claude-dev-env 8.73.1 → 8.74.0

package/hooks/blocking/test_haiku_spawn_slim_gate.py

@@ -0,0 +1,65 @@
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+import haiku_spawn_slim_gate
+from hooks_constants.haiku_spawn_slim_gate_constants import SLIM_PROFILE_DENY_REASON
+
+HOOK_SCRIPT = Path(__file__).resolve().parent / "haiku_spawn_slim_gate.py"
+
+
+def _run_hook(payload: dict[str, object]) -> str:
+    completed = subprocess.run(
+        [sys.executable, str(HOOK_SCRIPT)],
+        input=json.dumps(payload),
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    return completed.stdout
+
+
+@pytest.mark.parametrize(
+    ("tool_name", "model"),
+    [
+        ("Agent", "haiku"),
+        ("Task", "Haiku"),
+        ("Agent", "claude-haiku-5-5"),
+        ("Agent", "claude-haiku-4-5-20251001"),
+        ("mcp__hearthbot__start_thread_session", "claude-haiku-5-5"),
+    ],
+)
+def test_should_deny_a_haiku_spawn_with_the_headless_command(tool_name: str, model: str) -> None:
+    payload = {"tool_name": tool_name, "tool_input": {"prompt": "Review.", "model": model}}
+    hook_output = json.loads(_run_hook(payload))["hookSpecificOutput"]
+    assert hook_output["hookEventName"] == "PreToolUse"
+    assert hook_output["permissionDecision"] == "deny"
+    assert hook_output["permissionDecisionReason"] == SLIM_PROFILE_DENY_REASON
+
+
+@pytest.mark.parametrize("model", ["opus", "sonnet", "claude-opus-5-5", "fable", None, "", 7])
+def test_should_pass_a_spawn_that_names_no_haiku_model(model: object) -> None:
+    tool_input = {"prompt": "Review."}
+    if model is not None:
+        tool_input["model"] = model
+    assert _run_hook({"tool_name": "Agent", "tool_input": tool_input}) == ""
+
+
+def test_should_pass_a_payload_without_tool_input() -> None:
+    assert haiku_spawn_slim_gate.decide_hook_output(None) is None
+
+
+def test_should_name_every_slim_profile_flag_in_the_deny_reason() -> None:
+    for each_flag in (
+        "account_broker.py",
+        "--model haiku",
+        "--setting-sources local",
+        "--strict-mcp-config",
+        "--autocompact 100k",
+        "CLAUDE_CODE_DISABLE_CLAUDE_MDS=1",
+        "POSIX shell",
+    ):
+        assert each_flag in SLIM_PROFILE_DENY_REASON

package/hooks/blocking/test_reply_length_gate.py

@@ -22,12 +22,15 @@ def run_gate(
     capsys: pytest.CaptureFixture[str],
     tool_name: str,
     tool_input: dict[str, object],
+    transcript_path: Path | None = None,
 ) -> tuple[int, str]:
-    hook_input = {
+    hook_input: dict[str, object] = {
         "hook_event_name": "PreToolUse",
         "tool_name": tool_name,
         "tool_input": tool_input,
     }
+    if transcript_path is not None:
+        hook_input["transcript_path"] = str(transcript_path)
     monkeypatch.setattr(
         "sys.stdin", io.TextIOWrapper(io.BytesIO(json.dumps(hook_input).encode("utf-8")))
     )
@@ -39,6 +42,9 @@ def run_gate(
 def isolated_home(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
     monkeypatch.setenv("HOME", str(tmp_path))
     monkeypatch.setenv("USERPROFILE", str(tmp_path))
+    switch_path = tmp_path / ".claude" / "visual-reply-mode.json"
+    switch_path.parent.mkdir(exist_ok=True)
+    switch_path.write_text('{"enabled": true}', encoding="utf-8")
 
 
 def test_should_allow_three_short_sentences(
@@ -48,7 +54,7 @@ def test_should_allow_three_short_sentences(
         monkeypatch,
         capsys,
         REPLY_TOOL_NAME,
-        {"text": "The fix is in. Tests pass on CI. It ships with the next release."},
+        {"text": "The fix is in. Tests pass. It ships with the next release."},
     )
     assert (exit_code, stderr_text) == (0, "")
 
@@ -292,7 +298,7 @@ def test_should_replace_the_defaults_with_the_configured_list(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
 ) -> None:
     config_path = tmp_path / ".claude" / "reply-banned-words.json"
-    config_path.parent.mkdir()
+    config_path.parent.mkdir(exist_ok=True)
     config_path.write_text(json.dumps({"banned_words": ["synergy"]}), encoding="utf-8")
     likely_exit_code, _ = run_gate(
         monkeypatch, capsys, REPLY_TOOL_NAME, {"text": "It likely passed."}
@@ -318,7 +324,7 @@ def test_should_keep_the_defaults_when_the_config_file_is_malformed(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
 ) -> None:
     config_path = tmp_path / ".claude" / "reply-banned-words.json"
-    config_path.parent.mkdir()
+    config_path.parent.mkdir(exist_ok=True)
     config_path.write_text("{not json", encoding="utf-8")
     exit_code, _ = run_gate(monkeypatch, capsys, REPLY_TOOL_NAME, {"text": "It likely passed."})
     assert exit_code == 2
@@ -426,7 +432,7 @@ def test_should_apply_the_configured_list_to_decision_cards(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
 ) -> None:
     config_path = tmp_path / ".claude" / "reply-banned-words.json"
-    config_path.parent.mkdir()
+    config_path.parent.mkdir(exist_ok=True)
     config_path.write_text(json.dumps({"banned_words": ["synergy"]}), encoding="utf-8")
     probably_exit_code, _ = run_gate(
         monkeypatch,
@@ -489,6 +495,179 @@ def test_should_deny_an_em_dash_and_allow_one_in_code(
     assert "em dash" in denied_text
 
 
+WIDGET_TOOL_NAME = "mcp__hearthbot__post_widget"
+TWO_SENTENCE_REPLY = "The deploy stopped on a missing file. The page shows each step."
+
+
+def write_transcript(transcript_path: Path, all_entries: list[dict[str, object]]) -> Path:
+    transcript_path.write_text(
+        "\n".join(json.dumps(each_entry) for each_entry in all_entries), encoding="utf-8"
+    )
+    return transcript_path
+
+
+def prompt_entry(text: str) -> dict[str, object]:
+    return {"type": "user", "message": {"role": "user", "content": text}}
+
+
+def tool_call_entry(tool_name: str) -> dict[str, object]:
+    return {
+        "type": "assistant",
+        "message": {"content": [{"type": "tool_use", "id": "t1", "name": tool_name, "input": {}}]},
+    }
+
+
+def turn_mode_off(tmp_path: Path) -> None:
+    switch_path = tmp_path / ".claude" / "visual-reply-mode.json"
+    switch_path.parent.mkdir(exist_ok=True)
+    switch_path.write_text('{"enabled": false}', encoding="utf-8")
+
+
+def test_should_deny_an_abbreviation_in_a_reply(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    exit_code, stderr_text = run_gate(
+        monkeypatch, capsys, REPLY_TOOL_NAME, {"text": "The API deploy is fixed."}
+    )
+    assert exit_code == 2
+    assert 'Abbreviation "API"' in stderr_text
+
+
+def test_should_allow_an_abbreviation_inside_a_pull_request_link(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    exit_code, _ = run_gate(
+        monkeypatch,
+        capsys,
+        REPLY_TOOL_NAME,
+        {"text": "It merged in [PR 5256](https://github.com/owner/repo/pull/5256)."},
+    )
+    assert exit_code == 0
+
+
+def test_should_deny_a_tracker_item_number(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    exit_code, stderr_text = run_gate(
+        monkeypatch, capsys, REPLY_TOOL_NAME, {"text": "Item 6 is ready for you."}
+    )
+    assert exit_code == 2
+    assert 'Tracker number "Item 6"' in stderr_text
+
+
+def test_should_deny_an_abbreviation_in_a_decision_card(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    exit_code, stderr_text = run_gate(
+        monkeypatch,
+        capsys,
+        DECISION_TOOL_NAME,
+        {"question": "Ship the API fix?", "options": [{"label": "Ship it", "consequence": "It merges."}]},
+    )
+    assert exit_code == 2
+    assert 'Abbreviation "API"' in stderr_text
+
+
+def test_should_deny_two_sentences_with_no_visual_this_turn(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = write_transcript(
+        tmp_path / "t.jsonl",
+        [prompt_entry("why did the deploy stop"), tool_call_entry("Bash")],
+    )
+    exit_code, stderr_text = run_gate(
+        monkeypatch, capsys, REPLY_TOOL_NAME, {"text": TWO_SENTENCE_REPLY}, transcript_path
+    )
+    assert exit_code == 2
+    assert "no visual this turn" in stderr_text
+
+
+def test_should_allow_two_sentences_after_a_widget_this_turn(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = write_transcript(
+        tmp_path / "t.jsonl",
+        [prompt_entry("why did the deploy stop"), tool_call_entry(WIDGET_TOOL_NAME)],
+    )
+    exit_code, _ = run_gate(
+        monkeypatch, capsys, REPLY_TOOL_NAME, {"text": TWO_SENTENCE_REPLY}, transcript_path
+    )
+    assert exit_code == 0
+
+
+def test_should_deny_when_the_only_widget_came_before_the_last_prompt(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = write_transcript(
+        tmp_path / "t.jsonl",
+        [
+            prompt_entry("why did the deploy stop"),
+            tool_call_entry(WIDGET_TOOL_NAME),
+            prompt_entry("and the logs"),
+        ],
+    )
+    exit_code, _ = run_gate(
+        monkeypatch, capsys, REPLY_TOOL_NAME, {"text": TWO_SENTENCE_REPLY}, transcript_path
+    )
+    assert exit_code == 2
+
+
+def test_should_allow_one_sentence_with_no_visual(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = write_transcript(tmp_path / "t.jsonl", [prompt_entry("merge it")])
+    exit_code, _ = run_gate(
+        monkeypatch, capsys, REPLY_TOOL_NAME, {"text": "It merged."}, transcript_path
+    )
+    assert exit_code == 0
+
+
+def test_should_deny_an_anchor_link_inside_widget_code(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    exit_code, stderr_text = run_gate(
+        monkeypatch,
+        capsys,
+        WIDGET_TOOL_NAME,
+        {"widget_code": '<div><a href="https://claude.ai/artifact/x">Review page</a></div>'},
+    )
+    assert exit_code == 2
+    assert "does not open in the Claude app" in stderr_text
+
+
+def test_should_allow_widget_code_with_no_anchor(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    exit_code, _ = run_gate(
+        monkeypatch, capsys, WIDGET_TOOL_NAME, {"widget_code": "<div>Three steps</div>"}
+    )
+    assert exit_code == 0
+
+
+def test_should_skip_the_mode_checks_when_the_switch_turns_the_mode_off(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    turn_mode_off(tmp_path)
+    transcript_path = write_transcript(tmp_path / "t.jsonl", [prompt_entry("status")])
+    all_exit_codes = [
+        run_gate(monkeypatch, capsys, REPLY_TOOL_NAME, {"text": "The API deploy is fixed."})[0],
+        run_gate(monkeypatch, capsys, REPLY_TOOL_NAME, {"text": "Which build ships first?"})[0],
+        run_gate(
+            monkeypatch, capsys, REPLY_TOOL_NAME, {"text": TWO_SENTENCE_REPLY}, transcript_path
+        )[0],
+        run_gate(monkeypatch, capsys, WIDGET_TOOL_NAME, {"widget_code": '<a href="x">go</a>'})[0],
+    ]
+    assert all_exit_codes == [0, 0, 0, 0]
+
+
+def test_should_keep_the_length_check_when_the_mode_is_off(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    turn_mode_off(tmp_path)
+    exit_code, _ = run_gate(monkeypatch, capsys, REPLY_TOOL_NAME, {"text": "One. Two. Three. Four."})
+    assert exit_code == 2
+
+
 def test_should_deny_the_quoted_cause_with_no_source(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ) -> None:

package/hooks/blocking/test_state_description_blocker.py

@@ -741,7 +741,7 @@ def test_additional_context_contains_examples():
     ctx = output["hookSpecificOutput"].get("additionalContext", "")
     assert "BAD:" in ctx
     assert "GOOD:" in ctx
-    assert "~/.claude/rules/asd-ste100-language.md" in ctx
+    assert "~/.claude/docs/rule-guides/asd-ste100-language.md" in ctx
 
 
 def test_handles_non_dict_stdin():

package/hooks/features/conduct-gates.md

@@ -4,7 +4,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 
 ## Checks
 
-- `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, and requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link.
+- `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link. With visual reply mode on, it also runs the checks in `visual_reply_rules.py` from the rule list in `rules/visual-reply-rules.json`: no abbreviation or tracker number outside a link, a widget or page before a reply of more than one sentence, and no anchor link inside widget code. The mode is off by default; `~/.claude/visual-reply-mode.json` with `{"enabled": true}` turns the mode checks on.
 - `blocking/edit_marker_gate.py` rejects strikethrough and edit-note markers in replacement chat text or cards.
 - `blocking/issue_close_handoff_gate.py` denies an issue comment or issue write that closes the issue and routes a found defect to another issue or epic.
 - `blocking/session_title_format_gate.py` denies a session title that breaks the `<emoji> <name>` shape or has a name longer than 25 characters.
@@ -12,12 +12,11 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/step_note_gate.py` requires a status line before a tool call while its opt-in flag is on.
 - `blocking/verify_before_acting.py` blocks a completed mutating call when the agent's reasoning contains an unchecked claim.
 - `blocking/pr_lifecycle_skill_gate.py` denies a commit, push, pull request action, or merge until the `pr-lifecycle` skill appears in the transcript since the last compaction.
-- `blocking/artifact_look_gate.py` denies an Artifact publish of an HTML page until an image was opened with Read after the page file was last written, so the agent looks at its page before it ships.
 - `blocking/artifact_dark_mode_gate.py` denies an Artifact page publish when the page, inside the publish wrapper, keeps a light body or shows text under 4.5:1 contrast in dark mode. `blocking/artifact_dark_mode_render.cjs` renders the page in headless Chromium for it.
 
 ## When it fires
 
-- `blocking/reply_length_gate.py` runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message`, timeout `10` seconds in `hooks.json`.
+- `blocking/reply_length_gate.py` runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__ask_decision|mcp__hearthbot__post_widget`, timeout `10` seconds in `hooks.json`.
 - `blocking/edit_marker_gate.py` runs on `PreToolUse`, matcher `mcp__.*__update_message`, timeout `10` seconds in `hooks.json`.
 - `blocking/issue_close_handoff_gate.py` runs on `PreToolUse`, matcher `mcp__.*__(add_issue_comment|issue_write|update_issue_comment)`, timeout `10` seconds in `hooks.json`.
 - `blocking/session_title_format_gate.py` runs on `PreToolUse`, matcher `mcp__.*__set_session_title`, timeout `10` seconds in `hooks.json`.
@@ -25,7 +24,6 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/step_note_gate.py` runs on `PreToolUse`, matcher `*`, timeout `15` seconds in `hooks.json`.
 - `blocking/verify_before_acting.py` runs on `PostToolUse`, matcher `Write|Edit|MultiEdit|NotebookEdit|Agent|Task|apply_patch|Bash|PowerShell|mcp__.*`, timeout `10` seconds in `hooks.json`.
 - `blocking/pr_lifecycle_skill_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request|actions_run_trigger)`, timeout `10` seconds in `hooks.json`.
-- `blocking/artifact_look_gate.py` runs on `PreToolUse`, matcher `Artifact|Skill`, timeout `10` seconds in `hooks.json`. It speaks only on an `Artifact` publish of a `.html` or `.htm` file.
 - `blocking/artifact_dark_mode_gate.py` runs on `PreToolUse`, matcher `Artifact`, timeout `60` seconds in `hooks.json`.
 
 ## Proving it
@@ -34,7 +32,7 @@ Preconditions:
 
 - Run each command from the repository root with Python and pytest available. The tests create transcript and payload fixtures.
 
-- **Reply length.** Input is a reply with four sentences or a plain pull request number. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_reply_length_gate.py -q`. The adjacent test observes a denial and its count or link reason.
+- **Reply length.** Input is a reply with four sentences, a plain pull request number, an abbreviation, two sentences with no widget this turn, or widget code with an anchor link. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_reply_length_gate.py -q`. The adjacent test observes a denial and its count, link, or mode reason.
 - **Edit marker.** Input is an update message with strikethrough or an edit note. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_edit_marker_gate.py -q`. The adjacent test observes a denial; clean replacement text passes.
 - **Handoff close.** Input is an issue comment that says the issue is closed and that the found defect belongs to another issue. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_issue_close_handoff_gate.py -q`. The adjacent test observes a denial; a close with a plain cross-reference and a routing comment on an open issue both pass.
 - **Session title.** Input is a set session title call with no leading emoji or a name over 25 characters. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_session_title_format_gate.py -q`. The adjacent test observes a denial that names the broken rule; a well-formed title passes.
@@ -52,5 +50,4 @@ Preconditions:
 - The edit marker gate scans replacement cards as well as the message text.
 - The handoff close gate reads the `body` and `comment` fields of issue tools only. A `gh issue close --comment` command in Bash and a pull request body that closes the issue with `Closes #N` do not reach it.
 - The lifecycle gate counts only invocations after the last compaction, so a compacted session invokes `pr-lifecycle` again. A missing or unreadable transcript allows the call.
-- **Looked-at page.** Input is a transcript that writes a page and publishes it with no screenshot read after the write. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_artifact_look_gate.py -q`. The adjacent test observes a denial that names the screenshot command; a Read of a PNG after the last write passes.
 - The dark mode gate denies a page publish when Node, Playwright or Chromium is missing, and its reason names the install command. It checks both dark signals, `prefers-color-scheme: dark` and `data-theme="dark"` on the root element.

package/hooks/features/spawn-routing.md

@@ -1,6 +1,6 @@
 # Spawn routing
 
-This family reminds the agent to gather context before a spawn, tells it that it owns the spawned work, adjusts thread requests when usage exceeds pace, and selects an allowed subagent model.
+This family reminds the agent to gather context before a spawn, tells it that it owns the spawned work, adjusts thread requests when usage exceeds pace, selects an allowed subagent model, and sends a Haiku spawn to a headless slim-profile run.
 
 ## Checks
 
@@ -8,6 +8,7 @@ This family reminds the agent to gather context before a spawn, tells it that it
 - `routing/spawn_oversight_hook.py` adds the orchestrator oversight directive to every spawn: watch the agent, check its output against the user's words and standards, and correct it before the output reaches the user. The spawn still runs.
 - `routing/thread_spawn_pace_hook.py` reshapes a thread request when usage is over pace or unreadable.
 - `routing/subagent_model_routing.mjs` allows a selected Luna model, remaps eligible requests, and denies unsupported model routing.
+- `blocking/haiku_spawn_slim_gate.py` denies an Agent, Task, or thread spawn whose `model` names Haiku. The deny reason gives the headless `claude -p` command that loads the slim profile through the account broker.
 
 ## When it fires
 
@@ -15,6 +16,7 @@ This family reminds the agent to gather context before a spawn, tells it that it
 - `routing/spawn_oversight_hook.py` runs on `PreToolUse` with matchers `Agent|Task`, `multi_agent_v1__spawn_agent`, `Workflow|mcp__github__actions_run_trigger`, `mcp__hearthbot__start_thread_session`, and `mcp__hearthbot__start_rc_session`, each at `10` seconds in `hooks.json`. A workflow dispatch counts only when its inputs carry a `prompt`.
 - `routing/thread_spawn_pace_hook.py` runs on `PreToolUse`, matcher `mcp__hearthbot__start_thread_session`, timeout `30` seconds in `hooks.json`.
 - `routing/subagent_model_routing.mjs` runs on `PreToolUse`, matcher `multi_agent_v1__spawn_agent`, timeout `10` seconds through the quoted Node command in `hooks.json`.
+- `blocking/haiku_spawn_slim_gate.py` runs on `PreToolUse` with matchers `Agent|Task` and `mcp__hearthbot__start_thread_session`, each at `10` seconds in `hooks.json`.
 
 ## Proving it
 
@@ -25,6 +27,7 @@ Preconditions:
 - **Spawn readiness.** Input is a spawn after a read, a question, and its answer. Run `python -m pytest packages/claude-dev-env/hooks/routing/test_spawn_readiness_hook.py -q`. The adjacent test observes no output for a ready spawn and reminder context for each missing step.
 - **Spawn oversight.** Input is a spawn from each registered tool, a subagent's own spawn, and a non-spawn call. Run `python -m pytest packages/claude-dev-env/hooks/routing/test_spawn_oversight_hook.py -q`. The adjacent test observes the directive for every spawn and no output for the other calls.
 - **Thread pace.** Input is a thread spawn with usage over pace. Run `python -m pytest packages/claude-dev-env/hooks/routing/test_thread_spawn_pace_hook.py -q`. The adjacent test observes updated tool input with the selected model, effort, and advisor line.
+- **Haiku slim gate.** Input is a spawn with a Haiku alias or model ID, and spawns on other models or with no model. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_haiku_spawn_slim_gate.py -q`. The adjacent test observes a deny with the headless command for each Haiku spawn and no output for the rest.
 - **Model routing.** Input is a `multi_agent_v1__spawn_agent` payload with a model choice. Run `node --test packages/claude-dev-env/hooks/routing/subagent_model_routing.test.mjs`. The adjacent test observes an allow or deny decision with the routed model.
 
 ## Gotchas
@@ -32,4 +35,5 @@ Preconditions:
 - `routing/spawn_readiness_hook.py` also runs after the pace hook on thread spawns. A reshaped request still gets the readiness check.
 - The oversight hook fires inside subagents too, so each level of the tree oversees the level below it. It emits `additionalContext` only and never blocks.
 - The readiness hook emits `additionalContext` only, so it never blocks. It passes subagent calls, read-only helper types, a non-object tool input, and unreadable transcripts.
+- The Haiku slim gate reads only the spawn's `model` field. A spawn that names no model passes, even when its agent definition or `CLAUDE_CODE_SUBAGENT_MODEL` resolves it to Haiku.
 - The model router allows an advisor flag to bypass the Luna restriction. Its ordinary path denies unresolved or unsupported models.

package/hooks/followup_ledger.py

@@ -14,6 +14,7 @@ from __future__ import annotations
 
 import json
 import sys
+from collections.abc import Sequence
 from pathlib import Path
 from typing import NamedTuple
 
@@ -74,6 +75,52 @@ class FollowupFinding(NamedTuple):
         return (self.check_id or self.rule_id, self.file_path, self.message)
 
 
+def deduplicated_lines(all_lines: Sequence[str]) -> list[str]:
+    """Return the lines with every exact repeat removed.
+
+    The first occurrence of each line keeps its place, so the ledger keeps its
+    record order after a ``merge=union`` merge writes both sides' lines.
+
+    Args:
+        all_lines: The ledger lines, in file order.
+
+    Returns:
+        The lines in file order, each exact line once.
+    """
+    return list(dict.fromkeys(all_lines))
+
+
+def deduplicate_ledger(repository_root: Path) -> int:
+    """Rewrite the repository's ledger without exact repeated lines.
+
+    An absent or unreadable ledger, and a ledger that cannot be rewritten, are
+    left as they are, so a ledger failure never becomes a gate failure.
+
+    Args:
+        repository_root: The repository whose ledger to clean.
+
+    Returns:
+        How many lines the rewrite removed.
+    """
+    ledger_path = followup_ledger_path(repository_root)
+    try:
+        all_ledger_lines = ledger_path.read_text(encoding=LEDGER_ENCODING).splitlines()
+    except (OSError, UnicodeError):
+        return 0
+    all_unique_lines = deduplicated_lines(all_ledger_lines)
+    removed_line_count = len(all_ledger_lines) - len(all_unique_lines)
+    if not removed_line_count:
+        return 0
+    try:
+        ledger_path.write_text(
+            "".join(each_line + "\n" for each_line in all_unique_lines),
+            encoding=LEDGER_ENCODING,
+        )
+    except OSError:
+        return 0
+    return removed_line_count
+
+
 def followup_ledger_path(repository_root: Path) -> Path:
     """Return the ledger path for one repository.
 
@@ -89,8 +136,10 @@ def followup_ledger_path(repository_root: Path) -> Path:
 def record_followup_finding(repository_root: Path, finding: FollowupFinding) -> None:
     """Append one finding to the repository's ledger, once.
 
-    A finding already present in the ledger is left alone, so a gate that runs
-    on every commit records a standing smell a single time. The ledger
+    The ledger first loses every exact repeated line, so lines a
+    ``merge=union`` merge wrote twice leave on the next write. A finding
+    already present in the ledger is left alone, so a gate that runs on every
+    commit records a standing smell a single time. The ledger
     directory carries a ``.gitignore`` matching every file in it, so the
     ledger stays out of ``git status`` in any repository. Every filesystem
     error is swallowed, so a ledger failure leaves the caller's gate decision
@@ -100,6 +149,7 @@ def record_followup_finding(repository_root: Path, finding: FollowupFinding) ->
         repository_root: The repository whose ledger receives the finding.
         finding: The non-breaking finding to record.
     """
+    deduplicate_ledger(repository_root)
     all_recorded_keys = {
         each_finding.tracking_key()
         for each_finding in all_recorded_findings(repository_root)

package/hooks/hooks.json

@@ -10,6 +10,11 @@
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/skill_loaded_reminder.py",
             "timeout": 10
           },
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/haiku_spawn_slim_gate.py",
+            "timeout": 10
+          },
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/routing/spawn_readiness_hook.py",
@@ -118,7 +123,7 @@
         ]
       },
       {
-        "matcher": "mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__ask_decision",
+        "matcher": "mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__ask_decision|mcp__hearthbot__post_widget",
         "hooks": [
           {
             "type": "command",
@@ -174,17 +179,17 @@
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/artifact_template_pointer.py",
             "timeout": 10
-          },
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/artifact_look_gate.py",
-            "timeout": 10
           }
         ]
       },
       {
         "matcher": "mcp__hearthbot__start_thread_session",
         "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/haiku_spawn_slim_gate.py",
+            "timeout": 10
+          },
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/routing/thread_spawn_pace_hook.py",

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -42,7 +42,7 @@ ALL_AGENT_HOME_TOOLING_PATTERNS = {"/.grok/"}
 ALL_HOOK_INFRASTRUCTURE_PATTERNS = {
     "/.claude/hooks/",
     "/packages/claude-dev-env/hooks/",
-} | ALL_AGENT_HOME_TOOLING_PATTERNS
+}
 ALL_WORKFLOW_REGISTRY_PATTERNS = {"/workflow/", "_tab.py", "/states.py", "/modules.py"}
 ALL_MIGRATION_PATH_PATTERNS = {"/migrations/"}
 

package/hooks/hooks_constants/haiku_spawn_slim_gate_constants.py

@@ -0,0 +1,29 @@
+"""Constants for the Haiku spawn slim-profile PreToolUse gate.
+
+Groups: the model family the gate denies, the hook event name, the hook input and output keys, and
+the deny reason that gives the headless slim-profile command.
+"""
+
+from __future__ import annotations
+
+HAIKU_MODEL_FAMILY = "haiku"
+HOOK_EVENT_NAME = "PreToolUse"
+TOOL_INPUT_KEY = "tool_input"
+MODEL_INPUT_KEY = "model"
+DENY_DECISION = "deny"
+PERMISSION_DECISION_REASON_KEY = "permissionDecisionReason"
+SLIM_PROFILE_DENY_REASON = (
+    "BLOCKED: A Haiku agent started from this session runs with this session's settings, plugins, "
+    "MCP servers, and CLAUDE.md files. An Agent, Task, or thread spawn has no field for setting sources, "
+    "a plugin directory, or an MCP config, so it cannot load the slim profile. "
+    "Start Haiku as a headless run with the slim profile. Set CLAUDE_CODE_DISABLE_CLAUDE_MDS=1 and "
+    "CLAUDE_CODE_DISABLE_AUTO_MEMORY=1 in the environment, then run this from Bash or another POSIX shell, "
+    "because PowerShell strips the double quotes inside the single-quoted JSON: "
+    'python "$HOME/.claude/scripts/account_broker.py" run --product claude --report <report.json> -- '
+    "claude -p --model haiku --setting-sources local "
+    '--settings \'{"enabledPlugins": {}, "autoMemoryEnabled": false, "autoCompactWindow": 100000}\' '
+    "--strict-mcp-config --mcp-config '{\"mcpServers\": {}}' --autocompact 100k. "
+    "Send the task on standard input. In a cloud session, run the same claude -p command without the broker. "
+    "Where the efficient-review skill is installed, /efficient-review headless or /efficient-review auto builds "
+    "this profile. To keep the agent in this session, spawn it on opus or sonnet."
+)

package/hooks/hooks_constants/reply_length_gate_constants.py

@@ -13,6 +13,7 @@ ALL_DECISION_OPTION_PROSE_KEYS = ("label", "consequence")
 TOOL_NAME_KEY = "tool_name"
 TOOL_INPUT_KEY = "tool_input"
 TEXT_KEY = "text"
+TRANSCRIPT_PATH_KEY = "transcript_path"
 HOOK_EVENT_NAME = "PreToolUse"
 ALLOW_EXIT_CODE = 0
 BLOCK_EXIT_CODE = 2

package/hooks/hooks_constants/session_env_cleanup_constants.py

@@ -11,8 +11,6 @@ SECONDS_PER_DAY = 24 * 60 * 60
 STALE_AGE_DAYS = 7
 STALE_AGE_SECONDS = STALE_AGE_DAYS * SECONDS_PER_DAY
 
-ALL_RMTREE_ONEXC_PYTHON_VERSION_PARTS: tuple[int, int] = (3, 12)
-
 SESSION_ID_PAYLOAD_KEY: str = "session_id"
 
 SESSION_ID_PATTERN = re.compile(r"^[A-Za-z0-9_-]{1,64}$")

package/hooks/hooks_constants/test_visual_reply_rules_constants.py

@@ -0,0 +1,15 @@
+from hooks_constants import visual_reply_rules_constants as constants
+
+
+def test_rules_file_path_points_at_the_shipped_rule_list() -> None:
+    assert constants.RULES_FILE_PATH.is_file()
+
+
+def test_capitalized_abbreviation_pattern_needs_two_capitals() -> None:
+    assert constants.CAPITALIZED_ABBREVIATION_PATTERN.findall("CI and PRs, not Item or I") == ["CI", "PRs"]
+
+
+def test_tracker_number_pattern_reads_items_issues_and_cards() -> None:
+    assert [
+        each.group(0) for each in constants.TRACKER_NUMBER_PATTERN.finditer("issue 5735, item #6, card 2")
+    ] == ["issue 5735", "item #6", "card 2"]