claude-dev-env 8.40.1 → 8.41.0

package/hooks/blocking/pr_lifecycle_skill_gate.py

@@ -0,0 +1,190 @@
+"""Deny pull request lifecycle actions until their skill appears in the transcript."""
+
+from __future__ import annotations
+
+import json
+import re
+import shlex
+import sys
+from pathlib import Path
+
+hooks_directory = str(Path(__file__).resolve().parent.parent)
+if hooks_directory not in sys.path:
+    sys.path.insert(0, hooks_directory)
+
+from hooks_constants.pr_lifecycle_skill_gate_constants import (
+    ALL_API_ACTION_NAMES,
+    ALL_COMMAND_PREFIX_WORDS,
+    ALL_GITHUB_MCP_TOOL_SUFFIXES,
+    ALL_PREFIX_OPTIONS_WITH_VALUE,
+    ALL_SLASH_COMMAND_MARKERS,
+    ALL_TRANSCRIPT_PATH_FIELDS,
+    COMMAND_SEPARATORS,
+    COMMAND_WHITESPACE,
+    DENY_DECISION,
+    DENY_REASON,
+    ENVIRONMENT_ASSIGNMENT_PATTERN,
+    GH_API_COMMAND,
+    GH_OPTIONS_WITH_VALUE,
+    GH_PULL_REQUEST_COMMAND,
+    GIT_ACTIONS,
+    GIT_GLOBAL_OPTIONS_WITH_VALUE,
+    HOOK_EVENT_NAME,
+    HOOK_SPECIFIC_OUTPUT_KEY,
+    MERGE_PATH_SUFFIX,
+    OPTION_AND_VALUE_WORD_COUNT,
+    PERMISSION_DECISION_KEY,
+    PERMISSION_DECISION_REASON_KEY,
+    SHELL_TOOL_NAMES,
+    SKILL_NAME,
+)
+from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+from hooks_constants.setup_project_paths_constants import DECODE_ERRORS_POLICY, UTF8_ENCODING
+from transcript_skill_scan import is_skill_loaded_after_last_compaction
+
+
+def _command_segments(command: str) -> list[list[str]]:
+    lexer = shlex.shlex(command, posix=True, punctuation_chars=COMMAND_SEPARATORS)
+    lexer.whitespace = COMMAND_WHITESPACE
+    lexer.whitespace_split = True
+    all_segments: list[list[str]] = []
+    each_segment: list[str] = []
+    try:
+        all_words = list(lexer)
+    except ValueError:
+        return []
+    for each_word in all_words:
+        if each_word[0] in COMMAND_SEPARATORS:
+            all_segments.append(each_segment)
+            each_segment = []
+            continue
+        each_segment.append(each_word)
+    if each_segment:
+        all_segments.append(each_segment)
+    return [each_group for each_group in all_segments if each_group]
+
+
+def _next_command_word(
+    all_words: list[str], start: int, all_options_with_value: frozenset[str]
+) -> tuple[str | None, int]:
+    index = start
+    while index < len(all_words):
+        each_word = all_words[index]
+        if each_word in all_options_with_value:
+            index += OPTION_AND_VALUE_WORD_COUNT
+            continue
+        if each_word.startswith("-"):
+            index += 1
+            continue
+        return each_word, index + 1
+    return None, index
+
+
+def _is_git_action(all_words: list[str]) -> bool:
+    action, _ = _next_command_word(all_words, 1, GIT_GLOBAL_OPTIONS_WITH_VALUE)
+    return action in GIT_ACTIONS
+
+
+def _is_gh_action(all_words: list[str]) -> bool:
+    action, next_index = _next_command_word(all_words, 1, GH_OPTIONS_WITH_VALUE)
+    if action == GH_PULL_REQUEST_COMMAND:
+        subcommand, _ = _next_command_word(all_words, next_index, GH_OPTIONS_WITH_VALUE)
+        return subcommand is not None
+    if action != GH_API_COMMAND:
+        return False
+    all_api_arguments = all_words[next_index:]
+    if any(each_name in each_word for each_word in all_api_arguments for each_name in ALL_API_ACTION_NAMES):
+        return True
+    return any(
+        each_word.split("?", 1)[0].rstrip("/").endswith(MERGE_PATH_SUFFIX)
+        for each_word in all_api_arguments
+    )
+
+
+def _words_from_executable(all_words: list[str]) -> list[str]:
+    index = 0
+    while index < len(all_words):
+        each_word = all_words[index]
+        if re.match(ENVIRONMENT_ASSIGNMENT_PATTERN, each_word):
+            index += 1
+            continue
+        if each_word not in ALL_COMMAND_PREFIX_WORDS:
+            return all_words[index:]
+        index += 1
+        while index < len(all_words) and all_words[index].startswith("-"):
+            is_valued = all_words[index] in ALL_PREFIX_OPTIONS_WITH_VALUE
+            index += OPTION_AND_VALUE_WORD_COUNT if is_valued else 1
+    return []
+
+
+def _matches_shell_command(command: str) -> bool:
+    for each_segment in _command_segments(command):
+        all_command_words = _words_from_executable(each_segment)
+        if not all_command_words:
+            continue
+        executable = all_command_words[0].lower()
+        if executable in {"git", "git.exe"} and _is_git_action(all_command_words):
+            return True
+        if executable in {"gh", "gh.exe"} and _is_gh_action(all_command_words):
+            return True
+    return False
+
+
+def _is_governed_action(all_payload_fields: dict[str, object]) -> bool:
+    tool_name = all_payload_fields.get("tool_name")
+    if not isinstance(tool_name, str):
+        return False
+    if tool_name.endswith(ALL_GITHUB_MCP_TOOL_SUFFIXES):
+        return True
+    if tool_name not in SHELL_TOOL_NAMES:
+        return False
+    tool_input = all_payload_fields.get("tool_input")
+    return isinstance(tool_input, dict) and isinstance(tool_input.get("command"), str) and _matches_shell_command(tool_input["command"])
+
+
+def _transcript_load_status(path: str) -> bool | None:
+    try:
+        with open(path, encoding=UTF8_ENCODING, errors=DECODE_ERRORS_POLICY) as transcript:
+            return is_skill_loaded_after_last_compaction(
+                transcript, (SKILL_NAME,), ALL_SLASH_COMMAND_MARKERS
+            )
+    except OSError:
+        return None
+
+
+def decision_for(all_payload_fields: dict[str, object]) -> dict[str, object] | None:
+    """Return a deny for a governed action with readable, unloaded transcripts.
+
+    Args:
+        all_payload_fields: The parsed PreToolUse input.
+    """
+    if not _is_governed_action(all_payload_fields):
+        return None
+    paths = [all_payload_fields.get(field) for field in ALL_TRANSCRIPT_PATH_FIELDS]
+    readable_paths = [path for path in paths if isinstance(path, str) and path]
+    if not readable_paths:
+        return None
+    statuses = [_transcript_load_status(path) for path in readable_paths]
+    if any(status is None or status for status in statuses):
+        return None
+    return {
+        HOOK_SPECIFIC_OUTPUT_KEY: {
+            "hookEventName": HOOK_EVENT_NAME,
+            PERMISSION_DECISION_KEY: DENY_DECISION,
+            PERMISSION_DECISION_REASON_KEY: DENY_REASON,
+        }
+    }
+
+
+def main() -> int:
+    """Read one payload, print a deny when needed, and exit zero."""
+    payload = read_hook_input_dictionary_from_stdin()
+    if payload is not None:
+        decision = decision_for(payload)
+        if decision is not None:
+            sys.stdout.write(json.dumps(decision) + "\n")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/hooks/blocking/test_pr_lifecycle_skill_gate.py

@@ -0,0 +1,163 @@
+"""Behavior tests for the pull request lifecycle PreToolUse gate."""
+
+import json
+import sys
+from io import BytesIO, StringIO, TextIOWrapper
+from pathlib import Path
+from unittest.mock import patch
+
+HOOKS_DIRECTORY = Path(__file__).resolve().parent.parent
+if str(HOOKS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(HOOKS_DIRECTORY))
+
+from blocking import pr_lifecycle_skill_gate as gate
+from hooks_constants.pr_lifecycle_skill_gate_constants import DENY_REASON
+
+
+def _transcript(tmp_path: Path, skill_name: str | None = None, compact: bool = False) -> Path:
+    lines = [json.dumps({"type": "user", "message": {"content": "Start."}})]
+    if skill_name:
+        lines.append(json.dumps({"type": "assistant", "message": {"content": [{"type": "tool_use", "name": "Skill", "input": {"skill": skill_name}}]}}))
+    if compact:
+        lines.append(json.dumps({"subtype": "compact_boundary"}))
+    transcript_path = tmp_path / "session.jsonl"
+    transcript_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    return transcript_path
+
+
+def _payload(command: str, path: Path, tool_name: str = "Bash") -> dict[str, object]:
+    return {"tool_name": tool_name, "tool_input": {"command": command}, "transcript_path": str(path)}
+
+
+def _run_main(payload: object) -> tuple[int, str]:
+    stdin_text = payload if isinstance(payload, str) else json.dumps(payload)
+    output = StringIO()
+    input_stream = TextIOWrapper(BytesIO(stdin_text.encode("utf-8")), encoding="utf-8")
+    with patch("sys.stdin", input_stream), patch("sys.stdout", output):
+        exit_code = gate.main()
+    return exit_code, output.getvalue()
+
+
+def _assert_denied(payload: dict[str, object]) -> None:
+    assert gate.decision_for(payload) == {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "deny",
+            "permissionDecisionReason": DENY_REASON,
+        }
+    }
+
+
+def test_unloaded_pull_request_command_is_denied(tmp_path: Path) -> None:
+    exit_code, output = _run_main(_payload("gh pr create", _transcript(tmp_path)))
+    assert exit_code == 0
+    decision = json.loads(output)["hookSpecificOutput"]
+    assert decision["hookEventName"] == "PreToolUse"
+    assert decision["permissionDecision"] == "deny"
+    assert "Skill tool" in decision["permissionDecisionReason"]
+    assert "same command again" in decision["permissionDecisionReason"]
+
+
+def test_loaded_skill_allows_action_silently(tmp_path: Path) -> None:
+    path = _transcript(tmp_path, "plugin:pr-lifecycle")
+    assert _run_main(_payload("gh pr create", path)) == (0, "")
+
+
+def test_user_slash_command_loads_skill(tmp_path: Path) -> None:
+    path = tmp_path / "slash.jsonl"
+    path.write_text(json.dumps({"type": "user", "message": {"content": "<command-name>/pr-lifecycle</command-name>"}}) + "\n", encoding="utf-8")
+    assert _run_main(_payload("git commit", path)) == (0, "")
+
+
+def test_compaction_requires_another_invocation(tmp_path: Path) -> None:
+    _assert_denied(_payload("git push", _transcript(tmp_path, "pr-lifecycle", compact=True)))
+
+
+def test_agent_transcript_can_supply_invocation(tmp_path: Path) -> None:
+    session_path = _transcript(tmp_path)
+    agent_path = tmp_path / "agent.jsonl"
+    agent_path.write_text(json.dumps({"type": "assistant", "message": {"content": [{"type": "tool_use", "name": "Skill", "input": {"skill": "pr-lifecycle"}}]}}) + "\n", encoding="utf-8")
+    payload = _payload("git push", session_path)
+    payload["agent_transcript_path"] = str(agent_path)
+    assert gate.decision_for(payload) is None
+
+
+def test_unreadable_or_missing_transcript_allows_silently(tmp_path: Path) -> None:
+    payload = _payload("gh pr create", tmp_path / "missing.jsonl")
+    assert _run_main(payload) == (0, "")
+    payload.pop("transcript_path")
+    assert _run_main(payload) == (0, "")
+
+
+def test_action_command_shapes(tmp_path: Path) -> None:
+    path = _transcript(tmp_path)
+    commands = (
+        "git commit",
+        "git -C some/path commit -F message.txt",
+        "git --git-dir=.git push origin head",
+        "gh pr create",
+        "gh -R owner/repo pr --repo owner/repo merge",
+        "gh api -X PUT repos/owner/repo/pulls/1/merge",
+        "gh api graphql -f query='mutation { enablePullRequestAutoMerge }'",
+        "gh api graphql -f name=auto-merge",
+        "echo done; gh pr edit",
+        "GIT_TRACE=1 git push",
+        "env -u GH_TOKEN gh pr merge 1",
+        "env --unset=GH_TOKEN GH_HOST=github.com gh pr create",
+        "sudo git push",
+        "(git push)",
+    )
+    for command in commands:
+        _assert_denied(_payload(command, path, "PowerShell"))
+
+
+def test_non_action_command_shapes(tmp_path: Path) -> None:
+    path = _transcript(tmp_path)
+    commands = (
+        "git status",
+        "git commit-tree 123",
+        "git log --grep push",
+        "echo 'gh pr create'",
+        "gh api repos/owner/repo/pulls/1/mergeability",
+        "gh issue create --body-file message.txt",
+        "gh pr",
+        "GH_TOKEN=x gh issue list",
+        "env -u GH_TOKEN git status",
+    )
+    for command in commands:
+        assert gate.decision_for(_payload(command, path)) is None, command
+
+
+def test_matching_github_mcp_tools_are_denied(tmp_path: Path) -> None:
+    path = _transcript(tmp_path)
+    for suffix in ("create_pull_request", "merge_pull_request", "enable_pr_auto_merge", "update_pull_request"):
+        payload = _payload("", path, "mcp__github__" + suffix)
+        _assert_denied(payload)
+
+
+def test_malformed_payload_exits_zero_silently() -> None:
+    assert _run_main("bad json") == (0, "")
+
+
+def test_hook_has_its_own_pre_tool_use_registration() -> None:
+    registration_path = HOOKS_DIRECTORY / "hooks.json"
+    all_registration_fields = json.loads(registration_path.read_text(encoding="utf-8"))
+    all_groups = all_registration_fields["hooks"]["PreToolUse"]
+    matching_groups = [
+        each_group
+        for each_group in all_groups
+        if each_group["matcher"]
+        == "Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request)"
+    ]
+    assert matching_groups == [
+        {
+            "matcher": "Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request)",
+            "hooks": [
+                {
+                    "type": "command",
+                    "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/pr_lifecycle_skill_gate.py",
+                    "timeout": 10,
+                }
+            ],
+        }
+    ]

package/hooks/hooks.json

@@ -47,6 +47,16 @@
           }
         ]
       },
+      {
+        "matcher": "Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/pr_lifecycle_skill_gate.py",
+            "timeout": 10
+          }
+        ]
+      },
       {
         "matcher": "EnterWorktree",
         "hooks": [

package/hooks/hooks_constants/pr_lifecycle_skill_gate_constants.py

@@ -0,0 +1,33 @@
+"""Constants for the pull request lifecycle skill gate."""
+
+HOOK_EVENT_NAME = "PreToolUse"
+HOOK_SPECIFIC_OUTPUT_KEY = "hookSpecificOutput"
+PERMISSION_DECISION_KEY = "permissionDecision"
+PERMISSION_DECISION_REASON_KEY = "permissionDecisionReason"
+DENY_DECISION = "deny"
+DENY_REASON = (
+    "Invoke the pr-lifecycle skill with the Skill tool, then run the same command again."
+)
+SKILL_NAME = "pr-lifecycle"
+ALL_SLASH_COMMAND_MARKERS = ("<command-name>/pr-lifecycle</command-name>",)
+SHELL_TOOL_NAMES = frozenset({"Bash", "PowerShell"})
+ALL_GITHUB_MCP_TOOL_SUFFIXES = (
+    "__create_pull_request",
+    "__merge_pull_request",
+    "__enable_pr_auto_merge",
+    "__update_pull_request",
+)
+ALL_TRANSCRIPT_PATH_FIELDS = ("transcript_path", "agent_transcript_path")
+COMMAND_SEPARATORS = ";|&\n()"
+COMMAND_WHITESPACE = " \t\r"
+OPTION_AND_VALUE_WORD_COUNT = 2
+GIT_GLOBAL_OPTIONS_WITH_VALUE = frozenset({"-C", "-c", "--git-dir", "--work-tree", "--namespace", "--config-env"})
+GH_OPTIONS_WITH_VALUE = frozenset({"-R", "--repo", "--hostname", "--config", "-H", "--header", "-X", "--method", "-F", "--field", "-f", "--raw-field", "--input", "--jq", "-q", "--template", "-t", "--cache"})
+GIT_ACTIONS = frozenset({"commit", "push"})
+GH_PULL_REQUEST_COMMAND = "pr"
+GH_API_COMMAND = "api"
+MERGE_PATH_SUFFIX = "/merge"
+ALL_API_ACTION_NAMES = ("auto-merge", "enablePullRequestAutoMerge")
+ALL_COMMAND_PREFIX_WORDS = frozenset({"env", "sudo", "command", "exec", "nohup", "time"})
+ALL_PREFIX_OPTIONS_WITH_VALUE = frozenset({"-u", "--unset", "-C", "--chdir", "-g", "--group", "--user"})
+ENVIRONMENT_ASSIGNMENT_PATTERN = r"^[A-Za-z_][A-Za-z0-9_]*="

package/hooks/hooks_constants/skill_loaded_reminder_constants.py

@@ -4,8 +4,6 @@ from __future__ import annotations
 
 __all__ = [
     "ALL_SELF_LOADING_SUBAGENT_TYPES",
-    "ASSISTANT_ENTRY_TYPE",
-    "COMPACT_BOUNDARY_SUBTYPE",
     "COMPACTION_REMINDER",
     "COMPACTION_SOURCE",
     "NOT_LOADED_REMINDER",
@@ -13,14 +11,11 @@ __all__ = [
     "PRE_TOOL_USE_EVENT_NAME",
     "PROMPT_SEPARATOR",
     "SESSION_START_EVENT_NAME",
-    "SKILL_TOOL_NAME",
     "ALL_SLASH_COMMAND_MARKERS",
     "SUBAGENT_START_EVENT_NAME",
     "CLAUDE_SUBAGENT_PROMPT_PREFIX",
     "CODEX_SUBAGENT_PROMPT_PREFIX",
     "ALL_SPAWN_PROMPT_FIELDS_AND_PREFIXES_BY_TOOL_NAME",
-    "TOOL_USE_BLOCK_TYPE",
-    "USER_ENTRY_TYPE",
     "USER_PROMPT_SUBMIT_EVENT_NAME",
     "WORKFLOW_SUBAGENT_TYPE",
 ]
@@ -42,11 +37,6 @@ ALL_SLASH_COMMAND_MARKERS = (
 )
 PROMPT_SEPARATOR = "\n\n"
 
-ASSISTANT_ENTRY_TYPE = "assistant"
-USER_ENTRY_TYPE = "user"
-TOOL_USE_BLOCK_TYPE = "tool_use"
-COMPACT_BOUNDARY_SUBTYPE = "compact_boundary"
-
 CLAUDE_SUBAGENT_PROMPT_PREFIX = (
     "Before any other work, invoke the poteto-mode skill with the Skill tool. "
     "Every prompt you write for a subagent opens with the same instruction."

package/hooks/hooks_constants/test_pr_lifecycle_skill_gate_constants.py

@@ -0,0 +1,12 @@
+from hooks_constants import pr_lifecycle_skill_gate_constants as constants
+
+
+def test_gate_targets_the_named_skill_and_pre_tool_use() -> None:
+    assert constants.SKILL_NAME == "pr-lifecycle"
+    assert constants.HOOK_EVENT_NAME == "PreToolUse"
+    assert constants.DENY_DECISION == "deny"
+
+
+def test_gate_covers_shells_and_pull_request_tools() -> None:
+    assert constants.SHELL_TOOL_NAMES == {"Bash", "PowerShell"}
+    assert len(constants.ALL_GITHUB_MCP_TOOL_SUFFIXES) == 4

package/hooks/hooks_constants/test_transcript_skill_scan_constants.py

@@ -0,0 +1,7 @@
+from hooks_constants import transcript_skill_scan_constants as constants
+
+
+def test_transcript_entry_names() -> None:
+    assert constants.COMPACT_BOUNDARY_SUBTYPE == "compact_boundary"
+    assert constants.SKILL_TOOL_NAME == "Skill"
+    assert constants.TOOL_USE_BLOCK_TYPE == "tool_use"

package/hooks/hooks_constants/transcript_skill_scan_constants.py

@@ -0,0 +1,7 @@
+"""Entry fields used by transcript skill scans."""
+
+ASSISTANT_ENTRY_TYPE = "assistant"
+COMPACT_BOUNDARY_SUBTYPE = "compact_boundary"
+SKILL_TOOL_NAME = "Skill"
+TOOL_USE_BLOCK_TYPE = "tool_use"
+USER_ENTRY_TYPE = "user"

package/hooks/session/skill_loaded_reminder.py

@@ -29,8 +29,6 @@ if _hooks_dir not in sys.path:
 
 from hooks_constants.skill_loaded_reminder_constants import (
     ALL_SELF_LOADING_SUBAGENT_TYPES,
-    ASSISTANT_ENTRY_TYPE,
-    COMPACT_BOUNDARY_SUBTYPE,
     COMPACTION_REMINDER,
     COMPACTION_SOURCE,
     NOT_LOADED_REMINDER,
@@ -38,18 +36,16 @@ from hooks_constants.skill_loaded_reminder_constants import (
     PRE_TOOL_USE_EVENT_NAME,
     PROMPT_SEPARATOR,
     SESSION_START_EVENT_NAME,
-    SKILL_TOOL_NAME,
     ALL_SLASH_COMMAND_MARKERS,
     SUBAGENT_START_EVENT_NAME,
     ALL_SPAWN_PROMPT_FIELDS_AND_PREFIXES_BY_TOOL_NAME,
-    TOOL_USE_BLOCK_TYPE,
-    USER_ENTRY_TYPE,
     USER_PROMPT_SUBMIT_EVENT_NAME,
     WORKFLOW_SUBAGENT_TYPE,
 )
 from hooks_constants.pre_tool_use_allow_output import write_pre_tool_use_allow_to_stdout
 from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
 from hooks_constants.setup_project_paths_constants import DECODE_ERRORS_POLICY, UTF8_ENCODING
+from transcript_skill_scan import skill_invocation_status
 
 
 def subagent_input_with_poteto_mode(
@@ -81,44 +77,6 @@ def subagent_input_with_poteto_mode(
     return {**all_tool_input_fields, field_name: invocation_prefix + PROMPT_SEPARATOR + prompt}
 
 
-def _invokes_poteto_mode(all_entry_fields: dict[str, object]) -> bool:
-    message = all_entry_fields.get("message")
-    if not isinstance(message, dict):
-        return False
-    content_blocks = message.get("content")
-    if all_entry_fields.get("type") == USER_ENTRY_TYPE and isinstance(content_blocks, str):
-        return any(each_marker in content_blocks for each_marker in ALL_SLASH_COMMAND_MARKERS)
-    if all_entry_fields.get("type") != ASSISTANT_ENTRY_TYPE or not isinstance(content_blocks, list):
-        return False
-    return any(
-        isinstance(each_block, dict)
-        and each_block.get("type") == TOOL_USE_BLOCK_TYPE
-        and each_block.get("name") == SKILL_TOOL_NAME
-        and isinstance(each_block.get("input"), dict)
-        and each_block["input"].get("skill") in ALL_POTETO_MODE_SKILL_NAMES
-        for each_block in content_blocks
-    )
-
-
-def _marker_entry(transcript_line: str) -> dict[str, object] | None:
-    if (
-        COMPACT_BOUNDARY_SUBTYPE not in transcript_line
-        and ALL_POTETO_MODE_SKILL_NAMES[0] not in transcript_line
-    ):
-        return None
-    try:
-        parsed_entry = json.loads(transcript_line)
-    except json.JSONDecodeError:
-        return None
-    return parsed_entry if isinstance(parsed_entry, dict) else None
-
-
-def _is_loaded_after(all_entry_fields: dict[str, object], was_loaded: bool) -> bool:
-    if all_entry_fields.get("subtype") == COMPACT_BOUNDARY_SUBTYPE:
-        return False
-    return was_loaded or _invokes_poteto_mode(all_entry_fields)
-
-
 def poteto_mode_status(all_transcript_lines: Iterable[str]) -> tuple[bool, bool]:
     """Report whether the skill was invoked and whether it remains loaded.
 
@@ -139,14 +97,9 @@ def poteto_mode_status(all_transcript_lines: Iterable[str]) -> tuple[bool, bool]
     Returns:
         Whether the skill was invoked at any point and whether it is loaded now.
     """
-    was_invoked = False
-    is_loaded = False
-    for each_line in all_transcript_lines:
-        all_entry_fields = _marker_entry(each_line)
-        if all_entry_fields is not None:
-            is_loaded = _is_loaded_after(all_entry_fields, is_loaded)
-            was_invoked = was_invoked or is_loaded
-    return was_invoked, is_loaded
+    return skill_invocation_status(
+        all_transcript_lines, ALL_POTETO_MODE_SKILL_NAMES, ALL_SLASH_COMMAND_MARKERS
+    )
 
 
 def is_poteto_mode_loaded(all_transcript_lines: Iterable[str]) -> bool:

package/hooks/session/test_skill_loaded_reminder.py

@@ -200,6 +200,10 @@ class TestIsPotetoModeLoaded:
         prefixed_command_line = TYPED_COMMAND_LINE.replace("/poteto-mode", "/pstack:poteto-mode")
         assert reminder.is_poteto_mode_loaded([prefixed_command_line])
 
+    def test_a_different_skill_call_does_not_load_it(self) -> None:
+        other_skill_call_line = SKILL_CALL_LINE.replace("poteto-mode", "pr-lifecycle")
+        assert not reminder.is_poteto_mode_loaded([other_skill_call_line])
+
     def test_a_compaction_after_the_skill_call_drops_it(self) -> None:
         assert not reminder.is_poteto_mode_loaded(
             [SKILL_CALL_LINE, COMPACT_BOUNDARY_LINE, READ_CALL_LINE]

package/hooks/test_transcript_skill_scan.py

@@ -0,0 +1,58 @@
+"""Tests for skill invocation state across transcript compactions."""
+
+import json
+import sys
+from pathlib import Path
+
+HOOKS_DIRECTORY = Path(__file__).resolve().parent
+if str(HOOKS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(HOOKS_DIRECTORY))
+
+from transcript_skill_scan import is_skill_loaded_after_last_compaction, skill_invocation_status
+
+
+def _skill_entry(name: str) -> str:
+    return json.dumps(
+        {"type": "assistant", "message": {"content": [{"type": "tool_use", "name": "Skill", "input": {"skill": name}}]}}
+    )
+
+
+def test_matching_skill_after_compaction_loads() -> None:
+    lines = [
+        _skill_entry("pr-lifecycle"),
+        json.dumps({"type": "system", "subtype": "compact_boundary"}),
+        _skill_entry("plugin:pr-lifecycle"),
+    ]
+    assert is_skill_loaded_after_last_compaction(
+        lines, ("pr-lifecycle",), ("<command-name>/pr-lifecycle</command-name>",)
+    )
+
+
+def test_compaction_drops_a_loaded_skill() -> None:
+    lines = [_skill_entry("pr-lifecycle"), json.dumps({"subtype": "compact_boundary"})]
+    assert not is_skill_loaded_after_last_compaction(lines, ("pr-lifecycle",), ())
+
+
+def test_user_command_loads_and_quoted_tool_result_does_not() -> None:
+    marker = "<command-name>/pr-lifecycle</command-name>"
+    user_entry = json.dumps({"type": "user", "message": {"content": marker}})
+    quoted_result = json.dumps(
+        {"type": "user", "message": {"content": [{"type": "tool_result", "content": marker}]}}
+    )
+    assert is_skill_loaded_after_last_compaction([user_entry], ("pr-lifecycle",), (marker,))
+    assert not is_skill_loaded_after_last_compaction([quoted_result], ("pr-lifecycle",), (marker,))
+
+
+def test_malformed_entries_do_not_load() -> None:
+    assert not is_skill_loaded_after_last_compaction(
+        ["pr-lifecycle {", json.dumps({"type": "assistant", "message": {"content": "pr-lifecycle"}})],
+        ("pr-lifecycle",),
+        (),
+    )
+
+
+def test_invocation_status_separates_ever_invoked_from_loaded_now() -> None:
+    compaction = json.dumps({"subtype": "compact_boundary"})
+    assert skill_invocation_status([_skill_entry("pr-lifecycle")], ("pr-lifecycle",), ()) == (True, True)
+    assert skill_invocation_status([_skill_entry("pr-lifecycle"), compaction], ("pr-lifecycle",), ()) == (True, False)
+    assert skill_invocation_status([compaction, _skill_entry("other")], ("pr-lifecycle",), ()) == (False, False)