claude-dev-env 8.92.0 → 8.92.2

package/.agents/skills/e-code-review/SKILL.md

@@ -8,7 +8,7 @@ description: >-
 
 # e-code-review
 
-**Pick a level, load its file, run it.** Each file has the same steps, angles, caps, and fields as the built-in `/code-review` recipe for that level. Only the wording differs, where this repo's prose rules require it.
+**Pick a level, load its file, run it.** Each file has the same steps, angles, caps, and fields as the built-in `/code-review` recipe for that level. Only the wording differs, where this repo's prose rules require it. A question about `/code-review` asks about the built-in recipe, so answer it from the built-in text and use these files only for `/e-code-review`.
 
 | Level | File | Shape |
 |---|---|---|

package/.agents/skills/efficient-review/SKILL.md

@@ -21,7 +21,7 @@ When the plan runtime is `other`, the model is deferred. The running agent appli
 
 ## Loop
 
-Check each finding against the code. Fix every one that holds. Run the review again until a pass reports none. The steps are in [reference/criteria.md](reference/criteria.md).
+Check each finding against the code. Fix every one that holds. Run the review again until a pass reports none. Before a merge, [the pr-lifecycle review loop](../pr-lifecycle/reference/review-loop-before-merge.md) sets how many full passes run. The steps are in [reference/criteria.md](reference/criteria.md).
 
 ## Reading guide
 

package/.agents/skills/efficient-review/reference/criteria.md

@@ -18,4 +18,4 @@ An empty list is a valid review. End with a json block. Each finding has `file`,
 
 ## Loop
 
-Fix every finding that holds, including a file the diff did not touch. Then run the review again. Stop when a pass reports no finding that holds.
+Fix every finding that holds, including a file the diff did not touch. Then run the review again. Stop when a pass reports no finding that holds. Before a merge, [the pr-lifecycle review loop](../../pr-lifecycle/reference/review-loop-before-merge.md) sets how many full passes run.

package/.agents/skills/pr-lifecycle/reference/review-loop-before-merge.md

@@ -2,10 +2,11 @@
 
 A pull request the agent made merges only after a code review of its head comes back clean. Loop it:
 
-1. Review the head with the command `CLAUDE_MERGE_REVIEW_COMMAND` names. Where it is unset, run `/code-review high --max-findings all` against the base.
+1. Review the head with the command `CLAUDE_MERGE_REVIEW_COMMAND` names. Where it is unset, run `/code-review high --max-findings all` against the base. This is a full pass.
 2. Record the pass: `python3 ~/.claude/scripts/merge_review_receipt.py <owner>/<name> <number> <head sha> <finding count>`.
 3. Fix every valid finding, push, and review the new head. Answer each finding you rule out on the pull request with its file:line evidence.
-4. Repeat until a pass records `CLEAN`. A pass whose every finding is ruled out records `CLEAN` with `--ruled-out <finding count> --rulings <link to the rulings comment on this pull request>`.
-5. Merge pinned to that head: `expectedHeadSha` on the merge tool, or `--match-head-commit` on `gh pr merge`.
+4. The first three passes are full passes. Each later pass is `/code-review low --fix <number>`. It reads only the pull request's diff against its base and leaves its fixes uncommitted. Name the number: after a push, a bare `/code-review low` diffs the branch against its own upstream and sees nothing. Commit and push those fixes, then run the next pass on the new head. A pass that reported findings records its finding count, even when `--fix` fixed them all.
+5. Repeat until a pass records `CLEAN`. A pass whose every finding is ruled out records `CLEAN` with `--ruled-out <finding count> --rulings <link to the rulings comment on this pull request>`.
+6. Merge pinned to that head: `expectedHeadSha` on the merge tool, or `--match-head-commit` on `gh pr merge`.
 
 `hooks/blocking/merge_review_gate.py` denies any other merge. In a merge-queue repository, enqueue with `gh pr merge <number> --repo <owner>/<name> --auto --match-head-commit <head sha>`; auto-merge that names no head is denied. A repository whose own CI and merge queue review and merge its pull requests is listed in `CLAUDE_MERGE_REVIEW_EXEMPT_REPOSITORIES`, comma separated as `owner/name`, and skips the gate.

package/hooks/advisory/test_owned_pr_review_loop.py

@@ -281,6 +281,8 @@ def test_should_name_every_step_and_skill_in_the_context() -> None:
     )
     assert "jl-cmd-projects/claude-dev-env#42" in context
     assert "efficient-review" in context
+    assert "three full passes" in context
+    assert "/code-review low --fix 42" in context
     assert "gh pr ready 42 --repo jl-cmd-projects/claude-dev-env" in context
     assert "poteto-mode/playbooks/babysit.md" in context
     assert "poteto-mode/playbooks/shipping.md" in context

package/hooks/blocking/final_reply_gate.py

@@ -11,15 +11,21 @@ session ends its turn with, which reaches the user with no tool call::
 
 It applies the banned words, the unvalidated claim pattern, and the cited
 run, job, check, and pull request numbers from ``reply_length_gate.py``. The
-citation check is skipped when the transcript cannot be read. A block sends
+citation check is skipped when the transcript cannot be read. It also flags
+a path outside code whose backslash the terminal drops, such as
+``D:\\Reports\\.claude``. A block sends
 the reason back so the model rewrites the reply. Claude Code ends the turn
 after eight blocks in a row.
 """
 
 from __future__ import annotations
 
+import bisect
+import functools
 import json
+import re
 import sys
+from collections.abc import Callable
 from pathlib import Path
 
 hooks_root_directory = str(Path(__file__).resolve().parent.parent)
@@ -36,22 +42,187 @@ from hooks_constants.hook_block_logger import log_hook_block
 from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
 from hooks_constants.final_reply_gate_constants import (
     ALLOW_EXIT_CODE,
+    BACKSLASH,
+    BACKSLASHES_PER_LITERAL,
+    BACKTICK_RUN_PATTERN,
+    BLOCK_BOUNDARY_PATTERN,
     BLOCK_DECISION,
+    CARRIAGE_RETURN_LINE_BREAK,
     DECISION_KEY,
+    ESCAPED_PUNCTUATION_PATTERN,
+    FENCE_CLOSER_PREFIX,
+    FENCE_CLOSER_SUFFIX,
+    FENCE_OPENER_PATTERN,
+    HARD_BREAK_PATTERN,
+    HEADING_AS_OWN_BLOCK,
+    HEADING_LINE_PATTERN,
     HOOK_EVENT_NAME,
+    ALL_HTML_BLOCK_CLOSER_PATTERNS,
+    HTML_BLOCK_OPENER_PATTERN,
     LAST_ASSISTANT_MESSAGE_KEY,
+    LINE_BREAK,
+    MASKED_BLOCK_TEXT,
+    MASKED_CODE_TEXT,
+    NON_SPACE_TOKEN_PATTERN,
+    PARAGRAPH_SEPARATOR,
+    QUOTE_MARKER,
+    QUOTE_MARKER_PATTERN,
     REASON_KEY,
     REWRITE_INSTRUCTION,
     TRANSCRIPT_PATH_KEY,
+    WINDOWS_PATH_MESSAGE,
 )
 
 
+def _unescaped_start(paragraph_text: str, run_start: int) -> int:
+    backslash_start = run_start
+    while backslash_start > 0 and paragraph_text[backslash_start - 1] == BACKSLASH:
+        backslash_start -= 1
+    return run_start + (run_start - backslash_start) % BACKSLASHES_PER_LITERAL
+
+
+def code_spans_masked(paragraph_text: str) -> str:
+    """Return the paragraph with one space where each code span sat.
+
+    A backtick run opens a span unless an odd run of backslashes escapes its
+    first backtick. The span closes at the next run of the same length::
+
+        >>> code_spans_masked("see `a\\\\.b` and \\\\`x")
+        'see   and \\\\`x'
+    """
+    all_runs = [each_run.span() for each_run in BACKTICK_RUN_PATTERN.finditer(paragraph_text)]
+    all_run_indexes_by_length: dict[int, list[int]] = {}
+    for each_index, (each_run_start, each_run_end) in enumerate(all_runs):
+        all_run_indexes_by_length.setdefault(each_run_end - each_run_start, []).append(each_index)
+    all_masked_pieces: list[str] = []
+    copied_up_to = 0
+    run_index = 0
+    while run_index < len(all_runs):
+        run_start, run_end = all_runs[run_index]
+        opener_start = _unescaped_start(paragraph_text, run_start)
+        same_length_indexes = all_run_indexes_by_length.get(run_end - opener_start, [])
+        closer_position = bisect.bisect_right(same_length_indexes, run_index)
+        if opener_start == run_end or closer_position == len(same_length_indexes):
+            run_index += 1
+            continue
+        closer_index = same_length_indexes[closer_position]
+        all_masked_pieces.extend((paragraph_text[copied_up_to:opener_start], MASKED_CODE_TEXT))
+        copied_up_to = all_runs[closer_index][1]
+        run_index = closer_index + 1
+    all_masked_pieces.append(paragraph_text[copied_up_to:])
+    return "".join(all_masked_pieces)
+
+
+@functools.cache
+def _fence_closer_pattern(fence_text: str) -> re.Pattern[str]:
+    return re.compile(
+        FENCE_CLOSER_PREFIX + re.escape(fence_text) + re.escape(fence_text[0]) + FENCE_CLOSER_SUFFIX,
+        re.MULTILINE,
+    )
+
+
+def _fence_closer_for(opener: re.Match[str]) -> re.Pattern[str]:
+    return _fence_closer_pattern(opener.group(1) or opener.group(2))
+
+
+def _html_block_closer_for(opener: re.Match[str]) -> re.Pattern[str]:
+    return ALL_HTML_BLOCK_CLOSER_PATTERNS[opener.lastgroup or ""]
+
+
+def blocks_masked(
+    text: str,
+    opener_pattern: re.Pattern[str],
+    closer_for: Callable[[re.Match[str]], re.Pattern[str]],
+) -> str:
+    """Return the text with a blank line where each closed block sat.
+
+    A block runs from an opener to the first closer after it. An opener with
+    no closer stays in the text, and a closer search that found nothing is
+    not run again, so the scan stays linear::
+
+        >>> blocks_masked("a\\n<!--\\nb\\n-->\\nc", HTML_BLOCK_OPENER_PATTERN, _html_block_closer_for)
+        'a\\n\\n\\n\\nc'
+    """
+    all_masked_pieces: list[str] = []
+    all_closer_misses: dict[re.Pattern[str], int] = {}
+    copied_up_to = 0
+    search_from = 0
+    while (opener := opener_pattern.search(text, search_from)) is not None:
+        closer_pattern = closer_for(opener)
+        is_closer_possible = opener.end() < all_closer_misses.get(closer_pattern, len(text) + 1)
+        closer = closer_pattern.search(text, opener.end()) if is_closer_possible else None
+        if closer is None:
+            all_closer_misses.setdefault(closer_pattern, opener.end())
+            search_from = max(opener.end(), opener.start() + 1)
+            continue
+        all_masked_pieces.extend((text[copied_up_to : opener.start()], MASKED_BLOCK_TEXT))
+        copied_up_to = search_from = closer.end()
+    all_masked_pieces.append(text[copied_up_to:])
+    return "".join(all_masked_pieces)
+
+
+def quotes_unwrapped(text: str) -> str:
+    """Return the text with each quote marker removed.
+
+    Lines of one quote form one paragraph, so their markers go. A line that
+    goes deeper into a quote starts a new paragraph, and an unmarked line
+    continues the quote above it::
+
+        >>> quotes_unwrapped("> a\\n>> b\\nc")
+        '\\na\\n\\nb\\nc'
+    """
+    all_lines: list[str] = []
+    previous_depth = 0
+    for each_line in text.split(LINE_BREAK):
+        marker = QUOTE_MARKER_PATTERN.match(each_line)
+        marker_text = marker.group() if marker else ""
+        depth = marker_text.count(QUOTE_MARKER)
+        if depth > previous_depth:
+            all_lines.append("")
+        content_text = each_line[len(marker_text) :]
+        if depth or not content_text.strip():
+            previous_depth = depth
+        all_lines.append(content_text)
+    return LINE_BREAK.join(all_lines)
+
+
+def windows_path_violation(reply_text: str) -> str | None:
+    """Return the block reason for a path the terminal renders wrong, or None.
+
+    The terminal reads a backslash before punctuation as a markdown escape
+    and drops it. A path outside a code span loses that backslash::
+
+        flag: The report is at D:\\Reports\\.claude\\report.html now.
+              (the terminal shows D:\\Reports.claude\\report.html)
+        flag: Open D:\\Shared Files\\.claude\\x.html now.
+        ok:   The report is at `D:\\Reports\\.claude\\report.html` now.
+        ok:   The report is at D:\\Reports\\report.html now.
+    """
+    line_feed_text = reply_text.replace(CARRIAGE_RETURN_LINE_BREAK, LINE_BREAK)
+    unfenced_text = blocks_masked(line_feed_text, FENCE_OPENER_PATTERN, _fence_closer_for)
+    unfenced_text = blocks_masked(unfenced_text, HTML_BLOCK_OPENER_PATTERN, _html_block_closer_for)
+    unfenced_text = quotes_unwrapped(unfenced_text)
+    unfenced_text = HEADING_LINE_PATTERN.sub(HEADING_AS_OWN_BLOCK, unfenced_text)
+    prose_text = PARAGRAPH_SEPARATOR.join(
+        code_spans_masked(each_paragraph)
+        for each_paragraph in BLOCK_BOUNDARY_PATTERN.split(unfenced_text)
+    )
+    for each_token_match in NON_SPACE_TOKEN_PATTERN.finditer(prose_text):
+        token_text = each_token_match.group()
+        is_line_end = prose_text.startswith(LINE_BREAK, each_token_match.end())
+        is_hard_break = is_line_end and HARD_BREAK_PATTERN.search(token_text) is not None
+        if is_hard_break or ESCAPED_PUNCTUATION_PATTERN.search(token_text) is not None:
+            return WINDOWS_PATH_MESSAGE.format(path=token_text)
+    return None
+
+
 def final_reply_violation(reply_text: str, transcript_path: object) -> str | None:
     """Return the block reason for the closing reply, or None when it passes."""
     return (
         banned_word_violation(reply_text, configured_banned_words())
         or unvalidated_claim_violation(reply_text)
         or unseen_citation_violation(reply_text, transcript_path)
+        or windows_path_violation(reply_text)
     )
 
 

package/hooks/blocking/test_final_reply_gate.py

@@ -9,6 +9,10 @@ import final_reply_gate
 GUESSED_REPLY = "My guess is one to two hours if those builds pass first time."
 UNCONFIRMED_REPLY = "Merge queue: I didn\u2019t confirm this one."
 MEASURED_REPLY = "The last queue build took 39 minutes, run 18239174012."
+INSIGHTS_REPLY = (
+    "Your shareable insights report is ready:\n"
+    "file://C:\\Reports\\.claude-profiles\\org\\usage-data\\report-2026-10-20-094705.html"
+)
 
 
 def run_gate(
@@ -92,3 +96,129 @@ def test_should_allow_a_closing_reply_with_no_message(
 
 def test_should_return_none_for_a_measured_reply_without_a_transcript() -> None:
     assert final_reply_gate.final_reply_violation(MEASURED_REPLY, None) is None
+
+
+@pytest.mark.parametrize(
+    ("reply_text", "quoted_text"),
+    [
+        (INSIGHTS_REPLY, 'Path "file://C:\\Reports\\.claude-profiles'),
+        ("The report is at C:\\Reports\\.claude\\report.html now.", 'Path "C:\\Reports'),
+        ("Run C:\\Tools\\-v\\x.exe once.", 'Path "C:\\Tools\\-v'),
+        ("Wait ~~~ then open C:\\Reports\\.claude\\r.html now.", 'Path "C:\\Reports'),
+        ("Wait ``` then open C:\\Reports\\.claude\\r.html now.", 'Path "C:\\Reports'),
+        ("Escaped \\` then C:\\Reports\\.claude\\r.html then `x`.", 'Path "\\`"'),
+        ("Open C:\\Shared Files\\.claude\\x.html now.", 'Path "Files\\.claude'),
+        ("Open `C:\\Reports`\\.claude\\x.html now.", 'Path "\\.claude'),
+        ("Saved to C:\\Reports\\..\\out\\x.html now.", 'Path "C:\\Reports'),
+        ("Saved to D:\\Reports\\. now", 'Path "D:\\Reports\\."'),
+        ("Saved to D:\\Reports\\\\\\.claude now", 'Path "D:\\Reports'),
+        ("```\n```python\n```\nOpen C:\\Reports\\.claude\\x.html now.\n```", 'Path "C:\\Reports'),
+        ("Check `this\nand `C:\\Reports\\.claude\\r.html` now.", 'Path "C:\\Reports'),
+        ("```foo` bar\nOpen C:\\Reports\\.claude\\r.html now.", 'Path "C:\\Reports'),
+        ("Saved to D:\\Reports\\\n.claude\\x.html now.", 'Path "D:\\Reports\\"'),
+        ("\\\\`x` now C:\\Reports\\.claude\\r.html and `y`", 'Path "C:\\Reports'),
+        ("Check `this\n\nand C:\\Reports\\.claude\\r.html` now.", 'Path "C:\\Reports'),
+        ("- Stray ` here\n- Saved to D:\\Reports\\.claude\\r.html\n- Run `x`", 'Path "D:\\Reports'),
+        ("# Stray ` here\nSaved to D:\\Reports\\.claude\\r.html `x`", 'Path "D:\\Reports'),
+        ("Check `this\n2. and `C:\\Reports\\.claude\\r.html` now.", 'Path "C:\\Reports'),
+        ("Check `this\n    - and `C:\\Reports\\.claude\\r.html` now.", 'Path "C:\\Reports'),
+        ("Check `this\n    # and `C:\\Reports\\.claude\\r.html` now.", 'Path "C:\\Reports'),
+        ("Check `this\n\t# and `C:\\Reports\\.claude\\r.html` now.", 'Path "C:\\Reports'),
+        ("Check `this\n---\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n===\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n* * *\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n___\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n<!-- note -->\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n<details>\n\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n<span>a` and C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("<!-- ` -->\nSaved to C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n```\ncode\n```\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("- ```bash\n  echo hi\n  ```\nSaved to D:\\Reports\\.claude\\r.html now.", 'Path "D:\\Reports'),
+        ("```\nC:\\Reports\\.claude\\open.html", 'Path "C:\\Reports'),
+        ("> stray ` here\n> and `C:\\Reports\\.claude\\r.html` now", 'Path "C:\\Reports'),
+        ("> stray `\n>> and C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("> stray `\nlazy\n> and `C:\\Reports\\.claude\\r.html` now", 'Path "C:\\Reports'),
+        ("```\r\ncode\r\n```\r\nOpen C:\\Reports\\.claude\\r.html now.", 'Path "C:\\Reports'),
+    ],
+)
+def test_should_block_a_windows_path_markdown_mangles(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+    reply_text: str,
+    quoted_text: str,
+) -> None:
+    _, stdout_text = run_gate(monkeypatch, capsys, reply_text)
+    decision = json.loads(stdout_text)
+    assert decision["decision"] == "block"
+    assert quoted_text in decision["reason"]
+
+
+@pytest.mark.parametrize(
+    "reply_text",
+    [
+        "Open `file:///C:/Reports/.claude/report.html` now.",
+        "The report is at `C:\\Reports\\.claude\\report.html` now.",
+        "Paths:\n```text\nC:\\Reports\\.claude\\report.html\n```",
+        "The report is at C:\\Reports\\report.html now.",
+        "The report is at C:\\\\Reports\\\\.claude\\\\report.html now.",
+        "The report is at ``C:\\Reports\\.claude\\report.html`` now.",
+        "Paths:\n~~~\nC:\\Reports\\.claude\\report.html\n~~~",
+        "Paths `C:\\Reports\\.claude\nreport.html` here.",
+        "<pre>\nC:\\Reports\\.claude\\report.html\n</pre>",
+        "> Saved to `C:\\Reports\\.claude\\report.html`\n> now.",
+    ],
+)
+def test_should_allow_a_windows_path_inside_code(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], reply_text: str
+) -> None:
+    assert run_gate(monkeypatch, capsys, reply_text) == (0, "")
+
+
+@pytest.mark.parametrize(
+    ("text", "masked_text"),
+    [
+        ("a\n<!--\nb\n-->\nc", "a\n\n\n\nc"),
+        ("a\n<!--\nb\nc", "a\n<!--\nb\nc"),
+        ("<!--\n<!--\nb -->\nc", "\n\n\nc"),
+        ("<details>\nb\n\nc", "\n\n\n\nc"),
+    ],
+)
+def test_should_mask_html_blocks_only_where_they_close(text: str, masked_text: str) -> None:
+    assert (
+        final_reply_gate.blocks_masked(
+            text,
+            final_reply_gate.HTML_BLOCK_OPENER_PATTERN,
+            final_reply_gate._html_block_closer_for,
+        )
+        == masked_text
+    )
+
+
+@pytest.mark.parametrize(
+    ("text", "unwrapped_text"),
+    [
+        ("> a\n> b", "\na\nb"),
+        ("> a\n>> b", "\na\n\nb"),
+        ("> a\nb\n> c", "\na\nb\nc"),
+        ("> a\n\n> b", "\na\n\n\nb"),
+        ("plain", "plain"),
+    ],
+)
+def test_should_unwrap_quotes_into_their_paragraphs(text: str, unwrapped_text: str) -> None:
+    assert final_reply_gate.quotes_unwrapped(text) == unwrapped_text
+
+
+@pytest.mark.parametrize(
+    ("paragraph_text", "masked_text"),
+    [
+        ("see `a\\.b` and more", "see   and more"),
+        ("\\`x` stays", "\\`x` stays"),
+        ("\\\\`x` gone", "\\\\  gone"),
+        ("``a`b`` end", "  end"),
+        ("`open only", "`open only"),
+    ],
+)
+def test_should_mask_code_spans_the_way_commonmark_pairs_them(
+    paragraph_text: str, masked_text: str
+) -> None:
+    assert final_reply_gate.code_spans_masked(paragraph_text) == masked_text

package/hooks/blocking/test_merge_review_gate.py

@@ -178,6 +178,12 @@ def test_should_name_the_configured_review_command(monkeypatch: pytest.MonkeyPat
     assert "`/team-review`" in _reason(_merge_tool(CLEAN_HEAD))
 
 
+def test_should_name_the_low_fix_pass_after_three_full_reviews_in_the_deny_reason() -> None:
+    reason = _reason(_merge_tool(CLEAN_HEAD))
+    assert "three full passes" in reason
+    assert "`/code-review low --fix 12`" in reason
+
+
 def test_should_allow_auto_merge_pinned_to_the_clean_head() -> None:
     merge_review_receipt.record_review("acme/tools", 12, CLEAN_HEAD, 0)
     command = f"gh pr merge 12 --repo acme/tools --auto --match-head-commit {CLEAN_HEAD}"

package/hooks/features/conduct-gates.md

@@ -5,7 +5,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 ## Checks
 
 - `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link. It denies a sentence that guesses, estimates, hedges a duration, or admits a skipped check, such as "I didn't confirm this one." It denies a cited Actions run, pull request, or run, job, or check id that no successful tool result in the transcript shows; a subagent's report is the result of its Agent call. A question card from `AskUserQuestion` gets the banned word check and `unvalidated_claim_violation`, like a decision card. With visual reply mode on, it also runs the checks in `visual_reply_rules.py` from the rule list in `rules/visual-reply-rules.json`: no abbreviation or tracker number outside a link, a widget or page before a reply of more than one sentence, and no anchor link inside widget code. The mode is off by default; `~/.claude/visual-reply-mode.json` with `{"enabled": true}` turns the mode checks on.
-- `blocking/final_reply_gate.py` applies the banned words, `unvalidated_claim_violation`, and `unseen_citation_violation` from the reply gate to the reply a session ends its turn with.
+- `blocking/final_reply_gate.py` applies the banned words, `unvalidated_claim_violation`, and `unseen_citation_violation` from the reply gate to the reply a session ends its turn with. Its `windows_path_violation` blocks a path the terminal would render without one of its backslashes.
 - `blocking/open_tasks_stop_gate.py` holds the end of a turn while the session task list has items that are neither completed nor named on a `Blocked:` or `Open:` line of the closing reply. `blocking/open_tasks_transcript.py` rebuilds the task list and the last reply from the transcript for it.
 - The claim judge is a `prompt` hook in `hooks.json`, with no `model` set, so Claude Code's small default hook model reads each chat message and denies the first claim about how code, a file, a tool, a service, a run, or a process behaves, or why something happened, when nothing in the message shows it: inline code that quotes output or a code line, a file and line, or a link. A pull request link covers what that change does, what it blocks or lets through, and its checks. The author's own actions, a restatement of the user's words, questions, instructions, and a decision card's option consequences pass. It catches the plain claims the causal word list in `blocking/reply_length_gate.py` misses, such as "The code lets any of them rewrite it mid-check." `continueOnBlock` returns the reason to the agent as the tool error, so it can add the source and send again. The installer owns it through the `claude-dev-env: ` prefix on its `statusMessage`. It skips `post_widget`, whose input is SVG or HTML markup.
 - `blocking/chat_reply_gate.py` runs the `reply_length_gate.py` reply checks on a plain chat reply, which is no tool call. On `UserPromptSubmit` it adds the reply rules as `additionalContext`. On `MessageDisplay` it holds each streamed batch until the message ends. A message that passes shows whole. A message that fails shows as a draft from `claude -p` on Haiku that passes the same checks, and the original shows when two drafts fail. The draft changes only the text on screen, so the next `UserPromptSubmit` tells the agent the text the user saw, and `SessionEnd` deletes the stored draft. The [reply arena harness](https://github.com/jl-cmd-projects/claude-dev-env/tree/160349b90f627ea542fc6bc7b2b7f86dcbf98b73/tests/reply_arena) ran the comparison that chose this display path.
@@ -17,7 +17,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/verify_before_acting.py` blocks a completed mutating call when the agent's reasoning contains an unchecked claim.
 - `blocking/pr_lifecycle_skill_gate.py` denies a commit, push, pull request action, or merge until the `pr-lifecycle` skill appears in the transcript since the last compaction.
 - `blocking/build_eval_before_eval_write_gate.py` denies a write to an eval file until a Skill call named exactly `claude-api` with args `build-eval`, or the `/claude-api build-eval` command, appears in the transcript.
-- `blocking/merge_review_gate.py` denies an agent's merge until a review pass on the merged head reported zero findings, or ruled out every finding and linked the posted rulings. It reads the receipt `scripts/merge_review_receipt.py` writes, requires the merge, auto-merge or merge-queue entry to be pinned to that head, and skips repositories listed in `CLAUDE_MERGE_REVIEW_EXEMPT_REPOSITORIES`. Its deny reason names the review command `CLAUDE_MERGE_REVIEW_COMMAND` sets.
+- `blocking/merge_review_gate.py` denies an agent's merge until a review pass on the merged head reported zero findings, or ruled out every finding and linked the posted rulings. It reads the receipt `scripts/merge_review_receipt.py` writes, requires the merge, auto-merge or merge-queue entry to be pinned to that head, and skips repositories listed in `CLAUDE_MERGE_REVIEW_EXEMPT_REPOSITORIES`. Its deny reason names the review command `CLAUDE_MERGE_REVIEW_COMMAND` sets. The reason tells the agent to run that command for the first three passes and `/code-review low --fix <number>` for each later pass; the gate itself counts no passes.
 - `blocking/merge_over_review_offer_gate.py` denies a decision card or question that offers a merge while it names open review findings, a red check, unaddressed review comments, or an override. It reads the whole card as one text: every question, header, context, reason, and option, whether the option is a string or a label with a consequence or description.
 - `blocking/artifact_dark_mode_gate.py` denies an Artifact page publish when the page, inside the publish wrapper, keeps a light body or shows text under 4.5:1 contrast in dark mode. `blocking/artifact_dark_mode_render.cjs` renders the page in headless Chromium for it.
 
@@ -47,7 +47,7 @@ Preconditions:
 - Run each command from the repository root with Python and pytest available. The tests create transcript and payload fixtures.
 
 - **Reply length.** Input is a reply with four sentences, a plain pull request number, an abbreviation, two sentences with no widget this turn, or widget code with an anchor link. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_reply_length_gate.py -q`. The adjacent test observes a denial and its count, link, or mode reason. Widget code with no flowchart passes with a flowchart reminder in `additionalContext`.
-- **Final reply.** Input is a closing reply that says "My guess is one to two hours." or cites a run no tool result shows. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_final_reply_gate.py -q`. The adjacent test observes a `block` decision that quotes the sentence or the citation; a reply that cites a run a tool result shows passes.
+- **Final reply.** Input is a closing reply that says "My guess is one to two hours." or cites a run no tool result shows. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_final_reply_gate.py -q`. The adjacent test observes a `block` decision that quotes the sentence or the citation; a reply that cites a run a tool result shows passes. A reply with a plain-text `D:\Reports\.claude\report.html` is blocked; the same path in backticks or a fenced block passes.
 - **Open tasks.** Input is a session whose task list still has "rotate the deploy key" pending and a closing reply of "Done.". Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_open_tasks_stop_gate.py -q`. The adjacent test observes a `block` decision that names the item; a reply line `Blocked: rotate the deploy key - <what the user must give>` passes.
 - **Claim judge.** Input is a headless `claude -p` session with a stub MCP server named `hearthbot` that exposes `reply` and `ask_decision`, told to send "The code lets any of them rewrite it mid-check." The session settings add the `hooks.json` prompt hook. The stub logs zero bytes sent, and the tool error reads `PreToolUse:mcp__hearthbot__reply hook error: [<the prompt>]: Fact with no source: ...`. The same sentence with a `file:line` in backticks posts. A hook whose `model` Claude Code does not recognize lets every message through, so leave `model` unset. Run `node --test packages/claude-dev-env/bin/install.prompt-hook.test.mjs` for the installer side; it observes one managed prompt hook after two installs and none after uninstall.
 - **Chat reply.** Input is a `MessageDisplay` event whose message holds four sentences, the same message split over two batches, and a `UserPromptSubmit` event. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_chat_reply_gate.py -q`. The adjacent test observes the drafter's text in `displayContent`, an empty first batch, no output for three sentences, the original after two failed drafts, the shown draft in the next `additionalContext`, and the stored draft deleted at session end.

package/hooks/hooks_constants/final_reply_gate_constants.py

@@ -1,5 +1,7 @@
 """Constants for the final reply gate Stop hook."""
 
+import re
+
 HOOK_EVENT_NAME = "Stop"
 LAST_ASSISTANT_MESSAGE_KEY = "last_assistant_message"
 TRANSCRIPT_PATH_KEY = "transcript_path"
@@ -8,3 +10,57 @@ BLOCK_DECISION = "block"
 REASON_KEY = "reason"
 ALLOW_EXIT_CODE = 0
 REWRITE_INSTRUCTION = " Rewrite the reply without it."
+NON_SPACE_TOKEN_PATTERN = re.compile(r"\S+")
+ESCAPED_PUNCTUATION_PATTERN = re.compile(r"(?<!\\)(?:\\\\)*\\[!-/:-@\[\]^_`{-~]")
+HARD_BREAK_PATTERN = re.compile(r"(?<!\\)(?:\\\\)*\\\Z")
+CARRIAGE_RETURN_LINE_BREAK = "\r\n"
+LINE_BREAK = "\n"
+BACKTICK_RUN_PATTERN = re.compile(r"`+")
+ALL_HTML_BLOCK_TAG_NAMES = (
+    "address", "article", "aside", "base", "basefont", "blockquote", "body", "caption", "center",
+    "col", "colgroup", "dd", "details", "dialog", "dir", "div", "dl", "dt", "fieldset",
+    "figcaption", "figure", "footer", "form", "frame", "frameset", "h1", "h2", "h3", "h4", "h5",
+    "h6", "head", "header", "hr", "html", "iframe", "legend", "li", "link", "main", "menu",
+    "menuitem", "nav", "noframes", "ol", "optgroup", "option", "p", "param", "search", "section",
+    "summary", "table", "tbody", "td", "tfoot", "th", "thead", "title", "tr", "track", "ul",
+)
+HTML_BLOCK_OPENER_PATTERN = re.compile(
+    r"^ {0,3}(?:"
+    r"(?P<raw><(?:pre|script|style|textarea)(?:[\s>]|$))"
+    r"|(?P<comment><!--)"
+    r"|(?P<instruction><\?)"
+    r"|(?P<cdata><!\[CDATA\[)"
+    r"|(?P<declaration><![A-Za-z])"
+    r"|(?P<block></?(?:" + "|".join(ALL_HTML_BLOCK_TAG_NAMES) + r")(?:[\s>]|/>|$))"
+    r")",
+    re.IGNORECASE | re.MULTILINE,
+)
+ALL_HTML_BLOCK_CLOSER_PATTERNS = {
+    "raw": re.compile(r"</(?:pre|script|style|textarea)>[^\n]*", re.IGNORECASE),
+    "comment": re.compile(r"-->[^\n]*"),
+    "instruction": re.compile(r"\?>[^\n]*"),
+    "cdata": re.compile(r"\]\]>[^\n]*"),
+    "declaration": re.compile(r">[^\n]*"),
+    "block": re.compile(r"(?=\n[ \t]*\n)|\Z"),
+}
+BLOCK_BOUNDARY_PATTERN = re.compile(r"\n[ \t]*\n|\n(?= {0,3}(?:[-*+]|1[.)])[ \t]+\S)")
+QUOTE_MARKER_PATTERN = re.compile(r"(?: {0,3}>[ \t]?)*")
+QUOTE_MARKER = ">"
+MASKED_BLOCK_TEXT = "\n\n"
+HEADING_LINE_PATTERN = re.compile(
+    r"^( {0,3}(?:#{1,6}(?:[ \t][^\n]*)?|=+[ \t]*|(?:-[ \t]*)+|(?:\*[ \t]*){3,}|(?:_[ \t]*){3,}))$",
+    re.MULTILINE,
+)
+HEADING_AS_OWN_BLOCK = "\n\n\\1\n\n"
+PARAGRAPH_SEPARATOR = "\n\n"
+BACKSLASH = "\\"
+BACKSLASHES_PER_LITERAL = 2
+MASKED_CODE_TEXT = " "
+FENCE_OPENER_PATTERN = re.compile(r"^ {0,3}(?:(`{3,})[^`\n]*|(~{3,})[^\n]*)\n", re.MULTILINE)
+FENCE_CLOSER_PREFIX = r"^ {0,3}"
+FENCE_CLOSER_SUFFIX = r"*[ \t]*$"
+WINDOWS_PATH_MESSAGE = (
+    'Path "{path}" sits outside a code span. The terminal renders'
+    " markdown and drops a backslash before punctuation, so a copied path"
+    " points nowhere. Wrap the path in backticks."
+)

package/hooks/hooks_constants/merge_review_gate_constants.py

@@ -54,8 +54,10 @@ RECORD_COMMAND = "python3 ~/.claude/scripts/merge_review_receipt.py"
 NO_CLEAN_REVIEW_REASON_TEMPLATE = (
     "{slug}#{number} has no clean review on the head you are merging. Run the review "
     "loop: review the pull request head with `{review_command}`, fix and push every "
-    "finding, and review again "
-    "until a pass reports zero findings or every finding is ruled out with file:line "
+    "finding, and review again. After three full passes, each later pass is "
+    "`/code-review low --fix {number}`, which names the pull request so the diff "
+    "covers its base: commit and push its fixes, then review the new head. "
+    "Repeat until a pass reports zero findings or every finding is ruled out with file:line "
     "evidence. Record that pass with `"
     + RECORD_COMMAND
     + " {slug} {number} <head sha> <finding count>`, adding `--ruled-out <finding count> "

package/hooks/hooks_constants/owned_pr_review_loop_constants.py

@@ -114,7 +114,9 @@ REVIEW_LOOP_CONTEXT_TEMPLATE: str = (
     "asked for a draft or stopped at opening it.\n"
     "1. Review loop. Load the efficient-review skill (/efficient-review). Review the\n"
     "   branch, check each finding against the code, fix every one that holds, push,\n"
-    "   and review again. Repeat until a pass reports no findings.\n"
+    "   and review again. After three full passes, each later pass is\n"
+    "   /code-review low --fix {number}; commit and push its fixes, then review the new head.\n"
+    "   Repeat until a pass reports no findings.\n"
     "2. Mark ready. Once the loop is clean, CI is green, and no review thread is open,\n"
     "   mark the PR ready for review (gh pr ready {number} --repo {owner}/{repository},\n"
     "   or update_pull_request with draft false).\n"

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.92.0",
+    "version": "8.92.2",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {