claude-dev-env 2.31.1 → 2.32.0

package/bin/install.test.mjs

@@ -925,9 +925,17 @@ function isPreToolUseDispatcherCommand(command) {
     return /(?:^|[/\\])pre_tool_use_dispatcher\.py(?![A-Za-z0-9_])/.test(command);
 }
 
+function matcherCoversWriteAndEdit(matcher) {
+    const allToolNames = String(matcher || '').split('|');
+    return allToolNames.includes('Write') && allToolNames.includes('Edit');
+}
+
 function countManagedRunAllValidatorsHooks(settings) {
-    const writeEditGroups = (settings.hooks.PreToolUse || []).filter(
-        group => group.matcher === 'Write|Edit'
+    // The runner is registered inline on the write path. Which mutation tools
+    // that path lists is the gate's business, so this counts any matcher
+    // carrying Write and Edit rather than one exact tool list.
+    const writeEditGroups = (settings.hooks.PreToolUse || []).filter(group =>
+        matcherCoversWriteAndEdit(group.matcher)
     );
     let runAllValidatorsCount = 0;
     for (const group of writeEditGroups) {
@@ -1382,7 +1390,7 @@ test('shipped hooks.json matches the dispatcher design: dispatchers registered,
     assert.equal(
         countManagedRunAllValidatorsHooks(shippedHooksConfig),
         1,
-        'shipped hooks.json must retain the inline run_all_validators runner in Write|Edit',
+        'shipped hooks.json must retain the inline run_all_validators runner on the write path',
     );
 
     const allPostToolUseGroups = shippedHooksConfig.hooks.PostToolUse || [];

package/docs/CODE_RULES.md

@@ -130,4 +130,4 @@ Three surfaces report on the roster, and each reports a specific thing:
 
 - `hooks/validators/hook_timing_harness.py` builds a `Write` payload against a target that already holds content. `_contents_for_validation` returns `None` for that payload, so the harness times interpreter start and hook dispatch. Time an `Edit` payload against a real file to measure the checks.
 - `~/.claude/logs/hook-blocks.log` records the denials raised by fixtures in `test_code_rules_enforcer_*.py` and by the timing harness's default target.
-- `hooks/validators/run_all_validators.py` suppresses exemption-directory substring matching for a target under a system temporary root, so pytest's `test_<name>0` parents stay scaffolding. A pytest `--basetemp` outside those roots restores the matching, and the staged copy takes a test-file exemption. Run this suite under the default temporary root.
+- `hooks/validators/run_all_validators.py` stages the target under a temporary root and rebuilds the shortest path tail that carries every exemption signal. The walk starts at the target's own project root and skips a directory pytest generated for its own scratch tree, so the staged path reads the same wherever `--basetemp` places that tree.

package/hooks/blocking/bash_post_call_dispatcher.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""PostToolUse dispatcher that hosts the Bash hook chain running after a call.
+
+Named ``bash_post_call_dispatcher`` rather than the more obvious
+``bash_post_tool_use_dispatcher``: ``bin/install.test.mjs`` counts every
+PostToolUse command whose text contains the literal substring
+``post_tool_use_dispatcher.py`` and asserts exactly one match, against the
+unrelated Write/Edit dispatcher in ``validation/post_tool_use_dispatcher.py``.
+That check carries no basename anchor (its PreToolUse sibling does), so a
+correctly-named Bash-side sibling here would read as a second match of an
+unrelated dispatcher. This name carries the same meaning without the
+collision, and needs no change to that shared, out-of-scope test file.
+
+Reads the tool payload from stdin once, selects the hosted hooks applicable to
+the payload's tool name, and runs each one in-process via the shared
+hosted-hook runner. A hosted PostToolUse hook here carries no permission
+decision -- it is a side-effecting observer, not a gate -- so this dispatcher
+runs the whole roster unconditionally and emits nothing itself, matching every
+hosted hook's own empty-stdout contract.
+
+A single hosted hook crash fails open: ``run_hook_capturing_output`` isolates
+it, so it contributes nothing and does not stop the remaining hosted hooks.
+
+One interpreter start here serves the whole roster: every hosted hook's
+imports load once into this process rather than once per hook.
+"""
+
+from __future__ import annotations
+
+
+import _path_setup  # noqa: F401
+
+from hooks_constants.bash_post_call_dispatcher_constants import (
+    ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES,
+)
+from hooks_constants.bash_pre_tool_use_dispatcher_constants import BashHostedHookEntry
+from hooks_constants.hosted_hook_runner import (
+    run_hook_capturing_output,
+    resolved_hook_script_path,
+    run_dispatcher_main,
+)
+
+
+def select_applicable_entries(tool_name: str) -> list[BashHostedHookEntry]:
+    """Return the ordered hosted-hook entries that apply to tool_name."""
+    return [
+        each_entry
+        for each_entry in ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES
+        if tool_name in each_entry.applicable_tool_names
+    ]
+
+
+def dispatch(payload_text: str, tool_name: str) -> None:
+    """Run every hosted hook applicable to tool_name, in registration order.
+
+    Each hosted hook's crash is isolated by ``run_hook_capturing_output``, so
+    one hook failing never stops a later one in the same roster.
+    """
+    for each_entry in select_applicable_entries(tool_name):
+        script_path = resolved_hook_script_path(each_entry.script_relative_path)
+        run_hook_capturing_output(script_path, payload_text)
+
+
+def main() -> None:
+    """Read stdin once and dispatch the Bash PostToolUse hosted-hook roster."""
+    run_dispatcher_main(dispatch)
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/bash_pre_tool_use_dispatcher.py

@@ -22,7 +22,6 @@ from __future__ import annotations
 import json
 import sys
 from dataclasses import dataclass, field
-from pathlib import Path
 
 import _path_setup  # noqa: F401
 
@@ -36,8 +35,12 @@ from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
     REASON_JOIN_SEPARATOR,
     BashHostedHookEntry,
 )
-from hooks_constants.hosted_hook_runner import HostedHookRun, run_hook_capturing_output
-from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+from hooks_constants.hosted_hook_runner import (
+    run_dispatcher_main,
+    run_hook_capturing_output,
+    HostedHookRun,
+    resolved_hook_script_path,
+)
 
 _PERMISSION_DECISION_KEY = "permissionDecision"
 _PERMISSION_REASON_KEY = "permissionDecisionReason"
@@ -203,12 +206,6 @@ def aggregate_bash_hook_results(
     )
 
 
-def _resolve_hook_script_path(relative_path: str) -> str:
-    """Resolve a hooks/-relative path to an absolute script path."""
-    hooks_root = Path(__file__).resolve().parent.parent
-    return str(hooks_root / relative_path)
-
-
 def _emit_decision(decision: BashDispatcherDecision) -> None:
     """Write one PreToolUse permission payload to stdout when an outcome exists."""
     if not decision.decision:
@@ -251,7 +248,7 @@ def dispatch(payload_text: str, tool_name: str) -> None:
     applicable_entries = select_applicable_entries(tool_name)
     all_runs: list[HostedHookRun] = []
     for each_entry in applicable_entries:
-        script_path = _resolve_hook_script_path(each_entry.script_relative_path)
+        script_path = resolved_hook_script_path(each_entry.script_relative_path)
         hook_run = run_hook_capturing_output(script_path, payload_text)
         all_runs.append(hook_run)
         if _run_is_deny(hook_run):
@@ -264,17 +261,7 @@ def dispatch(payload_text: str, tool_name: str) -> None:
 
 def main() -> None:
     """Read stdin once and dispatch the Bash/PowerShell hosted-hook chain."""
-    payload_dictionary = read_hook_input_dictionary_from_stdin()
-    if payload_dictionary is None:
-        sys.exit(0)
-
-    payload_text = json.dumps(payload_dictionary)
-    tool_name = payload_dictionary.get("tool_name", "")
-    if not isinstance(tool_name, str) or not tool_name:
-        sys.exit(0)
-
-    dispatch(payload_text, tool_name)
-    sys.exit(0)
+    run_dispatcher_main(dispatch)
 
 
 if __name__ == "__main__":

package/hooks/blocking/code_rules_duplicate_body.py

@@ -492,6 +492,7 @@ def _total_reachable_statement_count(
 
 def _helper_match_window_dumps(
     function_node: ast.FunctionDef | ast.AsyncFunctionDef,
+    dump_by_statement: dict[ast.stmt, str],
 ) -> list[str] | None:
     """Return the helper's substantive block as per-statement dumps, or None.
 
@@ -541,7 +542,10 @@ def _helper_match_window_dumps(
     )
     if not has_substantial_compound:
         return None
-    return [_normalized_statement_dump(each) for each in match_window]
+    return [
+        _memoized_statement_dump(each_statement, dump_by_statement)
+        for each_statement in match_window
+    ]
 
 
 def check_same_file_inline_duplicate_body(
@@ -763,14 +767,14 @@ def _inline_duplicate_violation(
 
 
 def _violations_for_qualifying_helpers(
-    window_by_function: dict[_ModuleScopeFunction, list[str] | None],
+    window_by_function: dict[_ModuleScopeFunction, list[str]],
     profile_by_function: dict[_ModuleScopeFunction, _FunctionScanProfile],
     maximum_issue_count: int,
 ) -> list[tuple[frozenset[int], str]]:
     """Walk the helpers in source order and report the first inliner of each.
 
     Args:
-        window_by_function: Each function's helper match window, or None.
+        window_by_function: Each qualifying function's helper match window.
         profile_by_function: Each function's readings, keyed in source order.
         maximum_issue_count: The report ceiling the walk stops at.
 
@@ -779,8 +783,6 @@ def _violations_for_qualifying_helpers(
     """
     all_violations_in_walk_order: list[tuple[frozenset[int], str]] = []
     for each_helper, each_window_dumps in window_by_function.items():
-        if each_window_dumps is None:
-            continue
         each_enclosing = _first_enclosing_inliner(
             each_helper, each_window_dumps, profile_by_function
         )
@@ -811,10 +813,14 @@ def _inline_duplicate_violations(
     """
     dump_by_statement: dict[ast.stmt, str] = {}
     window_by_function = {
-        each_function: _helper_match_window_dumps(each_function)
+        each_function: each_window
         for each_function in all_top_level_functions
+        if (
+            each_window := _helper_match_window_dumps(each_function, dump_by_statement)
+        )
+        is not None
     }
-    if all(each_window is None for each_window in window_by_function.values()):
+    if not window_by_function:
         return []
     profile_by_function = {
         each_function: _function_scan_profile(each_function, dump_by_statement)

package/hooks/blocking/code_rules_enforcer_test_support.py

@@ -14,6 +14,45 @@ from pathlib import Path
 _ENFORCER_SCRIPT_PATH = Path(__file__).with_name("code_rules_enforcer.py")
 
 
+def repository_root() -> Path:
+    """Return the root of the checkout these tests run inside.
+
+    ::
+
+        <checkout>/packages/claude-dev-env/hooks/blocking/test_x.py -> <checkout>
+
+    Found by walking up for a ``.git`` entry rather than by counting
+    directories, so moving a test file does not silently anchor it somewhere
+    else. Falls back to the four-levels-up ancestor when no marker is found,
+    which is where the checkout root sits for this directory.
+
+    Returns:
+        The checkout root directory.
+    """
+    all_ancestors = Path(__file__).resolve().parents
+    for each_ancestor in all_ancestors:
+        if (each_ancestor / ".git").exists():
+            return each_ancestor
+    return all_ancestors[3]
+
+
+def repository_file_path(relative_path: str) -> str:
+    """Return the absolute path of a repository-relative file in this checkout.
+
+    A hook resolves a bare relative path against the process working
+    directory, so a payload carrying one answers to wherever pytest was
+    invoked from. An absolute path under the checkout root keeps the
+    decision stable however the suite is launched.
+
+    Args:
+        relative_path: The target file's path relative to the checkout root.
+
+    Returns:
+        That file's absolute path inside this checkout.
+    """
+    return str(repository_root() / relative_path)
+
+
 def build_write_payload(file_path: str, content: str) -> str:
     """Build the JSON payload sent by a Write tool call."""
     return json.dumps(

package/hooks/blocking/shell_substitution_blocker.py

@@ -23,6 +23,12 @@ ignored because bash performs no substitution inside them (for example
 are treated as literal only when the count of preceding backslashes is odd;
 an even count (including zero) means the backtick is a live substitution.
 
+A quoted heredoc body is stripped for the same reason. `<<'EOF'`, `<<"EOF"`
+and `<<\\EOF` each tell bash to expand nothing between the opener and the
+terminator, so a backtick there is text the file receives rather than a
+command the shell runs. A bare `<<EOF` expands its body and keeps its scan,
+and text outside any heredoc is scanned either way.
+
 Bash arithmetic expansion ``$((...))`` is explicitly NOT blocked: it does not
 spawn a subshell and does not defeat the allowlist matcher. Telling it apart
 from a disguised command substitution takes more than counting two open
@@ -41,11 +47,6 @@ another ``)`` (an ``))`` pair), the expansion is arithmetic and passes. When
 the closer that brings depth to zero is a lone ``)``, bash has fallen back to
 running a parenthesized command inside the substitution, so it is blocked.
 This hook applies that walk, tracking paren depth from the opening ``$((``.
-
-False positives are still possible when the user is intentionally writing
-shell-script content (for example, authoring a .sh file via heredoc) and the
-substitution is literal payload rather than something to execute. In that
-case, author the file with the Write tool, not a Bash heredoc.
 """
 
 from __future__ import annotations
@@ -53,6 +54,7 @@ from __future__ import annotations
 import json
 import sys
 from pathlib import Path
+from re import Match
 
 _hooks_dir = str(Path(__file__).resolve().parent.parent)
 if _hooks_dir not in sys.path:
@@ -74,6 +76,11 @@ from hooks_constants.shell_substitution_blocker_constants import (  # noqa: E402
     PERMISSION_DECISION_KEY,
     PERMISSION_DECISION_REASON_KEY,
     PROCESS_SUBSTITUTION_PATTERN,
+    BACKSLASH_CHARACTER,
+    COMMAND_LINE_SEPARATOR,
+    DOUBLE_QUOTE_CHARACTER,
+    NO_TERMINATOR_INDEX,
+    SINGLE_QUOTE_CHARACTER,
     SINGLE_QUOTED_RUN_PATTERN,
     STRIPPED_RUN_REPLACEMENT,
     TOOL_INPUT_KEY,
@@ -81,10 +88,169 @@ from hooks_constants.shell_substitution_blocker_constants import (  # noqa: E402
 )
 
 
+from hooks_constants.piped_pytest_blocker_constants import (  # noqa: E402
+    HEREDOC_ESCAPE_GROUP,
+    HEREDOC_OPENER_PATTERN,
+    HEREDOC_QUOTE_GROUP,
+    HEREDOC_TAB_STRIP_GROUP,
+    HEREDOC_TAB_STRIP_MARKER,
+    HEREDOC_TERMINATOR_GROUP,
+    HEREDOC_UNQUOTED_MARKER,
+)
+from hooks_constants.shell_command_pipeline import (  # noqa: E402
+    PendingHeredoc,
+    closes_the_heredoc,
+)
+
+
 def _strip_single_quoted_runs(command: str) -> str:
     return SINGLE_QUOTED_RUN_PATTERN.sub(STRIPPED_RUN_REPLACEMENT, command)
 
 
+def _opener_suppresses_expansion(opener_match: Match[str]) -> bool:
+    """Return whether an opener's delimiter is quoted or backslash-escaped.
+
+    ::
+
+        <<'EOF'  -> True   quoted, the body is literal
+        <<EOF    -> False  bare, bash expands the body
+
+    Args:
+        opener_match: One HEREDOC_OPENER_PATTERN match from a command line.
+
+    Returns:
+        True when bash expands nothing down to this opener's terminator.
+    """
+    is_quoted = opener_match.group(HEREDOC_QUOTE_GROUP) != HEREDOC_UNQUOTED_MARKER
+    is_escaped = opener_match.group(HEREDOC_ESCAPE_GROUP) != HEREDOC_UNQUOTED_MARKER
+    return is_quoted or is_escaped
+
+
+def _sits_outside_quotes(command_line: str, character_index: int) -> bool:
+    """Return whether a position on a line sits outside every quoted run.
+
+    ::
+
+        cat <<'EOF'      index of << -> True   bash reads an opener
+        echo "<<'EOF'"   index of << -> False  bash reads a string
+
+    Counting unescaped quotes before the position tells the two apart: an even
+    count of each quote character means every run opened before it also closed.
+
+    Args:
+        command_line: One line of the command.
+        character_index: Position of the candidate opener on that line.
+
+    Returns:
+        True when bash reads this position as shell syntax.
+    """
+    single_quote_count = 0
+    double_quote_count = 0
+    is_escaped = False
+    for each_character in command_line[:character_index]:
+        if is_escaped:
+            is_escaped = False
+            continue
+        if each_character == BACKSLASH_CHARACTER:
+            is_escaped = True
+            continue
+        if each_character == SINGLE_QUOTE_CHARACTER:
+            single_quote_count += 1
+        elif each_character == DOUBLE_QUOTE_CHARACTER:
+            double_quote_count += 1
+    return single_quote_count % 2 == 0 and double_quote_count % 2 == 0
+
+
+def _first_literal_opener(command_line: str) -> Match[str] | None:
+    """Return the line's first heredoc opener whose body bash leaves literal.
+
+    An opener spelled inside a quoted string is text bash passes on, so it
+    opens nothing and the lines below it stay in the scan.
+
+    Args:
+        command_line: One line of the command.
+
+    Returns:
+        The matching opener, or None when the line opens no literal heredoc.
+    """
+    for each_opener in HEREDOC_OPENER_PATTERN.finditer(command_line):
+        if not _sits_outside_quotes(command_line, each_opener.start()):
+            continue
+        if _opener_suppresses_expansion(each_opener):
+            return each_opener
+    return None
+
+
+def _index_past_literal_body(
+    all_lines: list[str], body_start_index: int, opener_match: Match[str]
+) -> int:
+    """Return the index of the line that closes a literal heredoc body.
+
+    The terminator match, including the ``<<-`` tab-strip rule, comes from
+    ``closes_the_heredoc`` so this hook and the shared pipeline agree on what
+    ends a body.
+
+    Args:
+        all_lines: Every line of the command.
+        body_start_index: Index of the body's first line.
+        opener_match: The opener whose terminator closes this body.
+
+    Returns:
+        The index of the terminator line, or NO_TERMINATOR_INDEX when the
+        command holds none.
+    """
+    pending_heredoc = PendingHeredoc(
+        terminator=opener_match.group(HEREDOC_TERMINATOR_GROUP),
+        allows_leading_tabs=(
+            opener_match.group(HEREDOC_TAB_STRIP_GROUP) == HEREDOC_TAB_STRIP_MARKER
+        ),
+    )
+    for each_index in range(body_start_index, len(all_lines)):
+        if closes_the_heredoc(all_lines[each_index], pending_heredoc):
+            return each_index
+    return NO_TERMINATOR_INDEX
+
+
+def _strip_quoted_heredoc_bodies(command: str) -> str:
+    """Return the command holding its openers, terminators, and shell text.
+
+    ::
+
+        cat <<'EOF'        ->  cat <<'EOF'
+        inert text             EOF
+        EOF
+
+    A quoted or escaped delimiter makes the lines below it text the shell hands
+    on, so a scan of those lines reports a substitution bash never runs. A bare
+    delimiter keeps its body, and text outside any heredoc keeps its scan.
+
+    An opener with no terminator returns the command whole. Bash consumes the
+    rest of the input in that case, and dropping those lines would hide a live
+    substitution among them.
+
+    Args:
+        command: The raw Bash command string from the tool input.
+
+    Returns:
+        The command with each literal heredoc body dropped.
+    """
+    all_lines = command.split(COMMAND_LINE_SEPARATOR)
+    all_kept_lines: list[str] = []
+    each_index = 0
+    while each_index < len(all_lines):
+        current_line = all_lines[each_index]
+        all_kept_lines.append(current_line)
+        each_index += 1
+        opener_match = _first_literal_opener(current_line)
+        if opener_match is None:
+            continue
+        terminator_index = _index_past_literal_body(all_lines, each_index, opener_match)
+        if terminator_index == NO_TERMINATOR_INDEX:
+            return command
+        each_index = terminator_index
+    return COMMAND_LINE_SEPARATOR.join(all_kept_lines)
+
+
 def _closes_as_arithmetic_expansion(command: str, scan_start_index: int) -> bool:
     """Return True when a ``$((`` expansion closes on an ``))`` pair.
 
@@ -132,8 +298,9 @@ def has_shell_substitution(command: str) -> bool:
         echo '$(not-executed)'         ok:   single-quoted, inert
         echo $((2 + 2))                ok:   arithmetic expansion
 
-    Single-quoted runs are stripped first because bash substitutes nothing
-    inside them. A backtick preceded by an odd backslash count is escaped.
+    Literal heredoc bodies are dropped first, then single-quoted runs are
+    stripped, because bash substitutes nothing inside either. A backtick
+    preceded by an odd backslash count is escaped.
     A `$((` pair is walked to its terminator (module docstring) to tell
     real arithmetic from a disguised subshell.
 
@@ -143,7 +310,7 @@ def has_shell_substitution(command: str) -> bool:
     Returns:
         True when a substitution the matcher cannot descend into is present.
     """
-    scannable_command = _strip_single_quoted_runs(command)
+    scannable_command = _strip_single_quoted_runs(_strip_quoted_heredoc_bodies(command))
     if _has_unsafe_dollar_paren_expansion(scannable_command):
         return True
     if EVEN_BACKSLASH_BACKTICK_PATTERN.search(scannable_command):

package/hooks/blocking/stop_dispatcher.py

@@ -12,11 +12,14 @@ from __future__ import annotations
 
 import json
 import sys
-from pathlib import Path
 
 import _path_setup  # noqa: F401
 
-from hooks_constants.hosted_hook_runner import HostedHookRun, run_hook_capturing_output
+from hooks_constants.hosted_hook_runner import (
+    run_hook_capturing_output,
+    HostedHookRun,
+    resolved_hook_script_path,
+)
 from hooks_constants.stop_dispatcher_constants import (
     ALL_STOP_HOSTED_HOOK_PATHS,
     BLOCK_DECISION,
@@ -24,12 +27,6 @@ from hooks_constants.stop_dispatcher_constants import (
 )
 
 
-def _resolve_hook_script_path(relative_path: str) -> str:
-    """Resolve a hooks/-relative path to an absolute script path."""
-    hooks_root = Path(__file__).resolve().parent.parent
-    return str(hooks_root / relative_path)
-
-
 def _is_block_decision(stdout_text: str) -> bool:
     """Return True when stdout carries a Stop decision of block."""
     stripped_text = stdout_text.strip()
@@ -58,7 +55,7 @@ def dispatch(payload_text: str) -> None:
     """Run every Stop hosted hook and emit the first block decision if any."""
     all_runs: list[HostedHookRun] = []
     for each_relative_path in ALL_STOP_HOSTED_HOOK_PATHS:
-        script_path = _resolve_hook_script_path(each_relative_path)
+        script_path = resolved_hook_script_path(each_relative_path)
         hook_run = run_hook_capturing_output(script_path, payload_text)
         all_runs.append(hook_run)
     block_stdout = select_first_block_stdout(all_runs)

package/hooks/blocking/tdd_enforcer.py

@@ -4,7 +4,9 @@ Blocks a write to a production source file when no matching test was modified
 within the freshness window, enforcing "TDD IS NON-NEGOTIABLE" from CLAUDE.md.
 The gate records each candidate test's content hash at every sighting and
 compares that hash on the next write. A first sighting requires content that
-differs from HEAD.
+differs from HEAD. A recorded failing pytest run, written by
+``hooks/observability/test_failure_recorder.py``, is read before that fallback
+and applies while the candidate's content still matches what failed.
 Each concern lives in a ``tdd_enforcer_parts`` submodule; this entry wires them
 into one PreToolUse gate and re-exports their surface for the test suite.
 """

package/hooks/blocking/tdd_enforcer_parts/config/tdd_enforcer_constants.py

@@ -3,6 +3,9 @@
 Centralizes the freshness window, the ancestor-walk limit, the git-tracking
 and git-diff command tokens, the source-file extension sets, the join
 separator, and the last-observed-hash store's filename shape and JSON keys.
+The store's JSON keys also cover a recorded failing-test-run entry: the test
+file's content hash at failure time, the failure timestamp, the failing
+command, and its exit status.
 """
 
 from __future__ import annotations
@@ -22,6 +25,10 @@ HASH_STATE_FILE_SUFFIX: str = ".json"
 REPOSITORY_ROOT_DIGEST_LENGTH: int = 16
 STORED_CONTENT_HASH_KEY: str = "hash"
 STORED_CHANGED_AT_KEY: str = "changed_at"
+STORED_FAILURE_HASH_KEY: str = "failed_hash"
+STORED_FAILED_AT_KEY: str = "failed_at"
+STORED_FAILURE_COMMAND_KEY: str = "failed_command"
+STORED_FAILURE_EXIT_STATUS_KEY: str = "failed_exit_status"
 PYTHON_SOURCE_EXTENSION: str = ".py"
 ENTRY_HOOK_FILE_NAME: str = "tdd_enforcer.py"
 NEWLINE_JOIN_SEPARATOR: str = "\n"