
- * the current block.
+ * Returns the file path when the file changed, and null otherwise.
  */
-export function writeCodexSkillLoadBlock(codexHome) {
+export function writeCodexAgentsGuidance(codexHome, packageGuidanceText, allPackageGuidancePaths) {
     const agentsPath = join(codexHome, 'AGENTS.md');
-    const hasGuidance = lstatSync(agentsPath, { throwIfNoEntry: false }) !== undefined;
-    const currentText = hasGuidance ? readFileSync(agentsPath, 'utf8') : '';
-    const updatedText = withSkillLoadBlock(currentText);
-    if (updatedText === currentText) return null;
+    const agentsEntry = lstatSync(agentsPath, { throwIfNoEntry: false });
+    const isPackageGuidanceLink = agentsEntry?.isSymbolicLink() ?? false;
+    if (isPackageGuidanceLink && !linksToPackageGuidance(agentsPath, allPackageGuidancePaths)) return null;
+    const currentText = agentsEntry && !isPackageGuidanceLink ? readFileSync(agentsPath, 'utf8') : '';
+    let updatedText = withSkillLoadBlock(currentText);
+    if (isPackageGuidanceLink || updatedText.includes(PACKAGE_GUIDANCE_BLOCK_START)) {
+        updatedText = withPackageGuidanceBlock(updatedText, packageGuidanceText);
+    }
+    if (!isPackageGuidanceLink && updatedText === currentText) return null;
     mkdirSync(codexHome, { recursive: true });
+    if (isPackageGuidanceLink) unlinkSync(agentsPath);
     writeFileSync(agentsPath, updatedText, 'utf8');
     return agentsPath;
 }

package/bin/codex-skill-load-block.test.mjs

@@ -1,22 +1,43 @@
 import { test } from 'node:test';
 import { strict as assert } from 'node:assert';
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { lstatSync, mkdtempSync, mkdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
+    PACKAGE_GUIDANCE_BLOCK_END,
+    PACKAGE_GUIDANCE_BLOCK_START,
     SKILL_LOAD_BLOCK_END,
     SKILL_LOAD_BLOCK_START,
     SKILL_LOAD_INSTRUCTION,
     withSkillLoadBlock,
-    writeCodexSkillLoadBlock,
+    writeCodexAgentsGuidance,
 } from './codex-skill-load-block.mjs';
 
 const EXPECTED_BLOCK = `${SKILL_LOAD_BLOCK_START}\n${SKILL_LOAD_INSTRUCTION}\n${SKILL_LOAD_BLOCK_END}\n`;
+const PACKAGE_GUIDANCE = 'Status\n\nChanged / proof / blocked.\n';
 
-function makeCodexHome(context) {
+function guidanceBlock(guidanceText) {
+    return `${PACKAGE_GUIDANCE_BLOCK_START}\n${guidanceText}${PACKAGE_GUIDANCE_BLOCK_END}\n`;
+}
+
+function makeHomes(context) {
     const root = mkdtempSync(join(tmpdir(), 'cde-skill-load-'));
     context.after(() => rmSync(root, { recursive: true, force: true }));
-    return join(root, '.codex');
+    const codexHome = join(root, '.codex');
+    const retiredGuidancePath = join(root, '.claude', 'AGENTS.md');
+    const sharedGuidancePath = join(root, '.agents', 'AGENTS.md');
+    return {
+        root,
+        codexHome,
+        agentsPath: join(codexHome, 'AGENTS.md'),
+        retiredGuidancePath,
+        sharedGuidancePath,
+        allPackageGuidancePaths: [retiredGuidancePath, sharedGuidancePath],
+    };
+}
+
+function writeGuidance(homes) {
+    return writeCodexAgentsGuidance(homes.codexHome, PACKAGE_GUIDANCE, homes.allPackageGuidancePaths);
 }
 
 test('the instruction names the skill and binds spawned helpers', () => {
@@ -24,37 +45,37 @@ test('the instruction names the skill and binds spawned helpers', () => {
     assert.match(SKILL_LOAD_INSTRUCTION, /spawn_agent/);
 });
 
-test('a missing Codex guidance file is created holding only the block', (context) => {
-    const codexHome = makeCodexHome(context);
+test('a missing Codex guidance file is created holding only the skill-load block', (context) => {
+    const homes = makeHomes(context);
 
-    const writtenPath = writeCodexSkillLoadBlock(codexHome);
+    const writtenPath = writeGuidance(homes);
 
-    assert.equal(writtenPath, join(codexHome, 'AGENTS.md'));
-    assert.equal(readFileSync(writtenPath, 'utf8'), EXPECTED_BLOCK);
+    assert.equal(writtenPath, homes.agentsPath);
+    assert.equal(readFileSync(homes.agentsPath, 'utf8'), EXPECTED_BLOCK);
 });
 
-test('existing guidance keeps every line and gains the block first', (context) => {
-    const codexHome = makeCodexHome(context);
-    mkdirSync(codexHome);
-    writeFileSync(join(codexHome, 'AGENTS.md'), '# pstack model configuration\n\nbug-fix: gpt-6-astra\n');
+test('existing guidance keeps every line and gains the skill-load block first', (context) => {
+    const homes = makeHomes(context);
+    mkdirSync(homes.codexHome);
+    writeFileSync(homes.agentsPath, '# pstack model configuration\n\nbug-fix: gpt-6-astra\n');
 
-    writeCodexSkillLoadBlock(codexHome);
+    writeGuidance(homes);
 
     assert.equal(
-        readFileSync(join(codexHome, 'AGENTS.md'), 'utf8'),
+        readFileSync(homes.agentsPath, 'utf8'),
         `${EXPECTED_BLOCK}\n# pstack model configuration\n\nbug-fix: gpt-6-astra\n`,
     );
 });
 
 test('a repeat install leaves the file unchanged and reports no write', (context) => {
-    const codexHome = makeCodexHome(context);
-    mkdirSync(codexHome);
-    writeFileSync(join(codexHome, 'AGENTS.md'), 'Custom agents\n');
-    writeCodexSkillLoadBlock(codexHome);
-    const afterFirstInstall = readFileSync(join(codexHome, 'AGENTS.md'), 'utf8');
-
-    assert.equal(writeCodexSkillLoadBlock(codexHome), null);
-    assert.equal(readFileSync(join(codexHome, 'AGENTS.md'), 'utf8'), afterFirstInstall);
+    const homes = makeHomes(context);
+    mkdirSync(homes.codexHome);
+    writeFileSync(homes.agentsPath, 'Custom agents\n');
+    writeGuidance(homes);
+    const afterFirstInstall = readFileSync(homes.agentsPath, 'utf8');
+
+    assert.equal(writeGuidance(homes), null);
+    assert.equal(readFileSync(homes.agentsPath, 'utf8'), afterFirstInstall);
 });
 
 test('an outdated block is replaced in place and the text around it is kept', () => {
@@ -66,7 +87,48 @@ test('an outdated block is replaced in place and the text around it is kept', ()
 test('a start marker with no end marker gets a fresh block and keeps the stray text', () => {
     const broken = `${SKILL_LOAD_BLOCK_START}\nHalf a block\n`;
 
-    const repaired = withSkillLoadBlock(broken);
+    assert.equal(withSkillLoadBlock(broken), `${EXPECTED_BLOCK}\n${broken}`);
+});
+
+for (const linkName of ['retiredGuidancePath', 'sharedGuidancePath']) {
+    test(`a link to package guidance at ${linkName} becomes a file with both blocks`, (context) => {
+        const homes = makeHomes(context);
+        mkdirSync(homes.codexHome);
+        symlinkSync(homes[linkName], homes.agentsPath);
+
+        const writtenPath = writeGuidance(homes);
+
+        assert.equal(writtenPath, homes.agentsPath);
+        assert.equal(lstatSync(homes.agentsPath).isSymbolicLink(), false);
+        assert.equal(
+            readFileSync(homes.agentsPath, 'utf8'),
+            `${EXPECTED_BLOCK}\n${guidanceBlock(PACKAGE_GUIDANCE)}`,
+        );
+    });
+}
+
+test('a converted file takes the new package guidance on the next install', (context) => {
+    const homes = makeHomes(context);
+    mkdirSync(homes.codexHome);
+    writeFileSync(homes.agentsPath, `${EXPECTED_BLOCK}\n${guidanceBlock('Old guidance\n')}`);
+
+    writeGuidance(homes);
+
+    assert.equal(
+        readFileSync(homes.agentsPath, 'utf8'),
+        `${EXPECTED_BLOCK}\n${guidanceBlock(PACKAGE_GUIDANCE)}`,
+    );
+});
 
-    assert.equal(repaired, `${EXPECTED_BLOCK}\n${broken}`);
+test('a link to a file the package does not own is left alone', (context) => {
+    const homes = makeHomes(context);
+    mkdirSync(homes.codexHome);
+    const ownGuidancePath = join(homes.root, 'notes', 'codex.md');
+    mkdirSync(join(homes.root, 'notes'));
+    writeFileSync(ownGuidancePath, 'My own Codex notes\n');
+    symlinkSync(ownGuidancePath, homes.agentsPath);
+
+    assert.equal(writeGuidance(homes), null);
+    assert.equal(lstatSync(homes.agentsPath).isSymbolicLink(), true);
+    assert.equal(readFileSync(ownGuidancePath, 'utf8'), 'My own Codex notes\n');
 });

package/bin/install.agents-home.test.mjs

@@ -39,7 +39,7 @@ const REFERENCE_DIRECTORY_NAME = 'reference';
 const SHIPPED_AGENT_FILE_NAME = 'AGENTS.md';
 const RETIRED_AGENT_FILE_NAMES = ['clean-coder.md', 'code-quality-agent.md', 'pr-description-writer.md'];
 const PERSONAL_SKILL_NAME = 'my-notes';
-const PREFLIGHT_PROPOSAL_FILE_NAME = 'preflight-proposal.md';
+const REVIEW_PROCEDURE_FILE_NAME = 'high.md';
 
 /**
  * @param {string} homeDirectory
@@ -70,22 +70,22 @@ function runInstaller(homeDirectory, extraArguments, environmentOverrides = {})
 /**
  * @param {{ skillsInstallDirectory: string }} installationPaths
  */
-function assertProposalContractInstallation(installationPaths) {
+function assertReviewProcedureInstallation(installationPaths) {
     const { skillsInstallDirectory } = installationPaths;
-    const allContractPathSegments = [
+    const allProcedurePathSegments = [
         E_CODE_REVIEW_SKILL_NAME,
         REFERENCE_DIRECTORY_NAME,
-        PREFLIGHT_PROPOSAL_FILE_NAME,
+        REVIEW_PROCEDURE_FILE_NAME,
     ];
-    const installedContractPath = join(skillsInstallDirectory, ...allContractPathSegments);
+    const installedProcedurePath = join(skillsInstallDirectory, ...allProcedurePathSegments);
     const sourceSkillsDirectory = resolvePackageManagedDirectory(
         PACKAGE_DIRECTORY,
         MANAGED_SKILLS_DIRECTORY_NAME,
     );
-    const sourceContractPath = join(sourceSkillsDirectory, ...allContractPathSegments);
+    const sourceProcedurePath = join(sourceSkillsDirectory, ...allProcedurePathSegments);
 
-    assert.equal(existsSync(installedContractPath), true);
-    assert.equal(readFileSync(installedContractPath, 'utf8'), readFileSync(sourceContractPath, 'utf8'));
+    assert.equal(existsSync(installedProcedurePath), true);
+    assert.equal(readFileSync(installedProcedurePath, 'utf8'), readFileSync(sourceProcedurePath, 'utf8'));
 }
 
 
@@ -179,7 +179,7 @@ test('a full install writes skills and agents under .agents and points .claude a
         );
         assert.equal(realpathSync(lookupSkillFile), realpathSync(canonicalSkillFile));
         assert.equal(realpathSync(lookupEli5SkillFile), realpathSync(canonicalEli5SkillFile));
-        assertProposalContractInstallation({ skillsInstallDirectory });
+        assertReviewProcedureInstallation({ skillsInstallDirectory });
         const projectedAdvisorPaths = [
             join(skillsInstallDirectory, TEAM_ADVISOR_SKILL_NAME, 'SKILL.md'),
             join(claudeHome, 'docs', 'references', 'advisor-tool.md'),

package/bin/install.mjs

@@ -45,7 +45,7 @@ import {
     shouldInstallPstackPlugin,
 } from './install-pstack-plugin.mjs';
 import { seedCodexPstackModels } from './seed-codex-pstack-models.mjs';
-import { writeCodexSkillLoadBlock } from './codex-skill-load-block.mjs';
+import { writeCodexAgentsGuidance } from './codex-skill-load-block.mjs';
 import {
     continuityHostConfigurationPaths,
     removeContinuityHooks,
@@ -2788,8 +2788,10 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
                     allUserOwnedPreferencePaths.add(eachPath);
                 }
             }
-            const skillLoadGuidancePath = writeCodexSkillLoadBlock(
+            const skillLoadGuidancePath = writeCodexAgentsGuidance(
                 INSTALL_ROOT_RESOLUTION.codexHomeDirectory,
+                readFileSync(join(PACKAGE_ROOT, 'AGENTS.md'), 'utf8'),
+                [join(CLAUDE_HOME, 'AGENTS.md'), join(AGENTS_HOME, 'AGENTS.md')],
             );
             if (skillLoadGuidancePath) {
                 console.log(`  \u2713 ${skillLoadGuidancePath} (Codex skill-load line)`);

package/bin/install.test.mjs

@@ -11,6 +11,7 @@ import {
     readdirSync,
     existsSync,
     copyFileSync,
+    lstatSync,
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
@@ -3099,6 +3100,25 @@ test('a repeat install preserves Codex pstack configuration', t => {
     assert.equal(readFileSync(join(codexHome, 'pstack-models.md'), 'utf8'), 'session hook: off\n');
 });
 
+test('a Codex guidance link to the retired Claude copy becomes a file Codex can read', t => {
+    const sandbox = pstackPluginSandbox(t);
+    const codexHome = join(sandbox.homeDirectory, '.codex');
+    const codexAgentsPath = join(codexHome, 'AGENTS.md');
+    mkdirSync(codexHome, { recursive: true });
+    symlinkSync(join(sandbox.homeDirectory, '.claude', 'AGENTS.md'), codexAgentsPath);
+
+    runPstackInstaller(sandbox.homeDirectory, [], sandbox.environment);
+
+    const packageGuidance = readFileSync(
+        join(dirname(fileURLToPath(import.meta.url)), '..', 'AGENTS.md'),
+        'utf8',
+    );
+    assert.equal(lstatSync(codexAgentsPath).isSymbolicLink(), false);
+    const codexGuidance = readFileSync(codexAgentsPath, 'utf8');
+    assert.ok(codexGuidance.startsWith(`${SKILL_LOAD_BLOCK_START}\n${SKILL_LOAD_INSTRUCTION}\n`));
+    assert.ok(codexGuidance.includes(packageGuidance));
+});
+
 test('an absent host command is reported and leaves the other host installed', t => {
     const sandbox = pstackPluginSandbox(t);
 

package/commands/sr-loop.md

@@ -54,7 +54,9 @@ stack's design, intent, and changes.
 ## Phase B — loop /code-review low --fix
 
 1. Invoke the `code-review` skill with arguments `low --fix` on the same
-   target. Let it report findings and apply its fixes.
+   target. Let it report findings and apply its fixes. When the host has no
+   `code-review` skill, invoke the `e-code-review` skill with `low --fix`
+   instead. It runs the same review and fix steps.
 2. After any pass that changed files: test, commit, push as in Phase A.
 3. Repeat until a pass reports zero findings, or until a pass reports only
    nits — then fix, test, commit, push, and stop with no confirming pass.

package/hooks/blocking/pii_prevention_blocker_parts/repository_exemption.py

@@ -64,7 +64,7 @@ def repository_allowlisted_values(repository_root: Path) -> frozenset[str]:
         The exact literal values the repository's commits and writes may carry
         past the PII scan, or an empty set when the repository has none.
     """
-    origin_slug = _repository_origin_slug(repository_root)
+    origin_slug = repository_origin_slug(repository_root)
     if origin_slug is None:
         return frozenset()
     return pii_allowlisted_values_by_repository().get(origin_slug, frozenset())
@@ -171,7 +171,7 @@ def _owner_repo_slug_from_origin_url(origin_url: str) -> str | None:
     return _owner_repo_slug_from_path(repository_path)
 
 
-def _repository_origin_slug(repository_root: Path) -> str | None:
+def repository_origin_slug(repository_root: Path) -> str | None:
     """Return the lowercased owner/repo slug of the origin remote, or None.
 
     Args:
@@ -211,7 +211,7 @@ def _is_repository_exempt_from_pii_scan(repository_root: Path) -> bool:
     Returns:
         True when the repository's origin slug is in the exempt set.
     """
-    origin_slug = _repository_origin_slug(repository_root)
+    origin_slug = repository_origin_slug(repository_root)
     if origin_slug is None:
         return False
     return origin_slug in pii_exempt_repository_slugs()

package/hooks/blocking/tests/test_repository_exemption.py

@@ -19,6 +19,7 @@ from pii_prevention_blocker_parts.repository_exemption import (
     _is_repository_exempt_from_pii_scan,
     _owner_repo_slug_from_origin_url,
     repository_allowlisted_values,
+    repository_origin_slug,
 )
 
 _ALLOWED_VALUE = "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
@@ -103,3 +104,9 @@ def test_repository_without_origin_is_never_exempt(tmp_path: Path) -> None:
 
 def test_owner_repo_slug_strips_a_trailing_slash_origin() -> None:
     assert _owner_repo_slug_from_origin_url("https://github.com/Owner/Repo/") == "owner/repo"
+
+
+def test_repository_origin_slug_reads_the_origin_remote(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, "SlugOwner/slug-repo")
+    assert repository_origin_slug(repository_root) == "slugowner/slug-repo"

package/hooks/hooks_constants/code_rules_path_utils_constants.py

@@ -23,7 +23,6 @@ ALL_CONFIG_DIRECTORY_NAMES = frozenset(
         "usage_pause_constants",
         "prototype_scripts_constants",
         "codex_review_scripts_constants",
-        "e_code_review_scripts_constants",
         "dev_env_scripts_constants",
         "fresh_branch_scripts_constants",
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.11.0",
+    "version": "8.12.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/rules/build-needs-a-user.md

@@ -32,7 +32,7 @@ correction arrives a second time, per
 ## Where it is enforced
 
 The staged policy lint's `uncalled-new-file` rule reads each code file a change
-adds under `scripts/`, `hooks/`, or `bin/`. It reports the file when its name
+adds under `scripts/`, `hooks/`, `bin/`, `ci/`, or `tools/`. It reports the file when its name
 appears only in its own tests, `CHANGELOG.md`, `README.md`, and
 `bin/ever-shipped-skills.mjs`. CI runs that lint against the merge base, so a
 file with no caller turns the pull request red.

package/rules/testing.md

@@ -29,4 +29,4 @@ Red, green, refactor is the default loop for a bug fix and for new behavior. The
 
 ## A Fix Carries Its Proof Test
 
-The `Fix test proof` job in `.github/workflows/pr-check.yml` runs `_shared/pr-loop/scripts/fix_pr_test_proof.py` on every pull request whose title starts with `fix`. A fix that changes production code must change at least one Python test that fails on the base and passes on the head. A fix that changes only docs or CI config passes. Version one reads Python tests only, so a fix proven by a JavaScript or PowerShell test needs a Python test beside it.
+The `Fix test proof` job in `.github/workflows/pr-check.yml` runs `_shared/pr-loop/scripts/fix_pr_test_proof.py` on every pull request whose title starts with `fix`. A fix that changes production code must change at least one Python or Node test that fails on the base and passes on the head. Node tests are files ending in `.test.mjs`, `.test.js`, or `.test.cjs`, and the job runs them with `node --test`. A fix that changes only docs or CI config passes. A fix proven by a PowerShell test needs a Python or Node test beside it.

package/scripts/policy_lint/config/constants.py

@@ -179,7 +179,7 @@ UNCALLED_NEW_FILE_MESSAGE = (
     " workflow, skill, command or import in this change, or drop it."
 )
 ALL_CALLED_CODE_SUFFIXES = frozenset({".py", ".mjs", ".js", ".sh", ".ps1"})
-ALL_CALLED_CODE_SEGMENTS = ("/scripts/", "/hooks/", "/bin/")
+ALL_CALLED_CODE_SEGMENTS = ("/scripts/", "/hooks/", "/bin/", "/ci/", "/tools/")
 ALL_CALLER_SEARCH_SKIPPED_DIRECTORIES = frozenset(
     {".git", "node_modules", "__pycache__", ".venv"}
 )

package/scripts/repository_checks/tracked_private_terms.py

@@ -13,6 +13,7 @@ from policy_lint.config import constants as policy_constants
 from private_terms import private_term_line_numbers
 
 from repository_checks.config import constants as repository_constants
+from repository_checks.hook_modules import load_hooks_module
 from repository_checks.models import RepositoryFinding
 
 
@@ -25,6 +26,15 @@ def _read_text_or_none(absolute_path: Path) -> str | None:
         return None
 
 
+def _is_owned_by_private_organization(repository_root: Path) -> bool:
+    exemption = load_hooks_module(repository_constants.REPOSITORY_EXEMPTION_MODULE_NAME)
+    origin_slug = exemption.repository_origin_slug(repository_root)
+    if origin_slug is None:
+        return False
+    owner_name = origin_slug.split(policy_constants.PATH_SEPARATOR)[0]
+    return bool(private_term_line_numbers(owner_name, ALL_PRIVATE_TERM_DIGESTS))
+
+
 def collect_tracked_private_term_findings(
     repository_root: Path, all_tracked_paths: Sequence[str]
 ) -> list[RepositoryFinding]:
@@ -35,8 +45,12 @@ def collect_tracked_private_term_findings(
         all_tracked_paths: Repository-relative tracked paths.
 
     Returns:
-        Findings that carry the path and line number, never the name.
+        Findings that carry the path and line number, never the name. A
+        repository whose github.com origin owner is itself a private
+        organization returns none, since that organization may name itself.
     """
+    if _is_owned_by_private_organization(repository_root):
+        return []
     all_findings: list[RepositoryFinding] = []
     for each_relative_path in all_tracked_paths:
         if (content := _read_text_or_none(repository_root / each_relative_path)) is None:

package/scripts/tests/test_policy_lint_rules_callers.py

@@ -124,3 +124,17 @@ def test_should_run_on_staged_and_base_selections() -> None:
     assert uncalled_rule.selections == frozenset(
         {SelectionKind.STAGED, SelectionKind.BASE}
     )
+
+
+def test_should_report_new_ci_and_tools_helpers_only_tests_name(
+    tmp_path: Path,
+) -> None:
+    ci_helper = ".github/ci/lonely_router.py"
+    tools_helper = "tools/lonely_archiver.py"
+    _write(tmp_path, ci_helper, "print('hi')\n")
+    _write(tmp_path, tools_helper, "print('hi')\n")
+    _write(tmp_path, ".github/ci/test_lonely_router.py", "import lonely_router\n")
+
+    all_messages = _messages(tmp_path, (_added(ci_helper), _added(tools_helper)))
+
+    assert len(all_messages) == 2