claude-dev-env 4.1.0 → 4.3.0

package/hooks/blocking/gh_pr_author_restore.py

@@ -1,105 +0,0 @@
-#!/usr/bin/env python3
-"""PostToolUse hook: restore the prior gh CLI account after `gh pr create` runs.
-
-Companion to ``gh_pr_author_enforcer.py``. When the PreToolUse enforcer
-silently swaps the active gh account to ``GITHUB_DEFAULT_ACCOUNT`` and
-records the original account in a per-session state file, this hook
-reads that state file after the matching Bash invocation finishes and
-runs ``gh auth switch --user <original>`` to put the prior account back
-in place.
-
-The state file is deleted only when the restore switch succeeds. If
-``gh auth switch`` fails the state file is left in place so the
-SessionStart cleanup hook (``gh_pr_author_session_cleanup.py``) can
-retry on the next session start instead of stranding the user on the
-canonical author account.
-
-Behavior:
-- No-op when tool_name is not Bash.
-- No-op when the command did not invoke ``gh pr create`` (uses the same
-  regex as the enforcer so the pair stays in sync).
-- No-op when no per-session state file exists — means the enforcer
-  never swapped on this command.
-- Otherwise reads the state file, runs ``gh auth switch --user <original>``,
-  and deletes the state file only when the switch succeeded. Failures
-  are logged to stderr; this hook never blocks the workflow.
-"""
-
-from __future__ import annotations
-
-import json
-import sys
-from pathlib import Path
-
-hooks_parent_directory = str(Path(__file__).resolve().parent.parent)
-if hooks_parent_directory not in sys.path:
-    sys.path.insert(0, hooks_parent_directory)
-
-from _gh_pr_author_swap_utils import (  # noqa: E402
-    _build_restore_failure_message,
-    _command_invokes_gh_pr_create_in_stripped,
-    _delete_state_file,
-    _preprocess_command_for_matching,
-    _read_original_account,
-    _state_file_is_attacker_planted,
-    _state_file_path,
-    _switch_gh_account,
-    _write_line,
-)
-from hooks_constants.gh_pr_author_swap_constants import BASH_TOOL_NAME  # noqa: E402
-
-
-def main() -> None:
-    """Read PostToolUse hook input on stdin and restore the prior gh account.
-
-    Exits 0 in every path. Errors are logged to stderr only — this hook
-    must never block subsequent commands.
-    """
-    try:
-        hook_input = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        sys.exit(0)
-
-    if hook_input.get("tool_name") != BASH_TOOL_NAME:
-        sys.exit(0)
-
-    command = hook_input.get("tool_input", {}).get("command", "")
-    if not command:
-        sys.exit(0)
-    preprocessed_command = _preprocess_command_for_matching(command)
-    if not _command_invokes_gh_pr_create_in_stripped(preprocessed_command):
-        sys.exit(0)
-
-    session_id = str(hook_input.get("session_id") or "")
-    state_file = _state_file_path(session_id)
-    if _state_file_is_attacker_planted(state_file):
-        _write_line(
-            f"[gh-pr-author-restore] state file at {state_file} has unexpected mode/owner; "
-            f"skipping restore and preserving file for inspection",
-            sys.stderr,
-        )
-        sys.exit(0)
-    original_account = _read_original_account(state_file)
-    if original_account is None:
-        if state_file.exists():
-            _delete_state_file(state_file)
-        sys.exit(0)
-
-    has_restored_account = _switch_gh_account(original_account)
-    if has_restored_account:
-        _delete_state_file(state_file)
-    else:
-        _write_line(
-            _build_restore_failure_message(
-                "gh-pr-author-restore",
-                original_account,
-                state_file,
-                "state file",
-            ),
-            sys.stderr,
-        )
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()

package/hooks/blocking/pr_description_writer_gate.py

@@ -1,256 +0,0 @@
-#!/usr/bin/env python3
-"""PreToolUse hook: block gh pr create when no pr-description-writer spawn is recorded.
-
-Picture a reviewer opening a fresh pull request and meeting a body that repeats
-the branch name. The ``pr-description-writer`` agent exists to write that body
-from the diff, and the spawn tracker records each time this session runs it.
-
-This gate reads that record when the session runs ``gh pr create``::
-
-    gh pr create --body-file body.md            flag: no spawn recorded
-    gh pr create --body-file body.md            ok:   a spawn recorded earlier
-    gh pr create ... # pr-description-skip      ok:   the author opted out
-
-Detection strategy: tokenize the command, then check each position that opens a
-command segment for a ``gh`` executable followed by ``pr`` and ``create``. The
-bypass marker counts only as the command's final tokens, so the same text
-inside a quoted title leaves the gate running.
-
-The gate fails OPEN on anything it cannot read: a command that will not
-tokenize, a payload that is not a shell tool, or a missing command. Only a
-recognized ``gh pr create`` with no recorded spawn and no bypass marker denies.
-"""
-
-from __future__ import annotations
-
-import json
-import shlex
-import sys
-from pathlib import Path
-
-_blocking_dir = str(Path(__file__).resolve().parent)
-if _blocking_dir not in sys.path:
-    sys.path.insert(0, _blocking_dir)
-
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-from hooks_constants.bash_pre_tool_use_dispatcher_constants import (  # noqa: E402
-    ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
-)
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.pre_tool_use_stdin import (  # noqa: E402
-    read_hook_input_dictionary_from_stdin,
-)
-from hooks_constants.pr_description_writer_gate_constants import (  # noqa: E402
-    ALL_GH_EXECUTABLE_BASENAMES,
-    COMMAND_FIELD_NAME,
-    CORRECTIVE_MESSAGE,
-    CREATE_SUBCOMMAND_TOKEN,
-    GH_PR_CREATE_MINIMUM_TOKEN_COUNT,
-    PR_SUBCOMMAND_TOKEN,
-    SPAWN_BYPASS_MARKER,
-    TOOL_INPUT_FIELD_NAME,
-    TOOL_NAME_FIELD_NAME,
-    spawn_marker_path,
-)
-from hooks_constants.session_edit_stage_gate_constants import (  # noqa: E402
-    ALL_COMMAND_SEPARATOR_TOKENS,
-)
-from sensitive_file_protector import build_deny_response  # noqa: E402
-
-
-def _all_command_tokens(shell_command: str) -> list[str] | None:
-    """Return the command's tokens, or None when it will not tokenize.
-
-    Args:
-        shell_command: The raw shell command string.
-
-    Returns:
-        The token list, or None when shlex rejects the command.
-    """
-    try:
-        return shlex.split(shell_command, posix=True)
-    except ValueError:
-        return None
-
-
-def _carries_trailing_bypass_marker(all_tokens: list[str]) -> bool:
-    """Report whether the bypass marker sits at the very end of the command.
-
-    The marker opts out only as a trailing shell comment the author adds on
-    purpose, so its parts are the command's final tokens. The same text inside
-    a quoted title tokenizes into the middle of the list and does not match.
-
-    Args:
-        all_tokens: The tokens of the whole command.
-
-    Returns:
-        True when the marker's tokens close the command.
-    """
-    all_marker_tokens = SPAWN_BYPASS_MARKER.split()
-    marker_length = len(all_marker_tokens)
-    if marker_length > len(all_tokens):
-        return False
-    return all_tokens[-marker_length:] == all_marker_tokens
-
-
-def _opens_pull_request_creation(all_leading_tokens: list[str]) -> bool:
-    """Report whether these leading tokens open a gh pr create invocation.
-
-    Args:
-        all_leading_tokens: The tokens that open one command segment.
-
-    Returns:
-        True when they name a gh executable, then ``pr``, then ``create``.
-    """
-    if len(all_leading_tokens) < GH_PR_CREATE_MINIMUM_TOKEN_COUNT:
-        return False
-    executable_basename = Path(all_leading_tokens[0]).name
-    if executable_basename not in ALL_GH_EXECUTABLE_BASENAMES:
-        return False
-    return all_leading_tokens[1:] == [PR_SUBCOMMAND_TOKEN, CREATE_SUBCOMMAND_TOKEN]
-
-
-def _all_command_segments(all_tokens: list[str]) -> list[list[str]]:
-    """Return the command's token segments in their original order.
-
-    A shell separator ends the current segment and starts the next one.
-
-    Args:
-        all_tokens: The tokens of the whole command.
-
-    Returns:
-        One token list for each command segment.
-    """
-    all_segments: list[list[str]] = [[]]
-    for each_token in all_tokens:
-        if each_token in ALL_COMMAND_SEPARATOR_TOKENS:
-            all_segments.append([])
-            continue
-        all_segments[-1].append(each_token)
-    return all_segments
-
-
-def _all_pull_request_creation_segment_indexes(all_segments: list[list[str]]) -> list[int]:
-    """Return indexes for segments that open a gh pr create command.
-
-    Args:
-        all_segments: The shell command's token segments.
-
-    Returns:
-        The indexes of segments that open a gh pr create command.
-    """
-    return [
-        each_index
-        for each_index, each_segment in enumerate(all_segments)
-        if _opens_pull_request_creation(each_segment[:GH_PR_CREATE_MINIMUM_TOKEN_COUNT])
-    ]
-
-
-def _only_final_create_carries_bypass(
-    all_tokens: list[str],
-    all_segments: list[list[str]],
-    all_creation_segment_indexes: list[int],
-) -> bool:
-    """Report whether one final gh pr create carries the final bypass comment.
-
-    The marker belongs to the command segment that creates the pull request.
-    A marker after another command, or after a second create, cannot opt an
-    earlier create out.
-
-    Args:
-        all_tokens: The tokens of the whole command.
-        all_segments: The command's token segments, already split by the caller.
-        all_creation_segment_indexes: Indexes of segments that create pull requests.
-
-    Returns:
-        True when one final create segment carries the final bypass marker.
-    """
-    if not _carries_trailing_bypass_marker(all_tokens):
-        return False
-    final_segment_index = len(all_segments) - 1
-    return all_creation_segment_indexes == [final_segment_index]
-
-
-def _spawn_is_recorded(session_id: str) -> bool:
-    """Report whether this session recorded a pr-description-writer spawn.
-
-    A payload naming no session reads as no record, so the gate denies rather
-    than falling back to a shared marker a different session could have left.
-
-    Args:
-        session_id: Raw ``session_id`` from the hook payload.
-
-    Returns:
-        True when this session's marker file is present.
-    """
-    marker_file = spawn_marker_path(session_id)
-    return marker_file is not None and marker_file.exists()
-
-
-def _shell_command_or_none(all_hook_payload: dict[str, object]) -> str | None:
-    """Return the shell command this payload carries, or None.
-
-    Args:
-        all_hook_payload: The parsed PreToolUse payload.
-
-    Returns:
-        The command string, or None when the payload runs no shell command.
-    """
-    if all_hook_payload.get(TOOL_NAME_FIELD_NAME, "") not in ALL_BASH_AND_POWERSHELL_TOOL_NAMES:
-        return None
-    tool_input = all_hook_payload.get(TOOL_INPUT_FIELD_NAME, {})
-    if not isinstance(tool_input, dict):
-        return None
-    shell_command = tool_input.get(COMMAND_FIELD_NAME, "")
-    if not isinstance(shell_command, str) or not shell_command:
-        return None
-    return shell_command
-
-
-def _emit_denial() -> None:
-    """Write the PreToolUse deny payload to stdout and log the block."""
-    log_hook_block(
-        calling_hook_name="pr_description_writer_gate.py",
-        hook_event="PreToolUse",
-        block_reason=CORRECTIVE_MESSAGE,
-    )
-    sys.stdout.write(json.dumps(build_deny_response(CORRECTIVE_MESSAGE)) + "\n")
-    sys.stdout.flush()
-
-
-def main() -> None:
-    """Deny a gh pr create that no recorded agent spawn or bypass marker covers.
-
-    Reads the PreToolUse payload from stdin and exits zero on every branch. A
-    tool that runs no shell, a missing command, a command that will not
-    tokenize, a command opening no pull request, a trailing bypass marker, and
-    a recorded spawn each pass through untouched.
-    """
-    hook_payload = read_hook_input_dictionary_from_stdin()
-    if hook_payload is None:
-        sys.exit(0)
-    shell_command = _shell_command_or_none(hook_payload)
-    if shell_command is None:
-        sys.exit(0)
-    all_tokens = _all_command_tokens(shell_command)
-    if all_tokens is None:
-        sys.exit(0)
-    all_segments = _all_command_segments(all_tokens)
-    all_creation_segment_indexes = _all_pull_request_creation_segment_indexes(all_segments)
-    if not all_creation_segment_indexes:
-        sys.exit(0)
-    if _only_final_create_carries_bypass(
-        all_tokens, all_segments, all_creation_segment_indexes
-    ):
-        sys.exit(0)
-    if _spawn_is_recorded(str(hook_payload.get("session_id") or "")):
-        sys.exit(0)
-    _emit_denial()
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()