claude-dev-env 2.21.1 → 2.22.0

package/.agents/skills/orchestrator/SKILL.md

@@ -6,6 +6,7 @@ description: >-
   correction, plan, or stop. Triggers: '/orchestrator', 'orchestrator
   strategy', 'run with an orchestrator', 'executor-advisor mode',
   'orchestrator enforcement', 'agent routing', 'orchestrate'.
+disable-model-invocation: true
 ---
 
 # Orchestrator Strategy

package/.agents/skills/pr-cleanup/SKILL.md

@@ -48,6 +48,7 @@ with the user.
 | `pr-name-by-capability` | Find driver or motive words on reusable capability surfaces | Naming findings and rename directions |
 | `pr-small-cl` | Choose one coherent pull request or an ordered replacement stack | Focused boundary and dependencies |
 | `source-command-sr-loop` | Run `e-simplify`, then `e-code-review low --fix` until clean | Review passes, fixes, and validation |
+| `pr-summarizer` (repo-local) | When the repository under cleanup ships `.claude/skills/pr-summarizer/`, run it after Ready and post the secret-gist preview comment | Preview URL and comment confirmation |
 
 ## Task seeding
 
@@ -89,7 +90,12 @@ review passes, fixes, skips, tests, and commit SHAs.
 
 ### 6. Promote and report
 
-After the applicable gate passes, complete the [Finish report](#finish-report).
+After the applicable gate passes, when the repository under cleanup includes
+`.claude/skills/pr-summarizer/SKILL.md`, load and run that skill for each pull
+request promoted to Ready in this cleanup run. Post the secret gist preview as a
+pull request comment before completing the [Finish report](#finish-report).
+
+When the skill is absent, record `N/A` for the summary step and continue.
 
 ## Promotion gates
 
@@ -110,6 +116,9 @@ Reapply every relevant fix to the child. Rerun child tests, `e-simplify`, and
 `e-code-review` after the merge. Record the new child head and every validation
 result before promoting the child to Ready.
 
+When the repository ships `pr-summarizer`, run it on the child after child Ready
+promotion if the child is in scope for this cleanup run.
+
 Use `reference/task-seeds.md` and `reference/process-inventory.md` to record promotion evidence.
 
 ## Finish report
@@ -118,6 +127,7 @@ Use `reference/task-seeds.md` and `reference/process-inventory.md` to record pro
 - `pr-refinement` outcome.
 - `source-command-sr-loop` passes, commits, and validation results.
 - Parent-ready and child-ready SHAs when a child is promoted.
+- `pr-summarizer` preview URLs and comment confirmation for each Ready pull request, or `N/A` when the repo does not ship the skill.
 - Remaining hard block, or `null`.
 
 ## File index
@@ -125,5 +135,5 @@ Use `reference/task-seeds.md` and `reference/process-inventory.md` to record pro
 | Path | Purpose |
 |---|---|
 | `SKILL.md` | Hub for refinement, cleanup convergence, promotion gates, and reporting |
-| `reference/task-seeds.md` | Ordered session tasks for audits, delivery, validation, and promotion |
+| `reference/task-seeds.md` | Ordered session tasks for audits, delivery, validation, promotion, and summary |
 | `reference/process-inventory.md` | Process classes, evidence homes, and paired task checks |

package/.agents/skills/pr-cleanup/reference/process-inventory.md

@@ -8,8 +8,10 @@
 | Apply or disposition findings | judgment | `SKILL.md` and `task-seed:reference/task-seeds.md` | Changed diff or exact disposition | task-tool |
 | Validate parent head | deterministic | `task-seed:reference/task-seeds.md` | Scoped test and confirmation results | task-tool |
 | Promote parent and record exact Ready SHA | deterministic | `task-seed:reference/task-seeds.md` | Remote parent Ready state and SHA | task-tool |
+| Post parent PR summary gist comment | deterministic | `SKILL.md` and `task-seed:reference/task-seeds.md` | Preview URL, comment confirmation, or `N/A` | task-tool |
 | Merge exact parent SHA into child | deterministic | `task-seed:reference/task-seeds.md` | Child merge commit and parent SHA | task-tool |
 | Prove parent SHA ancestry | deterministic | `task-seed:reference/task-seeds.md` | `git merge-base --is-ancestor` exit code `0` | task-tool |
 | Reapply relevant fixes to child | judgment | `SKILL.md` and `task-seed:reference/task-seeds.md` | Child diff and reapplication record | task-tool |
 | Validate child and rerun confirmations | deterministic | `task-seed:reference/task-seeds.md` | New child-head tests, simplify, and review results | task-tool |
 | Promote child and report | deterministic | `task-seed:reference/task-seeds.md` | Child Ready state and finish report | task-tool |
+| Post child PR summary gist comment | deterministic | `SKILL.md` and `task-seed:reference/task-seeds.md` | Preview URL, comment confirmation, or `N/A` | task-tool |

package/.agents/skills/pr-cleanup/reference/task-seeds.md

@@ -11,10 +11,12 @@ each task with evidence from the stated gate.
 6. Select, apply, validate, or exactly disposition every actionable preflight finding in the one-agent parent cleanup worktree.
 7. Run parent scoped tests and cleanup/review confirmation checks.
 8. Promote the parent to Ready and record the exact remote `parent_ready_sha`.
-9. Create the child from its intended pre-parent base and merge the exact `parent_ready_sha`.
-10. Prove `parent_ready_sha` is an ancestor of the child head and record the exit code.
-11. Reapply every relevant preflight fix to the child.
-12. Run child scoped tests on the new child head.
-13. Rerun `e-simplify` and `e-code-review` on the new child head.
-14. Promote the child to Ready after all child evidence passes.
-15. Write the finish report with SHAs, evidence, states, and hard blocks.
+9. When `.claude/skills/pr-summarizer/SKILL.md` exists in the repository under cleanup, run that skill on the parent and post the gist preview comment; otherwise record `N/A`.
+10. Create the child from its intended pre-parent base and merge the exact `parent_ready_sha`.
+11. Prove `parent_ready_sha` is an ancestor of the child head and record the exit code.
+12. Reapply every relevant preflight fix to the child.
+13. Run child scoped tests on the new child head.
+14. Rerun `e-simplify` and `e-code-review` on the new child head.
+15. Promote the child to Ready after all child evidence passes.
+16. When the repository ships `pr-summarizer` and the child is in scope, run it on the child and post the gist preview comment; otherwise record `N/A`.
+17. Write the finish report with SHAs, evidence, summary preview URLs, states, and hard blocks.

package/.agents/skills/team-advisor/SKILL.md

@@ -5,6 +5,7 @@ description: >-
   it before substantive work, completion, commits, or when stuck. Triggers:
   'team-advisor', 'team advisor', 'second opinion', 'advisor', 'consult',
   'verify', 'validate', 'commit', 'push'.
+disable-model-invocation: true
 ---
 
 # Team Advisor

package/AGENTS.md

@@ -1,4 +1,4 @@
-# Scope
+Avoid all redundant text for all output. IE: instead of "the review found 2 real issues", simply state "the review found 2 issues".
 
 ## User-facing language hierarchy
 

package/hooks/blocking/AGENTS.md

@@ -71,6 +71,7 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `bot_mention_comment_blocker.py` | PreToolUse (Write/Edit) | PR review comments that @-mention a bot |
 | `claude_md_orphan_file_blocker.py` | PreToolUse (Write/Edit/MultiEdit) | Per-directory `CLAUDE.md` table cells naming a bare filename absent from the directory subtree |
 | `conventional_pr_title_gate.py` | PreToolUse (Bash) | `gh pr create`/`gh pr edit` with a `--title` that is not a Conventional Commit, in a repo whose CI runs a semantic-pull-request title check |
+| `cursor_cli_python_misfire_blocker.py` | PreToolUse (Bash/PowerShell) | `cursor` / `Cursor.exe` launched against a Python script with code-rules-gate flags, which raises Cursor's EPIPE unknown-option dialog |
 | `destructive_command_blocker.py` | PreToolUse (Bash/PowerShell) | Shell commands with destructive literals (`rm -rf`, `git reset --hard`, etc.) |
 | `docstring_rule_gate_count_blocker.py` | PreToolUse (Write/Edit/MultiEdit) | A stale spelled-out gate-validator count in `docstring-prose-matches-implementation.md` — the "N more gate validators" / "M gated slices" count drifting from the `check_docstring_*` validators the prose names |
 | `duplicate_rmtree_helper_blocker.py` | PreToolUse (Write/Edit) | A local re-definition of the Windows-safe rmtree helper trio (`_strip_read_only_and_retry`, `_force_remove_tree` / `force_rmtree`) in place of importing a shared helper |
@@ -94,7 +95,7 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `precommit_code_rules_gate.py` | PreToolUse (Bash) | Staged changes that fail the CODE_RULES gate at commit time |
 | `pytest_testpaths_orphan_blocker.py` | PreToolUse (Write/Edit/MultiEdit) | New `test_*.py` files created under a directory absent from a package's explicit pytest `testpaths` allowlist |
 | `question_to_user_enforcer.py` | Stop | User-directed questions not routed through `AskUserQuestion` |
-| `send_user_file_open_locally_blocker.py` | PreToolUse (SendUserFile) | A desk-side file attach (`SendUserFile` with `status` not `proactive`); points to opening the file with its native Windows app |
+| `send_user_file_open_locally_blocker.py` | PreToolUse (SendUserFile) | A desk-side file attach (`SendUserFile` with `status` not `proactive`); points to `Invoke-Item -LiteralPath` for the native Windows app |
 | `sensitive_file_protector.py` | PreToolUse (Write/Edit/MultiEdit) | Writes to sensitive credential or config files |
 | `session_edit_stage_gate.py` | PreToolUse (Bash) | A `git commit` that would drop files edited this session because they are tracked but left unstaged |
 | `session_handoff_blocker.py` | Stop | Responses suggesting a new session mid-task |

package/hooks/blocking/cursor_cli_python_misfire_blocker.py

@@ -0,0 +1,108 @@
+#!/usr/bin/env python3
+"""PreToolUse hook: deny Cursor launches that mistreat a Python gate script.
+
+Agents sometimes run ``cursor code_rules_gate.py --base origin/main`` (or the
+same shape through ``Cursor.exe`` / ``cursor.cmd``) when the intent is either
+to execute the gate or to open a file. Cursor's main process then hits
+``onUnknownOption`` for the gate flags, ``console.warn`` writes to a closed
+pipe, and Windows shows an EPIPE error dialog — while still opening the
+``.py`` path in the editor.
+
+::
+
+    cursor code_rules_gate.py --base origin/main     flag
+    Cursor.exe gate.py --staged                      flag
+    cursor.cmd path/to/x.py --repo-root .            flag
+    cursor code_rules_gate.py                        ok: editor open, no gate flags
+    cursor -g file.py:10                             ok: editor goto, no gate flags
+    cursor README.md                                 ok: open without gate flags
+    python code_rules_gate.py --base origin/main     ok: real gate run
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+_hooks_dir = str(Path(__file__).resolve().parent.parent)
+if _hooks_dir not in sys.path:
+    sys.path.insert(0, _hooks_dir)
+
+from hooks_constants.cursor_cli_python_misfire_blocker_constants import (  # noqa: E402
+    ALL_SUPPORTED_TOOL_NAMES,
+    CALLING_HOOK_NAME,
+    COMMAND_KEY,
+    CORRECTIVE_MESSAGE,
+    CURSOR_LAUNCH_PATTERN,
+    DENY_DECISION,
+    GATE_FLAG_PATTERN,
+    GATE_SCRIPT_PATTERN,
+    HOOK_EVENT_NAME,
+    HOOK_EVENT_NAME_KEY,
+    HOOK_SPECIFIC_OUTPUT_KEY,
+    PERMISSION_DECISION_KEY,
+    PERMISSION_DECISION_REASON_KEY,
+    PYTHON_PATH_PATTERN,
+    TOOL_INPUT_KEY,
+    TOOL_NAME_KEY,
+)
+from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+from hooks_constants.pre_tool_use_stdin import (  # noqa: E402
+    read_hook_input_dictionary_from_stdin,
+)
+
+
+def is_cursor_python_gate_misfire(command: str) -> bool:
+    """Return True when *command* launches Cursor against a gate-shaped Python run.
+
+    Args:
+        command: Raw Bash or PowerShell command string from the tool input.
+
+    Returns:
+        True when Cursor is the launch target, a gate CLI flag is present, and
+        the operands name the gate script or another ``.py`` path.
+    """
+    if not command or not CURSOR_LAUNCH_PATTERN.search(command):
+        return False
+    if not GATE_FLAG_PATTERN.search(command):
+        return False
+    return bool(GATE_SCRIPT_PATTERN.search(command) or PYTHON_PATH_PATTERN.search(command))
+
+
+def main() -> None:
+    hook_input = read_hook_input_dictionary_from_stdin()
+    if hook_input is None:
+        sys.exit(0)
+
+    tool_name = hook_input.get(TOOL_NAME_KEY, "")
+    if tool_name not in ALL_SUPPORTED_TOOL_NAMES:
+        sys.exit(0)
+
+    tool_input = hook_input.get(TOOL_INPUT_KEY) or {}
+    if not isinstance(tool_input, dict):
+        sys.exit(0)
+    command = tool_input.get(COMMAND_KEY, "")
+    if not isinstance(command, str) or not is_cursor_python_gate_misfire(command):
+        sys.exit(0)
+
+    deny_payload = {
+        HOOK_SPECIFIC_OUTPUT_KEY: {
+            HOOK_EVENT_NAME_KEY: HOOK_EVENT_NAME,
+            PERMISSION_DECISION_KEY: DENY_DECISION,
+            PERMISSION_DECISION_REASON_KEY: CORRECTIVE_MESSAGE,
+        }
+    }
+    log_hook_block(
+        calling_hook_name=CALLING_HOOK_NAME,
+        hook_event=HOOK_EVENT_NAME,
+        block_reason=CORRECTIVE_MESSAGE,
+        tool_name=str(tool_name),
+    )
+    print(json.dumps(deny_payload))
+    sys.stdout.flush()
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/pre_tool_use_dispatcher.py

@@ -496,13 +496,15 @@ def _emit_allow_decision(decision: DispatcherDecision) -> None:
     allow_payload: dict[str, object] = {
         "hookSpecificOutput": allow_hook_specific,
     }
-    if decision.all_additional_context:
+    all_unique_additional_context = unique_first_seen_strings(decision.all_additional_context)
+    all_unique_system_messages = unique_first_seen_strings(decision.all_system_messages)
+    if all_unique_additional_context:
         allow_hook_specific["additionalContext"] = CONTEXT_JOIN_SEPARATOR.join(
-            decision.all_additional_context
+            all_unique_additional_context
         )
-    if decision.all_system_messages:
+    if all_unique_system_messages:
         allow_payload["systemMessage"] = SYSTEM_MESSAGE_JOIN_SEPARATOR.join(
-            decision.all_system_messages
+            all_unique_system_messages
         )
     sys.stdout.write(json.dumps(allow_payload) + "\n")
     sys.stdout.flush()

package/hooks/blocking/send_user_file_open_locally_blocker.py

@@ -3,8 +3,9 @@
 
 SendUserFile attaches a file to the session. While the user is at the terminal
 (status "normal" or unset) an attach does not let them see the file — it must
-open on screen in its native Windows app. The one attach allowed
-through is an away-from-desk phone push (status "proactive").
+open on screen in its native Windows app. The corrective message names the
+``Invoke-Item -LiteralPath`` form. The one attach allowed through is an
+away-from-desk phone push (status "proactive").
 """
 
 import json

package/hooks/blocking/test_bash_pre_tool_use_dispatcher.py

@@ -219,6 +219,7 @@ def test_powershell_selects_the_shared_hooks_in_registration_order() -> None:
         for each_entry in select_applicable_entries(POWERSHELL_TOOL_NAME)
     ]
     assert powershell_paths == [
+        "blocking/cursor_cli_python_misfire_blocker.py",
         "blocking/unscoped_search_blocker.py",
         "blocking/pii_prevention_blocker.py",
     ]

package/hooks/blocking/test_cursor_cli_python_misfire_blocker.py

@@ -0,0 +1,208 @@
+"""Behavior tests for the Cursor-vs-Python gate misfire PreToolUse hook."""
+
+from __future__ import annotations
+
+import importlib.util
+import io
+import json
+import pathlib
+import sys
+from unittest import mock
+
+_HOOK_DIR = pathlib.Path(__file__).parent
+if str(_HOOK_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIR))
+
+_HOOKS_DIR = str(_HOOK_DIR.parent)
+if _HOOKS_DIR not in sys.path:
+    sys.path.insert(0, _HOOKS_DIR)
+
+hook_spec = importlib.util.spec_from_file_location(
+    "cursor_cli_python_misfire_blocker",
+    _HOOK_DIR / "cursor_cli_python_misfire_blocker.py",
+)
+assert hook_spec is not None
+assert hook_spec.loader is not None
+hook_module = importlib.util.module_from_spec(hook_spec)
+hook_spec.loader.exec_module(hook_module)
+
+is_cursor_python_gate_misfire = hook_module.is_cursor_python_gate_misfire
+
+from hooks_constants.cursor_cli_python_misfire_blocker_constants import (  # noqa: E402
+    CORRECTIVE_MESSAGE,
+    DENY_DECISION,
+)
+
+
+def test_blocks_cursor_with_code_rules_gate_and_base_flag() -> None:
+    assert (
+        is_cursor_python_gate_misfire(
+            "cursor code_rules_gate.py --base origin/main"
+        )
+        is True
+    )
+
+
+def test_blocks_cursor_exe_with_staged_flag_on_python_path() -> None:
+    assert (
+        is_cursor_python_gate_misfire(r"Cursor.exe C:\temp\helper.py --staged")
+        is True
+    )
+
+
+def test_blocks_cursor_cmd_with_repo_root_flag() -> None:
+    assert (
+        is_cursor_python_gate_misfire("cursor.cmd path/to/module.py --repo-root .")
+        is True
+    )
+
+
+def test_allows_code_rules_gate_path_without_extra_flags() -> None:
+    assert is_cursor_python_gate_misfire("cursor code_rules_gate.py") is False
+
+
+def test_allows_cursor_goto_on_python_file() -> None:
+    assert is_cursor_python_gate_misfire("cursor -g file.py:10") is False
+
+
+def test_allows_cursor_goto_on_code_rules_gate_without_gate_flags() -> None:
+    assert (
+        is_cursor_python_gate_misfire("cursor -g code_rules_gate.py:40") is False
+    )
+
+
+def test_blocks_start_process_cursor_with_quoted_gate_flag() -> None:
+    command = (
+        r'Start-Process Cursor.exe -ArgumentList '
+        r'"C:\temp\helper.py","--staged"'
+    )
+    assert is_cursor_python_gate_misfire(command) is True
+
+
+def test_blocks_quoted_full_path_cursor_exe_with_gate_flags() -> None:
+    command = (
+        r"& 'C:\Program Files\Cursor\Cursor.exe' "
+        r"code_rules_gate.py --base origin/main"
+    )
+    assert is_cursor_python_gate_misfire(command) is True
+
+
+def test_blocks_unquoted_absolute_cursor_exe_with_gate_flags() -> None:
+    command = (
+        r"C:\Apps\Cursor\Cursor.exe code_rules_gate.py --base origin/main"
+    )
+    assert is_cursor_python_gate_misfire(command) is True
+
+
+def test_allows_relative_path_under_cursor_directory() -> None:
+    assert (
+        is_cursor_python_gate_misfire(
+            r"cursor\fix\x\code_rules_gate.py --base origin/main"
+        )
+        is False
+    )
+    assert (
+        is_cursor_python_gate_misfire(
+            "cursor/fix/x/code_rules_gate.py --base origin/main"
+        )
+        is False
+    )
+
+
+def test_allows_cursor_open_of_non_python_file() -> None:
+    assert is_cursor_python_gate_misfire("cursor README.md") is False
+
+
+def test_allows_python_running_the_gate() -> None:
+    assert (
+        is_cursor_python_gate_misfire(
+            "python code_rules_gate.py --base origin/main"
+        )
+        is False
+    )
+
+
+def test_allows_invoke_item() -> None:
+    assert (
+        is_cursor_python_gate_misfire("Invoke-Item -LiteralPath 'C:\\tmp\\a.py'")
+        is False
+    )
+
+
+def test_allows_empty_command() -> None:
+    assert is_cursor_python_gate_misfire("") is False
+
+
+def test_corrective_message_names_python_and_invoke_item() -> None:
+    assert "python" in CORRECTIVE_MESSAGE
+    assert "Invoke-Item -LiteralPath" in CORRECTIVE_MESSAGE
+    assert "EPIPE" in CORRECTIVE_MESSAGE
+
+
+def _run_main_with_io(input_text: str) -> str:
+    with mock.patch("sys.stdin", io.StringIO(input_text)):
+        with mock.patch("sys.stdout", new_callable=io.StringIO) as mock_stdout:
+            try:
+                hook_module.main()
+            except SystemExit:
+                pass
+            return mock_stdout.getvalue()
+
+
+def test_main_denies_bash_misfire() -> None:
+    hook_input = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "cursor code_rules_gate.py --base origin/main",
+        },
+    }
+    output_text = _run_main_with_io(json.dumps(hook_input))
+    output = json.loads(output_text)
+    assert output["hookSpecificOutput"]["permissionDecision"] == DENY_DECISION
+    assert "cursor-python-misfire" in output["hookSpecificOutput"][
+        "permissionDecisionReason"
+    ]
+
+
+def test_main_denies_powershell_misfire() -> None:
+    hook_input = {
+        "tool_name": "PowerShell",
+        "tool_input": {
+            "command": "cursor.cmd code_rules_gate.py --staged",
+        },
+    }
+    output_text = _run_main_with_io(json.dumps(hook_input))
+    output = json.loads(output_text)
+    assert output["hookSpecificOutput"]["permissionDecision"] == DENY_DECISION
+
+
+def test_main_passes_python_gate_run() -> None:
+    hook_input = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "python code_rules_gate.py --base origin/main",
+        },
+    }
+    assert _run_main_with_io(json.dumps(hook_input)) == ""
+
+
+def test_main_passes_wrong_tool_name() -> None:
+    hook_input = {
+        "tool_name": "Write",
+        "tool_input": {
+            "command": "cursor code_rules_gate.py --base origin/main",
+        },
+    }
+    assert _run_main_with_io(json.dumps(hook_input)) == ""
+
+
+def test_main_passes_malformed_json() -> None:
+    assert _run_main_with_io("not valid json {{{") == ""
+
+
+def test_main_passes_when_tool_input_is_null() -> None:
+    hook_input = {
+        "tool_name": "Bash",
+        "tool_input": None,
+    }
+    assert _run_main_with_io(json.dumps(hook_input)) == ""

package/hooks/blocking/test_send_user_file_open_locally_blocker.py

@@ -47,7 +47,10 @@ def test_allows_proactive_status() -> None:
 
 def test_corrective_message_points_to_native_windows_app() -> None:
     assert "native Windows app" in CORRECTIVE_MESSAGE
+    assert "Invoke-Item -LiteralPath" in CORRECTIVE_MESSAGE
     assert "Show-Asset.ps1" not in CORRECTIVE_MESSAGE
+    assert "Cursor.exe" in CORRECTIVE_MESSAGE
+    assert "EPIPE" in CORRECTIVE_MESSAGE
 
 
 def test_corrective_message_names_proactive_escape_hatch() -> None:

package/hooks/hooks_constants/AGENTS.md

@@ -21,6 +21,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `code_rules_path_utils_constants.py` | Path-matching helpers used by the code-rules check modules |
 | `command_dispatch_constants.py` | Command-word regex, command-key access pattern, tokenization pattern, and anchors for the unanchored command-dispatch meta-gate |
 | `conventional_pr_title_gate_constants.py` | Bash tool name, gh executable basenames and pr create/edit subcommand tokens, title/repo flag names, semantic-title-CI workflow markers, the Conventional Commits type list and title pattern, the semantic-pull-request action `types:` input pattern, and block-message text for the conventional-PR-title gate |
+| `cursor_cli_python_misfire_blocker_constants.py` | Detection patterns and deny message for Cursor launches that mistreat a Python code-rules-gate script |
 | `dead_argparse_argument_constants.py` | Patterns for detecting unused argparse arguments |
 | `dead_config_field_constants.py` | Patterns for detecting unused `*Config` / `*Selectors` dataclass fields |
 | `dead_dataclass_field_constants.py` | Patterns for detecting unused dataclass fields |
@@ -63,7 +64,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `pytest_testpaths_orphan_blocker_constants.py` | Marker filename, section and key names, test-file pattern, search budget, and block-message text for the pytest unregistered-test-directory blocker |
 | `python_style_checks_constants.py` | Command-line argument count and blank-line count between top-level functions for the style validator |
 | `ruff_integration_constants.py` | ``NO_COLOR`` / ``FORCE_COLOR`` environment variable names for plain ruff diagnostics |
-| `send_user_file_open_locally_blocker_constants.py` | Tool name, proactive status, and the block message for the open-locally attach blocker |
+| `send_user_file_open_locally_blocker_constants.py` | Tool name, proactive status, and the `Invoke-Item` block message for the open-locally attach blocker |
 | `sensitive_file_protector_constants.py` | Sensitive filename patterns, committed-template suffixes that earn an exemption, and the deny decision and message template for `sensitive_file_protector` |
 | `session_edit_stage_gate_constants.py` | Tracker filename prefix/suffix, JSON payload key, edit tool name set, session-id sanitize pattern, lock filename suffix and lock-acquire timing, git diff command, commit flag escapes, and deny-message template shared by the session edit stage gate trio |
 | `session_env_cleanup_constants.py` | Stale-age threshold and directory names for the session-env cleanup hook |

package/hooks/hooks_constants/bash_pre_tool_use_dispatcher_constants.py

@@ -58,6 +58,10 @@ ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
     BashHostedHookEntry("blocking/gh_body_arg_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/shell_substitution_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/piped_pytest_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
+    BashHostedHookEntry(
+        "blocking/cursor_cli_python_misfire_blocker.py",
+        ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+    ),
     BashHostedHookEntry(
         "blocking/unscoped_search_blocker.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES
     ),

package/hooks/hooks_constants/cursor_cli_python_misfire_blocker_constants.py

@@ -0,0 +1,79 @@
+"""Constants for the Cursor-vs-Python gate misfire PreToolUse blocker.
+
+Blocks Shell commands that launch Cursor's CLI or GUI binary against a Python
+script with code-rules-gate flags. That path feeds unknown options into
+Cursor's main process ``resolveArgs``, where ``console.warn`` on a closed pipe
+raises an EPIPE error dialog and still opens the script as an editor path.
+"""
+
+from __future__ import annotations
+
+import re
+
+__all__ = [
+    "ALL_SUPPORTED_TOOL_NAMES",
+    "BASH_TOOL_NAME",
+    "POWERSHELL_TOOL_NAME",
+    "TOOL_NAME_KEY",
+    "TOOL_INPUT_KEY",
+    "COMMAND_KEY",
+    "HOOK_SPECIFIC_OUTPUT_KEY",
+    "HOOK_EVENT_NAME_KEY",
+    "HOOK_EVENT_NAME",
+    "PERMISSION_DECISION_KEY",
+    "DENY_DECISION",
+    "PERMISSION_DECISION_REASON_KEY",
+    "CALLING_HOOK_NAME",
+    "CURSOR_LAUNCH_PATTERN",
+    "GATE_SCRIPT_PATTERN",
+    "GATE_FLAG_PATTERN",
+    "PYTHON_PATH_PATTERN",
+    "CORRECTIVE_MESSAGE",
+]
+
+BASH_TOOL_NAME = "Bash"
+POWERSHELL_TOOL_NAME = "PowerShell"
+ALL_SUPPORTED_TOOL_NAMES: frozenset[str] = frozenset(
+    {BASH_TOOL_NAME, POWERSHELL_TOOL_NAME}
+)
+
+TOOL_NAME_KEY = "tool_name"
+TOOL_INPUT_KEY = "tool_input"
+COMMAND_KEY = "command"
+
+HOOK_SPECIFIC_OUTPUT_KEY = "hookSpecificOutput"
+HOOK_EVENT_NAME_KEY = "hookEventName"
+HOOK_EVENT_NAME = "PreToolUse"
+PERMISSION_DECISION_KEY = "permissionDecision"
+DENY_DECISION = "deny"
+PERMISSION_DECISION_REASON_KEY = "permissionDecisionReason"
+
+CALLING_HOOK_NAME = "cursor_cli_python_misfire_blocker.py"
+
+CURSOR_LAUNCH_PATTERN = re.compile(
+    r"(?i)"
+    r"(?:"
+    r"(?:^|[\s;&|])(?:cursor(?:\.cmd|\.exe)?)(?=\s|[\"']|$)"
+    r"|"
+    r"[\\/](?:cursor(?:\.cmd|\.exe)?)(?=\s|[\"']|$)"
+    r")"
+)
+GATE_SCRIPT_PATTERN = re.compile(r"(?i)code_rules_gate\.py\b")
+GATE_FLAG_PATTERN = re.compile(
+    r"(?i)(?:^|[\s,\"'])(?:--base|--staged|--repo-root|--only-under)"
+    r"(?:\s|=|$|[\"'])"
+)
+PYTHON_PATH_PATTERN = re.compile(r"(?i)\.py(?:\s|$|['\":])")
+
+CORRECTIVE_MESSAGE = (
+    "BLOCKED [cursor-python-misfire]: Cursor's CLI/GUI was invoked against a "
+    "Python script with code-rules-gate flags. Cursor treats those flags as "
+    "unknown options, warns on a closed pipe, and raises an EPIPE error dialog "
+    "while still opening the script as an editor path.\n\n"
+    "To run the gate:\n"
+    "  python <path-to>/code_rules_gate.py --base origin/main\n\n"
+    "To open a file on screen in its native Windows app:\n"
+    "  Invoke-Item -LiteralPath '<path>'\n\n"
+    "Do not pass --base, --staged, --repo-root, or --only-under to cursor / "
+    "Cursor.exe."
+)

package/hooks/hooks_constants/send_user_file_open_locally_blocker_constants.py

@@ -7,7 +7,11 @@ PROACTIVE_STATUS: str = "proactive"
 CORRECTIVE_MESSAGE: str = (
     "BLOCKED [open-locally]: SendUserFile attaches a file to the session, which "
     "does not let the user see it while they are at the terminal. Open the file on "
-    "screen with its native Windows app. Open every path the user named.\n"
+    "screen with its native Windows app:\n"
+    "  Invoke-Item -LiteralPath '<path>'\n"
+    "Open every path the user named. Do not launch Cursor.exe or cursor.cmd to open "
+    "a file — unknown flags on that path raise an EPIPE error dialog in Cursor's "
+    "main process.\n"
     "The one allowed attach is a phone push: when the user has stepped away and you "
     'want the file to reach their phone, call SendUserFile with status "proactive".'
 )

package/hooks/hooks_constants/test_bash_pre_tool_use_dispatcher_constants.py

@@ -27,6 +27,7 @@ _EXPECTED_BASH_ORDER = (
     "blocking/gh_body_arg_blocker.py",
     "blocking/shell_substitution_blocker.py",
     "blocking/piped_pytest_blocker.py",
+    "blocking/cursor_cli_python_misfire_blocker.py",
     "blocking/unscoped_search_blocker.py",
     "blocking/nas_ssh_binary_enforcer.py",
     "blocking/volatile_path_in_post_blocker.py",
@@ -41,6 +42,7 @@ _EXPECTED_BASH_ORDER = (
 )
 
 _POWERSHELL_APPLICABLE = (
+    "blocking/cursor_cli_python_misfire_blocker.py",
     "blocking/unscoped_search_blocker.py",
     "blocking/pii_prevention_blocker.py",
 )

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "2.21.1",
+    "version": "2.22.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {