claude-dev-env 8.6.0 → 8.7.0

package/hooks/blocking/test_code_rules_shared.py

@@ -291,3 +291,21 @@ def test_is_dedicated_constants_module_true_for_config_directory() -> None:
 
 def test_is_dedicated_constants_module_false_for_ordinary_module() -> None:
     assert _SHARED_MODULE._is_dedicated_constants_module("app/services/orders.py") is False
+
+
+@pytest.mark.parametrize(
+    "normalized_marker_table_name",
+    [
+        "ALL_AGENT_HOME_TOOLING_PATTERNS",
+        "ALL_HOOK_INFRASTRUCTURE_PATTERNS",
+        "ALL_WORKFLOW_REGISTRY_PATTERNS",
+        "ALL_MIGRATION_PATH_PATTERNS",
+    ],
+)
+def test_normalized_path_marker_table_carries_no_backslash_entry(
+    normalized_marker_table_name: str,
+) -> None:
+    """Each table's consumer normalizes the path with .replace("\\\\", "/") but
+    not the marker, so a backslash entry can never match."""
+    marker_table = getattr(_SHARED_MODULE, normalized_marker_table_name)
+    assert all("\\" not in each_marker for each_marker in marker_table)

package/hooks/blocking/test_conftest.py

@@ -0,0 +1,35 @@
+"""Tests for the shared fixtures this directory's ``conftest.py`` provides."""
+
+from __future__ import annotations
+
+import pathlib
+
+from code_rules_shared import is_hook_infrastructure
+
+
+def should_yield_a_directory_a_target_inside_it_routes_as_hook_infrastructure(
+    hook_blocking_dir: pathlib.Path,
+) -> None:
+    target_file = hook_blocking_dir / "new_blocker.py"
+    assert is_hook_infrastructure(str(target_file)) is True
+
+
+def should_yield_a_directory_that_exists_on_disk(
+    hook_blocking_dir: pathlib.Path,
+) -> None:
+    assert hook_blocking_dir.is_dir()
+
+
+def should_keep_the_hook_blocking_dir_explanation_only_on_the_fixture() -> None:
+    directory = pathlib.Path(__file__).parent
+    exempt_paths = {directory / "conftest.py", pathlib.Path(__file__)}
+    explanation_fragment = "tail mirrors a production hook directory"
+    offending_files = [
+        path.name
+        for path in sorted(directory.glob("*.py"))
+        if path not in exempt_paths and explanation_fragment in path.read_text(encoding="utf-8")
+    ]
+    assert offending_files == [], (
+        "the hook_blocking_dir fixture's explanation belongs on conftest.py alone, "
+        f"got it repeated in: {offending_files}"
+    )

package/hooks/blocking/test_state_description_blocker.py

@@ -26,6 +26,7 @@ if _HOOKS_ROOT not in sys.path:
 from pre_tool_use_dispatcher import NativeHook, run_native_hook  # noqa: E402
 from state_description_blocker import (  # noqa: E402
     build_deny_payload,
+    find_violations_with_lines,
 )
 from state_description_blocker import evaluate as _evaluate_without_opt_in  # noqa: E402
 
@@ -33,6 +34,11 @@ from code_rules_enforcer_test_support import (
     repository_file_path,
     repository_root,
 )
+from hooks_constants.code_rules_enforcer_constants import (
+    JAVASCRIPT_BLOCK_COMMENT_CLOSER,
+    JAVASCRIPT_BLOCK_COMMENT_OPENER,
+)
+import state_description_blocker as _state_description_blocker_module
 
 HOOK_SCRIPT_PATH = os.path.join(
     os.path.dirname(__file__), "state_description_blocker.py"
@@ -952,3 +958,56 @@ def test_native_dispatch_path_logs_the_block(tmp_path: Path) -> None:
     logged_record = json.loads(all_records[0])
     assert logged_record["hook"] == "state_description_blocker.py"
     assert logged_record["event"] == "PreToolUse"
+
+
+def test_find_violations_with_lines_names_the_docstring_line_not_the_fixture_line() -> None:
+    module_source = (
+        'fixture_text = "the field was previously required"\n'
+        "\n"
+        "\n"
+        "def read_field():\n"
+        '    """Read the field.\n'
+        "\n"
+        "    The field was previously required.\n"
+        '    """\n'
+        "    return 1\n"
+    )
+
+    all_violations = find_violations_with_lines(module_source, "src/module.py")
+
+    assert all_violations == [("previously", 7), ("was previously", 7)]
+
+
+def test_find_violations_with_lines_reports_first_matching_comment_line() -> None:
+    module_source = "x = 1\n# no longer needed\ny = 2\n# no longer used\n"
+
+    all_violations = find_violations_with_lines(module_source, "src/module.py")
+
+    assert all_violations == [("no longer", 2)]
+
+
+def test_find_violations_with_lines_reports_markdown_line_past_a_code_fence() -> None:
+    markdown_source = (
+        "# Title\n"
+        "\n"
+        "```\n"
+        "used to fail\n"
+        "```\n"
+        "\n"
+        "The API was previously public.\n"
+    )
+
+    all_violations = find_violations_with_lines(markdown_source, "docs/api.md")
+
+    assert all_violations == [("previously", 7), ("was previously", 7)]
+
+
+def test_block_comment_markers_are_the_javascript_constants() -> None:
+    assert (
+        _state_description_blocker_module.JAVASCRIPT_BLOCK_COMMENT_OPENER
+        is JAVASCRIPT_BLOCK_COMMENT_OPENER
+    )
+    assert (
+        _state_description_blocker_module.JAVASCRIPT_BLOCK_COMMENT_CLOSER
+        is JAVASCRIPT_BLOCK_COMMENT_CLOSER
+    )

package/hooks/git-hooks/git_hooks_constants/__init__.py

@@ -47,20 +47,7 @@ LOCAL_SHA_FIELD_INDEX: int = 1
 NO_PARSEABLE_STDIN_LINES_MESSAGE: str = (
     "claude-dev-env pre-push: no parseable stdin lines; aborting"
 )
-NO_PARSEABLE_STDIN_LINES_SENTINEL: str = "__no_parseable_stdin_lines__"
-UNRESOLVABLE_MERGE_BASE_SENTINEL: str = "__unresolvable_merge_base__"
-UNRESOLVABLE_MERGE_BASE_MESSAGE: str = (
-    "claude-dev-env pre-push: CODE_RULES validation is pending because the pushed "
-    "object and default branch have no shared merge base. Restore shared history "
-    "or provide a reachable default branch, then run the push again."
-)
 LOCAL_BRANCH_REFERENCE_PREFIX: str = "refs/heads/"
-ORIGIN_HEAD_SYMBOLIC_REFERENCE: str = "refs/remotes/origin/HEAD"
-ORIGIN_REMOTE_TRACKING_REFERENCE_PREFIX: str = "refs/remotes/origin/"
-ALL_DEFAULT_BRANCH_FALLBACK_REFERENCES: tuple[str, ...] = (
-    "refs/remotes/origin/main",
-    "refs/remotes/origin/master",
-)
 REMOTE_BRANCH_REFERENCE_TEMPLATE: str = "refs/remotes/{remote}/{branch}"
 ALL_GIT_SYMBOLIC_REFERENCE_COMMAND_PREFIX: tuple[str, ...] = (
     "git",
@@ -99,7 +86,7 @@ GIT_SYMBOLIC_REFERENCE_SUBCOMMAND: str = "symbolic-ref"
 GIT_COMMAND_TIMEOUT_SECONDS: int = 30
 GH_EXECUTABLE_NAME: str = "gh"
 GH_PR_VIEW_TIMEOUT_SECONDS: int = 5
-GH_PR_VIEW_ARGUMENTS: tuple[str, ...] = ("pr", "view", "--json", "url", "--jq", ".url")
+ALL_GH_PR_VIEW_ARGUMENTS: tuple[str, ...] = ("pr", "view", "--json", "url", "--jq", ".url")
 GIT_FOR_EACH_REF_SUBCOMMAND: str = "for-each-ref"
 GIT_REFERENCE_SHORT_NAME_FORMAT_ARGUMENT: str = "--format=%(refname:short)"
 COMMIT_OBJECT_NAME_SUFFIX: str = "^{commit}"

package/hooks/git-hooks/pull_request_handoff.py

@@ -5,7 +5,7 @@ from pathlib import Path
 
 from git_hooks_constants import (
     GH_EXECUTABLE_NAME,
-    GH_PR_VIEW_ARGUMENTS,
+    ALL_GH_PR_VIEW_ARGUMENTS,
     GH_PR_VIEW_TIMEOUT_SECONDS,
 )
 
@@ -15,7 +15,7 @@ from subprocess_window_access import hidden_window_creation_flags
 def get_pull_request_url(repo_dir: Path) -> str | None:
     try:
         result = subprocess.run(
-            [GH_EXECUTABLE_NAME, *GH_PR_VIEW_ARGUMENTS],
+            [GH_EXECUTABLE_NAME, *ALL_GH_PR_VIEW_ARGUMENTS],
             cwd=repo_dir,
             check=False,
             capture_output=True,

package/hooks/git-hooks/test_config.py

@@ -11,6 +11,13 @@ def test_no_parseable_stdin_lines_message_exists_and_describes_problem() -> None
     assert "no parseable stdin lines" in git_hooks_constants.NO_PARSEABLE_STDIN_LINES_MESSAGE
 
 
-def test_no_parseable_stdin_lines_sentinel_is_distinct_sentinel_value() -> None:
-    assert git_hooks_constants.NO_PARSEABLE_STDIN_LINES_SENTINEL is not None
-    assert git_hooks_constants.NO_PARSEABLE_STDIN_LINES_SENTINEL != git_hooks_constants.DEFAULT_REMOTE_BASE_REFERENCE
+def test_pre_push_cut_leftovers_are_removed() -> None:
+    for removed_name in (
+        "ALL_DEFAULT_BRANCH_FALLBACK_REFERENCES",
+        "ORIGIN_HEAD_SYMBOLIC_REFERENCE",
+        "ORIGIN_REMOTE_TRACKING_REFERENCE_PREFIX",
+        "UNRESOLVABLE_MERGE_BASE_SENTINEL",
+        "UNRESOLVABLE_MERGE_BASE_MESSAGE",
+        "NO_PARSEABLE_STDIN_LINES_SENTINEL",
+    ):
+        assert not hasattr(git_hooks_constants, removed_name)

package/hooks/git-hooks/test_pull_request_handoff.py

@@ -0,0 +1,49 @@
+"""Tests for the pull-request URL query the commit handoff runs."""
+
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+import pytest
+
+import pull_request_handoff
+from git_hooks_constants import (
+    ALL_GH_PR_VIEW_ARGUMENTS,
+    GH_EXECUTABLE_NAME,
+    GH_PR_VIEW_TIMEOUT_SECONDS,
+)
+
+
+def test_should_query_the_url_through_the_named_executable_and_arguments(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    all_calls: list[tuple[list[str], object]] = []
+
+    def record_call(
+        command: list[str], **keyword_arguments: object
+    ) -> subprocess.CompletedProcess[str]:
+        all_calls.append((command, keyword_arguments["timeout"]))
+        return subprocess.CompletedProcess(command, 0, "https://example/pull/1\n", "")
+
+    monkeypatch.setattr(pull_request_handoff.subprocess, "run", record_call)
+
+    url = pull_request_handoff.get_pull_request_url(Path("/repo"))
+
+    assert url == "https://example/pull/1"
+    assert all_calls == [
+        ([GH_EXECUTABLE_NAME, *ALL_GH_PR_VIEW_ARGUMENTS], GH_PR_VIEW_TIMEOUT_SECONDS)
+    ]
+
+
+def test_should_report_no_url_when_the_query_exits_non_zero(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    def failing_call(
+        command: list[str], **keyword_arguments: object
+    ) -> subprocess.CompletedProcess[str]:
+        return subprocess.CompletedProcess(command, 1, "", "no pull request")
+
+    monkeypatch.setattr(pull_request_handoff.subprocess, "run", failing_call)
+
+    assert pull_request_handoff.get_pull_request_url(Path("/repo")) is None

package/hooks/git-hooks/test_verification_notice_state.py

@@ -0,0 +1,50 @@
+"""Tests for the base-reference construction in ``_base_matches_current``."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+import verification_notice
+import verification_notice_state
+from git_hooks_constants import COMMIT_OBJECT_NAME_SUFFIX
+from git_hooks_constants.verification_notice_constants import (
+    ALL_GIT_BASE_QUERY_PREFIX,
+    BASE_REFERENCE,
+)
+
+
+def test_base_matches_current_queries_base_reference_plus_commit_suffix() -> None:
+    captured_queries: list[tuple[str, ...]] = []
+
+    def _fake_git_query(
+        repository_root: Path, arguments: tuple[str, ...], capture_stderr: bool
+    ) -> str | None:
+        captured_queries.append(arguments)
+        return "deadbeef"
+
+    verification_notice_state._base_matches_current(Path("/repo"), "deadbeef", _fake_git_query)
+
+    assert captured_queries == [
+        (*ALL_GIT_BASE_QUERY_PREFIX, BASE_REFERENCE + COMMIT_OBJECT_NAME_SUFFIX)
+    ]
+
+
+def test_base_matches_current_derives_its_query_from_the_base_reference_constant(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(verification_notice_state, "BASE_REFERENCE", "custom/base")
+    captured_queries: list[tuple[str, ...]] = []
+
+    def _fake_git_query(
+        repository_root: Path, arguments: tuple[str, ...], capture_stderr: bool
+    ) -> str | None:
+        captured_queries.append(arguments)
+        return None
+
+    verification_notice_state._base_matches_current(Path("/repo"), "deadbeef", _fake_git_query)
+
+    assert captured_queries == [
+        (*ALL_GIT_BASE_QUERY_PREFIX, "custom/base" + COMMIT_OBJECT_NAME_SUFFIX)
+    ]

package/hooks/git-hooks/verification_notice_state.py

@@ -6,8 +6,10 @@ from collections.abc import Callable, Mapping
 from pathlib import Path
 from typing import Protocol
 
+from git_hooks_constants import COMMIT_OBJECT_NAME_SUFFIX
 from git_hooks_constants.verification_notice_constants import (
     ALL_GIT_BASE_QUERY_PREFIX,
+    BASE_REFERENCE,
     GIT_COMMAND_SUCCESS_EXIT_CODE,
     HEX_DIGITS,
     NOTICE_FAILED_LINE,
@@ -180,7 +182,7 @@ def _base_matches_current(
 ) -> bool:
     current_base_revision = run_git_query(
         repository_root,
-        (*ALL_GIT_BASE_QUERY_PREFIX, "origin/main^{commit}"),
+        (*ALL_GIT_BASE_QUERY_PREFIX, BASE_REFERENCE + COMMIT_OBJECT_NAME_SUFFIX),
         False,
     )
     return current_base_revision == base_revision

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -38,10 +38,13 @@ CLAUDE_JOB_DIR_SCRATCH_SUBDIRECTORY: str = "tmp"
 EPHEMERAL_EXEMPT_DISABLE_ENVIRONMENT_VARIABLE_NAME: str = "CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT"
 ALL_EPHEMERAL_EXEMPT_DISABLE_TRUTHY_VALUES: frozenset[str] = frozenset({"1", "true", "yes", "on"})
 LEADING_DRIVE_LETTER_PATTERN: re.Pattern[str] = re.compile(r"^[a-z]:")
-ALL_AGENT_HOME_TOOLING_PATTERNS = {"/.grok/", "\\.grok\\", "\\.grok/"}
-ALL_HOOK_INFRASTRUCTURE_PATTERNS = {"/.claude/hooks/", "\\.claude\\hooks\\", "\\.claude/hooks/", "/packages/claude-dev-env/hooks/", "\\packages\\claude-dev-env\\hooks\\"} | ALL_AGENT_HOME_TOOLING_PATTERNS
-ALL_WORKFLOW_REGISTRY_PATTERNS = {"/workflow/", "\\workflow\\", "_tab.py", "/states.py", "\\states.py", "/modules.py", "\\modules.py"}
-ALL_MIGRATION_PATH_PATTERNS = {"/migrations/", "\\migrations\\"}
+ALL_AGENT_HOME_TOOLING_PATTERNS = {"/.grok/"}
+ALL_HOOK_INFRASTRUCTURE_PATTERNS = {
+    "/.claude/hooks/",
+    "/packages/claude-dev-env/hooks/",
+} | ALL_AGENT_HOME_TOOLING_PATTERNS
+ALL_WORKFLOW_REGISTRY_PATTERNS = {"/workflow/", "_tab.py", "/states.py", "/modules.py"}
+ALL_MIGRATION_PATH_PATTERNS = {"/migrations/"}
 
 CONSTANTS_MODULE_SUFFIX: str = "_constants.py"
 CONFIG_DIRECTORY_SEGMENT: str = "config"
@@ -192,7 +195,12 @@ ALL_COLLECTION_TYPE_NAMES: frozenset[str] = frozenset({
 })
 ALL_SUBSCRIPT_ONLY_COLLECTION_TYPE_NAMES: frozenset[str] = frozenset({"dict"})
 COLLECTION_BY_NAME_PATTERN: re.Pattern[str] = re.compile(r"^[a-z][a-z0-9]*_by_[a-z][a-z0-9_]*$")
-ALL_CLI_FILE_PATH_MARKERS: tuple[str, ...] = ("/scripts/", "\\scripts\\", "_cli.py", "/cli.py", "\\cli.py")
+ALL_CLI_FILE_PATH_MARKERS: tuple[str, ...] = (
+    "/scripts/",
+    "/diagnostics/",
+    "_cli.py",
+    "/cli.py",
+)
 
 LOGGING_FSTRING_PATTERN = re.compile(
     r'\b(?:log_(?:debug|info|warning|error|critical|exception)'

package/hooks/hooks_constants/refactor_guard_constants.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+GIT_EXECUTABLE_TOKEN: str = "git"
+GIT_COMMAND_TIMEOUT_SECONDS: int = 5
 MAXIMUM_REFACTOR_LINE_DELTA: int = 3
 REFACTOR_LINE_DELTA_DIVISOR: int = 2
 CHANGED_SURFACE_MATCH_RATIO: float = 0.5

package/hooks/hooks_constants/session_edit_stage_gate_constants.py

@@ -1,9 +1,9 @@
 """Constants for the session-edit stage gate hook trio.
 
 Shared by the PostToolUse tracker
-(``hooks/observability/session_file_edit_tracker.py``), the PreToolUse gate
-(``hooks/blocking/session_edit_stage_gate.py``), and the SessionStart cleanup
-(``hooks/session/session_edit_tracker_cleanup.py``): the per-session tracker
+(``hooks/observability/session_file_edit_tracker.py``) and the SessionStart
+cleanup (``hooks/session/session_edit_tracker_cleanup.py``): the per-session
+tracker
 filename shape and JSON payload key, the session-id sanitize pattern, the
 SessionStart source key and the fresh-startup source value the cleanup keys its
 deletion on, the edit-tool name set, the per-session lock filename suffix and
@@ -62,7 +62,6 @@ ALL_TRACKED_UNSTAGED_FILES_COMMAND: tuple[str, ...] = (
 
 PARTIAL_COMMIT_BYPASS_MARKER: str = "# partial-commit"
 COMMIT_SUBCOMMAND_TOKEN: str = "commit"
-GIT_EXECUTABLE_TOKEN: str = "git"
 ENV_ASSIGNMENT_PREFIX_PATTERN: re.Pattern[str] = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=")
 ALL_STAGING_SUBCOMMAND_TOKENS: frozenset[str] = frozenset({"add", "stage"})
 ALL_STAGE_ALL_ADD_FLAG_TOKENS: frozenset[str] = frozenset({"-A", "--all", "-u", "--update"})

package/hooks/hooks_constants/state_description_blocker_constants.py

@@ -40,12 +40,13 @@ ALL_COMMENT_TRANSITION_PATTERNS: list[Pattern[str]] = [
     compile(r"\bas of\b", IGNORECASE),
 ]
 
-CODE_FENCE_PATTERN: Pattern[str] = compile(r"```[\s\S]*?```")
 INLINE_CODE_PATTERN: Pattern[str] = compile(r"``[^`]+``|`[^`]+`")
 DOUBLE_QUOTED_SPAN_PATTERN: Pattern[str] = compile(r'"[^"\n]*"')
 TRIPLE_QUOTED_BLOCK_PATTERN: Pattern[str] = compile(
     r'"""([\s\S]*?)"""|\'\'\'([\s\S]*?)\'\'\''
 )
+DOUBLE_QUOTE_BODY_GROUP: int = 1
+SINGLE_QUOTE_BODY_GROUP: int = 2
 
 PYTHON_EXTENSION: str = ".py"
 

package/hooks/hooks_constants/test_state_description_blocker_constants.py

@@ -0,0 +1,87 @@
+"""Behavior tests for state_description_blocker configuration constants."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_HOOKS_ROOT = Path(__file__).resolve().parent.parent
+if str(_HOOKS_ROOT) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_ROOT))
+
+from blocking.state_description_blocker import _extract_comment_lines
+from hooks_constants.code_rules_enforcer_constants import (
+    JAVASCRIPT_BLOCK_COMMENT_CLOSER,
+    JAVASCRIPT_BLOCK_COMMENT_OPENER,
+)
+from hooks_constants.state_description_blocker_constants import (
+    ALL_BLOCK_COMMENT_EXTENSIONS,
+    ALL_COMMENT_TRANSITION_PATTERNS,
+    ALL_HASH_ONLY_EXTENSIONS,
+    ALL_MARKDOWN_EXTENSIONS,
+    DOUBLE_QUOTE_BODY_GROUP,
+    SINGLE_QUOTE_BODY_GROUP,
+    TRIPLE_QUOTED_BLOCK_PATTERN,
+)
+
+
+def test_transition_patterns_match_their_own_phrase() -> None:
+    all_phrases = [
+        "instead of",
+        "previously",
+        "was previously",
+        "used to",
+        "no longer",
+        "switched to",
+    ]
+    for each_phrase in all_phrases:
+        sentence = f"The field is {each_phrase} required."
+        assert any(
+            each_pattern.search(sentence) for each_pattern in ALL_COMMENT_TRANSITION_PATTERNS
+        ), each_phrase
+
+
+def test_transition_patterns_do_not_match_unrelated_prose() -> None:
+    sentence = "The path selects the scan strategy for the file."
+    assert not any(
+        each_pattern.search(sentence) for each_pattern in ALL_COMMENT_TRANSITION_PATTERNS
+    )
+
+
+def test_block_comment_markers_close_a_single_line_block_comment() -> None:
+    text = f"{JAVASCRIPT_BLOCK_COMMENT_OPENER} note {JAVASCRIPT_BLOCK_COMMENT_CLOSER}\ncode();"
+    all_comment_lines = _extract_comment_lines(text, ".js")
+    assert all_comment_lines == [
+        (1, f"{JAVASCRIPT_BLOCK_COMMENT_OPENER} note {JAVASCRIPT_BLOCK_COMMENT_CLOSER}")
+    ]
+
+
+def test_block_comment_markers_carry_an_unclosed_comment_to_the_next_line() -> None:
+    text = f"{JAVASCRIPT_BLOCK_COMMENT_OPENER} still open\nclosed here {JAVASCRIPT_BLOCK_COMMENT_CLOSER}"
+    all_comment_lines = _extract_comment_lines(text, ".js")
+    assert all_comment_lines == [
+        (1, f"{JAVASCRIPT_BLOCK_COMMENT_OPENER} still open"),
+        (2, f"closed here {JAVASCRIPT_BLOCK_COMMENT_CLOSER}"),
+    ]
+
+
+def test_double_and_single_quote_body_groups_index_the_matching_quote_style() -> None:
+    double_quoted_match = TRIPLE_QUOTED_BLOCK_PATTERN.search('"""double body"""')
+    assert double_quoted_match is not None
+    assert double_quoted_match.group(DOUBLE_QUOTE_BODY_GROUP) == "double body"
+    assert double_quoted_match.group(SINGLE_QUOTE_BODY_GROUP) is None
+
+    single_quoted_match = TRIPLE_QUOTED_BLOCK_PATTERN.search("'''single body'''")
+    assert single_quoted_match is not None
+    assert single_quoted_match.group(SINGLE_QUOTE_BODY_GROUP) == "single body"
+    assert single_quoted_match.group(DOUBLE_QUOTE_BODY_GROUP) is None
+
+
+def test_extension_sets_are_disjoint_from_markdown_extensions() -> None:
+    assert not (ALL_HASH_ONLY_EXTENSIONS & ALL_MARKDOWN_EXTENSIONS)
+    assert not (ALL_BLOCK_COMMENT_EXTENSIONS & ALL_MARKDOWN_EXTENSIONS)
+
+
+def test_python_is_hash_only_and_never_block_comment() -> None:
+    assert ".py" in ALL_HASH_ONLY_EXTENSIONS
+    assert ".py" not in ALL_BLOCK_COMMENT_EXTENSIONS

package/hooks/validators/exempt_paths.py

@@ -48,27 +48,21 @@ TEST_PATH_PATTERNS: frozenset[str] = frozenset(
 HOOK_INFRASTRUCTURE_PATTERNS: frozenset[str] = frozenset(
     {
         "/.claude/hooks/",
-        "\\.claude\\hooks\\",
-        "\\.claude/hooks/",
     }
 )
 
 WORKFLOW_REGISTRY_PATTERNS: frozenset[str] = frozenset(
     {
         "/workflow/",
-        "\\workflow\\",
         "_tab.py",
         "/states.py",
-        "\\states.py",
         "/modules.py",
-        "\\modules.py",
     }
 )
 
 MIGRATION_PATH_PATTERNS: frozenset[str] = frozenset(
     {
         "/migrations/",
-        "\\migrations\\",
     }
 )
 
@@ -80,23 +74,14 @@ def is_test_file(file_path: str) -> bool:
 
 def is_hook_infrastructure(file_path: str) -> bool:
     path_normalized = file_path.lower().replace("\\", "/")
-    return any(
-        pattern.replace("\\", "/") in path_normalized
-        for pattern in HOOK_INFRASTRUCTURE_PATTERNS
-    )
+    return any(pattern in path_normalized for pattern in HOOK_INFRASTRUCTURE_PATTERNS)
 
 
 def is_workflow_registry_file(file_path: str) -> bool:
     path_normalized = file_path.lower().replace("\\", "/")
-    return any(
-        pattern.replace("\\", "/") in path_normalized
-        for pattern in WORKFLOW_REGISTRY_PATTERNS
-    )
+    return any(pattern in path_normalized for pattern in WORKFLOW_REGISTRY_PATTERNS)
 
 
 def is_migration_file(file_path: str) -> bool:
     path_normalized = file_path.lower().replace("\\", "/")
-    return any(
-        pattern.replace("\\", "/") in path_normalized
-        for pattern in MIGRATION_PATH_PATTERNS
-    )
+    return any(pattern in path_normalized for pattern in MIGRATION_PATH_PATTERNS)

package/hooks/validators/test_exempt_paths.py

@@ -14,6 +14,9 @@ _BLOCKING_DIR = str(Path(__file__).resolve().parent.parent / "blocking")
 if _BLOCKING_DIR not in sys.path:
     sys.path.insert(0, _BLOCKING_DIR)
 
+import pytest  # noqa: E402
+
+from validators import exempt_paths  # noqa: E402
 from validators.exempt_paths import is_config_file  # noqa: E402
 from code_rules_path_utils import is_config_file as path_utils_is_config_file  # noqa: E402
 
@@ -63,3 +66,20 @@ def test_is_config_file_is_identical_function_object_from_path_utils() -> None:
     assert is_config_file is path_utils_is_config_file, (
         "exempt_paths.is_config_file must be imported from code_rules_path_utils, not re-defined"
     )
+
+
+@pytest.mark.parametrize(
+    "normalized_pattern_set_name",
+    [
+        "HOOK_INFRASTRUCTURE_PATTERNS",
+        "WORKFLOW_REGISTRY_PATTERNS",
+        "MIGRATION_PATH_PATTERNS",
+    ],
+)
+def test_normalized_pattern_set_carries_no_backslash_entry(
+    normalized_pattern_set_name: str,
+) -> None:
+    """Each set's consumer normalizes the path with .replace("\\\\", "/") but
+    not the pattern, so a backslash entry can never match."""
+    pattern_set = getattr(exempt_paths, normalized_pattern_set_name)
+    assert all("\\" not in each_pattern for each_pattern in pattern_set)

package/hooks/validators/test_python_antipattern_checks.py

@@ -150,6 +150,18 @@ class TestPrintInCliEntryPoint:
         tree = ast.parse(CLI_ENTRY_POINT_WITH_PRINTS)
         assert check_print_in_production(tree, "packages/foo/scripts/run_job.py") == []
 
+    def test_diagnostics_path_allows_print(self) -> None:
+        tree = ast.parse(CLI_ENTRY_POINT_WITH_PRINTS)
+        assert check_print_in_production(tree, "theme_exports/tools/diagnostics/probe.py") == []
+
+    def test_windows_diagnostics_path_allows_print(self) -> None:
+        tree = ast.parse(CLI_ENTRY_POINT_WITH_PRINTS)
+        assert check_print_in_production(tree, "theme_exports\\tools\\diagnostics\\probe.py") == []
+
+    def test_near_miss_diagnostics_name_still_flagged(self) -> None:
+        tree = ast.parse(NEAR_MISS_WITH_PRINT)
+        assert len(check_print_in_production(tree, "run_diagnostics.py")) == 1
+
     def test_near_miss_name_still_flagged(self) -> None:
         tree = ast.parse(NEAR_MISS_WITH_PRINT)
         assert len(check_print_in_production(tree, "publicli.py")) == 1
@@ -180,6 +192,8 @@ class TestCrossSurfaceConsistency:
             "stp_preview/renderer.py",
             "publicli.py",
             "packages/foo/scripts/run_job.py",
+            "theme_exports/tools/diagnostics/probe.py",
+            "run_diagnostics.py",
         ):
             production_allows = check_print_in_production(tree, path) == []
             library_allows = check_library_print(source, path) == []

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.6.0",
+    "version": "8.7.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {