claude-dev-env 8.79.0 → 8.81.0

package/hooks/blocking/pr_lifecycle_skill_gate.py

@@ -32,7 +32,6 @@ from hooks_constants.pr_lifecycle_skill_gate_constants import (
     DENY_REASON,
     ENVIRONMENT_ASSIGNMENT_PATTERN,
     GH_API_COMMAND,
-    GH_OPTIONS_WITH_VALUE,
     GH_PULL_REQUEST_COMMAND,
     GIT_ACTIONS,
     GIT_GLOBAL_OPTIONS_WITH_VALUE,
@@ -49,6 +48,7 @@ from hooks_constants.pr_lifecycle_skill_gate_constants import (
     SUBAGENT_TRANSCRIPT_DIRECTORY_NAME,
     SUBAGENT_TRANSCRIPT_FILE_TEMPLATE,
 )
+from hooks_constants.gh_command_words import gh_command_words
 from hooks_constants.hook_specific_output_keys import (
     HOOK_SPECIFIC_OUTPUT_KEY,
     PERMISSION_DECISION_KEY,
@@ -113,13 +113,12 @@ def _is_git_action(all_words: list[str]) -> bool:
 
 
 def _is_gh_action(all_words: list[str]) -> bool:
-    action, next_index = _next_command_word(all_words, 1, GH_OPTIONS_WITH_VALUE)
-    if action == GH_PULL_REQUEST_COMMAND:
-        subcommand, _ = _next_command_word(all_words, next_index, GH_OPTIONS_WITH_VALUE)
-        return subcommand is not None
-    if action != GH_API_COMMAND:
+    all_gh_words = gh_command_words(all_words[1:])
+    if all_gh_words[:1] == [GH_PULL_REQUEST_COMMAND]:
+        return len(all_gh_words) > 1
+    if all_gh_words[:1] != [GH_API_COMMAND]:
         return False
-    all_api_arguments = all_words[next_index:]
+    all_api_arguments = all_words[all_words.index(GH_API_COMMAND, 1) + 1 :]
     if any(each_name in each_word for each_word in all_api_arguments for each_name in ALL_API_ACTION_NAMES):
         return True
     return any(
@@ -262,14 +261,24 @@ def decision_for(all_payload_fields: dict[str, object]) -> dict[str, object] | N
     return None if duplicate_reason is None else _deny(duplicate_reason)
 
 
-def _transcript_paths(all_payload_fields: dict[str, object]) -> list[str]:
+def transcript_paths(all_payload_fields: dict[str, object]) -> list[str]:
+    """Return each transcript path a hook payload names, with the subagent transcript last.
+
+    ::
+
+        transcript_path only                     -> [transcript_path]
+        transcript_path and a known agent_id     -> [transcript_path, <session>/subagents/agent-<id>.jsonl]
+
+    Args:
+        all_payload_fields: The parsed PreToolUse input.
+    """
     paths = [all_payload_fields.get(field) for field in ALL_TRANSCRIPT_PATH_FIELDS]
     paths.append(_subagent_transcript_path(all_payload_fields))
     return list(dict.fromkeys(path for path in paths if isinstance(path, str) and path))
 
 
 def _is_skill_unloaded(all_payload_fields: dict[str, object]) -> bool:
-    readable_paths = _transcript_paths(all_payload_fields)
+    readable_paths = transcript_paths(all_payload_fields)
     if not readable_paths:
         return False
     statuses = [_scanned_transcript(path, _shows_skill_load) for path in readable_paths]
@@ -279,7 +288,7 @@ def _is_skill_unloaded(all_payload_fields: dict[str, object]) -> bool:
 def _is_build_eval_missing(all_payload_fields: dict[str, object]) -> bool:
     all_statuses = [
         _scanned_transcript(each_path, _shows_build_eval)
-        for each_path in _transcript_paths(all_payload_fields)
+        for each_path in transcript_paths(all_payload_fields)
     ]
     all_read_statuses = [each_status for each_status in all_statuses if each_status is not None]
     return bool(all_read_statuses) and not any(all_read_statuses)

package/hooks/blocking/pull_request_proof.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import re
 import subprocess
 import sys
-from collections.abc import Mapping
+from collections.abc import Iterator, Mapping
 from typing import NamedTuple
 from pathlib import Path
 
@@ -130,15 +130,30 @@ def _create_arguments(all_segment_tokens: list[str]) -> list[str] | None:
     return _script_create_arguments(program, all_arguments)
 
 
+def _shell_command(all_payload_fields: Mapping[str, object]) -> str | None:
+    tool_input = all_payload_fields.get("tool_input")
+    command = tool_input.get("command") if isinstance(tool_input, dict) else None
+    if all_payload_fields.get("tool_name") not in SHELL_TOOL_NAMES or not isinstance(command, str):
+        return None
+    return command
+
+
+def _all_create_argument_lists(command: str) -> Iterator[list[str]]:
+    return (
+        all_create_arguments
+        for each_text in all_wrapped_command_texts(command)
+        for each_segment, _each_following_operator in pipeline_segments_for_command(each_text)
+        if (all_create_arguments := _create_arguments(each_segment)) is not None
+    )
+
+
 def _shell_create_calls(command: str, working_directory: str) -> list[CreateCall]:
     return [
         CreateCall(
             title_from_arguments(all_create_arguments),
             body_from_arguments(all_create_arguments, working_directory),
         )
-        for each_text in all_wrapped_command_texts(command)
-        for each_segment, _each_following_operator in pipeline_segments_for_command(each_text)
-        if (all_create_arguments := _create_arguments(each_segment)) is not None
+        for all_create_arguments in _all_create_argument_lists(command)
     ]
 
 
@@ -156,15 +171,12 @@ def _named_head_branch(all_payload_fields: Mapping[str, object]) -> str | None:
     head_branch = None if create_fields is None else create_fields.get("head")
     if isinstance(head_branch, str):
         return head_branch
-    tool_input = all_payload_fields.get("tool_input")
-    command = tool_input.get("command") if isinstance(tool_input, dict) else None
-    if all_payload_fields.get("tool_name") not in SHELL_TOOL_NAMES or not isinstance(command, str):
+    command = _shell_command(all_payload_fields)
+    if command is None:
         return None
     all_head_flag_values = [
         _head_flag_value(all_create_arguments)
-        for each_text in all_wrapped_command_texts(command)
-        for each_segment, _each_following_operator in pipeline_segments_for_command(each_text)
-        if (all_create_arguments := _create_arguments(each_segment)) is not None
+        for all_create_arguments in _all_create_argument_lists(command)
     ]
     return next((each_value for each_value in all_head_flag_values if each_value), None)
 
@@ -180,9 +192,8 @@ def _create_calls(all_payload_fields: Mapping[str, object]) -> list[CreateCall]:
                 body if isinstance(body, str) else "",
             )
         ]
-    tool_input = all_payload_fields.get("tool_input")
-    command = tool_input.get("command") if isinstance(tool_input, dict) else None
-    if all_payload_fields.get("tool_name") not in SHELL_TOOL_NAMES or not isinstance(command, str):
+    command = _shell_command(all_payload_fields)
+    if command is None:
         return []
     working_directory = all_payload_fields.get("cwd")
     return _shell_create_calls(
@@ -190,6 +201,24 @@ def _create_calls(all_payload_fields: Mapping[str, object]) -> list[CreateCall]:
     )
 
 
+def is_create_call(all_payload_fields: Mapping[str, object]) -> bool:
+    """Return whether a tool call opens a pull request.
+
+    ::
+
+        gh pr create --title t --body-file b.md         -> True
+        mcp__github__create_pull_request                -> True
+        gh pr edit 7, git push, Read                    -> False
+
+    Args:
+        all_payload_fields: A tool name and input, shaped like a PreToolUse payload.
+    """
+    command = _shell_command(all_payload_fields)
+    return create_tool_fields(all_payload_fields) is not None or (
+        command is not None and next(_all_create_argument_lists(command), None) is not None
+    )
+
+
 def _create_bodies(all_payload_fields: Mapping[str, object]) -> list[str | None]:
     return [each_call.body for each_call in _create_calls(all_payload_fields)]
 

package/hooks/blocking/pull_request_proof_edit_gate.py

@@ -0,0 +1,180 @@
+"""Deny an edit to the pull request proof gate while its last deny in the session has no passing create call after it."""
+
+from __future__ import annotations
+
+import json
+import sys
+from collections.abc import Iterable, Mapping
+from pathlib import Path
+
+hooks_directory = str(Path(__file__).resolve().parent.parent)
+if hooks_directory not in sys.path:
+    sys.path.insert(0, hooks_directory)
+
+from blocking.codex_apply_patch import payload_patch_target_paths
+from blocking.pr_lifecycle_skill_gate import transcript_paths
+from blocking.pull_request_proof import is_create_call
+from blocking.step_note_gate import entry_content_blocks
+from hooks_constants.hook_specific_output_keys import (
+    HOOK_EVENT_NAME_KEY,
+    HOOK_SPECIFIC_OUTPUT_KEY,
+    PERMISSION_DECISION_KEY,
+)
+from hooks_constants.pr_lifecycle_skill_gate_constants import (
+    DENY_DECISION,
+    HOOK_EVENT_NAME,
+    PERMISSION_DECISION_REASON_KEY,
+)
+from hooks_constants.pre_tool_use_dispatcher_constants import APPLY_PATCH_TOOL_NAME
+from hooks_constants.pre_tool_use_stdin import print_decision_from_stdin
+from hooks_constants.pull_request_proof_constants import (
+    ALL_PROOF_GATE_DENY_MARKERS,
+    ALL_PROOF_GATE_FILE_NAMES,
+    GATE_EDIT_BEFORE_ROUTE_REASON,
+    LINE_SEPARATOR,
+    POSIX_PATH_SEPARATOR,
+    WINDOWS_PATH_SEPARATOR,
+)
+from hooks_constants.setup_project_paths_constants import DECODE_ERRORS_POLICY, UTF8_ENCODING
+from hooks_constants.spawn_readiness_hook_constants import (
+    TOOL_RESULT_BLOCK_TYPE,
+    TOOL_USE_BLOCK_TYPE,
+)
+
+
+def _content_blocks(transcript_line: str) -> list[dict]:
+    try:
+        entry = json.loads(transcript_line)
+    except json.JSONDecodeError:
+        return []
+    if not isinstance(entry, dict) or not isinstance(entry.get("message"), dict):
+        return []
+    return entry_content_blocks(entry)
+
+
+def _result_text(content: object) -> str:
+    if isinstance(content, str):
+        return content
+    if not isinstance(content, list):
+        return ""
+    return LINE_SEPARATOR.join(
+        each_block["text"]
+        for each_block in content
+        if isinstance(each_block, dict) and isinstance(each_block.get("text"), str)
+    )
+
+
+def _is_proof_gate_deny(all_block_fields: dict[str, object]) -> bool:
+    result_text = _result_text(all_block_fields.get("content"))
+    return any(each_marker in result_text for each_marker in ALL_PROOF_GATE_DENY_MARKERS)
+
+
+def _deny_state_after(
+    all_block_fields: dict[str, object], all_create_tool_use_ids: set[str], is_deny_open: bool
+) -> bool:
+    if all_block_fields.get("type") == TOOL_USE_BLOCK_TYPE:
+        tool_use_id = all_block_fields.get("id")
+        payload = {"tool_name": all_block_fields.get("name"), "tool_input": all_block_fields.get("input")}
+        if isinstance(tool_use_id, str) and is_create_call(payload):
+            all_create_tool_use_ids.add(tool_use_id)
+        return is_deny_open
+    if all_block_fields.get("type") != TOOL_RESULT_BLOCK_TYPE:
+        return is_deny_open
+    result_tool_use_id = all_block_fields.get("tool_use_id")
+    if not isinstance(result_tool_use_id, str) or result_tool_use_id not in all_create_tool_use_ids:
+        return is_deny_open
+    if all_block_fields.get("is_error") is True:
+        return is_deny_open or _is_proof_gate_deny(all_block_fields)
+    return False
+
+
+def has_open_deny(all_transcript_lines: Iterable[str]) -> bool:
+    """Return whether the proof gate's last deny in a transcript has no passing create call after it.
+
+    ::
+
+        create denied with the proof gate's reason             -> True
+        create denied, later create returned without an error  -> False
+        no deny from the proof gate                            -> False
+
+    A deny is an errored result of a create call that carries one of the proof gate's guide paths.
+
+    Args:
+        all_transcript_lines: The JSON lines of a session transcript, oldest first.
+    """
+    all_create_tool_use_ids: set[str] = set()
+    is_deny_open = False
+    for each_line in all_transcript_lines:
+        for each_block in _content_blocks(each_line):
+            is_deny_open = _deny_state_after(each_block, all_create_tool_use_ids, is_deny_open)
+    return is_deny_open
+
+
+def _transcript_has_open_deny(transcript_path: str) -> bool:
+    try:
+        with open(transcript_path, encoding=UTF8_ENCODING, errors=DECODE_ERRORS_POLICY) as transcript:
+            return has_open_deny(transcript)
+    except OSError:
+        return False
+
+
+def _target_paths(all_payload_fields: Mapping[str, object]) -> tuple[str, ...]:
+    tool_input = all_payload_fields.get("tool_input")
+    if not isinstance(tool_input, dict):
+        return ()
+    if all_payload_fields.get("tool_name") == APPLY_PATCH_TOOL_NAME:
+        try:
+            return payload_patch_target_paths(dict(all_payload_fields), tool_input)
+        except ValueError:
+            return ()
+    file_path = tool_input.get("file_path")
+    return (file_path,) if isinstance(file_path, str) else ()
+
+
+def _edits_proof_gate(all_payload_fields: Mapping[str, object]) -> bool:
+    return any(
+        Path(each_path.replace(WINDOWS_PATH_SEPARATOR, POSIX_PATH_SEPARATOR)).name.lower()
+        in ALL_PROOF_GATE_FILE_NAMES
+        for each_path in _target_paths(all_payload_fields)
+    )
+
+
+def gate_edit_reason(all_payload_fields: Mapping[str, object]) -> str | None:
+    """Return a deny reason for an edit to the proof gate while its last deny is still open, else None.
+
+    ::
+
+        Edit or apply_patch of a gate file after an open deny       -> GATE_EDIT_BEFORE_ROUTE_REASON
+        Edit of pull_request_proof.py after a later passing create  -> None
+        Edit of any other file, or no readable transcript           -> None
+
+    Args:
+        all_payload_fields: The parsed PreToolUse input of a Write, Edit, MultiEdit or apply_patch call.
+    """
+    if not _edits_proof_gate(all_payload_fields):
+        return None
+    if any(_transcript_has_open_deny(each_path) for each_path in transcript_paths(dict(all_payload_fields))):
+        return GATE_EDIT_BEFORE_ROUTE_REASON
+    return None
+
+
+def _gate_edit_decision(all_payload_fields: dict[str, object]) -> dict[str, object] | None:
+    reason = gate_edit_reason(all_payload_fields)
+    if reason is None:
+        return None
+    return {
+        HOOK_SPECIFIC_OUTPUT_KEY: {
+            HOOK_EVENT_NAME_KEY: HOOK_EVENT_NAME,
+            PERMISSION_DECISION_KEY: DENY_DECISION,
+            PERMISSION_DECISION_REASON_KEY: reason,
+        }
+    }
+
+
+def main() -> int:
+    """Read one Write, Edit, MultiEdit or apply_patch payload and print a deny when it edits the proof gate too soon."""
+    return print_decision_from_stdin(_gate_edit_decision)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/hooks/blocking/test_bash_dispatcher_interpreter_starts.py

@@ -22,7 +22,7 @@ from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
 )
 
 
-def test_bash_roster_starts_only_the_msys_rewriter_and_the_two_gates() -> None:
+def test_bash_roster_starts_only_the_msys_rewriter_and_the_three_gates() -> None:
     assert ALL_BASH_HOSTED_HOOK_ENTRIES == (
         BashHostedHookEntry(
             script_relative_path="blocking/msys_rev_path_rewriter.py",
@@ -38,4 +38,8 @@ def test_bash_roster_starts_only_the_msys_rewriter_and_the_two_gates() -> None:
             applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
             replaced_by_plugin_name="shell-guards",
         ),
+        BashHostedHookEntry(
+            script_relative_path="blocking/cloud_graphql_gate.py",
+            applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+        ),
     )

package/hooks/blocking/test_bash_pre_tool_use_dispatcher.py

@@ -270,7 +270,10 @@ def test_should_drop_the_gates_the_shell_guards_mod_holds_while_it_is_on(
 ) -> None:
     _enable_shell_guards(tmp_path, monkeypatch)
     all_script_paths = [each_entry.script_relative_path for each_entry in select_applicable_entries(BASH_TOOL_NAME)]
-    assert all_script_paths == ["blocking/msys_rev_path_rewriter.py"]
+    assert all_script_paths == [
+        "blocking/msys_rev_path_rewriter.py",
+        "blocking/cloud_graphql_gate.py",
+    ]
 
 
 def test_should_pass_a_headless_claude_command_while_the_shell_guards_mod_is_on(

package/hooks/blocking/test_cloud_graphql_gate.py

@@ -0,0 +1,210 @@
+"""Tests for cloud_graphql_gate, which stops cloud sessions from calling GitHub GraphQL."""
+
+from __future__ import annotations
+
+import base64
+import json
+from io import StringIO
+from unittest.mock import patch
+
+import pytest
+
+import cloud_graphql_gate as gate
+
+
+def _stdout_from_main(payload: dict[str, object]) -> str:
+    """Return what main() wrote to stdout for one hook payload."""
+    captured_stdout = StringIO()
+    with (
+        patch("sys.stdin", StringIO(json.dumps(payload))),
+        patch("sys.stdout", captured_stdout),
+        patch.object(gate, "log_hook_block"),
+    ):
+        gate.main()
+    return captured_stdout.getvalue()
+
+
+_ENCODED_GH_PR_LIST = base64.b64encode("gh pr list".encode("utf-16-le")).decode()
+
+
+@pytest.fixture
+def cloud_session(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Mark the hook process as running inside a Claude Code cloud session."""
+    monkeypatch.setenv("CLAUDE_CODE_REMOTE", "true")
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "gh api graphql -f query='query{viewer{login}}'",
+        "gh.exe api graphql -F owner=o -f query=@q.graphql",
+        "cd repo && gh api graphql --paginate -f query=@q.graphql",
+        'bash -c "gh api graphql -f query=@q.graphql"',
+        "curl -sS -X POST https://api.github.com/graphql -d @q.json",
+        "curl -H 'Authorization: Bearer x' HTTPS://API.GITHUB.COM/GRAPHQL",
+        "wget --post-data=@q.json https://api.github.com/graphql",
+        "Invoke-RestMethod -Method Post -Uri https://api.github.com/graphql -Body $q",
+        "gh pr create --draft --title t --body-file b.md",
+        "gh pr view 12 --json title",
+        "gh pr checks 12",
+        "gh issue list -L 1",
+        "gh repo clone o/r",
+        "gh repo view o/r",
+        "gh label list",
+        "gh search prs repo:o/r",
+        "gh ruleset list",
+        "gh gist list",
+        "gh api -X POST graphql -f query='mutation{x}'",
+        "gh api --method POST graphql -f query=@q.graphql",
+        "gh api -H 'Accept: application/json' graphql -f query=@q",
+        "gh api /graphql -f query=@q",
+        "gh api https://api.github.com/graphql -f query=@q",
+        "gh -R o/r pr list",
+        "gh pr -R o/r list",
+        "gh pr --repo o/r view 12",
+        "gh pr merge 12 --body -h",
+        "gh pr view 12 --web",
+        "gh issue list --web",
+        "gh project item-list 1 --owner o",
+        "gh discussion list",
+        "gh status",
+        "gh status -o o",
+        "gh org list",
+        "gh repo archive o/r --yes",
+        "gh repo unarchive o/r --yes",
+        "curl -X POST https://api.github.com:443/graphql -d @q.json",
+        "if gh pr view 12; then echo ok; fi",
+        "if true; then gh api graphql -f query=@q; fi",
+        "while gh pr list; do sleep 1; done",
+        "! gh pr list",
+        "command gh pr list",
+        "exec gh issue list",
+        'echo "$(gh pr list)"',
+        "echo `gh pr view 12`",
+        "PR_URL=$(gh pr create --title t --body-file b.md)",
+        "(gh pr view 12)",
+        "python3 -c \"import requests; requests.post('https://api.github.com/graphql')\"",
+        "node -e \"fetch('https://api.github.com/graphql', {method: 'POST'})\"",
+        "gh release list -L 1",
+        "gh release view v1 --json name",
+        "gh workflow run ci.yml",
+        "gh workflow run ci.yml -f -r",
+        "gh pr list --search -w",
+        "echo \"$(printf ')'; gh pr list)\"",
+        "x=`echo \\`gh pr list\\``",
+        'echo $(echo "$(gh api graphql -f query=@q)")',
+        "python3.12 -c \"u('https://api.github.com/graphql')\"",
+        "pypy3 -c \"u('https://api.github.com/graphql')\"",
+        'eval "gh api graphql -f query=@q"',
+        "find . -maxdepth 0 -exec gh api graphql -f query=@q \\;",
+        "Invoke-Expression 'gh pr list'",
+        'iex "gh issue list"',
+        "find . -exec true \\; -exec gh api graphql -f query=@q \\;",
+        "gh repo sync o/r",
+        "gh repo create n --template o/t",
+        "gh repo create n -p o/t --private",
+        "gh repo edit o/r --enable-secret-scanning",
+        "gh repo edit --enable-advanced-security=false",
+        'Start-Process gh -ArgumentList "api graphql -f query=@q"',
+        "Start-Process -FilePath gh -ArgumentList 'pr','list' -Wait",
+        "Start-Process -FilePath:gh -ArgumentList:'api graphql -f query=@q'",
+        "GH.EXE pr list",
+        "pwsh -EncodedCommand " + _ENCODED_GH_PR_LIST,
+    ],
+)
+def test_should_detect_a_github_graphql_call(command: str) -> None:
+    assert gate.calls_github_graphql(command) is True
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "gh api repos/o/r/pulls/1/ccr/review_threads",
+        "gh api user",
+        "gh pr diff 12",
+        "gh pr create --help",
+        "gh issue view -h",
+        "gh pr list -R o/r --help",
+        "gh pr list --web",
+        "gh pr list -w -R o/r",
+        "gh project",
+        "gh api repos/o/r/contents/docs/graphql.md",
+        "gh api repos/o/r/issues -f title=graphql",
+        "gh repo fork o/r",
+        "gh repo rename new-name",
+        "echo '$(gh pr list)'",
+        "command -v gh",
+        "gh pr view -w -h",
+        "gh pr list --state open --web",
+        "gh release view --json name",
+        "gh workflow run ci.yml --ref main",
+        "gh workflow run ci.yml -r main",
+        "gh workflow run ci.yml --ref=main",
+        "gh search repos claude-dev-env",
+        "gh run view 12",
+        "python3 scripts/review_closure.py o/r 1",
+        'eval "gh api repos/o/r/pulls/1"',
+        "gh repo sync o/r --branch main",
+        "gh repo sync -b main",
+        "gh repo create n --private",
+        "gh repo edit o/r --description d",
+        "gh api repos/o/r --preview graphql",
+        "gh api repos/o/r/issues --jq graphql",
+        "Start-Process notepad",
+        "find . -name '*.py' -exec grep -l graphql {} +",
+        "gh pr",
+        "gh run list -L 1",
+        "gh workflow list",
+        "gh label create bug",
+        "curl -sS https://api.github.com/repos/o/r",
+        'grep -rn "api.github.com/graphql" scripts',
+        'echo "gh api graphql"',
+        'git commit -m "drop gh api graphql calls"',
+    ],
+)
+def test_should_pass_rest_calls_and_text_that_only_mentions_graphql(command: str) -> None:
+    assert gate.calls_github_graphql(command) is False
+
+
+def test_should_deny_gh_api_graphql_in_a_cloud_session_and_name_the_rest_routes(
+    cloud_session: None,
+) -> None:
+    decision = json.loads(
+        _stdout_from_main(
+            {"tool_name": "Bash", "tool_input": {"command": "gh api graphql -f query=@q"}}
+        )
+    )
+    specific_output = decision["hookSpecificOutput"]
+    assert specific_output["permissionDecision"] == "deny"
+    reason = specific_output["permissionDecisionReason"]
+    assert "GET /repos/{owner}/{repo}/pulls/{n}/ccr/review_threads" in reason
+    assert "gh api repos/{owner}/{repo}/..." in reason
+    assert "mcp__github__create_pull_request" in reason
+
+
+def test_should_deny_a_powershell_endpoint_call_in_a_cloud_session(cloud_session: None) -> None:
+    command = "Invoke-RestMethod -Uri https://api.github.com/graphql -Method Post"
+    decision = json.loads(
+        _stdout_from_main({"tool_name": "PowerShell", "tool_input": {"command": command}})
+    )
+    assert decision["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_should_stay_quiet_outside_a_cloud_session() -> None:
+    assert (
+        _stdout_from_main(
+            {"tool_name": "Bash", "tool_input": {"command": "gh api graphql -f query=@q"}}
+        )
+        == ""
+    )
+
+
+def test_should_stay_quiet_for_a_rest_call_in_a_cloud_session(cloud_session: None) -> None:
+    rest_command = "gh api repos/o/r/pulls/1/ccr/review_threads"
+    assert _stdout_from_main({"tool_name": "Bash", "tool_input": {"command": rest_command}}) == ""
+
+
+def test_should_stay_quiet_for_another_tool_in_a_cloud_session(cloud_session: None) -> None:
+    assert (
+        _stdout_from_main({"tool_name": "Write", "tool_input": {"command": "gh api graphql"}}) == ""
+    )

package/hooks/blocking/test_headless_claude_broker_gate.py

@@ -88,13 +88,18 @@ def test_other_tool_payload_emits_nothing() -> None:
     assert _stdout_from_main({"tool_name": "Write", "tool_input": {"command": 'claude -p "task"'}}) == ""
 
 
-def test_should_pass_bare_headless_claude_in_a_cloud_session(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("CLAUDE_CODE_REMOTE", "true")
+@pytest.mark.parametrize("marker_value", ["true", " TRUE "])
+def test_should_pass_bare_headless_claude_in_a_cloud_session(
+    monkeypatch: pytest.MonkeyPatch, marker_value: str
+) -> None:
+    monkeypatch.setenv("CLAUDE_CODE_REMOTE", marker_value)
     assert _stdout_from_main({"tool_name": "Bash", "tool_input": {"command": 'claude -p "task"'}}) == ""
 
 
-def test_should_report_a_cloud_session_only_when_the_marker_is_true(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("CLAUDE_CODE_REMOTE", "false")
-    assert gate.is_cloud_session() is False
-    monkeypatch.setenv("CLAUDE_CODE_REMOTE", "true")
-    assert gate.is_cloud_session() is True
+@pytest.mark.parametrize("marker_value", ["false", "1", ""])
+def test_should_deny_bare_headless_claude_when_the_marker_is_not_true(
+    monkeypatch: pytest.MonkeyPatch, marker_value: str
+) -> None:
+    monkeypatch.setenv("CLAUDE_CODE_REMOTE", marker_value)
+    decision = json.loads(_stdout_from_main({"tool_name": "Bash", "tool_input": {"command": 'claude -p "task"'}}))
+    assert decision["hookSpecificOutput"]["permissionDecision"] == "deny"