claude-dev-env 2.3.0 → 2.5.0

package/hooks/blocking/config/verified_commit_constants.py

@@ -1,155 +1,160 @@
-"""Constants for the verified-commit gate hook family.
-
-Shared by ``verification_verdict_store.py``, ``verified_commit_gate.py``,
-and ``verifier_verdict_minter.py`` so every tunable lives in one place.
-"""
-
-from __future__ import annotations
-
-GIT_TIMEOUT_SECONDS = 30
-ROOT_KEY_HEX_LENGTH = 16
-VERDICT_JSON_INDENT = 2
-CLAUDE_HOME_DIRECTORY_NAME = ".claude"
-VERDICT_DIRECTORY_NAME = "verification"
-VERDICT_DIRECTORY_NAME_SEPARATOR_PATTERN = r"['\"\\/,\s]+"
-VERDICT_DIRECTORY_PATH_BOUNDARY_PATTERN = r"(?=['\"]*[\\/,])"
-RELATIVE_VERDICT_DIRECTORY_PATTERN = r"(?:^|(?<=[\s;&|(='\"]))verification[\\/]"
-VERDICT_PATH_GLUE_PATTERN = r"['\"+\\/\s]*[\\/]['\"+\\/\s]*"
-VERDICT_DIRECTORY_CHANGE_TARGET_PATTERN = r"[ \t]+['\"]?verification[\\/]?['\"]?(?=[\s;&|]|$)"
-VERDICT_PATH_JOINED_VARIABLE_PATTERN = r"\$\{?(\w+)\}?[\\/]|[\\/]\$\{?(\w+)\}?"
-VERDICT_PATH_VARIABLE_ASSIGNMENT_PATTERN = r"(?:^|(?<=[\s;&|(]))%s=(\S+)"
-VERDICT_FILE_RELATIVE_REFERENCE_PATTERN = (
-    rf"(?:^|(?<=[\s;&|(='\"\\/]))verification[\\/][0-9a-f]{{{ROOT_KEY_HEX_LENGTH}}}\.json"
-)
-PATH_OBFUSCATION_PRIMITIVE_PATTERN = (
-    r"chr\s*\(|bytes\.fromhex\s*\(|b64decode\s*\(|codecs\.decode\s*\("
-    r"|(?:bytes|bytearray)\s*\(\s*\[|\[char\[?\]?\]"
-)
-ALL_VERDICT_PATH_SEGMENT_NAMES = (".claude", "verification")
-ALL_VERDICT_PATH_SEGMENT_BODIES = ("claude", "verification")
-HEX_TOKEN_PATTERN = r"(?<![0-9a-fx])([0-9a-f]{6,})(?![0-9a-f])"
-BASE64_TOKEN_PATTERN = r"[A-Za-z0-9+/]{8,}={0,2}"
-CHARACTER_CODE_SEQUENCE_PATTERN = r"\d{1,3}(?:\s*,\s*\d{1,3})+"
-CHR_CALL_CHAIN_PATTERN = r"chr\(\s*\d{1,3}\s*\)(?:\s*\+\s*chr\(\s*\d{1,3}\s*\))+"
-CHR_CALL_CODE_PATTERN = r"chr\(\s*(\d{1,3})\s*\)"
-HEX_DIGITS_PER_BYTE = 2
-FILE_WRITE_PRIMITIVE_PATTERN = (
-    r"\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
-    r"|Out-File|Set-Content|Add-Content|\btee\b|>"
-)
-NON_REDIRECT_FILE_WRITE_PRIMITIVE_PATTERN = (
-    r"\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
-    r"|Out-File|Set-Content|Add-Content|\btee\b"
-)
-WRITE_CALL_REGION_PATTERN = (
-    r"(?:\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
-    r"|Out-File|Set-Content|Add-Content|\btee\b)[^;&|\n]*"
-)
-VERDICT_KEY_ALL_PASS = "all_pass"
-VERDICT_KEY_MANIFEST_SHA256 = "manifest_sha256"
-VERDICT_KEY_FINDINGS = "findings"
-VERDICT_FINDING_CHECK_KEY = "check"
-LOGS_DIRECTORY_NAME = "logs"
-VERIFIER_VERDICTS_JSONL_FILENAME = "verifier-verdicts.jsonl"
-LEDGER_KEY_TIMESTAMP = "timestamp"
-LEDGER_KEY_REPO_ROOT = "repo_root"
-LEDGER_KEY_BRANCH = "branch"
-LEDGER_KEY_MANIFEST_HASH = "manifest_hash"
-LEDGER_KEY_ALL_PASS = "all_pass"
-LEDGER_KEY_FINDING_COUNT = "finding_count"
-LEDGER_KEY_FINDING_CHECK_NAMES = "finding_check_names"
-LEDGER_KEY_MINTED_FROM_AGENT_ID = "minted_from_agent_id"
-VERDICT_FILE_GLOB = "*.json"
-SUBAGENTS_DIRECTORY_NAME = "subagents"
-AGENT_TRANSCRIPT_GLOB = "agent-*.jsonl"
-AGENT_META_SIDECAR_SUFFIX = ".meta.json"
-AGENT_META_TYPE_KEY = "agentType"
-TRANSCRIPT_ENTRY_TYPE_KEY = "type"
-TRANSCRIPT_ASSISTANT_ENTRY_TYPE = "assistant"
-TRANSCRIPT_MESSAGE_KEY = "message"
-TRANSCRIPT_CONTENT_KEY = "content"
-TRANSCRIPT_CONTENT_TYPE_KEY = "type"
-TRANSCRIPT_TEXT_CONTENT_TYPE = "text"
-TRANSCRIPT_TEXT_KEY = "text"
-VERDICT_FENCE_PATTERN = r"```verdict\s*\n(.*?)```"
-MANIFEST_HASH_CLI_FLAG = "--manifest-hash"
-MANIFEST_HASH_FOR_BRANCH_CLI_FLAG = "--manifest-hash-for-branch"
-WORKTREE_LIST_PATH_PREFIX = "worktree "
-WORKTREE_LIST_BRANCH_PREFIX = "branch "
-BRANCH_REFERENCE_PREFIX = "refs/heads/"
-EMPTY_SURFACE_GUARD_MESSAGE = (
-    "ERROR: The work tree at {repo_root} has no changed or untracked files "
-    "versus origin/main (empty change surface). This work tree holds nothing "
-    "to verify — you are pointed at the wrong work tree. Run `git worktree list` "
-    "to see all checked-out work trees and target the one on the branch under review."
-)
-BRANCH_WORKTREE_ABSENT_MESSAGE = (
-    "ERROR: No work tree has branch '{branch}' checked out. "
-    "Check it out in a work tree first: "
-    "`git worktree add <path> <branch>` or `git checkout <branch>`."
-)
-DOCS_ONLY_EXTENSIONS = frozenset(
-    {".md", ".txt", ".rst", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp", ".ico"}
-)
-PYTHON_EXTENSION = ".py"
-TEST_FILE_PREFIX = "test_"
-TEST_FILE_SUFFIX = "_test.py"
-CONFTEST_FILE_NAME = "conftest.py"
-MINIMUM_STATUS_FIELD_COUNT = 2
-ALL_FALLBACK_BASE_REFERENCES = ("origin/main", "origin/master")
-DETACHED_HEAD_LABEL = "HEAD"
-BRANCH_REMOTE_CONFIG_KEY_TEMPLATE = "branch.{branch_name}.remote"
-ALL_TOOLING_STATE_PREFIXES = (
-    ".claude/verification/",
-    ".claude/worktrees/",
-    ".claude/daemon/",
-    ".claude/teams/",
-    ".claude/sessions/",
-    ".cursor/worktrees/",
-)
-GATED_GIT_SUBCOMMANDS = frozenset({"commit", "push"})
-ALL_GIT_BINARY_NAMES = frozenset({"git", "git.exe"})
-VALUE_TAKING_GIT_OPTIONS = frozenset({"-C", "-c", "--git-dir", "--work-tree", "--namespace"})
-REPO_DIRECTORY_OPTION = "-C"
-WORK_TREE_OPTION = "--work-tree"
-DIRECTORY_CHANGE_VERBS = frozenset({"cd", "pushd", "set-location", "sl"})
-DIRECTORY_CHANGE_PATH_OPTIONS = frozenset({"-path", "-literalpath"})
-DIRECTORY_CHANGE_OPTION_TERMINATOR = "--"
-DIRECTORY_CHANGE_PATTERN_PREFIX = r"(?:^|(?<=[\s;&|(]))(?:"
-DIRECTORY_CHANGE_PATTERN_SUFFIX = r")(?=\s|$)"
-DIRECTORY_CHANGE_OPTION_PREFIX_PATTERN = r"(?:[ \t]+(?:%s)(?=\s|$))*"
-DIRECTORY_CHANGE_TARGET_PATTERN = r"[ \t]+['\"]?\S*"
-CLAUDE_HOME_TARGET_BOUNDARY_PATTERN = r"[\\/]?['\"]?(?=[\s;&|]|$)"
-VERDICT_DIRECTORY_TARGET_BOUNDARY_PATTERN = r"[\\/]?['\"]?(?=[\s;&|]|$)"
-COMMAND_AFTER_DIRECTORY_CHANGE_PATTERN = r"[;&|\n][\s]*\S"
-OPTION_WITH_VALUE_STEP = 2
-ALL_GATED_TOOL_NAMES = ("Bash", "PowerShell")
-HASH_PREVIEW_LENGTH = 16
-VERIFICATION_BYPASS_MARKER = "# verify-skip"
-MINTING_AGENT_TYPE = "code-verifier"
-VERDICT_DIRECTORY_GUARD_MESSAGE = (
-    "BLOCKED: [VERDICT_DIRECTORY_GUARD] Shell access to the verification "
-    "verdict directory (~/.claude/verification/) is denied. Only the "
-    "verifier_verdict_minter.py SubagentStop hook writes verdict files; a "
-    "shell write here would forge a passing verdict and defeat the "
-    "verified-commit gate. Spawn the code-verifier agent to earn a verdict "
-    "instead of writing one."
-)
-CORRECTIVE_MESSAGE = (
-    "BLOCKED: [VERIFIED_COMMIT_GATE] This branch surface has no passing "
-    "verification verdict. Spawn the code-verifier agent (Agent tool, "
-    "subagent_type 'code-verifier') with the task texts, the diff scope, "
-    "and recorded baselines; when it finishes with a clean verdict the "
-    "SubagentStop hook mints the verdict and this command will pass. Any "
-    "file change after verification invalidates the verdict, so verify "
-    "last. The verdict binds to the exact surface content (every changed "
-    "and untracked file's bytes), not to a work-tree path, so a commit "
-    "from a different work tree passes only when its surface is "
-    "byte-identical; a work tree carrying any extra or later edit has a "
-    "surface no verdict covers. To land this change, run this command "
-    "from the work tree that holds the verified surface, or verify this "
-    "surface here. Exempt automatically: docs/image files, pytest test "
-    "files, and "
-    "Python files whose docstring- and comment-stripped AST is unchanged "
-    "(comment-only edits in non-Python files are not exempt)."
-)
+"""Constants for the verified-commit gate hook family.
+
+Shared by ``verification_verdict_store.py``, ``verified_commit_gate.py``,
+and ``verifier_verdict_minter.py`` so every tunable lives in one place.
+"""
+
+from __future__ import annotations
+
+GIT_TIMEOUT_SECONDS = 30
+ROOT_KEY_HEX_LENGTH = 16
+VERDICT_JSON_INDENT = 2
+CLAUDE_HOME_DIRECTORY_NAME = ".claude"
+VERDICT_DIRECTORY_NAME = "verification"
+VERDICT_DIRECTORY_NAME_SEPARATOR_PATTERN = r"['\"\\/,\s]+"
+VERDICT_DIRECTORY_PATH_BOUNDARY_PATTERN = r"(?=['\"]*[\\/,])"
+RELATIVE_VERDICT_DIRECTORY_PATTERN = r"(?:^|(?<=[\s;&|(='\"]))verification[\\/]"
+VERDICT_PATH_GLUE_PATTERN = r"['\"+\\/\s]*[\\/]['\"+\\/\s]*"
+VERDICT_DIRECTORY_CHANGE_TARGET_PATTERN = r"[ \t]+['\"]?verification[\\/]?['\"]?(?=[\s;&|]|$)"
+VERDICT_PATH_JOINED_VARIABLE_PATTERN = r"\$\{?(\w+)\}?[\\/]|[\\/]\$\{?(\w+)\}?"
+VERDICT_PATH_VARIABLE_ASSIGNMENT_PATTERN = r"(?:^|(?<=[\s;&|(]))%s=(\S+)"
+VERDICT_FILE_RELATIVE_REFERENCE_PATTERN = (
+    rf"(?:^|(?<=[\s;&|(='\"\\/]))verification[\\/][0-9a-f]{{{ROOT_KEY_HEX_LENGTH}}}\.json"
+)
+PATH_OBFUSCATION_PRIMITIVE_PATTERN = (
+    r"chr\s*\(|bytes\.fromhex\s*\(|b64decode\s*\(|codecs\.decode\s*\("
+    r"|(?:bytes|bytearray)\s*\(\s*\[|\[char\[?\]?\]"
+)
+ALL_VERDICT_PATH_SEGMENT_NAMES = (".claude", "verification")
+ALL_VERDICT_PATH_SEGMENT_BODIES = ("claude", "verification")
+HEX_TOKEN_PATTERN = r"(?<![0-9a-fx])([0-9a-f]{6,})(?![0-9a-f])"
+BASE64_TOKEN_PATTERN = r"[A-Za-z0-9+/]{8,}={0,2}"
+CHARACTER_CODE_SEQUENCE_PATTERN = r"\d{1,3}(?:\s*,\s*\d{1,3})+"
+CHR_CALL_CHAIN_PATTERN = r"chr\(\s*\d{1,3}\s*\)(?:\s*\+\s*chr\(\s*\d{1,3}\s*\))+"
+CHR_CALL_CODE_PATTERN = r"chr\(\s*(\d{1,3})\s*\)"
+HEX_DIGITS_PER_BYTE = 2
+FILE_WRITE_PRIMITIVE_PATTERN = (
+    r"\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
+    r"|Out-File|Set-Content|Add-Content|\btee\b|>"
+)
+NON_REDIRECT_FILE_WRITE_PRIMITIVE_PATTERN = (
+    r"\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
+    r"|Out-File|Set-Content|Add-Content|\btee\b"
+)
+WRITE_CALL_REGION_PATTERN = (
+    r"(?:\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
+    r"|Out-File|Set-Content|Add-Content|\btee\b)[^;&|\n]*"
+)
+VERDICT_KEY_ALL_PASS = "all_pass"
+VERDICT_KEY_MANIFEST_SHA256 = "manifest_sha256"
+VERDICT_KEY_FINDINGS = "findings"
+VERDICT_FINDING_CHECK_KEY = "check"
+LOGS_DIRECTORY_NAME = "logs"
+VERIFIER_VERDICTS_JSONL_FILENAME = "verifier-verdicts.jsonl"
+LEDGER_KEY_TIMESTAMP = "timestamp"
+LEDGER_KEY_REPO_ROOT = "repo_root"
+LEDGER_KEY_BRANCH = "branch"
+LEDGER_KEY_MANIFEST_HASH = "manifest_hash"
+LEDGER_KEY_ALL_PASS = "all_pass"
+LEDGER_KEY_FINDING_COUNT = "finding_count"
+LEDGER_KEY_FINDING_CHECK_NAMES = "finding_check_names"
+LEDGER_KEY_MINTED_FROM_AGENT_ID = "minted_from_agent_id"
+VERDICT_FILE_GLOB = "*.json"
+SUBAGENTS_DIRECTORY_NAME = "subagents"
+AGENT_TRANSCRIPT_GLOB = "agent-*.jsonl"
+AGENT_META_SIDECAR_SUFFIX = ".meta.json"
+AGENT_META_TYPE_KEY = "agentType"
+TRANSCRIPT_ENTRY_TYPE_KEY = "type"
+TRANSCRIPT_ASSISTANT_ENTRY_TYPE = "assistant"
+TRANSCRIPT_MESSAGE_KEY = "message"
+TRANSCRIPT_CONTENT_KEY = "content"
+TRANSCRIPT_CONTENT_TYPE_KEY = "type"
+TRANSCRIPT_TEXT_CONTENT_TYPE = "text"
+TRANSCRIPT_TEXT_KEY = "text"
+VERDICT_FENCE_PATTERN = r"```verdict\s*\n(.*?)```"
+MANIFEST_HASH_CLI_FLAG = "--manifest-hash"
+MANIFEST_HASH_FOR_BRANCH_CLI_FLAG = "--manifest-hash-for-branch"
+WORKTREE_LIST_PATH_PREFIX = "worktree "
+WORKTREE_LIST_BRANCH_PREFIX = "branch "
+BRANCH_REFERENCE_PREFIX = "refs/heads/"
+EMPTY_SURFACE_GUARD_MESSAGE = (
+    "ERROR: The work tree at {repo_root} has no changed or untracked files "
+    "versus origin/main (empty change surface). This work tree holds nothing "
+    "to verify — you are pointed at the wrong work tree. Run `git worktree list` "
+    "to see all checked-out work trees and target the one on the branch under review."
+)
+BRANCH_WORKTREE_ABSENT_MESSAGE = (
+    "ERROR: No work tree has branch '{branch}' checked out. "
+    "Check it out in a work tree first: "
+    "`git worktree add <path> <branch>` or `git checkout <branch>`."
+)
+DOCS_ONLY_EXTENSIONS = frozenset(
+    {".md", ".txt", ".rst", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp", ".ico"}
+)
+PYTHON_EXTENSION = ".py"
+TEST_FILE_PREFIX = "test_"
+TEST_FILE_SUFFIX = "_test.py"
+CONFTEST_FILE_NAME = "conftest.py"
+MINIMUM_STATUS_FIELD_COUNT = 2
+ALL_FALLBACK_BASE_REFERENCES = ("origin/main", "origin/master")
+DETACHED_HEAD_LABEL = "HEAD"
+BRANCH_REMOTE_CONFIG_KEY_TEMPLATE = "branch.{branch_name}.remote"
+ALL_TOOLING_STATE_PREFIXES = (
+    ".claude/verification/",
+    ".claude/worktrees/",
+    ".claude/daemon/",
+    ".claude/teams/",
+    ".claude/sessions/",
+    ".cursor/worktrees/",
+    ".claude-plugin-data/",
+)
+GATED_GIT_SUBCOMMANDS = frozenset({"commit", "push"})
+ALL_GIT_BINARY_NAMES = frozenset({"git", "git.exe"})
+VALUE_TAKING_GIT_OPTIONS = frozenset({"-C", "-c", "--git-dir", "--work-tree", "--namespace"})
+REPO_DIRECTORY_OPTION = "-C"
+WORK_TREE_OPTION = "--work-tree"
+DIRECTORY_CHANGE_VERBS = frozenset({"cd", "pushd", "set-location", "sl"})
+DIRECTORY_CHANGE_PATH_OPTIONS = frozenset({"-path", "-literalpath"})
+DIRECTORY_CHANGE_OPTION_TERMINATOR = "--"
+DIRECTORY_CHANGE_PATTERN_PREFIX = r"(?:^|(?<=[\s;&|(]))(?:"
+DIRECTORY_CHANGE_PATTERN_SUFFIX = r")(?=\s|$)"
+DIRECTORY_CHANGE_OPTION_PREFIX_PATTERN = r"(?:[ \t]+(?:%s)(?=\s|$))*"
+DIRECTORY_CHANGE_TARGET_PATTERN = r"[ \t]+['\"]?\S*"
+CLAUDE_HOME_TARGET_BOUNDARY_PATTERN = r"[\\/]?['\"]?(?=[\s;&|]|$)"
+VERDICT_DIRECTORY_TARGET_BOUNDARY_PATTERN = r"[\\/]?['\"]?(?=[\s;&|]|$)"
+COMMAND_AFTER_DIRECTORY_CHANGE_PATTERN = r"[;&|\n][\s]*\S"
+OPTION_WITH_VALUE_STEP = 2
+ALL_GATED_TOOL_NAMES = ("Bash", "PowerShell")
+HASH_PREVIEW_LENGTH = 16
+VERIFICATION_BYPASS_MARKER = "# verify-skip"
+MINTING_AGENT_TYPE = "code-verifier"
+VERDICT_DIRECTORY_GUARD_MESSAGE = (
+    "BLOCKED: [VERDICT_DIRECTORY_GUARD] Shell access to the verification "
+    "verdict directory (~/.claude/verification/) is denied. Only the "
+    "verifier_verdict_minter.py SubagentStop hook writes verdict files; a "
+    "shell write here would forge a passing verdict and defeat the "
+    "verified-commit gate. Spawn the code-verifier agent to earn a verdict "
+    "instead of writing one."
+)
+CORRECTIVE_MESSAGE = (
+    "BLOCKED: [VERIFIED_COMMIT_GATE] This branch surface has no passing "
+    "verification verdict. Clear commit-committability gates first "
+    "(CODE_RULES on changed lines and merge conflicts vs base — the "
+    "code_verifier_spawn_preflight_gate enforces these on the spawn). If a "
+    "prior commit failed on CODE_RULES or staging, fix those before "
+    "re-verifying. Then spawn the code-verifier agent (Agent or Task tool, "
+    "subagent_type 'code-verifier') with the task texts, the diff scope, "
+    "and recorded baselines; when it finishes with a clean verdict the "
+    "SubagentStop hook mints the verdict and this command will pass. Any "
+    "file change after verification invalidates the verdict, so verify "
+    "last only after commit gates are green. The verdict binds to the exact "
+    "surface content (every changed and untracked file's bytes), not to a "
+    "work-tree path, so a commit from a different work tree passes only "
+    "when its surface is byte-identical; a work tree carrying any extra or "
+    "later edit has a surface no verdict covers. To land this change, run "
+    "this command from the work tree that holds the verified surface, or "
+    "verify this surface here. Exempt automatically: docs/image files, "
+    "pytest test files, and "
+    "Python files whose docstring- and comment-stripped AST is unchanged "
+    "(comment-only edits in non-Python files are not exempt)."
+)

package/hooks/blocking/conftest.py

@@ -26,6 +26,8 @@ _MIRRORED_BLOCKING_FILE_NAMES = (
     "verifier_verdict_minter.py",
     "verdict_directory_write_blocker.py",
     "verified_commit_config_bootstrap.py",
+    "code_review_enforcement_config_bootstrap.py",
+    "code_review_stamp_store.py",
 )
 _DECOY_CONFIG_INIT_SOURCE = '"""Foreign config package that must never win resolution."""\n'
 _DECOY_CONFIG_CONSTANTS_SOURCE = (

package/hooks/blocking/convergence_gate_blocker.py

@@ -18,11 +18,19 @@ _hooks_dir = str(Path(__file__).resolve().parent.parent)
 if _hooks_dir not in sys.path:
     sys.path.insert(0, _hooks_dir)
 
+from blocking.pr_description_pr_number import (  # noqa: E402
+    _extract_pr_number_from_command,
+)
 from hooks_constants.convergence_gate_blocker_constants import (  # noqa: E402
+    ALL_GH_PR_VIEW_NUMBER_COMMAND,
+    BASH_LINE_CONTINUATION_PATTERN,
     COMMAND_SEPARATOR_PATTERN,
     GH_PR_READY_ANCHOR_PATTERN,
+    GH_REPO_FLAG,
+    GIT_URL_SUFFIX,
     PR_URL_OWNER_REPO_NUMBER_PATTERN,
     REPO_OVERRIDE_FLAG_PATTERN,
+    REPO_SLUG_TEMPLATE,
 )
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
 
@@ -36,12 +44,15 @@ def _ready_command_segment(command: str) -> str:
         ^^^^^^^^^^^^^^^^                            clipped -> returned segment
 
     Scanning only this segment keeps a ``--repo`` flag or PR URL that belongs to
-    a chained command from binding the gate to the wrong PR.
+    a chained command from binding the gate to the wrong PR. A backslash-newline
+    continuation is folded to a space before the separator search, so a
+    ``--repo`` flag written on a continued line stays inside the segment.
     """
     ready_match = re.search(GH_PR_READY_ANCHOR_PATTERN, command)
     if ready_match is None:
         return command
     ready_tail = command[ready_match.start() :]
+    ready_tail = re.sub(BASH_LINE_CONTINUATION_PATTERN, " ", ready_tail)
     separator_match = re.search(COMMAND_SEPARATOR_PATTERN, ready_tail)
     if separator_match is None:
         return ready_tail
@@ -61,30 +72,59 @@ def _parse_repo_flag(command: str) -> tuple[str, str] | None:
     flag_match = re.search(REPO_OVERRIDE_FLAG_PATTERN, command)
     if flag_match is None:
         return None
-    return flag_match.group("owner"), flag_match.group("repo")
+    return flag_match.group("owner"), flag_match.group("repo").removesuffix(GIT_URL_SUFFIX)
+
+
+def _resolve_named_identity(
+    command: str, cwd: str | None
+) -> tuple[tuple[str, str] | None, int] | None:
+    """Resolve the repository the command names and its PR number.
+
+    A full PR URL yields both the (owner, repo) pair and the number. A
+    ``--repo``/``-R`` flag yields the pair while the number resolves from the
+    command's positional argument or the named repository's current-branch PR.
+    With neither present, the pair is None — leaving gh bound to the current
+    directory's repository — and the number resolves the same way. Every parse
+    runs over the ``gh pr ready`` segment alone, clipped at the next command
+    separator, so a flag or URL belonging to a chained command cannot bind the
+    gate to the wrong PR.
+
+    Args:
+        command: The raw shell command captured by the hook.
+        cwd: The working directory gh runs in when the number resolves from the
+            current branch, or None for the process default.
+
+    Returns:
+        The (owner, repo) pair the command names — None when it names none —
+        paired with the resolved PR number, or None when no number resolves.
+    """
+    ready_segment = _ready_command_segment(command)
+    pr_url_identity = _parse_pr_url(ready_segment)
+    if pr_url_identity is not None:
+        url_owner, url_repo, url_number = pr_url_identity
+        return (url_owner, url_repo), url_number
+    all_target_repo = _parse_repo_flag(ready_segment)
+    from_owner, from_repo = all_target_repo if all_target_repo is not None else (None, None)
+    resolved_pr_number = _resolve_pr_number(ready_segment, cwd, from_owner, from_repo)
+    if resolved_pr_number is None:
+        return None
+    return all_target_repo, resolved_pr_number
 
 
 def _resolve_target_identity(command: str, cwd: str | None) -> tuple[str, str, int] | None:
     """Resolve the (owner, repo, pr_number) the gate keys its evidence to.
 
-    A full PR URL in the command yields all three. A --repo/-R flag yields
-    the repository while the PR number resolves from the command number or
-    the cwd. With neither present, both the repository and the number
-    resolve from the cwd.
+    Delegates the repository-and-number resolution to the shared core, then
+    falls back to the cwd repository for the number when the command names no
+    repository of its own.
     """
-    ready_segment = _ready_command_segment(command)
-    pr_url_identity = _parse_pr_url(ready_segment)
-    if pr_url_identity is not None:
-        return pr_url_identity
-
-    pr_number = _resolve_pr_number(ready_segment, cwd)
-    if pr_number is None:
+    named_identity = _resolve_named_identity(command, cwd)
+    if named_identity is None:
         return None
-
-    repo_flag_identity = _parse_repo_flag(ready_segment)
-    if repo_flag_identity is not None:
-        flag_owner, flag_repo = repo_flag_identity
-        return flag_owner, flag_repo, pr_number
+    all_target_repo, pr_number = named_identity
+    if all_target_repo is not None:
+        owner, repo = all_target_repo
+        return owner, repo, pr_number
 
     cwd_identity = _resolve_owner_repo(cwd)
     if cwd_identity is None:
@@ -93,13 +133,46 @@ def _resolve_target_identity(command: str, cwd: str | None) -> tuple[str, str, i
     return cwd_owner, cwd_repo, pr_number
 
 
-def _resolve_pr_number(command: str, cwd: str | None) -> int | None:
-    direct_match = re.search(r"\bgh\s+pr\s+ready\s+(\d+)", command)
-    if direct_match:
-        return int(direct_match.group(1))
+def _repo_flag_arguments(all_target_repo: tuple[str, str] | None) -> list[str]:
+    """Build the ``--repo owner/repo`` arguments for a gh subcommand.
+
+    Args:
+        all_target_repo: The (owner, repo) pair the command names, or None when
+            the command names no repository.
+
+    Returns:
+        A ``[--repo, owner/repo]`` argument pair when a repository is named, or
+        an empty list when it is None — leaving gh bound to the current
+        directory's repository.
+    """
+    if all_target_repo is None:
+        return []
+    owner, repo = all_target_repo
+    return [GH_REPO_FLAG, REPO_SLUG_TEMPLATE.format(owner=owner, repo=repo)]
+
+
+def _resolve_current_branch_pr_number(
+    all_target_repo: tuple[str, str] | None, cwd: str | None
+) -> int | None:
+    """Resolve the current-branch PR number through ``gh pr view``.
+
+    Args:
+        all_target_repo: The (owner, repo) pair the command names, or None to
+            read the current directory's repository.
+        cwd: The working directory gh runs in, or None for the process default.
+
+    Returns:
+        The PR number gh reports, or None when gh is missing, exits non-zero,
+        or prints no integer — every failure path returns None so the caller
+        fails open.
+    """
+    all_view_arguments = [
+        *ALL_GH_PR_VIEW_NUMBER_COMMAND,
+        *_repo_flag_arguments(all_target_repo),
+    ]
     try:
         completed_process = subprocess.run(
-            ["gh", "pr", "view", "--json", "number", "--jq", ".number"],
+            all_view_arguments,
             capture_output=True,
             text=True,
             cwd=cwd or None,
@@ -115,6 +188,22 @@ def _resolve_pr_number(command: str, cwd: str | None) -> int | None:
         return None
 
 
+def _resolve_pr_number(
+    command: str,
+    cwd: str | None,
+    from_owner: str | None,
+    from_repo: str | None,
+) -> int | None:
+    direct_number = _extract_pr_number_from_command(command)
+    if direct_number is not None:
+        return direct_number
+    if from_owner is not None and from_repo is not None:
+        all_target_repo: tuple[str, str] | None = (from_owner, from_repo)
+    else:
+        all_target_repo = None
+    return _resolve_current_branch_pr_number(all_target_repo, cwd)
+
+
 def _resolve_owner_repo(cwd: str | None) -> tuple[str, str] | None:
     try:
         completed_process = subprocess.run(

package/hooks/blocking/destructive_command_blocker.py

@@ -24,6 +24,8 @@ from hooks_constants.destructive_command_segment_constants import (  # noqa: E40
     ALL_BENIGN_COMPOUND_SEGMENT_COMMANDS,
     ALL_COMMAND_LAUNCHER_WRAPPER_COMMANDS,
     ALL_KNOWN_TEMPORARY_ENVIRONMENT_VARIABLE_NAMES,
+    ALL_TRUTHY_ENV_VALUES,
+    DESTRUCTIVE_DENY_MODE_ENV_VAR,
     ALL_FILE_WRITING_OUTPUT_FLAGS_BY_BENIGN_PROGRAM,
     ALL_FIND_EXEC_ACTION_FLAGS,
     ALL_FIND_EXEC_ACTION_TERMINATORS,
@@ -56,12 +58,17 @@ from hooks_constants.destructive_command_segment_constants import (  # noqa: E40
 
 CLAUDE_DIRECTORY_PATH = os.path.normpath(os.path.expanduser("~/.claude"))
 GH_REDIRECT_ACTIVE_ENV_VAR = "CLAUDE_GH_REDIRECT_ACTIVE"
-GH_REDIRECT_ACTIVE_TRUTHY_VALUES = frozenset({"1", "true", "yes", "on"})
 
 
 def gh_redirect_is_active() -> bool:
     env_var_value = os.environ.get(GH_REDIRECT_ACTIVE_ENV_VAR, "").strip().lower()
-    return env_var_value in GH_REDIRECT_ACTIVE_TRUTHY_VALUES
+    return env_var_value in ALL_TRUTHY_ENV_VALUES
+
+
+def deny_mode_is_active() -> bool:
+    env_var_value = os.environ.get(DESTRUCTIVE_DENY_MODE_ENV_VAR, "").strip().lower()
+    return env_var_value in ALL_TRUTHY_ENV_VALUES
+
 
 def directory_is_ephemeral(directory_path: str) -> bool:
     """Return True when a directory belongs to the ephemeral auto-allow namespace.
@@ -2043,14 +2050,20 @@ def main() -> None:
         matched_description = co_resident_hazard_description
 
     if matched_description is not None:
-        ask_response = {
+        if deny_mode_is_active():
+            terminal_decision = "deny"
+            terminal_reason = f"DESTRUCTIVE: {matched_description}. Blocked in deny mode."
+        else:
+            terminal_decision = "ask"
+            terminal_reason = f"DESTRUCTIVE: {matched_description}. Requires explicit user approval."
+        terminal_response = {
             "hookSpecificOutput": {
                 "hookEventName": "PreToolUse",
-                "permissionDecision": "ask",
-                "permissionDecisionReason": f"DESTRUCTIVE: {matched_description}. Requires explicit user approval."
+                "permissionDecision": terminal_decision,
+                "permissionDecisionReason": terminal_reason
             }
         }
-        print(json.dumps(ask_response))
+        print(json.dumps(terminal_response))
 
     sys.exit(0)