project-init 0.5.1__tar.gz → 0.5.2__tar.gz

{project_init-0.5.1/plugins/project-init-lifecycle → project_init-0.5.2/.claude}/hooks/dag_workflow.py

@@ -297,6 +297,37 @@ def _strip_heredocs(cmd: str) -> str:
     return _HEREDOC_RE.sub("", cmd)
 
 
+# Free-text flag values carry arbitrary prose (commit messages, issue/PR comment
+# and release bodies, titles) that must not be scanned for command patterns — a
+# `--body` mentioning the literal "git push main" is data, not an invocation.
+_TEXT_FLAG_RE = re.compile(
+    r"""(?P<flag>--body|--message|--title|--notes|-b|-m|-t)   # known free-text flags
+        (?:=|\s+)                                             # = or whitespace separator
+        (?P<q>['"])                                           # opening quote
+        (?P<val>(?:\\.|(?!(?P=q)).)*)                         # value (escapes allowed)
+        (?P=q)                                                # matching closing quote
+    """,
+    re.VERBOSE | re.DOTALL,
+)
+
+
+def _strip_text_flag_values(cmd: str) -> str:
+    """Blank the quoted value of known free-text flags so prose can't trip the
+    pattern rules. Values containing a command substitution (``$(`` or a
+    backtick) are left intact — those ARE executed, so the rules must still see
+    them. Flag values are otherwise inert data: masking loses no real
+    enforcement (an actual ``git push origin main`` uses a positional ref, not a
+    flag value, and stays blocked)."""
+
+    def _blank(m: re.Match[str]) -> str:
+        val = m.group("val")
+        if "$(" in val or "`" in val:
+            return m.group(0)
+        return f'{m.group("flag")} ""'
+
+    return _TEXT_FLAG_RE.sub(_blank, cmd)
+
+
 def _redirect_target_exists(reason: str) -> bool:
     """Best-effort: scan the redirect message for a `.claude/scripts/<name>`
     reference and check whether the file exists. If no reference is found,
@@ -325,9 +356,10 @@ def guard(payload: dict) -> dict | None:
     if not cmd:
         return None
 
-    # Strip heredoc bodies so pattern rules don't fire on body content
-    # (e.g. `gh issue create --body "$(cat <<'EOF'\n...git push...\nEOF\n)"`)
-    cmd_scan = _strip_heredocs(cmd)
+    # Strip heredoc bodies and free-text flag values so pattern rules don't fire
+    # on prose content (e.g. `gh issue create --body "$(cat <<'EOF'\n...git
+    # push...\nEOF\n)"`, or `gh pr comment --body "...git push main..."`).
+    cmd_scan = _strip_text_flag_values(_strip_heredocs(cmd))
 
     for pattern, target, message in COMMAND_RULES:
         if not pattern.search(cmd_scan):

{project_init-0.5.1 → project_init-0.5.2}/.claude-plugin/marketplace.json

@@ -1,5 +1,6 @@
 {
   "name": "project-init",
+  "description": "Plugins extracted from the project-init scaffolder: forge-agnostic quality and safety hooks plus general skills (project-init-workflow), and GitHub issue->branch->PR->review->merge lifecycle automation (project-init-lifecycle).",
   "owner": {
     "name": "Vytautas Čepas",
     "url": "https://github.com/VytCepas"

{project_init-0.5.1 → project_init-0.5.2}/CITATION.cff

@@ -9,4 +9,4 @@ authors:
 repository-code: https://github.com/VytCepas/project-init
 url: https://vytcepas.github.io/project-init/
 license: Apache-2.0
-version: 0.5.1
+version: 0.5.2

{project_init-0.5.1 → project_init-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: project-init
-Version: 0.5.1
+Version: 0.5.2
 Summary: Scaffolder for agentic-development infrastructure inside any project
 Project-URL: Repository, https://github.com/VytCepas/project-init
 Project-URL: Documentation, https://vytcepas.github.io/project-init/
@@ -38,6 +38,14 @@ Description-Content-Type: text/markdown
 
 Scaffolder for agentic-development infrastructure. One command drops a `.claude/` folder into any project so Claude Code (and other agents) have memory, docs, hooks, and curated MCPs ready to go.
 
+**Who it's for** — solo devs and small teams running Claude Code seriously across multiple repos who want consistent, *enforced* agent infrastructure (CI, a git-lifecycle DAG guard, memory, curated MCPs) — not a hand-maintained `.claude/` per project.
+
+```bash
+uvx project-init .        # scaffold into the current directory
+```
+
+→ **How it compares** to other scaffolders and Claude Code plugins: [docs/positioning.md](docs/positioning.md).
+
 ## What it gives you
 
 Inside any target project:
@@ -66,6 +74,52 @@ Principles:
 - **Claude-first, portable core** — built and tested for Claude Code; other agents get instructions, not enforcement. See [Agent support tiers](#agent-support-tiers).
 - **`bun` and `uv` only** — no `npm`/`npx`/`pip`/`venv` anywhere in scaffolded projects.
 
+## Install (one-time)
+
+Two install paths — pick by how you'll invoke it:
+
+**CLI-only, from [PyPI](https://pypi.org/project/project-init/)** (ADR-011). Gives
+you the `project-init` command — no `/project-init` slash command:
+
+```bash
+uv tool install project-init   # or one-off: uvx project-init .
+```
+
+**Full setup, from git** — adds the Claude Code slash command:
+
+```bash
+curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh | bash
+```
+
+This installs [`uv`](https://docs.astral.sh/uv/) if missing, clones the repo to `~/.local/share/project-init` (override with `PROJECT_INIT_HOME=...`) **pinned to the latest tagged release**, and writes a user-level slash command at `~/.claude/commands/project-init.md`.
+
+Pin a specific version, or opt into the unreleased development head:
+
+```bash
+PROJECT_INIT_REF=v0.5.1 bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
+PROJECT_INIT_REF=main   bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
+```
+
+Direct tool install without the slash command (any pinned tag):
+
+```bash
+uv tool install git+https://github.com/VytCepas/project-init@v0.5.1
+```
+
+Distribution rationale: [ADR-008](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-008-distribution-channel.md) (git channel), [ADR-011](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-011-pypi-trusted-publishing.md) (PyPI via trusted publishing).
+
+### Platform requirements
+
+macOS, Linux, and WSL work out of the box. The scaffolded hooks and lifecycle
+scripts are bash (a single bash-3.2 portability floor, epic #359) — so on **native Windows
+(non-WSL)** you need **[Git for Windows](https://gitforwindows.org/)** (it ships
+`bash`/`sh` + coreutils), and you should run from a **Git Bash** shell. Claude
+Code then runs hooks through Git Bash automatically; the wired hooks also pin
+`"shell": "bash"` to make that explicit. Without Git for Windows, Claude Code
+falls back to PowerShell, which can't run a bash hook — so the enforcement
+hooks won't fire. PowerShell-only is not a supported target; there are no
+`.ps1` equivalents by design. (WSL remains the smoothest Windows path.)
+
 ## Agent support tiers
 
 This is **firstly a Claude Code scaffolder**. It aims to be agent-agnostic where
@@ -121,52 +175,6 @@ Two honest caveats hold across all of it:
   files.** The suite validates settings/skills/hooks/MCP and the generated
   surface configs; no GUI agent is driven live in CI.
 
-## Install (one-time)
-
-Two install paths — pick by how you'll invoke it:
-
-**CLI-only, from [PyPI](https://pypi.org/project/project-init/)** (ADR-011). Gives
-you the `project-init` command — no `/project-init` slash command:
-
-```bash
-uv tool install project-init   # or one-off: uvx project-init .
-```
-
-**Full setup, from git** — adds the Claude Code slash command:
-
-```bash
-curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh | bash
-```
-
-This installs [`uv`](https://docs.astral.sh/uv/) if missing, clones the repo to `~/.local/share/project-init` (override with `PROJECT_INIT_HOME=...`) **pinned to the latest tagged release**, and writes a user-level slash command at `~/.claude/commands/project-init.md`.
-
-Pin a specific version, or opt into the unreleased development head:
-
-```bash
-PROJECT_INIT_REF=v0.5.1 bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
-PROJECT_INIT_REF=main   bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
-```
-
-Direct tool install without the slash command (any pinned tag):
-
-```bash
-uv tool install git+https://github.com/VytCepas/project-init@v0.5.1
-```
-
-Distribution rationale: [ADR-008](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-008-distribution-channel.md) (git channel), [ADR-011](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-011-pypi-trusted-publishing.md) (PyPI via trusted publishing).
-
-### Platform requirements
-
-macOS, Linux, and WSL work out of the box. The scaffolded hooks and lifecycle
-scripts are bash (a single bash-3.2 portability floor, epic #359) — so on **native Windows
-(non-WSL)** you need **[Git for Windows](https://gitforwindows.org/)** (it ships
-`bash`/`sh` + coreutils), and you should run from a **Git Bash** shell. Claude
-Code then runs hooks through Git Bash automatically; the wired hooks also pin
-`"shell": "bash"` to make that explicit. Without Git for Windows, Claude Code
-falls back to PowerShell, which can't run a bash hook — so the enforcement
-hooks won't fire. PowerShell-only is not a supported target; there are no
-`.ps1` equivalents by design. (WSL remains the smoothest Windows path.)
-
 ## Use
 
 ### Option 1: Inside a Claude Code session (interactive)
@@ -452,15 +460,23 @@ four-category comparison and the moat, see
 
 ```
 project-init/
-├── pyproject.toml            # uv-managed, rich-only runtime dep, ruff-only dev
-├── install.sh                # bootstrap one-liner
-├── src/project_init/         # wizard CLI + scaffold engine
+├── pyproject.toml              # uv-managed, rich-only runtime dep, ruff-only dev
+├── install.sh                  # bootstrap one-liner
+├── src/project_init/           # wizard CLI + scaffold engine (scaffold, concerns, surfaces, mcps, …)
 ├── templates/
-│   ├── base/                 # always copied (no memory backend of its own)
-│   ├── obsidian/             # vault + agent-memory overlay; derived from memory_stack (#466)
-│   ├── graphify/             # Graphify memory overlay (implies obsidian)
-│   └── presets/              # toml preset definitions
-└── tests/                    # focused pytest modules by behavior area
+│   ├── base/                   # always copied
+│   ├── fallback/               # shared hooks/skills — rendered only with --no-plugin (ADR-010)
+│   ├── presets/                # toml preset definitions
+│   ├── obsidian/               # vault + agent-memory overlay
+│   ├── graphify/               # Graphify memory overlay (implies obsidian)
+│   ├── rag/                    # tier-3 RAG memory overlay
+│   ├── lifecycle/              # git lifecycle enforcement (+ lifecycle_fallback for --no-plugin)
+│   ├── multi_model/            # CCR model-switching overlay (--multi-model)
+│   ├── observability/          # transcript metrics overlay (--observability)
+│   ├── governance/             # AI governance overlay (--governance)
+│   ├── auto/                   # always-on emitted artifacts
+│   └── amp/ antigravity/ codex/ junie/  # per-surface wiring overlays (--agents)
+└── tests/                      # focused pytest modules by behavior area
 ```
 
 ## Status

{project_init-0.5.1 → project_init-0.5.2}/README.md

@@ -7,6 +7,14 @@
 
 Scaffolder for agentic-development infrastructure. One command drops a `.claude/` folder into any project so Claude Code (and other agents) have memory, docs, hooks, and curated MCPs ready to go.
 
+**Who it's for** — solo devs and small teams running Claude Code seriously across multiple repos who want consistent, *enforced* agent infrastructure (CI, a git-lifecycle DAG guard, memory, curated MCPs) — not a hand-maintained `.claude/` per project.
+
+```bash
+uvx project-init .        # scaffold into the current directory
+```
+
+→ **How it compares** to other scaffolders and Claude Code plugins: [docs/positioning.md](docs/positioning.md).
+
 ## What it gives you
 
 Inside any target project:
@@ -35,6 +43,52 @@ Principles:
 - **Claude-first, portable core** — built and tested for Claude Code; other agents get instructions, not enforcement. See [Agent support tiers](#agent-support-tiers).
 - **`bun` and `uv` only** — no `npm`/`npx`/`pip`/`venv` anywhere in scaffolded projects.
 
+## Install (one-time)
+
+Two install paths — pick by how you'll invoke it:
+
+**CLI-only, from [PyPI](https://pypi.org/project/project-init/)** (ADR-011). Gives
+you the `project-init` command — no `/project-init` slash command:
+
+```bash
+uv tool install project-init   # or one-off: uvx project-init .
+```
+
+**Full setup, from git** — adds the Claude Code slash command:
+
+```bash
+curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh | bash
+```
+
+This installs [`uv`](https://docs.astral.sh/uv/) if missing, clones the repo to `~/.local/share/project-init` (override with `PROJECT_INIT_HOME=...`) **pinned to the latest tagged release**, and writes a user-level slash command at `~/.claude/commands/project-init.md`.
+
+Pin a specific version, or opt into the unreleased development head:
+
+```bash
+PROJECT_INIT_REF=v0.5.1 bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
+PROJECT_INIT_REF=main   bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
+```
+
+Direct tool install without the slash command (any pinned tag):
+
+```bash
+uv tool install git+https://github.com/VytCepas/project-init@v0.5.1
+```
+
+Distribution rationale: [ADR-008](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-008-distribution-channel.md) (git channel), [ADR-011](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-011-pypi-trusted-publishing.md) (PyPI via trusted publishing).
+
+### Platform requirements
+
+macOS, Linux, and WSL work out of the box. The scaffolded hooks and lifecycle
+scripts are bash (a single bash-3.2 portability floor, epic #359) — so on **native Windows
+(non-WSL)** you need **[Git for Windows](https://gitforwindows.org/)** (it ships
+`bash`/`sh` + coreutils), and you should run from a **Git Bash** shell. Claude
+Code then runs hooks through Git Bash automatically; the wired hooks also pin
+`"shell": "bash"` to make that explicit. Without Git for Windows, Claude Code
+falls back to PowerShell, which can't run a bash hook — so the enforcement
+hooks won't fire. PowerShell-only is not a supported target; there are no
+`.ps1` equivalents by design. (WSL remains the smoothest Windows path.)
+
 ## Agent support tiers
 
 This is **firstly a Claude Code scaffolder**. It aims to be agent-agnostic where
@@ -90,52 +144,6 @@ Two honest caveats hold across all of it:
   files.** The suite validates settings/skills/hooks/MCP and the generated
   surface configs; no GUI agent is driven live in CI.
 
-## Install (one-time)
-
-Two install paths — pick by how you'll invoke it:
-
-**CLI-only, from [PyPI](https://pypi.org/project/project-init/)** (ADR-011). Gives
-you the `project-init` command — no `/project-init` slash command:
-
-```bash
-uv tool install project-init   # or one-off: uvx project-init .
-```
-
-**Full setup, from git** — adds the Claude Code slash command:
-
-```bash
-curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh | bash
-```
-
-This installs [`uv`](https://docs.astral.sh/uv/) if missing, clones the repo to `~/.local/share/project-init` (override with `PROJECT_INIT_HOME=...`) **pinned to the latest tagged release**, and writes a user-level slash command at `~/.claude/commands/project-init.md`.
-
-Pin a specific version, or opt into the unreleased development head:
-
-```bash
-PROJECT_INIT_REF=v0.5.1 bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
-PROJECT_INIT_REF=main   bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
-```
-
-Direct tool install without the slash command (any pinned tag):
-
-```bash
-uv tool install git+https://github.com/VytCepas/project-init@v0.5.1
-```
-
-Distribution rationale: [ADR-008](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-008-distribution-channel.md) (git channel), [ADR-011](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-011-pypi-trusted-publishing.md) (PyPI via trusted publishing).
-
-### Platform requirements
-
-macOS, Linux, and WSL work out of the box. The scaffolded hooks and lifecycle
-scripts are bash (a single bash-3.2 portability floor, epic #359) — so on **native Windows
-(non-WSL)** you need **[Git for Windows](https://gitforwindows.org/)** (it ships
-`bash`/`sh` + coreutils), and you should run from a **Git Bash** shell. Claude
-Code then runs hooks through Git Bash automatically; the wired hooks also pin
-`"shell": "bash"` to make that explicit. Without Git for Windows, Claude Code
-falls back to PowerShell, which can't run a bash hook — so the enforcement
-hooks won't fire. PowerShell-only is not a supported target; there are no
-`.ps1` equivalents by design. (WSL remains the smoothest Windows path.)
-
 ## Use
 
 ### Option 1: Inside a Claude Code session (interactive)
@@ -421,15 +429,23 @@ four-category comparison and the moat, see
 
 ```
 project-init/
-├── pyproject.toml            # uv-managed, rich-only runtime dep, ruff-only dev
-├── install.sh                # bootstrap one-liner
-├── src/project_init/         # wizard CLI + scaffold engine
+├── pyproject.toml              # uv-managed, rich-only runtime dep, ruff-only dev
+├── install.sh                  # bootstrap one-liner
+├── src/project_init/           # wizard CLI + scaffold engine (scaffold, concerns, surfaces, mcps, …)
 ├── templates/
-│   ├── base/                 # always copied (no memory backend of its own)
-│   ├── obsidian/             # vault + agent-memory overlay; derived from memory_stack (#466)
-│   ├── graphify/             # Graphify memory overlay (implies obsidian)
-│   └── presets/              # toml preset definitions
-└── tests/                    # focused pytest modules by behavior area
+│   ├── base/                   # always copied
+│   ├── fallback/               # shared hooks/skills — rendered only with --no-plugin (ADR-010)
+│   ├── presets/                # toml preset definitions
+│   ├── obsidian/               # vault + agent-memory overlay
+│   ├── graphify/               # Graphify memory overlay (implies obsidian)
+│   ├── rag/                    # tier-3 RAG memory overlay
+│   ├── lifecycle/              # git lifecycle enforcement (+ lifecycle_fallback for --no-plugin)
+│   ├── multi_model/            # CCR model-switching overlay (--multi-model)
+│   ├── observability/          # transcript metrics overlay (--observability)
+│   ├── governance/             # AI governance overlay (--governance)
+│   ├── auto/                   # always-on emitted artifacts
+│   └── amp/ antigravity/ codex/ junie/  # per-surface wiring overlays (--agents)
+└── tests/                      # focused pytest modules by behavior area
 ```
 
 ## Status

{project_init-0.5.1/.claude → project_init-0.5.2/plugins/project-init-lifecycle}/hooks/dag_workflow.py

@@ -297,6 +297,37 @@ def _strip_heredocs(cmd: str) -> str:
     return _HEREDOC_RE.sub("", cmd)
 
 
+# Free-text flag values carry arbitrary prose (commit messages, issue/PR comment
+# and release bodies, titles) that must not be scanned for command patterns — a
+# `--body` mentioning the literal "git push main" is data, not an invocation.
+_TEXT_FLAG_RE = re.compile(
+    r"""(?P<flag>--body|--message|--title|--notes|-b|-m|-t)   # known free-text flags
+        (?:=|\s+)                                             # = or whitespace separator
+        (?P<q>['"])                                           # opening quote
+        (?P<val>(?:\\.|(?!(?P=q)).)*)                         # value (escapes allowed)
+        (?P=q)                                                # matching closing quote
+    """,
+    re.VERBOSE | re.DOTALL,
+)
+
+
+def _strip_text_flag_values(cmd: str) -> str:
+    """Blank the quoted value of known free-text flags so prose can't trip the
+    pattern rules. Values containing a command substitution (``$(`` or a
+    backtick) are left intact — those ARE executed, so the rules must still see
+    them. Flag values are otherwise inert data: masking loses no real
+    enforcement (an actual ``git push origin main`` uses a positional ref, not a
+    flag value, and stays blocked)."""
+
+    def _blank(m: re.Match[str]) -> str:
+        val = m.group("val")
+        if "$(" in val or "`" in val:
+            return m.group(0)
+        return f'{m.group("flag")} ""'
+
+    return _TEXT_FLAG_RE.sub(_blank, cmd)
+
+
 def _redirect_target_exists(reason: str) -> bool:
     """Best-effort: scan the redirect message for a `.claude/scripts/<name>`
     reference and check whether the file exists. If no reference is found,
@@ -325,9 +356,10 @@ def guard(payload: dict) -> dict | None:
     if not cmd:
         return None
 
-    # Strip heredoc bodies so pattern rules don't fire on body content
-    # (e.g. `gh issue create --body "$(cat <<'EOF'\n...git push...\nEOF\n)"`)
-    cmd_scan = _strip_heredocs(cmd)
+    # Strip heredoc bodies and free-text flag values so pattern rules don't fire
+    # on prose content (e.g. `gh issue create --body "$(cat <<'EOF'\n...git
+    # push...\nEOF\n)"`, or `gh pr comment --body "...git push main..."`).
+    cmd_scan = _strip_text_flag_values(_strip_heredocs(cmd))
 
     for pattern, target, message in COMMAND_RULES:
         if not pattern.search(cmd_scan):

{project_init-0.5.1 → project_init-0.5.2}/plugins/project-init-workflow/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "project-init-workflow",
   "displayName": "project-init Workflow",
   "version": "0.1.0",
-  "description": "GitHub lifecycle skills and deterministic guard hooks from project-init: issue->branch->PR->review->merge workflow, commit gating, and session bootstrap.",
+  "description": "Forge-agnostic quality and safety hooks plus general skills from project-init: commit gating, lint-on-edit, prod-safety guard, and session bootstrap. The always-on core payload; GitHub lifecycle automation lives in the separate project-init-lifecycle plugin.",
   "author": {
     "name": "Vytautas Čepas",
     "url": "https://github.com/VytCepas"

{project_init-0.5.1 → project_init-0.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "project-init"
-version = "0.5.1"
+version = "0.5.2"
 description = "Scaffolder for agentic-development infrastructure inside any project"
 readme = "README.md"
 requires-python = ">=3.11"

{project_init-0.5.1 → project_init-0.5.2}/src/project_init/__init__.py

@@ -1,6 +1,6 @@
 """project-init — scaffolder for agentic-development infrastructure."""
 
-__version__ = "0.5.1"
+__version__ = "0.5.2"
 # Plugin version is independent of the scaffolder (ADR-010). Kept in sync with
 # plugins/project-init-workflow/.claude-plugin/plugin.json by a contract test;
 # a constant here because plugins/ is not packaged into the installed wheel.

{project_init-0.5.1 → project_init-0.5.2}/templates/lifecycle/dot_claude/hooks/dag_workflow.py

@@ -297,6 +297,37 @@ def _strip_heredocs(cmd: str) -> str:
     return _HEREDOC_RE.sub("", cmd)
 
 
+# Free-text flag values carry arbitrary prose (commit messages, issue/PR comment
+# and release bodies, titles) that must not be scanned for command patterns — a
+# `--body` mentioning the literal "git push main" is data, not an invocation.
+_TEXT_FLAG_RE = re.compile(
+    r"""(?P<flag>--body|--message|--title|--notes|-b|-m|-t)   # known free-text flags
+        (?:=|\s+)                                             # = or whitespace separator
+        (?P<q>['"])                                           # opening quote
+        (?P<val>(?:\\.|(?!(?P=q)).)*)                         # value (escapes allowed)
+        (?P=q)                                                # matching closing quote
+    """,
+    re.VERBOSE | re.DOTALL,
+)
+
+
+def _strip_text_flag_values(cmd: str) -> str:
+    """Blank the quoted value of known free-text flags so prose can't trip the
+    pattern rules. Values containing a command substitution (``$(`` or a
+    backtick) are left intact — those ARE executed, so the rules must still see
+    them. Flag values are otherwise inert data: masking loses no real
+    enforcement (an actual ``git push origin main`` uses a positional ref, not a
+    flag value, and stays blocked)."""
+
+    def _blank(m: re.Match[str]) -> str:
+        val = m.group("val")
+        if "$(" in val or "`" in val:
+            return m.group(0)
+        return f'{m.group("flag")} ""'
+
+    return _TEXT_FLAG_RE.sub(_blank, cmd)
+
+
 def _redirect_target_exists(reason: str) -> bool:
     """Best-effort: scan the redirect message for a `.claude/scripts/<name>`
     reference and check whether the file exists. If no reference is found,
@@ -325,9 +356,10 @@ def guard(payload: dict) -> dict | None:
     if not cmd:
         return None
 
-    # Strip heredoc bodies so pattern rules don't fire on body content
-    # (e.g. `gh issue create --body "$(cat <<'EOF'\n...git push...\nEOF\n)"`)
-    cmd_scan = _strip_heredocs(cmd)
+    # Strip heredoc bodies and free-text flag values so pattern rules don't fire
+    # on prose content (e.g. `gh issue create --body "$(cat <<'EOF'\n...git
+    # push...\nEOF\n)"`, or `gh pr comment --body "...git push main..."`).
+    cmd_scan = _strip_text_flag_values(_strip_heredocs(cmd))
 
     for pattern, target, message in COMMAND_RULES:
         if not pattern.search(cmd_scan):

{project_init-0.5.1 → project_init-0.5.2}/tests/contracts/test_lifecycle_byte_identity.py

@@ -28,6 +28,12 @@ Exception (PI-526): the concern-decoupled skills `save_memory`, `status`, and
 `session_summary` gained deterministic presence-checks in their bodies — a
 deliberate fix, not move-drift. Only those three SKILL.md hashes were re-pinned
 (no_plugin combos), after verifying every other file still matched.
+
+Exception (PI-550): `dag_workflow.py` gained `_strip_text_flag_values` so the
+command-guard no longer false-positives on blocked-command phrases inside
+free-text flag values (`--body`/`-m`/`--title`/`--notes`). A deliberate guard
+fix, not move-drift. Only the `.claude/hooks/dag_workflow.py` hash was re-pinned
+across all four combos, after verifying every other file still matched.
 """
 
 from __future__ import annotations

{project_init-0.5.1 → project_init-0.5.2}/tests/contracts/test_memory_byte_identity.py

@@ -34,6 +34,12 @@ Exception (PI-526): the concern-decoupled skills `save_memory`, `status`, and
 write to `.claude/memory/` or `.claude/vault/` when that concern was declined) —
 a deliberate fix, not move-drift. Only those three SKILL.md hashes were re-pinned
 (no_plugin combos), after verifying every other file still matched.
+
+Exception (PI-550): `dag_workflow.py` gained `_strip_text_flag_values` so the
+command-guard no longer false-positives on blocked-command phrases inside
+free-text flag values. A deliberate guard fix, not move-drift. Only the
+`.claude/hooks/dag_workflow.py` hash was re-pinned across all four combos, after
+verifying every other file still matched.
 """
 
 from __future__ import annotations

{project_init-0.5.1/tests/fixtures/memory_baseline → project_init-0.5.2/tests/fixtures/lifecycle_baseline}/obsidian-graphify__no_plugin.json

@@ -19,7 +19,7 @@
   ".claude/hooks/README.md": "9a6533d1f8ad8cc667683ba58bbda5e524c230931f65c77cb2d477c72c080061",
   ".claude/hooks/_py.sh": "41c28f08f42df48131b052aa6a74f0b49b2baa17624e4c17e2f6ca4c289ad100",
   ".claude/hooks/_usage_log.sh": "9684c3821fd3ac2cbac334a3f2ccb6de6c5792062b1bc30702001c02d19da5de",
-  ".claude/hooks/dag_workflow.py": "b143f12e5f94ecd7b78ed7c9b0e99e5db16b541c1e7edf0870ac86ea38fa863d",
+  ".claude/hooks/dag_workflow.py": "04d34eebb7ae9184ffe40cf0dfe04bfa75b8df10add87853229ff0f596191357",
   ".claude/hooks/github_command_guard.sh": "14bcf3da720916a0fdaec22febb33401c60d79717cc0035880c7c84b2cd428f1",
   ".claude/hooks/post_edit_lint.sh": "6bccb22869a6630e0b8fe739a509a5277ce6fad249093e622f1a9466b7687789",
   ".claude/hooks/pre_commit_gate.sh": "060072ea89a9c8fbd6feea761e58af330b84e24a302a815faa2facdd10e7b0b8",

{project_init-0.5.1/tests/fixtures/memory_baseline → project_init-0.5.2/tests/fixtures/lifecycle_baseline}/obsidian-graphify__plugin.json

@@ -18,7 +18,7 @@
   ".claude/docs/guides/using-memory.md": "433598cd17ee0a7d98f2987100cae5426947ee8edb8e0b2dfa7c7786a7b94e1e",
   ".claude/hooks/README.md": "9a6533d1f8ad8cc667683ba58bbda5e524c230931f65c77cb2d477c72c080061",
   ".claude/hooks/_py.sh": "41c28f08f42df48131b052aa6a74f0b49b2baa17624e4c17e2f6ca4c289ad100",
-  ".claude/hooks/dag_workflow.py": "b143f12e5f94ecd7b78ed7c9b0e99e5db16b541c1e7edf0870ac86ea38fa863d",
+  ".claude/hooks/dag_workflow.py": "04d34eebb7ae9184ffe40cf0dfe04bfa75b8df10add87853229ff0f596191357",
   ".claude/hooks/prod_guard.py": "b801d9f46b0b91f3af75e3b8b55fae869561e1f4f1bb161ef8c9812d2516ef9f",
   ".claude/memory/MEMORY.md": "544dac81979cbe795cc55a020360c2569036381b62f879d10ce8dffdc0de0791",
   ".claude/memory/README.md": "ff7e14d842d875f537d7d3a6cbe18df47e754088949804f94f348e300bbcbc5e",

{project_init-0.5.1 → project_init-0.5.2}/tests/fixtures/lifecycle_baseline/obsidian-only__no_plugin.json

@@ -18,7 +18,7 @@
   ".claude/hooks/README.md": "9a6533d1f8ad8cc667683ba58bbda5e524c230931f65c77cb2d477c72c080061",
   ".claude/hooks/_py.sh": "41c28f08f42df48131b052aa6a74f0b49b2baa17624e4c17e2f6ca4c289ad100",
   ".claude/hooks/_usage_log.sh": "9684c3821fd3ac2cbac334a3f2ccb6de6c5792062b1bc30702001c02d19da5de",
-  ".claude/hooks/dag_workflow.py": "b143f12e5f94ecd7b78ed7c9b0e99e5db16b541c1e7edf0870ac86ea38fa863d",
+  ".claude/hooks/dag_workflow.py": "04d34eebb7ae9184ffe40cf0dfe04bfa75b8df10add87853229ff0f596191357",
   ".claude/hooks/github_command_guard.sh": "14bcf3da720916a0fdaec22febb33401c60d79717cc0035880c7c84b2cd428f1",
   ".claude/hooks/post_edit_lint.sh": "6bccb22869a6630e0b8fe739a509a5277ce6fad249093e622f1a9466b7687789",
   ".claude/hooks/pre_commit_gate.sh": "060072ea89a9c8fbd6feea761e58af330b84e24a302a815faa2facdd10e7b0b8",

{project_init-0.5.1/tests/fixtures/memory_baseline → project_init-0.5.2/tests/fixtures/lifecycle_baseline}/obsidian-only__plugin.json

@@ -17,7 +17,7 @@
   ".claude/docs/guides/using-memory.md": "433598cd17ee0a7d98f2987100cae5426947ee8edb8e0b2dfa7c7786a7b94e1e",
   ".claude/hooks/README.md": "9a6533d1f8ad8cc667683ba58bbda5e524c230931f65c77cb2d477c72c080061",
   ".claude/hooks/_py.sh": "41c28f08f42df48131b052aa6a74f0b49b2baa17624e4c17e2f6ca4c289ad100",
-  ".claude/hooks/dag_workflow.py": "b143f12e5f94ecd7b78ed7c9b0e99e5db16b541c1e7edf0870ac86ea38fa863d",
+  ".claude/hooks/dag_workflow.py": "04d34eebb7ae9184ffe40cf0dfe04bfa75b8df10add87853229ff0f596191357",
   ".claude/hooks/prod_guard.py": "b801d9f46b0b91f3af75e3b8b55fae869561e1f4f1bb161ef8c9812d2516ef9f",
   ".claude/memory/MEMORY.md": "544dac81979cbe795cc55a020360c2569036381b62f879d10ce8dffdc0de0791",
   ".claude/memory/README.md": "ff7e14d842d875f537d7d3a6cbe18df47e754088949804f94f348e300bbcbc5e",

{project_init-0.5.1/tests/fixtures/lifecycle_baseline → project_init-0.5.2/tests/fixtures/memory_baseline}/obsidian-graphify__no_plugin.json

@@ -19,7 +19,7 @@
   ".claude/hooks/README.md": "9a6533d1f8ad8cc667683ba58bbda5e524c230931f65c77cb2d477c72c080061",
   ".claude/hooks/_py.sh": "41c28f08f42df48131b052aa6a74f0b49b2baa17624e4c17e2f6ca4c289ad100",
   ".claude/hooks/_usage_log.sh": "9684c3821fd3ac2cbac334a3f2ccb6de6c5792062b1bc30702001c02d19da5de",
-  ".claude/hooks/dag_workflow.py": "b143f12e5f94ecd7b78ed7c9b0e99e5db16b541c1e7edf0870ac86ea38fa863d",
+  ".claude/hooks/dag_workflow.py": "04d34eebb7ae9184ffe40cf0dfe04bfa75b8df10add87853229ff0f596191357",
   ".claude/hooks/github_command_guard.sh": "14bcf3da720916a0fdaec22febb33401c60d79717cc0035880c7c84b2cd428f1",
   ".claude/hooks/post_edit_lint.sh": "6bccb22869a6630e0b8fe739a509a5277ce6fad249093e622f1a9466b7687789",
   ".claude/hooks/pre_commit_gate.sh": "060072ea89a9c8fbd6feea761e58af330b84e24a302a815faa2facdd10e7b0b8",

{project_init-0.5.1/tests/fixtures/lifecycle_baseline → project_init-0.5.2/tests/fixtures/memory_baseline}/obsidian-graphify__plugin.json

@@ -18,7 +18,7 @@
   ".claude/docs/guides/using-memory.md": "433598cd17ee0a7d98f2987100cae5426947ee8edb8e0b2dfa7c7786a7b94e1e",
   ".claude/hooks/README.md": "9a6533d1f8ad8cc667683ba58bbda5e524c230931f65c77cb2d477c72c080061",
   ".claude/hooks/_py.sh": "41c28f08f42df48131b052aa6a74f0b49b2baa17624e4c17e2f6ca4c289ad100",
-  ".claude/hooks/dag_workflow.py": "b143f12e5f94ecd7b78ed7c9b0e99e5db16b541c1e7edf0870ac86ea38fa863d",
+  ".claude/hooks/dag_workflow.py": "04d34eebb7ae9184ffe40cf0dfe04bfa75b8df10add87853229ff0f596191357",
   ".claude/hooks/prod_guard.py": "b801d9f46b0b91f3af75e3b8b55fae869561e1f4f1bb161ef8c9812d2516ef9f",
   ".claude/memory/MEMORY.md": "544dac81979cbe795cc55a020360c2569036381b62f879d10ce8dffdc0de0791",
   ".claude/memory/README.md": "ff7e14d842d875f537d7d3a6cbe18df47e754088949804f94f348e300bbcbc5e",

{project_init-0.5.1 → project_init-0.5.2}/tests/fixtures/memory_baseline/obsidian-only__no_plugin.json

@@ -18,7 +18,7 @@
   ".claude/hooks/README.md": "9a6533d1f8ad8cc667683ba58bbda5e524c230931f65c77cb2d477c72c080061",
   ".claude/hooks/_py.sh": "41c28f08f42df48131b052aa6a74f0b49b2baa17624e4c17e2f6ca4c289ad100",
   ".claude/hooks/_usage_log.sh": "9684c3821fd3ac2cbac334a3f2ccb6de6c5792062b1bc30702001c02d19da5de",
-  ".claude/hooks/dag_workflow.py": "b143f12e5f94ecd7b78ed7c9b0e99e5db16b541c1e7edf0870ac86ea38fa863d",
+  ".claude/hooks/dag_workflow.py": "04d34eebb7ae9184ffe40cf0dfe04bfa75b8df10add87853229ff0f596191357",
   ".claude/hooks/github_command_guard.sh": "14bcf3da720916a0fdaec22febb33401c60d79717cc0035880c7c84b2cd428f1",
   ".claude/hooks/post_edit_lint.sh": "6bccb22869a6630e0b8fe739a509a5277ce6fad249093e622f1a9466b7687789",
   ".claude/hooks/pre_commit_gate.sh": "060072ea89a9c8fbd6feea761e58af330b84e24a302a815faa2facdd10e7b0b8",

{project_init-0.5.1/tests/fixtures/lifecycle_baseline → project_init-0.5.2/tests/fixtures/memory_baseline}/obsidian-only__plugin.json

@@ -17,7 +17,7 @@
   ".claude/docs/guides/using-memory.md": "433598cd17ee0a7d98f2987100cae5426947ee8edb8e0b2dfa7c7786a7b94e1e",
   ".claude/hooks/README.md": "9a6533d1f8ad8cc667683ba58bbda5e524c230931f65c77cb2d477c72c080061",
   ".claude/hooks/_py.sh": "41c28f08f42df48131b052aa6a74f0b49b2baa17624e4c17e2f6ca4c289ad100",
-  ".claude/hooks/dag_workflow.py": "b143f12e5f94ecd7b78ed7c9b0e99e5db16b541c1e7edf0870ac86ea38fa863d",
+  ".claude/hooks/dag_workflow.py": "04d34eebb7ae9184ffe40cf0dfe04bfa75b8df10add87853229ff0f596191357",
   ".claude/hooks/prod_guard.py": "b801d9f46b0b91f3af75e3b8b55fae869561e1f4f1bb161ef8c9812d2516ef9f",
   ".claude/memory/MEMORY.md": "544dac81979cbe795cc55a020360c2569036381b62f879d10ce8dffdc0de0791",
   ".claude/memory/README.md": "ff7e14d842d875f537d7d3a6cbe18df47e754088949804f94f348e300bbcbc5e",