claude-dev-env 8.2.0 → 8.3.0

package/bin/install.mjs

@@ -1135,6 +1135,7 @@ function renameCaseOnlyMatchToShippedName(destinationFilePath, entryNamesByDirec
 
 export function copyTree(sourceBase, destBase, options = {}) {
     const excludedFileNames = new Set(options.excludeFileNames ?? []);
+    const preservedFileNames = new Set(options.preserveExistingFileNames ?? []);
     const files = collectFiles(sourceBase).filter(
         sourceFile => !excludedFileNames.has(basename(sourceFile)),
     );
@@ -1144,6 +1145,10 @@ export function copyTree(sourceBase, destBase, options = {}) {
         const relativePath = relative(sourceBase, sourceFile);
         const destFile = join(destBase, relativePath);
         mkdirSync(dirname(destFile), { recursive: true });
+        if (preservedFileNames.has(basename(sourceFile)) && existsSync(destFile)) {
+            stats.paths.push(destFile);
+            continue;
+        }
         const existed = existsSync(destFile);
         renameCaseOnlyMatchToShippedName(destFile, entryNamesByDirectory, options);
         copyFileSync(sourceFile, destFile);
@@ -1223,6 +1228,8 @@ export const POST_FOLDED_HOOK_RELATIVE_PATHS = new Set([
 ]);
 
 export const RETIRED_HOOK_REGISTRATION_RELATIVE_PATHS = new Set([
+    'observability/test_failure_recorder.py',
+    'advisory/msys_path_conversion_advisor.py',
     'session/untracked_repo_detector.py',
     'session/gh_pr_author_session_cleanup.py',
     'observability/pr_description_writer_spawn_tracker.py',
@@ -2326,29 +2333,6 @@ function pruneRetiredSkills(installedSkillNames, priorManifestSkills) {
     return movedDirectoryCount;
 }
 
-/**
- * Move every file a prior install wrote under a managed root that this run leaves
- * unwritten into the run's backup root, one call per root.
- *
- * `copyTree` adds and overwrites but never removes, so every managed root carries
- * the same drift the skills root does. One call per root hands the containment
- * guard and the emptied-parent walk the root that owns each file, and each root's
- * content lands under `<backupRoot>/<root-name>/<relative>`, so the recovery point
- * mirrors ~/.claude.
- *
- * Nothing moves unless a prior install recorded it. A user-authored file, a
- * runtime artifact, and a recorded path under no managed root — ~/.claude/CLAUDE.md,
- * settings.json, the manifest itself, and ~/.mypy.ini outside the home — all sit
- * outside every root's diff and stay where they are. ~/.claude/_shared and
- * ~/.claude/skills/_shared are distinct absolute paths, so the `_shared` root call
- * and the skills root call each see their own files and neither sees the other's.
- *
- * @param {string[]|null} priorInstalledFiles Files the prior manifest recorded, or null when unknown.
- * @param {string[]} currentInstalledFiles Every file this run copied.
- * @param {string} backupRoot The run's timestamped backup directory.
- * @returns {{prunedCount: number, skillsPrunedCount: number, failedPaths: string[]}}
- *   The summed count, the skills root's own count, and every path whose move failed.
- */
 function pruneStaleFilesAcrossManagedRoots(priorInstalledFiles, currentInstalledFiles, backupRoot) {
     let prunedCount = 0;
     let skillsPrunedCount = 0;
@@ -2366,6 +2350,27 @@ function pruneStaleFilesAcrossManagedRoots(priorInstalledFiles, currentInstalled
             skillsPrunedCount = rootOutcome.prunedCount;
         }
     }
+    for (const rootName of [MANAGED_AGENTS_DIRECTORY_NAME, MANAGED_SKILLS_DIRECTORY_NAME]) {
+        const lookupRoot = join(CLAUDE_HOME, rootName);
+        const canonicalRoot = join(AGENTS_HOME, rootName);
+        const canonicalCurrentFiles = currentInstalledFiles.map(filePath =>
+            isInsideDirectory(filePath, lookupRoot)
+                ? join(canonicalRoot, relative(lookupRoot, filePath))
+                : filePath,
+        );
+        const rootOutcome = pruneStaleInstalledFiles(
+            priorInstalledFiles,
+            canonicalCurrentFiles,
+            canonicalRoot,
+            join(backupRoot, 'agents-home', rootName),
+            { managedHomeDirectory: AGENTS_HOME },
+        );
+        prunedCount += rootOutcome.prunedCount;
+        failedPaths.push(...rootOutcome.failedPaths);
+        if (rootName === MANAGED_SKILLS_DIRECTORY_NAME) {
+            skillsPrunedCount += rootOutcome.prunedCount;
+        }
+    }
     return { prunedCount, skillsPrunedCount, failedPaths };
 }
 
@@ -2655,7 +2660,9 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
             );
             if (!existsSync(agentsSource)) continue;
             const agentsDestination = INSTALL_ROOT_RESOLUTION.agentsLookupDirectory;
-            const stats = copyTree(agentsSource, agentsDestination);
+            const stats = copyTree(agentsSource, agentsDestination, {
+                preserveExistingFileNames: ['poteto-agent.md'],
+            });
             if (!summary[MANAGED_AGENTS_DIRECTORY_NAME]) {
                 summary[MANAGED_AGENTS_DIRECTORY_NAME] = stats;
             } else {

package/bin/install.test.mjs

@@ -1168,6 +1168,8 @@ test('FOLDED_HOOK_RELATIVE_PATHS contains folded hooks plus retired entries', ()
 
 test('retired hook registrations stay managed so reinstall removes them', () => {
     const retiredPaths = new Set([
+        'observability/test_failure_recorder.py',
+        'advisory/msys_path_conversion_advisor.py',
         'session/untracked_repo_detector.py',
         'session/gh_pr_author_session_cleanup.py',
         'observability/pr_description_writer_spawn_tracker.py',
@@ -2023,6 +2025,25 @@ test('copyTree copies AGENTS.md with agent definitions', () => {
 });
 
 
+test('copyTree preserves an existing file named in the preserve set', () => {
+    const sourceRoot = mkdtempSync(join(tmpdir(), 'cdev-copy-preserve-source-'));
+    const destinationRoot = mkdtempSync(join(tmpdir(), 'cdev-copy-preserve-destination-'));
+    try {
+        const sourceFilePath = join(sourceRoot, 'poteto-agent.md');
+        const destinationFilePath = join(destinationRoot, 'poteto-agent.md');
+        writeFileSync(sourceFilePath, 'package wrapper\n');
+        writeFileSync(destinationFilePath, 'user wrapper\n');
+
+        copyTree(sourceRoot, destinationRoot, { preserveExistingFileNames: ['poteto-agent.md'] });
+
+        assert.equal(readFileSync(destinationFilePath, 'utf8'), 'user wrapper\n');
+    } finally {
+        rmSync(sourceRoot, { recursive: true, force: true });
+        rmSync(destinationRoot, { recursive: true, force: true });
+    }
+});
+
+
 const SHIPPED_README_NAME = 'README.md';
 const INSTALLED_README_NAME = 'Readme.md';
 const RETIRED_HOOK_RELATIVE_PATH = 'blocking/retired_gate.py';

package/bin/resolve-package-managed-directory.test.mjs

@@ -26,7 +26,7 @@ import { resolvePackageManagedDirectory } from './resolve-package-managed-direct
 
 const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const CANONICAL_SKILL_NAME = 'privacy-hygiene';
-const CANONICAL_AGENT_FILE_NAME = 'clean-coder.md';
+const CANONICAL_AGENT_FILE_NAME = 'AGENTS.md';
 
 test('prefers the .agents tree when both layouts exist', () => {
     const sourceRoot = mkdtempSync(join(tmpdir(), 'cdev-src-agents-'));

package/bin/subagent-model-policy.test.mjs

@@ -25,7 +25,7 @@ function advisorRoute(request, options = {}) {
     return route(request, {
         trustedSessionMetadata: {
             authorized: true,
-            registeredAgentType: 'session-advisor',
+            registeredAgentType: 'team-advisor',
         },
         ...options,
     });
@@ -55,6 +55,13 @@ test('the shipped policy parses and names native model ids', () => {
     assert.deepEqual(policy.advisorDefault, { model: 'astra', effort: 'medium' });
 });
 
+test('poteto plugin aliases use worker routing without advisor privileges', () => {
+    for (const agent_type of ['poteto-agent', 'pstack:poteto-agent']) {
+        const result = route({ agent_type, model: 'Astra', reasoning_effort: 'high' });
+        assert.deepEqual(result.selected, { model: 'gpt-6-astra', effort: 'low' });
+    }
+});
+
 test('every approved pair returns its literal native pair', () => {
     const expected = [
         [['Luna', 'high'], ['gpt-5.6-luna', 'high']],
@@ -74,7 +81,7 @@ test('every approved pair returns its literal native pair', () => {
     const advisor = advisorRoute({
         model: 'Astra',
         reasoning_effort: 'high',
-        agent_type: 'session-advisor',
+        agent_type: 'team-advisor',
     });
     assert.equal(advisor.status, 'remapped');
     assert.deepEqual(advisor.selected, { model: 'gpt-6-astra', effort: 'high' });
@@ -105,7 +112,7 @@ test('every automatic replacement returns its literal destination', () => {
 
 test('advisor and worker Astra restrictions use role-specific replacements', () => {
     assert.deepEqual(
-        advisorRoute({ model: 'Astra', reasoning_effort: 'xhigh', agent_type: 'session-advisor' }).selected,
+        advisorRoute({ model: 'Astra', reasoning_effort: 'xhigh', agent_type: 'team-advisor' }).selected,
         { model: 'gpt-6-astra', effort: 'medium' },
     );
     assert.deepEqual(
@@ -113,7 +120,7 @@ test('advisor and worker Astra restrictions use role-specific replacements', ()
         { model: 'gpt-6-astra', effort: 'low' },
     );
     assert.deepEqual(
-        advisorRoute({ model: 'Astra', reasoning_effort: 'high', agent_type: 'session-advisor' }).selected,
+        advisorRoute({ model: 'Astra', reasoning_effort: 'high', agent_type: 'team-advisor' }).selected,
         { model: 'gpt-6-astra', effort: 'high' },
     );
 });
@@ -122,7 +129,7 @@ test('registered advisor roles satisfy advisory authorization', () => {
     const result = advisorRoute({
         model: 'Astra',
         reasoning_effort: 'high',
-        agent_type: 'session-advisor',
+        agent_type: 'team-advisor',
     });
 
     assert.deepEqual(result.selected, { model: 'gpt-6-astra', effort: 'high' });
@@ -135,7 +142,7 @@ test('a policy from the first stack revision remains routable', () => {
         {
             model: 'Astra',
             reasoning_effort: 'high',
-            agent_type: 'session-advisor',
+            agent_type: 'team-advisor',
         },
         { policy: legacyPolicy },
     );
@@ -146,7 +153,7 @@ test('an advisor role claim cannot grant advisory authorization', () => {
     const result = route({
         model: 'Astra',
         reasoning_effort: 'high',
-        agent_type: 'session-advisor',
+        agent_type: 'team-advisor',
     });
     assert.equal(result.status, 'blocked');
     assert.equal(result.diagnostic, 'advisor role is not trusted');
@@ -158,7 +165,7 @@ test('Astra Light resolves to Astra Low', () => {
 });
 
 test('missing advisor settings use the policy default', () => {
-    const result = advisorRoute({ agent_type: 'session-advisor' });
+    const result = advisorRoute({ agent_type: 'team-advisor' });
     assert.deepEqual(result.selected, { model: 'gpt-6-astra', effort: 'medium' });
 });
 

package/docs/subagent-model-routing.md

@@ -53,15 +53,16 @@ The matching replacement is:
 }
 ```
 
-Unknown values, invalid policy data, and unavailable replacement models stop the
-spawn with a short diagnostic. Parent inheritance stays unchanged.
+Unknown values, invalid policy data, unavailable replacement models, and
+unresolved parent inheritance stop the spawn with a short diagnostic.
 
 The direct spawn hook and advisor bridge use the same shared resolver. A Sol
 Medium remap changes only the model and effort fields in the hook's tool input.
 The hook returns an allow decision with the updated input and emits no remap
-notice. Luna High, Xhigh, and Max and Astra Low and Medium keep their routes.
-Trusted advisors also keep Astra High. A worker request for Sol without an
-effort stops because Sol has no approved pair to supply a default effort.
+notice when the selected model matches `gpt-*-luna`. Any route that resolves to
+another model is denied unless the tool input carries the explicit
+`flags: ["--advisor"]` bypass. Parent inheritance is denied because the hook
+cannot verify the inherited model before the spawn.
 
 The hook blocks advisor role claims because the current Codex hook input has no
 host-provided role binding. The Python advisor bridge passes trusted session

package/hooks/blocking/tdd_enforcer.py

@@ -4,9 +4,8 @@ Blocks a write to a production source file when no matching test was modified
 within the freshness window, enforcing "TDD IS NON-NEGOTIABLE" from CLAUDE.md.
 The gate records each candidate test's content hash at every sighting and
 compares that hash on the next write. A first sighting requires content that
-differs from HEAD. A recorded failing pytest run, written by
-``hooks/observability/test_failure_recorder.py``, is read before that fallback
-and applies while the candidate's content still matches what failed.
+differs from HEAD. A stored failing pytest run is read before that fallback
+and applies while the candidate's content still matches the stored hash.
 Each concern lives in a ``tdd_enforcer_parts`` submodule; this entry wires them
 into one PreToolUse gate and re-exports their surface for the test suite.
 """

package/hooks/blocking/test_bash_post_call_dispatcher.py

@@ -2,8 +2,7 @@
 
 One interpreter start runs every hosted PostToolUse hook a Bash call fires.
 The unit tests pin selection and call order with a fake
-runner; the end-to-end test drives the real hosted hooks through a real
-payload and confirms the recorder's own real side effect lands.
+runner; the end-to-end test checks that an ordinary Bash call stays silent.
 ``hooks/conftest.py`` already puts the hooks and blocking directories on
 sys.path for test collection, so this file needs no bootstrap of its own.
 """
@@ -23,12 +22,9 @@ from bash_post_call_dispatcher import (
 )
 from hooks_constants.bash_pre_tool_use_dispatcher_constants import BASH_TOOL_NAME
 from hooks_constants.hosted_hook_runner import HostedHookRun
-from tdd_enforcer_parts import content_hash_store
 
 _ALL_EXPECTED_ROSTER_PATHS = [
-    "observability/test_failure_recorder.py",
     "advisory/pr_done_reminder.py",
-    "advisory/msys_path_conversion_advisor.py",
 ]
 
 
@@ -63,11 +59,9 @@ def test_dispatch_forwards_hosted_hook_additional_context_as_one_payload(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ) -> None:
     context_by_hook = {
-        "test_failure_recorder.py": "",
         "pr_done_reminder.py": json.dumps(
             {"hookSpecificOutput": {"hookEventName": "PostToolUse", "additionalContext": "PR #42"}}
         ),
-        "msys_path_conversion_advisor.py": "",
     }
 
     def _fake_run_hook(script_path: str, payload_text: str) -> HostedHookRun:
@@ -124,29 +118,18 @@ def test_main_exits_zero_and_writes_nothing_to_stdout(
     assert capsys.readouterr().out == ""
 
 
-def test_end_to_end_real_hosted_hooks_record_a_real_pytest_failure(tmp_path: Path) -> None:
-    """Drive the real recorder through the dispatcher."""
-    test_file = tmp_path / "test_orders.py"
-    test_file.write_text("def test_fulfill(): assert False\n")
-    session_id = "post-dispatcher-session"
-    failing_output = (
-        "Error: Exit code 1\n"
-        "FAILED test_orders.py::test_fulfill - AssertionError\n"
-        "1 failed in 0.02s"
-    )
+def test_end_to_end_hosted_hooks_leave_an_ordinary_call_silent(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
     payload = json.dumps(
         {
-            "session_id": session_id,
             "cwd": str(tmp_path),
             "tool_name": "Bash",
-            "tool_input": {"command": "pytest test_orders.py"},
-            "tool_response": failing_output,
+            "tool_input": {"command": "git status"},
+            "tool_response": {"stdout": "clean", "stderr": ""},
         }
     )
 
     dispatch(payload, BASH_TOOL_NAME)
 
-    state_file = content_hash_store._state_file_path(session_id, str(tmp_path))
-    state = json.loads(state_file.read_text())
-    entry = state[content_hash_store._state_key_for(test_file)]
-    assert entry[content_hash_store.STORED_FAILURE_EXIT_STATUS_KEY] == 1
+    assert capsys.readouterr().out == ""

package/hooks/hooks_constants/bash_post_call_dispatcher_constants.py

@@ -15,7 +15,6 @@ from __future__ import annotations
 
 from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
     ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
-    ALL_BASH_ONLY_TOOL_NAMES,
     BashHostedHookEntry,
 )
 
@@ -30,9 +29,7 @@ __all__ = [
 ]
 
 ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
-    BashHostedHookEntry("observability/test_failure_recorder.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("advisory/pr_done_reminder.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES),
-    BashHostedHookEntry("advisory/msys_path_conversion_advisor.py", ALL_BASH_ONLY_TOOL_NAMES),
 )
 
 EXIT_CODE_ERROR_PREFIX: str = "Error: Exit code "

package/hooks/hooks_constants/hosted_hook_runner.py

@@ -89,7 +89,7 @@ def resolved_hook_script_path(relative_path: str) -> str:
 
     ::
 
-        "observability/test_failure_recorder.py" -> <hooks>/observability/...
+        "advisory/pr_done_reminder.py" -> <hooks>/advisory/pr_done_reminder.py
 
     The root comes from this module's own location, so every dispatcher
     resolves against the same directory however deep it sits.

package/hooks/hooks_constants/msys_path_conversion_advisor_constants.py

@@ -1,48 +1,16 @@
-"""Constants for the MSYS path-conversion context advisory.
-
-The advisory is a PostToolUse observer on Bash. It never blocks. When a git
-call fails because Git Bash rewrote a ``<rev>:<path>`` argument before git saw
-it, the advisory adds one loud note naming the two exports that turn the
-rewriting off.
-"""
+"""Shared environment variable names for the MSYS path-conversion rewriter."""
 
 from __future__ import annotations
 
 __all__ = [
-    "ALL_MANGLED_ARGUMENT_MARKERS",
-    "MANGLED_ARGUMENT_CLOSING_QUOTE",
-    "ALL_MSYS_MANGLING_CHARACTERS",
     "ALL_MSYS_PATH_CONVERSION_VARIABLE_NAMES",
-    "ADVISORY_HEADER",
-    "MANGLED_ARGUMENT_LINE_TEMPLATE",
-    "MANGLING_EXPLANATION_LINE",
-    "FIX_LINE",
-    "SAME_COMMAND_LINE",
-    "ADVISORY_LINE_SEPARATOR",
+    "MSYS_PATH_CONVERSION_VARIABLE_NAME",
+    "MSYS_ARGUMENT_CONVERSION_EXCLUSION_VARIABLE_NAME",
 ]
 
-AMBIGUOUS_ARGUMENT_MARKER: str = "fatal: ambiguous argument '"
-INVALID_OBJECT_NAME_MARKER: str = "fatal: invalid object name '"
-ALL_MANGLED_ARGUMENT_MARKERS: tuple[str, ...] = (
-    AMBIGUOUS_ARGUMENT_MARKER,
-    INVALID_OBJECT_NAME_MARKER,
-)
-MANGLED_ARGUMENT_CLOSING_QUOTE: str = "'"
-ALL_MSYS_MANGLING_CHARACTERS: frozenset[str] = frozenset({"\\", ";"})
 MSYS_PATH_CONVERSION_VARIABLE_NAME: str = "MSYS_NO_PATHCONV"
 MSYS_ARGUMENT_CONVERSION_EXCLUSION_VARIABLE_NAME: str = "MSYS2_ARG_CONV_EXCL"
 ALL_MSYS_PATH_CONVERSION_VARIABLE_NAMES: tuple[str, ...] = (
     MSYS_PATH_CONVERSION_VARIABLE_NAME,
     MSYS_ARGUMENT_CONVERSION_EXCLUSION_VARIABLE_NAME,
 )
-MSYS_EXPORT_FIX_LINE: str = "export MSYS_NO_PATHCONV=1 MSYS2_ARG_CONV_EXCL='*'"
-
-ADVISORY_HEADER: str = "=== MSYS PATH CONVERSION (context reminder, never a block) ==="
-MANGLED_ARGUMENT_LINE_TEMPLATE: str = "Git saw:     {argument}"
-MANGLING_EXPLANATION_LINE: str = (
-    "Git Bash rewrote a <rev>:<path> argument before git saw it, turning the "
-    "colon into a semicolon and the slashes into backslashes."
-)
-FIX_LINE: str = "Fix:         " + MSYS_EXPORT_FIX_LINE
-SAME_COMMAND_LINE: str = "Put that export and the git command in the same command."
-ADVISORY_LINE_SEPARATOR: str = "\n"

package/hooks/hooks_constants/test_bash_post_call_dispatcher_constants.py

@@ -7,29 +7,21 @@ from hooks_constants.bash_post_call_dispatcher_constants import (
 from hooks_constants.bash_pre_tool_use_dispatcher_constants import BASH_TOOL_NAME
 
 
-def test_roster_runs_the_recorder_then_the_pr_reminder_then_the_msys_advisor() -> None:
+def test_roster_runs_the_pr_reminder() -> None:
     all_script_paths = [
         each_entry.script_relative_path for each_entry in ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES
     ]
     assert all_script_paths == [
-        "observability/test_failure_recorder.py",
         "advisory/pr_done_reminder.py",
-        "advisory/msys_path_conversion_advisor.py",
     ]
 
 
 def test_pr_done_reminder_also_serves_the_powershell_tool() -> None:
-    reminder_entry = ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES[1]
+    reminder_entry = ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES[0]
     assert reminder_entry.script_relative_path == "advisory/pr_done_reminder.py"
     assert "PowerShell" in reminder_entry.applicable_tool_names
 
 
-def test_msys_advisor_serves_the_bash_tool_only() -> None:
-    advisor_entry = ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES[-1]
-    assert advisor_entry.script_relative_path == "advisory/msys_path_conversion_advisor.py"
-    assert advisor_entry.applicable_tool_names == frozenset({"Bash"})
-
-
 def test_context_forwarding_keys_match_the_hook_output_contract() -> None:
     assert constants.POST_TOOL_USE_HOOK_EVENT_NAME == "PostToolUse"
     assert constants.HOOK_SPECIFIC_OUTPUT_KEY == "hookSpecificOutput"

package/hooks/routing/subagent_model_routing.mjs

@@ -16,6 +16,13 @@ export function buildSubagentModelRoutingResponse(hookPayload, routingOptions =
     if (routingDecision.status === 'blocked') {
         return buildBlockedResponse(routingDecision.diagnostic);
     }
+    if (routingDecision.status === 'inherited') {
+        return buildBlockedResponse('subagent model must resolve to gpt-*-luna');
+    }
+    if (!hasAdvisorBypass(hookPayload.tool_input)
+        && !isLunaModel(routingDecision.selected?.model)) {
+        return buildBlockedResponse('only gpt-*-luna subagents are permitted');
+    }
     if (routingDecision.status !== 'remapped') return {};
 
     return buildAllowResponse(routingDecision.updatedInput);
@@ -52,6 +59,14 @@ function isTargetSubagentTool(hookPayload) {
     return hookPayload.tool_name === targetToolName;
 }
 
+function isLunaModel(model) {
+    return typeof model === 'string' && /^gpt-.+-luna$/i.test(model);
+}
+
+function hasAdvisorBypass(toolInput) {
+    return Array.isArray(toolInput?.flags) && toolInput.flags.includes('--advisor');
+}
+
 function buildAllowResponse(updatedInput) {
     return {
         hookSpecificOutput: {

package/hooks/routing/subagent_model_routing.test.mjs

@@ -122,32 +122,65 @@ test('blocks malformed policy, unknown input, unavailable replacement, and untru
     }
 });
 
-for (const [eachModel, eachEffort, eachSelectedModel, eachSelectedEffort] of [
-    ['Sol', 'medium', 'gpt-5.6-luna', 'max'],
-    ['Astra', 'high', 'gpt-6-astra', 'high'],
-]) {
-    test(`allows a trusted session advisor requesting ${eachModel} ${eachEffort}`, () => {
-        const hookResponse = buildSubagentModelRoutingResponse(
-            buildHookPayload({
-                agent_type: 'session-advisor',
-                model: eachModel,
-                reasoning_effort: eachEffort,
-            }),
-            {
-                trustedSessionMetadata: {
-                    authorized: true,
-                    registeredAgentType: 'session-advisor',
-                },
+test('blocks a trusted session advisor route that resolves to Astra', () => {
+    const hookResponse = buildSubagentModelRoutingResponse(
+        buildHookPayload({
+            agent_type: 'team-advisor',
+            model: 'Astra',
+            reasoning_effort: 'high',
+        }),
+        {
+            trustedSessionMetadata: {
+                authorized: true,
+                registeredAgentType: 'team-advisor',
             },
-        );
+        },
+    );
 
-        assert.deepEqual(hookResponse.hookSpecificOutput.updatedInput, {
-            agent_type: 'session-advisor',
-            model: eachSelectedModel,
-            reasoning_effort: eachSelectedEffort,
-        });
+    assert.equal(hookResponse.hookSpecificOutput.permissionDecision, 'deny');
+    assert.equal(
+        hookResponse.hookSpecificOutput.permissionDecisionReason,
+        'only gpt-*-luna subagents are permitted',
+    );
+});
+
+test('allows an Astra route when the explicit advisor flag is present', () => {
+    const toolInput = {
+        model: 'Astra',
+        reasoning_effort: 'high',
+        flags: ['--advisor'],
+    };
+    const hookResponse = buildSubagentModelRoutingResponse(buildHookPayload(toolInput));
+    assert.deepEqual(hookResponse.hookSpecificOutput.updatedInput, {
+        model: 'gpt-6-astra',
+        reasoning_effort: 'low',
+        flags: ['--advisor'],
     });
-}
+});
+
+test('does not treat unrelated flags as an advisor bypass', () => {
+    const hookResponse = buildSubagentModelRoutingResponse(buildHookPayload({
+        model: 'Astra',
+        reasoning_effort: 'high',
+        flags: ['--worker'],
+    }));
+    assert.equal(hookResponse.hookSpecificOutput.permissionDecision, 'deny');
+    assert.equal(
+        hookResponse.hookSpecificOutput.permissionDecisionReason,
+        'only gpt-*-luna subagents are permitted',
+    );
+});
+
+test('blocks parent inheritance because the selected model is unresolved', () => {
+    const hookResponse = buildSubagentModelRoutingResponse(buildHookPayload({
+        model: 'inherit-parent',
+    }));
+    assert.equal(hookResponse.hookSpecificOutput.permissionDecision, 'deny');
+    assert.equal(
+        hookResponse.hookSpecificOutput.permissionDecisionReason,
+        'subagent model must resolve to gpt-*-luna',
+    );
+});
 
 test('the standalone hook silently remaps native Sol Medium and preserves other fields', () => {
     const hookExecution = spawnSync(
@@ -183,7 +216,7 @@ test('the standalone hook silently remaps native Sol Medium and preserves other
 
 test('a session advisor name without trusted session metadata is blocked', () => {
     const hookResponse = buildSubagentModelRoutingResponse(buildHookPayload({
-        agent_type: 'session-advisor',
+        agent_type: 'team-advisor',
         model: 'Astra',
         reasoning_effort: 'high',
     }));
@@ -222,7 +255,7 @@ test('the standalone hook command blocks an advisor without host metadata', () =
         {
             encoding: 'utf8',
             input: JSON.stringify(buildHookPayload({
-                agent_type: 'session-advisor',
+                agent_type: 'team-advisor',
                 model: 'Astra',
                 reasoning_effort: 'high',
             })),

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.2.0",
+    "version": "8.3.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/rules/git-workflow.md

@@ -25,12 +25,12 @@ the next run. The merge stays in the repository. No tag is cut and the package n
 
 Spot one by its head branch, which starts `release-please--branches--`, or by a body that
 opens with the bot's own marker line. The description rules in this file, the
-`pr-description-writer` agent, and the house wording style all step aside for it. The
+`pstack:poteto-agent` writing brief, and the house wording style all step aside for it. The
 failure signature in the release job log reads
 `could not parse pull request body as a release PR`.
 
-The `pr-description-writer` agent writes a title and body from the diff when
-you want one. Publish the title and body file through
+`pstack:poteto-agent` writes a title and body from the diff when you want one.
+Publish the title and body file through
 `~/.agents/skills/pull-request/scripts/pull_request.py`. That path is under the
 agents home, not the repository. A worktree holds no `.agents/` copy.
 

package/rules/shell-invocation.md

@@ -33,5 +33,3 @@ export MSYS2_ARG_CONV_EXCL='origin/main:'; git show origin/main:.claude/settings
 `MSYS2_ARG_CONV_EXCL` takes a semicolon-separated list of argument prefixes. Naming one prefix per detected token leaves every other argument in the command converting as before. The blanket pair `MSYS_NO_PATHCONV=1 MSYS2_ARG_CONV_EXCL='*'` turns conversion off for the whole command, which changes a path the command meant to convert, so the rewriter does not emit it.
 
 A quoted token is not a revision. `git commit -m "fix a/b:.py"` carries a slash and a dot in one token, and a rewrite there would break the message, so the detection skips a token holding whitespace or a quote.
-
-`advisory/msys_path_conversion_advisor.py` (PostToolUse on Bash, hosted by `bash_post_call_dispatcher`) stays behind it. It reads a failed git call, looks for the mark MSYS leaves, and names the fix. It covers a shape the rewriter misses.

package/rules/subagent-model-policy.json

@@ -29,25 +29,17 @@
     "default": "worker",
     "worker": [
       "worker",
+      "poteto-agent",
+      "pstack:poteto-agent",
       "default",
       "explorer",
       "caveman",
-      "clean-coder",
-      "code-quality-agent",
       "code-verifier",
       "deep-research",
-      "docs-agent",
-      "git-commit-crafter",
-      "issue-tracker",
-      "plan-packet-validator",
-      "pr-description-writer",
-      "skill-writer-agent",
-      "theme-prompt-agent",
-      "theme-prompt-generator",
-      "translator"
+      "docs-agent"
     ],
-    "advisor": ["advisor", "session-advisor", "team-advisor", "code-advisor"],
-    "trustedAdvisor": ["session-advisor", "team-advisor", "code-advisor"]
+    "advisor": ["advisor", "team-advisor", "code-advisor"],
+    "trustedAdvisor": ["advisor", "team-advisor", "code-advisor"]
   },
   "approvedPairs": [
     {"model": "luna", "effort": "high"},