claude-dev-env 2.7.0 → 2.8.0

package/skills/codex-review/scripts/codex_usage_probe.py

@@ -40,9 +40,21 @@ import sys
 import threading
 from collections.abc import Mapping, Sequence
 from datetime import datetime, timezone
+from pathlib import Path
 from typing import IO, Protocol
 
-from codex_review_scripts_constants.codex_usage_probe_constants import (
+_shared_process_tree_scripts_directory = (
+    Path(__file__).resolve().parents[3] / "_shared" / "process-tree" / "scripts"
+)
+if str(_shared_process_tree_scripts_directory) not in sys.path:
+    sys.path.insert(0, str(_shared_process_tree_scripts_directory))
+
+from process_tree_kill import (  # noqa: E402
+    should_start_new_session,
+    terminate_process_tree,
+)
+
+from codex_review_scripts_constants.codex_usage_probe_constants import (  # noqa: E402
     ALL_APP_SERVER_COMMAND_PARTS,
     ALL_WINDOWS_SCRIPT_SUFFIXES,
     APP_SERVER_TIMEOUT_SECONDS,
@@ -94,10 +106,6 @@ from codex_review_scripts_constants.codex_usage_probe_constants import (
     WINDOWS_COMMAND_SHELL,
     WINDOWS_COMMAND_SHELL_RUN_FLAG,
     WINDOWS_OS_NAME,
-    WINDOWS_TASKKILL_COMMAND,
-    WINDOWS_TASKKILL_FORCE_FLAG,
-    WINDOWS_TASKKILL_PID_FLAG,
-    WINDOWS_TASKKILL_TREE_FLAG,
 )
 
 
@@ -387,41 +395,19 @@ def _collect_server_lines(
 
 
 def _terminate_process_tree(server_process: subprocess.Popen[str]) -> None:
-    """Stop the app-server process and any children it launched.
+    """Stop the app-server process and any children it launched, then reap it.
 
     On Windows the probe may wrap a ``.cmd``/``.bat`` shim as ``cmd /c``, so
     ``Popen.pid`` is ``cmd.exe``. Killing only that process leaves the real
-    Codex app-server grandchild alive and holding stdout. ``taskkill /T``
-    tears down the whole tree; other platforms use ``kill()``.
+    Codex app-server grandchild alive and holding stdout. The shared tree kill
+    ends the whole tree on either platform; the timed wait that follows reaps
+    the direct child so the enclosing ``with`` block exits without a long wait.
     """
-    if server_process.poll() is not None:
-        return
-    process_id = server_process.pid
-    if process_id is None:
-        return
-    if os.name == WINDOWS_OS_NAME:
-        subprocess.run(
-            [
-                WINDOWS_TASKKILL_COMMAND,
-                WINDOWS_TASKKILL_FORCE_FLAG,
-                WINDOWS_TASKKILL_TREE_FLAG,
-                WINDOWS_TASKKILL_PID_FLAG,
-                str(process_id),
-            ],
-            check=False,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-        )
-        try:
-            server_process.wait(timeout=PROCESS_TREE_WAIT_TIMEOUT_SECONDS)
-        except subprocess.TimeoutExpired:
-            server_process.kill()
-        return
-    server_process.kill()
+    terminate_process_tree(server_process)
     try:
         server_process.wait(timeout=PROCESS_TREE_WAIT_TIMEOUT_SECONDS)
     except subprocess.TimeoutExpired:
-        pass
+        return
 
 
 def _teardown_app_server_exchange(
@@ -467,6 +453,7 @@ def _exchange_app_server_messages_via_subprocess(
         text=True,
         encoding=UTF8_ENCODING,
         shell=False,
+        start_new_session=should_start_new_session(),
     ) as server_process:
         server_stdin = server_process.stdin
         server_stdout = server_process.stdout

package/skills/codex-review/scripts/run_codex_review.py

@@ -18,22 +18,29 @@ import json
 import os
 import re
 import shutil
-import signal
 import subprocess
+import sys
 from dataclasses import dataclass
 from pathlib import Path
 
-from codex_review_scripts_constants.codex_usage_probe_constants import (
+_shared_process_tree_scripts_directory = (
+    Path(__file__).resolve().parents[3] / "_shared" / "process-tree" / "scripts"
+)
+if str(_shared_process_tree_scripts_directory) not in sys.path:
+    sys.path.insert(0, str(_shared_process_tree_scripts_directory))
+
+from process_tree_kill import (  # noqa: E402
+    should_start_new_session,
+    terminate_process_tree,
+)
+
+from codex_review_scripts_constants.codex_usage_probe_constants import (  # noqa: E402
     ALL_WINDOWS_SCRIPT_SUFFIXES,
     WINDOWS_COMMAND_SHELL,
     WINDOWS_COMMAND_SHELL_RUN_FLAG,
     WINDOWS_OS_NAME,
-    WINDOWS_TASKKILL_COMMAND,
-    WINDOWS_TASKKILL_FORCE_FLAG,
-    WINDOWS_TASKKILL_PID_FLAG,
-    WINDOWS_TASKKILL_TREE_FLAG,
 )
-from codex_review_scripts_constants.run_constants import (
+from codex_review_scripts_constants.run_constants import (  # noqa: E402
     ALL_SHAPE_PROBE_REQUIRED_FLAGS,
     BASE_TARGET_FLAG,
     CAPTURE_STREAMS_KEYWORD,
@@ -74,61 +81,6 @@ from codex_review_scripts_constants.run_constants import (
 )
 
 
-def _kill_windows_process_tree(process_identifier: int) -> None:
-    """Kill a Windows process and every descendant it started, by PID.
-
-    Swallows taskkill failures so the caller can fall back to ``Popen.kill()``
-    and a timed drain. A raised ``TimeoutExpired`` here would replace the
-    original review-timeout exception and skip that drain path.
-    """
-    try:
-        subprocess.run(
-            [
-                WINDOWS_TASKKILL_COMMAND,
-                WINDOWS_TASKKILL_TREE_FLAG,
-                WINDOWS_TASKKILL_FORCE_FLAG,
-                WINDOWS_TASKKILL_PID_FLAG,
-                str(process_identifier),
-            ],
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-            check=False,
-            timeout=PROCESS_TREE_KILL_TIMEOUT_SECONDS,
-        )
-    except (subprocess.TimeoutExpired, OSError):
-        return
-
-
-def _kill_posix_process_group(process_identifier: int) -> None:
-    """Kill a POSIX process group so no grandchild keeps the capture pipe open."""
-    try:
-        process_group_identifier = os.getpgid(process_identifier)
-        os.killpg(process_group_identifier, signal.SIGKILL)
-    except (ProcessLookupError, PermissionError):
-        return
-
-
-def _terminate_process_tree(review_process: subprocess.Popen[str]) -> None:
-    """Kill the review process and every descendant it spawned.
-
-    Tree kill first (taskkill /T or killpg). When the direct child is still
-    alive after that, fall back to ``Popen.kill()`` so ``Popen.__exit__`` never
-    hits an unbounded wait on a surviving process.
-    """
-    if review_process.poll() is not None:
-        return
-    if os.name == WINDOWS_OS_NAME:
-        _kill_windows_process_tree(review_process.pid)
-    else:
-        _kill_posix_process_group(review_process.pid)
-    if review_process.poll() is not None:
-        return
-    try:
-        review_process.kill()
-    except ProcessLookupError:
-        return
-
-
 def _open_codex_popen(
     all_arguments: list[str],
     all_keyword_arguments: dict[str, object],
@@ -147,7 +99,7 @@ def _open_codex_popen(
         text=bool(all_keyword_arguments.get(TEXT_MODE_KEYWORD, False)),
         encoding=stream_encoding if isinstance(stream_encoding, str) else None,
         env=process_environment if isinstance(process_environment, dict) else None,
-        start_new_session=os.name != WINDOWS_OS_NAME,
+        start_new_session=should_start_new_session(),
     )
 
 
@@ -198,7 +150,7 @@ def _communicate_with_tree_kill_on_timeout(
     try:
         return review_process.communicate(timeout=timeout_seconds)
     except subprocess.TimeoutExpired:
-        _terminate_process_tree(review_process)
+        terminate_process_tree(review_process)
         _drain_process_after_tree_kill(review_process)
         raise
 

package/skills/codex-review/scripts/test_codex_usage_probe.py

@@ -34,9 +34,6 @@ from codex_review_scripts_constants.codex_usage_probe_constants import (
     USAGE_REPORT_KEY_WINDOW_RESET,
     WEEKLY_USAGE_GATE_THRESHOLD_PERCENT,
     WEEKLY_WINDOW_DURATION_MINUTES,
-    WINDOWS_OS_NAME,
-    WINDOWS_TASKKILL_COMMAND,
-    WINDOWS_TASKKILL_TREE_FLAG,
 )
 
 PROBE_PATH = SCRIPTS_DIRECTORY / "codex_usage_probe.py"
@@ -300,58 +297,66 @@ class TestParseTextStatus:
 
 
 class TestProcessTreeTeardown:
-    def should_run_taskkill_tree_when_os_name_is_windows(
-        self,
-        monkeypatch: pytest.MonkeyPatch,
-    ) -> None:
+    def should_end_a_running_app_server_and_reap_it(self) -> None:
+        """A real sleeping child is gone once teardown returns, on any platform."""
         probe = load_probe_module()
-        all_taskkill_commands: list[list[str]] = []
-        fake_process = subprocess.Popen(
+        sleeping_process = subprocess.Popen(
             [sys.executable, "-c", "import time; time.sleep(30)"],
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
+            start_new_session=probe.should_start_new_session(),
         )
         try:
-            monkeypatch.setattr(probe.os, "name", WINDOWS_OS_NAME)
-
-            def capture_run(
-                command: list[str],
-                **_kwargs: object,
-            ) -> subprocess.CompletedProcess[str]:
-                all_taskkill_commands.append(list(command))
-                fake_process.kill()
-                fake_process.wait(timeout=PROCESS_TREE_WAIT_SECONDS)
-                return subprocess.CompletedProcess(command, 0)
-
-            monkeypatch.setattr(probe.subprocess, "run", capture_run)
-            probe._terminate_process_tree(fake_process)
+            probe._terminate_process_tree(sleeping_process)
+            assert sleeping_process.poll() is not None
         finally:
-            if fake_process.poll() is None:
-                fake_process.kill()
-                fake_process.wait(timeout=PROCESS_TREE_WAIT_SECONDS)
-        assert len(all_taskkill_commands) == 1
-        assert all_taskkill_commands[0][0] == WINDOWS_TASKKILL_COMMAND
-        assert WINDOWS_TASKKILL_TREE_FLAG in all_taskkill_commands[0]
-        assert str(fake_process.pid) in all_taskkill_commands[0]
-
-    def should_kill_process_directly_when_os_name_is_not_windows(
+            if sleeping_process.poll() is None:
+                sleeping_process.kill()
+                sleeping_process.wait(timeout=PROCESS_TREE_WAIT_SECONDS)
+
+    def should_hand_the_whole_tree_to_the_shared_kill(
         self,
         monkeypatch: pytest.MonkeyPatch,
     ) -> None:
+        """Teardown routes the server process through the shared tree kill.
+
+        ::
+
+            shared tree kill  ok:   the cmd.exe shim's app-server child dies too
+            Popen.kill()      flag: the app-server grandchild holds stdout open
+        """
         probe = load_probe_module()
-        fake_process = subprocess.Popen(
-            [sys.executable, "-c", "import time; time.sleep(30)"],
+        all_killed_processes: list[object] = []
+        finished_process = subprocess.Popen(
+            [sys.executable, "-c", ""],
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
         )
-        try:
-            monkeypatch.setattr(probe.os, "name", "posix")
-            probe._terminate_process_tree(fake_process)
-            assert fake_process.poll() is not None
-        finally:
-            if fake_process.poll() is None:
-                fake_process.kill()
-                fake_process.wait(timeout=PROCESS_TREE_WAIT_SECONDS)
+        finished_process.wait(timeout=PROCESS_TREE_WAIT_SECONDS)
+        monkeypatch.setattr(
+            probe,
+            "terminate_process_tree",
+            lambda target_process: all_killed_processes.append(target_process),
+        )
+
+        probe._terminate_process_tree(finished_process)
+
+        assert all_killed_processes == [finished_process]
+
+    def should_return_when_a_killed_child_never_reaps(
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+    ) -> None:
+        """A child that outlives its grace window ends teardown, never hangs it."""
+        probe = load_probe_module()
+
+        class _UnreapableProcess:
+            def wait(self, timeout: float | None = None) -> int:
+                raise subprocess.TimeoutExpired(cmd="codex", timeout=timeout or 0)
+
+        monkeypatch.setattr(probe, "terminate_process_tree", lambda _process: None)
+
+        probe._terminate_process_tree(_UnreapableProcess())
 
 
 class TestReaderThreadLifecycle:

package/skills/codex-review/scripts/test_run_codex_review.py

@@ -890,38 +890,6 @@ def test_run_command_kills_grandchild_tree_on_timeout_without_hanging(
     assert _wait_until_process_stops(grandchild_identifier, wall_clock_ceiling_seconds)
 
 
-def test_windows_process_tree_kill_builds_taskkill_argv(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """The Windows kill path issues taskkill /T /F /PID for the given process id."""
-    target_process_identifier = 4242
-    recorded_argv: list[list[str]] = []
-
-    def record_argv(all_arguments: list[str], **_keywords: object) -> None:
-        recorded_argv.append(all_arguments)
-
-    monkeypatch.setattr(wrapper.subprocess, "run", record_argv)
-    wrapper._kill_windows_process_tree(target_process_identifier)
-
-    assert recorded_argv == [
-        ["taskkill", "/T", "/F", "/PID", str(target_process_identifier)]
-    ]
-
-
-def test_windows_process_tree_kill_swallows_taskkill_timeout(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """A hung taskkill must not raise — caller falls back to Popen.kill + drain."""
-
-    def raise_taskkill_timeout(
-        _all_arguments: list[str], **_keywords: object
-    ) -> None:
-        raise subprocess.TimeoutExpired(cmd="taskkill", timeout=1)
-
-    monkeypatch.setattr(wrapper.subprocess, "run", raise_taskkill_timeout)
-    wrapper._kill_windows_process_tree(4242)
-
-
 def test_drain_joins_pipes_when_direct_kill_raises_process_lookup_error() -> None:
     """Even when the process is already gone, drain still joins pipe readers."""
     all_communicate_timeouts: list[float | None] = []
@@ -990,7 +958,7 @@ def test_run_command_surfaces_timeout_when_tree_kill_is_noop(
     def leave_process_alive(_review_process: object) -> None:
         return None
 
-    monkeypatch.setattr(wrapper, "_terminate_process_tree", leave_process_alive)
+    monkeypatch.setattr(wrapper, "terminate_process_tree", leave_process_alive)
     start_time = time.monotonic()
     with pytest.raises(subprocess.TimeoutExpired):
         wrapper._run_command(

package/skills/e-code-review/SKILL.md

@@ -13,11 +13,12 @@ description: >-
 
 ## Gotchas
 
-- **`low` stays single-pass.** Do not spawn subagents. One diff read, one findings pass.
+- **`low` stays single-pass.** No subagents, no full-file reads: one read pass per target item, one findings pass.
 - **`medium` favors precision, `xhigh` favors recall.** At `medium` (8 angles) surface only findings a maintainer would act on. At `xhigh` (10 angles plus a gap sweep) a single non-REFUTED vote carries the finding; do not drop on uncertainty.
-- **`--fix` applies findings once.** Load `reference/fix.md` and follow it — it owns the fix agent, the commit gate, skip logging, and outcome reporting.
-- **`loop` never asks.** After findings, fix nits or stop on bugs. Load `reference/loop.md` and follow it.
-- **`--fix` and `loop` combine.** With both, each loop round runs the level file, then `reference/fix.md`, then re-reviews.
+- **Every retained finding carries `severity` and `verdict`.** Severity is one of `blocker`, `high`, `medium`, `low`, `nit`. Verdict is `CONFIRMED` or `PLAUSIBLE`. Drop REFUTED candidates; never emit an unclassified retained finding.
+- **`--fix` applies findings once.** Load `reference/fix.md` and follow it — it owns the fix agent, the code-rules gate, skip logging, and outcome reporting. Commits are lead-owned; fix agents never commit or push.
+- **`loop` never asks.** A round with bug findings validates them with an advisor, fixes, and re-reviews. Terminals are exactly `clean`, `nits_fixed`, and `advisor_blocked`. There is no reviewed-head count limit; a new head increments the count once, a re-review of the same head does not. Load `reference/loop.md` and follow it.
+- **`--fix` and `loop` combine.** With both, each loop round runs the level file, and the round's fixing happens inside `reference/loop.md`'s gate sequence, which loads `reference/fix.md` for the mechanics. There is no separate fix pass around the round.
 
 ## When this skill applies
 
@@ -31,8 +32,8 @@ Triggers: `/e-code-review <level> [--fix] [loop]`. `<level>` is `low`, `medium`,
 
 1. Read `<level>` and the optional `--fix` and `loop` flags. Apply the refusal first.
 2. Load `reference/low.md`, `reference/medium.md`, or `reference/xhigh.md`. Run that file as one review cycle, ending in its structured findings report.
-3. If `--fix` is set, load `reference/fix.md` and apply it to that cycle's findings.
-4. If `loop` is set, load `reference/loop.md` and follow it. Each round re-runs the same level file from step 2, plus step 3 when `--fix` is set.
+3. If `--fix` is set and `loop` is not set, load `reference/fix.md` and apply it to that cycle's findings. This path has no commit step: the fixes stay uncommitted in the working tree for the user to review and commit.
+4. If `loop` is set, load `reference/loop.md` and follow it with that cycle's findings still unfixed. Round 1's findings are the ones step 2 already produced; from the second round on, the round re-runs that same level file end to end. End to end means the level file's review phases, up to and including its findings report — not its *Looping* section, which hands control to `loop.md` and would re-enter the loop the round is already inside. `loop.md`'s gate sequence owns when the round fixes.
 5. Without `--fix` or `loop`, return the cycle findings and stop.
 
 ## File index
@@ -40,10 +41,10 @@ Triggers: `/e-code-review <level> [--fix] [loop]`. `<level>` is `low`, `medium`,
 | File | Purpose |
 |---|---|
 | `SKILL.md` | Route by level; dispatch `--fix` and `loop` |
-| `reference/low.md` | low review procedure — 1 diff pass, no verify |
+| `reference/low.md` | low review procedure — 1 diff pass per target item, no verify |
 | `reference/medium.md` | medium review procedure — 8 angles, 1-vote verify |
 | `reference/xhigh.md` | xhigh review procedure — 10 angles, 1-vote verify, gap sweep |
-| `reference/fix.md` | Fix application, commit gate, skip logging, outcome reporting |
+| `reference/fix.md` | Fix application, code-rules gate, skip logging, outcome reporting |
 | `reference/loop.md` | Repeat review/fix rounds until clean |
 
 ## Folder map

package/skills/e-code-review/reference/fix.md

@@ -12,16 +12,38 @@ At `low` — and any time the Agent tool is unavailable — no finder agent exis
 to resume. Apply the fixes yourself, sequentially, in this context, holding to
 every rule below.
 
-## Commit gate
+## Code-rules gate
 
-Before returning, the resumed agent attempts a commit on its own change:
+Before returning, the resumed agent runs the code-rules gate with the same bare
+call every other surface in this skill uses:
 
 1. Run `~/.claude/_shared/pr-loop/scripts/code_rules_gate.py --repo-root <repo
-   root> <changed/added files>` against every file it changed or added.
-2. If the gate reports violations, fix them and re-run the exact same command.
-3. Repeat until the gate returns clean.
-4. Only after a clean gate result does the agent return control and report
-   its outcome.
+   root>` with no file paths and no `--only-under` prefix.
+2. If the gate reports violations **on lines this fix already owns** (the files
+   and added lines the fix changed), fix them and re-run the exact same command.
+3. A violation on a path or added line outside this fix's own work is reported
+   or skipped — it is not force-fixed into unrelated files. Log each skip with
+   the path and reason, then continue.
+4. Repeat until every violation on this fix's own work is clean (or skipped with
+   a logged reason for out-of-scope hits).
+5. Only after that result does the agent return control and report its outcome.
+
+A file path named on the command line puts the gate in whole-file scope and can
+churn on untouched lines; keep the call bare.
+
+This gate commits nothing. The fix lands in the working tree and stays
+uncommitted. **Commit ownership is lead-only:** a fix agent, patch worker, or
+resumed finding agent never runs `git commit` or `git push`. The lead that owns
+the branch creates the commit after gates pass. The bare code-rules call covers
+the merge-base surface and staged added lines only — working-tree-only lines
+enter that scope after the lead stages or commits them.
+
+Under a bare `--fix` — this document invoked without `loop` — nothing
+downstream commits either, and that is the intended outcome: a one-shot fix
+pass leaves its fixes uncommitted in the working tree for the lead to review
+and commit (stage first if you re-run the gate on those lines). Under `loop`,
+the round tail in `reference\loop.md` stages and runs required checks; the lead
+still owns the commit and push.
 
 ## Skip candidates