claude-dev-env 8.84.0 → 8.85.0

package/hooks/blocking/test_chat_reply_gate.py

@@ -0,0 +1,224 @@
+import io
+import json
+from pathlib import Path
+
+import pytest
+
+import chat_reply_gate
+
+FOUR_SENTENCE_REPLY = "PR one merged. PR two is queued. PR three needs a fix. Nothing else is open."
+THREE_SENTENCE_REPLY = "PR one merged. PR two is queued. Nothing else is open."
+PASSING_DRAFT = "PR one merged. Two others wait."
+
+
+@pytest.fixture(autouse=True)
+def default_banned_words(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setenv("CLAUDE_REPLY_BANNED_WORDS_PATH", str(tmp_path / "absent.json"))
+    monkeypatch.delenv("CHAT_REPLY_DRAFTER_ACTIVE", raising=False)
+    monkeypatch.setattr(chat_reply_gate, "log_hook_block", lambda *_args, **_kwargs: None)
+    monkeypatch.setattr(chat_reply_gate.tempfile, "gettempdir", lambda: str(tmp_path))
+
+
+def run_hook(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+    hook_input: dict[str, object],
+) -> tuple[int, dict[str, object] | None]:
+    monkeypatch.setattr(
+        "sys.stdin", io.TextIOWrapper(io.BytesIO(json.dumps(hook_input).encode("utf-8")))
+    )
+    exit_code = chat_reply_gate.main()
+    output_text = capsys.readouterr().out
+    return exit_code, json.loads(output_text)["hookSpecificOutput"] if output_text else None
+
+
+def display_input(delta: str, is_final: bool = True) -> dict[str, object]:
+    return {
+        "hook_event_name": "MessageDisplay",
+        "session_id": "abc",
+        "message_id": "m1",
+        "delta": delta,
+        "final": is_final,
+    }
+
+
+def test_should_show_a_passing_draft_in_place_of_a_long_reply(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    monkeypatch.setattr(chat_reply_gate, "ask_drafter", lambda *_args: PASSING_DRAFT)
+    exit_code, hook_output = run_hook(monkeypatch, capsys, display_input(FOUR_SENTENCE_REPLY))
+    assert exit_code == 0
+    assert hook_output == {"hookEventName": "MessageDisplay", "displayContent": PASSING_DRAFT}
+
+
+def test_should_show_a_reply_within_the_limit_unchanged(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    monkeypatch.setattr(chat_reply_gate, "ask_drafter", lambda *_args: pytest.fail("drafter called"))
+    exit_code, hook_output = run_hook(monkeypatch, capsys, display_input(THREE_SENTENCE_REPLY))
+    assert exit_code == 0
+    assert hook_output is None
+
+
+def test_should_hold_batches_until_the_last_one_arrives(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    all_requests: list[str] = []
+    monkeypatch.setattr(
+        chat_reply_gate,
+        "ask_drafter",
+        lambda reply_text, _violation: all_requests.append(reply_text) or PASSING_DRAFT,
+    )
+    _, first_output = run_hook(
+        monkeypatch, capsys, display_input("PR one merged. PR two is queued.\n", False)
+    )
+    _, last_output = run_hook(
+        monkeypatch, capsys, display_input("PR three needs a fix. Nothing else is open.")
+    )
+    assert first_output == {"hookEventName": "MessageDisplay", "displayContent": ""}
+    assert last_output == {"hookEventName": "MessageDisplay", "displayContent": PASSING_DRAFT}
+    assert all_requests == [
+        "PR one merged. PR two is queued.\nPR three needs a fix. Nothing else is open."
+    ]
+
+
+def test_should_show_the_whole_held_message_when_it_passes(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    run_hook(monkeypatch, capsys, display_input("PR one merged.\n", False))
+    _, hook_output = run_hook(monkeypatch, capsys, display_input("Nothing else is open."))
+    assert hook_output == {
+        "hookEventName": "MessageDisplay",
+        "displayContent": "PR one merged.\nNothing else is open.",
+    }
+
+
+def test_should_show_the_original_when_no_draft_passes(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    all_calls: list[str] = []
+    monkeypatch.setattr(
+        chat_reply_gate,
+        "ask_drafter",
+        lambda reply_text, _violation: all_calls.append(reply_text) or FOUR_SENTENCE_REPLY,
+    )
+    _, hook_output = run_hook(monkeypatch, capsys, display_input(FOUR_SENTENCE_REPLY))
+    assert hook_output is None
+    assert len(all_calls) == 2
+
+
+def test_should_tell_the_agent_which_draft_the_user_saw(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    monkeypatch.setattr(chat_reply_gate, "ask_drafter", lambda *_args: PASSING_DRAFT)
+    run_hook(monkeypatch, capsys, display_input(FOUR_SENTENCE_REPLY))
+    prompt_input = {"hook_event_name": "UserPromptSubmit", "session_id": "abc"}
+    _, first_output = run_hook(monkeypatch, capsys, prompt_input)
+    _, second_output = run_hook(monkeypatch, capsys, prompt_input)
+    assert first_output is not None and second_output is not None
+    assert str(first_output["additionalContext"]).endswith(PASSING_DRAFT)
+    assert PASSING_DRAFT not in str(second_output["additionalContext"])
+
+
+def test_should_delete_the_shown_draft_at_session_end(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    monkeypatch.setattr(chat_reply_gate, "ask_drafter", lambda *_args: PASSING_DRAFT)
+    run_hook(monkeypatch, capsys, display_input(FOUR_SENTENCE_REPLY))
+    shown_draft_path = chat_reply_gate.state_file_path("claude-chat-reply-shown-", "abc")
+    assert shown_draft_path.exists()
+    exit_code, hook_output = run_hook(
+        monkeypatch, capsys, {"hook_event_name": "SessionEnd", "session_id": "abc"}
+    )
+    assert exit_code == 0
+    assert hook_output is None
+    assert not shown_draft_path.exists()
+
+
+def test_should_add_the_reply_limit_on_each_user_prompt(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    exit_code, hook_output = run_hook(
+        monkeypatch, capsys, {"hook_event_name": "UserPromptSubmit", "prompt": "status?"}
+    )
+    assert exit_code == 0
+    assert hook_output is not None
+    assert hook_output["hookEventName"] == "UserPromptSubmit"
+    assert "3 sentences or fewer" in str(hook_output["additionalContext"])
+
+
+def test_should_do_nothing_inside_the_drafter_process(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    monkeypatch.setenv("CHAT_REPLY_DRAFTER_ACTIVE", "1")
+    exit_code, hook_output = run_hook(monkeypatch, capsys, display_input(FOUR_SENTENCE_REPLY))
+    assert exit_code == 0
+    assert hook_output is None
+
+
+def test_should_ignore_the_stop_event(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    exit_code, hook_output = run_hook(
+        monkeypatch,
+        capsys,
+        {"hook_event_name": "Stop", "last_assistant_message": FOUR_SENTENCE_REPLY},
+    )
+    assert exit_code == 0
+    assert hook_output is None
+
+
+def test_ask_drafter_should_read_the_result_field(monkeypatch: pytest.MonkeyPatch) -> None:
+    class CompletedDrafter:
+        stdout = json.dumps({"result": f"  {PASSING_DRAFT}\n"})
+
+    all_commands: list[list[str]] = []
+    monkeypatch.setattr(chat_reply_gate.shutil, "which", lambda _name: "C:/npm/claude.cmd")
+    monkeypatch.setattr(
+        chat_reply_gate.subprocess,
+        "run",
+        lambda command, **_kwargs: all_commands.append(command) or CompletedDrafter(),
+    )
+    assert chat_reply_gate.ask_drafter(FOUR_SENTENCE_REPLY, "too long") == PASSING_DRAFT
+    assert all_commands[0][:4] == ["C:/npm/claude.cmd", "-p", "--model", "haiku"]
+
+
+def test_ask_drafter_should_return_none_for_an_error_result(monkeypatch: pytest.MonkeyPatch) -> None:
+    class FailedDrafter:
+        stdout = json.dumps({"is_error": True, "result": "Credit balance is too low"})
+
+    monkeypatch.setattr(chat_reply_gate.subprocess, "run", lambda *_args, **_kwargs: FailedDrafter())
+    assert chat_reply_gate.ask_drafter(FOUR_SENTENCE_REPLY, "too long") is None
+
+
+def test_should_forget_the_shown_draft_when_a_later_reply_passes(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    monkeypatch.setattr(chat_reply_gate, "ask_drafter", lambda *_args: PASSING_DRAFT)
+    run_hook(monkeypatch, capsys, display_input(FOUR_SENTENCE_REPLY))
+    run_hook(monkeypatch, capsys, {**display_input(THREE_SENTENCE_REPLY), "message_id": "m2"})
+    _, hook_output = run_hook(monkeypatch, capsys, {"hook_event_name": "UserPromptSubmit", "session_id": "abc"})
+    assert hook_output is not None
+    assert PASSING_DRAFT not in str(hook_output["additionalContext"])
+
+
+def test_should_show_a_batch_without_a_message_id_as_it_is(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    monkeypatch.setattr(chat_reply_gate, "ask_drafter", lambda *_args: pytest.fail("drafter called"))
+    batch_input = {**display_input("PR one merged. PR two", is_final=False), "message_id": None}
+    exit_code, hook_output = run_hook(monkeypatch, capsys, batch_input)
+    assert exit_code == 0
+    assert hook_output is None
+
+
+def test_drafter_environment_should_carry_the_guard(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("CLAUDE_CODE_SESSION_ID", "parent")
+    environment = chat_reply_gate.drafter_environment()
+    assert environment["CHAT_REPLY_DRAFTER_ACTIVE"] == "1"
+    assert "CLAUDE_CODE_SESSION_ID" not in environment
+
+
+def test_state_file_path_should_strip_unsafe_characters(tmp_path: Path) -> None:
+    state_path = chat_reply_gate.state_file_path("claude-chat-reply-held-", "../a b/c")
+    assert state_path == tmp_path / "claude-chat-reply-held-abc.txt"

package/hooks/blocking/test_pull_request_proof.py

@@ -4,12 +4,15 @@ import subprocess
 import sys
 from pathlib import Path
 
+import pytest
+
 HOOKS_DIRECTORY = Path(__file__).resolve().parent.parent
 if str(HOOKS_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(HOOKS_DIRECTORY))
 
 from blocking import pull_request_proof as gate
 from hooks_constants.pull_request_proof_constants import (
+    COMPARE_FILE_LIST_LIMIT,
     MISSING_BODY_REASON,
     MISSING_EVAL_SECTION_REASON,
     MISSING_EXISTING_WORK_REASON,
@@ -306,6 +309,147 @@ def test_should_deny_when_git_cannot_read_the_branch_and_proof_shows_no_picture(
     assert gate.missing_look_reason(payload) == UNREADABLE_CHANGES_REASON
 
 
+def _fake_gh_api(all_responses: dict[str, list[str] | None], all_endpoints: list[str]):
+    def fake_gh_api_lines(endpoint: str, query: str) -> list[str] | None:
+        all_endpoints.append(endpoint)
+        return all_responses.get(endpoint)
+
+    return fake_gh_api_lines
+
+
+def _shell_create_elsewhere(tmp_path: Path, extra_flags: str) -> dict[str, object]:
+    body_path = tmp_path / "body.md"
+    body_path.write_text(PROVEN_BODY, encoding="utf-8")
+    return _shell(f"gh pr create --title t --body-file {body_path} {extra_flags}", tmp_path)
+
+
+def test_should_allow_a_python_only_change_the_compare_api_lists_when_git_cannot_read_it(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    all_endpoints: list[str] = []
+    compare_endpoint = "repos/o/r/compare/main...feature"
+    monkeypatch.setattr(gate, "_gh_api_lines", _fake_gh_api({compare_endpoint: ["tool.py"]}, all_endpoints))
+    payload = _shell_create_elsewhere(tmp_path, "--repo o/r --base main --head feature")
+    assert gate.missing_look_reason(payload) is None
+    assert all_endpoints == [compare_endpoint]
+
+
+def test_should_deny_a_page_change_the_compare_api_lists_without_a_picture(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    all_responses = {"repos/o/r": ["trunk"], "repos/o/r/compare/trunk...feature": ["web/page.html", "tool.py"]}
+    all_endpoints: list[str] = []
+    monkeypatch.setattr(gate, "_gh_api_lines", _fake_gh_api(all_responses, all_endpoints))
+    reason = gate.missing_look_reason(_shell_create_elsewhere(tmp_path, "-R o/r --head=feature"))
+    assert reason is not None
+    assert "web/page.html" in reason
+    assert "tool.py" not in reason
+    assert all_endpoints == ["repos/o/r", "repos/o/r/compare/trunk...feature"]
+
+
+def test_should_deny_as_unreadable_when_the_compare_api_fails(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setattr(gate, "_gh_api_lines", _fake_gh_api({}, []))
+    payload = _shell_create_elsewhere(tmp_path, "--repo o/r --base main --head feature")
+    reason = gate.missing_look_reason(payload)
+    assert reason == UNREADABLE_CHANGES_REASON
+    assert reason is not None
+    assert "compare API" in reason
+    assert "--repo" in reason
+    assert "--head" in reason
+    assert "origin fetched" in reason
+    assert "Artifact" in reason
+    assert "before any change to this gate" in reason
+
+
+def _python_paths(count: int) -> list[str]:
+    return [f"pkg/module_{each_index}.py" for each_index in range(count)]
+
+
+def test_should_deny_as_unreadable_when_a_full_compare_page_lists_no_visible_file(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    all_endpoints: list[str] = []
+    compare_endpoint = "repos/o/r/compare/main...feature"
+    monkeypatch.setattr(
+        gate,
+        "_gh_api_lines",
+        _fake_gh_api({compare_endpoint: _python_paths(COMPARE_FILE_LIST_LIMIT)}, all_endpoints),
+    )
+    assert COMPARE_FILE_LIST_LIMIT == 300
+    payload = _shell_create_elsewhere(tmp_path, "--repo o/r --base main --head feature")
+    assert gate.remote_visible_changed_files("o/r", "main", "feature") is None
+    assert gate.missing_look_reason(payload) == UNREADABLE_CHANGES_REASON
+    assert all_endpoints == [compare_endpoint, compare_endpoint]
+
+
+def test_should_allow_a_short_compare_page_that_lists_only_python(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    all_endpoints: list[str] = []
+    compare_endpoint = "repos/o/r/compare/main...feature"
+    monkeypatch.setattr(
+        gate,
+        "_gh_api_lines",
+        _fake_gh_api({compare_endpoint: _python_paths(COMPARE_FILE_LIST_LIMIT - 1)}, all_endpoints),
+    )
+    payload = _shell_create_elsewhere(tmp_path, "--repo o/r --base main --head feature")
+    assert gate.remote_visible_changed_files("o/r", "main", "feature") == []
+    assert gate.missing_look_reason(payload) is None
+
+
+def test_should_deny_a_visible_file_on_a_full_compare_page(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    all_endpoints: list[str] = []
+    compare_endpoint = "repos/o/r/compare/main...feature"
+    all_paths = [*_python_paths(COMPARE_FILE_LIST_LIMIT - 1), "web/page.html"]
+    monkeypatch.setattr(gate, "_gh_api_lines", _fake_gh_api({compare_endpoint: all_paths}, all_endpoints))
+    reason = gate.missing_look_reason(_shell_create_elsewhere(tmp_path, "--repo o/r --base main --head feature"))
+    assert reason is not None
+    assert "web/page.html" in reason
+    assert "module_0.py" not in reason
+
+
+def test_should_allow_a_page_the_compare_api_lists_when_the_proof_links_an_artifact(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    all_endpoints: list[str] = []
+    compare_endpoint = "repos/o/r/compare/main...feature"
+    monkeypatch.setattr(gate, "_gh_api_lines", _fake_gh_api({compare_endpoint: ["page.html"]}, all_endpoints))
+    body_path = tmp_path / "body.md"
+    body_path.write_text(PROVEN_BODY + "https://claude.ai/code/artifact/abc-123\n", encoding="utf-8")
+    payload = _shell(
+        f"gh pr create --title t --body-file {body_path} --repo o/r --base main --head feature",
+        tmp_path,
+    )
+    assert gate.missing_look_reason(payload) is None
+    assert all_endpoints == [compare_endpoint]
+
+
+def test_should_skip_the_compare_api_without_a_named_repository(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    all_endpoints: list[str] = []
+    monkeypatch.setattr(gate, "_gh_api_lines", _fake_gh_api({}, all_endpoints))
+    payload = _shell_create_elsewhere(tmp_path, "--base main --head feature")
+    assert gate.missing_look_reason(payload) == UNREADABLE_CHANGES_REASON
+    assert all_endpoints == []
+
+
+def test_should_read_owner_and_repo_of_an_mcp_create_for_the_compare_api(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    all_endpoints: list[str] = []
+    compare_endpoint = "repos/o/r/compare/main...feature"
+    monkeypatch.setattr(gate, "_gh_api_lines", _fake_gh_api({compare_endpoint: ["tool.py"]}, all_endpoints))
+    payload = _mcp_create_on_branch(PROVEN_BODY, tmp_path)
+    payload["tool_input"].update(owner="o", repo="r", base="main")
+    assert gate.missing_look_reason(payload) is None
+    assert all_endpoints == [compare_endpoint]
+
+
 def test_visible_changed_files_falls_back_to_origin_main_without_origin_head(tmp_path: Path) -> None:
     clone_path = _repository_with_change(tmp_path, "page.html")
     subprocess.run(["git", "-C", str(clone_path), "remote", "set-head", "origin", "-d"], check=True)

package/hooks/features/conduct-gates.md

@@ -7,6 +7,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link. It denies a sentence that guesses, estimates, hedges a duration, or admits a skipped check, such as "I didn't confirm this one." It denies a cited Actions run, pull request, or run, job, or check id that no successful tool result in the transcript shows; a subagent's report is the result of its Agent call. A question card from `AskUserQuestion` gets the banned word check and `unvalidated_claim_violation`, like a decision card. With visual reply mode on, it also runs the checks in `visual_reply_rules.py` from the rule list in `rules/visual-reply-rules.json`: no abbreviation or tracker number outside a link, a widget or page before a reply of more than one sentence, and no anchor link inside widget code. The mode is off by default; `~/.claude/visual-reply-mode.json` with `{"enabled": true}` turns the mode checks on.
 - `blocking/final_reply_gate.py` applies the banned words, `unvalidated_claim_violation`, and `unseen_citation_violation` from the reply gate to the reply a session ends its turn with.
 - The claim judge is a `prompt` hook in `hooks.json`, with no `model` set, so Claude Code's small default hook model reads each chat message and denies the first claim about how code, a file, a tool, a service, a run, or a process behaves, or why something happened, when nothing in the message shows it: inline code that quotes output or a code line, a file and line, or a link. A pull request link covers what that change does, what it blocks or lets through, and its checks. The author's own actions, a restatement of the user's words, questions, instructions, and a decision card's option consequences pass. It catches the plain claims the causal word list in `blocking/reply_length_gate.py` misses, such as "The code lets any of them rewrite it mid-check." `continueOnBlock` returns the reason to the agent as the tool error, so it can add the source and send again. The installer owns it through the `claude-dev-env: ` prefix on its `statusMessage`. It skips `post_widget`, whose input is SVG or HTML markup.
+- `blocking/chat_reply_gate.py` runs the `reply_length_gate.py` reply checks on a plain chat reply, which is no tool call. On `UserPromptSubmit` it adds the reply rules as `additionalContext`. On `MessageDisplay` it holds each streamed batch until the message ends. A message that passes shows whole. A message that fails shows as a draft from `claude -p` on Haiku that passes the same checks, and the original shows when two drafts fail. The draft changes only the text on screen, so the next `UserPromptSubmit` tells the agent the text the user saw, and `SessionEnd` deletes the stored draft. The [reply arena harness](https://github.com/jl-cmd-projects/claude-dev-env/tree/160349b90f627ea542fc6bc7b2b7f86dcbf98b73/tests/reply_arena) ran the comparison that chose this display path.
 - `blocking/edit_marker_gate.py` rejects strikethrough and edit-note markers in replacement chat text or cards.
 - `blocking/issue_close_handoff_gate.py` denies an issue comment or issue write that closes the issue and routes a found defect to another issue or epic.
 - `blocking/session_title_format_gate.py` denies a session title that breaks the `<emoji> <name>` shape or has a name longer than 25 characters.
@@ -23,6 +24,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/reply_length_gate.py` runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__update_message|mcp__hearthbot__ask_decision|AskUserQuestion|mcp__hearthbot__post_widget`, timeout `10` seconds in `hooks.json`.
 - `blocking/final_reply_gate.py` runs on `Stop`, timeout `10` seconds in `hooks.json`.
 - The claim judge runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__update_message|mcp__hearthbot__ask_decision`, timeout `30` seconds in `hooks.json`.
+- `blocking/chat_reply_gate.py` runs on `UserPromptSubmit`, matcher empty, timeout `10` seconds, on `MessageDisplay`, timeout `100` seconds, and on `SessionEnd`, timeout `3` seconds, in `hooks.json`.
 - `blocking/edit_marker_gate.py` runs on `PreToolUse`, matcher `mcp__.*__update_message`, timeout `10` seconds in `hooks.json`.
 - `blocking/issue_close_handoff_gate.py` runs on `PreToolUse`, matcher `mcp__.*__(add_issue_comment|issue_write|update_issue_comment)`, timeout `10` seconds in `hooks.json`.
 - `blocking/session_title_format_gate.py` runs on `PreToolUse`, matcher `mcp__.*__set_session_title`, timeout `10` seconds in `hooks.json`.
@@ -43,6 +45,7 @@ Preconditions:
 - **Reply length.** Input is a reply with four sentences, a plain pull request number, an abbreviation, two sentences with no widget this turn, or widget code with an anchor link. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_reply_length_gate.py -q`. The adjacent test observes a denial and its count, link, or mode reason. Widget code with no flowchart passes with a flowchart reminder in `additionalContext`.
 - **Final reply.** Input is a closing reply that says "My guess is one to two hours." or cites a run no tool result shows. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_final_reply_gate.py -q`. The adjacent test observes a `block` decision that quotes the sentence or the citation; a reply that cites a run a tool result shows passes.
 - **Claim judge.** Input is a headless `claude -p` session with a stub MCP server named `hearthbot` that exposes `reply` and `ask_decision`, told to send "The code lets any of them rewrite it mid-check." The session settings add the `hooks.json` prompt hook. The stub logs zero bytes sent, and the tool error reads `PreToolUse:mcp__hearthbot__reply hook error: [<the prompt>]: Fact with no source: ...`. The same sentence with a `file:line` in backticks posts. A hook whose `model` Claude Code does not recognize lets every message through, so leave `model` unset. Run `node --test packages/claude-dev-env/bin/install.prompt-hook.test.mjs` for the installer side; it observes one managed prompt hook after two installs and none after uninstall.
+- **Chat reply.** Input is a `MessageDisplay` event whose message holds four sentences, the same message split over two batches, and a `UserPromptSubmit` event. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_chat_reply_gate.py -q`. The adjacent test observes the drafter's text in `displayContent`, an empty first batch, no output for three sentences, the original after two failed drafts, the shown draft in the next `additionalContext`, and the stored draft deleted at session end.
 - **Edit marker.** Input is an update message with strikethrough or an edit note. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_edit_marker_gate.py -q`. The adjacent test observes a denial; clean replacement text passes.
 - **Handoff close.** Input is an issue comment that says the issue is closed and that the found defect belongs to another issue. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_issue_close_handoff_gate.py -q`. The adjacent test observes a denial; a close with a plain cross-reference and a routing comment on an open issue both pass.
 - **Session title.** Input is a set session title call with no leading emoji or a name over 25 characters. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_session_title_format_gate.py -q`. The adjacent test observes a denial that names the broken rule; a well-formed title passes.

package/hooks/hooks.json

@@ -293,6 +293,11 @@
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/lifecycle/nested_project_hooks.py",
             "timeout": 120
+          },
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/chat_reply_gate.py",
+            "timeout": 10
           }
         ]
       }
@@ -391,6 +396,11 @@
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/session_edit_tracker_cleanup.py",
             "timeout": 3
+          },
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/chat_reply_gate.py",
+            "timeout": 3
           }
         ]
       }
@@ -470,6 +480,17 @@
           }
         ]
       }
+    ],
+    "MessageDisplay": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/chat_reply_gate.py",
+            "timeout": 100
+          }
+        ]
+      }
     ]
   }
 }

package/hooks/hooks_constants/chat_reply_gate_constants.py

@@ -0,0 +1,58 @@
+"""Constants for the chat reply gate UserPromptSubmit and MessageDisplay hook."""
+
+from hooks_constants.reply_length_gate_constants import (
+    MAXIMUM_SENTENCE_COUNT,
+    MAXIMUM_WORDS_PER_SENTENCE,
+)
+
+HOOK_EVENT_NAME_INPUT_KEY = "hook_event_name"
+MESSAGE_DISPLAY_EVENT_NAME = "MessageDisplay"
+USER_PROMPT_SUBMIT_EVENT_NAME = "UserPromptSubmit"
+SESSION_END_EVENT_NAME = "SessionEnd"
+SESSION_ID_KEY = "session_id"
+MESSAGE_ID_KEY = "message_id"
+DELTA_KEY = "delta"
+FINAL_KEY = "final"
+DISPLAY_CONTENT_KEY = "displayContent"
+STATE_FILE_ENCODING = "utf-8"
+HELD_TEXT_FILE_PREFIX = "claude-chat-reply-held-"
+SHOWN_DRAFT_FILE_PREFIX = "claude-chat-reply-shown-"
+STATE_FILE_SUFFIX = ".txt"
+REPLY_LIMIT_REMINDER = (
+    f"Your reply to the user is final and gets no second pass. Keep it to {MAXIMUM_SENTENCE_COUNT}"
+    f" sentences or fewer, each {MAXIMUM_WORDS_PER_SENTENCE} words or fewer."
+    " Each line and each list item counts as one sentence, so prefer short prose over lists."
+    " Lead with the outcome and cut detail the user did not ask for."
+    " No colon in the middle of a sentence, and no em dash."
+    " Put any pull request number inside a markdown link."
+    " A sentence with so, because, caused, due to, therefore, or means needs inline code, a URL, or a link in it."
+    " Never write real, really, genuine, actual, actually, likely, probably, seems, maybe, perhaps, may be, or might be."
+    " Count your sentences before you send."
+)
+SHOWN_DRAFT_PREFIX = "\n\nThe user saw your last reply condensed to this text, so build on it:\n\n"
+DRAFTER_GUARD_ENV_VAR = "CHAT_REPLY_DRAFTER_ACTIVE"
+DRAFTER_MODEL_ENV_VAR = "CHAT_REPLY_DRAFTER_MODEL"
+DEFAULT_DRAFTER_MODEL = "haiku"
+DRAFTER_TIMEOUT_SECONDS = 45
+MAXIMUM_DRAFT_ATTEMPTS = 2
+DRAFTER_RESULT_KEY = "result"
+DRAFTER_ERROR_KEY = "is_error"
+DRAFTER_EXECUTABLE_NAME = "claude"
+CLAUDE_SESSION_ID_ENV_VAR = "CLAUDE_CODE_SESSION_ID"
+DRAFTER_REQUEST_TEMPLATE = "Rule the reply broke: {violation}\n\nReply to rewrite:\n\n{reply_text}"
+DRAFTER_RULES = (
+    f"Rewrite the reply below so it obeys every rule. At most {MAXIMUM_SENTENCE_COUNT} sentences,"
+    f" each at most {MAXIMUM_WORDS_PER_SENTENCE} words. Each line and each list item counts as one sentence."
+    " Keep the outcome, the recommendation, and any number, path, or command the user needs."
+    " Drop background the user did not ask for."
+    " No colon in the middle of a sentence. No em dash."
+    " Write a pull request number only inside a markdown link."
+    " A sentence that gives a cause, with so, because, caused, due to, therefore, or means,"
+    " must hold its own evidence as inline code, a URL, or a markdown link. Otherwise state the fact without the cause word."
+    " Never use these words: real, really, genuine, actual, actually, likely, probably, seems, maybe, perhaps,"
+    " might be, may be, appears to, suspect, guess, presumably."
+    " Speak as the original author to the original reader."
+    " Never mention the rule, the length, or this rewrite."
+    " Never add, drop, or change a fact, a command, a flag, or a file name; leave out a whole point instead."
+    " Return only the rewritten reply, with no preface."
+)

package/hooks/hooks_constants/pull_request_proof_constants.py

@@ -85,7 +85,17 @@ ALL_DEFAULT_BRANCH_REFERENCES = ("origin/HEAD", "origin/main", "main")
 REMOTE_BRANCH_PREFIX = "origin/"
 ALL_HEAD_FLAGS = frozenset({"--head", "-H"})
 HEAD_FLAG_ASSIGNMENT_PREFIX = "--head="
+ALL_BASE_FLAGS = frozenset({"--base", "-B"})
+BASE_FLAG_ASSIGNMENT_PREFIX = "--base="
+ALL_REPOSITORY_FLAGS = frozenset({"--repo", "-R"})
+REPOSITORY_FLAG_ASSIGNMENT_PREFIX = "--repo="
 GIT_TIMEOUT_SECONDS = 5
+GH_TIMEOUT_SECONDS = 15
+COMPARE_ENDPOINT_TEMPLATE = "repos/{repository}/compare/{base_branch}...{head_branch}"
+COMPARE_FILE_NAMES_QUERY = ".files[].filename"
+COMPARE_FILE_LIST_LIMIT = 300
+REPOSITORY_ENDPOINT_TEMPLATE = "repos/{repository}"
+DEFAULT_BRANCH_QUERY = ".default_branch"
 MISSING_LOOK_REASON = (
     "This pull request changes files people see ({changed_files}), and its 'Proof in"
     " practice' section shows no picture. Render the change, open the screenshot with the"
@@ -96,11 +106,14 @@ MISSING_LOOK_REASON = (
 )
 CHANGED_FILES_SEPARATOR = ", "
 UNREADABLE_CHANGES_REASON = (
-    "Git in this directory cannot list the files this pull request changes, so the"
-    " picture check cannot tell whether people see the change. Put a screenshot or"
-    " Artifact link in the 'Proof in practice' section and run the create call again,"
-    " or run it from a checkout of the head branch with origin fetched. Take one of"
-    " these routes now, before any change to this gate. Read " + PROOF_GUIDE_PATH + " for the full rule."
+    "Neither git in this directory nor the GitHub compare API can list the files this"
+    " pull request changes, so the picture check cannot tell whether people see the change."
+    " Name the repository and head branch with --repo and --head, run the create call"
+    " from a checkout of the head branch with origin fetched, or put a screenshot or"
+    " Artifact link in the 'Proof in practice' section and run the create call again."
+    " Take one of these routes now, before any change to this gate. Read "
+    + PROOF_GUIDE_PATH
+    + " for the full rule."
 )
 FEATURE_TITLE_PATTERN = r"^\s*feat(\([^)]*\))?!?:"
 EVAL_HEADING_PATTERN = r"^(#{1,6})[ \t]+evals?[ \t]*#*[ \t]*$"

package/hooks/hooks_constants/session_file_id.py

@@ -0,0 +1,17 @@
+"""Turn a hook payload's session id into a safe part of a temp file name."""
+
+from __future__ import annotations
+
+from hooks_constants.session_edit_stage_gate_constants import (
+    SESSION_ID_UNSAFE_CHARACTERS_PATTERN,
+    STATE_FILE_DEFAULT_SESSION_ID,
+)
+
+__all__ = ["session_file_id"]
+
+
+def session_file_id(session_id: object) -> str:
+    """Return the session id with unsafe characters stripped, or the default id when none remain."""
+    raw_session_id = session_id if isinstance(session_id, str) else ""
+    sanitized_session_id = SESSION_ID_UNSAFE_CHARACTERS_PATTERN.sub("", raw_session_id)
+    return sanitized_session_id or STATE_FILE_DEFAULT_SESSION_ID

package/hooks/hooks_constants/test_session_file_id.py

@@ -0,0 +1,17 @@
+"""Tests for the shared session id that names per-session temp files."""
+
+from __future__ import annotations
+
+from hooks_constants.session_file_id import session_file_id
+
+
+def test_should_strip_path_characters_from_the_session_id() -> None:
+    assert session_file_id("../a b/c-1_2") == "abc-1_2"
+
+
+def test_should_fall_back_to_the_default_id_when_nothing_safe_remains() -> None:
+    assert session_file_id("../ /") == "default"
+
+
+def test_should_fall_back_to_the_default_id_for_a_missing_session_id() -> None:
+    assert session_file_id(None) == "default"

package/hooks/observability/session_file_edit_tracker.py

@@ -39,11 +39,10 @@ from hooks_constants.session_edit_stage_gate_constants import (  # noqa: E402
     APPLY_PATCH_TOOL_NAME,
     SESSION_EDIT_FILE_PREFIX,
     SESSION_EDIT_FILE_SUFFIX,
-    SESSION_ID_UNSAFE_CHARACTERS_PATTERN,
     STATE_FILE_ATOMIC_WRITE_SUFFIX,
-    STATE_FILE_DEFAULT_SESSION_ID,
     STATE_FILE_JSON_INDENT_SPACES,
 )
+from hooks_constants.session_file_id import session_file_id
 
 
 def _resolved_path_or_none(file_path: str) -> str | None:
@@ -74,9 +73,7 @@ def _session_edit_file_path(session_id: str) -> Path:
     Returns:
         Absolute path to this session's tracker file.
     """
-    sanitized_session_id = SESSION_ID_UNSAFE_CHARACTERS_PATTERN.sub("", session_id)
-    effective_session_id = sanitized_session_id or STATE_FILE_DEFAULT_SESSION_ID
-    file_name = f"{SESSION_EDIT_FILE_PREFIX}{effective_session_id}{SESSION_EDIT_FILE_SUFFIX}"
+    file_name = f"{SESSION_EDIT_FILE_PREFIX}{session_file_id(session_id)}{SESSION_EDIT_FILE_SUFFIX}"
     return Path(tempfile.gettempdir()) / file_name
 
 

package/hooks/session/session_edit_tracker_cleanup.py

@@ -35,11 +35,10 @@ from hooks_constants.pre_tool_use_stdin import (  # noqa: E402
 from hooks_constants.session_edit_stage_gate_constants import (  # noqa: E402
     SESSION_EDIT_FILE_PREFIX,
     SESSION_EDIT_FILE_SUFFIX,
-    SESSION_ID_UNSAFE_CHARACTERS_PATTERN,
     SESSION_START_SOURCE_FRESH_STARTUP,
     SESSION_START_SOURCE_PAYLOAD_KEY,
-    STATE_FILE_DEFAULT_SESSION_ID,
 )
+from hooks_constants.session_file_id import session_file_id
 
 
 def _delete_file(target_file: Path) -> None:
@@ -66,9 +65,7 @@ def _current_session_file_name(session_id: str) -> str:
         The tracker file name for the sanitized session id, falling back to
         the default id when sanitizing leaves an empty string.
     """
-    sanitized_session_id = SESSION_ID_UNSAFE_CHARACTERS_PATTERN.sub("", session_id)
-    effective_session_id = sanitized_session_id or STATE_FILE_DEFAULT_SESSION_ID
-    return f"{SESSION_EDIT_FILE_PREFIX}{effective_session_id}{SESSION_EDIT_FILE_SUFFIX}"
+    return f"{SESSION_EDIT_FILE_PREFIX}{session_file_id(session_id)}{SESSION_EDIT_FILE_SUFFIX}"
 
 
 def _is_tracker_deletion_lifecycle_event(payload_by_field: dict[str, object]) -> bool:

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.84.0",
+    "version": "8.85.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {