claude-dev-env 8.46.4 → 8.46.6

package/.agents/agents-archived/clean-coder.md

@@ -135,7 +135,7 @@ Consult the advisor the spawn ticket names. When the ticket names the orchestrat
 [3] Parameters and returns typed; no Any / no type-ignore directives?
 [4] Do not add code comments. Preserve existing comments. Docstrings remain allowed.
 [5] When a change touches code that an existing comment describes or is attached to, remove that comment in the same change and carry its meaning through clear names and structure. Leave comments tied to untouched code unchanged. Keep comment cleanup inside the requested task.
-[6] Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed rather than added or justified.
+[6] Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed. Do not add or justify them.
 [7] Magic values and UPPER_SNAKE live in config/ where required?
 [8] Function short; one job; guards over else-chains?
 [9] Pre-check --check clean for the real destination path?

package/.agents/agents-archived/code-quality-agent.md

@@ -63,7 +63,7 @@ Tradeoff for category-restricted mode: parallel category invocation loses cross-
 
 Leave comments tied to untouched code unchanged. Findings on production and test code report only on new code added by the diff; comments on lines that remain otherwise unchanged stay outside the audit's scope. New inline comments added by this PR's diff are themselves a category J finding (code self-documents through naming).
 When a change touches code that an existing comment describes or is attached to, remove that comment in the same change and carry its meaning through clear names and structure. Leave comments tied to untouched code unchanged. Keep comment cleanup inside the requested task.
-Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed rather than added or justified.
+Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed. Do not add or justify them.
 
 ## Read-Only Stance
 

package/.agents/skills/grok-spawn/reference/worker-briefs.md

@@ -63,7 +63,7 @@ You edit code and run tests for one closed task. You never commit, push, or call
 
 Do not add code comments. Preserve existing comments. Docstrings remain allowed.
 When a change touches code that an existing comment describes or is attached to, remove that comment in the same change and carry its meaning through clear names and structure. Leave comments tied to untouched code unchanged. Keep comment cleanup inside the requested task.
-Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed rather than added or justified.
+Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed. Do not add or justify them.
 
 ## Scope
 

package/AGENTS.md

@@ -68,7 +68,7 @@ Match requested status, paths, links, and format. Name files, checks, blockers,
 
 Do not add code comments. Preserve existing comments. Docstrings remain allowed.
 When a change touches code that an existing comment describes or is attached to, remove that comment in the same change and carry its meaning through clear names and structure. Leave comments tied to untouched code unchanged. Keep comment cleanup inside the requested task.
-Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed rather than added or justified.
+Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed. Do not add or justify them.
 
 Banned word: real
 

package/docs/CODE_RULES.md

@@ -7,7 +7,7 @@ Use this index for edits. [`.cursor/BUGBOT.md`](../../../.cursor/BUGBOT.md) poin
 Do not add code comments. Preserve existing comments. Docstrings remain allowed.
 
 When a change touches code that an existing comment describes or is attached to, remove that comment in the same change and carry its meaning through clear names and structure. Leave comments tied to untouched code unchanged. Keep comment cleanup inside the requested task.
-Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed rather than added or justified.
+Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed. Do not add or justify them.
 
 A keep marker is the one comment that may be added and kept: a comment that opens with a prefix the repository lists under `comment_keep_markers` in `.claude/policy-lint.json`. Open [details](code-rules/comment-preservation.md) when editing comments.
 

package/hooks/blocking/code_rules_comments.py

@@ -201,10 +201,10 @@ def _is_keep_occurrence(comment_text: str, all_keep_markers: tuple[str, ...]) ->
     """Return True for a comment that opens with an accepted keep marker.
 
     A keep marker is meant to be freely added and to survive edits to the
-    line it sits on, unlike ``noqa`` or ``TODO``, which AGENTS.md requires to
-    be removed rather than added or justified. It is excluded here rather
-    than through the shared exempt-marker set that ``check_comment_changes``
-    deliberately still blocks on add.
+    line it sits on. AGENTS.md requires ``noqa`` and ``TODO`` comments to be
+    removed and forbids adding or justifying them. This check excludes keep
+    markers itself, outside the shared exempt-marker set that
+    ``check_comment_changes`` deliberately still blocks on add.
     """
     return comment_text.startswith("#") and comment_text[1:].lstrip().startswith(
         all_keep_markers

package/hooks/blocking/pr_lifecycle_skill_gate.py

@@ -13,6 +13,8 @@ if hooks_directory not in sys.path:
     sys.path.insert(0, hooks_directory)
 
 from hooks_constants.pr_lifecycle_skill_gate_constants import (
+    AGENT_ID_FIELD,
+    AGENT_ID_PATTERN,
     ALL_API_ACTION_NAMES,
     ALL_COMMAND_PREFIX_WORDS,
     ALL_GITHUB_MCP_TOOL_SUFFIXES,
@@ -40,8 +42,11 @@ from hooks_constants.pr_lifecycle_skill_gate_constants import (
     PERMISSION_DECISION_REASON_KEY,
     PULL_REQUEST_SCRIPT_NAME,
     PYTHON_OPTIONS_WITH_VALUE,
+    SESSION_TRANSCRIPT_PATH_FIELD,
     SHELL_TOOL_NAMES,
     SKILL_NAME,
+    SUBAGENT_TRANSCRIPT_DIRECTORY_NAME,
+    SUBAGENT_TRANSCRIPT_FILE_TEMPLATE,
 )
 from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
 from hooks_constants.setup_project_paths_constants import DECODE_ERRORS_POLICY, UTF8_ENCODING
@@ -174,6 +179,21 @@ def _transcript_load_status(path: str) -> bool | None:
         return None
 
 
+def _subagent_transcript_path(all_payload_fields: dict[str, object]) -> str | None:
+    session_path = all_payload_fields.get(SESSION_TRANSCRIPT_PATH_FIELD)
+    agent_id = all_payload_fields.get(AGENT_ID_FIELD)
+    if not isinstance(session_path, str) or not session_path:
+        return None
+    if not isinstance(agent_id, str) or not re.fullmatch(AGENT_ID_PATTERN, agent_id):
+        return None
+    subagent_path = (
+        Path(session_path).with_suffix("")
+        / SUBAGENT_TRANSCRIPT_DIRECTORY_NAME
+        / SUBAGENT_TRANSCRIPT_FILE_TEMPLATE.format(agent_id=agent_id)
+    )
+    return str(subagent_path) if subagent_path.is_file() else None
+
+
 def decision_for(all_payload_fields: dict[str, object]) -> dict[str, object] | None:
     """Return a deny for a governed action with readable, unloaded transcripts.
 
@@ -183,7 +203,8 @@ def decision_for(all_payload_fields: dict[str, object]) -> dict[str, object] | N
     if not _is_governed_action(all_payload_fields):
         return None
     paths = [all_payload_fields.get(field) for field in ALL_TRANSCRIPT_PATH_FIELDS]
-    readable_paths = [path for path in paths if isinstance(path, str) and path]
+    paths.append(_subagent_transcript_path(all_payload_fields))
+    readable_paths = list(dict.fromkeys(path for path in paths if isinstance(path, str) and path))
     if not readable_paths:
         return None
     statuses = [_transcript_load_status(path) for path in readable_paths]

package/hooks/blocking/test_pr_lifecycle_skill_gate.py

@@ -82,6 +82,49 @@ def test_agent_transcript_can_supply_invocation(tmp_path: Path) -> None:
     assert gate.decision_for(payload) is None
 
 
+def _subagent_transcript(tmp_path: Path, agent_id: str, skill_name: str | None) -> Path:
+    subagent_directory = tmp_path / "session" / "subagents"
+    subagent_directory.mkdir(parents=True)
+    subagent_path = subagent_directory / f"agent-{agent_id}.jsonl"
+    lines = [json.dumps({"type": "user", "message": {"content": "Task."}})]
+    if skill_name:
+        lines.append(json.dumps({"type": "assistant", "message": {"content": [{"type": "tool_use", "name": "Skill", "input": {"skill": skill_name}}]}}))
+    subagent_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    return subagent_path
+
+
+def test_subagent_transcript_located_by_agent_id_can_supply_invocation(tmp_path: Path) -> None:
+    session_path = _transcript(tmp_path)
+    _subagent_transcript(tmp_path, "a8865a3f3c71595ce", "pr-lifecycle")
+    payload = _payload("git commit", session_path)
+    payload["agent_id"] = "a8865a3f3c71595ce"
+    assert _run_main(payload) == (0, "")
+
+
+def test_subagent_without_invocation_is_denied(tmp_path: Path) -> None:
+    session_path = _transcript(tmp_path)
+    _subagent_transcript(tmp_path, "a8865a3f3c71595ce", None)
+    payload = _payload("git push", session_path)
+    payload["agent_id"] = "a8865a3f3c71595ce"
+    _assert_denied(payload)
+
+
+def test_missing_subagent_transcript_keeps_session_deny(tmp_path: Path) -> None:
+    payload = _payload("git push", _transcript(tmp_path))
+    payload["agent_id"] = "a8865a3f3c71595ce"
+    _assert_denied(payload)
+
+
+def test_agent_id_with_path_separator_is_not_followed(tmp_path: Path) -> None:
+    session_path = _transcript(tmp_path)
+    escaped_path = tmp_path / "session" / "agent-x.jsonl"
+    escaped_path.parent.mkdir(parents=True)
+    escaped_path.write_text(json.dumps({"type": "assistant", "message": {"content": [{"type": "tool_use", "name": "Skill", "input": {"skill": "pr-lifecycle"}}]}}) + "\n", encoding="utf-8")
+    payload = _payload("git push", session_path)
+    payload["agent_id"] = "../agent-x"
+    _assert_denied(payload)
+
+
 def test_unreadable_or_missing_transcript_allows_silently(tmp_path: Path) -> None:
     payload = _payload("gh pr create", tmp_path / "missing.jsonl")
     assert _run_main(payload) == (0, "")

package/hooks/hooks_constants/pr_lifecycle_skill_gate_constants.py

@@ -18,6 +18,11 @@ ALL_GITHUB_MCP_TOOL_SUFFIXES = (
     "__update_pull_request",
 )
 ALL_TRANSCRIPT_PATH_FIELDS = ("transcript_path", "agent_transcript_path")
+SESSION_TRANSCRIPT_PATH_FIELD = "transcript_path"
+AGENT_ID_FIELD = "agent_id"
+AGENT_ID_PATTERN = r"[A-Za-z0-9_-]+"
+SUBAGENT_TRANSCRIPT_DIRECTORY_NAME = "subagents"
+SUBAGENT_TRANSCRIPT_FILE_TEMPLATE = "agent-{agent_id}.jsonl"
 COMMAND_SEPARATORS = ";|&\n()`"
 COMMAND_WHITESPACE = " \t\r"
 OPTION_AND_VALUE_WORD_COUNT = 2

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.46.4",
+    "version": "8.46.6",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/system-prompts/software-engineer.xml

@@ -116,7 +116,7 @@
   - Preserve existing comments.
   - Do not add code comments.
   - When a change touches code that an existing comment describes or is attached to, remove that comment in the same change and carry its meaning through clear names and structure. Leave comments tied to untouched code unchanged. Keep comment cleanup inside the requested task.
-  - Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed rather than added or justified.
+  - Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed. Do not add or justify them.
   - Express new explanations through self-documenting names
   - Docstrings remain allowed.