claude-dev-env 8.46.5 → 8.46.7

package/.agents/agents-archived/clean-coder.md

@@ -22,7 +22,7 @@ Before writing a single line — **task-local discovery only** (no project-wide
 1. **Load scoped repository instructions first.** Starting at the repository root, read every applicable `AGENTS.md` on the path to the task file. Then read the applicable `CLAUDE.md` files. Apply nearer instructions after broader ones; the closest file wins.
 2. **Read the file you are about to edit** (when editing existing code). Note every existing comment so you can leave each one untouched on lines that remain otherwise unchanged.
 3. **Discover config only next to the task files.** From each file you will write or edit, walk up to the nearest package or repo root and inspect the target package's existing constants layout — such as `config/` or a sibling `*_constants` package. Keep this task-local constants search. Do **not** force a generic `config/` layout. Do **not** glob the whole tree for every config file. Do **not** glob or open `.env`, `.env.*`, or other secret files.
-4. **Reuse constants from that local table.** Reuse first: exact value match → import the existing name. Semantic match → reuse it. Add a shared constant only when the value is shared policy or has multiple consumers. When no match exists, use the target package's existing constants layout, and keep a one-use value in the scope that reads it rather than making it a new shared constant.
+4. **Reuse constants from that local table.** Reuse first: exact value match → import the existing name. Semantic match → reuse it. Add a shared constant only when the value is shared policy or has multiple consumers. When no match exists, use the target package's existing constants layout, and keep a one-use value in the scope that reads it.
 5. **Search callers.** When a symbol, name, or signature changes, search its full caller boundary and update every consumer. This search may be wider than the constants search.
 
 ## Generation mindset (9 laws)

package/.agents/agents-archived/code-quality-agent.md

@@ -210,7 +210,7 @@ Every Shape A finding cites a file path and a line number. The offending line is
 Do not infer missing context. If the diff and allowed checks cannot confirm a
 claim, use an open question or an evidence gap.
 
-When the diff alone lacks the context to confirm a finding, list the item under an "Open questions" section rather than asserting it as a Shape A finding. Each open question names the file and line where uncertainty arose and states what additional context would resolve it.
+When the diff alone lacks the context to confirm a finding, list the item under an "Open questions" section and keep it out of the Shape A findings. Each open question names the file and line where uncertainty arose and states what additional context would resolve it.
 
 ```json
 {

package/.agents/skills/grok-spawn/reference/worker-briefs.md

@@ -150,7 +150,7 @@ For each acceptance line from the brief:
 1. Keep task-specific detail in its own part file so the brief templates stay
    reusable.
 2. Absolute paths only in `prompt_parts` — the launcher reads them as given.
-3. One worker, one closed scope. Split large work into more workers rather than
-   one long brief.
+3. One worker, one closed scope. Split large work into more workers, each with a
+   short brief.
 4. The lead session fills bracketed fields before launch; workers never see the
    skill folder unless you copy text into their part files.

package/hooks/blocking/code_rules_comments.py

@@ -50,11 +50,11 @@ def check_comments_python(content: str) -> list[str]:
     Hash characters that appear inside string literals (hex color codes,
     URL fragments, and the hash inside an f-string interpolation pattern)
     are correctly skipped because the tokenizer recognizes them as parts
-    of string tokens rather than comment tokens.
+    of string tokens.
 
     When the tokenizer cannot parse the file (partial content during
-    Edit, invalid syntax), the check returns no findings rather than
-    falling back to a line-walker scan — false negatives on
+    Edit, invalid syntax), the check returns no findings and does not
+    fall back to a line-walker scan — false negatives on
     syntactically-invalid drafts are preferable to false positives that
     mis-classify string-interior hash characters as comments.
     """

package/hooks/blocking/pr_lifecycle_skill_gate.py

@@ -13,6 +13,8 @@ if hooks_directory not in sys.path:
     sys.path.insert(0, hooks_directory)
 
 from hooks_constants.pr_lifecycle_skill_gate_constants import (
+    AGENT_ID_FIELD,
+    AGENT_ID_PATTERN,
     ALL_API_ACTION_NAMES,
     ALL_COMMAND_PREFIX_WORDS,
     ALL_GITHUB_MCP_TOOL_SUFFIXES,
@@ -40,8 +42,11 @@ from hooks_constants.pr_lifecycle_skill_gate_constants import (
     PERMISSION_DECISION_REASON_KEY,
     PULL_REQUEST_SCRIPT_NAME,
     PYTHON_OPTIONS_WITH_VALUE,
+    SESSION_TRANSCRIPT_PATH_FIELD,
     SHELL_TOOL_NAMES,
     SKILL_NAME,
+    SUBAGENT_TRANSCRIPT_DIRECTORY_NAME,
+    SUBAGENT_TRANSCRIPT_FILE_TEMPLATE,
 )
 from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
 from hooks_constants.setup_project_paths_constants import DECODE_ERRORS_POLICY, UTF8_ENCODING
@@ -174,6 +179,21 @@ def _transcript_load_status(path: str) -> bool | None:
         return None
 
 
+def _subagent_transcript_path(all_payload_fields: dict[str, object]) -> str | None:
+    session_path = all_payload_fields.get(SESSION_TRANSCRIPT_PATH_FIELD)
+    agent_id = all_payload_fields.get(AGENT_ID_FIELD)
+    if not isinstance(session_path, str) or not session_path:
+        return None
+    if not isinstance(agent_id, str) or not re.fullmatch(AGENT_ID_PATTERN, agent_id):
+        return None
+    subagent_path = (
+        Path(session_path).with_suffix("")
+        / SUBAGENT_TRANSCRIPT_DIRECTORY_NAME
+        / SUBAGENT_TRANSCRIPT_FILE_TEMPLATE.format(agent_id=agent_id)
+    )
+    return str(subagent_path) if subagent_path.is_file() else None
+
+
 def decision_for(all_payload_fields: dict[str, object]) -> dict[str, object] | None:
     """Return a deny for a governed action with readable, unloaded transcripts.
 
@@ -183,7 +203,8 @@ def decision_for(all_payload_fields: dict[str, object]) -> dict[str, object] | N
     if not _is_governed_action(all_payload_fields):
         return None
     paths = [all_payload_fields.get(field) for field in ALL_TRANSCRIPT_PATH_FIELDS]
-    readable_paths = [path for path in paths if isinstance(path, str) and path]
+    paths.append(_subagent_transcript_path(all_payload_fields))
+    readable_paths = list(dict.fromkeys(path for path in paths if isinstance(path, str) and path))
     if not readable_paths:
         return None
     statuses = [_transcript_load_status(path) for path in readable_paths]

package/hooks/blocking/test_pr_lifecycle_skill_gate.py

@@ -82,6 +82,49 @@ def test_agent_transcript_can_supply_invocation(tmp_path: Path) -> None:
     assert gate.decision_for(payload) is None
 
 
+def _subagent_transcript(tmp_path: Path, agent_id: str, skill_name: str | None) -> Path:
+    subagent_directory = tmp_path / "session" / "subagents"
+    subagent_directory.mkdir(parents=True)
+    subagent_path = subagent_directory / f"agent-{agent_id}.jsonl"
+    lines = [json.dumps({"type": "user", "message": {"content": "Task."}})]
+    if skill_name:
+        lines.append(json.dumps({"type": "assistant", "message": {"content": [{"type": "tool_use", "name": "Skill", "input": {"skill": skill_name}}]}}))
+    subagent_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    return subagent_path
+
+
+def test_subagent_transcript_located_by_agent_id_can_supply_invocation(tmp_path: Path) -> None:
+    session_path = _transcript(tmp_path)
+    _subagent_transcript(tmp_path, "a8865a3f3c71595ce", "pr-lifecycle")
+    payload = _payload("git commit", session_path)
+    payload["agent_id"] = "a8865a3f3c71595ce"
+    assert _run_main(payload) == (0, "")
+
+
+def test_subagent_without_invocation_is_denied(tmp_path: Path) -> None:
+    session_path = _transcript(tmp_path)
+    _subagent_transcript(tmp_path, "a8865a3f3c71595ce", None)
+    payload = _payload("git push", session_path)
+    payload["agent_id"] = "a8865a3f3c71595ce"
+    _assert_denied(payload)
+
+
+def test_missing_subagent_transcript_keeps_session_deny(tmp_path: Path) -> None:
+    payload = _payload("git push", _transcript(tmp_path))
+    payload["agent_id"] = "a8865a3f3c71595ce"
+    _assert_denied(payload)
+
+
+def test_agent_id_with_path_separator_is_not_followed(tmp_path: Path) -> None:
+    session_path = _transcript(tmp_path)
+    escaped_path = tmp_path / "session" / "agent-x.jsonl"
+    escaped_path.parent.mkdir(parents=True)
+    escaped_path.write_text(json.dumps({"type": "assistant", "message": {"content": [{"type": "tool_use", "name": "Skill", "input": {"skill": "pr-lifecycle"}}]}}) + "\n", encoding="utf-8")
+    payload = _payload("git push", session_path)
+    payload["agent_id"] = "../agent-x"
+    _assert_denied(payload)
+
+
 def test_unreadable_or_missing_transcript_allows_silently(tmp_path: Path) -> None:
     payload = _payload("gh pr create", tmp_path / "missing.jsonl")
     assert _run_main(payload) == (0, "")

package/hooks/hooks_constants/pr_lifecycle_skill_gate_constants.py

@@ -18,6 +18,11 @@ ALL_GITHUB_MCP_TOOL_SUFFIXES = (
     "__update_pull_request",
 )
 ALL_TRANSCRIPT_PATH_FIELDS = ("transcript_path", "agent_transcript_path")
+SESSION_TRANSCRIPT_PATH_FIELD = "transcript_path"
+AGENT_ID_FIELD = "agent_id"
+AGENT_ID_PATTERN = r"[A-Za-z0-9_-]+"
+SUBAGENT_TRANSCRIPT_DIRECTORY_NAME = "subagents"
+SUBAGENT_TRANSCRIPT_FILE_TEMPLATE = "agent-{agent_id}.jsonl"
 COMMAND_SEPARATORS = ";|&\n()`"
 COMMAND_WHITESPACE = " \t\r"
 OPTION_AND_VALUE_WORD_COUNT = 2

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.46.5",
+    "version": "8.46.7",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {