claude-dev-env 8.98.1 → 8.98.3

package/hooks/blocking/pr_lifecycle_skill_gate.py

@@ -26,8 +26,9 @@ from hooks_constants.pr_lifecycle_skill_gate_constants import (
     ALL_TRANSCRIPT_PATH_FIELDS,
     BUILD_EVAL_ARGUMENT_WORD,
     BUILD_EVAL_COMMAND_MARKER,
-    COMMAND_SEPARATORS,
+    COMMAND_PIECE_PATTERN,
     COMMAND_WHITESPACE,
+    COMMENT_PIECE,
     DENY_DECISION,
     DENY_REASON,
     ENVIRONMENT_ASSIGNMENT_PATTERN,
@@ -36,17 +37,23 @@ from hooks_constants.pr_lifecycle_skill_gate_constants import (
     GIT_ACTIONS,
     GIT_GLOBAL_OPTIONS_WITH_VALUE,
     HOOK_EVENT_NAME,
+    LINE_CONTINUATION_PIECE,
     MERGE_PATH_SUFFIX,
+    NO_COMMENT_CHARACTERS,
     OPTION_AND_VALUE_WORD_COUNT,
     PATH_SEPARATOR_PATTERN,
     PERMISSION_DECISION_REASON_KEY,
     PULL_REQUEST_SCRIPT_NAME,
     PYTHON_OPTIONS_WITH_VALUE,
+    REMOVED_TEXT,
+    SEGMENT_BREAK,
+    SEPARATOR_PIECE,
     SESSION_TRANSCRIPT_PATH_FIELD,
     SHELL_TOOL_NAMES,
     SKILL_NAME,
     SUBAGENT_TRANSCRIPT_DIRECTORY_NAME,
     SUBAGENT_TRANSCRIPT_FILE_TEMPLATE,
+    UNCLOSED_QUOTE_PIECE,
 )
 from hooks_constants.gh_command_words import gh_command_words
 from hooks_constants.hook_specific_output_keys import (
@@ -70,25 +77,51 @@ from transcript_skill_scan import (
 )
 
 
+def _unquoted_segment_texts(command: str) -> list[str] | None:
+    """Split a command at each separator outside quotes, escapes, and comments.
+
+    ::
+
+        git commit -m "&" -a && git push  ->  ['git commit -m "&" -a ', '', ' git push']
+        git status # a; b                 ->  ['git status ']
+
+    Args:
+        command: One shell command as the tool received it.
+
+    Returns:
+        The raw text of each segment in order, or None when a quote never closes.
+    """
+    all_pieces = list(COMMAND_PIECE_PATTERN.finditer(command))
+    if any(each_piece.lastgroup == UNCLOSED_QUOTE_PIECE for each_piece in all_pieces):
+        return None
+    all_replacement_texts: dict[str | None, str] = {
+        SEPARATOR_PIECE: SEGMENT_BREAK,
+        COMMENT_PIECE: REMOVED_TEXT,
+        LINE_CONTINUATION_PIECE: REMOVED_TEXT,
+    }
+    marked_command = REMOVED_TEXT.join(
+        all_replacement_texts.get(each_piece.lastgroup, each_piece.group()) for each_piece in all_pieces
+    )
+    return marked_command.split(SEGMENT_BREAK)
+
+
 def _command_segments(command: str) -> list[list[str]]:
-    lexer = shlex.shlex(command, posix=True, punctuation_chars=COMMAND_SEPARATORS)
-    lexer.whitespace = COMMAND_WHITESPACE
-    lexer.whitespace_split = True
-    all_segments: list[list[str]] = []
-    each_segment: list[str] = []
-    try:
-        all_words = list(lexer)
-    except ValueError:
+    all_segment_texts = _unquoted_segment_texts(command)
+    if all_segment_texts is None:
         return []
-    for each_word in all_words:
-        if each_word[0] in COMMAND_SEPARATORS:
-            all_segments.append(each_segment)
-            each_segment = []
-            continue
-        each_segment.append(each_word)
-    if each_segment:
-        all_segments.append(each_segment)
-    return [each_group for each_group in all_segments if each_group]
+    all_segments: list[list[str]] = []
+    for each_text in all_segment_texts:
+        lexer = shlex.shlex(each_text, posix=True)
+        lexer.whitespace = COMMAND_WHITESPACE
+        lexer.whitespace_split = True
+        lexer.commenters = NO_COMMENT_CHARACTERS
+        try:
+            all_words = list(lexer)
+        except ValueError:
+            all_words = each_text.split()
+        if all_words:
+            all_segments.append(all_words)
+    return all_segments
 
 
 def next_command_word(

package/hooks/blocking/test_pr_lifecycle_skill_gate.py

@@ -74,6 +74,41 @@ def test_executable_word_lists_reads_chains_prefixes_and_shell_wrappers() -> Non
     assert gate.executable_word_lists("bash -c 'git add x; git commit'")[-2:] == [["git", "add", "x"], ["git", "commit"]]
 
 
+def test_executable_word_lists_keeps_an_empty_quoted_argument() -> None:
+    assert gate.executable_word_lists('git commit -m ""') == [["git", "commit", "-m", ""]]
+
+
+def test_executable_word_lists_keeps_a_quoted_argument_that_starts_with_a_separator() -> None:
+    assert gate.executable_word_lists('git -C "(dir)" commit -m x') == [["git", "-C", "(dir)", "commit", "-m", "x"]]
+
+
+def test_executable_word_lists_keeps_a_quoted_separator_argument_in_its_command() -> None:
+    assert gate.executable_word_lists('git commit -m "&" -a') == [["git", "commit", "-m", "&", "-a"]]
+    assert gate.executable_word_lists("git commit -m ';' -a && git push") == [
+        ["git", "commit", "-m", ";", "-a"],
+        ["git", "push"],
+    ]
+    assert gate.executable_word_lists("git commit -m x\\; -a") == [["git", "commit", "-m", "x;", "-a"]]
+
+
+def test_executable_word_lists_skips_a_comment_and_resumes_on_the_next_line() -> None:
+    assert gate.executable_word_lists("git status #note; more\ngit push") == [
+        ["git", "status"],
+        ["git", "push"],
+    ]
+    assert gate.executable_word_lists("echo 'a#b' c#d") == [["echo", "a#b", "c#d"]]
+    assert gate.executable_word_lists("git status x\\ #y; git push") == [["git", "status", "x #y"], ["git", "push"]]
+
+
+def test_executable_word_lists_joins_a_line_continuation() -> None:
+    assert gate.executable_word_lists("git \\\npush origin") == [["git", "push", "origin"]]
+    assert gate.executable_word_lists("git\\\n#note; git push") == [["git#note"], ["git", "push"]]
+
+
+def test_executable_word_lists_keeps_the_other_segments_beside_a_trailing_backslash() -> None:
+    assert gate.executable_word_lists("git push; echo a\\") == [["git", "push"], ["echo", "a\\"]]
+
+
 def test_loaded_skill_allows_action_silently(tmp_path: Path) -> None:
     path = _transcript(tmp_path, "plugin:pr-lifecycle")
     assert _run_main(_payload("gh pr view", path)) == (0, "")

package/hooks/features/conduct-gates.md

@@ -7,7 +7,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link. It denies a sentence that guesses, estimates, hedges a duration, or admits a skipped check, such as "I didn't confirm this one." It denies a cited Actions run, pull request, or run, job, or check id that no successful tool result in the transcript shows; a subagent's report is the result of its Agent call. A question card from `AskUserQuestion` gets the banned word check and `unvalidated_claim_violation`, like a decision card. With visual reply mode on, it also runs the checks in `visual_reply_rules.py` from the rule list in `rules/visual-reply-rules.json`: no abbreviation or tracker number outside a link, a widget or page before a reply of more than one sentence, and no anchor link inside widget code. The mode is off by default; `~/.claude/visual-reply-mode.json` with `{"enabled": true}` turns the mode checks on.
 - `blocking/final_reply_gate.py` applies the banned words, `unvalidated_claim_violation`, and `unseen_citation_violation` from the reply gate to the reply a session ends its turn with. Its `windows_path_violation` blocks a path the terminal would render without one of its backslashes.
 - `blocking/open_tasks_stop_gate.py` holds the end of a turn while the session has open items that the closing reply does not name on a `Blocked:` or `Open:` line. It merges the task store, the transcript task calls, the desktop `mcp__ccd_turn__update_plan` plan, and the recorded asks. A transcript item whose subject the task store holds is dropped, and every other item stays. `blocking/open_tasks_transcript.py` rebuilds the task list and the last reply from the transcript for it. Each new desktop plan list carries the unfinished items of the list before it after its own items, so `done` and `start` positions still point at its own items. An ask stays open until a reply line `Done: #ask-N` closes it. A line `Dropped: <#ask-N or carried item> - "<quote>"` closes an ask or a carried plan item when the quote is in a prompt the user sent after that ask or that list.
-- `session/open_task_ask_recorder.py` records each prompt in `~/.claude/open-task-asks/<session id>.json`, outside the task store. A prompt that asks for work gets the next `#ask-N` id. A question-only prompt, an acknowledgement such as `thanks!`, an empty prompt, and a harness envelope such as `<task-notification>` get none.
+- `session/open_task_ask_recorder.py` records each prompt in `~/.claude/open-task-asks/<session id>.json`, outside the task store. A prompt that asks for work gets the next `#ask-N` id. A question-only prompt, an acknowledgement such as `thanks!`, an empty prompt, a prompt of only `<system-reminder>` blocks, and an envelope such as `<agent-message>` or `<task-notification>` get none.
 - The claim judge is a `prompt` hook in `hooks.json`, with no `model` set, so Claude Code's small default hook model reads each chat message and denies the first claim about how code, a file, a tool, a service, a run, or a process behaves, or why something happened, when nothing in the message shows it: inline code that quotes output or a code line, a file and line, or a link. A pull request link covers what that change does, what it blocks or lets through, and its checks. The author's own actions, a restatement of the user's words, questions, instructions, and a decision card's option consequences pass. It catches the plain claims the causal word list in `blocking/reply_length_gate.py` misses, such as "The code lets any of them rewrite it mid-check." `continueOnBlock` returns the reason to the agent as the tool error, so it can add the source and send again. The installer owns it through the `claude-dev-env: ` prefix on its `statusMessage`. It skips `post_widget`, whose input is SVG or HTML markup.
 - `blocking/chat_reply_gate.py` runs the `reply_length_gate.py` reply checks on a plain chat reply, which is no tool call. On `UserPromptSubmit` it adds the reply rules as `additionalContext`. On `MessageDisplay` it holds each streamed batch until the message ends. A message that passes shows whole. A message that fails shows as a draft from `claude -p` on Haiku that passes the same checks, and the original shows when two drafts fail. The draft changes only the text on screen, so the next `UserPromptSubmit` tells the agent the text the user saw, and `SessionEnd` deletes the stored draft. The [reply arena harness](https://github.com/jl-cmd-projects/claude-dev-env/tree/160349b90f627ea542fc6bc7b2b7f86dcbf98b73/tests/reply_arena) ran the comparison that chose this display path.
 - `blocking/edit_marker_gate.py` rejects strikethrough and edit-note markers in replacement chat text or cards.

package/hooks/hooks_constants/open_tasks_stop_gate_constants.py

@@ -109,6 +109,8 @@ INTERROGATIVE_START_PATTERN = (
     r"^\s*(?:\w+,\s*)?(?:are|is|am|was|were|do|does|did|have|has|had|can|could|will|would"
     r"|should|shall|may|what|why|how|when|where|which|who|whose)\b"
 )
+ALL_ASK_ONLY_ENVELOPE_MARKERS = ("<agent-message",)
+SYSTEM_REMINDER_BLOCK_PATTERN = r"<system-reminder>.*?</system-reminder>"
 ACKNOWLEDGEMENT_PATTERN = (
     r"^\s*(?:ok(?:ay)?|k|thanks?|thank\s+you|thx|ty|cool|great|nice|perfect|awesome|got\s+it"
     r"|sounds\s+good|looks\s+good|lgtm)(?:[\s,]+(?:thanks?|thank\s+you))?\W*$"

package/hooks/hooks_constants/pr_lifecycle_skill_gate_constants.py

@@ -1,5 +1,7 @@
 """Constants for the pull request lifecycle skill gate."""
 
+import re
+
 HOOK_EVENT_NAME = "PreToolUse"
 PERMISSION_DECISION_REASON_KEY = "permissionDecisionReason"
 DENY_DECISION = "deny"
@@ -23,6 +25,24 @@ SUBAGENT_TRANSCRIPT_DIRECTORY_NAME = "subagents"
 SUBAGENT_TRANSCRIPT_FILE_TEMPLATE = "agent-{agent_id}.jsonl"
 COMMAND_SEPARATORS = ";|&\n()`"
 COMMAND_WHITESPACE = " \t\r"
+NO_COMMENT_CHARACTERS = ""
+REMOVED_TEXT = ""
+SEGMENT_BREAK = "\0"
+SEPARATOR_PIECE = "separator"
+COMMENT_PIECE = "comment"
+LINE_CONTINUATION_PIECE = "continuation"
+UNCLOSED_QUOTE_PIECE = "unclosed"
+COMMAND_PIECE_PATTERN = re.compile(
+    r"'[^']*'"
+    r'|"(?:\\.|[^"\\])*"'
+    rf"|(?P<{LINE_CONTINUATION_PIECE}>\\\n)"
+    rf"|\\.[^{re.escape(COMMAND_WHITESPACE + COMMAND_SEPARATORS)}'\"\\]*"
+    rf"|(?P<{COMMENT_PIECE}>(?<![^{re.escape(COMMAND_WHITESPACE + COMMAND_SEPARATORS)}])(?<!\\\n)#[^\n]*)"
+    rf"|(?P<{SEPARATOR_PIECE}>[{re.escape(COMMAND_SEPARATORS)}])"
+    rf"|(?P<{UNCLOSED_QUOTE_PIECE}>['\"])"
+    r"|.",
+    re.DOTALL,
+)
 OPTION_AND_VALUE_WORD_COUNT = 2
 GIT_GLOBAL_OPTIONS_WITH_VALUE = frozenset({"-C", "-c", "--git-dir", "--work-tree", "--namespace", "--config-env"})
 GIT_ACTIONS = frozenset({"commit", "push"})

package/hooks/open_task_asks.py

@@ -6,7 +6,8 @@ Every prompt lands in one file outside the task store::
     {"prompts": [{"text": "...", "recorded_at": 1761076800.0, "ask_id": "ask-1"}, ...]}
 
 A prompt that asks for work gets the next ``ask-N`` id. A question-only
-prompt, an acknowledgement such as ``thanks!``, an empty prompt, and a harness envelope such as
+prompt, an acknowledgement such as ``thanks!``, an empty prompt, a prompt of only
+``<system-reminder>`` blocks, and an envelope such as ``<agent-message>`` or
 ``<task-notification>`` get ``ask_id`` null, and the gate still reads their
 text when it checks the quote on a ``Dropped:`` line.
 """
@@ -23,6 +24,7 @@ from typing import NamedTuple
 from atomic_file_writer import write_text_atomically
 from hooks_constants.open_tasks_stop_gate_constants import (
     ACKNOWLEDGEMENT_PATTERN,
+    ALL_ASK_ONLY_ENVELOPE_MARKERS,
     ASK_ID_TEMPLATE,
     ASK_PROMPT_ID_KEY,
     ASK_PROMPT_RECORDED_AT_KEY,
@@ -39,6 +41,7 @@ from hooks_constants.open_tasks_stop_gate_constants import (
     QUESTION_END_PATTERN,
     SAFE_SESSION_ID_PATTERN,
     SENTENCE_SPLIT_PATTERN,
+    SYSTEM_REMINDER_BLOCK_PATTERN,
     UTF8_ENCODING,
     YES_OR_NO_END_PATTERN,
 )
@@ -49,7 +52,7 @@ class RecordedPrompt(NamedTuple):
     """One prompt the user sent.
 
     Attributes:
-        text: The prompt as the user sent it.
+        text: The prompt as the user sent it, with ``<system-reminder>`` blocks removed.
         recorded_at: Seconds since the epoch when the recorder saw it.
         ask_id: ``ask-N`` for a prompt that asks for work, or None.
     """
@@ -98,10 +101,23 @@ def is_question_only(prompt_text: str) -> bool:
     )
 
 
+def prompt_without_reminders(prompt_text: str) -> str:
+    """Return the prompt with every ``<system-reminder>`` block removed, stripped."""
+    return re.sub(SYSTEM_REMINDER_BLOCK_PATTERN, "", prompt_text, flags=re.DOTALL).strip()
+
+
 def is_ask(prompt_text: str) -> bool:
-    """Return True when the prompt asks for work the gate should hold the turn for."""
-    stripped_text = prompt_text.strip()
-    if not stripped_text or stripped_text.startswith(ALL_HARNESS_ENVELOPE_MARKERS):
+    """Return True when the prompt asks for work the gate should hold the turn for.
+
+    ::
+
+        '<agent-message from="a1">Report</agent-message>'    -> False
+        "<system-reminder>Tool loaded.</system-reminder>"     -> False
+        "<system-reminder>...</system-reminder> Export it"    -> True
+    """
+    stripped_text = prompt_without_reminders(prompt_text)
+    all_envelope_markers = (*ALL_HARNESS_ENVELOPE_MARKERS, *ALL_ASK_ONLY_ENVELOPE_MARKERS)
+    if not stripped_text or stripped_text.startswith(all_envelope_markers):
         return False
     if re.fullmatch(ACKNOWLEDGEMENT_PATTERN, stripped_text, re.IGNORECASE):
         return False
@@ -145,7 +161,7 @@ def record_prompt(session_id: object, prompt_text: str) -> str | None:
     all_prompts = recorded_prompts(session_id)
     ask_count = sum(1 for each_prompt in all_prompts if each_prompt.ask_id)
     ask_id = ASK_ID_TEMPLATE.format(ask_number=ask_count + 1) if is_ask(prompt_text) else None
-    all_prompts.append(RecordedPrompt(prompt_text, time.time(), ask_id))
+    all_prompts.append(RecordedPrompt(prompt_without_reminders(prompt_text), time.time(), ask_id))
     serialized_text = json.dumps(
         {ASKS_PROMPTS_KEY: [each_prompt._asdict() for each_prompt in all_prompts]}
     )

package/hooks/test_open_task_asks.py

@@ -30,6 +30,11 @@ def isolated_home(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
         ("Looks good", False),
         ("ok, ship it", True),
         ("yes", True),
+        ('<agent-message from="afbaf992127c7512f">\nReport delivered.\n</agent-message>', False),
+        ('<cross-session-message from="s-2">\nBuild the PR\n</cross-session-message>', False),
+        ("<system-reminder>\nTool loaded.\n</system-reminder>", False),
+        ("<system-reminder>\nTool loaded.\n</system-reminder>\n<system-reminder>\nMore.\n</system-reminder>", False),
+        ("<system-reminder>\nTool loaded.\n</system-reminder>\nExport the APKs", True),
     ],
 )
 def test_should_classify_work_prompts_as_asks(prompt_text: str, is_expected_ask: bool) -> None:

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.98.1",
+    "version": "8.98.3",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {