@r1z4x/tezgah 1.0.0

package/hooks/projects-posttooluse.py

@@ -0,0 +1,149 @@
+#!/usr/bin/env python3
+"""Claude Code / dsh PostToolUse / PostToolUseFailure hook: record evidence, and
+hand the model the provenance of the result it just read.
+
+The Stop hook decides whether a "done/tested" turn is allowed to end by looking
+at what actually ran, and that record has to be written here, from the tool
+result, not from the reply. Inert outside a tezgah root.
+
+The result is also where the untrusted-content control reaches the model.
+`hookSpecificOutput.additionalContext` is read with the tool result - Claude Code
+adds it as a system reminder alongside the result, and the dsh claude-code bridge
+prepends the same string to the downstream contexts - so a fetched page or an MCP
+answer is labelled in place, and an effect made in a turn that has already read
+one is marked as such. dsh gets both halves through this file: it runs the same
+script from hosts/dsh/hooks.json, and its bridge delivers PostToolUse context.
+"""
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.realpath(__file__)))
+from tezgah_guard import import_failed, safe  # noqa: E402
+try:
+    from tezgah_context import (GRAPH_TOOL_MARK, record, shell_kind,  # noqa: E402
+                                skill_read_kind)
+    from tezgah_integrity import (  # noqa: E402
+        SUBAGENT_CHANNEL, note_tool, ran_nothing, report_bytes, untrusted_source)
+    from tezgah_paths import root_for  # noqa: E402
+    from tezgah_untrusted import marks  # noqa: E402
+except Exception as exc:
+    import_failed(exc)
+
+# The tool-use kinds this hook can see, for the status line's used marks. Claude
+# reads them from its transcript and ignores this store, but dsh runs this same
+# file with no transcript of its own - the store is the only channel its Web
+# status line has, so without this its consult/graph marks could never light.
+# A Claude Skill call is recorded too: the skill-fitness report reads it back.
+
+
+def used_kind(tool, inp):
+    """The used-tool kind one PostToolUse call earns, or None."""
+    if GRAPH_TOOL_MARK in str(tool).lower():
+        return "graph"
+    skill = skill_read_kind(tool, inp)
+    if skill:
+        return skill
+    return shell_kind(inp.get("command") or inp.get("cmd") or "")
+
+
+def result_size(result):
+    """The size of the tool result the host reported, or None when it carries
+    none.
+
+    Only a size is kept: the ledger records that a call returned something,
+    never what it returned. The reader asks one question - is this non-zero -
+    so a container is measured by its top-level length (O(1) for str, bytes,
+    list, dict, set) instead of re-serializing it: `json.dumps` on every
+    PostToolUse copied the whole tool response and broke the hook's cost bound
+    ("a sha1 over a short string and a few fields; nothing else"). ponytail: a
+    dict result therefore reports its field count, not its byte length - the
+    host reports no size of its own, and no reader compares the two."""
+    if result is None:
+        return None
+    if isinstance(result, (str, bytes, bytearray, list, tuple, dict, set,
+                           frozenset)):
+        return len(result)
+    return 1
+
+
+def main():
+    try:
+        p = json.load(sys.stdin)
+    except Exception:
+        return
+    if not isinstance(p, dict):
+        return
+    cwd = p.get("cwd") or os.getcwd()
+    if not root_for(cwd):
+        return
+    event = p.get("hook_event_name") or "PostToolUse"
+    tool = p.get("tool_name", "")
+    inp = p.get("tool_input") or {}
+    session_id = p.get("session_id")
+    result = p.get("tool_response", p.get("tool_result"))
+    # Claude sets `agent_id` only on a call a subagent made (its hook reference,
+    # common input fields). The row carries it, and the taint reader keys on it,
+    # so one sibling's web read does not mark another sibling's effects.
+    agent = p.get("agent_id") if isinstance(p.get("agent_id"), str) else None
+    # A failure has no result and made no effect, and both lines assert one
+    # ("this result came from ..."), so only PostToolUse shows them. The channel
+    # is a property of the call either way, so the row keeps it on both events.
+    # Read before this call's row lands: `source` on the row is the taint's own
+    # mark, and `marks` answers about the turn the call arrived in.
+    if event == "PostToolUse":
+        # a crash in `marks` costs both halves of the provenance rather than the
+        # envelope: no source on the row, no notice to the model
+        source, notice = safe(session_id, marks, tool, inp, session_id,
+                              result, agent) or (None, None)
+    else:
+        source, notice = untrusted_source(tool, inp), None
+    safe(session_id, record, session_id, used_kind(tool, inp))
+    # Whether a successful PostToolUse means the call itself succeeded. Claude
+    # splits a call's outcome across two events, so the event name carries it;
+    # the dsh bridge collapses both into this one and its payload has no outcome
+    # field (dsh's ToolExecutionResult is a success|failure union the bridge drops
+    # on the floor), so the dsh manifest declares `none` in the environment and
+    # every check there is recorded as one that RAN. A host whose failure is
+    # written as a pass arms the Stop rule with the lie the ledger exists to
+    # catch, so the declaration is the manifest's, not a guess from the shape of
+    # a payload two hosts happen to share.
+    if os.environ.get("TEZGAH_CALL_OUTCOME") == "none":
+        failed = None
+    else:
+        failed = event == "PostToolUseFailure"
+    # A call the host stopped is not one the tool answered, and this host says so
+    # twice: `is_interrupt` ("true when the failure reached Claude Code as an
+    # abort rather than as an error the tool reported") on the failure event, and
+    # `interrupted` inside a Bash result. Read from the payload and never inferred
+    # from `failed` - recorded as a failure, a user's cancel armed the Stop rule's
+    # partial-failure branch and the corpus error rate for a check nobody saw
+    # fail. `is True` rather than truthiness: a host that sends the string "false"
+    # would otherwise turn a real failure into an interruption, which loses
+    # evidence, and the safer miss is the other direction.
+    interrupted = (p.get("is_interrupt") is True
+                   or (isinstance(result, dict)
+                       and result.get("interrupted") is True))
+    safe(session_id, note_tool, session_id, tool, inp,
+         failed=failed,
+         interrupted=interrupted,
+         # the report's byte rule is the delegate call's own: an effect that
+         # only inherits the subagent channel keeps its top-level measure
+         out_bytes=(report_bytes(result)
+                    if untrusted_source(tool, inp) == SUBAGENT_CHANNEL
+                    else result_size(result)),
+         error=p.get("error"),
+         cwd=cwd,
+         source=source,
+         # the Bash result's own stdout/stderr, read on a bounded tail for the
+         # empty-run contract (tezgah_integrity.EMPTY_RUN)
+         empty_run=ran_nothing(result),
+         agent=agent)
+    if notice:
+        json.dump({"hookSpecificOutput": {
+            "hookEventName": event,
+            "additionalContext": notice,
+        }}, sys.stdout)
+
+
+main()

package/hooks/projects-pretooluse.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python3
+"""Claude Code PreToolUse hook (matcher Agent|Task|Grep|Bash), inert outside roots.
+
+Claude's envelope around the shared gate (hooks/tezgah_gate.py): refuse the
+grep-only explorer subagent, and nudge the first identifier-shaped search of a
+session toward the code graph. Later searches pass.
+"""
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.realpath(__file__)))
+from tezgah_guard import import_failed, safe  # noqa: E402
+try:
+    from tezgah_gate import decision  # noqa: E402
+except Exception as exc:
+    import_failed(exc)
+
+
+def main():
+    try:
+        p = json.load(sys.stdin)
+    except Exception:
+        return
+    cwd = os.path.realpath(p.get("cwd") or os.getcwd())
+    tool = p.get("tool_name", "")
+    inp = p.get("tool_input") or {}
+    # `agent_id` is set only when the call comes from a subagent (Claude's hook
+    # reference, common input fields): the repeat ceilings key on it
+    reason = safe(p.get("session_id"), decision, tool, inp, cwd,
+                  p.get("session_id"), agent=p.get("agent_id"))
+    if reason:
+        json.dump({"hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "deny",
+            "permissionDecisionReason": reason,
+        }}, sys.stdout)
+
+
+main()

package/hooks/projects-stop.py

@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""Claude Code Stop / SubagentStop hook: refuse to end a turn on a false claim.
+
+Blocks (decision: "block") when the final message opens by placating, or claims
+done/tested/passing in a session whose newest turn changed code and left a check
+failing or unproven by a later pass. An explicit "doğrulanmadı" always clears
+it, so honest uncertainty is never punished. With `stop_hook_active` set - the
+reply after a block - the reply is judged in record-only mode (an `after_block`
+row) and never blocked again, and Claude Code overrides the hook after its own
+consecutive-block cap, so this can never trap a session. A subagent's end
+(SubagentStop) is judged record-only too: one `subagent_end` row, never a
+block (ADR 011). Inert outside a tezgah root or under the `verify-off` kill
+switch.
+"""
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.realpath(__file__)))
+from tezgah_guard import import_failed, safe  # noqa: E402
+try:
+    from tezgah_integrity import bind_session, stop_reason  # noqa: E402
+    from tezgah_paths import off, root_for  # noqa: E402
+except Exception as exc:
+    import_failed(exc)
+
+# How many times one stop chain may be refused: the one-nudge semantics is
+# deliberate, and raising it is owner decision 11. Claude says only whether a
+# block came before (`stop_hook_active`), so a chain has blocked 0 or 1 times.
+STOP_REASKS = 1
+
+
+def main():
+    try:
+        p = json.load(sys.stdin)
+    except Exception:
+        return
+    if not isinstance(p, dict):
+        return
+    session_id = p.get("session_id")
+    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    if off("verify-off"):
+        return
+    cwd = p.get("cwd") or os.getcwd()
+    if not root_for(cwd):
+        return
+    if p.get("hook_event_name") == "SubagentStop":
+        safe(session_id, stop_reason, p.get("last_assistant_message"),
+             session_id, cwd=cwd, subagent=True, agent=p.get("agent_id"))
+        return
+    blocked = 1 if p.get("stop_hook_active") else 0
+    # a core that cannot answer has refused nothing, so the turn ends: the rule
+    # never traps a session, and that holds for its own failure too
+    reason = safe(session_id, stop_reason, p.get("last_assistant_message"),
+                  session_id, cwd=cwd, record_only=blocked >= STOP_REASKS)
+    if reason:
+        json.dump({"decision": "block", "reason": reason}, sys.stdout)
+
+
+main()