claude-dev-env 8.43.2 → 8.43.4

package/hooks/blocking/pr_lifecycle_skill_gate.py

@@ -17,6 +17,8 @@ from hooks_constants.pr_lifecycle_skill_gate_constants import (
     ALL_COMMAND_PREFIX_WORDS,
     ALL_GITHUB_MCP_TOOL_SUFFIXES,
     ALL_PREFIX_OPTIONS_WITH_VALUE,
+    ALL_PYTHON_EXECUTABLES,
+    ALL_SHELL_WRAPPER_EXECUTABLES,
     ALL_SLASH_COMMAND_MARKERS,
     ALL_TRANSCRIPT_PATH_FIELDS,
     COMMAND_SEPARATORS,
@@ -33,8 +35,11 @@ from hooks_constants.pr_lifecycle_skill_gate_constants import (
     HOOK_SPECIFIC_OUTPUT_KEY,
     MERGE_PATH_SUFFIX,
     OPTION_AND_VALUE_WORD_COUNT,
+    PATH_SEPARATOR_PATTERN,
     PERMISSION_DECISION_KEY,
     PERMISSION_DECISION_REASON_KEY,
+    PULL_REQUEST_SCRIPT_NAME,
+    PYTHON_OPTIONS_WITH_VALUE,
     SHELL_TOOL_NAMES,
     SKILL_NAME,
 )
@@ -117,12 +122,29 @@ def _words_from_executable(all_words: list[str]) -> list[str]:
     return []
 
 
+def _file_name(path_word: str) -> str:
+    return re.split(PATH_SEPARATOR_PATTERN, path_word)[-1].lower()
+
+
+def _runs_pull_request_script(all_words: list[str]) -> bool:
+    script, _ = _next_command_word(all_words, 1, PYTHON_OPTIONS_WITH_VALUE)
+    return script is not None and _file_name(script) == PULL_REQUEST_SCRIPT_NAME
+
+
 def _matches_shell_command(command: str) -> bool:
     for each_segment in _command_segments(command):
         all_command_words = _words_from_executable(each_segment)
         if not all_command_words:
             continue
-        executable = all_command_words[0].lower()
+        executable = _file_name(all_command_words[0])
+        if executable == PULL_REQUEST_SCRIPT_NAME:
+            return True
+        if executable in ALL_PYTHON_EXECUTABLES and _runs_pull_request_script(all_command_words):
+            return True
+        if executable in ALL_SHELL_WRAPPER_EXECUTABLES and any(
+            _matches_shell_command(each_argument) for each_argument in all_command_words[1:]
+        ):
+            return True
         if executable in {"git", "git.exe"} and _is_git_action(all_command_words):
             return True
         if executable in {"gh", "gh.exe"} and _is_gh_action(all_command_words):

package/hooks/blocking/test_pr_lifecycle_skill_gate.py

@@ -128,6 +128,33 @@ def test_non_action_command_shapes(tmp_path: Path) -> None:
         assert gate.decision_for(_payload(command, path)) is None, command
 
 
+def test_wrapped_and_scripted_action_shapes_are_denied(tmp_path: Path) -> None:
+    path = _transcript(tmp_path)
+    commands = (
+        'bash -c "git push"',
+        "sh -lc 'gh pr create'",
+        'pwsh -NoProfile -Command "git commit -F message.txt"',
+        "echo `git push`",
+        "python ~/.agents/skills/pull-request/scripts/pull_request.py create --title-file t.txt",
+        "python3 -X utf8 'C:\\repo\\scripts\\pull_request.py' edit",
+    )
+    for command in commands:
+        _assert_denied(_payload(command, path))
+
+
+def test_wrapped_and_scripted_non_action_shapes_are_allowed(tmp_path: Path) -> None:
+    path = _transcript(tmp_path)
+    commands = (
+        'bash -c "git status"',
+        "bash script.sh",
+        "cat scripts/pull_request.py",
+        "python -m pytest scripts/test_pull_request.py",
+        "echo `git log`",
+    )
+    for command in commands:
+        assert gate.decision_for(_payload(command, path)) is None, command
+
+
 def test_matching_github_mcp_tools_are_denied(tmp_path: Path) -> None:
     path = _transcript(tmp_path)
     for suffix in ("create_pull_request", "merge_pull_request", "enable_pr_auto_merge", "update_pull_request"):

package/hooks/hooks_constants/pr_lifecycle_skill_gate_constants.py

@@ -18,7 +18,7 @@ ALL_GITHUB_MCP_TOOL_SUFFIXES = (
     "__update_pull_request",
 )
 ALL_TRANSCRIPT_PATH_FIELDS = ("transcript_path", "agent_transcript_path")
-COMMAND_SEPARATORS = ";|&\n()"
+COMMAND_SEPARATORS = ";|&\n()`"
 COMMAND_WHITESPACE = " \t\r"
 OPTION_AND_VALUE_WORD_COUNT = 2
 GIT_GLOBAL_OPTIONS_WITH_VALUE = frozenset({"-C", "-c", "--git-dir", "--work-tree", "--namespace", "--config-env"})
@@ -31,3 +31,8 @@ ALL_API_ACTION_NAMES = ("auto-merge", "enablePullRequestAutoMerge")
 ALL_COMMAND_PREFIX_WORDS = frozenset({"env", "sudo", "command", "exec", "nohup", "time"})
 ALL_PREFIX_OPTIONS_WITH_VALUE = frozenset({"-u", "--unset", "-C", "--chdir", "-g", "--group", "--user"})
 ENVIRONMENT_ASSIGNMENT_PATTERN = r"^[A-Za-z_][A-Za-z0-9_]*="
+ALL_SHELL_WRAPPER_EXECUTABLES = frozenset({"bash", "sh", "zsh", "dash", "pwsh", "pwsh.exe", "powershell", "powershell.exe"})
+ALL_PYTHON_EXECUTABLES = frozenset({"python", "python3", "python.exe", "python3.exe", "py", "py.exe"})
+PULL_REQUEST_SCRIPT_NAME = "pull_request.py"
+PATH_SEPARATOR_PATTERN = r"[\\/]"
+PYTHON_OPTIONS_WITH_VALUE = frozenset({"-X", "-W"})

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.43.2",
+    "version": "8.43.4",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/dev_env_scripts_constants/account_broker_constants.py

@@ -224,9 +224,13 @@ def _account_reset(reading: Reading, is_spent: bool = False) -> datetime | None:
         return None
     if is_spent:
         return min((reset for reset in (meters.session_resets_at, meters.weekly_resets_at) if reset is not None), default=None)
-    if reading.account.product is Product.CLAUDE:
-        if reading.account.is_main:
-            return meters.weekly_resets_at
+    is_claude_main = reading.account.product is Product.CLAUDE and reading.account.is_main
+    if is_claude_main:
+        blocking = (
+            (meters.session_percent_left, FULL_PERCENT - ALL_CLAUDE_FLOORS["main_session_used_ceiling"], meters.session_resets_at),
+            (meters.weekly_percent_left, FULL_PERCENT - ALL_CLAUDE_FLOORS["main_weekly_used_ceiling"], meters.weekly_resets_at),
+        )
+    elif reading.account.product is Product.CLAUDE:
         blocking = (
             (meters.session_percent_left, FULL_PERCENT - ALL_CLAUDE_FLOORS["extra_session_used_ceiling"], meters.session_resets_at),
             (meters.weekly_percent_left, FULL_PERCENT - ALL_CLAUDE_FLOORS["extra_weekly_used_ceiling"], meters.weekly_resets_at),
@@ -236,7 +240,10 @@ def _account_reset(reading: Reading, is_spent: bool = False) -> datetime | None:
             (meters.session_percent_left, ALL_CODEX_FLOORS["luna_short_minimum_left"], meters.session_resets_at),
             (meters.weekly_percent_left, ALL_CODEX_FLOORS["luna_stop_left"], meters.weekly_resets_at),
         )
-    return max((reset for room, floor, reset in blocking if room is not None and room <= floor and reset is not None), default=None)
+    all_blocking_resets = [reset for room, floor, reset in blocking if room is not None and room <= floor and reset is not None]
+    if is_claude_main and meters.weekly_resets_at is not None:
+        all_blocking_resets.append(meters.weekly_resets_at - ALL_CLAUDE_FLOORS["main_spend_window"])
+    return max(all_blocking_resets, default=None)
 
 
 def _rank_key(reading: Reading) -> float:

package/scripts/test_account_broker.py

@@ -127,6 +127,28 @@ def test_should_prioritize_main_when_its_guard_passes() -> None:
     assert decision.account == main.account
 
 
+@pytest.mark.parametrize(
+    ("short_left", "weekly_left", "weekly_reset", "expected_reset"),
+    (
+        (40, 20, NOW + timedelta(hours=4), NOW + timedelta(hours=2)),
+        (80, 5, NOW + timedelta(hours=4), NOW + timedelta(hours=4)),
+        (80, 50, NOW + timedelta(days=3), NOW + timedelta(days=2)),
+    ),
+)
+def test_should_wait_for_the_meter_or_window_that_blocks_main(
+    short_left: float, weekly_left: float, weekly_reset: datetime, expected_reset: datetime
+) -> None:
+    main = Reading(
+        _account("main", Product.CLAUDE, main=True),
+        _meters(short_left, weekly_left, short_reset=NOW + timedelta(hours=2), weekly_reset=weekly_reset),
+    )
+
+    decision = choose_from_readings(Product.CLAUDE, (main,), now=NOW)
+
+    assert decision.action == "wait"
+    assert decision.resets_at == expected_reset
+
+
 def test_should_try_next_account_after_usage_limit(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     accounts = (_account("first"), _account("second"))
     adapter = _adapter(accounts, {"first": _meters(80, 80), "second": _meters(70, 70)})