claude-dev-env 7.0.0 → 7.1.0

package/hooks/blocking/test_shared_stdin_adoption.py

@@ -34,11 +34,7 @@ from test_hook_subprocess_support import (  # noqa: E402
     run_hook_as_subprocess,
 )
 
-ALL_CONVERTED_HOOK_FILENAMES = (
-    "open_questions_in_plans_blocker.py",
-    "claude_md_orphan_file_blocker.py",
-    "package_inventory_stale_blocker.py",
-)
+ALL_CONVERTED_HOOK_FILENAMES = ("open_questions_in_plans_blocker.py",)
 
 EMPTY_STDIN_PAYLOAD = ""
 WHITESPACE_STDIN_PAYLOAD = "   \n\t  "
@@ -126,48 +122,6 @@ def test_open_questions_blocker_still_allows_plan_without_open_questions(
     assert _decision_from_stdout(completed) is None
 
 
-def test_package_inventory_blocker_still_denies_uninventoried_new_file(
-    tmp_path: Path,
-) -> None:
-    inventory_body = "# package\n\n| File | Role |\n|---|---|\n| `alpha.py` | A |\n| `beta.py` | B |\n"
-    (tmp_path / "README.md").write_text(inventory_body, encoding="utf-8")
-    (tmp_path / "alpha.py").write_text("x = 1\n", encoding="utf-8")
-    (tmp_path / "beta.py").write_text("x = 1\n", encoding="utf-8")
-    new_file_path = tmp_path / "gamma.py"
-    payload = json.dumps(
-        {
-            "tool_name": "Write",
-            "tool_input": {"file_path": str(new_file_path), "content": "x = 1\n"},
-        }
-    )
-    completed = _run_hook_script("package_inventory_stale_blocker.py", payload, tmp_path)
-    assert completed.returncode == 0, completed.stderr
-    assert _decision_from_stdout(completed) == "deny"
-    assert_hook_deny_log_contains(tmp_path, "package_inventory_stale_blocker.py")
-
-
-def test_package_inventory_blocker_still_allows_inventoried_new_file(
-    tmp_path: Path,
-) -> None:
-    inventory_body = (
-        "# package\n\n| File | Role |\n|---|---|\n"
-        "| `alpha.py` | A |\n| `beta.py` | B |\n| `gamma.py` | G |\n"
-    )
-    (tmp_path / "README.md").write_text(inventory_body, encoding="utf-8")
-    (tmp_path / "alpha.py").write_text("x = 1\n", encoding="utf-8")
-    (tmp_path / "beta.py").write_text("x = 1\n", encoding="utf-8")
-    new_file_path = tmp_path / "gamma.py"
-    payload = json.dumps(
-        {
-            "tool_name": "Write",
-            "tool_input": {"file_path": str(new_file_path), "content": "x = 1\n"},
-        }
-    )
-    completed = _run_hook_script("package_inventory_stale_blocker.py", payload, tmp_path)
-    assert completed.returncode == 0, completed.stderr
-    assert _decision_from_stdout(completed) is None
-
-
 def test_converted_hooks_allow_unrelated_tool_name(tmp_path: Path) -> None:
     payload = json.dumps({"tool_name": "Bash", "tool_input": {"command": "ls"}})
     for each_hook_filename in ALL_CONVERTED_HOOK_FILENAMES:

package/hooks/git-hooks/git_hooks_constants/verification_notice_constants.py

@@ -0,0 +1,116 @@
+from __future__ import annotations
+
+NOTICE_EVENT_COMMIT: str = "commit"
+NOTICE_EVENT_PUSH: str = "push"
+ALL_NOTICE_EVENTS: frozenset[str] = frozenset({NOTICE_EVENT_COMMIT, NOTICE_EVENT_PUSH})
+TARGET_REPOSITORY_REMOTE: str = "jonecho/python-automation"
+GIT_CONFIG_SUBCOMMAND: str = "config"
+GIT_REV_PARSE_SUBCOMMAND: str = "rev-parse"
+ALL_GIT_REMOTE_URL_QUERY: tuple[str, ...] = (GIT_CONFIG_SUBCOMMAND, "--get", "remote.origin.url")
+ALL_GIT_REPOSITORY_ROOT_QUERY: tuple[str, ...] = (GIT_REV_PARSE_SUBCOMMAND, "--show-toplevel")
+ALL_GIT_HEAD_QUERY: tuple[str, ...] = (GIT_REV_PARSE_SUBCOMMAND, "--verify", "HEAD")
+ALL_GIT_ABSOLUTE_DIRECTORY_QUERY: tuple[str, ...] = (
+    GIT_REV_PARSE_SUBCOMMAND,
+    "--absolute-git-dir",
+)
+GIT_COMMAND_SUCCESS_EXIT_CODE: int = 0
+LOCAL_VERIFICATION_DIRECTORY_NAME: str = "local-verification"
+MANIFEST_DIRECTORY_NAME: str = "config"
+MANIFEST_FILE_NAME: str = "local-verification.json"
+REPORT_FILE_NAME: str = "report.json"
+GIT_DIRECTORY_NAME: str = ".git"
+REPOSITORY_ARGUMENT: str = "--repo"
+BASE_ARGUMENT: str = "--base"
+BASE_REFERENCE: str = "origin/main"
+OUTPUT_ARGUMENT: str = "--output"
+PYTHON_COMMAND: str = "python"
+SCOPED_VERIFICATION_SCRIPT_PATH: str = ".github/ci/local_verify.py"
+EXECUTOR_ARGUMENT: str = "--executor"
+EXECUTOR_DIRECTORY_NAME: str = "scripts"
+LOCAL_VERIFICATION_PACKAGE_DIRECTORY_NAME: str = "local_verification"
+EXECUTOR_FILE_NAME: str = "cli.py"
+PACKAGE_ROOT_PARENT_INDEX: int = 2
+POWERSHELL_QUOTE: str = "'"
+POWERSHELL_ESCAPED_QUOTE: str = "''"
+NOTICE_HEADER: str = "=== LOCAL VERIFICATION ADVISORY ==="
+UNKNOWN_SHA: str = "unknown"
+NO_VERIFIED_SHA: str = "none"
+STATUS_PENDING: str = "pending"
+STATUS_UNVERIFIED: str = "unverified"
+STATUS_STALE: str = "stale"
+STATUS_FAILED: str = "failed"
+STATUS_PASSED: str = "passed"
+MINIMUM_REMOTE_PART_COUNT: int = 2
+OWNER_PART_INDEX: int = -2
+REPOSITORY_PART_INDEX: int = -1
+REPORT_HEAD_FIELD: str = "head"
+REPORT_BASE_FIELD: str = "base"
+REPORT_MANIFEST_DIGEST_FIELD: str = "manifest_digest"
+REPORT_STATUS_FIELD: str = "status"
+REPORT_AGGREGATE_FIELD: str = "aggregate"
+REPORT_TOTAL_FIELD: str = "total"
+REPORT_PASSED_FIELD: str = "passed"
+REPORT_FAILED_FIELD: str = "failed"
+REPORT_INCOMPLETE_FIELD: str = "incomplete"
+REPORT_EXIT_CODE_FIELD: str = "exit_code"
+REPORT_WORKTREE_CLEAN_FIELD: str = "worktree_clean"
+REPORT_INPUTS_UNCHANGED_FIELD: str = "inputs_unchanged"
+REPORT_PUBLISHABLE_FIELD: str = "publishable"
+RESOLVED_SHA_LENGTH: int = 40
+HEX_DIGITS: str = "0123456789abcdef"
+JSON_ENCODING: str = "utf-8"
+SHA256_ALGORITHM: str = "sha256"
+NOTICE_LINE_SEPARATOR: str = "\n"
+NOTICE_ADVISORY_LINE: str = "Advisory only. This notice does not block commit or push."
+NOTICE_SETUP_PENDING_LINE: str = "Setup status: pending. The manifest is missing or unreadable."
+NOTICE_NO_PASS_LINE: str = (
+    "Do not carry local-checks:passed to this revision. No complete current pass is recorded."
+)
+NOTICE_STALE_LINE: str = "Existing verification evidence belongs to another SHA. Do not carry local-checks:passed forward."
+NOTICE_FAILED_LINE: str = "The recorded local checks failed. This advisory does not block commit or push. Fix the failure before reporting a pass."
+NOTICE_PASSED_LINE: str = (
+    "local-checks:passed is valid only for this exact current SHA and manifest."
+)
+NOTICE_RUN_LINE: str = "Run the complete local checks with this canonical command:"
+PROTECTED_BRANCH_PUSH_ADVISORY_MESSAGE: str = (
+    "Advisory: push would send local branch {local_branch!r} to protected remote "
+    "branch {remote_branch!r}. The native hook permits the push."
+)
+MANIFEST_VERSION_KEY: str = "version"
+MANIFEST_CHECKS_KEY: str = "checks"
+MANIFEST_EXCLUSIONS_KEY: str = "exclusions"
+CHECK_ID_KEY: str = "id"
+CHECK_ARGUMENTS_KEY: str = "argv"
+CHECK_DIRECTORY_KEY: str = "cwd"
+CHECK_TIMEOUT_KEY: str = "timeout_seconds"
+CHECK_MINIMUM_TESTS_KEY: str = "minimum_tests"
+EXCLUSION_SELECTOR_KEY: str = "selector"
+EXCLUSION_REASON_KEY: str = "reason"
+ALL_MANIFEST_DIGEST_SEPARATORS: tuple[str, str] = (",", ":")
+WINDOWS_DIRECTORY_SEPARATOR: str = "\\"
+POSIX_DIRECTORY_SEPARATOR: str = "/"
+PARENT_DIRECTORY_NAME: str = ".."
+ALL_GIT_STATUS_QUERY: tuple[str, ...] = (
+    "status",
+    "--porcelain=v1",
+    "--untracked-files=all",
+)
+ALL_GIT_BASE_QUERY_PREFIX: tuple[str, ...] = ("rev-parse", "--verify")
+GIT_COMMIT_OBJECT_SUFFIX: str = "^{commit}"
+SELECTION_FIELD: str = "selection"
+SELECTED_MANIFEST_PATH_FIELD: str = "selected_manifest_path"
+COMMAND_SEPARATOR: str = " "
+RUNNER_FILE_NAME: str = "runner.json"
+RUNNER_PYTHON_FIELD: str = "python"
+RUNNER_SETTINGS_FIELD: str = "settings"
+ALL_RUNNER_FIELDS: frozenset[str] = frozenset(
+    {
+        RUNNER_PYTHON_FIELD,
+        RUNNER_SETTINGS_FIELD,
+    }
+)
+AUTOMATIC_ADVISORY_DIRECTORY_NAME: str = "automatic_advisory"
+AUTOMATIC_ADVISORY_CLI_FILE_NAME: str = "cli.py"
+WINDOWS_PLATFORM: str = "win32"
+CREATE_NO_WINDOW_ATTRIBUTE: str = "CREATE_NO_WINDOW"
+POWERSHELL_CALL_OPERATOR: str = "& "

package/hooks/git-hooks/post_commit.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+"""Show the local verification reminder after a native Git commit."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+from verification_notice import main as verification_notice_main
+from git_hooks_constants.verification_notice_constants import (
+    NOTICE_EVENT_COMMIT,
+    REPOSITORY_ARGUMENT,
+)
+
+
+def main() -> int:
+    try:
+        verification_notice_main(
+            [
+                "--event",
+                NOTICE_EVENT_COMMIT,
+                REPOSITORY_ARGUMENT,
+                str(Path.cwd()),
+            ],
+            stdout=sys.stdout,
+        )
+        return 0
+    except (OSError, UnicodeError, ValueError):
+        return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/hooks/git-hooks/pre_commit.py

@@ -1,106 +1,34 @@
 #!/usr/bin/env python3
-"""Run staged policy lint, then the existing staged CODE_RULES gate.
-
-Git invokes this module through the installed native pre-commit shim. Policy
-lint reads the Git index, including GIT_INDEX_FILE when Git supplies an
-alternate index. The existing gate still covers checks whose replacement
-coverage is unproven.
-
-A missing linter, launch failure, or timeout is an infrastructure failure.
-Linter diagnostics and failed-rule statuses reach Git.
-"""
+"""Show the local verification reminder before a native Git commit."""
 
 from __future__ import annotations
 
-import subprocess
 import sys
 from pathlib import Path
 
-from gate_utils import is_safe_regular_file, resolve_gate_script_path
-from git_hooks_constants import (
-    GATE_INFRASTRUCTURE_FAILURE_EXIT_CODE,
-    GATE_SCRIPT_NOT_FOUND_MESSAGE,
-    IMMEDIATE_SCOPE_ARGUMENT,
-    INVOKE_GATE_FAILURE_MESSAGE,
-)
-from git_hooks_constants.staged_policy_lint import (
-    POLICY_LINT_FAILED_MESSAGE,
-    POLICY_LINT_INFRASTRUCTURE_EXIT_CODE,
-    POLICY_LINT_PACKAGE_PARENT_INDEX,
-    POLICY_LINT_SCRIPT_RELATIVE_PATH,
-    POLICY_LINT_STAGED_ARGUMENT,
-    POLICY_LINT_TIMEOUT_SECONDS,
-    POLICY_LINT_UNAVAILABLE_MESSAGE,
+from verification_notice import main as verification_notice_main
+from git_hooks_constants.verification_notice_constants import (
+    NOTICE_EVENT_COMMIT,
+    REPOSITORY_ARGUMENT,
 )
 
 
-def resolve_policy_lint_script_path() -> Path:
-    """Return the policy-linter entry point in this package or managed home."""
-    package_root = Path(__file__).resolve().parents[POLICY_LINT_PACKAGE_PARENT_INDEX]
-    return package_root / POLICY_LINT_SCRIPT_RELATIVE_PATH
-
-
-def run_staged_policy_lint() -> int:
-    """Run the staged linter with Git's environment and working directory.
-
-    Returns:
-        The linter status, or the infrastructure status when it cannot run.
-    """
-    try:
-        script_path = resolve_policy_lint_script_path()
-        if not script_path.is_file():
-            sys.stderr.write(POLICY_LINT_UNAVAILABLE_MESSAGE + "\n")
-            return POLICY_LINT_INFRASTRUCTURE_EXIT_CODE
-        completion = subprocess.run(
-            [sys.executable, str(script_path.resolve(strict=True)), POLICY_LINT_STAGED_ARGUMENT],
-            check=False,
-            timeout=POLICY_LINT_TIMEOUT_SECONDS,
-        )
-    except (OSError, subprocess.TimeoutExpired) as launch_error:
-        sys.stderr.write(POLICY_LINT_FAILED_MESSAGE.format(error=launch_error) + "\n")
-        return POLICY_LINT_INFRASTRUCTURE_EXIT_CODE
-    return completion.returncode
-
-
-def invoke_gate(gate_script_path: Path) -> int:
-    """Invoke the shared staged gate and return its exit code."""
-    immediate_scope_argument = IMMEDIATE_SCOPE_ARGUMENT
-    invoke_gate_failure_message = INVOKE_GATE_FAILURE_MESSAGE
-    gate_infrastructure_failure_exit_code = GATE_INFRASTRUCTURE_FAILURE_EXIT_CODE
-    try:
-        resolved_gate_path = gate_script_path.resolve(strict=True)
-        completion = subprocess.run(
-            [sys.executable, str(resolved_gate_path), immediate_scope_argument],
-            check=False,
-        )
-    except OSError as launch_error:
-        print(
-            invoke_gate_failure_message.format(error=launch_error),
-            file=sys.stderr,
-        )
-        return gate_infrastructure_failure_exit_code
-    return completion.returncode
-
-
 def main() -> int:
-    """Run local staged policy lint before the existing native commit checks.
-
-    Returns:
-        The first failing check's status, or zero when the checks pass.
-    """
-    lint_exit_code = run_staged_policy_lint()
-    if lint_exit_code != 0:
-        return lint_exit_code
-    gate_script_not_found_message = GATE_SCRIPT_NOT_FOUND_MESSAGE
-    gate_script_path, exact_allowed_path = resolve_gate_script_path()
-    if not is_safe_regular_file(gate_script_path, exact_allowed_path):
-        print(
-            gate_script_not_found_message.format(path=gate_script_path),
-            file=sys.stderr,
+    try:
+        verification_notice_main(
+            [
+                "--event",
+                NOTICE_EVENT_COMMIT,
+                "--notice-only",
+                REPOSITORY_ARGUMENT,
+                str(Path.cwd()),
+            ],
+            stdout=sys.stdout,
         )
         return 0
-    return invoke_gate(gate_script_path)
+    except (OSError, UnicodeError, ValueError):
+        return 0
 
 
 if __name__ == "__main__":
-    sys.exit(main())
+    raise SystemExit(main())