claude-dev-env 1.89.0 → 1.92.0

package/hooks/blocking/code_verifier_spawn_preflight_gate.py

@@ -43,9 +43,11 @@ from verification_verdict_store import (  # noqa: E402
 )
 
 from hooks_constants.code_verifier_spawn_preflight_gate_constants import (  # noqa: E402
+    ALL_MERGE_HEAD_PROBE_FLAGS,
     ALL_MERGE_TREE_COMMAND_FLAGS,
     ALL_NAME_ONLY_WORKTREE_DIFF_FLAGS,
     ALL_UNIFIED_ZERO_DIFF_FLAGS,
+    ALL_UNMERGED_PATHS_DIFF_FLAGS,
     CODE_RULES_SECTION_HEADER,
     CODE_VERIFIER_SUBAGENT_TYPE,
     DENY_REASON_LEAD,
@@ -145,9 +147,49 @@ def _run_trial_merge(repo_root: str, base_ref: str) -> tuple[int, str] | None:
     return completed_process.returncode, completed_process.stdout
 
 
+def _merge_in_progress(repo_root: str) -> bool:
+    """Decide whether an unfinished merge is recorded in the work tree.
+
+    Args:
+        repo_root: The repository top-level directory.
+
+    Returns:
+        True when ``MERGE_HEAD`` resolves — a merge is started but not yet
+        committed; False when no merge is in progress or git fails.
+    """
+    return run_git(repo_root, *ALL_MERGE_HEAD_PROBE_FLAGS) is not None
+
+
+def _staged_merge_conflicts(repo_root: str) -> list[str] | None:
+    """Return the unmerged paths of an in-progress merge from the index.
+
+    A merge whose conflicts are fully resolved and staged leaves zero unmerged
+    index entries, so the resolved state is committable and this returns an
+    empty list. A merge with conflicts still open returns those paths, so the
+    caller keeps denying until the resolution is staged.
+
+    Args:
+        repo_root: The repository top-level directory.
+
+    Returns:
+        The still-unmerged paths (empty when the resolution is fully staged),
+        or None when git fails — the caller fails OPEN on None.
+    """
+    unmerged_text = run_git(repo_root, *ALL_UNMERGED_PATHS_DIFF_FLAGS)
+    if unmerged_text is None:
+        return None
+    return [each_line for each_line in unmerged_text.splitlines() if each_line]
+
+
 def _conflicting_files(repo_root: str, base_ref: str) -> list[str] | None:
     """Return the files that conflict when HEAD trial-merges against the base.
 
+    While a merge is in progress the branch tip has not yet recorded the
+    resolution, so the trial-merge of the base against HEAD would re-report
+    conflicts the staged index already fixed. In that state the index is the
+    authority: an empty unmerged set is a committable resolution, and any
+    remaining unmerged path is a live conflict.
+
     Args:
         repo_root: The repository top-level directory.
         base_ref: The base ref to trial-merge HEAD against.
@@ -158,6 +200,8 @@ def _conflicting_files(repo_root: str, base_ref: str) -> list[str] | None:
         timeout, or an exit code that is neither clean nor conflict) — the
         caller fails OPEN on None.
     """
+    if _merge_in_progress(repo_root):
+        return _staged_merge_conflicts(repo_root)
     merge_outcome = _run_trial_merge(repo_root, base_ref)
     if merge_outcome is None:
         return None

package/hooks/blocking/config/verified_commit_constants.py

@@ -86,6 +86,8 @@ TEST_FILE_SUFFIX = "_test.py"
 CONFTEST_FILE_NAME = "conftest.py"
 MINIMUM_STATUS_FIELD_COUNT = 2
 ALL_FALLBACK_BASE_REFERENCES = ("origin/main", "origin/master")
+DETACHED_HEAD_LABEL = "HEAD"
+BRANCH_REMOTE_CONFIG_KEY_TEMPLATE = "branch.{branch_name}.remote"
 ALL_TOOLING_STATE_PREFIXES = (
     ".claude/verification/",
     ".claude/worktrees/",

package/hooks/blocking/conftest.py

@@ -0,0 +1,115 @@
+"""Pytest fixture that reproduces foreign-``config`` shadowing for the gate family.
+
+The verified-commit gate hooks import shared constants as
+``from config.verified_commit_constants import ...``. This fixture mirrors the
+installed layout that breaks that import -- a real ``hooks/blocking`` package
+beside a decoy ``hooks/config`` regular package -- and runs a caller-supplied
+driver as a subprocess whose ``sys.path`` places the decoy ahead of
+``blocking``, the ordering under which the wrong ``config`` wins resolution.
+"""
+
+import shutil
+import subprocess
+import sys
+import textwrap
+from collections.abc import Callable
+from pathlib import Path
+
+import pytest
+
+_BLOCKING_SOURCE_DIRECTORY = Path(__file__).resolve().parent
+_HOOKS_CONSTANTS_SOURCE_DIRECTORY = _BLOCKING_SOURCE_DIRECTORY.parent / "hooks_constants"
+_SUBPROCESS_TIMEOUT_SECONDS = 60
+_MIRRORED_BLOCKING_FILE_NAMES = (
+    "verified_commit_gate.py",
+    "verification_verdict_store.py",
+    "verifier_verdict_minter.py",
+    "verdict_directory_write_blocker.py",
+    "verified_commit_config_bootstrap.py",
+)
+_DECOY_CONFIG_INIT_SOURCE = '"""Foreign config package that must never win resolution."""\n'
+_DECOY_CONFIG_CONSTANTS_SOURCE = (
+    '"""Stale stand-in carrying none of the real gate constants."""\n\nIS_DECOY_CONFIG = True\n'
+)
+
+
+def _build_shadowed_hook_tree(tmp_path: Path) -> tuple[Path, Path]:
+    """Mirror the hook tree with a decoy ``config`` package beside ``blocking``.
+
+    Args:
+        tmp_path: The directory the mirrored tree is built under.
+
+    Returns:
+        The mirrored ``hooks`` directory and its ``blocking`` subdirectory.
+    """
+    mirrored_hooks_directory = tmp_path / "hooks"
+    mirrored_blocking_directory = mirrored_hooks_directory / "blocking"
+    mirrored_blocking_directory.mkdir(parents=True)
+
+    for each_file_name in _MIRRORED_BLOCKING_FILE_NAMES:
+        source_file = _BLOCKING_SOURCE_DIRECTORY / each_file_name
+        if source_file.exists():
+            shutil.copy2(source_file, mirrored_blocking_directory / each_file_name)
+
+    shutil.copytree(
+        _BLOCKING_SOURCE_DIRECTORY / "config",
+        mirrored_blocking_directory / "config",
+    )
+    shutil.copytree(
+        _HOOKS_CONSTANTS_SOURCE_DIRECTORY,
+        mirrored_hooks_directory / "hooks_constants",
+    )
+
+    decoy_config_directory = mirrored_hooks_directory / "config"
+    decoy_config_directory.mkdir()
+    (decoy_config_directory / "__init__.py").write_text(_DECOY_CONFIG_INIT_SOURCE, encoding="utf-8")
+    (decoy_config_directory / "verified_commit_constants.py").write_text(
+        _DECOY_CONFIG_CONSTANTS_SOURCE, encoding="utf-8"
+    )
+    return mirrored_hooks_directory, mirrored_blocking_directory
+
+
+@pytest.fixture
+def run_under_config_shadow(
+    tmp_path: Path,
+) -> Callable[[str], subprocess.CompletedProcess[str]]:
+    """Return a runner that executes a driver under a foreign-``config`` sys.path.
+
+    ::
+
+        completed = run_under_config_shadow("import verified_commit_gate")
+        ok:   completed.returncode == 0 once the bootstrap seeds the real module
+        flag: nonzero with ModuleNotFoundError while the decoy config wins
+
+    The runner prefixes the driver with a ``sys.path`` preamble that puts the
+    mirrored ``hooks`` directory (holding the decoy ``config``) ahead of
+    ``blocking``, then runs the probe with the active interpreter.
+
+    Args:
+        tmp_path: Pytest's per-test temporary directory, fixture-injected.
+
+    Returns:
+        A function taking driver source text and returning the finished
+        subprocess result.
+    """
+    mirrored_hooks_directory, mirrored_blocking_directory = _build_shadowed_hook_tree(tmp_path)
+
+    def run_driver(driver_body: str) -> subprocess.CompletedProcess[str]:
+        probe_script = tmp_path / "probe.py"
+        sys_path_preamble = textwrap.dedent(
+            f"""\
+            import sys
+            sys.path.insert(0, {str(mirrored_blocking_directory)!r})
+            sys.path.insert(0, {str(mirrored_hooks_directory)!r})
+            """
+        )
+        probe_script.write_text(sys_path_preamble + textwrap.dedent(driver_body), encoding="utf-8")
+        return subprocess.run(
+            [sys.executable, str(probe_script)],
+            check=False,
+            capture_output=True,
+            text=True,
+            timeout=_SUBPROCESS_TIMEOUT_SECONDS,
+        )
+
+    return run_driver

package/hooks/blocking/nas_ssh_binary_enforcer.py

@@ -0,0 +1,191 @@
+#!/usr/bin/env python3
+"""PreToolUse hook: force the Windows OpenSSH binary for NAS ssh/scp/sftp commands.
+
+Root cause: Git Bash's MSYS ssh reads ``~/.ssh/id_ed25519`` as world-readable
+through its ACL mapping, rejects the key as "bad permissions", offers no key, and
+falls back to an interactive password prompt that hangs unattended agent sessions.
+The Windows OpenSSH binary under ``System32/OpenSSH`` authenticates the same key
+without prompting.
+
+Detection strategy: this hook fires only on the Bash tool. The command is
+shlex-tokenized (quotes removed), glued shell control operators are exploded off
+the tokens, and the tokens are split into simple-command segments on ``&&`` /
+``||`` / ``;`` / ``|&`` / ``|`` / ``&``. For each segment the effective leading program is
+found by skipping ``VAR=value`` assignments and launcher wrappers (``timeout``,
+``nohup``, ``nice``, ``stdbuf``, ``setsid``, ``env``) with their flags and duration
+arguments. A segment is evaluated only when its leading program's basename is
+``ssh``/``scp``/``sftp`` (with or without a ``.exe`` suffix) AND a token in that same
+segment holds the NAS address ``192.168.1.100`` as a connection host — bare,
+``user@host``, or a ``host:path`` target. The address inside a remote-command
+argument or a remote path component on another host does not count.
+
+An evaluated segment is DENIED with the binary-swap message when its leading program
+is a bare ssh-family word rather than a path ending in ``OpenSSH/ssh.exe`` (or
+``scp.exe`` / ``sftp.exe``). An evaluated segment whose leading program is that full
+OpenSSH path is DENIED with the batch-mode message when no token in the segment
+carries ``BatchMode=yes``, so an authentication regression fails loudly rather than
+prompting. Everything else is allowed: ssh to any other host, the full OpenSSH path
+with ``BatchMode=yes``, non-Bash tools, a command that only mentions the address
+without an ssh-family leading program, and a command shlex cannot tokenize.
+"""
+
+import json
+import shlex
+import sys
+from pathlib import Path
+
+_hooks_dir = str(Path(__file__).resolve().parent.parent)
+if _hooks_dir not in sys.path:
+    sys.path.insert(0, _hooks_dir)
+
+from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+from hooks_constants.nas_ssh_binary_enforcer_constants import (  # noqa: E402
+    ALL_LAUNCHER_WRAPPER_COMMANDS,
+    ALL_OPENSSH_BINARY_PATH_SUFFIXES,
+    ALL_SHELL_CONTROL_OPERATOR_TOKENS,
+    ALL_SSH_FAMILY_COMMAND_BASENAMES,
+    BARE_SSH_BINARY_MESSAGE,
+    BASH_TOOL_NAME,
+    BATCH_MODE_PATTERN,
+    CONTROL_OPERATOR_SPLIT_PATTERN,
+    LAUNCHER_DURATION_PATTERN,
+    LEADING_ASSIGNMENT_PATTERN,
+    MISSING_BATCH_MODE_MESSAGE,
+    NAS_HOST_TOKEN_PATTERN,
+)
+
+
+def _token_basename(token: str) -> str:
+    return token.replace("\\", "/").rsplit("/", 1)[-1].lower()
+
+
+def _is_openssh_binary_path(token: str) -> bool:
+    normalized_token = token.replace("\\", "/").lower()
+    return any(
+        normalized_token.endswith(each_suffix)
+        for each_suffix in ALL_OPENSSH_BINARY_PATH_SUFFIXES
+    )
+
+
+def _split_into_segments(all_command_tokens: list[str]) -> list[list[str]]:
+    all_exploded_tokens: list[str] = []
+    for each_token in all_command_tokens:
+        for each_fragment in CONTROL_OPERATOR_SPLIT_PATTERN.split(each_token):
+            if each_fragment:
+                all_exploded_tokens.append(each_fragment)
+    all_segments: list[list[str]] = []
+    current_segment: list[str] = []
+    for each_token in all_exploded_tokens:
+        if each_token in ALL_SHELL_CONTROL_OPERATOR_TOKENS:
+            all_segments.append(current_segment)
+            current_segment = []
+            continue
+        current_segment.append(each_token)
+    all_segments.append(current_segment)
+    return all_segments
+
+
+def _effective_leading_program(all_segment_tokens: list[str]) -> str | None:
+    has_seen_launcher_wrapper = False
+    for each_token in all_segment_tokens:
+        if LEADING_ASSIGNMENT_PATTERN.match(each_token):
+            continue
+        if _token_basename(each_token) in ALL_LAUNCHER_WRAPPER_COMMANDS:
+            has_seen_launcher_wrapper = True
+            continue
+        if has_seen_launcher_wrapper and (
+            each_token.startswith("-") or LAUNCHER_DURATION_PATTERN.match(each_token)
+        ):
+            continue
+        return each_token
+    return None
+
+
+def _segment_references_nas(all_segment_tokens: list[str]) -> bool:
+    return any(NAS_HOST_TOKEN_PATTERN.search(each_token) for each_token in all_segment_tokens)
+
+
+def _segment_carries_batch_mode(all_segment_tokens: list[str]) -> bool:
+    return any(BATCH_MODE_PATTERN.search(each_token) for each_token in all_segment_tokens)
+
+
+def _find_nas_ssh_violation(command: str) -> str | None:
+    """Return the deny message for a NAS ssh-family command, or None to allow.
+
+    ::
+
+        ssh -p 9222 jon@192.168.1.100 "ls"          flag: bare-binary message
+        "…/OpenSSH/ssh.exe" -p 9222 jon@192.168…    flag: missing-batch-mode message
+        "…/OpenSSH/ssh.exe" -o BatchMode=yes …NAS   ok:   None
+        ssh jon@example.com "ls"                     ok:   None
+
+    Tokenizes the command, splits it into simple-command segments, and evaluates
+    each segment whose leading program is an ssh-family word AND whose tokens carry
+    the NAS address. A bare ssh-family leader returns the binary-swap message; the
+    full OpenSSH path leader without a ``BatchMode=yes`` token returns the batch-mode
+    message. Returns None when shlex cannot tokenize the command.
+
+    Args:
+        command: The raw Bash command string from the tool input.
+
+    Returns:
+        The deny message string when a segment violates the NAS ssh policy, else None.
+    """
+    try:
+        all_command_tokens = shlex.split(command)
+    except ValueError:
+        return None
+    for each_segment in _split_into_segments(all_command_tokens):
+        leading_program = _effective_leading_program(each_segment)
+        if leading_program is None:
+            continue
+        if _token_basename(leading_program) not in ALL_SSH_FAMILY_COMMAND_BASENAMES:
+            continue
+        if not _segment_references_nas(each_segment):
+            continue
+        if not _is_openssh_binary_path(leading_program):
+            return BARE_SSH_BINARY_MESSAGE
+        if not _segment_carries_batch_mode(each_segment):
+            return MISSING_BATCH_MODE_MESSAGE
+    return None
+
+
+def main() -> None:
+    try:
+        hook_input = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        sys.exit(0)
+
+    tool_name = hook_input.get("tool_name", "")
+    if tool_name != BASH_TOOL_NAME:
+        sys.exit(0)
+
+    command = hook_input.get("tool_input", {}).get("command", "")
+    if not command:
+        sys.exit(0)
+
+    deny_reason = _find_nas_ssh_violation(command)
+    if deny_reason is None:
+        sys.exit(0)
+
+    deny_payload = {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "deny",
+            "permissionDecisionReason": deny_reason,
+        }
+    }
+    log_hook_block(
+        calling_hook_name="nas_ssh_binary_enforcer.py",
+        hook_event="PreToolUse",
+        block_reason=deny_reason,
+        tool_name=tool_name,
+        offending_input_preview=command,
+    )
+    print(json.dumps(deny_payload))
+    sys.stdout.flush()
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/pr_description_enforcer.py

@@ -1,10 +1,11 @@
-"""PreToolUse hook gating gh pr create/edit/comment body content.
-
-Reads a PreToolUse JSON payload on stdin, recognises the body-carrying
-gh pr create/edit/comment Bash invocations, audits the PR body against the
-Anthropic claude-code style rules, and denies the command when the body fails.
-Readability-management CLI flags short-circuit the stdin path to adjust the
-persisted readability state.
+"""PreToolUse hook gating gh pr create/edit/comment bodies and gh pr ready.
+
+Reads a PreToolUse JSON payload on stdin, audits body-carrying gh pr
+create/edit/comment invocations against the Anthropic claude-code style
+rules plus the proof-of-work audit for proof-shaped comment bodies, and
+denies gh pr ready while the PR carries no passing proof comment.
+Readability-management CLI flags short-circuit the stdin path to adjust
+the persisted readability state.
 """
 
 import json
@@ -32,6 +33,12 @@ from blocking.pr_description_pr_number import (  # noqa: E402
     _command_carries_body_flag,
     _extract_pr_number_from_command,
 )
+from blocking.pr_description_proof_of_work import (  # noqa: E402
+    audit_proof_comment_body,
+    evaluate_pr_ready_gate,
+    is_pr_ready_command,
+    is_proof_shaped_body,
+)
 from blocking.pr_description_readability import (  # noqa: E402
     _build_readability_escape_hatch_message,
     _dispatch_cli_flag,
@@ -131,6 +138,28 @@ def validate_pr_body(body: str, pr_number: int | None = None) -> list[str]:
     return violations
 
 
+def _emit_denial(denial_reason: str) -> None:
+    """Print the PreToolUse deny payload for a violation and log the block.
+
+    Args:
+        denial_reason: The permissionDecisionReason text for the deny payload.
+    """
+    denial_payload = {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "deny",
+            "permissionDecisionReason": denial_reason,
+        }
+    }
+    log_hook_block(
+        calling_hook_name="pr_description_enforcer.py",
+        hook_event="PreToolUse",
+        block_reason=denial_reason,
+    )
+    print(json.dumps(denial_payload))
+    sys.stdout.flush()
+
+
 def main() -> None:
     for each_argv_token in sys.argv[1:]:
         if each_argv_token in ALL_READABILITY_CLI_FLAG_TOKENS:
@@ -154,6 +183,12 @@ def main() -> None:
     if not command:
         sys.exit(0)
 
+    if is_pr_ready_command(command):
+        ready_denial_reason = evaluate_pr_ready_gate(command)
+        if ready_denial_reason is not None:
+            _emit_denial(ready_denial_reason)
+        sys.exit(0)
+
     has_any_body_flag = _command_carries_body_flag(command)
     is_pr_create = "gh pr create" in command and has_any_body_flag
     is_pr_edit = "gh pr edit" in command and has_any_body_flag
@@ -173,28 +208,17 @@ def main() -> None:
 
     violations = validate_pr_body(body, pr_number=extracted_pr_number)
 
+    if is_pr_comment and is_proof_shaped_body(body):
+        violations.extend(audit_proof_comment_body(body, extracted_pr_number))
+
     if violations:
         violation_list = "; ".join(violations)
         pr_guide_reference = f" @{PR_GUIDE_PATH}" if os.path.exists(PR_GUIDE_PATH) else ""
-        denial_reason = (
+        _emit_denial(
             f"BLOCKED: [PR_DESCRIPTION] {violation_list}. "
             f"Rewrite the body yourself in Anthropic claude-code style. "
             f"Guide:{pr_guide_reference}"
         )
-        denial_payload = {
-            "hookSpecificOutput": {
-                "hookEventName": "PreToolUse",
-                "permissionDecision": "deny",
-                "permissionDecisionReason": denial_reason,
-            }
-        }
-        log_hook_block(
-            calling_hook_name="pr_description_enforcer.py",
-            hook_event="PreToolUse",
-            block_reason=denial_reason,
-        )
-        print(json.dumps(denial_payload))
-        sys.stdout.flush()
 
     sys.exit(0)
 

package/hooks/blocking/pr_description_pr_number.py

@@ -2,7 +2,8 @@
 
 Reports whether a captured shell command carries any body or body-file flag,
 and extracts the positional PR number (bare integer or GitHub PR URL) from a
-gh pr edit/comment command while skipping value-taking flags and their values.
+gh pr edit/comment/ready command while skipping value-taking flags and their
+values.
 """
 
 import re
@@ -29,6 +30,7 @@ from blocking._gh_body_arg_utils import (  # noqa: E402
     strip_surrounding_quotes,
 )
 from hooks_constants.pr_description_enforcer_constants import (  # noqa: E402
+    ALL_PR_NUMBER_BEARING_GH_PR_SUBCOMMANDS,
     GH_PR_COMMAND_MIN_TOKEN_COUNT,
 )
 
@@ -59,7 +61,7 @@ def _resolve_positional_pr_number(token: str) -> int | None:
 
 
 def _extract_pr_number_from_command(command: str) -> int | None:
-    """Return the PR number positional argument from a `gh pr edit|comment` command.
+    """Return the PR number positional argument from a `gh pr edit|comment|ready` command.
 
     Skips value-taking non-body flags (and their value tokens) so that ``--repo owner/r``
     pairs do not consume the trailing PR number. Accepts both a bare integer literal
@@ -83,7 +85,7 @@ def _extract_pr_number_from_command(command: str) -> int | None:
     if all_tokens[0] != "gh" or all_tokens[1] != "pr":
         return None
     subcommand_token = all_tokens[2]
-    if subcommand_token not in {"edit", "comment"}:
+    if subcommand_token not in ALL_PR_NUMBER_BEARING_GH_PR_SUBCOMMANDS:
         return None
     all_value_taking_bare_flags: frozenset[str] = (
         non_body_value_flags | all_body_flags | {body_file_flag, body_file_short_flag}