claude-dev-env 4.1.0 → 4.3.0

package/hooks/blocking/test_pii_prevention_blocker.py

@@ -42,6 +42,14 @@ SYNTHETIC_REAL_EMAIL = "owner.fixture@acme-corp.example.io"
 SYNTHETIC_HOME_PATH = r"C:\Users\fixture_commit_user\secret.txt"
 SYNTHETIC_PRIVATE_IP = "10.44.12.9"
 SYNTHETIC_SAFE_BODY = "All checks pass. Contact user@example.com for docs."
+HASH_MARKER = "#"
+
+
+def test_post_body_extraction_has_a_neutral_module_owner() -> None:
+    assert (
+        blocker_module.extract_gh_post_body_texts_for_privacy_gate.__module__
+        == "gh_post_body_texts"
+    )
 
 
 def _run_hook(payload: dict[str, object]) -> tuple[int, str]:
@@ -370,10 +378,7 @@ def test_dispatcher_roster_hosts_pii_blocker() -> None:
         if each_entry.script_relative_path == "blocking/pii_prevention_blocker.py"
     ]
     assert len(matching_bash_entries) == 1
-    assert (
-        matching_bash_entries[0].applicable_tool_names
-        == ALL_BASH_AND_POWERSHELL_TOOL_NAMES
-    )
+    assert matching_bash_entries[0].applicable_tool_names == ALL_BASH_AND_POWERSHELL_TOOL_NAMES
 
 
 def test_is_git_commit_shell_command_covers_windows_and_flag_forms() -> None:
@@ -531,9 +536,7 @@ def test_is_git_commit_shell_command_detects_glued_and_newline_separators() -> N
     assert is_git_commit_shell_command("cd repo&&git commit -m x")
     assert is_git_commit_shell_command("git add notes.md\ngit commit -m update")
     assert is_git_commit_shell_command("git status\ngit commit -m x")
-    assert not is_git_commit_shell_command(
-        "gh pr comment 1 --body 'notes\ngit commit -m x'"
-    )
+    assert not is_git_commit_shell_command("gh pr comment 1 --body 'notes\ngit commit -m x'")
 
 
 def test_is_git_commit_shell_command_detects_backgrounded_commit() -> None:
@@ -681,11 +684,9 @@ def test_argument_bearing_wrapper_commit_scans_staged_pii(tmp_path: Path) -> Non
 
 
 def test_is_git_commit_shell_command_detects_commit_after_hash_bearing_token() -> None:
-    assert is_git_commit_shell_command(
-        "curl https://example.com/page#section && git commit -am x"
-    )
+    command = f"curl https://example.com/page{HASH_MARKER}section && git commit -am x"
+    assert is_git_commit_shell_command(command)
     assert is_git_commit_shell_command("echo done#note && git commit -m x")
-    assert is_git_commit_shell_command('git commit -m "fix #123"')
 
 
 def test_hash_bearing_token_before_commit_scans_staged_pii(tmp_path: Path) -> None:
@@ -721,21 +722,13 @@ def test_is_git_commit_shell_command_detects_unquoted_powershell_command() -> No
 
 
 def test_is_git_commit_shell_command_detects_powershell_preflags_before_command() -> None:
-    assert is_git_commit_shell_command(
-        'pwsh -ExecutionPolicy Bypass -Command "git commit -m x"'
-    )
-    assert is_git_commit_shell_command(
-        'pwsh -NonInteractive -Command "git commit -m x"'
-    )
+    assert is_git_commit_shell_command('pwsh -ExecutionPolicy Bypass -Command "git commit -m x"')
+    assert is_git_commit_shell_command('pwsh -NonInteractive -Command "git commit -m x"')
     assert is_git_commit_shell_command(
         'powershell -ExecutionPolicy Bypass -Command "git commit -m x"'
     )
-    assert is_git_commit_shell_command(
-        'pwsh -NoProfile -NonInteractive -Command "git commit -m x"'
-    )
-    assert not is_git_commit_shell_command(
-        'pwsh -NonInteractive -Command "git status"'
-    )
+    assert is_git_commit_shell_command('pwsh -NoProfile -NonInteractive -Command "git commit -m x"')
+    assert not is_git_commit_shell_command('pwsh -NonInteractive -Command "git status"')
 
 
 def test_is_git_commit_shell_command_detects_subshell_grouped_commit() -> None:
@@ -835,9 +828,7 @@ def test_is_git_commit_shell_command_detects_commit_after_apostrophe_line() -> N
 
 
 def test_is_git_commit_shell_command_ignores_commit_inside_quoted_body() -> None:
-    assert not is_git_commit_shell_command(
-        "gh pr comment 1 --body 'notes\ngit commit -m x'"
-    )
+    assert not is_git_commit_shell_command("gh pr comment 1 --body 'notes\ngit commit -m x'")
 
 
 def test_apostrophe_line_before_commit_scans_staged_pii(tmp_path: Path) -> None:
@@ -873,17 +864,9 @@ def test_powershell_backtick_continuation_commit_scans_staged_pii(
 
 
 def test_extract_git_commit_working_directory_resolves_dash_c_forms() -> None:
-    assert (
-        extract_git_commit_working_directory(r"git.exe -C /repoA commit -m x")
-        == "/repoA"
-    )
-    assert (
-        extract_git_commit_working_directory(r"git -C /repoA commit -m x") == "/repoA"
-    )
-    assert (
-        extract_git_commit_working_directory(r'git -C "C:/repo" commit -m x')
-        == "C:/repo"
-    )
+    assert extract_git_commit_working_directory(r"git.exe -C /repoA commit -m x") == "/repoA"
+    assert extract_git_commit_working_directory(r"git -C /repoA commit -m x") == "/repoA"
+    assert extract_git_commit_working_directory(r'git -C "C:/repo" commit -m x') == "C:/repo"
     assert extract_git_commit_working_directory("git commit -m x") is None
 
 
@@ -921,9 +904,7 @@ def test_exempt_repository_commit_skips_staged_pii_scan(
 ) -> None:
     repository_root = tmp_path / "repo"
     _init_repo_with_staged_email(repository_root)
-    _add_repository_origin(
-        repository_root, "https://github.com/ExemptOwner/exempt-repo.git"
-    )
+    _add_repository_origin(repository_root, "https://github.com/ExemptOwner/exempt-repo.git")
     monkeypatch.setenv("CLAUDE_PII_EXEMPT_REPOS", "ExemptOwner/exempt-repo")
     deny_reason = evaluate_bash_command(
         "git commit -m test",
@@ -937,9 +918,7 @@ def test_exempt_repository_matches_ssh_origin_url(
 ) -> None:
     repository_root = tmp_path / "repo"
     _init_repo_with_staged_email(repository_root)
-    _add_repository_origin(
-        repository_root, "git@github.com:ExemptOwner/exempt-repo.git"
-    )
+    _add_repository_origin(repository_root, "git@github.com:ExemptOwner/exempt-repo.git")
     monkeypatch.setenv("CLAUDE_PII_EXEMPT_REPOS", "exemptowner/EXEMPT-REPO")
     deny_reason = evaluate_bash_command(
         "git commit -m test",
@@ -953,9 +932,7 @@ def test_non_exempt_repository_commit_still_scans_staged_pii(
 ) -> None:
     repository_root = tmp_path / "repo"
     _init_repo_with_staged_email(repository_root)
-    _add_repository_origin(
-        repository_root, "https://github.com/OtherOwner/other-repo.git"
-    )
+    _add_repository_origin(repository_root, "https://github.com/OtherOwner/other-repo.git")
     monkeypatch.setenv("CLAUDE_PII_EXEMPT_REPOS", "ExemptOwner/exempt-repo")
     deny_reason = evaluate_bash_command(
         "git commit -m test",
@@ -981,45 +958,35 @@ def test_repository_without_origin_is_not_exempt(
 
 def test_owner_repo_slug_from_https_origin_with_git_suffix() -> None:
     assert (
-        blocker_module._owner_repo_slug_from_origin_url(
-            "https://github.com/Owner/repo.git"
-        )
+        blocker_module._owner_repo_slug_from_origin_url("https://github.com/Owner/repo.git")
         == "owner/repo"
     )
 
 
 def test_owner_repo_slug_from_https_origin_without_git_suffix() -> None:
     assert (
-        blocker_module._owner_repo_slug_from_origin_url(
-            "https://github.com/Owner/repo"
-        )
+        blocker_module._owner_repo_slug_from_origin_url("https://github.com/Owner/repo")
         == "owner/repo"
     )
 
 
 def test_owner_repo_slug_from_scp_ssh_origin() -> None:
     assert (
-        blocker_module._owner_repo_slug_from_origin_url(
-            "git@github.com:Owner/repo.git"
-        )
+        blocker_module._owner_repo_slug_from_origin_url("git@github.com:Owner/repo.git")
         == "owner/repo"
     )
 
 
 def test_owner_repo_slug_from_ssh_scheme_origin() -> None:
     assert (
-        blocker_module._owner_repo_slug_from_origin_url(
-            "ssh://git@github.com/Owner/repo.git"
-        )
+        blocker_module._owner_repo_slug_from_origin_url("ssh://git@github.com/Owner/repo.git")
         == "owner/repo"
     )
 
 
 def test_owner_repo_slug_from_trailing_slash_git_suffix() -> None:
     assert (
-        blocker_module._owner_repo_slug_from_origin_url(
-            "https://github.com/Owner/repo.git/"
-        )
+        blocker_module._owner_repo_slug_from_origin_url("https://github.com/Owner/repo.git/")
         == "owner/repo"
     )
 
@@ -1035,9 +1002,7 @@ def test_owner_repo_slug_rejects_spoofed_evil_host() -> None:
 
 def test_owner_repo_slug_rejects_notgithub_com_host() -> None:
     assert (
-        blocker_module._owner_repo_slug_from_origin_url(
-            "https://notgithub.com/Owner/repo.git"
-        )
+        blocker_module._owner_repo_slug_from_origin_url("https://notgithub.com/Owner/repo.git")
         is None
     )
 
@@ -1071,28 +1036,21 @@ def test_owner_repo_slug_rejects_invalid_ssh_port_authority() -> None:
 
 def test_owner_repo_slug_from_https_origin_with_valid_port() -> None:
     assert (
-        blocker_module._owner_repo_slug_from_origin_url(
-            "https://github.com:443/Owner/repo.git"
-        )
+        blocker_module._owner_repo_slug_from_origin_url("https://github.com:443/Owner/repo.git")
         == "owner/repo"
     )
 
 
 def test_owner_repo_slug_from_ssh_origin_with_valid_port() -> None:
     assert (
-        blocker_module._owner_repo_slug_from_origin_url(
-            "ssh://git@github.com:22/Owner/repo.git"
-        )
+        blocker_module._owner_repo_slug_from_origin_url("ssh://git@github.com:22/Owner/repo.git")
         == "owner/repo"
     )
 
 
 def test_owner_repo_slug_rejects_path_shaped_origin() -> None:
     assert (
-        blocker_module._owner_repo_slug_from_origin_url(
-            "C:/repos/ExemptOwner/exempt-repo"
-        )
-        is None
+        blocker_module._owner_repo_slug_from_origin_url("C:/repos/ExemptOwner/exempt-repo") is None
     )
 
 
@@ -1101,9 +1059,7 @@ def test_spoofed_origin_host_still_denies_staged_email(
 ) -> None:
     repository_root = tmp_path / "repo"
     _init_repo_with_staged_email(repository_root)
-    _add_repository_origin(
-        repository_root, "https://evil.test/ExemptOwner/exempt-repo.git"
-    )
+    _add_repository_origin(repository_root, "https://evil.test/ExemptOwner/exempt-repo.git")
     monkeypatch.setenv("CLAUDE_PII_EXEMPT_REPOS", "ExemptOwner/exempt-repo")
     deny_reason = evaluate_bash_command(
         "git commit -m test",
@@ -1151,9 +1107,7 @@ def test_trailing_slash_git_suffix_origin_still_exempts(
 ) -> None:
     repository_root = tmp_path / "repo"
     _init_repo_with_staged_email(repository_root)
-    _add_repository_origin(
-        repository_root, "https://github.com/ExemptOwner/exempt-repo.git/"
-    )
+    _add_repository_origin(repository_root, "https://github.com/ExemptOwner/exempt-repo.git/")
     monkeypatch.setenv("CLAUDE_PII_EXEMPT_REPOS", "ExemptOwner/exempt-repo")
     deny_reason = evaluate_bash_command(
         "git commit -m test",
@@ -1162,14 +1116,10 @@ def test_trailing_slash_git_suffix_origin_still_exempts(
     assert deny_reason is None
 
 
-def test_ssh_scheme_origin_still_exempts(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
+def test_ssh_scheme_origin_still_exempts(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
     repository_root = tmp_path / "repo"
     _init_repo_with_staged_email(repository_root)
-    _add_repository_origin(
-        repository_root, "ssh://git@github.com/ExemptOwner/exempt-repo.git"
-    )
+    _add_repository_origin(repository_root, "ssh://git@github.com/ExemptOwner/exempt-repo.git")
     monkeypatch.setenv("CLAUDE_PII_EXEMPT_REPOS", "ExemptOwner/exempt-repo")
     deny_reason = evaluate_bash_command(
         "git commit -m test",
@@ -1197,9 +1147,7 @@ def test_post_body_still_scans_when_repository_is_exempt(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
     monkeypatch.setenv("CLAUDE_PII_EXEMPT_REPOS", "ExemptOwner/exempt-repo")
-    deny_reason = evaluate_post_body_texts(
-        [f"Reach me at {SYNTHETIC_REAL_EMAIL}"]
-    )
+    deny_reason = evaluate_post_body_texts([f"Reach me at {SYNTHETIC_REAL_EMAIL}"])
     assert deny_reason is not None
     assert "email" in deny_reason
 

package/hooks/gh_post_body_texts.py

@@ -0,0 +1,195 @@
+"""Extract durable GitHub post body text for privacy checks."""
+
+from __future__ import annotations
+
+import shlex
+from pathlib import Path
+
+from blocking._gh_body_arg_utils import (
+    all_body_flags,
+    body_file_flag,
+    body_file_short_flag,
+    count_extra_tokens_to_skip_for_split_quoted_value,
+    get_logical_first_line,
+    is_unresolvable_shell_value,
+    match_body_file_equals_prefix,
+    match_body_flag_equals_prefix,
+    strip_surrounding_quotes,
+)
+from hooks_constants.gh_post_body_texts_constants import (
+    ALL_GH_POST_SUBCOMMANDS,
+    ALL_MCP_BODY_PARAM_NAMES,
+    BODY_FILE_ENCODING,
+    BODY_FLAG_WITH_VALUE_STEP,
+    GH_COMMAND_NAME,
+    MINIMUM_POST_SUBCOMMAND_TOKEN_COUNT,
+    TOKEN_JOIN_SEPARATOR,
+)
+
+
+def _is_environment_assignment(token: str) -> bool:
+    equals_index = token.find("=")
+    if equals_index <= 0:
+        return False
+    name_part = token[:equals_index]
+    if not (name_part[0].isalpha() or name_part[0] == "_"):
+        return False
+    return all(each_character.isalnum() or each_character == "_" for each_character in name_part)
+
+
+def _tokens_name_gh_post_command(all_command_tokens: list[str]) -> bool:
+    command_index = 0
+    while command_index < len(all_command_tokens) and _is_environment_assignment(
+        all_command_tokens[command_index]
+    ):
+        command_index += 1
+    if command_index >= len(all_command_tokens):
+        return False
+    if all_command_tokens[command_index] != GH_COMMAND_NAME:
+        return False
+    remaining_tokens = all_command_tokens[command_index + 1 :]
+    if len(remaining_tokens) < MINIMUM_POST_SUBCOMMAND_TOKEN_COUNT:
+        return False
+    post_noun, post_verb = remaining_tokens[:MINIMUM_POST_SUBCOMMAND_TOKEN_COUNT]
+    return post_verb in ALL_GH_POST_SUBCOMMANDS.get(post_noun, frozenset())
+
+
+def _reassemble_split_quoted_value(
+    value_token: str,
+    all_following_tokens: list[str],
+) -> tuple[str, int]:
+    extra_token_count = count_extra_tokens_to_skip_for_split_quoted_value(
+        all_following_tokens, value_token
+    )
+    if not extra_token_count:
+        return strip_surrounding_quotes(value_token), 0
+    joined_value = (
+        value_token
+        + TOKEN_JOIN_SEPARATOR
+        + TOKEN_JOIN_SEPARATOR.join(all_following_tokens[:extra_token_count])
+    )
+    return strip_surrounding_quotes(joined_value), extra_token_count
+
+
+def _extract_flag_value_at(
+    all_command_tokens: list[str],
+    token_index: int,
+) -> tuple[bool, str, int] | None:
+    current_token = all_command_tokens[token_index]
+    following_tokens = all_command_tokens[token_index + 1 :]
+    body_prefix = match_body_flag_equals_prefix(current_token)
+    if body_prefix is not None:
+        value, extra_count = _reassemble_split_quoted_value(
+            current_token[len(body_prefix) :], following_tokens
+        )
+        return False, value, token_index + 1 + extra_count
+    body_file_prefix = match_body_file_equals_prefix(current_token)
+    if body_file_prefix is not None:
+        value, extra_count = _reassemble_split_quoted_value(
+            current_token[len(body_file_prefix) :], following_tokens
+        )
+        return True, value, token_index + 1 + extra_count
+    if current_token in all_body_flags and following_tokens:
+        value, extra_count = _reassemble_split_quoted_value(
+            following_tokens[0], following_tokens[1:]
+        )
+        return False, value, token_index + BODY_FLAG_WITH_VALUE_STEP + extra_count
+    if current_token in (body_file_flag, body_file_short_flag) and following_tokens:
+        value, extra_count = _reassemble_split_quoted_value(
+            following_tokens[0], following_tokens[1:]
+        )
+        return True, value, token_index + BODY_FLAG_WITH_VALUE_STEP + extra_count
+    return None
+
+
+def _collect_body_flag_values(
+    all_command_tokens: list[str],
+) -> tuple[list[str], list[str]]:
+    all_inline_bodies: list[str] = []
+    all_body_file_paths: list[str] = []
+    token_index = 0
+    while token_index < len(all_command_tokens):
+        extraction = _extract_flag_value_at(all_command_tokens, token_index)
+        if extraction is None:
+            token_index += 1
+            continue
+        is_body_file, value, token_index = extraction
+        if is_body_file:
+            all_body_file_paths.append(value)
+        else:
+            all_inline_bodies.append(value)
+    return all_inline_bodies, all_body_file_paths
+
+
+def _read_body_file(
+    body_file_path: str,
+    working_directory: str | None,
+) -> str | None:
+    if is_unresolvable_shell_value(body_file_path):
+        return None
+    resolved_path = Path(body_file_path)
+    if not resolved_path.is_absolute() and working_directory:
+        resolved_path = Path(working_directory) / body_file_path
+    try:
+        return resolved_path.read_text(encoding=BODY_FILE_ENCODING)
+    except (OSError, UnicodeError):
+        return None
+
+
+def _body_texts_from_tokens(
+    all_command_tokens: list[str],
+    working_directory: str | None,
+) -> tuple[list[str], str | None]:
+    if not _tokens_name_gh_post_command(all_command_tokens):
+        return [], None
+    all_body_texts, all_body_file_paths = _collect_body_flag_values(all_command_tokens)
+    for each_path in all_body_file_paths:
+        file_text = _read_body_file(each_path, working_directory)
+        if file_text is None:
+            return [], (
+                "BLOCKED [pii_prevention_blocker]: durable post uses --body-file "
+                f"but '{each_path}' could not be read for PII scanning. Use an "
+                "absolute path, ensure the file exists, or pass --body text."
+            )
+        all_body_texts.append(file_text)
+    return all_body_texts, None
+
+
+def extract_gh_post_body_texts_for_privacy_gate(
+    command: str,
+    working_directory: str | None = None,
+) -> tuple[list[str], str | None]:
+    """Extract GitHub post text and reject unreadable declared body files.
+
+    Args:
+        command: Raw GitHub CLI command.
+        working_directory: Base directory for relative body-file paths.
+
+    Returns:
+        Body texts and no error, or no texts and a rejection message without body text.
+    """
+    logical_line = get_logical_first_line(command)
+    if not logical_line:
+        return [], None
+    try:
+        all_command_tokens = shlex.split(logical_line, posix=False)
+    except ValueError:
+        return [], None
+    return _body_texts_from_tokens(all_command_tokens, working_directory)
+
+
+def extract_mcp_body_texts(all_tool_input: dict[str, object]) -> list[str]:
+    """Extract body and comment strings from a GitHub tool request.
+
+    Args:
+        all_tool_input: GitHub tool input mapping.
+
+    Returns:
+        Nonempty body and comment values.
+    """
+    all_body_texts: list[str] = []
+    for each_name in ALL_MCP_BODY_PARAM_NAMES:
+        candidate_text = all_tool_input.get(each_name)
+        if isinstance(candidate_text, str) and candidate_text:
+            all_body_texts.append(candidate_text)
+    return all_body_texts

package/hooks/hooks.json

@@ -45,11 +45,6 @@
       {
         "matcher": "mcp__plugin_github_github__.*",
         "hooks": [
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/volatile_path_in_post_blocker.py",
-            "timeout": 10
-          },
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/pii_prevention_blocker.py",
@@ -149,11 +144,6 @@
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/session_env_cleanup.py",
             "timeout": 10
           },
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/gh_pr_author_session_cleanup.py",
-            "timeout": 30
-          },
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/session_edit_tracker_cleanup.py",
@@ -251,11 +241,6 @@
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/workflow/investigation_tracker_reset.py",
             "timeout": 30
-          },
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/observability/pr_description_writer_spawn_tracker.py",
-            "timeout": 30
           }
         ]
       },

package/hooks/hooks_constants/bash_post_call_dispatcher_constants.py

@@ -17,6 +17,5 @@ from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
 __all__ = ["ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES"]
 
 ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
-    BashHostedHookEntry("blocking/gh_pr_author_restore.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("observability/test_failure_recorder.py", ALL_BASH_ONLY_TOOL_NAMES),
 )

package/hooks/hooks_constants/bash_pre_tool_use_dispatcher_constants.py

@@ -35,7 +35,9 @@ BASH_TOOL_NAME = "Bash"
 POWERSHELL_TOOL_NAME = "PowerShell"
 
 ALL_BASH_ONLY_TOOL_NAMES: frozenset[str] = frozenset({BASH_TOOL_NAME})
-ALL_BASH_AND_POWERSHELL_TOOL_NAMES: frozenset[str] = frozenset({BASH_TOOL_NAME, POWERSHELL_TOOL_NAME})
+ALL_BASH_AND_POWERSHELL_TOOL_NAMES: frozenset[str] = frozenset(
+    {BASH_TOOL_NAME, POWERSHELL_TOOL_NAME}
+)
 
 
 @dataclass(frozen=True)
@@ -53,30 +55,17 @@ class BashHostedHookEntry:
 
 
 ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
-    BashHostedHookEntry("blocking/es_exe_path_rewriter.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/destructive_command_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry("blocking/gh_body_arg_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/shell_substitution_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/piped_pytest_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry(
         "blocking/cursor_cli_python_misfire_blocker.py",
         ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
     ),
-    BashHostedHookEntry(
-        "blocking/unscoped_search_blocker.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES
-    ),
+    BashHostedHookEntry("blocking/unscoped_search_blocker.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES),
     BashHostedHookEntry("blocking/nas_ssh_binary_enforcer.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry("blocking/volatile_path_in_post_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry(
-        "blocking/pii_prevention_blocker.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES
-    ),
-    BashHostedHookEntry("blocking/conventional_pr_title_gate.py", ALL_BASH_ONLY_TOOL_NAMES),
+    BashHostedHookEntry("blocking/pii_prevention_blocker.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES),
     BashHostedHookEntry("blocking/block_main_commit.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/session_edit_stage_gate.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry("blocking/test_preflight_check.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("blocking/windows_rmtree_blocker.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry("blocking/gh_pr_author_enforcer.py", ALL_BASH_ONLY_TOOL_NAMES),
-    BashHostedHookEntry(
-        "blocking/pr_description_writer_gate.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES
-    ),
 )

package/hooks/hooks_constants/gh_post_body_texts_constants.py

@@ -0,0 +1,12 @@
+"""Configuration constants for GitHub post body extraction."""
+
+ALL_GH_POST_SUBCOMMANDS: dict[str, frozenset[str]] = {
+    "issue": frozenset({"comment", "create", "edit"}),
+    "pr": frozenset({"comment", "create", "edit", "review"}),
+}
+ALL_MCP_BODY_PARAM_NAMES: tuple[str, ...] = ("body", "comment")
+BODY_FILE_ENCODING = "utf-8"
+BODY_FLAG_WITH_VALUE_STEP = 2
+GH_COMMAND_NAME = "gh"
+MINIMUM_POST_SUBCOMMAND_TOKEN_COUNT = 2
+TOKEN_JOIN_SEPARATOR = " "

package/hooks/hooks_constants/test_bash_post_call_dispatcher_constants.py

@@ -6,13 +6,6 @@ from hooks_constants.bash_post_call_dispatcher_constants import (
 from hooks_constants.bash_pre_tool_use_dispatcher_constants import BASH_TOOL_NAME
 
 
-def test_roster_names_the_gh_pr_author_restore_hook() -> None:
-    all_script_paths = [
-        each_entry.script_relative_path for each_entry in ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES
-    ]
-    assert "blocking/gh_pr_author_restore.py" in all_script_paths
-
-
 def test_roster_names_the_test_failure_recorder_hook() -> None:
     all_script_paths = [
         each_entry.script_relative_path for each_entry in ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES

package/hooks/hooks_constants/test_bash_pre_tool_use_dispatcher_constants.py

@@ -7,45 +7,34 @@ registration order the standalone chain used.
 
 from __future__ import annotations
 
-import sys
 from pathlib import Path
+from runpy import run_path
 
-_HOOKS_DIR = str(Path(__file__).resolve().parent.parent)
-if _HOOKS_DIR not in sys.path:
-    sys.path.insert(0, _HOOKS_DIR)
-
-from hooks_constants.bash_pre_tool_use_dispatcher_constants import (  # noqa: E402
-    ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
-    ALL_BASH_HOSTED_HOOK_ENTRIES,
-    BASH_TOOL_NAME,
-    POWERSHELL_TOOL_NAME,
+ALL_CONSTANT_BINDINGS = run_path(
+    str(Path(__file__).with_name("bash_pre_tool_use_dispatcher_constants.py"))
 )
+ALL_BASH_AND_POWERSHELL_TOOL_NAMES = ALL_CONSTANT_BINDINGS["ALL_BASH_AND_POWERSHELL_TOOL_NAMES"]
+ALL_BASH_HOSTED_HOOK_ENTRIES = ALL_CONSTANT_BINDINGS["ALL_BASH_HOSTED_HOOK_ENTRIES"]
+BASH_TOOL_NAME = ALL_CONSTANT_BINDINGS["BASH_TOOL_NAME"]
+POWERSHELL_TOOL_NAME = ALL_CONSTANT_BINDINGS["POWERSHELL_TOOL_NAME"]
 
 _EXPECTED_BASH_ORDER = (
-    "blocking/es_exe_path_rewriter.py",
     "blocking/destructive_command_blocker.py",
-    "blocking/gh_body_arg_blocker.py",
     "blocking/shell_substitution_blocker.py",
     "blocking/piped_pytest_blocker.py",
     "blocking/cursor_cli_python_misfire_blocker.py",
     "blocking/unscoped_search_blocker.py",
     "blocking/nas_ssh_binary_enforcer.py",
-    "blocking/volatile_path_in_post_blocker.py",
     "blocking/pii_prevention_blocker.py",
-    "blocking/conventional_pr_title_gate.py",
     "blocking/block_main_commit.py",
     "blocking/session_edit_stage_gate.py",
-    "blocking/test_preflight_check.py",
     "blocking/windows_rmtree_blocker.py",
-    "blocking/gh_pr_author_enforcer.py",
-    "blocking/pr_description_writer_gate.py",
 )
 
 _POWERSHELL_APPLICABLE = (
     "blocking/cursor_cli_python_misfire_blocker.py",
     "blocking/unscoped_search_blocker.py",
     "blocking/pii_prevention_blocker.py",
-    "blocking/pr_description_writer_gate.py",
 )
 
 
@@ -80,8 +69,6 @@ def test_powershell_hooks_carry_the_shared_tool_set() -> None:
             assert each_entry.applicable_tool_names == ALL_BASH_AND_POWERSHELL_TOOL_NAMES
 
 
-
-
 def test_every_roster_path_points_at_an_existing_hook() -> None:
     """Each roster path names a hook script present on disk, catching a typo."""
     hooks_root = Path(__file__).resolve().parent.parent

package/hooks/hooks_constants/test_failure_recorder_constants.py

@@ -6,9 +6,7 @@ tokens that keep the recognizer to one unchained command, the pytest program
 and Python interpreter basenames, and the flag-token marker the path
 extractor uses to skip an option rather than an existing test file argument.
 
-``BASH_TOOL_NAME`` lives in ``gh_pr_author_swap_constants`` already; this
-module reuses that name rather than a second literal. The pytest-program and
-interpreter recognition here is deliberately its own small, stdlib-only
+The pytest-program and interpreter recognition here is deliberately its own small, stdlib-only
 check rather than a reuse of ``piped_pytest_blocker_constants`` /
 ``pytest_invocation``: those solve the harder pipe-and-wrapper problem and
 pull in a much larger transitive import for every Bash call regardless of
@@ -19,6 +17,8 @@ from __future__ import annotations
 
 import re
 
+BASH_TOOL_NAME = "Bash"
+
 ALL_PYTEST_MENTION_SUBSTRINGS: tuple[str, ...] = ("pytest", "py.test")
 EXIT_CODE_ERROR_PREFIX: str = "Error: Exit code "
 OPTION_TOKEN_PREFIX: str = "-"