claude-dev-env 1.92.1 → 1.93.1

package/bin/install.test.mjs

@@ -9,6 +9,7 @@ import { pathToFileURL } from 'node:url';
 import {
     collectPackageSourceConflicts,
     CONTENT_DIRECTORIES,
+    CORE_INCLUDE_DIRECTORIES,
     FOLDED_HOOK_RELATIVE_PATHS,
     POST_FOLDED_HOOK_RELATIVE_PATHS,
     pythonCandidatesForPlatform,
@@ -21,6 +22,10 @@ import {
     mergeHooksIntoSettings,
     pruneManagedHooksFromSettings,
 } from './install.mjs';
+import {
+    expandHomeDirectoryTokens,
+    expandHomeDirectoryTokensInSettings,
+} from './expand_home_directory_tokens.mjs';
 
 
 function createTemporaryGitRepository() {
@@ -150,6 +155,18 @@ test('CONTENT_DIRECTORIES includes _shared so installer copies _shared/pr-loop/
 });
 
 
+test('core includeDirectories ships _shared and scripts for advisor protocol and CLI fallback', () => {
+    assert.ok(
+        CORE_INCLUDE_DIRECTORIES.includes('_shared'),
+        '_shared must ship with --only core so advisor-protocol.md lands for team-advisor/orchestrator',
+    );
+    assert.ok(
+        CORE_INCLUDE_DIRECTORIES.includes('scripts'),
+        'scripts must ship with --only core so claude_chain_runner.py is available for advisor CLI fallback',
+    );
+});
+
+
 test('CONTENT_DIRECTORIES includes audit-rubrics so installer copies category rubrics and prompts to ~/.claude/audit-rubrics/', () => {
     assert.ok(
         CONTENT_DIRECTORIES.includes('audit-rubrics'),
@@ -214,7 +231,7 @@ test('isWindowsStorePythonStub flags the Microsoft Store WindowsApps alias paths
         true,
     );
     assert.equal(
-        isWindowsStorePythonStub('C:/Users/jon/AppData/Local/Microsoft/WindowsApps/python.exe'),
+        isWindowsStorePythonStub('C:/Users/example/AppData/Local/Microsoft/WindowsApps/python.exe'),
         true,
     );
 });
@@ -239,6 +256,199 @@ test('interpreterCommandFromPath quotes an interpreter path that contains a spac
 });
 
 
+test('expandHomeDirectoryTokens expands $HOME, ${HOME}, and ~/', () => {
+    assert.equal(
+        expandHomeDirectoryTokens(
+            'python $HOME/.claude/hooks/session/fix_worktree_hookspath.py',
+            'C:\\Users\\x',
+        ),
+        'python C:/Users/x/.claude/hooks/session/fix_worktree_hookspath.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('python ${HOME}/.claude/hooks/a.py', '/home/x'),
+        'python /home/x/.claude/hooks/a.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('python ~/.claude/hooks/a.py', '/home/x'),
+        'python /home/x/.claude/hooks/a.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('echo $HOMEPATH', 'C:/Users/x'),
+        'echo $HOMEPATH',
+    );
+});
+
+
+test('expandHomeDirectoryTokens inserts dollar characters in home paths literally', () => {
+    const homeWithReplaceMetacharacters = 'C:/Users/$&evil$1';
+    assert.equal(
+        expandHomeDirectoryTokens('python $HOME/.claude/a.py', homeWithReplaceMetacharacters),
+        'python C:/Users/$&evil$1/.claude/a.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('python ${HOME}/.claude/a.py', homeWithReplaceMetacharacters),
+        'python C:/Users/$&evil$1/.claude/a.py',
+    );
+    assert.equal(
+        expandHomeDirectoryTokens('python ~/.claude/a.py', homeWithReplaceMetacharacters),
+        'python C:/Users/$&evil$1/.claude/a.py',
+    );
+});
+
+
+test('expandHomeDirectoryTokens expands ${HOME} before $HOME so braces stay intact', () => {
+    assert.equal(
+        expandHomeDirectoryTokens('python ${HOME}/.claude/a.py', '/home/x'),
+        'python /home/x/.claude/a.py',
+    );
+});
+
+
+test('expandHomeDirectoryTokens strips trailing slashes from the home directory', () => {
+    assert.equal(
+        expandHomeDirectoryTokens('python $HOME/.claude/a.py', 'C:/Users/x/'),
+        'python C:/Users/x/.claude/a.py',
+    );
+});
+
+
+test('expandHomeDirectoryTokensInSettings skips non-array hook event values', () => {
+    const settings = {
+        hooks: {
+            SessionStart: 'not-an-array',
+            PreToolUse: [
+                {
+                    matcher: 'Write',
+                    hooks: [{ type: 'command', command: 'python $HOME/.claude/hooks/a.py' }],
+                },
+            ],
+        },
+    };
+    expandHomeDirectoryTokensInSettings(settings, 'C:/Users/x');
+    assert.equal(settings.hooks.SessionStart, 'not-an-array');
+    assert.equal(
+        settings.hooks.PreToolUse[0].hooks[0].command,
+        'python C:/Users/x/.claude/hooks/a.py',
+    );
+});
+
+
+test('expandHomeDirectoryTokensInSettings rewrites hooks and statusLine', () => {
+    const settings = {
+        hooks: {
+            SessionStart: [
+                {
+                    matcher: '',
+                    hooks: [
+                        {
+                            type: 'command',
+                            command: 'python $HOME/.claude/hooks/session/fix_worktree_hookspath.py',
+                        },
+                    ],
+                },
+            ],
+        },
+        statusLine: {
+            type: 'command',
+            command: 'python "$HOME/.claude/statusline-command.py"',
+        },
+    };
+    expandHomeDirectoryTokensInSettings(settings, 'C:/Users/x');
+    assert.equal(
+        settings.hooks.SessionStart[0].hooks[0].command,
+        'python C:/Users/x/.claude/hooks/session/fix_worktree_hookspath.py',
+    );
+    assert.equal(
+        settings.statusLine.command,
+        'python "C:/Users/x/.claude/statusline-command.py"',
+    );
+});
+
+
+test('mergeHooksIntoSettings expands residual $HOME in preserved user hooks', () => {
+    const hooksConfig = {
+        hooks: {
+            SessionStart: [
+                {
+                    matcher: '',
+                    hooks: [
+                        {
+                            type: 'command',
+                            command: 'python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/session_env_cleanup.py',
+                        },
+                    ],
+                },
+            ],
+        },
+    };
+    const settings = {
+        hooks: {
+            SessionStart: [
+                {
+                    matcher: '',
+                    hooks: [
+                        {
+                            type: 'command',
+                            command: 'python $HOME/.claude/hooks/session/fix_worktree_hookspath.py',
+                        },
+                    ],
+                },
+            ],
+        },
+    };
+    mergeHooksIntoSettings(settings, hooksConfig, 'C:/Users/x/.claude', 'C:/Python313/python.exe');
+    const allCommands = settings.hooks.SessionStart[0].hooks.map(eachHook => eachHook.command);
+    assert.ok(
+        allCommands.includes(
+            'python C:/Users/x/.claude/hooks/session/fix_worktree_hookspath.py',
+        ),
+    );
+    assert.ok(
+        allCommands.includes(
+            'C:/Python313/python.exe C:/Users/x/.claude/hooks/session/session_env_cleanup.py',
+        ),
+    );
+    for (const eachCommand of allCommands) {
+        assert.equal(eachCommand.includes('$HOME'), false);
+        assert.equal(eachCommand.includes('${HOME}'), false);
+    }
+});
+
+
+test('mergeHooksIntoSettings inserts dollar characters in plugin root and interpreter literally', () => {
+    const pluginRootWithReplaceMetacharacters = 'C:/Users/$&evil$1/.claude';
+    const pythonWithReplaceMetacharacters = 'C:/Users/$&evil$1/Python/python.exe';
+    const hooksConfig = {
+        hooks: {
+            SessionStart: [
+                {
+                    matcher: '',
+                    hooks: [
+                        {
+                            type: 'command',
+                            command: 'python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/session_env_cleanup.py',
+                        },
+                    ],
+                },
+            ],
+        },
+    };
+    const settings = {};
+    mergeHooksIntoSettings(
+        settings,
+        hooksConfig,
+        pluginRootWithReplaceMetacharacters,
+        pythonWithReplaceMetacharacters,
+    );
+    const rewrittenCommand = settings.hooks.SessionStart[0].hooks[0].command;
+    assert.equal(
+        rewrittenCommand,
+        'C:/Users/$&evil$1/Python/python.exe C:/Users/$&evil$1/.claude/hooks/session/session_env_cleanup.py',
+    );
+    assert.equal(rewrittenCommand.includes('${CLAUDE_PLUGIN_ROOT}'), false);
+});
+
+
 test('mergeHooksIntoSettings substitutes a quoted absolute interpreter path for the python3 prefix', () => {
     const hooksConfig = {
         hooks: {
@@ -374,14 +584,14 @@ test('commandReferencesManagedHook matches managed scripts written with $HOME, ~
     assert.ok(commandReferencesManagedHook('python $HOME/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
     assert.ok(commandReferencesManagedHook('python ~/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
     assert.ok(commandReferencesManagedHook('python ${HOME}/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
-    assert.ok(commandReferencesManagedHook('py -3 C:/Users/jonlo/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
-    assert.ok(commandReferencesManagedHook('python /Users/jon/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
+    assert.ok(commandReferencesManagedHook('py -3 C:/Users/example/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
+    assert.ok(commandReferencesManagedHook('python /Users/example/.claude/hooks/notification/attention_needed_notify.py', managedPaths));
 });
 
 
 test('commandReferencesManagedHook matches Windows backslash paths', () => {
     const managedPaths = new Set(['blocking/hedging_language_blocker.py']);
-    assert.ok(commandReferencesManagedHook('py -3 C:\\Users\\jonlo\\.claude\\hooks\\blocking\\hedging_language_blocker.py', managedPaths));
+    assert.ok(commandReferencesManagedHook('py -3 C:\\Users\\example\\.claude\\hooks\\blocking\\hedging_language_blocker.py', managedPaths));
 });
 
 
@@ -414,7 +624,7 @@ test('commandReferencesManagedHook matches a managed script followed by a whites
 test('commandReferencesManagedHook matches the rewritten inline validators-runner hook that carries no script tail', () => {
     const managedPaths = new Set(['blocking/code_rules_enforcer.py']);
     const rewrittenInlineCommand =
-        "py -3 -c \"import sys; sys.path.insert(0, r'C:/Users/jonlo/.claude/hooks'); from validators.run_all_validators import main; sys.exit(main())\"";
+        "py -3 -c \"import sys; sys.path.insert(0, r'C:/Users/example/.claude/hooks'); from validators.run_all_validators import main; sys.exit(main())\"";
     assert.ok(commandReferencesManagedHook(rewrittenInlineCommand, managedPaths));
 });
 
@@ -462,7 +672,7 @@ test('mergeHooksIntoSettings is idempotent for the inline -c validators hook acr
         },
     };
     const settings = {};
-    const pluginRootDir = 'C:/Users/jonlo/.claude';
+    const pluginRootDir = 'C:/Users/example/.claude';
 
     mergeHooksIntoSettings(settings, hooksConfig, pluginRootDir, 'py -3');
     mergeHooksIntoSettings(settings, hooksConfig, pluginRootDir, 'py -3');
@@ -499,8 +709,8 @@ test('mergeHooksIntoSettings preserves user hooks in a managed matcher group acr
         },
     };
 
-    mergeHooksIntoSettings(settings, hooksConfig, 'C:/Users/jonlo/.claude', 'py -3');
-    mergeHooksIntoSettings(settings, hooksConfig, 'C:/Users/jonlo/.claude', 'py -3');
+    mergeHooksIntoSettings(settings, hooksConfig, 'C:/Users/example/.claude', 'py -3');
+    mergeHooksIntoSettings(settings, hooksConfig, 'C:/Users/example/.claude', 'py -3');
 
     const writeEditGroup = settings.hooks.PreToolUse.find(group => group.matcher === 'Write|Edit');
     const userHookSurvivors = writeEditGroup.hooks.filter(hook => hook.command === userHookCommand);
@@ -540,7 +750,7 @@ test('pruneManagedHooksFromSettings removes managed hooks in every home-path and
                     hooks: [
                         { command: 'python $HOME/.claude/hooks/notification/attention_needed_notify.py', timeout: 15 },
                         { command: 'python ${HOME}/.claude/hooks/notification/attention_needed_notify.py', timeout: 15 },
-                        { command: 'py -3 C:\\Users\\jonlo\\.claude\\hooks\\notification\\attention_needed_notify.py', timeout: 15 },
+                        { command: 'py -3 C:\\Users\\example\\.claude\\hooks\\notification\\attention_needed_notify.py', timeout: 15 },
                         { command: userHookCommand, timeout: 5 },
                     ],
                 },
@@ -637,7 +847,7 @@ test('purge set sourced from package hooks.json prunes standalone managed script
                     {
                         matcher: 'Write|Edit',
                         hooks: [
-                            { command: 'py -3 C:\\Users\\jonlo\\.claude\\hooks\\blocking\\code_rules_enforcer.py', timeout: 30 },
+                            { command: 'py -3 C:\\Users\\example\\.claude\\hooks\\blocking\\code_rules_enforcer.py', timeout: 30 },
                             { command: userHookCommand, timeout: 5 },
                         ],
                     },

package/hooks/CLAUDE.md

@@ -14,7 +14,7 @@ Python hook scripts wired into Claude Code's lifecycle via `settings.json`. Each
 | `diagnostic/queries/` | Parameterized SQL queries for inspecting blocked commands |
 | `git-hooks/` | Native git hooks (`pre-commit`, `pre-push`, `post-commit`) installed via the git-hooks path |
 | `git-hooks/git_hooks_constants/` | Shared constants for the git-hook scripts |
-| `hooks_constants/` | Shared constant modules imported by multiple hooks across this tree |
+| `hooks_constants/` | Shared constant modules imported by multiple hooks across this tree (includes `pii_prevention_constants.py` for personal-data and secret scan patterns) |
 | `lifecycle/` | Hooks that run at session or config-change boundaries |
 | `observability/` | PostToolUse hooks that record agent behavior for diagnostics |
 | `session/` | SessionStart and SessionEnd hooks for per-session cleanup |

package/hooks/blocking/CLAUDE.md

@@ -50,6 +50,7 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `code_rules_shared.py` | Shared dataclasses and helpers used by multiple check modules |
 | `code_rules_string_magic.py` | Magic string detection with masking and f-string support; whitespace-only indentation literals in function bodies |
 | `code_rules_test_assertions.py` | Test assertion style rules |
+| `code_rules_test_layout.py` | Dead scaffolding in a test module: a private module constant read by no other line, and an unused parameter on a private test helper |
 | `code_rules_test_branching_except.py` | No bare or broad `except` in test branches |
 | `code_rules_test_isolation.py` | Tests must not rely on home-dir or temp-dir side effects |
 | `code_rules_type_escape.py` | No `Any` imports, `cast()`, or `# type: ignore` outside boundary files |
@@ -78,8 +79,10 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `hook_prose_detector_consistency.py` | PreToolUse (Write/Edit) | Hook docstrings/messages that claim a trigger the detector cannot fire on |
 | `intent_only_ending_blocker.py` | Stop | Responses that end on a plan or intent without doing the work |
 | `open_questions_in_plans_blocker.py` | PreToolUse (Write/Edit) | Plan documents with unresolved open questions |
-| `nas_ssh_binary_enforcer.py` | PreToolUse (Bash) | A bare `ssh`/`scp`/`sftp` command word targeting the NAS at `192.168.1.100` (Git Bash's MSYS ssh stalls on an interactive password prompt), or the full `System32/OpenSSH` binary to that host without `-o BatchMode=yes` |
+| `nas_ssh_binary_enforcer.py` | PreToolUse (Bash) | A bare `ssh`/`scp`/`sftp` command word targeting the NAS (Git Bash's MSYS ssh stalls on an interactive password prompt), or the full `System32/OpenSSH` binary to that host without `-o BatchMode=yes` |
 | `package_inventory_stale_blocker.py` | PreToolUse (Write) | A new production code file created in a directory whose `README.md`/`CLAUDE.md` inventory (or a parent skill's `SKILL.md` Layout table mapping the `scripts/` subdirectory) names two or more sibling files but no entry for the new file |
+| `pii_prevention_blocker.py` | PreToolUse (Write/Edit/MultiEdit/Bash/PowerShell/MCP GitHub) | Content that carries high-confidence personal data or secrets (real emails, home-dir paths, private IPs, credential material) on write, durable GitHub posts, or staged commit paths |
+| `pii_scanner.py` | library | Pure text scanners shared by `pii_prevention_blocker.py` |
 | `plain_language_blocker.py` | PreToolUse (Write/Edit/AskUserQuestion) | Heavy or jargon words in user-facing prose |
 | `pr_converge_bugteam_enforcer.py` | PreToolUse | Enforces that bugteam runs in parallel with bugbot in pr-converge loops |
 | `pr_description_enforcer.py` | PreToolUse (Bash) | `gh pr create`/`edit`/`comment` bodies that fail the Anthropic claude-code style audit, proof-shaped `gh pr comment` bodies missing proof-of-work parts, and `gh pr ready` while the PR carries no passing proof comment |

package/hooks/blocking/_path_setup.py

@@ -0,0 +1,13 @@
+"""Add the hooks directory to sys.path for sibling entry-point dispatchers.
+
+Importing this module inserts the hooks directory (this file's parent's parent)
+at the front of sys.path so a dispatcher that runs as a standalone script from
+blocking/ can import hooks_constants with every import kept at module top.
+"""
+
+import sys
+from pathlib import Path
+
+_hooks_directory = str(Path(__file__).resolve().parent.parent)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)

package/hooks/blocking/bash_pre_tool_use_dispatcher.py

@@ -0,0 +1,281 @@
+#!/usr/bin/env python3
+"""PreToolUse dispatcher that hosts the Bash and PowerShell blocking hook chains.
+
+Reads the tool payload from stdin once, selects the hosted hooks applicable to
+the payload's tool name, runs each hook in-process via the shared hosted-hook
+runner, aggregates deny/ask/allow decisions with deny>ask>allow precedence, and
+emits one decision (carrying updatedInput when a rewriter allowed a rewrite, and
+systemMessage / additionalContext / suppressOutput when hosted hooks set them).
+
+A deny short-circuits the remaining chain: once any hosted hook denies, the
+dispatcher aggregates what has run so far, emits that deny immediately, and
+returns so a later process timeout cannot drop an already-known denial. Ask and
+allow continue through the full roster because a later hook may still deny.
+
+A single hosted hook crash fails open: it contributes no decision and does not
+stop the remaining hooks, matching a standalone hook whose uncaught exception
+exits nonzero without blocking the tool call.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from dataclasses import dataclass, field
+from pathlib import Path
+
+import _path_setup  # noqa: F401
+
+from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
+    ALL_BASH_HOSTED_HOOK_ENTRIES,
+    ALLOW_DECISION,
+    ASK_DECISION,
+    CONTEXT_JOIN_SEPARATOR,
+    DENY_DECISION,
+    HOOK_EVENT_NAME,
+    REASON_JOIN_SEPARATOR,
+    BashHostedHookEntry,
+)
+from hooks_constants.hosted_hook_runner import HostedHookRun, run_hook_capturing_output
+from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+
+_PERMISSION_DECISION_KEY = "permissionDecision"
+_PERMISSION_REASON_KEY = "permissionDecisionReason"
+_HOOK_SPECIFIC_OUTPUT_KEY = "hookSpecificOutput"
+_UPDATED_INPUT_KEY = "updatedInput"
+_SYSTEM_MESSAGE_KEY = "systemMessage"
+_ADDITIONAL_CONTEXT_KEY = "additionalContext"
+_SUPPRESS_OUTPUT_KEY = "suppressOutput"
+
+
+@dataclass
+class BashDispatcherDecision:
+    """Aggregated outcome across the Bash/PowerShell hosted-hook chain.
+
+    Attributes:
+        decision: The winning permission outcome (deny, ask, allow), or empty
+            when no hosted hook emitted an outcome.
+        reasons: Deny or ask reasons collected from deciding hooks, in run order.
+        updated_input: The rewritten tool_input from an allowing rewriter, or
+            None when no allow carried an updatedInput.
+        all_system_messages: Top-level systemMessage texts from hosted hooks.
+        all_additional_context: hookSpecificOutput.additionalContext texts.
+        should_suppress_output: True when any hosted hook set suppressOutput.
+    """
+
+    decision: str
+    reasons: list[str] = field(default_factory=list)
+    updated_input: dict[str, object] | None = None
+    all_system_messages: list[str] = field(default_factory=list)
+    all_additional_context: list[str] = field(default_factory=list)
+    should_suppress_output: bool = False
+
+
+@dataclass
+class _ParsedHookDecision:
+    """Fields parsed from one hosted hook's stdout."""
+
+    decision: str
+    reason: str
+    updated_input: dict[str, object] | None
+    system_message: str
+    additional_context: str
+    should_suppress_output: bool
+
+
+def select_applicable_entries(tool_name: str) -> list[BashHostedHookEntry]:
+    """Return the ordered hosted-hook entries that apply to tool_name."""
+    return [
+        each_entry
+        for each_entry in ALL_BASH_HOSTED_HOOK_ENTRIES
+        if tool_name in each_entry.applicable_tool_names
+    ]
+
+
+def _empty_parsed_hook_decision() -> _ParsedHookDecision:
+    """Return a non-deciding parse result with empty supplementary fields."""
+    return _ParsedHookDecision(
+        decision="",
+        reason="",
+        updated_input=None,
+        system_message="",
+        additional_context="",
+        should_suppress_output=False,
+    )
+
+
+def _parse_hook_stdout(stdout_text: str) -> _ParsedHookDecision:
+    """Parse one hook's stdout into a decision, reason, rewrite, and context."""
+    stripped_text = stdout_text.strip()
+    if not stripped_text:
+        return _empty_parsed_hook_decision()
+    try:
+        parsed_output = json.loads(stripped_text)
+    except json.JSONDecodeError:
+        return _empty_parsed_hook_decision()
+    if not isinstance(parsed_output, dict):
+        return _empty_parsed_hook_decision()
+    hook_specific = parsed_output.get(_HOOK_SPECIFIC_OUTPUT_KEY, {})
+    if not isinstance(hook_specific, dict):
+        return _empty_parsed_hook_decision()
+    raw_decision = hook_specific.get(_PERMISSION_DECISION_KEY, "")
+    decision = raw_decision if isinstance(raw_decision, str) else ""
+    raw_reason = hook_specific.get(_PERMISSION_REASON_KEY, "")
+    reason = raw_reason if isinstance(raw_reason, str) else ""
+    raw_updated_input = hook_specific.get(_UPDATED_INPUT_KEY)
+    updated_input = raw_updated_input if isinstance(raw_updated_input, dict) else None
+    raw_system_message = parsed_output.get(_SYSTEM_MESSAGE_KEY, "")
+    system_message = raw_system_message if isinstance(raw_system_message, str) else ""
+    raw_additional_context = hook_specific.get(_ADDITIONAL_CONTEXT_KEY, "")
+    additional_context = (
+        raw_additional_context if isinstance(raw_additional_context, str) else ""
+    )
+    should_suppress_output = parsed_output.get(_SUPPRESS_OUTPUT_KEY) is True
+    return _ParsedHookDecision(
+        decision=decision,
+        reason=reason,
+        updated_input=updated_input,
+        system_message=system_message,
+        additional_context=additional_context,
+        should_suppress_output=should_suppress_output,
+    )
+
+
+def aggregate_bash_hook_results(
+    all_runs: list[HostedHookRun],
+) -> BashDispatcherDecision:
+    """Aggregate hosted-hook runs into one deny>ask>allow decision.
+
+    Crashed hooks fail open: they contribute no decision. Reasons are collected
+    from deny and ask outputs. When the winning decision is allow, the first
+    non-empty updatedInput among allow results is carried through so rewriters
+    keep their contract. systemMessage, additionalContext, and suppressOutput
+    from every non-crashed hook are preserved so silent deny shapes (for example
+    destructive_command_blocker's gh-redirect deny) match standalone emission.
+    """
+    all_parsed: list[_ParsedHookDecision] = []
+    for each_run in all_runs:
+        if each_run.did_crash:
+            continue
+        all_parsed.append(_parse_hook_stdout(each_run.captured_stdout))
+
+    decision_precedence = (DENY_DECISION, ASK_DECISION, ALLOW_DECISION)
+    winning_decision = ""
+    for each_candidate in decision_precedence:
+        if any(each_parsed.decision == each_candidate for each_parsed in all_parsed):
+            winning_decision = each_candidate
+            break
+
+    if not winning_decision:
+        return BashDispatcherDecision(decision="")
+
+    all_reasons = [
+        each_parsed.reason
+        for each_parsed in all_parsed
+        if each_parsed.decision in (DENY_DECISION, ASK_DECISION) and each_parsed.reason
+    ]
+    updated_input: dict[str, object] | None = None
+    if winning_decision == ALLOW_DECISION:
+        for each_parsed in all_parsed:
+            if each_parsed.decision == ALLOW_DECISION and each_parsed.updated_input is not None:
+                updated_input = each_parsed.updated_input
+                break
+
+    all_system_messages = [
+        each_parsed.system_message for each_parsed in all_parsed if each_parsed.system_message
+    ]
+    all_additional_context = [
+        each_parsed.additional_context
+        for each_parsed in all_parsed
+        if each_parsed.additional_context
+    ]
+    should_suppress_output = any(
+        each_parsed.should_suppress_output for each_parsed in all_parsed
+    )
+
+    return BashDispatcherDecision(
+        decision=winning_decision,
+        reasons=all_reasons,
+        updated_input=updated_input,
+        all_system_messages=all_system_messages,
+        all_additional_context=all_additional_context,
+        should_suppress_output=should_suppress_output,
+    )
+
+
+def _resolve_hook_script_path(relative_path: str) -> str:
+    """Resolve a hooks/-relative path to an absolute script path."""
+    hooks_root = Path(__file__).resolve().parent.parent
+    return str(hooks_root / relative_path)
+
+
+def _emit_decision(decision: BashDispatcherDecision) -> None:
+    """Write one PreToolUse permission payload to stdout when an outcome exists."""
+    if not decision.decision:
+        return
+    hook_specific: dict[str, object] = {
+        "hookEventName": HOOK_EVENT_NAME,
+        _PERMISSION_DECISION_KEY: decision.decision,
+    }
+    if decision.reasons:
+        hook_specific[_PERMISSION_REASON_KEY] = REASON_JOIN_SEPARATOR.join(decision.reasons)
+    if decision.decision == ALLOW_DECISION and decision.updated_input is not None:
+        hook_specific[_UPDATED_INPUT_KEY] = decision.updated_input
+    if decision.all_additional_context:
+        hook_specific[_ADDITIONAL_CONTEXT_KEY] = CONTEXT_JOIN_SEPARATOR.join(
+            decision.all_additional_context
+        )
+    payload: dict[str, object] = {_HOOK_SPECIFIC_OUTPUT_KEY: hook_specific}
+    if decision.all_system_messages:
+        payload[_SYSTEM_MESSAGE_KEY] = CONTEXT_JOIN_SEPARATOR.join(decision.all_system_messages)
+    if decision.should_suppress_output:
+        payload[_SUPPRESS_OUTPUT_KEY] = True
+    sys.stdout.write(json.dumps(payload) + "\n")
+    sys.stdout.flush()
+
+
+def _run_is_deny(hook_run: HostedHookRun) -> bool:
+    """Return True when a non-crashed run carries a deny decision."""
+    if hook_run.did_crash:
+        return False
+    parsed_decision = _parse_hook_stdout(hook_run.captured_stdout)
+    return parsed_decision.decision == DENY_DECISION
+
+
+def dispatch(payload_text: str, tool_name: str) -> None:
+    """Run applicable hosted hooks and emit the aggregated decision.
+
+    Emits and returns as soon as any hosted hook denies so a process timeout
+    later in the chain cannot fail-open past an already-known denial.
+    """
+    applicable_entries = select_applicable_entries(tool_name)
+    all_runs: list[HostedHookRun] = []
+    for each_entry in applicable_entries:
+        script_path = _resolve_hook_script_path(each_entry.script_relative_path)
+        hook_run = run_hook_capturing_output(script_path, payload_text)
+        all_runs.append(hook_run)
+        if _run_is_deny(hook_run):
+            aggregated_decision = aggregate_bash_hook_results(all_runs)
+            _emit_decision(aggregated_decision)
+            return
+    aggregated_decision = aggregate_bash_hook_results(all_runs)
+    _emit_decision(aggregated_decision)
+
+
+def main() -> None:
+    """Read stdin once and dispatch the Bash/PowerShell hosted-hook chain."""
+    payload_dictionary = read_hook_input_dictionary_from_stdin()
+    if payload_dictionary is None:
+        sys.exit(0)
+
+    payload_text = json.dumps(payload_dictionary)
+    tool_name = payload_dictionary.get("tool_name", "")
+    if not isinstance(tool_name, str) or not tool_name:
+        sys.exit(0)
+
+    dispatch(payload_text, tool_name)
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()