claude-dev-env 8.6.1 → 8.7.0

package/hooks/blocking/test_code_rules_enforcer_zero_payload_alias_hook_routing.py

@@ -7,19 +7,16 @@ through ``validate_content_for_edit_lane``, which hook files never reach at PreT
 tests drive the real ``main()`` stdin entry point and the pre-check CLI with a
 hook-infrastructure target.
 
-Each test builds a temporary tree whose tail mirrors a production hook directory
-(``packages/claude-dev-env/hooks/blocking``) so ``is_hook_infrastructure`` matches
-the target path the same way it would for the real directory.
+Each test takes the ``hook_blocking_dir`` fixture from ``conftest.py``, which builds
+a temporary tree matching the production hook directory so ``is_hook_infrastructure``
+routes a target inside it the same way it would for the production directory.
 """
 
 from __future__ import annotations
 
 import json
 import pathlib
-import shutil
 import sys
-import tempfile
-from collections.abc import Iterator
 
 import pytest
 
@@ -46,19 +43,6 @@ PASS_THROUGH_ALIAS_SOURCE = (
     "    return find_bare_path_segments(content)\n"
 )
 
-_HOOK_INFRASTRUCTURE_TAIL = pathlib.Path("packages") / "claude-dev-env" / "hooks" / "blocking"
-
-
-@pytest.fixture
-def hook_blocking_dir() -> Iterator[pathlib.Path]:
-    base_directory = pathlib.Path(tempfile.mkdtemp())
-    blocking_directory = base_directory / _HOOK_INFRASTRUCTURE_TAIL
-    blocking_directory.mkdir(parents=True)
-    try:
-        yield blocking_directory
-    finally:
-        shutil.rmtree(base_directory, ignore_errors=False)
-
 
 def test_write_of_pass_through_alias_into_hook_directory_denies(
     hook_blocking_dir: pathlib.Path,

package/hooks/blocking/test_code_rules_shared.py

@@ -291,3 +291,21 @@ def test_is_dedicated_constants_module_true_for_config_directory() -> None:
 
 def test_is_dedicated_constants_module_false_for_ordinary_module() -> None:
     assert _SHARED_MODULE._is_dedicated_constants_module("app/services/orders.py") is False
+
+
+@pytest.mark.parametrize(
+    "normalized_marker_table_name",
+    [
+        "ALL_AGENT_HOME_TOOLING_PATTERNS",
+        "ALL_HOOK_INFRASTRUCTURE_PATTERNS",
+        "ALL_WORKFLOW_REGISTRY_PATTERNS",
+        "ALL_MIGRATION_PATH_PATTERNS",
+    ],
+)
+def test_normalized_path_marker_table_carries_no_backslash_entry(
+    normalized_marker_table_name: str,
+) -> None:
+    """Each table's consumer normalizes the path with .replace("\\\\", "/") but
+    not the marker, so a backslash entry can never match."""
+    marker_table = getattr(_SHARED_MODULE, normalized_marker_table_name)
+    assert all("\\" not in each_marker for each_marker in marker_table)

package/hooks/blocking/test_conftest.py

@@ -0,0 +1,35 @@
+"""Tests for the shared fixtures this directory's ``conftest.py`` provides."""
+
+from __future__ import annotations
+
+import pathlib
+
+from code_rules_shared import is_hook_infrastructure
+
+
+def should_yield_a_directory_a_target_inside_it_routes_as_hook_infrastructure(
+    hook_blocking_dir: pathlib.Path,
+) -> None:
+    target_file = hook_blocking_dir / "new_blocker.py"
+    assert is_hook_infrastructure(str(target_file)) is True
+
+
+def should_yield_a_directory_that_exists_on_disk(
+    hook_blocking_dir: pathlib.Path,
+) -> None:
+    assert hook_blocking_dir.is_dir()
+
+
+def should_keep_the_hook_blocking_dir_explanation_only_on_the_fixture() -> None:
+    directory = pathlib.Path(__file__).parent
+    exempt_paths = {directory / "conftest.py", pathlib.Path(__file__)}
+    explanation_fragment = "tail mirrors a production hook directory"
+    offending_files = [
+        path.name
+        for path in sorted(directory.glob("*.py"))
+        if path not in exempt_paths and explanation_fragment in path.read_text(encoding="utf-8")
+    ]
+    assert offending_files == [], (
+        "the hook_blocking_dir fixture's explanation belongs on conftest.py alone, "
+        f"got it repeated in: {offending_files}"
+    )

package/hooks/blocking/test_state_description_blocker.py

@@ -34,6 +34,11 @@ from code_rules_enforcer_test_support import (
     repository_file_path,
     repository_root,
 )
+from hooks_constants.code_rules_enforcer_constants import (
+    JAVASCRIPT_BLOCK_COMMENT_CLOSER,
+    JAVASCRIPT_BLOCK_COMMENT_OPENER,
+)
+import state_description_blocker as _state_description_blocker_module
 
 HOOK_SCRIPT_PATH = os.path.join(
     os.path.dirname(__file__), "state_description_blocker.py"
@@ -995,3 +1000,14 @@ def test_find_violations_with_lines_reports_markdown_line_past_a_code_fence() ->
     all_violations = find_violations_with_lines(markdown_source, "docs/api.md")
 
     assert all_violations == [("previously", 7), ("was previously", 7)]
+
+
+def test_block_comment_markers_are_the_javascript_constants() -> None:
+    assert (
+        _state_description_blocker_module.JAVASCRIPT_BLOCK_COMMENT_OPENER
+        is JAVASCRIPT_BLOCK_COMMENT_OPENER
+    )
+    assert (
+        _state_description_blocker_module.JAVASCRIPT_BLOCK_COMMENT_CLOSER
+        is JAVASCRIPT_BLOCK_COMMENT_CLOSER
+    )

package/hooks/git-hooks/git_hooks_constants/__init__.py

@@ -47,20 +47,7 @@ LOCAL_SHA_FIELD_INDEX: int = 1
 NO_PARSEABLE_STDIN_LINES_MESSAGE: str = (
     "claude-dev-env pre-push: no parseable stdin lines; aborting"
 )
-NO_PARSEABLE_STDIN_LINES_SENTINEL: str = "__no_parseable_stdin_lines__"
-UNRESOLVABLE_MERGE_BASE_SENTINEL: str = "__unresolvable_merge_base__"
-UNRESOLVABLE_MERGE_BASE_MESSAGE: str = (
-    "claude-dev-env pre-push: CODE_RULES validation is pending because the pushed "
-    "object and default branch have no shared merge base. Restore shared history "
-    "or provide a reachable default branch, then run the push again."
-)
 LOCAL_BRANCH_REFERENCE_PREFIX: str = "refs/heads/"
-ORIGIN_HEAD_SYMBOLIC_REFERENCE: str = "refs/remotes/origin/HEAD"
-ORIGIN_REMOTE_TRACKING_REFERENCE_PREFIX: str = "refs/remotes/origin/"
-ALL_DEFAULT_BRANCH_FALLBACK_REFERENCES: tuple[str, ...] = (
-    "refs/remotes/origin/main",
-    "refs/remotes/origin/master",
-)
 REMOTE_BRANCH_REFERENCE_TEMPLATE: str = "refs/remotes/{remote}/{branch}"
 ALL_GIT_SYMBOLIC_REFERENCE_COMMAND_PREFIX: tuple[str, ...] = (
     "git",
@@ -99,7 +86,7 @@ GIT_SYMBOLIC_REFERENCE_SUBCOMMAND: str = "symbolic-ref"
 GIT_COMMAND_TIMEOUT_SECONDS: int = 30
 GH_EXECUTABLE_NAME: str = "gh"
 GH_PR_VIEW_TIMEOUT_SECONDS: int = 5
-GH_PR_VIEW_ARGUMENTS: tuple[str, ...] = ("pr", "view", "--json", "url", "--jq", ".url")
+ALL_GH_PR_VIEW_ARGUMENTS: tuple[str, ...] = ("pr", "view", "--json", "url", "--jq", ".url")
 GIT_FOR_EACH_REF_SUBCOMMAND: str = "for-each-ref"
 GIT_REFERENCE_SHORT_NAME_FORMAT_ARGUMENT: str = "--format=%(refname:short)"
 COMMIT_OBJECT_NAME_SUFFIX: str = "^{commit}"

package/hooks/git-hooks/pull_request_handoff.py

@@ -5,7 +5,7 @@ from pathlib import Path
 
 from git_hooks_constants import (
     GH_EXECUTABLE_NAME,
-    GH_PR_VIEW_ARGUMENTS,
+    ALL_GH_PR_VIEW_ARGUMENTS,
     GH_PR_VIEW_TIMEOUT_SECONDS,
 )
 
@@ -15,7 +15,7 @@ from subprocess_window_access import hidden_window_creation_flags
 def get_pull_request_url(repo_dir: Path) -> str | None:
     try:
         result = subprocess.run(
-            [GH_EXECUTABLE_NAME, *GH_PR_VIEW_ARGUMENTS],
+            [GH_EXECUTABLE_NAME, *ALL_GH_PR_VIEW_ARGUMENTS],
             cwd=repo_dir,
             check=False,
             capture_output=True,

package/hooks/git-hooks/test_config.py

@@ -11,6 +11,13 @@ def test_no_parseable_stdin_lines_message_exists_and_describes_problem() -> None
     assert "no parseable stdin lines" in git_hooks_constants.NO_PARSEABLE_STDIN_LINES_MESSAGE
 
 
-def test_no_parseable_stdin_lines_sentinel_is_distinct_sentinel_value() -> None:
-    assert git_hooks_constants.NO_PARSEABLE_STDIN_LINES_SENTINEL is not None
-    assert git_hooks_constants.NO_PARSEABLE_STDIN_LINES_SENTINEL != git_hooks_constants.DEFAULT_REMOTE_BASE_REFERENCE
+def test_pre_push_cut_leftovers_are_removed() -> None:
+    for removed_name in (
+        "ALL_DEFAULT_BRANCH_FALLBACK_REFERENCES",
+        "ORIGIN_HEAD_SYMBOLIC_REFERENCE",
+        "ORIGIN_REMOTE_TRACKING_REFERENCE_PREFIX",
+        "UNRESOLVABLE_MERGE_BASE_SENTINEL",
+        "UNRESOLVABLE_MERGE_BASE_MESSAGE",
+        "NO_PARSEABLE_STDIN_LINES_SENTINEL",
+    ):
+        assert not hasattr(git_hooks_constants, removed_name)

package/hooks/git-hooks/test_pull_request_handoff.py

@@ -0,0 +1,49 @@
+"""Tests for the pull-request URL query the commit handoff runs."""
+
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+import pytest
+
+import pull_request_handoff
+from git_hooks_constants import (
+    ALL_GH_PR_VIEW_ARGUMENTS,
+    GH_EXECUTABLE_NAME,
+    GH_PR_VIEW_TIMEOUT_SECONDS,
+)
+
+
+def test_should_query_the_url_through_the_named_executable_and_arguments(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    all_calls: list[tuple[list[str], object]] = []
+
+    def record_call(
+        command: list[str], **keyword_arguments: object
+    ) -> subprocess.CompletedProcess[str]:
+        all_calls.append((command, keyword_arguments["timeout"]))
+        return subprocess.CompletedProcess(command, 0, "https://example/pull/1\n", "")
+
+    monkeypatch.setattr(pull_request_handoff.subprocess, "run", record_call)
+
+    url = pull_request_handoff.get_pull_request_url(Path("/repo"))
+
+    assert url == "https://example/pull/1"
+    assert all_calls == [
+        ([GH_EXECUTABLE_NAME, *ALL_GH_PR_VIEW_ARGUMENTS], GH_PR_VIEW_TIMEOUT_SECONDS)
+    ]
+
+
+def test_should_report_no_url_when_the_query_exits_non_zero(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    def failing_call(
+        command: list[str], **keyword_arguments: object
+    ) -> subprocess.CompletedProcess[str]:
+        return subprocess.CompletedProcess(command, 1, "", "no pull request")
+
+    monkeypatch.setattr(pull_request_handoff.subprocess, "run", failing_call)
+
+    assert pull_request_handoff.get_pull_request_url(Path("/repo")) is None

package/hooks/git-hooks/test_verification_notice_state.py

@@ -0,0 +1,50 @@
+"""Tests for the base-reference construction in ``_base_matches_current``."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+import verification_notice
+import verification_notice_state
+from git_hooks_constants import COMMIT_OBJECT_NAME_SUFFIX
+from git_hooks_constants.verification_notice_constants import (
+    ALL_GIT_BASE_QUERY_PREFIX,
+    BASE_REFERENCE,
+)
+
+
+def test_base_matches_current_queries_base_reference_plus_commit_suffix() -> None:
+    captured_queries: list[tuple[str, ...]] = []
+
+    def _fake_git_query(
+        repository_root: Path, arguments: tuple[str, ...], capture_stderr: bool
+    ) -> str | None:
+        captured_queries.append(arguments)
+        return "deadbeef"
+
+    verification_notice_state._base_matches_current(Path("/repo"), "deadbeef", _fake_git_query)
+
+    assert captured_queries == [
+        (*ALL_GIT_BASE_QUERY_PREFIX, BASE_REFERENCE + COMMIT_OBJECT_NAME_SUFFIX)
+    ]
+
+
+def test_base_matches_current_derives_its_query_from_the_base_reference_constant(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(verification_notice_state, "BASE_REFERENCE", "custom/base")
+    captured_queries: list[tuple[str, ...]] = []
+
+    def _fake_git_query(
+        repository_root: Path, arguments: tuple[str, ...], capture_stderr: bool
+    ) -> str | None:
+        captured_queries.append(arguments)
+        return None
+
+    verification_notice_state._base_matches_current(Path("/repo"), "deadbeef", _fake_git_query)
+
+    assert captured_queries == [
+        (*ALL_GIT_BASE_QUERY_PREFIX, "custom/base" + COMMIT_OBJECT_NAME_SUFFIX)
+    ]

package/hooks/git-hooks/verification_notice_state.py

@@ -6,8 +6,10 @@ from collections.abc import Callable, Mapping
 from pathlib import Path
 from typing import Protocol
 
+from git_hooks_constants import COMMIT_OBJECT_NAME_SUFFIX
 from git_hooks_constants.verification_notice_constants import (
     ALL_GIT_BASE_QUERY_PREFIX,
+    BASE_REFERENCE,
     GIT_COMMAND_SUCCESS_EXIT_CODE,
     HEX_DIGITS,
     NOTICE_FAILED_LINE,
@@ -180,7 +182,7 @@ def _base_matches_current(
 ) -> bool:
     current_base_revision = run_git_query(
         repository_root,
-        (*ALL_GIT_BASE_QUERY_PREFIX, "origin/main^{commit}"),
+        (*ALL_GIT_BASE_QUERY_PREFIX, BASE_REFERENCE + COMMIT_OBJECT_NAME_SUFFIX),
         False,
     )
     return current_base_revision == base_revision

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -38,10 +38,13 @@ CLAUDE_JOB_DIR_SCRATCH_SUBDIRECTORY: str = "tmp"
 EPHEMERAL_EXEMPT_DISABLE_ENVIRONMENT_VARIABLE_NAME: str = "CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT"
 ALL_EPHEMERAL_EXEMPT_DISABLE_TRUTHY_VALUES: frozenset[str] = frozenset({"1", "true", "yes", "on"})
 LEADING_DRIVE_LETTER_PATTERN: re.Pattern[str] = re.compile(r"^[a-z]:")
-ALL_AGENT_HOME_TOOLING_PATTERNS = {"/.grok/", "\\.grok\\", "\\.grok/"}
-ALL_HOOK_INFRASTRUCTURE_PATTERNS = {"/.claude/hooks/", "\\.claude\\hooks\\", "\\.claude/hooks/", "/packages/claude-dev-env/hooks/", "\\packages\\claude-dev-env\\hooks\\"} | ALL_AGENT_HOME_TOOLING_PATTERNS
-ALL_WORKFLOW_REGISTRY_PATTERNS = {"/workflow/", "\\workflow\\", "_tab.py", "/states.py", "\\states.py", "/modules.py", "\\modules.py"}
-ALL_MIGRATION_PATH_PATTERNS = {"/migrations/", "\\migrations\\"}
+ALL_AGENT_HOME_TOOLING_PATTERNS = {"/.grok/"}
+ALL_HOOK_INFRASTRUCTURE_PATTERNS = {
+    "/.claude/hooks/",
+    "/packages/claude-dev-env/hooks/",
+} | ALL_AGENT_HOME_TOOLING_PATTERNS
+ALL_WORKFLOW_REGISTRY_PATTERNS = {"/workflow/", "_tab.py", "/states.py", "/modules.py"}
+ALL_MIGRATION_PATH_PATTERNS = {"/migrations/"}
 
 CONSTANTS_MODULE_SUFFIX: str = "_constants.py"
 CONFIG_DIRECTORY_SEGMENT: str = "config"
@@ -192,7 +195,12 @@ ALL_COLLECTION_TYPE_NAMES: frozenset[str] = frozenset({
 })
 ALL_SUBSCRIPT_ONLY_COLLECTION_TYPE_NAMES: frozenset[str] = frozenset({"dict"})
 COLLECTION_BY_NAME_PATTERN: re.Pattern[str] = re.compile(r"^[a-z][a-z0-9]*_by_[a-z][a-z0-9_]*$")
-ALL_CLI_FILE_PATH_MARKERS: tuple[str, ...] = ("/scripts/", "\\scripts\\", "_cli.py", "/cli.py", "\\cli.py")
+ALL_CLI_FILE_PATH_MARKERS: tuple[str, ...] = (
+    "/scripts/",
+    "/diagnostics/",
+    "_cli.py",
+    "/cli.py",
+)
 
 LOGGING_FSTRING_PATTERN = re.compile(
     r'\b(?:log_(?:debug|info|warning|error|critical|exception)'

package/hooks/hooks_constants/refactor_guard_constants.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+GIT_EXECUTABLE_TOKEN: str = "git"
+GIT_COMMAND_TIMEOUT_SECONDS: int = 5
 MAXIMUM_REFACTOR_LINE_DELTA: int = 3
 REFACTOR_LINE_DELTA_DIVISOR: int = 2
 CHANGED_SURFACE_MATCH_RATIO: float = 0.5

package/hooks/hooks_constants/session_edit_stage_gate_constants.py

@@ -1,9 +1,9 @@
 """Constants for the session-edit stage gate hook trio.
 
 Shared by the PostToolUse tracker
-(``hooks/observability/session_file_edit_tracker.py``), the PreToolUse gate
-(``hooks/blocking/session_edit_stage_gate.py``), and the SessionStart cleanup
-(``hooks/session/session_edit_tracker_cleanup.py``): the per-session tracker
+(``hooks/observability/session_file_edit_tracker.py``) and the SessionStart
+cleanup (``hooks/session/session_edit_tracker_cleanup.py``): the per-session
+tracker
 filename shape and JSON payload key, the session-id sanitize pattern, the
 SessionStart source key and the fresh-startup source value the cleanup keys its
 deletion on, the edit-tool name set, the per-session lock filename suffix and
@@ -62,7 +62,6 @@ ALL_TRACKED_UNSTAGED_FILES_COMMAND: tuple[str, ...] = (
 
 PARTIAL_COMMIT_BYPASS_MARKER: str = "# partial-commit"
 COMMIT_SUBCOMMAND_TOKEN: str = "commit"
-GIT_EXECUTABLE_TOKEN: str = "git"
 ENV_ASSIGNMENT_PREFIX_PATTERN: re.Pattern[str] = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=")
 ALL_STAGING_SUBCOMMAND_TOKENS: frozenset[str] = frozenset({"add", "stage"})
 ALL_STAGE_ALL_ADD_FLAG_TOKENS: frozenset[str] = frozenset({"-A", "--all", "-u", "--update"})

package/hooks/hooks_constants/state_description_blocker_constants.py

@@ -40,9 +40,6 @@ ALL_COMMENT_TRANSITION_PATTERNS: list[Pattern[str]] = [
     compile(r"\bas of\b", IGNORECASE),
 ]
 
-BLOCK_COMMENT_OPEN_MARKER: str = "/*"
-BLOCK_COMMENT_CLOSE_MARKER: str = "*/"
-
 INLINE_CODE_PATTERN: Pattern[str] = compile(r"``[^`]+``|`[^`]+`")
 DOUBLE_QUOTED_SPAN_PATTERN: Pattern[str] = compile(r'"[^"\n]*"')
 TRIPLE_QUOTED_BLOCK_PATTERN: Pattern[str] = compile(

package/hooks/hooks_constants/test_state_description_blocker_constants.py

@@ -10,13 +10,15 @@ if str(_HOOKS_ROOT) not in sys.path:
     sys.path.insert(0, str(_HOOKS_ROOT))
 
 from blocking.state_description_blocker import _extract_comment_lines
+from hooks_constants.code_rules_enforcer_constants import (
+    JAVASCRIPT_BLOCK_COMMENT_CLOSER,
+    JAVASCRIPT_BLOCK_COMMENT_OPENER,
+)
 from hooks_constants.state_description_blocker_constants import (
     ALL_BLOCK_COMMENT_EXTENSIONS,
     ALL_COMMENT_TRANSITION_PATTERNS,
     ALL_HASH_ONLY_EXTENSIONS,
     ALL_MARKDOWN_EXTENSIONS,
-    BLOCK_COMMENT_CLOSE_MARKER,
-    BLOCK_COMMENT_OPEN_MARKER,
     DOUBLE_QUOTE_BODY_GROUP,
     SINGLE_QUOTE_BODY_GROUP,
     TRIPLE_QUOTED_BLOCK_PATTERN,
@@ -47,19 +49,19 @@ def test_transition_patterns_do_not_match_unrelated_prose() -> None:
 
 
 def test_block_comment_markers_close_a_single_line_block_comment() -> None:
-    text = f"{BLOCK_COMMENT_OPEN_MARKER} note {BLOCK_COMMENT_CLOSE_MARKER}\ncode();"
+    text = f"{JAVASCRIPT_BLOCK_COMMENT_OPENER} note {JAVASCRIPT_BLOCK_COMMENT_CLOSER}\ncode();"
     all_comment_lines = _extract_comment_lines(text, ".js")
     assert all_comment_lines == [
-        (1, f"{BLOCK_COMMENT_OPEN_MARKER} note {BLOCK_COMMENT_CLOSE_MARKER}")
+        (1, f"{JAVASCRIPT_BLOCK_COMMENT_OPENER} note {JAVASCRIPT_BLOCK_COMMENT_CLOSER}")
     ]
 
 
 def test_block_comment_markers_carry_an_unclosed_comment_to_the_next_line() -> None:
-    text = f"{BLOCK_COMMENT_OPEN_MARKER} still open\nclosed here {BLOCK_COMMENT_CLOSE_MARKER}"
+    text = f"{JAVASCRIPT_BLOCK_COMMENT_OPENER} still open\nclosed here {JAVASCRIPT_BLOCK_COMMENT_CLOSER}"
     all_comment_lines = _extract_comment_lines(text, ".js")
     assert all_comment_lines == [
-        (1, f"{BLOCK_COMMENT_OPEN_MARKER} still open"),
-        (2, f"closed here {BLOCK_COMMENT_CLOSE_MARKER}"),
+        (1, f"{JAVASCRIPT_BLOCK_COMMENT_OPENER} still open"),
+        (2, f"closed here {JAVASCRIPT_BLOCK_COMMENT_CLOSER}"),
     ]
 
 

package/hooks/validators/exempt_paths.py

@@ -48,27 +48,21 @@ TEST_PATH_PATTERNS: frozenset[str] = frozenset(
 HOOK_INFRASTRUCTURE_PATTERNS: frozenset[str] = frozenset(
     {
         "/.claude/hooks/",
-        "\\.claude\\hooks\\",
-        "\\.claude/hooks/",
     }
 )
 
 WORKFLOW_REGISTRY_PATTERNS: frozenset[str] = frozenset(
     {
         "/workflow/",
-        "\\workflow\\",
         "_tab.py",
         "/states.py",
-        "\\states.py",
         "/modules.py",
-        "\\modules.py",
     }
 )
 
 MIGRATION_PATH_PATTERNS: frozenset[str] = frozenset(
     {
         "/migrations/",
-        "\\migrations\\",
     }
 )
 
@@ -80,23 +74,14 @@ def is_test_file(file_path: str) -> bool:
 
 def is_hook_infrastructure(file_path: str) -> bool:
     path_normalized = file_path.lower().replace("\\", "/")
-    return any(
-        pattern.replace("\\", "/") in path_normalized
-        for pattern in HOOK_INFRASTRUCTURE_PATTERNS
-    )
+    return any(pattern in path_normalized for pattern in HOOK_INFRASTRUCTURE_PATTERNS)
 
 
 def is_workflow_registry_file(file_path: str) -> bool:
     path_normalized = file_path.lower().replace("\\", "/")
-    return any(
-        pattern.replace("\\", "/") in path_normalized
-        for pattern in WORKFLOW_REGISTRY_PATTERNS
-    )
+    return any(pattern in path_normalized for pattern in WORKFLOW_REGISTRY_PATTERNS)
 
 
 def is_migration_file(file_path: str) -> bool:
     path_normalized = file_path.lower().replace("\\", "/")
-    return any(
-        pattern.replace("\\", "/") in path_normalized
-        for pattern in MIGRATION_PATH_PATTERNS
-    )
+    return any(pattern in path_normalized for pattern in MIGRATION_PATH_PATTERNS)

package/hooks/validators/test_exempt_paths.py

@@ -14,6 +14,9 @@ _BLOCKING_DIR = str(Path(__file__).resolve().parent.parent / "blocking")
 if _BLOCKING_DIR not in sys.path:
     sys.path.insert(0, _BLOCKING_DIR)
 
+import pytest  # noqa: E402
+
+from validators import exempt_paths  # noqa: E402
 from validators.exempt_paths import is_config_file  # noqa: E402
 from code_rules_path_utils import is_config_file as path_utils_is_config_file  # noqa: E402
 
@@ -63,3 +66,20 @@ def test_is_config_file_is_identical_function_object_from_path_utils() -> None:
     assert is_config_file is path_utils_is_config_file, (
         "exempt_paths.is_config_file must be imported from code_rules_path_utils, not re-defined"
     )
+
+
+@pytest.mark.parametrize(
+    "normalized_pattern_set_name",
+    [
+        "HOOK_INFRASTRUCTURE_PATTERNS",
+        "WORKFLOW_REGISTRY_PATTERNS",
+        "MIGRATION_PATH_PATTERNS",
+    ],
+)
+def test_normalized_pattern_set_carries_no_backslash_entry(
+    normalized_pattern_set_name: str,
+) -> None:
+    """Each set's consumer normalizes the path with .replace("\\\\", "/") but
+    not the pattern, so a backslash entry can never match."""
+    pattern_set = getattr(exempt_paths, normalized_pattern_set_name)
+    assert all("\\" not in each_pattern for each_pattern in pattern_set)

package/hooks/validators/test_python_antipattern_checks.py

@@ -150,6 +150,18 @@ class TestPrintInCliEntryPoint:
         tree = ast.parse(CLI_ENTRY_POINT_WITH_PRINTS)
         assert check_print_in_production(tree, "packages/foo/scripts/run_job.py") == []
 
+    def test_diagnostics_path_allows_print(self) -> None:
+        tree = ast.parse(CLI_ENTRY_POINT_WITH_PRINTS)
+        assert check_print_in_production(tree, "theme_exports/tools/diagnostics/probe.py") == []
+
+    def test_windows_diagnostics_path_allows_print(self) -> None:
+        tree = ast.parse(CLI_ENTRY_POINT_WITH_PRINTS)
+        assert check_print_in_production(tree, "theme_exports\\tools\\diagnostics\\probe.py") == []
+
+    def test_near_miss_diagnostics_name_still_flagged(self) -> None:
+        tree = ast.parse(NEAR_MISS_WITH_PRINT)
+        assert len(check_print_in_production(tree, "run_diagnostics.py")) == 1
+
     def test_near_miss_name_still_flagged(self) -> None:
         tree = ast.parse(NEAR_MISS_WITH_PRINT)
         assert len(check_print_in_production(tree, "publicli.py")) == 1
@@ -180,6 +192,8 @@ class TestCrossSurfaceConsistency:
             "stp_preview/renderer.py",
             "publicli.py",
             "packages/foo/scripts/run_job.py",
+            "theme_exports/tools/diagnostics/probe.py",
+            "run_diagnostics.py",
         ):
             production_allows = check_print_in_production(tree, path) == []
             library_allows = check_library_print(source, path) == []

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.6.1",
+    "version": "8.7.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/rules/agent-merges-its-own-green-pull-request.md

@@ -0,0 +1,54 @@
+# The Agent Merges Its Own Green Pull Request
+
+**When this applies:** Any pull request an agent opened or was asked to drive, once its checks report.
+
+## Rule
+
+The agent that drives a pull request merges it. A pull request that is green, carries no open review thread, and sits at a merge state of `clean` is merged in the same run that brought it there. Waiting for the owner to type "merge" parks finished work on the person the work was done for.
+
+Three things stay with the owner, and nothing else does:
+
+- A pull request the owner asked to hold.
+- A change the owner said they want to read first.
+- A repository whose branch rule requires an approving review the agent cannot give.
+
+Where the branch rule requires zero approvals and one status check, that check is the gate, and the agent merges on its verdict.
+
+Validation is the precondition, and green means every check reported on the exact head commit. A branch rule that requires one status check names the floor a merge needs; a pull request whose other checks are red or still running is held until they report.
+
+## The precondition is mechanical
+
+One command prints the verdict:
+
+```
+python packages/claude-dev-env/scripts/agent_merge_check.py <owner>/<name> <number>
+```
+
+It prints `MERGE` and exits 0 when the pull request is ready. It prints `HOLD` with the reason and exits 1 for a draft, for a head behind or conflicting with the base, for a required check that is not passing, for a check still running or red, and for an open review thread. It exits 2 when the state could not be read.
+
+Each hold reason names its own repair, and each repair belongs to the agent:
+
+| Hold | What the agent does |
+|---|---|
+| Head behind the base | Merge the base branch in and push |
+| Head conflicts with the base | Merge the base branch in, resolve, push |
+| A required check is red | Read the failing check, fix it, push |
+| A check is red or still running | Fix it, or wait for it, then read the verdict again |
+| A review thread is open | Answer it, push the fix, resolve the thread |
+| The pull request is a draft | Mark it ready once the checks pass |
+
+## When a gate elsewhere holds the merge command
+
+A session working inside another repository can sit behind that repository's own pre-merge gate, which reads the checkout the session works in and refuses a merge command whatever repository the pull request belongs to. That session hands the merge to the session that owns this repository's pull requests, by message, naming the pull request. The receiving session reads the verdict above and merges. The hand-off carries the work; it never lands on the owner.
+
+## After the merge
+
+Delete nothing by hand. The repository deletes the head branch on merge.
+
+## Sibling rules
+
+| Rule | Role |
+|---|---|
+| [`git-workflow.md`](git-workflow.md) | Draft first, and confirm each required context fired after the push |
+| [`ci-owns-the-gate.md`](ci-owns-the-gate.md) | The gate runs once, and it runs on CI |
+| [`correction-lens.md`](correction-lens.md) | A correction becomes a control at the highest layer that can hold it |

package/rules/archiving-agent-config.md

@@ -43,6 +43,16 @@ Record a row in the archive manifest for each file: why it went, the `git mv`
 that restores it, and every other edit a restore has to undo. A restore that has
 to be reconstructed from the diff is not recoverable in any useful sense.
 
+## Exempt files
+
+The "Never archived" section of `rules-archived/ARCHIVE-MANIFEST.md` names the
+files this procedure leaves alone. Read that section before a prune moves
+anything. A pass that reaches an exempt file stops there and reports which file
+it was, so the prune's other moves still land.
+
+`rules/correction-lens.md` is on that list today. Editing an exempt file to
+sharpen it is ordinary work.
+
 ## Make the archive stick
 
 Two things do not follow the file on their own.

package/rules/code-standards.md

@@ -27,6 +27,7 @@ BDD is the outer process and TDD is the inner loop: [`bdd.md`](bdd.md) discovers
 
 | Concern | Rule file |
 |---|---|
+| Handling a correction from the user | [`correction-lens.md`](correction-lens.md) |
 | Task tracking / worker completion | [`workers-done-before-complete.md`](workers-done-before-complete.md) |
 | Multi-step task list | skill `task-build` (see agents catalog) |