claude-dev-env 8.97.0 → 8.98.0

package/hooks/blocking/verify_before_commit_gate.py

@@ -0,0 +1,278 @@
+"""Deny a code commit until the repository's verify skill loads in the current turn."""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from collections.abc import Iterable
+from dataclasses import dataclass
+from pathlib import Path, PurePosixPath
+
+hooks_directory = str(Path(__file__).resolve().parent.parent)
+if hooks_directory not in sys.path:
+    sys.path.insert(0, hooks_directory)
+
+from blocking.pr_lifecycle_skill_gate import (
+    deny_decision,
+    executable_word_lists,
+    file_name,
+    next_command_word,
+    transcript_paths,
+)
+from hooks_constants.pr_lifecycle_skill_gate_constants import (
+    GIT_GLOBAL_OPTIONS_WITH_VALUE,
+    SHELL_TOOL_NAMES,
+)
+from hooks_constants.pre_tool_use_stdin import print_decision_from_stdin
+from hooks_constants.setup_project_paths_constants import (
+    DECODE_ERRORS_POLICY,
+    UTF8_ENCODING,
+)
+from hooks_constants.verify_before_commit_gate_constants import (
+    ADD_ACTION,
+    ALL_ADD_EVERYTHING_OPTIONS,
+    ALL_COMMIT_ALL_OPTIONS,
+    ALL_COMMIT_VALUED_SHORT_FLAGS,
+    ALL_DOCS_EXTENSIONS,
+    ALL_GIT_EXECUTABLES,
+    ALL_SLASH_COMMAND_MARKERS,
+    ALL_STAGED_PATHS_ARGUMENTS,
+    ALL_TEST_DIRECTORY_NAMES,
+    ALL_TEST_FILE_INFIXES,
+    ALL_TEST_FILE_NAMES,
+    ALL_TEST_FILE_PREFIXES,
+    ALL_TEST_FILE_SUFFIXES,
+    ALL_TOP_LEVEL_ARGUMENTS,
+    ALL_TRACKED_CHANGE_ARGUMENTS,
+    ALL_VERIFY_SKILL_DIRECTORIES,
+    ALL_WORKING_TREE_PATHS_ARGUMENTS,
+    COMMIT_ACTION,
+    COMMIT_ALL_SHORT_FLAG,
+    DENY_REASON,
+    GIT_DIRECTORY_OPTION,
+    GIT_TIMEOUT_SECONDS,
+    PATHSPEC_TERMINATOR,
+    SKILL_NAME,
+    WHOLE_TREE_PATHSPEC,
+)
+from transcript_skill_scan import is_skill_loaded_since_last_prompt
+
+
+@dataclass(frozen=True)
+class GitCall:
+    """One git command in a shell command: its directory, action, and the words after the action."""
+
+    directory: Path
+    action: str
+    all_arguments: tuple[str, ...]
+
+
+def _git_directory(all_global_words: list[str], base_directory: Path) -> Path:
+    directory = base_directory
+    for each_index, each_word in enumerate(all_global_words[:-1]):
+        if each_word == GIT_DIRECTORY_OPTION:
+            directory = directory / all_global_words[each_index + 1]
+    return directory
+
+
+def _git_calls(command: str, base_directory: Path) -> list[GitCall]:
+    all_calls: list[GitCall] = []
+    for each_words in executable_word_lists(command):
+        if file_name(each_words[0]) not in ALL_GIT_EXECUTABLES:
+            continue
+        action, after_action = next_command_word(
+            each_words, 1, GIT_GLOBAL_OPTIONS_WITH_VALUE
+        )
+        if action is None:
+            continue
+        directory = _git_directory(each_words[1 : after_action - 1], base_directory)
+        all_calls.append(GitCall(directory, action, tuple(each_words[after_action:])))
+    return all_calls
+
+
+def _git_lines(directory: Path, all_arguments: Iterable[str]) -> list[str] | None:
+    try:
+        completed = subprocess.run(
+            ["git", "-C", str(directory), *all_arguments],
+            capture_output=True,
+            text=True,
+            encoding=UTF8_ENCODING,
+            errors=DECODE_ERRORS_POLICY,
+            timeout=GIT_TIMEOUT_SECONDS,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if completed.returncode != 0:
+        return None
+    return [each_line for each_line in completed.stdout.splitlines() if each_line]
+
+
+def _short_flag_cluster(cluster: str) -> tuple[bool, bool]:
+    for each_flag in cluster[1:]:
+        if each_flag == COMMIT_ALL_SHORT_FLAG:
+            return True, False
+        if each_flag in ALL_COMMIT_VALUED_SHORT_FLAGS:
+            return False, cluster.endswith(each_flag)
+    return False, False
+
+
+def _commits_all_tracked_changes(all_arguments: tuple[str, ...]) -> bool:
+    skips_value = False
+    for each_word in all_arguments:
+        if skips_value:
+            skips_value = False
+            continue
+        if each_word == PATHSPEC_TERMINATOR:
+            return False
+        if each_word in ALL_COMMIT_ALL_OPTIONS:
+            return True
+        is_short_cluster = each_word.startswith("-") and not each_word.startswith("--")
+        commits_all, skips_value = _short_flag_cluster(each_word) if is_short_cluster else (False, False)
+        if commits_all:
+            return True
+    return False
+
+
+def _added_pathspecs(all_arguments: tuple[str, ...]) -> list[str]:
+    terminator_index = (
+        all_arguments.index(PATHSPEC_TERMINATOR) if PATHSPEC_TERMINATOR in all_arguments else len(all_arguments)
+    )
+    all_option_words = all_arguments[:terminator_index]
+    all_pathspecs = [each_word for each_word in all_option_words if not each_word.startswith("-")]
+    all_pathspecs.extend(all_arguments[terminator_index + 1 :])
+    if not all_pathspecs and any(each_word in ALL_ADD_EVERYTHING_OPTIONS for each_word in all_option_words):
+        return [WHOLE_TREE_PATHSPEC]
+    return all_pathspecs
+
+
+def _committed_paths(
+    commit: GitCall, all_earlier_calls: list[GitCall]
+) -> set[str] | None:
+    staged_paths = _git_lines(commit.directory, ALL_STAGED_PATHS_ARGUMENTS)
+    if staged_paths is None:
+        return None
+    all_paths = set(staged_paths)
+    if _commits_all_tracked_changes(commit.all_arguments):
+        all_paths.update(
+            _git_lines(commit.directory, ALL_TRACKED_CHANGE_ARGUMENTS) or []
+        )
+    for each_call in all_earlier_calls:
+        if each_call.action != ADD_ACTION or each_call.directory != commit.directory:
+            continue
+        all_pathspecs = _added_pathspecs(each_call.all_arguments)
+        if all_pathspecs:
+            all_working_tree_arguments = (
+                *ALL_WORKING_TREE_PATHS_ARGUMENTS,
+                *all_pathspecs,
+            )
+            all_paths.update(
+                _git_lines(each_call.directory, all_working_tree_arguments) or []
+            )
+    return all_paths
+
+
+def _is_docs_or_test_path(repository_path: str) -> bool:
+    path = PurePosixPath(repository_path)
+    if path.suffix.lower() in ALL_DOCS_EXTENSIONS or path.name in ALL_TEST_FILE_NAMES:
+        return True
+    if any(each_part in ALL_TEST_DIRECTORY_NAMES for each_part in path.parts[:-1]):
+        return True
+    return (
+        path.name.startswith(ALL_TEST_FILE_PREFIXES)
+        or path.name.endswith(ALL_TEST_FILE_SUFFIXES)
+        or any(each_infix in path.name for each_infix in ALL_TEST_FILE_INFIXES)
+    )
+
+
+def _has_verify_skill(directory: Path) -> bool:
+    top_level = _git_lines(directory, ALL_TOP_LEVEL_ARGUMENTS)
+    if not top_level:
+        return False
+    repository_root = Path(top_level[0])
+    return any(
+        (repository_root / each_directory).is_dir()
+        for each_directory in ALL_VERIFY_SKILL_DIRECTORIES
+    )
+
+
+def _verify_load_status(transcript_path: str) -> bool | None:
+    try:
+        with open(
+            transcript_path, encoding=UTF8_ENCODING, errors=DECODE_ERRORS_POLICY
+        ) as transcript:
+            return is_skill_loaded_since_last_prompt(
+                transcript, (SKILL_NAME,), ALL_SLASH_COMMAND_MARKERS
+            )
+    except OSError:
+        return None
+
+
+def _is_verified_or_unreadable(all_payload_fields: dict[str, object]) -> bool:
+    all_paths = transcript_paths(all_payload_fields)
+    if not all_paths:
+        return True
+    return any(_verify_load_status(each_path) is not False for each_path in all_paths)
+
+
+def _commits_code(all_git_calls: list[GitCall]) -> bool:
+    for each_index, each_call in enumerate(all_git_calls):
+        if each_call.action != COMMIT_ACTION or not _has_verify_skill(
+            each_call.directory
+        ):
+            continue
+        all_paths = _committed_paths(each_call, all_git_calls[:each_index])
+        if all_paths and not all(
+            _is_docs_or_test_path(each_path) for each_path in all_paths
+        ):
+            return True
+    return False
+
+
+def _shell_command(all_payload_fields: dict[str, object]) -> str | None:
+    if all_payload_fields.get("tool_name") not in SHELL_TOOL_NAMES:
+        return None
+    tool_input = all_payload_fields.get("tool_input")
+    command = tool_input.get("command") if isinstance(tool_input, dict) else None
+    return command if isinstance(command, str) else None
+
+
+def decision_for(all_payload_fields: dict[str, object]) -> dict[str, object] | None:
+    """Return a deny for a code commit made before the verify skill loads this turn, else None.
+
+    ::
+
+        git commit, code staged, no verify since the last prompt      -> DENY_REASON
+        git add app.py; git commit, empty index, no verify            -> DENY_REASON
+        git commit, only docs or test files                           -> None
+        git commit after a verify Skill call or a /verify prompt      -> None
+        git commit in a repository with no verify skill directory     -> None
+        transcript missing or unreadable, or git fails                -> None
+
+    Args:
+        all_payload_fields: The parsed PreToolUse input.
+    """
+    command = _shell_command(all_payload_fields)
+    if command is None:
+        return None
+    working_directory = all_payload_fields.get("cwd")
+    base_directory = (
+        Path(working_directory) if isinstance(working_directory, str) else Path.cwd()
+    )
+    all_git_calls = _git_calls(command, base_directory)
+    if not any(each_call.action == COMMIT_ACTION for each_call in all_git_calls):
+        return None
+    if _is_verified_or_unreadable(all_payload_fields) or not _commits_code(
+        all_git_calls
+    ):
+        return None
+    return deny_decision(DENY_REASON)
+
+
+def main() -> int:
+    """Read one payload, print a deny when needed, and exit zero."""
+    return print_decision_from_stdin(decision_for)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/hooks/features/bash-dispatchers.md

@@ -9,6 +9,7 @@ This family rewrites a Git Bash command when path conversion would change a revi
 - `blocking/headless_claude_broker_gate.py` denies a headless `claude -p` or `claude --print` call and names the broker command to run instead.
 - `blocking/gh_global_account_switch_gate.py` denies `gh auth switch`, `gh auth login`, and `gh auth logout` and names the per-command `GH_TOKEN` form to run instead.
 - `blocking/cloud_graphql_gate.py` denies the `gh` commands that call GraphQL (`gh api graphql` with any flags before the endpoint, `gh pr`, `gh issue`, `gh project` and `gh discussion` except `gh pr diff` and `gh pr list --web`, `gh status`, `gh org list`, `gh release list`, `gh release view` with a tag, `gh workflow run` without `--ref`, and a few `repo`, `label`, `search`, `ruleset` and `gist` commands, read past `if`, `!` and command substitutions) and an HTTP client or `python -c` style call to `api.github.com/graphql`, with or without a port, inside a cloud session, where the proxy answers GraphQL with HTTP 403, and names the REST routes to run instead.
+- `blocking/python_windows_invocation_gate.py` denies, on a Windows host, `python`, `python3` or `py` run with `-I` and without `-X utf8`, because `-I` ignores `PYTHONUTF8` and non-ASCII output then stops with `UnicodeEncodeError: 'charmap'`. Under the PowerShell tool it also denies a `python -c "..."` argument that holds `\"`, because PowerShell ends the string at that quote, and names a script file or a single-quoted here-string to use instead.
 - `blocking/bash_post_call_dispatcher.py` runs hosted observers and joins their context output without blocking the call.
 - `advisory/pr_done_reminder.py` adds a pull request checklist after a successful push or pull request creation.
 - `advisory/owned_pr_review_loop.py` adds review-loop instructions after the agent opens a pull request on an owned repository outside the preset list of repositories that run their own automated review: run efficient-review until clean, mark the pull request ready, babysit it, and ship it to merge. It also records the pull request for the session in `owned_pr_session_record.py`.
@@ -21,6 +22,7 @@ This family rewrites a Git Bash command when path conversion would change a revi
 - `blocking/headless_claude_broker_gate.py` runs inside that dispatcher on `PreToolUse`, matcher `Bash`, timeout `60` seconds, for the Bash and PowerShell tools.
 - `blocking/gh_global_account_switch_gate.py` runs inside that dispatcher on `PreToolUse`, matcher `Bash`, timeout `60` seconds, for the Bash and PowerShell tools.
 - `blocking/cloud_graphql_gate.py` runs inside that dispatcher on `PreToolUse`, matcher `Bash`, timeout `60` seconds, for the Bash and PowerShell tools, when `CLAUDE_CODE_REMOTE` is `true`.
+- `blocking/python_windows_invocation_gate.py` runs inside that dispatcher on `PreToolUse`, matcher `Bash`, timeout `60` seconds, for the Bash and PowerShell tools. The `-I` check runs only when `os.name` is `nt`.
 - `blocking/bash_post_call_dispatcher.py` runs on `PostToolUse`, matcher `Bash|PowerShell`, timeout `60` seconds in `hooks.json`.
 - `advisory/pr_done_reminder.py` runs inside that dispatcher on `PostToolUse`, matcher `Bash|PowerShell`, timeout `60` seconds. `ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES` selects `Bash` and `PowerShell`.
 - `advisory/owned_pr_review_loop.py` runs on `PostToolUse`, matcher `Bash|PowerShell|exec_command|shell_command|mcp__.*__(create_pull_request|github_create_pull_request)`, timeout `10` seconds in `hooks.json`. It wakes on `gh pr create`, `gh pr new`, a POST to `gh api repos/<owner>/<repo>/pulls`, a `pull_request.py create` call to the pull request publisher, and an MCP pull request creation. The installer also registers it on Codex `PostToolUse` through `ALL_CODEX_NATIVE_POST_TOOL_USE_HOOK_SCRIPT_NAMES`.
@@ -36,6 +38,7 @@ Preconditions:
 - **Revision rewrite.** Input is a Git command with `origin/main:.claude/settings.json`. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_msys_rev_path_rewriter.py -q`. The adjacent test observes the `origin/main:` exclusion prefix.
 - **Broker gate.** Input is a `claude -p task` command. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_headless_claude_broker_gate.py -q`. The adjacent test observes a denial that names the broker command.
 - **Cloud GraphQL gate.** Input is a `gh api graphql` command with `CLAUDE_CODE_REMOTE=true`. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_cloud_graphql_gate.py -q`. The adjacent test observes a denial that names the REST routes, and silence outside a cloud session.
+- **Python Windows invocation gate.** Input is `python -I s.py` on Windows, and a PowerShell `python -c "print(\"x\")"`. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_python_windows_invocation_gate.py -q`. The adjacent test observes a denial that names `-X utf8` or the here-string, and a pass for `-IX utf8`, `-I -X utf8`, and the Bash tool.
 - **Post-call dispatch.** Input is a Bash call that yields hosted context. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_bash_post_call_dispatcher.py -q`. The adjacent test observes a joined context payload and exit code zero.
 - **Pull request reminder.** Input is a completed push or pull request creation. Run `python -m pytest packages/claude-dev-env/hooks/advisory/test_pr_done_reminder.py -q`. The adjacent test checks the reminder trigger and checklist verdict.
 - **Owned pull request review loop.** Input is a pull request creation result on an owned repository. Run `python -m pytest packages/claude-dev-env/hooks/advisory/test_owned_pr_review_loop.py -q`. The adjacent test observes the review-loop block for owned repositories and silence for the preset and foreign repositories.

package/hooks/features/conduct-gates.md

@@ -6,7 +6,8 @@ This family stops a chat reply, edited message, or tool call when its payload br
 
 - `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link. It denies a sentence that guesses, estimates, hedges a duration, or admits a skipped check, such as "I didn't confirm this one." It denies a cited Actions run, pull request, or run, job, or check id that no successful tool result in the transcript shows; a subagent's report is the result of its Agent call. A question card from `AskUserQuestion` gets the banned word check and `unvalidated_claim_violation`, like a decision card. With visual reply mode on, it also runs the checks in `visual_reply_rules.py` from the rule list in `rules/visual-reply-rules.json`: no abbreviation or tracker number outside a link, a widget or page before a reply of more than one sentence, and no anchor link inside widget code. The mode is off by default; `~/.claude/visual-reply-mode.json` with `{"enabled": true}` turns the mode checks on.
 - `blocking/final_reply_gate.py` applies the banned words, `unvalidated_claim_violation`, and `unseen_citation_violation` from the reply gate to the reply a session ends its turn with. Its `windows_path_violation` blocks a path the terminal would render without one of its backslashes.
-- `blocking/open_tasks_stop_gate.py` holds the end of a turn while the session task list has items that are neither completed nor named on a `Blocked:` or `Open:` line of the closing reply. `blocking/open_tasks_transcript.py` rebuilds the task list and the last reply from the transcript for it.
+- `blocking/open_tasks_stop_gate.py` holds the end of a turn while the session has open items that the closing reply does not name on a `Blocked:` or `Open:` line. It merges the task store, the transcript task calls, the desktop `mcp__ccd_turn__update_plan` plan, and the recorded asks, one item per subject. `blocking/open_tasks_transcript.py` rebuilds the task list and the last reply from the transcript for it. Each new desktop plan list carries the unfinished items of the list before it after its own items, so `done` and `start` positions still point at its own items. An ask stays open until a reply line `Done: #ask-N` closes it. A line `Dropped: <#ask-N or carried item> - "<quote>"` closes an ask or a carried plan item when the quote is in a prompt the user sent after that ask or that list.
+- `session/open_task_ask_recorder.py` records each prompt in `~/.claude/open-task-asks/<session id>.json`, outside the task store. A prompt that asks for work gets the next `#ask-N` id. A question-only prompt, an acknowledgement such as `thanks!`, an empty prompt, and a harness envelope such as `<task-notification>` get none.
 - The claim judge is a `prompt` hook in `hooks.json`, with no `model` set, so Claude Code's small default hook model reads each chat message and denies the first claim about how code, a file, a tool, a service, a run, or a process behaves, or why something happened, when nothing in the message shows it: inline code that quotes output or a code line, a file and line, or a link. A pull request link covers what that change does, what it blocks or lets through, and its checks. The author's own actions, a restatement of the user's words, questions, instructions, and a decision card's option consequences pass. It catches the plain claims the causal word list in `blocking/reply_length_gate.py` misses, such as "The code lets any of them rewrite it mid-check." `continueOnBlock` returns the reason to the agent as the tool error, so it can add the source and send again. The installer owns it through the `claude-dev-env: ` prefix on its `statusMessage`. It skips `post_widget`, whose input is SVG or HTML markup.
 - `blocking/chat_reply_gate.py` runs the `reply_length_gate.py` reply checks on a plain chat reply, which is no tool call. On `UserPromptSubmit` it adds the reply rules as `additionalContext`. On `MessageDisplay` it holds each streamed batch until the message ends. A message that passes shows whole. A message that fails shows as a draft from `claude -p` on Haiku that passes the same checks, and the original shows when two drafts fail. The draft changes only the text on screen, so the next `UserPromptSubmit` tells the agent the text the user saw, and `SessionEnd` deletes the stored draft. The [reply arena harness](https://github.com/jl-cmd-projects/claude-dev-env/tree/160349b90f627ea542fc6bc7b2b7f86dcbf98b73/tests/reply_arena) ran the comparison that chose this display path.
 - `blocking/edit_marker_gate.py` rejects strikethrough and edit-note markers in replacement chat text or cards.
@@ -16,6 +17,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/step_note_gate.py` requires a status line before a tool call while its opt-in flag is on.
 - `blocking/verify_before_acting.py` blocks a completed mutating call when the agent's reasoning contains an unchecked claim.
 - `blocking/pr_lifecycle_skill_gate.py` denies a commit, push, pull request action, or merge until the `pr-lifecycle` skill appears in the transcript since the last compaction.
+- `blocking/verify_before_commit_gate.py` denies a `git commit` in a repository with a `.claude/skills/verify` or `.agents/skills/verify` directory until the `verify` skill loads after the last user prompt, through a Skill call or the `/verify` command in that prompt. It reads the committed paths from the staged diff, the tracked changes for `-a`, and the paths of each `git add` earlier in the same command, and passes a commit whose paths are all docs, images, or test files.
 - `blocking/build_eval_before_eval_write_gate.py` denies a write to an eval file until a Skill call named exactly `claude-api` with args `build-eval`, or the `/claude-api build-eval` command, appears in the transcript.
 - `blocking/merge_review_gate.py` denies an agent's merge until a review pass on the merged head reported zero findings, or ruled out every finding and linked the posted rulings. It reads the receipt `scripts/merge_review_receipt.py` writes, requires the merge, auto-merge or merge-queue entry to be pinned to that head, and skips repositories listed in `CLAUDE_MERGE_REVIEW_EXEMPT_REPOSITORIES`. Its deny reason names the review command `CLAUDE_MERGE_REVIEW_COMMAND` sets. The reason tells the agent to run that command for the first three passes and `/code-review low --fix <number>` for each later pass; the gate itself counts no passes.
 - `blocking/merge_over_review_offer_gate.py` denies a decision card or question that offers a merge while it names open review findings, a red check, unaddressed review comments, or an override. It reads the whole card as one text: every question, header, context, reason, and option, whether the option is a string or a label with a consequence or description.
@@ -27,6 +29,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/reply_length_gate.py` runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__update_message|mcp__hearthbot__ask_decision|AskUserQuestion|mcp__hearthbot__post_widget`, timeout `10` seconds in `hooks.json`.
 - `blocking/final_reply_gate.py` runs on `Stop`, timeout `10` seconds in `hooks.json`.
 - `blocking/open_tasks_stop_gate.py` runs on `Stop`, timeout `10` seconds in `hooks.json`. The installer also registers it on Codex `Stop` and as a native Cursor `stop` entry in `~/.cursor/hooks.json`, where a block also returns `followup_message`. A Cursor stop with status `aborted` or `error` passes. A Cursor stop whose `loop_count` is 5 or more passes, because a copy Cursor imports from `~/.claude/settings.json` has no follow-up limit.
+- `session/open_task_ask_recorder.py` runs on `UserPromptSubmit`, matcher empty, timeout `10` seconds in `hooks.json`. It prints nothing.
 - The claim judge runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__update_message|mcp__hearthbot__ask_decision`, timeout `30` seconds in `hooks.json`.
 - `blocking/chat_reply_gate.py` runs on `UserPromptSubmit`, matcher empty, timeout `10` seconds, on `MessageDisplay`, timeout `100` seconds, and on `SessionEnd`, timeout `3` seconds, in `hooks.json`.
 - `blocking/edit_marker_gate.py` runs on `PreToolUse`, matcher `mcp__.*__update_message`, timeout `10` seconds in `hooks.json`.
@@ -36,6 +39,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/step_note_gate.py` runs on `PreToolUse`, matcher `*`, timeout `15` seconds in `hooks.json`.
 - `blocking/verify_before_acting.py` runs on `PostToolUse`, matcher `Write|Edit|MultiEdit|NotebookEdit|Agent|Task|apply_patch|Bash|PowerShell|mcp__.*`, timeout `10` seconds in `hooks.json`.
 - `blocking/pr_lifecycle_skill_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request|actions_run_trigger)`, timeout `10` seconds in `hooks.json`.
+- `blocking/verify_before_commit_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell`, timeout `30` seconds in `hooks.json`.
 - `blocking/build_eval_before_eval_write_gate.py` runs on `PreToolUse`, matcher `Write|Edit|MultiEdit|NotebookEdit|apply_patch`, timeout `10` seconds in `hooks.json`.
 - `blocking/merge_review_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__(merge_pull_request|enable_pr_auto_merge)`, timeout `10` seconds in `hooks.json`.
 - `blocking/merge_over_review_offer_gate.py` runs on `PreToolUse`, matcher `AskUserQuestion|mcp__.*__ask_decision`, timeout `10` seconds in `hooks.json`.
@@ -50,7 +54,8 @@ Preconditions:
 
 - **Reply length.** Input is a reply with four sentences, a plain pull request number, an abbreviation, two sentences with no widget this turn, or widget code with an anchor link. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_reply_length_gate.py -q`. The adjacent test observes a denial and its count, link, or mode reason. Widget code with no flowchart passes with a flowchart reminder in `additionalContext`.
 - **Final reply.** Input is a closing reply that says "My guess is one to two hours." or cites a run no tool result shows. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_final_reply_gate.py -q`. The adjacent test observes a `block` decision that quotes the sentence or the citation; a reply that cites a run a tool result shows passes. A reply with a plain-text `D:\Reports\.claude\report.html` is blocked; the same path in backticks or a fenced block passes.
-- **Open tasks.** Input is a session whose task list still has "rotate the deploy key" pending and a closing reply of "Done.". Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_open_tasks_stop_gate.py -q`. The adjacent test observes a `block` decision that names the item; a reply line `Blocked: rotate the deploy key - <what the user must give>` passes.
+- **Open tasks.** Input is a session whose task list still has "rotate the deploy key" pending and a closing reply of "Done.". Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_open_tasks_stop_gate.py -q`. The adjacent test observes a `block` decision that names the item; a reply line `Blocked: rotate the deploy key - <what the user must give>` passes. The same file covers an interrupted ask, a continuation plan list that leaves items out, `Done:` and `Dropped:` lines, and a carried item that a later list marks completed.
+- **Ask recorder.** Input is a `UserPromptSubmit` payload with a work prompt, a question, a `<task-notification>` envelope, and a polite request. Run `python -m pytest packages/claude-dev-env/hooks/session/test_open_task_ask_recorder.py -q`. The adjacent test observes `ask-1` and `ask-2` for the work prompt and the request, no ask for the other two, and empty stdout.
 - **Claim judge.** Input is a headless `claude -p` session with a stub MCP server named `hearthbot` that exposes `reply` and `ask_decision`, told to send "The code lets any of them rewrite it mid-check." The session settings add the `hooks.json` prompt hook. The stub logs zero bytes sent, and the tool error reads `PreToolUse:mcp__hearthbot__reply hook error: [<the prompt>]: Fact with no source: ...`. The same sentence with a `file:line` in backticks posts. A hook whose `model` Claude Code does not recognize lets every message through, so leave `model` unset. Run `node --test packages/claude-dev-env/bin/install.prompt-hook.test.mjs` for the installer side; it observes one managed prompt hook after two installs and none after uninstall.
 - **Chat reply.** Input is a `MessageDisplay` event whose message holds four sentences, the same message split over two batches, and a `UserPromptSubmit` event. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_chat_reply_gate.py -q`. The adjacent test observes the drafter's text in `displayContent`, an empty first batch, no output for three sentences, the original after two failed drafts, the shown draft in the next `additionalContext`, and the stored draft deleted at session end.
 - **Edit marker.** Input is an update message with strikethrough or an edit note. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_edit_marker_gate.py -q`. The adjacent test observes a denial; clean replacement text passes.
@@ -60,6 +65,7 @@ Preconditions:
 - **Step note.** Input is a tool call after a transcript message without a status line while the flag is on. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_step_note_gate.py -q`. The adjacent test observes a block until a status line appears.
 - **Checked claim.** Input is a Write after hedged reasoning in the transcript. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_verify_before_acting.py -q`. The adjacent test observes a block and a logged blocked outcome.
 - **Lifecycle skill.** Input is a `git commit` or `gh pr create` command with no `pr-lifecycle` invocation in the transcript. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_pr_lifecycle_skill_gate.py -q`. The adjacent test observes a denial, then a silent allow once the skill or its slash command appears.
+- **Verify before commit.** Input is `git add app.py; git commit -m change` in a temporary repository with `.agents/skills/verify`, and a transcript with no `verify` load after its last prompt. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_verify_before_commit_gate.py -q`. The adjacent test observes a denial, then a silent allow after a `verify` Skill call or a `/verify` prompt. A load before the last prompt still denies. A docs-only commit, a tests-only commit, and a repository with no verify skill pass.
 - **Eval write.** Input is a Write to `evals/cases.json` with no build-eval call in the transcript. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_build_eval_before_eval_write_gate.py -q`. The adjacent test observes a denial, then an allow once the call appears; a write outside an eval path passes.
 - **Clean review.** Input is a merge with no receipt, a receipt with findings, a merge pinned to a newer head, an unpinned merge, or auto-merge with no head. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_merge_review_gate.py -q`. The adjacent test observes a denial for each; a merge or auto-merge pinned to the clean head and a merge in an exempt repository pass.
 - **Merge offer.** Input is a decision card or AskUserQuestion that offers "Merge now", the merge queue, or a yes to "Merge it now?" while any part of the card names open findings or unaddressed review comments. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_merge_over_review_offer_gate.py -q`. The adjacent test observes a denial for each, including an offer and findings in separate questions; a card with no merge offer, a card about the merge review check itself, a card about shipping a docs change, and a merge offer after a clean review pass.
@@ -68,6 +74,7 @@ Preconditions:
 
 ## Gotchas
 
+- The open tasks gate reads `Done:` and `Dropped:` lines in every assistant text of the transcript, so a close holds for later stops. The ask recorder runs only from `hooks.json`, so Codex and Cursor sessions get no asks.
 - `blocking/step_note_gate.py` is off by default and polls for the transcript record. Subagent calls and unreadable records pass.
 - `blocking/verify_before_acting.py` runs after the tool. A block asks the agent to check the claim and undo a contradicted change.
 - The reply gate counts each nonempty list line as a sentence. Link targets and code spans add no words. Its banned words come from `reply-banned-words.json` in the Claude home, or the file `CLAUDE_REPLY_BANNED_WORDS_PATH` names, with built-in defaults.
@@ -75,6 +82,7 @@ Preconditions:
 - The edit marker gate scans replacement cards as well as the message text.
 - The handoff close gate reads the `body` and `comment` fields of issue tools only. A `gh issue close --comment` command in Bash and a pull request body that closes the issue with `Closes #N` do not reach it.
 - The eval write gate reads Write, Edit, MultiEdit, NotebookEdit and apply_patch calls. A Bash or PowerShell command that writes an eval file reaches it without the gate. An apply_patch that will not parse counts as an eval write when any of its words is an eval path. A missing or unreadable transcript denies the write.
+- The verify gate passes when the transcript is missing or unreadable, or when git cannot resolve the repository. It reads the repository from the payload `cwd` and `git -C`, so a `cd <dir> && git commit` chain is checked against the session directory. A `git commit <pathspec>` that names paths without `git add` is checked against the staged diff only.
 - The lifecycle gate counts only invocations after the last compaction, so a compacted session invokes `pr-lifecycle` again. A missing or unreadable transcript allows the call.
 - The dark mode gate denies a page publish when Node, Playwright or Chromium is missing, and its reason names the install command. It checks both dark signals, `prefers-color-scheme: dark` and `data-theme="dark"` on the root element.
 - The clean-review gate trusts the receipt. A receipt the agent writes by hand with zero findings, or with every finding ruled out and a rulings link, passes, so the pr-lifecycle skill names the review loop that writes it. A `gh pr merge` that names no repository is denied, because the gate cannot tell which repository the current branch belongs to.

package/hooks/hooks.json

@@ -102,6 +102,16 @@
           }
         ]
       },
+      {
+        "matcher": "Bash|PowerShell",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/verify_before_commit_gate.py",
+            "timeout": 30
+          }
+        ]
+      },
       {
         "matcher": "Write|Edit|MultiEdit|NotebookEdit|apply_patch",
         "hooks": [
@@ -314,6 +324,11 @@
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/chat_reply_gate.py",
             "timeout": 10
           },
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/open_task_ask_recorder.py",
+            "timeout": 10
+          },
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session/plugin_change_warning.py",

package/hooks/hooks_constants/bash_pre_tool_use_dispatcher_constants.py

@@ -79,4 +79,8 @@ ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
         script_relative_path="blocking/cloud_graphql_gate.py",
         applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
     ),
+    BashHostedHookEntry(
+        script_relative_path="blocking/python_windows_invocation_gate.py",
+        applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+    ),
 )

package/hooks/hooks_constants/open_tasks_stop_gate_constants.py

@@ -70,3 +70,53 @@ BLOCK_REASON_SUFFIX = (
     " 'Blocked: <item> - <what the user must give>' when only the user can unblock it, or"
     " 'Open: <item> - <the step you take next>' when you are still working it."
 )
+ASK_CLOSE_SUFFIX = (
+    "\nClose a finished ask with a 'Done: #ask-N' line. Close an ask or a carried plan item the user"
+    " called off with 'Dropped: <#ask-N or item> - \"<the user's words that called it off>\"'."
+)
+COMPLETED_STATUS = "completed"
+IN_PROGRESS_STATUS = "in_progress"
+ASSISTANT_RECORD_TYPE = "assistant"
+RECORD_TIMESTAMP_KEY = "timestamp"
+UTC_SUFFIX = "Z"
+UTC_OFFSET_TEXT = "+00:00"
+CCD_PLAN_TOOL_NAME = "mcp__ccd_turn__update_plan"
+CCD_PLAN_ITEMS_KEY = "items"
+CCD_PLAN_CONTENT_KEY = "content"
+CCD_PLAN_DONE_KEY = "done"
+CCD_PLAN_START_KEY = "start"
+CCD_PLAN_ADVANCE_KEY = "advance"
+CCD_PLAN_ITEM_ID_TEMPLATE = "plan-{position}"
+ASK_ID_PREFIX = "ask-"
+ASK_ID_TEMPLATE = "ask-{ask_number}"
+ASK_LINE_TEMPLATE = "\n- #{ask_id}: {subject}"
+ASK_SUBJECT_CHARACTER_LIMIT = 120
+ASK_SUBJECT_ELLIPSIS = "..."
+ASKS_DIRECTORY_NAME = "open-task-asks"
+ASKS_FILE_SUFFIX = ".json"
+ASKS_TEMPORARY_PREFIX = ".open-task-asks-"
+ASKS_TEMPORARY_SUFFIX = ".tmp"
+ASKS_PROMPTS_KEY = "prompts"
+ASK_PROMPT_TEXT_KEY = "text"
+ASK_PROMPT_RECORDED_AT_KEY = "recorded_at"
+ASK_PROMPT_ID_KEY = "ask_id"
+PROMPT_KEY = "prompt"
+SAFE_SESSION_ID_PATTERN = r"[\w-]+"
+SENTENCE_SPLIT_PATTERN = r"(?<=[.!?])\s+|\n+"
+QUESTION_END_PATTERN = r"\?\s*$"
+YES_OR_NO_END_PATTERN = r"\byes\s+or\s+no\W*$"
+INTERROGATIVE_START_PATTERN = (
+    r"^\s*(?:\w+,\s*)?(?:are|is|am|was|were|do|does|did|have|has|had|can|could|will|would"
+    r"|should|shall|may|what|why|how|when|where|which|who|whose)\b"
+)
+ACKNOWLEDGEMENT_PATTERN = (
+    r"^\s*(?:ok(?:ay)?|k|thanks?|thank\s+you|thx|ty|cool|great|nice|perfect|awesome|got\s+it"
+    r"|sounds\s+good|looks\s+good|lgtm)(?:[\s,]+(?:thanks?|thank\s+you))?\W*$"
+)
+POLITE_REQUEST_START_PATTERN = r"^\s*(?:please\b|(?:can|could|would|will)\s+you\b)"
+DONE_LINE_PATTERN = r"^\s*(?:[-*]\s*)?done\b\s*[:\-]?\s*(.*)$"
+DONE_TEXT_GROUP_INDEX = 1
+ASK_REFERENCE_PATTERN = r"#(ask-\d+)\b"
+DROPPED_LINE_PATTERN = r"^\s*(?:[-*]\s*)?dropped\b\s*[:\-]?\s*(.+?)\s+-\s+[\"“](.+?)[\"”]\s*$"
+DROPPED_TARGET_GROUP_INDEX = 1
+DROPPED_QUOTE_GROUP_INDEX = 2

package/hooks/hooks_constants/python_windows_invocation_gate_constants.py

@@ -0,0 +1,60 @@
+"""Constants for the gate that stops two Windows Python invocation failures.
+
+Holds the interpreter option letters the option scan reads, the ``-X`` values
+that turn UTF-8 mode on, the Windows ``os.name`` value, the pattern that finds
+a backslash quote inside a ``python -c "..."`` argument, the hook name the
+block log records, and the two deny messages that name the command to run
+instead.
+"""
+
+from __future__ import annotations
+
+import re
+
+__all__ = [
+    "GATE_HOOK_NAME",
+    "WINDOWS_OS_NAME",
+    "OPTION_PREFIX",
+    "END_OF_OPTIONS_MARKER",
+    "ISOLATED_MODE_OPTION_LETTER",
+    "IMPLEMENTATION_OPTION_LETTER",
+    "ALL_VALUE_OPTION_LETTERS",
+    "ALL_VALUE_LONG_OPTIONS",
+    "ALL_COMMAND_ENDING_OPTION_LETTERS",
+    "ALL_UTF8_MODE_OPTION_VALUES",
+    "PYTHON_CODE_ARGUMENT_BACKSLASH_QUOTE_PATTERN",
+    "ISOLATED_PYTHON_DENY_REASON",
+    "POWERSHELL_BACKSLASH_QUOTE_DENY_REASON",
+]
+
+GATE_HOOK_NAME = "python_windows_invocation_gate"
+WINDOWS_OS_NAME = "nt"
+
+OPTION_PREFIX = "-"
+END_OF_OPTIONS_MARKER = "--"
+ISOLATED_MODE_OPTION_LETTER = "I"
+IMPLEMENTATION_OPTION_LETTER = "X"
+ALL_VALUE_OPTION_LETTERS: frozenset[str] = frozenset({"X", "W", "c", "m"})
+ALL_VALUE_LONG_OPTIONS: frozenset[str] = frozenset({"--check-hash-based-pycs"})
+ALL_COMMAND_ENDING_OPTION_LETTERS: frozenset[str] = frozenset({"c", "m"})
+ALL_UTF8_MODE_OPTION_VALUES: frozenset[str] = frozenset({"utf8", "utf8=1"})
+
+PYTHON_CODE_ARGUMENT_BACKSLASH_QUOTE_PATTERN = re.compile(
+    r"(?<![\w.\-])(?:(?:python|pypy)w?[0-9._]*t?|pyw?)(?:\.exe)?"
+    r"(?:\s+[^\s\"';|&]+)*?"
+    r"\s+-[A-Za-z]*c\s+\"[^\"\n]*\\\"",
+    re.IGNORECASE,
+)
+
+ISOLATED_PYTHON_DENY_REASON = (
+    "BLOCKED: python -I ignores PYTHONUTF8, so on Windows the interpreter writes "
+    "with the console code page and non-ASCII output stops with UnicodeEncodeError: "
+    "'charmap'. Add -X utf8 after -I, as in python -I -X utf8 script.py."
+)
+POWERSHELL_BACKSLASH_QUOTE_DENY_REASON = (
+    'BLOCKED: PowerShell reads a backslash as a plain character, so \\" inside '
+    'python -c "..." ends the string at that quote and Python gets cut code. '
+    "Put the code in a .py file and run the file, or pass it in a single-quoted "
+    "here-string: python -c @' on one line, the code on the next lines, and '@ "
+    "at the start of its own line."
+)

package/hooks/hooks_constants/test_bash_pre_tool_use_dispatcher_constants.py

@@ -12,7 +12,7 @@ ALL_BASH_AND_POWERSHELL_TOOL_NAMES = ALL_CONSTANT_BINDINGS["ALL_BASH_AND_POWERSH
 BashHostedHookEntry = ALL_CONSTANT_BINDINGS["BashHostedHookEntry"]
 
 
-def test_roster_hosts_the_four_gates_and_hands_two_to_the_shell_guards_mod() -> None:
+def test_roster_hosts_the_five_gates_and_hands_two_to_the_shell_guards_mod() -> None:
     assert ALL_BASH_HOSTED_HOOK_ENTRIES == (
         BashHostedHookEntry(
             script_relative_path="blocking/msys_rev_path_rewriter.py",
@@ -32,4 +32,8 @@ def test_roster_hosts_the_four_gates_and_hands_two_to_the_shell_guards_mod() ->
             script_relative_path="blocking/cloud_graphql_gate.py",
             applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
         ),
+        BashHostedHookEntry(
+            script_relative_path="blocking/python_windows_invocation_gate.py",
+            applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+        ),
     )

package/hooks/hooks_constants/transcript_skill_scan_constants.py

@@ -6,3 +6,5 @@ SKILL_TOOL_NAME = "Skill"
 TOOL_USE_BLOCK_TYPE = "tool_use"
 USER_ENTRY_TYPE = "user"
 COMMAND_ARGUMENTS_PATTERN = r"<command-args>(.*?)</command-args>"
+META_ENTRY_FIELD = "isMeta"
+TOOL_RESULT_BLOCK_TYPE = "tool_result"

package/hooks/hooks_constants/verify_before_commit_gate_constants.py

@@ -0,0 +1,54 @@
+"""Constants for the verify-before-commit gate."""
+
+DENY_REASON = (
+    "This repository has a verify skill, and this commit changes code. Invoke the verify "
+    "skill with the Skill tool, run the check it routes you to, then run the same command again. "
+    "A commit that changes only docs or tests passes without it."
+)
+SKILL_NAME = "verify"
+ALL_SLASH_COMMAND_MARKERS = ("<command-name>/verify</command-name>",)
+ALL_VERIFY_SKILL_DIRECTORIES = (".claude/skills/verify", ".agents/skills/verify")
+COMMIT_ACTION = "commit"
+ADD_ACTION = "add"
+ALL_GIT_EXECUTABLES = frozenset({"git", "git.exe"})
+GIT_DIRECTORY_OPTION = "-C"
+ALL_COMMIT_ALL_OPTIONS = frozenset({"-a", "--all"})
+COMMIT_ALL_SHORT_FLAG = "a"
+ALL_COMMIT_VALUED_SHORT_FLAGS = frozenset("mFCct")
+ALL_ADD_EVERYTHING_OPTIONS = frozenset({"-A", "--all", "-u", "--update"})
+WHOLE_TREE_PATHSPEC = ":/"
+PATHSPEC_TERMINATOR = "--"
+GIT_TIMEOUT_SECONDS = 5
+ALL_TOP_LEVEL_ARGUMENTS = ("rev-parse", "--show-toplevel")
+ALL_STAGED_PATHS_ARGUMENTS = ("diff", "--cached", "--name-only")
+ALL_TRACKED_CHANGE_ARGUMENTS = ("diff", "--name-only")
+ALL_WORKING_TREE_PATHS_ARGUMENTS = (
+    "ls-files",
+    "--modified",
+    "--others",
+    "--deleted",
+    "--exclude-standard",
+    "--full-name",
+    "--",
+)
+ALL_DOCS_EXTENSIONS = frozenset(
+    {
+        ".md",
+        ".mdx",
+        ".txt",
+        ".rst",
+        ".adoc",
+        ".png",
+        ".jpg",
+        ".jpeg",
+        ".gif",
+        ".svg",
+        ".webp",
+        ".ico",
+    }
+)
+ALL_TEST_DIRECTORY_NAMES = frozenset({"tests", "test", "__tests__"})
+ALL_TEST_FILE_PREFIXES = ("test_",)
+ALL_TEST_FILE_SUFFIXES = ("_test.py",)
+ALL_TEST_FILE_INFIXES = (".test.", ".spec.")
+ALL_TEST_FILE_NAMES = frozenset({"conftest.py"})