pi-dev-team 0.2.0

package/hooks/mutation_gate.py

@@ -0,0 +1,193 @@
+#!/usr/bin/env python3
+"""mutation_gate.py — PostToolUse hook (Python port of mutation-gate.sh).
+
+After each RED-to-GREEN test transition, runs mutation testing scoped to
+the affected test file and blocks tests that kill zero mutants.
+
+Output protocol (PostToolUse):
+  Blocking : `emit_block` JSON on stdout, exit 0.
+  Advisory : `emit_advisory` JSON on stdout, exit 0.
+  Silent   : no stdout, exit 0.
+
+Delegates to `hooks.mutation_adapters` for detection, dispatch, and per-
+adapter execution — the same Python library shipped in #572.D0.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import sys
+from pathlib import Path
+
+_HOOK_DIR = Path(__file__).resolve().parent
+# Add the plugin hooks dir to sys.path so the mutation_adapters package resolves.
+sys.path.insert(0, str(_HOOK_DIR))
+sys.path.insert(0, str(_HOOK_DIR / "lib"))
+
+from boundary_events import emit_boundary_event as _emit_boundary_event
+from mutation_adapters import lib as adapter_lib
+from mutation_adapters import mutmut, pitest, stryker, stryker_net
+
+
+def emit_boundary_event(*args, **kwargs) -> None:
+    """Local safety net (#859): even a misbehaving helper must never affect
+    this hook's exit code, stdout, or stderr."""
+    try:
+        _emit_boundary_event(*args, **kwargs)
+    except Exception:  # noqa: BLE001, S110 - fail-open by design
+        pass
+
+
+_JQ_MISSING_MESSAGE = (
+    "MUTATION GATE ADVISORY: jq is required but not installed. Run "
+    "/setup to install it, or: brew install jq (macOS) / apt install jq "
+    "(Linux) / winget install jqlang.jq (Windows)."
+)
+
+
+def _emit_advisory_pretty(message: str) -> None:
+    """Emit an advisory in bash `jq -n`'s pretty format (2-space indent + \\n).
+
+    `mutation-gate.sh` prints its advisories with `jq -n` so downstream Claude
+    Code output stays visually indented. This matches that shape byte-for-byte
+    for the paths the mutation-gate hook itself dispatches; the adapters still
+    print compact JSON (their internal `emit_advisory` returns compact),
+    tracked for the next release cycle when the settings-toggle flips
+    default to `.py`.
+    """
+    print(
+        json.dumps(
+            {
+                "hookSpecificOutput": {
+                    "hookEventName": "PostToolUse",
+                    "additionalContext": message,
+                }
+            },
+            indent=2,
+        )
+    )
+
+
+def _emit_block_pretty(reason: str) -> None:
+    print(json.dumps({"decision": "block", "reason": reason}, indent=2))
+
+
+def main() -> int:
+    # Hard dependency guards — mirror the bash order.
+    if shutil.which("jq") is None:
+        _emit_advisory_pretty(_JQ_MISSING_MESSAGE)
+        return 0
+    # python3 is by definition available here (we are python3), but if the
+    # bash sibling migrates a caller through the settings-toggle env var, the
+    # advisory would already have fired. Keep the branch for parity of the
+    # shape, harmlessly no-op.
+
+    if os.environ.get("MUTATION_GATE_SKIP") == "1":
+        return 0
+
+    raw = sys.stdin.read()
+    try:
+        payload = json.loads(raw)
+    except (TypeError, ValueError):
+        return 0
+    if not isinstance(payload, dict):
+        return 0
+
+    command = ""
+    tool_input = payload.get("tool_input") or {}
+    if isinstance(tool_input, dict):
+        candidate = tool_input.get("command")
+        if isinstance(candidate, str):
+            command = candidate
+    if not command:
+        return 0
+
+    if not adapter_lib.is_test_command(command):
+        return 0
+
+    event_json = raw
+    current_result = adapter_lib.detect_result(event_json)
+
+    prev_state = adapter_lib.read_state()
+    prev_result = "none"
+    if prev_state:
+        try:
+            prev_result = json.loads(prev_state).get("result") or "none"
+        except (TypeError, ValueError):
+            prev_result = "none"
+
+    adapter_lib.write_state(current_result, event_json)
+
+    if not adapter_lib.is_red_to_green(prev_result, current_result):
+        return 0
+
+    adapter = adapter_lib.detect_adapter(command)
+    if adapter == "none":
+        _emit_advisory_pretty(
+            "MUTATION GATE ADVISORY: no mutation testing adapter for this "
+            "language. Run /setup to install one (supports JS/TS via "
+            "Stryker, Java via pitest, C# via Stryker.NET)."
+        )
+        return 0
+
+    zero_kills_dir = Path(os.environ.get("TMPDIR", "/tmp")) / "mutation-gate"
+    zero_kills_file = zero_kills_dir / "zero-kills.json"
+    zero_kills_dir.mkdir(parents=True, exist_ok=True)
+
+    os.environ["ADAPTER_TIMEOUT"] = os.environ.get("MUTATION_GATE_TIMEOUT", "60")
+    os.environ["ADAPTER_COMMAND"] = command
+
+    runner_stdout = ""
+    if prev_state:
+        try:
+            runner_stdout = json.loads(prev_state).get("runner_stdout") or ""
+        except (TypeError, ValueError):
+            runner_stdout = ""
+    os.environ["ADAPTER_RUNNER_STDOUT"] = runner_stdout
+
+    if adapter == "stryker":
+        if not stryker.stryker_detect():
+            return 0
+        # bash derives ADAPTER_SOURCE_FILE from the last word of the command.
+        last_arg = command.rsplit(" ", 1)[-1] if command else ""
+        source_file = stryker.derive_source_file(last_arg) if last_arg else ""
+        os.environ["ADAPTER_SOURCE_FILE"] = source_file
+        stryker.stryker_run(zero_kills_file)
+    elif adapter == "pitest":
+        if not pitest.pitest_detect():
+            return 0
+        pitest.pitest_run(zero_kills_file)
+    elif adapter == "stryker-net":
+        if not stryker_net.stryker_net_detect():
+            return 0
+        stryker_net.stryker_net_run(zero_kills_file)
+    elif adapter == "mutmut":
+        if not mutmut.mutmut_detect():
+            return 0
+        mutmut.mutmut_run(zero_kills_file)
+
+    # Emit block if zero-kill tests found.
+    if zero_kills_file.is_file():
+        try:
+            data = json.loads(zero_kills_file.read_text())
+        except (OSError, ValueError):
+            data = []
+        if isinstance(data, list) and data:
+            reason = adapter_lib.format_blocking_reason(zero_kills_file, command)
+            _emit_block_pretty(reason)
+            emit_boundary_event(
+                payload.get("cwd") or ".",
+                "mutation_gate",
+                "Bash",
+                "block",
+                "mutation-gate-zero-kills",
+                payload.get("session_id"),
+            )
+
+    return 0
+
+
+if __name__ == "__main__":  # pragma: no cover
+    sys.exit(main())

package/hooks/mutation_testing_smoke_gate.py

@@ -0,0 +1,371 @@
+#!/usr/bin/env python3
+"""Mutation-testing smoke gate — PreToolUse hook (#565; python port per #574 / #572).
+
+Byte-compatible port of the Claude Code PreToolUse hook that enforces the
+SKILL.md § Step 1c smoke gate. Blocks whole-scope Stryker.NET invocations
+until a single-file smoke probe has landed a mutation-report.json under
+StrykerOutput/smoke/reports/ with at least one Killed mutant.
+
+Contract (docs/python-hook-contract.md):
+    Input : PreToolUse JSON on stdin
+    Output: exit 2 + message on stdout to BLOCK
+            exit 0 + no stdout for SILENT-PASS
+            exit 0 + ADVISORY-prefixed stdout for missing-dep / malformed / drift
+    Env   : MUTATION_SMOKE_GATE_SKIP=1 → silent bypass + audit-log line
+
+Stdlib-only. See docs/python-hook-contract.md.
+
+Refs: #565 (the .sh predecessor), #554, #557 (the failure modes it guards).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import shlex
+import shutil
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+
+_HOOK_DIR = Path(__file__).resolve().parent
+_LIB_DIR = _HOOK_DIR / "lib"
+
+sys.path.insert(0, str(_LIB_DIR))
+import artifact_paths  # type: ignore[import-not-found]
+
+try:
+    from atomic_state import (  # type: ignore[import-not-found]
+        append_line_locked,
+    )
+    from boundary_events import (  # type: ignore[import-not-found]
+        emit_boundary_event as _emit_boundary_event,
+    )
+    from stdin_json import read_stdin_json  # type: ignore[import-not-found]
+except ImportError:  # pragma: no cover
+
+    def read_stdin_json() -> dict | None:  # type: ignore[misc]
+        return None
+
+    def _emit_boundary_event(*_args, **_kwargs) -> None:  # type: ignore[misc]
+        return None
+
+    def append_line_locked(  # type: ignore[misc]
+        path: Path, line: str, *, delay_env_var=None, fail_open: bool = True
+    ) -> None:
+        # Degraded-import fallback: atomic_state itself couldn't be
+        # imported, so no hardened (locked, O_NOFOLLOW) append is available.
+        # #1904 item 5: this used to fall back to a plain unlocked
+        # `open(path, "a")` — the exact O_NOFOLLOW-hardening gap that
+        # issue disclosed for this and `pre_commit_review.py`'s equivalent
+        # shim. A failed audit write is already fail-open by design (the
+        # bypass this line records proceeds either way), so degrading
+        # further to "don't write at all" costs nothing beyond the audit
+        # trail entry itself, and avoids reintroducing the symlink-redirect
+        # gap the shared helper exists to close.
+        if not fail_open:
+            raise OSError("atomic_state unavailable (degraded import)")
+
+
+def emit_boundary_event(*args, **kwargs) -> None:
+    """Local safety net (#859): even a misbehaving helper must never affect
+    this hook's exit code, stdout, or stderr."""
+    try:
+        _emit_boundary_event(*args, **kwargs)
+    except Exception:  # noqa: BLE001, S110 - fail-open by design
+        pass
+
+
+# ---------------------------------------------------------------------------
+# Trigger detection
+# ---------------------------------------------------------------------------
+
+try:
+    from stryker_invocation import (  # type: ignore[import-not-found]
+        is_stryker_invocation as _is_stryker_invocation,
+    )
+except ImportError:  # pragma: no cover - degraded fallback, hooks/lib unreachable
+    _STRYKER_TRIGGER_FALLBACK = re.compile(
+        r"(?:^|[^a-zA-Z0-9])dotnet[ \t]+stryker(?:\b|$)|csharp-stryker-net-wrapper\.sh"
+    )
+
+    def _is_stryker_invocation(cmd: str) -> bool:  # type: ignore[misc]
+        return bool(cmd) and bool(_STRYKER_TRIGGER_FALLBACK.search(cmd))
+
+
+def is_stryker_command(cmd: str) -> bool:
+    """True when `cmd` invokes dotnet stryker OR the wrapper script.
+
+    Delegates to the shared `hooks/lib/stryker_invocation` predicate (#2185):
+    parsed via `shlex` in program position, not scanned with a bare regex —
+    so a mention of the tool name in a --body/grep/echo/comment argument is
+    never mistaken for a real invocation.
+    """
+    if not cmd:
+        return False
+    return _is_stryker_invocation(cmd)
+
+
+def extract_mutate_value(cmd: str) -> str:
+    """Return the --mutate value (handles --mutate=X, --mutate X, -m X).
+
+    Respects shell quoting via shlex so `--mutate 'src/Foo.cs'` and
+    `--mutate "src/Foo.cs"` both yield the unquoted path. Malformed shell
+    input yields "" (silent, matching the .sh's behavior).
+    """
+    try:
+        tokens = shlex.split(cmd)
+    except ValueError:
+        return ""
+    for i, tok in enumerate(tokens):
+        if tok.startswith("--mutate="):
+            return tok.split("=", 1)[1]
+        if tok in ("--mutate", "-m"):
+            if i + 1 < len(tokens):
+                return tokens[i + 1]
+            return ""
+    return ""
+
+
+def is_single_file_mutate(value: str) -> bool:
+    """A --mutate value is single-file only when it has no glob metacharacters
+    (*, ?, [) AND no semicolon (Stryker.NET's multi-file separator)."""
+    if not value:
+        return False
+    return not any(c in value for c in ("*", "?", "[", ";"))
+
+
+# ---------------------------------------------------------------------------
+# Audit-log helpers
+# ---------------------------------------------------------------------------
+
+
+def sha256_first_16(text: str) -> str:
+    """First 16 hex chars of sha256(text). Matches the .sh's cross-platform
+    shasum/sha256sum fallback chain output."""
+    return hashlib.sha256(text.encode("utf-8")).hexdigest()[:16]
+
+
+def iso_utc_timestamp() -> str:
+    """ISO-8601 UTC timestamp with 'Z' suffix. Matches the .sh helper."""
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def log_bypass_audit(raw_command: str, payload_cwd: str) -> None:
+    """Append one JSONL line to <payload_cwd>/.claude/metrics/gate-bypass.jsonl.
+
+    Writes timestamp + hook name + command_hash (sha256 first 16) + cwd.
+    The raw command is NEVER written — only its hash — matching the .sh's
+    privacy boundary. Filesystem errors write to stderr and return
+    silently so the bypass still succeeds.
+    """
+    audit_file = artifact_paths.resolve_file(
+        "metrics", "gate-bypass.jsonl", payload_cwd
+    )
+    audit_dir = audit_file.parent
+    try:
+        audit_dir.mkdir(parents=True, exist_ok=True)
+    except OSError:
+        print(
+            f"mutation-testing-smoke-gate: cannot create {audit_dir} "
+            "(bypass still succeeds)",
+            file=sys.stderr,
+        )
+        return
+    record = {
+        "timestamp": iso_utc_timestamp(),
+        "hook": "mutation-testing-smoke-gate",
+        "command_hash": sha256_first_16(raw_command),
+        "cwd": payload_cwd,
+    }
+    try:
+        # Match jq -c compact output: no spaces after ',' or ':'.
+        append_line_locked(
+            audit_file, json.dumps(record, separators=(",", ":")) + "\n", fail_open=False
+        )
+    except OSError:
+        print(
+            f"mutation-testing-smoke-gate: cannot write to {audit_file} "
+            "(bypass still succeeds)",
+            file=sys.stderr,
+        )
+
+
+# ---------------------------------------------------------------------------
+# Block message
+# ---------------------------------------------------------------------------
+
+
+_BLOCK_TEMPLATE = """[BLOCK] mutation-testing-smoke-gate: whole-scope Stryker.NET run detected
+
+{diagnostic}
+
+The Step 1c smoke gate (see SKILL.md § Step 1c) requires a single-file
+mutation probe with Killed > 0 before authorizing a full run. This
+prevents the silent 0.00 % failure mode (see #554, #557).
+
+To run the smoke probe:
+
+  dotnet stryker --config-file stryker-config.json \\
+    --mutate 'path/to/one/covered/file.cs' \\
+    -O StrykerOutput/smoke
+
+Then re-run this command. To bypass this gate for a legitimate exception,
+set MUTATION_SMOKE_GATE_SKIP=1 in the environment (audit-logged)."""
+
+
+def print_block_message(diagnostic: str) -> None:
+    """Write the shared block-message body with the caller's diagnostic."""
+    print(_BLOCK_TEMPLATE.format(diagnostic=diagnostic))
+
+
+# ---------------------------------------------------------------------------
+# Report parsing
+# ---------------------------------------------------------------------------
+
+
+def count_mutants_by_status(report: dict, status: str) -> int:
+    """Count entries in report['mutants'] with the given status field."""
+    mutants = report.get("mutants") or []
+    return sum(1 for m in mutants if isinstance(m, dict) and m.get("status") == status)
+
+
+# ---------------------------------------------------------------------------
+# main()
+# ---------------------------------------------------------------------------
+
+
+def main() -> int:
+    # -------------------------------------------------------------------
+    # Dependency guards — a missing dep must NOT become a de facto gate.
+    # -------------------------------------------------------------------
+    if shutil.which("jq") is None:
+        # Preserve parity with the .sh, which uses jq for JSON parsing.
+        # The Python port does not itself use jq, but flags the missing
+        # dep to keep the failure mode identical across ports.
+        print(
+            "ADVISORY: mutation-testing-smoke-gate: jq is required but not installed; gate not enforced"
+        )
+        return 0
+    # python3 is always present by construction in a .py hook; the .sh's
+    # python3 dep check is a no-op here.
+
+    # -------------------------------------------------------------------
+    # Parse PreToolUse payload
+    # -------------------------------------------------------------------
+    payload = read_stdin_json()
+    if payload is None:
+        # Empty or malformed stdin — nothing to check, silent-pass.
+        return 0
+
+    command = str(payload.get("tool_input", {}).get("command", "") or "")
+    if not command:
+        return 0
+
+    # cwd from payload, fall back to $PWD (matches .sh's `${PAYLOAD_CWD:=$PWD}`).
+    # Prefer the shell-provided $PWD over os.getcwd() so macOS's /var → /private/var
+    # symlink resolution does not diverge from the .sh.
+    payload_cwd = str(payload.get("cwd") or os.environ.get("PWD") or os.getcwd())
+
+    # -------------------------------------------------------------------
+    # Trigger detection
+    # -------------------------------------------------------------------
+    if not is_stryker_command(command):
+        return 0
+
+    mutate_value = extract_mutate_value(command)
+    if is_single_file_mutate(mutate_value):
+        # This IS the smoke probe; do not block it.
+        return 0
+
+    # -------------------------------------------------------------------
+    # Escape hatch — must run BEFORE report check so bypass works even
+    # without a report. Matches .sh ordering.
+    # -------------------------------------------------------------------
+    if os.environ.get("MUTATION_SMOKE_GATE_SKIP", "0") == "1":
+        log_bypass_audit(command, payload_cwd)
+        return 0
+
+    # -------------------------------------------------------------------
+    # Whole-scope run detected — check the smoke report.
+    # -------------------------------------------------------------------
+    report_path = (
+        Path(payload_cwd)
+        / "StrykerOutput"
+        / "smoke"
+        / "reports"
+        / "mutation-report.json"
+    )
+
+    session_id = payload.get("session_id")
+
+    if not report_path.is_file():
+        print_block_message(f"no smoke report at {report_path}")
+        emit_boundary_event(
+            payload_cwd, "mutation_testing_smoke_gate", "Bash", "block",
+            "mutation-smoke-report-missing", session_id,
+        )
+        return 2
+
+    try:
+        report_text = report_path.read_text(encoding="utf-8")
+    except OSError:
+        print_block_message(f"no smoke report at {report_path}")
+        emit_boundary_event(
+            payload_cwd, "mutation_testing_smoke_gate", "Bash", "block",
+            "mutation-smoke-report-missing", session_id,
+        )
+        return 2
+
+    try:
+        report = json.loads(report_text)
+    except json.JSONDecodeError:
+        # Malformed JSON — advisory (not block, not silent-pass). Matches .sh.
+        print(
+            f"ADVISORY: mutation-testing-smoke-gate: report at {report_path} is not valid JSON — cannot enforce gate; command not blocked"
+        )
+        return 0
+
+    # Schema drift — valid JSON without mutants[]. Advisory. ORDERING NOTE
+    # (from .sh): schema-drift advisory MUST run before counting logic;
+    # otherwise a schema-drift report incorrectly reports "no scored mutants".
+    if not isinstance(report, dict) or "mutants" not in report:
+        print(
+            f"ADVISORY: mutation-testing-smoke-gate: report at {report_path} lacks the mutants[] key — not the mutation-testing-elements shape; cannot enforce gate"
+        )
+        return 0
+
+    killed = count_mutants_by_status(report, "Killed")
+    survived = count_mutants_by_status(report, "Survived")
+
+    # At least one Killed → gate passes silently.
+    if killed > 0:
+        return 0
+
+    # Killed==0 && Survived>0 → mutation-switch not observing mutations.
+    if survived > 0:
+        print_block_message(
+            f"killed=0 survived={survived} — mutation-switch not observing mutations at runtime "
+            "(see #554, #557 and SKILL.md Step 1c diagnostic checklist)"
+        )
+        emit_boundary_event(
+            payload_cwd, "mutation_testing_smoke_gate", "Bash", "block",
+            "mutation-smoke-switch-not-observed", session_id,
+        )
+        return 2
+
+    # Killed==0 && Survived==0 → empty mutants[] or only NoCoverage/CompileError.
+    print_block_message(
+        "no scored mutants in smoke report — pick a different probe file with real test coverage"
+    )
+    emit_boundary_event(
+        payload_cwd, "mutation_testing_smoke_gate", "Bash", "block",
+        "mutation-smoke-no-scored-mutants", session_id,
+    )
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/hooks/pending_review_notify.py

@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+"""SessionStart hook: notify when the pending-review queue has entries.
+
+Emits a one-line notification when .claude/metrics/pending-review.jsonl has
+unreviewed entries. Split off (#1284/#1288) from the retired
+session_model_banner.py, whose other two responsibilities (persisting the
+session model to `.claude/session-model` and announcing the effort-band
+routing table) belonged to the band-to-model resolver system ADR 0026
+retired — the harness now resolves `model:`/`effort:` natively, with no
+plugin-side banner to keep in sync.
+
+Env seams (TEST-ONLY):
+    PENDING_REVIEW_FILE  defaults to <cwd>/.claude/metrics/pending-review.jsonl
+
+Contract (docs/python-hook-contract.md):
+    Input : SessionStart JSON on stdin (hook_event_name, cwd, model, ...).
+    Output: notification text on stdout. Exit 0 always.
+    Posture: fail-open — a buggy notifier must never block a session.
+
+Stdlib-only (json/os/pathlib/sys).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from pathlib import Path
+
+_HOOK_DIR = Path(__file__).resolve().parent
+_LIB_DIR = _HOOK_DIR / "lib"
+if str(_LIB_DIR) not in sys.path:
+    sys.path.insert(0, str(_LIB_DIR))
+
+import artifact_paths
+from stdin_json import read_stdin_json, resolve_cwd  # type: ignore[import-not-found]
+
+
+def _notify_pending_findings(cwd: str) -> str | None:
+    """Count still-pending entries in the pending-review queue, rotating out
+    disposed ones so the file stays bounded (#732).
+
+    A finding gains exactly one disposition (`reviewed_at` on approval,
+    `rejected_at` on rejection — see feedback-learning/SKILL.md); once either
+    is present, its audit trail lives in .claude/metrics/config-changelog.jsonl
+    (on approval) and the entry itself has no further use here. Rewriting the
+    queue to drop disposed entries every SessionStart keeps it bounded to the
+    outstanding backlog instead of growing without limit across the life of
+    a project. Lines that fail to parse can't be classified either way, so
+    they are left untouched — /session-review handles malformed-line
+    reporting on its own.
+    """
+    queue_env = os.environ.get("PENDING_REVIEW_FILE")
+    queue = (
+        Path(queue_env)
+        if queue_env
+        else artifact_paths.resolve_file("metrics", "pending-review.jsonl", cwd)
+    )
+    if not queue.is_file():
+        return None
+    try:
+        with queue.open("r", encoding="utf-8", errors="replace") as fh:
+            lines = fh.readlines()
+    except OSError:
+        return None
+
+    kept_lines: list[str] = []
+    dropped_any = False
+    count = 0
+    for raw_line in lines:
+        line = raw_line.strip()
+        if not line:
+            dropped_any = True
+            continue
+        try:
+            entry = json.loads(line)
+        except (json.JSONDecodeError, ValueError):
+            # Can't classify — keep it as-is rather than silently losing it.
+            kept_lines.append(line)
+            continue
+        if isinstance(entry, dict) and (
+            "reviewed_at" in entry or "rejected_at" in entry
+        ):
+            # Disposed — rotate it out of the queue.
+            dropped_any = True
+            continue
+        if isinstance(entry, dict):
+            count += 1
+        kept_lines.append(line)
+
+    if dropped_any:
+        try:
+            queue.write_text(
+                "".join(f"{line}\n" for line in kept_lines), encoding="utf-8"
+            )
+        except OSError:
+            pass
+
+    if count <= 0:
+        return None
+    return (
+        f"📋 {count} queued finding(s) from background analysis — "
+        "run /session-review to review\n"
+    )
+
+
+def main() -> int:
+    payload = read_stdin_json()
+    if payload is None:
+        return 0
+    cwd = resolve_cwd(payload)
+
+    notice = _notify_pending_findings(cwd)
+    if notice is not None:
+        sys.stdout.write(notice)
+
+    return 0
+
+
+if __name__ == "__main__":  # pragma: no cover
+    sys.exit(main())