claude-dev-env 8.97.0 → 8.98.0

package/hooks/blocking/python_windows_invocation_gate.py

@@ -0,0 +1,249 @@
+#!/usr/bin/env python3
+"""PreToolUse gate: stop two Python invocations that fail on Windows.
+
+``python -I`` turns on isolated mode, which ignores every ``PYTHON*``
+environment variable, ``PYTHONUTF8`` included. On Windows the interpreter then
+writes with the console code page, and non-ASCII output stops with
+``UnicodeEncodeError: 'charmap'``. On a Windows host a command segment is
+denied when it runs ``python``, ``python3`` or ``py`` with ``-I`` and without
+``-X utf8``. The option scan reads clusters, so ``-IX utf8``, ``-IXutf8`` and
+``-I -X utf8`` all pass. It stops at the script name, ``-c`` or ``-m``, so an
+``-I`` meant for the script passes. Linux runs ``-I`` in UTF-8 already, so the
+check stays quiet there.
+
+Under the PowerShell tool a command is also denied when a ``python -c "..."``
+argument holds ``\\"``. PowerShell reads the backslash as a plain character and
+ends the string at that quote. The deny reason names a script file or a
+single-quoted here-string. Bash reads ``\\"`` as an escaped quote, so the Bash
+tool passes it.
+
+Hosted by ``blocking/bash_pre_tool_use_dispatcher.py`` for the Bash and
+PowerShell tools.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from collections.abc import Iterator
+from pathlib import Path
+
+try:
+    _hooks_root_directory = str(Path(__file__).resolve().parent.parent)
+    if _hooks_root_directory not in sys.path:
+        sys.path.insert(0, _hooks_root_directory)
+    from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
+        ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+        DENY_DECISION,
+        HOOK_EVENT_NAME,
+        POWERSHELL_TOOL_NAME,
+        REASON_JOIN_SEPARATOR,
+    )
+    from hooks_constants.hook_block_logger import log_hook_block
+    from hooks_constants.piped_pytest_blocker_constants import (
+        PYTHON_INTERPRETER_BASENAME_PATTERN,
+    )
+    from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+    from hooks_constants.python_windows_invocation_gate_constants import (
+        ALL_COMMAND_ENDING_OPTION_LETTERS,
+        ALL_UTF8_MODE_OPTION_VALUES,
+        ALL_VALUE_LONG_OPTIONS,
+        ALL_VALUE_OPTION_LETTERS,
+        END_OF_OPTIONS_MARKER,
+        GATE_HOOK_NAME,
+        IMPLEMENTATION_OPTION_LETTER,
+        ISOLATED_MODE_OPTION_LETTER,
+        ISOLATED_PYTHON_DENY_REASON,
+        OPTION_PREFIX,
+        POWERSHELL_BACKSLASH_QUOTE_DENY_REASON,
+        PYTHON_CODE_ARGUMENT_BACKSLASH_QUOTE_PATTERN,
+        WINDOWS_OS_NAME,
+    )
+    from hooks_constants.shell_command_wrappers import (
+        all_wrapped_command_segments,
+        segment_program_and_arguments,
+    )
+except ImportError as import_error:
+    raise ImportError(
+        "The Python Windows invocation gate cannot import its dependencies; "
+        "ensure the hooks directory is importable."
+    ) from import_error
+
+
+def is_windows_host() -> bool:
+    """Return True when the hook runs on Windows, where the shell commands run too."""
+    return os.name == WINDOWS_OS_NAME
+
+
+def _is_short_option_cluster(argument: str) -> bool:
+    return (
+        argument.startswith(OPTION_PREFIX)
+        and not argument.startswith(END_OF_OPTIONS_MARKER)
+        and argument != OPTION_PREFIX
+    )
+
+
+def _is_long_option(argument: str) -> bool:
+    return argument.startswith(END_OF_OPTIONS_MARKER) and argument != END_OF_OPTIONS_MARKER
+
+
+def _skip_long_option_value(argument: str, remaining_arguments: Iterator[str]) -> None:
+    if argument in ALL_VALUE_LONG_OPTIONS:
+        next(remaining_arguments, "")
+
+
+def _cluster_options(
+    cluster_letters: str, remaining_arguments: Iterator[str]
+) -> list[tuple[str, str]]:
+    """Return each option letter in one short-option cluster with its value.
+
+    A letter that takes a value uses the rest of the cluster, or the next
+    argument when the rest is empty, so ``-IXutf8`` and ``-IX utf8`` both read
+    as ``I`` and ``X`` with the value ``utf8``.
+    """
+    all_options: list[tuple[str, str]] = []
+    for each_index, each_letter in enumerate(cluster_letters):
+        if each_letter not in ALL_VALUE_OPTION_LETTERS:
+            all_options.append((each_letter, ""))
+            continue
+        inline_value = cluster_letters[each_index + 1 :]
+        all_options.append((each_letter, inline_value or next(remaining_arguments, "")))
+        return all_options
+    return all_options
+
+
+def _interpreter_options(all_arguments: list[str]) -> list[tuple[str, str]]:
+    """Return the interpreter option letters and values ahead of the script, ``-c`` or ``-m``.
+
+    Args:
+        all_arguments: The tokens after the interpreter program name.
+    """
+    all_options: list[tuple[str, str]] = []
+    remaining_arguments = iter(all_arguments)
+    for each_argument in remaining_arguments:
+        if _is_long_option(each_argument):
+            _skip_long_option_value(each_argument, remaining_arguments)
+            continue
+        if not _is_short_option_cluster(each_argument):
+            break
+        all_options.extend(
+            _cluster_options(each_argument[len(OPTION_PREFIX) :], remaining_arguments)
+        )
+        if all_options[-1][0] in ALL_COMMAND_ENDING_OPTION_LETTERS:
+            break
+    return all_options
+
+
+def _isolated_without_utf8_mode(all_arguments: list[str]) -> bool:
+    """Return True when the interpreter options set ``-I`` and leave out ``-X utf8``.
+
+    Args:
+        all_arguments: The tokens after the interpreter program name.
+    """
+    all_options = _interpreter_options(all_arguments)
+    is_isolated = any(
+        each_letter == ISOLATED_MODE_OPTION_LETTER for each_letter, _ in all_options
+    )
+    has_utf8_mode = any(
+        each_letter == IMPLEMENTATION_OPTION_LETTER
+        and each_value in ALL_UTF8_MODE_OPTION_VALUES
+        for each_letter, each_value in all_options
+    )
+    return is_isolated and not has_utf8_mode
+
+
+def runs_isolated_python_without_utf8_mode(command: str) -> bool:
+    """Return True when any command segment runs Python with ``-I`` and without ``-X utf8``.
+
+    ::
+
+        python -I script.py             -> True
+        py -3 -I -c pass                -> True
+        python -IX utf8 script.py       -> False
+        python -I -X utf8 script.py     -> False
+        python script.py -I             -> False
+
+    Args:
+        command: The shell command text the agent is about to run.
+    """
+    for each_segment in all_wrapped_command_segments(command):
+        program_name, all_arguments = segment_program_and_arguments(each_segment)
+        if PYTHON_INTERPRETER_BASENAME_PATTERN.fullmatch(program_name.lower()) is None:
+            continue
+        if _isolated_without_utf8_mode(all_arguments):
+            return True
+    return False
+
+
+def has_backslash_quote_in_python_code_argument(command: str) -> bool:
+    """Return True when a ``python -c "..."`` argument holds ``\\"`` in the raw command text.
+
+    ::
+
+        python -c "print(\\"x\\")"     -> True
+        python -c 'print("x")'        -> False
+
+    Args:
+        command: The shell command text the agent is about to run.
+    """
+    return PYTHON_CODE_ARGUMENT_BACKSLASH_QUOTE_PATTERN.search(command) is not None
+
+
+def all_deny_reasons(command: str, tool_name: str) -> list[str]:
+    """Return the deny reason for each Windows Python failure the command would hit.
+
+    Args:
+        command: The shell command text the agent is about to run.
+        tool_name: The tool that runs the command, Bash or PowerShell.
+    """
+    all_reasons: list[str] = []
+    if is_windows_host() and runs_isolated_python_without_utf8_mode(command):
+        all_reasons.append(ISOLATED_PYTHON_DENY_REASON)
+    if (
+        tool_name == POWERSHELL_TOOL_NAME
+        and has_backslash_quote_in_python_code_argument(command)
+    ):
+        all_reasons.append(POWERSHELL_BACKSLASH_QUOTE_DENY_REASON)
+    return all_reasons
+
+
+def _write_deny_decision(reason: str) -> None:
+    sys.stdout.write(
+        json.dumps(
+            {
+                "hookSpecificOutput": {
+                    "hookEventName": HOOK_EVENT_NAME,
+                    "permissionDecision": DENY_DECISION,
+                    "permissionDecisionReason": reason,
+                }
+            }
+        )
+    )
+    sys.stdout.flush()
+
+
+def main() -> None:
+    """Deny a Python invocation that fails on Windows, or stay quiet."""
+    hook_payload = read_hook_input_dictionary_from_stdin()
+    if hook_payload is None:
+        return
+    tool_name = hook_payload.get("tool_name")
+    if tool_name not in ALL_BASH_AND_POWERSHELL_TOOL_NAMES:
+        return
+    tool_input = hook_payload.get("tool_input")
+    if not isinstance(tool_input, dict):
+        return
+    command = tool_input.get("command", "")
+    if not isinstance(command, str):
+        return
+    all_reasons = all_deny_reasons(command, str(tool_name))
+    if not all_reasons:
+        return
+    reason = REASON_JOIN_SEPARATOR.join(all_reasons)
+    log_hook_block(GATE_HOOK_NAME, HOOK_EVENT_NAME, reason, str(tool_name), command)
+    _write_deny_decision(reason)
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/test_bash_dispatcher_interpreter_starts.py

@@ -22,7 +22,7 @@ from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
 )
 
 
-def test_bash_roster_starts_only_the_msys_rewriter_and_the_three_gates() -> None:
+def test_bash_roster_starts_only_the_msys_rewriter_and_the_four_gates() -> None:
     assert ALL_BASH_HOSTED_HOOK_ENTRIES == (
         BashHostedHookEntry(
             script_relative_path="blocking/msys_rev_path_rewriter.py",
@@ -42,4 +42,8 @@ def test_bash_roster_starts_only_the_msys_rewriter_and_the_three_gates() -> None
             script_relative_path="blocking/cloud_graphql_gate.py",
             applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
         ),
+        BashHostedHookEntry(
+            script_relative_path="blocking/python_windows_invocation_gate.py",
+            applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+        ),
     )

package/hooks/blocking/test_bash_pre_tool_use_dispatcher.py

@@ -273,6 +273,7 @@ def test_should_drop_the_gates_the_shell_guards_mod_holds_while_it_is_on(
     assert all_script_paths == [
         "blocking/msys_rev_path_rewriter.py",
         "blocking/cloud_graphql_gate.py",
+        "blocking/python_windows_invocation_gate.py",
     ]
 
 

package/hooks/blocking/test_open_tasks_stop_gate.py

@@ -1,3 +1,4 @@
+import importlib
 import io
 import json
 import subprocess
@@ -295,3 +296,204 @@ def test_should_allow_a_cursor_stop_after_five_followups(
     transcript_path = write_cursor_transcript(tmp_path / "cursor.jsonl", [cursor_todo_record(all_todos, False, "Done.")])
     assert "rotate the deploy key" in run_cursor_gate(monkeypatch, capsys, transcript_path, loop_count=4)["followup_message"]
     assert run_cursor_gate(monkeypatch, capsys, transcript_path, loop_count=5) == {}
+
+
+def ccd_plan_record(all_plan_input: dict[str, object]) -> dict[str, object]:
+    tool_use = {"type": "tool_use", "id": "p1", "name": "mcp__ccd_turn__update_plan", "input": all_plan_input}
+    return {"type": "assistant", "timestamp": "2026-01-01T00:00:00.000Z", "message": {"content": [tool_use]}}
+
+
+def assistant_text_record(reply_text: str) -> dict[str, object]:
+    return {"type": "assistant", "message": {"role": "assistant", "content": [{"type": "text", "text": reply_text}]}}
+
+
+def write_records(transcript_path: Path, all_records: list[dict[str, object]]) -> Path:
+    transcript_path.write_text("\n".join(json.dumps(each_record) for each_record in all_records), encoding="utf-8")
+    return transcript_path
+
+
+def block_reason(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+    reply_text: str,
+    transcript_path: Path | None = None,
+) -> str:
+    _, stdout_text = run_gate(monkeypatch, capsys, reply_text, transcript_path)
+    return json.loads(stdout_text)["reason"] if stdout_text else ""
+
+
+def record_ask(prompt_text: str) -> str | None:
+    return importlib.import_module("open_task_asks").record_prompt(SESSION_ID, prompt_text)
+
+
+def submit_and_replace_list(tmp_path: Path) -> Path:
+    return write_records(
+        tmp_path / "s.jsonl",
+        [
+            ccd_plan_record({"items": [{"content": "Submit both APKs", "status": "pending"}], "scope": "first_task"}),
+            ccd_plan_record({"items": [{"content": "Set rows in Neon", "status": "completed"}], "scope": "continuation"}),
+        ],
+    )
+
+
+def test_should_hold_an_interrupted_ask_after_the_user_redirects(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    assert record_ask("Export the OneUI8 and OneUI9 APKs and submit them") == "ask-1"
+    assert record_ask("Set the 8 rows to Ready to Export in Neon") == "ask-2"
+    transcript_path = write_records(
+        tmp_path / "s.jsonl",
+        [ccd_plan_record({"items": [{"content": "Set the 8 rows in Neon", "status": "completed"}], "scope": "continuation"})],
+    )
+    reason_text = block_reason(monkeypatch, capsys, "Rows set.\nDone: #ask-2", transcript_path)
+    assert "#ask-1" in reason_text
+    assert "OneUI9" in reason_text
+    assert "#ask-2" not in reason_text
+
+
+def test_should_hold_plan_items_a_continuation_list_dropped(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    first_items = [
+        {"content": "Export the OneUI8 APK", "status": "in_progress"},
+        {"content": "Submit both APKs", "status": "pending"},
+    ]
+    transcript_path = write_records(
+        tmp_path / "s.jsonl",
+        [
+            ccd_plan_record({"items": first_items, "scope": "first_task"}),
+            ccd_plan_record({"scope": "continuation", "items": [{"content": "Set rows in Neon", "status": "completed"}]}),
+        ],
+    )
+    reason_text = block_reason(monkeypatch, capsys, "Rows set.", transcript_path)
+    assert "Export the OneUI8 APK" in reason_text
+    assert "Submit both APKs" in reason_text
+    assert "Set rows in Neon" not in reason_text
+
+
+def test_should_hold_an_ask_that_never_reached_a_plan(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    record_ask("Export the OneUI8 and OneUI9 APKs and submit them")
+    reason_text = block_reason(monkeypatch, capsys, "Done.")
+    assert "#ask-1: Export the OneUI8 and OneUI9 APKs and submit them" in reason_text
+    assert "Done: #ask-N" in reason_text
+
+
+def test_should_merge_the_task_store_with_the_ccd_plan(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    write_task_store(tmp_path, [{"id": "1", "subject": "Rotate the deploy key", "status": "pending"}])
+    transcript_path = write_records(
+        tmp_path / "s.jsonl",
+        [ccd_plan_record({"items": [{"content": "Port the hook", "status": "in_progress"}], "scope": "first_task"})],
+    )
+    reason_text = block_reason(monkeypatch, capsys, "Done.", transcript_path)
+    assert "Rotate the deploy key" in reason_text
+    assert "Port the hook" in reason_text
+
+
+def test_should_hold_an_ask_whose_subject_matches_a_completed_task(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    write_task_store(tmp_path, [{"id": "1", "subject": "Fix login", "status": "completed"}])
+    assert record_ask("Fix login") == "ask-1"
+    reason_text = block_reason(monkeypatch, capsys, "Done.")
+    assert "#ask-1: Fix login" in reason_text
+
+
+def test_should_record_nothing_for_a_question_only_prompt(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    assert record_ask("wait, did the export fail?") is None
+    assert record_ask("are you monitoring these? yes or no") is None
+    assert run_gate(monkeypatch, capsys, "No, it passed.") == (0, "")
+
+
+def test_should_not_close_a_plan_item_on_a_done_line(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = write_records(
+        tmp_path / "s.jsonl",
+        [ccd_plan_record({"items": [{"content": "Port the hook", "status": "in_progress"}], "scope": "first_task"})],
+    )
+    assert "Port the hook" in block_reason(monkeypatch, capsys, "Done: Port the hook", transcript_path)
+
+
+def test_should_close_an_ask_and_a_carried_item_on_a_dropped_line_quoting_the_user(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    record_ask("Export the OneUI8 and OneUI9 APKs and submit them")
+    transcript_path = submit_and_replace_list(tmp_path)
+    record_ask("Skip the APK export for now, set the rows instead")
+    reply_text = (
+        "Rows set.\nDone: #ask-2\n"
+        'Dropped: #ask-1 - "skip the APK export for now"\n'
+        'Dropped: Submit both APKs - "Skip the APK export"'
+    )
+    assert run_gate(monkeypatch, capsys, reply_text, transcript_path) == (0, "")
+    with transcript_path.open("a", encoding="utf-8") as transcript_handle:
+        transcript_handle.write("\n" + json.dumps(assistant_text_record(reply_text)))
+    assert run_gate(monkeypatch, capsys, "Nothing else.", transcript_path) == (0, "")
+
+
+def test_should_hold_a_dropped_line_whose_quote_the_user_never_wrote(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    record_ask("Export the OneUI8 and OneUI9 APKs and submit them")
+    transcript_path = submit_and_replace_list(tmp_path)
+    record_ask("Set the rows next")
+    reply_text = 'Dropped: #ask-1 - "the user cancelled the export"\nDropped: Submit both APKs - "skip it, it is done"'
+    reason_text = block_reason(monkeypatch, capsys, reply_text, transcript_path)
+    assert "#ask-1" in reason_text
+    assert "Submit both APKs" in reason_text
+
+
+def test_should_hold_a_dropped_line_quoting_the_ask_itself(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    record_ask("Export the OneUI8 and OneUI9 APKs and submit them")
+    reason_text = block_reason(monkeypatch, capsys, 'Dropped: #ask-1 - "Export the OneUI8"')
+    assert "#ask-1" in reason_text
+
+
+def test_should_hold_an_ask_again_when_the_next_reply_omits_its_open_line(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    record_ask("Export the OneUI8 and OneUI9 APKs and submit them")
+    first_reply = "Open: #ask-1 - the export job runs next"
+    assert run_gate(monkeypatch, capsys, first_reply) == (0, "")
+    transcript_path = write_records(tmp_path / "s.jsonl", [assistant_text_record(first_reply)])
+    assert "#ask-1" in block_reason(monkeypatch, capsys, "Still running.", transcript_path)
+
+
+def test_should_allow_the_stop_once_a_carried_item_is_listed_completed(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = submit_and_replace_list(tmp_path)
+    assert "Submit both APKs" in block_reason(monkeypatch, capsys, "Rows set.", transcript_path)
+    with transcript_path.open("a", encoding="utf-8") as transcript_handle:
+        relisted = ccd_plan_record({"items": [{"content": "Submit both APKs", "status": "completed"}], "scope": "continuation"})
+        transcript_handle.write("\n" + json.dumps(relisted))
+    assert run_gate(monkeypatch, capsys, "Both submitted.", transcript_path) == (0, "")
+
+
+def test_should_mark_the_right_item_for_a_done_index_after_a_continuation(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    replacing_items = [
+        {"content": "Read the schema", "status": "in_progress"},
+        {"content": "Set rows in Neon", "status": "pending"},
+    ]
+    transcript_path = write_records(
+        tmp_path / "s.jsonl",
+        [
+            ccd_plan_record({"items": [{"content": "Submit both APKs", "status": "pending"}], "scope": "first_task"}),
+            ccd_plan_record({"items": replacing_items, "scope": "continuation"}),
+            ccd_plan_record({"done": [1, 2]}),
+        ],
+    )
+    reason_text = block_reason(monkeypatch, capsys, "Rows set.", transcript_path)
+    assert "Submit both APKs" in reason_text
+    assert "Read the schema" not in reason_text
+    assert "Set rows in Neon" not in reason_text

package/hooks/blocking/test_open_tasks_transcript.py

@@ -52,3 +52,92 @@ def test_should_parse_only_json_objects() -> None:
     assert parsed_object('{"a": 1}') == {"a": 1}
     assert parsed_object("[1]") is None
     assert parsed_object("not json") is None
+
+
+def ccd_plan_record(all_plan_input: dict[str, object], record_type: str = "assistant") -> dict[str, object]:
+    tool_use = {"type": "tool_use", "id": "p1", "name": "mcp__ccd_turn__update_plan", "input": all_plan_input}
+    return {"type": record_type, "timestamp": "2026-01-01T00:00:00.000Z", "message": {"content": [tool_use]}}
+
+
+def plan_statuses(transcript_path: Path) -> list[tuple[str, str, bool]]:
+    all_items = replayed_transcript(str(transcript_path)).items() or []
+    return [(each_item.subject, each_item.status, each_item.is_carried) for each_item in all_items]
+
+
+def test_should_replay_ccd_turn_advance_once_and_skip_request_blob_copies(tmp_path: Path) -> None:
+    all_items = [
+        {"content": "Read the gate", "status": "in_progress"},
+        {"content": "Write the tests", "status": "pending"},
+        {"content": "Open the PR", "status": "pending"},
+    ]
+    transcript_path = write_transcript(
+        tmp_path / "ccd.jsonl",
+        [
+            ccd_plan_record({"items": all_items, "scope": "first_task"}),
+            ccd_plan_record({"advance": True}),
+            ccd_plan_record({"advance": True}, record_type="api-request-blob"),
+        ],
+    )
+    assert plan_statuses(transcript_path) == [
+        ("Read the gate", "completed", False),
+        ("Write the tests", "in_progress", False),
+        ("Open the PR", "pending", False),
+    ]
+
+
+def test_should_carry_unfinished_items_after_the_replacing_list(tmp_path: Path) -> None:
+    first_items = [
+        {"content": "Export the OneUI8 APK", "status": "in_progress"},
+        {"content": "Submit both APKs", "status": "pending"},
+        {"content": "Find the rows", "status": "completed"},
+    ]
+    transcript_path = write_transcript(
+        tmp_path / "ccd.jsonl",
+        [
+            ccd_plan_record({"items": first_items, "scope": "first_task"}),
+            ccd_plan_record({"scope": "continuation", "items": [{"content": "Set rows in Neon", "status": "in_progress"}]}),
+        ],
+    )
+    assert plan_statuses(transcript_path) == [
+        ("Set rows in Neon", "in_progress", False),
+        ("Export the OneUI8 APK", "in_progress", True),
+        ("Submit both APKs", "pending", True),
+    ]
+
+
+def test_should_point_done_and_start_indices_at_the_tools_own_items(tmp_path: Path) -> None:
+    transcript_path = write_transcript(
+        tmp_path / "ccd.jsonl",
+        [
+            ccd_plan_record({"items": [{"content": "Alpha", "status": "pending"}], "scope": "first_task"}),
+            ccd_plan_record(
+                {
+                    "items": [{"content": "Beta", "status": "in_progress"}, {"content": "Gamma", "status": "pending"}],
+                    "scope": "continuation",
+                }
+            ),
+            ccd_plan_record({"done": [1, 3], "start": 2}),
+        ],
+    )
+    assert plan_statuses(transcript_path) == [
+        ("Beta", "completed", False),
+        ("Gamma", "in_progress", False),
+        ("Alpha", "pending", True),
+    ]
+
+
+def test_should_let_a_later_list_close_a_carried_item_by_subject(tmp_path: Path) -> None:
+    transcript_path = write_transcript(
+        tmp_path / "ccd.jsonl",
+        [
+            ccd_plan_record({"items": [{"content": "Alpha", "status": "pending"}], "scope": "first_task"}),
+            ccd_plan_record({"items": [{"content": "Beta", "status": "pending"}], "scope": "continuation"}),
+            ccd_plan_record(
+                {
+                    "items": [{"content": "Beta", "status": "completed"}, {"content": "alpha", "status": "completed"}],
+                    "scope": "continuation",
+                }
+            ),
+        ],
+    )
+    assert plan_statuses(transcript_path) == [("Beta", "completed", False), ("alpha", "completed", False)]

package/hooks/blocking/test_pr_lifecycle_skill_gate.py

@@ -66,6 +66,14 @@ def test_unloaded_pull_request_command_is_denied(tmp_path: Path) -> None:
     assert "same command again" in decision["permissionDecisionReason"]
 
 
+def test_executable_word_lists_reads_chains_prefixes_and_shell_wrappers() -> None:
+    assert gate.executable_word_lists("cd repo && env A=1 git commit -m x") == [
+        ["cd", "repo"],
+        ["git", "commit", "-m", "x"],
+    ]
+    assert gate.executable_word_lists("bash -c 'git add x; git commit'")[-2:] == [["git", "add", "x"], ["git", "commit"]]
+
+
 def test_loaded_skill_allows_action_silently(tmp_path: Path) -> None:
     path = _transcript(tmp_path, "plugin:pr-lifecycle")
     assert _run_main(_payload("gh pr view", path)) == (0, "")