claude-dev-env 8.10.0 → 8.11.1

package/scripts/repository_checks/tracked_private_terms.py

@@ -13,6 +13,7 @@ from policy_lint.config import constants as policy_constants
 from private_terms import private_term_line_numbers
 
 from repository_checks.config import constants as repository_constants
+from repository_checks.hook_modules import load_hooks_module
 from repository_checks.models import RepositoryFinding
 
 
@@ -25,6 +26,15 @@ def _read_text_or_none(absolute_path: Path) -> str | None:
         return None
 
 
+def _is_owned_by_private_organization(repository_root: Path) -> bool:
+    exemption = load_hooks_module(repository_constants.REPOSITORY_EXEMPTION_MODULE_NAME)
+    origin_slug = exemption.repository_origin_slug(repository_root)
+    if origin_slug is None:
+        return False
+    owner_name = origin_slug.split(policy_constants.PATH_SEPARATOR)[0]
+    return bool(private_term_line_numbers(owner_name, ALL_PRIVATE_TERM_DIGESTS))
+
+
 def collect_tracked_private_term_findings(
     repository_root: Path, all_tracked_paths: Sequence[str]
 ) -> list[RepositoryFinding]:
@@ -35,8 +45,12 @@ def collect_tracked_private_term_findings(
         all_tracked_paths: Repository-relative tracked paths.
 
     Returns:
-        Findings that carry the path and line number, never the name.
+        Findings that carry the path and line number, never the name. A
+        repository whose github.com origin owner is itself a private
+        organization returns none, since that organization may name itself.
     """
+    if _is_owned_by_private_organization(repository_root):
+        return []
     all_findings: list[RepositoryFinding] = []
     for each_relative_path in all_tracked_paths:
         if (content := _read_text_or_none(repository_root / each_relative_path)) is None:

package/scripts/tests/test_cde_lint.py

@@ -396,3 +396,53 @@ def test_should_emit_only_located_diagnostics_in_editor_format(
     assert exit_code == 1
     assert "src/app.py:4:2:" in stdout_text
     assert "unlocated finding" not in stdout_text
+
+
+def test_should_exit_zero_and_record_a_followup_when_only_warnings_exist(
+    tmp_path: Path,
+) -> None:
+    warning_report = LintReport(
+        1,
+        (
+            Diagnostic(
+                "code-rules",
+                Severity.WARNING,
+                "Line 4: paired test gap",
+                Location(PurePosixPath("src/app.py"), 4, 1),
+                "code-rules/paired-test-missing-function",
+            ),
+        ),
+        (PurePosixPath("src/app.py"),),
+        ("code-rules",),
+        (),
+        (),
+    )
+    exit_code, stdout_text, _stderr_text = _run_cli(
+        ["--files", "src/app.py"],
+        lint_runner=lambda _request: warning_report,
+        repository_root=tmp_path,
+    )
+    ledger_path = tmp_path / ".claude" / "followups" / "smells.jsonl"
+    all_ledger_records = [
+        json.loads(each_line)
+        for each_line in ledger_path.read_text(encoding="utf-8").splitlines()
+    ]
+    assert exit_code == 0
+    assert "paired test gap" in stdout_text
+    assert [each_record["check_id"] for each_record in all_ledger_records] == [
+        "code-rules/paired-test-missing-function"
+    ]
+    assert all_ledger_records[0]["file_path"] == "src/app.py"
+
+
+def test_should_leave_the_ledger_absent_when_every_finding_is_an_error(
+    tmp_path: Path,
+) -> None:
+    _run_cli(
+        ["--files", "src/app.py"],
+        lint_runner=lambda _request: LintReport(
+            1, (_located_diagnostic(),), (), ("rule-a",), (), ()
+        ),
+        repository_root=tmp_path,
+    )
+    assert not (tmp_path / ".claude" / "followups" / "smells.jsonl").exists()

package/scripts/tests/test_policy_lint_rules_archive.py

@@ -118,3 +118,19 @@ def test_retirement_and_restoration_preserve_live_change_metadata(tmp_path: Path
     assert tuple(document.path for document in runtime_set.documents) == (restored_path,)
     assert runtime_set.deleted_paths == (deleted_path, retired_path)
     assert runtime_set.renamed_paths == ((restored_source, restored_path),)
+
+
+def test_archived_hook_moves_leave_the_automatic_checks(tmp_path: Path) -> None:
+    live_hook_path = PurePosixPath("packages/tool/hooks/blocking/retired_gate.py")
+    archived_hook_path = PurePosixPath("packages/tool/hooks-archived/blocking/retired_gate.py")
+    document_set = DocumentSet(
+        (Document.from_text(archived_hook_path, "archived"),),
+        SelectionKind.BASE,
+        tmp_path,
+        (),
+        ((live_hook_path, archived_hook_path),),
+    )
+    runtime_set = _runtime_document_set(document_set)
+    assert runtime_set.documents == ()
+    assert runtime_set.deleted_paths == (live_hook_path,)
+    assert runtime_set.renamed_paths == ()

package/scripts/tests/test_policy_lint_rules_callers.py

@@ -0,0 +1,140 @@
+"""Tests for the uncalled-new-file rule over a change set."""
+
+from __future__ import annotations
+
+from pathlib import Path, PurePosixPath
+
+from policy_lint import adapter_callers, registry
+from policy_lint.model import (
+    ChangeSetRule,
+    ContentOrigin,
+    Document,
+    DocumentSet,
+    SelectionKind,
+)
+
+_PACKAGE = "packages/claude-dev-env"
+_NEW_SCRIPT = f"{_PACKAGE}/scripts/lonely_watcher.py"
+
+
+def _write(repository_root: Path, relative_path: str, text: str) -> None:
+    target = repository_root / relative_path
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text(text, "utf-8")
+
+
+def _added(relative_path: str, prior_text: str | None = None) -> Document:
+    return Document(
+        PurePosixPath(relative_path),
+        "print('hi')\n",
+        prior_text,
+        None,
+        ContentOrigin.REVISION_DIFF,
+    )
+
+
+def _messages(
+    repository_root: Path,
+    all_documents: tuple[Document, ...],
+    selection: SelectionKind = SelectionKind.BASE,
+) -> tuple[str, ...]:
+    document_set = DocumentSet(all_documents, selection, repository_root)
+    return tuple(
+        each_diagnostic.message
+        for each_diagnostic in adapter_callers.uncalled_new_file_diagnostics(
+            document_set
+        )
+    )
+
+
+def test_should_report_a_new_script_only_its_own_test_names(tmp_path: Path) -> None:
+    _write(tmp_path, _NEW_SCRIPT, "print('hi')\n")
+    _write(
+        tmp_path,
+        f"{_PACKAGE}/scripts/tests/test_lonely_watcher.py",
+        "import lonely_watcher\n",
+    )
+    _write(tmp_path, f"{_PACKAGE}/CHANGELOG.md", "added lonely_watcher\n")
+    _write(tmp_path, f"{_PACKAGE}/README.md", "| lonely_watcher | x |\n")
+    _write(tmp_path, f"{_PACKAGE}/bin/ever-shipped-skills.mjs", "'lonely_watcher'\n")
+
+    all_messages = _messages(tmp_path, (_added(_NEW_SCRIPT),))
+
+    assert len(all_messages) == 1
+    assert "lonely_watcher" in all_messages[0]
+
+
+def test_should_pass_a_new_script_a_workflow_runs(tmp_path: Path) -> None:
+    _write(tmp_path, _NEW_SCRIPT, "print('hi')\n")
+    _write(
+        tmp_path,
+        ".github/workflows/ci.yml",
+        f"run: python {_NEW_SCRIPT}\n",
+    )
+
+    assert _messages(tmp_path, (_added(_NEW_SCRIPT),)) == ()
+
+
+def test_should_pass_a_new_hook_that_hooks_json_registers(tmp_path: Path) -> None:
+    hook_path = f"{_PACKAGE}/hooks/advisory/quiet_guard.py"
+    _write(tmp_path, hook_path, "")
+    _write(
+        tmp_path,
+        f"{_PACKAGE}/hooks/hooks.json",
+        '{"command": "python hooks/advisory/quiet_guard.py"}',
+    )
+
+    assert _messages(tmp_path, (_added(hook_path),)) == ()
+
+
+def test_should_ignore_a_file_that_existed_before_the_change(tmp_path: Path) -> None:
+    _write(tmp_path, _NEW_SCRIPT, "print('hi')\n")
+
+    assert _messages(tmp_path, (_added(_NEW_SCRIPT, "old\n"),)) == ()
+
+
+def test_should_ignore_new_tests_and_files_outside_code_folders(
+    tmp_path: Path,
+) -> None:
+    test_path = f"{_PACKAGE}/scripts/tests/test_orphan.py"
+    rule_path = f"{_PACKAGE}/rules/orphan.md"
+    _write(tmp_path, test_path, "")
+    _write(tmp_path, rule_path, "")
+
+    assert _messages(tmp_path, (_added(test_path), _added(rule_path))) == ()
+
+
+def test_should_not_count_a_longer_name_that_contains_the_stem(
+    tmp_path: Path,
+) -> None:
+    _write(tmp_path, _NEW_SCRIPT, "print('hi')\n")
+    _write(tmp_path, f"{_PACKAGE}/scripts/runner.py", "import lonely_watcher_v2\n")
+
+    assert len(_messages(tmp_path, (_added(_NEW_SCRIPT),))) == 1
+
+
+def test_should_run_on_staged_and_base_selections() -> None:
+    uncalled_rule = next(
+        each_rule
+        for each_rule in registry.default_registry()
+        if each_rule.rule_id == "uncalled-new-file"
+    )
+
+    assert isinstance(uncalled_rule, ChangeSetRule)
+    assert uncalled_rule.selections == frozenset(
+        {SelectionKind.STAGED, SelectionKind.BASE}
+    )
+
+
+def test_should_report_new_ci_and_tools_helpers_only_tests_name(
+    tmp_path: Path,
+) -> None:
+    ci_helper = ".github/ci/lonely_router.py"
+    tools_helper = "tools/lonely_archiver.py"
+    _write(tmp_path, ci_helper, "print('hi')\n")
+    _write(tmp_path, tools_helper, "print('hi')\n")
+    _write(tmp_path, ".github/ci/test_lonely_router.py", "import lonely_router\n")
+
+    all_messages = _messages(tmp_path, (_added(ci_helper), _added(tools_helper)))
+
+    assert len(all_messages) == 2

package/scripts/tests/test_policy_lint_rules_check_catalog.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 from pathlib import Path
 
 import pytest
-from policy_lint.check_catalog import check_id_for_message
+from policy_lint.check_catalog import check_id_for_message, severity_for_check_id
 from policy_lint.config.check_catalog_constants import (
     ALL_CHECK_CATALOG_ENTRIES,
     UNCLASSIFIED_CHECK_NAME,
@@ -71,6 +71,17 @@ ALL_MESSAGE_SAMPLES: tuple[tuple[str, str], ...] = (
         "missing-return-annotation",
     ),
     ("src/app.py:3: Single-letter variable 'p'", "single-letter-variable"),
+    (
+        "Line 45: public function 'run' is exercised by no test in the module's"
+        " paired test suite, though that suite already exercises this module",
+        "paired-test-missing-function",
+    ),
+    (
+        "app.py public function 'run' is a public function this stem-matched test"
+        " suite defines its module for but exercises nowhere, though the suite"
+        " already covers another public function in that module",
+        "paired-test-omitted-function",
+    ),
 )
 
 
@@ -149,3 +160,16 @@ def test_a_diagnostic_reports_the_check_identifier_it_carries() -> None:
     )
 
     assert diagnostic.as_dict()["check_id"] == "code-rules/constant-outside-config"
+
+
+@pytest.mark.parametrize(
+    "check_name", ("paired-test-missing-function", "paired-test-omitted-function")
+)
+def test_a_paired_test_check_reports_as_a_warning(check_name: str) -> None:
+    assert severity_for_check_id(f"{_BUNDLING_RULE_ID}/{check_name}") is Severity.WARNING
+
+
+def test_an_unclassified_check_reports_as_an_error() -> None:
+    unclassified_check_id = f"{_BUNDLING_RULE_ID}/{UNCLASSIFIED_CHECK_NAME}"
+
+    assert severity_for_check_id(unclassified_check_id) is Severity.ERROR

package/scripts/tests/test_policy_lint_rules_pairing.py

@@ -14,6 +14,7 @@ from policy_lint.model import (
     Document,
     DocumentSet,
     SelectionKind,
+    Severity,
 )
 
 _MODULE_DOCSTRING_BEFORE = '''"""Before."""
@@ -117,6 +118,17 @@ def test_pairing_requires_a_test_for_python_body_changes(tmp_path: Path) -> None
     assert len(all_diagnostics) == 1
 
 
+def test_pairing_reports_an_unpaired_change_as_a_recorded_warning(
+    tmp_path: Path,
+) -> None:
+    all_diagnostics = _pairing_diagnostics(
+        tmp_path,
+        _changed_document(_BODY_AFTER, _BODY_BEFORE),
+    )
+    assert [each.severity for each in all_diagnostics] == [Severity.WARNING]
+    assert all_diagnostics[0].check_id == "test-pairing"
+
+
 def test_pairing_rejects_python_syntax_errors_without_a_test(tmp_path: Path) -> None:
     all_diagnostics = _pairing_diagnostics(
         tmp_path,
@@ -186,10 +198,10 @@ def test_cursor_verifier_constants_require_the_changed_driver_suite(
     tmp_path: Path,
 ) -> None:
     constants_path = PurePosixPath(
-        ".cursor/skills/verify-claude-dev-env/scripts/verify_installer_constants/constants.mjs"
+        ".agents/skills/verify/scripts/verify_installer_constants/constants.mjs"
     )
     suite_path = PurePosixPath(
-        ".cursor/skills/verify-claude-dev-env/scripts/verify-installer.test.mjs"
+        ".agents/skills/verify/scripts/verify-installer.test.mjs"
     )
     constants_change = _body_change_at(constants_path)
     assert _diagnostic_paths(tmp_path, constants_change) == (constants_path,)
@@ -528,6 +540,23 @@ def test_pairing_accepts_installer_modules_with_the_cursor_rules_suite(
     assert all_paths == ()
 
 
+_INSTALLER_MODULE_PATH = PurePosixPath("packages/claude-dev-env/bin/install.mjs")
+_AGENTS_HOME_SUITE_PATH = PurePosixPath(
+    "packages/claude-dev-env/bin/install.agents-home.test.mjs"
+)
+
+
+def test_pairing_accepts_installer_module_with_the_agents_home_suite(
+    tmp_path: Path,
+) -> None:
+    all_paths = _diagnostic_paths(
+        tmp_path,
+        _body_change_at(_INSTALLER_MODULE_PATH),
+        _body_change_at(_AGENTS_HOME_SUITE_PATH),
+    )
+    assert all_paths == ()
+
+
 _COMMENT_RULES_PRODUCTION_PATH = PurePosixPath(
     "packages/claude-dev-env/hooks/blocking/code_rules_comments.py"
 )

package/scripts/tests/test_policy_lint_selection.py

@@ -285,6 +285,41 @@ def test_base_source_should_compare_merge_base_and_read_worktree_bytes(
     assert selected_document.origin == ContentOrigin.REVISION_DIFF
 
 
+def test_base_file_that_was_a_directory_at_base_should_have_no_prior_text(
+    tmp_path: Path,
+) -> None:
+    repository_root = _initialize_repository(tmp_path)
+    _commit_text(repository_root, "skills/verify/notes.md", "base-text\n")
+    _run_git(repository_root, "checkout", "--quiet", "-b", "feature")
+    _run_git(repository_root, "rm", "--quiet", "-r", "--", "skills")
+    _commit_text(repository_root, "skills", "../shared/skills\n")
+
+    document_set = select_documents(LintRequest.base(repository_root, "main"))
+    selected_document = _document_for(document_set, "skills")
+
+    assert selected_document.text == "../shared/skills\n"
+    assert selected_document.prior_text is None
+
+
+def test_base_directory_pointer_should_be_left_out_of_the_selection(
+    tmp_path: Path,
+) -> None:
+    repository_root = _initialize_repository(tmp_path)
+    _commit_text(repository_root, "shared/skills/verify/notes.md", "base-text\n")
+    _run_git(repository_root, "checkout", "--quiet", "-b", "feature")
+    try:
+        os.symlink("shared/skills", repository_root / "skills", target_is_directory=True)
+    except OSError as error:
+        pytest.skip(f"this host cannot create a directory pointer: {error}")
+    _run_git(repository_root, "add", "--", "skills")
+    _run_git(repository_root, "commit", "--quiet", "-m", "selection pointer fixture")
+
+    document_set = select_documents(LintRequest.base(repository_root, "main"))
+
+    assert "skills" not in _all_selected_paths(document_set)
+    assert "shared/skills" not in _all_selected_paths(document_set)
+
+
 def test_base_selection_records_merge_base_revision_and_staged_does_not(
     tmp_path: Path,
 ) -> None:

package/scripts/tests/test_tracked_private_terms.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import hashlib
+import subprocess
 import sys
 from pathlib import Path
 
@@ -69,3 +70,37 @@ def test_should_pass_a_tree_that_names_no_private_organization(
     exit_code, stdout_text, _stderr_text = run_policy(repository_root)
     assert exit_code == SUCCESS_EXIT_CODE
     assert stdout_text == ""
+
+
+def test_should_pass_a_repository_the_named_organization_owns(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    subprocess.run(
+        ["git", "remote", "add", "origin", "https://github.com/AcmeWidget/app.git"],
+        cwd=repository_root,
+        check=True,
+    )
+    write_text(repository_root / "docs" / "notes.md", "Built by Acme Widgets.\n")
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == SUCCESS_EXIT_CODE
+    assert stdout_text == ""
+
+
+def test_should_flag_a_repository_another_owner_holds(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    subprocess.run(
+        ["git", "remote", "add", "origin", "https://github.com/someone/app.git"],
+        cwd=repository_root,
+        check=True,
+    )
+    write_text(repository_root / "docs" / "notes.md", "Built by Acme Widgets.\n")
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert f"{CHECK_ID_TRACKED_PRIVATE_TERMS}: docs/notes.md:" in stdout_text

package/hooks/blocking/tdd_enforcer.py

@@ -1,195 +0,0 @@
-"""BDD Automate-phase gate (production code touch).
-
-Blocks a write to a production source file when no matching test was modified
-within the freshness window, enforcing "TDD IS NON-NEGOTIABLE" from CLAUDE.md.
-The gate records each candidate test's content hash at every sighting and
-compares that hash on the next write. A first sighting requires content that
-differs from HEAD. A stored failing pytest run is read before that fallback
-and applies while the candidate's content still matches the stored hash.
-Each concern lives in a ``tdd_enforcer_parts`` submodule; this entry wires them
-into one PreToolUse gate and re-exports their surface for the test suite.
-"""
-
-import json
-import sys
-from pathlib import Path
-
-try:
-    _hooks_root_directory = str(Path(__file__).resolve().parent.parent)
-    _blocking_directory = str(Path(__file__).resolve().parent)
-    for each_bootstrap_directory in (_hooks_root_directory, _blocking_directory):
-        if each_bootstrap_directory not in sys.path:
-            sys.path.insert(0, each_bootstrap_directory)
-    from code_rules_shared import (
-        is_agent_home_tooling,
-        is_ephemeral_script_path,
-        is_under_session_scratchpad,
-    )
-    from codex_apply_patch import (
-        payload_patch_target_paths,
-    )
-    from hooks_constants.pre_tool_use_dispatcher_constants import APPLY_PATCH_TOOL_NAME
-    from tdd_enforcer_parts import (
-        candidate_paths,
-        content_analysis,
-        content_hash_store,
-        decisions,
-        freshness,
-        git_tracking,
-        path_classification,
-    )
-    from tdd_enforcer_parts.config.tdd_enforcer_constants import PYTHON_SOURCE_EXTENSION
-except ImportError as import_error:
-    raise ImportError(
-        "tdd_enforcer: cannot import its tdd_enforcer_parts submodules; "
-        "ensure the hooks directory is importable."
-    ) from import_error
-
-
-def _is_session_scratchpad_write(file_path: str, input_data: dict) -> bool:
-    return is_under_session_scratchpad(file_path, input_data)
-
-
-def _is_agent_home_tooling_write(file_path: str) -> bool:
-    """A coding agent's own home-directory tooling is outside the TDD gate."""
-    return is_agent_home_tooling(file_path)
-
-
-production_extensions = path_classification.production_extensions
-skip_extensions = path_classification.skip_extensions
-_is_inside_dotclaude_segment = path_classification._is_inside_dotclaude_segment
-_directory_skip_components = path_classification._directory_skip_components
-_matches_any_skip_pattern = path_classification._matches_any_skip_pattern
-_extract_written_content = path_classification._extract_written_content
-candidate_test_paths_for = candidate_paths.candidate_test_paths_for
-_ancestor_tests_directories = candidate_paths._ancestor_tests_directories
-_parent_walk_limit = candidate_paths._parent_walk_limit
-_freshness_seconds = freshness._freshness_seconds
-_read_candidate_text = freshness._read_candidate_text
-has_recorded_or_fresh_test = content_hash_store.has_recorded_or_fresh_test
-_is_constants_only_python_content = content_analysis._is_constants_only_python_content
-_is_post_edit_import_only = content_analysis._is_post_edit_import_only
-_is_post_edit_constants_only = content_analysis._is_post_edit_constants_only
-is_absent_but_tracked = git_tracking.is_absent_but_tracked
-build_deny_reason = decisions.build_deny_reason
-emit_allow = decisions.emit_allow
-emit_deny = decisions.emit_deny
-
-
-def _resolve_payload(input_data: dict) -> tuple[str, dict, str]:
-    tool_input = input_data.get("tool_input", {})
-    return input_data.get("tool_name", ""), tool_input, tool_input.get("file_path", "")
-
-
-def _is_silently_skipped(
-    file_path: str, extension: str, path: Path, repository_root: str = ""
-) -> bool:
-    if _is_inside_dotclaude_segment(file_path) or is_ephemeral_script_path(
-        file_path, repository_root
-    ):
-        return True
-    if _is_agent_home_tooling_write(file_path):
-        return True
-    if extension in skip_extensions():
-        return True
-    if extension not in production_extensions():
-        return True
-    path_with_forward_slashes = str(path).lower().replace("\\", "/")
-    return _matches_any_skip_pattern(path.name.lower(), path_with_forward_slashes)
-
-
-def _edit_is_constants_or_import_only(
-    tool_name: str, tool_input: dict, path: Path, extension: str
-) -> bool:
-    if (
-        tool_name not in ("Edit", "MultiEdit")
-        or extension != PYTHON_SOURCE_EXTENSION
-        or not path.exists()
-    ):
-        return False
-    existing_content = _read_candidate_text(path)
-    if existing_content is None:
-        return False
-    if _is_post_edit_import_only(existing_content, tool_name, tool_input):
-        return True
-    return _is_post_edit_constants_only(existing_content, tool_name, tool_input)
-
-
-def _write_is_exempt(
-    tool_name: str, tool_input: dict, path: Path, extension: str
-) -> bool:
-    if is_absent_but_tracked(path):
-        return True
-    written_content = _extract_written_content(tool_name, tool_input)
-    if (
-        tool_name == "Write"
-        and extension == PYTHON_SOURCE_EXTENSION
-        and _is_constants_only_python_content(written_content)
-    ):
-        return True
-    return _edit_is_constants_or_import_only(tool_name, tool_input, path, extension)
-
-
-def _decide_for_target(
-    tool_name: str, tool_input: dict, file_path: str, input_data: dict
-) -> tuple[bool, str] | None:
-    """Return (is_allowed, deny_reason) for one target file, or None to skip silently."""
-    if not file_path:
-        return None
-    if _is_session_scratchpad_write(file_path, input_data):
-        return None
-    path = Path(file_path)
-    extension = path.suffix.lower()
-    repository_root = str(input_data.get("cwd") or "")
-    if _is_silently_skipped(file_path, extension, path, repository_root):
-        return None
-    if _write_is_exempt(tool_name, tool_input, path, extension):
-        return True, ""
-    all_candidates = candidate_test_paths_for(path)
-    session_id = str(input_data.get("session_id") or "")
-    is_recorded_or_fresh = has_recorded_or_fresh_test(
-        all_candidates, session_id, repository_root, _freshness_seconds()
-    )
-    if is_recorded_or_fresh:
-        return True, ""
-    return False, build_deny_reason(path, all_candidates)
-
-
-def _decide_apply_patch(input_data: dict, tool_input: dict) -> None:
-    """Run the TDD gate over every file a Codex apply_patch payload touches."""
-    for each_file_path in payload_patch_target_paths(input_data, tool_input):
-        decision = _decide_for_target(
-            APPLY_PATCH_TOOL_NAME, tool_input, each_file_path, input_data
-        )
-        if decision is None:
-            continue
-        is_allowed, deny_reason = decision
-        if not is_allowed:
-            emit_deny(deny_reason)
-            return
-    emit_allow()
-
-
-def main() -> None:
-    """Run the TDD gate over one PreToolUse Write, Edit, MultiEdit, or apply_patch payload."""
-    try:
-        input_data = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        sys.exit(0)
-    tool_name, tool_input, file_path = _resolve_payload(input_data)
-    if tool_name == APPLY_PATCH_TOOL_NAME:
-        _decide_apply_patch(input_data, tool_input)
-        sys.exit(0)
-    decision = _decide_for_target(tool_name, tool_input, file_path, input_data)
-    if decision is None:
-        sys.exit(0)
-    is_allowed, deny_reason = decision
-    if is_allowed:
-        emit_allow()
-        sys.exit(0)
-    emit_deny(deny_reason)
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()