claude-dev-env 2.4.0 → 2.7.0

package/hooks/hooks.json

@@ -102,6 +102,16 @@
           }
         ]
       },
+      {
+        "matcher": "ScheduleWakeup|CronCreate",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/orchestrator_refresh_reschedule_gate.py",
+            "timeout": 15
+          }
+        ]
+      },
       {
         "matcher": "Skill",
         "hooks": [
@@ -192,18 +202,6 @@
         ]
       }
     ],
-    "SubagentStop": [
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/verifier_verdict_minter.py",
-            "timeout": 30
-          }
-        ]
-      }
-    ],
     "SessionEnd": [
       {
         "matcher": "",

package/hooks/hooks_constants/CLAUDE.md

@@ -31,6 +31,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `duplicate_function_body_constants.py` | Hashing and comparison config for the duplicate-body check |
 | `duplicate_rmtree_helper_blocker_constants.py` | Sanctioned Windows-safe rmtree helper names, the definition pattern, and the exempt-path set for the duplicate-rmtree-helper blocker |
 | `dynamic_stderr_handler.py` | `DynamicStderrHandler` — a logging handler that resolves `sys.stderr` at emit time (for testability) |
+| `eli11_reply_enforcer_constants.py` | Reply-shape thresholds (word cap, enforced word floor, bullet cap, lead-line window, per-line word cap, over-packed line cap), the `Long form:` escape prefix, the bullet / numbered-step / table-row / link-target / word patterns, the imperative instruction verbs, and the user-facing notice for the ELI11 reply-shape Stop hook |
 | `gh_pr_author_swap_constants.py` | Constants for the PR-author swap enforcement hooks |
 | `hardcoded_user_path_constants.py` | Patterns for detecting hardcoded home-directory paths |
 | `harness_scratchpad_constants.py` | Fixed path components (`claude` / `claude-` user-directory name and prefix, `scratchpad` leaf name), the PreToolUse session-id payload key, and the `CLAUDE_CODE_SESSION_ID` environment variable name that the code-rules and TDD gates use to recognize an existing harness session scratchpad directory |
@@ -45,7 +46,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `multi_edit_reconstruction.py` | `apply_edits()` / `edits_for_tool()` — shared helpers that reconstruct the post-edit content of an Edit or MultiEdit, imported by the blockers that judge post-edit content |
 | `mypy_integration_constants.py` | Path markers (``.git``, ``.py``, ``pyproject.toml``) for mypy project-root resolution |
 | `mypy_validator_cache_constants.py` | Cache paths and tunables for the mypy_validator per-session caches |
-| `nas_ssh_binary_enforcer_constants.py` | Bash tool name, ssh-family basenames, OpenSSH binary path suffixes, launcher-wrapper set, shell control-operator tokens and split pattern, leading-assignment and duration patterns, and the batch-mode pattern for the NAS ssh binary enforcer |
+| `nas_ssh_binary_enforcer_constants.py` | Bash tool name, ssh-family basenames, OpenSSH binary path suffixes, and the batch-mode pattern for the NAS ssh binary enforcer; segment helpers come from `shell_command_segments.py` |
 | `open_questions_in_plans_blocker_constants.py` | Patterns for detecting unresolved open questions in plan documents |
 | `orphan_css_class_constants.py` | Scan radius and selector patterns for the orphan-CSS-class check |
 | `package_inventory_stale_blocker_constants.py` | Inventory document names, production code extensions, backtick token pattern, smallest inventory size, exempt names, scan budget, and block-message text for the package-inventory stale-entry blocker |
@@ -64,12 +65,15 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `pytest_testpaths_orphan_blocker_constants.py` | Marker filename, section and key names, test-file pattern, search budget, and block-message text for the pytest unregistered-test-directory blocker |
 | `python_style_checks_constants.py` | Command-line argument count and blank-line count between top-level functions for the style validator |
 | `reviewer_spawn_gate_constants.py` | Bash tool name, the sentinel marker, the Copilot and Bugbot trigger markers, the availability-script relative path and override env-var name, and the deny-message template for the reviewer-spawn gate |
+| `ruff_integration_constants.py` | ``NO_COLOR`` / ``FORCE_COLOR`` environment variable names for plain ruff diagnostics |
 | `send_user_file_open_locally_blocker_constants.py` | Tool name, proactive status, and the block message for the open-locally attach blocker |
 | `sensitive_file_protector_constants.py` | Sensitive filename patterns, the committed-template suffixes that earn an exemption, the write/edit tool names, and the deny decision and message template for `sensitive_file_protector` |
 | `session_edit_stage_gate_constants.py` | Tracker filename prefix/suffix, JSON payload key, edit tool name set, session-id sanitize pattern, lock filename suffix and lock-acquire timing, git diff command, commit flag escapes, and deny-message template shared by the session edit stage gate trio |
 | `session_env_cleanup_constants.py` | Stale-age threshold and directory names for the session-env cleanup hook |
 | `session_handoff_blocker_constants.py` | Trigger phrases for the session-handoff blocker |
 | `setup_project_paths_constants.py` | Encoding policy, BOM marker, and registry meta-key used across multiple hooks |
+| `shell_command_segments.py` | Shell tokenization helpers shared by the segment-walking blockers: segment splitting on control operators, a segment's effective leading program, and a token's basename |
+| `shell_substitution_blocker_constants.py` | Tool name, payload keys, the four substitution-detection patterns, the deny decision shape, and the corrective message for the shell-substitution blocker |
 | `stale_comment_reference_blocker_constants.py` | Identifier pattern, comment stopwords, and denial text for the stale-comment-reference blocker |
 | `state_description_blocker_constants.py` | The set of historical/comparative phrases the state-description blocker rejects, plus the docstring-extraction and mention-span patterns for its Python docstring scan |
 | `stop_dispatcher_constants.py` | Ordered hosted-hook roster and Stop block payload field names for the Stop-chain dispatcher |
@@ -80,6 +84,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `task_list_loop_starter_constants.py` | The one-line task-list instruction and the full session-start directive text for the task-list loop starter hook |
 | `test_layout_constants.py` | The named constants for the test-layout write-time checks |
 | `text_stripping.py` | `strip_code_and_quotes()` — shared helper that removes fenced code blocks, inline code, and blockquotes from prose, imported by the Stop-hook prose blockers |
+| `unscoped_search_blocker_constants.py` | Tool names, `find` and listing program basenames, Get-ChildItem option sets, unscoped-root patterns, the flag/value token stride, and the deny message for the unscoped-search blocker |
 | `unused_module_import_constants.py` | Patterns for detecting unused module-level imports |
 | `volatile_path_in_post_blocker_constants.py` | Volatile path markers, affected `gh` post subcommands, MCP body param names, and the corrective message for the volatile-path post blocker |
 | `windows_rmtree_blocker_constants.py` | The unsafe `shutil.rmtree` pattern and the safe replacement pattern |
@@ -90,6 +95,6 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 - Most files in this package are pure constants modules — no side effects, no I/O.
 - Hooks import from this package with `from hooks_constants.<module> import <CONSTANT>`.
 - Tests for these modules live beside them as `test_<module>.py`. Run with `python -m pytest hooks_constants/test_<name>.py`.
-- `dynamic_stderr_handler.py`, `pre_tool_use_stdin.py`, `multi_edit_reconstruction.py`, `hosted_hook_runner.py`, and `text_stripping.py` are utility modules (not pure constants) but live here because they are shared across many hooks.
+- `dynamic_stderr_handler.py`, `pre_tool_use_stdin.py`, `multi_edit_reconstruction.py`, `hosted_hook_runner.py`, and `text_stripping.py` are utility modules (not pure constants) but live here because they hold logic shared across hook surfaces.
 - `local_identity.py` is a loader: it reads the environment or `~/.claude/local-identity.json` (its path overridable via `CLAUDE_LOCAL_IDENTITY_PATH`) to resolve private NAS values (with committed placeholder defaults), the PII commit-scan exempt-repo slug set (`CLAUDE_PII_EXEMPT_REPOS` / `pii_exempt_repositories`), and the per-repository allowlisted-values mapping (`pii_allowlisted_values`).
 

package/hooks/hooks_constants/bash_pre_tool_use_dispatcher_constants.py

@@ -56,6 +56,10 @@ ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
     BashHostedHookEntry("blocking/es_exe_path_rewriter.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/destructive_command_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/gh_body_arg_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
+    BashHostedHookEntry("blocking/shell_substitution_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
+    BashHostedHookEntry(
+        "blocking/unscoped_search_blocker.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES
+    ),
     BashHostedHookEntry("blocking/nas_ssh_binary_enforcer.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/volatile_path_in_post_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry(
@@ -71,10 +75,6 @@ ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
     BashHostedHookEntry("blocking/convergence_gate_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/windows_rmtree_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/gh_pr_author_enforcer.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry("blocking/verified_commit_gate.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES),
-    BashHostedHookEntry(
-        "blocking/verdict_directory_write_blocker.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES
-    ),
     BashHostedHookEntry("blocking/code_review_push_gate.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES),
     BashHostedHookEntry(
         "blocking/code_review_pr_create_gate.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES

package/hooks/hooks_constants/eli11_reply_enforcer_constants.py

@@ -0,0 +1,101 @@
+"""Tunables for the eli11_reply_enforcer Stop hook.
+
+::
+
+    NUMBERED_STEP_PATTERN
+        ok:   "1. Run the script"      flag: "1.5% of hosts still fail."
+    ALL_IMPERATIVE_OBJECT_LEAD_WORDS
+        ok:   "Run the migration"      flag: "Run time stays under a second"
+
+Holds the reply-shape thresholds the `eli11-replies` rule names, the compiled
+patterns that read a reply's structure, the closed sets naming an instruction
+verb and its object, and the notice the hook shows when it blocks.
+"""
+
+import re
+
+__all__ = [
+    "ACTION_FIRST_LEAD_LINE_COUNT",
+    "ALL_IMPERATIVE_INSTRUCTION_VERBS",
+    "ALL_IMPERATIVE_OBJECT_LEAD_WORDS",
+    "ALPHABETIC_WORD_PATTERN",
+    "BULLET_LINE_PATTERN",
+    "COUNTABLE_WORD_PATTERN",
+    "IMPERATIVE_OBJECT_TOKEN_PATTERN",
+    "LINK_TARGET_PATTERN",
+    "LIST_MARKER_PREFIX_PATTERN",
+    "LONG_FORM_ESCAPE_PREFIX",
+    "MARKDOWN_LEAD_MARKER_PATTERN",
+    "MAXIMUM_BULLET_LINE_COUNT",
+    "MAXIMUM_OVERPACKED_LINE_COUNT",
+    "MAXIMUM_REPLY_WORD_COUNT",
+    "MAXIMUM_WORDS_PER_LINE",
+    "MINIMUM_ENFORCED_WORD_COUNT",
+    "NUMBERED_STEP_PATTERN",
+    "TABLE_ROW_PATTERN",
+    "TARGET_BULLET_LINE_COUNT",
+    "USER_FACING_ELI11_NOTICE",
+    "VIOLATION_SEPARATOR",
+]
+
+MAXIMUM_REPLY_WORD_COUNT = 120
+MINIMUM_ENFORCED_WORD_COUNT = 60
+MAXIMUM_BULLET_LINE_COUNT = 6
+TARGET_BULLET_LINE_COUNT = 3
+ACTION_FIRST_LEAD_LINE_COUNT = 6
+MAXIMUM_WORDS_PER_LINE = 20
+MAXIMUM_OVERPACKED_LINE_COUNT = 2
+
+LONG_FORM_ESCAPE_PREFIX = "long form:"
+VIOLATION_SEPARATOR = "; "
+USER_FACING_ELI11_NOTICE = "Agent wrote a long reply - rewriting it short..."
+
+TABLE_ROW_PATTERN = re.compile(r"^[ \t]*\|.*\|[ \t]*$", re.MULTILINE)
+LINK_TARGET_PATTERN = re.compile(r"(?:https?://|www\.)\S+", re.IGNORECASE)
+COUNTABLE_WORD_PATTERN = re.compile(r"\S*[A-Za-z0-9]\S*")
+ALPHABETIC_WORD_PATTERN = re.compile(r"[A-Za-z][A-Za-z'’-]*")
+BULLET_LINE_PATTERN = re.compile(r"^[ \t]*[-*+][ \t]+\S")
+NUMBERED_STEP_PATTERN = re.compile(r"^[ \t]*(?:\*\*)?\d{1,2}[.)](?:\*\*)?[ \t]+\S")
+LIST_MARKER_PREFIX_PATTERN = re.compile(
+    r"^[ \t]*(?:[-*+][ \t]+|(?:\*\*)?\d{1,2}[.)][ \t]*)?(?:\*\*)?"
+)
+MARKDOWN_LEAD_MARKER_PATTERN = re.compile(r"^(?:[ \t]*(?:>+|#{1,6}|\*\*|__|\*|_))+[ \t]*")
+
+ALL_IMPERATIVE_INSTRUCTION_VERBS = (
+    "click",
+    "copy",
+    "delete",
+    "do",
+    "download",
+    "install",
+    "merge",
+    "open",
+    "paste",
+    "restart",
+    "run",
+    "save",
+)
+
+ALL_IMPERATIVE_OBJECT_LEAD_WORDS = (
+    "a",
+    "all",
+    "an",
+    "any",
+    "both",
+    "each",
+    "every",
+    "into",
+    "it",
+    "my",
+    "our",
+    "that",
+    "the",
+    "them",
+    "these",
+    "this",
+    "those",
+    "to",
+    "your",
+)
+
+IMPERATIVE_OBJECT_TOKEN_PATTERN = re.compile(r"^\d|[`/\\]|\.[A-Za-z]{1,4}$")

package/hooks/hooks_constants/enter_worktree_prefetch_constants.py

@@ -1,18 +1,18 @@
-"""Configuration constants for the ``enter_worktree_origin_prefetch`` hook.
-
-The hook keeps a freshly created worktree from starting on a stale cached
-``refs/remotes/origin/<default-branch>`` value: it fetches that ref right
-before ``EnterWorktree`` resolves its base.
-"""
-
-from __future__ import annotations
-
-ENTER_WORKTREE_TOOL_NAME: str = "EnterWorktree"
-ENTER_WORKTREE_PATH_INPUT_KEY: str = "path"
-
-ORIGIN_REMOTE_NAME: str = "origin"
-ORIGIN_HEAD_SYMBOLIC_REF: str = "refs/remotes/origin/HEAD"
-ORIGIN_REMOTE_REF_PREFIX: str = "refs/remotes/origin/"
-
-GIT_SYMBOLIC_REF_TIMEOUT_SECONDS: int = 5
-GIT_FETCH_TIMEOUT_SECONDS: int = 15
+"""Configuration constants for the ``enter_worktree_origin_prefetch`` hook.
+
+The hook keeps a freshly created worktree from starting on a stale cached
+``refs/remotes/origin/<default-branch>`` value: it fetches that ref right
+before ``EnterWorktree`` resolves its base.
+"""
+
+from __future__ import annotations
+
+ENTER_WORKTREE_TOOL_NAME: str = "EnterWorktree"
+ENTER_WORKTREE_PATH_INPUT_KEY: str = "path"
+
+ORIGIN_REMOTE_NAME: str = "origin"
+ORIGIN_HEAD_SYMBOLIC_REF: str = "refs/remotes/origin/HEAD"
+ORIGIN_REMOTE_REF_PREFIX: str = "refs/remotes/origin/"
+
+GIT_SYMBOLIC_REF_TIMEOUT_SECONDS: int = 5
+GIT_FETCH_TIMEOUT_SECONDS: int = 15

package/hooks/hooks_constants/nas_ssh_binary_enforcer_constants.py

@@ -1,9 +1,8 @@
 """Constants for the NAS ssh binary enforcer hook.
 
 Holds the Bash tool name, the ssh-family command basenames, the Windows OpenSSH
-binary path suffixes, the launcher-wrapper set, the shell control-operator tokens
-and their split pattern, the leading-assignment and launcher-duration patterns,
-and the batch-mode pattern.
+binary path suffixes, and the batch-mode pattern. Segment splitting and
+leading-program resolution come from ``shell_command_segments``.
 """
 
 import re
@@ -18,9 +17,4 @@ ALL_OPENSSH_BINARY_PATH_SUFFIXES = (
     "/openssh/scp.exe",
     "/openssh/sftp.exe",
 )
-ALL_LAUNCHER_WRAPPER_COMMANDS = frozenset({"timeout", "nohup", "nice", "stdbuf", "setsid", "env"})
-ALL_SHELL_CONTROL_OPERATOR_TOKENS = frozenset({"&&", "||", ";", "|", "&", "|&"})
-CONTROL_OPERATOR_SPLIT_PATTERN = re.compile(r"(&&|\|\||;|\|&|\||(?<!>)&(?!>))")
-LEADING_ASSIGNMENT_PATTERN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=")
-LAUNCHER_DURATION_PATTERN = re.compile(r"^\d+[a-z]*$", re.IGNORECASE)
 BATCH_MODE_PATTERN = re.compile(r"batchmode\s*=\s*yes", re.IGNORECASE)

package/hooks/hooks_constants/orchestrator_refresh_reschedule_gate_constants.py

@@ -0,0 +1,48 @@
+"""Constants for the orchestrator-refresh ScheduleWakeup reschedule gate."""
+
+from __future__ import annotations
+
+SCHEDULE_WAKEUP_TOOL_NAME = "ScheduleWakeup"
+CRON_CREATE_TOOL_NAME = "CronCreate"
+ALL_SCHEDULE_TOOL_NAMES: frozenset[str] = frozenset(
+    {
+        SCHEDULE_WAKEUP_TOOL_NAME,
+        CRON_CREATE_TOOL_NAME,
+    }
+)
+
+ORCHESTRATOR_REFRESH_PROMPT_TOKEN = "/orchestrator-refresh"
+RUN_SLUG_PROMPT_FLAG = "--run-slug"
+RUN_SLUG_PROMPT_VALUE_PATTERN = r"(?:=\s*|\s+)([^\s]+)"
+PROMPT_FIELD_NAME = "prompt"
+TOOL_NAME_FIELD_NAME = "tool_name"
+TOOL_INPUT_FIELD_NAME = "tool_input"
+CWD_FIELD_NAME = "cwd"
+
+REASON_CRON_CREATE_FORBIDDEN = "cron_create_forbidden"
+
+DENY_REASON_TEMPLATE = (
+    "BLOCKED: orchestrator-refresh re-arm denied ({reason}). "
+    "Use one-shot delayed wake only (never CronCreate / never recurring). "
+    "At most one re-arm slot: begin-firing at refresh start; "
+    "should-reschedule then create then claim-rearm (never claim before "
+    "ScheduleWakeup). Status must be active: "
+    "python skills/orchestrator/scripts/status_gate.py set "
+    "--status active. When finished: --status done. Never re-arm an idle loop."
+)
+
+CALLING_HOOK_NAME = "orchestrator_refresh_reschedule_gate.py"
+HOOK_EVENT_NAME = "PreToolUse"
+
+ALL_SKILL_SCRIPTS_RELATIVE_PARTS: tuple[str, ...] = (
+    "skills",
+    "orchestrator",
+    "scripts",
+)
+PLUGIN_ROOT_ENV_VAR = "CLAUDE_PLUGIN_ROOT"
+ALL_HOME_SKILLS_RELATIVE_PARTS: tuple[str, ...] = (
+    ".claude",
+    "skills",
+    "orchestrator",
+    "scripts",
+)

package/hooks/hooks_constants/ruff_integration_constants.py

@@ -0,0 +1,16 @@
+"""Environment variable names used when ruff emits plain diagnostics.
+
+The PreToolUse gate parses ``path:line:col:`` prefixes. Forcing ``NO_COLOR`` and
+clearing ``FORCE_COLOR`` keeps ANSI codes out of those fields so baseline
+scoping can locate each finding.
+"""
+
+__all__ = [
+    "FORCE_COLOR_ENVIRONMENT_VARIABLE_NAME",
+    "NO_COLOR_ENABLED_VALUE",
+    "NO_COLOR_ENVIRONMENT_VARIABLE_NAME",
+]
+
+NO_COLOR_ENVIRONMENT_VARIABLE_NAME: str = "NO_COLOR"
+FORCE_COLOR_ENVIRONMENT_VARIABLE_NAME: str = "FORCE_COLOR"
+NO_COLOR_ENABLED_VALUE: str = "1"

package/hooks/hooks_constants/shell_command_segments.py

@@ -0,0 +1,82 @@
+"""Shared shell-command segment helpers for Bash PreToolUse blockers.
+
+Tokenizes a command into simple-command segments on control operators and finds
+each segment's effective leading program after env assignments and launcher
+wrappers. NAS ssh enforcement and unscoped-search blocking both need this
+shape, so one module owns it.
+"""
+
+from __future__ import annotations
+
+import re
+
+__all__ = [
+    "ALL_LAUNCHER_WRAPPER_COMMANDS",
+    "ALL_SHELL_CONTROL_OPERATOR_TOKENS",
+    "CONTROL_OPERATOR_SPLIT_PATTERN",
+    "LEADING_ASSIGNMENT_PATTERN",
+    "LAUNCHER_DURATION_PATTERN",
+    "token_basename",
+    "split_into_segments",
+    "effective_leading_program",
+]
+
+ALL_LAUNCHER_WRAPPER_COMMANDS: frozenset[str] = frozenset(
+    {"timeout", "nohup", "nice", "stdbuf", "setsid", "env"}
+)
+ALL_SHELL_CONTROL_OPERATOR_TOKENS: frozenset[str] = frozenset(
+    {"&&", "||", ";", "|", "&", "|&"}
+)
+CONTROL_OPERATOR_SPLIT_PATTERN = re.compile(r"(&&|\|\||;|\|&|\||(?<!>)&(?!>))")
+LEADING_ASSIGNMENT_PATTERN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=")
+LAUNCHER_DURATION_PATTERN = re.compile(r"^\d+[a-z]*$", re.IGNORECASE)
+
+
+def token_basename(token: str) -> str:
+    """Return the lowercased basename of a path-or-command token."""
+    return token.replace("\\", "/").rsplit("/", 1)[-1].lower()
+
+
+def split_into_segments(all_command_tokens: list[str]) -> list[list[str]]:
+    """Split tokens into simple-command segments on shell control operators.
+
+    Glued operators on a single token are exploded first, then the stream is
+    cut on ``&&`` / ``||`` / ``;`` / ``|`` / ``&`` / ``|&``.
+    """
+    all_exploded_tokens: list[str] = []
+    for each_token in all_command_tokens:
+        for each_fragment in CONTROL_OPERATOR_SPLIT_PATTERN.split(each_token):
+            if each_fragment:
+                all_exploded_tokens.append(each_fragment)
+    all_segments: list[list[str]] = []
+    current_segment: list[str] = []
+    for each_token in all_exploded_tokens:
+        if each_token in ALL_SHELL_CONTROL_OPERATOR_TOKENS:
+            all_segments.append(current_segment)
+            current_segment = []
+            continue
+        current_segment.append(each_token)
+    all_segments.append(current_segment)
+    return all_segments
+
+
+def effective_leading_program(all_segment_tokens: list[str]) -> str | None:
+    """Return the effective program token after assignments and launcher wrappers.
+
+    Skips ``VAR=value`` prefixes and known launchers (``timeout``, ``env``, …)
+    plus their flags and duration arguments. Returns None when no program token
+    remains.
+    """
+    has_seen_launcher_wrapper = False
+    for each_token in all_segment_tokens:
+        if LEADING_ASSIGNMENT_PATTERN.match(each_token):
+            continue
+        if token_basename(each_token) in ALL_LAUNCHER_WRAPPER_COMMANDS:
+            has_seen_launcher_wrapper = True
+            continue
+        if has_seen_launcher_wrapper and (
+            each_token.startswith("-") or LAUNCHER_DURATION_PATTERN.match(each_token)
+        ):
+            continue
+        return each_token
+    return None

package/hooks/hooks_constants/shell_substitution_blocker_constants.py

@@ -0,0 +1,67 @@
+"""Constants for the shell-substitution PreToolUse Bash blocker.
+
+Holds the tool name, the payload keys, the four detection patterns, the deny
+decision shape, and the corrective message. The hook imports these so no
+single-use constant sits at its file scope.
+"""
+
+from __future__ import annotations
+
+import re
+
+__all__ = [
+    "BASH_TOOL_NAME",
+    "TOOL_NAME_KEY",
+    "TOOL_INPUT_KEY",
+    "COMMAND_KEY",
+    "HOOK_SPECIFIC_OUTPUT_KEY",
+    "HOOK_EVENT_NAME_KEY",
+    "HOOK_EVENT_NAME",
+    "PERMISSION_DECISION_KEY",
+    "DENY_DECISION",
+    "PERMISSION_DECISION_REASON_KEY",
+    "DOLLAR_PAREN_PATTERN",
+    "EVEN_BACKSLASH_BACKTICK_PATTERN",
+    "PROCESS_SUBSTITUTION_PATTERN",
+    "SINGLE_QUOTED_RUN_PATTERN",
+    "STRIPPED_RUN_REPLACEMENT",
+    "CORRECTIVE_MESSAGE",
+]
+
+BASH_TOOL_NAME = "Bash"
+
+TOOL_NAME_KEY = "tool_name"
+TOOL_INPUT_KEY = "tool_input"
+COMMAND_KEY = "command"
+
+HOOK_SPECIFIC_OUTPUT_KEY = "hookSpecificOutput"
+HOOK_EVENT_NAME_KEY = "hookEventName"
+HOOK_EVENT_NAME = "PreToolUse"
+PERMISSION_DECISION_KEY = "permissionDecision"
+DENY_DECISION = "deny"
+PERMISSION_DECISION_REASON_KEY = "permissionDecisionReason"
+
+DOLLAR_PAREN_PATTERN = re.compile(r"\$\((?!\()")
+EVEN_BACKSLASH_BACKTICK_PATTERN = re.compile(r"(?<!\\)(?:\\\\)*`")
+PROCESS_SUBSTITUTION_PATTERN = re.compile(r"[<>]\(")
+SINGLE_QUOTED_RUN_PATTERN = re.compile(r"'[^']*'")
+STRIPPED_RUN_REPLACEMENT = ""
+
+CORRECTIVE_MESSAGE = (
+    "BLOCKED [shell-substitution]: command contains $(...), backtick, or "
+    "<(...)/>(...) process substitution, which forces a permission prompt "
+    "because the Claude Code allowlist matcher does not descend into "
+    "substitutions.\n\n"
+    "Fix: split into two Bash tool calls, or rewrite without substitution.\n"
+    '  cd X && echo "$(git rev-parse HEAD)"\n'
+    "becomes either two calls:\n"
+    "  1) cd X\n"
+    "  2) git rev-parse HEAD\n"
+    "or one substitution-free call:\n"
+    "  git -C X rev-parse HEAD\n\n"
+    "Process substitution example:\n"
+    "  diff <(cat a) <(cat b)\n"
+    "becomes two separate Bash calls to `cat a` and `cat b`, with the diff "
+    "performed on the captured outputs.\n\n"
+    "See `shell-invocation.md` in the rules directory for full guidance."
+)

package/hooks/hooks_constants/stop_dispatcher_constants.py

@@ -22,5 +22,6 @@ ALL_STOP_HOSTED_HOOK_PATHS: tuple[str, ...] = (
     "blocking/question_to_user_enforcer.py",
     "blocking/intent_only_ending_blocker.py",
     "blocking/session_handoff_blocker.py",
+    "blocking/eli11_reply_enforcer.py",
     "diagnostic/hook_log_stop_wrapper.py",
 )

package/hooks/hooks_constants/test_bash_pre_tool_use_dispatcher_constants.py

@@ -25,6 +25,8 @@ _EXPECTED_BASH_ORDER = (
     "blocking/es_exe_path_rewriter.py",
     "blocking/destructive_command_blocker.py",
     "blocking/gh_body_arg_blocker.py",
+    "blocking/shell_substitution_blocker.py",
+    "blocking/unscoped_search_blocker.py",
     "blocking/nas_ssh_binary_enforcer.py",
     "blocking/volatile_path_in_post_blocker.py",
     "blocking/pii_prevention_blocker.py",
@@ -38,17 +40,14 @@ _EXPECTED_BASH_ORDER = (
     "blocking/convergence_gate_blocker.py",
     "blocking/windows_rmtree_blocker.py",
     "blocking/gh_pr_author_enforcer.py",
-    "blocking/verified_commit_gate.py",
-    "blocking/verdict_directory_write_blocker.py",
     "blocking/code_review_push_gate.py",
     "blocking/code_review_pr_create_gate.py",
     "blocking/code_review_stamp_directory_write_blocker.py",
 )
 
 _POWERSHELL_APPLICABLE = (
+    "blocking/unscoped_search_blocker.py",
     "blocking/pii_prevention_blocker.py",
-    "blocking/verified_commit_gate.py",
-    "blocking/verdict_directory_write_blocker.py",
     "blocking/code_review_push_gate.py",
     "blocking/code_review_pr_create_gate.py",
     "blocking/code_review_stamp_directory_write_blocker.py",
@@ -69,8 +68,8 @@ def test_every_hook_applies_to_the_bash_tool() -> None:
         assert BASH_TOOL_NAME in each_entry.applicable_tool_names
 
 
-def test_powershell_applicable_hooks_include_pii_and_verified_commit_pair() -> None:
-    """PowerShell runs the PII gate plus the verified-commit pair."""
+def test_powershell_applicable_hooks_include_the_shared_gates() -> None:
+    """PowerShell runs the unscoped-search and PII gates plus the review family."""
     powershell_hooks = tuple(
         each_entry.script_relative_path
         for each_entry in ALL_BASH_HOSTED_HOOK_ENTRIES

package/hooks/hooks_constants/test_stop_dispatcher_constants.py

@@ -16,6 +16,7 @@ _EXPECTED_STOP_ORDER = (
     "blocking/question_to_user_enforcer.py",
     "blocking/intent_only_ending_blocker.py",
     "blocking/session_handoff_blocker.py",
+    "blocking/eli11_reply_enforcer.py",
     "diagnostic/hook_log_stop_wrapper.py",
 )