claude-dev-env 8.46.19 → 8.46.21

package/docs/rule-guides/failure-blast-radius.md

@@ -42,7 +42,7 @@ for each_member in all_members:
 
 The re-raise comes first, sending an escalation directly through the boundary.
 
-**The boundary recognizes declared types.** A runtime crash inside member work — a `TypeError`, an `AttributeError` — ends the run because its type identifies a code defect. `except Exception` triggers the rule (`CODE_RULES.md` §31).
+**The boundary recognizes declared types.** A runtime crash inside member work — a `TypeError`, an `AttributeError` — ends the run because its type identifies a code defect. `except Exception` triggers the rule (`CODE_RULES.md` §9.7).
 
 ## Repair, park, and the deliverable
 

package/hooks/blocking/code_rules_shared.py

@@ -431,6 +431,26 @@ def _existing_scratchpad_root(
     return None
 
 
+def _is_at_or_under_payload_working_directory(file_path: str, hook_payload: dict) -> bool:
+    """Return True when file_path's real path sits at or under the payload ``cwd``.
+
+    Args:
+        file_path: The path the write targets.
+        hook_payload: The PreToolUse payload that may carry ``cwd``.
+
+    Returns:
+        True when the payload names a working directory and file_path resolves
+        at or under its real path.
+    """
+    working_directory = str(hook_payload.get("cwd") or "")
+    if not working_directory:
+        return False
+    return _is_at_or_under_root(
+        _normalized_absolute_comparison_path(os.path.realpath(file_path)),
+        _normalized_absolute_comparison_path(os.path.realpath(working_directory)),
+    )
+
+
 def is_under_session_scratchpad(file_path: str, hook_payload: dict) -> bool:
     """Return True when file_path resolves under the harness session scratchpad.
 
@@ -460,13 +480,9 @@ def is_under_session_scratchpad(file_path: str, hook_payload: dict) -> bool:
     session_id = _session_id_for_scratchpad(hook_payload)
     if not session_id:
         return False
-    real_target = os.path.realpath(file_path)
-    working_directory = str(hook_payload.get("cwd") or "")
-    if working_directory and _is_at_or_under_root(
-        _normalized_absolute_comparison_path(real_target),
-        _normalized_absolute_comparison_path(os.path.realpath(working_directory)),
-    ):
+    if _is_at_or_under_payload_working_directory(file_path, hook_payload):
         return False
+    real_target = os.path.realpath(file_path)
     real_temp_root = os.path.realpath(tempfile.gettempdir())
     all_relative_parts = _relative_parts_under_temp_root(real_target, real_temp_root)
     return (
@@ -482,10 +498,10 @@ def is_ephemeral_path(file_path: str, hook_payload: dict | None = None) -> bool:
     scratch directories (``/tmp`` and ``$CLAUDE_JOB_DIR/tmp``), the harness
     session scratchpad, and a coding agent's own home-directory tooling such as
     ``~/.grok/runs/``. A path inside the payload's own working directory
-    (``cwd``) is never treated as scratch, so a repository checked out under
-    ``/tmp`` still receives full enforcement. The scratchpad match reads the
-    session id from the payload when supplied, else the harness environment
-    variable. The code-rules and TDD gates call the underlying predicates
+    (``cwd``) is never treated as scratch or agent tooling, so a repository
+    checked out under ``/tmp`` or ``~/.grok/runs/`` still receives full
+    enforcement. The scratchpad match reads the session id from the payload
+    when supplied, else the harness environment variable. The code-rules and TDD gates call the underlying predicates
     ``is_ephemeral_script_path``, ``is_agent_home_tooling``, and
     ``is_under_session_scratchpad`` directly.
 
@@ -501,7 +517,9 @@ def is_ephemeral_path(file_path: str, hook_payload: dict | None = None) -> bool:
     repository_root = str((hook_payload or {}).get("cwd") or "")
     if is_ephemeral_script_path(file_path, repository_root):
         return True
-    if is_agent_home_tooling(file_path):
+    if is_agent_home_tooling(file_path) and not _is_at_or_under_payload_working_directory(
+        file_path, hook_payload or {}
+    ):
         return True
     return is_under_session_scratchpad(file_path, hook_payload or {})
 

package/hooks/blocking/test_code_rules_shared.py

@@ -357,3 +357,20 @@ def test_ephemeral_path_stays_true_for_scratchpad_file_outside_payload_cwd(
     assert (
         _SHARED_MODULE.is_ephemeral_path(str(throwaway_script), payload_with_worktree_cwd) is True
     )
+
+
+def test_ephemeral_path_is_false_for_file_under_payload_cwd_inside_agent_home() -> None:
+    checkout_directory = os.path.join("/home/example", ".grok", "runs", "checkout")
+    repository_module = os.path.join(checkout_directory, "src", "service.py")
+
+    assert (
+        _SHARED_MODULE.is_ephemeral_path(repository_module, {"cwd": checkout_directory})
+        is False
+    )
+
+
+def test_ephemeral_path_stays_true_for_agent_home_file_outside_payload_cwd() -> None:
+    checkout_directory = os.path.join("/home/example", ".grok", "runs", "checkout")
+    helper_script = os.path.join("/home/example", ".grok", "runs", "worktree-health", "health.py")
+
+    assert _SHARED_MODULE.is_ephemeral_path(helper_script, {"cwd": checkout_directory}) is True

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.46.19",
+    "version": "8.46.21",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/tests/test_code_rules_index.py

@@ -27,7 +27,8 @@ _TEXT_SUFFIXES = frozenset({".md", ".py", ".js", ".mjs", ".ts", ".json", ".xml"}
 _MARKDOWN_LINK = re.compile(r"(?<!!)\[[^]]+\]\(([^)\s]+)(?:\s+[^)]*)?\)")
 _INDEX_ANCHOR = re.compile(r"CODE_RULES\.md#([^\s)\]<>\"`]+)", re.IGNORECASE)
 _NUMBERED_CITATION = re.compile(
-    r"(?:CODE_RULES\s*\u00a7\s*|\bsection\s+)(\d+(?:\.\d+)?)", re.IGNORECASE
+    r"CODE_RULES(?:\.md)?[`'\"]*\s*(?:\u00a7\s*|section\s+)(\d+(?:\.\d+)?)",
+    re.IGNORECASE,
 )
 
 
@@ -129,6 +130,27 @@ def test_should_report_dead_code_rules_anchor() -> None:
         _assert_citations_resolve(index_text, [dead_citation])
 
 
+def test_should_ignore_section_number_of_another_document() -> None:
+    index_text = _INDEX_PATH.read_text(encoding="utf-8")
+    foreign_citation = (_INDEX_PATH, "See the runbook section 12 appendix row.")
+    _assert_citations_resolve(index_text, [foreign_citation])
+
+
+@pytest.mark.parametrize(
+    "citation_text",
+    [
+        "CODE_RULES.md" + " section 12",
+        "``docs/CODE_RULES.md``" + " section 12",
+        "CODE_RULES" + " \u00a712",
+        "CODE_RULES.md" + " \u00a712",
+    ],
+)
+def test_should_report_dead_code_rules_section(citation_text: str) -> None:
+    index_text = _INDEX_PATH.read_text(encoding="utf-8")
+    with pytest.raises(AssertionError, match="dead CODE_RULES" + " section 12"):
+        _assert_citations_resolve(index_text, [(_INDEX_PATH, citation_text)])
+
+
 def _assert_destination_resolves(markdown_path: Path, destination: str) -> None:
     if "://" in destination or destination.startswith("#"):
         return