claude-dev-env 8.92.1 → 8.92.3

package/hooks/advisory/owned_pr_review_loop.py

@@ -53,7 +53,10 @@ try:
         ALL_PRESET_REPOSITORY_DIGESTS,
         ALL_SHELL_COMMAND_INPUT_KEYS,
         ALL_SHELL_TOOL_NAMES,
+        ALL_PYTHON_SCRIPTLESS_OPTIONS,
         ALREADY_EXISTS_MARKER,
+        BACKSLASH,
+        DOUBLED_BACKSLASH,
         GH_API_POST_METHOD,
         GH_API_PULLS_ENDPOINT_PATTERN,
         GH_API_SUBCOMMAND,
@@ -68,14 +71,28 @@ try:
         MCP_TOOL_NAME_PREFIX,
         NAME_DIGEST_TEXT_ENCODING,
         PULL_REQUEST_URL_PATTERN,
+        PYTHON_OPTION_AND_VALUE_WORD_COUNT,
+        PYTHON_OPTION_PREFIX,
+        PYTHON_SHORT_OPTION_LENGTH,
         REVIEW_LOOP_CONTEXT_TEMPLATE,
         SHELL_ARGUMENT_SEPARATOR,
     )
     from hooks_constants.post_tool_use_context import (
         write_post_tool_use_context_to_stdout,
     )
+    from hooks_constants.pr_lifecycle_skill_gate_constants import PYTHON_OPTIONS_WITH_VALUE
     from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
-    from hooks_constants.shell_command_segments import command_tokens, split_into_segments
+    from hooks_constants.pull_request_proof_constants import (
+        ALL_PYTHON_PROGRAM_NAMES,
+        PULL_REQUEST_SCRIPT_CREATE_WORD,
+        PULL_REQUEST_SCRIPT_NAME,
+    )
+    from hooks_constants.pytest_invocation import unquoted_token
+    from hooks_constants.shell_command_segments import (
+        command_tokens,
+        split_into_segments,
+        token_basename,
+    )
     from hooks_constants.shell_command_wrappers import (
         all_wrapped_command_texts,
         segment_program_and_arguments,
@@ -127,8 +144,34 @@ def _is_gh_api_pulls_post(all_arguments: list[str]) -> bool:
     return sends_body
 
 
+def _python_script_index(all_arguments: list[str]) -> int | None:
+    index = 0
+    while index < len(all_arguments) and all_arguments[index].startswith(PYTHON_OPTION_PREFIX):
+        if all_arguments[index][:PYTHON_SHORT_OPTION_LENGTH] in ALL_PYTHON_SCRIPTLESS_OPTIONS:
+            return None
+        is_option_with_value = all_arguments[index] in PYTHON_OPTIONS_WITH_VALUE
+        index += PYTHON_OPTION_AND_VALUE_WORD_COUNT if is_option_with_value else 1
+    return index if index < len(all_arguments) else None
+
+
+def _is_pull_request_script_create(program_name: str, all_arguments: list[str]) -> bool:
+    all_script_arguments = all_arguments
+    if program_name != PULL_REQUEST_SCRIPT_NAME:
+        script_index = (
+            _python_script_index(all_arguments) if program_name in ALL_PYTHON_PROGRAM_NAMES else None
+        )
+        if script_index is None:
+            return False
+        if token_basename(unquoted_token(all_arguments[script_index])) != PULL_REQUEST_SCRIPT_NAME:
+            return False
+        all_script_arguments = all_arguments[script_index + 1 :]
+    return all_script_arguments[:1] == [PULL_REQUEST_SCRIPT_CREATE_WORD]
+
+
 def _segment_opens_pull_request(all_segment_tokens: list[str]) -> bool:
     program_name, all_arguments = segment_program_and_arguments(all_segment_tokens)
+    if _is_pull_request_script_create(program_name, all_arguments):
+        return True
     return program_name == GH_PROGRAM_NAME and (
         _is_gh_pr_create(all_arguments) or _is_gh_api_pulls_post(all_arguments)
     )
@@ -137,11 +180,18 @@ def _segment_opens_pull_request(all_segment_tokens: list[str]) -> bool:
 def command_creates_pull_request(command: str) -> bool:
     """Return True when any segment of the shell command opens a pull request.
 
-    Three shapes count::
+    Four shapes count::
 
         gh pr create --fill
         gh pr new --fill
         gh api repos/acme/widgets/pulls --input pr.json
+        python ~/.agents/skills/pull-request/scripts/pull_request.py create --repo acme/widgets
+
+    The publisher counts when ``python``, ``python3``, or ``py`` runs a
+    script named ``pull_request.py`` with ``create``, or the script runs
+    alone. Interpreter options such as ``-X utf8`` before the script are
+    skipped, and an unquoted Windows path such as
+    ``C:\\tools\\pull_request.py`` keeps its separators.
 
     A ``gh api`` call counts only when it targets the pulls collection. An
     explicit method (``-X POST``, ``-XPOST``, ``--method=POST``) decides
@@ -157,7 +207,11 @@ def command_creates_pull_request(command: str) -> bool:
     return any(
         _segment_opens_pull_request(each_segment)
         for each_command_text in all_wrapped_command_texts(command)
-        for each_segment in split_into_segments(command_tokens(each_command_text))
+        for each_command_tokens in (
+            command_tokens(each_command_text),
+            command_tokens(each_command_text.replace(BACKSLASH, DOUBLED_BACKSLASH)),
+        )
+        for each_segment in split_into_segments(each_command_tokens)
     )
 
 

package/hooks/advisory/test_owned_pr_review_loop.py

@@ -85,6 +85,13 @@ def _context_of(stdout: str) -> str:
         "gh api --method=POST repos/acme/widgets/pulls",
         "gh api -XPOST repos/acme/widgets/pulls",
         "gh api repos/acme/widgets/pulls -Ftitle=t -fhead=x",
+        'python "C:/Users/me/.agents/skills/pull-request/scripts/pull_request.py" create --repo acme/widgets',
+        "python3 ~/.agents/skills/pull-request/scripts/pull_request.py create --title t",
+        "py pull_request.py create --fill",
+        "git push && python pull_request.py create --repo acme/widgets 2>&1 | tail -5",
+        "python -X utf8 ~/.agents/skills/pull-request/scripts/pull_request.py create --fill",
+        "python -I -W ignore pull_request.py create",
+        "python C:\\Users\\me\\.agents\\skills\\pull-request\\scripts\\pull_request.py create",
     ],
 )
 def test_should_detect_gh_pr_create(command: str) -> None:
@@ -103,6 +110,12 @@ def test_should_detect_gh_pr_create(command: str) -> None:
         "gh api repos/acme/widgets/issues --input issue.json",
         "gh api --method GET repos/acme/widgets/pulls -f state=open",
         "gh api -X GET repos/acme/widgets/pulls -f state=open",
+        "python pull_request.py edit --repo acme/widgets --number 42",
+        "python other_script.py create",
+        "python pull_request.py",
+        "python -m pull_request.py create",
+        "python -c pull_request.py create",
+        "python C:\\Users\\me\\scripts\\my_pull_request.py create",
     ],
 )
 def test_should_not_detect_other_commands(command: str) -> None:
@@ -325,6 +338,16 @@ def test_main_should_emit_the_loop_after_a_gh_api_pulls_post() -> None:
     assert "jl-cmd-projects/claude-dev-env#42" in _context_of(stdout)
 
 
+def test_main_should_emit_the_loop_after_the_pull_request_publisher_creates() -> None:
+    publisher_command = (
+        'python "C:/Users/me/.agents/skills/pull-request/scripts/pull_request.py" create'
+        " --repo jl-cmd-projects/claude-dev-env --base main --head fix/x --title t"
+        " --body-file body.md 2>&1 | tail -5"
+    )
+    stdout = _run_hook(_shell_payload(publisher_command, f"{OWNED_PR_URL}\n"))
+    assert "jl-cmd-projects/claude-dev-env#42" in _context_of(stdout)
+
+
 def test_main_should_emit_the_loop_for_a_codex_shell_call() -> None:
     stdout = _run_hook(
         _shell_payload(

package/hooks/blocking/final_reply_gate.py

@@ -11,15 +11,21 @@ session ends its turn with, which reaches the user with no tool call::
 
 It applies the banned words, the unvalidated claim pattern, and the cited
 run, job, check, and pull request numbers from ``reply_length_gate.py``. The
-citation check is skipped when the transcript cannot be read. A block sends
+citation check is skipped when the transcript cannot be read. It also flags
+a path outside code whose backslash the terminal drops, such as
+``D:\\Reports\\.claude``. A block sends
 the reason back so the model rewrites the reply. Claude Code ends the turn
 after eight blocks in a row.
 """
 
 from __future__ import annotations
 
+import bisect
+import functools
 import json
+import re
 import sys
+from collections.abc import Callable
 from pathlib import Path
 
 hooks_root_directory = str(Path(__file__).resolve().parent.parent)
@@ -36,22 +42,187 @@ from hooks_constants.hook_block_logger import log_hook_block
 from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
 from hooks_constants.final_reply_gate_constants import (
     ALLOW_EXIT_CODE,
+    BACKSLASH,
+    BACKSLASHES_PER_LITERAL,
+    BACKTICK_RUN_PATTERN,
+    BLOCK_BOUNDARY_PATTERN,
     BLOCK_DECISION,
+    CARRIAGE_RETURN_LINE_BREAK,
     DECISION_KEY,
+    ESCAPED_PUNCTUATION_PATTERN,
+    FENCE_CLOSER_PREFIX,
+    FENCE_CLOSER_SUFFIX,
+    FENCE_OPENER_PATTERN,
+    HARD_BREAK_PATTERN,
+    HEADING_AS_OWN_BLOCK,
+    HEADING_LINE_PATTERN,
     HOOK_EVENT_NAME,
+    ALL_HTML_BLOCK_CLOSER_PATTERNS,
+    HTML_BLOCK_OPENER_PATTERN,
     LAST_ASSISTANT_MESSAGE_KEY,
+    LINE_BREAK,
+    MASKED_BLOCK_TEXT,
+    MASKED_CODE_TEXT,
+    NON_SPACE_TOKEN_PATTERN,
+    PARAGRAPH_SEPARATOR,
+    QUOTE_MARKER,
+    QUOTE_MARKER_PATTERN,
     REASON_KEY,
     REWRITE_INSTRUCTION,
     TRANSCRIPT_PATH_KEY,
+    WINDOWS_PATH_MESSAGE,
 )
 
 
+def _unescaped_start(paragraph_text: str, run_start: int) -> int:
+    backslash_start = run_start
+    while backslash_start > 0 and paragraph_text[backslash_start - 1] == BACKSLASH:
+        backslash_start -= 1
+    return run_start + (run_start - backslash_start) % BACKSLASHES_PER_LITERAL
+
+
+def code_spans_masked(paragraph_text: str) -> str:
+    """Return the paragraph with one space where each code span sat.
+
+    A backtick run opens a span unless an odd run of backslashes escapes its
+    first backtick. The span closes at the next run of the same length::
+
+        >>> code_spans_masked("see `a\\\\.b` and \\\\`x")
+        'see   and \\\\`x'
+    """
+    all_runs = [each_run.span() for each_run in BACKTICK_RUN_PATTERN.finditer(paragraph_text)]
+    all_run_indexes_by_length: dict[int, list[int]] = {}
+    for each_index, (each_run_start, each_run_end) in enumerate(all_runs):
+        all_run_indexes_by_length.setdefault(each_run_end - each_run_start, []).append(each_index)
+    all_masked_pieces: list[str] = []
+    copied_up_to = 0
+    run_index = 0
+    while run_index < len(all_runs):
+        run_start, run_end = all_runs[run_index]
+        opener_start = _unescaped_start(paragraph_text, run_start)
+        same_length_indexes = all_run_indexes_by_length.get(run_end - opener_start, [])
+        closer_position = bisect.bisect_right(same_length_indexes, run_index)
+        if opener_start == run_end or closer_position == len(same_length_indexes):
+            run_index += 1
+            continue
+        closer_index = same_length_indexes[closer_position]
+        all_masked_pieces.extend((paragraph_text[copied_up_to:opener_start], MASKED_CODE_TEXT))
+        copied_up_to = all_runs[closer_index][1]
+        run_index = closer_index + 1
+    all_masked_pieces.append(paragraph_text[copied_up_to:])
+    return "".join(all_masked_pieces)
+
+
+@functools.cache
+def _fence_closer_pattern(fence_text: str) -> re.Pattern[str]:
+    return re.compile(
+        FENCE_CLOSER_PREFIX + re.escape(fence_text) + re.escape(fence_text[0]) + FENCE_CLOSER_SUFFIX,
+        re.MULTILINE,
+    )
+
+
+def _fence_closer_for(opener: re.Match[str]) -> re.Pattern[str]:
+    return _fence_closer_pattern(opener.group(1) or opener.group(2))
+
+
+def _html_block_closer_for(opener: re.Match[str]) -> re.Pattern[str]:
+    return ALL_HTML_BLOCK_CLOSER_PATTERNS[opener.lastgroup or ""]
+
+
+def blocks_masked(
+    text: str,
+    opener_pattern: re.Pattern[str],
+    closer_for: Callable[[re.Match[str]], re.Pattern[str]],
+) -> str:
+    """Return the text with a blank line where each closed block sat.
+
+    A block runs from an opener to the first closer after it. An opener with
+    no closer stays in the text, and a closer search that found nothing is
+    not run again, so the scan stays linear::
+
+        >>> blocks_masked("a\\n<!--\\nb\\n-->\\nc", HTML_BLOCK_OPENER_PATTERN, _html_block_closer_for)
+        'a\\n\\n\\n\\nc'
+    """
+    all_masked_pieces: list[str] = []
+    all_closer_misses: dict[re.Pattern[str], int] = {}
+    copied_up_to = 0
+    search_from = 0
+    while (opener := opener_pattern.search(text, search_from)) is not None:
+        closer_pattern = closer_for(opener)
+        is_closer_possible = opener.end() < all_closer_misses.get(closer_pattern, len(text) + 1)
+        closer = closer_pattern.search(text, opener.end()) if is_closer_possible else None
+        if closer is None:
+            all_closer_misses.setdefault(closer_pattern, opener.end())
+            search_from = max(opener.end(), opener.start() + 1)
+            continue
+        all_masked_pieces.extend((text[copied_up_to : opener.start()], MASKED_BLOCK_TEXT))
+        copied_up_to = search_from = closer.end()
+    all_masked_pieces.append(text[copied_up_to:])
+    return "".join(all_masked_pieces)
+
+
+def quotes_unwrapped(text: str) -> str:
+    """Return the text with each quote marker removed.
+
+    Lines of one quote form one paragraph, so their markers go. A line that
+    goes deeper into a quote starts a new paragraph, and an unmarked line
+    continues the quote above it::
+
+        >>> quotes_unwrapped("> a\\n>> b\\nc")
+        '\\na\\n\\nb\\nc'
+    """
+    all_lines: list[str] = []
+    previous_depth = 0
+    for each_line in text.split(LINE_BREAK):
+        marker = QUOTE_MARKER_PATTERN.match(each_line)
+        marker_text = marker.group() if marker else ""
+        depth = marker_text.count(QUOTE_MARKER)
+        if depth > previous_depth:
+            all_lines.append("")
+        content_text = each_line[len(marker_text) :]
+        if depth or not content_text.strip():
+            previous_depth = depth
+        all_lines.append(content_text)
+    return LINE_BREAK.join(all_lines)
+
+
+def windows_path_violation(reply_text: str) -> str | None:
+    """Return the block reason for a path the terminal renders wrong, or None.
+
+    The terminal reads a backslash before punctuation as a markdown escape
+    and drops it. A path outside a code span loses that backslash::
+
+        flag: The report is at D:\\Reports\\.claude\\report.html now.
+              (the terminal shows D:\\Reports.claude\\report.html)
+        flag: Open D:\\Shared Files\\.claude\\x.html now.
+        ok:   The report is at `D:\\Reports\\.claude\\report.html` now.
+        ok:   The report is at D:\\Reports\\report.html now.
+    """
+    line_feed_text = reply_text.replace(CARRIAGE_RETURN_LINE_BREAK, LINE_BREAK)
+    unfenced_text = blocks_masked(line_feed_text, FENCE_OPENER_PATTERN, _fence_closer_for)
+    unfenced_text = blocks_masked(unfenced_text, HTML_BLOCK_OPENER_PATTERN, _html_block_closer_for)
+    unfenced_text = quotes_unwrapped(unfenced_text)
+    unfenced_text = HEADING_LINE_PATTERN.sub(HEADING_AS_OWN_BLOCK, unfenced_text)
+    prose_text = PARAGRAPH_SEPARATOR.join(
+        code_spans_masked(each_paragraph)
+        for each_paragraph in BLOCK_BOUNDARY_PATTERN.split(unfenced_text)
+    )
+    for each_token_match in NON_SPACE_TOKEN_PATTERN.finditer(prose_text):
+        token_text = each_token_match.group()
+        is_line_end = prose_text.startswith(LINE_BREAK, each_token_match.end())
+        is_hard_break = is_line_end and HARD_BREAK_PATTERN.search(token_text) is not None
+        if is_hard_break or ESCAPED_PUNCTUATION_PATTERN.search(token_text) is not None:
+            return WINDOWS_PATH_MESSAGE.format(path=token_text)
+    return None
+
+
 def final_reply_violation(reply_text: str, transcript_path: object) -> str | None:
     """Return the block reason for the closing reply, or None when it passes."""
     return (
         banned_word_violation(reply_text, configured_banned_words())
         or unvalidated_claim_violation(reply_text)
         or unseen_citation_violation(reply_text, transcript_path)
+        or windows_path_violation(reply_text)
     )
 
 

package/hooks/blocking/test_final_reply_gate.py

@@ -9,6 +9,10 @@ import final_reply_gate
 GUESSED_REPLY = "My guess is one to two hours if those builds pass first time."
 UNCONFIRMED_REPLY = "Merge queue: I didn\u2019t confirm this one."
 MEASURED_REPLY = "The last queue build took 39 minutes, run 18239174012."
+INSIGHTS_REPLY = (
+    "Your shareable insights report is ready:\n"
+    "file://C:\\Reports\\.claude-profiles\\org\\usage-data\\report-2026-10-20-094705.html"
+)
 
 
 def run_gate(
@@ -92,3 +96,129 @@ def test_should_allow_a_closing_reply_with_no_message(
 
 def test_should_return_none_for_a_measured_reply_without_a_transcript() -> None:
     assert final_reply_gate.final_reply_violation(MEASURED_REPLY, None) is None
+
+
+@pytest.mark.parametrize(
+    ("reply_text", "quoted_text"),
+    [
+        (INSIGHTS_REPLY, 'Path "file://C:\\Reports\\.claude-profiles'),
+        ("The report is at C:\\Reports\\.claude\\report.html now.", 'Path "C:\\Reports'),
+        ("Run C:\\Tools\\-v\\x.exe once.", 'Path "C:\\Tools\\-v'),
+        ("Wait ~~~ then open C:\\Reports\\.claude\\r.html now.", 'Path "C:\\Reports'),
+        ("Wait ``` then open C:\\Reports\\.claude\\r.html now.", 'Path "C:\\Reports'),
+        ("Escaped \\` then C:\\Reports\\.claude\\r.html then `x`.", 'Path "\\`"'),
+        ("Open C:\\Shared Files\\.claude\\x.html now.", 'Path "Files\\.claude'),
+        ("Open `C:\\Reports`\\.claude\\x.html now.", 'Path "\\.claude'),
+        ("Saved to C:\\Reports\\..\\out\\x.html now.", 'Path "C:\\Reports'),
+        ("Saved to D:\\Reports\\. now", 'Path "D:\\Reports\\."'),
+        ("Saved to D:\\Reports\\\\\\.claude now", 'Path "D:\\Reports'),
+        ("```\n```python\n```\nOpen C:\\Reports\\.claude\\x.html now.\n```", 'Path "C:\\Reports'),
+        ("Check `this\nand `C:\\Reports\\.claude\\r.html` now.", 'Path "C:\\Reports'),
+        ("```foo` bar\nOpen C:\\Reports\\.claude\\r.html now.", 'Path "C:\\Reports'),
+        ("Saved to D:\\Reports\\\n.claude\\x.html now.", 'Path "D:\\Reports\\"'),
+        ("\\\\`x` now C:\\Reports\\.claude\\r.html and `y`", 'Path "C:\\Reports'),
+        ("Check `this\n\nand C:\\Reports\\.claude\\r.html` now.", 'Path "C:\\Reports'),
+        ("- Stray ` here\n- Saved to D:\\Reports\\.claude\\r.html\n- Run `x`", 'Path "D:\\Reports'),
+        ("# Stray ` here\nSaved to D:\\Reports\\.claude\\r.html `x`", 'Path "D:\\Reports'),
+        ("Check `this\n2. and `C:\\Reports\\.claude\\r.html` now.", 'Path "C:\\Reports'),
+        ("Check `this\n    - and `C:\\Reports\\.claude\\r.html` now.", 'Path "C:\\Reports'),
+        ("Check `this\n    # and `C:\\Reports\\.claude\\r.html` now.", 'Path "C:\\Reports'),
+        ("Check `this\n\t# and `C:\\Reports\\.claude\\r.html` now.", 'Path "C:\\Reports'),
+        ("Check `this\n---\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n===\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n* * *\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n___\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n<!-- note -->\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n<details>\n\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n<span>a` and C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("<!-- ` -->\nSaved to C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("Check `this\n```\ncode\n```\nand C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("- ```bash\n  echo hi\n  ```\nSaved to D:\\Reports\\.claude\\r.html now.", 'Path "D:\\Reports'),
+        ("```\nC:\\Reports\\.claude\\open.html", 'Path "C:\\Reports'),
+        ("> stray ` here\n> and `C:\\Reports\\.claude\\r.html` now", 'Path "C:\\Reports'),
+        ("> stray `\n>> and C:\\Reports\\.claude\\r.html `x`", 'Path "C:\\Reports'),
+        ("> stray `\nlazy\n> and `C:\\Reports\\.claude\\r.html` now", 'Path "C:\\Reports'),
+        ("```\r\ncode\r\n```\r\nOpen C:\\Reports\\.claude\\r.html now.", 'Path "C:\\Reports'),
+    ],
+)
+def test_should_block_a_windows_path_markdown_mangles(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+    reply_text: str,
+    quoted_text: str,
+) -> None:
+    _, stdout_text = run_gate(monkeypatch, capsys, reply_text)
+    decision = json.loads(stdout_text)
+    assert decision["decision"] == "block"
+    assert quoted_text in decision["reason"]
+
+
+@pytest.mark.parametrize(
+    "reply_text",
+    [
+        "Open `file:///C:/Reports/.claude/report.html` now.",
+        "The report is at `C:\\Reports\\.claude\\report.html` now.",
+        "Paths:\n```text\nC:\\Reports\\.claude\\report.html\n```",
+        "The report is at C:\\Reports\\report.html now.",
+        "The report is at C:\\\\Reports\\\\.claude\\\\report.html now.",
+        "The report is at ``C:\\Reports\\.claude\\report.html`` now.",
+        "Paths:\n~~~\nC:\\Reports\\.claude\\report.html\n~~~",
+        "Paths `C:\\Reports\\.claude\nreport.html` here.",
+        "<pre>\nC:\\Reports\\.claude\\report.html\n</pre>",
+        "> Saved to `C:\\Reports\\.claude\\report.html`\n> now.",
+    ],
+)
+def test_should_allow_a_windows_path_inside_code(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], reply_text: str
+) -> None:
+    assert run_gate(monkeypatch, capsys, reply_text) == (0, "")
+
+
+@pytest.mark.parametrize(
+    ("text", "masked_text"),
+    [
+        ("a\n<!--\nb\n-->\nc", "a\n\n\n\nc"),
+        ("a\n<!--\nb\nc", "a\n<!--\nb\nc"),
+        ("<!--\n<!--\nb -->\nc", "\n\n\nc"),
+        ("<details>\nb\n\nc", "\n\n\n\nc"),
+    ],
+)
+def test_should_mask_html_blocks_only_where_they_close(text: str, masked_text: str) -> None:
+    assert (
+        final_reply_gate.blocks_masked(
+            text,
+            final_reply_gate.HTML_BLOCK_OPENER_PATTERN,
+            final_reply_gate._html_block_closer_for,
+        )
+        == masked_text
+    )
+
+
+@pytest.mark.parametrize(
+    ("text", "unwrapped_text"),
+    [
+        ("> a\n> b", "\na\nb"),
+        ("> a\n>> b", "\na\n\nb"),
+        ("> a\nb\n> c", "\na\nb\nc"),
+        ("> a\n\n> b", "\na\n\n\nb"),
+        ("plain", "plain"),
+    ],
+)
+def test_should_unwrap_quotes_into_their_paragraphs(text: str, unwrapped_text: str) -> None:
+    assert final_reply_gate.quotes_unwrapped(text) == unwrapped_text
+
+
+@pytest.mark.parametrize(
+    ("paragraph_text", "masked_text"),
+    [
+        ("see `a\\.b` and more", "see   and more"),
+        ("\\`x` stays", "\\`x` stays"),
+        ("\\\\`x` gone", "\\\\  gone"),
+        ("``a`b`` end", "  end"),
+        ("`open only", "`open only"),
+    ],
+)
+def test_should_mask_code_spans_the_way_commonmark_pairs_them(
+    paragraph_text: str, masked_text: str
+) -> None:
+    assert final_reply_gate.code_spans_masked(paragraph_text) == masked_text

package/hooks/features/bash-dispatchers.md

@@ -23,7 +23,7 @@ This family rewrites a Git Bash command when path conversion would change a revi
 - `blocking/cloud_graphql_gate.py` runs inside that dispatcher on `PreToolUse`, matcher `Bash`, timeout `60` seconds, for the Bash and PowerShell tools, when `CLAUDE_CODE_REMOTE` is `true`.
 - `blocking/bash_post_call_dispatcher.py` runs on `PostToolUse`, matcher `Bash|PowerShell`, timeout `60` seconds in `hooks.json`.
 - `advisory/pr_done_reminder.py` runs inside that dispatcher on `PostToolUse`, matcher `Bash|PowerShell`, timeout `60` seconds. `ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES` selects `Bash` and `PowerShell`.
-- `advisory/owned_pr_review_loop.py` runs on `PostToolUse`, matcher `Bash|PowerShell|exec_command|shell_command|mcp__.*__(create_pull_request|github_create_pull_request)`, timeout `10` seconds in `hooks.json`. It wakes on `gh pr create`, `gh pr new`, a POST to `gh api repos/<owner>/<repo>/pulls`, and an MCP pull request creation. The installer also registers it on Codex `PostToolUse` through `ALL_CODEX_NATIVE_POST_TOOL_USE_HOOK_SCRIPT_NAMES`.
+- `advisory/owned_pr_review_loop.py` runs on `PostToolUse`, matcher `Bash|PowerShell|exec_command|shell_command|mcp__.*__(create_pull_request|github_create_pull_request)`, timeout `10` seconds in `hooks.json`. It wakes on `gh pr create`, `gh pr new`, a POST to `gh api repos/<owner>/<repo>/pulls`, a `pull_request.py create` call to the pull request publisher, and an MCP pull request creation. The installer also registers it on Codex `PostToolUse` through `ALL_CODEX_NATIVE_POST_TOOL_USE_HOOK_SCRIPT_NAMES`.
 - `blocking/owned_pr_merge_stop_gate.py` runs on `Stop`, timeout `60` seconds in `hooks.json`. The installer also registers it on Codex `Stop` through `ALL_CODEX_NATIVE_STOP_HOOK_SCRIPT_NAMES`.
 
 ## Proving it

package/hooks/features/conduct-gates.md

@@ -5,7 +5,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 ## Checks
 
 - `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link. It denies a sentence that guesses, estimates, hedges a duration, or admits a skipped check, such as "I didn't confirm this one." It denies a cited Actions run, pull request, or run, job, or check id that no successful tool result in the transcript shows; a subagent's report is the result of its Agent call. A question card from `AskUserQuestion` gets the banned word check and `unvalidated_claim_violation`, like a decision card. With visual reply mode on, it also runs the checks in `visual_reply_rules.py` from the rule list in `rules/visual-reply-rules.json`: no abbreviation or tracker number outside a link, a widget or page before a reply of more than one sentence, and no anchor link inside widget code. The mode is off by default; `~/.claude/visual-reply-mode.json` with `{"enabled": true}` turns the mode checks on.
-- `blocking/final_reply_gate.py` applies the banned words, `unvalidated_claim_violation`, and `unseen_citation_violation` from the reply gate to the reply a session ends its turn with.
+- `blocking/final_reply_gate.py` applies the banned words, `unvalidated_claim_violation`, and `unseen_citation_violation` from the reply gate to the reply a session ends its turn with. Its `windows_path_violation` blocks a path the terminal would render without one of its backslashes.
 - `blocking/open_tasks_stop_gate.py` holds the end of a turn while the session task list has items that are neither completed nor named on a `Blocked:` or `Open:` line of the closing reply. `blocking/open_tasks_transcript.py` rebuilds the task list and the last reply from the transcript for it.
 - The claim judge is a `prompt` hook in `hooks.json`, with no `model` set, so Claude Code's small default hook model reads each chat message and denies the first claim about how code, a file, a tool, a service, a run, or a process behaves, or why something happened, when nothing in the message shows it: inline code that quotes output or a code line, a file and line, or a link. A pull request link covers what that change does, what it blocks or lets through, and its checks. The author's own actions, a restatement of the user's words, questions, instructions, and a decision card's option consequences pass. It catches the plain claims the causal word list in `blocking/reply_length_gate.py` misses, such as "The code lets any of them rewrite it mid-check." `continueOnBlock` returns the reason to the agent as the tool error, so it can add the source and send again. The installer owns it through the `claude-dev-env: ` prefix on its `statusMessage`. It skips `post_widget`, whose input is SVG or HTML markup.
 - `blocking/chat_reply_gate.py` runs the `reply_length_gate.py` reply checks on a plain chat reply, which is no tool call. On `UserPromptSubmit` it adds the reply rules as `additionalContext`. On `MessageDisplay` it holds each streamed batch until the message ends. A message that passes shows whole. A message that fails shows as a draft from `claude -p` on Haiku that passes the same checks, and the original shows when two drafts fail. The draft changes only the text on screen, so the next `UserPromptSubmit` tells the agent the text the user saw, and `SessionEnd` deletes the stored draft. The [reply arena harness](https://github.com/jl-cmd-projects/claude-dev-env/tree/160349b90f627ea542fc6bc7b2b7f86dcbf98b73/tests/reply_arena) ran the comparison that chose this display path.
@@ -47,7 +47,7 @@ Preconditions:
 - Run each command from the repository root with Python and pytest available. The tests create transcript and payload fixtures.
 
 - **Reply length.** Input is a reply with four sentences, a plain pull request number, an abbreviation, two sentences with no widget this turn, or widget code with an anchor link. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_reply_length_gate.py -q`. The adjacent test observes a denial and its count, link, or mode reason. Widget code with no flowchart passes with a flowchart reminder in `additionalContext`.
-- **Final reply.** Input is a closing reply that says "My guess is one to two hours." or cites a run no tool result shows. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_final_reply_gate.py -q`. The adjacent test observes a `block` decision that quotes the sentence or the citation; a reply that cites a run a tool result shows passes.
+- **Final reply.** Input is a closing reply that says "My guess is one to two hours." or cites a run no tool result shows. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_final_reply_gate.py -q`. The adjacent test observes a `block` decision that quotes the sentence or the citation; a reply that cites a run a tool result shows passes. A reply with a plain-text `D:\Reports\.claude\report.html` is blocked; the same path in backticks or a fenced block passes.
 - **Open tasks.** Input is a session whose task list still has "rotate the deploy key" pending and a closing reply of "Done.". Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_open_tasks_stop_gate.py -q`. The adjacent test observes a `block` decision that names the item; a reply line `Blocked: rotate the deploy key - <what the user must give>` passes.
 - **Claim judge.** Input is a headless `claude -p` session with a stub MCP server named `hearthbot` that exposes `reply` and `ask_decision`, told to send "The code lets any of them rewrite it mid-check." The session settings add the `hooks.json` prompt hook. The stub logs zero bytes sent, and the tool error reads `PreToolUse:mcp__hearthbot__reply hook error: [<the prompt>]: Fact with no source: ...`. The same sentence with a `file:line` in backticks posts. A hook whose `model` Claude Code does not recognize lets every message through, so leave `model` unset. Run `node --test packages/claude-dev-env/bin/install.prompt-hook.test.mjs` for the installer side; it observes one managed prompt hook after two installs and none after uninstall.
 - **Chat reply.** Input is a `MessageDisplay` event whose message holds four sentences, the same message split over two batches, and a `UserPromptSubmit` event. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_chat_reply_gate.py -q`. The adjacent test observes the drafter's text in `displayContent`, an empty first batch, no output for three sentences, the original after two failed drafts, the shown draft in the next `additionalContext`, and the stored draft deleted at session end.

package/hooks/hooks_constants/final_reply_gate_constants.py

@@ -1,5 +1,7 @@
 """Constants for the final reply gate Stop hook."""
 
+import re
+
 HOOK_EVENT_NAME = "Stop"
 LAST_ASSISTANT_MESSAGE_KEY = "last_assistant_message"
 TRANSCRIPT_PATH_KEY = "transcript_path"
@@ -8,3 +10,57 @@ BLOCK_DECISION = "block"
 REASON_KEY = "reason"
 ALLOW_EXIT_CODE = 0
 REWRITE_INSTRUCTION = " Rewrite the reply without it."
+NON_SPACE_TOKEN_PATTERN = re.compile(r"\S+")
+ESCAPED_PUNCTUATION_PATTERN = re.compile(r"(?<!\\)(?:\\\\)*\\[!-/:-@\[\]^_`{-~]")
+HARD_BREAK_PATTERN = re.compile(r"(?<!\\)(?:\\\\)*\\\Z")
+CARRIAGE_RETURN_LINE_BREAK = "\r\n"
+LINE_BREAK = "\n"
+BACKTICK_RUN_PATTERN = re.compile(r"`+")
+ALL_HTML_BLOCK_TAG_NAMES = (
+    "address", "article", "aside", "base", "basefont", "blockquote", "body", "caption", "center",
+    "col", "colgroup", "dd", "details", "dialog", "dir", "div", "dl", "dt", "fieldset",
+    "figcaption", "figure", "footer", "form", "frame", "frameset", "h1", "h2", "h3", "h4", "h5",
+    "h6", "head", "header", "hr", "html", "iframe", "legend", "li", "link", "main", "menu",
+    "menuitem", "nav", "noframes", "ol", "optgroup", "option", "p", "param", "search", "section",
+    "summary", "table", "tbody", "td", "tfoot", "th", "thead", "title", "tr", "track", "ul",
+)
+HTML_BLOCK_OPENER_PATTERN = re.compile(
+    r"^ {0,3}(?:"
+    r"(?P<raw><(?:pre|script|style|textarea)(?:[\s>]|$))"
+    r"|(?P<comment><!--)"
+    r"|(?P<instruction><\?)"
+    r"|(?P<cdata><!\[CDATA\[)"
+    r"|(?P<declaration><![A-Za-z])"
+    r"|(?P<block></?(?:" + "|".join(ALL_HTML_BLOCK_TAG_NAMES) + r")(?:[\s>]|/>|$))"
+    r")",
+    re.IGNORECASE | re.MULTILINE,
+)
+ALL_HTML_BLOCK_CLOSER_PATTERNS = {
+    "raw": re.compile(r"</(?:pre|script|style|textarea)>[^\n]*", re.IGNORECASE),
+    "comment": re.compile(r"-->[^\n]*"),
+    "instruction": re.compile(r"\?>[^\n]*"),
+    "cdata": re.compile(r"\]\]>[^\n]*"),
+    "declaration": re.compile(r">[^\n]*"),
+    "block": re.compile(r"(?=\n[ \t]*\n)|\Z"),
+}
+BLOCK_BOUNDARY_PATTERN = re.compile(r"\n[ \t]*\n|\n(?= {0,3}(?:[-*+]|1[.)])[ \t]+\S)")
+QUOTE_MARKER_PATTERN = re.compile(r"(?: {0,3}>[ \t]?)*")
+QUOTE_MARKER = ">"
+MASKED_BLOCK_TEXT = "\n\n"
+HEADING_LINE_PATTERN = re.compile(
+    r"^( {0,3}(?:#{1,6}(?:[ \t][^\n]*)?|=+[ \t]*|(?:-[ \t]*)+|(?:\*[ \t]*){3,}|(?:_[ \t]*){3,}))$",
+    re.MULTILINE,
+)
+HEADING_AS_OWN_BLOCK = "\n\n\\1\n\n"
+PARAGRAPH_SEPARATOR = "\n\n"
+BACKSLASH = "\\"
+BACKSLASHES_PER_LITERAL = 2
+MASKED_CODE_TEXT = " "
+FENCE_OPENER_PATTERN = re.compile(r"^ {0,3}(?:(`{3,})[^`\n]*|(~{3,})[^\n]*)\n", re.MULTILINE)
+FENCE_CLOSER_PREFIX = r"^ {0,3}"
+FENCE_CLOSER_SUFFIX = r"*[ \t]*$"
+WINDOWS_PATH_MESSAGE = (
+    'Path "{path}" sits outside a code span. The terminal renders'
+    " markdown and drops a backslash before punctuation, so a copied path"
+    " points nowhere. Wrap the path in backticks."
+)

package/hooks/hooks_constants/owned_pr_review_loop_constants.py

@@ -39,6 +39,12 @@ __all__ = [
     "GH_SHORT_OPTION_LENGTH",
     "ALL_GH_API_SHORT_OPTIONS",
     "GH_OPTION_VALUE_SEPARATOR",
+    "PYTHON_OPTION_PREFIX",
+    "PYTHON_SHORT_OPTION_LENGTH",
+    "PYTHON_OPTION_AND_VALUE_WORD_COUNT",
+    "ALL_PYTHON_SCRIPTLESS_OPTIONS",
+    "BACKSLASH",
+    "DOUBLED_BACKSLASH",
     "MCP_TOOL_NAME_PREFIX",
     "ALL_MCP_CREATE_PULL_REQUEST_TOOL_SUFFIXES",
     "MCP_OWNER_INPUT_KEY",
@@ -85,6 +91,12 @@ GH_LONG_OPTION_PREFIX: str = "--"
 GH_SHORT_OPTION_LENGTH: int = 2
 ALL_GH_API_SHORT_OPTIONS: frozenset[str] = frozenset({"-f", "-F", "-X"})
 GH_OPTION_VALUE_SEPARATOR: str = "="
+PYTHON_OPTION_PREFIX: str = "-"
+PYTHON_SHORT_OPTION_LENGTH: int = 2
+PYTHON_OPTION_AND_VALUE_WORD_COUNT: int = 2
+ALL_PYTHON_SCRIPTLESS_OPTIONS: frozenset[str] = frozenset({"-m", "-c"})
+BACKSLASH: str = "\\"
+DOUBLED_BACKSLASH: str = "\\\\"
 
 MCP_TOOL_NAME_PREFIX: str = "mcp__"
 ALL_MCP_CREATE_PULL_REQUEST_TOOL_SUFFIXES: tuple[str, ...] = (

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.92.1",
+    "version": "8.92.3",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {