claude-dev-env 8.98.7 → 8.98.9

package/hooks/blocking/test_resolve_thread_reply_gate.py

@@ -16,6 +16,11 @@ from transcript_skill_scan import TranscriptToolCall
 GATE_PATH = Path(__file__).resolve().parent / "resolve_thread_reply_gate.py"
 RESOLVE_TOOL_NAME = "mcp__github__resolve_review_thread"
 REPLY_TOOL_NAME = "mcp__github__add_reply_to_pull_request_comment"
+READ_TOOL_NAME = "mcp__github__pull_request_read"
+FIRST_THREAD_ID = "PRRT_kwDOfirst"
+SECOND_THREAD_ID = "PRRT_kwDOsecond"
+FIRST_COMMENT_ID = 350000001
+SECOND_COMMENT_ID = 350000005
 HOOK_DENIAL_TEXT = "PreToolUse:mcp__github__add_reply_to_pull_request_comment hook error: too many sentences"
 
 
@@ -33,17 +38,60 @@ def _result(tool_use_id: str, is_error: bool = False, text: str = "ok") -> str:
     return json.dumps({"type": "user", "message": {"content": [tool_result]}})
 
 
+def _threads_read(tool_use_id: str = "read-1") -> list[str]:
+    all_threads = [
+        {
+            "id": each_thread_id,
+            "is_resolved": False,
+            "comments": [
+                {"path": "a.py", "html_url": f"https://github.com/o/r/pull/7#discussion_r{each_comment_id}"},
+                {"path": "a.py", "html_url": f"https://github.com/o/r/pull/7#discussion_r{each_comment_id + 1}"},
+            ],
+        }
+        for each_thread_id, each_comment_id in ((FIRST_THREAD_ID, FIRST_COMMENT_ID), (SECOND_THREAD_ID, SECOND_COMMENT_ID))
+    ]
+    return [
+        _call(tool_use_id, READ_TOOL_NAME, {"method": "get_review_comments", "pullNumber": 7}),
+        _result(tool_use_id, text=json.dumps({"review_threads": all_threads, "totalCount": 2})),
+    ]
+
+
+def _reply(tool_use_id: str, comment_id: int = FIRST_COMMENT_ID) -> str:
+    return _call(tool_use_id, REPLY_TOOL_NAME, {"commentId": comment_id, "body": "Fixed in `abc1234`."})
+
+
+def _resolve(tool_use_id: str, thread_id: str = FIRST_THREAD_ID) -> str:
+    return _call(tool_use_id, RESOLVE_TOOL_NAME, {"threadID": thread_id})
+
+
+def _shell_resolve_command(thread_id: str = FIRST_THREAD_ID) -> str:
+    return (
+        "gh api graphql -f query='mutation { resolveReviewThread(input: {threadId: \""
+        + thread_id
+        + "\"}) { thread { isResolved } } }'"
+    )
+
+
 def _write_transcript(tmp_path: Path, all_lines: list[str]) -> Path:
     transcript_path = tmp_path / "session.jsonl"
     transcript_path.write_text("\n".join(all_lines) + "\n", encoding="utf-8")
     return transcript_path
 
 
-def _resolve_payload(transcript_path: Path) -> dict[str, object]:
+def _resolve_payload(transcript_path: Path, thread_id: str = FIRST_THREAD_ID) -> dict[str, object]:
     return {
         "hook_event_name": "PreToolUse",
         "tool_name": RESOLVE_TOOL_NAME,
-        "tool_input": {"threadId": "PRRT_1"},
+        "tool_input": {"threadID": thread_id},
+        "transcript_path": str(transcript_path),
+    }
+
+
+def _shell_resolve_payload(transcript_path: Path, command: str) -> dict[str, object]:
+    return {
+        "hook_event_name": "PreToolUse",
+        "tool_name": "Bash",
+        "tool_input": {"command": command},
         "transcript_path": str(transcript_path),
     }
 
@@ -62,9 +110,10 @@ def should_allow_a_resolve_after_a_reply_that_posted(tmp_path: Path) -> None:
         tmp_path,
         [
             _prompt("Address the review threads."),
-            _call("reply-1", REPLY_TOOL_NAME, {"body": "Fixed in `abc1234`."}),
+            *_threads_read(),
+            _reply("reply-1"),
             _result("reply-1"),
-            _call("resolve-1", RESOLVE_TOOL_NAME),
+            _resolve("resolve-1"),
         ],
     )
     assert gate.decision_for(_resolve_payload(transcript_path)) is None
@@ -75,9 +124,10 @@ def should_deny_a_resolve_after_a_reply_a_hook_refused(tmp_path: Path) -> None:
         tmp_path,
         [
             _prompt("Address the review threads."),
-            _call("reply-1", REPLY_TOOL_NAME, {"body": "A long reply."}),
+            *_threads_read(),
+            _reply("reply-1"),
             _result("reply-1", is_error=True, text=HOOK_DENIAL_TEXT),
-            _call("resolve-1", RESOLVE_TOOL_NAME),
+            _resolve("resolve-1"),
         ],
     )
     assert _deny_reason(gate.decision_for(_resolve_payload(transcript_path))) == MISSING_REPLY_REASON
@@ -86,7 +136,7 @@ def should_deny_a_resolve_after_a_reply_a_hook_refused(tmp_path: Path) -> None:
 def should_deny_a_resolve_with_no_reply(tmp_path: Path) -> None:
     transcript_path = _write_transcript(
         tmp_path,
-        [_prompt("Address the review threads."), _call("resolve-1", RESOLVE_TOOL_NAME)],
+        [_prompt("Address the review threads."), *_threads_read(), _resolve("resolve-1")],
     )
     assert _deny_reason(gate.decision_for(_resolve_payload(transcript_path))) == MISSING_REPLY_REASON
 
@@ -96,42 +146,243 @@ def should_deny_a_second_resolve_after_one_reply(tmp_path: Path) -> None:
         tmp_path,
         [
             _prompt("Address the review threads."),
-            _call("reply-1", REPLY_TOOL_NAME, {"body": "Fixed in `abc1234`."}),
+            *_threads_read(),
+            _reply("reply-1"),
             _result("reply-1"),
-            _call("resolve-1", RESOLVE_TOOL_NAME),
+            _resolve("resolve-1"),
             _result("resolve-1"),
-            _call("resolve-2", RESOLVE_TOOL_NAME),
+            _resolve("resolve-2"),
         ],
     )
     assert _deny_reason(gate.decision_for(_resolve_payload(transcript_path))) == MISSING_REPLY_REASON
 
 
-def should_allow_a_second_resolve_after_two_replies(tmp_path: Path) -> None:
+def should_allow_a_second_resolve_after_a_reply_on_each_thread(tmp_path: Path) -> None:
     transcript_path = _write_transcript(
         tmp_path,
         [
             _prompt("Address the review threads."),
-            _call("reply-1", REPLY_TOOL_NAME, {"body": "Fixed in `abc1234`."}),
+            *_threads_read(),
+            _reply("reply-1"),
             _result("reply-1"),
-            _call("reply-2", REPLY_TOOL_NAME, {"body": "Fixed in `def5678`."}),
+            _reply("reply-2", SECOND_COMMENT_ID),
             _result("reply-2"),
-            _call("resolve-1", RESOLVE_TOOL_NAME),
+            _resolve("resolve-1"),
             _result("resolve-1"),
-            _call("resolve-2", RESOLVE_TOOL_NAME),
+            _resolve("resolve-2", SECOND_THREAD_ID),
+        ],
+    )
+    assert gate.decision_for(_resolve_payload(transcript_path, SECOND_THREAD_ID)) is None
+
+
+def should_deny_a_resolve_on_a_thread_the_reply_did_not_answer(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            *_threads_read(),
+            _reply("reply-1"),
+            _result("reply-1"),
+            _resolve("resolve-1", SECOND_THREAD_ID),
+        ],
+    )
+    decision = gate.decision_for(_resolve_payload(transcript_path, SECOND_THREAD_ID))
+    assert _deny_reason(decision) == MISSING_REPLY_REASON
+
+
+def should_deny_a_second_resolve_of_one_thread_after_replies_on_two_threads(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            *_threads_read(),
+            _reply("reply-1"),
+            _result("reply-1"),
+            _reply("reply-2", SECOND_COMMENT_ID),
+            _result("reply-2"),
+            _resolve("resolve-1"),
+            _result("resolve-1"),
+            _resolve("resolve-2"),
+        ],
+    )
+    assert _deny_reason(gate.decision_for(_resolve_payload(transcript_path))) == MISSING_REPLY_REASON
+
+
+def should_match_a_reply_on_a_later_comment_in_the_thread(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            *_threads_read(),
+            _reply("reply-1", SECOND_COMMENT_ID + 1),
+            _result("reply-1"),
+            _resolve("resolve-1", SECOND_THREAD_ID),
+        ],
+    )
+    assert gate.decision_for(_resolve_payload(transcript_path, SECOND_THREAD_ID)) is None
+
+
+def should_read_the_thread_map_from_before_the_last_prompt(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("List the review threads."),
+            *_threads_read(),
+            _prompt("Reply and resolve."),
+            _reply("reply-1"),
+            _result("reply-1"),
+            _resolve("resolve-1"),
         ],
     )
     assert gate.decision_for(_resolve_payload(transcript_path)) is None
 
 
+def should_deny_a_resolve_when_no_read_ties_the_reply_to_the_thread(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            _reply("reply-1"),
+            _result("reply-1"),
+            _resolve("resolve-1"),
+        ],
+    )
+    assert _deny_reason(gate.decision_for(_resolve_payload(transcript_path))) == MISSING_REPLY_REASON
+
+
+def should_allow_a_resolve_after_a_graphql_reply_on_the_thread(tmp_path: Path) -> None:
+    reply_command = (
+        "gh api graphql -f query='mutation { addPullRequestReviewThreadReply(input: "
+        f'{{pullRequestReviewThreadId: "{FIRST_THREAD_ID}", body: "Fixed."}}) {{ comment {{ id }} }} }}\''
+    )
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            _call("reply-1", "Bash", {"command": reply_command}),
+            _result("reply-1"),
+            _resolve("resolve-1"),
+        ],
+    )
+    assert gate.decision_for(_resolve_payload(transcript_path)) is None
+
+
+def should_deny_a_shell_resolve_with_no_reply(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(tmp_path, [_prompt("Address the review threads."), *_threads_read()])
+    decision = gate.decision_for(_shell_resolve_payload(transcript_path, _shell_resolve_command()))
+    assert _deny_reason(decision) == MISSING_REPLY_REASON
+
+
+def should_allow_a_shell_resolve_after_a_rest_reply_on_the_thread(tmp_path: Path) -> None:
+    reply_command = f"gh api repos/o/r/pulls/7/comments/{FIRST_COMMENT_ID}/replies -f body=Fixed."
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            *_threads_read(),
+            _call("reply-1", "Bash", {"command": reply_command}),
+            _result("reply-1"),
+        ],
+    )
+    assert gate.decision_for(_shell_resolve_payload(transcript_path, _shell_resolve_command())) is None
+
+
+def should_deny_a_shell_resolve_on_a_thread_the_reply_did_not_answer(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [_prompt("Address the review threads."), *_threads_read(), _reply("reply-1"), _result("reply-1")],
+    )
+    decision = gate.decision_for(_shell_resolve_payload(transcript_path, _shell_resolve_command(SECOND_THREAD_ID)))
+    assert _deny_reason(decision) == MISSING_REPLY_REASON
+
+
+def should_deny_a_shell_resolve_that_names_no_thread_id(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [_prompt("Address the review threads."), *_threads_read(), _reply("reply-1"), _result("reply-1")],
+    )
+    command = "gh api graphql -f threadId=\"$thread\" -f query='mutation($threadId: ID!) { resolveReviewThread(input: {threadId: $threadId}) { thread { isResolved } } }'"
+    assert _deny_reason(gate.decision_for(_shell_resolve_payload(transcript_path, command))) == MISSING_REPLY_REASON
+
+
+def should_spend_the_reply_on_a_shell_resolve(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            *_threads_read(),
+            _reply("reply-1"),
+            _result("reply-1"),
+            _call("resolve-1", "Bash", {"command": _shell_resolve_command()}),
+            _result("resolve-1"),
+            _resolve("resolve-2"),
+        ],
+    )
+    assert _deny_reason(gate.decision_for(_resolve_payload(transcript_path))) == MISSING_REPLY_REASON
+
+
+def _ccr_resolve_command(comment_id: int = FIRST_COMMENT_ID) -> str:
+    return f"gh api -X POST repos/o/r/pulls/7/ccr/comments/{comment_id}/resolve"
+
+
+def should_deny_a_ccr_resolve_with_no_reply(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(tmp_path, [_prompt("Address the review threads.")])
+    decision = gate.decision_for(_shell_resolve_payload(transcript_path, _ccr_resolve_command()))
+    assert _deny_reason(decision) == MISSING_REPLY_REASON
+
+
+def should_allow_a_ccr_resolve_of_the_comment_the_reply_answered(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [_prompt("Address the review threads."), _reply("reply-1"), _result("reply-1")],
+    )
+    assert gate.decision_for(_shell_resolve_payload(transcript_path, _ccr_resolve_command())) is None
+
+
+def should_deny_a_ccr_resolve_of_a_comment_in_another_thread(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [_prompt("Address the review threads."), *_threads_read(), _reply("reply-1"), _result("reply-1")],
+    )
+    decision = gate.decision_for(_shell_resolve_payload(transcript_path, _ccr_resolve_command(SECOND_COMMENT_ID)))
+    assert _deny_reason(decision) == MISSING_REPLY_REASON
+
+
+def should_spend_the_reply_on_a_ccr_resolve_of_the_same_thread(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            *_threads_read(),
+            _reply("reply-1"),
+            _result("reply-1"),
+            _call("resolve-1", "Bash", {"command": _ccr_resolve_command(FIRST_COMMENT_ID + 1)}),
+            _result("resolve-1"),
+            _resolve("resolve-2"),
+        ],
+    )
+    assert _deny_reason(gate.decision_for(_resolve_payload(transcript_path))) == MISSING_REPLY_REASON
+
+
+def should_ignore_shell_commands_other_than_a_resolve(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(tmp_path, [_prompt("Address the review threads.")])
+    assert gate.decision_for(_shell_resolve_payload(transcript_path, "gh pr view 7")) is None
+    unresolve_command = _shell_resolve_command().replace("resolveReviewThread", "unresolveReviewThread")
+    assert gate.decision_for(_shell_resolve_payload(transcript_path, unresolve_command)) is None
+    ccr_unresolve_command = _ccr_resolve_command().replace("/resolve", "/unresolve")
+    assert gate.decision_for(_shell_resolve_payload(transcript_path, ccr_unresolve_command)) is None
+
+
 def should_deny_a_resolve_whose_reply_came_before_the_last_prompt(tmp_path: Path) -> None:
     transcript_path = _write_transcript(
         tmp_path,
         [
             _prompt("Reply on the thread."),
-            _call("reply-1", REPLY_TOOL_NAME, {"body": "Fixed in `abc1234`."}),
+            *_threads_read(),
+            _reply("reply-1"),
             _result("reply-1"),
-            _prompt("Now resolve the other thread."),
-            _call("resolve-1", RESOLVE_TOOL_NAME),
+            _prompt("Now resolve the thread."),
+            _resolve("resolve-1"),
         ],
     )
     assert _deny_reason(gate.decision_for(_resolve_payload(transcript_path))) == MISSING_REPLY_REASON
@@ -142,11 +393,12 @@ def should_allow_a_retry_after_a_resolve_error(tmp_path: Path) -> None:
         tmp_path,
         [
             _prompt("Address the review threads."),
-            _call("reply-1", REPLY_TOOL_NAME, {"body": "Fixed in `abc1234`."}),
+            *_threads_read(),
+            _reply("reply-1"),
             _result("reply-1"),
-            _call("resolve-1", RESOLVE_TOOL_NAME),
+            _resolve("resolve-1"),
             _result("resolve-1", is_error=True, text="Bad gateway"),
-            _call("resolve-2", RESOLVE_TOOL_NAME),
+            _resolve("resolve-2"),
         ],
     )
     assert gate.decision_for(_resolve_payload(transcript_path)) is None
@@ -177,16 +429,52 @@ def should_count_a_gh_api_reply_command_as_a_reply() -> None:
     assert not gate.is_reply_call(TranscriptToolCall("mcp__github__add_issue_comment", {}, True))
 
 
+def should_name_the_threads_a_call_resolves() -> None:
+    assert gate.resolved_thread_ids(RESOLVE_TOOL_NAME, {"threadID": FIRST_THREAD_ID}) == {FIRST_THREAD_ID}
+    assert gate.resolved_thread_ids(RESOLVE_TOOL_NAME, {"threadId": FIRST_THREAD_ID}) == {FIRST_THREAD_ID}
+    assert gate.resolved_thread_ids("Bash", {"command": _shell_resolve_command()}) == {FIRST_THREAD_ID}
+    assert gate.resolved_thread_ids("PowerShell", {"command": _shell_resolve_command()}) == {FIRST_THREAD_ID}
+    assert gate.resolved_thread_ids("Bash", {"command": _ccr_resolve_command()}) == {str(FIRST_COMMENT_ID)}
+    assert gate.resolved_thread_ids("Bash", {"command": "gh pr view 7"}) is None
+    assert gate.resolved_thread_ids(REPLY_TOOL_NAME, {"commentId": FIRST_COMMENT_ID}) is None
+
+
+def should_map_comment_ids_to_threads_from_tool_results() -> None:
+    graphql_text = json.dumps(
+        {"nodes": [{"id": SECOND_THREAD_ID, "comments": {"nodes": [{"databaseId": SECOND_COMMENT_ID}]}}]}
+    )
+    graphql_result = json.dumps(
+        {
+            "type": "user",
+            "message": {
+                "content": [
+                    {"type": "tool_result", "tool_use_id": "read-2", "content": [{"type": "text", "text": graphql_text}]}
+                ]
+            },
+        }
+    )
+    refused_text = json.dumps({"id": SECOND_THREAD_ID, "html_url": "x#discussion_r1"})
+    thread_id_by_comment_id = gate.thread_ids_by_comment_id(
+        [*_threads_read(), graphql_result, _result("read-3", is_error=True, text=refused_text), "not json"]
+    )
+    assert thread_id_by_comment_id[str(FIRST_COMMENT_ID)] == FIRST_THREAD_ID
+    assert thread_id_by_comment_id[str(FIRST_COMMENT_ID + 1)] == FIRST_THREAD_ID
+    assert thread_id_by_comment_id[str(SECOND_COMMENT_ID)] == SECOND_THREAD_ID
+    assert "1" not in thread_id_by_comment_id
+
+
 def should_report_a_posted_reply_from_transcript_lines() -> None:
-    all_lines = [_prompt("Go."), _call("reply-1", REPLY_TOOL_NAME), _result("reply-1")]
-    assert gate.has_posted_reply_since_last_resolve(all_lines)
-    assert not gate.has_posted_reply_since_last_resolve(all_lines[:2])
+    all_lines = [_prompt("Go."), *_threads_read(), _reply("reply-1"), _result("reply-1")]
+    assert gate.has_posted_reply_on_threads(all_lines, frozenset({FIRST_THREAD_ID}))
+    assert not gate.has_posted_reply_on_threads(all_lines, frozenset({SECOND_THREAD_ID}))
+    assert not gate.has_posted_reply_on_threads(all_lines[:-1], frozenset({FIRST_THREAD_ID}))
+    assert not gate.has_posted_reply_on_threads(all_lines, frozenset())
 
 
 def should_print_the_deny_when_run_as_a_hook(tmp_path: Path) -> None:
     transcript_path = _write_transcript(
         tmp_path,
-        [_prompt("Address the review threads."), _call("resolve-1", RESOLVE_TOOL_NAME)],
+        [_prompt("Address the review threads."), _resolve("resolve-1")],
     )
     completed_process = subprocess.run(
         [sys.executable, str(GATE_PATH)],
@@ -197,3 +485,31 @@ def should_print_the_deny_when_run_as_a_hook(tmp_path: Path) -> None:
     )
     assert completed_process.returncode == 0
     assert _deny_reason(json.loads(completed_process.stdout)) == MISSING_REPLY_REASON
+
+
+def _review_write_payload(transcript_path: Path, method: str, thread_id: str = FIRST_THREAD_ID) -> dict[str, object]:
+    return {
+        "hook_event_name": "PreToolUse",
+        "tool_name": "mcp__github__pull_request_review_write",
+        "tool_input": {"method": method, "threadId": thread_id, "owner": "o", "repo": "r", "pullNumber": 7},
+        "transcript_path": str(transcript_path),
+    }
+
+
+def should_deny_a_review_write_resolve_with_no_reply(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(tmp_path, [_prompt("Address the review threads.")])
+    decision = gate.decision_for(_review_write_payload(transcript_path, "resolve_thread"))
+    assert _deny_reason(decision) == MISSING_REPLY_REASON
+
+
+def should_allow_a_review_write_resolve_after_a_reply_on_that_thread(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [_prompt("Address the review threads."), *_threads_read(), _reply("reply-1"), _result("reply-1")],
+    )
+    assert gate.decision_for(_review_write_payload(transcript_path, "resolve_thread")) is None
+
+
+def should_leave_a_review_write_that_submits_a_review_alone(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(tmp_path, [_prompt("Review the pull request.")])
+    assert gate.decision_for(_review_write_payload(transcript_path, "create")) is None

package/hooks/features/conduct-gates.md

@@ -17,7 +17,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/step_note_gate.py` requires a status line before a tool call while its opt-in flag is on.
 - `blocking/verify_before_acting.py` blocks a completed mutating call when the agent's reasoning contains an unchecked claim.
 - `blocking/pr_lifecycle_skill_gate.py` denies a commit, push, pull request action, or merge until the `pr-lifecycle` skill appears in the transcript since the last compaction.
-- `blocking/resolve_thread_reply_gate.py` denies a review thread resolve until the agent's own transcript shows a reply on a thread that posted after the last user prompt and that no successful resolve has spent. Each successful resolve spends one posted reply. A reply is an `add_reply_to_pull_request_comment` call, or a `gh api` call to a comment's `replies` endpoint or to `addPullRequestReviewThreadReply`. A reply whose result is an error, such as a refusal from `blocking/reply_length_gate.py`, does not count. With no readable transcript, the resolve passes.
+- `blocking/resolve_thread_reply_gate.py` denies a review thread resolve until the agent's own transcript shows a reply on that same thread that posted after the last user prompt and that no successful resolve of the thread has spent. A resolve is a `resolve_review_thread` call, which names the thread by `threadID`; a `pull_request_review_write` call with method `resolve_thread`, which names it by `threadId`; a shell command with a `gh api graphql` `resolveReviewThread` mutation, which names it by a literal `PRRT_` id; or a shell call to `pulls/<n>/ccr/comments/<id>/resolve`, which names it by a comment id. A graphql resolve that names no `PRRT_` id is denied. A reply is an `add_reply_to_pull_request_comment` call, or a `gh api` call to a comment's `replies` endpoint or to `addPullRequestReviewThreadReply`, which names its thread by `PRRT_` id. A reply and a resolve by comment id match when they name the same comment, or when a successful tool result in the transcript, such as `pull_request_read` `get_review_comments`, lists the comment under the thread by its `discussion_r` anchor or `databaseId`. A reply whose result is an error, such as a refusal from `blocking/reply_length_gate.py`, does not count. With no readable transcript, the resolve passes.
 - `blocking/verify_before_commit_gate.py` denies a `git commit` in a repository with a `.claude/skills/verify` or `.agents/skills/verify` directory until the `verify` skill loads after the last user prompt, through a Skill call or the `/verify` command in that prompt. It reads the committed paths from the staged diff, the tracked changes for `-a`, and the paths of each `git add` earlier in the same command, and passes a commit whose paths are all docs, images, or test files.
 - `blocking/build_eval_before_eval_write_gate.py` denies a write to an eval file until a Skill call named exactly `claude-api` with args `build-eval`, or the `/claude-api build-eval` command, appears in the transcript.
 - `blocking/merge_review_gate.py` denies an agent's merge until a review pass on the merged head reported zero findings, or ruled out every finding and linked the posted rulings. It reads the receipt `scripts/merge_review_receipt.py` writes, requires the merge, auto-merge or merge-queue entry to be pinned to that head, and skips repositories listed in `CLAUDE_MERGE_REVIEW_EXEMPT_REPOSITORIES`. Its deny reason names the review command `CLAUDE_MERGE_REVIEW_COMMAND` sets. The reason tells the agent to run that command for the first three passes and `/code-review low --fix <number>` for each later pass; the gate itself counts no passes.
@@ -40,7 +40,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/step_note_gate.py` runs on `PreToolUse`, matcher `*`, timeout `15` seconds in `hooks.json`.
 - `blocking/verify_before_acting.py` runs on `PostToolUse`, matcher `Write|Edit|MultiEdit|NotebookEdit|Agent|Task|apply_patch|Bash|PowerShell|mcp__.*`, timeout `10` seconds in `hooks.json`.
 - `blocking/pr_lifecycle_skill_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request|actions_run_trigger)`, timeout `10` seconds in `hooks.json`.
-- `blocking/resolve_thread_reply_gate.py` runs on `PreToolUse`, matcher `mcp__.*__resolve_review_thread`, timeout `10` seconds in `hooks.json`.
+- `blocking/resolve_thread_reply_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__resolve_review_thread|mcp__.*__pull_request_review_write`, timeout `10` seconds in `hooks.json`.
 - `blocking/verify_before_commit_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell`, timeout `30` seconds in `hooks.json`.
 - `blocking/build_eval_before_eval_write_gate.py` runs on `PreToolUse`, matcher `Write|Edit|MultiEdit|NotebookEdit|apply_patch`, timeout `10` seconds in `hooks.json`.
 - `blocking/merge_review_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__(merge_pull_request|enable_pr_auto_merge)`, timeout `10` seconds in `hooks.json`.
@@ -55,7 +55,7 @@ Preconditions:
 - Run each command from the repository root with Python and pytest available. The tests create transcript and payload fixtures.
 
 - **Reply length.** Input is a reply with four sentences, a plain pull request number, an abbreviation, two sentences with no widget this turn, or widget code with an anchor link. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_reply_length_gate.py -q`. The adjacent test observes a denial and its count, link, or mode reason. Widget code with no flowchart passes with a flowchart reminder in `additionalContext`.
-- **Resolve reply.** Input is a transcript where a thread reply came back refused, or with no reply, or with one reply already spent on a resolve, then a resolve call. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_resolve_thread_reply_gate.py -q`. The adjacent test observes a deny whose reason says to post the reply, confirm it posted, then resolve. A reply that posted before the resolve passes, and an unreadable transcript passes.
+- **Resolve reply.** Input is a transcript where a thread reply came back refused, or with no reply, or with one reply already spent on a resolve, or with a reply on another thread, then a resolve call, a `pull_request_review_write` `resolve_thread` call, a graphql `resolveReviewThread` command, or a `ccr/comments/<id>/resolve` call. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_resolve_thread_reply_gate.py -q`. The adjacent test observes a deny whose reason says to post the reply, confirm it posted, then resolve. A reply that posted before the resolve passes, and an unreadable transcript passes.
 - **Final reply.** Input is a closing reply that says "My guess is one to two hours." or cites a run no tool result shows. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_final_reply_gate.py -q`. The adjacent test observes a `block` decision that quotes the sentence or the citation; a reply that cites a run a tool result shows passes. A reply with a plain-text `D:\Reports\.claude\report.html` is blocked; the same path in backticks or a fenced block passes.
 - **Open tasks.** Input is a session whose task list still has "rotate the deploy key" pending and a closing reply of "Done.". Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_open_tasks_stop_gate.py -q`. The adjacent test observes a `block` decision that names the item; a reply line `Blocked: rotate the deploy key - <what the user must give>` passes. The same file covers an interrupted ask, a continuation plan list that leaves items out, `Done:` and `Dropped:` lines, and a carried item that a later list marks completed.
 - **Ask recorder.** Input is a `UserPromptSubmit` payload with a work prompt, a question, a `<task-notification>` envelope, and a polite request. Run `python -m pytest packages/claude-dev-env/hooks/session/test_open_task_ask_recorder.py -q`. The adjacent test observes `ask-1` and `ask-2` for the work prompt and the request, no ask for the other two, and empty stdout.

package/hooks/hooks.json

@@ -103,7 +103,7 @@
         ]
       },
       {
-        "matcher": "mcp__.*__resolve_review_thread",
+        "matcher": "Bash|PowerShell|mcp__.*__resolve_review_thread|mcp__.*__pull_request_review_write",
         "hooks": [
           {
             "type": "command",

package/hooks/hooks_constants/resolve_thread_reply_gate_constants.py

@@ -8,15 +8,30 @@ from hooks_constants.reply_length_gate_constants import (
 )
 
 RESOLVE_TOOL_NAME_PATTERN = re.compile(r"^mcp__.+__resolve_review_thread$")
+REVIEW_WRITE_TOOL_NAME_PATTERN = re.compile(r"^mcp__.+__pull_request_review_write$")
+REVIEW_WRITE_METHOD_KEY = "method"
+RESOLVE_THREAD_METHOD = "resolve_thread"
 ALL_REPLY_TOOL_NAME_SUFFIXES = ("__add_reply_to_pull_request_comment",)
 SHELL_COMMAND_KEY = "command"
 SHELL_REPLY_COMMAND_PATTERN = re.compile(
     r"\bgh\s+api\b.*(?:/comments/\d+/replies\b|addPullRequestReviewThreadReply)", re.DOTALL
 )
+SHELL_RESOLVE_COMMAND_PATTERN = re.compile(r"\bgh\s+api\s+graphql\b.*\bresolveReviewThread\b", re.DOTALL)
+SHELL_RESOLVE_COMMENT_ID_PATTERN = re.compile(r"/pulls/\d+/ccr/comments/(\d+)/resolve\b")
+ALL_THREAD_ID_INPUT_KEYS = ("threadID", "threadId")
+COMMENT_ID_INPUT_KEY = "commentId"
+THREAD_ID_PATTERN = re.compile(r"\bPRRT_[A-Za-z0-9_-]+")
+COMMENT_ANCHOR_PATTERN = re.compile(r"(?:discussion_r|\"databaseId\"\s*:\s*)(\d+)")
+SHELL_REPLY_COMMENT_ID_PATTERN = re.compile(r"/comments/(\d+)/replies\b")
+TEXT_BLOCK_TYPE = "text"
+TEXT_FIELD = "text"
 MISSING_REPLY_REASON = (
-    "This review thread has no reply that posted since the last user prompt and the last resolve."
-    " Post the reply with add_reply_to_pull_request_comment, confirm its result came back without"
-    " an error, then resolve the thread. A reply that a hook refused did not post; shorten it to"
+    "This review thread has no reply on it that posted since the last user prompt and the last"
+    " resolve of the thread. Post the reply on this thread with add_reply_to_pull_request_comment,"
+    " or with gh api graphql addPullRequestReviewThreadReply and the thread's PRRT_ id, confirm its"
+    " result came back without an error, then resolve the thread by its PRRT_ id or by the comment id the reply answered. A comment id"
+    " ties to a thread only through a pull_request_read get_review_comments result in this session."
+    " A reply that a hook refused did not post; shorten it to"
     f" at most {MAXIMUM_SENTENCE_COUNT} sentences of at most {MAXIMUM_WORDS_PER_SENTENCE} words each,"
     " footer included, and send it again."
 )

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.98.7",
+    "version": "8.98.9",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {