dev-loops 0.6.0 → 0.7.2

package/.claude/hooks/_bash-command-classify.mjs

@@ -15,6 +15,53 @@ export const TARGET_REPO_SLUG = "mfittko/dev-loops";
 /** Flags known to take a value argument for `gh pr ready` (not boolean flags). */
 export const FLAGS_THAT_TAKE_VALUE = new Set(["-r", "--repo"]);
 
+/**
+ * Shell command separators that terminate one segment and begin the next.
+ * Newline (`\n`) and carriage return (`\r`) are full command terminators in bash
+ * (equivalent to `;`), and the Claude Code Bash tool accepts multi-line command
+ * strings — so a segment must break on them too, else `echo hi\ngh pr create` evades
+ * the gate. Used by all segment-splitting sites (DRY).
+ */
+const SHELL_SEGMENT_SEPARATOR = /\s*(?:&&|\|\||;|\||\n|\r)\s*/;
+
+/**
+ * Strip a single balanced surrounding quote pair (`'…'` or `"…"`) from a shell arg value.
+ * A repo flag value may reach us quoted (`--repo 'owner/name'`); the scope check compares against
+ * the bare slug, so quotes must be normalized or a quoted on-target repo evades the guard (#1074).
+ * ponytail: single balanced pair only — no full shell tokenization (mismatched/partial quotes stay).
+ * @param {string|null} value @returns {string|null}
+ */
+function stripSurroundingQuotes(value) {
+  if (value == null || value.length < 2) return value;
+  const first = value[0];
+  if ((first === "'" || first === '"') && value[value.length - 1] === first) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+
+/**
+ * Read an inline `GH_REPO=<value>` env-assignment prefix on a single command segment.
+ * `gh` resolves its target repo from the `GH_REPO` env var, and a segment may set it inline
+ * (`GH_REPO=owner/name gh issue create …`) — same targeting intent as `--repo owner/name`, so the
+ * scope check must treat it the same or an off-cwd redirect evades the guard (#1074). Only the
+ * FIRST leading env assignment matching `GH_REPO=` is read (env assignments precede the executable);
+ * the value is quote-normalized. Ambient `process.env.GH_REPO` is out of scope — this is a static
+ * command-string classifier, so only the inline assignment in the string is considered.
+ * @param {string} segment @returns {string|null}
+ */
+function extractGhRepoEnvAssignment(segment) {
+  if (!segment) return null;
+  for (const token of segment.trim().split(/\s+/)) {
+    const assign = token.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!assign) break; // first non-assignment token ends the env-assignment prefix
+    if (assign[1] === "GH_REPO") {
+      return trimToNull(stripSurroundingQuotes(assign[2]));
+    }
+  }
+  return null;
+}
+
 /** @param {string|null|undefined} value @returns {string|null} */
 export function trimToNull(value) {
   const trimmed = `${value ?? ""}`.trim();
@@ -51,7 +98,7 @@ export function normalizeGitHubRepoSlug(remoteUrl) {
   return null;
 }
 
-function isGhPrMergeCommand(segment) {
+function segmentIsGhPrMerge(segment) {
   if (!/^gh\s+pr\s+merge(?:\s|$)/i.test(segment)) {
     return false;
   }
@@ -82,36 +129,178 @@ export function isMergeCapableCommand(command) {
     return false;
   }
   return normalized
-    .split(/\s*(?:&&|\|\||;|\|)\s*/)
-    .some((segment) => isGhPrMergeCommand(segment) || isGitMergeCompletionCommand(segment));
+    .split(SHELL_SEGMENT_SEPARATOR)
+    .some((segment) => segmentIsGhPrMerge(segment) || isGitMergeCompletionCommand(segment));
 }
 
 /** @param {string} command @returns {string} */
 export function firstShellSegment(command) {
-  return command.trim().split(/\s*(?:&&|\|\||;|\|)\s*/)[0]?.trim() ?? "";
+  return command.trim().split(SHELL_SEGMENT_SEPARATOR)[0]?.trim() ?? "";
 }
 
-/** @param {string} command @returns {boolean} */
-export function isGhPrReadyCommand(command) {
-  const segment = firstShellSegment(command);
-  if (!segment || !/^gh\s+pr\s+ready(?:\s|$)/i.test(segment)) {
-    return false;
+/** Split a compound shell command into its individual segments. */
+function shellSegments(command) {
+  return command.trim().split(SHELL_SEGMENT_SEPARATOR).map((s) => s.trim()).filter(Boolean);
+}
+
+/**
+ * Leading prefix a `gh pr <verb>` segment may carry before the `gh` executable:
+ * a run of `NAME=value` env assignments, optional `command`/`env`/`exec` wrapper
+ * words, and an absolute/relative path on the gh binary (`/usr/bin/gh`).
+ *
+ * Note: this is a pragmatic normalizer, not a full shell tokenizer. Subshell
+ * `(gh pr create)`, `{ …; }` group, `-R=value` short-flag, and backslash-escaped
+ * `\gh` forms are deliberately out of scope.
+ */
+const GH_PR_VERB_PREFIX = "(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*(?:(?:command|env|exec)\\s+)*(?:\\S*/)?";
+
+/**
+ * Build the `gh <subcmd> <verb>` prefix matcher (subcmd = "pr" | "issue").
+ * Tolerates a leading env-assignment/wrapper/path prefix so `GH_TOKEN=x gh pr create`,
+ * `command gh issue create`, and `/usr/bin/gh pr create` are all matched. The same regex
+ * is reused to strip the matched prefix (`segment.replace(re, "")`), so remainder
+ * extraction stays consistent across all matcher/extractor call sites. The `gh` prefix
+ * requirement means node-wrapper commands (`node scripts/github/comment-issue.mjs …`) never
+ * match — their first token is `node`, not `gh`.
+ */
+function ghSubcmdVerbRegex(subcmd, verb) {
+  return new RegExp(`^${GH_PR_VERB_PREFIX}gh\\s+${subcmd}\\s+${verb}(?:\\s|$)`, "i");
+}
+
+/** Build the `gh pr <verb>` prefix matcher — delegates to the generic subcmd matcher (DRY). */
+function ghPrVerbRegex(verb) {
+  return ghSubcmdVerbRegex("pr", verb);
+}
+
+/**
+ * Return the first segment in the command that is a `gh <subcmd> <verb>` call (ignoring
+ * --help/-h), or null. Scans ALL segments so compound commands are caught.
+ */
+function findGhSubcmdVerbSegment(command, subcmd, verb) {
+  const re = ghSubcmdVerbRegex(subcmd, verb);
+  for (const segment of shellSegments(command)) {
+    if (!re.test(segment)) continue;
+    const remainder = segment.replace(re, "").trim();
+    if (!remainder) return segment;
+    const args = remainder.split(/\s+/).map((a) => a.toLowerCase());
+    if (!args.includes("--help") && !args.includes("-h")) return segment;
   }
-  const remainder = segment.replace(/^gh\s+pr\s+ready(?:\s|$)/i, "").trim();
-  if (!remainder) {
-    return true;
+  return null;
+}
+
+/**
+ * Extract the `--repo`/`-R` flag value from an already-isolated `gh <subcmd> <verb>` segment.
+ * @param {string} segment @param {string} subcmd @param {string} verb @returns {string|null}
+ */
+function extractRepoFlagFromSubcmdSegment(segment, subcmd, verb) {
+  const re = ghSubcmdVerbRegex(subcmd, verb);
+  if (!segment || !re.test(segment)) return null;
+  const remainder = segment.replace(re, "").trim();
+  if (!remainder) return null;
+  const tokens = remainder.split(/\s+/);
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i];
+    const lower = token.toLowerCase();
+    if (lower === "-r" || lower === "--repo") {
+      if (i + 1 < tokens.length && !tokens[i + 1].startsWith("-")) return stripSurroundingQuotes(tokens[i + 1]);
+    }
+    const repoEqMatch = token.match(/^(?:--repo|-R)=(.+)$/i);
+    if (repoEqMatch) return stripSurroundingQuotes(repoEqMatch[1]);
+  }
+  // No explicit --repo/-R flag: fall back to an inline GH_REPO= env assignment (flag wins,
+  // mirroring gh's own precedence). This closes the GH_REPO repo-targeting bypass (#1074).
+  return extractGhRepoEnvAssignment(segment);
+}
+
+/**
+ * Return one `{ segment, explicitRepo }` entry for EVERY `gh <subcmd> <verb>` segment (ignoring
+ * --help/-h). Mirrors `extractRepoFlagsFromGhPrCreateSegments`.
+ * @param {string} command @param {string} subcmd @param {string} verb
+ * @returns {{ segment: string, explicitRepo: string|null }[]}
+ */
+function extractRepoFlagsFromGhSubcmdVerbSegments(command, subcmd, verb) {
+  const re = ghSubcmdVerbRegex(subcmd, verb);
+  const out = [];
+  for (const segment of shellSegments(command)) {
+    if (!re.test(segment)) continue;
+    const remainder = segment.replace(re, "").trim();
+    if (remainder) {
+      const args = remainder.split(/\s+/).map((a) => a.toLowerCase());
+      if (args.includes("--help") || args.includes("-h")) continue;
+    }
+    out.push({ segment, explicitRepo: extractRepoFlagFromSubcmdSegment(segment, subcmd, verb) });
   }
+  return out;
+}
+
+/**
+ * The raw external-write verb forms that must be blocked when originating from a subagent:
+ * ad-hoc GitHub issue/PR creation and comments run directly via `gh` (not the sanctioned node
+ * wrappers). Each entry is `[subcmd, verb]`.
+ */
+const EXTERNAL_WRITE_VERB_FORMS = Object.freeze([
+  ["issue", "create"],
+  ["issue", "comment"],
+  ["pr", "comment"],
+]);
+
+/**
+ * Whether `command` contains a raw `gh issue create`, `gh issue comment`, or `gh pr comment`
+ * invocation in ANY shell segment (ignoring --help/-h). PreToolUse gate use only — the gate
+ * blocks these when they originate from a subagent context. Node-wrapper commands
+ * (`node scripts/github/comment-issue.mjs …`) never match (first token is `node`, not `gh`).
+ * @param {string} command @returns {boolean}
+ */
+export function commandContainsRawExternalWrite(command) {
+  return EXTERNAL_WRITE_VERB_FORMS.some(([subcmd, verb]) => findGhSubcmdVerbSegment(command, subcmd, verb) !== null);
+}
+
+/**
+ * Return `{ segment, explicitRepo }` for every raw external-write segment across all three verb
+ * forms (`gh issue create` / `gh issue comment` / `gh pr comment`). PreToolUse gate use only —
+ * lets the gate decide in-scope-ness per segment so a leading out-of-scope write can't shield a
+ * later in-scope one. `explicitRepo` is the segment's `--repo`/`-R` value or null.
+ * @param {string} command @returns {{ segment: string, explicitRepo: string|null }[]}
+ */
+export function extractRepoFlagsFromExternalWriteSegments(command) {
+  return EXTERNAL_WRITE_VERB_FORMS.flatMap(([subcmd, verb]) =>
+    extractRepoFlagsFromGhSubcmdVerbSegments(command, subcmd, verb),
+  );
+}
+
+/**
+ * Return the first segment in the command that is a `gh pr <verb>` call (ignoring --help/-h),
+ * or null. Scans ALL segments so compound commands (`echo ok && gh pr merge 1`) are caught.
+ */
+function findGhPrVerbSegment(command, verb) {
+  return findGhSubcmdVerbSegment(command, "pr", verb);
+}
+
+/**
+ * Generic `gh pr <verb>` detector — checks the FIRST shell segment only.
+ *
+ * Used by the Pi extension's post-execute handler (`onUserBash`) to record that `gh pr ready`
+ * actually ran. First-segment-only is correct for that use: `false && gh pr ready 42` short-
+ * circuits so ready never executes, and the extension should not record a spurious invocation.
+ *
+ * For the Claude Code PreToolUse gate (block before execution), use
+ * `commandContainsGhPrReady`/`commandContainsGhPrMerge` instead — those scan ALL segments.
+ */
+function isGhPrVerbCommand(command, verb) {
+  const re = ghPrVerbRegex(verb);
+  const segment = firstShellSegment(command);
+  if (!segment || !re.test(segment)) return false;
+  const remainder = segment.replace(re, "").trim();
+  if (!remainder) return true;
   const args = remainder.split(/\s+/).map((a) => a.toLowerCase());
   return !args.includes("--help") && !args.includes("-h");
 }
 
-/** @param {string} command @returns {number|null} */
-export function extractPrNumberFromGhPrReady(command) {
-  const segment = firstShellSegment(command);
-  if (!/^gh\s+pr\s+ready(?:\s|$)/i.test(segment)) {
-    return null;
-  }
-  const remainder = segment.replace(/^gh\s+pr\s+ready(?:\s|$)/i, "").trim();
+/** Extract PR number from a single already-isolated segment (shared by both first- and all-segment paths). */
+function extractPrNumberFromSegment(segment, verb) {
+  const re = ghPrVerbRegex(verb);
+  if (!segment || !re.test(segment)) return null;
+  const remainder = segment.replace(re, "").trim();
   if (!remainder) {
     return null;
   }
@@ -136,13 +325,11 @@ export function extractPrNumberFromGhPrReady(command) {
   return null;
 }
 
-/** @param {string} command @returns {string|null} */
-export function extractRepoFlagFromGhPrReady(command) {
-  const segment = firstShellSegment(command);
-  if (!/^gh\s+pr\s+ready(?:\s|$)/i.test(segment)) {
-    return null;
-  }
-  const remainder = segment.replace(/^gh\s+pr\s+ready(?:\s|$)/i, "").trim();
+/** Extract repo flag from a single already-isolated segment. */
+function extractRepoFlagFromSegment(segment, verb) {
+  const re = ghPrVerbRegex(verb);
+  if (!segment || !re.test(segment)) return null;
+  const remainder = segment.replace(re, "").trim();
   if (!remainder) {
     return null;
   }
@@ -152,13 +339,130 @@ export function extractRepoFlagFromGhPrReady(command) {
     const lower = token.toLowerCase();
     if (lower === "-r" || lower === "--repo") {
       if (i + 1 < tokens.length && !tokens[i + 1].startsWith("-")) {
-        return tokens[i + 1];
+        return stripSurroundingQuotes(tokens[i + 1]);
       }
     }
     const repoEqMatch = token.match(/^(?:--repo|-R)=(.+)$/i);
     if (repoEqMatch) {
-      return repoEqMatch[1];
+      return stripSurroundingQuotes(repoEqMatch[1]);
     }
   }
-  return null;
+  // No explicit --repo/-R flag: fall back to an inline GH_REPO= env assignment (flag wins,
+  // mirroring gh's own precedence). Applied here too so gh pr ready/merge/create scope checks get
+  // consistent GH_REPO handling — the root-cause fix, not just the external-write path (#1074).
+  return extractGhRepoEnvAssignment(segment);
+}
+
+/** First-segment extractor for `gh pr <verb>` PR number — Pi extension public API. */
+function extractPrNumberFromGhPrVerb(command, verb) {
+  return extractPrNumberFromSegment(firstShellSegment(command), verb);
+}
+
+/** First-segment extractor for `gh pr <verb>` --repo flag — Pi extension public API. */
+function extractRepoFlagFromGhPrVerb(command, verb) {
+  return extractRepoFlagFromSegment(firstShellSegment(command), verb);
+}
+
+/** @param {string} command @returns {boolean} */
+export function isGhPrReadyCommand(command) {
+  return isGhPrVerbCommand(command, "ready");
+}
+
+/** @param {string} command @returns {number|null} */
+export function extractPrNumberFromGhPrReady(command) {
+  return extractPrNumberFromGhPrVerb(command, "ready");
+}
+
+/** @param {string} command @returns {string|null} */
+export function extractRepoFlagFromGhPrReady(command) {
+  return extractRepoFlagFromGhPrVerb(command, "ready");
+}
+
+/**
+ * Whether `command` contains a `gh pr merge` invocation in the FIRST shell segment,
+ * ignoring `--help`/`-h`. Used by the Pi extension's post-execute handler.
+ * For the Claude Code PreToolUse gate, use `commandContainsGhPrMerge` instead.
+ * @param {string} command @returns {boolean}
+ */
+export function isGhPrMergeCommand(command) {
+  return isGhPrVerbCommand(command, "merge");
+}
+
+/**
+ * Whether `command` contains a `gh pr ready` invocation in ANY shell segment.
+ * For use in the Claude Code PreToolUse gate only — blocks the whole command pre-emptively
+ * regardless of shell short-circuit semantics (`false && gh pr ready 42` is still blocked).
+ * @param {string} command @returns {boolean}
+ */
+export function commandContainsGhPrReady(command) {
+  return findGhPrVerbSegment(command, "ready") !== null;
+}
+
+/**
+ * Whether `command` contains a `gh pr merge` invocation in ANY shell segment.
+ * For use in the Claude Code PreToolUse gate only — blocks the whole command pre-emptively.
+ * @param {string} command @returns {boolean}
+ */
+export function commandContainsGhPrMerge(command) {
+  return findGhPrVerbSegment(command, "merge") !== null;
+}
+
+/** Extract PR number from `gh pr ready` in any shell segment — PreToolUse gate use only. */
+export function extractPrNumberFromGhPrReadyAnywhere(command) {
+  return extractPrNumberFromSegment(findGhPrVerbSegment(command, "ready"), "ready");
+}
+
+/** @param {string} command @returns {string|null} */
+export function extractRepoFlagFromGhPrReadyAnywhere(command) {
+  return extractRepoFlagFromSegment(findGhPrVerbSegment(command, "ready"), "ready");
+}
+
+/** Extract PR number from `gh pr merge` in any shell segment — PreToolUse gate use only. */
+export function extractPrNumberFromGhPrMergeAnywhere(command) {
+  return extractPrNumberFromSegment(findGhPrVerbSegment(command, "merge"), "merge");
+}
+
+/** @param {string} command @returns {string|null} */
+export function extractRepoFlagFromGhPrMergeAnywhere(command) {
+  return extractRepoFlagFromSegment(findGhPrVerbSegment(command, "merge"), "merge");
+}
+
+/**
+ * Whether `command` contains a raw `gh pr create` invocation in ANY shell segment.
+ * PreToolUse gate use only — blocks raw `gh pr create` so PR creation flows through the
+ * canonical wrapper (`scripts/github/create-pr.mjs` / `dev-loops pr create`), which always
+ * creates a draft and self-assigns. The wrapper runs `gh pr create` inside a node child
+ * process, so its Bash command string (`node …/create-pr.mjs …`) never matches this — only a
+ * literal `gh pr create` in the agent's shell command does.
+ * @param {string} command @returns {boolean}
+ */
+export function commandContainsGhPrCreate(command) {
+  return findGhPrVerbSegment(command, "create") !== null;
+}
+
+/** Extract repo flag from `gh pr create` in any shell segment — PreToolUse gate use only. */
+export function extractRepoFlagFromGhPrCreateAnywhere(command) {
+  return extractRepoFlagFromSegment(findGhPrVerbSegment(command, "create"), "create");
+}
+
+/**
+ * Return one `{ segment, explicitRepo }` entry for EVERY `gh pr create` segment (ignoring
+ * --help/-h), not just the first. PreToolUse gate use only: the create-scope decision must
+ * consider every create segment, so a leading out-of-scope create can't shield a later
+ * in-scope raw create (`gh pr create --repo other/repo && gh pr create --fill`).
+ * `explicitRepo` is the segment's `--repo`/`-R` value or null when none is present.
+ * @param {string} command @returns {{ segment: string, explicitRepo: string|null }[]}
+ */
+export function extractRepoFlagsFromGhPrCreateSegments(command) {
+  return extractRepoFlagsFromGhSubcmdVerbSegments(command, "pr", "create");
+}
+
+/** @param {string} command @returns {number|null} */
+export function extractPrNumberFromGhPrMerge(command) {
+  return extractPrNumberFromGhPrVerb(command, "merge");
+}
+
+/** @param {string} command @returns {string|null} */
+export function extractRepoFlagFromGhPrMerge(command) {
+  return extractRepoFlagFromGhPrVerb(command, "merge");
 }

package/.claude/hooks/_hook-decisions.mjs

@@ -12,9 +12,16 @@
 
 import { resolveRunId } from "./_run-context.mjs";
 import {
-  isGhPrReadyCommand,
-  extractPrNumberFromGhPrReady,
-  extractRepoFlagFromGhPrReady,
+  commandContainsGhPrReady,
+  commandContainsGhPrMerge,
+  commandContainsGhPrCreate,
+  extractPrNumberFromGhPrReadyAnywhere,
+  extractRepoFlagFromGhPrReadyAnywhere,
+  extractPrNumberFromGhPrMergeAnywhere,
+  extractRepoFlagFromGhPrMergeAnywhere,
+  extractRepoFlagsFromGhPrCreateSegments,
+  commandContainsRawExternalWrite,
+  extractRepoFlagsFromExternalWriteSegments,
   TARGET_REPO_SLUG,
 } from "./_bash-command-classify.mjs";
 
@@ -26,6 +33,16 @@ import {
 
 const ALLOW = Object.freeze({ decision: "allow" });
 
+/**
+ * Whether the command string also invokes an evidence-writing script (findings-log ledger or
+ * checkpoint-verdict upsert). Used only to enrich the merge-block message (#1172) — a compound
+ * command combining an evidence write with `gh pr merge` is blocked pre-execution, so the write
+ * never runs; this substring check has no false-negative cost (worst case: the plain message).
+ */
+function commandContainsEvidenceWrite(command) {
+  return command.includes("write-gate-findings-log") || command.includes("upsert-checkpoint-verdict");
+}
+
 /**
  * The agent type (Claude `agent_type` / the canonical agent name) that owns repo mutations.
  * Only this subagent — not arbitrary subagents (Explore, Plan, generic Task agents) — may
@@ -34,26 +51,114 @@ const ALLOW = Object.freeze({ decision: "allow" });
 export const DEV_LOOP_AGENT_TYPE = "dev-loop";
 
 /**
- * Decide whether a PreToolUse Bash command must be blocked by the draft-gate boundary.
+ * Decide whether a PreToolUse Bash command must be blocked by a dev-loop gate boundary.
+ *
+ * Three gated commands on the target repo:
+ *   - `gh pr create` — blocked outright; PR creation must flow through the canonical wrapper
+ *     (`scripts/github/create-pr.mjs` / `dev-loops pr create`), which always drafts and
+ *     self-assigns. Closes the hole where raw `gh pr create` opens a ready PR, bypassing draft-first.
+ *   - `gh pr ready` — blocked without clean draft_gate evidence (`pre-pr-ready-gate`).
+ *   - `gh pr merge` — blocked without the full pre-merge gate evidence (`detect-checkpoint-evidence`:
+ *     clean current-head draft_gate + pre_approval_gate). The loop runs this check before merging;
+ *     gating it here closes the hole where a hand-run `gh pr merge` skips the pre-approval gate
+ *     entirely. Everything else passes through.
+ *   - raw `gh issue create` / `gh issue comment` / `gh pr comment` — blocked ONLY when the call
+ *     originates from a SUBAGENT context (`agentType` is a non-null string) and targets the repo.
+ *     Sanctioned external writes flow through node wrappers (gate-verdict comments via
+ *     `upsert-checkpoint-verdict.mjs`, review replies via `reply-resolve*.mjs`, board sync,
+ *     `comment-issue.mjs`), whose Bash command string is `node scripts/…` and never matches these
+ *     raw-`gh` matchers. The MAIN AGENT / operator (agentType null) retains direct `gh issue
+ *     create` — that path is authorized (#1051).
  *
- * Mirrors the Pi extension's `onUserBash`: the only blocked case is `gh pr ready` for the
- * target repo without clean draft_gate evidence. Everything else (including merges, which
- * trigger the post-merge step, not a block) is allowed through.
+ * The hook computes `gatePassed`/`gateError` from the gate script appropriate to the command kind.
  *
  * @param {Object} params
  * @param {string} params.command - The Bash command string.
  * @param {string|null} [params.repoSlug] - Resolved owner/name of the cwd repo (null if unknown).
- * @param {boolean} [params.gatePassed] - Whether `pre-pr-ready-gate` evidence exists for the PR.
+ * @param {boolean} [params.gatePassed] - Whether the relevant gate evidence exists for the PR.
  * @param {string|null} [params.gateError] - Error detail when the gate guard could not run.
+ * @param {string|null} [params.agentType] - Claude `agent_type` from the hook payload; non-null
+ *   string inside a subagent, null in the main agent. Scopes the external-write guard.
  * @returns {HookDecision}
  */
-export function decideBashGate({ command, repoSlug = null, gatePassed = false, gateError = null }) {
-  if (typeof command !== "string" || !isGhPrReadyCommand(command)) {
+export function decideBashGate({ command, repoSlug = null, gatePassed = false, gateError = null, agentType = null }) {
+  if (typeof command !== "string") {
+    return ALLOW;
+  }
+  // Subagent-scoped external-write guard: block ad-hoc `gh issue create`/`gh issue comment`/
+  // `gh pr comment` on the target repo from a subagent, so external writes flow through the
+  // sanctioned node wrappers. The main-agent/operator path (agentType null) is unaffected (#1051).
+  if (typeof agentType === "string" && commandContainsRawExternalWrite(command)) {
+    const cwdTargets = (repoSlug ?? "").toLowerCase() === TARGET_REPO_SLUG.toLowerCase();
+    // Scope PER segment, mirroring the `gh pr create` block: in scope when no explicit --repo and
+    // cwd is the target, or an explicit --repo/-R equals the target. An explicit non-target --repo
+    // passes through. DENY if ANY external-write segment is in scope.
+    const anyWriteInScope = extractRepoFlagsFromExternalWriteSegments(command).some((seg) =>
+      seg.explicitRepo == null
+        ? cwdTargets
+        : seg.explicitRepo.toLowerCase() === TARGET_REPO_SLUG.toLowerCase(),
+    );
+    if (anyWriteInScope) {
+      return {
+        decision: "deny",
+        reason:
+          "Ad-hoc GitHub issue/PR creation and comments from a subagent are blocked. Use the sanctioned " +
+          "node wrappers instead — gate-verdict comments via scripts/github/upsert-checkpoint-verdict.mjs, " +
+          "review-thread replies via scripts/github/reply-resolve*.mjs, board sync, or scripts/github/comment-issue.mjs. " +
+          "Direct `gh issue create` is reserved for the main agent / operator.",
+      };
+    }
+  }
+  // Scan ALL shell segments — the PreToolUse gate blocks pre-emptively, so a gated verb in any
+  // segment (even after `&&` or `;`) must be caught. This differs from the Pi extension's
+  // post-execute `isGhPrReadyCommand`/`isGhPrMergeCommand` which scan only the first segment
+  // (correct there: `false && gh pr ready 42` short-circuits so ready never ran).
+  const isReady = commandContainsGhPrReady(command);
+  const isMerge = commandContainsGhPrMerge(command);
+  const isCreate = commandContainsGhPrCreate(command);
+  if (!isReady && !isMerge && !isCreate) {
     return ALLOW;
   }
 
+  // Raw `gh pr create` is blocked outright on the target repo (no PR number / gate evidence
+  // exists yet): PR creation must flow through the canonical wrapper, which always drafts and
+  // self-assigns. This closes the draft-first hole where raw `gh pr create` opens a ready PR.
+  if (isCreate) {
+    const cwdTargets = (repoSlug ?? "").toLowerCase() === TARGET_REPO_SLUG.toLowerCase();
+    // Evaluate scope PER create segment, not just the first: a create is in scope when it
+    // explicitly targets the repo, or (with no explicit --repo) the cwd is the repo. An explicit
+    // `--repo <target>` is denied regardless of cwd (#1047). DENY if ANY create segment is in
+    // scope — otherwise a leading out-of-scope create (`gh pr create --repo other/repo`) would
+    // short-circuit and shield a later in-scope raw create (`&& gh pr create --fill`).
+    const anyCreateInScope = extractRepoFlagsFromGhPrCreateSegments(command).some((seg) =>
+      seg.explicitRepo == null
+        ? cwdTargets
+        : seg.explicitRepo.toLowerCase() === TARGET_REPO_SLUG.toLowerCase(),
+    );
+    if (anyCreateInScope) {
+      return {
+        decision: "deny",
+        reason:
+          "gh pr create blocked: open PRs via the canonical wrapper `node scripts/github/create-pr.mjs` " +
+          "(a.k.a. `dev-loops pr create`), which always creates a draft and self-assigns. Raw `gh pr create` " +
+          "defaults to ready-for-review and bypasses the draft-first contract (workflow.requireDraftFirst).",
+      };
+    }
+    // The create is out of scope. Only allow outright when there is no ready/merge segment to
+    // evaluate — otherwise fall through so a gated `gh pr ready`/`gh pr merge` in the same
+    // compound command (e.g. `gh pr create --repo other/repo && gh pr merge 5`) is still gated
+    // below rather than short-circuited.
+    if (!isReady && !isMerge) {
+      return ALLOW;
+    }
+  }
+  // When both verbs appear in a compound command, apply the stricter merge gate — if it passes,
+  // the draft_gate (a subset of the pre-merge evidence check) is also satisfied.
+  const verb = isMerge ? "gh pr merge" : "gh pr ready";
   // An explicit `--repo other/repo` that is not the target → not our concern, pass through.
-  const explicitRepo = extractRepoFlagFromGhPrReady(command);
+  const explicitRepo = isMerge
+    ? extractRepoFlagFromGhPrMergeAnywhere(command)
+    : extractRepoFlagFromGhPrReadyAnywhere(command);
   if (explicitRepo && explicitRepo.toLowerCase() !== TARGET_REPO_SLUG.toLowerCase()) {
     return ALLOW;
   }
@@ -62,23 +167,41 @@ export function decideBashGate({ command, repoSlug = null, gatePassed = false, g
     return ALLOW;
   }
 
-  const prNumber = extractPrNumberFromGhPrReady(command);
+  const prNumber = isMerge
+    ? extractPrNumberFromGhPrMergeAnywhere(command)
+    : extractPrNumberFromGhPrReadyAnywhere(command);
   if (prNumber === null) {
     return {
       decision: "deny",
-      reason:
-        "gh pr ready blocked: could not determine the PR number from the command. Include the PR number explicitly.",
+      reason: `${verb} blocked: could not determine the PR number from the command. Include the PR number explicitly.`,
     };
   }
 
   if (gateError) {
+    const which = isMerge ? "pre-merge gate" : "draft-gate";
     return {
       decision: "deny",
-      reason: `gh pr ready blocked: draft-gate evidence check failed (${gateError}).`,
+      reason: `${verb} blocked: ${which} evidence check failed (${gateError}).`,
     };
   }
 
   if (!gatePassed) {
+    if (isMerge) {
+      // This hook evaluates PreToolUse — BEFORE the Bash tool call runs. A compound command that
+      // writes gate evidence (findings-log ledger, checkpoint verdict) and merges in the same call
+      // is blocked here with the write never having executed, which looks like the evidence
+      // "vanished" (#1172). Hint the split when the command carries an evidence-writing invocation
+      // alongside the merge, so the failure is self-explaining instead of looking like data loss.
+      const alsoWritesEvidence = commandContainsEvidenceWrite(command);
+      return {
+        decision: "deny",
+        reason:
+          `gh pr merge blocked: missing pre-merge gate evidence for PR #${prNumber} (need clean current-head draft_gate + pre_approval_gate; inline verdicts are not accepted). Run the dev-loop gates instead of merging directly.` +
+          (alsoWritesEvidence
+            ? " This command also writes gate evidence, but hooks evaluate before the command runs — write the evidence in a separate call, then merge alone."
+            : ""),
+      };
+    }
     return {
       decision: "deny",
       reason: `gh pr ready blocked: no visible clean draft_gate checkpoint verdict comment found for PR #${prNumber}.`,