claude-dev-env 8.87.1 → 8.88.0

package/hooks/blocking/open_tasks_transcript.py

@@ -0,0 +1,270 @@
+#!/usr/bin/env python3
+"""Rebuild a session task list and its last assistant text from a transcript.
+
+The open tasks Stop gate reads three transcript shapes, replayed in order::
+
+    TaskCreate / TaskUpdate calls        (Claude Code)
+    TodoWrite input.todos                (Claude Code and Cursor; ``merge`` updates by id)
+    update_plan function_call arguments  (Codex rollout)
+
+The Cursor CLI can also reach TodoWrite through ``CallDynamicTool``, with the
+TodoWrite input under ``arguments``; that call counts as the TodoWrite call.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+from pathlib import Path
+from typing import NamedTuple
+
+hooks_root_directory = str(Path(__file__).resolve().parent.parent)
+if hooks_root_directory not in sys.path:
+    sys.path.insert(0, hooks_root_directory)
+
+from hooks_constants.open_tasks_stop_gate_constants import (
+    ASSISTANT_ROLE,
+    CODEX_ARGUMENTS_KEY,
+    CODEX_FUNCTION_CALL_TYPE,
+    CODEX_PAYLOAD_KEY,
+    CODEX_PLAN_KEY,
+    CODEX_PLAN_TOOL_NAME,
+    CODEX_RESPONSE_ITEM_TYPE,
+    CODEX_STEP_KEY,
+    CONTENT_KEY,
+    CREATED_TASK_ID_GROUP_INDEX,
+    DYNAMIC_TOOL_ARGUMENTS_KEY,
+    DYNAMIC_TOOL_CALL_NAME,
+    DYNAMIC_TOOL_NAME_KEY,
+    FIRST_ITEM_NUMBER,
+    MESSAGE_KEY,
+    PENDING_STATUS,
+    RECORD_TYPE_KEY,
+    REPLY_TEXT_SEPARATOR,
+    ROLE_KEY,
+    TASK_CREATED_PATTERN,
+    TASK_CREATE_TOOL_NAME,
+    TASK_ID_KEY,
+    TASK_STATUS_KEY,
+    TASK_SUBJECT_KEY,
+    TASK_UPDATE_ID_KEY,
+    TASK_UPDATE_TOOL_NAME,
+    TEXT_KEY,
+    TODOS_KEY,
+    TODO_CONTENT_KEY,
+    TODO_ID_KEY,
+    TODO_MERGE_KEY,
+    TODO_WRITE_TOOL_NAME,
+    TOOL_INPUT_KEY,
+    TOOL_NAME_KEY,
+    TOOL_RESULT_BLOCK_TYPE,
+    TOOL_USE_BLOCK_TYPE,
+    TOOL_USE_ID_KEY,
+    UTF8_ENCODING,
+    WORD_SEPARATOR,
+)
+
+
+class TaskItem(NamedTuple):
+    """One task list item.
+
+    Attributes:
+        item_id: The task number or position, as text.
+        subject: The item's wording.
+        status: The item's status, such as ``pending`` or ``completed``.
+    """
+
+    item_id: str
+    subject: str
+    status: str
+
+
+def parsed_object(json_text: str) -> dict[str, object] | None:
+    """Return the JSON object in the text, or None for anything else."""
+    try:
+        parsed_value = json.loads(json_text)
+    except ValueError:
+        return None
+    return parsed_value if isinstance(parsed_value, dict) else None
+
+
+def _transcript_records(transcript_path: object) -> list[dict[str, object]]:
+    if not isinstance(transcript_path, str):
+        return []
+    try:
+        all_lines = Path(transcript_path).read_text(encoding=UTF8_ENCODING).splitlines()
+    except OSError:
+        return []
+    all_records = (parsed_object(each_line) for each_line in all_lines)
+    return [each_record for each_record in all_records if each_record is not None]
+
+
+def _content_blocks(all_record_fields: dict[str, object]) -> list[dict[str, object]]:
+    message_body = all_record_fields.get(MESSAGE_KEY)
+    content_value = message_body.get(CONTENT_KEY) if isinstance(message_body, dict) else None
+    if not isinstance(content_value, list):
+        return []
+    return [each_block for each_block in content_value if isinstance(each_block, dict)]
+
+
+def _result_text(all_block_fields: dict[str, object]) -> str:
+    result_content = all_block_fields.get(CONTENT_KEY)
+    if isinstance(result_content, str):
+        return result_content
+    if not isinstance(result_content, list):
+        return ""
+    return WORD_SEPARATOR.join(
+        str(each_part.get(TEXT_KEY, "")) for each_part in result_content if isinstance(each_part, dict)
+    )
+
+
+def _numbered_items(all_entries: object, subject_key: str) -> list[TaskItem]:
+    if not isinstance(all_entries, list):
+        return []
+    all_dictionaries = [each_entry for each_entry in all_entries if isinstance(each_entry, dict)]
+    return [
+        TaskItem(str(each_number), str(each_entry.get(subject_key, "")), str(each_entry.get(TASK_STATUS_KEY, "")))
+        for each_number, each_entry in enumerate(all_dictionaries, start=FIRST_ITEM_NUMBER)
+    ]
+
+
+def _todo_items(all_todo_entries: object) -> list[TaskItem]:
+    if not isinstance(all_todo_entries, list):
+        return []
+    all_dictionaries = [each_entry for each_entry in all_todo_entries if isinstance(each_entry, dict)]
+    return [
+        TaskItem(
+            str(each_entry.get(TODO_ID_KEY, each_number)),
+            str(each_entry.get(TODO_CONTENT_KEY, "")),
+            str(each_entry.get(TASK_STATUS_KEY, "")),
+        )
+        for each_number, each_entry in enumerate(all_dictionaries, start=FIRST_ITEM_NUMBER)
+    ]
+
+
+def merged_todo_items(all_earlier_items: list[TaskItem], all_update_entries: object) -> list[TaskItem]:
+    """Apply a ``merge`` TodoWrite call: update earlier items by id and append new ones."""
+    item_by_id = {each_item.item_id: each_item for each_item in all_earlier_items}
+    for each_update in _todo_items(all_update_entries):
+        earlier_item = item_by_id.get(each_update.item_id)
+        if earlier_item is None:
+            item_by_id[each_update.item_id] = each_update
+            continue
+        item_by_id[each_update.item_id] = earlier_item._replace(
+            subject=each_update.subject or earlier_item.subject,
+            status=each_update.status or earlier_item.status,
+        )
+    return list(item_by_id.values())
+
+
+def codex_plan_items(all_record_fields: dict[str, object]) -> list[TaskItem] | None:
+    """Return the plan from a Codex rollout ``update_plan`` call record, or None for any other record."""
+    payload_body = all_record_fields.get(CODEX_PAYLOAD_KEY)
+    if all_record_fields.get(RECORD_TYPE_KEY) != CODEX_RESPONSE_ITEM_TYPE or not isinstance(payload_body, dict):
+        return None
+    if payload_body.get(RECORD_TYPE_KEY) != CODEX_FUNCTION_CALL_TYPE or payload_body.get(TOOL_NAME_KEY) != CODEX_PLAN_TOOL_NAME:
+        return None
+    all_plan_arguments = parsed_object(str(payload_body.get(CODEX_ARGUMENTS_KEY, "")))
+    if all_plan_arguments is None:
+        return None
+    return _numbered_items(all_plan_arguments.get(CODEX_PLAN_KEY), CODEX_STEP_KEY)
+
+
+def unwrapped_tool_call(tool_name: str, all_input_fields: dict[str, object]) -> tuple[str, dict[str, object]]:
+    """Return the inner tool name and arguments of a Cursor ``CallDynamicTool`` call, or the call itself.
+
+    The Cursor CLI can reach TodoWrite through ``CallDynamicTool`` with
+    ``{"toolName": "TodoWrite", "arguments": {"todos": [...], "merge": true}}``.
+    """
+    inner_name = all_input_fields.get(DYNAMIC_TOOL_NAME_KEY)
+    all_inner_arguments = all_input_fields.get(DYNAMIC_TOOL_ARGUMENTS_KEY)
+    if tool_name != DYNAMIC_TOOL_CALL_NAME or not isinstance(inner_name, str) or not isinstance(all_inner_arguments, dict):
+        return tool_name, all_input_fields
+    return inner_name, all_inner_arguments
+
+
+class _TranscriptReplay:
+    """Fold transcript records into the newest task list they describe."""
+
+    def __init__(self) -> None:
+        self.latest_items: list[TaskItem] | None = None
+        self.created_by_id: dict[str, TaskItem] = {}
+        self.subject_by_tool_use_id: dict[str, str] = {}
+        self.last_assistant_text = ""
+
+    def apply_record(self, all_record_fields: dict[str, object]) -> None:
+        plan_items = codex_plan_items(all_record_fields)
+        if plan_items is not None:
+            self.latest_items = plan_items
+            return
+        all_blocks = _content_blocks(all_record_fields)
+        for each_block in all_blocks:
+            self.apply_block(each_block)
+        self.note_assistant_text(all_record_fields, all_blocks)
+
+    def note_assistant_text(self, all_record_fields: dict[str, object], all_blocks: list[dict[str, object]]) -> None:
+        message_body = all_record_fields.get(MESSAGE_KEY)
+        message_role = message_body.get(ROLE_KEY) if isinstance(message_body, dict) else None
+        if ASSISTANT_ROLE not in (all_record_fields.get(ROLE_KEY), all_record_fields.get(RECORD_TYPE_KEY), message_role):
+            return
+        record_text = REPLY_TEXT_SEPARATOR.join(
+            str(each_block.get(TEXT_KEY, "")) for each_block in all_blocks if each_block.get(RECORD_TYPE_KEY) == TEXT_KEY
+        ).strip()
+        if record_text:
+            self.last_assistant_text = record_text
+
+    def apply_block(self, all_block_fields: dict[str, object]) -> None:
+        block_type = all_block_fields.get(RECORD_TYPE_KEY)
+        tool_input = all_block_fields.get(TOOL_INPUT_KEY)
+        if block_type == TOOL_USE_BLOCK_TYPE and isinstance(tool_input, dict):
+            tool_name, all_tool_arguments = unwrapped_tool_call(str(all_block_fields.get(TOOL_NAME_KEY)), tool_input)
+            self.apply_tool_use(tool_name, str(all_block_fields.get(TASK_ID_KEY)), all_tool_arguments)
+        elif block_type == TOOL_RESULT_BLOCK_TYPE:
+            self.apply_tool_result(all_block_fields)
+
+    def apply_tool_use(self, tool_name: str, tool_use_id: str, all_input_fields: dict[str, object]) -> None:
+        if tool_name == TODO_WRITE_TOOL_NAME:
+            all_todo_entries = all_input_fields.get(TODOS_KEY)
+            is_merge = all_input_fields.get(TODO_MERGE_KEY) is True and self.latest_items is not None
+            self.latest_items = (
+                merged_todo_items(self.latest_items or [], all_todo_entries) if is_merge else _todo_items(all_todo_entries)
+            )
+            return
+        if tool_name == TASK_CREATE_TOOL_NAME:
+            self.subject_by_tool_use_id[tool_use_id] = str(all_input_fields.get(TASK_SUBJECT_KEY, ""))
+            return
+        if tool_name == TASK_UPDATE_TOOL_NAME:
+            self.apply_task_update(all_input_fields)
+
+    def apply_task_update(self, all_input_fields: dict[str, object]) -> None:
+        task_id = str(all_input_fields.get(TASK_UPDATE_ID_KEY, ""))
+        new_status = all_input_fields.get(TASK_STATUS_KEY)
+        if task_id in self.created_by_id and new_status:
+            self.created_by_id[task_id] = self.created_by_id[task_id]._replace(status=str(new_status))
+
+    def apply_tool_result(self, all_block_fields: dict[str, object]) -> None:
+        created_subject = self.subject_by_tool_use_id.pop(str(all_block_fields.get(TOOL_USE_ID_KEY)), None)
+        created_match = re.search(TASK_CREATED_PATTERN, _result_text(all_block_fields))
+        if created_subject is None or created_match is None:
+            return
+        created_id = created_match.group(CREATED_TASK_ID_GROUP_INDEX)
+        self.created_by_id[created_id] = TaskItem(created_id, created_subject, PENDING_STATUS)
+
+    def items(self) -> list[TaskItem] | None:
+        if self.created_by_id:
+            return list(self.created_by_id.values())
+        return self.latest_items
+
+
+def replayed_transcript(transcript_path: object) -> _TranscriptReplay:
+    """Fold every transcript record into one replay of the task list and the last assistant text."""
+    replay = _TranscriptReplay()
+    for each_record in _transcript_records(transcript_path):
+        replay.apply_record(each_record)
+    return replay
+
+
+def transcript_items(transcript_path: object) -> list[TaskItem] | None:
+    """Rebuild the task list from TaskCreate/TaskUpdate, TodoWrite, and Codex update_plan calls."""
+    return replayed_transcript(transcript_path).items()

package/hooks/blocking/test_open_tasks_stop_gate.py

@@ -0,0 +1,297 @@
+import io
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+import open_tasks_stop_gate
+
+GATE_PATH = Path(open_tasks_stop_gate.__file__)
+SESSION_ID = "s-123"
+
+
+@pytest.fixture(autouse=True)
+def isolated_home(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("USERPROFILE", str(tmp_path))
+    monkeypatch.delenv("CLAUDE_CONFIG_DIR", raising=False)
+    monkeypatch.delenv("CLAUDE_CODE_TASK_LIST_ID", raising=False)
+
+
+def run_gate(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+    reply_text: str,
+    transcript_path: Path | None = None,
+) -> tuple[int, str]:
+    hook_input: dict[str, object] = {
+        "hook_event_name": "Stop",
+        "session_id": SESSION_ID,
+        "stop_hook_active": False,
+        "last_assistant_message": reply_text,
+    }
+    if transcript_path is not None:
+        hook_input["transcript_path"] = str(transcript_path)
+    monkeypatch.setattr(
+        "sys.stdin", io.TextIOWrapper(io.BytesIO(json.dumps(hook_input).encode("utf-8")))
+    )
+    exit_code = open_tasks_stop_gate.main()
+    return exit_code, capsys.readouterr().out
+
+
+def write_task_store(home_directory: Path, all_tasks: list[dict[str, str]]) -> None:
+    task_directory = home_directory / ".claude" / "tasks" / SESSION_ID
+    task_directory.mkdir(parents=True)
+    for each_task in all_tasks:
+        (task_directory / f"{each_task['id']}.json").write_text(json.dumps(each_task), encoding="utf-8")
+
+
+def write_todo_transcript(transcript_path: Path, all_todos: list[dict[str, str]]) -> Path:
+    tool_use = {"type": "tool_use", "id": "t1", "name": "TodoWrite", "input": {"todos": all_todos}}
+    transcript_path.write_text(
+        json.dumps({"type": "assistant", "message": {"content": [tool_use]}}), encoding="utf-8"
+    )
+    return transcript_path
+
+
+def test_should_block_when_a_pending_task_is_not_reported(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    write_task_store(tmp_path, [{"id": "1", "subject": "Rotate the deploy key", "status": "pending"}])
+    exit_code, stdout_text = run_gate(monkeypatch, capsys, "All done.")
+    decision = json.loads(stdout_text)
+    assert exit_code == 0
+    assert decision["decision"] == "block"
+    assert "Rotate the deploy key" in decision["reason"]
+
+
+def test_should_allow_when_every_open_task_is_reported_as_blocked_or_open(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    write_task_store(
+        tmp_path,
+        [
+            {"id": "1", "subject": "Rotate the deploy key", "status": "pending"},
+            {"id": "2", "subject": "Wait on checks", "status": "in_progress"},
+            {"id": "3", "subject": "Write tests", "status": "completed"},
+        ],
+    )
+    reply_text = "Tests written.\nBlocked: Rotate the deploy key - the owner approves the secret\n- Open: #2 - checks running"
+    assert run_gate(monkeypatch, capsys, reply_text) == (0, "")
+
+
+def test_should_block_when_the_item_is_only_mentioned_in_prose(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    write_task_store(tmp_path, [{"id": "1", "subject": "Rotate the deploy key", "status": "pending"}])
+    _, stdout_text = run_gate(monkeypatch, capsys, "I will rotate the deploy key later.")
+    assert json.loads(stdout_text)["decision"] == "block"
+
+
+def test_should_allow_when_every_task_is_completed(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    write_task_store(tmp_path, [{"id": "1", "subject": "Rotate the deploy key", "status": "completed"}])
+    assert run_gate(monkeypatch, capsys, "Done.") == (0, "")
+
+
+def test_should_read_todowrite_from_the_transcript_when_no_task_store_exists(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = write_todo_transcript(
+        tmp_path / "s.jsonl",
+        [{"content": "Ship the fix", "status": "in_progress"}, {"content": "Lint", "status": "completed"}],
+    )
+    _, stdout_text = run_gate(monkeypatch, capsys, "Done.", transcript_path)
+    reason_text = json.loads(stdout_text)["reason"]
+    assert "Ship the fix" in reason_text
+    assert "Lint" not in reason_text
+
+
+def test_should_replay_taskcreate_and_taskupdate_from_the_transcript(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_records = [
+        {"type": "assistant", "message": {"content": [{"type": "tool_use", "id": "c1", "name": "TaskCreate", "input": {"subject": "Alpha"}}]}},
+        {"type": "user", "message": {"content": [{"type": "tool_result", "tool_use_id": "c1", "content": "Task #1 created successfully: Alpha"}]}},
+        {"type": "assistant", "message": {"content": [{"type": "tool_use", "id": "c2", "name": "TaskCreate", "input": {"subject": "Beta"}}]}},
+        {"type": "user", "message": {"content": [{"type": "tool_result", "tool_use_id": "c2", "content": "Task #2 created successfully: Beta"}]}},
+        {"type": "assistant", "message": {"content": [{"type": "tool_use", "id": "u1", "name": "TaskUpdate", "input": {"taskId": "1", "status": "completed"}}]}},
+    ]
+    transcript_path = tmp_path / "s.jsonl"
+    transcript_path.write_text("\n".join(json.dumps(each) for each in transcript_records), encoding="utf-8")
+    _, stdout_text = run_gate(monkeypatch, capsys, "Done.", transcript_path)
+    reason_text = json.loads(stdout_text)["reason"]
+    assert "Beta" in reason_text
+    assert "Alpha" not in reason_text
+
+
+def test_should_read_codex_update_plan_from_the_rollout(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    plan_arguments = json.dumps({"plan": [{"step": "Port the hook", "status": "pending"}]})
+    rollout_record = {"type": "response_item", "payload": {"type": "function_call", "name": "update_plan", "arguments": plan_arguments}}
+    transcript_path = tmp_path / "rollout.jsonl"
+    transcript_path.write_text(json.dumps(rollout_record), encoding="utf-8")
+    _, stdout_text = run_gate(monkeypatch, capsys, "Done.", transcript_path)
+    assert "Port the hook" in json.loads(stdout_text)["reason"]
+
+
+def test_should_allow_a_session_with_no_task_list(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    assert run_gate(monkeypatch, capsys, "Done.") == (0, "")
+
+
+def test_should_allow_malformed_stdin(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    monkeypatch.setattr("sys.stdin", io.TextIOWrapper(io.BytesIO(b"not json")))
+    assert (open_tasks_stop_gate.main(), capsys.readouterr().out) == (0, "")
+
+
+def test_should_block_through_a_subprocess_with_the_documented_contract(tmp_path: Path) -> None:
+    write_task_store(tmp_path, [{"id": "1", "subject": "Rotate the deploy key", "status": "pending"}])
+    hook_input = {"hook_event_name": "Stop", "session_id": SESSION_ID, "last_assistant_message": "Done."}
+    completed_process = subprocess.run(
+        [sys.executable, str(GATE_PATH)],
+        input=json.dumps(hook_input),
+        capture_output=True,
+        text=True,
+        env={"HOME": str(tmp_path), "USERPROFILE": str(tmp_path), "PATH": ""},
+        check=False,
+    )
+    assert completed_process.returncode == 0
+    assert json.loads(completed_process.stdout)["decision"] == "block"
+
+
+def write_cursor_transcript(transcript_path: Path, all_records: list[dict[str, object]]) -> Path:
+    transcript_path.write_text("\n".join(json.dumps(each_record) for each_record in all_records), encoding="utf-8")
+    return transcript_path
+
+
+def cursor_todo_record(all_todos: list[dict[str, str]], is_merge: bool, reply_text: str) -> dict[str, object]:
+    tool_use = {"type": "tool_use", "name": "TodoWrite", "input": {"todos": all_todos, "merge": is_merge}}
+    return {"role": "assistant", "message": {"content": [{"type": "text", "text": reply_text}, tool_use]}}
+
+
+def run_cursor_gate(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+    transcript_path: Path,
+    stop_status: str = "completed",
+    loop_count: int = 0,
+) -> dict[str, str]:
+    hook_input = {
+        "hook_event_name": "stop",
+        "conversation_id": "c-1",
+        "status": stop_status,
+        "loop_count": loop_count,
+        "transcript_path": str(transcript_path),
+    }
+    monkeypatch.setattr("sys.stdin", io.TextIOWrapper(io.BytesIO(json.dumps(hook_input).encode("utf-8"))))
+    open_tasks_stop_gate.main()
+    printed_output = capsys.readouterr().out
+    return json.loads(printed_output) if printed_output else {}
+
+
+def test_should_send_a_cursor_followup_when_a_merged_todo_stays_pending(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    all_first_todos = [
+        {"id": "1", "content": "write hello.txt", "status": "in_progress"},
+        {"id": "2", "content": "rotate the deploy key", "status": "pending"},
+    ]
+    transcript_path = write_cursor_transcript(
+        tmp_path / "cursor.jsonl",
+        [
+            cursor_todo_record(all_first_todos, False, "Starting."),
+            cursor_todo_record([{"id": "1", "status": "completed"}], True, "Done."),
+        ],
+    )
+    block_output = run_cursor_gate(monkeypatch, capsys, transcript_path)
+    assert "rotate the deploy key" in block_output["followup_message"]
+    assert "write hello.txt" not in block_output["followup_message"]
+    assert block_output["decision"] == "block"
+
+
+@pytest.mark.parametrize("stop_status", ["aborted", "error"])
+def test_should_allow_a_cursor_stop_the_user_aborted_or_that_errored(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path, stop_status: str
+) -> None:
+    all_todos = [{"id": "2", "content": "rotate the deploy key", "status": "pending"}]
+    transcript_path = write_cursor_transcript(
+        tmp_path / "cursor.jsonl", [cursor_todo_record(all_todos, False, "Stopping.")]
+    )
+    assert run_cursor_gate(monkeypatch, capsys, transcript_path, stop_status) == {}
+
+
+def test_should_allow_cursor_when_the_last_assistant_text_reports_the_item(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    all_todos = [{"id": "2", "content": "rotate the deploy key", "status": "pending"}]
+    transcript_path = write_cursor_transcript(
+        tmp_path / "cursor.jsonl",
+        [
+            cursor_todo_record(all_todos, False, "Working."),
+            {"role": "assistant", "message": {"content": [
+                {"type": "text", "text": "Blocked: rotate the deploy key - the owner must approve the org secret"}
+            ]}},
+        ],
+    )
+    assert run_cursor_gate(monkeypatch, capsys, transcript_path) == {}
+
+
+def test_should_leave_claude_block_output_without_a_followup_message(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = write_todo_transcript(
+        tmp_path / "t.jsonl", [{"content": "rotate the deploy key", "status": "pending"}]
+    )
+    _, printed_output = run_gate(monkeypatch, capsys, "Done.", transcript_path)
+    assert set(json.loads(printed_output)) == {"decision", "reason"}
+
+
+def cursor_dynamic_todo_record(all_todos: list[dict[str, str]], is_merge: bool) -> dict[str, object]:
+    tool_use = {
+        "type": "tool_use",
+        "name": "CallDynamicTool",
+        "input": {"namespace": "cursor", "toolName": "TodoWrite", "arguments": {"merge": is_merge, "todos": all_todos}},
+    }
+    return {"role": "assistant", "message": {"content": [tool_use]}}
+
+
+def test_should_read_todos_the_cursor_cli_writes_through_call_dynamic_tool(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    all_first_todos = [
+        {"id": "1", "content": "write hello.txt", "status": "in_progress"},
+        {"id": "2", "content": "rotate the deploy key", "status": "pending"},
+    ]
+    all_merged_todos = [
+        {"id": "1", "content": "write hello.txt", "status": "completed"},
+        {"id": "2", "content": "rotate the deploy key", "status": "pending"},
+    ]
+    transcript_path = write_cursor_transcript(
+        tmp_path / "cursor.jsonl",
+        [
+            cursor_dynamic_todo_record(all_first_todos, False),
+            cursor_dynamic_todo_record(all_merged_todos, True),
+            {"role": "assistant", "message": {"content": [{"type": "text", "text": "Done."}]}},
+            {"type": "turn_ended", "status": "success"},
+        ],
+    )
+    block_output = run_cursor_gate(monkeypatch, capsys, transcript_path)
+    assert "rotate the deploy key" in block_output["followup_message"]
+    assert "write hello.txt" not in block_output["followup_message"]
+
+
+def test_should_allow_a_cursor_stop_after_five_followups(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    all_todos = [{"id": "2", "content": "rotate the deploy key", "status": "pending"}]
+    transcript_path = write_cursor_transcript(tmp_path / "cursor.jsonl", [cursor_todo_record(all_todos, False, "Done.")])
+    assert "rotate the deploy key" in run_cursor_gate(monkeypatch, capsys, transcript_path, loop_count=4)["followup_message"]
+    assert run_cursor_gate(monkeypatch, capsys, transcript_path, loop_count=5) == {}

package/hooks/blocking/test_open_tasks_transcript.py

@@ -0,0 +1,54 @@
+import json
+from pathlib import Path
+
+from open_tasks_transcript import TaskItem, parsed_object, replayed_transcript, unwrapped_tool_call
+
+
+def write_transcript(transcript_path: Path, all_records: list[dict[str, object]]) -> Path:
+    transcript_path.write_text("\n".join(json.dumps(each_record) for each_record in all_records), encoding="utf-8")
+    return transcript_path
+
+
+def dynamic_todo_record(all_todos: list[dict[str, str]], is_merge: bool) -> dict[str, object]:
+    tool_use = {
+        "type": "tool_use",
+        "name": "CallDynamicTool",
+        "input": {"namespace": "cursor", "toolName": "TodoWrite", "arguments": {"merge": is_merge, "todos": all_todos}},
+    }
+    return {"role": "assistant", "message": {"content": [tool_use]}}
+
+
+def test_should_unwrap_a_call_dynamic_tool_todo_write_call() -> None:
+    all_arguments = {"merge": False, "todos": []}
+    wrapped_input = {"namespace": "cursor", "toolName": "TodoWrite", "arguments": all_arguments}
+    assert unwrapped_tool_call("CallDynamicTool", wrapped_input) == ("TodoWrite", all_arguments)
+    assert unwrapped_tool_call("Read", wrapped_input) == ("Read", wrapped_input)
+    assert unwrapped_tool_call("CallDynamicTool", {"toolName": "TodoWrite"}) == ("CallDynamicTool", {"toolName": "TodoWrite"})
+
+
+def test_should_replay_cursor_dynamic_todo_writes_and_the_last_reply(tmp_path: Path) -> None:
+    all_first_todos = [
+        {"id": "1", "content": "write hello.txt", "status": "in_progress"},
+        {"id": "2", "content": "rotate the deploy key", "status": "pending"},
+    ]
+    transcript_path = write_transcript(
+        tmp_path / "cursor.jsonl",
+        [
+            dynamic_todo_record(all_first_todos, False),
+            dynamic_todo_record([{"id": "1", "content": "write hello.txt", "status": "completed"}], True),
+            {"role": "assistant", "message": {"content": [{"type": "text", "text": "Done."}]}},
+            {"type": "turn_ended", "status": "success"},
+        ],
+    )
+    replay = replayed_transcript(str(transcript_path))
+    assert replay.items() == [
+        TaskItem("1", "write hello.txt", "completed"),
+        TaskItem("2", "rotate the deploy key", "pending"),
+    ]
+    assert replay.last_assistant_text == "Done."
+
+
+def test_should_parse_only_json_objects() -> None:
+    assert parsed_object('{"a": 1}') == {"a": 1}
+    assert parsed_object("[1]") is None
+    assert parsed_object("not json") is None

package/hooks/features/conduct-gates.md

@@ -6,6 +6,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 
 - `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link. It denies a sentence that guesses, estimates, hedges a duration, or admits a skipped check, such as "I didn't confirm this one." It denies a cited Actions run, pull request, or run, job, or check id that no successful tool result in the transcript shows; a subagent's report is the result of its Agent call. A question card from `AskUserQuestion` gets the banned word check and `unvalidated_claim_violation`, like a decision card. With visual reply mode on, it also runs the checks in `visual_reply_rules.py` from the rule list in `rules/visual-reply-rules.json`: no abbreviation or tracker number outside a link, a widget or page before a reply of more than one sentence, and no anchor link inside widget code. The mode is off by default; `~/.claude/visual-reply-mode.json` with `{"enabled": true}` turns the mode checks on.
 - `blocking/final_reply_gate.py` applies the banned words, `unvalidated_claim_violation`, and `unseen_citation_violation` from the reply gate to the reply a session ends its turn with.
+- `blocking/open_tasks_stop_gate.py` holds the end of a turn while the session task list has items that are neither completed nor named on a `Blocked:` or `Open:` line of the closing reply. `blocking/open_tasks_transcript.py` rebuilds the task list and the last reply from the transcript for it.
 - The claim judge is a `prompt` hook in `hooks.json`, with no `model` set, so Claude Code's small default hook model reads each chat message and denies the first claim about how code, a file, a tool, a service, a run, or a process behaves, or why something happened, when nothing in the message shows it: inline code that quotes output or a code line, a file and line, or a link. A pull request link covers what that change does, what it blocks or lets through, and its checks. The author's own actions, a restatement of the user's words, questions, instructions, and a decision card's option consequences pass. It catches the plain claims the causal word list in `blocking/reply_length_gate.py` misses, such as "The code lets any of them rewrite it mid-check." `continueOnBlock` returns the reason to the agent as the tool error, so it can add the source and send again. The installer owns it through the `claude-dev-env: ` prefix on its `statusMessage`. It skips `post_widget`, whose input is SVG or HTML markup.
 - `blocking/chat_reply_gate.py` runs the `reply_length_gate.py` reply checks on a plain chat reply, which is no tool call. On `UserPromptSubmit` it adds the reply rules as `additionalContext`. On `MessageDisplay` it holds each streamed batch until the message ends. A message that passes shows whole. A message that fails shows as a draft from `claude -p` on Haiku that passes the same checks, and the original shows when two drafts fail. The draft changes only the text on screen, so the next `UserPromptSubmit` tells the agent the text the user saw, and `SessionEnd` deletes the stored draft. The [reply arena harness](https://github.com/jl-cmd-projects/claude-dev-env/tree/160349b90f627ea542fc6bc7b2b7f86dcbf98b73/tests/reply_arena) ran the comparison that chose this display path.
 - `blocking/edit_marker_gate.py` rejects strikethrough and edit-note markers in replacement chat text or cards.
@@ -23,6 +24,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 
 - `blocking/reply_length_gate.py` runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__update_message|mcp__hearthbot__ask_decision|AskUserQuestion|mcp__hearthbot__post_widget`, timeout `10` seconds in `hooks.json`.
 - `blocking/final_reply_gate.py` runs on `Stop`, timeout `10` seconds in `hooks.json`.
+- `blocking/open_tasks_stop_gate.py` runs on `Stop`, timeout `10` seconds in `hooks.json`. The installer also registers it on Codex `Stop` and as a native Cursor `stop` entry in `~/.cursor/hooks.json`, where a block also returns `followup_message`. A Cursor stop with status `aborted` or `error` passes. A Cursor stop whose `loop_count` is 5 or more passes, because a copy Cursor imports from `~/.claude/settings.json` has no follow-up limit.
 - The claim judge runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__update_message|mcp__hearthbot__ask_decision`, timeout `30` seconds in `hooks.json`.
 - `blocking/chat_reply_gate.py` runs on `UserPromptSubmit`, matcher empty, timeout `10` seconds, on `MessageDisplay`, timeout `100` seconds, and on `SessionEnd`, timeout `3` seconds, in `hooks.json`.
 - `blocking/edit_marker_gate.py` runs on `PreToolUse`, matcher `mcp__.*__update_message`, timeout `10` seconds in `hooks.json`.
@@ -44,6 +46,7 @@ Preconditions:
 
 - **Reply length.** Input is a reply with four sentences, a plain pull request number, an abbreviation, two sentences with no widget this turn, or widget code with an anchor link. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_reply_length_gate.py -q`. The adjacent test observes a denial and its count, link, or mode reason. Widget code with no flowchart passes with a flowchart reminder in `additionalContext`.
 - **Final reply.** Input is a closing reply that says "My guess is one to two hours." or cites a run no tool result shows. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_final_reply_gate.py -q`. The adjacent test observes a `block` decision that quotes the sentence or the citation; a reply that cites a run a tool result shows passes.
+- **Open tasks.** Input is a session whose task list still has "rotate the deploy key" pending and a closing reply of "Done.". Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_open_tasks_stop_gate.py -q`. The adjacent test observes a `block` decision that names the item; a reply line `Blocked: rotate the deploy key - <what the user must give>` passes.
 - **Claim judge.** Input is a headless `claude -p` session with a stub MCP server named `hearthbot` that exposes `reply` and `ask_decision`, told to send "The code lets any of them rewrite it mid-check." The session settings add the `hooks.json` prompt hook. The stub logs zero bytes sent, and the tool error reads `PreToolUse:mcp__hearthbot__reply hook error: [<the prompt>]: Fact with no source: ...`. The same sentence with a `file:line` in backticks posts. A hook whose `model` Claude Code does not recognize lets every message through, so leave `model` unset. Run `node --test packages/claude-dev-env/bin/install.prompt-hook.test.mjs` for the installer side; it observes one managed prompt hook after two installs and none after uninstall.
 - **Chat reply.** Input is a `MessageDisplay` event whose message holds four sentences, the same message split over two batches, and a `UserPromptSubmit` event. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_chat_reply_gate.py -q`. The adjacent test observes the drafter's text in `displayContent`, an empty first batch, no output for three sentences, the original after two failed drafts, the shown draft in the next `additionalContext`, and the stored draft deleted at session end.
 - **Edit marker.** Input is an update message with strikethrough or an edit note. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_edit_marker_gate.py -q`. The adjacent test observes a denial; clean replacement text passes.

package/hooks/hooks.json

@@ -379,6 +379,11 @@
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/final_reply_gate.py",
             "timeout": 10
+          },
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/open_tasks_stop_gate.py",
+            "timeout": 10
           }
         ]
       }