[ptr727]

Summary

• install.py decided whether a PreToolUse or SessionEnd hook registration belonged to this kit by testing whether a bare substring (GUARD_STEM/SWEEP_STEM) appeared anywhere in the hook's command string. A maintainer's own hook whose command merely contained that substring, such as a wrapper named my-gh-write-guard-audit.sh, was silently stripped and re-added on every install, and misreported by --report as a broken registration of the kit's own hook.
• Adds names_hook(command, name), matched with the same boundary characters runs_hook already uses (a quoted path is read to its own closing quote; a bare word is bounded by whitespace and shell metacharacters), so it agrees with runs_hook on every shape it accepts while correctly rejecting a maintainer's own hook whose name merely contains the stem.
• Both call sites in registration_problems and both strip-then-append sites in main's re-registration now use names_hook instead of the old substring test.
• Two local-strict-review passes over this change each found real disagreements between the new names_hook and the existing runs_hook on unusual but real command shapes (bash -c "..." wrapping, parenthesized subshells, a trailing ; true, an unbalanced quote, and a quoted path whose own directory contains shell metacharacters like spaces or &/;/|/(/)); both were fixed and are covered by a new regression test, test_names_hook_agrees_with_runs_hook_on_every_shape_it_accepts.
• A third pass found a narrower residual gap (an unquoted path containing a boundary character in its own directory, and a few shell compositions runs_hook only accepts because it already holds the exact literal path). Closing that fully means widening runs_hook itself, a design change beyond this fix's scope, so it is documented in names_hook's docstring and filed separately as names_hook Does Not Match Every Shape runs_hook Accepts #1953.

Closes on promotion: #1905

Test plan

• python3 -m unittest test_install — 87 tests pass (86 existing + 1 new agreement test)
• ruff check / ruff format --check clean
• mypy host-setup/agent-safety/claude/install.py clean (repo's configured type-check gate)
• Reverted-fix check: temporarily restored the pre-fix behavior and confirmed the new tests fail, then restored the fix and confirmed they pass
• Three local-strict-review passes (opus) against the branch's full diff, each disposed before the next push

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: ptr727/ProjectTemplate/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 29a10045-1782-47b5-bb68-0b7e3fa96dd4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (develop@416b459). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop    #1954   +/-   ##
==========================================
  Coverage           ?   55.40%           
==========================================
  Files              ?       16           
  Lines              ?     7223           
  Branches           ?        0           
==========================================
  Hits               ?     4002           
  Misses             ?     3221           
  Partials           ?        0           

Flag	Coverage Δ
python-3.13	55.40% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Copilot review overview

🟢 Approval recommended

The change is narrowly scoped, aligns ownership detection with the existing boundary model, and is backed by targeted regression tests covering the previously failing scenarios.

Review effort: Lite
Findings: None

What changed in this PR

This PR hardens host-setup/agent-safety/claude/install.py hook ownership detection by switching from substring-based matching to filename-based matching, preventing the installer from mistakenly stripping or misreporting maintainer-owned hooks whose commands merely contain the kit’s stems.

Changes:

• Added names_hook(command, name) to identify registrations by an exact hook filename (with boundary rules aligned to runs_hook), replacing the previous substring checks.
• Updated registration validation (registration_problems) and re-registration strip/append logic to use names_hook for both PreToolUse and SessionEnd hooks.
• Extended the test suite with regression coverage ensuring wrappers that merely contain stems are not treated as kit-owned, and that names_hook agrees with runs_hook across representative accepted command shapes.

File	Description
host-setup/​agent-safety/​claude/​install.py	Replaces substring-based hook ownership detection with names_hook and applies it consistently in reporting and re-registration.
host-setup/​agent-safety/​claude/​test_install.py	Updates existing tests to the new matching semantics and adds new regression tests for wrapper-name false positives and names_hook/runs_hook agreement.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.