claude-dev-env 1.93.0 → 1.94.0

package/_shared/pr-loop/state-schema.md

@@ -31,26 +31,7 @@ Adds nothing beyond common. Single subagent loops internally and returns a final
 
 ### pr-converge
 
-Adds the same **traffic** fields whether they live in **`state.json`** or in the **conversation state line**; only the **store** differs.
-
-| Field | Type | Purpose |
-|---|---|---|
-| `phase` | enum | `BUGBOT`, `BUGTEAM` — which reviewer the current tick drives |
-| `current_head` | str | PR `.head.sha` / `git rev-parse` for the PR under work (each tick; from `pull_request_read(method="get")` when no file store) |
-| `bugbot_clean_at` | str \| null | HEAD SHA at which Cursor Bugbot last reported clean, or `null` (reset on every push) |
-| `copilot_clean_at` | str \| null | HEAD SHA at which the GitHub Copilot reviewer (`copilot-pull-request-reviewer[bot]`) last reported clean (review `state == "APPROVED"`), or `null`. Reset on every push. Convergence gates require this equals `current_head` after bugbot+bugteam are clean (see `skills/pr-converge/SKILL.md` § Convergence gates). |
-| `merge_state_status` | str \| null | Last-observed `mergeable_state` from `pull_request_read(method="get")` (e.g., `clean`, `dirty`, `blocked`, `behind`, `unknown`), or `null` before the first check. Reset on every push. `dirty` triggers the rebase invocation; non-`clean` non-`dirty` is a hard blocker per pr-converge `Stop conditions`. |
-| `inline_lag_streak` | int | Consecutive ticks where bugbot's review body claims findings but inline-comments API returns zero rows for `current_head` |
-| `tick_count` | int | Observability only — **no ceiling**; loop ends on convergence or **Stop conditions** in `pr-converge` |
-
-**Dual persistence** (normative: `skills/pr-converge/SKILL.md` § State across ticks, § Multi-PR orchestration model):
-
-| Mode | When it applies | Source of truth | `tick_count` bump |
-|---|---|---|---|
-| **`state.json`** | File exists at `<TMPDIR>/pr-converge-<session_id>/state.json` (multi-PR orchestration or other file-backed session) | JSON: top-level `session_id`; per-PR objects under `prs[<number>]` with `owner`, `repo`, `branch`, `phase`, `current_head`, `bugbot_clean_at`, `inline_lag_streak`, `tick_count`, `last_action`, `status`, `last_updated`. Optional sibling `converged.log` (append-only; multi-PR only). Writes use lock + atomic replace per skill **Concurrency** | **Orchestrator only** at tick start (locked merge for every non-terminal PR); **never** bump `tick_count` in Step 1 when this file is in use |
-| **Conversation state line** | **No** `state.json` (typical single-PR `/pr-converge` in Cursor) | Persist **`phase`**, **`bugbot_clean_at`**, **`inline_lag_streak`**, **`tick_count`** as **plain text** in each assistant turn; next tick reads them from the **most recent assistant message**. **`current_head` is not serialized in that line** — re-resolve each tick via `pull_request_read(method="get")` (same contract as `skills/pr-converge/SKILL.md` § State across ticks). | **Step 1** increments `tick_count` in that line **only** when no `state.json` — must not double-count with any file-backed path |
-
-**`status` (file-backed `prs[...]` only):** `fresh | in_progress | awaiting_bugbot | awaiting_bugteam | converged | blocked`
+Normative field list, phase enum, dual persistence, and reset semantics: [`../../skills/pr-converge/reference/state-schema.md`](../../skills/pr-converge/reference/state-schema.md). File-backed multi-PR `status` enum: [`../../skills/pr-converge/reference/multi-pr-orchestration.md`](../../skills/pr-converge/reference/multi-pr-orchestration.md).
 
 ### monitor-many
 
@@ -71,11 +52,11 @@ Adds per-PR JSON state file at `~/.claude/skills/monitor-many/state/<owner>-<rep
 
 - bugteam: cleared on each new `/bugteam` invocation
 - qbug: cleared on each new `/qbug` invocation
-- pr-converge: `bugbot_clean_at`, `copilot_clean_at`, and `merge_state_status` all reset to `null` on every push (a new commit invalidates every reviewer's prior clean and the prior mergeability snapshot by definition); `phase` cycles each tick. With `state.json`, orchestrator reads that file at tick start; without it, rely on the prior conversation state line — **never** mix both increment rules for `tick_count` on the same run
+- pr-converge: see [`../../skills/pr-converge/reference/state-schema.md`](../../skills/pr-converge/reference/state-schema.md)
 - monitor-many: persists across orchestrator runs; only `last_seen_comment_id` advances monotonically
 
 ## Convergence checks
 
 - bugteam, qbug: `last_action == "audited"` AND `last_findings.total == 0` → `converged`
-- pr-converge: `bugbot_clean_at == current_head` AND most-recent bugteam exit is `converged` AND no push during the bugteam tick AND no outstanding Copilot findings on `current_head` AND `merge_state_status == "clean"` (per `skills/pr-converge/SKILL.md` § Convergence gates) → back-to-back clean → `update_pull_request(draft=false)` (read `current_head` / `bugbot_clean_at` / `copilot_clean_at` / `merge_state_status` from `state.json` when file-backed, else from the conversation state line and Step 1 `pull_request_read(method="get")` output)
+- pr-converge: see [`../../skills/pr-converge/reference/convergence-gates.md`](../../skills/pr-converge/reference/convergence-gates.md)
 - monitor-many: no unresolved comments requiring code changes AND required checks green AND review policy satisfied → `gh pr ready`

package/bin/CLAUDE.md

@@ -26,4 +26,4 @@ The installer and its companion modules. Running `npx claude-dev-env` (or `node
 
 ## Install groups
 
-`install.mjs` defines install groups (`core`, `journal`, `research`) plus any dependency groups discovered from `package.json` `dependencies`. The `core` group installs skills, all hooks, and the content directories. `journal` and `research` install only their skill sets.
+`install.mjs` defines install groups (`core`, `journal`) plus any dependency groups discovered from `package.json` `dependencies`. The `core` group installs skills, all hooks, and the content directories. `journal` installs only its skill set.

package/bin/install.mjs

@@ -152,11 +152,10 @@ const INSTALL_GROUPS = {
     core: {
         description: 'Development standards, hooks, agents, commands',
         skills: [
-            'orchestrator', 'orchestrator-refresh', 'team-advisor',
+            'orchestrator', 'orchestrator-refresh', 'team-advisor', 'grokify',
             'anthropic-plan', 'everything-search',
-            'pr-review-responder',
             'privacy-hygiene',
-            'recall', 'remember', 'task-build', 'verified-build'
+            'recall', 'remember', 'task-build'
         ],
         includeDirectories: CORE_INCLUDE_DIRECTORIES,
         includeAllHooks: true,
@@ -165,10 +164,6 @@ const INSTALL_GROUPS = {
         description: 'Session logging and memory',
         skills: ['session-log', 'session-tidy'],
     },
-    research: {
-        description: 'Deep research and citation tools',
-        skills: ['deep-research', 'research-mode'],
-    },
     ...discoverDependencyGroups(),
 };
 

package/bin/install.test.mjs

@@ -637,6 +637,12 @@ test('commandReferencesManagedHook leaves an unmanaged inline -c command that im
 });
 
 
+
+function isPreToolUseDispatcherCommand(command) {
+    // Basename-anchored match: bash_pre_tool_use_dispatcher.py must not count.
+    return /(?:^|[/\\])pre_tool_use_dispatcher\.py(?![A-Za-z0-9_])/.test(command);
+}
+
 function countManagedRunAllValidatorsHooks(settings) {
     const writeEditGroups = (settings.hooks.PreToolUse || []).filter(
         group => group.matcher === 'Write|Edit'
@@ -996,7 +1002,7 @@ test('mergeHooksIntoSettings into old folded-hooks settings yields exactly one d
     const allPreToolUseGroups = settings.hooks.PreToolUse || [];
     const allHookCommands = allPreToolUseGroups.flatMap(group => group.hooks.map(hook => hook.command));
 
-    const allDispatcherCommands = allHookCommands.filter(cmd => cmd.includes('pre_tool_use_dispatcher.py'));
+    const allDispatcherCommands = allHookCommands.filter(isPreToolUseDispatcherCommand);
     assert.equal(allDispatcherCommands.length, 1, 'exactly one dispatcher entry must be present');
 
     for (const foldedPath of FOLDED_HOOK_RELATIVE_PATHS) {
@@ -1029,7 +1035,7 @@ test('mergeHooksIntoSettings is idempotent when run twice against an already-upd
     const allPreToolUseGroups = settings.hooks.PreToolUse || [];
     const allHookCommands = allPreToolUseGroups.flatMap(group => group.hooks.map(hook => hook.command));
 
-    const allDispatcherCommands = allHookCommands.filter(cmd => cmd.includes('pre_tool_use_dispatcher.py'));
+    const allDispatcherCommands = allHookCommands.filter(isPreToolUseDispatcherCommand);
     assert.equal(allDispatcherCommands.length, 1, 'dispatcher must appear exactly once after two merges');
     assert.equal(countManagedRunAllValidatorsHooks(settings), 1, 'run_all_validators must appear exactly once after two merges');
 });
@@ -1042,7 +1048,7 @@ test('shipped hooks.json matches the dispatcher design: dispatchers registered,
 
     const allPreToolUseGroups = shippedHooksConfig.hooks.PreToolUse || [];
     const allPreCommands = allPreToolUseGroups.flatMap(group => group.hooks.map(hook => hook.command));
-    const preDispatcherCommands = allPreCommands.filter(cmd => cmd.includes('pre_tool_use_dispatcher.py'));
+    const preDispatcherCommands = allPreCommands.filter(isPreToolUseDispatcherCommand);
     assert.equal(preDispatcherCommands.length, 1, 'shipped hooks.json must register the PreToolUse dispatcher exactly once');
 
     assert.equal(
@@ -1222,6 +1228,6 @@ test('mergeHooksIntoSettings prunes the inline run_all_validators runner when th
     }
 
     const dispatcherGroup = settings.hooks.PreToolUse.find(group => group.matcher === 'Write|Edit|MultiEdit');
-    const dispatcherCommands = dispatcherGroup.hooks.filter(hook => hook.command.includes('pre_tool_use_dispatcher.py'));
+    const dispatcherCommands = dispatcherGroup.hooks.filter(hook => isPreToolUseDispatcherCommand(hook.command));
     assert.equal(dispatcherCommands.length, 1, 'the PreToolUse dispatcher must remain exactly once');
 });

package/hooks/blocking/CLAUDE.md

@@ -81,6 +81,8 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `open_questions_in_plans_blocker.py` | PreToolUse (Write/Edit) | Plan documents with unresolved open questions |
 | `nas_ssh_binary_enforcer.py` | PreToolUse (Bash) | A bare `ssh`/`scp`/`sftp` command word targeting the NAS (Git Bash's MSYS ssh stalls on an interactive password prompt), or the full `System32/OpenSSH` binary to that host without `-o BatchMode=yes` |
 | `package_inventory_stale_blocker.py` | PreToolUse (Write) | A new production code file created in a directory whose `README.md`/`CLAUDE.md` inventory (or a parent skill's `SKILL.md` Layout table mapping the `scripts/` subdirectory) names two or more sibling files but no entry for the new file |
+| `pii_commit_command.py` | library | Token-aware git-commit detection reused by `pii_prevention_blocker.py` |
+| `pii_payload_scan.py` | library | Write/Edit and durable post-body PII evaluation reused by `pii_prevention_blocker.py` |
 | `pii_prevention_blocker.py` | PreToolUse (Write/Edit/MultiEdit/Bash/PowerShell/MCP GitHub) | Content that carries high-confidence personal data or secrets (real emails, home-dir paths, private IPs, credential material) on write, durable GitHub posts, or staged commit paths |
 | `pii_scanner.py` | library | Pure text scanners shared by `pii_prevention_blocker.py` |
 | `plain_language_blocker.py` | PreToolUse (Write/Edit/AskUserQuestion) | Heavy or jargon words in user-facing prose |

package/hooks/blocking/pii_commit_command.py

@@ -0,0 +1,398 @@
+#!/usr/bin/env python3
+"""Token-aware git-commit detection reused by ``pii_prevention_blocker``."""
+
+from __future__ import annotations
+
+import re
+import shlex
+import sys
+from pathlib import Path
+
+_blocking_directory = str(Path(__file__).resolve().parent)
+_hooks_directory = str(Path(__file__).resolve().parent.parent)
+if _blocking_directory not in sys.path:
+    sys.path.insert(0, _blocking_directory)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+from block_main_commit import extract_git_working_directory  # noqa: E402
+
+from hooks_constants.pii_prevention_constants import (  # noqa: E402
+    ALL_BASH_FAMILY_INTERPRETER_BASENAMES,
+    ALL_COMMAND_BOUNDARY_NEWLINE_CHARACTERS,
+    ALL_GIT_BINARY_BASENAMES,
+    ALL_LEADING_SKIPPABLE_COMMAND_TOKENS,
+    ALL_ONE_OPERAND_WRAPPER_TOKENS,
+    ALL_SHELL_COMMAND_SEPARATOR_TOKENS,
+    ALL_SHELL_INTERPRETER_BASENAMES,
+    ALL_SHELL_QUOTE_CHARACTERS,
+    ALL_VALUE_TAKING_GIT_OPTIONS,
+    DOUBLE_DASH_OPTION_PREFIX,
+    ENVIRONMENT_ASSIGNMENT_PATTERN,
+    GIT_COMMIT_SUBCOMMAND,
+    GIT_OPTION_WITH_VALUE_STEP,
+    GIT_WORKING_DIRECTORY_OPTION,
+    INLINE_COMMAND_FLAG_CLUSTER_CHARACTER,
+    INLINE_COMMAND_TOKEN_JOINER,
+    LINE_CONTINUATION_PATTERN,
+    POWERSHELL_INLINE_COMMAND_FLAG,
+    POWERSHELL_LINE_CONTINUATION_PATTERN,
+    SHELL_INLINE_COMMAND_FLAG,
+    SINGLE_DASH_OPTION_PREFIX,
+    SUBSHELL_GROUP_OPEN_TOKEN,
+)
+
+
+def _strip_token_edge_quotes(token_text: str) -> str:
+    return token_text.strip("\"'")
+
+
+def _token_basename_lower(token_text: str) -> str:
+    stripped_token = _strip_token_edge_quotes(token_text)
+    return re.split(r"[\\/]", stripped_token)[-1].lower()
+
+
+def _token_is_git_binary(token_text: str) -> bool:
+    return _token_basename_lower(token_text) in ALL_GIT_BINARY_BASENAMES
+
+
+def _token_is_shell_interpreter(token_text: str) -> bool:
+    return _token_basename_lower(token_text) in ALL_SHELL_INTERPRETER_BASENAMES
+
+
+def _token_is_bash_family_interpreter(token_text: str) -> bool:
+    return _token_basename_lower(token_text) in ALL_BASH_FAMILY_INTERPRETER_BASENAMES
+
+
+def _token_is_subshell_group_open(token_text: str) -> bool:
+    return token_text == SUBSHELL_GROUP_OPEN_TOKEN
+
+
+def _token_is_skippable_prefix(token_text: str) -> bool:
+    if ENVIRONMENT_ASSIGNMENT_PATTERN.match(token_text):
+        return True
+    return _token_basename_lower(token_text) in ALL_LEADING_SKIPPABLE_COMMAND_TOKENS
+
+
+def _following_tokens_invoke_commit(all_following_tokens: list[str]) -> bool:
+    token_index = 0
+    option_with_value_step = GIT_OPTION_WITH_VALUE_STEP
+    while token_index < len(all_following_tokens):
+        each_token = _strip_token_edge_quotes(all_following_tokens[token_index])
+        option_name = each_token
+        has_attached_value = False
+        if each_token.startswith(DOUBLE_DASH_OPTION_PREFIX) and "=" in each_token:
+            option_name, _, _attached_value = each_token.partition("=")
+            has_attached_value = True
+        if option_name in ALL_VALUE_TAKING_GIT_OPTIONS:
+            if has_attached_value:
+                token_index += 1
+            else:
+                token_index += option_with_value_step
+            continue
+        if each_token.startswith(SINGLE_DASH_OPTION_PREFIX):
+            token_index += 1
+            continue
+        return each_token.lower() == GIT_COMMIT_SUBCOMMAND
+    return False
+
+
+def _split_shell_command_segments(all_tokens: list[str]) -> list[list[str]]:
+    all_segments: list[list[str]] = [[]]
+    shell_separators = ALL_SHELL_COMMAND_SEPARATOR_TOKENS
+    for each_token in all_tokens:
+        if each_token in shell_separators:
+            all_segments.append([])
+            continue
+        all_segments[-1].append(each_token)
+    return all_segments
+
+
+def _tokenize_shell_command(shell_command_piece: str) -> list[str] | None:
+    lexer = shlex.shlex(shell_command_piece, posix=True, punctuation_chars=True)
+    lexer.whitespace_split = True
+    lexer.escape = ""
+    lexer.commenters = ""
+    try:
+        return list(lexer)
+    except ValueError:
+        return None
+
+
+def _fallback_segments_by_physical_line(shell_command_piece: str) -> list[list[str]]:
+    all_segments: list[list[str]] = []
+    for each_physical_line in shell_command_piece.splitlines():
+        line_tokens = each_physical_line.split()
+        all_segments.extend(_split_shell_command_segments(line_tokens))
+    return all_segments
+
+
+def _segments_for_piece(shell_command_piece: str) -> list[list[str]]:
+    piece_tokens = _tokenize_shell_command(shell_command_piece)
+    if piece_tokens is None:
+        return _fallback_segments_by_physical_line(shell_command_piece)
+    return _split_shell_command_segments(piece_tokens)
+
+
+def _split_on_unquoted_newlines(shell_command: str) -> list[str]:
+    all_pieces: list[str] = []
+    current_characters: list[str] = []
+    active_quote_character = ""
+    for each_character in shell_command:
+        if active_quote_character:
+            if each_character == active_quote_character:
+                active_quote_character = ""
+            current_characters.append(each_character)
+            continue
+        if each_character in ALL_SHELL_QUOTE_CHARACTERS:
+            active_quote_character = each_character
+            current_characters.append(each_character)
+            continue
+        if each_character in ALL_COMMAND_BOUNDARY_NEWLINE_CHARACTERS:
+            all_pieces.append("".join(current_characters))
+            current_characters = []
+            continue
+        current_characters.append(each_character)
+    all_pieces.append("".join(current_characters))
+    return all_pieces
+
+
+def _all_command_segments(shell_command: str) -> list[list[str]]:
+    collapsed_command = LINE_CONTINUATION_PATTERN.sub("", shell_command)
+    collapsed_command = POWERSHELL_LINE_CONTINUATION_PATTERN.sub("", collapsed_command)
+    all_segments: list[list[str]] = []
+    for each_piece in _split_on_unquoted_newlines(collapsed_command):
+        all_segments.extend(_segments_for_piece(each_piece))
+    return all_segments
+
+
+def _token_is_leading_skip_target(token_text: str) -> bool:
+    return _token_is_git_binary(token_text) or _token_is_shell_interpreter(token_text)
+
+
+def _token_is_wrapper_option_flag(token_text: str) -> bool:
+    return token_text.startswith(SINGLE_DASH_OPTION_PREFIX)
+
+
+def _wrapper_leading_operand_count(token_text: str) -> int:
+    if _token_basename_lower(token_text) in ALL_ONE_OPERAND_WRAPPER_TOKENS:
+        return 1
+    return 0
+
+
+def _flag_value_token_follows(all_segment_tokens: list[str], value_index: int) -> bool:
+    if value_index >= len(all_segment_tokens):
+        return False
+    if not _token_is_leading_skip_target(all_segment_tokens[value_index]):
+        return True
+    return _later_token_is_leading_skip_target(all_segment_tokens, value_index + 1)
+
+
+def _later_token_is_leading_skip_target(
+    all_segment_tokens: list[str], search_start_index: int
+) -> bool:
+    for each_token in all_segment_tokens[search_start_index:]:
+        if _token_is_leading_skip_target(each_token):
+            return True
+    return False
+
+
+def _skip_leading_noop_tokens(all_segment_tokens: list[str]) -> int:
+    token_index = 0
+    has_skipped_wrapper_prefix = False
+    pending_operand_budget = 0
+    while token_index < len(all_segment_tokens):
+        each_token = all_segment_tokens[token_index]
+        if _token_is_subshell_group_open(each_token):
+            token_index += 1
+            continue
+        if _token_is_skippable_prefix(each_token):
+            has_skipped_wrapper_prefix = True
+            pending_operand_budget += _wrapper_leading_operand_count(each_token)
+            token_index += 1
+            continue
+        if not has_skipped_wrapper_prefix:
+            break
+        if _token_is_leading_skip_target(each_token):
+            break
+        if _token_is_wrapper_option_flag(each_token):
+            token_index += 1
+            if _flag_value_token_follows(all_segment_tokens, token_index):
+                token_index += 1
+            continue
+        if pending_operand_budget > 0:
+            pending_operand_budget -= 1
+            token_index += 1
+            continue
+        break
+    return token_index
+
+
+def _token_is_powershell_command_flag_prefix(lowered_token: str) -> bool:
+    if lowered_token == SINGLE_DASH_OPTION_PREFIX:
+        return False
+    return POWERSHELL_INLINE_COMMAND_FLAG.startswith(lowered_token)
+
+
+def _token_is_interpreter_inline_command_flag(
+    token_text: str, interpreter_allows_short_flag_cluster: bool
+) -> bool:
+    if not token_text.startswith(SINGLE_DASH_OPTION_PREFIX):
+        return False
+    if token_text.startswith(DOUBLE_DASH_OPTION_PREFIX):
+        return False
+    lowered_token = token_text.lower()
+    if lowered_token == SHELL_INLINE_COMMAND_FLAG:
+        return True
+    if _token_is_powershell_command_flag_prefix(lowered_token):
+        return True
+    if not interpreter_allows_short_flag_cluster:
+        return False
+    clustered_flag_characters = lowered_token[len(SINGLE_DASH_OPTION_PREFIX) :]
+    return INLINE_COMMAND_FLAG_CLUSTER_CHARACTER in clustered_flag_characters
+
+
+def _interpreter_inline_command_invokes_commit(
+    interpreter_token: str, all_following_tokens: list[str]
+) -> bool:
+    allows_short_flag_cluster = _token_is_bash_family_interpreter(interpreter_token)
+    token_index = 0
+    while token_index < len(all_following_tokens):
+        each_token = all_following_tokens[token_index]
+        if _token_is_interpreter_inline_command_flag(
+            each_token, allows_short_flag_cluster
+        ):
+            argument_index = token_index + 1
+            if argument_index >= len(all_following_tokens):
+                return False
+            inline_command = INLINE_COMMAND_TOKEN_JOINER.join(
+                all_following_tokens[argument_index:]
+            )
+            return is_git_commit_shell_command(inline_command)
+        token_index += 1
+    return False
+
+
+def _segment_invokes_git_commit(all_segment_tokens: list[str]) -> bool:
+    command_index = _skip_leading_noop_tokens(all_segment_tokens)
+    if command_index >= len(all_segment_tokens):
+        return False
+    all_following_tokens = all_segment_tokens[command_index + 1 :]
+    command_token = all_segment_tokens[command_index]
+    if _token_is_shell_interpreter(command_token):
+        return _interpreter_inline_command_invokes_commit(
+            command_token, all_following_tokens
+        )
+    if not _token_is_git_binary(command_token):
+        return False
+    return _following_tokens_invoke_commit(all_following_tokens)
+
+
+def is_git_commit_shell_command(shell_command: str) -> bool:
+    """Report whether *shell_command* invokes git commit (token-aware).
+
+    Each segment is read past its leading noise to the real command word::
+
+        sudo git commit -m x        ->  skip the wrapper, then match commit
+        nice -n 10 git commit       ->  skip the wrapper and its flag value
+        then git commit -m x        ->  skip the keyword, then match commit
+        build & git commit -m x     ->  split on the background operator
+        bash -cx "git commit"                     ->  unwrap the bash cluster
+        pwsh -ExecutionPolicy Bypass -Command ... ->  skip past the pwsh flag
+        (git commit -m x)                         ->  step over the group open
+
+    Skipped leading tokens: a subshell-group open ``(``, env-assignments, shell
+    keywords (then, do, else, elif), and wrapper commands (sudo, env, time,
+    nice, xargs, command, stdbuf) together with each wrapper's own option flags,
+    flag values, and the single leading operand that timeout and flock take
+    before their command. A non-wrapper command word between a wrapper and a
+    later git commit stops the scan, so the wrapper's own payload command is
+    read rather than the trailing git token. Segments split on unquoted control
+    separators (including
+    a lone ``&`` background operator) and newlines, and the git binary may be
+    path-prefixed and carry global flags (no-verify, config, and
+    working-directory) before its subcommand. A shell interpreter is unwrapped
+    at its inline-command flag by interpreter family: bash and sh take an
+    isolated ``-c`` or any short-flag cluster carrying ``c`` (``-lc``, ``-cx``),
+    and PowerShell (pwsh, powershell) takes only ``-Command`` or ``-c``, so a
+    leading pwsh flag whose name merely contains ``c`` (``-ExecutionPolicy``,
+    ``-NonInteractive``) is stepped over until the real ``-Command`` is reached.
+    The inline command's remaining tokens rejoin into one string, so an
+    unquoted multi-token command is read whole.
+
+    Args:
+        shell_command: Bash or PowerShell tool command string.
+
+    Returns:
+        True when a command segment invokes git with a commit subcommand.
+    """
+    if not shell_command or not shell_command.strip():
+        return False
+    for each_segment in _all_command_segments(shell_command):
+        if _segment_invokes_git_commit(each_segment):
+            return True
+    return False
+
+
+def _following_tokens_working_directory(all_following_tokens: list[str]) -> str | None:
+    token_index = 0
+    option_with_value_step = GIT_OPTION_WITH_VALUE_STEP
+    while token_index < len(all_following_tokens):
+        each_token = _strip_token_edge_quotes(all_following_tokens[token_index])
+        if each_token == GIT_WORKING_DIRECTORY_OPTION:
+            value_index = token_index + 1
+            if value_index >= len(all_following_tokens):
+                return None
+            return _strip_token_edge_quotes(all_following_tokens[value_index])
+        option_name = each_token
+        has_attached_value = False
+        if each_token.startswith(DOUBLE_DASH_OPTION_PREFIX) and "=" in each_token:
+            option_name, _, _attached_value = each_token.partition("=")
+            has_attached_value = True
+        if option_name in ALL_VALUE_TAKING_GIT_OPTIONS:
+            token_index += 1 if has_attached_value else option_with_value_step
+            continue
+        if each_token.startswith(SINGLE_DASH_OPTION_PREFIX):
+            token_index += 1
+            continue
+        return None
+    return None
+
+
+def _segment_git_commit_working_directory(
+    all_segment_tokens: list[str],
+) -> str | None:
+    command_index = _skip_leading_noop_tokens(all_segment_tokens)
+    if command_index >= len(all_segment_tokens):
+        return None
+    command_token = all_segment_tokens[command_index]
+    if not _token_is_git_binary(command_token):
+        return None
+    all_following_tokens = all_segment_tokens[command_index + 1 :]
+    return _following_tokens_working_directory(all_following_tokens)
+
+
+def extract_git_commit_working_directory(shell_command: str) -> str | None:
+    """Return the directory a git-commit command runs in, or None for the CWD.
+
+    Reads the ``-C`` value off the same commit-invoking segment the detector
+    matches, so every git-binary shape the detector recognizes resolves too::
+
+        git.exe -C /repoA commit -m x   ->  /repoA
+        git -C "C:/repo" commit -m x    ->  C:/repo
+        cd /repoB && git commit -m x    ->  /repoB (cd/pushd fallback)
+        git commit -m x                 ->  None   (runs in the CWD)
+
+    Args:
+        shell_command: Bash or PowerShell tool command string.
+
+    Returns:
+        The working directory the commit targets, or None when it uses the CWD.
+    """
+    for each_segment in _all_command_segments(shell_command):
+        if not _segment_invokes_git_commit(each_segment):
+            continue
+        segment_directory = _segment_git_commit_working_directory(each_segment)
+        if segment_directory is not None:
+            return segment_directory
+    return extract_git_working_directory(shell_command)

package/hooks/blocking/pii_payload_scan.py

@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+"""Scan Write/Edit payloads and durable post bodies for high-confidence PII.
+
+Reused by ``pii_prevention_blocker``: ``build_deny_reason`` composes the deny
+message, and ``evaluate_write_edit_payload`` / ``evaluate_post_body_texts`` judge
+new file content and durable GitHub post bodies against the pure scanners in
+``pii_scanner``.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_blocking_directory = str(Path(__file__).resolve().parent)
+_hooks_directory = str(Path(__file__).resolve().parent.parent)
+if _blocking_directory not in sys.path:
+    sys.path.insert(0, _blocking_directory)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+from pii_scanner import (  # noqa: E402
+    PiiFinding,
+    is_path_exempt_from_pii_scan,
+    scan_text_for_pii,
+)
+
+from hooks_constants.multi_edit_reconstruction import edits_for_tool  # noqa: E402
+from hooks_constants.pii_prevention_constants import (  # noqa: E402
+    ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
+    CORRECTIVE_MESSAGE_FOOTER,
+    CORRECTIVE_MESSAGE_HEADER,
+    EDIT_TOOL_NAME,
+    FINDING_LINE_TEMPLATE,
+    MESSAGE_LINE_SEPARATOR,
+    MULTI_EDIT_TOOL_NAME,
+    WRITE_TOOL_NAME,
+)
+
+
+def build_deny_reason(all_findings: list[PiiFinding], gate_surface: str) -> str:
+    """Return the deny message listing each finding for *gate_surface*.
+
+    Args:
+        all_findings: Findings returned by ``scan_text_for_pii``.
+        gate_surface: Human-readable surface (write, post body, staged commit).
+
+    Returns:
+        Multi-line deny reason for ``permissionDecisionReason``.
+    """
+    all_lines = [
+        CORRECTIVE_MESSAGE_HEADER,
+        f"Surface: {gate_surface}",
+    ]
+    for each_finding in all_findings:
+        all_lines.append(
+            FINDING_LINE_TEMPLATE.format(
+                category=each_finding.category,
+                preview=each_finding.preview,
+            )
+        )
+    all_lines.append(CORRECTIVE_MESSAGE_FOOTER)
+    message_line_separator = MESSAGE_LINE_SEPARATOR
+    return message_line_separator.join(all_lines)
+
+
+def _collect_write_edit_texts(
+    tool_name: str, all_tool_input: dict[str, object]
+) -> tuple[str, list[str]]:
+    raw_file_path = all_tool_input.get("file_path", "")
+    file_path = raw_file_path if isinstance(raw_file_path, str) else ""
+    if is_path_exempt_from_pii_scan(file_path):
+        return file_path, []
+    if tool_name == WRITE_TOOL_NAME:
+        write_content = all_tool_input.get("content", "")
+        if isinstance(write_content, str) and write_content:
+            return file_path, [write_content]
+        return file_path, []
+    if tool_name in (EDIT_TOOL_NAME, MULTI_EDIT_TOOL_NAME):
+        all_texts: list[str] = []
+        for each_edit in edits_for_tool(tool_name, all_tool_input):
+            if not isinstance(each_edit, dict):
+                continue
+            new_string = each_edit.get("new_string", "")
+            if isinstance(new_string, str) and new_string:
+                all_texts.append(new_string)
+        return file_path, all_texts
+    return file_path, []
+
+
+def _first_findings_in_texts(all_texts: list[str]) -> list[PiiFinding]:
+    for each_text in all_texts:
+        all_findings = scan_text_for_pii(each_text)
+        if all_findings:
+            return all_findings
+    return []
+
+
+def evaluate_write_edit_payload(
+    tool_name: str, all_tool_input: dict[str, object]
+) -> str | None:
+    """Return a deny reason when Write/Edit/MultiEdit content carries PII.
+
+    Args:
+        tool_name: The intercepted tool name.
+        all_tool_input: The tool input mapping.
+
+    Returns:
+        Deny reason text, or None when the write is clean or out of scope.
+    """
+    if tool_name not in ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES:
+        return None
+    file_path, all_texts = _collect_write_edit_texts(tool_name, all_tool_input)
+    all_findings = _first_findings_in_texts(all_texts)
+    if not all_findings:
+        return None
+    gate_surface = f"file write ({file_path or 'unknown path'})"
+    return build_deny_reason(all_findings, gate_surface)
+
+
+def evaluate_post_body_texts(all_body_texts: list[str]) -> str | None:
+    """Return a deny reason when any durable post body carries PII.
+
+    Args:
+        all_body_texts: Body strings extracted from a gh or MCP post tool.
+
+    Returns:
+        Deny reason text, or None when every body is clean.
+    """
+    all_findings = _first_findings_in_texts(all_body_texts)
+    if not all_findings:
+        return None
+    return build_deny_reason(all_findings, "durable GitHub post body")