claude-dev-env 8.46.9 → 8.46.11

package/.agents/agents-archived/clean-coder.md

@@ -121,7 +121,7 @@ Do not write production behavior before RED, skip the red run, or call a green t
 
 ## Hook-specific workflow
 
-For a hook change, use the target package's active managed root for installed files, not the current working directory. The default is `~/.claude`; `--target` or `CLAUDE_CONFIG_DIR` selects another managed root. Read `<managed-root>/hooks/AGENTS.md` (default: `~/.claude/hooks/AGENTS.md`; source fallback: `packages/claude-dev-env/hooks/AGENTS.md`), each closer `AGENTS.md` and `CLAUDE.md`, and the registered hook entry before editing. Trace the lifecycle event, stdin JSON, output contract, exit code, and registration. Reuse the target hook area's constants package. Run `<managed-root>/scripts/check.ps1` (default: `~/.claude/scripts/check.ps1`; source fallback: `packages/claude-dev-env/scripts/check.ps1`) and drive the production entry point with event payloads. The RED test covers each allow and deny outcome. Run every applicable test file and suite for the hook, then the full quality gates required by the affected package.
+For a hook change, use the target package's active managed root for installed files. The default is `~/.claude`; `--target` or `CLAUDE_CONFIG_DIR` selects another managed root. Read `<managed-root>/hooks/AGENTS.md` (default: `~/.claude/hooks/AGENTS.md`; source fallback: `packages/claude-dev-env/hooks/AGENTS.md`), each closer `AGENTS.md` and `CLAUDE.md`, and the registered hook entry before editing. Trace the lifecycle event, stdin JSON, output contract, exit code, and registration. Reuse the target hook area's constants package. Run `<managed-root>/scripts/check.ps1` (default: `~/.claude/scripts/check.ps1`; source fallback: `packages/claude-dev-env/scripts/check.ps1`) and drive the production entry point with event payloads. The RED test covers each allow and deny outcome. Run every applicable test file and suite for the hook, then the full quality gates required by the affected package.
 
 ## Session advisor
 

package/.agents/agents-archived/code-quality-agent.md

@@ -41,8 +41,8 @@ Treat scoped `AGENTS.md` files as the canonical repository and path rules. Treat
 For Category J, keep these sources separate:
 
 - Use the target repository's full review contract as the primary policy when available.
-- `docs/CODE_RULES.md` is a compact projection, not the full contract. Use it as a checklist.
-- `hooks/blocking/code_rules_enforcer.py` is hand-maintained write-time coverage. It shows what the hook checks, not whether other contract rules are absent.
+- `docs/CODE_RULES.md` is a compact projection of the contract. Use it as a checklist.
+- `hooks/blocking/code_rules_enforcer.py` is hand-maintained write-time coverage. It shows only what the hook checks.
 
 Record each Category J conclusion's policy source and hook coverage. Compact rules and hook results do not replace the canonical contract or scoped `AGENTS.md` rules.
 
@@ -199,7 +199,7 @@ When the primary and adversarial passes flag the same file:line:
 - Concatenate the `failure_mode` strings (separator: " // adversarial: ") so both pass narratives survive.
 - For Shape B entries on the same category, keep every distinct `adversarial_probe` from both passes — collapsing them would drop information that was found.
 
-The merge runs at the end of the adversarial pass, before constructing the output. The output preamble's `Total: N` counts merged findings, not pre-merge total.
+The merge runs at the end of the adversarial pass, before constructing the output. The output preamble's `Total: N` counts merged findings.
 
 ## file:line Evidence Requirement
 

package/hooks/blocking/code_rules_comments.py

@@ -46,7 +46,7 @@ extract_javascript_comment_occurrences = (
 def check_comments_python(content: str) -> list[str]:
     """Check for comments in Python code.
 
-    Uses ``tokenize.generate_tokens`` to find true ``COMMENT`` tokens.
+    Uses ``tokenize.generate_tokens`` to find ``COMMENT`` tokens.
     Hash characters that appear inside string literals (hex color codes,
     URL fragments, and the hash inside an f-string interpolation pattern)
     are correctly skipped because the tokenizer recognizes them as parts

package/hooks/conftest.py

@@ -18,10 +18,28 @@ _is_ephemeral_script_path = importlib.import_module("code_rules_shared").is_ephe
 _EPHEMERAL_EXEMPT_DISABLE_ENVIRONMENT_VARIABLE_NAME = importlib.import_module(
     "hooks_constants.code_rules_enforcer_constants"
 ).EPHEMERAL_EXEMPT_DISABLE_ENVIRONMENT_VARIABLE_NAME
+_CLAUDE_SESSION_ID_ENVIRONMENT_VARIABLE_NAME = importlib.import_module(
+    "hooks_constants.harness_scratchpad_constants"
+).CLAUDE_SESSION_ID_ENVIRONMENT_VARIABLE_NAME
 
 _ROOT_ANCHORED_PROBE_PATH = "/tmp/scratch.py"
 
 
+@pytest.fixture(autouse=True)
+def isolate_from_live_session_scratchpad(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Remove the live harness session id before each hooks test.
+
+    A Claude Code session exports ``CLAUDE_CODE_SESSION_ID``. When this checkout
+    sits inside that session's scratchpad, the scratchpad predicate classifies
+    every repository file as throwaway scratch, and the gates under test step
+    aside. Tests that exercise the scratchpad match set their own session id.
+
+    Args:
+        monkeypatch: Pytest's environment-variable patcher, torn down after the test.
+    """
+    monkeypatch.delenv(_CLAUDE_SESSION_ID_ENVIRONMENT_VARIABLE_NAME, raising=False)
+
+
 @pytest.fixture
 def ephemeral_exempt_off(monkeypatch: pytest.MonkeyPatch) -> None:
     """Turn off the ephemeral scratch-path exemption for the current test.

package/hooks/test_conftest.py

@@ -0,0 +1,29 @@
+"""Tests for the shared fixtures in hooks/conftest.py."""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+
+from hooks_constants.harness_scratchpad_constants import (
+    CLAUDE_SESSION_ID_ENVIRONMENT_VARIABLE_NAME,
+)
+
+
+def test_live_session_id_is_absent_inside_each_test() -> None:
+    assert CLAUDE_SESSION_ID_ENVIRONMENT_VARIABLE_NAME not in os.environ
+
+
+def test_hook_subprocess_inherits_no_live_session_id() -> None:
+    completed = subprocess.run(
+        [
+            sys.executable,
+            "-c",
+            f"import os; print(os.environ.get('{CLAUDE_SESSION_ID_ENVIRONMENT_VARIABLE_NAME}', ''))",
+        ],
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    assert completed.stdout.strip() == ""

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.46.9",
+    "version": "8.46.11",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {