claude-dev-env 8.78.2 → 8.79.0

package/bin/install.prompt-hook.test.mjs

@@ -1,12 +1,37 @@
 import { test } from 'node:test';
 import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
 
-import { mergeHooksIntoSettings, pruneManagedHooksFromSettings } from './install.mjs';
+import { isManagedPromptHook, mergeHooksIntoSettings, pruneManagedHooksFromSettings } from './install.mjs';
+
+const SHIPPED_HOOKS_CONFIG = JSON.parse(readFileSync(new URL('../hooks/hooks.json', import.meta.url), 'utf8'));
 
 const REPLY_MATCHER = 'mcp__hearthbot__reply';
-const MANAGED_STATUS = 'claude-dev-env: checking each claim for its source';
+const EXAMPLE_HOME = '/home/example';
 const USER_PROMPT_HOOK = { type: 'prompt', prompt: 'User check. $ARGUMENTS', statusMessage: 'my own check' };
 
+function modelHookEntries(hooksConfig) {
+    return Object.entries(hooksConfig.hooks).flatMap(([eventName, matcherGroups]) => matcherGroups.flatMap(
+        eachGroup => (eachGroup.hooks ?? [])
+            .filter(eachHook => typeof eachHook.command !== 'string')
+            .map(eachHook => ({ eventName, matcher: eachGroup.matcher ?? '', hook: eachHook })),
+    ));
+}
+
+function shippedReplyJudgeEntries() {
+    return modelHookEntries(SHIPPED_HOOKS_CONFIG).filter(
+        eachEntry => eachEntry.eventName === 'PreToolUse' && eachEntry.matcher.split('|').includes(REPLY_MATCHER),
+    );
+}
+
+const [SHIPPED_REPLY_JUDGE_ENTRY] = shippedReplyJudgeEntries();
+assert.ok(SHIPPED_REPLY_JUDGE_ENTRY, 'the shipped hooks.json needs a claim judge on reply');
+const MANAGED_STATUS = SHIPPED_REPLY_JUDGE_ENTRY.hook.statusMessage;
+
+function mergeInto(settings, hooksConfig) {
+    mergeHooksIntoSettings(settings, hooksConfig, `${EXAMPLE_HOME}/.claude`, 'python3', null, EXAMPLE_HOME);
+}
+
 function hooksConfigWithPrompt(promptText) {
     return {
         hooks: {
@@ -23,14 +48,14 @@ function hooksConfigWithPrompt(promptText) {
 function replyHooks(settings) {
     return (settings.hooks?.PreToolUse ?? [])
         .filter(eachGroup => eachGroup.matcher === REPLY_MATCHER)
-        .flatMap(eachGroup => eachGroup.hooks);
+        .flatMap(eachGroup => eachGroup.hooks ?? []);
 }
 
 test('should keep one managed prompt hook across reinstalls and carry the new prompt text', () => {
     const settings = { hooks: { PreToolUse: [{ matcher: REPLY_MATCHER, hooks: [USER_PROMPT_HOOK] }] } };
 
-    mergeHooksIntoSettings(settings, hooksConfigWithPrompt('First judge. $ARGUMENTS'), '/home/example/.claude', 'python3');
-    mergeHooksIntoSettings(settings, hooksConfigWithPrompt('Second judge. $ARGUMENTS'), '/home/example/.claude', 'python3');
+    mergeInto(settings, hooksConfigWithPrompt('First judge. $ARGUMENTS'));
+    mergeInto(settings, hooksConfigWithPrompt('Second judge. $ARGUMENTS'));
 
     assert.deepEqual(
         replyHooks(settings).map(eachHook => eachHook.prompt),
@@ -40,9 +65,41 @@ test('should keep one managed prompt hook across reinstalls and carry the new pr
 
 test('should remove the managed prompt hook on uninstall and keep the user prompt hook', () => {
     const settings = { hooks: { PreToolUse: [{ matcher: REPLY_MATCHER, hooks: [USER_PROMPT_HOOK] }] } };
-    mergeHooksIntoSettings(settings, hooksConfigWithPrompt('Judge. $ARGUMENTS'), '/home/example/.claude', 'python3');
+    mergeInto(settings, hooksConfigWithPrompt('Judge. $ARGUMENTS'));
 
     pruneManagedHooksFromSettings(settings, new Set());
 
     assert.deepEqual(replyHooks(settings), [USER_PROMPT_HOOK]);
 });
+
+test('should mark the shipped claim judge on reply, and any other shipped model hook, as managed', () => {
+    assert.ok(modelHookEntries(SHIPPED_HOOKS_CONFIG).every(eachEntry => isManagedPromptHook(eachEntry.hook)));
+});
+
+test('should keep the shipped claim judge once, under its own event and matcher, after two installs', () => {
+    const settings = {};
+    mergeInto(settings, structuredClone(SHIPPED_HOOKS_CONFIG));
+    mergeInto(settings, structuredClone(SHIPPED_HOOKS_CONFIG));
+
+    assert.deepEqual(modelHookEntries(settings), modelHookEntries(SHIPPED_HOOKS_CONFIG));
+});
+
+test('should drop a managed prompt hook left under a retired matcher of an event the shipped config lists', () => {
+    const staleMatcher = 'mcp__hearthbot__retired';
+    const judgeOnlyMatcher = 'mcp__hearthbot__retired_alone';
+    const oldJudge = { type: 'prompt', prompt: 'Old judge. $ARGUMENTS', statusMessage: MANAGED_STATUS };
+    const settings = {
+        hooks: {
+            PreToolUse: [
+                { matcher: staleMatcher, hooks: [oldJudge, USER_PROMPT_HOOK] },
+                { matcher: judgeOnlyMatcher, hooks: [oldJudge] },
+            ],
+        },
+    };
+
+    mergeInto(settings, structuredClone(SHIPPED_HOOKS_CONFIG));
+
+    const staleGroup = settings.hooks.PreToolUse.find(eachGroup => eachGroup.matcher === staleMatcher);
+    assert.deepEqual(staleGroup.hooks, [USER_PROMPT_HOOK]);
+    assert.equal(settings.hooks.PreToolUse.some(eachGroup => eachGroup.matcher === judgeOnlyMatcher), false);
+});

package/docs/account-broker.md

@@ -18,7 +18,7 @@ python scripts/account_broker.py check --product codex
 printf "%s" "prompt" | python scripts/account_broker.py run --product claude --report report.json -- claude --output-format json -p
 ```
 
-`accounts` prints the roster without reading meters. `choose` prints `decision`, `accounts`, and `state_path`. Each decision contains `action`, `account`, `home`, `reason`, `tier`, and `resets_at`. A wait decision has no account or home and includes the soonest reset in UTC. A failed meter read excludes the account for that choice. `--spent` saves an exclusion until the supplied Unix reset, the account's soonest known meter reset, or one hour when neither is available. A `--spent` name absent from the roster is saved until the supplied Unix reset, or for one hour when no reset is given. While any such mark is still in the future, `choose` waits until the soonest mark and exits 3, and with no Codex roster `--spent default` waits until that mark passes. Meter reads younger than 60 seconds are reused.
+`accounts` prints the roster without reading meters. `choose` prints `decision`, `accounts`, and `state_path`. Each decision contains `action`, `account`, `profile`, `home`, `reason`, `tier`, and `resets_at`. `profile` is the name of the profile whose home the account uses, such as `editor` for a home at `~/.claude-profiles/editor`. It is null for the main account, a Codex account, a home outside the profiles root, a home whose folder name is not a valid profile name such as `main`, and a wait decision. `--spent` takes an account's name or its profile. The account order file matches the name, command, or launcher, and resume affinity stores the command, or the name for an account without one. When a mark is one account's name and another account's profile, the name wins. Every mark is read before the first one is saved, so an unreadable mark saves none. `accounts` and the `choose` account list carry the same `profile` field. A wait decision has no account or home and includes the soonest reset in UTC. A failed meter read excludes the account for that choice. `--spent` saves an exclusion until the supplied Unix reset, the account's soonest known meter reset, or one hour when neither is available. A `--spent` name absent from the roster is saved until the supplied Unix reset, or for one hour when no reset is given. A mark splits at its last colon, so an absent name that contains a colon, such as `C:\bin\old.cmd`, takes an explicit reset, such as `C:\bin\old.cmd:1800000000`. While any such mark is still in the future, `choose` waits until the soonest mark and exits 3, and with no Codex roster `--spent default` waits until that mark passes. Meter reads younger than 60 seconds are reused.
 
 `check` prints nothing and exits 3 while every account is below its floor. `run` sets `CLAUDE_CONFIG_DIR` or `CODEX_HOME` for each attempt. A Claude job also starts without the parent session's variables, such as `CLAUDE_CODE_SESSION_ID` and `CLAUDECODE`, so a child started from inside a Claude Code session runs as its own session. `ALL_PARENT_CLAUDE_SESSION_VARIABLES` lists them. It replays the same stdin bytes when a usage limit or start failure leads to another account. Send the prompt on stdin. When the command resolves to a `.cmd` or `.bat` file, the broker refuses an argument that holds a cmd.exe metacharacter and records `start_failed`. It writes the command's stdout to stdout and diagnostics to stderr. A resumed Claude session uses the account bound to its session when that account has room.
 

package/hooks/blocking/merge_over_review_offer_gate.py

@@ -0,0 +1,114 @@
+"""Deny a decision card or question that offers a merge over open review findings."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+hooks_directory = str(Path(__file__).resolve().parent.parent)
+if hooks_directory not in sys.path:
+    sys.path.insert(0, hooks_directory)
+
+from hooks_constants.hook_specific_output_keys import (
+    HOOK_EVENT_NAME_KEY,
+    HOOK_SPECIFIC_OUTPUT_KEY,
+    PERMISSION_DECISION_KEY,
+)
+from hooks_constants.merge_over_review_offer_gate_constants import (
+    ALL_CARD_TEXT_FIELDS,
+    ALL_OPTION_TEXT_FIELDS,
+    CLEAN_REVIEW_PATTERN,
+    DENY_DECISION,
+    HOOK_EVENT_NAME,
+    MERGE_OFFER_PATTERN,
+    MERGE_OVER_REVIEW_OFFER_REASON,
+    OPEN_REVIEW_PATTERN,
+    OPTIONS_FIELD,
+    PERMISSION_DECISION_REASON_KEY,
+    QUESTIONS_FIELD,
+    TEXT_SEPARATOR,
+    TOOL_INPUT_KEY,
+)
+from hooks_constants.pre_tool_use_stdin import print_decision_from_stdin
+
+
+def _one_option_text(each_option: object) -> str:
+    if isinstance(each_option, dict):
+        return TEXT_SEPARATOR.join(
+            str(each_option.get(each_field, "")) for each_field in ALL_OPTION_TEXT_FIELDS
+        )
+    return str(each_option)
+
+
+def _block_texts(block_by_key: dict[str, object]) -> list[str]:
+    all_texts = [str(block_by_key.get(each_field, "")) for each_field in ALL_CARD_TEXT_FIELDS]
+    all_options = block_by_key.get(OPTIONS_FIELD)
+    if isinstance(all_options, list):
+        all_texts.extend(_one_option_text(each_option) for each_option in all_options)
+    return all_texts
+
+
+def _card_text(card_by_key: dict[str, object]) -> str:
+    all_questions = card_by_key.get(QUESTIONS_FIELD)
+    if not isinstance(all_questions, list):
+        all_questions = []
+    all_blocks = [card_by_key] + [
+        each_question for each_question in all_questions if isinstance(each_question, dict)
+    ]
+    return TEXT_SEPARATOR.join(
+        each_text for each_block in all_blocks for each_text in _block_texts(each_block)
+    )
+
+
+def offers_merge_over_review(card_by_key: dict[str, object]) -> bool:
+    """Return whether a card offers a merge while it names open review findings.
+
+    The whole card is read as one text: every question, header, context,
+    reason, and option, across both card shapes, an ``ask_decision`` card and
+    an ``AskUserQuestion`` questions list.
+
+    ::
+
+        option "Merge now", context "9 findings remain"          -> True
+        question 1 "The review reports 9 findings.",
+            question 2 "Merge it now?" with "Yes" / "No"         -> True
+        context "I can merge it now, but 9 findings remain."     -> True
+        option "Join the merge queue", context "9 findings"      -> True
+        context "The merge review check reports 11 findings",
+            options "Keep fixing" / "Split it"                   -> False
+        option "Merge", context "the review found no findings"   -> False
+
+    Args:
+        card_by_key: The card's tool input.
+    """
+    card_text = _card_text(card_by_key)
+    if not MERGE_OFFER_PATTERN.search(card_text):
+        return False
+    return OPEN_REVIEW_PATTERN.search(CLEAN_REVIEW_PATTERN.sub("", card_text)) is not None
+
+
+def decision_for(payload_by_key: dict[str, object]) -> dict[str, object] | None:
+    """Return a deny for a card that offers a merge over open findings, else None.
+
+    Args:
+        payload_by_key: The parsed PreToolUse input.
+    """
+    card_by_key = payload_by_key.get(TOOL_INPUT_KEY)
+    if not isinstance(card_by_key, dict) or not offers_merge_over_review(card_by_key):
+        return None
+    return {
+        HOOK_SPECIFIC_OUTPUT_KEY: {
+            HOOK_EVENT_NAME_KEY: HOOK_EVENT_NAME,
+            PERMISSION_DECISION_KEY: DENY_DECISION,
+            PERMISSION_DECISION_REASON_KEY: MERGE_OVER_REVIEW_OFFER_REASON,
+        }
+    }
+
+
+def main() -> int:
+    """Read one payload, print a deny when needed, and exit zero."""
+    return print_decision_from_stdin(decision_for)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/hooks/blocking/test_merge_over_review_offer_gate.py

@@ -0,0 +1,138 @@
+"""Behavior tests for the merge-over-review decision card gate."""
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+HOOKS_DIRECTORY = Path(__file__).resolve().parent.parent
+if str(HOOKS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(HOOKS_DIRECTORY))
+
+from blocking import merge_over_review_offer_gate as gate
+
+GATE_SCRIPT = Path(gate.__file__)
+
+
+def _card(context: str, *options: tuple[str, str]) -> dict[str, object]:
+    return {
+        "question": "What next for the pull request?",
+        "context": context,
+        "options": [{"label": label, "consequence": consequence} for label, consequence in options],
+    }
+
+
+def test_merge_option_over_open_findings_should_be_offered_over_review() -> None:
+    card = _card("The review found 9 findings.", ("Merge now", "It lands today."), ("Keep looping", "I rerun."))
+    assert gate.offers_merge_over_review(card)
+
+
+def test_merge_option_that_overrides_a_status_should_be_offered_over_review() -> None:
+    card = _card("Tests pass.", ("Merge now", "You override the status."))
+    assert gate.offers_merge_over_review(card)
+
+
+def test_card_without_a_merge_option_should_pass() -> None:
+    card = _card("The review found 9 findings.", ("Keep looping", "I rerun."), ("Drop shell checks", "Smaller diff."))
+    assert not gate.offers_merge_over_review(card)
+
+
+def test_merge_option_after_a_clean_review_should_pass() -> None:
+    card = _card("The review pass on the head came back clean.", ("Merge", "It lands."), ("Hold", "It waits."))
+    assert not gate.offers_merge_over_review(card)
+
+
+def test_merge_question_with_yes_no_options_over_unresolved_threads_should_be_offered_over_review() -> None:
+    card = {"question": "Merge PR 41 now?", "context": "3 unresolved review threads.", "options": ["Yes", "No"]}
+    assert gate.offers_merge_over_review(card)
+
+
+def test_string_options_should_be_read() -> None:
+    card = {"question": "What next?", "context": "9 findings remain.", "options": ["Merge now", "Keep looping"]}
+    assert gate.offers_merge_over_review(card)
+
+
+def test_merge_queue_option_over_findings_should_be_offered_over_review() -> None:
+    card = _card("9 findings remain.", ("Join the merge queue", "It waits for checks."), ("Wait", "It waits."))
+    assert gate.offers_merge_over_review(card)
+
+
+def test_merge_offer_in_context_over_findings_should_be_offered_over_review() -> None:
+    card = {
+        "question": "Go ahead?",
+        "context": "The PR is green and I can merge it now, but the review reports 9 findings.",
+        "options": ["Yes", "No"],
+    }
+    assert gate.offers_merge_over_review(card)
+
+
+def test_offer_and_findings_in_separate_questions_should_be_offered_over_review() -> None:
+    card = {
+        "questions": [
+            {"question": "The review reports 9 findings. Which next?", "options": ["Keep fixing", "Split it"]},
+            {"question": "Merge it now?", "options": ["Yes", "No"]},
+        ]
+    }
+    assert gate.offers_merge_over_review(card)
+
+
+def test_merge_option_over_unaddressed_review_comments_should_be_offered_over_review() -> None:
+    card = _card("3 review comments are unaddressed; 2 changes requested.", ("Merge now", "It lands."))
+    assert gate.offers_merge_over_review(card)
+
+
+def test_ship_card_about_a_pending_translation_should_pass() -> None:
+    card = {
+        "question": "Ship the README update now? The pending translation can follow.",
+        "options": ["Ship it", "Wait"],
+    }
+    assert not gate.offers_merge_over_review(card)
+
+
+def test_ask_user_question_merge_option_over_findings_should_be_offered_over_review() -> None:
+    card = {
+        "questions": [
+            {
+                "question": "The review failed with 2 findings. What next?",
+                "header": "Next step",
+                "options": [
+                    {"label": "Squash and merge", "description": "It lands now."},
+                    {"label": "Fix first", "description": "I fix both."},
+                ],
+            }
+        ]
+    }
+    assert gate.offers_merge_over_review(card)
+
+
+def test_card_about_the_merge_review_check_without_a_merge_offer_should_pass() -> None:
+    card = _card(
+        "The Merge review check reports 11 findings.", ("Keep fixing", "I rerun."), ("Split the PR", "Smaller diff.")
+    )
+    assert not gate.offers_merge_over_review(card)
+
+
+def test_merge_option_after_a_review_with_no_findings_should_pass() -> None:
+    card = _card("The review on the head found no findings.", ("Merge", "It lands."), ("Hold", "It waits."))
+    assert not gate.offers_merge_over_review(card)
+
+
+def test_decision_for_should_return_none_for_a_clean_card() -> None:
+    payload = {"tool_name": "AskUserQuestion", "tool_input": _card("All checks pass.", ("Merge", "It lands."))}
+    assert gate.decision_for(payload) is None
+
+
+def test_script_should_print_a_deny_for_a_merge_over_findings_card() -> None:
+    payload = {
+        "tool_name": "mcp__hearthbot__ask_decision",
+        "tool_input": _card("9 findings remain.", ("Merge now", "It lands.")),
+    }
+    completed = subprocess.run(
+        [sys.executable, str(GATE_SCRIPT)],
+        input=json.dumps(payload),
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    assert completed.returncode == 0
+    assert json.loads(completed.stdout)["hookSpecificOutput"]["permissionDecision"] == "deny"

package/hooks/features/conduct-gates.md

@@ -13,6 +13,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/verify_before_acting.py` blocks a completed mutating call when the agent's reasoning contains an unchecked claim.
 - `blocking/pr_lifecycle_skill_gate.py` denies a commit, push, pull request action, or merge until the `pr-lifecycle` skill appears in the transcript since the last compaction.
 - `blocking/merge_review_gate.py` denies an agent's merge until a review pass on the merged head reported zero findings. It reads the receipt `scripts/merge_review_receipt.py` writes, requires the merge, auto-merge or merge-queue entry to be pinned to that head, and skips repositories listed in `CLAUDE_MERGE_REVIEW_EXEMPT_REPOSITORIES`. Its deny reason names the review command `CLAUDE_MERGE_REVIEW_COMMAND` sets.
+- `blocking/merge_over_review_offer_gate.py` denies a decision card or question that offers a merge while it names open review findings, a red check, unaddressed review comments, or an override. It reads the whole card as one text: every question, header, context, reason, and option, whether the option is a string or a label with a consequence or description.
 - `blocking/artifact_dark_mode_gate.py` denies an Artifact page publish when the page, inside the publish wrapper, keeps a light body or shows text under 4.5:1 contrast in dark mode. `blocking/artifact_dark_mode_render.cjs` renders the page in headless Chromium for it.
 
 ## When it fires
@@ -26,6 +27,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/verify_before_acting.py` runs on `PostToolUse`, matcher `Write|Edit|MultiEdit|NotebookEdit|Agent|Task|apply_patch|Bash|PowerShell|mcp__.*`, timeout `10` seconds in `hooks.json`.
 - `blocking/pr_lifecycle_skill_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request|actions_run_trigger)`, timeout `10` seconds in `hooks.json`.
 - `blocking/merge_review_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__(merge_pull_request|enable_pr_auto_merge)`, timeout `10` seconds in `hooks.json`.
+- `blocking/merge_over_review_offer_gate.py` runs on `PreToolUse`, matcher `AskUserQuestion|mcp__.*__ask_decision`, timeout `10` seconds in `hooks.json`.
 - `blocking/artifact_dark_mode_gate.py` runs on `PreToolUse`, matcher `Artifact`, timeout `60` seconds in `hooks.json`.
 
 ## Proving it
@@ -43,6 +45,7 @@ Preconditions:
 - **Checked claim.** Input is a Write after hedged reasoning in the transcript. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_verify_before_acting.py -q`. The adjacent test observes a block and a logged blocked outcome.
 - **Lifecycle skill.** Input is a `git commit` or `gh pr create` command with no `pr-lifecycle` invocation in the transcript. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_pr_lifecycle_skill_gate.py -q`. The adjacent test observes a denial, then a silent allow once the skill or its slash command appears.
 - **Clean review.** Input is a merge with no receipt, a receipt with findings, a merge pinned to a newer head, an unpinned merge, or auto-merge with no head. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_merge_review_gate.py -q`. The adjacent test observes a denial for each; a merge or auto-merge pinned to the clean head and a merge in an exempt repository pass.
+- **Merge offer.** Input is a decision card or AskUserQuestion that offers "Merge now", the merge queue, or a yes to "Merge it now?" while any part of the card names open findings or unaddressed review comments. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_merge_over_review_offer_gate.py -q`. The adjacent test observes a denial for each, including an offer and findings in separate questions; a card with no merge offer, a card about the merge review check itself, a card about shipping a docs change, and a merge offer after a clean review pass.
 - **Dark mode page.** Input is an Artifact publish of a page that themes `html` but leaves `body` to the publish wrapper. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_artifact_dark_mode_gate.py -q`. The adjacent test observes a denial that names the text and its contrast; a page that themes `body` passes. The render tests skip on a host with no Node Playwright and Chromium.
 
 ## Gotchas

package/hooks/hooks.json

@@ -164,6 +164,16 @@
           }
         ]
       },
+      {
+        "matcher": "AskUserQuestion|mcp__.*__ask_decision",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/merge_over_review_offer_gate.py",
+            "timeout": 10
+          }
+        ]
+      },
       {
         "matcher": "mcp__.*__(add_issue_comment|issue_write|update_issue_comment)",
         "hooks": [

package/hooks/hooks_constants/merge_over_review_offer_gate_constants.py

@@ -0,0 +1,34 @@
+"""Constants for the gate that keeps merge-over-review offers off decision cards."""
+
+import re
+
+TOOL_INPUT_KEY = "tool_input"
+HOOK_EVENT_NAME = "PreToolUse"
+DENY_DECISION = "deny"
+PERMISSION_DECISION_REASON_KEY = "permissionDecisionReason"
+ALL_CARD_TEXT_FIELDS = ("question", "header", "context", "reason")
+QUESTIONS_FIELD = "questions"
+OPTIONS_FIELD = "options"
+TEXT_SEPARATOR = " "
+ALL_OPTION_TEXT_FIELDS = ("label", "consequence", "description")
+MERGE_OFFER_PATTERN = re.compile(
+    r"\b(?:merg(?:e|es|ing)|squash(?:es|ing)?|auto-merge)\b"
+    r"(?!\s+(?:review|check|base|conflicts?|state|status|gate)\b)",
+    re.IGNORECASE,
+)
+CLEAN_REVIEW_PATTERN = re.compile(
+    r"\b(?:no|zero|0)\s+(?:open\s+|review\s+|blocking\s+)?(?:findings?|failures?|threads?|comments?)\b",
+    re.IGNORECASE,
+)
+OPEN_REVIEW_PATTERN = re.compile(
+    r"\b(?:findings?|override|red|failing|failed|failures?|not clean|unresolved|unaddressed"
+    r"|changes requested|review comments?|open (?:review )?threads?|issues? (?:left|remain(?:ing)?)"
+    r"|\d+ remaining)\b",
+    re.IGNORECASE,
+)
+MERGE_OVER_REVIEW_OFFER_REASON = (
+    "This card offers a merge while it names open review findings, a red check, or an"
+    " override. A pull request merges only after a review pass on its head reports zero"
+    " findings. Drop the merge offer, keep fixing and rerunning the review, and ask only"
+    " about choices that keep that bar."
+)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.78.2",
+    "version": "8.79.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/account_broker.py

@@ -47,6 +47,7 @@ from dev_env_scripts_constants.account_broker_constants import (
     _wait_decision,
     ALL_PARENT_CLAUDE_SESSION_VARIABLES,
     COMMAND_MISSING_EXIT_CODE,
+    PLACEHOLDER_NAME_SLOT,
     REPORT_INDENT_SPACES,
     TIMEOUT_EXIT_CODE,
     WAIT_EXIT_CODE,
@@ -102,6 +103,7 @@ def decision_payload(decision: Decision) -> dict[str, object]:
     return {
         "action": decision.action,
         "account": decision.account.name if decision.account else None,
+        "profile": decision.account.profile if decision.account else None,
         "home": str(decision.account.home) if decision.account else None,
         "reason": decision.reason,
         "tier": decision.tier,
@@ -121,6 +123,7 @@ def readings_payload(all_readings: Sequence[Reading]) -> list[dict[str, object]]
     return [
         {
             "name": each_reading.account.name,
+            "profile": each_reading.account.profile,
             "home": str(each_reading.account.home),
             "is_main": each_reading.account.is_main,
             "priority": each_reading.account.priority,
@@ -150,11 +153,16 @@ def _spent_for_readings(all_readings: Sequence[Reading], all_state: dict[str, ob
     return frozenset(spent), spent
 
 
-def _mark_spent(all_state: dict[str, object], reading: Reading, now: datetime, reset: datetime | None = None) -> datetime:
+def _record_spent(all_state: dict[str, object], reading: Reading, now: datetime, reset: datetime | None = None) -> datetime:
     until = reset or _account_reset(reading, is_spent=True) or now + timedelta(hours=1)
     if until <= now:
         until = now + timedelta(hours=1)
     all_state["spent"][_state_key(reading.account)] = until.timestamp()
+    return until
+
+
+def _mark_spent(all_state: dict[str, object], reading: Reading, now: datetime) -> datetime:
+    until = _record_spent(all_state, reading, now)
     _save_state(broker_state_path(), all_state)
     return until
 
@@ -162,8 +170,7 @@ def _mark_spent(all_state: dict[str, object], reading: Reading, now: datetime, r
 def _outside_roster_resets(product: Product, all_readings: Sequence[Reading], all_state: Mapping[str, object], now: datetime) -> dict[str, datetime]:
     marks = all_state.get("spent") if isinstance(all_state.get("spent"), dict) else {}
     all_roster_names = {each_reading.account.name for each_reading in all_readings}
-    prefix = f"{product.value}:"
-    placeholder_suffix = f":{Path()}"
+    prefix, _, placeholder_suffix = _state_key(Account(product, PLACEHOLDER_NAME_SLOT, Path(), False)).partition(PLACEHOLDER_NAME_SLOT)
     all_resets_by_name = {}
     for each_key, each_raw in marks.items():
         if not (isinstance(each_key, str) and each_key.startswith(prefix) and each_key.endswith(placeholder_suffix)):
@@ -376,25 +383,30 @@ def _parse_spent_mark(all_accounts_by_name: Mapping[str, Reading], mark: str, pr
     try:
         reset = datetime.fromtimestamp(float(reset_text), timezone.utc) if separator else None
     except (ValueError, OSError, OverflowError) as error:
-        raise BrokerConfigurationError(f"invalid reset for account {name}") from error
+        raise BrokerConfigurationError(f"invalid reset in spent mark {mark!r}") from error
     reading = all_accounts_by_name.get(name)
     if reading is None:
-        if all_accounts_by_name or name != NO_ROSTER_ACCOUNT_NAME:
-            print(f"warning: spent mark names {name}, an account outside the roster; choose waits until its reset", file=sys.stderr)
         return Reading(Account(product, name, Path(), False), None), reset
     return reading, reset
 
 
 def _save_spent_arguments(all_marks: Sequence[str], all_readings: Sequence[Reading], all_state: dict[str, object], now: datetime, product: Product) -> None:
-    all_accounts_by_name = {each_reading.account.name: each_reading for each_reading in all_readings}
-    for each_mark in all_marks:
-        reading, reset = _parse_spent_mark(all_accounts_by_name, each_mark, product)
-        _mark_spent(all_state, reading, now, reset)
+    all_accounts_by_profile = {each_reading.account.profile: each_reading for each_reading in all_readings if each_reading.account.profile}
+    all_accounts_by_name = all_accounts_by_profile | {each_reading.account.name: each_reading for each_reading in all_readings}
+    all_parsed_marks = [_parse_spent_mark(all_accounts_by_name, each_mark, product) for each_mark in all_marks]
+    for each_reading, each_reset in all_parsed_marks:
+        _record_spent(all_state, each_reading, now, each_reset)
+    if all_parsed_marks:
+        _save_state(broker_state_path(), all_state)
+    for each_reading, _ in all_parsed_marks:
+        name = each_reading.account.name
+        if name not in all_accounts_by_name and (all_accounts_by_name or name != NO_ROSTER_ACCOUNT_NAME):
+            print(f"warning: spent mark names {name}, an account outside the roster; choose waits until its reset", file=sys.stderr)
 
 
 def _accounts_cli(product: Product) -> int:
     roster = all_product_adapters[product].load_accounts()
-    print(json.dumps({"accounts": [{"name": each_account.name, "home": str(each_account.home), "is_main": each_account.is_main} for each_account in roster]}))
+    print(json.dumps({"accounts": [{"name": each_account.name, "profile": each_account.profile, "home": str(each_account.home), "is_main": each_account.is_main} for each_account in roster]}))
     return 0
 
 

package/scripts/account_broker_support.py

@@ -105,7 +105,7 @@ def _chain_entry(raw_entry: object, main_home: Path, chain_path: Path) -> Accoun
     if not isinstance(extra_args, list) or any(not isinstance(each_arg, str) for each_arg in extra_args):
         raise BrokerConfigurationError(f"invalid account list {chain_path}")
     home = Path(credential).expanduser().parent.resolve() if credential else main_home
-    return Account(Product.CLAUDE, command, home, command=command)
+    return Account(Product.CLAUDE, command, home, command=command, profile=_home_profile(home))
 
 
 def _chain_entries(chain_path: Path, main_home: Path) -> tuple[Account, ...]:
@@ -169,11 +169,20 @@ def _with_priorities(all_accounts: Sequence[Account], all_ordered_names: Sequenc
     return tuple(dataclasses.replace(each_account, priority=priority_of(each_account)) for each_account in all_accounts)
 
 
+def _home_profile(home: Path) -> str | None:
+    try:
+        profile_home = default_profile_home(home.name).resolve()
+    except ValueError:
+        return None
+    return home.name if profile_home == home else None
+
+
 def load_claude_accounts() -> tuple[Account, ...]:
     """Read the Claude account roster.
 
     Returns:
-        Main and additional accounts in configured order, each with its place in the account order file.
+        Main and additional accounts in configured order, each with its place in the account order file
+        and, for a home under the profiles root, its profile name.
 
     Raises:
         BrokerConfigurationError: An account list is unreadable.
@@ -185,7 +194,8 @@ def load_claude_accounts() -> tuple[Account, ...]:
         _append_claude_account(all_accounts, all_seen, each_entry, main_home)
     for each_home in _extra_homes(main_home):
         home = each_home.resolve()
-        _append_claude_account(all_accounts, all_seen, Account(Product.CLAUDE, home.name, home, command=home.name), main_home)
+        extra_account = Account(Product.CLAUDE, home.name, home, command=home.name, profile=_home_profile(home))
+        _append_claude_account(all_accounts, all_seen, extra_account, main_home)
     return _with_priorities(all_accounts, _account_order(main_home))
 
 

package/scripts/conftest.py

@@ -18,7 +18,9 @@ is in place by the time any test module runs its top-level imports.
 from __future__ import annotations
 
 import importlib
+import subprocess
 import sys
+from collections.abc import Callable
 from pathlib import Path
 
 import pytest
@@ -52,3 +54,26 @@ def isolated_broker_state_path(monkeypatch: pytest.MonkeyPatch, tmp_path: Path)
         if getattr(each_module, "broker_state_path", None) is _live_broker_state_resolver:
             monkeypatch.setattr(each_module, "broker_state_path", lambda: isolated_path)
     return isolated_path
+
+
+def _link_directory(*, from_link: Path, to_target: Path) -> None:
+    try:
+        importlib.import_module("claude_account_profile")._link_directory(to_target, from_link)
+    except subprocess.CalledProcessError as error:
+        link_output = (error.stderr or error.stdout or b"").decode(errors="replace").strip()
+        pytest.fail(f"directory link {from_link} -> {to_target} failed: {link_output}")
+    except OSError as error:
+        pytest.fail(f"directory link {from_link} -> {to_target} failed: {error}")
+
+
+@pytest.fixture
+def create_directory_link() -> Callable[..., None]:
+    """Return a helper that points a new directory link at a target folder.
+
+    Windows gets a junction, which needs no extra rights. Other systems get a
+    symlink. A link that cannot be made fails the test on either system.
+
+    Returns:
+        The helper, called as ``create_directory_link(from_link=..., to_target=...)``.
+    """
+    return _link_directory

package/scripts/dev_env_scripts_constants/account_broker_constants.py

@@ -56,6 +56,7 @@ WAIT_EXIT_CODE = 3
 COMMAND_MISSING_EXIT_CODE = 127
 TIMEOUT_EXIT_CODE = 124
 REPORT_INDENT_SPACES = 2
+PLACEHOLDER_NAME_SLOT = "{name}"
 BROKER_STATE_DIRECTORY_NAME = "account-broker"
 BROKER_STATE_FILE_NAME = "state.json"
 BROKER_STATE_TEMP_SUFFIX = ".json"
@@ -150,6 +151,7 @@ class Account:
     is_main: bool = False
     command: str | None = None
     priority: int | None = None
+    profile: str | None = field(default=None, compare=False)
 
 
 @dataclass(frozen=True)

package/scripts/dev_env_scripts_constants/test_account_broker_constants.py

@@ -5,11 +5,11 @@ from __future__ import annotations
 import dataclasses
 import importlib
 import importlib.util
-import os
 import shutil
 import sys
 import types
 from datetime import datetime, timedelta, timezone
+from collections.abc import Callable
 from pathlib import Path
 
 import pytest
@@ -21,7 +21,9 @@ from dev_env_scripts_constants.account_broker_constants import (
     ALL_CODEX_FLOORS,
     ALL_PARENT_CLAUDE_SESSION_VARIABLES,
     CMD_SHELL_METACHARACTERS,
+    Account,
     JobOutcome,
+    Product,
 )
 from dev_env_scripts_constants.claude_account_constants import (
     MAIN_SESSION_USED_CEILING_PERCENT,
@@ -113,16 +115,9 @@ def test_parse_utc_time_converts_an_offset_timestamp() -> None:
     assert parsed.isoformat() == "2026-10-03T11:30:00+00:00"
 
 
-def _create_directory_link(*, from_link: Path, to_target: Path) -> None:
-    if sys.platform.startswith("win32"):
-        importlib.import_module("_winapi").CreateJunction(
-            str(to_target), str(from_link)
-        )
-        return
-    os.symlink(to_target, from_link, target_is_directory=True)
-
-
-def _build_install_layout(home: Path) -> tuple[Path, Path]:
+def _build_install_layout(
+    home: Path, create_directory_link: Callable[..., None]
+) -> tuple[Path, Path]:
     agents_constants_directory = (
         home / ".agents" / "scripts" / "dev_env_scripts_constants"
     )
@@ -143,7 +138,7 @@ def _build_install_layout(home: Path) -> tuple[Path, Path]:
     (classifier_directory / "classifier_constants.py").write_text(
         f"ALL_USAGE_LIMIT_MARKERS = ({TEMP_TREE_MARKER!r},)\n", encoding="utf-8"
     )
-    _create_directory_link(
+    create_directory_link(
         from_link=home / ".claude" / "scripts", to_target=home / ".agents" / "scripts"
     )
     linked_module = (
@@ -170,10 +165,10 @@ def _load_module_from(
 
 @pytest.mark.parametrize("entry_point", ("through_scripts_link", "through_agents_path"))
 def test_codex_usage_limit_signatures_finds_shared_tree_beside_the_scripts_link(
-    entry_point: str, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    entry_point: str, tmp_path: Path, create_directory_link: Callable[..., None], monkeypatch: pytest.MonkeyPatch
 ) -> None:
     monkeypatch.delenv("CLAUDE_CONFIG_DIR", raising=False)
-    linked_module, agents_module = _build_install_layout(tmp_path / "home")
+    linked_module, agents_module = _build_install_layout(tmp_path / "home", create_directory_link)
     module_file = (
         linked_module if entry_point == "through_scripts_link" else agents_module
     )
@@ -188,3 +183,9 @@ def test_parent_session_variables_name_the_session_link_and_leave_the_account_ho
     assert "CLAUDE_CODE_SESSION_ID" in ALL_PARENT_CLAUDE_SESSION_VARIABLES
     assert "CLAUDECODE" in ALL_PARENT_CLAUDE_SESSION_VARIABLES
     assert "CLAUDE_CONFIG_DIR" not in ALL_PARENT_CLAUDE_SESSION_VARIABLES
+
+
+def test_should_treat_accounts_that_differ_only_in_profile_as_one_account() -> None:
+    home = Path("/profiles/first")
+
+    assert Account(Product.CLAUDE, "first", home, profile="first") == Account(Product.CLAUDE, "first", home)

package/scripts/policy_lint/adapter_configuration.py

@@ -135,6 +135,7 @@ def _names_exempt_registration_path(registered_string: str) -> bool:
         hooks/blocking/verify_before_acting.py           -> exempt
         hooks/blocking/session_title_format_gate.py      -> exempt
         hooks/blocking/artifact_dark_mode_gate.py        -> exempt
+        hooks/blocking/merge_over_review_offer_gate.py   -> exempt
         hooks/blocking/some_new_blocker.py               -> flagged
 
     The Bash PreToolUse dispatcher sits under ``blocking/`` for layout reasons
@@ -166,6 +167,10 @@ def _names_exempt_registration_path(registered_string: str) -> bool:
     The artifact page gate denies a page publish whose text is unreadable in
     dark mode. It decides how a page renders and no code or safety policy.
 
+    The merge offer gate denies a decision card whose text offers a merge and
+    names open review findings. It reads only the wording of a chat card and
+    decides no code or safety policy; the merge review gate holds the merge.
+
     Args:
         registered_string: One command, path, script, or entrypoint string.
     """

package/scripts/policy_lint/config/constants.py

@@ -74,6 +74,7 @@ ALL_ACTION_BOUNDARY_EXEMPT_REGISTRATION_PATHS = (
     "blocking/image_read_size_gate.py",
     "blocking/artifact_dark_mode_gate.py",
     "blocking/haiku_spawn_slim_gate.py",
+    "blocking/merge_over_review_offer_gate.py",
 )
 ALL_TEST_DIRECTORY_NAMES = frozenset({"tests"})
 ALL_TEST_FILE_PREFIXES = ("test_",)

package/scripts/test_account_broker.py

@@ -441,6 +441,7 @@ def test_should_print_decision_and_meters_for_choose(
     assert account_broker.main(("choose", "--product", "codex")) == 0
     payload = json.loads(capsys.readouterr().out)
     assert payload["decision"]["account"] == "roomy"
+    assert payload["decision"]["profile"] is None
     assert payload["accounts"][0]["meters"]["session_percent_left"] == 80
     assert payload["state_path"].endswith("state.json")
 
@@ -781,7 +782,7 @@ def test_should_list_accounts_without_reading_meters(
 
     assert account_broker.main(("accounts", "--product", "codex")) == 0
     assert json.loads(capsys.readouterr().out) == {
-        "accounts": [{"name": "listed", "home": str(account.home), "is_main": False}]
+        "accounts": [{"name": "listed", "profile": None, "home": str(account.home), "is_main": False}]
     }
 
 
@@ -931,6 +932,59 @@ def test_should_mark_a_windows_launcher_path_account_spent(
     assert decision["account"] == "second"
 
 
+def test_should_mark_an_account_spent_by_its_profile(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    launcher_name = "C:\\Users\\someone\\.local\\bin\\claude-first.cmd"
+    first = Account(Product.CLAUDE, launcher_name, Path("/profiles/first"), command=launcher_name, profile="first")
+    second = _account("second", Product.CLAUDE)
+    monkeypatch.setitem(
+        account_broker.all_product_adapters,
+        Product.CLAUDE,
+        _adapter((first, second), {launcher_name: _meters(80, 80), "second": _meters(80, 80)}),
+    )
+    _freeze_clock(monkeypatch, NOW)
+
+    code = account_broker.main(("choose", "--product", "claude", "--spent", f"first:{(NOW + timedelta(hours=2)).timestamp()}"))
+
+    decision = json.loads(capsys.readouterr().out)["decision"]
+    assert code == 0
+    assert decision["account"] == "second"
+
+
+def test_should_mark_the_account_named_by_a_mark_that_is_also_another_profile(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    launcher_name = "C:\\Users\\someone\\.local\\bin\\claude-editor.cmd"
+    profiled = Account(Product.CLAUDE, launcher_name, Path("/profiles/second"), command=launcher_name, profile="second")
+    second = _account("second", Product.CLAUDE)
+    monkeypatch.setitem(
+        account_broker.all_product_adapters,
+        Product.CLAUDE,
+        _adapter((second, profiled), {launcher_name: _meters(80, 80), "second": _meters(90, 90)}),
+    )
+    _freeze_clock(monkeypatch, NOW)
+
+    code = account_broker.main(("choose", "--product", "claude", "--spent", f"second:{(NOW + timedelta(hours=2)).timestamp()}"))
+
+    decision = json.loads(capsys.readouterr().out)["decision"]
+    assert code == 0
+    assert decision["account"] == launcher_name
+
+
+def test_should_save_no_spent_mark_when_a_later_mark_is_unreadable(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    account = _account("first")
+    monkeypatch.setitem(account_broker.all_product_adapters, Product.CODEX, _adapter((account,), {"first": _meters(80, 80)}))
+
+    code = account_broker.main(("choose", "--product", "codex", "--spent", "first", "--spent", "guest:tomorrow"))
+
+    assert code == 2
+    assert "invalid reset" in capsys.readouterr().err
+    assert account_broker._load_state(account_broker.broker_state_path()).get("spent", {}) == {}
+
+
 def test_should_reject_an_invalid_spent_reset(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ) -> None:
@@ -1044,6 +1098,22 @@ def test_should_run_past_a_stored_spent_mark_beyond_the_platform_range(
     assert decision["action"] == "run"
 
 
+def test_should_wait_on_an_outside_spent_mark_under_another_state_key_layout(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    account = _account("first")
+    monkeypatch.setitem(account_broker.all_product_adapters, Product.CODEX, _adapter((account,), {"first": _meters(80, 80)}))
+    monkeypatch.setattr(account_broker, "_state_key", lambda marked: f"{marked.product.value}|{marked.name}|{marked.home}")
+    _freeze_clock(monkeypatch, NOW)
+    reset = NOW + timedelta(hours=2)
+
+    account_broker.main(("choose", "--product", "codex", "--spent", f"visitor:{int(reset.timestamp())}"))
+
+    decision = json.loads(capsys.readouterr().out)["decision"]
+    assert decision["action"] == "wait"
+    assert "account visitor outside the roster is spent" in decision["reason"]
+
+
 def test_should_name_the_outside_spent_mark_when_it_forces_a_wait(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ) -> None:
@@ -1106,6 +1176,37 @@ def test_should_warn_when_a_spent_mark_names_an_account_the_roster_lacks(
     assert "outside the roster" in all_warning_lines[0]
 
 
+def test_should_print_no_outside_roster_warning_when_a_later_mark_is_unreadable(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    account = _account("first")
+    monkeypatch.setitem(account_broker.all_product_adapters, Product.CODEX, _adapter((account,), {"first": _meters(80, 80)}))
+
+    code = account_broker.main(("choose", "--product", "codex", "--spent", "visitor", "--spent", "first:notanumber"))
+
+    all_error_lines = capsys.readouterr().err.splitlines()
+    assert code == 2
+    assert len(all_error_lines) == 1
+    assert "invalid reset in spent mark 'first:notanumber'" in all_error_lines[0]
+    assert account_broker._load_state(account_broker.broker_state_path())["spent"] == {}
+
+
+def test_should_save_an_outside_launcher_path_given_with_an_explicit_reset(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    account = _account("first")
+    monkeypatch.setitem(account_broker.all_product_adapters, Product.CODEX, _adapter((account,), {"first": _meters(80, 80)}))
+    reset = int((datetime.now(timezone.utc) + timedelta(hours=2)).timestamp())
+
+    code = account_broker.main(("choose", "--product", "codex", "--spent", f"C:\\bin\\old.cmd:{reset}"))
+
+    all_warning_lines = capsys.readouterr().err.splitlines()
+    all_saved_marks = account_broker._load_state(account_broker.broker_state_path())["spent"]
+    assert code == WAIT_EXIT_CODE
+    assert "C:\\bin\\old.cmd" in all_warning_lines[0]
+    assert all_saved_marks == {f"codex:C:\\bin\\old.cmd:{Path()}": float(reset)}
+
+
 @pytest.mark.parametrize("mark", ["", ":1800000000"])
 def test_should_reject_a_spent_mark_without_an_account_name(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], mark: str
@@ -1127,8 +1228,8 @@ def test_should_serialize_a_run_and_a_wait_decision() -> None:
     run_payload = account_broker.decision_payload(account_broker.Decision("run", account, None, "first has 80% left", "normal"))
     wait_payload = account_broker.decision_payload(account_broker.Decision("wait", None, reset, "no account has room", "wait"))
 
-    assert run_payload == {"action": "run", "account": "first", "home": str(Path("/profiles/first")), "reason": "first has 80% left", "tier": "normal", "resets_at": None}
-    assert wait_payload == {"action": "wait", "account": None, "home": None, "reason": "no account has room", "tier": "wait", "resets_at": reset.isoformat()}
+    assert run_payload == {"action": "run", "account": "first", "profile": None, "home": str(Path("/profiles/first")), "reason": "first has 80% left", "tier": "normal", "resets_at": None}
+    assert wait_payload == {"action": "wait", "account": None, "profile": None, "home": None, "reason": "no account has room", "tier": "wait", "resets_at": reset.isoformat()}
 
 
 def test_should_print_the_whole_rate_limit_result_for_one_home(
@@ -1236,6 +1337,12 @@ def test_should_hand_the_live_log_to_the_subprocess_runner(tmp_path: Path, monke
     assert captured_options["live_log"] == live_log
 
 
+def test_decision_payload_should_carry_the_profile_of_a_claude_account() -> None:
+    account = Account(Product.CLAUDE, "C:\\bin\\claude-editor.cmd", Path("/profiles/editor"), command="C:\\bin\\claude-editor.cmd", profile="editor")
+
+    assert account_broker.decision_payload(account_broker.Decision("run", account, None, "most room", "normal"))["profile"] == "editor"
+
+
 def test_decision_payload_should_name_the_chosen_account_and_its_home() -> None:
     account = _account("codex-2")
     decision = account_broker.Decision("run", account, None, "most room", "normal")
@@ -1243,6 +1350,7 @@ def test_decision_payload_should_name_the_chosen_account_and_its_home() -> None:
     assert account_broker.decision_payload(decision) == {
         "action": "run",
         "account": "codex-2",
+        "profile": None,
         "home": str(Path("/profiles") / "codex-2"),
         "reason": "most room",
         "tier": "normal",
@@ -1259,3 +1367,25 @@ def test_decision_payload_should_leave_the_account_empty_and_give_the_reset_for_
     assert payload["account"] is None
     assert payload["home"] is None
     assert payload["resets_at"] == "2026-10-03T08:00:00+00:00"
+
+
+def test_should_save_every_spent_mark_in_one_write(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    accounts = (_account("first"), _account("second"))
+    monkeypatch.setitem(account_broker.all_product_adapters, Product.CODEX, _adapter(accounts, {
+        "first": _meters(80, 80), "second": _meters(70, 70)
+    }))
+    all_saved_marks: list[dict[str, object]] = []
+
+    def save_or_fail(path: Path, all_state: dict[str, object]) -> None:
+        all_saved_marks.append(dict(all_state["spent"]))
+        raise OSError("disk full")
+
+    monkeypatch.setattr(account_broker, "_save_state", save_or_fail)
+
+    with pytest.raises(OSError):
+        account_broker.main(("choose", "--product", "codex", "--spent", "first", "--spent", "second"))
+
+    assert len(all_saved_marks) == 1
+    assert len(all_saved_marks[0]) == 2

package/scripts/test_account_broker_support.py

@@ -8,6 +8,7 @@ import subprocess
 import sys
 import time
 from datetime import datetime, timezone
+from collections.abc import Callable
 from pathlib import Path
 from types import SimpleNamespace
 
@@ -45,6 +46,61 @@ def _claude_home_with_extras(monkeypatch: pytest.MonkeyPatch, tmp_path: Path, ex
     return main_home
 
 
+def test_should_name_a_chain_account_profile_from_its_home(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    monkeypatch.delenv("LLM_SETTINGS_PROFILES_ROOT", raising=False)
+    main_home = tmp_path / ".claude"
+    main_home.mkdir()
+    profiles_root = tmp_path / ".claude-profiles"
+    launcher = "C:\\bin\\claude-editor.cmd"
+    (main_home / "claude-chain.json").write_text(
+        json.dumps(
+            {
+                "chain": [
+                    {"command": launcher, "credentials_path": str(profiles_root / "editor" / ".credentials.json")},
+                    {"command": "C:\\bin\\other.cmd", "credentials_path": str(tmp_path / "elsewhere" / ".credentials.json")},
+                    {"command": "C:\\bin\\reserved.cmd", "credentials_path": str(profiles_root / "main" / ".credentials.json")},
+                ]
+            }
+        ),
+        encoding="utf-8",
+    )
+    (main_home / "extra-profiles.json").write_text('["extra"]', encoding="utf-8")
+
+    accounts = support.load_claude_accounts()
+
+    assert [(each_account.name, each_account.profile) for each_account in accounts] == [
+        ("main", None),
+        (launcher, "editor"),
+        ("C:\\bin\\other.cmd", None),
+        ("C:\\bin\\reserved.cmd", None),
+        ("extra", "extra"),
+    ]
+
+
+@pytest.mark.parametrize(
+    ("target_parts", "expected_profile"),
+    [(("claude-profiles-link-target", "target"), None), ((".claude-profiles", "target"), "target")],
+)
+def test_should_name_an_extra_account_profile_from_its_resolved_home(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path, create_directory_link: Callable[..., None], target_parts: tuple[str, str], expected_profile: str | None
+) -> None:
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    monkeypatch.delenv("LLM_SETTINGS_PROFILES_ROOT", raising=False)
+    main_home = tmp_path / ".claude"
+    main_home.mkdir()
+    profiles_root = tmp_path / ".claude-profiles"
+    profiles_root.mkdir()
+    target = tmp_path.joinpath(*target_parts)
+    target.mkdir(parents=True)
+    create_directory_link(from_link=profiles_root / "alias", to_target=target)
+    (main_home / "extra-profiles.json").write_text('["alias"]', encoding="utf-8")
+
+    accounts = support.load_claude_accounts()
+
+    assert [(each_account.name, each_account.profile) for each_account in accounts[1:]] == [("target", expected_profile)]
+
+
 def test_should_leave_claude_priorities_unset_without_an_order_file(
     monkeypatch: pytest.MonkeyPatch, tmp_path: Path
 ) -> None:

package/scripts/test_claude_chain_usage.py

@@ -2,12 +2,11 @@
 
 from __future__ import annotations
 
-import importlib
-import os
 import subprocess
 import sys
 import urllib.error
 from datetime import datetime, timezone
+from collections.abc import Callable
 from pathlib import Path
 
 import pytest
@@ -105,18 +104,11 @@ def test_probe_rejects_missing_access_token_for_another_account(
         usage.probe_account_meters(Path("home") / ".claude-profiles" / "ev" / ".credentials.json")
 
 
-def _create_directory_link(*, from_link: Path, to_target: Path) -> None:
-    if sys.platform.startswith("win32"):
-        importlib.import_module("_winapi").CreateJunction(str(to_target), str(from_link))
-        return
-    os.symlink(to_target, from_link, target_is_directory=True)
-
-
-def test_scripts_directory_follows_the_installed_scripts_link(tmp_path: Path) -> None:
+def test_scripts_directory_follows_the_installed_scripts_link(tmp_path: Path, create_directory_link: Callable[..., None]) -> None:
     home = tmp_path.resolve()
     (home / ".agents" / "scripts").mkdir(parents=True)
     (home / ".claude").mkdir()
-    _create_directory_link(
+    create_directory_link(
         from_link=home / ".claude" / "scripts", to_target=home / ".agents" / "scripts"
     )
 

package/scripts/test_shared_tree_paths.py

@@ -2,13 +2,13 @@
 
 from __future__ import annotations
 
-import importlib
-import os
-import sys
+import subprocess
+from collections.abc import Callable
 from pathlib import Path
 
 import pytest
 
+import claude_account_profile
 import shared_tree_paths
 from dev_env_scripts_constants.grok_worker_constants import (
     CLAUDE_CONFIG_DIR_ENV_VAR,
@@ -23,27 +23,17 @@ from dev_env_scripts_constants.shared_tree_constants import (
 )
 
 
-def _create_directory_link(*, from_link: Path, to_target: Path) -> None:
-    if sys.platform.startswith("win32"):
-        importlib.import_module("_winapi").CreateJunction(
-            str(to_target), str(from_link)
-        )
-        return
-    try:
-        os.symlink(to_target, from_link, target_is_directory=True)
-    except OSError:
-        pytest.skip("directory symlink creation is not available")
-
-
-def _build_junction_scripts_layout(tmp_path: Path) -> Path:
-    real_scripts_directory = tmp_path / "real" / SCRIPTS_DIRECTORY_NAME
-    real_scripts_directory.mkdir(parents=True)
-    (real_scripts_directory / "runner.py").write_text("", encoding="utf-8")
+def _build_junction_scripts_layout(
+    tmp_path: Path, create_directory_link: Callable[..., None]
+) -> Path:
+    linked_scripts_directory = tmp_path / "target" / SCRIPTS_DIRECTORY_NAME
+    linked_scripts_directory.mkdir(parents=True)
+    (linked_scripts_directory / "runner.py").write_text("", encoding="utf-8")
     managed_root = tmp_path / "root"
     managed_root.mkdir()
-    _create_directory_link(
+    create_directory_link(
         from_link=managed_root / SCRIPTS_DIRECTORY_NAME,
-        to_target=real_scripts_directory,
+        to_target=linked_scripts_directory,
     )
     return managed_root / SCRIPTS_DIRECTORY_NAME / "runner.py"
 
@@ -63,9 +53,9 @@ def _write_process_tree_kill_stub(from_root: Path) -> Path:
 
 
 def test_junction_scripts_dir_finds_shared_tree_on_unresolved_parent(
-    tmp_path: Path,
+    tmp_path: Path, create_directory_link: Callable[..., None],
 ) -> None:
-    module_file = _build_junction_scripts_layout(tmp_path)
+    module_file = _build_junction_scripts_layout(tmp_path, create_directory_link)
     expected_scripts_directory = _write_process_tree_kill_stub(tmp_path / "root")
     resolved_scripts_directory = (
         shared_tree_paths.resolve_shared_process_tree_scripts_directory(
@@ -76,10 +66,10 @@ def test_junction_scripts_dir_finds_shared_tree_on_unresolved_parent(
 
 
 def test_resolved_parent_is_used_when_link_side_has_no_shared_tree(
-    tmp_path: Path,
+    tmp_path: Path, create_directory_link: Callable[..., None],
 ) -> None:
-    module_file = _build_junction_scripts_layout(tmp_path)
-    expected_scripts_directory = _write_process_tree_kill_stub(tmp_path / "real")
+    module_file = _build_junction_scripts_layout(tmp_path, create_directory_link)
+    expected_scripts_directory = _write_process_tree_kill_stub(tmp_path / "target")
     resolved_scripts_directory = (
         shared_tree_paths.resolve_shared_process_tree_scripts_directory(
             module_file, all_environment={}
@@ -89,9 +79,9 @@ def test_resolved_parent_is_used_when_link_side_has_no_shared_tree(
 
 
 def test_configured_root_is_used_when_neither_parent_holds_the_module(
-    tmp_path: Path,
+    tmp_path: Path, create_directory_link: Callable[..., None],
 ) -> None:
-    module_file = _build_junction_scripts_layout(tmp_path)
+    module_file = _build_junction_scripts_layout(tmp_path, create_directory_link)
     configured_root = tmp_path / "configured"
     expected_scripts_directory = _write_process_tree_kill_stub(configured_root)
     resolved_scripts_directory = (
@@ -106,9 +96,9 @@ def test_configured_root_is_used_when_neither_parent_holds_the_module(
 
 
 def test_unresolved_parent_wins_when_configured_root_also_holds_the_module(
-    tmp_path: Path,
+    tmp_path: Path, create_directory_link: Callable[..., None],
 ) -> None:
-    module_file = _build_junction_scripts_layout(tmp_path)
+    module_file = _build_junction_scripts_layout(tmp_path, create_directory_link)
     expected_scripts_directory = _write_process_tree_kill_stub(tmp_path / "root")
     configured_root = tmp_path / "configured"
     _write_process_tree_kill_stub(configured_root)
@@ -123,8 +113,8 @@ def test_unresolved_parent_wins_when_configured_root_also_holds_the_module(
     assert resolved_scripts_directory == expected_scripts_directory
 
 
-def test_missing_module_returns_unresolved_candidate(tmp_path: Path) -> None:
-    module_file = _build_junction_scripts_layout(tmp_path)
+def test_missing_module_returns_unresolved_candidate(tmp_path: Path, create_directory_link: Callable[..., None]) -> None:
+    module_file = _build_junction_scripts_layout(tmp_path, create_directory_link)
     expected_scripts_directory = (
         tmp_path
         / "root"
@@ -144,9 +134,9 @@ def test_missing_module_returns_unresolved_candidate(tmp_path: Path) -> None:
 
 
 def test_junction_scripts_dir_finds_advisor_scripts_on_unresolved_parent(
-    tmp_path: Path,
+    tmp_path: Path, create_directory_link: Callable[..., None],
 ) -> None:
-    module_file = _build_junction_scripts_layout(tmp_path)
+    module_file = _build_junction_scripts_layout(tmp_path, create_directory_link)
     expected_scripts_directory = (
         tmp_path
         / "root"
@@ -198,7 +188,7 @@ def test_generalized_resolver_serves_a_deeper_anchor(tmp_path: Path) -> None:
 
 @pytest.mark.parametrize("managed_name", (".claude", "profile-a"))
 def test_resolved_agents_scripts_find_the_verified_managed_root(
-    tmp_path: Path, managed_name: str,
+    tmp_path: Path, create_directory_link: Callable[..., None], managed_name: str,
 ) -> None:
     agents_name = ".agents" if managed_name == ".claude" else f"{managed_name}.agents"
     agents_root = tmp_path / agents_name
@@ -208,7 +198,7 @@ def test_resolved_agents_scripts_find_the_verified_managed_root(
     module_file.write_text("", encoding="utf-8")
     managed_root = tmp_path / managed_name
     managed_root.mkdir()
-    _create_directory_link(from_link=managed_root / "scripts", to_target=scripts_directory)
+    create_directory_link(from_link=managed_root / "scripts", to_target=scripts_directory)
     expected = _write_process_tree_kill_stub(managed_root)
     resolved_directory = shared_tree_paths.resolve_shared_process_tree_scripts_directory(module_file, {})
     assert resolved_directory == expected
@@ -227,3 +217,35 @@ def test_neighboring_managed_root_cannot_supply_a_foreign_shared_tree(tmp_path:
     resolved_directory = shared_tree_paths.resolve_shared_process_tree_scripts_directory(module_file, {})
     expected = agents_root / "_shared" / "process-tree" / "scripts"
     assert resolved_directory == expected
+
+
+def test_should_fail_with_the_link_command_output_when_a_link_cannot_be_made(
+    tmp_path: Path,
+    create_directory_link: Callable[..., None],
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    def refuse_link(source_path: Path, link_path: Path) -> None:
+        raise subprocess.CalledProcessError(1, ["mklink"], b"", b"Access is denied.")
+
+    monkeypatch.setattr(claude_account_profile, "_link_directory", refuse_link)
+
+    with pytest.raises(pytest.fail.Exception) as failure:
+        create_directory_link(from_link=tmp_path / "link", to_target=tmp_path)
+
+    assert "Access is denied." in str(failure.value)
+
+
+def test_should_fail_with_the_os_error_when_a_symlink_cannot_be_made(
+    tmp_path: Path,
+    create_directory_link: Callable[..., None],
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    def refuse_link(source_path: Path, link_path: Path) -> None:
+        raise PermissionError("Operation not permitted")
+
+    monkeypatch.setattr(claude_account_profile, "_link_directory", refuse_link)
+
+    with pytest.raises(pytest.fail.Exception) as failure:
+        create_directory_link(from_link=tmp_path / "link", to_target=tmp_path)
+
+    assert "Operation not permitted" in str(failure.value)

package/scripts/tests/test_adapter_configuration.py

@@ -58,6 +58,14 @@ def test_pull_request_lifecycle_gate_registration_is_clean(tmp_path: Path) -> No
     assert adapters.hook_configuration_diagnostics(current_document, tmp_path) == ()
 
 
+def test_new_merge_offer_gate_registration_is_clean(tmp_path: Path) -> None:
+    current_document = _hook_document(
+        ["hooks/blocking/merge_over_review_offer_gate.py"],
+        '{"hooks": {}}',
+    )
+    assert adapters.hook_configuration_diagnostics(current_document, tmp_path) == ()
+
+
 def test_new_step_note_gate_registration_is_clean(tmp_path: Path) -> None:
     current_document = _hook_document(
         ["hooks/blocking/step_note_gate.py"],