claude-dev-env 8.79.0 → 8.80.0

package/hooks/blocking/test_bash_dispatcher_interpreter_starts.py

@@ -22,7 +22,7 @@ from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
 )
 
 
-def test_bash_roster_starts_only_the_msys_rewriter_and_the_two_gates() -> None:
+def test_bash_roster_starts_only_the_msys_rewriter_and_the_three_gates() -> None:
     assert ALL_BASH_HOSTED_HOOK_ENTRIES == (
         BashHostedHookEntry(
             script_relative_path="blocking/msys_rev_path_rewriter.py",
@@ -38,4 +38,8 @@ def test_bash_roster_starts_only_the_msys_rewriter_and_the_two_gates() -> None:
             applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
             replaced_by_plugin_name="shell-guards",
         ),
+        BashHostedHookEntry(
+            script_relative_path="blocking/cloud_graphql_gate.py",
+            applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+        ),
     )

package/hooks/blocking/test_bash_pre_tool_use_dispatcher.py

@@ -270,7 +270,10 @@ def test_should_drop_the_gates_the_shell_guards_mod_holds_while_it_is_on(
 ) -> None:
     _enable_shell_guards(tmp_path, monkeypatch)
     all_script_paths = [each_entry.script_relative_path for each_entry in select_applicable_entries(BASH_TOOL_NAME)]
-    assert all_script_paths == ["blocking/msys_rev_path_rewriter.py"]
+    assert all_script_paths == [
+        "blocking/msys_rev_path_rewriter.py",
+        "blocking/cloud_graphql_gate.py",
+    ]
 
 
 def test_should_pass_a_headless_claude_command_while_the_shell_guards_mod_is_on(

package/hooks/blocking/test_cloud_graphql_gate.py

@@ -0,0 +1,210 @@
+"""Tests for cloud_graphql_gate, which stops cloud sessions from calling GitHub GraphQL."""
+
+from __future__ import annotations
+
+import base64
+import json
+from io import StringIO
+from unittest.mock import patch
+
+import pytest
+
+import cloud_graphql_gate as gate
+
+
+def _stdout_from_main(payload: dict[str, object]) -> str:
+    """Return what main() wrote to stdout for one hook payload."""
+    captured_stdout = StringIO()
+    with (
+        patch("sys.stdin", StringIO(json.dumps(payload))),
+        patch("sys.stdout", captured_stdout),
+        patch.object(gate, "log_hook_block"),
+    ):
+        gate.main()
+    return captured_stdout.getvalue()
+
+
+_ENCODED_GH_PR_LIST = base64.b64encode("gh pr list".encode("utf-16-le")).decode()
+
+
+@pytest.fixture
+def cloud_session(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Mark the hook process as running inside a Claude Code cloud session."""
+    monkeypatch.setenv("CLAUDE_CODE_REMOTE", "true")
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "gh api graphql -f query='query{viewer{login}}'",
+        "gh.exe api graphql -F owner=o -f query=@q.graphql",
+        "cd repo && gh api graphql --paginate -f query=@q.graphql",
+        'bash -c "gh api graphql -f query=@q.graphql"',
+        "curl -sS -X POST https://api.github.com/graphql -d @q.json",
+        "curl -H 'Authorization: Bearer x' HTTPS://API.GITHUB.COM/GRAPHQL",
+        "wget --post-data=@q.json https://api.github.com/graphql",
+        "Invoke-RestMethod -Method Post -Uri https://api.github.com/graphql -Body $q",
+        "gh pr create --draft --title t --body-file b.md",
+        "gh pr view 12 --json title",
+        "gh pr checks 12",
+        "gh issue list -L 1",
+        "gh repo clone o/r",
+        "gh repo view o/r",
+        "gh label list",
+        "gh search prs repo:o/r",
+        "gh ruleset list",
+        "gh gist list",
+        "gh api -X POST graphql -f query='mutation{x}'",
+        "gh api --method POST graphql -f query=@q.graphql",
+        "gh api -H 'Accept: application/json' graphql -f query=@q",
+        "gh api /graphql -f query=@q",
+        "gh api https://api.github.com/graphql -f query=@q",
+        "gh -R o/r pr list",
+        "gh pr -R o/r list",
+        "gh pr --repo o/r view 12",
+        "gh pr merge 12 --body -h",
+        "gh pr view 12 --web",
+        "gh issue list --web",
+        "gh project item-list 1 --owner o",
+        "gh discussion list",
+        "gh status",
+        "gh status -o o",
+        "gh org list",
+        "gh repo archive o/r --yes",
+        "gh repo unarchive o/r --yes",
+        "curl -X POST https://api.github.com:443/graphql -d @q.json",
+        "if gh pr view 12; then echo ok; fi",
+        "if true; then gh api graphql -f query=@q; fi",
+        "while gh pr list; do sleep 1; done",
+        "! gh pr list",
+        "command gh pr list",
+        "exec gh issue list",
+        'echo "$(gh pr list)"',
+        "echo `gh pr view 12`",
+        "PR_URL=$(gh pr create --title t --body-file b.md)",
+        "(gh pr view 12)",
+        "python3 -c \"import requests; requests.post('https://api.github.com/graphql')\"",
+        "node -e \"fetch('https://api.github.com/graphql', {method: 'POST'})\"",
+        "gh release list -L 1",
+        "gh release view v1 --json name",
+        "gh workflow run ci.yml",
+        "gh workflow run ci.yml -f -r",
+        "gh pr list --search -w",
+        "echo \"$(printf ')'; gh pr list)\"",
+        "x=`echo \\`gh pr list\\``",
+        'echo $(echo "$(gh api graphql -f query=@q)")',
+        "python3.12 -c \"u('https://api.github.com/graphql')\"",
+        "pypy3 -c \"u('https://api.github.com/graphql')\"",
+        'eval "gh api graphql -f query=@q"',
+        "find . -maxdepth 0 -exec gh api graphql -f query=@q \\;",
+        "Invoke-Expression 'gh pr list'",
+        'iex "gh issue list"',
+        "find . -exec true \\; -exec gh api graphql -f query=@q \\;",
+        "gh repo sync o/r",
+        "gh repo create n --template o/t",
+        "gh repo create n -p o/t --private",
+        "gh repo edit o/r --enable-secret-scanning",
+        "gh repo edit --enable-advanced-security=false",
+        'Start-Process gh -ArgumentList "api graphql -f query=@q"',
+        "Start-Process -FilePath gh -ArgumentList 'pr','list' -Wait",
+        "Start-Process -FilePath:gh -ArgumentList:'api graphql -f query=@q'",
+        "GH.EXE pr list",
+        "pwsh -EncodedCommand " + _ENCODED_GH_PR_LIST,
+    ],
+)
+def test_should_detect_a_github_graphql_call(command: str) -> None:
+    assert gate.calls_github_graphql(command) is True
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "gh api repos/o/r/pulls/1/ccr/review_threads",
+        "gh api user",
+        "gh pr diff 12",
+        "gh pr create --help",
+        "gh issue view -h",
+        "gh pr list -R o/r --help",
+        "gh pr list --web",
+        "gh pr list -w -R o/r",
+        "gh project",
+        "gh api repos/o/r/contents/docs/graphql.md",
+        "gh api repos/o/r/issues -f title=graphql",
+        "gh repo fork o/r",
+        "gh repo rename new-name",
+        "echo '$(gh pr list)'",
+        "command -v gh",
+        "gh pr view -w -h",
+        "gh pr list --state open --web",
+        "gh release view --json name",
+        "gh workflow run ci.yml --ref main",
+        "gh workflow run ci.yml -r main",
+        "gh workflow run ci.yml --ref=main",
+        "gh search repos claude-dev-env",
+        "gh run view 12",
+        "python3 scripts/review_closure.py o/r 1",
+        'eval "gh api repos/o/r/pulls/1"',
+        "gh repo sync o/r --branch main",
+        "gh repo sync -b main",
+        "gh repo create n --private",
+        "gh repo edit o/r --description d",
+        "gh api repos/o/r --preview graphql",
+        "gh api repos/o/r/issues --jq graphql",
+        "Start-Process notepad",
+        "find . -name '*.py' -exec grep -l graphql {} +",
+        "gh pr",
+        "gh run list -L 1",
+        "gh workflow list",
+        "gh label create bug",
+        "curl -sS https://api.github.com/repos/o/r",
+        'grep -rn "api.github.com/graphql" scripts',
+        'echo "gh api graphql"',
+        'git commit -m "drop gh api graphql calls"',
+    ],
+)
+def test_should_pass_rest_calls_and_text_that_only_mentions_graphql(command: str) -> None:
+    assert gate.calls_github_graphql(command) is False
+
+
+def test_should_deny_gh_api_graphql_in_a_cloud_session_and_name_the_rest_routes(
+    cloud_session: None,
+) -> None:
+    decision = json.loads(
+        _stdout_from_main(
+            {"tool_name": "Bash", "tool_input": {"command": "gh api graphql -f query=@q"}}
+        )
+    )
+    specific_output = decision["hookSpecificOutput"]
+    assert specific_output["permissionDecision"] == "deny"
+    reason = specific_output["permissionDecisionReason"]
+    assert "GET /repos/{owner}/{repo}/pulls/{n}/ccr/review_threads" in reason
+    assert "gh api repos/{owner}/{repo}/..." in reason
+    assert "mcp__github__create_pull_request" in reason
+
+
+def test_should_deny_a_powershell_endpoint_call_in_a_cloud_session(cloud_session: None) -> None:
+    command = "Invoke-RestMethod -Uri https://api.github.com/graphql -Method Post"
+    decision = json.loads(
+        _stdout_from_main({"tool_name": "PowerShell", "tool_input": {"command": command}})
+    )
+    assert decision["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_should_stay_quiet_outside_a_cloud_session() -> None:
+    assert (
+        _stdout_from_main(
+            {"tool_name": "Bash", "tool_input": {"command": "gh api graphql -f query=@q"}}
+        )
+        == ""
+    )
+
+
+def test_should_stay_quiet_for_a_rest_call_in_a_cloud_session(cloud_session: None) -> None:
+    rest_command = "gh api repos/o/r/pulls/1/ccr/review_threads"
+    assert _stdout_from_main({"tool_name": "Bash", "tool_input": {"command": rest_command}}) == ""
+
+
+def test_should_stay_quiet_for_another_tool_in_a_cloud_session(cloud_session: None) -> None:
+    assert (
+        _stdout_from_main({"tool_name": "Write", "tool_input": {"command": "gh api graphql"}}) == ""
+    )

package/hooks/blocking/test_headless_claude_broker_gate.py

@@ -88,13 +88,18 @@ def test_other_tool_payload_emits_nothing() -> None:
     assert _stdout_from_main({"tool_name": "Write", "tool_input": {"command": 'claude -p "task"'}}) == ""
 
 
-def test_should_pass_bare_headless_claude_in_a_cloud_session(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("CLAUDE_CODE_REMOTE", "true")
+@pytest.mark.parametrize("marker_value", ["true", " TRUE "])
+def test_should_pass_bare_headless_claude_in_a_cloud_session(
+    monkeypatch: pytest.MonkeyPatch, marker_value: str
+) -> None:
+    monkeypatch.setenv("CLAUDE_CODE_REMOTE", marker_value)
     assert _stdout_from_main({"tool_name": "Bash", "tool_input": {"command": 'claude -p "task"'}}) == ""
 
 
-def test_should_report_a_cloud_session_only_when_the_marker_is_true(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("CLAUDE_CODE_REMOTE", "false")
-    assert gate.is_cloud_session() is False
-    monkeypatch.setenv("CLAUDE_CODE_REMOTE", "true")
-    assert gate.is_cloud_session() is True
+@pytest.mark.parametrize("marker_value", ["false", "1", ""])
+def test_should_deny_bare_headless_claude_when_the_marker_is_not_true(
+    monkeypatch: pytest.MonkeyPatch, marker_value: str
+) -> None:
+    monkeypatch.setenv("CLAUDE_CODE_REMOTE", marker_value)
+    decision = json.loads(_stdout_from_main({"tool_name": "Bash", "tool_input": {"command": 'claude -p "task"'}}))
+    assert decision["hookSpecificOutput"]["permissionDecision"] == "deny"

package/hooks/blocking/test_merge_review_gate.py

@@ -16,6 +16,7 @@ from blocking import merge_review_gate as gate
 
 CLEAN_HEAD = "abc1234def5678abc1234def5678abc1234def56"
 NEW_HEAD = "9999999aaaaaaa9999999aaaaaaa9999999aaaaa"
+RULINGS_LINK = "https://github.com/acme/tools/pull/12#issuecomment-1"
 
 
 @pytest.fixture(autouse=True)
@@ -58,6 +59,68 @@ def test_should_allow_a_merge_pinned_to_the_clean_head() -> None:
     assert _reason(_merge_tool(CLEAN_HEAD)) is None
 
 
+def test_should_allow_a_merge_whose_findings_are_all_ruled_out_with_a_link() -> None:
+    merge_review_receipt.record_review("acme/tools", 12, CLEAN_HEAD, 2, 2, RULINGS_LINK)
+    assert _reason(_merge_tool(CLEAN_HEAD)) is None
+
+
+def test_should_deny_a_merge_with_a_finding_left_open() -> None:
+    merge_review_receipt.record_review("acme/tools", 12, CLEAN_HEAD, 3, 2, RULINGS_LINK)
+    assert "no clean review" in _reason(_merge_tool(CLEAN_HEAD))
+
+
+@pytest.mark.parametrize(
+    "receipt",
+    [
+        {"head": CLEAN_HEAD, "findings": 2, "ruled_out": 2},
+        {"head": CLEAN_HEAD, "findings": 2, "ruled_out": 2, "rulings": "  "},
+        {"head": CLEAN_HEAD, "findings": 2, "ruled_out": 2, "rulings": "x"},
+        {
+            "head": CLEAN_HEAD,
+            "findings": 2,
+            "ruled_out": 2,
+            "rulings": "https://github.com/acme/other/pull/12#issuecomment-1",
+        },
+        {
+            "head": CLEAN_HEAD,
+            "findings": 2,
+            "ruled_out": 2,
+            "rulings": "https://github.com/acme/tools/pull/13#issuecomment-1",
+        },
+        {
+            "head": CLEAN_HEAD,
+            "findings": 2,
+            "ruled_out": 2,
+            "rulings": "https://evil.example/?https://github.com/acme/tools/pull/12#issuecomment-1",
+        },
+        {"head": CLEAN_HEAD, "findings": True},
+        {"head": CLEAN_HEAD, "findings": "0"},
+        {"head": CLEAN_HEAD, "findings": 1, "ruled_out": True, "rulings": RULINGS_LINK},
+        {"head": CLEAN_HEAD, "findings": -1, "ruled_out": -1, "rulings": RULINGS_LINK},
+    ],
+)
+def test_is_clean_receipt_should_reject_a_receipt_it_cannot_back(receipt: dict[str, object]) -> None:
+    assert gate.is_clean_receipt(receipt, "acme", "tools", 12) is False
+
+
+def test_is_clean_receipt_should_accept_zero_findings() -> None:
+    assert gate.is_clean_receipt({"head": CLEAN_HEAD, "findings": 0}, "acme", "tools", 12) is True
+
+
+@pytest.mark.parametrize(
+    "rulings", ["x", "https://github.com/acme/tools/pull/13#issuecomment-1"]
+)
+def test_should_deny_a_merge_whose_rulings_link_is_not_a_comment_on_this_pull_request(
+    rulings: str,
+) -> None:
+    merge_review_receipt.record_review("acme/tools", 12, CLEAN_HEAD, 2, 2, rulings)
+    assert "no clean review" in _reason(_merge_tool(CLEAN_HEAD))
+
+
+def test_should_name_the_ruled_out_route_in_the_deny_reason() -> None:
+    assert "--ruled-out" in _reason(_merge_tool(CLEAN_HEAD))
+
+
 def test_should_deny_a_merge_pinned_to_a_head_pushed_after_the_review() -> None:
     merge_review_receipt.record_review("acme/tools", 12, CLEAN_HEAD, 0)
     assert "Review the new head" in _reason(_merge_tool(NEW_HEAD))

package/hooks/blocking/test_pr_lifecycle_skill_gate.py

@@ -156,6 +156,7 @@ def test_action_command_shapes(tmp_path: Path) -> None:
         "git --git-dir=.git push origin head",
         "gh pr create",
         "gh -R owner/repo pr --repo owner/repo merge",
+        "gh -R owner/repo api -X PUT repos/owner/repo/pulls/1/merge",
         "gh api -X PUT repos/owner/repo/pulls/1/merge",
         "gh api graphql -f query='mutation { enablePullRequestAutoMerge }'",
         "gh api graphql -f name=auto-merge",
@@ -180,6 +181,8 @@ def test_non_action_command_shapes(tmp_path: Path) -> None:
         "gh api repos/owner/repo/pulls/1/mergeability",
         "gh issue create --body-file message.txt",
         "gh pr",
+        "gh pr --repo owner/repo",
+        "gh api -H 'Accept: x' repos/owner/repo/pulls/1/mergeability",
         "GH_TOKEN=x gh issue list",
         "env -u GH_TOKEN git status",
     )

package/hooks/conftest.py

@@ -23,7 +23,7 @@ _CLAUDE_SESSION_ID_ENVIRONMENT_VARIABLE_NAME = importlib.import_module(
 ).CLAUDE_SESSION_ID_ENVIRONMENT_VARIABLE_NAME
 
 _CLOUD_SESSION_ENVIRONMENT_VARIABLE_NAME = importlib.import_module(
-    "hooks_constants.headless_claude_broker_gate_constants"
+    "hooks_constants.cloud_session_constants"
 ).CLOUD_SESSION_ENV_VAR
 
 _ROOT_ANCHORED_PROBE_PATH = "/tmp/scratch.py"

package/hooks/features/bash-dispatchers.md

@@ -8,6 +8,7 @@ This family rewrites a Git Bash command when path conversion would change a revi
 - `blocking/msys_rev_path_rewriter.py` adds a narrow `MSYS2_ARG_CONV_EXCL` prefix for affected revision and path tokens.
 - `blocking/headless_claude_broker_gate.py` denies a headless `claude -p` or `claude --print` call and names the broker command to run instead.
 - `blocking/gh_global_account_switch_gate.py` denies `gh auth switch`, `gh auth login`, and `gh auth logout` and names the per-command `GH_TOKEN` form to run instead.
+- `blocking/cloud_graphql_gate.py` denies the `gh` commands that call GraphQL (`gh api graphql` with any flags before the endpoint, `gh pr`, `gh issue`, `gh project` and `gh discussion` except `gh pr diff` and `gh pr list --web`, `gh status`, `gh org list`, `gh release list`, `gh release view` with a tag, `gh workflow run` without `--ref`, and a few `repo`, `label`, `search`, `ruleset` and `gist` commands, read past `if`, `!` and command substitutions) and an HTTP client or `python -c` style call to `api.github.com/graphql`, with or without a port, inside a cloud session, where the proxy answers GraphQL with HTTP 403, and names the REST routes to run instead.
 - `blocking/bash_post_call_dispatcher.py` runs hosted observers and joins their context output without blocking the call.
 - `advisory/pr_done_reminder.py` adds a pull request checklist after a successful push or pull request creation.
 
@@ -17,6 +18,7 @@ This family rewrites a Git Bash command when path conversion would change a revi
 - `blocking/msys_rev_path_rewriter.py` runs inside that dispatcher on `PreToolUse`, matcher `Bash`, timeout `60` seconds. `ALL_BASH_HOSTED_HOOK_ENTRIES` selects the `Bash` tool.
 - `blocking/headless_claude_broker_gate.py` runs inside that dispatcher on `PreToolUse`, matcher `Bash`, timeout `60` seconds, for the Bash and PowerShell tools.
 - `blocking/gh_global_account_switch_gate.py` runs inside that dispatcher on `PreToolUse`, matcher `Bash`, timeout `60` seconds, for the Bash and PowerShell tools.
+- `blocking/cloud_graphql_gate.py` runs inside that dispatcher on `PreToolUse`, matcher `Bash`, timeout `60` seconds, for the Bash and PowerShell tools, when `CLAUDE_CODE_REMOTE` is `true`.
 - `blocking/bash_post_call_dispatcher.py` runs on `PostToolUse`, matcher `Bash|PowerShell`, timeout `60` seconds in `hooks.json`.
 - `advisory/pr_done_reminder.py` runs inside that dispatcher on `PostToolUse`, matcher `Bash|PowerShell`, timeout `60` seconds. `ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES` selects `Bash` and `PowerShell`.
 
@@ -29,6 +31,7 @@ Preconditions:
 - **Pre-call dispatch.** Input is a clean Bash command. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_bash_pre_tool_use_dispatcher.py -q`. The adjacent test observes the combined decision and hosted precedence.
 - **Revision rewrite.** Input is a Git command with `origin/main:.claude/settings.json`. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_msys_rev_path_rewriter.py -q`. The adjacent test observes the `origin/main:` exclusion prefix.
 - **Broker gate.** Input is a `claude -p task` command. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_headless_claude_broker_gate.py -q`. The adjacent test observes a denial that names the broker command.
+- **Cloud GraphQL gate.** Input is a `gh api graphql` command with `CLAUDE_CODE_REMOTE=true`. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_cloud_graphql_gate.py -q`. The adjacent test observes a denial that names the REST routes, and silence outside a cloud session.
 - **Post-call dispatch.** Input is a Bash call that yields hosted context. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_bash_post_call_dispatcher.py -q`. The adjacent test observes a joined context payload and exit code zero.
 - **Pull request reminder.** Input is a completed push or pull request creation. Run `python -m pytest packages/claude-dev-env/hooks/advisory/test_pr_done_reminder.py -q`. The adjacent test checks the reminder trigger and checklist verdict.
 

package/hooks/features/conduct-gates.md

@@ -12,7 +12,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/step_note_gate.py` requires a status line before a tool call while its opt-in flag is on.
 - `blocking/verify_before_acting.py` blocks a completed mutating call when the agent's reasoning contains an unchecked claim.
 - `blocking/pr_lifecycle_skill_gate.py` denies a commit, push, pull request action, or merge until the `pr-lifecycle` skill appears in the transcript since the last compaction.
-- `blocking/merge_review_gate.py` denies an agent's merge until a review pass on the merged head reported zero findings. It reads the receipt `scripts/merge_review_receipt.py` writes, requires the merge, auto-merge or merge-queue entry to be pinned to that head, and skips repositories listed in `CLAUDE_MERGE_REVIEW_EXEMPT_REPOSITORIES`. Its deny reason names the review command `CLAUDE_MERGE_REVIEW_COMMAND` sets.
+- `blocking/merge_review_gate.py` denies an agent's merge until a review pass on the merged head reported zero findings, or ruled out every finding and linked the posted rulings. It reads the receipt `scripts/merge_review_receipt.py` writes, requires the merge, auto-merge or merge-queue entry to be pinned to that head, and skips repositories listed in `CLAUDE_MERGE_REVIEW_EXEMPT_REPOSITORIES`. Its deny reason names the review command `CLAUDE_MERGE_REVIEW_COMMAND` sets.
 - `blocking/merge_over_review_offer_gate.py` denies a decision card or question that offers a merge while it names open review findings, a red check, unaddressed review comments, or an override. It reads the whole card as one text: every question, header, context, reason, and option, whether the option is a string or a label with a consequence or description.
 - `blocking/artifact_dark_mode_gate.py` denies an Artifact page publish when the page, inside the publish wrapper, keeps a light body or shows text under 4.5:1 contrast in dark mode. `blocking/artifact_dark_mode_render.cjs` renders the page in headless Chromium for it.
 
@@ -57,4 +57,4 @@ Preconditions:
 - The handoff close gate reads the `body` and `comment` fields of issue tools only. A `gh issue close --comment` command in Bash and a pull request body that closes the issue with `Closes #N` do not reach it.
 - The lifecycle gate counts only invocations after the last compaction, so a compacted session invokes `pr-lifecycle` again. A missing or unreadable transcript allows the call.
 - The dark mode gate denies a page publish when Node, Playwright or Chromium is missing, and its reason names the install command. It checks both dark signals, `prefers-color-scheme: dark` and `data-theme="dark"` on the root element.
-- The clean-review gate trusts the receipt. A receipt the agent writes by hand with zero findings passes, so the pr-lifecycle skill names the review loop that writes it. A `gh pr merge` that names no repository is denied, because the gate cannot tell which repository the current branch belongs to.
+- The clean-review gate trusts the receipt. A receipt the agent writes by hand with zero findings, or with every finding ruled out and a rulings link, passes, so the pr-lifecycle skill names the review loop that writes it. A `gh pr merge` that names no repository is denied, because the gate cannot tell which repository the current branch belongs to.

package/hooks/hooks_constants/bash_pre_tool_use_dispatcher_constants.py

@@ -75,4 +75,8 @@ ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
         applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
         replaced_by_plugin_name=SHELL_GUARDS_PLUGIN_NAME,
     ),
+    BashHostedHookEntry(
+        script_relative_path="blocking/cloud_graphql_gate.py",
+        applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+    ),
 )

package/hooks/hooks_constants/cloud_graphql_gate_constants.py

@@ -0,0 +1,116 @@
+"""Constants for the gate that stops cloud sessions from calling GitHub GraphQL.
+
+Holds the ``gh`` commands that call GraphQL, the ``gh`` subcommands inside
+those groups that call REST, the options that keep a GraphQL command on REST,
+the commands that call GraphQL only with an operand or only with certain
+options, the help flags that reach no network, the HTTP client and script
+interpreter programs and the GraphQL endpoint pattern they could name, the
+hook name the block log records, and the deny message that names the REST
+routes to run instead.
+"""
+
+from __future__ import annotations
+
+import re
+
+__all__ = [
+    "GH_PROGRAM_NAME",
+    "GH_API_SUBCOMMAND",
+    "GH_GRAPHQL_ENDPOINT",
+    "GH_ENDPOINT_PATH_SEPARATOR",
+    "GH_COMMAND_PATH_LENGTH",
+    "ALL_GH_GRAPHQL_COMMAND_GROUPS",
+    "ALL_GH_REST_COMMAND_PATHS_IN_GRAPHQL_GROUPS",
+    "ALL_GH_GRAPHQL_COMMAND_PATHS",
+    "ALL_GH_HELP_FLAGS",
+    "ALL_GH_REST_OPTIONS_BY_COMMAND_PATH",
+    "ALL_GH_COMMAND_PATHS_CALLING_GRAPHQL_WITH_AN_OPERAND",
+    "ALL_GH_GRAPHQL_OPTIONS_BY_COMMAND_PATH",
+    "ALL_HTTP_CLIENT_PROGRAM_NAMES",
+    "ALL_SCRIPT_INTERPRETER_PROGRAM_NAMES",
+    "GITHUB_GRAPHQL_ENDPOINT_PATTERN",
+    "GATE_HOOK_NAME",
+    "CLOUD_GRAPHQL_DENY_REASON",
+]
+
+GH_PROGRAM_NAME: str = "gh"
+GH_API_SUBCOMMAND: str = "api"
+GH_GRAPHQL_ENDPOINT: str = "graphql"
+GH_ENDPOINT_PATH_SEPARATOR: str = "/"
+GH_COMMAND_PATH_LENGTH: int = 2
+ALL_GH_GRAPHQL_COMMAND_GROUPS: frozenset[str] = frozenset({"pr", "issue", "project", "discussion"})
+ALL_GH_REST_COMMAND_PATHS_IN_GRAPHQL_GROUPS: frozenset[tuple[str, ...]] = frozenset(
+    {("pr", "diff")}
+)
+ALL_GH_GRAPHQL_COMMAND_PATHS: frozenset[tuple[str, ...]] = frozenset(
+    {
+        ("status",),
+        ("org", "list"),
+        ("repo", "view"),
+        ("repo", "clone"),
+        ("repo", "list"),
+        ("repo", "archive"),
+        ("repo", "unarchive"),
+        ("label", "list"),
+        ("search", "prs"),
+        ("search", "issues"),
+        ("ruleset", "list"),
+        ("gist", "list"),
+        ("release", "list"),
+        ("workflow", "run"),
+        ("repo", "sync"),
+    }
+)
+ALL_GH_HELP_FLAGS: frozenset[str] = frozenset({"--help", "-h"})
+ALL_GH_REST_OPTIONS_BY_COMMAND_PATH: dict[tuple[str, ...], frozenset[str]] = {
+    ("pr", "list"): frozenset({"--web", "-w"}),
+    ("workflow", "run"): frozenset({"--ref", "-r"}),
+    ("repo", "sync"): frozenset({"--branch", "-b"}),
+}
+ALL_GH_GRAPHQL_OPTIONS_BY_COMMAND_PATH: dict[tuple[str, ...], frozenset[str]] = {
+    ("repo", "create"): frozenset({"--template", "-p"}),
+    ("repo", "edit"): frozenset(
+        {
+            "--enable-advanced-security",
+            "--enable-secret-scanning",
+            "--enable-secret-scanning-push-protection",
+        }
+    ),
+}
+ALL_GH_COMMAND_PATHS_CALLING_GRAPHQL_WITH_AN_OPERAND: frozenset[tuple[str, ...]] = frozenset(
+    {("release", "view")}
+)
+ALL_HTTP_CLIENT_PROGRAM_NAMES: frozenset[str] = frozenset(
+    {"curl", "wget", "http", "https", "invoke-restmethod", "invoke-webrequest", "irm", "iwr"}
+)
+ALL_SCRIPT_INTERPRETER_PROGRAM_NAMES: frozenset[str] = frozenset(
+    {"node", "deno", "bun", "ruby", "perl", "php"}
+)
+GITHUB_GRAPHQL_ENDPOINT_PATTERN: re.Pattern[str] = re.compile(
+    r"api\.github\.com(?::\d+)?/graphql", re.IGNORECASE
+)
+GATE_HOOK_NAME: str = "cloud_graphql_gate.py"
+CLOUD_GRAPHQL_DENY_REASON: str = (
+    "BLOCKED: the Claude Code cloud proxy answers every GitHub GraphQL request with "
+    "HTTP 403, whatever the token. gh api graphql calls it, and so do gh pr and gh issue "
+    "(all but gh pr diff and gh pr list --web), gh project, gh discussion, gh status, "
+    "gh org list, gh repo view/clone/list/archive/unarchive, gh label list, "
+    "gh search prs/issues, gh ruleset list, gh gist list, gh release list, "
+    "gh release view with a tag, gh workflow run without --ref, gh repo sync without "
+    "--branch, gh repo create --template, and gh repo edit with a security setting. "
+    "Use REST through gh api repos/{owner}/{repo}/... or the mcp__github__ tools. "
+    "Open a PR: mcp__github__create_pull_request, or gh api repos/{owner}/{repo}/pulls "
+    "--input pr.json with title, head, base, body and draft in the JSON. "
+    "Read a PR: gh api repos/{owner}/{repo}/pulls/{n}. "
+    "Checks: gh api repos/{owner}/{repo}/commits/{sha}/check-runs. "
+    "Issues: gh api repos/{owner}/{repo}/issues/{n}. "
+    "Clone: git clone https://github.com/{owner}/{repo}. "
+    "Review threads: GET /repos/{owner}/{repo}/pulls/{n}/ccr/review_threads. "
+    "Resolve a thread: POST /repos/{owner}/{repo}/pulls/{n}/ccr/comments/{comment_id}/resolve "
+    "(or /unresolve). "
+    "Auto-merge: PUT or DELETE /repos/{owner}/{repo}/pulls/{n}/ccr/auto_merge. "
+    "Draft state: POST /repos/{owner}/{repo}/pulls/{n}/ccr/ready_for_review "
+    "or /ccr/convert_to_draft. "
+    "A query with no REST route cannot run in this session; it needs a machine outside "
+    "the cloud proxy."
+)

package/hooks/hooks_constants/cloud_session.py

@@ -0,0 +1,17 @@
+"""Tell a hook whether it runs inside a Claude Code cloud session."""
+
+from __future__ import annotations
+
+import os
+
+from hooks_constants.cloud_session_constants import (
+    CLOUD_SESSION_ENV_TRUE_VALUE,
+    CLOUD_SESSION_ENV_VAR,
+)
+
+__all__ = ["is_cloud_session"]
+
+
+def is_cloud_session() -> bool:
+    """Return True when ``CLAUDE_CODE_REMOTE`` is ``true``, whatever its case or padding."""
+    return os.environ.get(CLOUD_SESSION_ENV_VAR, "").strip().lower() == CLOUD_SESSION_ENV_TRUE_VALUE

package/hooks/hooks_constants/cloud_session_constants.py

@@ -0,0 +1,11 @@
+"""Names the environment variable and value a Claude Code cloud session sets."""
+
+from __future__ import annotations
+
+__all__ = [
+    "CLOUD_SESSION_ENV_VAR",
+    "CLOUD_SESSION_ENV_TRUE_VALUE",
+]
+
+CLOUD_SESSION_ENV_VAR: str = "CLAUDE_CODE_REMOTE"
+CLOUD_SESSION_ENV_TRUE_VALUE: str = "true"

package/hooks/hooks_constants/gh_command_words.py

@@ -0,0 +1,52 @@
+"""Read the command words and the standalone options of a ``gh`` call.
+
+::
+
+    gh -R o/r pr list --web          words ["pr", "list"], options ["-R", "--web"]
+    gh api -X POST graphql           words ["api", "graphql"], options ["-X"]
+    gh pr merge 12 --body -h         words ["pr", "merge", "12"], options ["--body"]
+
+An option's separate value is neither a word nor an option, so a value that
+looks like a flag, such as the ``-h`` body above, reads as text.
+"""
+
+from __future__ import annotations
+
+from hooks_constants.gh_command_words_constants import (
+    ALL_GH_OPTIONS_WITH_A_VALUE,
+    GH_OPTION_PREFIX,
+    GH_OPTION_VALUE_SEPARATOR,
+)
+
+__all__ = ["gh_command_words", "gh_command_words_and_options"]
+
+
+def gh_command_words_and_options(all_arguments: list[str]) -> tuple[list[str], list[str]]:
+    """Return the command words and the option names in one pass.
+
+    Each option's separate value is skipped, and an option name drops any
+    ``=value`` part.
+
+    Args:
+        all_arguments: The tokens after the ``gh`` program name.
+    """
+    all_command_words: list[str] = []
+    all_option_names: list[str] = []
+    is_option_value = False
+    for each_argument in all_arguments:
+        is_option = not is_option_value and each_argument.startswith(GH_OPTION_PREFIX)
+        if is_option:
+            all_option_names.append(each_argument.split(GH_OPTION_VALUE_SEPARATOR, 1)[0])
+        if not is_option and not is_option_value:
+            all_command_words.append(each_argument)
+        is_option_value = is_option and each_argument in ALL_GH_OPTIONS_WITH_A_VALUE
+    return all_command_words, all_option_names
+
+
+def gh_command_words(all_arguments: list[str]) -> list[str]:
+    """Return the gh arguments that are neither an option nor an option's separate value.
+
+    Args:
+        all_arguments: The tokens after the ``gh`` program name.
+    """
+    return gh_command_words_and_options(all_arguments)[0]