claude-dev-env 8.98.6 → 8.98.8

package/.agents/skills/pr-lifecycle/SKILL.md

@@ -22,7 +22,7 @@ User-level rule: applies to **every** git repo that uses GitHub with `gh`. Small
 
 ### Pull request submission rules
 
-**Prove the change where it runs before opening a PR.** Read `~/.claude/docs/rule-guides/proof-before-pull-request.md` for the body and hook requirements. A `feat` PR also needs an "Eval" section and a session that invoked `/claude-api build-eval`; read `~/.claude/docs/rule-guides/features-start-with-an-eval.md` before you build the feature.
+**Prove the change where it runs before opening a PR.** Read `~/.claude/docs/rule-guides/proof-before-pull-request.md` for the body and hook requirements. A `feat` PR also needs an "Eval" section and a session that invoked `/claude-api build-eval`; read `~/.claude/docs/rule-guides/features-start-with-an-eval.md` before you build the feature. A new workflow that runs only on `workflow_dispatch` cannot run until its file is on the default branch: before the PR, run its `run:` steps with a stub `gh` on PATH, name in the body the live run that waits on the merge, and dispatch it right after the merge.
 
 **Open PRs ready for review; use `--draft` when the owner requests it.** Before you commit copied files or open a PR, list the open PRs that change a file whose path starts with yours, then read each hit, with `gh pr list --state open --limit 1000 --json number,files --jq '.[] | select(any(.files[]; .path | startswith("<path>"))) | .number'`, so you do not duplicate a peer's PR. Each pre-existing failure or remaining defect the PR body names links a tracked issue.
 
@@ -121,7 +121,7 @@ An image a PR needs as visual evidence is not an exception to that row. Upload i
 1. Fetch every reviewer comment before making any fix.
 2. Create a checklist in the session's task tool with one item per comment.
 3. Fix systematically, marking each todo complete.
-4. Reply to each comment inline.
+4. Reply to each comment inline, read the reply back from the thread, and resolve the thread only after the reply shows there.
 
 Repair only the reported findings. A finding that comes back on a second head escalates. Fix the source the reviewer reads, or change the gate that files the finding. Post no second reply with the same text, because a repeat finding shows the first reply changed nothing the reviewer sees.
 
@@ -405,7 +405,7 @@ Resolve the active managed root (`CLAUDE_CONFIG_DIR` when set, `~/.claude`
 otherwise), then run `<managed-root>/scripts/durable_post_lint.py` before the
 server write. Pass the matching action and body file. Use `pr-create`,
 `pr-edit`, `pr-comment`, `pr-review`, `issue-create`, `issue-edit`,
-`issue-comment`, or `github-mcp-post`.
+`issue-comment`, `github-mcp-post`, or `github-mcp-comment` for an MCP comment or reply.
 
 Pass `--repository <owner>/<name>` for the repository the post targets. A
 post may name a private organization only inside a repository that
@@ -440,7 +440,7 @@ For pull requests, use
 `.agents/skills/pull-request/scripts/pull_request.py`. It passes
 `--body-file` to `gh` after the action-aware linter succeeds. For issues and
 GitHub MCP posts, run the linter directly with `issue-create`, `issue-edit`,
-`issue-comment`, or `github-mcp-post` as the action.
+`issue-comment`, `github-mcp-post`, or `github-mcp-comment` as the action.
 
 ### Paginated reads slurp before they filter
 

package/bin/install-pstack-plugin.mjs

@@ -72,6 +72,7 @@ const HOST_DEFINITIONS = Object.freeze({
         ),
         installVerb: 'install',
         uninstallVerb: 'uninstall',
+        updateVerb: 'update',
     }),
     codex: Object.freeze({
         executable: 'codex',
@@ -79,18 +80,23 @@ const HOST_DEFINITIONS = Object.freeze({
         homeVariable: 'CODEX_HOME',
         installVerb: 'add',
         uninstallVerb: 'remove',
+        updateVerb: null,
     }),
 });
 
 /**
  * Read the marketplace and plugin commands one host installs a set of plugins with.
  *
- * Every plugin in the set comes from one marketplace. Removing a marketplace
- * uninstalls each plugin it supplied, so the plan removes and adds that
- * marketplace once for the whole set. The removal commands run first and take
- * out each installed plugin, its cached versions, and the marketplace clone,
- * so the install commands that follow fetch the newest published version into
- * an empty slot.
+ * Every plugin in the set comes from one marketplace. A host with an update
+ * verb gets refresh commands: the marketplace add and plugin install leave an
+ * existing entry in place, and the update commands then pull the newest
+ * published version over it, so an installed plugin stays installed through
+ * the whole run. When any refresh command fails, or the host has no update
+ * verb, the removal commands run and take out each installed plugin, its
+ * cached versions, and the marketplace clone, and the install commands that
+ * follow fetch the newest published version into an empty slot. Removing a
+ * marketplace uninstalls each plugin it supplied, so the plan removes and adds
+ * that marketplace once for the whole set.
  *
  * Claude Code and Codex publish a marketplace under different plugin verbs, so
  * the install verb belongs to the host and the marketplace and identifier
@@ -102,6 +108,7 @@ const HOST_DEFINITIONS = Object.freeze({
  * @param {ReadonlyArray<typeof PSTACK_PLUGIN_SPEC>} allSpecs The plugins to install, from one marketplace.
  * @param {string} host A host every spec names, `claude` or `codex`.
  * @returns {{executable: string, executableVariable: string, homeVariable: string,
+ *   refreshCommands: ReadonlyArray<ReadonlyArray<string>>,
  *   removalCommands: ReadonlyArray<ReadonlyArray<string>>,
  *   commands: ReadonlyArray<ReadonlyArray<string>>}} The host's install plan.
  */
@@ -126,18 +133,28 @@ export function marketplacePluginsPlan(allSpecs, host) {
     }
     const allSparsePaths = [...new Set(allSpecs.flatMap(eachSpec => eachSpec.sparsePaths))];
     const sparseArguments = allSparsePaths.length > 0 ? ['--sparse', ...allSparsePaths] : [];
+    const marketplaceAddCommand = ['plugin', 'marketplace', 'add', firstSpec.marketplaceRepository, ...sparseArguments];
+    const allPluginInstallCommands = allSpecs.map(
+        eachSpec => ['plugin', hostDefinition.installVerb, eachSpec.pluginIdentifier],
+    );
+    const refreshCommands = hostDefinition.updateVerb
+        ? [
+            marketplaceAddCommand,
+            ['plugin', 'marketplace', hostDefinition.updateVerb, firstSpec.marketplaceName],
+            ...allPluginInstallCommands,
+            ...allSpecs.map(eachSpec => ['plugin', hostDefinition.updateVerb, eachSpec.pluginIdentifier]),
+        ]
+        : [];
     return {
         executable: hostDefinition.executable,
         executableVariable: hostDefinition.executableVariable,
         homeVariable: hostDefinition.homeVariable,
+        refreshCommands,
         removalCommands: [
             ...allSpecs.map(eachSpec => ['plugin', hostDefinition.uninstallVerb, eachSpec.pluginIdentifier]),
             ['plugin', 'marketplace', 'remove', firstSpec.marketplaceName],
         ],
-        commands: [
-            ['plugin', 'marketplace', 'add', firstSpec.marketplaceRepository, ...sparseArguments],
-            ...allSpecs.map(eachSpec => ['plugin', hostDefinition.installVerb, eachSpec.pluginIdentifier]),
-        ],
+        commands: [marketplaceAddCommand, ...allPluginInstallCommands],
     };
 }
 
@@ -280,18 +297,49 @@ function lockedFolderDetail(allSpecs, host, homeDirectory, errorText, findLocker
     }).join('');
 }
 
+function refreshInPlace(plan, executable, commandEnvironment, runCommand) {
+    for (const commandArguments of plan.refreshCommands) {
+        const outcome = runCommand(executable, [...commandArguments], {
+            environment: commandEnvironment,
+        });
+        if (namesAnAbsentCommand(outcome)) return 'absent';
+        if (outcome.status !== 0 || outcome.error) return 'failed';
+    }
+    return 'refreshed';
+}
+
+function removeOrphanedVersionsForHost(allSpecs, host, homeDirectory) {
+    const hostDefinition = HOST_DEFINITIONS[host];
+    if (!hostDefinition.orphanedVersionsDirectory || !homeDirectory) return;
+    for (const eachSpec of allSpecs) {
+        removeOrphanedPluginVersions(hostDefinition.orphanedVersionsDirectory(homeDirectory, eachSpec));
+    }
+}
+
 function installForHost(allSpecs, host, homeDirectory, environment, runCommand, findLockers) {
     const plan = marketplacePluginsPlan(allSpecs, host);
     const executable = environment[plan.executableVariable] || plan.executable;
     const commandEnvironment = { [plan.homeVariable]: homeDirectory };
+    const staleCloneDirectory = HOST_DEFINITIONS[host].staleCloneDirectory;
+    if (staleCloneDirectory && homeDirectory) {
+        removeStaleMarketplaceClone(staleCloneDirectory(homeDirectory, allSpecs[0]));
+    }
+    if (plan.refreshCommands.length > 0) {
+        const refreshOutcome = refreshInPlace(plan, executable, commandEnvironment, runCommand);
+        if (refreshOutcome === 'absent') return absentHostOutcome(allSpecs, host, executable);
+        if (refreshOutcome === 'refreshed') {
+            removeOrphanedVersionsForHost(allSpecs, host, homeDirectory);
+            return { host, executable, status: 'installed', warning: null };
+        }
+    }
     for (const commandArguments of plan.removalCommands) {
         const outcome = runCommand(executable, [...commandArguments], {
             environment: commandEnvironment,
         });
         if (namesAnAbsentCommand(outcome)) return absentHostOutcome(allSpecs, host, executable);
     }
-    if (HOST_DEFINITIONS[host].staleCloneDirectory && homeDirectory) {
-        removeStaleMarketplaceClone(HOST_DEFINITIONS[host].staleCloneDirectory(homeDirectory, allSpecs[0]));
+    if (staleCloneDirectory && homeDirectory) {
+        removeStaleMarketplaceClone(staleCloneDirectory(homeDirectory, allSpecs[0]));
     }
     for (const commandArguments of plan.commands) {
         const outcome = runCommand(executable, [...commandArguments], {
@@ -309,12 +357,7 @@ function installForHost(allSpecs, host, homeDirectory, environment, runCommand,
             };
         }
     }
-    const hostDefinition = HOST_DEFINITIONS[host];
-    if (hostDefinition.orphanedVersionsDirectory && homeDirectory) {
-        for (const eachSpec of allSpecs) {
-            removeOrphanedPluginVersions(hostDefinition.orphanedVersionsDirectory(homeDirectory, eachSpec));
-        }
-    }
+    removeOrphanedVersionsForHost(allSpecs, host, homeDirectory);
     return { host, executable, status: 'installed', warning: null };
 }
 
@@ -338,10 +381,17 @@ export function restartNotice(allSpecs, allInstalledHosts) {
 /**
  * Install a set of plugins from one marketplace into each host's own home.
  *
- * Each host first removes every plugin in the set and then the marketplace,
- * so an older version never survives beside the new one. A removal that finds
+ * Claude Code refreshes in place: it adds the marketplace and installs each
+ * plugin, both of which leave an existing entry alone, then updates the
+ * marketplace and each plugin. An installed plugin stays installed and enabled
+ * through the run, so a session that starts mid-run still loads it, and a
+ * failed network step leaves the prior version in place. When a refresh
+ * command fails, such as a marketplace add whose sparse paths changed, the
+ * host falls back to the clean install Codex always runs: it removes every
+ * plugin in the set and then the marketplace, so an older version never
+ * survives beside the new one, and adds them again. A removal that finds
  * nothing to remove exits non-zero on a fresh home, and the install goes on.
- * Before the Claude marketplace add, the install deletes the half-made clone
+ * Before each Claude marketplace add, the install deletes the half-made clone
  * folder an interrupted earlier add left, so the add starts in an empty slot.
  *
  * Each host is one member of the batch. A host without its command-line tool

package/bin/install-pstack-plugin.test.mjs

@@ -68,10 +68,10 @@ test('each host installs into the managed root this run wrote', () => {
     const outcome = installMarketplacePlugins([PSTACK_PLUGIN_SPEC], ROOTS, runner);
     assert.equal(outcome.status, 'installed');
     assert.deepEqual(runner.calls.map(call => [call.executable, ...call.commandArguments]), [
-        ['claude', 'plugin', 'uninstall', PSTACK_PLUGIN_IDENTIFIER],
-        ['claude', 'plugin', 'marketplace', 'remove', 'pstack-claude'],
         ['claude', 'plugin', 'marketplace', 'add', PSTACK_MARKETPLACE_REPOSITORY],
+        ['claude', 'plugin', 'marketplace', 'update', 'pstack-claude'],
         ['claude', 'plugin', 'install', PSTACK_PLUGIN_IDENTIFIER],
+        ['claude', 'plugin', 'update', PSTACK_PLUGIN_IDENTIFIER],
         ['codex', 'plugin', 'remove', PSTACK_PLUGIN_IDENTIFIER],
         ['codex', 'plugin', 'marketplace', 'remove', 'pstack-claude'],
         ['codex', 'plugin', 'marketplace', 'add', PSTACK_MARKETPLACE_REPOSITORY],
@@ -81,7 +81,43 @@ test('each host installs into the managed root this run wrote', () => {
     assert.equal(runner.calls[4].environment.CODEX_HOME, ROOTS.codexHome);
 });
 
-test('each host removes the installed plugin and marketplace before it installs', () => {
+test('the Claude plan refreshes in place and Codex has no refresh commands', () => {
+    assert.deepEqual(marketplacePluginsPlan([PSTACK_PLUGIN_SPEC], 'claude').refreshCommands, [
+        ['plugin', 'marketplace', 'add', PSTACK_MARKETPLACE_REPOSITORY],
+        ['plugin', 'marketplace', 'update', 'pstack-claude'],
+        ['plugin', 'install', PSTACK_PLUGIN_IDENTIFIER],
+        ['plugin', 'update', PSTACK_PLUGIN_IDENTIFIER],
+    ]);
+    assert.deepEqual(marketplacePluginsPlan([PSTACK_PLUGIN_SPEC], 'codex').refreshCommands, []);
+});
+
+test('a Claude refresh that passes never uninstalls the plugin or removes its marketplace', () => {
+    const runner = recordingRunner();
+    const outcome = installMarketplacePlugins([PSTACK_PLUGIN_SPEC], { ...ROOTS, hosts: ['claude'] }, runner);
+    assert.equal(outcome.status, 'installed');
+    const allRemovalCalls = runner.calls.filter(call => (
+        call.commandArguments.includes('uninstall') || call.commandArguments.includes('remove')
+    ));
+    assert.deepEqual(allRemovalCalls, []);
+});
+
+test('a failed Claude refresh falls back to removing and adding the marketplace again', () => {
+    const runner = recordingRunner((executable, commandArguments) => (
+        commandArguments[2] === 'add' && runner.calls.length === 1
+            ? { status: 1, stderr: "its source doesn't match its extraKnownMarketplaces entry" }
+            : { status: 0, stderr: '' }));
+    const outcome = installMarketplacePlugins([USAGE_WRAPUP_PLUGIN_SPEC], { ...ROOTS, hosts: ['claude'] }, runner);
+    assert.equal(outcome.status, 'installed');
+    assert.deepEqual(runner.calls.map(call => call.commandArguments), [
+        ['plugin', 'marketplace', 'add', 'jl-cmd-projects/claude-dev-env', '--sparse', '.claude-plugin', 'packages/usage-wrapup'],
+        ['plugin', 'uninstall', 'usage-wrapup@claude-dev-env'],
+        ['plugin', 'marketplace', 'remove', 'claude-dev-env'],
+        ['plugin', 'marketplace', 'add', 'jl-cmd-projects/claude-dev-env', '--sparse', '.claude-plugin', 'packages/usage-wrapup'],
+        ['plugin', 'install', 'usage-wrapup@claude-dev-env'],
+    ]);
+});
+
+test('each host removes the installed plugin and marketplace before a clean install', () => {
     assert.deepEqual(marketplacePluginsPlan([PSTACK_PLUGIN_SPEC], 'claude').removalCommands, [
         ['plugin', 'uninstall', PSTACK_PLUGIN_IDENTIFIER],
         ['plugin', 'marketplace', 'remove', 'pstack-claude'],
@@ -95,6 +131,7 @@ test('each host removes the installed plugin and marketplace before it installs'
 test('a removal that finds nothing installed still lets the install run', () => {
     const runner = recordingRunner((executable, commandArguments) => (
         commandArguments.includes('uninstall') || commandArguments.includes('remove')
+            || commandArguments.includes('update')
             ? { status: 1, stderr: 'not installed' }
             : { status: 0, stderr: '' }));
     const outcome = installMarketplacePlugins([PSTACK_PLUGIN_SPEC], { ...ROOTS, hosts: ['claude'] }, runner);
@@ -267,10 +304,10 @@ test('installing usage-wrapup runs only the Claude commands, inside the managed
     assert.equal(outcome.status, 'installed');
     assert.deepEqual(outcome.hosts.map(host => host.host), ['claude']);
     assert.deepEqual(runner.calls.map(call => [call.executable, ...call.commandArguments]), [
-        ['claude', 'plugin', 'uninstall', 'usage-wrapup@claude-dev-env'],
-        ['claude', 'plugin', 'marketplace', 'remove', 'claude-dev-env'],
         ['claude', 'plugin', 'marketplace', 'add', 'jl-cmd-projects/claude-dev-env', '--sparse', '.claude-plugin', 'packages/usage-wrapup'],
+        ['claude', 'plugin', 'marketplace', 'update', 'claude-dev-env'],
         ['claude', 'plugin', 'install', 'usage-wrapup@claude-dev-env'],
+        ['claude', 'plugin', 'update', 'usage-wrapup@claude-dev-env'],
     ]);
     for (const call of runner.calls) {
         assert.deepEqual(call.environment, { CLAUDE_CONFIG_DIR: ROOTS.claudeRoot });
@@ -319,21 +356,21 @@ for (const [spec, packageFolder] of [
     });
 }
 
-test('should remove and add the shared marketplace once when installing usage-wrapup and subagent-models together', () => {
+test('should add and update the shared marketplace once when installing usage-wrapup and subagent-models together', () => {
     const runner = recordingRunner();
     const outcome = installMarketplacePlugins([USAGE_WRAPUP_PLUGIN_SPEC, SUBAGENT_MODELS_PLUGIN_SPEC], ROOTS, runner);
     assert.equal(outcome.status, 'installed');
     assert.deepEqual(outcome.hosts.map(host => host.host), ['claude']);
     assert.deepEqual(runner.calls.map(call => [call.executable, ...call.commandArguments]), [
-        ['claude', 'plugin', 'uninstall', 'usage-wrapup@claude-dev-env'],
-        ['claude', 'plugin', 'uninstall', 'subagent-models@claude-dev-env'],
-        ['claude', 'plugin', 'marketplace', 'remove', 'claude-dev-env'],
         [
             'claude', 'plugin', 'marketplace', 'add', 'jl-cmd-projects/claude-dev-env',
             '--sparse', '.claude-plugin', 'packages/usage-wrapup', 'packages/subagent-models',
         ],
+        ['claude', 'plugin', 'marketplace', 'update', 'claude-dev-env'],
         ['claude', 'plugin', 'install', 'usage-wrapup@claude-dev-env'],
         ['claude', 'plugin', 'install', 'subagent-models@claude-dev-env'],
+        ['claude', 'plugin', 'update', 'usage-wrapup@claude-dev-env'],
+        ['claude', 'plugin', 'update', 'subagent-models@claude-dev-env'],
     ]);
 });
 

package/bin/install.test.mjs

@@ -3148,10 +3148,10 @@ test('a full install adds the pstack marketplace and plugin on both hosts', t =>
     const installerOutput = runPstackInstaller(sandbox.homeDirectory, [], sandbox.environment);
 
     assert.deepEqual(sandbox.recordedCommands(), [
-        'claude plugin uninstall pstack@pstack-claude',
-        'claude plugin marketplace remove pstack-claude',
         'claude plugin marketplace add jl-cmd/pstack-claude',
+        'claude plugin marketplace update pstack-claude',
         'claude plugin install pstack@pstack-claude',
+        'claude plugin update pstack@pstack-claude',
         'codex plugin remove pstack@pstack-claude',
         'codex plugin marketplace remove pstack-claude',
         'codex plugin marketplace add jl-cmd/pstack-claude',
@@ -3190,10 +3190,10 @@ test('a full install adds DeepStack for Claude, Codex, and Cursor', t => {
     });
 
     assert.deepEqual(sandbox.recordedCommands(), [
-        'claude plugin uninstall deepstack@DeepStack',
-        'claude plugin marketplace remove DeepStack',
         'claude plugin marketplace add jl-cmd-projects/DeepStack',
+        'claude plugin marketplace update DeepStack',
         'claude plugin install deepstack@DeepStack',
+        'claude plugin update deepstack@DeepStack',
         'codex plugin remove deepstack@DeepStack',
         'codex plugin marketplace remove DeepStack',
         'codex plugin marketplace add jl-cmd-projects/DeepStack',
@@ -3407,10 +3407,10 @@ test('a pstack install after a --no-pstack install seeds the Codex model sheet',
 });
 
 const USAGE_WRAPUP_CLAUDE_COMMANDS = Object.freeze([
-    'claude plugin uninstall usage-wrapup@claude-dev-env',
-    'claude plugin marketplace remove claude-dev-env',
     'claude plugin marketplace add jl-cmd-projects/claude-dev-env --sparse .claude-plugin packages/usage-wrapup',
+    'claude plugin marketplace update claude-dev-env',
     'claude plugin install usage-wrapup@claude-dev-env',
+    'claude plugin update usage-wrapup@claude-dev-env',
 ]);
 
 function usageWrapupCommands(allRecordedCommands) {
@@ -3485,12 +3485,12 @@ test('the help output names the usage-wrapup opt-out beside the pstack one', ()
 });
 
 const REPOSITORY_PLUGIN_CLAUDE_COMMANDS = Object.freeze([
-    'claude plugin uninstall usage-wrapup@claude-dev-env',
-    'claude plugin uninstall subagent-models@claude-dev-env',
-    'claude plugin marketplace remove claude-dev-env',
     'claude plugin marketplace add jl-cmd-projects/claude-dev-env --sparse .claude-plugin packages/usage-wrapup packages/subagent-models',
+    'claude plugin marketplace update claude-dev-env',
     'claude plugin install usage-wrapup@claude-dev-env',
     'claude plugin install subagent-models@claude-dev-env',
+    'claude plugin update usage-wrapup@claude-dev-env',
+    'claude plugin update subagent-models@claude-dev-env',
 ]);
 
 test('should install subagent-models beside usage-wrapup with one marketplace add on a full install', t => {

package/docs/account-broker.md

@@ -18,7 +18,7 @@ python scripts/account_broker.py check --product codex
 printf "%s" "prompt" | python scripts/account_broker.py run --product claude --report report.json -- claude --output-format json -p
 ```
 
-`accounts` prints the roster without reading meters. `choose` prints `decision`, `accounts`, and `state_path`. Each decision contains `action`, `account`, `profile`, `home`, `reason`, `tier`, and `resets_at`. `profile` is the name of the profile whose home the account uses, such as `editor` for a home at `~/.claude-profiles/editor`. It is null for the main account, a Codex account, a home outside the profiles root, a home whose folder name is not a valid profile name such as `main`, and a wait decision. `--spent` takes an account's name or its profile. The account order file matches the name, command, or launcher, and resume affinity stores the command, or the name for an account without one. When a mark is one account's name and another account's profile, the name wins. Every mark is read before the first one is saved, so an unreadable mark saves none. `accounts` and the `choose` account list carry the same `profile` field. A wait decision has no account or home and includes the soonest reset in UTC. An account counts as free at the latest reset of the windows that hold it, and one hour out when one of those windows has no reset time. A failed meter read reuses the account's last good reading when that reading is 30 minutes old or less, and otherwise excludes the account for that choice. `--spent` saves an exclusion until the supplied Unix reset, the account's soonest known meter reset, or one hour when neither is available. A `--spent` name absent from the roster is saved until the supplied Unix reset, or for one hour when no reset is given. A mark splits at its last colon, so an absent name that contains a colon, such as `C:\bin\old.cmd`, takes an explicit reset, such as `C:\bin\old.cmd:1800000000`. While any such mark is still in the future, `choose` waits until the soonest mark and exits 3, and with no Codex roster `--spent default` waits until that mark passes. Meter reads younger than 60 seconds are reused.
+`accounts` prints the roster without reading meters. `choose` prints `decision`, `accounts`, and `state_path`. Each decision contains `action`, `account`, `profile`, `home`, `reason`, `tier`, and `resets_at`. `profile` is the name of the profile whose home the account uses, such as `editor` for a home at `~/.claude-profiles/editor`. It is null for the main account, a Codex account, a home outside the profiles root, a home whose folder name is not a valid profile name such as `main`, and a wait decision. `--spent` takes an account's name or its profile. The account order file matches the name, command, or launcher, and resume affinity stores the command, or the name for an account without one. When a mark is one account's name and another account's profile, the name wins. Every mark is read before the first one is saved, so an unreadable mark saves none. `accounts` and the `choose` account list carry the same `profile` field. A wait decision has no account or home and includes the soonest reset in UTC. An account counts as free at the latest reset of the windows that hold it, and one hour out when one of those windows has no reset time. A failed meter read reuses the account's last good reading when that reading is 30 minutes old or less, and otherwise excludes the account for that choice. `--spent` saves an exclusion until the supplied Unix reset, the account's soonest known meter reset, or one hour when neither is available. A `--spent` name absent from the roster is saved until the supplied Unix reset, or for one hour when no reset is given. A mark splits at its last colon, so an absent name that contains a colon, such as `C:\bin\old.cmd`, takes an explicit reset, such as `C:\bin\old.cmd:1800000000`. While any such mark is still in the future, `choose` waits until the soonest mark and exits 3, and with no Codex roster `--spent default` waits until that mark passes. `default` is the name `choose` gives the Codex home when no roster is configured, so while a Codex roster exists `choose` neither saves a `--spent default` mark nor waits on a stored one. Meter reads younger than 60 seconds are reused.
 
 `check` prints nothing and exits 3 while every account is below its floor. `run` sets `CLAUDE_CONFIG_DIR` or `CODEX_HOME` for each attempt. A Claude job also starts without the parent session's variables, such as `CLAUDE_CODE_SESSION_ID` and `CLAUDECODE`, so a child started from inside a Claude Code session runs as its own session. `ALL_PARENT_CLAUDE_SESSION_VARIABLES` lists them. It replays the same stdin bytes when a usage limit or start failure leads to another account. Send the prompt on stdin. When the command resolves to a `.cmd` or `.bat` file, the broker refuses an argument that holds a cmd.exe metacharacter and records `start_failed`. It writes the command's stdout to stdout and diagnostics to stderr. A resumed Claude session uses the account bound to its session when that account has room.
 

package/hooks/blocking/reply_length_gate.py

@@ -559,15 +559,24 @@ def gh_command_token_runs(all_command_tokens: list[str]) -> list[list[str]]:
     return all_runs
 
 
+def comment_length_violation(comment_text: str) -> str | None:
+    """Return the deny reason for one over-long GitHub comment text, or None when it fits.
+
+    Fenced code blocks and collapsed ``<details>`` blocks carry no words.
+    """
+    violation = length_violation(DETAILS_BLOCK_PATTERN.sub(" ", comment_text))
+    return None if violation is None else violation + COMMENT_RETRY_INSTRUCTION
+
+
 def github_comment_violation(tool_name: object, all_tool_input: dict[str, object]) -> tuple[str, str] | None:
     """Return the deny reason and text for an over-long GitHub comment, or None.
 
     Fenced code blocks and collapsed ``<details>`` blocks carry no words.
     """
     for each_comment_text in github_comment_texts(tool_name, all_tool_input):
-        violation = length_violation(DETAILS_BLOCK_PATTERN.sub(" ", each_comment_text))
+        violation = comment_length_violation(each_comment_text)
         if violation is not None:
-            return violation + COMMENT_RETRY_INSTRUCTION, each_comment_text
+            return violation, each_comment_text
     return None
 
 

package/hooks/blocking/resolve_thread_reply_gate.py

@@ -0,0 +1,135 @@
+"""Deny a review thread resolve until a reply posted after the last user prompt and the last resolve."""
+
+from __future__ import annotations
+
+import sys
+from collections.abc import Iterable
+from pathlib import Path
+
+hooks_directory = str(Path(__file__).resolve().parent.parent)
+if hooks_directory not in sys.path:
+    sys.path.insert(0, hooks_directory)
+
+from blocking.pr_lifecycle_skill_gate import deny_decision, transcript_paths
+from hooks_constants.pr_lifecycle_skill_gate_constants import SHELL_TOOL_NAMES
+from hooks_constants.pre_tool_use_stdin import print_decision_from_stdin
+from hooks_constants.resolve_thread_reply_gate_constants import (
+    ALL_REPLY_TOOL_NAME_SUFFIXES,
+    MISSING_REPLY_REASON,
+    RESOLVE_TOOL_NAME_PATTERN,
+    SHELL_COMMAND_KEY,
+    SHELL_REPLY_COMMAND_PATTERN,
+)
+from hooks_constants.setup_project_paths_constants import DECODE_ERRORS_POLICY, UTF8_ENCODING
+from transcript_skill_scan import TranscriptToolCall, tool_calls_since_last_prompt
+
+
+def is_resolve_call(tool_name: object) -> bool:
+    """Return whether a tool name resolves a review thread, such as ``mcp__github__resolve_review_thread``.
+
+    Args:
+        tool_name: The tool name from a hook payload or transcript.
+    """
+    return isinstance(tool_name, str) and RESOLVE_TOOL_NAME_PATTERN.match(tool_name) is not None
+
+
+def is_reply_call(tool_call: TranscriptToolCall) -> bool:
+    """Return whether a transcript tool call replies on a review thread.
+
+    ::
+
+        mcp__github__add_reply_to_pull_request_comment               -> True
+        Bash "gh api repos/o/r/pulls/7/comments/99/replies -f body=x" -> True
+        Bash "gh api graphql" with addPullRequestReviewThreadReply    -> True
+        mcp__github__add_issue_comment                                -> False
+
+    Args:
+        tool_call: One tool call read from the transcript.
+    """
+    if tool_call.name.endswith(ALL_REPLY_TOOL_NAME_SUFFIXES):
+        return True
+    command = tool_call.tool_input.get(SHELL_COMMAND_KEY)
+    return (
+        tool_call.name in SHELL_TOOL_NAMES
+        and isinstance(command, str)
+        and SHELL_REPLY_COMMAND_PATTERN.search(command) is not None
+    )
+
+
+def has_posted_reply_since_last_resolve(all_transcript_lines: Iterable[str]) -> bool:
+    """Return whether a reply that succeeded since the last user prompt is not yet spent on a successful resolve.
+
+    ::
+
+        prompt, reply ok, resolve pending                                 -> True
+        prompt, reply refused by a hook, resolve                          -> False
+        prompt, resolve                                                   -> False
+        prompt, reply ok, resolve ok, resolve pending                     -> False
+        prompt, reply ok, reply ok, resolve ok, resolve pending           -> True
+
+    Each successful resolve spends one successful reply. A failed or denied
+    resolve spends none, so a retry after a resolve error needs no second reply.
+
+    Args:
+        all_transcript_lines: JSON transcript entries, one per line.
+    """
+    unspent_reply_count = 0
+    for each_call in tool_calls_since_last_prompt(all_transcript_lines):
+        unspent_reply_count = _unspent_reply_count_after(unspent_reply_count, each_call)
+    return unspent_reply_count > 0
+
+
+def _unspent_reply_count_after(unspent_reply_count: int, tool_call: TranscriptToolCall) -> int:
+    if not tool_call.succeeded:
+        return unspent_reply_count
+    if is_resolve_call(tool_call.name):
+        return max(0, unspent_reply_count - 1)
+    if is_reply_call(tool_call):
+        return unspent_reply_count + 1
+    return unspent_reply_count
+
+
+def _transcript_shows_reply(transcript_path: str) -> bool | None:
+    try:
+        with open(transcript_path, encoding=UTF8_ENCODING, errors=DECODE_ERRORS_POLICY) as transcript:
+            return has_posted_reply_since_last_resolve(transcript)
+    except OSError:
+        return None
+
+
+def decision_for(all_payload_fields: dict[str, object]) -> dict[str, object] | None:
+    """Return a deny for a review thread resolve with no posted reply before it, else None.
+
+    ::
+
+        resolve after a reply that posted        -> None
+        resolve after a reply a hook refused     -> MISSING_REPLY_REASON
+        resolve with no reply this turn          -> MISSING_REPLY_REASON
+        second resolve after one reply           -> MISSING_REPLY_REASON
+        resolve with an unreadable transcript    -> None
+        any other tool                           -> None
+
+    The gate reads the calling agent's own transcript: a subagent's file when
+    the payload names one, else the session transcript.
+
+    Args:
+        all_payload_fields: The parsed PreToolUse input.
+    """
+    if not is_resolve_call(all_payload_fields.get("tool_name")):
+        return None
+    all_paths = transcript_paths(all_payload_fields)
+    if not all_paths:
+        return None
+    shows_reply = _transcript_shows_reply(all_paths[-1])
+    if shows_reply is None or shows_reply:
+        return None
+    return deny_decision(MISSING_REPLY_REASON)
+
+
+def main() -> int:
+    """Read one payload, print a deny when needed, and exit zero."""
+    return print_decision_from_stdin(decision_for)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/hooks/blocking/test_reply_length_gate.py

@@ -1065,3 +1065,14 @@ def test_should_read_gh_comment_body_and_skip_pr_create() -> None:
     assert reply_length_gate.github_comment_texts("Bash", {"command": flagged_command}) == [f"note=x. {LONG_GITHUB_COMMENT}"]
     chained_command = f"git push && {comment_command}"
     assert reply_length_gate.github_comment_texts("Bash", {"command": chained_command}) == [LONG_GITHUB_COMMENT]
+
+
+def test_should_report_an_over_long_comment_text_with_the_comment_instruction() -> None:
+    violation = reply_length_gate.comment_length_violation(LONG_GITHUB_COMMENT)
+    assert violation is not None
+    assert violation.endswith(reply_length_gate.COMMENT_RETRY_INSTRUCTION)
+
+
+def test_should_pass_a_comment_text_whose_long_part_sits_in_a_details_block() -> None:
+    comment_text = "Fixed.\n<details><summary>Log</summary>\n" + LONG_GITHUB_COMMENT + "\n</details>"
+    assert reply_length_gate.comment_length_violation(comment_text) is None