claude-dev-env 8.48.7 → 8.49.0

package/.agents/skills/pull-request/SKILL.md

@@ -205,6 +205,9 @@ The recovery command restores the named account and deletes only that record.
   `--confirm-inactive` before recovery.
 - Normal pull request actions never call `gh auth switch`. If that command
   appears outside explicit recovery, stop.
+- `gh auth switch`, `login`, and `logout` change the account for every session
+  on the machine, and a PreToolUse hook denies them. Scope another account to
+  one command: `GH_TOKEN=$(gh auth token -u <account>) gh <command>`.
 - GitHub CLI output can contain account data. The command captures account
   lookup and recovery output and prints only generic errors.
 

package/hooks/blocking/gh_global_account_switch_gate.py

@@ -0,0 +1,116 @@
+#!/usr/bin/env python3
+"""PreToolUse gate: keep agents from changing the global GitHub CLI account.
+
+``gh auth switch``, ``gh auth login``, and ``gh auth logout`` write the shared
+gh configuration, so they change the active account for every session on the
+machine. A command segment whose program is ``gh`` and whose arguments start
+with one of those subcommands is denied, and the deny reason names the
+per-command ``GH_TOKEN`` form to run instead. The program is read past wrappers
+and chained commands, so ``cd x && gh auth switch`` and ``bash -c "gh auth
+logout"`` are denied too. ``gh auth status``, ``gh auth token``, and quoted text
+that only mentions the words pass.
+
+Hosted by ``blocking/bash_pre_tool_use_dispatcher.py`` for the Bash and
+PowerShell tools.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+try:
+    _hooks_root_directory = str(Path(__file__).resolve().parent.parent)
+    if _hooks_root_directory not in sys.path:
+        sys.path.insert(0, _hooks_root_directory)
+    from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
+        ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+        DENY_DECISION,
+        HOOK_EVENT_NAME,
+    )
+    from hooks_constants.gh_global_account_switch_gate_constants import (
+        ALL_GLOBAL_ACCOUNT_CHANGING_COMMAND_PATHS,
+        GATE_HOOK_NAME,
+        GH_COMMAND_PATH_LENGTH,
+        GH_PROGRAM_NAME,
+        GLOBAL_ACCOUNT_CHANGE_DENY_REASON,
+    )
+    from hooks_constants.hook_block_logger import log_hook_block
+    from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+    from hooks_constants.shell_command_pipeline import pipeline_segments_for_command
+    from hooks_constants.shell_command_wrappers import (
+        all_wrapped_command_texts,
+        segment_program_and_arguments,
+    )
+except ImportError as import_error:
+    raise ImportError(
+        "The gh global account switch gate cannot import its dependencies; "
+        "ensure the hooks directory is importable."
+    ) from import_error
+
+
+def _changes_global_gh_account(all_segment_tokens: list[str]) -> bool:
+    """Return True when a segment runs gh auth switch, login, or logout.
+
+    Args:
+        all_segment_tokens: One command segment's shell tokens.
+    """
+    program_name, all_arguments = segment_program_and_arguments(all_segment_tokens)
+    command_path = tuple(all_arguments[:GH_COMMAND_PATH_LENGTH])
+    return program_name.lower() == GH_PROGRAM_NAME and command_path in ALL_GLOBAL_ACCOUNT_CHANGING_COMMAND_PATHS
+
+
+def changes_global_gh_account(command: str) -> bool:
+    """Return True when any command segment changes the machine-wide gh account.
+
+    ::
+
+        gh auth switch -u <account>                          -> True
+        git fetch && gh auth login                           -> True
+        GH_TOKEN=$(gh auth token -u <account>) gh repo list  -> False
+        git commit -m "never run gh auth switch"             -> False
+
+    Args:
+        command: The shell command text the agent is about to run.
+    """
+    return any(
+        _changes_global_gh_account(each_segment)
+        for each_text in all_wrapped_command_texts(command)
+        for each_segment, _each_following_operator in pipeline_segments_for_command(each_text)
+    )
+
+
+def main() -> None:
+    """Deny a command that changes the global gh account, or stay quiet."""
+    hook_payload = read_hook_input_dictionary_from_stdin()
+    if hook_payload is None:
+        return
+    tool_name = hook_payload.get("tool_name")
+    if tool_name not in ALL_BASH_AND_POWERSHELL_TOOL_NAMES:
+        return
+    tool_input = hook_payload.get("tool_input")
+    if not isinstance(tool_input, dict):
+        return
+    command = tool_input.get("command", "")
+    if not isinstance(command, str) or not changes_global_gh_account(command):
+        return
+    log_hook_block(
+        GATE_HOOK_NAME, HOOK_EVENT_NAME, GLOBAL_ACCOUNT_CHANGE_DENY_REASON, str(tool_name), command
+    )
+    sys.stdout.write(
+        json.dumps(
+            {
+                "hookSpecificOutput": {
+                    "hookEventName": HOOK_EVENT_NAME,
+                    "permissionDecision": DENY_DECISION,
+                    "permissionDecisionReason": GLOBAL_ACCOUNT_CHANGE_DENY_REASON,
+                }
+            }
+        )
+    )
+    sys.stdout.flush()
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/test_bash_dispatcher_interpreter_starts.py

@@ -2,8 +2,9 @@
 
 A Bash tool call starts one interpreter, the dispatcher's own. Each roster
 entry then runs in that process through runpy, so the roster's exact content is
-the chain's cost after that single start. The roster holds the MSYS rewriter and
-the headless Claude broker gate; any other hook added here fails this test.
+the chain's cost after that single start. The roster holds the MSYS rewriter,
+the headless Claude broker gate, and the gh global account gate; any other hook
+added here fails this test.
 """
 
 import sys
@@ -21,7 +22,7 @@ from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
 )
 
 
-def test_bash_roster_starts_only_the_msys_rewriter_and_the_broker_gate() -> None:
+def test_bash_roster_starts_only_the_msys_rewriter_and_the_two_gates() -> None:
     assert ALL_BASH_HOSTED_HOOK_ENTRIES == (
         BashHostedHookEntry(
             script_relative_path="blocking/msys_rev_path_rewriter.py",
@@ -31,4 +32,8 @@ def test_bash_roster_starts_only_the_msys_rewriter_and_the_broker_gate() -> None
             script_relative_path="blocking/headless_claude_broker_gate.py",
             applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
         ),
+        BashHostedHookEntry(
+            script_relative_path="blocking/gh_global_account_switch_gate.py",
+            applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+        ),
     )

package/hooks/blocking/test_gh_global_account_switch_gate.py

@@ -0,0 +1,100 @@
+"""Tests for gh_global_account_switch_gate, which keeps the global gh account fixed."""
+
+from __future__ import annotations
+
+import json
+from io import StringIO
+from unittest.mock import patch
+
+import pytest
+
+import gh_global_account_switch_gate as gate
+
+
+def _stdout_from_main(payload: dict[str, object]) -> str:
+    """Return what main() wrote to stdout for one hook payload."""
+    captured_stdout = StringIO()
+    with (
+        patch("sys.stdin", StringIO(json.dumps(payload))),
+        patch("sys.stdout", captured_stdout),
+        patch.object(gate, "log_hook_block"),
+    ):
+        gate.main()
+    return captured_stdout.getvalue()
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "gh auth switch",
+        "gh auth switch -u account-a",
+        "gh auth login",
+        "gh auth login --with-token",
+        "gh auth logout -u account-b",
+        "gh.exe auth switch -u account-b",
+        "cd repo && gh auth switch -u account-a",
+        "gh auth status; gh auth switch -u account-a",
+        "gh auth status || gh auth login",
+        'bash -c "gh auth switch -u account-a"',
+        'pwsh -Command "gh auth logout"',
+        "& gh auth switch",
+        "sudo gh auth switch --user account-b",
+    ],
+)
+def test_global_account_change_is_detected(command: str) -> None:
+    assert gate.changes_global_gh_account(command) is True
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "gh auth status",
+        "gh auth status --active",
+        "gh auth token -u account-a",
+        "GH_TOKEN=$(gh auth token -u account-a) gh repo list",
+        "$env:GH_TOKEN = gh auth token -u account-a; gh repo list; Remove-Item Env:GH_TOKEN",
+        "gh pr view 12",
+        "gh api user",
+        "gh",
+        'git commit -m "never call gh auth switch"',
+        'echo "gh auth switch"',
+        'grep -rn "gh auth login" docs',
+        "git switch main",
+    ],
+)
+def test_read_only_and_unrelated_commands_pass(command: str) -> None:
+    assert gate.changes_global_gh_account(command) is False
+
+
+def test_bash_payload_with_switch_is_denied_with_the_scoped_token_forms() -> None:
+    decision = json.loads(
+        _stdout_from_main(
+            {"tool_name": "Bash", "tool_input": {"command": "gh auth switch -u account-a"}}
+        )
+    )
+    specific_output = decision["hookSpecificOutput"]
+    assert specific_output["permissionDecision"] == "deny"
+    reason = specific_output["permissionDecisionReason"]
+    assert "GH_TOKEN=$(gh auth token -u <account>) gh <command>" in reason
+    assert (
+        "$env:GH_TOKEN = gh auth token -u <account>; gh <command>; Remove-Item Env:GH_TOKEN"
+        in reason
+    )
+
+
+def test_powershell_payload_with_logout_is_denied() -> None:
+    decision = json.loads(
+        _stdout_from_main({"tool_name": "PowerShell", "tool_input": {"command": "gh auth logout"}})
+    )
+    assert decision["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_scoped_token_payload_emits_nothing() -> None:
+    scoped_command = "GH_TOKEN=$(gh auth token -u account-b) gh repo list"
+    assert _stdout_from_main({"tool_name": "Bash", "tool_input": {"command": scoped_command}}) == ""
+
+
+def test_other_tool_payload_emits_nothing() -> None:
+    assert (
+        _stdout_from_main({"tool_name": "Write", "tool_input": {"command": "gh auth switch"}}) == ""
+    )

package/hooks/hooks_constants/bash_pre_tool_use_dispatcher_constants.py

@@ -63,4 +63,8 @@ ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
         script_relative_path="blocking/headless_claude_broker_gate.py",
         applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
     ),
+    BashHostedHookEntry(
+        script_relative_path="blocking/gh_global_account_switch_gate.py",
+        applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+    ),
 )

package/hooks/hooks_constants/gh_global_account_switch_gate_constants.py

@@ -0,0 +1,33 @@
+"""Constants for the gate that keeps agents from changing the global gh account.
+
+Holds the GitHub CLI program name, the ``gh auth`` command paths that change the
+account every session on the machine uses and their word count, the hook name
+the block log records, and the deny message that names the per-command token
+form to run instead.
+"""
+
+from __future__ import annotations
+
+__all__ = [
+    "GH_PROGRAM_NAME",
+    "GH_COMMAND_PATH_LENGTH",
+    "ALL_GLOBAL_ACCOUNT_CHANGING_COMMAND_PATHS",
+    "GATE_HOOK_NAME",
+    "GLOBAL_ACCOUNT_CHANGE_DENY_REASON",
+]
+
+GH_PROGRAM_NAME: str = "gh"
+GH_COMMAND_PATH_LENGTH: int = 2
+ALL_GLOBAL_ACCOUNT_CHANGING_COMMAND_PATHS: frozenset[tuple[str, ...]] = frozenset(
+    {("auth", "switch"), ("auth", "login"), ("auth", "logout")}
+)
+GATE_HOOK_NAME: str = "gh_global_account_switch_gate.py"
+GLOBAL_ACCOUNT_CHANGE_DENY_REASON: str = (
+    "BLOCKED: gh auth switch, login, and logout change the active GitHub CLI account "
+    "for every session on this machine, so other running agents lose access. "
+    "Scope the other signed-in account to one command instead. "
+    "Bash: GH_TOKEN=$(gh auth token -u <account>) gh <command>. "
+    "PowerShell: $env:GH_TOKEN = gh auth token -u <account>; gh <command>; Remove-Item Env:GH_TOKEN. "
+    "Run gh auth status to list the signed-in accounts. "
+    "Signing an account in or out is a step for the user to run."
+)

package/hooks/hooks_constants/test_bash_pre_tool_use_dispatcher_constants.py

@@ -12,7 +12,7 @@ ALL_BASH_AND_POWERSHELL_TOOL_NAMES = ALL_CONSTANT_BINDINGS["ALL_BASH_AND_POWERSH
 BashHostedHookEntry = ALL_CONSTANT_BINDINGS["BashHostedHookEntry"]
 
 
-def test_roster_hosts_only_the_msys_rewriter_and_the_broker_gate() -> None:
+def test_roster_hosts_the_msys_rewriter_the_broker_gate_and_the_gh_account_gate() -> None:
     assert ALL_BASH_HOSTED_HOOK_ENTRIES == (
         BashHostedHookEntry(
             script_relative_path="blocking/msys_rev_path_rewriter.py",
@@ -22,4 +22,8 @@ def test_roster_hosts_only_the_msys_rewriter_and_the_broker_gate() -> None:
             script_relative_path="blocking/headless_claude_broker_gate.py",
             applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
         ),
+        BashHostedHookEntry(
+            script_relative_path="blocking/gh_global_account_switch_gate.py",
+            applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+        ),
     )

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.48.7",
+    "version": "8.49.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {