claude-dev-env 8.106.1 → 8.106.3

package/hooks/features/conduct-gates.md

@@ -4,11 +4,11 @@ This family stops a chat reply, edited message, or tool call when its payload br
 
 ## Checks
 
-- `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link. It denies a sentence that guesses, estimates, hedges a duration, or admits a skipped check, such as "I didn't confirm this one." It denies a cited Actions run, pull request, or run, job, or check id that no successful tool result in the transcript shows; a subagent's report is the result of its Agent call. A question card from `AskUserQuestion` gets the banned word check and `unvalidated_claim_violation`, like a decision card. With visual reply mode on, it also runs the checks in `visual_reply_rules.py` from the rule list in `rules/visual-reply-rules.json`: no abbreviation or tracker number outside a link, a widget or page before a reply of more than one sentence, and no anchor link inside widget code. The mode is off by default; `~/.claude/visual-reply-mode.json` with `{"enabled": true}` turns the mode checks on.
+- `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link. It denies a sentence that guesses, estimates, hedges a duration, or admits a skipped check, such as "I didn't confirm this one." It denies a cited Actions run, pull request, or run, job, or check id that no successful tool result in the transcript shows; a subagent's report is the result of its Agent call. A question card from `AskUserQuestion` gets the banned word check and `unvalidated_claim_violation`, like a decision card. One refusal names every broken rule and every offending sentence, numbered, and ends with "Fix every item above in your next write." With visual reply mode on, it also runs the checks in `visual_reply_rules.py` from the rule list in `rules/visual-reply-rules.json`: no abbreviation or tracker number outside a link, a widget or page before a reply of more than one sentence, and no anchor link inside widget code. The mode is off by default; `~/.claude/visual-reply-mode.json` with `{"enabled": true}` turns the mode checks on.
 - `blocking/final_reply_gate.py` applies the banned words, `unvalidated_claim_violation`, and `unseen_citation_violation` from the reply gate to the reply a session ends its turn with. Its `windows_path_violation` blocks a path the terminal would render without one of its backslashes.
 - `blocking/open_tasks_stop_gate.py` holds the end of a turn once when the prompt that started it asks for work, the turn ran a work tool, and the turn made no tracker call: TaskCreate, TaskUpdate, TodoWrite, the Codex `update_plan`, or the desktop `mcp__ccd_turn__update_plan`. A work tool is any tool but a tracker call, the session title tool, `AskUserQuestion`, a hearthbot decision card, Codex `request_user_input`, `ToolSearch`, `TaskList`, or `TaskGet`. It never reads the reply text. `open_task_asks.is_ask` decides whether a prompt asks for work: a question-only prompt, an acknowledgement such as `thanks!`, an empty prompt, a prompt of only `<system-reminder>` blocks, and an envelope such as `<agent-message>` or `<task-notification>` do not. `blocking/open_tasks_transcript.py` replays the transcript for it: the turn's prompt, its tool calls, and the task list. `session_task_items` merges the task store with the transcript items whose subject the store does not hold, for the session title gate.
 - `session/tracking_nudge.py` adds one `additionalContext` note to a prompt that asks for work. The note asks for a task list item. When the title shows the red flag or the check mark, it also asks for the hourglass before other work. It never blocks.
-- The claim judge is a `prompt` hook in `hooks.json`, with no `model` set, so Claude Code's small default hook model reads each chat message and denies the first claim about how code, a file, a tool, a service, a run, or a process behaves, or why something happened, when nothing in the message shows it: inline code that quotes output or a code line, a file and line, or a link. A pull request link covers what that change does, what it blocks or lets through, and its checks. The author's own actions, a restatement of the user's words, questions, instructions, and a decision card's option consequences pass. It catches the plain claims the causal word list in `blocking/reply_length_gate.py` misses, such as "The code lets any of them rewrite it mid-check." `continueOnBlock` returns the reason to the agent as the tool error, so it can add the source and send again. The installer owns it through the `claude-dev-env: ` prefix on its `statusMessage`. It skips `post_widget`, whose input is SVG or HTML markup.
+- The claim judge is a `prompt` hook in `hooks.json`, with no `model` set, so Claude Code's small default hook model reads each chat message and denies every claim, numbered in one refusal, about how code, a file, a tool, a service, a run, or a process behaves, or why something happened, when nothing in the message shows it: inline code that quotes output or a code line, a file and line, or a link. A pull request link covers what that change does, what it blocks or lets through, and its checks. The author's own actions, a restatement of the user's words, questions, instructions, and a decision card's option consequences pass. It catches the plain claims the causal word list in `blocking/reply_length_gate.py` misses, such as "The code lets any of them rewrite it mid-check." `continueOnBlock` returns the reason to the agent as the tool error, so it can add the source and send again. The installer owns it through the `claude-dev-env: ` prefix on its `statusMessage`. It skips `post_widget`, whose input is SVG or HTML markup.
 - `blocking/chat_reply_gate.py` runs the `reply_length_gate.py` reply checks on a plain chat reply, which is no tool call. On `UserPromptSubmit` it adds the reply rules as `additionalContext`. On `MessageDisplay` it holds each streamed batch until the message ends. A message that passes shows whole. A message that fails shows as a draft from `claude -p` on Haiku that passes the same checks, and the original shows when two drafts fail. The draft changes only the text on screen, so the next `UserPromptSubmit` tells the agent the text the user saw, and `SessionEnd` deletes the stored draft. The [reply arena harness](https://github.com/jl-cmd-projects/claude-dev-env/tree/160349b90f627ea542fc6bc7b2b7f86dcbf98b73/tests/reply_arena) ran the comparison that chose this display path.
 - `blocking/edit_marker_gate.py` rejects strikethrough and edit-note markers in replacement chat text or cards.
 - `blocking/issue_close_handoff_gate.py` denies an issue comment or issue write that closes the issue and routes a found defect to another issue or epic.
@@ -63,7 +63,7 @@ Preconditions:
 - **Final reply.** Input is a closing reply that says "My guess is one to two hours." or cites a run no tool result shows. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_final_reply_gate.py -q`. The adjacent test observes a `block` decision that quotes the sentence or the citation; a reply that cites a run a tool result shows passes. A reply with a plain-text `D:\Reports\.claude\report.html` is blocked; the same path in backticks or a fenced block passes.
 - **Open tasks.** Input is a transcript whose last prompt asks for work and whose turn ran a Bash call and no tracker call. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_open_tasks_stop_gate.py -q`. The adjacent test observes one `block` decision; the same turn with a TaskCreate, TaskUpdate, TodoWrite, or desktop plan call passes. A question, an acknowledgement, a `<task-notification>` envelope, a tool-free turn, and a held stop pass. The same file covers Codex and Cursor payloads.
 - **Ask nudge.** Input is a `UserPromptSubmit` payload with a work prompt, a question, and a `<task-notification>` envelope, after a transcript whose title shows the red flag. Run `python -m pytest packages/claude-dev-env/hooks/session/test_tracking_nudge.py -q`. The adjacent test observes a task list note and a title note for the work prompt, and empty stdout for the other two.
-- **Claim judge.** Input is a headless `claude -p` session with a stub MCP server named `hearthbot` that exposes `reply` and `ask_decision`, told to send "The code lets any of them rewrite it mid-check." The session settings add the `hooks.json` prompt hook. The stub logs zero bytes sent, and the tool error reads `PreToolUse:mcp__hearthbot__reply hook error: [<the prompt>]: Fact with no source: ...`. The same sentence with a `file:line` in backticks posts. A hook whose `model` Claude Code does not recognize lets every message through, so leave `model` unset. Run `node --test packages/claude-dev-env/bin/install.prompt-hook.test.mjs` for the installer side; it observes one managed prompt hook after two installs and none after uninstall.
+- **Claim judge.** Input is a headless `claude -p` session with a stub MCP server named `hearthbot` that exposes `reply` and `ask_decision`, told to send "The code lets any of them rewrite it mid-check." The session settings add the `hooks.json` prompt hook. The stub logs zero bytes sent, and the tool error reads `PreToolUse:mcp__hearthbot__reply hook error: [<the prompt>]: Facts with no source: 1. ...`, numbering every failing claim. The same sentence with a `file:line` in backticks posts. A hook whose `model` Claude Code does not recognize lets every message through, so leave `model` unset. Run `node --test packages/claude-dev-env/bin/install.prompt-hook.test.mjs` for the installer side; it observes one managed prompt hook after two installs and none after uninstall.
 - **Chat reply.** Input is a `MessageDisplay` event whose message holds four sentences, the same message split over two batches, and a `UserPromptSubmit` event. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_chat_reply_gate.py -q`. The adjacent test observes the drafter's text in `displayContent`, an empty first batch, no output for three sentences, the original after two failed drafts, the shown draft in the next `additionalContext`, and the stored draft deleted at session end.
 - **Edit marker.** Input is an update message with strikethrough or an edit note. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_edit_marker_gate.py -q`. The adjacent test observes a denial; clean replacement text passes.
 - **Handoff close.** Input is an issue comment that says the issue is closed and that the found defect belongs to another issue. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_issue_close_handoff_gate.py -q`. The adjacent test observes a denial; a close with a plain cross-reference and a routing comment on an open issue both pass.

package/hooks/features/lifecycle-cleanup.md

@@ -4,7 +4,7 @@ This family runs nested checkout hooks, refreshes a worktree base, and clears st
 
 ## Checks
 
-- `lifecycle/nested_project_hooks.py` runs hook registrations from checkouts nested one level below a session directory.
+- `lifecycle/nested_project_hooks.py` runs hook registrations from checkouts nested one level below a session directory. When several nested hooks refuse a tool call, the one refusal it returns carries every refusing hook's reason.
 - `lifecycle/enter_worktree_origin_prefetch.py` fetches the default branch before a fresh worktree is created.
 - `lifecycle/session_end_cleanup.py` removes old context cache files, temporary files, and transcript backups at session end.
 - `session/plugin_data_dir_cleanup.py` removes empty plugin data directories at session start.
@@ -34,7 +34,7 @@ Preconditions:
 
 ## Gotchas
 
-- The nested checkout runner forwards child denials and asks. It drops child allow decisions so a child cannot widen permission.
+- The nested checkout runner forwards child denials and asks, a denial ahead of an ask. It drops child allow decisions so a child cannot widen permission.
 - Worktree prefetch applies to fresh creation and exits zero after a failed fetch.
 - Session-end cleanup has no adjacent behavior test. Its direct probe calls `purge_old_entries` with an isolated directory.
 - The session edit tracker survives a compact or resume. Cleanup targets the current session only.

package/hooks/features/observability.md

@@ -1,18 +1,16 @@
 # Observability
 
-This family records instruction loads and file edits for later checks. Delegation also clears the lead session's investigation timer so the agent can continue its investigation.
+This family records instruction loads and file edits for later checks.
 
 ## Checks
 
 - `observability/instructions_loaded_logger.py` writes selected instruction-load fields to a JSONL log.
 - `observability/session_file_edit_tracker.py` records edited file paths in a per-session tracker for the stage gate.
-- `workflow/investigation_tracker_reset.py` clears the investigation tracker after delegation.
 
 ## When it fires
 
 - `observability/instructions_loaded_logger.py` runs on `InstructionsLoaded`, matcher `session_start|nested_traversal|path_glob_match|include|compact`, timeout `10` seconds in `hooks.json`.
 - `observability/session_file_edit_tracker.py` runs on `PostToolUse`, matcher `Write|Edit|MultiEdit|apply_patch`, timeout `30` seconds in `hooks.json`.
-- `workflow/investigation_tracker_reset.py` runs on `PostToolUse`, matcher `Agent|Task|TeamCreate`, timeout `30` seconds in `hooks.json`.
 
 ## Proving it
 
@@ -22,10 +20,8 @@ Preconditions:
 
 - **Instruction log.** Input is an `InstructionsLoaded` payload with a file path and load reason. Run `python -m pytest packages/claude-dev-env/hooks/observability/test_instructions_loaded_logger.py -q`. The adjacent test observes one JSONL record with the selected fields.
 - **Edit tracker.** Input is a Write payload with a file path and session ID. Run `python -m pytest packages/claude-dev-env/hooks/observability/test_session_file_edit_tracker.py -q`. The adjacent test observes the resolved path in that session's tracker.
-- **Investigation reset.** Input is a completed Agent, Task, or TeamCreate call. Run `python -m pytest packages/claude-dev-env/hooks/workflow/test_investigation_tracker_reset.py -q`. The adjacent test observes removal of the tracker file.
 
 ## Gotchas
 
 - The instruction logger keeps only selected payload fields. It exits zero if logging fails.
 - The edit tracker never blocks a tool call. Its per-session file is read later by the stage gate.
-- The investigation reset applies to delegation tools. Its companion investigation gate lives outside this Claude hook registration map.

package/hooks/features/session-context.md

@@ -1,6 +1,6 @@
 # Session context
 
-This family injects reminders and task guidance when an agent starts, resumes, submits a prompt, spawns a helper, starts an artifact page, or hits an auto mode denial. The startup scripts leave the session quiet when their opt-in conditions fail.
+This family injects reminders and task guidance when an agent starts, resumes, submits a prompt, starts a workflow helper, starts an artifact page, or hits an auto mode denial. The startup scripts leave the session quiet when their opt-in conditions fail.
 
 ## Checks
 
@@ -17,7 +17,7 @@ This family injects reminders and task guidance when an agent starts, resumes, s
 
 ## When it fires
 
-- `session/skill_loaded_reminder.py` runs on `PreToolUse` matcher `Agent|Task` at `10` seconds, `UserPromptSubmit` matcher empty at `10` seconds, `SessionStart` matcher `compact` at `10` seconds, and `SubagentStart` matcher `workflow-subagent` at `10` seconds in `hooks.json`.
+- `session/skill_loaded_reminder.py` runs on `UserPromptSubmit` matcher empty at `10` seconds, `SessionStart` matcher `compact` at `10` seconds, and `SubagentStart` matcher `workflow-subagent` at `10` seconds in `hooks.json`.
 - `session/compaction_recall_prompt.py` runs on `SessionStart` matcher `compact` at `10` seconds in `hooks.json`. The installer also writes it to the Codex `hooks.json`, the only `SessionStart` hook Codex gets.
 - `session/task_tool_prompt.py`, `session/working_style_prompt.py`, `session/advisor_rules_prompt.py`, and `session/orchestrator_auto_starter.py` run on `SessionStart`, matcher empty, timeout `10` seconds each in `hooks.json`.
 - `session/plugin_session_baseline_writer.py` runs on `SessionStart`, matcher empty, at `10` seconds, so it sees every source. `session/plugin_change_warning.py` runs on `UserPromptSubmit`, matcher empty, at `10` seconds in `hooks.json`.
@@ -30,7 +30,7 @@ Preconditions:
 
 - Run each command from the repository root with Python and pytest available. Enable opt-in flags only inside the tests.
 
-- **Skill reminder.** Input is a helper spawn whose prompt lacks poteto-mode. Run `python -m pytest packages/claude-dev-env/hooks/session/test_skill_loaded_reminder.py -q`. The adjacent test observes the reminder and leaves an already prepared prompt unchanged.
+- **Skill reminder.** Input is a compaction, a user turn, or a workflow helper start. Run `python -m pytest packages/claude-dev-env/hooks/session/test_skill_loaded_reminder.py -q`. The adjacent test observes the reminder, silence on a spawn payload, and no `PreToolUse` registration in `hooks.json`.
 - **Compaction recall.** Input is a Claude Code transcript or a Codex rollout with typed, meta, sidechain, peer, and harness entries across a compaction. Run `python -m pytest packages/claude-dev-env/hooks/session/test_compaction_user_messages.py packages/claude-dev-env/hooks/session/test_compaction_trim.py packages/claude-dev-env/hooks/session/test_compaction_recall_prompt.py packages/claude-dev-env/hooks/session/test_compaction_trim_eval.py -q`. The tests observe only typed messages, a stable result across a second compaction, the trim rules, the recall budget, and the trimmed lines in the hook's `additionalContext`. `python packages/claude-dev-env/hooks/session/compaction_trim_eval.py` trims each fixture transcript with planted facts, prints the share of facts that survive, the reversals marked, and the compression ratio, and exits 1 on any loss.
 - **Task tracking.** Input is a SessionStart event. Run `python -m pytest packages/claude-dev-env/hooks/session/test_task_tool_prompt.py -q`. The adjacent test observes a `SessionStart` context directive that names the task tool.
 - **Working style.** Input is a SessionStart event. Run `python -m pytest packages/claude-dev-env/hooks/session/test_working_style_prompt.py -q`. The adjacent test observes the fixed context text.
@@ -44,7 +44,7 @@ Preconditions:
 
 - The recall keeps the first message and the newest that fit in 6,000 characters, under the 2,500 token preview limit Codex applies to hook context. A message over 1,500 characters is cut, and the line says how much was left out.
 - The overruled mark comes from cue phrases such as `instead` or `change of plan` and shared words. A reversal with no cue phrase gets no mark, and the later line still overrides by its place. A cue in a message that agrees with an earlier one, such as `dont use haiku` after `use Python trim instead of Haiku`, marks that earlier line too, so the context tells the agent to follow the later message where the two differ.
-- `session/skill_loaded_reminder.py` has four registration points. Its tests cover helper prompt rewriting and repeated prompt suppression.
+- `session/skill_loaded_reminder.py` has three registration points. An `Agent` or `Task` helper gets no poteto-mode line from it; a brief that needs the skill names it, or spawns `pstack:poteto-agent`. Its tests cover the compaction restore, the workflow helper reminder, silence on a user turn while the skill stays loaded, silence on a spawn payload, and no `PreToolUse` registration in `hooks.json`.
 - The advisor prompt depends on settings and an environment disable flag. The two starter scripts each use separate opt-in checks.
 - The issue tracker starter requires the checkout to appear in the project path registry.
 - `advisory/auto_mode_denial_quick_fix.py` lives under `advisory/` but belongs here because its only output is agent context and a one-line user message.

package/hooks/hooks.json

@@ -5,11 +5,6 @@
       {
         "matcher": "Agent|Task",
         "hooks": [
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/skill_loaded_reminder.py",
-            "timeout": 10
-          },
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/haiku_spawn_slim_gate.py",
@@ -187,7 +182,7 @@
         "hooks": [
           {
             "type": "prompt",
-            "prompt": "You check one chat message before it posts. The hook input JSON is: $ARGUMENTS\n\nRead the message prose in tool_input: the text, body, question, context, reason, and option fields. Find each claim the message states as fact about how code, a file, a tool, a service, a run, or a process behaves, what state it is in, or why something happened.\n\nA claim passes when the message carries evidence that shows it: inline code that quotes output, an exit code, a count, a log line, or a code line; a file:line reference; or a URL or markdown link to the run, file, pull request, or page. A pull request or commit link covers what that change does, what it blocks or lets through, and the state of its checks, also in the later sentences about that same change. The evidence may sit in another sentence of the same message when it covers that claim. A link to one thing does not cover a claim about something else.\n\nThese pass with no evidence: the author's own actions, done, in progress, or planned, with or without \"I\", including what the action is aimed at, such as \"I'm finding where the check failed\"; a change the author made; a question; an instruction or request; a restatement of what the user said; and an option's consequence on a decision card.\n\nWhen every claim passes, return {\"ok\": true}. Otherwise return {\"ok\": false, \"reason\": \"Fact with no source: <the first failing claim>. Put the file:line, the quoted output, or the link that shows it in the message, run the check first, or leave the claim out.\"}",
+            "prompt": "You check one chat message before it posts. The hook input JSON is: $ARGUMENTS\n\nRead the message prose in tool_input: the text, body, question, context, reason, and option fields. Find each claim the message states as fact about how code, a file, a tool, a service, a run, or a process behaves, what state it is in, or why something happened.\n\nA claim passes when the message carries evidence that shows it: inline code that quotes output, an exit code, a count, a log line, or a code line; a file:line reference; or a URL or markdown link to the run, file, pull request, or page. A pull request or commit link covers what that change does, what it blocks or lets through, and the state of its checks, also in the later sentences about that same change. The evidence may sit in another sentence of the same message when it covers that claim. A link to one thing does not cover a claim about something else.\n\nThese pass with no evidence: the author's own actions, done, in progress, or planned, with or without \"I\", including what the action is aimed at, such as \"I'm finding where the check failed\"; a change the author made; a question; an instruction or request; a restatement of what the user said; and an option's consequence on a decision card.\n\nWhen every claim passes, return {\"ok\": true}. Otherwise return {\"ok\": false, \"reason\": \"Facts with no source: 1. <first failing claim> 2. <second failing claim> ... For each, put the file:line, the quoted output, or the link that shows it in the message, run the check first, or leave the claim out. Fix every item above in your next write.\"} List every failing claim, numbered in message order, never only the first.",
             "timeout": 30,
             "continueOnBlock": true,
             "statusMessage": "claude-dev-env: checking each claim for its source"
@@ -526,16 +521,6 @@
           }
         ]
       },
-      {
-        "matcher": "Agent|Task|TeamCreate",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/workflow/investigation_tracker_reset.py",
-            "timeout": 30
-          }
-        ]
-      },
       {
         "matcher": "Bash|PowerShell",
         "hooks": [

package/hooks/hooks_constants/hook_specific_output_keys.py

@@ -6,10 +6,12 @@ __all__ = [
     "HOOK_SPECIFIC_OUTPUT_KEY",
     "HOOK_EVENT_NAME_KEY",
     "PERMISSION_DECISION_KEY",
+    "PERMISSION_DECISION_REASON_KEY",
     "UPDATED_INPUT_KEY",
 ]
 
 HOOK_SPECIFIC_OUTPUT_KEY: str = "hookSpecificOutput"
 HOOK_EVENT_NAME_KEY: str = "hookEventName"
 PERMISSION_DECISION_KEY: str = "permissionDecision"
+PERMISSION_DECISION_REASON_KEY: str = "permissionDecisionReason"
 UPDATED_INPUT_KEY: str = "updatedInput"

package/hooks/hooks_constants/nested_project_hooks_constants.py

@@ -31,6 +31,8 @@ ALL_SHELL_PROGRAM_NAMES: tuple[str, ...] = ("bash", "sh")
 SHELL_COMMAND_FLAG: str = "-c"
 
 BLOCKING_EXIT_CODE: int = 2
-ALL_FORWARDED_PERMISSION_DECISIONS: frozenset[str] = frozenset({"deny", "ask"})
+DENY_PERMISSION_DECISION: str = "deny"
+ASK_PERMISSION_DECISION: str = "ask"
+ALL_FORWARDED_PERMISSION_DECISIONS: tuple[str, ...] = (DENY_PERMISSION_DECISION, ASK_PERMISSION_DECISION)
 ADDITIONAL_CONTEXT_KEY: str = "additionalContext"
 CONTEXT_SECTION_SEPARATOR: str = "\n\n"

package/hooks/hooks_constants/reply_length_gate_constants.py

@@ -44,6 +44,8 @@ SENTENCE_PREVIEW_WORD_COUNT = 6
 WORD_SEPARATOR = " "
 SENTENCE_PREVIEW_SUFFIX = "..."
 RETRY_INSTRUCTION = " Cut the text and resend the call."
+FIX_EVERY_ITEM_INSTRUCTION = " Fix every item above in your next write."
+FINDING_SEPARATOR = "\n"
 TOO_MANY_SENTENCES_MESSAGE = "Reply too long: {sentence_count} sentences, limit {sentence_limit}."
 CARD_CONTEXT_TOO_LONG_MESSAGE = (
     "Card context too long: {sentence_count} sentences, limit {sentence_limit}."

package/hooks/hooks_constants/skill_loaded_reminder_constants.py

@@ -3,52 +3,29 @@
 from __future__ import annotations
 
 __all__ = [
-    "ALL_SELF_LOADING_SUBAGENT_TYPES",
     "COMPACTION_REMINDER",
     "COMPACTION_SOURCE",
     "NOT_LOADED_REMINDER",
     "ALL_POTETO_MODE_SKILL_NAMES",
-    "PRE_TOOL_USE_EVENT_NAME",
-    "PROMPT_SEPARATOR",
     "SESSION_START_EVENT_NAME",
     "ALL_SLASH_COMMAND_MARKERS",
     "SUBAGENT_START_EVENT_NAME",
-    "CLAUDE_SUBAGENT_PROMPT_PREFIX",
-    "CODEX_SUBAGENT_PROMPT_PREFIX",
-    "ALL_SPAWN_PROMPT_FIELDS_AND_PREFIXES_BY_TOOL_NAME",
     "USER_PROMPT_SUBMIT_EVENT_NAME",
     "WORKFLOW_SUBAGENT_TYPE",
 ]
 
-PRE_TOOL_USE_EVENT_NAME = "PreToolUse"
 SESSION_START_EVENT_NAME = "SessionStart"
 USER_PROMPT_SUBMIT_EVENT_NAME = "UserPromptSubmit"
 COMPACTION_SOURCE = "compact"
 SUBAGENT_START_EVENT_NAME = "SubagentStart"
 WORKFLOW_SUBAGENT_TYPE = "workflow-subagent"
 
-ALL_SELF_LOADING_SUBAGENT_TYPES = frozenset({"pstack:poteto-agent", "poteto-agent"})
-
 ALL_POTETO_MODE_SKILL_NAMES = ("poteto-mode", "pstack:poteto-mode")
 SKILL_TOOL_NAME = "Skill"
 ALL_SLASH_COMMAND_MARKERS = (
     "<command-name>/poteto-mode</command-name>",
     "<command-name>/pstack:poteto-mode</command-name>",
 )
-PROMPT_SEPARATOR = "\n\n"
-
-CLAUDE_SUBAGENT_PROMPT_PREFIX = (
-    "Before any other work, invoke the poteto-mode skill with the Skill tool. "
-    "Every prompt you write for a subagent opens with the same instruction."
-)
-
-CODEX_SUBAGENT_PROMPT_PREFIX = "$poteto-mode"
-
-ALL_SPAWN_PROMPT_FIELDS_AND_PREFIXES_BY_TOOL_NAME = {
-    "Agent": ("prompt", CLAUDE_SUBAGENT_PROMPT_PREFIX),
-    "Task": ("prompt", CLAUDE_SUBAGENT_PROMPT_PREFIX),
-    "spawn_agent": ("message", CODEX_SUBAGENT_PROMPT_PREFIX),
-}
 
 NOT_LOADED_REMINDER = (
     "The poteto-mode skill is not loaded in this context. "

package/hooks/hooks_constants/test_hook_specific_output_keys.py

@@ -13,5 +13,6 @@ def test_keys_match_the_harness_hook_specific_output_field_names() -> None:
         "HOOK_SPECIFIC_OUTPUT_KEY": "hookSpecificOutput",
         "HOOK_EVENT_NAME_KEY": "hookEventName",
         "PERMISSION_DECISION_KEY": "permissionDecision",
+        "PERMISSION_DECISION_REASON_KEY": "permissionDecisionReason",
         "UPDATED_INPUT_KEY": "updatedInput",
     }

package/hooks/hooks_constants/visual_reply_rules_constants.py

@@ -66,6 +66,7 @@ RESULT_TEXT_SEPARATOR = "\n"
 
 ABBREVIATION_MESSAGE = 'Abbreviation "{abbreviation}" in the text. {reminder}'
 TRACKER_NUMBER_MESSAGE = 'Tracker number "{reference}" in the text. {reminder}'
+VIOLATION_LINE_SEPARATOR = "\n"
 NO_VISUAL_MESSAGE = "This reply has {sentence_count} sentences and no visual this turn. {reminder}"
 SECOND_REPLY_MESSAGE = "A reply already went out this turn. {reminder}"
 NOT_FLOWCHART_MESSAGE = "This widget is not a flowchart. {reminder}"

package/hooks/lifecycle/nested_project_hooks.py

@@ -13,7 +13,8 @@ hooks, and tool guards then never run. This hook runs them::
 
 Each child hook receives the same stdin payload, runs inside its checkout, and
 keeps its own matcher and timeout. A child ``exit 2`` blocks the tool call and a
-child ``deny`` or ``ask`` decision passes through; a child ``allow`` is dropped,
+child ``deny``, else a child ``ask``, passes through, a ``deny`` carrying every
+refusing child's reason; a child ``allow`` is dropped,
 so no child widens permissions for the session. The ``additionalContext`` of
 every child, at SessionStart, UserPromptSubmit, and PreToolUse, joins into one
 ``additionalContext``.
@@ -48,6 +49,7 @@ from hooks_constants.nested_project_hooks_constants import (
     COMMAND_KEY,
     CONTEXT_SECTION_SEPARATOR,
     DEFAULT_HOOK_TIMEOUT_SECONDS,
+    DENY_PERMISSION_DECISION,
     HOOK_EVENT_NAME_KEY,
     HOOK_TYPE_KEY,
     HOOKS_KEY,
@@ -67,6 +69,7 @@ from hooks_constants.hook_specific_output_keys import (
     HOOK_EVENT_NAME_KEY as HOOK_EVENT_NAME_OUTPUT_KEY,
     HOOK_SPECIFIC_OUTPUT_KEY,
     PERMISSION_DECISION_KEY,
+    PERMISSION_DECISION_REASON_KEY,
 )
 from hooks_constants.subprocess_window import hidden_window_creation_flags
 
@@ -276,41 +279,78 @@ def _permission_decision(all_output_fields: dict[str, object]) -> object:
     return specific_output.get(PERMISSION_DECISION_KEY)
 
 
+def _deny_reason(all_output_fields: dict[str, object]) -> str:
+    if _permission_decision(all_output_fields) != DENY_PERMISSION_DECISION:
+        return ""
+    specific_output = all_output_fields.get(HOOK_SPECIFIC_OUTPUT_KEY)
+    reason = (
+        specific_output.get(PERMISSION_DECISION_REASON_KEY)
+        if isinstance(specific_output, dict)
+        else None
+    )
+    return reason.strip() if isinstance(reason, str) else ""
+
+
+def _joined_reasons(all_reasons: Iterable[str]) -> str:
+    return CONTEXT_SECTION_SEPARATOR.join(dict.fromkeys(_non_empty_sections(all_reasons)))
+
+
 def pre_tool_use_verdict(
     all_results: list[subprocess.CompletedProcess[str]],
 ) -> HookVerdict:
     """Fold nested PreToolUse results into the one verdict Claude Code reads.
 
+    Claude Code shows one reason per refused call, so every refusing child's
+    reason travels in that one reason::
+
+        alpha exits 2 "no tests", beta denies "no link"  -> exit 2, both reasons
+        alpha denies "no link", beta denies "too long"   -> deny, both reasons
+        alpha asks, beta denies "no link"                -> deny, "no link"
+
     Args:
         all_results: The completed nested hooks, in run order.
 
     Returns:
-        A blocking exit carrying the child's stderr when any child exits 2,
-        else the first child ``deny`` or ``ask`` output carrying one copy
-        of each distinct child ``additionalContext``, else a pass carrying
-        that context, else an empty pass.
+        A blocking exit when any child exits 2, its stderr holding every
+        exit-2 child's stderr and every child ``deny`` reason; else the first
+        child ``deny`` output, its reason holding every child ``deny``
+        reason, or with no ``deny`` the first child ``ask`` output, either
+        carrying one copy of each distinct child ``additionalContext``; else
+        a pass carrying that context, else an empty pass.
     """
-    for each_result in all_results:
-        if each_result.returncode == BLOCKING_EXIT_CODE:
-            return HookVerdict(BLOCKING_EXIT_CODE, "", each_result.stderr)
     all_parsed_outputs = [
         _parsed_hook_output(each_result.stdout)
         for each_result in all_results
         if each_result.returncode == 0
     ]
     all_parsed_outputs = [each_output for each_output in all_parsed_outputs if each_output is not None]
+    all_deny_reasons = [_deny_reason(each_output) for each_output in all_parsed_outputs]
+    all_blocking_stderr = [
+        each_result.stderr.strip()
+        for each_result in all_results
+        if each_result.returncode == BLOCKING_EXIT_CODE
+    ]
+    if all_blocking_stderr:
+        return HookVerdict(
+            BLOCKING_EXIT_CODE, "", _joined_reasons([*all_blocking_stderr, *all_deny_reasons])
+        )
     all_context_sections = _non_empty_sections(
         _json_additional_context(each_parsed_output) for each_parsed_output in all_parsed_outputs
     )
     all_distinct_context_sections = list(dict.fromkeys(all_context_sections))
     joined_context = CONTEXT_SECTION_SEPARATOR.join(all_distinct_context_sections)
-    for each_parsed_output in all_parsed_outputs:
-        if _permission_decision(each_parsed_output) in ALL_FORWARDED_PERMISSION_DECISIONS:
+    for each_decision in ALL_FORWARDED_PERMISSION_DECISIONS:
+        for each_parsed_output in all_parsed_outputs:
+            if _permission_decision(each_parsed_output) != each_decision:
+                continue
             decision_output = dict(each_parsed_output)
+            decision_specific_output = dict(decision_output[HOOK_SPECIFIC_OUTPUT_KEY])
             if joined_context:
-                decision_specific_output = dict(decision_output[HOOK_SPECIFIC_OUTPUT_KEY])
                 decision_specific_output[ADDITIONAL_CONTEXT_KEY] = joined_context
-                decision_output[HOOK_SPECIFIC_OUTPUT_KEY] = decision_specific_output
+            joined_deny_reasons = _joined_reasons(all_deny_reasons)
+            if each_decision == DENY_PERMISSION_DECISION and joined_deny_reasons:
+                decision_specific_output[PERMISSION_DECISION_REASON_KEY] = joined_deny_reasons
+            decision_output[HOOK_SPECIFIC_OUTPUT_KEY] = decision_specific_output
             return HookVerdict(0, json.dumps(decision_output), "")
     if not joined_context:
         return HookVerdict(0, "", "")

package/hooks/lifecycle/test_nested_project_hooks.py

@@ -189,6 +189,87 @@ def test_should_pass_a_child_deny_decision_through(tmp_path: pathlib.Path) -> No
     assert json.loads(completed_process.stdout) == deny_output
 
 
+def _deny_output(reason: str) -> dict[str, object]:
+    return {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "deny",
+            "permissionDecisionReason": reason,
+        }
+    }
+
+
+def test_should_carry_every_child_deny_reason_in_one_refusal(
+    tmp_path: pathlib.Path,
+) -> None:
+    _make_checkout(
+        tmp_path,
+        "alpha",
+        {
+            "PreToolUse": [
+                _command_group("Bash", f"echo '{json.dumps(_deny_output('no link'))}'"),
+                _command_group("Bash", f"echo '{json.dumps(_deny_output('too long'))}'"),
+            ]
+        },
+    )
+    _make_checkout(
+        tmp_path,
+        "beta",
+        {"PreToolUse": [_command_group("Bash", f"echo '{json.dumps(_deny_output('no link'))}'")]},
+    )
+
+    completed_process = _run_hook(tmp_path, _pre_tool_use_payload("Bash"))
+
+    assert completed_process.returncode == 0
+    assert json.loads(completed_process.stdout) == _deny_output("no link\n\ntoo long")
+
+
+def test_should_carry_child_deny_reasons_into_a_blocking_exit(
+    tmp_path: pathlib.Path,
+) -> None:
+    _make_checkout(
+        tmp_path,
+        "alpha",
+        {"PreToolUse": [_command_group("Bash", f"echo '{json.dumps(_deny_output('no link'))}'")]},
+    )
+    _make_checkout(
+        tmp_path,
+        "beta",
+        {"PreToolUse": [_command_group("Bash", "echo no tests ran >&2; exit 2")]},
+    )
+
+    completed_process = _run_hook(tmp_path, _pre_tool_use_payload("Bash"))
+
+    assert completed_process.returncode == BLOCKING_EXIT_CODE
+    assert completed_process.stderr == "no tests ran\n\nno link"
+
+
+def test_should_forward_a_later_child_deny_ahead_of_an_earlier_ask(
+    tmp_path: pathlib.Path,
+) -> None:
+    ask_output = {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "ask",
+            "permissionDecisionReason": "publishing needs a person",
+        }
+    }
+    _make_checkout(
+        tmp_path,
+        "alpha",
+        {"PreToolUse": [_command_group("Bash", f"echo '{json.dumps(ask_output)}'")]},
+    )
+    _make_checkout(
+        tmp_path,
+        "beta",
+        {"PreToolUse": [_command_group("Bash", f"echo '{json.dumps(_deny_output('no link'))}'")]},
+    )
+
+    completed_process = _run_hook(tmp_path, _pre_tool_use_payload("Bash"))
+
+    assert json.loads(completed_process.stdout) == _deny_output("no link")
+
+
 def test_should_not_forward_a_child_allow_decision(tmp_path: pathlib.Path) -> None:
     allow_output = {
         "hookSpecificOutput": {

package/hooks/session/skill_loaded_reminder.py

@@ -1,9 +1,8 @@
 #!/usr/bin/env python3
-"""Hook that restores poteto-mode after compaction and loads it for helpers.
+"""Hook that restores poteto-mode after compaction and loads it for workflow helpers.
 
 ::
 
-    Agent or Codex spawn_agent, skill not named -> prompt opens with "invoke poteto-mode"
     Workflow script helper starts               -> "invoke poteto-mode now"
     compact SessionStart, skill invoked before   -> "invoke the skill again"
     compact SessionStart, no prior invocation
@@ -28,55 +27,21 @@ if _hooks_dir not in sys.path:
     sys.path.insert(0, _hooks_dir)
 
 from hooks_constants.skill_loaded_reminder_constants import (
-    ALL_SELF_LOADING_SUBAGENT_TYPES,
     COMPACTION_REMINDER,
     COMPACTION_SOURCE,
     NOT_LOADED_REMINDER,
     ALL_POTETO_MODE_SKILL_NAMES,
-    PRE_TOOL_USE_EVENT_NAME,
-    PROMPT_SEPARATOR,
     SESSION_START_EVENT_NAME,
     ALL_SLASH_COMMAND_MARKERS,
     SUBAGENT_START_EVENT_NAME,
-    ALL_SPAWN_PROMPT_FIELDS_AND_PREFIXES_BY_TOOL_NAME,
     USER_PROMPT_SUBMIT_EVENT_NAME,
     WORKFLOW_SUBAGENT_TYPE,
 )
-from hooks_constants.pre_tool_use_allow_output import write_pre_tool_use_allow_to_stdout
 from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
 from hooks_constants.setup_project_paths_constants import DECODE_ERRORS_POLICY, UTF8_ENCODING
 from transcript_skill_scan import skill_invocation_status
 
 
-def subagent_input_with_poteto_mode(
-    tool_name: str,
-    all_tool_input_fields: dict[str, object],
-) -> dict[str, object] | None:
-    """Return the spawn input with the poteto-mode invocation first, or None to leave it.
-
-    ::
-
-        Agent        {"prompt": "Reply leaf."}   -> {"prompt": "Before any ...\\n\\nReply leaf."}
-        spawn_agent  {"message": "Fix it."}      -> {"message": "$poteto-mode\\n\\nFix it."}
-        Agent        {"prompt": "Invoke poteto-mode, then ..."}  -> None
-        Agent        {"subagent_type": "poteto-agent", ...}      -> None, it loads the skill
-
-    Claude Code spawns through Agent or Task and Codex through spawn_agent, so
-    each tool name carries its own prompt field and invocation text.
-
-    Args:
-        tool_name: The spawn tool the session called.
-        all_tool_input_fields: The spawn input the session is about to send.
-    """
-    field_name, invocation_prefix = ALL_SPAWN_PROMPT_FIELDS_AND_PREFIXES_BY_TOOL_NAME[tool_name]
-    prompt = all_tool_input_fields.get(field_name)
-    if not isinstance(prompt, str) or ALL_POTETO_MODE_SKILL_NAMES[0] in prompt:
-        return None
-    if all_tool_input_fields.get("subagent_type") in ALL_SELF_LOADING_SUBAGENT_TYPES:
-        return None
-    return {**all_tool_input_fields, field_name: invocation_prefix + PROMPT_SEPARATOR + prompt}
-
-
 def poteto_mode_status(all_transcript_lines: Iterable[str]) -> tuple[bool, bool]:
     """Report whether the skill was invoked and whether it remains loaded.
 
@@ -160,26 +125,11 @@ def reminder_for(all_hook_fields: dict[str, object]) -> str | None:
     return NOT_LOADED_REMINDER if was_invoked and not is_loaded else None
 
 
-def _is_subagent_spawn(all_hook_fields: dict[str, object]) -> bool:
-    return (
-        all_hook_fields.get("hook_event_name") == PRE_TOOL_USE_EVENT_NAME
-        and all_hook_fields.get("tool_name") in ALL_SPAWN_PROMPT_FIELDS_AND_PREFIXES_BY_TOOL_NAME
-        and isinstance(all_hook_fields.get("tool_input"), dict)
-    )
-
-
 def main() -> None:
-    """Rewrite a subagent prompt, or print the reminder its event needs, or stay quiet."""
+    """Print the reminder its event needs, or stay quiet."""
     hook_payload = read_hook_input_dictionary_from_stdin()
     if hook_payload is None:
         return
-    if _is_subagent_spawn(hook_payload):
-        rewritten_input = subagent_input_with_poteto_mode(
-            hook_payload["tool_name"], hook_payload["tool_input"]
-        )
-        if rewritten_input is not None:
-            write_pre_tool_use_allow_to_stdout(rewritten_input)
-        return
     reminder = reminder_for(hook_payload)
     if reminder is None:
         return