claude-dev-env 2.3.0 → 2.4.0

package/hooks/blocking/config/code_review_enforcement_constants.py

@@ -0,0 +1,110 @@
+"""Single source of truth for the code-review enforcement gate family.
+
+Holds the stamp directory name, the ordered effort tokens (``low`` under
+``medium`` under ``high`` under ``xhigh`` under ``max``, with ``ultra`` kept
+out because it needs an interactive terminal), the effort a push and a
+pull-request creation each require, the stamp record keys, the gate and
+write-blocker messages, the store-forge shell patterns, the MCP create-PR
+tool name, and the effort comparison every gate and the stamp store share so
+the thresholds never drift between them.
+"""
+
+from __future__ import annotations
+
+STAMP_DIRECTORY_NAME = "code-review-stamps"
+ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER = ("low", "medium", "high", "xhigh", "max")
+PUSH_REQUIRED_EFFORT = "low"
+PR_CREATE_REQUIRED_EFFORT = "xhigh"
+STAMP_KEY_EFFORT = "effort"
+STAMP_KEY_MANIFEST_SHA256 = "manifest_sha256"
+STAMP_KEY_RECORDED_AT_EPOCH = "recorded_at_epoch"
+CODE_REVIEW_BYPASS_MARKER = "# code-review-skip"
+GATED_PUSH_SUBCOMMANDS = frozenset({"push"})
+ALL_GATED_SHELL_TOOL_NAMES = ("Bash", "PowerShell")
+ALL_WRITE_EDIT_TOOL_NAMES = ("Write", "Edit", "MultiEdit")
+MCP_CREATE_PULL_REQUEST_TOOL_NAME = "mcp__plugin_github_github__create_pull_request"
+HASH_PREVIEW_LENGTH = 16
+PRE_TOOL_USE_HOOK_EVENT_NAME = "PreToolUse"
+DENY_PERMISSION_DECISION = "deny"
+PUSH_GATE_HOOK_MODULE_NAME = "code_review_push_gate.py"
+PR_CREATE_GATE_HOOK_MODULE_NAME = "code_review_pr_create_gate.py"
+STAMP_WRITE_BLOCKER_HOOK_MODULE_NAME = "code_review_stamp_directory_write_blocker.py"
+SANCTIONED_STAMP_MINTER_FLAG = "--record-stamp"
+PUSH_GATE_CORRECTIVE_MESSAGE = (
+    "BLOCKED: [CODE_REVIEW_PUSH_GATE] This branch surface has no clean "
+    "code-review stamp at effort 'low' or higher. Run "
+    "`python invoke_code_review.py --record-stamp --cwd <dir> "
+    "--session-model <alias> low` (or a higher effort) so a clean review "
+    "mints the stamp before `git push`; any file change after minting "
+    "invalidates it. Append `# code-review-skip` as a trailing shell comment "
+    "only when the verified-commit gate's verify-skip rule for a same-surface "
+    "re-land applies. Exempt automatically: docs/image files, pytest test "
+    "files, and Python files whose docstring- and comment-stripped AST is "
+    "unchanged."
+)
+PR_CREATE_GATE_CORRECTIVE_MESSAGE = (
+    "BLOCKED: [CODE_REVIEW_PR_CREATE_GATE] This branch surface has no clean "
+    "code-review stamp at effort 'xhigh' or higher. Run "
+    "`python invoke_code_review.py --record-stamp --cwd <dir> "
+    "--session-model <alias> xhigh` (or max) so a clean review mints the "
+    "stamp before `gh pr create` or the MCP create_pull_request tool. Any "
+    "file change after minting invalidates the stamp."
+)
+STAMP_DIRECTORY_GUARD_MESSAGE = (
+    "BLOCKED: [CODE_REVIEW_STAMP_DIRECTORY_GUARD] Access to the code-review "
+    "stamp directory (~/.claude/code-review-stamps/) is denied. Only "
+    "invoke_code_review.py --record-stamp mints stamp files; a shell or "
+    "Write/Edit forge here would defeat the push and PR-create gates. "
+    "Earn a stamp by running a clean /code-review through the invoker."
+)
+RELATIVE_STAMP_DIRECTORY_PATTERN = r"(?:^|(?<=[\s;&|(='\"]))code-review-stamps[\\/]"
+STAMP_DIRECTORY_CHANGE_TARGET_PATTERN = r"[ \t]+['\"]?code-review-stamps[\\/]?['\"]?(?=[\s;&|]|$)"
+STAMP_FILE_REFERENCE_BOUNDARY_PREFIX_PATTERN = r"(?:^|(?<=[\s;&|(='\"\\/]))"
+STAMP_FILE_ROOT_KEY_JSON_SUFFIX_PATTERN = r"[\\/][0-9a-f]{%d}\.json"
+GH_PR_CREATE_INVOCATION_PATTERN = (
+    r"(?:^|[;&|\n`({]|\$\()[ \t]*"
+    r"(?:(?:if|then|else|elif|while|until|do|!)[ \t]+)*"
+    r"(?:[A-Za-z_][A-Za-z0-9_]*=\S+[ \t]+)*"
+    r"gh(?:[ \t]+(?:--[A-Za-z][\w-]*(?:=\S+)?|-[A-Za-z])(?:[ \t]+(?!-)\S+)?)*"
+    r"[ \t]+pr[ \t]+create\b"
+)
+ALL_STAMP_PATH_SEGMENT_NAMES = (".claude", "code-review-stamps")
+ALL_STAMP_PATH_SEGMENT_BODIES = ("claude", "code-review-stamps")
+STAMP_STORE_MODULE_NAME = "code_review_stamp_store"
+STAMP_MINT_FUNCTION_NAME = "record_clean_stamp"
+ALL_STAMP_STORE_FORGE_PATTERNS = (
+    rf"\bimport\s+{STAMP_STORE_MODULE_NAME}\b",
+    rf"\bfrom\s+{STAMP_STORE_MODULE_NAME}\s+import\b",
+    rf"\b{STAMP_MINT_FUNCTION_NAME}\s*\(",
+)
+
+
+def effort_meets_threshold(candidate_effort: str, required_effort: str) -> bool:
+    """Decide whether a recorded effort satisfies a required threshold.
+
+    ::
+
+        effort_meets_threshold("xhigh", "low")  -> True   xhigh outranks low
+        effort_meets_threshold("low", "xhigh")  -> False  low sits below xhigh
+        effort_meets_threshold("ultra", "low")  -> False  ultra is unranked
+
+    A candidate satisfies the threshold when it sits at or above the required
+    token in the ascending order. A token outside the known order — ``ultra``
+    among them — satisfies nothing, so an unrecognized stored effort clears no
+    gate.
+
+    Args:
+        candidate_effort: The effort a recorded stamp was earned at.
+        required_effort: The effort the gate demands for the action.
+
+    Returns:
+        True when both tokens are known and the candidate ranks at or above the
+        required token; False otherwise.
+    """
+    if candidate_effort not in ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER:
+        return False
+    if required_effort not in ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER:
+        return False
+    candidate_rank = ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER.index(candidate_effort)
+    required_rank = ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER.index(required_effort)
+    return candidate_rank >= required_rank

package/hooks/blocking/config/test_code_review_enforcement_constants.py

@@ -0,0 +1,108 @@
+"""Behavioral tests for the code-review enforcement constants and comparator.
+
+These exercise ``effort_meets_threshold`` against the ordered effort tokens and
+assert the push and pull-request thresholds carry the push-based names the gate
+family reads, so a rename that reintroduces commit terminology fails loudly.
+"""
+
+import importlib.util
+import pathlib
+import re
+
+_CONFIG_DIR = pathlib.Path(__file__).parent
+
+SAMPLE_ROOT_KEY_HEX_LENGTH = 16
+
+_constants_spec = importlib.util.spec_from_file_location(
+    "code_review_enforcement_constants",
+    _CONFIG_DIR / "code_review_enforcement_constants.py",
+)
+assert _constants_spec is not None
+assert _constants_spec.loader is not None
+_constants_module = importlib.util.module_from_spec(_constants_spec)
+_constants_spec.loader.exec_module(_constants_module)
+
+effort_meets_threshold = _constants_module.effort_meets_threshold
+PUSH_REQUIRED_EFFORT = _constants_module.PUSH_REQUIRED_EFFORT
+PR_CREATE_REQUIRED_EFFORT = _constants_module.PR_CREATE_REQUIRED_EFFORT
+GATED_PUSH_SUBCOMMANDS = _constants_module.GATED_PUSH_SUBCOMMANDS
+ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER = _constants_module.ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER
+PUSH_GATE_CORRECTIVE_MESSAGE = _constants_module.PUSH_GATE_CORRECTIVE_MESSAGE
+SANCTIONED_STAMP_MINTER_FLAG = _constants_module.SANCTIONED_STAMP_MINTER_FLAG
+STAMP_DIRECTORY_GUARD_MESSAGE = _constants_module.STAMP_DIRECTORY_GUARD_MESSAGE
+STAMP_DIRECTORY_NAME = _constants_module.STAMP_DIRECTORY_NAME
+GH_PR_CREATE_INVOCATION_PATTERN = _constants_module.GH_PR_CREATE_INVOCATION_PATTERN
+STAMP_FILE_REFERENCE_BOUNDARY_PREFIX_PATTERN = (
+    _constants_module.STAMP_FILE_REFERENCE_BOUNDARY_PREFIX_PATTERN
+)
+STAMP_FILE_ROOT_KEY_JSON_SUFFIX_PATTERN = _constants_module.STAMP_FILE_ROOT_KEY_JSON_SUFFIX_PATTERN
+
+
+def test_gh_pr_create_pattern_matches_create_but_not_edit() -> None:
+    invocation_pattern = re.compile(GH_PR_CREATE_INVOCATION_PATTERN, re.IGNORECASE)
+    assert invocation_pattern.search("gh pr create --title T --body-file b.md") is not None
+    assert invocation_pattern.search("gh pr edit 1 --title T") is None
+
+
+def test_stamp_file_pattern_fragments_match_a_stamp_file_reference() -> None:
+    stamp_file_pattern = re.compile(
+        STAMP_FILE_REFERENCE_BOUNDARY_PREFIX_PATTERN
+        + re.escape(STAMP_DIRECTORY_NAME)
+        + STAMP_FILE_ROOT_KEY_JSON_SUFFIX_PATTERN % SAMPLE_ROOT_KEY_HEX_LENGTH,
+        re.IGNORECASE,
+    )
+    stamp_file_reference = f"cat {STAMP_DIRECTORY_NAME}/{'a' * SAMPLE_ROOT_KEY_HEX_LENGTH}.json"
+    assert stamp_file_pattern.search(stamp_file_reference) is not None
+    assert stamp_file_pattern.search("cat notes.json") is None
+
+
+def test_higher_effort_meets_a_lower_threshold() -> None:
+    assert effort_meets_threshold("xhigh", "low") is True
+
+
+def test_lower_effort_fails_a_higher_threshold() -> None:
+    assert effort_meets_threshold("low", "xhigh") is False
+
+
+def test_equal_effort_meets_the_threshold() -> None:
+    assert effort_meets_threshold("low", "low") is True
+
+
+def test_ultra_is_unranked_and_meets_nothing() -> None:
+    assert effort_meets_threshold("ultra", "low") is False
+
+
+def test_unknown_required_effort_meets_nothing() -> None:
+    assert effort_meets_threshold("low", "ultra") is False
+
+
+def test_push_requires_the_lowest_effort_token() -> None:
+    every_token_meets_push = all(
+        effort_meets_threshold(each_token, PUSH_REQUIRED_EFFORT)
+        for each_token in ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER
+    )
+    assert every_token_meets_push
+
+
+def test_pr_create_threshold_admits_xhigh_but_rejects_high() -> None:
+    assert effort_meets_threshold("xhigh", PR_CREATE_REQUIRED_EFFORT) is True
+    assert effort_meets_threshold("high", PR_CREATE_REQUIRED_EFFORT) is False
+
+
+def test_gated_push_subcommands_gates_push_not_commit() -> None:
+    assert "push" in GATED_PUSH_SUBCOMMANDS
+    assert "commit" not in GATED_PUSH_SUBCOMMANDS
+
+
+def test_ultra_absent_from_the_ordered_tokens() -> None:
+    assert "ultra" not in ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER
+
+
+def test_push_gate_message_names_the_push_action_and_low_effort() -> None:
+    assert "git push" in PUSH_GATE_CORRECTIVE_MESSAGE
+    assert "CODE_REVIEW_PUSH_GATE" in PUSH_GATE_CORRECTIVE_MESSAGE
+    assert "'low'" in PUSH_GATE_CORRECTIVE_MESSAGE
+
+
+def test_guard_message_directs_users_to_the_sanctioned_minter_flag() -> None:
+    assert SANCTIONED_STAMP_MINTER_FLAG in STAMP_DIRECTORY_GUARD_MESSAGE

package/hooks/blocking/config/verified_commit_constants.py

@@ -137,19 +137,23 @@ VERDICT_DIRECTORY_GUARD_MESSAGE = (
 )
 CORRECTIVE_MESSAGE = (
     "BLOCKED: [VERIFIED_COMMIT_GATE] This branch surface has no passing "
-    "verification verdict. Spawn the code-verifier agent (Agent tool, "
+    "verification verdict. Clear commit-committability gates first "
+    "(CODE_RULES on changed lines and merge conflicts vs base — the "
+    "code_verifier_spawn_preflight_gate enforces these on the spawn). If a "
+    "prior commit failed on CODE_RULES or staging, fix those before "
+    "re-verifying. Then spawn the code-verifier agent (Agent or Task tool, "
     "subagent_type 'code-verifier') with the task texts, the diff scope, "
     "and recorded baselines; when it finishes with a clean verdict the "
     "SubagentStop hook mints the verdict and this command will pass. Any "
     "file change after verification invalidates the verdict, so verify "
-    "last. The verdict binds to the exact surface content (every changed "
-    "and untracked file's bytes), not to a work-tree path, so a commit "
-    "from a different work tree passes only when its surface is "
-    "byte-identical; a work tree carrying any extra or later edit has a "
-    "surface no verdict covers. To land this change, run this command "
-    "from the work tree that holds the verified surface, or verify this "
-    "surface here. Exempt automatically: docs/image files, pytest test "
-    "files, and "
+    "last only after commit gates are green. The verdict binds to the exact "
+    "surface content (every changed and untracked file's bytes), not to a "
+    "work-tree path, so a commit from a different work tree passes only "
+    "when its surface is byte-identical; a work tree carrying any extra or "
+    "later edit has a surface no verdict covers. To land this change, run "
+    "this command from the work tree that holds the verified surface, or "
+    "verify this surface here. Exempt automatically: docs/image files, "
+    "pytest test files, and "
     "Python files whose docstring- and comment-stripped AST is unchanged "
     "(comment-only edits in non-Python files are not exempt)."
 )

package/hooks/blocking/conftest.py

@@ -26,6 +26,8 @@ _MIRRORED_BLOCKING_FILE_NAMES = (
     "verifier_verdict_minter.py",
     "verdict_directory_write_blocker.py",
     "verified_commit_config_bootstrap.py",
+    "code_review_enforcement_config_bootstrap.py",
+    "code_review_stamp_store.py",
 )
 _DECOY_CONFIG_INIT_SOURCE = '"""Foreign config package that must never win resolution."""\n'
 _DECOY_CONFIG_CONSTANTS_SOURCE = (

package/hooks/blocking/convergence_gate_blocker.py

@@ -18,11 +18,19 @@ _hooks_dir = str(Path(__file__).resolve().parent.parent)
 if _hooks_dir not in sys.path:
     sys.path.insert(0, _hooks_dir)
 
+from blocking.pr_description_pr_number import (  # noqa: E402
+    _extract_pr_number_from_command,
+)
 from hooks_constants.convergence_gate_blocker_constants import (  # noqa: E402
+    ALL_GH_PR_VIEW_NUMBER_COMMAND,
+    BASH_LINE_CONTINUATION_PATTERN,
     COMMAND_SEPARATOR_PATTERN,
     GH_PR_READY_ANCHOR_PATTERN,
+    GH_REPO_FLAG,
+    GIT_URL_SUFFIX,
     PR_URL_OWNER_REPO_NUMBER_PATTERN,
     REPO_OVERRIDE_FLAG_PATTERN,
+    REPO_SLUG_TEMPLATE,
 )
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
 
@@ -36,12 +44,15 @@ def _ready_command_segment(command: str) -> str:
         ^^^^^^^^^^^^^^^^                            clipped -> returned segment
 
     Scanning only this segment keeps a ``--repo`` flag or PR URL that belongs to
-    a chained command from binding the gate to the wrong PR.
+    a chained command from binding the gate to the wrong PR. A backslash-newline
+    continuation is folded to a space before the separator search, so a
+    ``--repo`` flag written on a continued line stays inside the segment.
     """
     ready_match = re.search(GH_PR_READY_ANCHOR_PATTERN, command)
     if ready_match is None:
         return command
     ready_tail = command[ready_match.start() :]
+    ready_tail = re.sub(BASH_LINE_CONTINUATION_PATTERN, " ", ready_tail)
     separator_match = re.search(COMMAND_SEPARATOR_PATTERN, ready_tail)
     if separator_match is None:
         return ready_tail
@@ -61,30 +72,59 @@ def _parse_repo_flag(command: str) -> tuple[str, str] | None:
     flag_match = re.search(REPO_OVERRIDE_FLAG_PATTERN, command)
     if flag_match is None:
         return None
-    return flag_match.group("owner"), flag_match.group("repo")
+    return flag_match.group("owner"), flag_match.group("repo").removesuffix(GIT_URL_SUFFIX)
+
+
+def _resolve_named_identity(
+    command: str, cwd: str | None
+) -> tuple[tuple[str, str] | None, int] | None:
+    """Resolve the repository the command names and its PR number.
+
+    A full PR URL yields both the (owner, repo) pair and the number. A
+    ``--repo``/``-R`` flag yields the pair while the number resolves from the
+    command's positional argument or the named repository's current-branch PR.
+    With neither present, the pair is None — leaving gh bound to the current
+    directory's repository — and the number resolves the same way. Every parse
+    runs over the ``gh pr ready`` segment alone, clipped at the next command
+    separator, so a flag or URL belonging to a chained command cannot bind the
+    gate to the wrong PR.
+
+    Args:
+        command: The raw shell command captured by the hook.
+        cwd: The working directory gh runs in when the number resolves from the
+            current branch, or None for the process default.
+
+    Returns:
+        The (owner, repo) pair the command names — None when it names none —
+        paired with the resolved PR number, or None when no number resolves.
+    """
+    ready_segment = _ready_command_segment(command)
+    pr_url_identity = _parse_pr_url(ready_segment)
+    if pr_url_identity is not None:
+        url_owner, url_repo, url_number = pr_url_identity
+        return (url_owner, url_repo), url_number
+    all_target_repo = _parse_repo_flag(ready_segment)
+    from_owner, from_repo = all_target_repo if all_target_repo is not None else (None, None)
+    resolved_pr_number = _resolve_pr_number(ready_segment, cwd, from_owner, from_repo)
+    if resolved_pr_number is None:
+        return None
+    return all_target_repo, resolved_pr_number
 
 
 def _resolve_target_identity(command: str, cwd: str | None) -> tuple[str, str, int] | None:
     """Resolve the (owner, repo, pr_number) the gate keys its evidence to.
 
-    A full PR URL in the command yields all three. A --repo/-R flag yields
-    the repository while the PR number resolves from the command number or
-    the cwd. With neither present, both the repository and the number
-    resolve from the cwd.
+    Delegates the repository-and-number resolution to the shared core, then
+    falls back to the cwd repository for the number when the command names no
+    repository of its own.
     """
-    ready_segment = _ready_command_segment(command)
-    pr_url_identity = _parse_pr_url(ready_segment)
-    if pr_url_identity is not None:
-        return pr_url_identity
-
-    pr_number = _resolve_pr_number(ready_segment, cwd)
-    if pr_number is None:
+    named_identity = _resolve_named_identity(command, cwd)
+    if named_identity is None:
         return None
-
-    repo_flag_identity = _parse_repo_flag(ready_segment)
-    if repo_flag_identity is not None:
-        flag_owner, flag_repo = repo_flag_identity
-        return flag_owner, flag_repo, pr_number
+    all_target_repo, pr_number = named_identity
+    if all_target_repo is not None:
+        owner, repo = all_target_repo
+        return owner, repo, pr_number
 
     cwd_identity = _resolve_owner_repo(cwd)
     if cwd_identity is None:
@@ -93,13 +133,46 @@ def _resolve_target_identity(command: str, cwd: str | None) -> tuple[str, str, i
     return cwd_owner, cwd_repo, pr_number
 
 
-def _resolve_pr_number(command: str, cwd: str | None) -> int | None:
-    direct_match = re.search(r"\bgh\s+pr\s+ready\s+(\d+)", command)
-    if direct_match:
-        return int(direct_match.group(1))
+def _repo_flag_arguments(all_target_repo: tuple[str, str] | None) -> list[str]:
+    """Build the ``--repo owner/repo`` arguments for a gh subcommand.
+
+    Args:
+        all_target_repo: The (owner, repo) pair the command names, or None when
+            the command names no repository.
+
+    Returns:
+        A ``[--repo, owner/repo]`` argument pair when a repository is named, or
+        an empty list when it is None — leaving gh bound to the current
+        directory's repository.
+    """
+    if all_target_repo is None:
+        return []
+    owner, repo = all_target_repo
+    return [GH_REPO_FLAG, REPO_SLUG_TEMPLATE.format(owner=owner, repo=repo)]
+
+
+def _resolve_current_branch_pr_number(
+    all_target_repo: tuple[str, str] | None, cwd: str | None
+) -> int | None:
+    """Resolve the current-branch PR number through ``gh pr view``.
+
+    Args:
+        all_target_repo: The (owner, repo) pair the command names, or None to
+            read the current directory's repository.
+        cwd: The working directory gh runs in, or None for the process default.
+
+    Returns:
+        The PR number gh reports, or None when gh is missing, exits non-zero,
+        or prints no integer — every failure path returns None so the caller
+        fails open.
+    """
+    all_view_arguments = [
+        *ALL_GH_PR_VIEW_NUMBER_COMMAND,
+        *_repo_flag_arguments(all_target_repo),
+    ]
     try:
         completed_process = subprocess.run(
-            ["gh", "pr", "view", "--json", "number", "--jq", ".number"],
+            all_view_arguments,
             capture_output=True,
             text=True,
             cwd=cwd or None,
@@ -115,6 +188,22 @@ def _resolve_pr_number(command: str, cwd: str | None) -> int | None:
         return None
 
 
+def _resolve_pr_number(
+    command: str,
+    cwd: str | None,
+    from_owner: str | None,
+    from_repo: str | None,
+) -> int | None:
+    direct_number = _extract_pr_number_from_command(command)
+    if direct_number is not None:
+        return direct_number
+    if from_owner is not None and from_repo is not None:
+        all_target_repo: tuple[str, str] | None = (from_owner, from_repo)
+    else:
+        all_target_repo = None
+    return _resolve_current_branch_pr_number(all_target_repo, cwd)
+
+
 def _resolve_owner_repo(cwd: str | None) -> tuple[str, str] | None:
     try:
         completed_process = subprocess.run(

package/hooks/blocking/destructive_command_blocker.py

@@ -24,6 +24,8 @@ from hooks_constants.destructive_command_segment_constants import (  # noqa: E40
     ALL_BENIGN_COMPOUND_SEGMENT_COMMANDS,
     ALL_COMMAND_LAUNCHER_WRAPPER_COMMANDS,
     ALL_KNOWN_TEMPORARY_ENVIRONMENT_VARIABLE_NAMES,
+    ALL_TRUTHY_ENV_VALUES,
+    DESTRUCTIVE_DENY_MODE_ENV_VAR,
     ALL_FILE_WRITING_OUTPUT_FLAGS_BY_BENIGN_PROGRAM,
     ALL_FIND_EXEC_ACTION_FLAGS,
     ALL_FIND_EXEC_ACTION_TERMINATORS,
@@ -56,12 +58,17 @@ from hooks_constants.destructive_command_segment_constants import (  # noqa: E40
 
 CLAUDE_DIRECTORY_PATH = os.path.normpath(os.path.expanduser("~/.claude"))
 GH_REDIRECT_ACTIVE_ENV_VAR = "CLAUDE_GH_REDIRECT_ACTIVE"
-GH_REDIRECT_ACTIVE_TRUTHY_VALUES = frozenset({"1", "true", "yes", "on"})
 
 
 def gh_redirect_is_active() -> bool:
     env_var_value = os.environ.get(GH_REDIRECT_ACTIVE_ENV_VAR, "").strip().lower()
-    return env_var_value in GH_REDIRECT_ACTIVE_TRUTHY_VALUES
+    return env_var_value in ALL_TRUTHY_ENV_VALUES
+
+
+def deny_mode_is_active() -> bool:
+    env_var_value = os.environ.get(DESTRUCTIVE_DENY_MODE_ENV_VAR, "").strip().lower()
+    return env_var_value in ALL_TRUTHY_ENV_VALUES
+
 
 def directory_is_ephemeral(directory_path: str) -> bool:
     """Return True when a directory belongs to the ephemeral auto-allow namespace.
@@ -2043,14 +2050,20 @@ def main() -> None:
         matched_description = co_resident_hazard_description
 
     if matched_description is not None:
-        ask_response = {
+        if deny_mode_is_active():
+            terminal_decision = "deny"
+            terminal_reason = f"DESTRUCTIVE: {matched_description}. Blocked in deny mode."
+        else:
+            terminal_decision = "ask"
+            terminal_reason = f"DESTRUCTIVE: {matched_description}. Requires explicit user approval."
+        terminal_response = {
             "hookSpecificOutput": {
                 "hookEventName": "PreToolUse",
-                "permissionDecision": "ask",
-                "permissionDecisionReason": f"DESTRUCTIVE: {matched_description}. Requires explicit user approval."
+                "permissionDecision": terminal_decision,
+                "permissionDecisionReason": terminal_reason
             }
         }
-        print(json.dumps(ask_response))
+        print(json.dumps(terminal_response))
 
     sys.exit(0)