claude-git-hooks 2.33.0 → 2.34.0

package/lib/hooks/pre-commit.js

@@ -33,6 +33,7 @@ import { getVersion } from '../utils/package-info.js';
 import logger from '../utils/logger.js';
 import { getConfig } from '../config.js';
 import { recordMetric } from '../utils/metrics.js';
+import { runLinters, displayLintResults, lintIssuesToAnalysisDetails } from '../utils/linter-runner.js';
 
 /**
  * Configuration loaded from lib/config.js
@@ -144,11 +145,45 @@ const main = async () => {
             process.exit(0);
         }
 
-        // Step 3: Build file data using shared engine
+        // Step 3: Run linters (fast, deterministic — before Claude analysis)
+        // Unfixable lint issues are forwarded to the judge for semantic resolution
+        let unfixableLintDetails = [];
+        if (config.linting?.enabled !== false) {
+            logger.info('🔍 Running linters...');
+            const lintStartTime = Date.now();
+            const filePaths = validFiles.map((f) => (typeof f === 'string' ? f : f.path));
+            const lintResult = runLinters(filePaths, config, presetName);
+            displayLintResults(lintResult);
+
+            // Record lint metric
+            recordMetric('linting.completed', {
+                preset: presetName,
+                fileCount: filePaths.length,
+                totalErrors: lintResult.totalErrors,
+                totalWarnings: lintResult.totalWarnings,
+                totalFixed: lintResult.totalFixed,
+                toolsRun: lintResult.results.filter((r) => !r.skipped).length,
+                toolsSkipped: lintResult.results.filter((r) => r.skipped).length,
+                duration: Date.now() - lintStartTime
+            }).catch((err) => {
+                logger.debug('pre-commit - main', 'Lint metrics recording failed', err);
+            });
+
+            // Forward all remaining lint issues (errors + warnings) to the judge
+            // The judge decides whether to fix, dismiss, or block — no hard exit here
+            if (lintResult.totalErrors > 0 || lintResult.totalWarnings > 0) {
+                unfixableLintDetails = lintIssuesToAnalysisDetails(lintResult);
+                logger.debug('pre-commit - main', 'Forwarding unfixable lint issues to judge', {
+                    count: unfixableLintDetails.length
+                });
+            }
+        }
+
+        // Step 4: Build file data using shared engine
         logger.debug('pre-commit - main', 'Building file data for analysis');
         const filesData = buildFilesData(validFiles, { staged: true });
 
-        // Step 4: Log analysis configuration
+        // Step 5: Log analysis configuration
         logger.info(`Sending ${filesData.length} files for review...`);
 
         // Display analysis routing hint
@@ -156,51 +191,82 @@ const main = async () => {
             logger.info('⚡ Intelligent orchestration: grouping files and assigning models');
         }
 
-        // Step 5: Run analysis using shared engine
+        // Step 6: Run analysis using shared engine
         const result = await runAnalysis(filesData, config, {
             hook: 'pre-commit',
             saveDebug: config.system.debug
         });
 
-        // Step 6: Display results using shared function
+        // Step 7: Display results using shared function
         displayResults(result);
 
-        // Step 6.5: Judge — auto-fix all issues
+        // Step 8: Merge unfixable lint issues into analysis result for the judge
+        if (unfixableLintDetails.length > 0) {
+            if (!Array.isArray(result.details)) {
+                result.details = [];
+            }
+            result.details.push(...unfixableLintDetails);
+
+            // Update issue counts
+            for (const detail of unfixableLintDetails) {
+                const sev = (detail.severity || 'minor').toLowerCase();
+                if (result.issues[sev] !== undefined) {
+                    result.issues[sev]++;
+                }
+            }
+
+            logger.info(`📋 ${unfixableLintDetails.length} unfixable lint issue(s) forwarded to judge`);
+        }
+
+        // Step 9: Judge — auto-fix all issues (Claude + lint)
         if (config.judge?.enabled !== false && hasAnyIssues(result)) {
+            let judgeModule;
             try {
-                const { judgeAndFix } = await import('../utils/judge.js');
-                const judgeResult = await judgeAndFix(result, filesData, config);
+                judgeModule = await import('../utils/judge.js');
+            } catch (importErr) {
+                logger.warning(`Judge module import failed: ${importErr.message}`);
+                logger.warning('Commit blocked — judge module unavailable');
+                result.QUALITY_GATE = 'FAILED';
+                result.approved = false;
+                judgeModule = null;
+            }
 
-                // Update result with remaining issues (fixed + false positives removed)
-                result.blockingIssues = judgeResult.remainingIssues.filter((i) =>
-                    ['blocker', 'critical'].includes((i.severity || '').toLowerCase())
-                );
-                result.details = judgeResult.remainingIssues;
-
-                // Recalculate quality gate — pass only if ALL issues resolved
-                if (judgeResult.remainingIssues.length === 0) {
-                    result.issues = {
-                        blocker: 0,
-                        critical: 0,
-                        major: 0,
-                        minor: 0,
-                        info: 0
-                    };
-                    result.QUALITY_GATE = 'PASSED';
-                    result.approved = true;
-                } else {
+            if (judgeModule) {
+                try {
+                    const { judgeAndFix } = judgeModule;
+                    const judgeResult = await judgeAndFix(result, filesData, config);
+
+                    // Update result with remaining issues (fixed + false positives removed)
+                    result.blockingIssues = judgeResult.remainingIssues.filter((i) =>
+                        ['blocker', 'critical'].includes((i.severity || '').toLowerCase())
+                    );
+                    result.details = judgeResult.remainingIssues;
+
+                    // Recalculate quality gate — pass only if ALL issues resolved
+                    if (judgeResult.remainingIssues.length === 0) {
+                        result.issues = {
+                            blocker: 0,
+                            critical: 0,
+                            major: 0,
+                            minor: 0,
+                            info: 0
+                        };
+                        result.QUALITY_GATE = 'PASSED';
+                        result.approved = true;
+                    } else {
+                        result.QUALITY_GATE = 'FAILED';
+                        result.approved = false;
+                    }
+                } catch (err) {
+                    logger.warning(`Judge execution failed: ${err.message}`);
+                    logger.warning('Commit blocked — judge could not verify issues');
                     result.QUALITY_GATE = 'FAILED';
                     result.approved = false;
                 }
-            } catch (err) {
-                logger.warning(`Judge failed: ${err.message}`);
-                logger.warning('Commit blocked — judge could not verify issues');
-                result.QUALITY_GATE = 'FAILED';
-                result.approved = false;
             }
         }
 
-        // Step 7: Check quality gate
+        // Step 10: Check quality gate
         const qualityGatePassed = result.QUALITY_GATE === 'PASSED';
         const approved = result.approved !== false;
 

package/lib/utils/claude-client.js

@@ -15,7 +15,7 @@
  * - claude-diagnostics: Error detection and formatting
  */
 
-import { spawn, execSync } from 'child_process';
+import { spawn, execSync, execFileSync } from 'child_process';
 import fs from 'fs/promises';
 import path from 'path';
 import os from 'os';
@@ -70,6 +70,37 @@ const isWSLAvailable = () => {
     }
 };
 
+/**
+ * Get running WSL distros, excluding Docker-internal ones
+ * Why: The default WSL distro may be docker-desktop (which doesn't have Claude).
+ * We need to find the actual Linux distro (e.g., Ubuntu) where Claude is installed.
+ *
+ * @param {string} wslPath - Absolute path to wsl.exe
+ * @returns {string[]} List of running non-Docker distro names
+ */
+export const getRunningWSLDistros = (wslPath) => {
+    try {
+        // Use execFileSync to bypass cmd.exe shell quoting — args passed directly to wsl.exe
+        const raw = execFileSync(wslPath, ['-l', '--running', '-q'], {
+            timeout: 5000,
+            stdio: ['pipe', 'pipe', 'ignore']
+        });
+        // Why UTF-16LE: wsl.exe is a native Windows executable that outputs Unicode in Windows' default
+        // encoding (UTF-16LE), not UTF-8. The null bytes (\0) are BOM artifacts and padding characters
+        // from the UTF-16LE encoding that must be stripped to get clean distro names.
+        const output = raw.toString('utf16le');
+        return output
+            .split(/\r?\n/)
+            .map((s) => s.replace(/\0/g, '').trim())
+            .filter((s) => s && !s.toLowerCase().includes('docker'));
+    } catch (e) {
+        logger.debug('claude-client - getRunningWSLDistros', 'Failed to list WSL distros', {
+            error: e.message
+        });
+        return [];
+    }
+};
+
 /**
  * Get Claude command configuration for current platform
  * Why: On Windows, try native Claude first, then WSL as fallback
@@ -112,11 +143,12 @@ const getClaudeCommand = () => {
         // Node 24: Resolve wsl.exe absolute path to avoid shell: true
         const wslPath = which('wsl');
         if (wslPath) {
+            const wslCheckTimeout = config.system.wslCheckTimeout || 15000;
+
+            // Strategy 1: Direct `wsl claude` (Claude in default non-interactive PATH)
+            // Use execFileSync to bypass cmd.exe — args passed directly to wsl.exe without quote mangling
             try {
-                // Verify Claude exists in WSL
-                // Increased timeout from 5s to 15s to handle system load better
-                const wslCheckTimeout = config.system.wslCheckTimeout || 15000;
-                execSync(`"${wslPath}" claude --version`, {
+                execFileSync(wslPath, ['claude', '--version'], {
                     stdio: 'ignore',
                     timeout: wslCheckTimeout
                 });
@@ -125,11 +157,9 @@ const getClaudeCommand = () => {
                 });
                 return { command: wslPath, args: ['claude'] };
             } catch (wslError) {
-                // Differentiate error types for accurate user feedback
                 const errorMsg = wslError.message || '';
-                const wslCheckTimeout = config.system.wslCheckTimeout || 15000;
 
-                // Timeout: Transient system load issue
+                // Timeout: Transient system load issue — don't try fallback
                 if (errorMsg.includes('ETIMEDOUT')) {
                     throw new ClaudeClientError(
                         'Timeout connecting to WSL - system under heavy load',
@@ -146,30 +176,132 @@ const getClaudeCommand = () => {
                     );
                 }
 
-                // Not found: Claude CLI missing in WSL
-                if (errorMsg.includes('ENOENT') || errorMsg.includes('command not found')) {
-                    throw new ClaudeClientError('Claude CLI not found in WSL', {
-                        context: {
-                            platform: 'Windows',
-                            wslPath,
-                            error: 'ENOENT',
-                            suggestion:
-                                'Install Claude in WSL: wsl -e bash -c "npm install -g @anthropic-ai/claude-cli"'
-                        }
+                // Not a timeout — try login-shell fallback below
+                logger.debug(
+                    'claude-client - getClaudeCommand',
+                    'Direct wsl claude failed, trying login-shell resolution',
+                    { error: errorMsg }
+                );
+            }
+
+            // Strategy 2: WSL login-shell resolution (Claude installed via nvm or custom PATH)
+            // Why: `wsl claude` runs a non-interactive shell that doesn't source .bashrc/.profile,
+            // so Claude installed via nvm or user-scoped npm prefix won't be in PATH.
+            // `bash -lc "which claude"` sources the login profile to resolve the full path.
+            // Why execFileSync: cmd.exe strips inner quotes from `bash -lc "which claude"`,
+            // causing bash to receive `which` and `claude` as separate args. execFileSync bypasses
+            // cmd.exe and passes arguments directly, preserving multi-word argument boundaries.
+            try {
+                const resolvedPath = execFileSync(
+                    wslPath,
+                    ['bash', '-lc', 'which claude'],
+                    {
+                        encoding: 'utf8',
+                        stdio: ['pipe', 'pipe', 'ignore'],
+                        timeout: wslCheckTimeout
+                    }
+                ).trim();
+
+                if (resolvedPath && resolvedPath.startsWith('/')) {
+                    // Verify: run the resolved path via login shell (node may also require login shell)
+                    execFileSync(wslPath, ['bash', '-lc', `${resolvedPath} --version`], {
+                        stdio: 'ignore',
+                        timeout: wslCheckTimeout
                     });
+                    logger.debug(
+                        'claude-client - getClaudeCommand',
+                        'Using WSL Claude CLI via login-shell resolution',
+                        { wslPath, claudePath: resolvedPath }
+                    );
+                    // Return loginShell so executeClaude wraps the call in bash -lc
+                    return { command: wslPath, args: [], loginShell: { path: resolvedPath } };
                 }
+            } catch (loginShellError) {
+                logger.debug(
+                    'claude-client - getClaudeCommand',
+                    'WSL login-shell resolution failed',
+                    { error: loginShellError.message }
+                );
+            }
 
-                // Generic error: Other WSL issues
-                throw new ClaudeClientError('Failed to verify Claude CLI in WSL', {
-                    context: {
-                        platform: 'Windows',
-                        wslPath,
-                        error: errorMsg,
-                        suggestion:
-                            'Check WSL is functioning: wsl --version, or skip analysis: git commit --no-verify'
+            // Strategy 3: Non-default WSL distro (e.g., default is docker-desktop)
+            // Why: If the default WSL distro is docker-desktop or another minimal distro,
+            // Claude may be installed in a different distro like Ubuntu.
+            const distros = getRunningWSLDistros(wslPath);
+            logger.debug(
+                'claude-client - getClaudeCommand',
+                'Trying non-default WSL distros',
+                { distros }
+            );
+
+            for (const distro of distros) {
+                // Try direct call in this distro
+                try {
+                    execFileSync(wslPath, ['-d', distro, 'claude', '--version'], {
+                        stdio: 'ignore',
+                        timeout: wslCheckTimeout
+                    });
+                    logger.debug(
+                        'claude-client - getClaudeCommand',
+                        'Using WSL Claude CLI in distro',
+                        { wslPath, distro }
+                    );
+                    return { command: wslPath, args: ['-d', distro, 'claude'] };
+                } catch (distroError) {
+                    // Try login-shell resolution in this distro
+                    try {
+                        const resolved = execFileSync(
+                            wslPath,
+                            ['-d', distro, 'bash', '-lc', 'which claude'],
+                            {
+                                encoding: 'utf8',
+                                stdio: ['pipe', 'pipe', 'ignore'],
+                                timeout: wslCheckTimeout
+                            }
+                        ).trim();
+
+                        if (resolved && resolved.startsWith('/')) {
+                            execFileSync(
+                                wslPath,
+                                ['-d', distro, 'bash', '-lc', `${resolved} --version`],
+                                {
+                                    stdio: 'ignore',
+                                    timeout: wslCheckTimeout
+                                }
+                            );
+                            logger.debug(
+                                'claude-client - getClaudeCommand',
+                                'Using WSL Claude CLI via login-shell in distro',
+                                { wslPath, distro, claudePath: resolved }
+                            );
+                            // Return loginShell so executeClaude wraps the call in bash -lc
+                            return {
+                                command: wslPath,
+                                args: ['-d', distro],
+                                loginShell: { path: resolved }
+                            };
+                        }
+                    } catch (distroLoginError) {
+                        logger.debug(
+                            'claude-client - getClaudeCommand',
+                            `Distro ${distro} does not have Claude`,
+                            { error: distroLoginError.message }
+                        );
                     }
-                });
+                }
             }
+
+            // All strategies failed
+            throw new ClaudeClientError('Claude CLI not found in WSL', {
+                context: {
+                    platform: 'Windows',
+                    wslPath,
+                    error: 'Claude not found via direct call or login-shell resolution',
+                    triedDistros: distros,
+                    suggestion:
+                        'Install Claude in WSL: wsl -e bash -c "npm install -g @anthropic-ai/claude-cli"'
+                }
+            });
         }
 
         throw new ClaudeClientError('Claude CLI not found in Windows or WSL', {
@@ -212,18 +344,26 @@ const getClaudeCommand = () => {
 const executeClaude = (prompt, { timeout = 120000, allowedTools = [], model = null } = {}) =>
     new Promise((resolve, reject) => {
         // Get platform-specific command
-        const { command, args } = getClaudeCommand();
+        const { command, args, loginShell } = getClaudeCommand();
 
-        // Add allowed tools if specified (for MCP tools)
+        // Build final args — handling differs for login-shell (WSL via bash -lc) vs direct invocation
         const finalArgs = [...args];
-        if (allowedTools.length > 0) {
-            // Format: --allowedTools "mcp__github__create_pull_request,mcp__github__get_file_contents"
-            finalArgs.push('--allowedTools', allowedTools.join(','));
-        }
-
-        // Add model override if specified
-        if (model) {
-            finalArgs.push('--model', model);
+        if (loginShell) {
+            // Why: When claude is found via WSL login-shell (e.g. nvm-installed node), it must be
+            // executed inside bash --login so that .profile/.bashrc set up the correct PATH.
+            // All CLI flags are embedded in the bash -c command string (no spaces in flag values).
+            const claudeParts = [loginShell.path];
+            if (allowedTools.length > 0) claudeParts.push(`--allowedTools ${allowedTools.join(',')}`);
+            if (model) claudeParts.push(`--model ${model}`);
+            finalArgs.push('bash', '-lc', claudeParts.join(' '));
+        } else {
+            if (allowedTools.length > 0) {
+                // Format: --allowedTools "mcp__github__create_pull_request,mcp__github__get_file_contents"
+                finalArgs.push('--allowedTools', allowedTools.join(','));
+            }
+            if (model) {
+                finalArgs.push('--model', model);
+            }
         }
 
         // CRITICAL FIX: Windows .cmd/.bat file handling

package/lib/utils/judge.js

@@ -182,17 +182,19 @@ const judgeAndFix = async (analysisResult, filesData, config) => {
     const resolvedIndices = new Set();
     const verdicts = [];
 
-    for (let i = 0; i < fixes.length; i++) {
+    // Cap at allIssues.length — LLM may hallucinate extra fixes beyond the input count
+    const fixCount = Math.min(fixes.length, allIssues.length);
+
+    if (fixes.length > allIssues.length) {
+        logger.debug('judge', `LLM returned ${fixes.length} fixes for ${allIssues.length} issues — ignoring ${fixes.length - allIssues.length} extra entries`);
+    }
+
+    for (let i = 0; i < fixCount; i++) {
         const verdict = fixes[i];
         const num = i + 1;
-        // Find matching issue by index or use verdict data if index exceeds allIssues length
-        const matchedIssue = i < allIssues.length ? allIssues[i] : null;
-        const severity = matchedIssue
-            ? (matchedIssue.severity || 'unknown').toUpperCase()
-            : 'UNKNOWN';
-        const desc = matchedIssue
-            ? matchedIssue.description || matchedIssue.message || 'No description'
-            : verdict.explanation || 'Unknown issue';
+        const matchedIssue = allIssues[i];
+        const severity = (matchedIssue.severity || 'unknown').toUpperCase();
+        const desc = matchedIssue.description || matchedIssue.message || 'No description';
 
         if (verdict.assessment === 'FALSE_POSITIVE') {
             falsePositiveCount++;