claude-dev-env 2.31.1 → 2.33.0

package/hooks/observability/test_failure_recorder.py

@@ -0,0 +1,219 @@
+#!/usr/bin/env python3
+"""PostToolUse hook: record a failing single pytest run as TDD-gate evidence.
+
+A file-content edit is not the same claim as a test that ran and failed. The
+content-hash store in ``tdd_enforcer_parts/content_hash_store.py`` already
+tracks whether a candidate test file's content changed; this hook adds a
+stronger form of evidence -- a real RED -- by watching every Bash call finish
+and, for a genuine failing pytest run, recording the command, its real exit
+status, and the test file paths it named into that same store.
+
+::
+
+    pytest test_orders.py                    (exit 1)  -> record test_orders.py
+    pytest test_orders.py -k fulfill          (exit 1)  -> record test_orders.py
+    pytest test_orders.py::test_fulfill       (exit 1)  -> record test_orders.py
+    pytest -q                                 (exit 1)  -> no path named, no record
+    cd repo && pytest test_orders.py          (exit 1)  -> chained, no record
+    pytest test_orders.py | tee run.log       (blocked by piped_pytest_blocker
+                                                first -- this hook never sees it)
+    npm test                                  (exit 1)  -> not pytest, no record
+    pytest test_orders.py                     (exit 0)  -> passed, no record
+
+What this hook matches, and why
+--------------------------------
+
+Only a single, unchained Bash command whose own program is ``pytest`` /
+``py.test``, or a Python interpreter running ``-m pytest``. A chained command
+(``&&``, ``;``, ``|``, ``||``, a newline) is rejected outright: this repo's own
+``piped_pytest_blocker.py`` already tells the caller to "run pytest alone" for
+exactly this reason, and a chain's reported exit status may belong to a
+command other than pytest, or to none of them if an earlier link short-
+circuited before pytest even ran. ``npm test``, ``node --test``, and
+``vitest`` are deliberately not matched: ``npm test`` is a script indirection
+whose real test runner lives in ``package.json``, not on the command line,
+and the other two have no existing, tested classification helper in this
+repository the way pytest does. Extending to them would mean inventing new
+parsing rather than reusing anything proven, which is the over-reach this
+mechanism is built to avoid.
+
+The recognizer here is deliberately its own small, stdlib-only ``shlex``
+check rather than a reuse of ``hooks_constants.pytest_invocation`` /
+``shell_command_pipeline``. Those solve the harder pipe-and-wrapper problem a
+PreToolUse blocker needs, and this repository's own style rule forbids an
+import inside a function body, so importing that larger machinery here would
+mean paying its full transitive import cost on every single Bash call this
+hook sees, pytest or not -- working directly against the point of watching
+every Bash call. The narrower, single-unchained-command scope this hook
+accepts does not need that machinery.
+
+Where the exit status comes from
+---------------------------------
+
+Not from scraping the command's output text for words like "failed" or
+"error". The Bash tool's own PostToolUse ``tool_response`` takes two shapes
+observed directly in this session's own transcript: a dict with ``stdout``/
+``stderr`` keys when the command's reported exit status is 0, and the literal
+string ``"Error: Exit code <N>\\n<output>"`` when it is not. This hook reads
+that harness-authored ``<N>`` directly; it is a real Bash mechanism doing the
+work correctly, not a lookalike that only mimics one.
+
+Where the test paths come from
+--------------------------------
+
+The command's own arguments, not its output. A bare ``pytest`` or ``pytest
+-q`` names no path and is left unrecorded on purpose: recording it against
+every test file pytest might have discovered would satisfy the gate for a
+file this run never demonstrably covered, which is the exact bypass the
+audit calls out. Only a token that is not an option flag and resolves to a
+real file on disk, relative to the command's own ``cwd``, counts.
+
+What stops a bypass
+---------------------
+
+Three things, together:
+
+1. ``content_hash_store.record_test_command_failure`` keys each entry
+   exactly as the gate looks candidates up, so a failure never satisfies a
+   sibling file the same command also happened to run (see
+   ``test_content_hash_store.py::test_recorded_failure_does_not_satisfy_a_different_candidate``).
+2. The gate consults a recorded failure only while the file's *current*
+   content hash still matches what actually failed (see
+   ``test_recorded_failure_does_not_apply_once_content_no_longer_matches``).
+   Editing the test again clears it as evidence.
+3. A record ages out after the same freshness window every other form of
+   evidence uses (see ``test_recorded_failure_expires_after_the_freshness_window``).
+
+The hook never blocks a tool call. A non-Bash tool, a malformed payload, a
+command that does not mention "pytest", a chained command, a command with no
+real path argument, or a failed record each returns quietly.
+"""
+
+from __future__ import annotations
+
+import shlex
+import sys
+from pathlib import Path
+
+try:
+    _hooks_root_directory = str(Path(__file__).resolve().parent.parent)
+    _blocking_directory = str(Path(_hooks_root_directory) / "blocking")
+    for each_bootstrap_directory in (_hooks_root_directory, _blocking_directory):
+        if each_bootstrap_directory not in sys.path:
+            sys.path.insert(0, each_bootstrap_directory)
+    from hooks_constants.gh_pr_author_swap_constants import BASH_TOOL_NAME
+    from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+    from hooks_constants.test_failure_recorder_constants import (
+        ALL_CHAINING_OPERATOR_SUBSTRINGS,
+        ALL_PYTEST_MENTION_SUBSTRINGS,
+        ALL_PYTEST_PROGRAM_BASENAMES,
+        ALL_REDIRECTION_TOKENS,
+        EXIT_CODE_ERROR_PREFIX,
+        MODULE_RUN_FLAG,
+        NODE_ID_FILE_PATH_SEPARATOR,
+        OPTION_TOKEN_PREFIX,
+        PYTEST_MODULE_NAME,
+        PYTHON_INTERPRETER_BASENAME_PATTERN,
+    )
+    from tdd_enforcer_parts import content_hash_store
+except ImportError as import_error:
+    raise ImportError(
+        "test_failure_recorder: cannot import its dependencies; "
+        "ensure the hooks directory is importable."
+    ) from import_error
+
+
+def _mentions_pytest(command: str) -> bool:
+    lowered_command = command.lower()
+    return any(
+        each_substring in lowered_command for each_substring in ALL_PYTEST_MENTION_SUBSTRINGS
+    )
+
+
+def _harness_reported_exit_status(tool_response: object) -> int | None:
+    if not isinstance(tool_response, str) or not tool_response.startswith(EXIT_CODE_ERROR_PREFIX):
+        return None
+    remainder = tool_response[len(EXIT_CODE_ERROR_PREFIX) :]
+    digit_count = 0
+    while digit_count < len(remainder) and remainder[digit_count].isdigit():
+        digit_count += 1
+    return int(remainder[:digit_count]) if digit_count else None
+
+
+def _is_single_unchained_command(command: str) -> bool:
+    return not any(each_operator in command for each_operator in ALL_CHAINING_OPERATOR_SUBSTRINGS)
+
+
+def _runs_pytest_via_module_flag(all_tokens: list[str]) -> bool:
+    if MODULE_RUN_FLAG not in all_tokens:
+        return False
+    flag_index = all_tokens.index(MODULE_RUN_FLAG)
+    return flag_index + 1 < len(all_tokens) and all_tokens[flag_index + 1] == PYTEST_MODULE_NAME
+
+
+def _command_tokens_run_pytest(all_tokens: list[str]) -> bool:
+    if not all_tokens:
+        return False
+    first_basename = Path(all_tokens[0]).name
+    if first_basename in ALL_PYTEST_PROGRAM_BASENAMES:
+        return True
+    if not PYTHON_INTERPRETER_BASENAME_PATTERN.match(first_basename):
+        return False
+    return _runs_pytest_via_module_flag(all_tokens)
+
+
+def _existing_test_file_paths(all_tokens: list[str], cwd: str) -> list[Path]:
+    all_paths: list[Path] = []
+    for each_token in all_tokens:
+        if each_token.startswith(OPTION_TOKEN_PREFIX) or each_token in ALL_REDIRECTION_TOKENS:
+            continue
+        file_path_text = each_token.split(NODE_ID_FILE_PATH_SEPARATOR, 1)[0]
+        candidate_path = Path(cwd, file_path_text) if cwd else Path(file_path_text)
+        if candidate_path.is_file():
+            all_paths.append(candidate_path)
+    return all_paths
+
+
+def _command_tokens(command: str) -> list[str]:
+    try:
+        return shlex.split(command)
+    except ValueError:
+        return []
+
+
+def _record_pytest_failure(hook_payload: dict, command: str) -> None:
+    exit_status = _harness_reported_exit_status(hook_payload.get("tool_response"))
+    if exit_status is None or not _is_single_unchained_command(command):
+        return
+    all_tokens = _command_tokens(command)
+    if not _command_tokens_run_pytest(all_tokens):
+        return
+    cwd = str(hook_payload.get("cwd") or "")
+    all_test_file_paths = _existing_test_file_paths(all_tokens, cwd)
+    if not all_test_file_paths:
+        return
+    session_id = str(hook_payload.get("session_id") or "")
+    content_hash_store.record_test_command_failure(
+        all_test_file_paths, command, exit_status, session_id, cwd
+    )
+
+
+def main() -> None:
+    """Record one failing pytest run's evidence from a PostToolUse Bash payload.
+
+    Reads the payload from stdin. Returns quietly on every branch that is not
+    a genuine, single, unchained, path-naming pytest failure, so a logging
+    problem never surfaces as a blocked or altered tool call.
+    """
+    hook_payload = read_hook_input_dictionary_from_stdin()
+    if hook_payload is None or hook_payload.get("tool_name") != BASH_TOOL_NAME:
+        return
+    tool_input = hook_payload.get("tool_input")
+    command = tool_input.get("command", "") if isinstance(tool_input, dict) else ""
+    if not isinstance(command, str) or not _mentions_pytest(command):
+        return
+    _record_pytest_failure(hook_payload, command)
+
+
+if __name__ == "__main__":
+    main()

package/hooks/observability/test_test_failure_recorder.py

@@ -0,0 +1,173 @@
+"""Behavior tests for the test_failure_recorder PostToolUse hook.
+
+Drives the hook's main through real stdin payloads shaped like a genuine
+Bash PostToolUse call, then reads the shared content-hash store back to
+confirm what -- if anything -- it recorded. The store's real state file
+under the OS temp directory is read directly, the same way
+test_content_hash_store.py and test_tdd_enforcer.py already do, rather than
+mocking tempfile.gettempdir. ``hooks/conftest.py`` already puts the hooks
+and blocking directories on sys.path for test collection, so this file needs
+no bootstrap of its own before importing content_hash_store.
+"""
+
+import contextlib
+import importlib.util
+import io
+import json
+from pathlib import Path
+from unittest import mock
+
+from tdd_enforcer_parts import content_hash_store
+
+_HOOK_DIRECTORY = Path(__file__).parent
+_hook_spec = importlib.util.spec_from_file_location(
+    "test_failure_recorder_under_test", _HOOK_DIRECTORY / "test_failure_recorder.py"
+)
+assert _hook_spec is not None
+assert _hook_spec.loader is not None
+_hook_module = importlib.util.module_from_spec(_hook_spec)
+_hook_spec.loader.exec_module(_hook_module)
+
+
+def _run_hook_with_payload(payload: dict) -> None:
+    with (
+        mock.patch("sys.stdin", io.StringIO(json.dumps(payload))),
+        contextlib.suppress(SystemExit),
+    ):
+        _hook_module.main()
+
+
+def _recorded_failure_entry(test_file: Path, session_id: str, repository_root: str) -> dict | None:
+    state_file = content_hash_store._state_file_path(session_id, repository_root)
+    if not state_file.exists():
+        return None
+    state = json.loads(state_file.read_text())
+    return state.get(content_hash_store._state_key_for(test_file))
+
+
+def _bash_payload(command: str, tool_response: object, cwd: Path, session_id: str) -> dict:
+    return {
+        "session_id": session_id,
+        "cwd": str(cwd),
+        "tool_name": "Bash",
+        "tool_input": {"command": command},
+        "tool_response": tool_response,
+    }
+
+
+_FAILING_OUTPUT = (
+    "Error: Exit code 1\n"
+    "F                                                                    [100%]\n"
+    "=================================== FAILURES ===================================\n"
+    "FAILED test_orders.py::test_fulfill - AssertionError\n"
+    "1 failed in 0.02s"
+)
+_PASSING_OUTPUT = {"stdout": "1 passed in 0.02s", "stderr": "", "interrupted": False}
+
+
+def test_records_a_failure_for_a_bare_pytest_command_naming_a_real_file(
+    tmp_path: Path,
+) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "recorder-session-1"
+
+    _run_hook_with_payload(
+        _bash_payload("pytest test_orders.py", _FAILING_OUTPUT, tmp_path, session_id)
+    )
+
+    entry = _recorded_failure_entry(test_file, session_id, str(tmp_path))
+    assert entry is not None
+    assert entry[content_hash_store.STORED_FAILURE_EXIT_STATUS_KEY] == 1
+    assert entry[content_hash_store.STORED_FAILURE_COMMAND_KEY] == "pytest test_orders.py"
+
+
+def test_does_not_record_for_a_passing_command(tmp_path: Path) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): pass\n")
+    session_id = "recorder-session-2"
+
+    _run_hook_with_payload(
+        _bash_payload("pytest test_orders.py", _PASSING_OUTPUT, tmp_path, session_id)
+    )
+
+    assert _recorded_failure_entry(test_file, session_id, str(tmp_path)) is None
+
+
+def test_does_not_record_for_a_non_pytest_command(tmp_path: Path) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "recorder-session-3"
+
+    _run_hook_with_payload(
+        _bash_payload("npm test", "Error: Exit code 1\n1 failing", tmp_path, session_id)
+    )
+
+    assert _recorded_failure_entry(test_file, session_id, str(tmp_path)) is None
+
+
+def test_does_not_record_for_a_chained_command(tmp_path: Path) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "recorder-session-4"
+
+    _run_hook_with_payload(
+        _bash_payload("cd /repo && pytest test_orders.py", _FAILING_OUTPUT, tmp_path, session_id)
+    )
+
+    assert _recorded_failure_entry(test_file, session_id, str(tmp_path)) is None
+
+
+def test_does_not_record_for_a_bare_pytest_run_with_no_path_argument(
+    tmp_path: Path,
+) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "recorder-session-5"
+
+    _run_hook_with_payload(_bash_payload("pytest -q", _FAILING_OUTPUT, tmp_path, session_id))
+
+    assert _recorded_failure_entry(test_file, session_id, str(tmp_path)) is None
+
+
+def test_records_only_the_named_file_not_an_option_or_expression_token(
+    tmp_path: Path,
+) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "recorder-session-6"
+
+    _run_hook_with_payload(
+        _bash_payload("pytest test_orders.py -k fulfill", _FAILING_OUTPUT, tmp_path, session_id)
+    )
+
+    entry = _recorded_failure_entry(test_file, session_id, str(tmp_path))
+    assert entry is not None
+    state_file = content_hash_store._state_file_path(session_id, str(tmp_path))
+    state = json.loads(state_file.read_text())
+    assert len(state) == 1
+
+
+def test_ignores_a_tool_other_than_bash(tmp_path: Path) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "recorder-session-7"
+    payload = _bash_payload("pytest test_orders.py", _FAILING_OUTPUT, tmp_path, session_id)
+    payload["tool_name"] = "Write"
+
+    _run_hook_with_payload(payload)
+
+    assert _recorded_failure_entry(test_file, session_id, str(tmp_path)) is None
+
+
+def test_does_not_record_when_the_named_file_does_not_exist_on_disk(
+    tmp_path: Path,
+) -> None:
+    session_id = "recorder-session-8"
+    missing_file = tmp_path / "test_missing.py"
+
+    _run_hook_with_payload(
+        _bash_payload("pytest test_missing.py", _FAILING_OUTPUT, tmp_path, session_id)
+    )
+
+    assert _recorded_failure_entry(missing_file, session_id, str(tmp_path)) is None

package/hooks/validators/comment_checks.py

@@ -1,4 +1,4 @@
-"""Comment detection validator.
+"""Comment detection helpers used by the opt-in diff-aware linter.
 
 Implements check 26: No comments in code (self-documenting code principle).
 
@@ -12,7 +12,7 @@ Exceptions (NOT flagged):
 - Docstrings (triple-quoted strings for function contracts)
 
 Note: Docstrings documenting function Args/Returns/Raises are acceptable
-per CODE_RULES.md. This validator only flags # and // style comments.
+per CODE_RULES.md. The save-path validator does not invoke these helpers.
 """
 
 import re

package/hooks/validators/config/directory_exemption_constants.py

@@ -38,15 +38,6 @@ ALL_PYTEST_SANITIZED_TEST_NAME_CHARACTERS: frozenset[str] = frozenset(
     LOWERCASE_ASCII_LETTER_CHARACTERS + DECIMAL_DIGIT_CHARACTERS + UNDERSCORE_CHARACTER
 )
 
-ALL_SYSTEM_TEMPORARY_ROOT_ENVIRONMENT_VARIABLE_NAMES: frozenset[str] = frozenset(
-    {
-        "TEMP",
-        "TMP",
-        "TMPDIR",
-        "RUNNER_TEMP",
-    }
-)
-
 ALL_AUTHORITATIVE_DIRECTORY_PATH_PATTERN_SETS: tuple[Iterable[str], ...] = (
     TEST_PATH_PATTERNS,
     WORKFLOW_REGISTRY_PATTERNS,

package/hooks/validators/config/system_temporary_roots_constants.py

@@ -0,0 +1,15 @@
+"""Constants naming where the system keeps temporary directories."""
+
+from __future__ import annotations
+
+# A run reaches its temp root through any of these, so a walk that stops at
+# that boundary checks all four rather than gettempdir() alone. RUNNER_TEMP
+# is the hosted-CI case: pytest writes there while gettempdir() stays /tmp.
+ALL_SYSTEM_TEMPORARY_ROOT_ENVIRONMENT_VARIABLE_NAMES: frozenset[str] = frozenset(
+    {
+        "TEMP",
+        "TMP",
+        "TMPDIR",
+        "RUNNER_TEMP",
+    }
+)

package/hooks/validators/fast_save_validators.py

@@ -42,7 +42,6 @@ from .test_safety_checks import (
     check_debug_guard_in_dev_scripts,
     check_no_skip_decorators,
 )
-from .todo_checks import validate_file as validate_todo_file
 from .type_safety_checks import validate_file as validate_type_safety_file
 from .useless_test_checks import validate_file as validate_useless_test_file
 from .validator_base import ValidatorResult
@@ -153,14 +152,6 @@ def _all_fast_save_validator_specifications() -> (
             _violation_lines_from(validate_magic_literal_file),
             NO_PYTHON_FILES_MESSAGE,
         ),
-        # Python code quality and TODO tracking.
-        _FastSaveValidatorSpecification(
-            "TODO Tracking",
-            "36",
-            _is_python_file,
-            _violation_lines_from(validate_todo_file),
-            NO_PYTHON_FILES_MESSAGE,
-        ),
         _FastSaveValidatorSpecification(
             "Security",
             "27,28,29",

package/hooks/validators/git_checks.py

@@ -6,12 +6,6 @@ import sys
 from dataclasses import dataclass
 from typing import List
 
-try:
-    from .validator_defaults import DEFAULT_BASE_BRANCH_WHEN_UNKNOWN
-except ImportError:
-    from validator_defaults import DEFAULT_BASE_BRANCH_WHEN_UNKNOWN
-
-
 SUBPROCESS_TIMEOUT_SECONDS = 30
 
 
@@ -38,83 +32,6 @@ def get_current_branch() -> str:
         return ""
 
 
-def check_single_commit_when_pr_exists() -> List[Violation]:
-    """
-    Check that a PR branch has exactly 1 commit ahead of its base.
-
-    Returns empty list if:
-    - No PR exists for current branch
-    - gh CLI or git is not available
-    - gh/git times out
-    - Branch is exactly 1 commit ahead of base
-    - git rev-list output is non-numeric
-
-    Returns violation if:
-    - Branch is 0 commits ahead of base
-    - Branch is more than 1 commit ahead of base
-    """
-    branch = get_current_branch()
-    if not branch:
-        return []
-
-    try:
-        pr_info = subprocess.run(
-            ["gh", "pr", "list", "--head", branch, "--json", "baseRefName,number"],
-            capture_output=True,
-            text=True,
-            check=True,
-            timeout=SUBPROCESS_TIMEOUT_SECONDS,
-        )
-    except FileNotFoundError:
-        return []
-    except subprocess.CalledProcessError:
-        return []
-    except subprocess.TimeoutExpired:
-        return []
-
-    try:
-        pr_data = json.loads(pr_info.stdout)
-    except json.JSONDecodeError:
-        return []
-
-    if not pr_data:
-        return []
-
-    base_branch = pr_data[0].get("baseRefName", DEFAULT_BASE_BRANCH_WHEN_UNKNOWN)
-
-    try:
-        rev_list = subprocess.run(
-            ["git", "rev-list", "--count", f"{base_branch}..HEAD"],
-            capture_output=True,
-            text=True,
-            check=True,
-            timeout=SUBPROCESS_TIMEOUT_SECONDS,
-        )
-    except FileNotFoundError:
-        return []
-    except subprocess.CalledProcessError:
-        return []
-    except subprocess.TimeoutExpired:
-        return []
-
-    commit_count_text = rev_list.stdout.strip()
-    try:
-        commit_count = int(commit_count_text)
-    except ValueError:
-        return []
-
-    if commit_count == 1:
-        return []
-
-    return [
-        Violation(
-            file="",
-            line=0,
-            message=f"Branch must have exactly 1 commit ahead of {base_branch}, found {commit_count} commits",
-        )
-    ]
-
-
 def check_draft_pr_state() -> List[Violation]:
     """
     Check that PR is in draft state.
@@ -175,7 +92,6 @@ def main() -> None:
     """Run all git checks and exit with appropriate code."""
     violations: List[Violation] = []
 
-    violations.extend(check_single_commit_when_pr_exists())
     violations.extend(check_draft_pr_state())
 
     if violations:

package/hooks/validators/mypy_integration.py

@@ -13,28 +13,26 @@ _validators_directory = str(Path(__file__).resolve().parent)
 _hooks_directory = str(Path(__file__).resolve().parent.parent)
 
 try:
+    from project_roots import enclosing_project_root
     from pyproject_config_discovery import (
-        ancestor_directories,
+        ancestor_directories,  # noqa: F401  re-exported for validation/mypy_validator
         find_pyproject_configuring_tool,
     )
-    from system_temporary_roots import enclosing_system_temporary_root
 except ModuleNotFoundError:
     if _validators_directory not in sys.path:
         sys.path.insert(0, _validators_directory)
+    from project_roots import enclosing_project_root
     from pyproject_config_discovery import (
-        ancestor_directories,
+        ancestor_directories,  # noqa: F401  re-exported for validation/mypy_validator
         find_pyproject_configuring_tool,
     )
-    from system_temporary_roots import enclosing_system_temporary_root
 
 try:
     from hooks_constants.mypy_integration_constants import (
         FOLLOW_IMPORTS_FLAG,
         FOLLOW_IMPORTS_SKIP_VALUE,
-        GIT_DIRECTORY_NAME,
         MYPY_DETACHED_SUBPROCESS_TIMEOUT_SECONDS,
         MYPY_DETACHED_TIMEOUT_SKIP_MESSAGE,
-        PYPROJECT_FILENAME,
         PYTHON_SOURCE_SUFFIX,
     )
     from hooks_constants.pyproject_config_discovery_constants import MYPY_TOOL_TABLE_NAME
@@ -44,10 +42,8 @@ except ModuleNotFoundError:
     from hooks_constants.mypy_integration_constants import (
         FOLLOW_IMPORTS_FLAG,
         FOLLOW_IMPORTS_SKIP_VALUE,
-        GIT_DIRECTORY_NAME,
         MYPY_DETACHED_SUBPROCESS_TIMEOUT_SECONDS,
         MYPY_DETACHED_TIMEOUT_SKIP_MESSAGE,
-        PYPROJECT_FILENAME,
         PYTHON_SOURCE_SUFFIX,
     )
     from hooks_constants.pyproject_config_discovery_constants import MYPY_TOOL_TABLE_NAME
@@ -97,41 +93,19 @@ def find_pyproject_with_mypy_config(starting_file: Path) -> Path | None:
 
 
 def find_module_resolution_root(starting_file: Path) -> Path | None:
-    """Return the nearest ancestor directory that roots a project, else None.
+    """Return the project root mypy resolves this file's first-party imports against.
 
-    A project root is the first ancestor holding a ``.git`` entry or a
-    ``pyproject.toml``. Mypy resolves a first-party import against its working
-    directory, so anchoring there binds ``config.*`` to the target file's own
-    project and keeps a foreign ``config`` in the caller's directory out of scope.
-
-    The walk does not climb out of the system temp directory. A PreToolUse
-    staging copy lives under ``%TEMP%``, and a ``.git`` in the user home above
-    that temp root is not this file's project.
-
-    ::
-
-        target_repo/.git + target_repo/tools/x.py -> target_repo
-        /tmp/detached/x.py (home .git above temp) -> None
-        flag: walk past %TEMP% into ~/.git        -> mypy cwd=home, hook timeout
+    Mypy resolves a first-party import against its working directory, so
+    anchoring there binds ``config.*`` to the target file's own project and
+    keeps a foreign ``config`` in the caller's directory out of scope.
 
     Args:
         starting_file: The file (or directory) the walk begins from.
 
     Returns:
-        The nearest ancestor Path that holds ``.git`` or ``pyproject.toml``,
-        or ``None`` when no such ancestor exists inside the walk limit.
+        The project root, or None when the file sits inside none.
     """
-    git_entry_name = GIT_DIRECTORY_NAME
-    pyproject_filename = PYPROJECT_FILENAME
-    enclosing_temporary_root = enclosing_system_temporary_root(starting_file)
-    for each_candidate_directory in ancestor_directories(starting_file):
-        has_git_entry = (each_candidate_directory / git_entry_name).exists()
-        has_pyproject = (each_candidate_directory / pyproject_filename).is_file()
-        if has_git_entry or has_pyproject:
-            return each_candidate_directory
-        if each_candidate_directory == enclosing_temporary_root:
-            return None
-    return None
+    return enclosing_project_root(starting_file)
 
 
 def _first_module_resolution_root(all_py_files: list[str]) -> Path | None: