claude-dev-env 8.4.2 → 8.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.4.2",
+    "version": "8.4.3",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/windows/pstack/pstack-command-shim.ps1

@@ -32,8 +32,15 @@ $scriptsRoot = Split-Path -Parent (Split-Path -Parent $entrypoint)
 $exitCode = 1
 Push-Location $scriptsRoot
 try {
-  & bun $entrypoint @commandArguments
-  $exitCode = $LASTEXITCODE
+  & bun -e 'import { ensureDependenciesInstalled } from "./bootstrap.ts"; ensureDependenciesInstalled();'
+  $bootstrapExitCode = $LASTEXITCODE
+  if ($bootstrapExitCode -ne 0) {
+    Write-Error "The pstack dependencies could not be installed"
+    $exitCode = $bootstrapExitCode
+  } else {
+    & bun $entrypoint @commandArguments
+    $exitCode = $LASTEXITCODE
+  }
 }
 finally {
   Pop-Location

package/scripts/audit-hooks-cli.mjs

@@ -1,59 +0,0 @@
-import { writeFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { auditHooks } from "./audit-hooks.mjs";
-
-function parseArguments(argv) {
-  const options = {
-    catalogPath: null,
-    format: "text",
-    homeDirectory: null,
-    includeInstalled: false,
-    outputPath: null,
-    requireNonblocking: false,
-    repositoryRoot: path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../.."),
-  };
-  for (let offset = 0; offset < argv.length; offset += 1) {
-    const argument = argv[offset];
-    if (argument === "--installed") options.includeInstalled = true;
-    else if (argument === "--catalog") options.catalogPath = argv[++offset];
-    else if (argument === "--format") options.format = argv[++offset];
-    else if (argument === "--home") options.homeDirectory = argv[++offset];
-    else if (argument === "--output") options.outputPath = argv[++offset];
-    else if (argument === "--require-nonblocking") options.requireNonblocking = true;
-    else if (argument === "--repository-root") options.repositoryRoot = argv[++offset];
-    else throw new Error(`unknown argument ${argument}`);
-  }
-  return options;
-}
-
-function renderText(report) {
-  const summary = report.summary;
-  return [
-    `canonical direct: ${summary.directCount}`,
-    `dispatchers: ${summary.dispatcherCount}`,
-    `hosted entries: ${summary.effectiveCount}`,
-    `logical associations: ${summary.logicalAssociationCount}`,
-    `unclassified targets: ${summary.unclassifiedCount}`,
-    `installed Claude direct: ${summary.claudeDirectCount}`,
-    `installed Codex direct: ${summary.codexDirectCount}`,
-    `active native Git hooks: ${summary.gitHookCount}`,
-    `known native Git hooks: ${summary.knownGitHookCount}`,
-    `registration eligibility: ${report.registrationEligibility.status}`,
-    "runtime proof: separate verification required",
-    `findings: ${summary.findingCount}`,
-  ].join("\n");
-}
-
-function main() {
-  const options = parseArguments(process.argv.slice(2));
-  const report = auditHooks(options);
-  const rendered =
-    options.format === "json" ? `${JSON.stringify(report, null, 2)}\n` : `${renderText(report)}\n`;
-  if (options.outputPath) writeFileSync(options.outputPath, rendered, "utf8");
-  else process.stdout.write(rendered);
-  process.exitCode = report.findings.some(({ severity }) => severity === "error") ? 1 : 0;
-}
-
-main();

package/scripts/audit-hooks.mjs

@@ -1,452 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import path from "node:path";
-
-import { KNOWN_GIT_HOOK_NAMES } from "../bin/git_hooks_installer.mjs";
-
-const dispatcherSpecs = Object.freeze([
-  ["script:blocking/pre_tool_use_dispatcher.py", "hooks_constants/pre_tool_use_dispatcher_constants.py", "ALL_HOSTED_HOOK_ENTRIES"],
-  ["script:blocking/bash_pre_tool_use_dispatcher.py", "hooks_constants/bash_pre_tool_use_dispatcher_constants.py", "ALL_BASH_HOSTED_HOOK_ENTRIES"],
-  ["script:validation/post_tool_use_dispatcher.py", "hooks_constants/post_tool_use_dispatcher_constants.py", "ALL_POST_HOSTED_HOOK_ENTRIES"],
-  ["script:blocking/bash_post_call_dispatcher.py", "hooks_constants/bash_post_call_dispatcher_constants.py", "ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES"],
-]);
-const lifecycleNames = new Set([
-  "delete",
-  "keep_boundary_check",
-  "keep_nonblocking_automation",
-  "move_to_ci",
-  "move_to_explicit_command",
-  "move_to_linter",
-]);
-const nonblockingLifecycle = "keep_nonblocking_automation";
-const blockingGitEvents = new Set(["pre-commit", "pre-push"]);
-
-function normalizeMatcher(rawMatcher) {
-  return typeof rawMatcher === "string" && rawMatcher
-    ? rawMatcher.split("|").sort().join("|")
-    : "*";
-}
-
-function targetFromCommand(command, scope, event, ordinal) {
-  const normalized = command.replaceAll("\\", "/");
-  const hookMarker = "/hooks/";
-  if (normalized.includes(hookMarker)) {
-    const relative = normalized.split(hookMarker).at(-1).split(/[\s"']/u, 1)[0];
-    if (relative.endsWith(".py")) return `script:${relative}`;
-  }
-  const importMatch = /\bfrom\s+([A-Za-z_][\w.]*)\s+import\s+main\b/u.exec(command);
-  if (importMatch) return `script:${importMatch[1].replaceAll(".", "/")}.py`;
-  const scriptMatches = [...normalized.matchAll(/(?:^|\s)["']?([^"'/\s]+\.(?:exe|js|mjs|ps1|py))\b/gu)];
-  if (scriptMatches.length) return `external:${scriptMatches.at(-1)[1]}`;
-  return `external:${scope}:${event}:${ordinal}`;
-}
-
-function readDirect(configPath, scope) {
-  const parsed = JSON.parse(readFileSync(configPath, "utf8"));
-  const records = [];
-  for (const [event, groups] of Object.entries(parsed.hooks ?? {})) {
-    for (const group of Array.isArray(groups) ? groups : []) {
-      appendGroupRecords(records, scope, event, group);
-    }
-  }
-  return records;
-}
-
-function appendGroupRecords(records, scope, event, group) {
-  const matcher = normalizeMatcher(group.matcher);
-  for (const hook of Array.isArray(group.hooks) ? group.hooks : []) {
-    if (hook?.type !== "command" || typeof hook.command !== "string") continue;
-    const ordinal = records.length;
-    const target = targetFromCommand(hook.command, scope, event, ordinal);
-    const isDispatcher = dispatcherSpecs.some(([knownTarget]) => knownTarget === target);
-    records.push({
-      event,
-      matcher,
-      ordinal,
-      role: isDispatcher ? "dispatcher" : "hook",
-      scope,
-      target,
-      timeoutSeconds: Number.isInteger(hook.timeout) ? hook.timeout : null,
-    });
-  }
-}
-
-function assignmentBody(source, rosterName) {
-  const rosterOffset = source.lastIndexOf(rosterName);
-  if (rosterOffset < 0) throw new Error(`missing roster ${rosterName}`);
-  const equalsOffset = source.indexOf("=", rosterOffset);
-  const openOffset = source.indexOf("(", equalsOffset);
-  if (equalsOffset < 0 || openOffset < 0) throw new Error(`invalid roster ${rosterName}`);
-  const closeOffset = matchingParenthesis(source, openOffset);
-  return source.slice(openOffset + 1, closeOffset);
-}
-
-function matchingParenthesis(source, openOffset) {
-  let depth = 0;
-  let quote = "";
-  for (let offset = openOffset; offset < source.length; offset += 1) {
-    const character = source[offset];
-    const previous = source[offset - 1];
-    if (quote && character === quote && previous !== "\\") quote = "";
-    else if (!quote && (character === '"' || character === "'")) quote = character;
-    else if (!quote && character === "(") depth += 1;
-    else if (!quote && character === ")") depth -= 1;
-    if (depth === 0) return offset;
-  }
-  throw new Error("unclosed roster");
-}
-
-function topLevelEntries(source) {
-  const entries = [];
-  let depth = 0;
-  let quote = "";
-  let start = 0;
-  for (let offset = 0; offset < source.length; offset += 1) {
-    const character = source[offset];
-    const previous = source[offset - 1];
-    if (quote && character === quote && previous !== "\\") quote = "";
-    else if (!quote && (character === '"' || character === "'")) quote = character;
-    else if (!quote && /[([{]/u.test(character)) depth += 1;
-    else if (!quote && /[\])}]/u.test(character)) depth -= 1;
-    else if (!quote && character === "," && depth === 0) {
-      entries.push(source.slice(start, offset));
-      start = offset + 1;
-    }
-  }
-  entries.push(source.slice(start));
-  return entries.filter((entry) => entry.trim());
-}
-
-function toolMatchers(source) {
-  const matchers = new Map();
-  for (const match of source.matchAll(/\b([A-Z][A-Z0-9_]*_TOOL_NAME)\s*=\s*["']([^"']+)["']/gu)) {
-    matchers.set(match[1], new Set([match[2]]));
-  }
-  const collections = [...source.matchAll(/\b([A-Z][A-Z0-9_]*_TOOL_NAMES)\s*(?::[^=]+)?=\s*frozenset\s*\(/gu)];
-  for (const collection of collections) {
-    const openOffset = source.indexOf("(", collection.index + collection[0].indexOf("frozenset"));
-    const body = source.slice(openOffset + 1, matchingParenthesis(source, openOffset));
-    const names = new Set();
-    for (const token of body.match(/\b[A-Z][A-Z0-9_]+\b/gu) ?? []) {
-      for (const toolName of matchers.get(token) ?? []) names.add(toolName);
-    }
-    matchers.set(collection[1], names);
-  }
-  return matchers;
-}
-
-function rosterEntries(hooksRoot, constantsPath, rosterName) {
-  const source = readFileSync(path.join(hooksRoot, constantsPath), "utf8");
-  const body = assignmentBody(source, rosterName);
-  const matchers = toolMatchers(source);
-  return topLevelEntries(body).map((expression) => {
-    const targetMatch = /["']([^"']+\.py)["']/u.exec(expression);
-    if (!targetMatch) throw new Error(`invalid roster entry ${rosterName}`);
-    const names = new Set();
-    for (const token of expression.match(/\b[A-Z][A-Z0-9_]+\b/gu) ?? []) {
-      for (const toolName of matchers.get(token) ?? []) names.add(toolName);
-    }
-    return {
-      matcher: names.size ? [...names].sort().join("|") : null,
-      target: `script:${targetMatch[1].replaceAll("\\", "/")}`,
-    };
-  });
-}
-
-function expandHosted(directRecords, hooksRoot) {
-  const parents = new Map(
-    directRecords.filter(({ role }) => role === "dispatcher").map((record) => [record.target, record]),
-  );
-  const hosted = [];
-  for (const [dispatcherTarget, constantsPath, rosterName] of dispatcherSpecs) {
-    const parent = parents.get(dispatcherTarget);
-    if (!parent) continue;
-    const entries = rosterEntries(hooksRoot, constantsPath, rosterName);
-    for (const entry of entries) {
-      hosted.push({
-        event: parent.event,
-        matcher: entry.matcher ?? parent.matcher,
-        ordinal: hosted.length,
-        parentTarget: parent.target,
-        role: "hosted",
-        scope: parent.scope,
-        target: entry.target,
-        timeoutSeconds: parent.timeoutSeconds,
-      });
-    }
-  }
-  return hosted;
-}
-
-function logicalRecords(directRecords, hostedRecords) {
-  return [...directRecords.filter(({ role }) => role !== "dispatcher"), ...hostedRecords].sort(recordSort);
-}
-
-function recordSort(left, right) {
-  const leftKey = [left.scope, left.event, left.matcher, left.target, left.role, left.ordinal].join("\0");
-  const rightKey = [right.scope, right.event, right.matcher, right.target, right.role, right.ordinal].join("\0");
-  return leftKey.localeCompare(rightKey);
-}
-
-function duplicateFindings(records, scope) {
-  const counts = new Map();
-  for (const record of records) {
-    const key = [record.event, record.matcher, record.target].join("\0");
-    counts.set(key, (counts.get(key) ?? 0) + 1);
-  }
-  return [...counts.entries()]
-    .filter(([, count]) => count > 1)
-    .map(([key, count]) => ({
-      code: "DUPLICATE_EFFECTIVE_EXECUTION",
-      message: `The same event, matcher, and target run ${count} times.`,
-      scope,
-      severity: "error",
-      target: key.split("\0").at(-1),
-    }));
-}
-
-function missingTargetFindings(records, hooksRoot, scope) {
-  return records
-    .filter(({ target }) => target.startsWith("script:"))
-    .filter(({ target }) => !existsSync(path.join(hooksRoot, target.slice("script:".length))))
-    .map(({ target }) => ({
-      code: "MISSING_HOOK_TARGET",
-      message: "The registered script is missing from the installed hook tree.",
-      scope,
-      severity: "error",
-      target,
-    }));
-}
-
-function missingManagedFindings(expectedRecords, installedRecords, scope) {
-  const installedIdentities = new Set(installedRecords.map(recordIdentity));
-  return expectedRecords
-    .filter((record) => !installedIdentities.has(recordIdentity(record)))
-    .map(({ target }) => ({
-      code: "MISSING_MANAGED_REGISTRATION",
-      message: "The installed configuration is missing a canonical registration.",
-      scope,
-      severity: "error",
-      target,
-    }));
-}
-
-function recordIdentity({ event, matcher, target }) {
-  return [event, matcher, target].join("\0");
-}
-
-function readLifecycle(catalogPath) {
-  if (!catalogPath) return [];
-  const parsed = JSON.parse(readFileSync(catalogPath, "utf8"));
-  return Object.entries(parsed.hooks ?? {}).map(([target, decision]) => {
-    const safeTarget = /^(?:external:[A-Za-z0-9_.:-]+|git:(?:post-commit|pre-commit|pre-push)|script:[A-Za-z0-9_./-]+)$/u;
-    if (!safeTarget.test(target) || !lifecycleNames.has(decision?.lifecycle) || !decision.reason) {
-      throw new Error("invalid lifecycle entry");
-    }
-    return { lifecycle: decision.lifecycle, target };
-  });
-}
-
-function lifecycleFindings(records, lifecycle) {
-  const targets = new Set(records.map(({ target }) => target));
-  const classified = new Set(lifecycle.map(({ target }) => target));
-  const missing = [...targets].filter((target) => !classified.has(target));
-  const stale = [...classified].filter((target) => !targets.has(target));
-  return [
-    ...missing.map((target) => ({
-      code: "UNCLASSIFIED_HOOK",
-      message: "The effective hook has no lifecycle decision.",
-      scope: "catalog",
-      severity: "error",
-      target,
-    })),
-    ...stale.map((target) => ({
-      code: "STALE_LIFECYCLE_ENTRY",
-      message: "The lifecycle target is absent from the canonical graph.",
-      scope: "catalog",
-      severity: "warning",
-      target,
-    })),
-  ];
-}
-
-function nonblockingFindings(records, lifecycle) {
-  const lifecycleByTarget = new Map(
-    lifecycle.map(({ target, lifecycle: lifecycleName }) => [target, lifecycleName]),
-  );
-  const uniqueTargets = [...new Set(records.map(({ target }) => target))];
-  const lifecycleMismatches = uniqueTargets
-    .filter((target) => !target.startsWith("git:") && lifecycleByTarget.has(target))
-    .filter((target) => lifecycleByTarget.get(target) !== nonblockingLifecycle)
-    .map((target) => ({
-      code: "NONBLOCKING_LIFECYCLE_MISMATCH",
-      message: "The registration is not eligible for nonblocking automation.",
-      scope: "catalog",
-      severity: "error",
-      target,
-    }));
-  const blockingGitFindings = records
-    .filter(({ event, scope }) => scope === "git" && blockingGitEvents.has(event))
-    .map(({ target }) => ({
-      code: "NATIVE_GIT_BLOCKING_HOOK",
-      message: "A native Git blocking hook remains active.",
-      scope: "git",
-      severity: "error",
-      target,
-    }));
-  return [...lifecycleMismatches, ...blockingGitFindings];
-}
-
-function registrationEligibility(records, lifecycle, isRequired) {
-  if (!isRequired) {
-    return { status: "not_checked", runtimeProof: "not_assessed" };
-  }
-  const lifecycleByTarget = new Map(
-    lifecycle.map(({ target, lifecycle: lifecycleName }) => [target, lifecycleName]),
-  );
-  const uniqueTargets = [...new Set(records.map(({ target }) => target))];
-  const hasUnclassifiedTarget = uniqueTargets.some((target) => !lifecycleByTarget.has(target));
-  const hasIneligibleTarget = uniqueTargets.some(
-    (target) => lifecycleByTarget.get(target) && lifecycleByTarget.get(target) !== nonblockingLifecycle,
-  );
-  const hasBlockingGitHook = records.some(
-    ({ event, scope }) => scope === "git" && blockingGitEvents.has(event),
-  );
-  const isEligible = !hasUnclassifiedTarget && !hasIneligibleTarget && !hasBlockingGitHook;
-  return {
-    status: isEligible ? "eligible" : "ineligible",
-    runtimeProof: "not_assessed",
-  };
-}
-
-function readInstalled(configPath, hooksRoot, scope) {
-  if (!existsSync(configPath)) return { findings: [], logical: [], records: [] };
-  const records = readDirect(configPath, scope);
-  const hosted = expandHosted(records, hooksRoot);
-  const logical = logicalRecords(records, hosted);
-  return {
-    findings: [
-      ...duplicateFindings(logical, scope),
-      ...missingTargetFindings([...records, ...hosted], hooksRoot, scope),
-    ],
-    logical,
-    records,
-  };
-}
-
-function activeGitHooks(repositoryRoot) {
-  const gitQuery = spawnSync("git", ["rev-parse", "--git-path", "hooks"], {
-    cwd: repositoryRoot,
-    encoding: "utf8",
-    shell: false,
-    timeout: 10_000,
-  });
-  if (gitQuery.status !== 0) return [];
-  const hooksPath = gitQuery.stdout?.trim();
-  if (!hooksPath) return [];
-  const hooksRoot = path.isAbsolute(hooksPath) ? hooksPath : path.resolve(repositoryRoot, hooksPath);
-  return KNOWN_GIT_HOOK_NAMES
-    .filter((name) => existsSync(path.join(hooksRoot, name)))
-    .map((name, ordinal) => ({
-      event: name,
-      matcher: "*",
-      ordinal,
-      role: "native",
-      scope: "git",
-      target: `git:${name}`,
-      timeoutSeconds: null,
-    }));
-}
-
-function knownGitHooks() {
-  return KNOWN_GIT_HOOK_NAMES.map((event, ordinal) => ({
-    event,
-    matcher: "*",
-    ordinal,
-    role: "native",
-    scope: "git",
-    target: `git:${event}`,
-    timeoutSeconds: null,
-  }));
-}
-
-export function auditHooks(options) {
-  const repositoryRoot = path.resolve(options.repositoryRoot);
-  const hooksRoot = path.join(repositoryRoot, "packages", "claude-dev-env", "hooks");
-  const direct = readDirect(path.join(hooksRoot, "hooks.json"), "canonical");
-  const hosted = expandHosted(direct, hooksRoot);
-  const logical = logicalRecords(direct, hosted);
-  const knownGit = knownGitHooks();
-  const lifecycle = readLifecycle(options.catalogPath);
-  const dispatcherCount = direct.filter(({ role }) => role === "dispatcher").length;
-  const installed = options.includeInstalled
-    ? installedAudit(options.homeDirectory ?? homedir(), repositoryRoot, logical)
-    : { claudeCount: 0, codexCount: 0, findings: [], git: [], logical: [], records: [] };
-  const allLogical = [...logical, ...installed.logical, ...installed.git];
-  const isNonblockingRequired = options.requireNonblocking === true;
-  const findings = [
-    ...duplicateFindings(logical, "canonical"),
-    ...(options.catalogPath || isNonblockingRequired ? lifecycleFindings(allLogical, lifecycle) : []),
-    ...(isNonblockingRequired ? nonblockingFindings(allLogical, lifecycle) : []),
-    ...installed.findings,
-  ].sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
-  const targets = new Set(allLogical.map(({ target }) => target));
-  const classified = new Set(lifecycle.map(({ target }) => target));
-  return {
-    directRegistrations: direct.sort(recordSort),
-    findings,
-    hostedRegistrations: hosted.sort(recordSort),
-    installedRegistrations: installed.records.sort(recordSort),
-    installedLogicalRegistrations: installed.logical.sort(recordSort),
-    gitRegistrations: installed.git,
-    knownGitRegistrations: knownGit,
-    lifecycle,
-    logicalRegistrations: logical,
-    schemaVersion: 1,
-    summary: {
-      claudeDirectCount: installed.claudeCount,
-      codexDirectCount: installed.codexCount,
-      directCount: direct.length,
-      dispatcherCount,
-      effectiveCount: hosted.length,
-      findingCount: findings.length,
-      gitHookCount: installed.git.length,
-      knownGitHookCount: knownGit.length,
-      lifecycleCount: lifecycle.length,
-      logicalAssociationCount: logical.length,
-      unclassifiedCount: options.catalogPath || isNonblockingRequired
-        ? [...targets].filter((target) => !classified.has(target)).length
-        : 0,
-      uniqueTargetCount: targets.size,
-    },
-    registrationEligibility: registrationEligibility(allLogical, lifecycle, isNonblockingRequired),
-  };
-}
-
-function installedAudit(homeDirectory, repositoryRoot, canonicalLogical) {
-  const claude = readInstalled(
-    path.join(homeDirectory, ".claude", "settings.json"),
-    path.join(homeDirectory, ".claude", "hooks"),
-    "claude",
-  );
-  const codex = readInstalled(
-    path.join(homeDirectory, ".codex", "hooks.json"),
-    path.join(homeDirectory, ".codex", "hooks"),
-    "codex",
-  );
-  const git = activeGitHooks(repositoryRoot);
-  return {
-    claudeCount: claude.records.length,
-    codexCount: codex.records.length,
-    findings: [
-      ...claude.findings,
-      ...codex.findings,
-      ...missingManagedFindings(canonicalLogical, claude.logical, "claude"),
-      ...missingManagedFindings(canonicalLogical, codex.logical, "codex"),
-    ],
-    git,
-    logical: [...claude.logical, ...codex.logical],
-    records: [...claude.records, ...codex.records],
-  };
-}

package/scripts/tests/test-audit-hooks-cli.mjs

@@ -1,150 +0,0 @@
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import {
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-
-const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const auditCliPath = path.join(packageRoot, "audit-hooks-cli.mjs");
-
-function writeJson(filePath, jsonDocument) {
-  writeFileSync(filePath, JSON.stringify(jsonDocument), "utf8");
-}
-
-function createAuditFixture({
-  canonicalHooks = {},
-  claudeHooks = { hooks: {} },
-  codexHooks = { hooks: {} },
-} = {}) {
-  const fixtureRoot = mkdtempSync(path.join(tmpdir(), "hook-audit-cli-"));
-  const canonicalHooksRoot = path.join(fixtureRoot, "packages", "claude-dev-env", "hooks");
-  const homeDirectory = path.join(fixtureRoot, "home");
-  mkdirSync(canonicalHooksRoot, { recursive: true });
-  mkdirSync(path.join(homeDirectory, ".claude", "hooks"), { recursive: true });
-  mkdirSync(path.join(homeDirectory, ".codex", "hooks"), { recursive: true });
-  writeJson(path.join(canonicalHooksRoot, "hooks.json"), { hooks: canonicalHooks });
-  writeJson(path.join(homeDirectory, ".claude", "settings.json"), claudeHooks);
-  writeJson(path.join(homeDirectory, ".codex", "hooks.json"), codexHooks);
-  return { fixtureRoot, homeDirectory };
-}
-
-function runAuditCli(allArguments) {
-  const childProcess = spawnSync(process.execPath, [auditCliPath, ...allArguments], {
-    cwd: packageRoot,
-    encoding: "utf8",
-    env: { ...process.env, HOME: path.join(tmpdir(), "unused-audit-cli-home") },
-    shell: false,
-  });
-  assert.equal(childProcess.error, undefined);
-  return childProcess;
-}
-
-test("writes a JSON audit report to stdout through the CLI", () => {
-  const fixture = createAuditFixture({
-    canonicalHooks: {
-      PreToolUse: [{
-        matcher: "Write",
-        hooks: [{
-          type: "command",
-          command: "python3 " + "$" + "{CLAUDE_PLUGIN_ROOT}/hooks/blocking/write_existing_file_blocker.py",
-        }],
-      }],
-    },
-  });
-  try {
-    const childProcess = runAuditCli([
-      "--format",
-      "json",
-      "--repository-root",
-      fixture.fixtureRoot,
-    ]);
-
-    assert.equal(childProcess.status, 0);
-    assert.equal(childProcess.stderr, "");
-    const report = JSON.parse(childProcess.stdout);
-    assert.equal(report.summary.directCount, 1);
-    assert.equal(report.registrationEligibility.status, "not_checked");
-  } finally {
-    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
-  }
-});
-
-test("writes the JSON audit report to the requested file through the CLI", () => {
-  const fixture = createAuditFixture();
-  const reportPath = path.join(fixture.fixtureRoot, "audit-report.json");
-  try {
-    const childProcess = runAuditCli([
-      "--format",
-      "json",
-      "--output",
-      reportPath,
-      "--repository-root",
-      fixture.fixtureRoot,
-    ]);
-
-    assert.equal(childProcess.status, 0);
-    assert.equal(childProcess.stdout, "");
-    const report = JSON.parse(readFileSync(reportPath, "utf8"));
-    assert.equal(report.summary.directCount, 0);
-    assert.equal(report.summary.findingCount, 0);
-  } finally {
-    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
-  }
-});
-
-test("returns a strict nonblocking failure through the CLI", () => {
-  const fixture = createAuditFixture({
-    claudeHooks: {
-      hooks: {
-        SessionStart: [{
-          hooks: [{ command: "node cleanup.mjs", type: "command" }],
-        }],
-      },
-    },
-  });
-  const catalogPath = path.join(fixture.fixtureRoot, "lifecycle.json");
-  writeJson(catalogPath, {
-    hooks: {
-      "external:cleanup.mjs": {
-        lifecycle: "delete",
-        reason: "The installed entry is retired.",
-        replacement: null,
-      },
-    },
-  });
-  try {
-    const childProcess = runAuditCli([
-      "--format",
-      "json",
-      "--catalog",
-      catalogPath,
-      "--home",
-      fixture.homeDirectory,
-      "--installed",
-      "--require-nonblocking",
-      "--repository-root",
-      fixture.fixtureRoot,
-    ]);
-
-    assert.equal(childProcess.status, 1);
-    assert.equal(childProcess.stderr, "");
-    const report = JSON.parse(childProcess.stdout);
-    assert.equal(report.registrationEligibility.status, "ineligible");
-    assert.equal(
-      report.findings.some(({ code, target }) =>
-        code === "NONBLOCKING_LIFECYCLE_MISMATCH" && target === "external:cleanup.mjs",
-      ),
-      true,
-    );
-  } finally {
-    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
-  }
-});

package/scripts/tests/test-audit-hooks.mjs

@@ -1,497 +0,0 @@
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-
-import { auditHooks } from "../audit-hooks.mjs";
-
-const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../..");
-
-function writeJson(filePath, document) {
-  writeFileSync(filePath, JSON.stringify(document), "utf8");
-}
-
-function createAuditFixture({ canonicalHooks = {}, claudeHooks = { hooks: {} }, codexHooks = { hooks: {} } } = {}) {
-  const fixtureRoot = mkdtempSync(path.join(tmpdir(), "hook-audit-"));
-  const canonicalHooksRoot = path.join(fixtureRoot, "packages", "claude-dev-env", "hooks");
-  const homeDirectory = path.join(fixtureRoot, "home");
-  mkdirSync(canonicalHooksRoot, { recursive: true });
-  mkdirSync(path.join(homeDirectory, ".claude", "hooks"), { recursive: true });
-  mkdirSync(path.join(homeDirectory, ".codex", "hooks"), { recursive: true });
-  writeJson(path.join(canonicalHooksRoot, "hooks.json"), { hooks: canonicalHooks });
-  writeJson(path.join(homeDirectory, ".claude", "settings.json"), claudeHooks);
-  writeJson(path.join(homeDirectory, ".codex", "hooks.json"), codexHooks);
-  return { fixtureRoot, homeDirectory, canonicalHooksRoot };
-}
-
-function writeHookFile(hooksRoot, relativePath) {
-  const hookPath = path.join(hooksRoot, relativePath);
-  mkdirSync(path.dirname(hookPath), { recursive: true });
-  writeFileSync(hookPath, "", "utf8");
-}
-
-function runGit(repositoryRoot, argumentsList, environment) {
-  const command = spawnSync("git", argumentsList, {
-    cwd: repositoryRoot,
-    encoding: "utf8",
-    env: environment,
-    shell: false,
-  });
-  assert.equal(command.status, 0, command.stderr);
-  return command;
-}
-
-test("reports the canonical execution graph", () => {
-  const fixture = createAuditFixture({
-    canonicalHooks: {
-      PreToolUse: [{
-        matcher: "Write",
-        hooks: [{ type: "command", command: "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/write_existing_file_blocker.py" }],
-      }],
-    },
-  });
-  try {
-    const report = auditHooks({ repositoryRoot: fixture.fixtureRoot });
-    assert.equal(report.summary.directCount, 1);
-    assert.equal(report.summary.dispatcherCount, 0);
-    assert.equal(report.summary.effectiveCount, 0);
-    assert.equal(report.summary.logicalAssociationCount, 1);
-  } finally {
-    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
-  }
-});
-
-test("does not expand the retired stop dispatcher", () => {
-  const fixture = createAuditFixture({
-    canonicalHooks: {
-      Stop: [{
-        hooks: [{ type: "command", command: "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/stop_dispatcher.py" }],
-      }],
-    },
-  });
-  const constantsPath = path.join(
-    fixture.canonicalHooksRoot,
-    "hooks_constants",
-    "stop_dispatcher_constants.py",
-  );
-  writeHookFile(fixture.canonicalHooksRoot, "blocking/stop_dispatcher.py");
-  mkdirSync(path.dirname(constantsPath), { recursive: true });
-  writeFileSync(constantsPath, "ALL_STOP_HOSTED_HOOK_PATHS = ()\n", "utf8");
-  try {
-    const report = auditHooks({ repositoryRoot: fixture.fixtureRoot });
-    assert.equal(report.summary.dispatcherCount, 0);
-    assert.equal(report.hostedRegistrations.length, 0);
-    assert.equal(report.directRegistrations[0].target, "script:blocking/stop_dispatcher.py");
-  } finally {
-    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
-  }
-});
-
-test("renders deterministic private JSON", () => {
-  const report = auditHooks({ repositoryRoot });
-  const first = JSON.stringify(report);
-  const second = JSON.stringify(report);
-  assert.equal(first, second);
-  assert.equal(first.includes(repositoryRoot), false);
-  assert.equal(first.includes("python3 ${CLAUDE_PLUGIN_ROOT}"), false);
-});
-
-test("does not compare the live graph with retired baseline counts", () => {
-  const report = auditHooks({ repositoryRoot });
-  assert.equal(report.summary.directCount, report.directRegistrations.length);
-  assert.equal(report.summary.effectiveCount, report.hostedRegistrations.length);
-  assert.equal(report.summary.logicalAssociationCount, report.logicalRegistrations.length);
-  assert.ok(report.summary.directCount > 0);
-  assert.ok(report.summary.effectiveCount > 0);
-  assert.ok(report.summary.logicalAssociationCount > report.summary.directCount);
-  assert.equal(report.findings.some(({ code }) => code === "DIRECT_COUNT_DRIFT"), false);
-  assert.equal(report.findings.some(({ code }) => code === "HOSTED_COUNT_DRIFT"), false);
-});
-
-test("does not execute registered commands", () => {
-  const fixture = createAuditFixture({
-    canonicalHooks: {
-      PreToolUse: [{
-        hooks: [{
-          command: "node -e \"require('node:fs').writeFileSync('audit-executed', 'yes')\"",
-          type: "command",
-        }],
-      }],
-    },
-  });
-  try {
-    auditHooks({ repositoryRoot: fixture.fixtureRoot });
-    assert.equal(existsSync(path.join(fixture.fixtureRoot, "audit-executed")), false);
-  } finally {
-    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
-  }
-});
-
-test("reports every unclassified target", () => {
-  const temporaryRoot = mkdtempSync(path.join(tmpdir(), "hook-audit-"));
-  const catalogPath = path.join(temporaryRoot, "lifecycle.json");
-  writeFileSync(catalogPath, '{"schema_version":1,"hooks":{}}', "utf8");
-  try {
-    const report = auditHooks({ catalogPath, repositoryRoot });
-    assert.equal(report.summary.unclassifiedCount, report.summary.uniqueTargetCount);
-    assert.equal(report.findings.some(({ code }) => code === "UNCLASSIFIED_HOOK"), true);
-  } finally {
-    rmSync(temporaryRoot, { force: true, recursive: true });
-  }
-});
-
-test("reports canonical native Git hooks from the installer registry", () => {
-  const report = auditHooks({ repositoryRoot });
-  assert.deepEqual(
-    report.knownGitRegistrations.map(({ target }) => target),
-    ["git:pre-commit", "git:pre-push", "git:post-commit"],
-  );
-  assert.equal(report.summary.knownGitHookCount, 3);
-});
-
-test("keeps each hosted matcher as narrow as its roster", () => {
-  const fixture = createAuditFixture({
-    canonicalHooks: {
-      PreToolUse: [{
-        matcher: "Bash|Write",
-        hooks: [{ type: "command", command: "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/pre_tool_use_dispatcher.py" }],
-      }],
-    },
-  });
-  const constantsRoot = path.join(fixture.canonicalHooksRoot, "hooks_constants");
-  writeHookFile(fixture.canonicalHooksRoot, "blocking/pre_tool_use_dispatcher.py");
-  mkdirSync(constantsRoot, { recursive: true });
-  writeFileSync(
-    path.join(constantsRoot, "pre_tool_use_dispatcher_constants.py"),
-    [
-      'BASH_TOOL_NAME = "Bash"',
-      "ALL_BASH_TOOL_NAMES = frozenset({BASH_TOOL_NAME})",
-      "ALL_HOSTED_HOOK_ENTRIES = (",
-      'HostedHookEntry(script_relative_path="blocking/shell_substitution_blocker.py", applicable_tool_names=ALL_BASH_TOOL_NAMES),',
-      ")",
-    ].join("\n"),
-    "utf8",
-  );
-  try {
-    const report = auditHooks({ repositoryRoot: fixture.fixtureRoot });
-    const shellGate = report.hostedRegistrations.find(({ target }) =>
-      target.endsWith("shell_substitution_blocker.py"),
-    );
-    assert.equal(shellGate.matcher, "Bash");
-  } finally {
-    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
-  }
-});
-
-test("omits untrusted lifecycle prose from output", () => {
-  const temporaryRoot = mkdtempSync(path.join(tmpdir(), "hook-audit-"));
-  const catalogPath = path.join(temporaryRoot, "lifecycle.json");
-  const privateText = "PRIVATE_TOKEN python3 C:/Users/example/private.py";
-  const catalog = {
-    hooks: {
-      "script:blocking/code_rules_enforcer.py": {
-        lifecycle: "move_to_linter",
-        reason: privateText,
-        replacement: privateText,
-      },
-    },
-  };
-  writeFileSync(catalogPath, JSON.stringify(catalog), "utf8");
-  try {
-    const rendered = JSON.stringify(auditHooks({ catalogPath, repositoryRoot }));
-    assert.equal(rendered.includes(privateText), false);
-  } finally {
-    rmSync(temporaryRoot, { force: true, recursive: true });
-  }
-});
-
-test("classifies installed-only targets", () => {
-  const fixture = createAuditFixture();
-  const temporaryRoot = fixture.fixtureRoot;
-  const claudeRoot = path.join(fixture.homeDirectory, ".claude");
-  const codexRoot = path.join(fixture.homeDirectory, ".codex");
-  const installedOnly = {
-    hooks: {
-      SessionStart: [{ hooks: [{ command: "node cleanup.mjs", type: "command" }], matcher: "" }],
-    },
-  };
-  writeJson(path.join(claudeRoot, "settings.json"), installedOnly);
-  writeJson(path.join(codexRoot, "hooks.json"), { hooks: {} });
-  const catalogPath = path.join(temporaryRoot, "lifecycle.json");
-  writeFileSync(catalogPath, '{"hooks":{}}', "utf8");
-  try {
-    const report = auditHooks({
-      catalogPath,
-      homeDirectory: fixture.homeDirectory,
-      includeInstalled: true,
-      requireNonblocking: true,
-      repositoryRoot: temporaryRoot,
-    });
-    const missingTargets = new Set(
-      report.findings.filter(({ code }) => code === "UNCLASSIFIED_HOOK").map(({ target }) => target),
-    );
-    assert.equal(missingTargets.has("external:cleanup.mjs"), true);
-  } finally {
-    rmSync(temporaryRoot, { force: true, recursive: true });
-  }
-});
-
-test("reads dispatcher children from the installed hook tree", () => {
-  const fixture = createAuditFixture();
-  const temporaryRoot = fixture.fixtureRoot;
-  const claudeRoot = path.join(fixture.homeDirectory, ".claude");
-  const installedHooks = path.join(claudeRoot, "hooks");
-  const constantsRoot = path.join(installedHooks, "hooks_constants");
-  const blockingRoot = path.join(installedHooks, "blocking");
-  mkdirSync(constantsRoot, { recursive: true });
-  mkdirSync(blockingRoot, { recursive: true });
-  const config = {
-    hooks: {
-      PreToolUse: [{
-        hooks: [{
-          command: "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/pre_tool_use_dispatcher.py",
-          type: "command",
-        }],
-        matcher: "Write",
-      }],
-    },
-  };
-  const roster = [
-    'WRITE_TOOL_NAME = "Write"',
-    "ALL_WRITE_TOOL_NAMES = frozenset({WRITE_TOOL_NAME})",
-    "ALL_HOSTED_HOOK_ENTRIES = (",
-    'HostedHookEntry(script_relative_path="blocking/installed_only.py", applicable_tool_names=ALL_WRITE_TOOL_NAMES),',
-    ")",
-  ].join("\n");
-  writeJson(path.join(claudeRoot, "settings.json"), config);
-  writeFileSync(path.join(constantsRoot, "pre_tool_use_dispatcher_constants.py"), roster, "utf8");
-  writeFileSync(path.join(blockingRoot, "pre_tool_use_dispatcher.py"), "", "utf8");
-  writeJson(path.join(fixture.homeDirectory, ".codex", "hooks.json"), { hooks: {} });
-  try {
-    const report = auditHooks({
-      homeDirectory: fixture.homeDirectory,
-      includeInstalled: true,
-      repositoryRoot: temporaryRoot,
-    });
-    assert.equal(
-      report.installedLogicalRegistrations.some(({ target }) => target.endsWith("installed_only.py")),
-      true,
-    );
-    assert.equal(
-      report.findings.some(({ code, target }) =>
-        code === "MISSING_HOOK_TARGET" && target === "script:blocking/installed_only.py",
-      ),
-      true,
-    );
-  } finally {
-    rmSync(temporaryRoot, { force: true, recursive: true });
-  }
-});
-
-test("reports missing installed dispatcher targets", () => {
-  const fixture = createAuditFixture({
-    claudeHooks: {
-      hooks: {
-        PreToolUse: [{
-          matcher: "Write",
-          hooks: [{
-            type: "command",
-            command: "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/pre_tool_use_dispatcher.py",
-          }],
-        }],
-      },
-    },
-  });
-  const constantsPath = path.join(
-    fixture.homeDirectory,
-    ".claude",
-    "hooks",
-    "hooks_constants",
-    "pre_tool_use_dispatcher_constants.py",
-  );
-  mkdirSync(path.dirname(constantsPath), { recursive: true });
-  writeFileSync(constantsPath, "ALL_HOSTED_HOOK_ENTRIES = ()\n", "utf8");
-  try {
-    const report = auditHooks({
-      homeDirectory: fixture.homeDirectory,
-      includeInstalled: true,
-      repositoryRoot: fixture.fixtureRoot,
-    });
-    assert.equal(
-      report.findings.some(({ code, scope, target }) =>
-        code === "MISSING_HOOK_TARGET" &&
-        scope === "claude" &&
-        target === "script:blocking/pre_tool_use_dispatcher.py",
-      ),
-      true,
-    );
-  } finally {
-    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
-  }
-});
-
-test("rejects an installed-only registration without nonblocking lifecycle", () => {
-  const fixture = createAuditFixture({
-    claudeHooks: {
-      hooks: {
-        SessionStart: [{
-          hooks: [{ command: "node cleanup.mjs", type: "command" }],
-        }],
-      },
-    },
-  });
-  const catalogPath = path.join(fixture.fixtureRoot, "lifecycle.json");
-  writeJson(catalogPath, {
-    hooks: {
-      "external:cleanup.mjs": {
-        lifecycle: "delete",
-        reason: "The installed entry is retired.",
-        replacement: null,
-      },
-    },
-  });
-  try {
-    const report = auditHooks({
-      catalogPath,
-      homeDirectory: fixture.homeDirectory,
-      includeInstalled: true,
-      requireNonblocking: true,
-      repositoryRoot: fixture.fixtureRoot,
-    });
-    assert.equal(report.registrationEligibility.status, "ineligible");
-    assert.equal(
-      report.findings.some(({ code, target }) =>
-        code === "NONBLOCKING_LIFECYCLE_MISMATCH" && target === "external:cleanup.mjs",
-      ),
-      true,
-    );
-  } finally {
-    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
-  }
-});
-
-test("checks canonical managed parity for Codex registrations", () => {
-  const fixture = createAuditFixture({
-    canonicalHooks: {
-      PreToolUse: [{
-        matcher: "Write",
-        hooks: [{ type: "command", command: "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/write_existing_file_blocker.py" }],
-      }],
-    },
-  });
-  try {
-    const report = auditHooks({
-      homeDirectory: fixture.homeDirectory,
-      includeInstalled: true,
-      repositoryRoot: fixture.fixtureRoot,
-    });
-    assert.equal(
-      report.findings.some(({ code, scope, target }) =>
-        code === "MISSING_MANAGED_REGISTRATION" &&
-        scope === "codex" &&
-        target === "script:blocking/write_existing_file_blocker.py",
-      ),
-      true,
-    );
-  } finally {
-    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
-  }
-});
-
-test("compares managed registrations by event, matcher, and target", () => {
-  const command = "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/write_existing_file_blocker.py";
-  const fixture = createAuditFixture({
-    canonicalHooks: {
-      PreToolUse: [{ matcher: "Write", hooks: [{ type: "command", command }] }],
-    },
-    claudeHooks: {
-      hooks: {
-        PostToolUse: [{ matcher: "Read", hooks: [{ type: "command", command }] }],
-      },
-    },
-    codexHooks: {
-      hooks: {
-        PreToolUse: [{ matcher: "Write", hooks: [{ type: "command", command }] }],
-      },
-    },
-  });
-  writeHookFile(path.join(fixture.homeDirectory, ".claude", "hooks"), "blocking/write_existing_file_blocker.py");
-  writeHookFile(path.join(fixture.homeDirectory, ".codex", "hooks"), "blocking/write_existing_file_blocker.py");
-  try {
-    const report = auditHooks({
-      homeDirectory: fixture.homeDirectory,
-      includeInstalled: true,
-      repositoryRoot: fixture.fixtureRoot,
-    });
-    assert.equal(
-      report.findings.some(({ code, scope, target }) =>
-        code === "MISSING_MANAGED_REGISTRATION" &&
-        scope === "claude" &&
-        target === "script:blocking/write_existing_file_blocker.py",
-      ),
-      true,
-    );
-    assert.equal(
-      report.findings.some(({ code, scope }) =>
-        code === "MISSING_MANAGED_REGISTRATION" && scope === "codex",
-      ),
-      false,
-    );
-  } finally {
-    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
-  }
-});
-
-test("finds default Git hooks from a worktree", () => {
-  const sourceRoot = mkdtempSync(path.join(tmpdir(), "hook-audit-git-"));
-  const worktreeRoot = path.join(sourceRoot, "worktree");
-  const globalConfigPath = path.join(sourceRoot, "global-gitconfig");
-  writeFileSync(globalConfigPath, "", "utf8");
-  const environment = { ...process.env, GIT_CONFIG_GLOBAL: globalConfigPath, GIT_CONFIG_NOSYSTEM: "1" };
-  const previousGlobalConfig = process.env.GIT_CONFIG_GLOBAL;
-  const previousNoSystem = process.env.GIT_CONFIG_NOSYSTEM;
-  process.env.GIT_CONFIG_GLOBAL = globalConfigPath;
-  process.env.GIT_CONFIG_NOSYSTEM = "1";
-  try {
-    runGit(sourceRoot, ["init", "--quiet"], environment);
-    runGit(sourceRoot, ["config", "user.email", "hook-audit@example.invalid"], environment);
-    runGit(sourceRoot, ["config", "user.name", "Hook Audit"], environment);
-    runGit(sourceRoot, ["commit", "--quiet", "--allow-empty", "-m", "fixture"], environment);
-    runGit(sourceRoot, ["worktree", "add", "--quiet", worktreeRoot, "HEAD"], environment);
-    writeHookFile(path.join(sourceRoot, ".git", "hooks"), "pre-commit");
-    writeHookFile(path.join(sourceRoot, ".git", "hooks"), "post-commit");
-    const canonicalHooksRoot = path.join(worktreeRoot, "packages", "claude-dev-env", "hooks");
-    const homeDirectory = path.join(sourceRoot, "home");
-    mkdirSync(canonicalHooksRoot, { recursive: true });
-    mkdirSync(path.join(homeDirectory, ".claude", "hooks"), { recursive: true });
-    mkdirSync(path.join(homeDirectory, ".codex", "hooks"), { recursive: true });
-    writeJson(path.join(canonicalHooksRoot, "hooks.json"), { hooks: {} });
-    writeJson(path.join(homeDirectory, ".claude", "settings.json"), { hooks: {} });
-    writeJson(path.join(homeDirectory, ".codex", "hooks.json"), { hooks: {} });
-    const report = auditHooks({
-      homeDirectory,
-      includeInstalled: true,
-      requireNonblocking: true,
-      repositoryRoot: worktreeRoot,
-    });
-    assert.deepEqual(report.gitRegistrations.map(({ target }) => target), [
-      "git:pre-commit",
-      "git:post-commit",
-    ]);
-    assert.equal(
-      report.findings.some(({ code, target }) =>
-        code === "NATIVE_GIT_BLOCKING_HOOK" && target === "git:pre-commit",
-      ),
-      true,
-    );
-  } finally {
-    if (previousGlobalConfig === undefined) delete process.env.GIT_CONFIG_GLOBAL;
-    else process.env.GIT_CONFIG_GLOBAL = previousGlobalConfig;
-    if (previousNoSystem === undefined) delete process.env.GIT_CONFIG_NOSYSTEM;
-    else process.env.GIT_CONFIG_NOSYSTEM = previousNoSystem;
-    rmSync(sourceRoot, { force: true, recursive: true });
-  }
-});