fix(democracy): ignore heavy commands inside quotes and heredocs in the block hook

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

skills/democracy/scripts/watch.py

@@ -208,9 +208,17 @@ def cmd_watch(cfg: dict) -> int:
     return 0
 
 
+HEREDOC = re.compile(r"<<-?\s*(['\"]?)(\w+)\1[^\n]*\n.*?\n\s*\2(?=\s|\)|$)", re.DOTALL)
+QUOTED = re.compile(r"'[^']*'|\"(?:\\.|[^\"\\])*\"")
+
+
+def executable_text(command: str) -> str:
+    return QUOTED.sub("''", HEREDOC.sub("", command))
+
+
 def cmd_block(cfg: dict) -> int:
     payload = json.load(sys.stdin)
-    command = (payload.get("tool_input") or {}).get("command", "")
+    command = executable_text((payload.get("tool_input") or {}).get("command", ""))
     stage = read_json(STATE).get("stage", "ok")
     if stage not in ("stop", "critical"):
         return 0

tests/test_watch.py

@@ -105,6 +105,24 @@ class TestWatchCommands(unittest.TestCase):
         self._stage("warn")
         self.assertEqual(self._run("block", stdin=self._bash("make compose-deploy")).returncode, 0)
 
+    def test_block_ignores_heavy_words_inside_quotes_and_heredocs(self):
+        self.cfg["heavy_commands"] = [r"\bmake\s+(-C\s+\S+\s+)?(compose-deploy|test|swarm-\S+)(\s|$)"]
+        self._write_config()
+        self._stage("stop")
+        message = "$(cat <<'EOF'\nfix: run \"make test\" and make swarm-zombie\nEOF\n)"
+        for command in (
+            'git commit --no-verify -m "fix: passes the vars to make swarm-zombie app=x"',
+            "grep -n 'make test' Makefile",
+            f'git commit --no-verify -m "{message}"',
+        ):
+            self.assertEqual(self._run("block", stdin=self._bash(command)).returncode, 0, command)
+        for command in (
+            "make -C x swarm-zombie app=y",
+            "env FOO=1 make swarm-zombie",
+            'make compose-deploy apps="web-app-x"',
+        ):
+            self.assertEqual(self._run("block", stdin=self._bash(command)).returncode, 2, command)
+
     def test_admit_keeps_the_stop_floor(self):
         self.cfg["thresholds_gb"] = {"warn": 0, "stop": 0, "critical": 0}
         self._write_config()