claude-dev-env 8.6.1 → 8.8.0

package/hooks/blocking/code_rules_enforcer_test_support.py

@@ -13,6 +13,16 @@ from pathlib import Path
 
 _ENFORCER_SCRIPT_PATH = Path(__file__).with_name("code_rules_enforcer.py")
 
+STRIP_CODE_AND_QUOTES_SOURCE = (
+    "import re\n"
+    "\n"
+    "def strip_code_and_quotes(text: str) -> str:\n"
+    "    without_fences = re.sub(r'```.*?```', '', text, flags=re.DOTALL)\n"
+    "    without_inline = re.sub(r'`[^`]*`', '', without_fences)\n"
+    "    without_quotes = re.sub(r'(?m)^>.*$', '', without_inline)\n"
+    "    return without_quotes.strip()\n"
+)
+
 
 def repository_root() -> Path:
     """Return the root of the checkout these tests run inside.

package/hooks/blocking/code_rules_shared.py

@@ -48,7 +48,7 @@ def get_file_extension(file_path: str) -> str:
 def is_hook_infrastructure(file_path: str) -> bool:
     """Check if file is a Claude Code hook (standalone infrastructure, not project code)."""
     path_lower = "/" + file_path.lower().replace("\\", "/").lstrip("/")
-    return any(pattern.replace("\\", "/") in path_lower for pattern in ALL_HOOK_INFRASTRUCTURE_PATTERNS)
+    return any(pattern in path_lower for pattern in ALL_HOOK_INFRASTRUCTURE_PATTERNS)
 
 
 def is_agent_home_tooling(file_path: str) -> bool:
@@ -66,10 +66,7 @@ def is_agent_home_tooling(file_path: str) -> bool:
         True when the path sits under a recognized agent home directory.
     """
     path_lower = "/" + file_path.lower().replace("\\", "/").lstrip("/")
-    return any(
-        each_pattern.replace("\\", "/") in path_lower
-        for each_pattern in ALL_AGENT_HOME_TOOLING_PATTERNS
-    )
+    return any(each_pattern in path_lower for each_pattern in ALL_AGENT_HOME_TOOLING_PATTERNS)
 
 
 def is_test_file(file_path: str) -> bool:
@@ -106,7 +103,7 @@ def is_workflow_registry_file(file_path: str) -> bool:
     These are module-level singletons, not misplaced literal constants.
     """
     path_lower = file_path.lower().replace("\\", "/")
-    return any(pattern.replace("\\", "/") in path_lower for pattern in ALL_WORKFLOW_REGISTRY_PATTERNS)
+    return any(pattern in path_lower for pattern in ALL_WORKFLOW_REGISTRY_PATTERNS)
 
 
 def is_spec_file(file_path: str) -> bool:
@@ -523,7 +520,7 @@ def _is_dedicated_constants_module(file_path: str) -> bool:
 def is_migration_file(file_path: str) -> bool:
     """Check if file is a Django migration (must be self-contained)."""
     path_lower = file_path.lower().replace("\\", "/")
-    return any(pattern.replace("\\", "/") in path_lower for pattern in ALL_MIGRATION_PATH_PATTERNS)
+    return any(pattern in path_lower for pattern in ALL_MIGRATION_PATH_PATTERNS)
 
 
 def docstring_line_numbers(content: str) -> set[int]:

package/hooks/blocking/conftest.py

@@ -1,8 +1,11 @@
 """Add hooks/blocking and hooks/ to sys.path for every test collected under this directory."""
 
 import json
+import shutil
 import subprocess
 import sys
+import tempfile
+from collections.abc import Iterator
 from pathlib import Path
 from typing import Callable
 
@@ -14,6 +17,25 @@ for each_directory in (_BLOCKING_DIRECTORY, _HOOKS_DIRECTORY):
     if each_directory not in sys.path:
         sys.path.insert(0, each_directory)
 
+_HOOK_INFRASTRUCTURE_TAIL = Path("packages") / "claude-dev-env" / "hooks" / "blocking"
+
+
+@pytest.fixture
+def hook_blocking_dir() -> Iterator[Path]:
+    """Build a temporary tree whose tail mirrors a production hook directory.
+
+    ``is_hook_infrastructure`` matches on the path tail, so a target inside
+    the yielded directory routes the way a
+    ``packages/claude-dev-env/hooks/blocking`` target does.
+    """
+    base_directory = Path(tempfile.mkdtemp())
+    blocking_directory = base_directory / _HOOK_INFRASTRUCTURE_TAIL
+    blocking_directory.mkdir(parents=True)
+    try:
+        yield blocking_directory
+    finally:
+        shutil.rmtree(base_directory, ignore_errors=False)
+
 
 @pytest.fixture
 def three_operation_patch() -> str:

package/hooks/blocking/state_description_blocker.py

@@ -22,6 +22,10 @@ try:
         sys.path.insert(0, _hooks_dir)
 
     from blocking.code_rules_shared import is_ephemeral_path
+    from hooks_constants.code_rules_enforcer_constants import (
+        JAVASCRIPT_BLOCK_COMMENT_CLOSER,
+        JAVASCRIPT_BLOCK_COMMENT_OPENER,
+    )
     from hooks_constants.hook_block_logger import log_hook_block
     from hooks_constants.multi_edit_reconstruction import joined_new_strings
     from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
@@ -34,8 +38,6 @@ try:
         ALL_HASH_AND_SLASH_EXTENSIONS,
         ALL_HASH_ONLY_EXTENSIONS,
         ALL_MARKDOWN_EXTENSIONS,
-        BLOCK_COMMENT_CLOSE_MARKER,
-        BLOCK_COMMENT_OPEN_MARKER,
         DOUBLE_QUOTE_BODY_GROUP,
         DOUBLE_QUOTED_SPAN_PATTERN,
         INLINE_CODE_PATTERN,
@@ -90,13 +92,13 @@ def _consume_block_comment_open(
     on this same line (``None`` when the whole line was consumed), and
     whether the comment is still open past this line.
     """
-    slash_star_index = stripped.find(BLOCK_COMMENT_OPEN_MARKER)
+    slash_star_index = stripped.find(JAVASCRIPT_BLOCK_COMMENT_OPENER)
     close_star_index = stripped.find(
-        BLOCK_COMMENT_CLOSE_MARKER, slash_star_index + len(BLOCK_COMMENT_OPEN_MARKER)
+        JAVASCRIPT_BLOCK_COMMENT_CLOSER, slash_star_index + len(JAVASCRIPT_BLOCK_COMMENT_OPENER)
     )
     if close_star_index < 0:
         return [(each_line_number, stripped[slash_star_index:])], None, True
-    close_end = close_star_index + len(BLOCK_COMMENT_CLOSE_MARKER)
+    close_end = close_star_index + len(JAVASCRIPT_BLOCK_COMMENT_CLOSER)
     entry = (each_line_number, stripped[slash_star_index:close_end])
     after_close = stripped[close_end:].lstrip()
     return [entry], (after_close or None), False
@@ -110,10 +112,10 @@ def _consume_block_comment_continuation(
     Returns the extracted entries, whether the comment is still open past
     this line, and whether the caller should move to the next source line.
     """
-    close_index = stripped.find(BLOCK_COMMENT_CLOSE_MARKER)
+    close_index = stripped.find(JAVASCRIPT_BLOCK_COMMENT_CLOSER)
     if close_index < 0:
         return [(each_line_number, stripped)], True, True
-    close_end = close_index + len(BLOCK_COMMENT_CLOSE_MARKER)
+    close_end = close_index + len(JAVASCRIPT_BLOCK_COMMENT_CLOSER)
     return [(each_line_number, stripped[:close_end])], False, False
 
 
@@ -140,7 +142,7 @@ def _extract_comment_lines(text: str, extension: str = "") -> list[tuple[int, st
             ):
                 all_comment_lines.append((each_line_number, stripped))
                 continue
-            if BLOCK_COMMENT_OPEN_MARKER in stripped and not is_in_block_comment:
+            if JAVASCRIPT_BLOCK_COMMENT_OPENER in stripped and not is_in_block_comment:
                 entries, leftover, is_in_block_comment = _consume_block_comment_open(
                     each_line_number, stripped
                 )

package/hooks/blocking/test_code_rules_enforcer_duplicate_body.py

@@ -24,6 +24,8 @@ from collections.abc import Iterator
 
 import pytest
 
+from code_rules_enforcer_test_support import STRIP_CODE_AND_QUOTES_SOURCE as SHARED_HELPER_SOURCE
+
 _HOOK_DIRECTORY = pathlib.Path(__file__).parent
 if str(_HOOK_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(_HOOK_DIRECTORY))
@@ -39,17 +41,6 @@ _hook_spec.loader.exec_module(_hook_module)
 check_duplicate_function_body_across_files = _hook_module.check_duplicate_function_body_across_files
 
 
-SHARED_HELPER_SOURCE = (
-    "import re\n"
-    "\n"
-    "def strip_code_and_quotes(text: str) -> str:\n"
-    "    without_fences = re.sub(r'```.*?```', '', text, flags=re.DOTALL)\n"
-    "    without_inline = re.sub(r'`[^`]*`', '', without_fences)\n"
-    "    without_quotes = re.sub(r'(?m)^>.*$', '', without_inline)\n"
-    "    return without_quotes.strip()\n"
-)
-
-
 @pytest.fixture
 def module_dir() -> Iterator[pathlib.Path]:
     base_directory = pathlib.Path(tempfile.mkdtemp())

package/hooks/blocking/test_code_rules_enforcer_duplicate_body_hook_routing.py

@@ -9,18 +9,15 @@ points (the ``main()`` stdin path and the pre-check CLI) with a hook-infrastruct
 target, so each lane's behavior is proven on the same path a live Write or a
 pre-check run would take, rather than by calling the check function directly.
 
-Each test builds a temporary tree whose tail mirrors a production hook directory
-(``packages/claude-dev-env/hooks/blocking``) so ``is_hook_infrastructure`` matches the
-target path the same way it would for the production directory.
+Each test takes the ``hook_blocking_dir`` fixture from ``conftest.py``, which builds
+a temporary tree matching the production hook directory so ``is_hook_infrastructure``
+routes a target inside it the same way it would for the production directory.
 """
 
 from __future__ import annotations
 
 import pathlib
-import shutil
 import sys
-import tempfile
-from collections.abc import Iterator
 
 import pytest
 
@@ -33,35 +30,13 @@ if str(_HOOKS_PARENT) not in sys.path:
 
 from code_rules_enforcer import main  # noqa: E402
 from code_rules_enforcer_test_support import (  # noqa: E402
+    STRIP_CODE_AND_QUOTES_SOURCE as SHARED_HELPER_SOURCE,
     run_precheck,
     run_write_entrypoint,
 )
 
 pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
 
-SHARED_HELPER_SOURCE = (
-    "import re\n"
-    "\n"
-    "def strip_code_and_quotes(text: str) -> str:\n"
-    "    without_fences = re.sub(r'```.*?```', '', text, flags=re.DOTALL)\n"
-    "    without_inline = re.sub(r'`[^`]*`', '', without_fences)\n"
-    "    without_quotes = re.sub(r'(?m)^>.*$', '', without_inline)\n"
-    "    return without_quotes.strip()\n"
-)
-
-_HOOK_INFRASTRUCTURE_TAIL = pathlib.Path("packages") / "claude-dev-env" / "hooks" / "blocking"
-
-
-@pytest.fixture
-def hook_blocking_dir() -> Iterator[pathlib.Path]:
-    base_directory = pathlib.Path(tempfile.mkdtemp())
-    blocking_directory = base_directory / _HOOK_INFRASTRUCTURE_TAIL
-    blocking_directory.mkdir(parents=True)
-    try:
-        yield blocking_directory
-    finally:
-        shutil.rmtree(base_directory, ignore_errors=False)
-
 
 def _run_main_with_write_payload(
     file_path: str,

package/hooks/blocking/test_code_rules_enforcer_test_support.py

@@ -0,0 +1,21 @@
+"""Tests for the shared constants this directory's test-support module provides."""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from typing import cast
+
+from code_rules_enforcer_test_support import STRIP_CODE_AND_QUOTES_SOURCE
+
+
+def should_define_a_strip_code_and_quotes_function_that_removes_fenced_code() -> None:
+    module_namespace: dict[str, object] = {}
+    exec(STRIP_CODE_AND_QUOTES_SOURCE, module_namespace)
+    strip_code_and_quotes = cast("Callable[[str], str]", module_namespace["strip_code_and_quotes"])
+
+    stripped = strip_code_and_quotes("keep this\n```\ncode block\n```\n> a quote\nkeep this too")
+
+    assert "code block" not in stripped
+    assert "a quote" not in stripped
+    assert "keep this" in stripped
+    assert "keep this too" in stripped

package/hooks/blocking/test_code_rules_enforcer_zero_payload_alias_hook_routing.py

@@ -7,19 +7,16 @@ through ``validate_content_for_edit_lane``, which hook files never reach at PreT
 tests drive the real ``main()`` stdin entry point and the pre-check CLI with a
 hook-infrastructure target.
 
-Each test builds a temporary tree whose tail mirrors a production hook directory
-(``packages/claude-dev-env/hooks/blocking``) so ``is_hook_infrastructure`` matches
-the target path the same way it would for the real directory.
+Each test takes the ``hook_blocking_dir`` fixture from ``conftest.py``, which builds
+a temporary tree matching the production hook directory so ``is_hook_infrastructure``
+routes a target inside it the same way it would for the production directory.
 """
 
 from __future__ import annotations
 
 import json
 import pathlib
-import shutil
 import sys
-import tempfile
-from collections.abc import Iterator
 
 import pytest
 
@@ -46,19 +43,6 @@ PASS_THROUGH_ALIAS_SOURCE = (
     "    return find_bare_path_segments(content)\n"
 )
 
-_HOOK_INFRASTRUCTURE_TAIL = pathlib.Path("packages") / "claude-dev-env" / "hooks" / "blocking"
-
-
-@pytest.fixture
-def hook_blocking_dir() -> Iterator[pathlib.Path]:
-    base_directory = pathlib.Path(tempfile.mkdtemp())
-    blocking_directory = base_directory / _HOOK_INFRASTRUCTURE_TAIL
-    blocking_directory.mkdir(parents=True)
-    try:
-        yield blocking_directory
-    finally:
-        shutil.rmtree(base_directory, ignore_errors=False)
-
 
 def test_write_of_pass_through_alias_into_hook_directory_denies(
     hook_blocking_dir: pathlib.Path,

package/hooks/blocking/test_code_rules_shared.py

@@ -291,3 +291,21 @@ def test_is_dedicated_constants_module_true_for_config_directory() -> None:
 
 def test_is_dedicated_constants_module_false_for_ordinary_module() -> None:
     assert _SHARED_MODULE._is_dedicated_constants_module("app/services/orders.py") is False
+
+
+@pytest.mark.parametrize(
+    "normalized_marker_table_name",
+    [
+        "ALL_AGENT_HOME_TOOLING_PATTERNS",
+        "ALL_HOOK_INFRASTRUCTURE_PATTERNS",
+        "ALL_WORKFLOW_REGISTRY_PATTERNS",
+        "ALL_MIGRATION_PATH_PATTERNS",
+    ],
+)
+def test_normalized_path_marker_table_carries_no_backslash_entry(
+    normalized_marker_table_name: str,
+) -> None:
+    """Each table's consumer normalizes the path with .replace("\\\\", "/") but
+    not the marker, so a backslash entry can never match."""
+    marker_table = getattr(_SHARED_MODULE, normalized_marker_table_name)
+    assert all("\\" not in each_marker for each_marker in marker_table)

package/hooks/blocking/test_conftest.py

@@ -0,0 +1,35 @@
+"""Tests for the shared fixtures this directory's ``conftest.py`` provides."""
+
+from __future__ import annotations
+
+import pathlib
+
+from code_rules_shared import is_hook_infrastructure
+
+
+def should_yield_a_directory_a_target_inside_it_routes_as_hook_infrastructure(
+    hook_blocking_dir: pathlib.Path,
+) -> None:
+    target_file = hook_blocking_dir / "new_blocker.py"
+    assert is_hook_infrastructure(str(target_file)) is True
+
+
+def should_yield_a_directory_that_exists_on_disk(
+    hook_blocking_dir: pathlib.Path,
+) -> None:
+    assert hook_blocking_dir.is_dir()
+
+
+def should_keep_the_hook_blocking_dir_explanation_only_on_the_fixture() -> None:
+    directory = pathlib.Path(__file__).parent
+    exempt_paths = {directory / "conftest.py", pathlib.Path(__file__)}
+    explanation_fragment = "tail mirrors a production hook directory"
+    offending_files = [
+        path.name
+        for path in sorted(directory.glob("*.py"))
+        if path not in exempt_paths and explanation_fragment in path.read_text(encoding="utf-8")
+    ]
+    assert offending_files == [], (
+        "the hook_blocking_dir fixture's explanation belongs on conftest.py alone, "
+        f"got it repeated in: {offending_files}"
+    )

package/hooks/blocking/test_pii_scanner.py

@@ -24,6 +24,7 @@ SYNTHETIC_AWS_KEY = "AKIA" + ("B" * 16)
 SYNTHETIC_PEM_HEADER = "-----BEGIN RSA PRIVATE KEY-----"
 SYNTHETIC_REAL_EMAIL = "person.fixture@company-example.io"
 SYNTHETIC_SAFE_EMAIL = "user@example.com"
+SYNTHETIC_GITHUB_NOREPLY_EMAIL = "24366590+octocat@users.noreply.github.com"
 SYNTHETIC_HOME_PATH = r"C:\Users\fixture_real_user\notes.txt"
 SYNTHETIC_PLACEHOLDER_HOME = r"C:\Users\<you>\notes.txt"
 SYNTHETIC_PRIVATE_IP = "192.168.42.17"
@@ -42,6 +43,13 @@ def test_flags_real_email_and_allows_example_domain() -> None:
     assert all_safe_hits == []
 
 
+def test_allows_github_noreply_email_and_still_flags_a_company_lookalike() -> None:
+    all_noreply_hits = scan_text_for_pii(f"commit author {SYNTHETIC_GITHUB_NOREPLY_EMAIL}")
+    all_lookalike_hits = scan_text_for_pii("contact person@users.noreply.github.com.evil.io")
+    assert all_noreply_hits == []
+    assert any(each.category == "email" for each in all_lookalike_hits)
+
+
 def test_flags_home_path_and_allows_placeholder_user() -> None:
     all_home_hits = scan_text_for_pii(f"path is {SYNTHETIC_HOME_PATH}")
     all_placeholder_hits = scan_text_for_pii(f"path is {SYNTHETIC_PLACEHOLDER_HOME}")

package/hooks/blocking/test_state_description_blocker.py

@@ -34,6 +34,11 @@ from code_rules_enforcer_test_support import (
     repository_file_path,
     repository_root,
 )
+from hooks_constants.code_rules_enforcer_constants import (
+    JAVASCRIPT_BLOCK_COMMENT_CLOSER,
+    JAVASCRIPT_BLOCK_COMMENT_OPENER,
+)
+import state_description_blocker as _state_description_blocker_module
 
 HOOK_SCRIPT_PATH = os.path.join(
     os.path.dirname(__file__), "state_description_blocker.py"
@@ -995,3 +1000,14 @@ def test_find_violations_with_lines_reports_markdown_line_past_a_code_fence() ->
     all_violations = find_violations_with_lines(markdown_source, "docs/api.md")
 
     assert all_violations == [("previously", 7), ("was previously", 7)]
+
+
+def test_block_comment_markers_are_the_javascript_constants() -> None:
+    assert (
+        _state_description_blocker_module.JAVASCRIPT_BLOCK_COMMENT_OPENER
+        is JAVASCRIPT_BLOCK_COMMENT_OPENER
+    )
+    assert (
+        _state_description_blocker_module.JAVASCRIPT_BLOCK_COMMENT_CLOSER
+        is JAVASCRIPT_BLOCK_COMMENT_CLOSER
+    )

package/hooks/git-hooks/git_hooks_constants/__init__.py

@@ -47,20 +47,7 @@ LOCAL_SHA_FIELD_INDEX: int = 1
 NO_PARSEABLE_STDIN_LINES_MESSAGE: str = (
     "claude-dev-env pre-push: no parseable stdin lines; aborting"
 )
-NO_PARSEABLE_STDIN_LINES_SENTINEL: str = "__no_parseable_stdin_lines__"
-UNRESOLVABLE_MERGE_BASE_SENTINEL: str = "__unresolvable_merge_base__"
-UNRESOLVABLE_MERGE_BASE_MESSAGE: str = (
-    "claude-dev-env pre-push: CODE_RULES validation is pending because the pushed "
-    "object and default branch have no shared merge base. Restore shared history "
-    "or provide a reachable default branch, then run the push again."
-)
 LOCAL_BRANCH_REFERENCE_PREFIX: str = "refs/heads/"
-ORIGIN_HEAD_SYMBOLIC_REFERENCE: str = "refs/remotes/origin/HEAD"
-ORIGIN_REMOTE_TRACKING_REFERENCE_PREFIX: str = "refs/remotes/origin/"
-ALL_DEFAULT_BRANCH_FALLBACK_REFERENCES: tuple[str, ...] = (
-    "refs/remotes/origin/main",
-    "refs/remotes/origin/master",
-)
 REMOTE_BRANCH_REFERENCE_TEMPLATE: str = "refs/remotes/{remote}/{branch}"
 ALL_GIT_SYMBOLIC_REFERENCE_COMMAND_PREFIX: tuple[str, ...] = (
     "git",
@@ -99,7 +86,7 @@ GIT_SYMBOLIC_REFERENCE_SUBCOMMAND: str = "symbolic-ref"
 GIT_COMMAND_TIMEOUT_SECONDS: int = 30
 GH_EXECUTABLE_NAME: str = "gh"
 GH_PR_VIEW_TIMEOUT_SECONDS: int = 5
-GH_PR_VIEW_ARGUMENTS: tuple[str, ...] = ("pr", "view", "--json", "url", "--jq", ".url")
+ALL_GH_PR_VIEW_ARGUMENTS: tuple[str, ...] = ("pr", "view", "--json", "url", "--jq", ".url")
 GIT_FOR_EACH_REF_SUBCOMMAND: str = "for-each-ref"
 GIT_REFERENCE_SHORT_NAME_FORMAT_ARGUMENT: str = "--format=%(refname:short)"
 COMMIT_OBJECT_NAME_SUFFIX: str = "^{commit}"

package/hooks/git-hooks/pull_request_handoff.py

@@ -5,7 +5,7 @@ from pathlib import Path
 
 from git_hooks_constants import (
     GH_EXECUTABLE_NAME,
-    GH_PR_VIEW_ARGUMENTS,
+    ALL_GH_PR_VIEW_ARGUMENTS,
     GH_PR_VIEW_TIMEOUT_SECONDS,
 )
 
@@ -15,7 +15,7 @@ from subprocess_window_access import hidden_window_creation_flags
 def get_pull_request_url(repo_dir: Path) -> str | None:
     try:
         result = subprocess.run(
-            [GH_EXECUTABLE_NAME, *GH_PR_VIEW_ARGUMENTS],
+            [GH_EXECUTABLE_NAME, *ALL_GH_PR_VIEW_ARGUMENTS],
             cwd=repo_dir,
             check=False,
             capture_output=True,

package/hooks/git-hooks/test_config.py

@@ -11,6 +11,13 @@ def test_no_parseable_stdin_lines_message_exists_and_describes_problem() -> None
     assert "no parseable stdin lines" in git_hooks_constants.NO_PARSEABLE_STDIN_LINES_MESSAGE
 
 
-def test_no_parseable_stdin_lines_sentinel_is_distinct_sentinel_value() -> None:
-    assert git_hooks_constants.NO_PARSEABLE_STDIN_LINES_SENTINEL is not None
-    assert git_hooks_constants.NO_PARSEABLE_STDIN_LINES_SENTINEL != git_hooks_constants.DEFAULT_REMOTE_BASE_REFERENCE
+def test_pre_push_cut_leftovers_are_removed() -> None:
+    for removed_name in (
+        "ALL_DEFAULT_BRANCH_FALLBACK_REFERENCES",
+        "ORIGIN_HEAD_SYMBOLIC_REFERENCE",
+        "ORIGIN_REMOTE_TRACKING_REFERENCE_PREFIX",
+        "UNRESOLVABLE_MERGE_BASE_SENTINEL",
+        "UNRESOLVABLE_MERGE_BASE_MESSAGE",
+        "NO_PARSEABLE_STDIN_LINES_SENTINEL",
+    ):
+        assert not hasattr(git_hooks_constants, removed_name)

package/hooks/git-hooks/test_pull_request_handoff.py

@@ -0,0 +1,49 @@
+"""Tests for the pull-request URL query the commit handoff runs."""
+
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+import pytest
+
+import pull_request_handoff
+from git_hooks_constants import (
+    ALL_GH_PR_VIEW_ARGUMENTS,
+    GH_EXECUTABLE_NAME,
+    GH_PR_VIEW_TIMEOUT_SECONDS,
+)
+
+
+def test_should_query_the_url_through_the_named_executable_and_arguments(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    all_calls: list[tuple[list[str], object]] = []
+
+    def record_call(
+        command: list[str], **keyword_arguments: object
+    ) -> subprocess.CompletedProcess[str]:
+        all_calls.append((command, keyword_arguments["timeout"]))
+        return subprocess.CompletedProcess(command, 0, "https://example/pull/1\n", "")
+
+    monkeypatch.setattr(pull_request_handoff.subprocess, "run", record_call)
+
+    url = pull_request_handoff.get_pull_request_url(Path("/repo"))
+
+    assert url == "https://example/pull/1"
+    assert all_calls == [
+        ([GH_EXECUTABLE_NAME, *ALL_GH_PR_VIEW_ARGUMENTS], GH_PR_VIEW_TIMEOUT_SECONDS)
+    ]
+
+
+def test_should_report_no_url_when_the_query_exits_non_zero(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    def failing_call(
+        command: list[str], **keyword_arguments: object
+    ) -> subprocess.CompletedProcess[str]:
+        return subprocess.CompletedProcess(command, 1, "", "no pull request")
+
+    monkeypatch.setattr(pull_request_handoff.subprocess, "run", failing_call)
+
+    assert pull_request_handoff.get_pull_request_url(Path("/repo")) is None

package/hooks/git-hooks/test_verification_notice_state.py

@@ -0,0 +1,50 @@
+"""Tests for the base-reference construction in ``_base_matches_current``."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+import verification_notice
+import verification_notice_state
+from git_hooks_constants import COMMIT_OBJECT_NAME_SUFFIX
+from git_hooks_constants.verification_notice_constants import (
+    ALL_GIT_BASE_QUERY_PREFIX,
+    BASE_REFERENCE,
+)
+
+
+def test_base_matches_current_queries_base_reference_plus_commit_suffix() -> None:
+    captured_queries: list[tuple[str, ...]] = []
+
+    def _fake_git_query(
+        repository_root: Path, arguments: tuple[str, ...], capture_stderr: bool
+    ) -> str | None:
+        captured_queries.append(arguments)
+        return "deadbeef"
+
+    verification_notice_state._base_matches_current(Path("/repo"), "deadbeef", _fake_git_query)
+
+    assert captured_queries == [
+        (*ALL_GIT_BASE_QUERY_PREFIX, BASE_REFERENCE + COMMIT_OBJECT_NAME_SUFFIX)
+    ]
+
+
+def test_base_matches_current_derives_its_query_from_the_base_reference_constant(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(verification_notice_state, "BASE_REFERENCE", "custom/base")
+    captured_queries: list[tuple[str, ...]] = []
+
+    def _fake_git_query(
+        repository_root: Path, arguments: tuple[str, ...], capture_stderr: bool
+    ) -> str | None:
+        captured_queries.append(arguments)
+        return None
+
+    verification_notice_state._base_matches_current(Path("/repo"), "deadbeef", _fake_git_query)
+
+    assert captured_queries == [
+        (*ALL_GIT_BASE_QUERY_PREFIX, "custom/base" + COMMIT_OBJECT_NAME_SUFFIX)
+    ]

package/hooks/git-hooks/verification_notice_state.py

@@ -6,8 +6,10 @@ from collections.abc import Callable, Mapping
 from pathlib import Path
 from typing import Protocol
 
+from git_hooks_constants import COMMIT_OBJECT_NAME_SUFFIX
 from git_hooks_constants.verification_notice_constants import (
     ALL_GIT_BASE_QUERY_PREFIX,
+    BASE_REFERENCE,
     GIT_COMMAND_SUCCESS_EXIT_CODE,
     HEX_DIGITS,
     NOTICE_FAILED_LINE,
@@ -180,7 +182,7 @@ def _base_matches_current(
 ) -> bool:
     current_base_revision = run_git_query(
         repository_root,
-        (*ALL_GIT_BASE_QUERY_PREFIX, "origin/main^{commit}"),
+        (*ALL_GIT_BASE_QUERY_PREFIX, BASE_REFERENCE + COMMIT_OBJECT_NAME_SUFFIX),
         False,
     )
     return current_base_revision == base_revision

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -38,10 +38,13 @@ CLAUDE_JOB_DIR_SCRATCH_SUBDIRECTORY: str = "tmp"
 EPHEMERAL_EXEMPT_DISABLE_ENVIRONMENT_VARIABLE_NAME: str = "CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT"
 ALL_EPHEMERAL_EXEMPT_DISABLE_TRUTHY_VALUES: frozenset[str] = frozenset({"1", "true", "yes", "on"})
 LEADING_DRIVE_LETTER_PATTERN: re.Pattern[str] = re.compile(r"^[a-z]:")
-ALL_AGENT_HOME_TOOLING_PATTERNS = {"/.grok/", "\\.grok\\", "\\.grok/"}
-ALL_HOOK_INFRASTRUCTURE_PATTERNS = {"/.claude/hooks/", "\\.claude\\hooks\\", "\\.claude/hooks/", "/packages/claude-dev-env/hooks/", "\\packages\\claude-dev-env\\hooks\\"} | ALL_AGENT_HOME_TOOLING_PATTERNS
-ALL_WORKFLOW_REGISTRY_PATTERNS = {"/workflow/", "\\workflow\\", "_tab.py", "/states.py", "\\states.py", "/modules.py", "\\modules.py"}
-ALL_MIGRATION_PATH_PATTERNS = {"/migrations/", "\\migrations\\"}
+ALL_AGENT_HOME_TOOLING_PATTERNS = {"/.grok/"}
+ALL_HOOK_INFRASTRUCTURE_PATTERNS = {
+    "/.claude/hooks/",
+    "/packages/claude-dev-env/hooks/",
+} | ALL_AGENT_HOME_TOOLING_PATTERNS
+ALL_WORKFLOW_REGISTRY_PATTERNS = {"/workflow/", "_tab.py", "/states.py", "/modules.py"}
+ALL_MIGRATION_PATH_PATTERNS = {"/migrations/"}
 
 CONSTANTS_MODULE_SUFFIX: str = "_constants.py"
 CONFIG_DIRECTORY_SEGMENT: str = "config"
@@ -192,7 +195,12 @@ ALL_COLLECTION_TYPE_NAMES: frozenset[str] = frozenset({
 })
 ALL_SUBSCRIPT_ONLY_COLLECTION_TYPE_NAMES: frozenset[str] = frozenset({"dict"})
 COLLECTION_BY_NAME_PATTERN: re.Pattern[str] = re.compile(r"^[a-z][a-z0-9]*_by_[a-z][a-z0-9_]*$")
-ALL_CLI_FILE_PATH_MARKERS: tuple[str, ...] = ("/scripts/", "\\scripts\\", "_cli.py", "/cli.py", "\\cli.py")
+ALL_CLI_FILE_PATH_MARKERS: tuple[str, ...] = (
+    "/scripts/",
+    "/diagnostics/",
+    "_cli.py",
+    "/cli.py",
+)
 
 LOGGING_FSTRING_PATTERN = re.compile(
     r'\b(?:log_(?:debug|info|warning|error|critical|exception)'

package/hooks/hooks_constants/pii_prevention_constants.py

@@ -136,6 +136,7 @@ ALL_SAFE_EMAIL_DOMAINS: frozenset[str] = frozenset(
         "test",
         "local",
         "test.local",
+        "users.noreply.github.com",
     }
 )
 

package/hooks/hooks_constants/refactor_guard_constants.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+GIT_EXECUTABLE_TOKEN: str = "git"
+GIT_COMMAND_TIMEOUT_SECONDS: int = 5
 MAXIMUM_REFACTOR_LINE_DELTA: int = 3
 REFACTOR_LINE_DELTA_DIVISOR: int = 2
 CHANGED_SURFACE_MATCH_RATIO: float = 0.5