claude-dev-env 2.21.1 → 2.21.2

package/hooks/blocking/AGENTS.md

@@ -71,6 +71,7 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `bot_mention_comment_blocker.py` | PreToolUse (Write/Edit) | PR review comments that @-mention a bot |
 | `claude_md_orphan_file_blocker.py` | PreToolUse (Write/Edit/MultiEdit) | Per-directory `CLAUDE.md` table cells naming a bare filename absent from the directory subtree |
 | `conventional_pr_title_gate.py` | PreToolUse (Bash) | `gh pr create`/`gh pr edit` with a `--title` that is not a Conventional Commit, in a repo whose CI runs a semantic-pull-request title check |
+| `cursor_cli_python_misfire_blocker.py` | PreToolUse (Bash/PowerShell) | `cursor` / `Cursor.exe` launched against a Python script with code-rules-gate flags, which raises Cursor's EPIPE unknown-option dialog |
 | `destructive_command_blocker.py` | PreToolUse (Bash/PowerShell) | Shell commands with destructive literals (`rm -rf`, `git reset --hard`, etc.) |
 | `docstring_rule_gate_count_blocker.py` | PreToolUse (Write/Edit/MultiEdit) | A stale spelled-out gate-validator count in `docstring-prose-matches-implementation.md` — the "N more gate validators" / "M gated slices" count drifting from the `check_docstring_*` validators the prose names |
 | `duplicate_rmtree_helper_blocker.py` | PreToolUse (Write/Edit) | A local re-definition of the Windows-safe rmtree helper trio (`_strip_read_only_and_retry`, `_force_remove_tree` / `force_rmtree`) in place of importing a shared helper |
@@ -94,7 +95,7 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `precommit_code_rules_gate.py` | PreToolUse (Bash) | Staged changes that fail the CODE_RULES gate at commit time |
 | `pytest_testpaths_orphan_blocker.py` | PreToolUse (Write/Edit/MultiEdit) | New `test_*.py` files created under a directory absent from a package's explicit pytest `testpaths` allowlist |
 | `question_to_user_enforcer.py` | Stop | User-directed questions not routed through `AskUserQuestion` |
-| `send_user_file_open_locally_blocker.py` | PreToolUse (SendUserFile) | A desk-side file attach (`SendUserFile` with `status` not `proactive`); points to opening the file with its native Windows app |
+| `send_user_file_open_locally_blocker.py` | PreToolUse (SendUserFile) | A desk-side file attach (`SendUserFile` with `status` not `proactive`); points to `Invoke-Item -LiteralPath` for the native Windows app |
 | `sensitive_file_protector.py` | PreToolUse (Write/Edit/MultiEdit) | Writes to sensitive credential or config files |
 | `session_edit_stage_gate.py` | PreToolUse (Bash) | A `git commit` that would drop files edited this session because they are tracked but left unstaged |
 | `session_handoff_blocker.py` | Stop | Responses suggesting a new session mid-task |

package/hooks/blocking/cursor_cli_python_misfire_blocker.py

@@ -0,0 +1,108 @@
+#!/usr/bin/env python3
+"""PreToolUse hook: deny Cursor launches that mistreat a Python gate script.
+
+Agents sometimes run ``cursor code_rules_gate.py --base origin/main`` (or the
+same shape through ``Cursor.exe`` / ``cursor.cmd``) when the intent is either
+to execute the gate or to open a file. Cursor's main process then hits
+``onUnknownOption`` for the gate flags, ``console.warn`` writes to a closed
+pipe, and Windows shows an EPIPE error dialog — while still opening the
+``.py`` path in the editor.
+
+::
+
+    cursor code_rules_gate.py --base origin/main     flag
+    Cursor.exe gate.py --staged                      flag
+    cursor.cmd path/to/x.py --repo-root .            flag
+    cursor code_rules_gate.py                        ok: editor open, no gate flags
+    cursor -g file.py:10                             ok: editor goto, no gate flags
+    cursor README.md                                 ok: open without gate flags
+    python code_rules_gate.py --base origin/main     ok: real gate run
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+_hooks_dir = str(Path(__file__).resolve().parent.parent)
+if _hooks_dir not in sys.path:
+    sys.path.insert(0, _hooks_dir)
+
+from hooks_constants.cursor_cli_python_misfire_blocker_constants import (  # noqa: E402
+    ALL_SUPPORTED_TOOL_NAMES,
+    CALLING_HOOK_NAME,
+    COMMAND_KEY,
+    CORRECTIVE_MESSAGE,
+    CURSOR_LAUNCH_PATTERN,
+    DENY_DECISION,
+    GATE_FLAG_PATTERN,
+    GATE_SCRIPT_PATTERN,
+    HOOK_EVENT_NAME,
+    HOOK_EVENT_NAME_KEY,
+    HOOK_SPECIFIC_OUTPUT_KEY,
+    PERMISSION_DECISION_KEY,
+    PERMISSION_DECISION_REASON_KEY,
+    PYTHON_PATH_PATTERN,
+    TOOL_INPUT_KEY,
+    TOOL_NAME_KEY,
+)
+from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+from hooks_constants.pre_tool_use_stdin import (  # noqa: E402
+    read_hook_input_dictionary_from_stdin,
+)
+
+
+def is_cursor_python_gate_misfire(command: str) -> bool:
+    """Return True when *command* launches Cursor against a gate-shaped Python run.
+
+    Args:
+        command: Raw Bash or PowerShell command string from the tool input.
+
+    Returns:
+        True when Cursor is the launch target, a gate CLI flag is present, and
+        the operands name the gate script or another ``.py`` path.
+    """
+    if not command or not CURSOR_LAUNCH_PATTERN.search(command):
+        return False
+    if not GATE_FLAG_PATTERN.search(command):
+        return False
+    return bool(GATE_SCRIPT_PATTERN.search(command) or PYTHON_PATH_PATTERN.search(command))
+
+
+def main() -> None:
+    hook_input = read_hook_input_dictionary_from_stdin()
+    if hook_input is None:
+        sys.exit(0)
+
+    tool_name = hook_input.get(TOOL_NAME_KEY, "")
+    if tool_name not in ALL_SUPPORTED_TOOL_NAMES:
+        sys.exit(0)
+
+    tool_input = hook_input.get(TOOL_INPUT_KEY) or {}
+    if not isinstance(tool_input, dict):
+        sys.exit(0)
+    command = tool_input.get(COMMAND_KEY, "")
+    if not isinstance(command, str) or not is_cursor_python_gate_misfire(command):
+        sys.exit(0)
+
+    deny_payload = {
+        HOOK_SPECIFIC_OUTPUT_KEY: {
+            HOOK_EVENT_NAME_KEY: HOOK_EVENT_NAME,
+            PERMISSION_DECISION_KEY: DENY_DECISION,
+            PERMISSION_DECISION_REASON_KEY: CORRECTIVE_MESSAGE,
+        }
+    }
+    log_hook_block(
+        calling_hook_name=CALLING_HOOK_NAME,
+        hook_event=HOOK_EVENT_NAME,
+        block_reason=CORRECTIVE_MESSAGE,
+        tool_name=str(tool_name),
+    )
+    print(json.dumps(deny_payload))
+    sys.stdout.flush()
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/pre_tool_use_dispatcher.py

@@ -496,13 +496,15 @@ def _emit_allow_decision(decision: DispatcherDecision) -> None:
     allow_payload: dict[str, object] = {
         "hookSpecificOutput": allow_hook_specific,
     }
-    if decision.all_additional_context:
+    all_unique_additional_context = unique_first_seen_strings(decision.all_additional_context)
+    all_unique_system_messages = unique_first_seen_strings(decision.all_system_messages)
+    if all_unique_additional_context:
         allow_hook_specific["additionalContext"] = CONTEXT_JOIN_SEPARATOR.join(
-            decision.all_additional_context
+            all_unique_additional_context
         )
-    if decision.all_system_messages:
+    if all_unique_system_messages:
         allow_payload["systemMessage"] = SYSTEM_MESSAGE_JOIN_SEPARATOR.join(
-            decision.all_system_messages
+            all_unique_system_messages
         )
     sys.stdout.write(json.dumps(allow_payload) + "\n")
     sys.stdout.flush()

package/hooks/blocking/send_user_file_open_locally_blocker.py

@@ -3,8 +3,9 @@
 
 SendUserFile attaches a file to the session. While the user is at the terminal
 (status "normal" or unset) an attach does not let them see the file — it must
-open on screen in its native Windows app. The one attach allowed
-through is an away-from-desk phone push (status "proactive").
+open on screen in its native Windows app. The corrective message names the
+``Invoke-Item -LiteralPath`` form. The one attach allowed through is an
+away-from-desk phone push (status "proactive").
 """
 
 import json

package/hooks/blocking/test_bash_pre_tool_use_dispatcher.py

@@ -219,6 +219,7 @@ def test_powershell_selects_the_shared_hooks_in_registration_order() -> None:
         for each_entry in select_applicable_entries(POWERSHELL_TOOL_NAME)
     ]
     assert powershell_paths == [
+        "blocking/cursor_cli_python_misfire_blocker.py",
         "blocking/unscoped_search_blocker.py",
         "blocking/pii_prevention_blocker.py",
     ]

package/hooks/blocking/test_cursor_cli_python_misfire_blocker.py

@@ -0,0 +1,208 @@
+"""Behavior tests for the Cursor-vs-Python gate misfire PreToolUse hook."""
+
+from __future__ import annotations
+
+import importlib.util
+import io
+import json
+import pathlib
+import sys
+from unittest import mock
+
+_HOOK_DIR = pathlib.Path(__file__).parent
+if str(_HOOK_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIR))
+
+_HOOKS_DIR = str(_HOOK_DIR.parent)
+if _HOOKS_DIR not in sys.path:
+    sys.path.insert(0, _HOOKS_DIR)
+
+hook_spec = importlib.util.spec_from_file_location(
+    "cursor_cli_python_misfire_blocker",
+    _HOOK_DIR / "cursor_cli_python_misfire_blocker.py",
+)
+assert hook_spec is not None
+assert hook_spec.loader is not None
+hook_module = importlib.util.module_from_spec(hook_spec)
+hook_spec.loader.exec_module(hook_module)
+
+is_cursor_python_gate_misfire = hook_module.is_cursor_python_gate_misfire
+
+from hooks_constants.cursor_cli_python_misfire_blocker_constants import (  # noqa: E402
+    CORRECTIVE_MESSAGE,
+    DENY_DECISION,
+)
+
+
+def test_blocks_cursor_with_code_rules_gate_and_base_flag() -> None:
+    assert (
+        is_cursor_python_gate_misfire(
+            "cursor code_rules_gate.py --base origin/main"
+        )
+        is True
+    )
+
+
+def test_blocks_cursor_exe_with_staged_flag_on_python_path() -> None:
+    assert (
+        is_cursor_python_gate_misfire(r"Cursor.exe C:\temp\helper.py --staged")
+        is True
+    )
+
+
+def test_blocks_cursor_cmd_with_repo_root_flag() -> None:
+    assert (
+        is_cursor_python_gate_misfire("cursor.cmd path/to/module.py --repo-root .")
+        is True
+    )
+
+
+def test_allows_code_rules_gate_path_without_extra_flags() -> None:
+    assert is_cursor_python_gate_misfire("cursor code_rules_gate.py") is False
+
+
+def test_allows_cursor_goto_on_python_file() -> None:
+    assert is_cursor_python_gate_misfire("cursor -g file.py:10") is False
+
+
+def test_allows_cursor_goto_on_code_rules_gate_without_gate_flags() -> None:
+    assert (
+        is_cursor_python_gate_misfire("cursor -g code_rules_gate.py:40") is False
+    )
+
+
+def test_blocks_start_process_cursor_with_quoted_gate_flag() -> None:
+    command = (
+        r'Start-Process Cursor.exe -ArgumentList '
+        r'"C:\temp\helper.py","--staged"'
+    )
+    assert is_cursor_python_gate_misfire(command) is True
+
+
+def test_blocks_quoted_full_path_cursor_exe_with_gate_flags() -> None:
+    command = (
+        r"& 'C:\Program Files\Cursor\Cursor.exe' "
+        r"code_rules_gate.py --base origin/main"
+    )
+    assert is_cursor_python_gate_misfire(command) is True
+
+
+def test_blocks_unquoted_absolute_cursor_exe_with_gate_flags() -> None:
+    command = (
+        r"C:\Apps\Cursor\Cursor.exe code_rules_gate.py --base origin/main"
+    )
+    assert is_cursor_python_gate_misfire(command) is True
+
+
+def test_allows_relative_path_under_cursor_directory() -> None:
+    assert (
+        is_cursor_python_gate_misfire(
+            r"cursor\fix\x\code_rules_gate.py --base origin/main"
+        )
+        is False
+    )
+    assert (
+        is_cursor_python_gate_misfire(
+            "cursor/fix/x/code_rules_gate.py --base origin/main"
+        )
+        is False
+    )
+
+
+def test_allows_cursor_open_of_non_python_file() -> None:
+    assert is_cursor_python_gate_misfire("cursor README.md") is False
+
+
+def test_allows_python_running_the_gate() -> None:
+    assert (
+        is_cursor_python_gate_misfire(
+            "python code_rules_gate.py --base origin/main"
+        )
+        is False
+    )
+
+
+def test_allows_invoke_item() -> None:
+    assert (
+        is_cursor_python_gate_misfire("Invoke-Item -LiteralPath 'C:\\tmp\\a.py'")
+        is False
+    )
+
+
+def test_allows_empty_command() -> None:
+    assert is_cursor_python_gate_misfire("") is False
+
+
+def test_corrective_message_names_python_and_invoke_item() -> None:
+    assert "python" in CORRECTIVE_MESSAGE
+    assert "Invoke-Item -LiteralPath" in CORRECTIVE_MESSAGE
+    assert "EPIPE" in CORRECTIVE_MESSAGE
+
+
+def _run_main_with_io(input_text: str) -> str:
+    with mock.patch("sys.stdin", io.StringIO(input_text)):
+        with mock.patch("sys.stdout", new_callable=io.StringIO) as mock_stdout:
+            try:
+                hook_module.main()
+            except SystemExit:
+                pass
+            return mock_stdout.getvalue()
+
+
+def test_main_denies_bash_misfire() -> None:
+    hook_input = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "cursor code_rules_gate.py --base origin/main",
+        },
+    }
+    output_text = _run_main_with_io(json.dumps(hook_input))
+    output = json.loads(output_text)
+    assert output["hookSpecificOutput"]["permissionDecision"] == DENY_DECISION
+    assert "cursor-python-misfire" in output["hookSpecificOutput"][
+        "permissionDecisionReason"
+    ]
+
+
+def test_main_denies_powershell_misfire() -> None:
+    hook_input = {
+        "tool_name": "PowerShell",
+        "tool_input": {
+            "command": "cursor.cmd code_rules_gate.py --staged",
+        },
+    }
+    output_text = _run_main_with_io(json.dumps(hook_input))
+    output = json.loads(output_text)
+    assert output["hookSpecificOutput"]["permissionDecision"] == DENY_DECISION
+
+
+def test_main_passes_python_gate_run() -> None:
+    hook_input = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "python code_rules_gate.py --base origin/main",
+        },
+    }
+    assert _run_main_with_io(json.dumps(hook_input)) == ""
+
+
+def test_main_passes_wrong_tool_name() -> None:
+    hook_input = {
+        "tool_name": "Write",
+        "tool_input": {
+            "command": "cursor code_rules_gate.py --base origin/main",
+        },
+    }
+    assert _run_main_with_io(json.dumps(hook_input)) == ""
+
+
+def test_main_passes_malformed_json() -> None:
+    assert _run_main_with_io("not valid json {{{") == ""
+
+
+def test_main_passes_when_tool_input_is_null() -> None:
+    hook_input = {
+        "tool_name": "Bash",
+        "tool_input": None,
+    }
+    assert _run_main_with_io(json.dumps(hook_input)) == ""

package/hooks/blocking/test_send_user_file_open_locally_blocker.py

@@ -47,7 +47,10 @@ def test_allows_proactive_status() -> None:
 
 def test_corrective_message_points_to_native_windows_app() -> None:
     assert "native Windows app" in CORRECTIVE_MESSAGE
+    assert "Invoke-Item -LiteralPath" in CORRECTIVE_MESSAGE
     assert "Show-Asset.ps1" not in CORRECTIVE_MESSAGE
+    assert "Cursor.exe" in CORRECTIVE_MESSAGE
+    assert "EPIPE" in CORRECTIVE_MESSAGE
 
 
 def test_corrective_message_names_proactive_escape_hatch() -> None:

package/hooks/hooks_constants/AGENTS.md

@@ -21,6 +21,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `code_rules_path_utils_constants.py` | Path-matching helpers used by the code-rules check modules |
 | `command_dispatch_constants.py` | Command-word regex, command-key access pattern, tokenization pattern, and anchors for the unanchored command-dispatch meta-gate |
 | `conventional_pr_title_gate_constants.py` | Bash tool name, gh executable basenames and pr create/edit subcommand tokens, title/repo flag names, semantic-title-CI workflow markers, the Conventional Commits type list and title pattern, the semantic-pull-request action `types:` input pattern, and block-message text for the conventional-PR-title gate |
+| `cursor_cli_python_misfire_blocker_constants.py` | Detection patterns and deny message for Cursor launches that mistreat a Python code-rules-gate script |
 | `dead_argparse_argument_constants.py` | Patterns for detecting unused argparse arguments |
 | `dead_config_field_constants.py` | Patterns for detecting unused `*Config` / `*Selectors` dataclass fields |
 | `dead_dataclass_field_constants.py` | Patterns for detecting unused dataclass fields |
@@ -63,7 +64,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `pytest_testpaths_orphan_blocker_constants.py` | Marker filename, section and key names, test-file pattern, search budget, and block-message text for the pytest unregistered-test-directory blocker |
 | `python_style_checks_constants.py` | Command-line argument count and blank-line count between top-level functions for the style validator |
 | `ruff_integration_constants.py` | ``NO_COLOR`` / ``FORCE_COLOR`` environment variable names for plain ruff diagnostics |
-| `send_user_file_open_locally_blocker_constants.py` | Tool name, proactive status, and the block message for the open-locally attach blocker |
+| `send_user_file_open_locally_blocker_constants.py` | Tool name, proactive status, and the `Invoke-Item` block message for the open-locally attach blocker |
 | `sensitive_file_protector_constants.py` | Sensitive filename patterns, committed-template suffixes that earn an exemption, and the deny decision and message template for `sensitive_file_protector` |
 | `session_edit_stage_gate_constants.py` | Tracker filename prefix/suffix, JSON payload key, edit tool name set, session-id sanitize pattern, lock filename suffix and lock-acquire timing, git diff command, commit flag escapes, and deny-message template shared by the session edit stage gate trio |
 | `session_env_cleanup_constants.py` | Stale-age threshold and directory names for the session-env cleanup hook |

package/hooks/hooks_constants/bash_pre_tool_use_dispatcher_constants.py

@@ -58,6 +58,10 @@ ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
     BashHostedHookEntry("blocking/gh_body_arg_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/shell_substitution_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/piped_pytest_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
+    BashHostedHookEntry(
+        "blocking/cursor_cli_python_misfire_blocker.py",
+        ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+    ),
     BashHostedHookEntry(
         "blocking/unscoped_search_blocker.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES
     ),

package/hooks/hooks_constants/cursor_cli_python_misfire_blocker_constants.py

@@ -0,0 +1,79 @@
+"""Constants for the Cursor-vs-Python gate misfire PreToolUse blocker.
+
+Blocks Shell commands that launch Cursor's CLI or GUI binary against a Python
+script with code-rules-gate flags. That path feeds unknown options into
+Cursor's main process ``resolveArgs``, where ``console.warn`` on a closed pipe
+raises an EPIPE error dialog and still opens the script as an editor path.
+"""
+
+from __future__ import annotations
+
+import re
+
+__all__ = [
+    "ALL_SUPPORTED_TOOL_NAMES",
+    "BASH_TOOL_NAME",
+    "POWERSHELL_TOOL_NAME",
+    "TOOL_NAME_KEY",
+    "TOOL_INPUT_KEY",
+    "COMMAND_KEY",
+    "HOOK_SPECIFIC_OUTPUT_KEY",
+    "HOOK_EVENT_NAME_KEY",
+    "HOOK_EVENT_NAME",
+    "PERMISSION_DECISION_KEY",
+    "DENY_DECISION",
+    "PERMISSION_DECISION_REASON_KEY",
+    "CALLING_HOOK_NAME",
+    "CURSOR_LAUNCH_PATTERN",
+    "GATE_SCRIPT_PATTERN",
+    "GATE_FLAG_PATTERN",
+    "PYTHON_PATH_PATTERN",
+    "CORRECTIVE_MESSAGE",
+]
+
+BASH_TOOL_NAME = "Bash"
+POWERSHELL_TOOL_NAME = "PowerShell"
+ALL_SUPPORTED_TOOL_NAMES: frozenset[str] = frozenset(
+    {BASH_TOOL_NAME, POWERSHELL_TOOL_NAME}
+)
+
+TOOL_NAME_KEY = "tool_name"
+TOOL_INPUT_KEY = "tool_input"
+COMMAND_KEY = "command"
+
+HOOK_SPECIFIC_OUTPUT_KEY = "hookSpecificOutput"
+HOOK_EVENT_NAME_KEY = "hookEventName"
+HOOK_EVENT_NAME = "PreToolUse"
+PERMISSION_DECISION_KEY = "permissionDecision"
+DENY_DECISION = "deny"
+PERMISSION_DECISION_REASON_KEY = "permissionDecisionReason"
+
+CALLING_HOOK_NAME = "cursor_cli_python_misfire_blocker.py"
+
+CURSOR_LAUNCH_PATTERN = re.compile(
+    r"(?i)"
+    r"(?:"
+    r"(?:^|[\s;&|])(?:cursor(?:\.cmd|\.exe)?)(?=\s|[\"']|$)"
+    r"|"
+    r"[\\/](?:cursor(?:\.cmd|\.exe)?)(?=\s|[\"']|$)"
+    r")"
+)
+GATE_SCRIPT_PATTERN = re.compile(r"(?i)code_rules_gate\.py\b")
+GATE_FLAG_PATTERN = re.compile(
+    r"(?i)(?:^|[\s,\"'])(?:--base|--staged|--repo-root|--only-under)"
+    r"(?:\s|=|$|[\"'])"
+)
+PYTHON_PATH_PATTERN = re.compile(r"(?i)\.py(?:\s|$|['\":])")
+
+CORRECTIVE_MESSAGE = (
+    "BLOCKED [cursor-python-misfire]: Cursor's CLI/GUI was invoked against a "
+    "Python script with code-rules-gate flags. Cursor treats those flags as "
+    "unknown options, warns on a closed pipe, and raises an EPIPE error dialog "
+    "while still opening the script as an editor path.\n\n"
+    "To run the gate:\n"
+    "  python <path-to>/code_rules_gate.py --base origin/main\n\n"
+    "To open a file on screen in its native Windows app:\n"
+    "  Invoke-Item -LiteralPath '<path>'\n\n"
+    "Do not pass --base, --staged, --repo-root, or --only-under to cursor / "
+    "Cursor.exe."
+)

package/hooks/hooks_constants/send_user_file_open_locally_blocker_constants.py

@@ -7,7 +7,11 @@ PROACTIVE_STATUS: str = "proactive"
 CORRECTIVE_MESSAGE: str = (
     "BLOCKED [open-locally]: SendUserFile attaches a file to the session, which "
     "does not let the user see it while they are at the terminal. Open the file on "
-    "screen with its native Windows app. Open every path the user named.\n"
+    "screen with its native Windows app:\n"
+    "  Invoke-Item -LiteralPath '<path>'\n"
+    "Open every path the user named. Do not launch Cursor.exe or cursor.cmd to open "
+    "a file — unknown flags on that path raise an EPIPE error dialog in Cursor's "
+    "main process.\n"
     "The one allowed attach is a phone push: when the user has stepped away and you "
     'want the file to reach their phone, call SendUserFile with status "proactive".'
 )

package/hooks/hooks_constants/test_bash_pre_tool_use_dispatcher_constants.py

@@ -27,6 +27,7 @@ _EXPECTED_BASH_ORDER = (
     "blocking/gh_body_arg_blocker.py",
     "blocking/shell_substitution_blocker.py",
     "blocking/piped_pytest_blocker.py",
+    "blocking/cursor_cli_python_misfire_blocker.py",
     "blocking/unscoped_search_blocker.py",
     "blocking/nas_ssh_binary_enforcer.py",
     "blocking/volatile_path_in_post_blocker.py",
@@ -41,6 +42,7 @@ _EXPECTED_BASH_ORDER = (
 )
 
 _POWERSHELL_APPLICABLE = (
+    "blocking/cursor_cli_python_misfire_blocker.py",
     "blocking/unscoped_search_blocker.py",
     "blocking/pii_prevention_blocker.py",
 )

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "2.21.1",
+    "version": "2.21.2",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {