claude-dev-env 7.0.0 → 7.2.0

package/scripts/codex_compat_materializer.py

@@ -615,7 +615,7 @@ def _resolved_codex_enforcer_command(config: MaterializerConfig) -> str:
 
 def _source_codex_enforcer_hook(
     all_source_manifest: dict[str, object], command: str
-) -> dict[str, object]:
+) -> dict[str, object] | None:
     """Read the source enforcer hook shape and resolve its target command."""
     all_events = all_source_manifest.get("hooks")
     if not isinstance(all_events, dict):
@@ -637,11 +637,7 @@ def _source_codex_enforcer_hook(
             resolved_hook = dict(each_hook)
             resolved_hook[codex_hook_command_field_name] = command
             return resolved_hook
-    return {
-        "type": "command",
-        codex_hook_command_field_name: command,
-        "timeout": codex_hook_timeout_seconds,
-    }
+    return None
 
 
 def _hook_records(raw_hooks: object) -> list[dict[str, object]]:
@@ -668,6 +664,72 @@ def _is_code_rules_enforcer_hook(all_hook_record: dict[str, object]) -> bool:
     )
 
 
+def _is_managed_codex_enforcer_hook(
+    all_hook_record: dict[str, object], managed_command: str
+) -> bool:
+    """Report whether a hook record is the materializer's target command."""
+    command = all_hook_record.get(codex_hook_command_field_name)
+    if not isinstance(command, str):
+        return False
+    normalized_command = command.replace("\\", path_separator)
+    normalized_managed_command = managed_command.replace("\\", path_separator)
+    if os.name == "nt":
+        return normalized_command.casefold() == normalized_managed_command.casefold()
+    return normalized_command == normalized_managed_command
+
+
+def _without_managed_codex_enforcer(
+    entry: object, managed_command: str
+) -> object | None:
+    """Remove the managed enforcer while preserving every other hook record."""
+    if not isinstance(entry, dict):
+        return entry
+    if entry.get("matcher") != codex_hook_matcher:
+        return entry
+    copied_entry = dict(entry)
+    all_hook_records = copied_entry.get(codex_hook_records_field_name)
+    if not isinstance(all_hook_records, list):
+        return copied_entry
+    all_retained_hooks = [
+        each_hook
+        for each_hook in all_hook_records
+        if not isinstance(each_hook, dict)
+        or not _is_managed_codex_enforcer_hook(each_hook, managed_command)
+    ]
+    if all_retained_hooks == all_hook_records:
+        return copied_entry
+    if not all_retained_hooks:
+        return None
+    copied_entry[codex_hook_records_field_name] = all_retained_hooks
+    return copied_entry
+
+
+def _remove_managed_codex_enforcer(
+    all_target_manifest: dict[str, object], managed_command: str
+) -> dict[str, object]:
+    """Remove the retired managed enforcer from the target manifest."""
+    all_events = all_target_manifest.get(codex_hook_records_field_name, {})
+    if not isinstance(all_events, dict):
+        raise MaterializerError("Codex hook manifest requires a hooks object")
+    all_pre_tool_use = all_events.get(codex_hook_event_name)
+    if all_pre_tool_use is None:
+        return _prune_retired_codex_hooks(all_target_manifest)
+    if not isinstance(all_pre_tool_use, list):
+        raise MaterializerError("Codex hook manifest requires a PreToolUse list")
+    all_retained_entries: list[object] = []
+    for each_entry in all_pre_tool_use:
+        maybe_retained_entry = _without_managed_codex_enforcer(
+            each_entry, managed_command
+        )
+        if maybe_retained_entry is not None:
+            all_retained_entries.append(maybe_retained_entry)
+    merged_events = dict(all_events)
+    merged_events[codex_hook_event_name] = all_retained_entries
+    merged_manifest = dict(all_target_manifest)
+    merged_manifest[codex_hook_records_field_name] = merged_events
+    return _prune_retired_codex_hooks(merged_manifest)
+
+
 def _is_retired_codex_hook_command(command: object) -> bool:
     """Report whether a command names a known retired hook path."""
     if not isinstance(command, str):
@@ -764,13 +826,20 @@ def _has_modified_codex_enforcer_hook(
     current_hooks = _codex_enforcer_hooks(current_manifest)
     if not current_hooks:
         return False
-    return current_hooks != _codex_enforcer_hooks(planned_manifest)
+    planned_hooks = _codex_enforcer_hooks(planned_manifest)
+    if all(each_hook in current_hooks for each_hook in planned_hooks):
+        return False
+    return current_hooks != planned_hooks
 
 
 def _merge_codex_hook_manifest(
-    all_target_manifest: dict[str, object], all_focused_hook: dict[str, object]
+    all_target_manifest: dict[str, object],
+    all_focused_hook: dict[str, object] | None,
+    managed_command: str,
 ) -> dict[str, object]:
     """Preserve target hook order while merging one deterministic enforcer entry."""
+    if all_focused_hook is None:
+        return _remove_managed_codex_enforcer(all_target_manifest, managed_command)
     all_events = all_target_manifest.get(codex_hook_records_field_name, {})
     if not isinstance(all_events, dict):
         raise MaterializerError("Codex hook manifest requires a hooks object")
@@ -797,13 +866,17 @@ def _merge_codex_hook_manifest(
         if merged_apply_patch_entry is None:
             merged_apply_patch_entry = copied_entry
             merged_hooks = [
-                each_hook for each_hook in all_hook_records if not _is_code_rules_enforcer_hook(each_hook)
+                each_hook
+                for each_hook in all_hook_records
+                if not _is_managed_codex_enforcer_hook(each_hook, managed_command)
             ]
             merged_apply_patch_entry[codex_hook_records_field_name] = merged_hooks
             merged_pre_tool_use.append(merged_apply_patch_entry)
         else:
             merged_hooks.extend(
-                each_hook for each_hook in all_hook_records if not _is_code_rules_enforcer_hook(each_hook)
+                each_hook
+                for each_hook in all_hook_records
+                if not _is_managed_codex_enforcer_hook(each_hook, managed_command)
             )
     if merged_apply_patch_entry is None:
         merged_apply_patch_entry = {
@@ -831,10 +904,11 @@ def _build_codex_hook_projection(config: MaterializerConfig) -> PlannedFile | No
         if target_path.is_file()
         else {"hooks": {}}
     )
-    focused_hook = _source_codex_enforcer_hook(
-        source_manifest, _resolved_codex_enforcer_command(config)
+    managed_command = _resolved_codex_enforcer_command(config)
+    focused_hook = _source_codex_enforcer_hook(source_manifest, managed_command)
+    projected_manifest = _merge_codex_hook_manifest(
+        target_manifest, focused_hook, managed_command
     )
-    projected_manifest = _merge_codex_hook_manifest(target_manifest, focused_hook)
     projected_content = json.dumps(projected_manifest, ensure_ascii=False, indent=manifest_indentation_width) + line_separator
     return PlannedFile(
         codex_hook_manifest_source_path,
@@ -849,6 +923,8 @@ def _build_codex_hook_dependency_projection(
     config: MaterializerConfig,
 ) -> list[PlannedFile]:
     """Build the reviewed source files required by the target enforcer."""
+    if not _has_source_codex_enforcer(config):
+        return []
     all_dependencies: list[PlannedFile] = []
     for each_relative_path in codex_hook_dependency_manifest:
         source_path = _validated_source_file(
@@ -871,6 +947,16 @@ def _build_codex_hook_dependency_projection(
     return all_dependencies
 
 
+def _has_source_codex_enforcer(config: MaterializerConfig) -> bool:
+    """Report whether hooks.json registers the enforcer."""
+    source_path = _find_codex_hook_source(config)
+    if source_path is None:
+        return False
+    source_manifest = _read_json_object(source_path, "source Codex hook manifest")
+    managed_command = _resolved_codex_enforcer_command(config)
+    return _source_codex_enforcer_hook(source_manifest, managed_command) is not None
+
+
 def discover_agents(config: MaterializerConfig) -> list[ClaudeAgent]:
     """Discover and parse Markdown agents below the source root.
 

package/scripts/durable_post_lint.py

@@ -16,6 +16,7 @@ from durable_post_lint_config.config.constants import (
     ALL_PATH_ANCHORED_VOLATILE_PATH_MARKERS,
     ALL_POST_ACTIONS,
     ALL_PR_DESCRIPTION_ACTIONS,
+    ALL_RELEASE_BODY_MARKERS,
     ALL_REQUIRED_PR_DESCRIPTION_HEADINGS,
     ALL_TITLE_ACTIONS,
     BODY_FILE_ENCODING,
@@ -35,6 +36,9 @@ from durable_post_lint_config.config.constants import (
     MISSING_HEADING_MESSAGE_TEMPLATE,
     PATH_ANCHOR_CHARACTER,
     PATH_SEGMENT_START_CHARACTERS,
+    RELEASE_BRANCH_PREFIX,
+    REWRITTEN_RELEASE_BODY_CODE,
+    REWRITTEN_RELEASE_BODY_MESSAGE,
     TITLE_NOT_ALLOWED_MESSAGE,
     TITLE_REQUIRED_MESSAGE,
     VOLATILE_PATH_CODE,
@@ -136,9 +140,25 @@ def _title_findings(title: str | None) -> list[DurablePostFinding]:
     return [DurablePostFinding(code=INVALID_TITLE_CODE, message=INVALID_TITLE_MESSAGE)]
 
 
+def _is_release_automation_branch(head_branch: str | None) -> bool:
+    return head_branch is not None and head_branch.startswith(RELEASE_BRANCH_PREFIX)
+
+
+def _release_body_findings(body_text: str) -> list[DurablePostFinding]:
+    if all(each_marker in body_text for each_marker in ALL_RELEASE_BODY_MARKERS):
+        return []
+    return [
+        DurablePostFinding(
+            code=REWRITTEN_RELEASE_BODY_CODE,
+            message=REWRITTEN_RELEASE_BODY_MESSAGE,
+        )
+    ]
+
+
 def _body_findings(
     action: str,
     body_text: str | None,
+    head_branch: str | None = None,
 ) -> list[DurablePostFinding]:
     if body_text is None:
         return []
@@ -150,7 +170,9 @@ def _body_findings(
                 message=BODY_MUST_NOT_BE_EMPTY_MESSAGE,
             )
         )
-    if action in ALL_PR_DESCRIPTION_ACTIONS:
+    if _is_release_automation_branch(head_branch):
+        all_findings.extend(_release_body_findings(body_text))
+    elif action in ALL_PR_DESCRIPTION_ACTIONS:
         all_findings.extend(_description_heading_findings(body_text))
     if find_volatile_path_marker(body_text) is not None:
         all_findings.append(
@@ -166,10 +188,14 @@ def lint_durable_post(
     action: str,
     title: str | None,
     body_text: str | None,
+    head_branch: str | None = None,
 ) -> tuple[DurablePostFinding, ...]:
     """Return content findings for one locally valid GitHub post request."""
     _validate_request_shape(action, title, body_text)
-    return (*_title_findings(title), *_body_findings(action, body_text))
+    return (
+        *_title_findings(title),
+        *_body_findings(action, body_text, head_branch),
+    )
 
 
 def _parse_arguments(all_arguments: Sequence[str]) -> argparse.Namespace:
@@ -177,6 +203,7 @@ def _parse_arguments(all_arguments: Sequence[str]) -> argparse.Namespace:
     parser.add_argument("--action", required=True)
     parser.add_argument("--title")
     parser.add_argument("--body-file", type=Path)
+    parser.add_argument("--head-branch")
     return parser.parse_args(list(all_arguments))
 
 
@@ -193,6 +220,7 @@ def main(all_arguments: Sequence[str]) -> int:
             action=arguments.action,
             title=arguments.title,
             body_text=body_text,
+            head_branch=arguments.head_branch,
         )
     except (DurablePostInputError, DurablePostUsageError) as error:
         sys.stderr.write(f"{error}\n")

package/scripts/durable_post_lint_config/config/constants.py

@@ -94,3 +94,13 @@ TITLE_NOT_ALLOWED_MESSAGE = "this action does not accept a title"
 TITLE_REQUIRED_MESSAGE = "pr-create requires a title"
 VOLATILE_PATH_CODE = "volatile-local-path"
 VOLATILE_PATH_MESSAGE = "body contains a volatile local artifact path"
+RELEASE_BRANCH_PREFIX = "release-please--branches--"
+ALL_RELEASE_BODY_MARKERS: tuple[str, ...] = (
+    ":robot: I have created a release",
+    "This PR was generated with [Release Please]",
+)
+REWRITTEN_RELEASE_BODY_CODE = "rewritten-release-body"
+REWRITTEN_RELEASE_BODY_MESSAGE = (
+    "release automation reads this body back to recognize its own merge; "
+    "keep the generated text whole"
+)

package/scripts/durable_post_lint_config/config/test_constants.py

@@ -3,7 +3,9 @@
 from durable_post_lint_config.config.constants import (
     ALL_CONVENTIONAL_TITLE_TYPES,
     ALL_POST_ACTIONS,
+    ALL_RELEASE_BODY_MARKERS,
     CONVENTIONAL_TITLE_PATTERN,
+    RELEASE_BRANCH_PREFIX,
 )
 
 
@@ -23,3 +25,14 @@ def test_action_inventory_covers_pull_request_issue_and_tool_posts() -> None:
 def test_title_pattern_uses_every_configured_type() -> None:
     for each_title_type in ALL_CONVENTIONAL_TITLE_TYPES:
         assert CONVENTIONAL_TITLE_PATTERN.fullmatch(f"{each_title_type}: one change")
+
+
+def should_carry_both_markers_release_automation_writes() -> None:
+    assert ALL_RELEASE_BODY_MARKERS == (
+        ":robot: I have created a release",
+        "This PR was generated with [Release Please]",
+    )
+
+
+def should_name_the_branch_prefix_release_automation_pushes() -> None:
+    assert RELEASE_BRANCH_PREFIX == "release-please--branches--"

package/scripts/local_report_cli.py

@@ -0,0 +1,184 @@
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass
+from pathlib import Path
+from typing import TextIO
+
+from local_report_core import PublicationOutcome, publish_local_report
+from local_verification.config import SUCCESS_EXIT_CODE
+from pr_verification.config.constants import GIT_BARE_SUFFIX, GITHUB_API_URL
+from pr_verification.github import GitHubAppAuthenticator, GitHubError
+from pr_verification.model import RepositorySettings
+
+
+def main(
+    all_arguments: Sequence[str],
+    *,
+    stdout: TextIO = sys.stdout,
+    stderr: TextIO = sys.stderr,
+) -> int:
+    """Publish one local verification report.
+
+    Args:
+        all_arguments: Command line arguments.
+        stdout: Output stream for the publication outcome.
+        stderr: Output stream for startup and API errors.
+
+    Returns:
+        The verifier process exit code.
+    """
+    parser = _build_parser()
+    parsed_arguments = parser.parse_args(list(all_arguments))
+    try:
+        settings = _load_settings(parsed_arguments)
+        outcome = _publish_from_settings(settings, parsed_arguments)
+    except (OSError, TypeError, ValueError, GitHubError) as error:
+        stderr.write(f"{error}\n")
+        return 3
+    stdout.write(json.dumps(_outcome_mapping(outcome)) + "\n")
+    return SUCCESS_EXIT_CODE
+
+
+def _publish_from_settings(
+    settings: _PublisherSettings, parsed_arguments: argparse.Namespace
+) -> PublicationOutcome:
+    repository = RepositorySettings(
+        settings.repository, settings.repository + GIT_BARE_SUFFIX
+    )
+    authenticator = GitHubAppAuthenticator(
+        settings.api_url,
+        settings.app_id,
+        settings.installation_id,
+        settings.private_key_path,
+    )
+    github = authenticator.issue_repository_api(
+        repository, should_write_issue_labels=True
+    )
+    return publish_local_report(
+        github,
+        repository,
+        settings.pull_request_number,
+        parsed_arguments.local_repo,
+        parsed_arguments.manifest,
+        parsed_arguments.report,
+    )
+
+
+def _outcome_mapping(outcome: PublicationOutcome) -> dict[str, object]:
+    return {
+        "status": outcome.status.value,
+        "description": outcome.description,
+        "publishable": outcome.publishable,
+    }
+
+
+@dataclass(frozen=True)
+class _PublisherSettings:
+    api_url: str
+    app_id: int
+    installation_id: int
+    private_key_path: Path
+    repository: str
+    pull_request_number: int
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="cde publish-local-report")
+    parser.add_argument("--settings", type=Path)
+    parser.add_argument("--api-url")
+    parser.add_argument("--app-id", type=int)
+    parser.add_argument("--installation-id", type=int)
+    parser.add_argument("--private-key-path", type=Path)
+    parser.add_argument("--repository")
+    parser.add_argument("--pull-number", type=int)
+    parser.add_argument("--local-repo", type=Path, required=True)
+    parser.add_argument("--manifest", type=Path, required=True)
+    parser.add_argument("--report", type=Path, required=True)
+    return parser
+
+
+def _load_settings(parsed_arguments: argparse.Namespace) -> _PublisherSettings:
+    all_settings: Mapping[str, object] = {}
+    if parsed_arguments.settings is not None:
+        parsed_settings = json.loads(
+            parsed_arguments.settings.read_text(encoding="utf-8")
+        )
+        if not isinstance(parsed_settings, Mapping):
+            raise ValueError("Publisher settings must be an object")
+        all_settings = parsed_settings
+    return _PublisherSettings(
+        _required_setting(
+            parsed_arguments.api_url,
+            all_settings,
+            "api_url",
+            GITHUB_API_URL,
+        ),
+        _required_integer_setting(parsed_arguments.app_id, all_settings, "app_id"),
+        _required_integer_setting(
+            parsed_arguments.installation_id, all_settings, "installation_id"
+        ),
+        _required_path_setting(parsed_arguments.private_key_path, all_settings),
+        _required_repository_setting(parsed_arguments.repository, all_settings),
+        _required_integer_setting(
+            parsed_arguments.pull_number, all_settings, "pull_number"
+        ),
+    )
+
+
+def _required_setting(
+    explicit_setting: object,
+    all_settings: Mapping[str, object],
+    setting_name: str,
+    default_setting: str | None = None,
+) -> str:
+    selected_setting = explicit_setting
+    if selected_setting is None:
+        selected_setting = all_settings.get(setting_name, default_setting)
+    if not isinstance(selected_setting, str) or not selected_setting:
+        raise TypeError(f"Missing publisher setting: {setting_name}")
+    return selected_setting
+
+
+def _required_repository_setting(
+    explicit_repository: object, all_settings: Mapping[str, object]
+) -> str:
+    repository_slug = _required_setting(explicit_repository, all_settings, "repository")
+    try:
+        repository_owner, repository_name = repository_slug.split("/")
+    except ValueError as error:
+        raise TypeError("Repository must use the owner/name form") from error
+    if not repository_owner or not repository_name:
+        raise TypeError("Repository must use the owner/name form")
+    return repository_slug
+
+
+def _required_path_setting(
+    explicit_path: object, all_settings: Mapping[str, object]
+) -> Path:
+    selected_path = explicit_path
+    if selected_path is None:
+        selected_path = all_settings.get("private_key_path")
+    if not isinstance(selected_path, (str, Path)) or not selected_path:
+        raise TypeError("Missing publisher setting: private_key_path")
+    return Path(selected_path)
+
+
+def _required_integer_setting(
+    explicit_setting: object,
+    all_settings: Mapping[str, object],
+    setting_name: str,
+) -> int:
+    selected_setting = explicit_setting
+    if selected_setting is None:
+        selected_setting = all_settings.get(setting_name)
+    if isinstance(selected_setting, bool) or not isinstance(selected_setting, int):
+        raise TypeError(f"Missing publisher setting: {setting_name}")
+    return selected_setting
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))