fix: agent_persona hook silently drops hyphen-less skill names like docker

_SKILL_TOKEN_RE required at least one hyphen in every skill token
(quantifier was '+', one-or-more), so single-word skill names such as
'docker' and 'kubernetes' -- both real, currently-shipping skills in
claude-global-library -- were silently dropped from the parsed
declared-skills list even when present verbatim in a persona block's
skills: field. This caused the PreToolUse hook to HARD BLOCK correct
Agent/Task dispatches with a misleading "missing: docker" message.

Fix: change the quantifier to '*' (zero-or-more) so a bare hyphen-less
word still matches. The regex is only ever applied to the already-
isolated skills: field value, so the broadened match carries no risk of
picking up unrelated words elsewhere in a dispatch prompt.

Added a regression test class (TestHyphenLessSkillNamesAreNotDropped)
covering token extraction and the full dispatch-allow/dispatch-block
paths for a hyphen-less mandatory skill, since none of the existing 38
tests exercised this case -- which is exactly how the bug shipped
unnoticed.

Fixes #314.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DZrJrDJYy6x6bJFvQrpuJi

Author: piyushmakhija28

hooks/pre_tool_enforcer/policies/agent_persona.py

@@ -36,10 +36,16 @@
 # ('skills:\n  - a\n  - b') forms used across real dispatch prompts.
 _SKILLS_FIELD_RE = re.compile(r"skills\s*:\s*(.*?)(?:\n[ \t]*[A-Za-z_][\w-]*\s*:|\Z)", re.DOTALL | re.IGNORECASE)
 
-# A skill slug: lowercase, at least one hyphen (every real skill in this
-# library is named like 'ai-agents-core' / 'system-design') -- this avoids
-# matching stray single words or YAML punctuation inside the skills: value.
-_SKILL_TOKEN_RE = re.compile(r"[a-z][a-z0-9]*(?:-[a-z0-9]+)+")
+# A skill slug: lowercase, hyphen-separated words with zero or more hyphens.
+# Most real skills in this library are named like 'ai-agents-core' /
+# 'system-design', but a few genuinely have no hyphen at all (e.g. 'docker',
+# 'kubernetes') -- the quantifier below must be zero-or-more ('*'), not
+# one-or-more ('+'), or those skills are silently dropped from the parsed
+# declared-skills list even when present verbatim in the skills: field. This
+# regex is only ever applied to the already-isolated skills: field capture
+# (via _SKILLS_FIELD_RE), so broadening it does not risk matching stray
+# words elsewhere in a dispatch prompt.
+_SKILL_TOKEN_RE = re.compile(r"[a-z][a-z0-9]*(?:-[a-z0-9]+)*")
 
 # 'agent: <name>' line inside the persona block.
 _AGENT_NAME_RE = re.compile(r"^\s*agent\s*:\s*([a-z0-9][a-z0-9\-]*)\s*$", re.IGNORECASE | re.MULTILINE)

tests/test_agent_persona_policy.py

@@ -295,9 +295,57 @@ def test_escape_hatch_still_bypasses_hollow_persona_check(self):
         "mandatory_skills": ["iam-security-core", "zero-trust-architecture-core"],
         "cross_domain_mandatory_skills": ["authentication-core"],
     },
+    {
+        "name": "python-backend-engineer",
+        # 'docker' has zero hyphens -- this is the exact real-library shape
+        # that regressed _SKILL_TOKEN_RE (issue: single-word skill names were
+        # silently dropped from the parsed declared-skills list).
+        "mandatory_skills": ["fastapi-core", "docker", "rdbms-core"],
+    },
 ]
 
 
+class TestHyphenLessSkillNamesAreNotDropped:
+    """Regression coverage for a real bug: _SKILL_TOKEN_RE required at least
+    one hyphen in every skill token, so single-word skill names like
+    'docker' or 'kubernetes' -- both real, currently-shipping skills in
+    claude-global-library -- were silently dropped from the parsed
+    declared-skills list even when present verbatim in the persona block's
+    skills: field, causing a false INCOMPLETE_SKILLS block. See the fixed
+    _SKILL_TOKEN_RE quantifier ('*' not '+') above.
+    """
+
+    def test_extract_declared_skills_includes_hyphen_less_token(self):
+        block_text = "\nagent: python-backend-engineer\nskills: [fastapi-core, docker, rdbms-core]\n"
+        declared = agent_persona._extract_declared_skills(block_text)
+        assert "docker" in declared, "hyphen-less skill token 'docker' must not be dropped"
+        assert declared == ["fastapi-core", "docker", "rdbms-core"]
+
+    def test_extract_declared_skills_includes_kubernetes(self):
+        block_text = "\nskills: [nosql-core, kubernetes, redis-core]\n"
+        declared = agent_persona._extract_declared_skills(block_text)
+        assert "kubernetes" in declared
+
+    def test_allows_dispatch_when_hyphen_less_mandatory_skill_is_declared(self, monkeypatch):
+        monkeypatch.setattr(agent_persona, "_resolve_agents_registry", lambda prompt: _FAKE_REGISTRY)
+        prompt = _compliant_prompt_for("python-backend-engineer", ["fastapi-core", "docker", "rdbms-core"])
+        blocked, msg = agent_persona.check_agent_persona(
+            "Agent", {"subagent_type": "general-purpose", "prompt": prompt}
+        )
+        assert blocked is False, "correctly-declared hyphen-less mandatory skill must not block dispatch: " + msg
+        assert msg == ""
+
+    def test_still_blocks_when_hyphen_less_mandatory_skill_is_genuinely_missing(self, monkeypatch):
+        monkeypatch.setattr(agent_persona, "_resolve_agents_registry", lambda prompt: _FAKE_REGISTRY)
+        # 'docker' genuinely omitted this time -- must still correctly block.
+        prompt = _compliant_prompt_for("python-backend-engineer", ["fastapi-core", "rdbms-core"])
+        blocked, msg = agent_persona.check_agent_persona(
+            "Agent", {"subagent_type": "general-purpose", "prompt": prompt}
+        )
+        assert blocked is True
+        assert "docker" in msg
+
+
 def _compliant_prompt_for(agent_name, skills):
     skills_yaml = ", ".join(skills)
     reads = "\n".join("- skills/{0}/SKILL.md".format(s) for s in skills)