chore(hooks): match guarded verbs in command position, not only at line start

Every blocking gate decided "is this the command I guard?" with a
LINE-START-anchored regex tolerating exactly one chained shape, an
optional leading `cd <path> &&`. So `git push` chained into a PR create
-- the natural way to push a branch and open its PR in one step -- did
not match and the gate never fired. Not hypothetical: that is how PR
1451's own PR-create slipped past verify-pr-gate.

The hole was in all six merge-time gates too, which is strictly worse:
those stand between an unverified destroy path and main. Chaining a
merge after any other command skipped integ-destroy, integ-broad,
integ-local, integ-schema-migration, pr-review and ci-green at once.

The anchoring was deliberate, not an oversight -- it kept a mention of
the verb inside a quoted argument from false-positiving into a hard
block. So this does not simply drop the anchor. It separates the two
concerns: strip the DATA spans (heredoc bodies, then quoted spans),
removing the false-positive source directly rather than dodging it by
position; then match the verb in command position -- line start OR
immediately after a `&&` / `||` / `;` / `|` operator.

Stripping heredoc bodies turned out to be required, not a refinement.
The first attempt at this commit was blocked by integ-broad-gate,
because the message describes the bug by naming the commands that
trigger it, and a heredoc body is not shell-quoted. Commit messages and
PR bodies routinely quote the commands they are about, so
prose-as-invocation is the common case rather than the exotic one.

A second, independent blind spot surfaced the same way: this commit
first landed as `fix(hooks):` with no src/** staged, which
commit-prefix-scope-gate exists to stop. It did not fire because it
parses `-F <path>` but not `-F -`, so a heredoc message resolved to a
nonexistent "<dir>/-", left the subject empty, and fell through. That
form is what commit-msg-heredoc-gate steers people toward, so it is the
common shape here. The gate now reads the subject out of the heredoc
body, and three cases pin it.

Fourteen matchers across thirteen hooks now share
.claude/hooks/lib/command-match.sh; restore-backup.sh uses the same
command-position prefix inline because it builds its regex from a
shared variable. The `cd <path> &&` special case disappears from the
patterns -- it is just a verb after an operator. Hooks needing the cd
TARGET still parse it from the raw command themselves.

Two existing smoke-test cases asserted the chained shape was an
"ACCEPTED FALSE-NEGATIVE" (branch-gate, pr-review-gate); both now
assert it is caught. verify-pr-gate gains five command-position cases,
including one proving a quoted mention after a chain operator still
passes -- the case where quote-stripping does the work, since position
alone no longer saves us. The shared matcher gets its own 22-case test
so a regression is reported once and precisely.

Verified: 32/32 hook smoke tests green (31 baseline + the new lib
test); reverting the helper to the line-start form fails 8 assertions.

Remaining non-goals, unchanged because the old anchor missed them too:
escaped quotes inside a quoted span, and an inner shell, which would
need real parsing.

Closes #1455

Author: go-to-k

.claude/hooks/branch-gate.sh

@@ -22,6 +22,12 @@
 #   3. The hook input's `cwd` field (the Bash tool's persisted cwd).
 #   4. The hook process's own $PWD (fallback, almost never reached).
 
+# Shared command-position matcher (issue #1455): catches the guarded verb
+# after ANY chained command (`git push && gh pr create`), not just after an
+# optional leading `cd`. See .claude/hooks/lib/command-match.sh.
+# shellcheck source=lib/command-match.sh
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/command-match.sh"
+
 set -u
 
 # Read the entire stdin payload once; we need both .tool_input.command
@@ -75,7 +81,7 @@ hook_cwd=$(printf '%s' "$input" | jq -r '.cwd // ""' 2>/dev/null || echo "")
 #                               forms are an accepted false-negative
 #                               of the line-start tightening (per the
 #                               memory rule's trade-off).
-if ! printf '%s' "$cmd" | grep -qE '^[[:space:]]*(cd[[:space:]]+[^[:space:]]+[[:space:]]*&&[[:space:]]*)?git([[:space:]]+(-[^[:space:]]+([[:space:]]+[^[:space:]-][^[:space:]]*)?))*[[:space:]]+(commit|push)([[:space:]]|$|[|;&`)])'; then
+if ! cmd_matches_verb "$cmd" 'git([[:space:]]+(-[^[:space:]]+([[:space:]]+[^[:space:]-][^[:space:]]*)?))*[[:space:]]+(commit|push)([[:space:]]|$|[|;&`)])'; then
   exit 0
 fi
 

.claude/hooks/branch-gate.test.sh

@@ -157,16 +157,18 @@ run_case "git -C <main> commit blocked" 2 \
 #     shape where the second `git` is NOT at line-start. With the
 #     line-start anchored matcher (per memory rule
 #     feedback_hook_command_match_line_start.md, issue #563), the
-#     matcher fires on the FIRST `git -C <feature> status` token
-#     (the line-start one), which is not a commit/push subcommand,
-#     so the hook short-circuits at the matcher (exit 0). This is
-#     an ACCEPTED FALSE-NEGATIVE of the line-start tightening — the
-#     trade-off we make to eliminate quoted-body false-positives
-#     (see Part C false-positive cases below). For the agent
-#     workflow this is fine: chained-on-one-line commits to main
-#     are rare; the dominant shape is `cd <repo> && git commit ...`,
-#     which IS line-start matched.
-run_case "single-line chained git -C status; git -C commit (accepted false-negative)" 0 \
+#     Formerly an ACCEPTED FALSE-NEGATIVE: the line-start matcher saw
+#     only the first `git -C <feature> status` token, which is not a
+#     commit/push subcommand, so the hook short-circuited (exit 0) and
+#     a commit to main chained after a `;` went through.
+#
+#     Issue #1455 closed that. The matcher now recognises the verb in
+#     COMMAND POSITION (line start OR after `&&` / `||` / `;` / `|`),
+#     so the second `git -C <main> commit` is seen and blocked. The
+#     quoted-body false-positives this anchoring originally existed to
+#     prevent are handled directly now, by stripping quoted spans
+#     before matching — see the Part C cases below, which still pass.
+run_case "single-line chained git -C status; git -C commit is now CAUGHT (#1455)" 2 \
   "$(printf '{"cwd":"%s","tool_input":{"command":"git -C %s status; git -C %s commit -m oops"}}' "$feature_repo" "$feature_repo" "$main_repo")"
 
 # 11b. `git -c <key>=<val> commit` — global `-c` flag before commit

.claude/hooks/bughunt-clean-gate.sh

@@ -18,6 +18,12 @@
 # so a fix committed from a feature worktree still sees a sentinel armed from
 # the main tree.
 
+# Shared command-position matcher (issue #1455): catches the guarded verb
+# after ANY chained command (`git push && gh pr create`), not just after an
+# optional leading `cd`. See .claude/hooks/lib/command-match.sh.
+# shellcheck source=lib/command-match.sh
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/command-match.sh"
+
 set -u
 
 input=$(cat 2>/dev/null || true)
@@ -28,11 +34,11 @@ hook_cwd=$(printf '%s' "$input" | jq -r '.cwd // ""' 2>/dev/null || echo "")
 # Gate only `git commit`, `gh pr create`, and `gh pr merge`. Line-start anchored
 # (tolerating an optional `cd <path> &&` prefix and `gh -C <path>`) so the
 # command words inside a quoted argument body do NOT false-positive.
-git_commit_re='^[[:space:]]*(cd[[:space:]]+[^[:space:]]+[[:space:]]*&&[[:space:]]*)?git([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+commit([[:space:]]|$)'
-gh_pr_re='^[[:space:]]*(cd[[:space:]]+[^[:space:]]+[[:space:]]*&&[[:space:]]*)?gh([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+pr[[:space:]]+(create|merge)([[:space:]]|$|[|;&`)])'
+git_commit_re='git([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+commit([[:space:]]|$)'
+gh_pr_re='gh([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+pr[[:space:]]+(create|merge)([[:space:]]|$|[|;&`)])'
 
-if ! printf '%s' "$cmd" | grep -qE "$git_commit_re" \
-  && ! printf '%s' "$cmd" | grep -qE "$gh_pr_re"; then
+if ! cmd_matches_verb "$cmd" "$git_commit_re" \
+  && ! cmd_matches_verb "$cmd" "$gh_pr_re"; then
   exit 0
 fi
 

.claude/hooks/check-gate.sh

@@ -20,6 +20,12 @@
 # branch-gate.sh / integ-local-gate.sh, so the markgate verify runs
 # against the worktree the commit will actually land in.
 
+# Shared command-position matcher (issue #1455): catches the guarded verb
+# after ANY chained command (`git push && gh pr create`), not just after an
+# optional leading `cd`. See .claude/hooks/lib/command-match.sh.
+# shellcheck source=lib/command-match.sh
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/command-match.sh"
+
 set -u
 
 # Read the entire stdin payload once; we need both .tool_input.command
@@ -47,7 +53,7 @@ hook_cwd=$(printf '%s' "$input" | jq -r '.cwd // ""' 2>/dev/null || echo "")
 # SUBCOMMAND POSITION — not as the prefix of `commit-tree` /
 # `commit-graph`. Single-line `git status && git commit` shapes are
 # an accepted false-negative (per the memory rule's trade-off).
-if ! printf '%s' "$cmd" | grep -qE '^[[:space:]]*(cd[[:space:]]+[^[:space:]]+[[:space:]]*&&[[:space:]]*)?git([[:space:]]+(-[^[:space:]]+([[:space:]]+[^[:space:]-][^[:space:]]*)?))*[[:space:]]+commit([[:space:]]|$|[|;&`)])'; then
+if ! cmd_matches_verb "$cmd" 'git([[:space:]]+(-[^[:space:]]+([[:space:]]+[^[:space:]-][^[:space:]]*)?))*[[:space:]]+commit([[:space:]]|$|[|;&`)])'; then
   exit 0
 fi
 

.claude/hooks/ci-green-gate.sh

@@ -29,6 +29,12 @@
 # outage should not block merges); a successful `gh pr checks` answer
 # is enforced strictly.
 
+# Shared command-position matcher (issue #1455): catches the guarded verb
+# after ANY chained command (`git push && gh pr create`), not just after an
+# optional leading `cd`. See .claude/hooks/lib/command-match.sh.
+# shellcheck source=lib/command-match.sh
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/command-match.sh"
+
 set -u
 
 input=$(cat 2>/dev/null || true)
@@ -38,7 +44,7 @@ hook_cwd=$(printf '%s' "$input" | jq -r '.cwd // ""' 2>/dev/null || echo "")
 # Only gate `gh pr merge`. Line-start anchored (memory rule
 # feedback_hook_command_match_line_start.md); tolerates an optional
 # leading `cd <path> &&` and `gh -C <path>` (mirrors pr-review-gate.sh).
-if ! printf '%s' "$cmd" | grep -qE '^[[:space:]]*(cd[[:space:]]+[^[:space:]]+[[:space:]]*&&[[:space:]]*)?(CDKD_SKIP_CI_GREEN_GATE=1[[:space:]]+)?gh([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+pr[[:space:]]+merge([[:space:]]|$|[|;&`)])'; then
+if ! cmd_matches_verb "$cmd" '(CDKD_SKIP_CI_GREEN_GATE=1[[:space:]]+)?gh([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+pr[[:space:]]+merge([[:space:]]|$|[|;&`)])'; then
   exit 0
 fi
 

.claude/hooks/commit-prefix-scope-gate.sh

@@ -134,7 +134,25 @@ if [[ -z "$subject" ]]; then
   elif [[ "$cmd" =~ [[:space:]]--file[[:space:]]+([^[:space:]\"\'\;\&\|]+) ]]; then
     msg_file="${BASH_REMATCH[1]}"
   fi
-  if [[ -n "$msg_file" ]]; then
+  if [[ "$msg_file" == "-" ]]; then
+    # `git commit -F -` reads the message from STDIN, which in practice is a
+    # heredoc whose body is part of this very command string — so the subject
+    # IS available at PreToolUse time, it just is not on disk.
+    #
+    # This was a silent blind spot: `-F -` matched the path parser, resolved
+    # to a nonexistent "<dir>/-", left $subject empty, and fell through to the
+    # pass-through below. It let a `fix(hooks):` commit touching only
+    # `.claude/**` through — exactly the mislabelled-release shape this gate
+    # exists to stop — and it did so on the commit that fixed issue #1455.
+    # The `-F -` heredoc form is also what `commit-msg-heredoc-gate.sh` steers
+    # people toward, so it is the COMMON shape here, not a rare one.
+    #
+    # Take the first non-empty line after the heredoc opener as the subject.
+    subject=$(printf '%s' "$cmd" | awk '
+      seen { if ($0 != "") { print; exit } next }
+      /<<-?[ \t]*("[^"]+"|\047[^\047]+\047|[A-Za-z_][A-Za-z0-9_]*)/ { seen = 1 }
+    ')
+  elif [[ -n "$msg_file" ]]; then
     # Resolve relative path against target_dir.
     if [[ "$msg_file" != /* ]]; then
       msg_file="$target_dir/$msg_file"

.claude/hooks/commit-prefix-scope-gate.test.sh

@@ -51,6 +51,13 @@ run_case() {
       echo "$subject" > "$msgfile"
       cmdstr=$(printf 'git -C %q commit -F %q' "$tmpdir" "$msgfile")
       ;;
+    Fdash)
+      # `git commit -F -` + heredoc: the message never touches disk, so the
+      # subject has to be read out of the command string itself. This shape
+      # used to fall through the path parser (resolving to a nonexistent
+      # "<dir>/-") and silently skip the whole gate.
+      cmdstr=$(printf "git -C %q commit -q -F - <<'MSGEOF'\n%s\n\nbody\nMSGEOF" "$tmpdir" "$subject")
+      ;;
     amend)
       cmdstr=$(printf 'git -C %q commit --amend -m "%s"' "$tmpdir" "$subject")
       ;;
@@ -198,6 +205,23 @@ run_case "feat!: breaking, no src/** BLOCKED" 2 \
 run_case "feat: via -F file, .claude/** only BLOCKED" 2 \
   "feat(review-pr): add bucket entry" ".claude/skills/review-pr/SKILL.md" "F"
 
+# --- BLOCK / PASS: via `-F -` heredoc shape (the #1455 blind spot) ---
+#
+# `-F -` matched the path parser, resolved to a nonexistent "<dir>/-", left
+# the subject empty and fell through to the pass-through. It let a
+# `fix(hooks):` commit touching only `.claude/**` land -- on the very commit
+# that fixed #1455. The heredoc form is what commit-msg-heredoc-gate.sh
+# steers people toward, so it is the common shape here, not a rare one.
+
+run_case "fix: via -F - heredoc, .claude/** only BLOCKED" 2 \
+  "fix(hooks): match verbs in command position" ".claude/hooks/verify-pr-gate.sh" "Fdash"
+
+run_case "chore: via -F - heredoc, .claude/** only passes" 0 \
+  "chore(hooks): match verbs in command position" ".claude/hooks/verify-pr-gate.sh" "Fdash"
+
+run_case "feat: via -F - heredoc with src/** passes" 0 \
+  "feat(cli): add flag" "src/cli/options.ts" "Fdash"
+
 # --- BLOCK: variant subject formats ---
 
 run_case "feat: with --message= form BLOCKED" 2 \

.claude/hooks/integ-broad-gate.sh

@@ -38,6 +38,12 @@
 # Set ONLY by /run-integ; never call `markgate set integ-broad` by hand
 # (same rule as the other AWS-coupled gates).
 
+# Shared command-position matcher (issue #1455): catches the guarded verb
+# after ANY chained command (`git push && gh pr create`), not just after an
+# optional leading `cd`. See .claude/hooks/lib/command-match.sh.
+# shellcheck source=lib/command-match.sh
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/command-match.sh"
+
 set -u
 
 # Read the PreToolUse payload (command + cwd).
@@ -55,7 +61,7 @@ hook_cwd=$(printf '%s' "$input" | jq -r '.cwd // ""' 2>/dev/null || echo "")
 # into a hard block. The optional leading `cd <path> &&` prefix
 # preserves the worktree-aware `cd <side> && gh pr merge` chain
 # shape, mirroring check-gate.sh (PR #562 fix pattern).
-if ! printf '%s' "$cmd" | grep -qE '^[[:space:]]*(cd[[:space:]]+[^[:space:]]+[[:space:]]*&&[[:space:]]*)?gh([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+pr[[:space:]]+merge([[:space:]]|$|[|;&`)])'; then
+if ! cmd_matches_verb "$cmd" 'gh([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+pr[[:space:]]+merge([[:space:]]|$|[|;&`)])'; then
   exit 0
 fi
 

.claude/hooks/integ-destroy-gate.sh

@@ -23,6 +23,12 @@
 # target working tree from the PreToolUse payload's `cwd` field +
 # leading `cd <path>` + last `gh -C <path>` flag.
 
+# Shared command-position matcher (issue #1455): catches the guarded verb
+# after ANY chained command (`git push && gh pr create`), not just after an
+# optional leading `cd`. See .claude/hooks/lib/command-match.sh.
+# shellcheck source=lib/command-match.sh
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/command-match.sh"
+
 set -u
 
 # Read the entire stdin payload once; we need both .tool_input.command
@@ -41,7 +47,7 @@ hook_cwd=$(printf '%s' "$input" | jq -r '.cwd // ""' 2>/dev/null || echo "")
 # into a hard block. The optional leading `cd <path> &&` prefix
 # preserves the worktree-aware `cd <side> && gh pr merge` chain
 # shape, mirroring check-gate.sh (PR #562 fix pattern).
-if ! printf '%s' "$cmd" | grep -qE '^[[:space:]]*(cd[[:space:]]+[^[:space:]]+[[:space:]]*&&[[:space:]]*)?gh([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+pr[[:space:]]+merge([[:space:]]|$|[|;&`)])'; then
+if ! cmd_matches_verb "$cmd" 'gh([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+pr[[:space:]]+merge([[:space:]]|$|[|;&`)])'; then
   exit 0
 fi
 

.claude/hooks/integ-local-gate.sh

@@ -41,6 +41,12 @@
 #   3. The hook input's `cwd` field.
 #   4. The hook process's own $PWD.
 
+# Shared command-position matcher (issue #1455): catches the guarded verb
+# after ANY chained command (`git push && gh pr create`), not just after an
+# optional leading `cd`. See .claude/hooks/lib/command-match.sh.
+# shellcheck source=lib/command-match.sh
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/command-match.sh"
+
 set -u
 
 # Read the entire stdin payload once; we need both .tool_input.command
@@ -66,7 +72,8 @@ hook_cwd=$(printf '%s' "$input" | jq -r '.cwd // ""' 2>/dev/null || echo "")
 # (PR #562 fix pattern). `[^|;&]*` matches flags / values between
 # `gh`/`git` and the subcommand without crossing pipeline separators.
 # Tolerate an optional `gh -C <path>` between `gh` and `pr`.
-if ! printf '%s' "$cmd" | grep -qE '^[[:space:]]*(cd[[:space:]]+[^[:space:]]+[[:space:]]*&&[[:space:]]*)?gh([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+pr[[:space:]]+merge([[:space:]]|$|[|;&`)])|^[[:space:]]*(cd[[:space:]]+[^[:space:]]+[[:space:]]*&&[[:space:]]*)?git[^|;&]*[[:space:]]merge([[:space:]]|$|[|;&`)])'; then
+if ! { cmd_matches_verb "$cmd" 'gh([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+pr[[:space:]]+merge([[:space:]]|$|[|;&`)])' \
+     || cmd_matches_verb "$cmd" 'git[^|;&]*[[:space:]]merge([[:space:]]|$|[|;&`)])'; }; then
   exit 0
 fi
 
@@ -199,7 +206,7 @@ fi
 # `gh pr merge <N>` path above. Bail conservatively (fall through to
 # the unconditional verify) on `--abort` / `--continue` / `--quit`,
 # octopus (2+ refs), a ref we cannot resolve, or an unparsable shape.
-if printf '%s' "$cmd" | grep -qE '^[[:space:]]*(cd[[:space:]]+[^[:space:]]+[[:space:]]*&&[[:space:]]*)?git[^|;&]*[[:space:]]merge([[:space:]]|$|[|;&`)])' \
+if cmd_matches_verb "$cmd" 'git[^|;&]*[[:space:]]merge([[:space:]]|$|[|;&`)])' \
   && ! printf '%s' "$cmd" | grep -qE 'gh([[:space:]]+-C[[:space:]]+[^[:space:]]+)?[[:space:]]+pr[[:space:]]+merge'; then
   merge_ref=""
   parse_ok=1