claude-dev-env 2.31.0 → 2.32.0

package/hooks/blocking/test_state_description_blocker.py

@@ -1,4 +1,11 @@
-"""Tests for state_description_blocker hook."""
+"""Tests for state_description_blocker hook.
+
+Every payload here names an absolute file under this repository and carries
+the repository root as its ``cwd``, so each decision belongs to this
+checkout rather than to the directory pytest runs from. The one exception is
+the ephemeral-path test, which keeps its scratch target outside the
+repository root on purpose.
+"""
 
 import json
 import os
@@ -22,10 +29,17 @@ from state_description_blocker import (  # noqa: E402
 )
 from state_description_blocker import evaluate as _evaluate_without_opt_in  # noqa: E402
 
+from code_rules_enforcer_test_support import (
+    repository_file_path,
+    repository_root,
+)
+
 HOOK_SCRIPT_PATH = os.path.join(
     os.path.dirname(__file__), "state_description_blocker.py"
 )
 
+_REPOSITORY_ROOT = str(repository_root())
+
 CLEAN_PYTHON = "x = 1  # Uses a default timeout"
 CLEAN_MD = "# Config\n\nThe API uses port 8080."
 CLEAN_COMMENT = "# Configured with a 30-second timeout"
@@ -46,7 +60,11 @@ def evaluate(payload_by_key: dict[str, object]) -> str | None:
 
 
 class _RunHook:
-    """Helper to test the hook via subprocess."""
+    """Run the hook as a subprocess on a payload anchored in this repository.
+
+    The payload names the repository root as the session working directory,
+    so the hook treats each target inside it as a real production file.
+    """
 
     def __call__(
         self,
@@ -55,7 +73,9 @@ class _RunHook:
         *,
         is_prose_style_enabled: bool = True,
     ) -> subprocess.CompletedProcess:
-        payload = json.dumps({"tool_name": tool_name, "tool_input": tool_input})
+        payload = json.dumps(
+            {"tool_name": tool_name, "tool_input": tool_input, "cwd": _REPOSITORY_ROOT}
+        )
         environment_by_key = os.environ.copy()
         if is_prose_style_enabled:
             environment_by_key["CLAUDE_PROSE_STYLE_ENFORCEMENT"] = "1"
@@ -81,7 +101,7 @@ def test_historical_phrase_scan_runs_with_the_env_flag_unset(
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "content": VIOLATION_INSTEAD_OF_COMMENT,
         },
         is_prose_style_enabled=False,
@@ -92,9 +112,10 @@ def test_historical_phrase_scan_runs_with_the_env_flag_unset(
         {
             "tool_name": "Write",
             "tool_input": {
-                "file_path": "src/main.py",
+                "file_path": repository_file_path("src/main.py"),
                 "content": VIOLATION_INSTEAD_OF_COMMENT,
             },
+            "cwd": _REPOSITORY_ROOT,
         }
     )
     assert deny_reason is not None
@@ -105,7 +126,7 @@ def test_block_clean_python_comment_passes():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "content": CLEAN_PYTHON,
         },
     )
@@ -117,7 +138,7 @@ def test_block_clean_markdown_passes():
     result = _run_hook(
         "Write",
         {
-            "file_path": "docs/README.md",
+            "file_path": repository_file_path("docs/README.md"),
             "content": CLEAN_MD,
         },
     )
@@ -129,7 +150,7 @@ def test_block_clean_comment_passes():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.py",
+            "file_path": repository_file_path("src/config.py"),
             "content": CLEAN_COMMENT,
         },
     )
@@ -141,7 +162,7 @@ def test_block_irrelevant_file_passes():
     result = _run_hook(
         "Write",
         {
-            "file_path": "data.txt",
+            "file_path": repository_file_path("data.txt"),
             "content": VIOLATION_INSTEAD_OF_COMMENT,
         },
     )
@@ -153,7 +174,7 @@ def test_block_empty_content_passes():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "content": "",
         },
     )
@@ -177,7 +198,7 @@ def test_detects_instead_of_in_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "content": VIOLATION_INSTEAD_OF_COMMENT,
         },
     )
@@ -191,7 +212,7 @@ def test_detects_previously_in_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.py",
+            "file_path": repository_file_path("src/config.py"),
             "content": VIOLATION_PREVIOUSLY_COMMENT,
         },
     )
@@ -205,7 +226,7 @@ def test_detects_now_uses_in_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/client.py",
+            "file_path": repository_file_path("src/client.py"),
             "content": VIOLATION_NOW_USES_COMMENT,
         },
     )
@@ -219,7 +240,7 @@ def test_detects_instead_of_in_markdown():
     result = _run_hook(
         "Write",
         {
-            "file_path": "docs/api.md",
+            "file_path": repository_file_path("docs/api.md"),
             "content": VIOLATION_MD_INSTEAD,
         },
     )
@@ -232,7 +253,7 @@ def test_detects_previously_in_markdown():
     result = _run_hook(
         "Write",
         {
-            "file_path": "docs/config.md",
+            "file_path": repository_file_path("docs/config.md"),
             "content": VIOLATION_MD_PREVIOUSLY,
         },
     )
@@ -245,7 +266,7 @@ def test_detects_now_uses_in_markdown():
     result = _run_hook(
         "Write",
         {
-            "file_path": "docs/auth.md",
+            "file_path": repository_file_path("docs/auth.md"),
             "content": VIOLATION_MD_NOW_USES,
         },
     )
@@ -271,7 +292,7 @@ def test_detects_edit_new_string():
     result = _run_hook(
         "Edit",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "old_string": "old_comment",
             "new_string": VIOLATION_PREVIOUSLY_COMMENT,
         },
@@ -286,7 +307,7 @@ def test_clean_edit_passes():
     result = _run_hook(
         "Edit",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "old_string": "x = 1",
             "new_string": CLEAN_PYTHON,
         },
@@ -300,7 +321,7 @@ def test_detects_multi_edit_second_new_string() -> None:
     result = _run_hook(
         "MultiEdit",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "edits": [
                 {"old_string": "a = 1", "new_string": CLEAN_PYTHON},
                 {"old_string": "old_comment", "new_string": VIOLATION_PREVIOUSLY_COMMENT},
@@ -317,7 +338,7 @@ def test_clean_multi_edit_passes() -> None:
     result = _run_hook(
         "MultiEdit",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "edits": [
                 {"old_string": "a = 1", "new_string": CLEAN_PYTHON},
                 {"old_string": "b = 2", "new_string": CLEAN_COMMENT},
@@ -339,7 +360,7 @@ def test_multi_edit_new_strings_join_on_a_separator_not_concatenation() -> None:
     result = _run_hook(
         "MultiEdit",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "edits": [
                 {"old_string": "a = 1", "new_string": "# describes the previous"},
                 {"old_string": "b = 2", "new_string": "ly implemented step."},
@@ -354,7 +375,7 @@ def test_multi_edit_with_a_single_edit_still_denies() -> None:
     result = _run_hook(
         "MultiEdit",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "edits": [{"old_string": "old_comment", "new_string": VIOLATION_PREVIOUSLY_COMMENT}],
         },
     )
@@ -367,7 +388,7 @@ def test_system_message_and_suppress_output():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "content": VIOLATION_INSTEAD_OF_COMMENT,
         },
     )
@@ -382,7 +403,7 @@ def test_detects_no_longer_in_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.py",
+            "file_path": repository_file_path("src/config.py"),
             "content": "# No longer supports legacy mode",
         },
     )
@@ -396,7 +417,7 @@ def test_detects_used_to_in_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.py",
+            "file_path": repository_file_path("src/config.py"),
             "content": "# Used to be hardcoded",
         },
     )
@@ -410,7 +431,7 @@ def test_detects_switched_to_in_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.py",
+            "file_path": repository_file_path("src/config.py"),
             "content": "# Switched to async processing",
         },
     )
@@ -428,7 +449,7 @@ def test_detects_comment_with_close_block_token():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.py",
+            "file_path": repository_file_path("src/config.py"),
             "content": VIOLATION_COMMENT_WITH_CLOSE_BLOCK,
         },
     )
@@ -445,7 +466,7 @@ def test_detects_inline_trailing_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "content": "max_retries = 3  # No longer needed since async retry handles it",
         },
     )
@@ -461,7 +482,7 @@ def test_ignores_c_preprocessor_directive():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.h",
+            "file_path": repository_file_path("src/config.h"),
             "content": '#error "This code previously used replaced API"',
         },
     )
@@ -477,7 +498,7 @@ def test_ignores_hash_in_javascript_inline():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.js",
+            "file_path": repository_file_path("src/main.js"),
             "content": 'const selector = "#originally-dark"  // Use dark as default',
         },
     )
@@ -493,7 +514,7 @@ def test_ignores_double_slash_in_js_url():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/fetch.ts",
+            "file_path": repository_file_path("src/fetch.ts"),
             "content": 'fetch("https://api.example.com/replaces")',
         },
     )
@@ -509,7 +530,7 @@ def test_block_comment_continuation_with_nested_glob():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/cache.ts",
+            "file_path": repository_file_path("src/cache.ts"),
             "content": content,
         },
     )
@@ -526,7 +547,7 @@ def test_detects_inline_after_url_on_same_line():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/fetch.ts",
+            "file_path": repository_file_path("src/fetch.ts"),
             "content": 'const url = "https://api.com"; // no longer used',
         },
     )
@@ -543,7 +564,7 @@ def test_ignores_code_before_block_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/cache.ts",
+            "file_path": repository_file_path("src/cache.ts"),
             "content": "cache.replaces(old); /* Use fresh cache */",
         },
     )
@@ -559,7 +580,7 @@ def test_ignores_url_with_double_slash_in_python():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "content": 'url = "https://api.example.com/replaces/v1"',
         },
     )
@@ -574,7 +595,7 @@ def test_ignores_instead_of_in_code_string_with_inline_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "content": "msg = 'instead of'  # Use the default timeout",
         },
     )
@@ -590,7 +611,7 @@ def test_ignores_glob_pattern_with_star_in_python():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "content": content,
         },
     )
@@ -606,7 +627,7 @@ def test_ignores_comment_with_glob_pattern():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "content": content,
         },
     )
@@ -621,7 +642,7 @@ def test_single_line_block_comment_closes():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/cache.ts",
+            "file_path": repository_file_path("src/cache.ts"),
             "content": content,
         },
     )
@@ -639,7 +660,7 @@ def test_block_comment_with_url_closes_correctly():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/cache.ts",
+            "file_path": repository_file_path("src/cache.ts"),
             "content": content,
         },
     )
@@ -656,7 +677,7 @@ def test_same_line_block_comment_with_trailing_inline():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/fetch.ts",
+            "file_path": repository_file_path("src/fetch.ts"),
             "content": content,
         },
     )
@@ -674,7 +695,7 @@ def test_multi_line_block_comment_close_with_trailing_inline():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/cache.ts",
+            "file_path": repository_file_path("src/cache.ts"),
             "content": content,
         },
     )
@@ -691,7 +712,7 @@ def test_detects_earliest_inline_marker_in_php():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/index.php",
+            "file_path": repository_file_path("src/index.php"),
             "content": 'echo $x; // previously used #tag',
         },
     )
@@ -705,7 +726,7 @@ def test_additional_context_contains_examples():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": repository_file_path("src/main.py"),
             "content": VIOLATION_INSTEAD_OF_COMMENT,
         },
     )
@@ -750,7 +771,13 @@ def test_handles_non_dict_tool_input():
 def test_handles_non_string_tool_name():
     """A tool_name that is not a string should exit cleanly — the hook must
     guard against tool_name not being a string."""
-    payload = json.dumps({"tool_name": 123, "tool_input": {"file_path": "src/main.py"}})
+    payload = json.dumps(
+        {
+            "tool_name": 123,
+            "tool_input": {"file_path": repository_file_path("src/main.py")},
+            "cwd": _REPOSITORY_ROOT,
+        }
+    )
     result = subprocess.run(
         [sys.executable, HOOK_SCRIPT_PATH],
         input=payload,
@@ -774,7 +801,7 @@ def test_detects_used_to_in_python_module_docstring() -> None:
     result = _run_hook(
         "Write",
         {
-            "file_path": "tests/test_exports.py",
+            "file_path": repository_file_path("tests/test_exports.py"),
             "content": written_source,
         },
     )
@@ -795,7 +822,7 @@ def test_detects_previously_in_python_function_docstring() -> None:
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/configuration.py",
+            "file_path": repository_file_path("src/configuration.py"),
             "content": written_source,
         },
     )
@@ -812,7 +839,7 @@ def test_ignores_transitional_phrase_in_regular_python_string() -> None:
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/messages.py",
+            "file_path": repository_file_path("src/messages.py"),
             "content": 'PADDING_NOTE = "used to pad with a flat sleep"\n',
         },
     )
@@ -831,7 +858,7 @@ def test_ignores_quoted_mention_inside_python_docstring() -> None:
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/scanner.py",
+            "file_path": repository_file_path("src/scanner.py"),
             "content": written_source,
         },
     )
@@ -847,7 +874,7 @@ def test_detects_docstring_at_start_of_unparseable_edit_fragment() -> None:
     result = _run_hook(
         "Edit",
         {
-            "file_path": "src/exports.py",
+            "file_path": repository_file_path("src/exports.py"),
             "old_string": "placeholder",
             "new_string": fragment,
         },
@@ -869,7 +896,7 @@ def test_detects_docstring_after_def_header_in_unparseable_fragment() -> None:
     result = _run_hook(
         "Edit",
         {
-            "file_path": "src/reporting.py",
+            "file_path": repository_file_path("src/reporting.py"),
             "old_string": "placeholder",
             "new_string": fragment,
         },
@@ -888,7 +915,7 @@ def test_ignores_assigned_triple_quoted_string_in_unparseable_fragment() -> None
     result = _run_hook(
         "Edit",
         {
-            "file_path": "src/fixtures.py",
+            "file_path": repository_file_path("src/fixtures.py"),
             "old_string": "placeholder",
             "new_string": fragment,
         },
@@ -907,7 +934,11 @@ def test_native_dispatch_path_logs_the_block(tmp_path: Path) -> None:
     """
     deny_payload = {
         "tool_name": "Write",
-        "tool_input": {"file_path": "src/main.py", "content": VIOLATION_INSTEAD_OF_COMMENT},
+        "tool_input": {
+            "file_path": repository_file_path("src/main.py"),
+            "content": VIOLATION_INSTEAD_OF_COMMENT,
+        },
+        "cwd": _REPOSITORY_ROOT,
     }
     native_hook = NativeHook(evaluate=evaluate, build_deny_payload=build_deny_payload)
 

package/hooks/blocking/test_tdd_enforcer.py

@@ -1,4 +1,9 @@
-"""Tests for tdd-enforcer hook (blocking behavior)."""
+"""Tests for tdd-enforcer hook (blocking behavior).
+
+Includes the recorded-test-failure evidence path: a genuinely recorded
+failure unlocks a production write, and never unlocks it for a test file
+the failing command did not name.
+"""
 
 import importlib.util
 import io
@@ -1352,6 +1357,67 @@ def test_should_allow_repeat_production_write_within_window_without_further_test
     assert _decision_from(second_write) == "allow"
 
 
+def _seed_recorded_test_failure(
+    test_file: Path, session_id: str, repository_root: Path, command: str, exit_status: int
+) -> None:
+    """Plant a failure record as if a PostToolUse hook had genuinely seen it fail."""
+    content_hash_store.record_test_command_failure(
+        [test_file], command, exit_status, session_id, str(repository_root)
+    )
+
+
+def test_should_allow_production_write_when_recorded_test_failure_matches_content(
+    tmp_path: Path,
+) -> None:
+    """RED evidence outranks a stale mtime: a genuinely recorded failure unlocks GREEN."""
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): assert fulfill() == 1\n")
+    stale_timestamp = time.time() - STALE_MTIME_OFFSET_SECONDS
+    os.utime(sibling_test, (stale_timestamp, stale_timestamp))
+    session_id = "recorded-failure-session"
+    _seed_recorded_test_failure(
+        sibling_test, session_id, sandbox, "pytest test_orders.py", 1
+    )
+
+    completed = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 1\n", session_id, sandbox
+        )
+    )
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_deny_production_write_when_recorded_failure_names_a_different_file(
+    tmp_path: Path,
+) -> None:
+    """Anti-bypass: a failure recorded for one test file must not unlock a sibling's gate."""
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): assert fulfill() == 1\n")
+    stale_timestamp = time.time() - STALE_MTIME_OFFSET_SECONDS
+    os.utime(sibling_test, (stale_timestamp, stale_timestamp))
+    unrelated_test = sandbox / "test_unrelated.py"
+    unrelated_test.write_text("def test_other(): pass\n")
+    session_id = "recorded-failure-unrelated-session"
+    _seed_recorded_test_failure(
+        unrelated_test, session_id, sandbox, "pytest test_unrelated.py", 1
+    )
+
+    completed = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 1\n", session_id, sandbox
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
 def test_should_deny_apply_patch_that_adds_test_and_production_file_in_one_transaction(
     tmp_path: Path,
 ) -> None:
@@ -1374,3 +1440,67 @@ def test_should_deny_apply_patch_that_adds_test_and_production_file_in_one_trans
     completed = _run_hook_with_payload(_make_apply_patch_payload(sandbox, patch_command))
 
     assert _decision_from(completed) == "deny"
+
+
+def test_should_stay_exempt_for_scratch_outside_repository_root(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Repo-root fix: a genuine scratch file outside the repository stays exempt."""
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
+    repository_root = "/tmp/pr-alpha"
+    payload = {
+        "tool_name": "Write",
+        "tool_input": {
+            "file_path": "/tmp/scratch/one_off.py",
+            "content": _BEHAVIOR_BEARING_CONTENT,
+        },
+        "cwd": repository_root,
+    }
+    completed = _run_hook_with_payload(payload)
+    assert _decision_from(completed) != "deny", (
+        f"TDD enforcer must not deny scratch outside the repository, got: {completed.stdout!r}"
+    )
+
+
+def test_should_stay_exempt_for_unrelated_worktree_sibling_under_tmp(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Repo-root fix: a sibling sharing the root's name prefix is not inside it.
+
+    Containment is judged by path segment, so /tmp/pr-alpha-sibling is outside
+    /tmp/pr-alpha however much of the name the two share.
+    """
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
+    repository_root = "/tmp/pr-alpha"
+    payload = {
+        "tool_name": "Write",
+        "tool_input": {
+            "file_path": "/tmp/pr-alpha-sibling/hooks/orders.py",
+            "content": _BEHAVIOR_BEARING_CONTENT,
+        },
+        "cwd": repository_root,
+    }
+    completed = _run_hook_with_payload(payload)
+    assert _decision_from(completed) != "deny", (
+        f"TDD enforcer must not deny an unrelated sibling worktree, got: {completed.stdout!r}"
+    )
+
+
+def test_should_deny_production_file_inside_repository_root_under_tmp(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Repo-root fix: a production file inside a repository under /tmp still needs a test."""
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
+    repository_root = "/tmp/pr-alpha"
+    payload = {
+        "tool_name": "Write",
+        "tool_input": {
+            "file_path": f"{repository_root}/hooks/blocking/orders.py",
+            "content": _BEHAVIOR_BEARING_CONTENT,
+        },
+        "cwd": repository_root,
+    }
+    completed = _run_hook_with_payload(payload)
+    assert _decision_from(completed) == "deny", (
+        f"TDD enforcer must gate a repository file under /tmp, got: {completed.stdout!r}"
+    )

package/hooks/hooks.json

@@ -3,7 +3,7 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Write|Edit",
+        "matcher": "Write|Edit|MultiEdit|apply_patch",
         "hooks": [
           {
             "type": "command",
@@ -264,7 +264,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/gh_pr_author_restore.py",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/bash_post_call_dispatcher.py",
             "timeout": 60
           }
         ]

package/hooks/hooks_constants/bash_post_call_dispatcher_constants.py

@@ -0,0 +1,22 @@
+"""Constants for the Bash PostToolUse dispatcher.
+
+Holds the ordered hosted-hook roster this dispatcher runs after a Bash call
+finishes. Reuses ``BashHostedHookEntry`` and the Bash-only tool-name set from
+``bash_pre_tool_use_dispatcher_constants`` -- the entry shape and the tool-name
+membership question are identical on the PostToolUse side, so this module adds
+no second copy of either.
+"""
+
+from __future__ import annotations
+
+from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
+    ALL_BASH_ONLY_TOOL_NAMES,
+    BashHostedHookEntry,
+)
+
+__all__ = ["ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES"]
+
+ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
+    BashHostedHookEntry("blocking/gh_pr_author_restore.py", ALL_BASH_ONLY_TOOL_NAMES),
+    BashHostedHookEntry("observability/test_failure_recorder.py", ALL_BASH_ONLY_TOOL_NAMES),
+)