claude-dev-env 8.73.0 → 8.73.2

package/hooks/features/conduct-gates.md

@@ -4,7 +4,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 
 ## Checks
 
-- `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, and requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link.
+- `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link. With visual reply mode on, it also runs the checks in `visual_reply_rules.py` from the rule list in `rules/visual-reply-rules.json`: no abbreviation or tracker number outside a link, a widget or page before a reply of more than one sentence, and no anchor link inside widget code. The mode is off by default; `~/.claude/visual-reply-mode.json` with `{"enabled": true}` turns the mode checks on.
 - `blocking/edit_marker_gate.py` rejects strikethrough and edit-note markers in replacement chat text or cards.
 - `blocking/issue_close_handoff_gate.py` denies an issue comment or issue write that closes the issue and routes a found defect to another issue or epic.
 - `blocking/session_title_format_gate.py` denies a session title that breaks the `<emoji> <name>` shape or has a name longer than 25 characters.
@@ -12,12 +12,11 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/step_note_gate.py` requires a status line before a tool call while its opt-in flag is on.
 - `blocking/verify_before_acting.py` blocks a completed mutating call when the agent's reasoning contains an unchecked claim.
 - `blocking/pr_lifecycle_skill_gate.py` denies a commit, push, pull request action, or merge until the `pr-lifecycle` skill appears in the transcript since the last compaction.
-- `blocking/artifact_look_gate.py` denies an Artifact publish of an HTML page until an image was opened with Read after the page file was last written, so the agent looks at its page before it ships.
 - `blocking/artifact_dark_mode_gate.py` denies an Artifact page publish when the page, inside the publish wrapper, keeps a light body or shows text under 4.5:1 contrast in dark mode. `blocking/artifact_dark_mode_render.cjs` renders the page in headless Chromium for it.
 
 ## When it fires
 
-- `blocking/reply_length_gate.py` runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message`, timeout `10` seconds in `hooks.json`.
+- `blocking/reply_length_gate.py` runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__ask_decision|mcp__hearthbot__post_widget`, timeout `10` seconds in `hooks.json`.
 - `blocking/edit_marker_gate.py` runs on `PreToolUse`, matcher `mcp__.*__update_message`, timeout `10` seconds in `hooks.json`.
 - `blocking/issue_close_handoff_gate.py` runs on `PreToolUse`, matcher `mcp__.*__(add_issue_comment|issue_write|update_issue_comment)`, timeout `10` seconds in `hooks.json`.
 - `blocking/session_title_format_gate.py` runs on `PreToolUse`, matcher `mcp__.*__set_session_title`, timeout `10` seconds in `hooks.json`.
@@ -25,7 +24,6 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/step_note_gate.py` runs on `PreToolUse`, matcher `*`, timeout `15` seconds in `hooks.json`.
 - `blocking/verify_before_acting.py` runs on `PostToolUse`, matcher `Write|Edit|MultiEdit|NotebookEdit|Agent|Task|apply_patch|Bash|PowerShell|mcp__.*`, timeout `10` seconds in `hooks.json`.
 - `blocking/pr_lifecycle_skill_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request|actions_run_trigger)`, timeout `10` seconds in `hooks.json`.
-- `blocking/artifact_look_gate.py` runs on `PreToolUse`, matcher `Artifact|Skill`, timeout `10` seconds in `hooks.json`. It speaks only on an `Artifact` publish of a `.html` or `.htm` file.
 - `blocking/artifact_dark_mode_gate.py` runs on `PreToolUse`, matcher `Artifact`, timeout `60` seconds in `hooks.json`.
 
 ## Proving it
@@ -34,7 +32,7 @@ Preconditions:
 
 - Run each command from the repository root with Python and pytest available. The tests create transcript and payload fixtures.
 
-- **Reply length.** Input is a reply with four sentences or a plain pull request number. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_reply_length_gate.py -q`. The adjacent test observes a denial and its count or link reason.
+- **Reply length.** Input is a reply with four sentences, a plain pull request number, an abbreviation, two sentences with no widget this turn, or widget code with an anchor link. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_reply_length_gate.py -q`. The adjacent test observes a denial and its count, link, or mode reason.
 - **Edit marker.** Input is an update message with strikethrough or an edit note. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_edit_marker_gate.py -q`. The adjacent test observes a denial; clean replacement text passes.
 - **Handoff close.** Input is an issue comment that says the issue is closed and that the found defect belongs to another issue. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_issue_close_handoff_gate.py -q`. The adjacent test observes a denial; a close with a plain cross-reference and a routing comment on an open issue both pass.
 - **Session title.** Input is a set session title call with no leading emoji or a name over 25 characters. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_session_title_format_gate.py -q`. The adjacent test observes a denial that names the broken rule; a well-formed title passes.
@@ -52,5 +50,4 @@ Preconditions:
 - The edit marker gate scans replacement cards as well as the message text.
 - The handoff close gate reads the `body` and `comment` fields of issue tools only. A `gh issue close --comment` command in Bash and a pull request body that closes the issue with `Closes #N` do not reach it.
 - The lifecycle gate counts only invocations after the last compaction, so a compacted session invokes `pr-lifecycle` again. A missing or unreadable transcript allows the call.
-- **Looked-at page.** Input is a transcript that writes a page and publishes it with no screenshot read after the write. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_artifact_look_gate.py -q`. The adjacent test observes a denial that names the screenshot command; a Read of a PNG after the last write passes.
 - The dark mode gate denies a page publish when Node, Playwright or Chromium is missing, and its reason names the install command. It checks both dark signals, `prefers-color-scheme: dark` and `data-theme="dark"` on the root element.

package/hooks/hooks.json

@@ -118,7 +118,7 @@
         ]
       },
       {
-        "matcher": "mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__ask_decision",
+        "matcher": "mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__ask_decision|mcp__hearthbot__post_widget",
         "hooks": [
           {
             "type": "command",
@@ -174,11 +174,6 @@
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/artifact_template_pointer.py",
             "timeout": 10
-          },
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/artifact_look_gate.py",
-            "timeout": 10
           }
         ]
       },

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -42,7 +42,7 @@ ALL_AGENT_HOME_TOOLING_PATTERNS = {"/.grok/"}
 ALL_HOOK_INFRASTRUCTURE_PATTERNS = {
     "/.claude/hooks/",
     "/packages/claude-dev-env/hooks/",
-} | ALL_AGENT_HOME_TOOLING_PATTERNS
+}
 ALL_WORKFLOW_REGISTRY_PATTERNS = {"/workflow/", "_tab.py", "/states.py", "/modules.py"}
 ALL_MIGRATION_PATH_PATTERNS = {"/migrations/"}
 

package/hooks/hooks_constants/reply_length_gate_constants.py

@@ -13,6 +13,7 @@ ALL_DECISION_OPTION_PROSE_KEYS = ("label", "consequence")
 TOOL_NAME_KEY = "tool_name"
 TOOL_INPUT_KEY = "tool_input"
 TEXT_KEY = "text"
+TRANSCRIPT_PATH_KEY = "transcript_path"
 HOOK_EVENT_NAME = "PreToolUse"
 ALLOW_EXIT_CODE = 0
 BLOCK_EXIT_CODE = 2

package/hooks/hooks_constants/session_env_cleanup_constants.py

@@ -11,8 +11,6 @@ SECONDS_PER_DAY = 24 * 60 * 60
 STALE_AGE_DAYS = 7
 STALE_AGE_SECONDS = STALE_AGE_DAYS * SECONDS_PER_DAY
 
-ALL_RMTREE_ONEXC_PYTHON_VERSION_PARTS: tuple[int, int] = (3, 12)
-
 SESSION_ID_PAYLOAD_KEY: str = "session_id"
 
 SESSION_ID_PATTERN = re.compile(r"^[A-Za-z0-9_-]{1,64}$")

package/hooks/hooks_constants/test_visual_reply_rules_constants.py

@@ -0,0 +1,15 @@
+from hooks_constants import visual_reply_rules_constants as constants
+
+
+def test_rules_file_path_points_at_the_shipped_rule_list() -> None:
+    assert constants.RULES_FILE_PATH.is_file()
+
+
+def test_capitalized_abbreviation_pattern_needs_two_capitals() -> None:
+    assert constants.CAPITALIZED_ABBREVIATION_PATTERN.findall("CI and PRs, not Item or I") == ["CI", "PRs"]
+
+
+def test_tracker_number_pattern_reads_items_issues_and_cards() -> None:
+    assert [
+        each.group(0) for each in constants.TRACKER_NUMBER_PATTERN.finditer("issue 5735, item #6, card 2")
+    ] == ["issue 5735", "item #6", "card 2"]

package/hooks/hooks_constants/test_windows_filesystem.py

@@ -0,0 +1,57 @@
+"""Tests for the shared Windows-safe force_rmtree helper."""
+
+from __future__ import annotations
+
+import os
+import stat
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from hooks_constants import windows_filesystem
+from hooks_constants.windows_filesystem import force_rmtree
+
+_original_unlink = os.unlink
+
+
+def _unlink_refusing_read_only_files(path, *, dir_fd=None):
+    file_mode = os.stat(path, dir_fd=dir_fd, follow_symlinks=False).st_mode
+    if not file_mode & stat.S_IWRITE:
+        raise PermissionError(f"read-only file refused: {path}")
+    _original_unlink(path, dir_fd=dir_fd)
+
+
+@pytest.fixture
+def tree_with_read_only_file(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
+    tree_root = tmp_path / "tree"
+    nested_directory = tree_root / "nested"
+    nested_directory.mkdir(parents=True)
+    read_only_file = nested_directory / "pack.idx"
+    read_only_file.write_text("packed", encoding="utf-8")
+    os.chmod(read_only_file, stat.S_IREAD)
+    monkeypatch.setattr(os, "unlink", _unlink_refusing_read_only_files)
+    with pytest.raises(PermissionError):
+        os.unlink(read_only_file)
+    return tree_root
+
+
+def test_removes_tree_holding_read_only_file(tree_with_read_only_file: Path) -> None:
+    force_rmtree(str(tree_with_read_only_file))
+    assert not tree_with_read_only_file.exists()
+
+
+def test_removes_read_only_file_through_onerror_callback(
+    tree_with_read_only_file: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setattr(windows_filesystem, "_rmtree_supports_onexc", False)
+    force_rmtree(str(tree_with_read_only_file))
+    assert not tree_with_read_only_file.exists()
+
+
+def test_missing_tree_does_not_raise(tmp_path: Path) -> None:
+    missing_tree = tmp_path / "absent"
+    force_rmtree(str(missing_tree))
+    assert not missing_tree.exists()

package/hooks/hooks_constants/visual_reply_rules_constants.py

@@ -0,0 +1,63 @@
+"""Constants for the visual reply mode checks in the reply length gate."""
+
+import re
+from pathlib import Path
+
+RULES_FILE_PATH = (
+    Path(__file__).resolve().parent.parent.parent / "rules" / "visual-reply-rules.json"
+)
+RULES_FILE_ENCODING = "utf-8"
+RULES_LIST_KEY = "rules"
+RULE_KEY_FIELD = "key"
+RULE_LABEL_FIELD = "label"
+RULE_REMINDER_FIELD = "reminder"
+ALLOWED_CAPITALIZED_WORDS_KEY = "allowed_capitalized_words"
+LOWERCASE_ABBREVIATIONS_KEY = "lowercase_abbreviations"
+
+MODE_SWITCH_FILE_NAME = "visual-reply-mode.json"
+MODE_SWITCH_ENABLED_KEY = "enabled"
+
+NO_PICTURE_RULE_KEY = "no_picture"
+ABBREVIATIONS_RULE_KEY = "abbreviations"
+ONE_ITEM_RULE_KEY = "one_item"
+
+WIDGET_TOOL_NAME_SUFFIX = "__post_widget"
+ARTIFACT_TOOL_NAME = "Artifact"
+ALL_VISUAL_TOOL_NAME_SUFFIXES = (WIDGET_TOOL_NAME_SUFFIX, ARTIFACT_TOOL_NAME)
+ALL_REPLY_TOOL_NAME_SUFFIXES = ("__reply", "__post_message")
+MAXIMUM_REPLIES_PER_TURN = 1
+MAXIMUM_SENTENCES_WITHOUT_VISUAL = 1
+
+CAPITALIZED_ABBREVIATION_PATTERN = re.compile(
+    r"(?<![A-Za-z0-9])(?=[A-Z0-9]*[A-Z][A-Z0-9]*[A-Z])[A-Z0-9]{2,}s?(?![A-Za-z0-9])"
+)
+LOWERCASE_ABBREVIATION_TEMPLATE = r"(?<![A-Za-z0-9]){abbreviation}(?![A-Za-z0-9])"
+TRACKER_NUMBER_PATTERN = re.compile(
+    r"\b(?:issues?|items?|cards?|tickets?|tasks?)\s*#?\d+", re.IGNORECASE
+)
+WIDGET_ANCHOR_PATTERN = re.compile(r"<a\b[^>]*\bhref\s*=", re.IGNORECASE)
+
+TRANSCRIPT_ENCODING = "utf-8"
+ENTRY_TYPE_KEY = "type"
+USER_ENTRY_TYPE = "user"
+ASSISTANT_ENTRY_TYPE = "assistant"
+MESSAGE_KEY = "message"
+CONTENT_KEY = "content"
+BLOCK_TYPE_KEY = "type"
+BLOCK_NAME_KEY = "name"
+TEXT_BLOCK_TYPE = "text"
+TOOL_USE_BLOCK_TYPE = "tool_use"
+TOOL_RESULT_BLOCK_TYPE = "tool_result"
+BLOCK_ID_KEY = "id"
+TOOL_USE_ID_KEY = "tool_use_id"
+IS_ERROR_KEY = "is_error"
+IS_META_KEY = "isMeta"
+
+ABBREVIATION_MESSAGE = 'Abbreviation "{abbreviation}" in the text. {reminder}'
+TRACKER_NUMBER_MESSAGE = 'Tracker number "{reference}" in the text. {reminder}'
+NO_VISUAL_MESSAGE = "This reply has {sentence_count} sentences and no visual this turn. {reminder}"
+SECOND_REPLY_MESSAGE = "A reply already went out this turn. {reminder}"
+WIDGET_ANCHOR_MESSAGE = (
+    "A link sits inside the widget code, and a widget link does not open in the Claude app."
+    " Remove the anchor and put the page link in the reply text."
+)

package/hooks/hooks_constants/windows_filesystem.py

@@ -0,0 +1,51 @@
+"""Shared Windows-safe directory-tree removal for the hooks package.
+
+Windows refuses to delete a file that carries the ReadOnly attribute, which git
+sets on pack files and which a test sandbox can leave behind. ``force_rmtree``
+clears the attribute and retries each refused removal, so every hook and test
+that removes a tree imports this one helper.
+"""
+
+from __future__ import annotations
+
+import inspect
+import os
+import shutil
+import stat
+from collections.abc import Callable
+
+__all__ = ["force_rmtree"]
+
+_rmtree_supports_onexc = "onexc" in inspect.signature(shutil.rmtree).parameters
+
+
+def _strip_read_only_and_retry(
+    removal_function: Callable[[str], None],
+    target_path: str,
+    *_unused_exception_info: object,
+) -> None:
+    try:
+        os.chmod(target_path, stat.S_IWRITE)
+        removal_function(target_path)
+    except OSError:
+        pass
+
+
+def force_rmtree(target_path: str) -> None:
+    """Remove a directory tree, clearing the ReadOnly attribute on refused entries.
+
+    Python 3.12 renamed the rmtree error callback to ``onexc``; earlier versions
+    accept only ``onerror``. The helper passes whichever keyword the running
+    interpreter's ``shutil.rmtree`` accepts.
+
+    Args:
+        target_path: The directory tree to remove. A tree that cannot be
+            removed, including a missing one, is left as is without raising.
+    """
+    try:
+        if _rmtree_supports_onexc:
+            shutil.rmtree(target_path, onexc=_strip_read_only_and_retry)
+        else:
+            shutil.rmtree(target_path, onerror=_strip_read_only_and_retry)
+    except OSError:
+        pass

package/hooks/session/session_env_cleanup.py

@@ -18,48 +18,22 @@ from __future__ import annotations
 
 import json
 import os
-import shutil
-import stat
 import sys
 import time
 from pathlib import Path
-from typing import Callable
 
 _hooks_dir = str(Path(__file__).resolve().parent.parent)
 if _hooks_dir not in sys.path:
     sys.path.insert(0, _hooks_dir)
 
-from hooks_constants.session_env_cleanup_constants import (  # noqa: E402
-    ALL_RMTREE_ONEXC_PYTHON_VERSION_PARTS,
+from hooks_constants.session_env_cleanup_constants import (
     SESSION_ENV_DIRECTORY,
     SESSION_ID_PATTERN,
     SESSION_ID_PAYLOAD_KEY,
     STALE_AGE_SECONDS,
     WINDOWS_PLATFORM_TAG,
 )
-
-
-def _strip_read_only_and_retry(
-    removal_function: Callable[[str], None],
-    target_path: str,
-    *_unused_exception_info: object,
-) -> None:
-    try:
-        os.chmod(target_path, stat.S_IWRITE)
-        removal_function(target_path)
-    except OSError:
-        pass
-
-
-def _force_rmtree(target_path: str) -> None:
-    rmtree_onexc_python_version = ALL_RMTREE_ONEXC_PYTHON_VERSION_PARTS
-    try:
-        if sys.version_info >= rmtree_onexc_python_version:
-            shutil.rmtree(target_path, onexc=_strip_read_only_and_retry)
-        else:
-            shutil.rmtree(target_path, onerror=_strip_read_only_and_retry)
-    except OSError:
-        pass
+from hooks_constants.windows_filesystem import force_rmtree
 
 
 def prune_session_env(
@@ -71,7 +45,7 @@ def prune_session_env(
     if session_id:
         current_session_path = os.path.join(session_env_directory, session_id)
         if os.path.isdir(current_session_path):
-            _force_rmtree(current_session_path)
+            force_rmtree(current_session_path)
     if not os.path.isdir(session_env_directory):
         return
     stale_cutoff_seconds = time.time() - stale_age_seconds
@@ -87,7 +61,7 @@ def prune_session_env(
             continue
         if entry_mtime_seconds >= stale_cutoff_seconds:
             continue
-        _force_rmtree(entry_path)
+        force_rmtree(entry_path)
 
 
 def _read_session_id_from_stdin() -> str:

package/hooks/test_visual_reply_rules.py

@@ -0,0 +1,164 @@
+"""Behavior tests for the visual reply rule list."""
+
+import json
+import sys
+from pathlib import Path
+
+_hooks_directory = str(Path(__file__).resolve().parent)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+from visual_reply_rules import (
+    abbreviation_violation,
+    load_rules,
+    mode_enabled,
+    replies_sent_this_turn,
+    second_reply_violation,
+    visual_shown_this_turn,
+    visual_violation,
+    widget_anchor_violation,
+)
+
+SHIPPED_RULES = load_rules()
+
+
+def prompt_line(text: str) -> str:
+    return json.dumps({"type": "user", "message": {"content": text}})
+
+
+def tool_line(tool_name: str) -> str:
+    return json.dumps(
+        {"type": "assistant", "message": {"content": [{"type": "tool_use", "name": tool_name}]}}
+    )
+
+
+def test_shipped_rule_file_parses_with_a_label_and_reminder_per_rule() -> None:
+    rules = load_rules()
+    assert rules is not None
+    assert {each.key for each in rules.all_rules} >= {"one_item", "no_picture", "abbreviations"}
+    assert all(each.label and each.reminder for each in rules.all_rules)
+
+
+def test_load_rules_returns_none_when_a_needed_rule_is_missing(tmp_path: Path) -> None:
+    rules_path = tmp_path / "rules.json"
+    rules_path.write_text(
+        json.dumps({"rules": [{"key": "no_picture", "label": "No picture", "reminder": "Draw it."}]}),
+        encoding="utf-8",
+    )
+    assert load_rules(rules_path) is None
+
+
+def test_mode_is_off_without_a_switch_file(tmp_path: Path) -> None:
+    assert mode_enabled(tmp_path) is False
+
+
+def test_mode_is_on_when_the_switch_file_says_so(tmp_path: Path) -> None:
+    (tmp_path / "visual-reply-mode.json").write_text('{"enabled": true}', encoding="utf-8")
+    assert mode_enabled(tmp_path) is True
+
+
+def test_abbreviation_violation_names_the_abbreviation_and_allows_listed_words() -> None:
+    assert SHIPPED_RULES is not None
+    assert 'Abbreviation "UI"' in str(abbreviation_violation("The UI is done.", SHIPPED_RULES))
+    assert abbreviation_violation("OK, I merged it.", SHIPPED_RULES) is None
+
+
+def test_abbreviation_violation_flags_a_lowercase_abbreviation_and_a_tracker_number() -> None:
+    assert SHIPPED_RULES is not None
+    assert 'Abbreviation "e.g."' in str(abbreviation_violation("Logs, e.g. the error log.", SHIPPED_RULES))
+    assert 'Tracker number "card 12"' in str(abbreviation_violation("See card 12.", SHIPPED_RULES))
+
+
+def test_widget_anchor_violation_reads_only_widget_calls() -> None:
+    anchor_input = {"widget_code": '<a href="https://example.com">page</a>'}
+    assert widget_anchor_violation("mcp__hearthbot__post_widget", anchor_input) is not None
+    assert widget_anchor_violation("mcp__hearthbot__reply", anchor_input) is None
+
+
+def test_visual_shown_this_turn_counts_only_calls_after_the_last_prompt() -> None:
+    assert visual_shown_this_turn([prompt_line("status"), tool_line("Artifact")])
+    assert not visual_shown_this_turn(
+        [prompt_line("status"), tool_line("mcp__hearthbot__post_widget"), prompt_line("next")]
+    )
+
+
+def test_visual_violation_reads_the_transcript_file(tmp_path: Path) -> None:
+    assert SHIPPED_RULES is not None
+    transcript_path = tmp_path / "t.jsonl"
+    transcript_path.write_text(prompt_line("status"), encoding="utf-8")
+    assert visual_violation(2, str(transcript_path), SHIPPED_RULES) is not None
+    assert visual_violation(1, str(transcript_path), SHIPPED_RULES) is None
+    assert visual_violation(2, str(tmp_path / "missing.jsonl"), SHIPPED_RULES) is None
+
+
+def reply_use_line(tool_use_id: str) -> str:
+    return json.dumps(
+        {
+            "type": "assistant",
+            "message": {
+                "content": [{"type": "tool_use", "id": tool_use_id, "name": "mcp__thread__reply"}]
+            },
+        }
+    )
+
+
+def result_line(tool_use_id: str, is_error: bool) -> str:
+    return json.dumps(
+        {
+            "type": "user",
+            "message": {
+                "content": [{"type": "tool_result", "tool_use_id": tool_use_id, "is_error": is_error}]
+            },
+        }
+    )
+
+
+def test_replies_sent_this_turn_counts_delivered_replies_after_the_last_prompt() -> None:
+    all_lines = [
+        prompt_line("earlier"),
+        reply_use_line("a"),
+        result_line("a", False),
+        prompt_line("status"),
+        reply_use_line("b"),
+        result_line("b", True),
+        reply_use_line("c"),
+        result_line("c", False),
+        reply_use_line("d"),
+    ]
+    assert replies_sent_this_turn(all_lines) == 1
+
+
+def widget_use_line(tool_use_id: str) -> str:
+    return json.dumps(
+        {
+            "type": "assistant",
+            "message": {
+                "content": [
+                    {"type": "tool_use", "id": tool_use_id, "name": "mcp__hearthbot__post_widget"}
+                ]
+            },
+        }
+    )
+
+
+def test_visual_shown_this_turn_skips_a_widget_that_came_back_with_an_error() -> None:
+    assert not visual_shown_this_turn(
+        [prompt_line("status"), widget_use_line("w"), result_line("w", True)]
+    )
+    assert visual_shown_this_turn([prompt_line("status"), widget_use_line("w"), result_line("w", False)])
+    assert visual_shown_this_turn([prompt_line("status"), widget_use_line("w")])
+
+
+def test_second_reply_violation_denies_only_after_a_delivered_reply(tmp_path: Path) -> None:
+    transcript_path = tmp_path / "transcript.jsonl"
+    transcript_path.write_text(
+        "\n".join([prompt_line("status"), reply_use_line("a"), result_line("a", True)]),
+        encoding="utf-8",
+    )
+    assert second_reply_violation(str(transcript_path), SHIPPED_RULES) is None
+    transcript_path.write_text(
+        "\n".join([prompt_line("status"), reply_use_line("a"), result_line("a", False)]),
+        encoding="utf-8",
+    )
+    assert second_reply_violation(str(transcript_path), SHIPPED_RULES) is not None
+    assert second_reply_violation(str(tmp_path / "missing.jsonl"), SHIPPED_RULES) is None