claude-dev-env 8.9.0 → 8.11.0

package/bin/install.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, copyFileSync, unlinkSync, rmSync, rmdirSync, renameSync, realpathSync, lstatSync, constants as filesystemConstants } from 'node:fs';
-import { join, dirname, resolve, relative, basename, isAbsolute, extname } from 'node:path';
+import { join, dirname, resolve, relative, basename, isAbsolute, extname, sep } from 'node:path';
 import { homedir } from 'node:os';
 import { execSync, execFileSync, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
@@ -38,12 +38,14 @@ import {
     SUBAGENT_MODEL_POLICY_FILE_NAME,
     WINDOWS_PYTHON_LAUNCHER_COMMAND,
     PYTHON_PROBE_TIMEOUT_MILLISECONDS,
-    CODEX_NATIVE_ROUTING_MATCHER,
+    ALL_CODEX_NATIVE_PRE_TOOL_USE_MATCHERS,
 } from './install-constants.mjs';
 import {
     installPstackPlugin,
     shouldInstallPstackPlugin,
 } from './install-pstack-plugin.mjs';
+import { seedCodexPstackModels } from './seed-codex-pstack-models.mjs';
+import { writeCodexSkillLoadBlock } from './codex-skill-load-block.mjs';
 import {
     continuityHostConfigurationPaths,
     removeContinuityHooks,
@@ -1173,11 +1175,9 @@ export function copyTree(sourceBase, destBase, options = {}) {
  * @param {string} backupName The managed file name used in the backup path.
  * @returns {string|null} The backup path when existing content differs.
  */
-function backupHubBeforeOverwrite(destPath, incomingPath, backupName) {
+function backupHubBeforeOverwrite(destPath, incomingText, backupName) {
     if (!existsSync(destPath)) return null;
-    const existingBytes = readFileSync(destPath);
-    const incomingBytes = readFileSync(incomingPath);
-    if (existingBytes.equals(incomingBytes)) return null;
+    if (readFileSync(destPath, 'utf8') === incomingText) return null;
     const backupsDir = join(CLAUDE_HOME, 'backups');
     mkdirSync(backupsDir, { recursive: true });
     const stamp = new Date().toISOString().replace(/[:.]/g, '-');
@@ -2102,7 +2102,7 @@ function selectCodexNativeHooksConfig(hooksConfig) {
         ...hooksConfig,
         hooks: {
             PreToolUse: Array.isArray(preToolUseGroups)
-                ? preToolUseGroups.filter(group => group?.matcher === CODEX_NATIVE_ROUTING_MATCHER)
+                ? preToolUseGroups.filter(group => ALL_CODEX_NATIVE_PRE_TOOL_USE_MATCHERS.has(group?.matcher))
                 : [],
         },
     };
@@ -2371,6 +2371,15 @@ function pruneStaleFilesAcrossManagedRoots(priorInstalledFiles, currentInstalled
             skillsPrunedCount += rootOutcome.prunedCount;
         }
     }
+    const retiredClaudeGuidancePath = join(CLAUDE_HOME, 'AGENTS.md');
+    const retiredGuidanceOutcome = pruneStaleInstalledFiles(
+        priorInstalledFiles?.filter(priorFile => resolve(priorFile) === retiredClaudeGuidancePath) ?? null,
+        currentInstalledFiles,
+        CLAUDE_HOME,
+        backupRoot,
+    );
+    prunedCount += retiredGuidanceOutcome.prunedCount;
+    failedPaths.push(...retiredGuidanceOutcome.failedPaths);
     return { prunedCount, skillsPrunedCount, failedPaths };
 }
 
@@ -2769,6 +2778,23 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
     if (!selectedGroups && shouldInstallPstackPlugin()) {
         const pstackPlugin = installPstackPluginForHosts();
         summary.pstackPlugin = pstackPlugin;
+        if (pstackPlugin.hosts.some(host => host.host === 'codex' && host.status === 'installed')) {
+            summary.codexPstackModels = seedCodexPstackModels(
+                INSTALL_ROOT_RESOLUTION.codexHomeDirectory,
+            );
+            if (summary.codexPstackModels) {
+                allInstalledFiles.push(...summary.codexPstackModels);
+                for (const eachPath of summary.codexPstackModels) {
+                    allUserOwnedPreferencePaths.add(eachPath);
+                }
+            }
+            const skillLoadGuidancePath = writeCodexSkillLoadBlock(
+                INSTALL_ROOT_RESOLUTION.codexHomeDirectory,
+            );
+            if (skillLoadGuidancePath) {
+                console.log(`  \u2713 ${skillLoadGuidancePath} (Codex skill-load line)`);
+            }
+        }
         for (const eachHost of pstackPlugin.hosts) {
             console.log(eachHost.warning
                 ? `  Pstack (${eachHost.host}): ${eachHost.status} \u2014 ${eachHost.warning}`
@@ -2877,31 +2903,27 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
         );
     }
 
-    const claudeHubSource = join(PACKAGE_ROOT, '.claude', 'CLAUDE.md');
-    if (existsSync(claudeHubSource)) {
-        const claudeHubDest = join(CLAUDE_HOME, 'CLAUDE.md');
-        const backupPath = backupHubBeforeOverwrite(claudeHubDest, claudeHubSource, 'CLAUDE.md');
-        if (backupPath) {
-            console.log(
-                `  \u21bb ${relative(CLAUDE_HOME, backupPath)} (previous CLAUDE.md hub preserved)`
-            );
-        }
-        copyFileSync(claudeHubSource, claudeHubDest);
-        allInstalledFiles.push(claudeHubDest);
-        console.log(`  \u2713 ${relative(CLAUDE_HOME, claudeHubDest)} (hub)`);
-    }
     const agentsHubSource = join(PACKAGE_ROOT, 'AGENTS.md');
     if (existsSync(agentsHubSource)) {
-        const agentsHubDest = join(CLAUDE_HOME, 'AGENTS.md');
-        const backupPath = backupHubBeforeOverwrite(agentsHubDest, agentsHubSource, 'AGENTS.md');
-        if (backupPath) {
-            console.log(
-                `  \u21bb ${relative(CLAUDE_HOME, backupPath)} (previous AGENTS.md guidance preserved)`
-            );
+        const agentsHubDest = join(AGENTS_HOME, 'AGENTS.md');
+        const claudeHubDest = join(CLAUDE_HOME, 'CLAUDE.md');
+        const claudeHubText = `@${relative(CLAUDE_HOME, agentsHubDest).split(sep).join('/')}\n`;
+        const allHubWrites = [
+            { destPath: agentsHubDest, text: readFileSync(agentsHubSource, 'utf8'), label: 'AGENTS.md', role: 'shared guidance' },
+            { destPath: claudeHubDest, text: claudeHubText, label: 'CLAUDE.md', role: 'hub' },
+        ];
+        mkdirSync(AGENTS_HOME, { recursive: true });
+        for (const eachHubWrite of allHubWrites) {
+            const backupPath = backupHubBeforeOverwrite(eachHubWrite.destPath, eachHubWrite.text, eachHubWrite.label);
+            if (backupPath) {
+                console.log(
+                    `  \u21bb ${relative(CLAUDE_HOME, backupPath)} (previous ${eachHubWrite.label} preserved)`
+                );
+            }
+            writeFileSync(eachHubWrite.destPath, eachHubWrite.text);
+            allInstalledFiles.push(eachHubWrite.destPath);
+            console.log(`  \u2713 ${eachHubWrite.destPath} (${eachHubWrite.role})`);
         }
-        copyFileSync(agentsHubSource, agentsHubDest);
-        allInstalledFiles.push(agentsHubDest);
-        console.log(`  \u2713 ${relative(CLAUDE_HOME, agentsHubDest)} (canonical guidance)`);
     }
     const isFullInstall = !selectedGroups;
     const didPruneRun = isFullInstall && UNRESOLVED_DEPENDENCY_NAMES.length === 0;
@@ -3322,10 +3344,10 @@ Profile selection (--profile/--profiles) is mutually exclusive with --target.
 Target selection finishes before any mutation. Each target writes its own manifest
 with package, version, targetIdentity, managedRoot, files, and skills.
 
-If ~/.claude/CLAUDE.md already exists and differs from the package copy, the installer
-writes the previous contents to ~/.claude/backups/CLAUDE.md.<timestamp>.bak first.
-If ~/.claude/AGENTS.md already exists and differs from the package copy, the installer
-writes the previous contents to ~/.claude/backups/AGENTS.md.<timestamp>.bak first.
+The package guidance lands once at ~/.agents/AGENTS.md, and ~/.claude/CLAUDE.md
+holds one import line that loads it. If either file already exists with other
+contents, the installer writes the previous contents to
+~/.claude/backups/<name>.<timestamp>.bak first.
 `);
 }
 

package/bin/install.test.mjs

@@ -52,6 +52,11 @@ import {
     retainNewestRunBackupOnly,
 } from './install.mjs';
 import { EVER_SHIPPED_SKILL_NAMES } from './ever-shipped-skills.mjs';
+import {
+    SKILL_LOAD_BLOCK_START,
+    SKILL_LOAD_INSTRUCTION,
+    withSkillLoadBlock,
+} from './codex-skill-load-block.mjs';
 
 
 test('installer reports the authoritative Git hook names', () => {
@@ -3064,6 +3069,34 @@ test('a full install adds the pstack marketplace and plugin on both hosts', t =>
     ]);
     assert.match(installerOutput, /Pstack \(claude\): installed/);
     assert.match(installerOutput, /Pstack \(codex\): installed/);
+    const codexHome = join(sandbox.homeDirectory, '.codex');
+    const sheet = readFileSync(join(codexHome, 'pstack-models.md'), 'utf8');
+    const agents = readFileSync(join(codexHome, 'AGENTS.md'), 'utf8');
+    assert.match(sheet, /^session hook: on$/m);
+    assert.match(agents, /^feature, refactoring: gpt-6-sol$/m);
+    assert.doesNotMatch(agents, /^session hook:/m);
+    assert.ok(agents.startsWith(`${SKILL_LOAD_BLOCK_START}\n${SKILL_LOAD_INSTRUCTION}\n`));
+    assert.equal(existsSync(join(sandbox.homeDirectory, '.claude', 'pstack-models.md')), false);
+    const manifestPath = join(sandbox.homeDirectory, '.claude', '.claude-dev-env-manifest.json');
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    assert.equal(manifest.files.includes(join(codexHome, 'pstack-models.md')), false);
+    assert.equal(manifest.files.includes(join(codexHome, 'AGENTS.md')), false);
+});
+
+test('a repeat install preserves Codex pstack configuration', t => {
+    const sandbox = pstackPluginSandbox(t);
+    const codexHome = join(sandbox.homeDirectory, '.codex');
+    runPstackInstaller(sandbox.homeDirectory, [], sandbox.environment);
+    writeFileSync(join(codexHome, 'AGENTS.md'), 'Custom Codex guidance\n');
+    writeFileSync(join(codexHome, 'pstack-models.md'), 'session hook: off\n');
+
+    runPstackInstaller(sandbox.homeDirectory, [], sandbox.environment);
+
+    assert.equal(
+        readFileSync(join(codexHome, 'AGENTS.md'), 'utf8'),
+        withSkillLoadBlock('Custom Codex guidance\n'),
+    );
+    assert.equal(readFileSync(join(codexHome, 'pstack-models.md'), 'utf8'), 'session hook: off\n');
 });
 
 test('an absent host command is reported and leaves the other host installed', t => {
@@ -3085,6 +3118,8 @@ test('an absent host command is reported and leaves the other host installed', t
         sandbox.recordedCommands().filter(eachCommand => eachCommand.startsWith('codex')),
         [],
     );
+    assert.equal(existsSync(join(sandbox.homeDirectory, '.codex', 'pstack-models.md')), false);
+    assert.equal(existsSync(join(sandbox.homeDirectory, '.codex', 'AGENTS.md')), false);
 });
 
 test('--no-pstack leaves both hosts untouched', t => {
@@ -3096,6 +3131,8 @@ test('--no-pstack leaves both hosts untouched', t => {
 
     assert.deepEqual(sandbox.recordedCommands(), []);
     assert.doesNotMatch(installerOutput, /Pstack \(/);
+    assert.equal(existsSync(join(sandbox.homeDirectory, '.codex', 'pstack-models.md')), false);
+    assert.equal(existsSync(join(sandbox.homeDirectory, '.codex', 'AGENTS.md')), false);
 });
 
 function continuityCommandCount(configurationPath) {

package/bin/install.transaction.test.mjs

@@ -270,13 +270,6 @@ test('runWithInstallTransaction commits and discards journal on success', () =>
     rmSync(box.root, { recursive: true, force: true });
 });
 
-/**
- * Spawn the real installer against a sandbox home with optional fault phase.
- *
- * @param {string} homeDirectory
- * @param {string[]} extraArguments
- * @param {{ faultPhase?: string|null }} [options]
- */
 function runInstaller(homeDirectory, extraArguments, options = {}) {
     const childEnvironment = {
         ...process.env,
@@ -285,6 +278,7 @@ function runInstaller(homeDirectory, extraArguments, options = {}) {
         USERPROFILE: homeDirectory,
         GIT_CONFIG_GLOBAL: join(homeDirectory, '.gitconfig'),
         CODEX_HOME: join(homeDirectory, '.codex'),
+        ...options.environment,
     };
     if (options.faultPhase) {
         childEnvironment[INSTALL_FAULT_ENV] = options.faultPhase;
@@ -298,6 +292,34 @@ function runInstaller(homeDirectory, extraArguments, options = {}) {
     });
 }
 
+test('a later install fault removes newly seeded Codex pstack files', () => {
+    const homeDirectory = mkdtempSync(join(tmpdir(), 'cdev-txn-codex-pstack-'));
+    try {
+        const codexCommandPath = join(
+            homeDirectory,
+            process.platform === 'win32' ? 'codex.cmd' : 'codex',
+        );
+        writeFileSync(
+            codexCommandPath,
+            process.platform === 'win32' ? '@echo off\r\nexit /b 0\r\n' : '#!/bin/sh\nexit 0\n',
+            { mode: 0o755 },
+        );
+        const failedRun = runInstaller(homeDirectory, [], {
+            faultPhase: FAULT_PHASES.AFTER_MANIFEST_WRITE,
+            environment: {
+                CDE_INSTALL_PSTACK: '1',
+                CDE_CODEX_EXECUTABLE: codexCommandPath,
+            },
+        });
+        assert.notEqual(failedRun.status, 0, failedRun.stdout + failedRun.stderr);
+        assert.match(`${failedRun.stdout}${failedRun.stderr}`, /after_manifest_write/);
+        assert.equal(existsSync(join(homeDirectory, '.codex', 'pstack-models.md')), false);
+        assert.equal(existsSync(join(homeDirectory, '.codex', 'AGENTS.md')), false);
+    } finally {
+        rmSync(homeDirectory, { recursive: true, force: true });
+    }
+});
+
 function seedPriorInstall(homeDirectory) {
     const claudeDirectory = join(homeDirectory, '.claude');
     const rulesFile = join(claudeDirectory, 'rules', 'prior.md');

package/bin/seed-codex-pstack-models.mjs

@@ -0,0 +1,27 @@
+import { copyFileSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, constants as filesystemConstants } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const CODEX_PRESET_PATH = fileURLToPath(new URL('../pstack-codex-models.md', import.meta.url));
+
+function pathExists(path) {
+    return lstatSync(path, { throwIfNoEntry: false }) !== undefined;
+}
+
+export function seedCodexPstackModels(codexHome, writeAgentGuidance = writeFileSync) {
+    const sheetPath = join(codexHome, 'pstack-models.md');
+    const agentsPath = join(codexHome, 'AGENTS.md');
+    if (pathExists(sheetPath) || pathExists(agentsPath)) return null;
+
+    const preset = readFileSync(CODEX_PRESET_PATH, 'utf8');
+    const agentGuidance = preset.replace(/^session hook: on\n?$/m, '');
+    mkdirSync(codexHome, { recursive: true });
+    copyFileSync(CODEX_PRESET_PATH, sheetPath, filesystemConstants.COPYFILE_EXCL);
+    try {
+        writeAgentGuidance(agentsPath, agentGuidance, { encoding: 'utf8', flag: 'wx' });
+    } catch (writeError) {
+        unlinkSync(sheetPath);
+        throw writeError;
+    }
+    return [sheetPath, agentsPath];
+}

package/bin/seed-codex-pstack-models.test.mjs

@@ -0,0 +1,72 @@
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { seedCodexPstackModels } from './seed-codex-pstack-models.mjs';
+
+test('fresh Codex home gets the selected roles and hook setting', (context) => {
+    const root = mkdtempSync(join(tmpdir(), 'cde-pstack-models-'));
+    context.after(() => rmSync(root, { recursive: true, force: true }));
+    const codexHome = join(root, '.codex');
+    const claudeHome = join(root, '.claude');
+    mkdirSync(claudeHome);
+    writeFileSync(join(claudeHome, 'CLAUDE.md'), 'Claude guidance\n');
+
+    const paths = seedCodexPstackModels(codexHome);
+    const sheet = readFileSync(join(codexHome, 'pstack-models.md'), 'utf8');
+    const agents = readFileSync(join(codexHome, 'AGENTS.md'), 'utf8');
+    assert.deepEqual(paths, [join(codexHome, 'pstack-models.md'), join(codexHome, 'AGENTS.md')]);
+    assert.match(sheet, /^feature, refactoring: gpt-6-sol$/m);
+    assert.match(sheet, /^bug-fix: gpt-6-astra$/m);
+    assert.match(sheet, /^how explorer: gpt-6-luna$/m);
+    assert.match(sheet, /^arena runners: gpt-6-astra, gpt-6-sol, gpt-6-luna$/m);
+    assert.match(sheet, /^session hook: on$/m);
+    assert.match(agents, /^feature, refactoring: gpt-6-sol$/m);
+    assert.doesNotMatch(agents, /^session hook:/m);
+    assert.equal(readFileSync(join(claudeHome, 'CLAUDE.md'), 'utf8'), 'Claude guidance\n');
+    assert.equal(existsSync(join(claudeHome, 'pstack-models.md')), false);
+});
+
+test('existing Codex configuration stays untouched on repeat installs', (context) => {
+    const root = mkdtempSync(join(tmpdir(), 'cde-pstack-models-'));
+    context.after(() => rmSync(root, { recursive: true, force: true }));
+    const codexHome = join(root, '.codex');
+    seedCodexPstackModels(codexHome);
+    writeFileSync(join(codexHome, 'AGENTS.md'), 'Custom agents\n');
+
+    assert.equal(seedCodexPstackModels(codexHome), null);
+    assert.equal(readFileSync(join(codexHome, 'AGENTS.md'), 'utf8'), 'Custom agents\n');
+});
+
+test('a failed AGENTS write removes only the sheet created by that attempt', (context) => {
+    const root = mkdtempSync(join(tmpdir(), 'cde-pstack-models-'));
+    context.after(() => rmSync(root, { recursive: true, force: true }));
+    const codexHome = join(root, '.codex');
+    const claudeHome = join(root, '.claude');
+    mkdirSync(claudeHome);
+    writeFileSync(join(claudeHome, 'CLAUDE.md'), 'Existing Claude guidance\n');
+
+    const competingWrite = (agentsPath) => {
+        writeFileSync(agentsPath, 'Existing Codex guidance\n');
+        throw new Error('AGENTS.md already exists');
+    };
+    assert.throws(() => seedCodexPstackModels(codexHome, competingWrite), /already exists/);
+    assert.equal(existsSync(join(codexHome, 'pstack-models.md')), false);
+    assert.equal(readFileSync(join(codexHome, 'AGENTS.md'), 'utf8'), 'Existing Codex guidance\n');
+    assert.equal(readFileSync(join(claudeHome, 'CLAUDE.md'), 'utf8'), 'Existing Claude guidance\n');
+});
+
+for (const existingFile of ['AGENTS.md', 'pstack-models.md']) {
+    test(`partial Codex setup with ${existingFile} is preserved`, (context) => {
+        const root = mkdtempSync(join(tmpdir(), 'cde-pstack-models-'));
+        context.after(() => rmSync(root, { recursive: true, force: true }));
+        const codexHome = join(root, '.codex');
+        mkdirSync(codexHome);
+        writeFileSync(join(codexHome, existingFile), 'Custom configuration\n');
+
+        assert.equal(seedCodexPstackModels(codexHome), null);
+        assert.equal(readFileSync(join(codexHome, existingFile), 'utf8'), 'Custom configuration\n');
+        assert.equal(existsSync(join(codexHome, existingFile === 'AGENTS.md' ? 'pstack-models.md' : 'AGENTS.md')), false);
+    });
+}

package/docs/CODE_RULES.md

@@ -75,7 +75,11 @@ Parameters follow YAGNI: add an optional parameter when a caller varies the valu
 
 ## 8. TDD PROCESS
 
-1. **RED** — failing test first. 2. **GREEN** — minimum code to pass. 3. **REFACTOR** — only if valuable.
+1. **RED** — a failing test. 2. **GREEN** — minimum code to pass. 3. **REFACTOR** — only if valuable.
+
+This loop is the default for a bug fix and for new behavior, and the TDD skill (`pstack:tdd`) carries the procedure. No hook or lint checks the order. A prototype may run ahead of its tests and adds them before the pull request goes ready. A bug fix ships with a test that reproduces the bug.
+
+**Proof of check.** Each pull request body states how the change was checked: a test, a run, a screenshot, or a measurement, named so a reviewer can repeat it. A reviewer flags a pull request whose body names no proof.
 
 ## 9. SELF-CONTAINED COMPONENTS
 

package/hooks/blocking/code_rules_enforcer.py

@@ -11,9 +11,7 @@ Advisory only (non-blocking):
 
 Companion tests live alongside this file as
 ``test_code_rules_enforcer_<suffix>.py``; the ``<suffix>`` split keeps each
-concern focused. The separate ``tdd_enforcer.py`` hook accepts any
-``test_code_rules_enforcer_*.py`` sibling as a test candidate for the
-``code_rules_*`` module family, so the suffix files satisfy its gate.
+concern focused.
 """
 import json
 import sys

package/hooks/blocking/code_rules_magic_values.py

@@ -36,9 +36,7 @@ def _mask_string_literals_preserving_length(source_line: str) -> str:
 
     Matching tests live in
     ``test_code_rules_enforcer_magic_string_masking.py``, one of the
-    ``test_code_rules_enforcer_<suffix>.py`` family files the
-    ``tdd_enforcer.py`` hook accepts as test candidates for the
-    ``code_rules_*`` module family.
+    ``test_code_rules_enforcer_<suffix>.py`` family files.
     """
 
     string_literal_pattern = re.compile(

package/hooks/blocking/code_rules_paired_test.py

@@ -1,10 +1,9 @@
 """Public-function paired-test coverage check for ``code_rules_enforcer``.
 
-The TDD gate ``tdd_enforcer.py`` requires a fresh test file to exist before a
-production module is written, but it judges coverage at file granularity: a
-module whose dedicated test file exercises some public functions while leaving
-one untested still satisfies it. This check closes that gap from both write
-orders, so a forgotten function gets a behavioral test before the
+The staged policy lint's test-pairing rule judges coverage at file
+granularity: a module whose dedicated test file exercises some public functions
+while leaving one untested still satisfies it. This check closes that gap from
+both write orders, so a forgotten function gets a behavioral test before the
 partially-covered module lands.
 
 ``check_public_function_missing_paired_test`` fires on the production-module
@@ -25,7 +24,7 @@ Both checks stay conservative to keep false positives near zero:
 
 - The production-side check runs only on a production module whose stem-matched
   test file already exists; a module with no dedicated test file is out of scope
-  and left to the file-level TDD gate. The test-side check runs only on a
+  and left to the staged lint's test-pairing rule. The test-side check runs only on a
   stem-matched test file whose paired production module exists on disk.
 - The production-side check fires only when the suite already exercises the
   module — covering at least one of its public functions, or referencing one of

package/hooks/blocking/tdd_enforcer_parts/__init__.py

@@ -1 +1 @@
-"""Decomposed concern modules the ``tdd_enforcer`` entry hook wires together."""
+"""Content analysis the policy lint's adapter pairing rule loads to exempt constants-only and import-only edits."""

package/hooks/blocking/test_code_rules_enforcer_ephemeral.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import json
 import os
 import subprocess
 import sys
@@ -21,13 +20,11 @@ if _HOOKS_DIRECTORY not in sys.path:
 from code_rules_enforcer import main as enforcer_main  # noqa: E402
 from code_rules_shared import is_ephemeral_script_path  # noqa: E402
 from code_rules_enforcer_test_support import (  # noqa: E402
-    build_write_payload,
     run_enforcer_cli,
     run_write_entrypoint,
 )
 
 _ENFORCER_SCRIPT = Path(__file__).resolve().parent / "code_rules_enforcer.py"
-_TDD_SCRIPT = Path(__file__).resolve().parent / "tdd_enforcer.py"
 
 _VIOLATING_PRODUCTION_SOURCE = "def process_data(payload: str) -> None:\n    print(payload)\n"
 
@@ -56,44 +53,6 @@ def _run_main_with_write_payload(
     return run_write_entrypoint(enforcer_main, file_path, content)
 
 
-def _run_tdd_with_write_payload(
-    file_path: str,
-    content: str,
-) -> subprocess.CompletedProcess[str]:
-    """Drive the TDD enforcer through subprocess with a Write payload.
-
-    Args:
-        file_path: The destination path the Write targets.
-        content: The production-looking content to write.
-
-    Returns:
-        The completed process carrying stdout, stderr, and the exit code.
-    """
-    write_payload = build_write_payload(file_path, content)
-    return subprocess.run(
-        [sys.executable, str(_TDD_SCRIPT)],
-        input=write_payload,
-        capture_output=True,
-        text=True,
-    )
-
-
-def _decision_from(completed: subprocess.CompletedProcess[str]) -> str | None:
-    """Extract the permissionDecision from a hook's JSON stdout.
-
-    Args:
-        completed: The completed subprocess carrying the hook's stdout.
-
-    Returns:
-        The permissionDecision string, or None when stdout is empty.
-    """
-    if not completed.stdout:
-        return None
-    parsed = json.loads(completed.stdout)
-    hook_output = parsed.get("hookSpecificOutput", {})
-    return hook_output.get("permissionDecision")
-
-
 def test_should_return_true_for_claude_job_dir_tmp_path(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
@@ -320,7 +279,7 @@ def test_should_exempt_same_path_set_on_both_gates(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    """B21: every ephemeral path exits 0 on both enforcer main and TDD enforcer main."""
+    """B21: every ephemeral path exits 0 on enforcer main."""
     monkeypatch.setenv("CLAUDE_JOB_DIR", str(tmp_path))
     all_ephemeral_paths = [
         str(tmp_path / "tmp" / "scratch.py"),
@@ -339,7 +298,3 @@ def test_should_exempt_same_path_set_on_both_gates(
         assert "deny" not in captured_stdout.lower(), (
             f"enforcer must not deny ephemeral path {each_ephemeral_path!r}"
         )
-        completed = _run_tdd_with_write_payload(each_ephemeral_path, _VIOLATING_PRODUCTION_SOURCE)
-        assert _decision_from(completed) != "deny", (
-            f"TDD enforcer must not deny ephemeral path {each_ephemeral_path!r}"
-        )

package/hooks/blocking/test_pre_tool_use_dispatcher.py

@@ -496,8 +496,8 @@ def test_aggregate_exit_code_zero_with_no_output_allows() -> None:
 def test_aggregate_explicit_allow_payload_signals_allow_decision() -> None:
     """An explicit permissionDecision allow from a hosted hook signals an allow decision.
 
-    tdd_enforcer writes an explicit allow payload on its allow path, which
-    auto-approves the write standalone. The aggregator must surface that as an
+    A hosted hook can write an explicit allow payload, which auto-approves the
+    write standalone. The aggregator must surface that as an
     explicit allow decision so the dispatcher re-emits it rather than silently
     falling back to the default permission flow.
     """
@@ -680,43 +680,6 @@ def _orphan_claude_md_payload(tmp_path: Path) -> str:
     return _write_payload(claude_md_path, orphan_table)
 
 
-def _parse_hook_allow(completed_process: subprocess.CompletedProcess[str]) -> bool:
-    """Parse one hook's subprocess result for an explicit permissionDecision allow.
-
-    Args:
-        completed_process: The completed subprocess from running a hook.
-
-    Returns:
-        True when the hook emitted an explicit allow decision.
-    """
-    stdout_text = completed_process.stdout.strip()
-    if not stdout_text:
-        return False
-    try:
-        parsed_output = json.loads(stdout_text)
-    except json.JSONDecodeError:
-        return False
-    hook_specific = parsed_output.get("hookSpecificOutput", {})
-    if not isinstance(hook_specific, dict):
-        return False
-    return hook_specific.get("permissionDecision") == "allow"
-
-
-def test_retired_tdd_hook_cannot_auto_approve_the_write(tmp_path: Path) -> None:
-    """Pairing belongs to staged lint; its edit-time auto-approval is absent."""
-    config_target_path = str(tmp_path / "config" / "timing.py")
-    constants_only_content = (
-        '"""Timing constants."""\n\nMAXIMUM_RETRIES = 3\nRETRY_DELAY_SECONDS = 5\n'
-    )
-    payload_text = _write_payload(config_target_path, constants_only_content)
-    standalone_result = _run_hook_subprocess("blocking/tdd_enforcer.py", payload_text)
-    assert _parse_hook_allow(standalone_result)
-    dispatcher_result = _run_dispatcher(payload_text)
-    dispatcher_is_deny, reason = _parse_hook_decision(dispatcher_result)
-    assert not dispatcher_is_deny, reason
-    assert not _parse_hook_allow(dispatcher_result)
-
-
 def test_runpy_hosted_hook_sees_its_own_argv_not_the_dispatchers(tmp_path: Path) -> None:
     """A runpy-hosted hook resolves its own script path as sys.argv, not the dispatcher's.
 
@@ -851,7 +814,6 @@ ALL_RETAINED_PATHS = {
 ALL_RETIRED_PATHS = {
     "validation/hook_format_validator.py",
     "blocking/code_rules_enforcer.py",
-    "blocking/tdd_enforcer.py",
     "blocking/windows_rmtree_blocker.py",
     "blocking/state_description_blocker.py",
     "blocking/subprocess_budget_completeness.py",

package/hooks/followup_ledger.py

@@ -31,6 +31,8 @@ from hooks_constants.followup_ledger_constants import (
     GIT_REFERENCE_PREFIX,
     LEDGER_APPEND_MODE,
     LEDGER_ENCODING,
+    LEDGER_IGNORE_FILE_NAME,
+    LEDGER_IGNORE_TEXT,
     MESSAGE_KEY,
     ORIGIN_COMMIT_KEY,
     RULE_ID_KEY,
@@ -88,7 +90,9 @@ def record_followup_finding(repository_root: Path, finding: FollowupFinding) ->
     """Append one finding to the repository's ledger, once.
 
     A finding already present in the ledger is left alone, so a gate that runs
-    on every commit records a standing smell a single time. Every filesystem
+    on every commit records a standing smell a single time. The ledger
+    directory carries a ``.gitignore`` matching every file in it, so the
+    ledger stays out of ``git status`` in any repository. Every filesystem
     error is swallowed, so a ledger failure leaves the caller's gate decision
     unchanged.
 
@@ -116,6 +120,9 @@ def record_followup_finding(repository_root: Path, finding: FollowupFinding) ->
     )
     try:
         ledger_path.parent.mkdir(parents=True, exist_ok=True)
+        ignore_path = ledger_path.parent / LEDGER_IGNORE_FILE_NAME
+        if not ignore_path.exists():
+            ignore_path.write_text(LEDGER_IGNORE_TEXT, encoding=LEDGER_ENCODING)
         with ledger_path.open(LEDGER_APPEND_MODE, encoding=LEDGER_ENCODING) as ledger_file:
             ledger_file.write(record_text + "\n")
     except OSError:

package/hooks/git-hooks/test_installed_policy_lint.py

@@ -14,7 +14,6 @@ from test_native_hook_support import run_git
 
 ALL_RETIRED_HOOK_PATHS = (
     "blocking/code_rules_enforcer.py",
-    "blocking/tdd_enforcer.py",
     "blocking/windows_rmtree_blocker.py",
     "blocking/state_description_blocker.py",
     "blocking/subprocess_budget_completeness.py",
@@ -26,6 +25,7 @@ ALL_RETIRED_HOOK_PATHS = (
     "blocking/plain_language_blocker.py",
     "lifecycle/config_change_guard.py",
 )
+ALL_ARCHIVED_HOOK_PATHS = ("blocking/tdd_enforcer.py",)
 PACKAGE_ROOT = Path(__file__).resolve().parents[2]
 ALL_RULE_FIXTURES = (
     ("code-rules", "src/worker.py", "from typing import Any\n\ndef worker() -> Any:\n    return None\n"),
@@ -80,7 +80,7 @@ def _legacy_settings_bytes(managed_root: Path, foreign_command: str) -> bytes:
                     "type": "command",
                     "command": f"python {managed_root.as_posix()}/hooks/{each_path}",
                     "timeout": 10,
-                } for each_path in ALL_RETIRED_HOOK_PATHS),
+                } for each_path in (*ALL_RETIRED_HOOK_PATHS, *ALL_ARCHIVED_HOOK_PATHS)),
             ],
         }]},
     }
@@ -135,6 +135,8 @@ def _assert_retired_registrations(managed_root: Path, settings_bytes: bytes, for
         source = PACKAGE_ROOT / "hooks" / each_relative_path
         installed = managed_root / "hooks" / each_relative_path
         assert hashlib.sha256(installed.read_bytes()).digest() == hashlib.sha256(source.read_bytes()).digest()
+    for each_relative_path in ALL_ARCHIVED_HOOK_PATHS:
+        assert not any(each_relative_path in each_command for each_command in all_commands)
 
 
 @pytest.fixture(scope="module")