claude-dev-env 8.80.0 → 8.82.0

package/hooks/blocking/final_reply_gate.py

@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""Stop hook that checks the closing chat reply for an unvalidated claim.
+
+The reply length gate checks the chat tools. This gate checks the reply the
+session ends its turn with, which reaches the user with no tool call::
+
+    flag: My guess is one to two hours.
+    flag: I didn't confirm this one.
+    flag: Run 18239174012 passed.        (no tool result shows the run)
+    ok:   Run 18239174012 took 39 minutes. (a tool result shows the run)
+
+It applies the banned words, the unvalidated claim pattern, and the cited
+run, job, check, and pull request numbers from ``reply_length_gate.py``. The
+citation check is skipped when the transcript cannot be read. A block sends
+the reason back so the model rewrites the reply. Claude Code ends the turn
+after eight blocks in a row.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+hooks_root_directory = str(Path(__file__).resolve().parent.parent)
+if hooks_root_directory not in sys.path:
+    sys.path.insert(0, hooks_root_directory)
+
+from reply_length_gate import (
+    banned_word_violation,
+    configured_banned_words,
+    unseen_citation_violation,
+    unvalidated_claim_violation,
+)
+from hooks_constants.hook_block_logger import log_hook_block
+from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+from hooks_constants.final_reply_gate_constants import (
+    ALLOW_EXIT_CODE,
+    BLOCK_DECISION,
+    DECISION_KEY,
+    HOOK_EVENT_NAME,
+    LAST_ASSISTANT_MESSAGE_KEY,
+    REASON_KEY,
+    REWRITE_INSTRUCTION,
+    TRANSCRIPT_PATH_KEY,
+)
+
+
+def final_reply_violation(reply_text: str, transcript_path: object) -> str | None:
+    """Return the block reason for the closing reply, or None when it passes."""
+    return (
+        banned_word_violation(reply_text, configured_banned_words())
+        or unvalidated_claim_violation(reply_text)
+        or unseen_citation_violation(reply_text, transcript_path)
+    )
+
+
+def main() -> int:
+    hook_input = read_hook_input_dictionary_from_stdin()
+    if hook_input is None:
+        return ALLOW_EXIT_CODE
+    reply_text = hook_input.get(LAST_ASSISTANT_MESSAGE_KEY)
+    if not isinstance(reply_text, str):
+        return ALLOW_EXIT_CODE
+    violation = final_reply_violation(reply_text, hook_input.get(TRANSCRIPT_PATH_KEY))
+    if violation is None:
+        return ALLOW_EXIT_CODE
+    block_reason = violation + REWRITE_INSTRUCTION
+    log_hook_block(
+        Path(__file__).name, HOOK_EVENT_NAME, block_reason, offending_input_preview=reply_text
+    )
+    sys.stdout.write(json.dumps({DECISION_KEY: BLOCK_DECISION, REASON_KEY: block_reason}))
+    return ALLOW_EXIT_CODE
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/hooks/blocking/pr_lifecycle_skill_gate.py

@@ -261,14 +261,24 @@ def decision_for(all_payload_fields: dict[str, object]) -> dict[str, object] | N
     return None if duplicate_reason is None else _deny(duplicate_reason)
 
 
-def _transcript_paths(all_payload_fields: dict[str, object]) -> list[str]:
+def transcript_paths(all_payload_fields: dict[str, object]) -> list[str]:
+    """Return each transcript path a hook payload names, with the subagent transcript last.
+
+    ::
+
+        transcript_path only                     -> [transcript_path]
+        transcript_path and a known agent_id     -> [transcript_path, <session>/subagents/agent-<id>.jsonl]
+
+    Args:
+        all_payload_fields: The parsed PreToolUse input.
+    """
     paths = [all_payload_fields.get(field) for field in ALL_TRANSCRIPT_PATH_FIELDS]
     paths.append(_subagent_transcript_path(all_payload_fields))
     return list(dict.fromkeys(path for path in paths if isinstance(path, str) and path))
 
 
 def _is_skill_unloaded(all_payload_fields: dict[str, object]) -> bool:
-    readable_paths = _transcript_paths(all_payload_fields)
+    readable_paths = transcript_paths(all_payload_fields)
     if not readable_paths:
         return False
     statuses = [_scanned_transcript(path, _shows_skill_load) for path in readable_paths]
@@ -278,7 +288,7 @@ def _is_skill_unloaded(all_payload_fields: dict[str, object]) -> bool:
 def _is_build_eval_missing(all_payload_fields: dict[str, object]) -> bool:
     all_statuses = [
         _scanned_transcript(each_path, _shows_build_eval)
-        for each_path in _transcript_paths(all_payload_fields)
+        for each_path in transcript_paths(all_payload_fields)
     ]
     all_read_statuses = [each_status for each_status in all_statuses if each_status is not None]
     return bool(all_read_statuses) and not any(all_read_statuses)

package/hooks/blocking/pull_request_proof.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import re
 import subprocess
 import sys
-from collections.abc import Mapping
+from collections.abc import Iterator, Mapping
 from typing import NamedTuple
 from pathlib import Path
 
@@ -130,15 +130,30 @@ def _create_arguments(all_segment_tokens: list[str]) -> list[str] | None:
     return _script_create_arguments(program, all_arguments)
 
 
+def _shell_command(all_payload_fields: Mapping[str, object]) -> str | None:
+    tool_input = all_payload_fields.get("tool_input")
+    command = tool_input.get("command") if isinstance(tool_input, dict) else None
+    if all_payload_fields.get("tool_name") not in SHELL_TOOL_NAMES or not isinstance(command, str):
+        return None
+    return command
+
+
+def _all_create_argument_lists(command: str) -> Iterator[list[str]]:
+    return (
+        all_create_arguments
+        for each_text in all_wrapped_command_texts(command)
+        for each_segment, _each_following_operator in pipeline_segments_for_command(each_text)
+        if (all_create_arguments := _create_arguments(each_segment)) is not None
+    )
+
+
 def _shell_create_calls(command: str, working_directory: str) -> list[CreateCall]:
     return [
         CreateCall(
             title_from_arguments(all_create_arguments),
             body_from_arguments(all_create_arguments, working_directory),
         )
-        for each_text in all_wrapped_command_texts(command)
-        for each_segment, _each_following_operator in pipeline_segments_for_command(each_text)
-        if (all_create_arguments := _create_arguments(each_segment)) is not None
+        for all_create_arguments in _all_create_argument_lists(command)
     ]
 
 
@@ -156,15 +171,12 @@ def _named_head_branch(all_payload_fields: Mapping[str, object]) -> str | None:
     head_branch = None if create_fields is None else create_fields.get("head")
     if isinstance(head_branch, str):
         return head_branch
-    tool_input = all_payload_fields.get("tool_input")
-    command = tool_input.get("command") if isinstance(tool_input, dict) else None
-    if all_payload_fields.get("tool_name") not in SHELL_TOOL_NAMES or not isinstance(command, str):
+    command = _shell_command(all_payload_fields)
+    if command is None:
         return None
     all_head_flag_values = [
         _head_flag_value(all_create_arguments)
-        for each_text in all_wrapped_command_texts(command)
-        for each_segment, _each_following_operator in pipeline_segments_for_command(each_text)
-        if (all_create_arguments := _create_arguments(each_segment)) is not None
+        for all_create_arguments in _all_create_argument_lists(command)
     ]
     return next((each_value for each_value in all_head_flag_values if each_value), None)
 
@@ -180,9 +192,8 @@ def _create_calls(all_payload_fields: Mapping[str, object]) -> list[CreateCall]:
                 body if isinstance(body, str) else "",
             )
         ]
-    tool_input = all_payload_fields.get("tool_input")
-    command = tool_input.get("command") if isinstance(tool_input, dict) else None
-    if all_payload_fields.get("tool_name") not in SHELL_TOOL_NAMES or not isinstance(command, str):
+    command = _shell_command(all_payload_fields)
+    if command is None:
         return []
     working_directory = all_payload_fields.get("cwd")
     return _shell_create_calls(
@@ -190,6 +201,24 @@ def _create_calls(all_payload_fields: Mapping[str, object]) -> list[CreateCall]:
     )
 
 
+def is_create_call(all_payload_fields: Mapping[str, object]) -> bool:
+    """Return whether a tool call opens a pull request.
+
+    ::
+
+        gh pr create --title t --body-file b.md         -> True
+        mcp__github__create_pull_request                -> True
+        gh pr edit 7, git push, Read                    -> False
+
+    Args:
+        all_payload_fields: A tool name and input, shaped like a PreToolUse payload.
+    """
+    command = _shell_command(all_payload_fields)
+    return create_tool_fields(all_payload_fields) is not None or (
+        command is not None and next(_all_create_argument_lists(command), None) is not None
+    )
+
+
 def _create_bodies(all_payload_fields: Mapping[str, object]) -> list[str | None]:
     return [each_call.body for each_call in _create_calls(all_payload_fields)]
 

package/hooks/blocking/pull_request_proof_edit_gate.py

@@ -0,0 +1,180 @@
+"""Deny an edit to the pull request proof gate while its last deny in the session has no passing create call after it."""
+
+from __future__ import annotations
+
+import json
+import sys
+from collections.abc import Iterable, Mapping
+from pathlib import Path
+
+hooks_directory = str(Path(__file__).resolve().parent.parent)
+if hooks_directory not in sys.path:
+    sys.path.insert(0, hooks_directory)
+
+from blocking.codex_apply_patch import payload_patch_target_paths
+from blocking.pr_lifecycle_skill_gate import transcript_paths
+from blocking.pull_request_proof import is_create_call
+from blocking.step_note_gate import entry_content_blocks
+from hooks_constants.hook_specific_output_keys import (
+    HOOK_EVENT_NAME_KEY,
+    HOOK_SPECIFIC_OUTPUT_KEY,
+    PERMISSION_DECISION_KEY,
+)
+from hooks_constants.pr_lifecycle_skill_gate_constants import (
+    DENY_DECISION,
+    HOOK_EVENT_NAME,
+    PERMISSION_DECISION_REASON_KEY,
+)
+from hooks_constants.pre_tool_use_dispatcher_constants import APPLY_PATCH_TOOL_NAME
+from hooks_constants.pre_tool_use_stdin import print_decision_from_stdin
+from hooks_constants.pull_request_proof_constants import (
+    ALL_PROOF_GATE_DENY_MARKERS,
+    ALL_PROOF_GATE_FILE_NAMES,
+    GATE_EDIT_BEFORE_ROUTE_REASON,
+    LINE_SEPARATOR,
+    POSIX_PATH_SEPARATOR,
+    WINDOWS_PATH_SEPARATOR,
+)
+from hooks_constants.setup_project_paths_constants import DECODE_ERRORS_POLICY, UTF8_ENCODING
+from hooks_constants.spawn_readiness_hook_constants import (
+    TOOL_RESULT_BLOCK_TYPE,
+    TOOL_USE_BLOCK_TYPE,
+)
+
+
+def _content_blocks(transcript_line: str) -> list[dict]:
+    try:
+        entry = json.loads(transcript_line)
+    except json.JSONDecodeError:
+        return []
+    if not isinstance(entry, dict) or not isinstance(entry.get("message"), dict):
+        return []
+    return entry_content_blocks(entry)
+
+
+def _result_text(content: object) -> str:
+    if isinstance(content, str):
+        return content
+    if not isinstance(content, list):
+        return ""
+    return LINE_SEPARATOR.join(
+        each_block["text"]
+        for each_block in content
+        if isinstance(each_block, dict) and isinstance(each_block.get("text"), str)
+    )
+
+
+def _is_proof_gate_deny(all_block_fields: dict[str, object]) -> bool:
+    result_text = _result_text(all_block_fields.get("content"))
+    return any(each_marker in result_text for each_marker in ALL_PROOF_GATE_DENY_MARKERS)
+
+
+def _deny_state_after(
+    all_block_fields: dict[str, object], all_create_tool_use_ids: set[str], is_deny_open: bool
+) -> bool:
+    if all_block_fields.get("type") == TOOL_USE_BLOCK_TYPE:
+        tool_use_id = all_block_fields.get("id")
+        payload = {"tool_name": all_block_fields.get("name"), "tool_input": all_block_fields.get("input")}
+        if isinstance(tool_use_id, str) and is_create_call(payload):
+            all_create_tool_use_ids.add(tool_use_id)
+        return is_deny_open
+    if all_block_fields.get("type") != TOOL_RESULT_BLOCK_TYPE:
+        return is_deny_open
+    result_tool_use_id = all_block_fields.get("tool_use_id")
+    if not isinstance(result_tool_use_id, str) or result_tool_use_id not in all_create_tool_use_ids:
+        return is_deny_open
+    if all_block_fields.get("is_error") is True:
+        return is_deny_open or _is_proof_gate_deny(all_block_fields)
+    return False
+
+
+def has_open_deny(all_transcript_lines: Iterable[str]) -> bool:
+    """Return whether the proof gate's last deny in a transcript has no passing create call after it.
+
+    ::
+
+        create denied with the proof gate's reason             -> True
+        create denied, later create returned without an error  -> False
+        no deny from the proof gate                            -> False
+
+    A deny is an errored result of a create call that carries one of the proof gate's guide paths.
+
+    Args:
+        all_transcript_lines: The JSON lines of a session transcript, oldest first.
+    """
+    all_create_tool_use_ids: set[str] = set()
+    is_deny_open = False
+    for each_line in all_transcript_lines:
+        for each_block in _content_blocks(each_line):
+            is_deny_open = _deny_state_after(each_block, all_create_tool_use_ids, is_deny_open)
+    return is_deny_open
+
+
+def _transcript_has_open_deny(transcript_path: str) -> bool:
+    try:
+        with open(transcript_path, encoding=UTF8_ENCODING, errors=DECODE_ERRORS_POLICY) as transcript:
+            return has_open_deny(transcript)
+    except OSError:
+        return False
+
+
+def _target_paths(all_payload_fields: Mapping[str, object]) -> tuple[str, ...]:
+    tool_input = all_payload_fields.get("tool_input")
+    if not isinstance(tool_input, dict):
+        return ()
+    if all_payload_fields.get("tool_name") == APPLY_PATCH_TOOL_NAME:
+        try:
+            return payload_patch_target_paths(dict(all_payload_fields), tool_input)
+        except ValueError:
+            return ()
+    file_path = tool_input.get("file_path")
+    return (file_path,) if isinstance(file_path, str) else ()
+
+
+def _edits_proof_gate(all_payload_fields: Mapping[str, object]) -> bool:
+    return any(
+        Path(each_path.replace(WINDOWS_PATH_SEPARATOR, POSIX_PATH_SEPARATOR)).name.lower()
+        in ALL_PROOF_GATE_FILE_NAMES
+        for each_path in _target_paths(all_payload_fields)
+    )
+
+
+def gate_edit_reason(all_payload_fields: Mapping[str, object]) -> str | None:
+    """Return a deny reason for an edit to the proof gate while its last deny is still open, else None.
+
+    ::
+
+        Edit or apply_patch of a gate file after an open deny       -> GATE_EDIT_BEFORE_ROUTE_REASON
+        Edit of pull_request_proof.py after a later passing create  -> None
+        Edit of any other file, or no readable transcript           -> None
+
+    Args:
+        all_payload_fields: The parsed PreToolUse input of a Write, Edit, MultiEdit or apply_patch call.
+    """
+    if not _edits_proof_gate(all_payload_fields):
+        return None
+    if any(_transcript_has_open_deny(each_path) for each_path in transcript_paths(dict(all_payload_fields))):
+        return GATE_EDIT_BEFORE_ROUTE_REASON
+    return None
+
+
+def _gate_edit_decision(all_payload_fields: dict[str, object]) -> dict[str, object] | None:
+    reason = gate_edit_reason(all_payload_fields)
+    if reason is None:
+        return None
+    return {
+        HOOK_SPECIFIC_OUTPUT_KEY: {
+            HOOK_EVENT_NAME_KEY: HOOK_EVENT_NAME,
+            PERMISSION_DECISION_KEY: DENY_DECISION,
+            PERMISSION_DECISION_REASON_KEY: reason,
+        }
+    }
+
+
+def main() -> int:
+    """Read one Write, Edit, MultiEdit or apply_patch payload and print a deny when it edits the proof gate too soon."""
+    return print_decision_from_stdin(_gate_edit_decision)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/hooks/blocking/reply_length_gate.py

@@ -33,9 +33,23 @@ The gate uses the ``banned_words`` list in ``~/.claude/reply-banned-words.json``
 or in the file that CLAUDE_REPLY_BANNED_WORDS_PATH names. Without a valid
 list there, it uses ALL_DEFAULT_BANNED_WORDS.
 
-The banned-word check also reads the prose of a decision card: its question,
-its context, and each option's label and consequence.
-A decision card gets no length check.
+It denies a sentence that guesses, estimates, hedges a duration, or admits
+a check did not run::
+
+    flag: My guess is one to two hours.
+    flag: I didn't confirm this one.
+    ok:   The last build took 39 minutes.
+
+It denies an Actions run, a pull request link, or a run, job, or check id
+that no successful tool result in the transcript shows. A subagent's report
+is the result of its Agent call. With no readable transcript, this check
+is skipped.
+
+The banned-word, unvalidated claim, and citation checks also read the prose of a
+decision card: its question, its context, and each option's label and
+consequence. They read an AskUserQuestion card the same way: each
+question, its header, and each option's label and description.
+A card gets no length check.
 
 Each non-empty line counts as its own sentence, so a list counts one
 sentence per item. URLs, markdown link targets, inline code spans, and
@@ -74,6 +88,7 @@ from visual_reply_rules import (
     load_rules,
     mode_enabled,
     second_reply_violation,
+    successful_result_text,
     visual_violation,
     widget_anchor_violation,
     widget_flowchart_advice,
@@ -90,6 +105,8 @@ from hooks_constants.reply_length_gate_constants import (
     ALL_DECISION_OPTION_PROSE_KEYS,
     ALL_DEFAULT_BANNED_WORDS,
     ALL_EVIDENCE_PATTERNS,
+    ALL_QUESTION_CARD_PROSE_KEYS,
+    ALL_QUESTION_OPTION_PROSE_KEYS,
     ALLOW_EXIT_CODE,
     BANNED_WORD_MESSAGE,
     BANNED_WORD_PART_SEPARATOR,
@@ -100,10 +117,14 @@ from hooks_constants.reply_length_gate_constants import (
     BLOCK_EXIT_CODE,
     CAUSAL_CLAIM_PATTERN,
     CARD_TEXT_SEPARATOR,
+    CITED_NUMBER_IN_RESULT_TEMPLATE,
+    CITED_NUMBER_PATTERN,
     CLAUDE_HOME_DIRECTORY_NAME,
     CONFIG_FILE_ENCODING,
+    CURLY_APOSTROPHE,
     DECISION_CARD_OPTIONS_KEY,
     DECISION_CARD_TOOL_NAME,
+    DURATION_CLAIM_PATTERN,
     EM_DASH_MESSAGE,
     EM_DASH_PATTERN,
     FENCED_BLOCK_PATTERN,
@@ -118,10 +139,13 @@ from hooks_constants.reply_length_gate_constants import (
     MAXIMUM_WORDS_PER_SENTENCE,
     MID_SENTENCE_COLON_MESSAGE,
     MID_SENTENCE_COLON_PATTERN,
+    QUESTION_CARD_QUESTIONS_KEY,
+    QUESTION_CARD_TOOL_NAME,
     RETRY_INSTRUCTION,
     SENTENCE_END_PATTERN,
     SENTENCE_PREVIEW_SUFFIX,
     SENTENCE_PREVIEW_WORD_COUNT,
+    STRAIGHT_APOSTROPHE,
     TEXT_KEY,
     TOO_MANY_SENTENCES_MESSAGE,
     TOOL_INPUT_KEY,
@@ -129,7 +153,10 @@ from hooks_constants.reply_length_gate_constants import (
     TRANSCRIPT_PATH_KEY,
     UNLINKED_PULL_REQUEST_MESSAGE,
     UNLINKED_PULL_REQUEST_PATTERN,
+    UNSEEN_CITATION_MESSAGE,
     UNSOURCED_CAUSE_MESSAGE,
+    UNVALIDATED_CLAIM_MESSAGE,
+    UNVALIDATED_CLAIM_PATTERN,
     URL_PATTERN,
     WORD_PATTERN,
     WORD_SEPARATOR,
@@ -146,12 +173,9 @@ def countable_text(reply_text: str) -> str:
 
 def sentence_word_lists(reply_text: str) -> list[list[str]]:
     """Split the text into sentences, one per line or terminal mark, as word lists."""
-    all_sentence_texts = [
-        each_sentence
-        for each_line in LINE_BREAK_PATTERN.split(countable_text(reply_text))
-        for each_sentence in SENTENCE_END_PATTERN.split(each_line)
+    all_word_lists = [
+        WORD_PATTERN.findall(each_sentence) for each_sentence in prose_sentences(countable_text(reply_text))
     ]
-    all_word_lists = [WORD_PATTERN.findall(each_sentence) for each_sentence in all_sentence_texts]
     return [each_word_list for each_word_list in all_word_lists if each_word_list]
 
 
@@ -187,14 +211,18 @@ def em_dash_violation(reply_text: str) -> str | None:
     return EM_DASH_MESSAGE
 
 
-def unsourced_cause_violation(reply_text: str) -> str | None:
-    """Return the deny reason for the first causal sentence that cites no evidence itself, or None."""
-    all_sentences = [
-        each_sentence
+def prose_sentences(reply_text: str) -> list[str]:
+    """Split the text outside fenced blocks into sentences, one per line or terminal mark."""
+    return [
+        each_sentence.strip()
         for each_line in LINE_BREAK_PATTERN.split(FENCED_BLOCK_PATTERN.sub(" ", reply_text))
         for each_sentence in SENTENCE_END_PATTERN.split(each_line)
     ]
-    for each_sentence in all_sentences:
+
+
+def unsourced_cause_violation(reply_text: str) -> str | None:
+    """Return the deny reason for the first causal sentence that cites no evidence itself, or None."""
+    for each_sentence in prose_sentences(reply_text):
         is_causal = CAUSAL_CLAIM_PATTERN.search(INLINE_CODE_PATTERN.sub(" ", each_sentence))
         has_evidence = any(each_pattern.search(each_sentence) for each_pattern in ALL_EVIDENCE_PATTERNS)
         if is_causal and not has_evidence:
@@ -254,6 +282,45 @@ def banned_word_violation(reply_text: str, all_banned_words: tuple[str, ...]) ->
     return None
 
 
+def unvalidated_claim_violation(reply_text: str) -> str | None:
+    """Return the deny reason quoting the first sentence that guesses or admits a skipped check, or None.
+
+    A duration counts as a guess unless its sentence cites the run, job, check,
+    or pull request that measured it::
+
+        flag: It should take about 40 minutes.
+        ok:   The last queue build took 39 minutes, run 18239174012.
+    """
+    for each_sentence in prose_sentences(reply_text):
+        prose_text = countable_text(each_sentence).replace(CURLY_APOSTROPHE, STRAIGHT_APOSTROPHE)
+        is_guess = UNVALIDATED_CLAIM_PATTERN.search(prose_text) is not None
+        is_uncited_duration = (
+            DURATION_CLAIM_PATTERN.search(prose_text) is not None
+            and CITED_NUMBER_PATTERN.search(each_sentence) is None
+        )
+        if is_guess or is_uncited_duration:
+            return UNVALIDATED_CLAIM_MESSAGE.format(claim=each_sentence)
+    return None
+
+
+def unseen_citation_violation(reply_text: str, transcript_path: object) -> str | None:
+    """Return the deny reason for the first cited run, job, check, or pull request no tool result shows.
+
+    Returns None when the text cites nothing or the transcript cannot be read.
+    """
+    all_citations = list(CITED_NUMBER_PATTERN.finditer(FENCED_BLOCK_PATTERN.sub(" ", reply_text)))
+    if not all_citations:
+        return None
+    result_text = successful_result_text(transcript_path)
+    if result_text is None:
+        return None
+    for each_match in all_citations:
+        cited_number = next(each_group for each_group in each_match.groups() if each_group)
+        if re.search(CITED_NUMBER_IN_RESULT_TEMPLATE.format(number=cited_number), result_text) is None:
+            return UNSEEN_CITATION_MESSAGE.format(citation=each_match.group(0))
+    return None
+
+
 def all_card_texts(all_card_input: dict[str, object]) -> list[str]:
     """Collect the prose fields of a decision card: question, context, and each option's text."""
     all_options = all_card_input.get(DECISION_CARD_OPTIONS_KEY)
@@ -271,6 +338,24 @@ def all_card_texts(all_card_input: dict[str, object]) -> list[str]:
     ]
 
 
+def all_question_card_texts(all_card_input: dict[str, object]) -> list[str]:
+    """Collect the prose fields of a question card: each question, its header, and each option's text."""
+    all_questions = all_card_input.get(QUESTION_CARD_QUESTIONS_KEY)
+    all_question_fields: list[object] = []
+    for each_question in all_questions if isinstance(all_questions, list) else []:
+        if not isinstance(each_question, dict):
+            continue
+        all_question_fields.extend(each_question.get(each_key) for each_key in ALL_QUESTION_CARD_PROSE_KEYS)
+        all_options = each_question.get(DECISION_CARD_OPTIONS_KEY)
+        all_question_fields.extend(
+            each_option.get(each_key)
+            for each_option in (all_options if isinstance(all_options, list) else [])
+            if isinstance(each_option, dict)
+            for each_key in ALL_QUESTION_OPTION_PROSE_KEYS
+        )
+    return [each_field for each_field in all_question_fields if isinstance(each_field, str)]
+
+
 def active_mode_rules() -> VisualReplyRules | None:
     """Return the visual reply rules when the mode is on and the rule file parses."""
     if not mode_enabled(Path.home() / CLAUDE_HOME_DIRECTORY_NAME):
@@ -280,7 +365,10 @@ def active_mode_rules() -> VisualReplyRules | None:
 
 def card_violation(card_text: str, mode_rules: VisualReplyRules | None) -> str | None:
     """Return the deny reason for a decision card's prose, or None."""
-    return banned_word_violation(card_text, configured_banned_words()) or (
+    return (
+        banned_word_violation(card_text, configured_banned_words())
+        or unvalidated_claim_violation(card_text)
+    ) or (
         None if mode_rules is None else abbreviation_violation(prose_outside_links(card_text), mode_rules)
     )
 
@@ -296,6 +384,8 @@ def reply_violation(
         or unlinked_pull_request_violation(reply_text)
         or unsourced_cause_violation(reply_text)
         or banned_word_violation(reply_text, configured_banned_words())
+        or unvalidated_claim_violation(reply_text)
+        or unseen_citation_violation(reply_text, transcript_path)
     )
     if violation is not None or mode_rules is None:
         return violation
@@ -316,9 +406,16 @@ def tool_violation(
         anchor_violation = widget_anchor_violation(tool_name, all_tool_input)
         if anchor_violation is not None:
             return anchor_violation, str(all_tool_input)
-    if tool_name == DECISION_CARD_TOOL_NAME:
-        card_text = CARD_TEXT_SEPARATOR.join(all_card_texts(all_tool_input))
-        violation = card_violation(card_text, mode_rules)
+    if tool_name in (DECISION_CARD_TOOL_NAME, QUESTION_CARD_TOOL_NAME):
+        all_texts = (
+            all_card_texts(all_tool_input)
+            if tool_name == DECISION_CARD_TOOL_NAME
+            else all_question_card_texts(all_tool_input)
+        )
+        card_text = CARD_TEXT_SEPARATOR.join(all_texts)
+        violation = card_violation(card_text, mode_rules) or unseen_citation_violation(
+            card_text, transcript_path
+        )
         return None if violation is None else (violation, card_text)
     if tool_name not in ALL_CHECKED_TOOL_NAMES:
         return None