claude-dev-env 7.4.0 → 7.5.0

package/hooks/blocking/bash_post_call_dispatcher.py

@@ -18,7 +18,8 @@ decision -- it is an observer, not a gate -- so this dispatcher runs the whole
 roster unconditionally and never blocks. The one thing it forwards is context:
 a hosted hook may print a ``hookSpecificOutput.additionalContext`` string (the
 PR done reminder does), and the dispatcher joins every such string into one
-PostToolUse payload. A hook that prints nothing adds nothing.
+PostToolUse payload through the shared emitter every PostToolUse hook here
+writes with. A hook that prints nothing adds nothing.
 
 A single hosted hook crash fails open: ``run_hook_capturing_output`` isolates
 it, so it contributes nothing and does not stop the remaining hosted hooks.
@@ -30,7 +31,6 @@ imports load once into this process rather than once per hook.
 from __future__ import annotations
 
 import json
-import sys
 
 import _path_setup  # noqa: F401
 
@@ -39,8 +39,8 @@ from hooks_constants.bash_post_call_dispatcher_constants import (
     ADDITIONAL_CONTEXT_KEY,
     ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES,
     HOOK_SPECIFIC_OUTPUT_KEY,
-    POST_TOOL_USE_HOOK_EVENT_NAME,
 )
+from hooks_constants.post_tool_use_context import write_post_tool_use_context_to_stdout
 from hooks_constants.bash_pre_tool_use_dispatcher_constants import BashHostedHookEntry
 from hooks_constants.hosted_hook_runner import (
     run_hook_capturing_output,
@@ -98,14 +98,9 @@ def dispatch(payload_text: str, tool_name: str) -> None:
             all_additional_context.append(additional_context)
     if not all_additional_context:
         return
-    payload = {
-        HOOK_SPECIFIC_OUTPUT_KEY: {
-            "hookEventName": POST_TOOL_USE_HOOK_EVENT_NAME,
-            ADDITIONAL_CONTEXT_KEY: ADDITIONAL_CONTEXT_JOIN_SEPARATOR.join(all_additional_context),
-        }
-    }
-    sys.stdout.write(json.dumps(payload))
-    sys.stdout.flush()
+    write_post_tool_use_context_to_stdout(
+        ADDITIONAL_CONTEXT_JOIN_SEPARATOR.join(all_additional_context)
+    )
 
 
 def main() -> None:

package/hooks/blocking/env_var_table_code_drift_blocker.py

@@ -25,22 +25,23 @@ _hooks_dir = str(Path(__file__).resolve().parent.parent)
 if _hooks_dir not in sys.path:
     sys.path.insert(0, _hooks_dir)
 
-from hooks_constants.env_var_table_code_drift_constants import (  # noqa: E402
-    ALL_CODE_FILE_EXTENSIONS,
+from env_var_table_rows import (
+    _code_file_reference_in_cell,
+    _env_var_name_in_cell,
+    _is_separator_row,
+    _row_cells,
+    iter_env_var_table_rows,
+)
+from hooks_constants.env_var_table_code_drift_constants import (
     ALL_NOISE_DIRECTORY_NAMES,
-    BACKTICK_TOKEN_PATTERN,
-    CODE_FENCE_PATTERN,
     DRIFT_ADDITIONAL_CONTEXT,
     DRIFT_MESSAGE_TEMPLATE,
     DRIFT_SYSTEM_MESSAGE,
-    ENV_VAR_NAME_PATTERN,
     GIT_DIRECTORY_NAME,
     MARKDOWN_FILE_EXTENSION,
     MAX_DRIFT_ISSUES,
     MAX_SUBTREE_FILES_SCANNED,
     MINIMUM_ENV_VAR_ROW_CELL_COUNT,
-    SEPARATOR_CELL_PATTERN,
-    TABLE_ROW_PATTERN,
 )
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
 from hooks_constants.multi_edit_reconstruction import (  # noqa: E402
@@ -65,87 +66,6 @@ def is_markdown_file(file_path: str) -> bool:
     return extension.lower() == MARKDOWN_FILE_EXTENSION
 
 
-def _row_cells(table_line: str) -> list[str]:
-    """Return the trimmed cells of one markdown table row.
-
-    Args:
-        table_line: A single line that begins with a pipe character.
-
-    Returns:
-        The text of each pipe-delimited cell, stripped, with the empty leading
-        and trailing segments a bounding pipe produces removed.
-    """
-    stripped_line = table_line.strip()
-    inner = stripped_line.strip("|")
-    return [each_cell.strip() for each_cell in inner.split("|")]
-
-
-def _first_backtick_token(cell_text: str) -> str | None:
-    """Return the first backtick-wrapped token in a cell, when it has one.
-
-    Args:
-        cell_text: The trimmed text of a table cell.
-
-    Returns:
-        The text inside the first pair of backticks, or None when the cell
-        carries no backtick-wrapped token.
-    """
-    token_match = BACKTICK_TOKEN_PATTERN.search(cell_text)
-    if token_match is None:
-        return None
-    inner_text = token_match.group(1).strip()
-    return inner_text or None
-
-
-def _env_var_name_in_cell(cell_text: str) -> str | None:
-    """Return the environment-variable name a cell names, when it names one.
-
-    Args:
-        cell_text: The trimmed text of a table cell.
-
-    Returns:
-        The UPPER_SNAKE variable name inside the first backticks, or None when
-        the cell names no variable-shaped token.
-    """
-    token = _first_backtick_token(cell_text)
-    if token is None:
-        return None
-    if ENV_VAR_NAME_PATTERN.match(token) is None:
-        return None
-    return token
-
-
-def _code_file_reference_in_cell(cell_text: str) -> str | None:
-    """Return the code-file path a cell names, when it names one.
-
-    Args:
-        cell_text: The trimmed text of a table cell.
-
-    Returns:
-        The relative code-file path inside the first backticks, or None when the
-        token carries no recognized code-file extension.
-    """
-    token = _first_backtick_token(cell_text)
-    if token is None:
-        return None
-    _, extension = os.path.splitext(token)
-    if extension.lower() not in ALL_CODE_FILE_EXTENSIONS:
-        return None
-    return token
-
-
-def _is_separator_row(all_cells: list[str]) -> bool:
-    """Return whether every cell is a markdown table header-separator cell.
-
-    Args:
-        all_cells: The trimmed cells of one table row.
-
-    Returns:
-        True when each cell holds only dashes, colons, and whitespace.
-    """
-    return all(SEPARATOR_CELL_PATTERN.match(each_cell) is not None for each_cell in all_cells)
-
-
 def _resolve_scan_root(markdown_directory: Path) -> Path:
     """Return the repository directory whose subtree bounds the code-file search.
 
@@ -248,8 +168,8 @@ def _code_file_reads_variable(code_file: Path, variable_name: str) -> bool | Non
 def find_drift_rows(content: str, markdown_directory: Path) -> list[str]:
     """Return each env-var table row whose code file does not read the variable.
 
-    Walks the markdown content line by line, skipping lines inside a fenced code
-    block. A table row counts when its first cell names an UPPER_SNAKE variable and
+    Reads environment-variable tables and headerless edit fragments outside code
+    fences. A row counts when its first cell names an UPPER_SNAKE variable and
     a later cell names a code file with a recognized extension. The row drifts when
     that code file resolves under the scan root yet its source never references the
     variable name; a row whose code file does not resolve, or cannot be read, is
@@ -266,15 +186,7 @@ def find_drift_rows(content: str, markdown_directory: Path) -> list[str]:
     scan_root = _resolve_scan_root(markdown_directory)
     drift_rows: list[str] = []
     already_reported: set[str] = set()
-    is_inside_code_fence = False
-    for each_line in content.splitlines():
-        if CODE_FENCE_PATTERN.match(each_line) is not None:
-            is_inside_code_fence = not is_inside_code_fence
-            continue
-        if is_inside_code_fence:
-            continue
-        if TABLE_ROW_PATTERN.match(each_line) is None:
-            continue
+    for each_line in iter_env_var_table_rows(content):
         each_finding = _drift_finding_for_row(each_line, scan_root)
         if each_finding is None or each_finding in already_reported:
             continue

package/hooks/blocking/env_var_table_rows.py

@@ -0,0 +1,130 @@
+"""Recognize Markdown environment-variable tables and parse their cells."""
+
+from __future__ import annotations
+
+import os
+from collections.abc import Iterator
+
+from hooks_constants.env_var_table_code_drift_constants import (
+    ALL_CODE_FILE_EXTENSIONS,
+    ALL_GENERIC_ENV_VAR_HEADERS,
+    BACKTICK_TOKEN_PATTERN,
+    CODE_FENCE_PATTERN,
+    ENV_VAR_HEADER_PATTERN,
+    ENV_VAR_HEADING_PATTERN,
+    ENV_VAR_NAME_PATTERN,
+    SEPARATOR_CELL_PATTERN,
+    TABLE_ROW_PATTERN,
+)
+
+
+def _row_cells(table_line: str) -> list[str]:
+    """Return the trimmed cells of one markdown table row.
+
+    Args:
+        table_line: A single line that begins with a pipe character.
+
+    Returns:
+        The text of each pipe-delimited cell, stripped, with the empty leading
+        and trailing segments a bounding pipe produces removed.
+    """
+    stripped_line = table_line.strip()
+    inner = stripped_line.strip("|")
+    return [each_cell.strip() for each_cell in inner.split("|")]
+
+
+def _first_backtick_token(cell_text: str) -> str | None:
+    """Return the first backtick-wrapped token in a cell, when it has one.
+
+    Args:
+        cell_text: The trimmed text of a table cell.
+
+    Returns:
+        The text inside the first pair of backticks, or None when the cell
+        carries no backtick-wrapped token.
+    """
+    token_match = BACKTICK_TOKEN_PATTERN.search(cell_text)
+    if token_match is None:
+        return None
+    inner_text = token_match.group(1).strip()
+    return inner_text or None
+
+
+def _env_var_name_in_cell(cell_text: str) -> str | None:
+    """Return the environment-variable name a cell names, when it names one.
+
+    Args:
+        cell_text: The trimmed text of a table cell.
+
+    Returns:
+        The UPPER_SNAKE variable name inside the first backticks, or None when
+        the cell names no variable-shaped token.
+    """
+    token = _first_backtick_token(cell_text)
+    if token is None:
+        return None
+    if ENV_VAR_NAME_PATTERN.match(token) is None:
+        return None
+    return token
+
+
+def _code_file_reference_in_cell(cell_text: str) -> str | None:
+    """Return the code-file path a cell names, when it names one.
+
+    Args:
+        cell_text: The trimmed text of a table cell.
+
+    Returns:
+        The relative code-file path inside the first backticks, or None when the
+        token carries no recognized code-file extension.
+    """
+    token = _first_backtick_token(cell_text)
+    if token is None:
+        return None
+    _, extension = os.path.splitext(token)
+    if extension.lower() not in ALL_CODE_FILE_EXTENSIONS:
+        return None
+    return token
+
+
+def _is_separator_row(all_cells: list[str]) -> bool:
+    """Return whether every cell is a markdown table header-separator cell.
+
+    Args:
+        all_cells: The trimmed cells of one table row.
+
+    Returns:
+        True when each cell holds only dashes, colons, and whitespace.
+    """
+    return all(SEPARATOR_CELL_PATTERN.match(each_cell) is not None for each_cell in all_cells)
+
+
+def iter_env_var_table_rows(content: str) -> Iterator[str]:
+    """Yield environment-table rows and headerless edit fragments outside code fences."""
+    is_inside_code_fence = False
+    is_environment_table: bool | None = None
+    is_environment_section = False
+    for each_line in content.splitlines():
+        if CODE_FENCE_PATTERN.match(each_line) is not None:
+            is_inside_code_fence = not is_inside_code_fence
+            is_environment_table = None
+            continue
+        if is_inside_code_fence:
+            continue
+        if each_line.lstrip().startswith("#"):
+            is_environment_section = ENV_VAR_HEADING_PATTERN.search(each_line) is not None
+        if TABLE_ROW_PATTERN.match(each_line) is None:
+            is_environment_table = None
+            continue
+        all_cells = _row_cells(each_line)
+        if not all_cells or _is_separator_row(all_cells):
+            continue
+        if is_environment_table is None:
+            header = all_cells[0].strip("`* ")
+            is_environment_table = (
+                ENV_VAR_HEADER_PATTERN.fullmatch(header) is not None
+                or _env_var_name_in_cell(all_cells[0]) is not None
+                or (is_environment_section and header.casefold() in ALL_GENERIC_ENV_VAR_HEADERS)
+            )
+        if is_environment_table:
+            yield each_line

package/hooks/blocking/msys_rev_path_rewriter.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+"""PreToolUse rewriter: keep Git Bash from converting a ``<rev>:<path>`` argument.
+
+Git Bash rewrites a git argument such as ``origin/main:.claude/settings.json``
+into a backslash-separated form joined by a semicolon before git sees it, and
+git then fails with ``fatal: ambiguous argument``. This hook reads the command
+before it runs, finds every token MSYS would convert, and prepends one
+``export MSYS2_ARG_CONV_EXCL='<rev1>:;<rev2>:'; `` naming exactly those
+prefixes. Every other argument in the command keeps converting as before.
+
+A token is converted only when the part before its first colon carries a slash
+and the part after that colon opens a repository-root path, so ``HEAD:.gitignore``
+and ``origin/main:packages/app.py`` both reach git untouched and neither is
+collected.
+
+Quiet branches, each emitting nothing: a non-Bash tool, a command that already
+names one of the MSYS conversion variables, and a command from which no prefix
+was collected.
+
+Hosted by ``blocking/bash_pre_tool_use_dispatcher.py``, which carries the
+``updatedInput`` this hook prints through to the harness.
+"""
+
+from __future__ import annotations
+
+import shlex
+import sys
+from pathlib import Path
+
+try:
+    _hooks_root_directory = str(Path(__file__).resolve().parent.parent)
+    if _hooks_root_directory not in sys.path:
+        sys.path.insert(0, _hooks_root_directory)
+    from hooks_constants.bash_pre_tool_use_dispatcher_constants import BASH_TOOL_NAME
+    from hooks_constants.msys_path_conversion_advisor_constants import (
+        ALL_MSYS_PATH_CONVERSION_VARIABLE_NAMES,
+    )
+    from hooks_constants.msys_rev_path_rewriter_constants import (
+        ALL_CONVERTED_PATH_START_CHARACTERS,
+        ALL_REVISION_FORBIDDEN_CHARACTERS,
+        ALL_UNCONVERTED_PATH_START_PREFIXES,
+        EXCLUSION_EXPORT_TEMPLATE,
+        EXCLUSION_PREFIX_JOIN_SEPARATOR,
+        GIT_PROGRAM_NAME,
+        REVISION_PATH_SEPARATOR,
+        REVISION_PATH_SPLIT_COUNT,
+        REVISION_SLASH_CHARACTER,
+    )
+    from hooks_constants.pre_tool_use_allow_output import (
+        write_pre_tool_use_allow_to_stdout,
+    )
+    from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+    from hooks_constants.shell_command_segments import (
+        effective_leading_program,
+        split_into_segments,
+        token_basename,
+    )
+except ImportError as import_error:
+    raise ImportError(
+        "The MSYS revision-path rewriter cannot import its dependencies; "
+        "ensure the hooks directory is importable."
+    ) from import_error
+
+
+def _all_git_segment_tokens(command: str) -> list[list[str]]:
+    """Return the token lists of the command's segments that run git."""
+    try:
+        all_command_tokens = shlex.split(command, posix=True)
+    except ValueError:
+        all_command_tokens = command.split()
+    all_git_segments: list[list[str]] = []
+    for each_segment in split_into_segments(all_command_tokens):
+        program_token = effective_leading_program(each_segment)
+        if program_token is None:
+            continue
+        if token_basename(program_token) == GIT_PROGRAM_NAME:
+            all_git_segments.append(each_segment)
+    return all_git_segments
+
+
+def _is_revision_shaped(revision_text: str) -> bool:
+    """Return True when the text can name a git revision.
+
+    ::
+
+        origin/main                 -> True
+        HEAD                        -> False, no slash
+        don't touch a/b             -> False, a quoted message, not a revision
+
+    Args:
+        revision_text: The part of a token before its first colon.
+    """
+    if not revision_text or REVISION_SLASH_CHARACTER not in revision_text:
+        return False
+    if any(each_character.isspace() for each_character in revision_text):
+        return False
+    return not any(
+        each_character in revision_text for each_character in ALL_REVISION_FORBIDDEN_CHARACTERS
+    )
+
+
+def _converted_revision_prefix(token: str) -> str | None:
+    """Return the ``<rev>:`` prefix MSYS would convert in this token, or None.
+
+    Args:
+        token: One shell token from a git segment.
+    """
+    if REVISION_PATH_SEPARATOR not in token:
+        return None
+    revision_text, path_text = token.split(REVISION_PATH_SEPARATOR, REVISION_PATH_SPLIT_COUNT)
+    if not _is_revision_shaped(revision_text):
+        return None
+    if not path_text.startswith(ALL_CONVERTED_PATH_START_CHARACTERS):
+        return None
+    if path_text.startswith(ALL_UNCONVERTED_PATH_START_PREFIXES):
+        return None
+    return revision_text + REVISION_PATH_SEPARATOR
+
+
+def _extend_with_new_prefixes(
+    all_ordered_prefixes: list[str], all_segment_tokens: list[str]
+) -> None:
+    """Append each convertible prefix this segment adds, skipping repeats.
+
+    Args:
+        all_ordered_prefixes: The prefixes collected so far, appended in place.
+        all_segment_tokens: One git segment's shell tokens.
+    """
+    for each_token in all_segment_tokens:
+        revision_prefix = _converted_revision_prefix(each_token)
+        if revision_prefix is not None and revision_prefix not in all_ordered_prefixes:
+            all_ordered_prefixes.append(revision_prefix)
+
+
+def all_exclusion_prefixes(command: str) -> tuple[str, ...]:
+    """Return the ``<rev>:`` prefixes MSYS would convert, deduplicated in order.
+
+    Args:
+        command: The Bash command text the agent is about to run.
+
+    Returns:
+        Each distinct prefix in first-appearance order, empty when the command
+        carries no token Git Bash would convert.
+    """
+    all_ordered_prefixes: list[str] = []
+    for each_segment in _all_git_segment_tokens(command):
+        _extend_with_new_prefixes(all_ordered_prefixes, each_segment)
+    return tuple(all_ordered_prefixes)
+
+
+def command_with_exclusion_export(command: str) -> str:
+    """Return the command prefixed with the surgical exclusion export.
+
+    Returns the command unchanged when it already names an MSYS conversion
+    variable or when no convertible token was found.
+
+    Args:
+        command: The Bash command text the agent is about to run.
+    """
+    if any(
+        each_variable_name in command
+        for each_variable_name in ALL_MSYS_PATH_CONVERSION_VARIABLE_NAMES
+    ):
+        return command
+    all_prefixes = all_exclusion_prefixes(command)
+    if not all_prefixes:
+        return command
+    export_prefix = EXCLUSION_EXPORT_TEMPLATE.format(
+        all_prefixes=EXCLUSION_PREFIX_JOIN_SEPARATOR.join(all_prefixes)
+    )
+    return export_prefix + command
+
+
+def main() -> None:
+    """Emit an allow carrying the exclusion-prefixed command, or stay quiet."""
+    hook_payload = read_hook_input_dictionary_from_stdin()
+    if hook_payload is None or hook_payload.get("tool_name") != BASH_TOOL_NAME:
+        return
+    tool_input = hook_payload.get("tool_input")
+    if not isinstance(tool_input, dict):
+        return
+    command = tool_input.get("command", "")
+    if not isinstance(command, str):
+        return
+    rewritten_command = command_with_exclusion_export(command)
+    if rewritten_command == command:
+        return
+    write_pre_tool_use_allow_to_stdout({**tool_input, "command": rewritten_command})
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/pii_scanner.py

@@ -18,10 +18,9 @@ if _hooks_directory not in sys.path:
     sys.path.insert(0, _hooks_directory)
 
 from hooks_constants.local_identity import nas_host  # noqa: E402
-from hooks_constants.pii_prevention_constants import (  # noqa: E402
+from hooks_constants.pii_prevention_constants import (
     ALL_ALLOWLISTED_PRIVATE_IP_ADDRESSES,
     ALL_EXACT_LEGAL_NOTICE_BASENAMES,
-    ALL_HOME_DIRECTORY_PATH_MARKERS,
     ALL_PLACEHOLDER_HOME_USERNAMES,
     ALL_REDACTED_PREVIEW_CATEGORIES,
     ALL_RFC1918_NETWORK_CIDRS,
@@ -37,6 +36,8 @@ from hooks_constants.pii_prevention_constants import (  # noqa: E402
     CONFTEST_BASENAME,
     EMAIL_PATTERN,
     HOME_PATH_PATTERN,
+    HOME_USERNAME_MARKER_PATTERN,
+    INTERPOLATED_HOME_USERNAME_PATTERN,
     IPV4_PATTERN,
     IPV4_VERSION_NUMBER,
     MAXIMUM_FINDINGS_PER_SCAN,
@@ -90,9 +91,7 @@ def is_path_exempt_from_pii_scan(file_path: str) -> bool:
         return False
     normalized_path = file_path.replace("\\", "/").lower()
     path_for_suffix_match = (
-        normalized_path
-        if normalized_path.startswith("/")
-        else f"/{normalized_path}"
+        normalized_path if normalized_path.startswith("/") else f"/{normalized_path}"
     )
     basename = os.path.basename(file_path)
     basename_lower = basename.lower()
@@ -106,9 +105,7 @@ def is_path_exempt_from_pii_scan(file_path: str) -> bool:
         or basename_lower.endswith(TEST_MODULE_BASENAME_SUFFIX)
     ):
         return True
-    if TESTS_PATH_SEGMENT in normalized_path or normalized_path.startswith(
-        TESTS_PATH_PREFIX
-    ):
+    if TESTS_PATH_SEGMENT in normalized_path or normalized_path.startswith(TESTS_PATH_PREFIX):
         return True
     if basename_lower.endswith(ALL_SOURCE_TEST_FILE_SUFFIXES) and (
         SPEC_BASENAME_MARKER in basename_lower or TEST_BASENAME_MARKER in basename_lower
@@ -130,11 +127,7 @@ def _redact_sensitive_preview(matched_text: str) -> str:
         return REDACTED_SHORT_PREVIEW
     prefix_length = REDACTED_PREVIEW_PREFIX_LENGTH
     suffix_length = REDACTED_PREVIEW_SUFFIX_LENGTH
-    return (
-        matched_text[:prefix_length]
-        + REDACTED_PREVIEW_ELLIPSIS
-        + matched_text[-suffix_length:]
-    )
+    return matched_text[:prefix_length] + REDACTED_PREVIEW_ELLIPSIS + matched_text[-suffix_length:]
 
 
 def _build_preview(matched_text: str, category: str) -> str:
@@ -161,8 +154,7 @@ def _is_safe_email_domain(domain_name: str) -> bool:
     if domain_name in ALL_SAFE_EMAIL_DOMAINS:
         return True
     return any(
-        domain_name.endswith("." + each_safe_domain)
-        for each_safe_domain in ALL_SAFE_EMAIL_DOMAINS
+        domain_name.endswith("." + each_safe_domain) for each_safe_domain in ALL_SAFE_EMAIL_DOMAINS
     )
 
 
@@ -180,8 +172,8 @@ def _home_username_offset(matched_path: str) -> tuple[int, str] | None:
 
         C:\\Users\\Users\\file.txt  ->  (9, "Users")   the second Users, not the first
 
-    Replacing backslashes with forward slashes preserves length, so the marker
-    offset computed on the normalized path indexes *matched_path* directly.
+    The marker match consumes repeated separators, so the username starts after
+    both ordinary and escaped Windows path separators.
 
     Args:
         matched_path: The matched home-path substring.
@@ -189,18 +181,14 @@ def _home_username_offset(matched_path: str) -> tuple[int, str] | None:
     Returns:
         The username's start index and value, or None when no marker is found.
     """
-    normalized_path = matched_path.replace("\\", "/")
-    lowered_path = normalized_path.lower()
-    for each_marker in ALL_HOME_DIRECTORY_PATH_MARKERS:
-        marker_index = lowered_path.find(each_marker)
-        if marker_index < 0:
-            continue
-        username_start = marker_index + len(each_marker)
-        username = normalized_path[username_start:].split("/", 1)[0]
-        if not username:
-            return None
-        return username_start, username
-    return None
+    marker = HOME_USERNAME_MARKER_PATTERN.search(matched_path)
+    if marker is None:
+        return None
+    username_start = marker.end()
+    username = matched_path[username_start:].replace("\\", "/").split("/", 1)[0]
+    if not username:
+        return None
+    return username_start, username
 
 
 def _username_from_home_path(matched_path: str) -> str | None:
@@ -226,6 +214,8 @@ def _redact_home_path_username(matched_text: str) -> str:
 
 
 def _is_placeholder_home_username(username: str) -> bool:
+    if INTERPOLATED_HOME_USERNAME_PATTERN.fullmatch(username) is not None:
+        return True
     if ANGLE_BRACKET_PLACEHOLDER_PATTERN.match(username) is not None:
         return True
     lowered_username = username.lower()

package/hooks/blocking/test_bash_dispatcher_interpreter_starts.py

@@ -1,4 +1,10 @@
-"""Tests for the retired Bash and PowerShell blocking roster."""
+"""Tests for what the Bash and PowerShell PreToolUse chain costs to run.
+
+A Bash tool call starts one interpreter, the dispatcher's own. Each roster
+entry then runs in that process through runpy, so the roster's exact content is
+the chain's cost after that single start. One allow-and-rewrite hook is the
+whole roster; a blocking hook added here fails this test.
+"""
 
 import sys
 from pathlib import Path
@@ -9,8 +15,15 @@ if str(_HOOKS_ROOT) not in sys.path:
 
 from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
     ALL_BASH_HOSTED_HOOK_ENTRIES,
+    ALL_BASH_ONLY_TOOL_NAMES,
+    BashHostedHookEntry,
 )
 
 
-def test_retired_bash_roster_has_no_effective_blocking_hooks() -> None:
-    assert ALL_BASH_HOSTED_HOOK_ENTRIES == ()
+def test_bash_roster_starts_only_the_msys_rewriter_and_no_blocking_hook() -> None:
+    assert ALL_BASH_HOSTED_HOOK_ENTRIES == (
+        BashHostedHookEntry(
+            script_relative_path="blocking/msys_rev_path_rewriter.py",
+            applicable_tool_names=ALL_BASH_ONLY_TOOL_NAMES,
+        ),
+    )

package/hooks/blocking/test_bash_post_call_dispatcher.py

@@ -28,6 +28,7 @@ from tdd_enforcer_parts import content_hash_store
 _ALL_EXPECTED_ROSTER_PATHS = [
     "observability/test_failure_recorder.py",
     "advisory/pr_done_reminder.py",
+    "advisory/msys_path_conversion_advisor.py",
 ]
 
 
@@ -66,6 +67,7 @@ def test_dispatch_forwards_hosted_hook_additional_context_as_one_payload(
         "pr_done_reminder.py": json.dumps(
             {"hookSpecificOutput": {"hookEventName": "PostToolUse", "additionalContext": "PR #42"}}
         ),
+        "msys_path_conversion_advisor.py": "",
     }
 
     def _fake_run_hook(script_path: str, payload_text: str) -> HostedHookRun: