claude-dev-env 8.48.3 → 8.48.5

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.48.3",
+    "version": "8.48.5",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/agent_merge_check.py

@@ -607,6 +607,7 @@ def read_pull_request(slug: str, number: int, token: str) -> Mapping[str, object
 def read_blocked_evidence(
     slug: str,
     all_pull_request_fields: Mapping[str, object],
+    all_rules: list[object] | MergeCheckError,
     token: str,
 ) -> BlockedEvidence:
     """Read what stands behind a ``blocked`` merge state.
@@ -615,6 +616,8 @@ def read_blocked_evidence(
         slug: The repository as ``owner/name``.
         all_pull_request_fields: The pull request, carrying its base branch
             and its head commit.
+        all_rules: The base branch rules, or the failure that kept them
+            unread.
         token: The GitHub token the requests authenticate with.
 
     Returns:
@@ -628,7 +631,8 @@ def read_blocked_evidence(
         str(_nested_field(all_pull_request_fields, BASE_KEY, REF_KEY))
     )
     head_sha = str(_nested_field(all_pull_request_fields, HEAD_KEY, SHA_KEY))
-    all_rules = _read_branch_rules(slug, base_ref, token)
+    if isinstance(all_rules, MergeCheckError):
+        raise all_rules
     return BlockedEvidence(
         all_unmet_checks=_read_unmet_checks(slug, head_sha, all_rules, token),
         behind_by=_read_behind_by(slug, base_ref, head_sha, token),
@@ -636,13 +640,30 @@ def read_blocked_evidence(
     )
 
 
-def _read_branch_rules(slug: str, base_ref: str, token: str) -> list[object]:
-    return _request_list(
-        BRANCH_RULES_ENDPOINT_TEMPLATE.format(
-            api_root=GITHUB_API_ROOT, slug=slug, branch=base_ref
-        ),
-        token,
-    )
+def read_branch_rules(
+    slug: str, base_ref: str, token: str
+) -> list[object] | MergeCheckError:
+    """Read the rules GitHub reports as active on the base branch.
+
+    Args:
+        slug: The repository as ``owner/name``.
+        base_ref: The branch the pull request merges into.
+        token: The GitHub token the request authenticates with.
+
+    Returns:
+        The rules, or the failure that kept them unread.
+    """
+    try:
+        return _request_list(
+            BRANCH_RULES_ENDPOINT_TEMPLATE.format(
+                api_root=GITHUB_API_ROOT,
+                slug=slug,
+                branch=urllib.parse.quote(base_ref),
+            ),
+            token,
+        )
+    except MergeCheckError as failure:
+        return failure
 
 
 def read_unstable_checks(
@@ -879,7 +900,11 @@ def _field_at(document: object, all_fields: object, key: str) -> object:
 
 
 def read_merge_queue_ejection(
-    slug: str, number: int, base_ref: str, token: str
+    slug: str,
+    number: int,
+    base_ref: str,
+    all_rules: list[object] | MergeCheckError,
+    token: str,
 ) -> bool:
     """Read whether the merge queue ejected the pull request's current head.
 
@@ -891,6 +916,8 @@ def read_merge_queue_ejection(
         slug: The repository as ``owner/name``.
         number: The pull request number.
         base_ref: The branch the pull request merges into.
+        all_rules: The base branch rules, or the failure that kept them
+            unread.
         token: The GitHub token the request authenticates with.
 
     Returns:
@@ -901,7 +928,9 @@ def read_merge_queue_ejection(
         MergeCheckError: A read failed, or answered with another shape. A
             refused GraphQL query names the merge queue that needed it.
     """
-    if not _may_merge_through_a_queue(slug, base_ref, token):
+    if not isinstance(all_rules, MergeCheckError) and not has_merge_queue_rule(
+        all_rules
+    ):
         return False
     document = _merge_queue_removal_document(slug, number, base_ref, token)
     return _is_ejected_on_head(
@@ -924,14 +953,6 @@ def _merge_queue_removal_document(
         ) from failure
 
 
-def _may_merge_through_a_queue(slug: str, base_ref: str, token: str) -> bool:
-    try:
-        all_rules = _read_branch_rules(slug, urllib.parse.quote(base_ref), token)
-    except MergeCheckError:
-        return True
-    return has_merge_queue_rule(all_rules)
-
-
 def _list_along(document: object, all_keys: Sequence[str]) -> list[object]:
     all_records = functools.reduce(
         functools.partial(_field_at, document), all_keys, document
@@ -1009,11 +1030,10 @@ def main(all_arguments: Sequence[str]) -> int:
         unresolved_thread_count = read_unresolved_thread_count(
             parsed.slug, parsed.number, token
         )
+        base_ref = str(_nested_field(all_pull_request_fields, BASE_KEY, REF_KEY))
+        all_rules = read_branch_rules(parsed.slug, base_ref, token)
         is_ejected_from_merge_queue = read_merge_queue_ejection(
-            parsed.slug,
-            parsed.number,
-            str(_nested_field(all_pull_request_fields, BASE_KEY, REF_KEY)),
-            token,
+            parsed.slug, parsed.number, base_ref, all_rules, token
         )
     except MergeCheckError as failure:
         print(failure, file=sys.stderr)
@@ -1022,7 +1042,7 @@ def main(all_arguments: Sequence[str]) -> int:
     if all_pull_request_fields.get(MERGEABLE_STATE_KEY) == MERGEABLE_STATE_BLOCKED:
         try:
             blocked_evidence = read_blocked_evidence(
-                parsed.slug, all_pull_request_fields, token
+                parsed.slug, all_pull_request_fields, all_rules, token
             )
         except MergeCheckError as failure:
             print(failure, file=sys.stderr)

package/scripts/claude_chain_usage.py

@@ -28,11 +28,31 @@ class WeeklyUtilizationProbeError(Exception):
     """Raised when an account's usage meters cannot be measured."""
 
 
-def _usage_pause_scripts_directory() -> Path:
-    package_root = Path(__file__).resolve().parent.parent
-    return (
+def _usage_pause_scripts_directory(module_file: Path) -> Path:
+    """Return the usage-pause scripts directory beside this scripts tree.
+
+    ::
+
+        packages/claude-dev-env/scripts/x.py  ->  packages/claude-dev-env/.agents/skills/usage-pause/scripts
+        ~/.claude/scripts/x.py (link)         ->  ~/.agents/skills/usage-pause/scripts
+
+    The installer links ~/.claude/scripts to ~/.agents/scripts, so the
+    resolved scripts tree already sits inside the agents home.
+
+    Args:
+        module_file: Path of a module inside the scripts tree.
+
+    Returns:
+        The directory that holds the usage-pause resolver.
+    """
+    package_root = module_file.resolve().parent.parent
+    agents_home = (
         package_root
-        / USAGE_PAUSE_AGENTS_HOME_DIRECTORY_NAME
+        if package_root.name.endswith(USAGE_PAUSE_AGENTS_HOME_DIRECTORY_NAME)
+        else package_root / USAGE_PAUSE_AGENTS_HOME_DIRECTORY_NAME
+    )
+    return (
+        agents_home
         / USAGE_PAUSE_SKILL_DIRECTORY_NAME
         / USAGE_PAUSE_SKILL_NAME
         / USAGE_PAUSE_SCRIPTS_DIRECTORY_NAME
@@ -48,7 +68,7 @@ def _load_resolve_usage_window_module() -> ModuleType:
     already_loaded = sys.modules.get(RESOLVE_USAGE_WINDOW_MODULE_NAME)
     if already_loaded is not None:
         return already_loaded
-    scripts_directory = _usage_pause_scripts_directory()
+    scripts_directory = _usage_pause_scripts_directory(Path(__file__))
     module_path = scripts_directory / RESOLVE_USAGE_WINDOW_FILENAME
     if not module_path.is_file():
         raise WeeklyUtilizationProbeError(
@@ -90,12 +110,43 @@ class AccountUsageMeters:
     weekly_resets_at: datetime | None
 
 
+def _read_access_token(
+    usage_window_resolver: ModuleType, credentials_path: Path, now: datetime
+) -> str | None:
+    """Return the bearer token that reads one account's meters.
+
+    ::
+
+        credential file holds a token                ->  that token
+        no token, the session's own credential path  ->  the session ingress token
+        no token, another account's credential path  ->  None
+
+    A cloud session has no credential file, only the ingress token, and that
+    token belongs to the account the session runs on.
+
+    Args:
+        usage_window_resolver: The loaded usage-pause resolver module.
+        credentials_path: The account's CLI credential file.
+        now: The current time, for the token expiry check.
+
+    Returns:
+        A bearer token, or None when the account has none.
+    """
+    file_token = usage_window_resolver.read_oauth_access_token(credentials_path, now)
+    if file_token is not None:
+        return file_token
+    session_credentials_path = usage_window_resolver.default_credentials_path()
+    if credentials_path.resolve() != session_credentials_path.resolve():
+        return None
+    return usage_window_resolver.read_session_ingress_token()
+
+
 def _fetch_account_usage_payload(
     usage_window_resolver: ModuleType, credentials_path: Path
 ) -> dict[str, object]:
     now = datetime.now().astimezone()
     try:
-        access_token = usage_window_resolver.read_oauth_access_token(credentials_path, now)
+        access_token = _read_access_token(usage_window_resolver, credentials_path, now)
         if access_token is None:
             raise WeeklyUtilizationProbeError(
                 NO_ACCESS_TOKEN_ERROR_TEMPLATE.format(credentials_path=credentials_path)

package/scripts/test_agent_merge_check.py

@@ -291,10 +291,15 @@ def test_a_ready_pull_request_exits_zero(monkeypatch: pytest.MonkeyPatch) -> Non
         "read_unresolved_thread_count",
         lambda slug, number, token: 0,
     )
+    monkeypatch.setattr(
+        agent_merge_check,
+        "read_branch_rules",
+        lambda slug, base_ref, token: [],
+    )
     monkeypatch.setattr(
         agent_merge_check,
         "read_merge_queue_ejection",
-        lambda slug, number, base_ref, token: False,
+        lambda slug, number, base_ref, all_rules, token: False,
     )
     assert agent_merge_check.main(["jl-cmd/claude-dev-env", "1442"]) == 0
 
@@ -311,10 +316,15 @@ def test_a_held_pull_request_exits_one(monkeypatch: pytest.MonkeyPatch) -> None:
         "read_unresolved_thread_count",
         lambda slug, number, token: 0,
     )
+    monkeypatch.setattr(
+        agent_merge_check,
+        "read_branch_rules",
+        lambda slug, base_ref, token: [],
+    )
     monkeypatch.setattr(
         agent_merge_check,
         "read_merge_queue_ejection",
-        lambda slug, number, base_ref, token: False,
+        lambda slug, number, base_ref, all_rules, token: False,
     )
     assert agent_merge_check.main(["jl-cmd/claude-dev-env", "1442"]) == 1
 
@@ -491,6 +501,65 @@ def test_an_unreadable_branch_rule_keeps_the_generic_blocked_reason(
     assert BLOCKED_HOLD_REASON in line
 
 
+def test_a_blocked_pull_request_reads_the_branch_rules_once(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    routed_answer = _github_answers(
+        MAIN_BRANCH_RULES,
+        [
+            _check_run("Ruff", "success", run_id=11),
+            _check_run("Tip Local green", "success", run_id=12),
+        ],
+        behind_by=225,
+    )
+    all_rules_urls: list[str] = []
+
+    def _answer(url: str, token: str, all_payload_fields: object) -> object:
+        if "/rules/branches/" in url:
+            all_rules_urls.append(url)
+        return routed_answer(url, token, all_payload_fields)
+
+    exit_code, line = _run_main(monkeypatch, capsys, _answer)
+    assert exit_code == 1
+    assert BEHIND_MERGE_QUEUE_HOLD_TEMPLATE.format(count=225) in line
+    assert len(all_rules_urls) == 1
+
+
+def test_read_branch_rules_quotes_the_base_branch_and_returns_its_rules(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    all_rules_urls: list[str] = []
+
+    def _answer(url: str, token: str, all_payload_fields: object) -> object:
+        all_rules_urls.append(url)
+        return MAIN_BRANCH_RULES
+
+    monkeypatch.setattr(agent_merge_check, "_request_json", _answer)
+    assert (
+        agent_merge_check.read_branch_rules(
+            "jl-cmd/claude-dev-env", "release/2026 q4", "token"
+        )
+        == MAIN_BRANCH_RULES
+    )
+    assert all_rules_urls[0].endswith("/rules/branches/release/2026%20q4")
+
+
+def test_read_branch_rules_returns_the_failure_of_a_refused_read(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    refusal = agent_merge_check.MergeCheckError("HTTP Error 403: Forbidden")
+
+    def _refuse(url: str, token: str, all_payload_fields: object) -> object:
+        raise refusal
+
+    monkeypatch.setattr(agent_merge_check, "_request_json", _refuse)
+    assert (
+        agent_merge_check.read_branch_rules("jl-cmd/claude-dev-env", "main", "token")
+        is refusal
+    )
+
+
 def _evidence(
     all_unmet_checks: tuple[str, ...] = (),
     behind_by: int = 0,
@@ -626,7 +695,7 @@ def test_read_blocked_evidence_reads_the_pull_request_4922_shape(
         ),
     )
     assert agent_merge_check.read_blocked_evidence(
-        "jl-cmd/claude-dev-env", PULL_REQUEST_4922, "token"
+        "jl-cmd/claude-dev-env", PULL_REQUEST_4922, MAIN_BRANCH_RULES, "token"
     ) == _evidence(behind_by=225)
 
 
@@ -821,7 +890,7 @@ def test_read_merge_queue_ejection_compares_failed_checks_removals_to_the_head(
     )
     assert (
         agent_merge_check.read_merge_queue_ejection(
-            "jl-cmd/claude-dev-env", 1442, "main", "token"
+            "jl-cmd/claude-dev-env", 1442, "main", MAIN_BRANCH_RULES, "token"
         )
         is expected_ejection
     )

package/scripts/test_claude_chain_usage.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+import importlib
+import os
 import subprocess
 import sys
 import urllib.error
@@ -44,18 +46,95 @@ def test_probe_reads_both_meters_and_resets(monkeypatch: pytest.MonkeyPatch) ->
     )
 
 
-def test_probe_rejects_missing_access_token(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_probe_reads_the_session_token_for_the_session_account(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    session_credentials = Path("home") / ".claude" / ".credentials.json"
+    all_fetched_tokens: list[str] = []
+
+    class Windows:
+        session_utilization = 15.0
+        session_resets_at = None
+        weekly_utilization = 70.0
+        weekly_resets_at = None
+
     class Resolver:
         def read_oauth_access_token(self, credentials_path: Path, now: datetime) -> None:
             return None
 
+        def default_credentials_path(self) -> Path:
+            return session_credentials
+
+        def read_session_ingress_token(self) -> str:
+            return "session-token"
+
+        def _fetch_usage_payload(self, access_token: str) -> dict[str, object]:
+            all_fetched_tokens.append(access_token)
+            return {"usage": 70.0}
+
+        def extract_usage_windows(self, payload: dict[str, object]) -> Windows:
+            return Windows()
+
+    monkeypatch.setattr(usage, "_load_resolve_usage_window_module", lambda: Resolver())
+
+    assert usage.probe_account_meters(session_credentials) == usage.AccountUsageMeters(
+        15.0, None, 70.0, None
+    )
+    assert all_fetched_tokens == ["session-token"]
+
+
+def test_probe_rejects_missing_access_token_for_another_account(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    class Resolver:
+        def read_oauth_access_token(self, credentials_path: Path, now: datetime) -> None:
+            return None
+
+        def default_credentials_path(self) -> Path:
+            return Path("home") / ".claude" / ".credentials.json"
+
+        def read_session_ingress_token(self) -> str:
+            return "session-token"
+
         def _fetch_usage_payload(self, access_token: str) -> dict[str, object]:
             pytest.fail("meter request must not run")
 
     monkeypatch.setattr(usage, "_load_resolve_usage_window_module", lambda: Resolver())
 
     with pytest.raises(usage.WeeklyUtilizationProbeError, match="bearer token"):
-        usage.probe_account_meters(Path("account.json"))
+        usage.probe_account_meters(Path("home") / ".claude-profiles" / "ev" / ".credentials.json")
+
+
+def _create_directory_link(*, from_link: Path, to_target: Path) -> None:
+    if sys.platform.startswith("win32"):
+        importlib.import_module("_winapi").CreateJunction(str(to_target), str(from_link))
+        return
+    os.symlink(to_target, from_link, target_is_directory=True)
+
+
+def test_scripts_directory_follows_the_installed_scripts_link(tmp_path: Path) -> None:
+    home = tmp_path.resolve()
+    (home / ".agents" / "scripts").mkdir(parents=True)
+    (home / ".claude").mkdir()
+    _create_directory_link(
+        from_link=home / ".claude" / "scripts", to_target=home / ".agents" / "scripts"
+    )
+
+    scripts_directory = usage._usage_pause_scripts_directory(
+        home / ".claude" / "scripts" / "claude_chain_usage.py"
+    )
+
+    assert scripts_directory == home / ".agents" / "skills" / "usage-pause" / "scripts"
+
+
+def test_scripts_directory_in_the_package_tree(tmp_path: Path) -> None:
+    package_root = tmp_path.resolve() / "claude-dev-env"
+
+    scripts_directory = usage._usage_pause_scripts_directory(
+        package_root / "scripts" / "claude_chain_usage.py"
+    )
+
+    assert scripts_directory == package_root / ".agents" / "skills" / "usage-pause" / "scripts"
 
 
 def test_probe_wraps_network_failure(monkeypatch: pytest.MonkeyPatch) -> None:
@@ -79,7 +158,7 @@ def test_failed_module_load_does_not_poison_cache(
     (tmp_path / "resolve_usage_window.py").write_text(
         "raise ImportError('intentional load failure')\n", encoding="utf-8"
     )
-    monkeypatch.setattr(usage, "_usage_pause_scripts_directory", lambda: tmp_path)
+    monkeypatch.setattr(usage, "_usage_pause_scripts_directory", lambda _module_file: tmp_path)
 
     with pytest.raises(ImportError, match="intentional load failure"):
         usage._load_resolve_usage_window_module()