claude-dev-env 8.43.3 → 8.43.5

package/bin/install.mjs

@@ -1363,15 +1363,16 @@ function commandRunsHookOfRootSharingSettings(normalizedCommand, relativePath, s
     while (tailStart !== -1) {
         const characterAfterPath = normalizedCommand[tailStart + hookPathTail.length];
         if (characterAfterPath === undefined || commandArgumentBoundary.test(characterAfterPath)) {
-            let rootStart = tailStart;
+            let rootPath;
             if (characterAfterPath === '"' || characterAfterPath === "'") {
-                rootStart = normalizedCommand.lastIndexOf(characterAfterPath, tailStart - 1) + 1;
+                rootPath = quotedRootPathBeforeTail(normalizedCommand.slice(0, tailStart), characterAfterPath);
             } else {
+                let rootStart = tailStart;
                 while (rootStart > 0 && !commandArgumentBoundary.test(normalizedCommand[rootStart - 1])) {
                     rootStart--;
                 }
+                rootPath = normalizedCommand.slice(rootStart, tailStart);
             }
-            const rootPath = normalizedCommand.slice(rootStart, tailStart);
             const rootSettingsRealPath = rootPath
                 ? realPathOrNull(join(rootPath, SETTINGS_FILE_NAME))
                 : null;
@@ -1384,6 +1385,41 @@ function commandRunsHookOfRootSharingSettings(normalizedCommand, relativePath, s
     return false;
 }
 
+/**
+ * How each quote style of a hook path argument joins the segments around an
+ * escaped character, keyed by the quote, in the forward-slash command form.
+ */
+const QUOTED_ARGUMENT_ESCAPES = {
+    '"': { segmentJoin: '"^%"', joinedCharacter: '%' },
+    "'": { segmentJoin: "'/''", joinedCharacter: "'" },
+};
+
+/**
+ * Decode the root part of a quoted argument that `commandArgumentFromPath`
+ * wrote, read from the command text that ends where the hook path tail starts.
+ *
+ * The win32 form splits a path at each `%` into `"a"^%"b"`. The POSIX form
+ * escapes each `'` as `'\''`, which reads `'/''` once backslashes become
+ * forward slashes.
+ *
+ * @param {string} commandBeforeTail Normalized command text up to the hook path tail.
+ * @param {string} closingQuote The quote that closes the argument after the tail.
+ * @returns {string} The root path with each escaped character restored.
+ */
+function quotedRootPathBeforeTail(commandBeforeTail, closingQuote) {
+    const { segmentJoin, joinedCharacter } = QUOTED_ARGUMENT_ESCAPES[closingQuote];
+    const segments = [];
+    let segmentEnd = commandBeforeTail.length;
+    let openingQuote = commandBeforeTail.lastIndexOf(closingQuote, segmentEnd - 1);
+    while (commandBeforeTail.slice(openingQuote - segmentJoin.length + 1, openingQuote + 1) === segmentJoin) {
+        segments.unshift(commandBeforeTail.slice(openingQuote + 1, segmentEnd));
+        segmentEnd = openingQuote - segmentJoin.length + 1;
+        openingQuote = commandBeforeTail.lastIndexOf(closingQuote, segmentEnd - 1);
+    }
+    segments.unshift(commandBeforeTail.slice(openingQuote + 1, segmentEnd));
+    return segments.join(joinedCharacter);
+}
+
 function commandTailEndsAtManagedHook(normalizedCommand, relativePath) {
     if (commandHoldsPathAtBoundary(normalizedCommand, `/.claude/hooks/${relativePath}`)) {
         return true;

package/bin/install.shared-settings.test.mjs

@@ -243,3 +243,49 @@ test('the merge prunes a quoted hook of a sharing root whose path holds a space'
         rmSync(sandboxRoot, { recursive: true, force: true });
     }
 });
+
+for (const { shape, rootDirectoryName, platform } of [
+    { shape: 'a percent sign', rootDirectoryName: 'Jane 100% Doe', platform: 'win32' },
+    { shape: 'an apostrophe', rootDirectoryName: "Jane O'Doe", platform: 'linux' },
+]) {
+    test(`the merge prunes a ${platform}-quoted hook of a sharing root whose path holds ${shape}`, t => {
+        const sandboxRoot = mkdtempSync(join(tmpdir(), 'cdev-shared-settings-escape-'));
+        try {
+            const installRoot = join(sandboxRoot, 'install-root');
+            const sharingRoot = join(sandboxRoot, rootDirectoryName, 'profiles', 'second');
+            for (const eachRoot of [installRoot, sharingRoot]) mkdirSync(eachRoot, { recursive: true });
+            const settingsPath = join(installRoot, 'settings.json');
+            writeFileSync(settingsPath, '{}\n');
+            try {
+                symlinkSync(settingsPath, join(sharingRoot, 'settings.json'), 'file');
+            } catch (linkError) {
+                t.skip(`this host cannot create a file symlink (${linkError.code})`);
+                return;
+            }
+            const hooksConfig = {
+                hooks: {
+                    SessionStart: [{
+                        matcher: '',
+                        hooks: [{ type: 'command', command: 'python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/start.py' }],
+                    }],
+                },
+            };
+            const forwardSlashed = rootPath => rootPath.replace(/\\/g, '/');
+            const sharingHookPath = `${forwardSlashed(sharingRoot)}/hooks/session/start.py`;
+            const sharingCommand = `python3 ${commandArgumentFromPath(sharingHookPath, platform)}`;
+            const settings = {
+                hooks: {
+                    SessionStart: [{ matcher: '', hooks: [{ type: 'command', command: sharingCommand }] }],
+                },
+            };
+
+            mergeHooksIntoSettings(settings, hooksConfig, forwardSlashed(installRoot), 'python3', settingsPath);
+
+            const allCommands = settings.hooks.SessionStart.flatMap(group => group.hooks.map(hook => hook.command));
+            assert.ok(!allCommands.includes(sharingCommand), `the sharing root entry ${sharingCommand} is pruned`);
+            assert.equal(allCommands.length, 1, 'only the install root entry stays after the merge');
+        } finally {
+            rmSync(sandboxRoot, { recursive: true, force: true });
+        }
+    });
+}

package/hooks/blocking/pr_lifecycle_skill_gate.py

@@ -17,6 +17,8 @@ from hooks_constants.pr_lifecycle_skill_gate_constants import (
     ALL_COMMAND_PREFIX_WORDS,
     ALL_GITHUB_MCP_TOOL_SUFFIXES,
     ALL_PREFIX_OPTIONS_WITH_VALUE,
+    ALL_PYTHON_EXECUTABLES,
+    ALL_SHELL_WRAPPER_EXECUTABLES,
     ALL_SLASH_COMMAND_MARKERS,
     ALL_TRANSCRIPT_PATH_FIELDS,
     COMMAND_SEPARATORS,
@@ -33,8 +35,11 @@ from hooks_constants.pr_lifecycle_skill_gate_constants import (
     HOOK_SPECIFIC_OUTPUT_KEY,
     MERGE_PATH_SUFFIX,
     OPTION_AND_VALUE_WORD_COUNT,
+    PATH_SEPARATOR_PATTERN,
     PERMISSION_DECISION_KEY,
     PERMISSION_DECISION_REASON_KEY,
+    PULL_REQUEST_SCRIPT_NAME,
+    PYTHON_OPTIONS_WITH_VALUE,
     SHELL_TOOL_NAMES,
     SKILL_NAME,
 )
@@ -117,12 +122,29 @@ def _words_from_executable(all_words: list[str]) -> list[str]:
     return []
 
 
+def _file_name(path_word: str) -> str:
+    return re.split(PATH_SEPARATOR_PATTERN, path_word)[-1].lower()
+
+
+def _runs_pull_request_script(all_words: list[str]) -> bool:
+    script, _ = _next_command_word(all_words, 1, PYTHON_OPTIONS_WITH_VALUE)
+    return script is not None and _file_name(script) == PULL_REQUEST_SCRIPT_NAME
+
+
 def _matches_shell_command(command: str) -> bool:
     for each_segment in _command_segments(command):
         all_command_words = _words_from_executable(each_segment)
         if not all_command_words:
             continue
-        executable = all_command_words[0].lower()
+        executable = _file_name(all_command_words[0])
+        if executable == PULL_REQUEST_SCRIPT_NAME:
+            return True
+        if executable in ALL_PYTHON_EXECUTABLES and _runs_pull_request_script(all_command_words):
+            return True
+        if executable in ALL_SHELL_WRAPPER_EXECUTABLES and any(
+            _matches_shell_command(each_argument) for each_argument in all_command_words[1:]
+        ):
+            return True
         if executable in {"git", "git.exe"} and _is_git_action(all_command_words):
             return True
         if executable in {"gh", "gh.exe"} and _is_gh_action(all_command_words):

package/hooks/blocking/test_pr_lifecycle_skill_gate.py

@@ -128,6 +128,33 @@ def test_non_action_command_shapes(tmp_path: Path) -> None:
         assert gate.decision_for(_payload(command, path)) is None, command
 
 
+def test_wrapped_and_scripted_action_shapes_are_denied(tmp_path: Path) -> None:
+    path = _transcript(tmp_path)
+    commands = (
+        'bash -c "git push"',
+        "sh -lc 'gh pr create'",
+        'pwsh -NoProfile -Command "git commit -F message.txt"',
+        "echo `git push`",
+        "python ~/.agents/skills/pull-request/scripts/pull_request.py create --title-file t.txt",
+        "python3 -X utf8 'C:\\repo\\scripts\\pull_request.py' edit",
+    )
+    for command in commands:
+        _assert_denied(_payload(command, path))
+
+
+def test_wrapped_and_scripted_non_action_shapes_are_allowed(tmp_path: Path) -> None:
+    path = _transcript(tmp_path)
+    commands = (
+        'bash -c "git status"',
+        "bash script.sh",
+        "cat scripts/pull_request.py",
+        "python -m pytest scripts/test_pull_request.py",
+        "echo `git log`",
+    )
+    for command in commands:
+        assert gate.decision_for(_payload(command, path)) is None, command
+
+
 def test_matching_github_mcp_tools_are_denied(tmp_path: Path) -> None:
     path = _transcript(tmp_path)
     for suffix in ("create_pull_request", "merge_pull_request", "enable_pr_auto_merge", "update_pull_request"):

package/hooks/hooks_constants/pr_lifecycle_skill_gate_constants.py

@@ -18,7 +18,7 @@ ALL_GITHUB_MCP_TOOL_SUFFIXES = (
     "__update_pull_request",
 )
 ALL_TRANSCRIPT_PATH_FIELDS = ("transcript_path", "agent_transcript_path")
-COMMAND_SEPARATORS = ";|&\n()"
+COMMAND_SEPARATORS = ";|&\n()`"
 COMMAND_WHITESPACE = " \t\r"
 OPTION_AND_VALUE_WORD_COUNT = 2
 GIT_GLOBAL_OPTIONS_WITH_VALUE = frozenset({"-C", "-c", "--git-dir", "--work-tree", "--namespace", "--config-env"})
@@ -31,3 +31,8 @@ ALL_API_ACTION_NAMES = ("auto-merge", "enablePullRequestAutoMerge")
 ALL_COMMAND_PREFIX_WORDS = frozenset({"env", "sudo", "command", "exec", "nohup", "time"})
 ALL_PREFIX_OPTIONS_WITH_VALUE = frozenset({"-u", "--unset", "-C", "--chdir", "-g", "--group", "--user"})
 ENVIRONMENT_ASSIGNMENT_PATTERN = r"^[A-Za-z_][A-Za-z0-9_]*="
+ALL_SHELL_WRAPPER_EXECUTABLES = frozenset({"bash", "sh", "zsh", "dash", "pwsh", "pwsh.exe", "powershell", "powershell.exe"})
+ALL_PYTHON_EXECUTABLES = frozenset({"python", "python3", "python.exe", "python3.exe", "py", "py.exe"})
+PULL_REQUEST_SCRIPT_NAME = "pull_request.py"
+PATH_SEPARATOR_PATTERN = r"[\\/]"
+PYTHON_OPTIONS_WITH_VALUE = frozenset({"-X", "-W"})

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.43.3",
+    "version": "8.43.5",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/policy_lint/config/approved_test_pairs.py

@@ -23,6 +23,7 @@ APPROVED_TEST_PATHS_BY_PRODUCTION_PATH: dict[
         {
             PurePosixPath("packages/claude-dev-env/bin/install.agents-home.test.mjs"),
             PurePosixPath("packages/claude-dev-env/bin/install.cursor-rules.test.mjs"),
+            PurePosixPath("packages/claude-dev-env/bin/install.shared-settings.test.mjs"),
         }
     ),
     PurePosixPath(

package/scripts/tests/test_policy_lint_rules_pairing.py

@@ -557,6 +557,19 @@ def test_pairing_accepts_installer_module_with_the_agents_home_suite(
     assert all_paths == ()
 
 
+def test_pairing_accepts_installer_module_with_the_shared_settings_suite(
+    tmp_path: Path,
+) -> None:
+    all_paths = _diagnostic_paths(
+        tmp_path,
+        _body_change_at(_INSTALLER_MODULE_PATH),
+        _body_change_at(
+            PurePosixPath("packages/claude-dev-env/bin/install.shared-settings.test.mjs")
+        ),
+    )
+    assert all_paths == ()
+
+
 _COMMENT_RULES_PRODUCTION_PATH = PurePosixPath(
     "packages/claude-dev-env/hooks/blocking/code_rules_comments.py"
 )