claude-dev-env 8.73.1 → 8.74.0

package/docs/rule-guides/no-contrast-framing.md

@@ -1,7 +1,13 @@
-Back to the [rule entry](../../rules/no-contrast-framing.md).
+Back to the [rules index](../../rules/index.md).
 
 # No contrast framing
 
+## In brief
+
+State the chosen point directly and leave out the discarded reading. Remove these six forms: `trailing-comma-not`, `corrective-it-is-not`, `substitution-rather-than`, `additive-not-just`, `comparative-ranking`, `substitution-as-opposed-to`. Keep quantity comparisons. If a sentence loses substance, add the failing check, log line, measured number, or file and line.
+
+**Enforcement:** staged policy lint and `scripts/durable_post_lint.py` check authored text; the agent checks chat.
+
 **When this applies:** Every sentence a person reads. A chat reply, a commit
 message, a pull request title or body, a review comment, an issue, a rule file,
 a document, a plan, a memory file.
@@ -55,7 +61,7 @@ file and the line.
 The pattern list lives in
 `scripts/dev_env_scripts_constants/contrast_framing_constants.py`, and both
 lints read that one list. A synchronization test requires the rule file
-`rules/no-contrast-framing.md` to name every form the list carries.
+`docs/rule-guides/no-contrast-framing.md` to name every form the list carries.
 
 A chat reply reaches no check, so the same list is what the writer reads the
 sentence against: a comma followed by `not`, a `rather than`, a `not just`, a
@@ -65,6 +71,6 @@ ranking of one thing over another.
 
 | Rule | Role |
 |---|---|
-| [`asd-ste100-language.md`](../../rules/asd-ste100-language.md) | Plain word choice, sentence style, and tone |
+| [`asd-ste100-language.md`](asd-ste100-language.md) | Plain word choice, sentence style, and tone |
 | [`correction-lens.md`](../../rules/correction-lens.md) | Every correction becomes a control at the highest layer that can hold it |
-| [`research-mode.md`](../../rules/research-mode.md) | A claim carries its source |
+| [`research-mode.md`](research-mode.md) | A claim carries its source |

package/docs/rule-guides/prefer-existing-tools.md

@@ -18,5 +18,5 @@ Code written here needs local maintenance. A widely used tool draws fixes and ne
 
 | Rule | Role |
 |---|---|
-| [`explore-thoroughly.md`](../../rules/explore-thoroughly.md) | Read existing code before proposing a change |
-| [`verify-before-asking.md`](../../rules/verify-before-asking.md) | Check a question with a tool before asking it |
+| [`explore-thoroughly.md`](explore-thoroughly.md) | Read existing code before proposing a change |
+| [`verify-before-asking.md`](verify-before-asking.md) | Check a question with a tool before asking it |

package/docs/rule-guides/proof-before-pull-request.md

@@ -1,7 +1,11 @@
-Back to the [rule entry](../../rules/proof-before-pull-request.md).
+Back to the [rules index](../../rules/index.md).
 
 # Proof before a pull request
 
+## In brief
+
+Run the change where it runs, with and without it, and quote both results under "Proof in practice" in the body. A hook denies a body without one. Unproven: leave it unopened and tell the user.
+
 **When this applies:** Every session that builds a change and opens a pull request, in every project.
 
 ## Rule

package/docs/rule-guides/request-scope.md

@@ -1,7 +1,11 @@
-Back to the [rule entry](../../rules/request-scope.md).
+Back to the [rules index](../../rules/index.md).
 
 # Request scope
 
+## In brief
+
+A shipped gate makes each block line restating what it enforces dead text. Propose removing all of them, past the part asked about, and give each kept line's reason. Read the output back before reporting done.
+
 **When this applies:** The user asks whether part of a prompt, rule, card, or check is still needed, or asks you to change one.
 
 ## Rule

package/docs/rule-guides/research-mode.md

@@ -1,7 +1,15 @@
-Back to the [rule entry](../../rules/research-mode.md).
+Back to the [rules index](../../rules/index.md).
 
 # Research mode (global)
 
+## In brief
+
+**When:** Making a factual claim, recommendation, or piece of advice.
+
+State no claim without a credible source; do not guess or infer. Before an answer depends on an unsettled fact, run each tool that could settle it and that reads state or that permissions already allow, and stop at the first one that settles it. When none can, name the exact check and who can run or approve it. Cite a project file, web source, named expert or paper, or official documentation for each claim. Retract claims a source cannot support. Extract document text before analysis and ground the answer in word-for-word quotes. In chat, cite compactly with a link or `file:line`; put full quotes and citation lists in artifacts or replies that request them. Ground synthesis in sourced inputs. Creative ideas need no citation.
+
+**Enforcement:** none.
+
 Three anti-hallucination constraints are always active.
 
 Source: [Anthropic - Reduce Hallucinations](https://docs.anthropic.com/en/docs/test-and-evaluate/strengthen-guardrails/reduce-hallucinations)

package/docs/rule-guides/session-title.md

@@ -1,7 +1,13 @@
-Back to the [rule entry](../../rules/session-title.md).
+Back to the [rules index](../../rules/index.md).
 
 # Status in the session title
 
+## In brief
+
+Before each turn ends, set the title to `<emoji> <name>`. Use the red flag when the user must act, the check mark when the work is done, and the hourglass while work, CI, or a merge queue runs. The name has 25 characters or fewer, in sentence case, with concrete nouns and no IDs, dates, or branch names.
+
+**Enforcement:** `hooks/blocking/session_title_format_gate.py` denies a malformed title; `hooks/blocking/session_title_stop_gate.py` blocks a turn end with no title.
+
 **When this applies:** The session has a tool whose name ends in `__set_session_title`, such as `mcp__claude-code-remote__set_session_title` in a cloud session or `mcp__ccd_session_mgmt__set_session_title` in the desktop app.
 
 ## Rule

package/docs/rule-guides/shell-invocation.md

@@ -1,7 +1,15 @@
-Back to the [rule entry](../../rules/shell-invocation.md).
+Back to the [rules index](../../rules/index.md).
 
 # Shell Invocation
 
+## In brief
+
+**When:** Issuing a Bash-tool shell command, or writing a `settings.json` permission rule.
+
+On Windows, run shell work through `pwsh`: `pwsh -NoProfile -File '<script>.ps1' <args>` for a script, and `pwsh -NoProfile -Command "..."` or the `PowerShell` tool for inline work. A direct interpreter call such as `python script.py` conforms as written. Keep `powershell`, `cmd /c`, and `bash -c` out of permission rules. Keep `$(...)`, unescaped backticks, and `<(...)` or `>(...)` out of Bash commands; split the call or use a flag form such as `git -C "<path>"`. Arithmetic `$((...))` passes.
+
+**Enforcement:** none; a permission prompt on a wrapped command is the signal. `blocking/msys_rev_path_rewriter.py` only rewrites a `<rev>:<path>` argument.
+
 Two constraints govern every shell command an agent issues: which shell runs it, and what the command string may contain.
 
 ## Use pwsh

package/docs/rule-guides/verify-before-asking.md

@@ -1,7 +1,13 @@
-Back to the [rule entry](../../rules/verify-before-asking.md).
+Back to the [rules index](../../rules/index.md).
 
 # Verify before asking
 
+## In brief
+
+Inspect files, directories, configuration, environment, databases, and available tools for the answer. Recheck facts recalled from earlier sessions. Apply any criterion the user already supplied and state the decision. Ask only for a judgment, preference, or inaccessible fact.
+
+**Enforcement:** none.
+
 **When this applies:** Before asking the user any clarifying question during discovery, scoping, or implementation planning.
 
 ## Rule

package/docs/rule-guides/verify-runtime-state.md

@@ -1,7 +1,13 @@
-Back to the [rule entry](../../rules/verify-runtime-state.md).
+Back to the [rules index](../../rules/index.md).
 
 # Verify runtime state
 
+## In brief
+
+Gather a live signal this session: process list, port probe, log, status code, or fresh reproduction. Read the user's terminal and named error log while a reported failure is still visible. Check the effect the work should produce, including each job result, loaded config, or deployed artifact; a success status alone does not establish the effect. When testing code, identify the loaded module path.
+
+**Enforcement:** none.
+
 **When this applies:** Before stating that a component is fine, healthy, innocent, or working: during debugging, triage, or any judgment about whether something runs.
 
 ## Rule

package/hooks/blocking/code_rules_enforcer.py

@@ -118,9 +118,10 @@ from code_rules_paths_syspath import (  # noqa: E402
     check_hardcoded_user_paths,
     check_sys_path_insert_deduplication_guard,
 )
-from code_rules_shared import (  # noqa: E402
+from code_rules_shared import (
     changed_line_numbers,
     get_file_extension,
+    is_agent_home_tooling_outside_working_directory,
     is_ephemeral_script_path,
     is_hook_infrastructure,
     is_test_file,
@@ -754,6 +755,13 @@ def prior_and_post_edit_content(
     return existing_content, apply_edits(existing_content, [one_edit])
 
 
+def _is_exempt_tooling(file_path: str, repository_root: str) -> bool:
+    """Return whether the path is hook infrastructure or agent-home tooling outside the cwd."""
+    return is_hook_infrastructure(file_path) or is_agent_home_tooling_outside_working_directory(
+        file_path, repository_root
+    )
+
+
 def _is_validated_target(file_path: str, repository_root: str = "") -> bool:
     """Return whether the path is subject to code-rules validation.
 
@@ -764,14 +772,15 @@ def _is_validated_target(file_path: str, repository_root: str = "") -> bool:
             scratch merely because the repository sits under ``/tmp``.
 
     Returns:
-        True when the path is non-empty, outside hook infrastructure, and
-        carries a code extension; False for every exempt path.
+        Whether the path is non-empty, outside hook infrastructure, outside
+        agent-home tooling that sits beyond ``repository_root``, and carries a
+        code extension.
     """
     if not file_path:
         return False
     if is_ephemeral_script_path(file_path, repository_root):
         return False
-    if is_hook_infrastructure(file_path):
+    if _is_exempt_tooling(file_path, repository_root):
         return False
     return get_file_extension(file_path) in ALL_CODE_EXTENSIONS
 
@@ -791,13 +800,14 @@ def _is_hook_infrastructure_python_target(file_path: str, repository_root: str =
             scratch merely because the repository sits under ``/tmp``.
 
     Returns:
-        True when the path names a Python file inside hook infrastructure.
+        Whether the path names a Python file inside hook infrastructure or
+        inside agent-home tooling that sits beyond ``repository_root``.
     """
     if not file_path:
         return False
     if is_ephemeral_script_path(file_path, repository_root):
         return False
-    if not is_hook_infrastructure(file_path):
+    if not _is_exempt_tooling(file_path, repository_root):
         return False
     return get_file_extension(file_path) in ALL_PYTHON_EXTENSIONS
 

package/hooks/blocking/code_rules_shared.py

@@ -69,6 +69,27 @@ def is_agent_home_tooling(file_path: str) -> bool:
     return any(each_pattern in path_lower for each_pattern in ALL_AGENT_HOME_TOOLING_PATTERNS)
 
 
+def is_agent_home_tooling_outside_working_directory(file_path: str, repository_root: str) -> bool:
+    """Check whether a path is agent-home tooling that sits outside the session cwd.
+
+    A repository checked out under an agent home, such as
+    ``~/.grok/runs/<repo>/``, is project code whenever the session works inside
+    it, so only agent-home paths outside the payload ``cwd`` stay exempt.
+
+    Args:
+        file_path: The candidate path to classify.
+        repository_root: The PreToolUse payload's ``cwd``, or an empty string
+            when the payload names none.
+
+    Returns:
+        Whether the path sits under a recognized agent home directory and
+        outside ``repository_root``.
+    """
+    return is_agent_home_tooling(file_path) and not _is_at_or_under_payload_working_directory(
+        file_path, {"cwd": repository_root}
+    )
+
+
 def is_test_file(file_path: str) -> bool:
     """Check if file is a test file."""
     path_lower = file_path.lower()
@@ -502,7 +523,7 @@ def is_ephemeral_path(file_path: str, hook_payload: dict | None = None) -> bool:
     checked out under ``/tmp`` or ``~/.grok/runs/`` still receives full
     enforcement. The scratchpad match reads the session id from the payload
     when supplied, else the harness environment variable. The code-rules and TDD gates call the underlying predicates
-    ``is_ephemeral_script_path``, ``is_agent_home_tooling``, and
+    ``is_ephemeral_script_path``, ``is_agent_home_tooling_outside_working_directory``, and
     ``is_under_session_scratchpad`` directly.
 
     Args:
@@ -517,9 +538,7 @@ def is_ephemeral_path(file_path: str, hook_payload: dict | None = None) -> bool:
     repository_root = str((hook_payload or {}).get("cwd") or "")
     if is_ephemeral_script_path(file_path, repository_root):
         return True
-    if is_agent_home_tooling(file_path) and not _is_at_or_under_payload_working_directory(
-        file_path, hook_payload or {}
-    ):
+    if is_agent_home_tooling_outside_working_directory(file_path, repository_root):
         return True
     return is_under_session_scratchpad(file_path, hook_payload or {})
 

package/hooks/blocking/haiku_spawn_slim_gate.py

@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+"""PreToolUse gate: deny a Haiku agent spawned inside this session.
+
+Registered on ``Agent|Task`` and ``mcp__hearthbot__start_thread_session``. An
+in-session spawn shares this session's settings, plugins, MCP servers, and
+CLAUDE.md files, so a Haiku agent started that way cannot run on the slim
+profile. The deny reason gives the headless command that loads the profile.
+
+::
+
+    model "haiku"                       -> deny with the headless command
+    model "claude-haiku-5-5"            -> deny with the headless command
+    model "opus", "sonnet", or omitted  -> no output; the call runs unchanged
+
+A spawn that names no model passes, even when the subagent's definition or
+``CLAUDE_CODE_SUBAGENT_MODEL`` resolves it to Haiku.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+hooks_root_directory = str(Path(__file__).resolve().parent.parent)
+if hooks_root_directory not in sys.path:
+    sys.path.insert(0, hooks_root_directory)
+
+from hooks_constants.haiku_spawn_slim_gate_constants import (
+    DENY_DECISION,
+    HAIKU_MODEL_FAMILY,
+    HOOK_EVENT_NAME,
+    MODEL_INPUT_KEY,
+    PERMISSION_DECISION_REASON_KEY,
+    SLIM_PROFILE_DENY_REASON,
+    TOOL_INPUT_KEY,
+)
+from hooks_constants.hook_specific_output_keys import (
+    HOOK_EVENT_NAME_KEY,
+    HOOK_SPECIFIC_OUTPUT_KEY,
+    PERMISSION_DECISION_KEY,
+)
+from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+
+
+def is_haiku_model(model: object) -> bool:
+    """Return True when the spawn's model field names the Haiku family.
+
+    ::
+
+        "haiku" -> True     "claude-haiku-4-5-20251001" -> True
+        "opus" -> False     None -> False
+
+    Args:
+        model: The ``model`` field of the spawn input.
+    """
+    return isinstance(model, str) and HAIKU_MODEL_FAMILY in model.lower()
+
+
+def decide_hook_output(tool_input: object) -> dict[str, object] | None:
+    """Choose the hook's output for one spawn.
+
+    Args:
+        tool_input: The ``tool_input`` of the PreToolUse payload.
+
+    Returns:
+        None to pass the call through unchanged, else the deny output.
+    """
+    if not isinstance(tool_input, dict) or not is_haiku_model(tool_input.get(MODEL_INPUT_KEY)):
+        return None
+    return {
+        HOOK_SPECIFIC_OUTPUT_KEY: {
+            HOOK_EVENT_NAME_KEY: HOOK_EVENT_NAME,
+            PERMISSION_DECISION_KEY: DENY_DECISION,
+            PERMISSION_DECISION_REASON_KEY: SLIM_PROFILE_DENY_REASON,
+        }
+    }
+
+
+def main() -> int:
+    """Read the PreToolUse payload and print the decision.
+
+    Returns:
+        0 in every case.
+    """
+    hook_payload = read_hook_input_dictionary_from_stdin()
+    tool_input = hook_payload.get(TOOL_INPUT_KEY) if hook_payload is not None else None
+    hook_output = decide_hook_output(tool_input)
+    if hook_output is not None:
+        sys.stdout.write(json.dumps(hook_output))
+        sys.stdout.flush()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/hooks/blocking/reply_length_gate.py

@@ -41,6 +41,15 @@ Each non-empty line counts as its own sentence, so a list counts one
 sentence per item. URLs, markdown link targets, inline code spans, and
 fenced blocks carry no words.
 
+With visual reply mode on, the gate also runs the checks in
+``visual_reply_rules.py``. The mode is off until
+``~/.claude/visual-reply-mode.json`` holds ``{"enabled": true}``. A reply
+or a decision card may hold no abbreviation and no tracker number outside
+a link. A reply of more than one sentence needs a widget or a page earlier
+in the turn. A turn sends one reply, so a reply after a delivered reply in
+the same turn is denied. A widget may hold no anchor link, since a widget
+link does not open in the Claude app.
+
 A length limit is a smell elsewhere in this package, recorded and fixed in a
 later pass. A posted reply reaches the user the moment it sends and has no
 later pass, so this gate denies it and the model resends a shorter one.
@@ -58,6 +67,15 @@ if hooks_root_directory not in sys.path:
     sys.path.insert(0, hooks_root_directory)
 
 from json_file_reader import read_json_object
+from visual_reply_rules import (
+    VisualReplyRules,
+    abbreviation_violation,
+    load_rules,
+    mode_enabled,
+    second_reply_violation,
+    visual_violation,
+    widget_anchor_violation,
+)
 from hooks_constants.hook_block_logger import log_hook_block
 from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
 from hooks_constants.reply_length_gate_constants import (
@@ -101,6 +119,7 @@ from hooks_constants.reply_length_gate_constants import (
     TOO_MANY_SENTENCES_MESSAGE,
     TOOL_INPUT_KEY,
     TOOL_NAME_KEY,
+    TRANSCRIPT_PATH_KEY,
     UNLINKED_PULL_REQUEST_MESSAGE,
     UNLINKED_PULL_REQUEST_PATTERN,
     UNSOURCED_CAUSE_MESSAGE,
@@ -176,12 +195,17 @@ def unsourced_cause_violation(reply_text: str) -> str | None:
     return None
 
 
-def unlinked_pull_request_violation(reply_text: str) -> str | None:
-    """Return the deny reason for a pull request number outside a link, or None."""
+def prose_outside_links(reply_text: str) -> str:
+    """Remove fenced blocks, code spans, whole markdown links and URLs."""
     without_fences = FENCED_BLOCK_PATTERN.sub(" ", reply_text)
     without_code = INLINE_CODE_PATTERN.sub(" ", without_fences)
     without_links = MARKDOWN_LINK_PATTERN.sub(" ", without_code)
-    unlinked_match = UNLINKED_PULL_REQUEST_PATTERN.search(URL_PATTERN.sub(" ", without_links))
+    return URL_PATTERN.sub(" ", without_links)
+
+
+def unlinked_pull_request_violation(reply_text: str) -> str | None:
+    """Return the deny reason for a pull request number outside a link, or None."""
+    unlinked_match = UNLINKED_PULL_REQUEST_PATTERN.search(prose_outside_links(reply_text))
     if unlinked_match is None:
         return None
     return UNLINKED_PULL_REQUEST_MESSAGE.format(reference=unlinked_match.group(0))
@@ -240,17 +264,24 @@ def all_card_texts(all_card_input: dict[str, object]) -> list[str]:
     ]
 
 
-def tool_violation(tool_name: object, all_tool_input: dict[str, object]) -> tuple[str, str] | None:
-    """Return the deny reason and the checked text for one call, or None when it passes."""
-    if tool_name == DECISION_CARD_TOOL_NAME:
-        card_text = CARD_TEXT_SEPARATOR.join(all_card_texts(all_tool_input))
-        card_violation = banned_word_violation(card_text, configured_banned_words())
-        return None if card_violation is None else (card_violation, card_text)
-    if tool_name not in ALL_CHECKED_TOOL_NAMES:
-        return None
-    reply_text = all_tool_input.get(TEXT_KEY)
-    if not isinstance(reply_text, str):
+def active_mode_rules() -> VisualReplyRules | None:
+    """Return the visual reply rules when the mode is on and the rule file parses."""
+    if not mode_enabled(Path.home() / CLAUDE_HOME_DIRECTORY_NAME):
         return None
+    return load_rules()
+
+
+def card_violation(card_text: str, mode_rules: VisualReplyRules | None) -> str | None:
+    """Return the deny reason for a decision card's prose, or None."""
+    return banned_word_violation(card_text, configured_banned_words()) or (
+        None if mode_rules is None else abbreviation_violation(prose_outside_links(card_text), mode_rules)
+    )
+
+
+def reply_violation(
+    reply_text: str, transcript_path: object, mode_rules: VisualReplyRules | None
+) -> str | None:
+    """Return the deny reason for a reply's text, or None."""
     violation = (
         length_violation(reply_text)
         or mid_sentence_colon_violation(reply_text)
@@ -259,6 +290,35 @@ def tool_violation(tool_name: object, all_tool_input: dict[str, object]) -> tupl
         or unsourced_cause_violation(reply_text)
         or banned_word_violation(reply_text, configured_banned_words())
     )
+    if violation is not None or mode_rules is None:
+        return violation
+    prose_text = prose_outside_links(reply_text)
+    return (
+        abbreviation_violation(prose_text, mode_rules)
+        or second_reply_violation(transcript_path, mode_rules)
+        or visual_violation(len(sentence_word_lists(reply_text)), transcript_path, mode_rules)
+    )
+
+
+def tool_violation(
+    tool_name: object, all_tool_input: dict[str, object], transcript_path: object = None
+) -> tuple[str, str] | None:
+    """Return the deny reason and the checked text for one call, or None when it passes."""
+    mode_rules = active_mode_rules()
+    if isinstance(tool_name, str) and mode_rules is not None:
+        anchor_violation = widget_anchor_violation(tool_name, all_tool_input)
+        if anchor_violation is not None:
+            return anchor_violation, str(all_tool_input)
+    if tool_name == DECISION_CARD_TOOL_NAME:
+        card_text = CARD_TEXT_SEPARATOR.join(all_card_texts(all_tool_input))
+        violation = card_violation(card_text, mode_rules)
+        return None if violation is None else (violation, card_text)
+    if tool_name not in ALL_CHECKED_TOOL_NAMES:
+        return None
+    reply_text = all_tool_input.get(TEXT_KEY)
+    if not isinstance(reply_text, str):
+        return None
+    violation = reply_violation(reply_text, transcript_path, mode_rules)
     return None if violation is None else (violation, reply_text)
 
 
@@ -270,7 +330,7 @@ def main() -> int:
     tool_input = hook_input.get(TOOL_INPUT_KEY)
     if not isinstance(tool_input, dict):
         return ALLOW_EXIT_CODE
-    checked = tool_violation(tool_name, tool_input)
+    checked = tool_violation(tool_name, tool_input, hook_input.get(TRANSCRIPT_PATH_KEY))
     if checked is None:
         return ALLOW_EXIT_CODE
     violation, reply_text = checked

package/hooks/blocking/state_description_blocker.py

@@ -500,7 +500,7 @@ def build_deny_payload(deny_reason: str) -> dict[str, object]:
                 "only the current state. For example:\n"
                 '  BAD: "Uses X instead of Y"  →  GOOD: "Uses X"\n'
                 '  BAD: "Previously configured via Z"  →  GOOD: "Configured via Z"\n'
-                "Apply ~/.claude/rules/asd-ste100-language.md for user-facing language."
+                "Apply ~/.claude/docs/rule-guides/asd-ste100-language.md for user-facing language."
             ),
         },
         "systemMessage": "Agent wrote comparative/historical language - describe current state only",

package/hooks/blocking/test_code_rules_enforcer_agent_home_tooling.py

@@ -11,6 +11,7 @@ so the repository code rules do not govern it::
 
 from __future__ import annotations
 
+import json
 import os
 from subprocess import CompletedProcess
 import tempfile
@@ -20,8 +21,9 @@ import pytest
 
 from blocking import _path_setup  # noqa: F401  (pins this checkout ahead of sibling worktrees)
 import code_rules_enforcer_test_support
+from blocking.code_rules_enforcer import main as enforcer_main
 from blocking.code_rules_shared import is_agent_home_tooling, is_ephemeral_path
-from code_rules_enforcer_test_support import run_precheck
+from code_rules_enforcer_test_support import run_precheck, run_serialized_payload_entrypoint
 
 _VIOLATING_PRODUCTION_SOURCE = "def process_data(payload: str) -> None:\n    print(payload)\n"
 
@@ -122,3 +124,54 @@ def test_enforcer_still_flags_the_same_source_in_a_project_path() -> None:
     completed = _check_as(_VIOLATING_PRODUCTION_SOURCE, target)
 
     assert completed.returncode != 0
+
+
+def _run_enforcer_with_payload(all_pretooluse_payload: dict[str, object]) -> str:
+    """Drive the enforcer's stdin entry point and return what it wrote to stdout."""
+    captured_stdout, _exit_code = run_serialized_payload_entrypoint(
+        enforcer_main, json.dumps(all_pretooluse_payload)
+    )
+    return captured_stdout
+
+
+def test_enforcer_applies_every_rule_to_a_repository_checked_out_under_the_agent_home(
+    tmp_path_factory: pytest.TempPathFactory,
+) -> None:
+    home_root = tmp_path_factory.mktemp("agent-home")
+    repository_directory = home_root / "home" / "example" / ".grok" / "runs" / "checkout"
+    service_module = repository_directory / "src" / "service.py"
+    service_module.parent.mkdir(parents=True)
+    service_module.write_text(
+        "def process_data(payload: str) -> None:\n    return None\n", encoding="utf-8"
+    )
+
+    captured_stdout = _run_enforcer_with_payload(
+        {
+            "tool_name": "Edit",
+            "tool_input": {
+                "file_path": str(service_module),
+                "old_string": "    return None\n",
+                "new_string": "    print(payload)\n",
+            },
+            "cwd": str(repository_directory),
+        }
+    )
+
+    assert '"permissionDecision": "deny"' in captured_stdout
+    assert "Library print()" in captured_stdout
+    assert "banned noun word" in captured_stdout
+
+
+def test_enforcer_keeps_agent_home_tooling_outside_the_cwd_exempt() -> None:
+    helper_script = os.path.join("/home/example", ".grok", "runs", "worktree-health", "health.py")
+    repository_directory = os.path.join("/home/example", ".grok", "runs", "checkout")
+
+    captured_stdout = _run_enforcer_with_payload(
+        {
+            "tool_name": "Write",
+            "tool_input": {"file_path": helper_script, "content": _VIOLATING_PRODUCTION_SOURCE},
+            "cwd": repository_directory,
+        }
+    )
+
+    assert captured_stdout == ""

package/hooks/blocking/test_code_rules_shared.py

@@ -374,3 +374,36 @@ def test_ephemeral_path_stays_true_for_agent_home_file_outside_payload_cwd() ->
     helper_script = os.path.join("/home/example", ".grok", "runs", "worktree-health", "health.py")
 
     assert _SHARED_MODULE.is_ephemeral_path(helper_script, {"cwd": checkout_directory}) is True
+
+
+def test_agent_home_tooling_under_the_cwd_is_not_exempt() -> None:
+    checkout_directory = os.path.join("/home/example", ".grok", "runs", "checkout")
+    repository_module = os.path.join(checkout_directory, "src", "service.py")
+
+    assert (
+        _SHARED_MODULE.is_agent_home_tooling_outside_working_directory(
+            repository_module, checkout_directory
+        )
+        is False
+    )
+
+
+def test_agent_home_tooling_outside_the_cwd_is_exempt() -> None:
+    checkout_directory = os.path.join("/home/example", ".grok", "runs", "checkout")
+    helper_script = os.path.join("/home/example", ".grok", "runs", "worktree-health", "health.py")
+
+    assert _SHARED_MODULE.is_agent_home_tooling_outside_working_directory(
+        helper_script, checkout_directory
+    )
+
+
+def test_agent_home_tooling_with_no_cwd_is_exempt() -> None:
+    helper_script = os.path.join("/home/example", ".grok", "runs", "worktree-health", "health.py")
+
+    assert _SHARED_MODULE.is_agent_home_tooling_outside_working_directory(helper_script, "")
+
+
+def test_hook_infrastructure_excludes_agent_home_tooling() -> None:
+    helper_script = os.path.join("/home/example", ".grok", "runs", "worktree-health", "health.py")
+
+    assert _SHARED_MODULE.is_hook_infrastructure(helper_script) is False