flashgate 0.5.2__tar.gz → 0.5.4__tar.gz

{flashgate-0.5.2 → flashgate-0.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flashgate
-Version: 0.5.2
+Version: 0.5.4
 Summary: Hardware-in-the-loop verification gate: your agent can't claim the firmware works until the board says so.
 License: MIT
 Project-URL: Homepage, https://github.com/Lion-1209/flashgate
@@ -47,8 +47,12 @@ FLASHGATE-BOOT board=apollo-h743 git=2c58bd3 build=2026-08-28T07:26:35Z rtos=Fre
 ```
 
 Both carry the git sha plus `-dirty` when the tree differs from HEAD, so a
-passing verify proves the board is running exactly the code you're looking
-at. Functional probes then send real commands and assert on the answers,
+passing verify proves the board is running a build of your current HEAD
+(`-dirty` marks uncommitted changes; it does not fingerprint their
+content — the Stop hook's tree fingerprint covers that side: tracked diffs
+in full, untracked files and the board profile by path + size + first
+4 MiB, so tightening probe expectations invalidates a cached PASS. Files
+ignored by git and nested git repositories are outside the gate). Functional probes then send real commands and assert on the answers,
 including register readbacks (TIM3 CCR), not firmware self-reports:
 
 ```yaml
@@ -95,10 +99,12 @@ Board profiles, probes, fixes and docs are welcome — see
 
 `hooks/flashgate_stop.py` is a Claude Code Stop hook (any harness
 implementing the same hook contract works). When the agent tries to finish after
-touching watched firmware files, the hook fingerprints the tree and allows
-instantly if that exact state already passed hardware verify (~0.7 s
-cached). Otherwise it runs the full verify on the real board and blocks
-the stop on failure, feeding the agent the board's testimony:
+touching watched firmware files, the hook fingerprints the tree (plus the
+board profile — editing verification semantics must not reuse a cached
+green) and allows instantly if that exact state already passed hardware
+verify (~0.7 s cached). Otherwise it runs the full verify on the real
+board and blocks the stop on failure, feeding the agent the board's
+testimony:
 
 ```
 [flashgate] BLOCKED (attempt 1/2): firmware changes are not verified on hardware (verify rc=7).

{flashgate-0.5.2 → flashgate-0.5.4}/README.md

@@ -28,8 +28,12 @@ FLASHGATE-BOOT board=apollo-h743 git=2c58bd3 build=2026-08-28T07:26:35Z rtos=Fre
 ```
 
 Both carry the git sha plus `-dirty` when the tree differs from HEAD, so a
-passing verify proves the board is running exactly the code you're looking
-at. Functional probes then send real commands and assert on the answers,
+passing verify proves the board is running a build of your current HEAD
+(`-dirty` marks uncommitted changes; it does not fingerprint their
+content — the Stop hook's tree fingerprint covers that side: tracked diffs
+in full, untracked files and the board profile by path + size + first
+4 MiB, so tightening probe expectations invalidates a cached PASS. Files
+ignored by git and nested git repositories are outside the gate). Functional probes then send real commands and assert on the answers,
 including register readbacks (TIM3 CCR), not firmware self-reports:
 
 ```yaml
@@ -76,10 +80,12 @@ Board profiles, probes, fixes and docs are welcome — see
 
 `hooks/flashgate_stop.py` is a Claude Code Stop hook (any harness
 implementing the same hook contract works). When the agent tries to finish after
-touching watched firmware files, the hook fingerprints the tree and allows
-instantly if that exact state already passed hardware verify (~0.7 s
-cached). Otherwise it runs the full verify on the real board and blocks
-the stop on failure, feeding the agent the board's testimony:
+touching watched firmware files, the hook fingerprints the tree (plus the
+board profile — editing verification semantics must not reuse a cached
+green) and allows instantly if that exact state already passed hardware
+verify (~0.7 s cached). Otherwise it runs the full verify on the real
+board and blocks the stop on failure, feeding the agent the board's
+testimony:
 
 ```
 [flashgate] BLOCKED (attempt 1/2): firmware changes are not verified on hardware (verify rc=7).

{flashgate-0.5.2 → flashgate-0.5.4}/flashgate/board.py

@@ -48,11 +48,13 @@ class Board:
             sha = subprocess.run(
                 ["git", "rev-parse", "--short=7", "HEAD"],
                 cwd=self.firmware_dir, capture_output=True, text=True,
+                encoding="utf-8", errors="replace",
                 timeout=15, check=True,
             ).stdout.strip()
             status = subprocess.run(
                 ["git", "status", "--porcelain"],
                 cwd=self.firmware_dir, capture_output=True, text=True,
+                encoding="utf-8", errors="replace",
                 timeout=15, check=True,
             ).stdout.strip()
             if status:
@@ -68,6 +70,13 @@ def load_board(yaml_path: Path) -> Board:
         raw = yaml.safe_load(yaml_path.read_text(encoding="utf-8"))
     except (OSError, yaml.YAMLError) as exc:
         raise BoardError(f"cannot load board profile {yaml_path}: {exc}") from exc
+    if not isinstance(raw, dict):
+        # Empty file parses to None; a list/scalar document is equally
+        # malformed — both must surface as BoardError so the Stop hook's
+        # "gate misconfigured" branch (not a traceback) handles them.
+        raise BoardError(
+            f"board profile {yaml_path} is not a mapping "
+            f"(got {type(raw).__name__})")
 
     fw = raw.get("firmware") or {}
     flash = raw.get("flash") or {}

{flashgate-0.5.2 → flashgate-0.5.4}/flashgate/flasher.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import subprocess
+import sys
 import time
 from dataclasses import dataclass
 from pathlib import Path
@@ -22,11 +23,22 @@ class FlashResult:
 
 def _kill_stlinkserver() -> None:
     """A stale stlink-server session can wedge the probe; it restarts on
-    demand, so killing it between attempts is safe."""
-    subprocess.run(
-        ["taskkill", "/F", "/IM", "stlinkserver.exe"],
-        capture_output=True, timeout=15,
-    )
+    demand, so killing it between attempts is safe. Windows-only: the
+    helper process only exists there and so does taskkill — invoking it
+    on Linux/macOS used to raise FileNotFoundError straight out of the
+    flash-retry path. Best-effort by design: a failed kill must never
+    abort the retry it precedes."""
+    if sys.platform != "win32":
+        return
+    try:
+        subprocess.run(
+            ["taskkill", "/F", "/IM", "stlinkserver.exe"],
+            capture_output=True, timeout=15,
+        )
+    except (OSError, subprocess.SubprocessError):
+        # OSError: taskkill missing/blocked; SubprocessError covers
+        # TimeoutExpired — a kill that hangs 15 s must die quietly too.
+        pass
 
 
 def _attempt_flash(cli: Path, bin_path: Path, connect: str, address: str, start: bool) -> tuple[bool, int, str]:

flashgate-0.5.4/flashgate/gatestate.py

@@ -0,0 +1,171 @@
+"""Gate state: fingerprint the firmware tree, remember the last PASS.
+
+The Stop hook only re-runs the (slow) hardware verify when the firmware tree
+actually changed since the last passing run. The fingerprint covers HEAD,
+the full diff against HEAD, and the untracked-file list — so any content
+change to a watched file produces a new fingerprint.
+
+Escalation: after MAX_CONSECUTIVE_BLOCKS failed blocks for the SAME
+fingerprint, the gate releases with a warning instead of blocking forever
+(coderio VerifyGate semantics: never wedge the session, never silently
+give up).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import subprocess
+from datetime import datetime, timezone
+from fnmatch import fnmatch
+from pathlib import Path
+
+STATE_DIR = ".flashgate"
+STATE_FILE = "state.json"
+MAX_CONSECUTIVE_BLOCKS = 2
+
+DEFAULT_WATCH = [
+    "*.c", "*.h", "*.s", "*.ld", "*.ioc",
+    "CMakeLists.txt", "*.cmake", "cmake/*",
+]
+
+
+def _git(args: list[str], cwd: Path) -> str:
+    # errors="surrogateescape": `ls-files -z` emits raw UTF-8 path bytes and
+    # text=True alone would decode with the ANSI code page (cp936 on a
+    # Chinese Windows) — a non-ASCII path then kills the reader thread,
+    # stdout becomes None, and the Stop hook crashes to exit 1, which the
+    # hook contract treats as non-blocking: the gate would fail OPEN.
+    try:
+        proc = subprocess.run(
+            ["git", *args], cwd=cwd, capture_output=True, text=True,
+            encoding="utf-8", errors="surrogateescape",
+            timeout=20, check=True,
+        )
+        return proc.stdout or ""
+    except (subprocess.SubprocessError, OSError):
+        return ""
+
+
+_HASH_CAP_BYTES = 4 * 1024 * 1024   # per file: length + first 4 MiB
+
+
+def _untracked_files(fw_dir: Path) -> list[str]:
+    """Untracked files, recursively, gitignore-respecting, no quoting.
+
+    `git status --porcelain` collapses a new directory to '?? dir/' (hiding
+    every file inside) and C-escapes non-ASCII paths under core.quotepath —
+    both let content edits slip past a content digest. `ls-files
+    --others --exclude-standard -z` lists real paths, NUL-separated."""
+    out = _git(["ls-files", "--others", "--exclude-standard", "-z"], fw_dir)
+    return sorted(p for p in out.split("\x00") if p)
+
+
+def _untracked_content_digest(fw_dir: Path) -> str:
+    """Digest over the CONTENT of untracked files.
+
+    Found by the 2026-09-13 external review: git diff ignores untracked
+    files and git status lists only their paths, so editing an untracked
+    source file after a cached PASS kept the fingerprint unchanged — the
+    Stop hook reused the stale green. Hashing path + size + content closes
+    it. The gate's own state dir is excluded: save_state() rewrites a
+    timestamp there, and letting it feed the fingerprint would invalidate
+    every cached PASS."""
+    h = hashlib.sha256()
+    for path in _untracked_files(fw_dir):
+        if path == ".flashgate" or path.startswith(".flashgate/"):
+            continue
+        f = fw_dir / path
+        try:
+            size = f.stat().st_size
+            h.update(f"{path}\x00{size}\x00".encode("utf-8", errors="replace"))
+            with f.open("rb") as fh:               # chunked: never OOM on a
+                remaining = min(size, _HASH_CAP_BYTES)  # stray huge file
+                while remaining > 0:
+                    chunk = fh.read(min(1 << 20, remaining))
+                    if not chunk:
+                        break
+                    h.update(chunk)
+                    remaining -= len(chunk)
+        except OSError:
+            h.update(f"{path}\x00<unreadable>\x00".encode("utf-8", errors="replace"))
+        h.update(b"\x00")
+    return h.hexdigest()
+
+
+def _profile_digest(profile: Path) -> str:
+    """sha256 over the board profile's bytes (same 4 MiB cap as untracked
+    files). Identity is content-only: two profiles with identical bytes
+    define identical verification semantics; any location-dependent field
+    resolves through firmware_dir, which is fingerprinted separately."""
+    try:
+        h = hashlib.sha256()
+        with profile.open("rb") as fh:
+            remaining = _HASH_CAP_BYTES
+            while remaining > 0:
+                chunk = fh.read(min(1 << 20, remaining))
+                if not chunk:
+                    break
+                h.update(chunk)
+                remaining -= len(chunk)
+        return h.hexdigest()
+    except OSError:
+        return "<unreadable>"
+
+
+def tree_fingerprint(fw_dir: Path, profile: Path | None = None) -> str:
+    """Content-identity of the working tree AND the verification semantics.
+
+    Not just HEAD: dirty trees with different edits must NOT share a
+    fingerprint — including edits to untracked files (hashed explicitly)
+    and edits to the board profile. The profile defines what "PASS"
+    means (probe expectations, build command), so tightening or loosening
+    it after a cached PASS must invalidate that green, not reuse it —
+    same stale-PASS class as the untracked-content hole (2026-09-13
+    external review)."""
+    head = _git(["rev-parse", "HEAD"], fw_dir)
+    diff = _git(["diff", "HEAD"], fw_dir)
+    status = _git(["status", "--porcelain"], fw_dir)
+    untracked = _untracked_content_digest(fw_dir)
+    profile_part = _profile_digest(profile) if profile is not None else "<no-profile>"
+    blob = "\x00".join((head, diff, status, untracked, profile_part))
+    return hashlib.sha256(blob.encode("utf-8", errors="replace")).hexdigest()
+
+
+def watched_paths(fw_dir: Path, patterns: list[str]) -> list[str]:
+    """Working-tree changes that match the watch globs (gate triggers)."""
+    status = _git(["status", "--porcelain"], fw_dir)
+    watched: list[str] = []
+    for line in status.splitlines():
+        if line.startswith("?? "):
+            continue     # untracked: handled below, dir-collapsed in status
+        path = line[3:].strip().strip('"')
+        if " -> " in path:                     # rename: judge by the new name
+            path = path.split(" -> ")[1]
+        if path and any(fnmatch(path, pat) for pat in patterns):
+            watched.append(path)
+    # Untracked files come from ls-files: a new directory collapses to a
+    # single '?? dir/' status line that no *.c glob can match, which used
+    # to mean new files in new dirs never even triggered the gate.
+    for path in _untracked_files(fw_dir):
+        if any(fnmatch(path, pat) for pat in patterns):
+            watched.append(path)
+    return watched
+
+
+def state_path(fw_dir: Path) -> Path:
+    return fw_dir / STATE_DIR / STATE_FILE
+
+
+def load_state(fw_dir: Path) -> dict:
+    try:
+        return json.loads(state_path(fw_dir).read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return {}
+
+
+def save_state(fw_dir: Path, **fields) -> None:
+    path = state_path(fw_dir)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    payload = {"updated": datetime.now(timezone.utc).isoformat(), **fields}
+    path.write_text(json.dumps(payload, indent=2), encoding="utf-8")

{flashgate-0.5.2 → flashgate-0.5.4}/flashgate.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flashgate
-Version: 0.5.2
+Version: 0.5.4
 Summary: Hardware-in-the-loop verification gate: your agent can't claim the firmware works until the board says so.
 License: MIT
 Project-URL: Homepage, https://github.com/Lion-1209/flashgate
@@ -47,8 +47,12 @@ FLASHGATE-BOOT board=apollo-h743 git=2c58bd3 build=2026-08-28T07:26:35Z rtos=Fre
 ```
 
 Both carry the git sha plus `-dirty` when the tree differs from HEAD, so a
-passing verify proves the board is running exactly the code you're looking
-at. Functional probes then send real commands and assert on the answers,
+passing verify proves the board is running a build of your current HEAD
+(`-dirty` marks uncommitted changes; it does not fingerprint their
+content — the Stop hook's tree fingerprint covers that side: tracked diffs
+in full, untracked files and the board profile by path + size + first
+4 MiB, so tightening probe expectations invalidates a cached PASS. Files
+ignored by git and nested git repositories are outside the gate). Functional probes then send real commands and assert on the answers,
 including register readbacks (TIM3 CCR), not firmware self-reports:
 
 ```yaml
@@ -95,10 +99,12 @@ Board profiles, probes, fixes and docs are welcome — see
 
 `hooks/flashgate_stop.py` is a Claude Code Stop hook (any harness
 implementing the same hook contract works). When the agent tries to finish after
-touching watched firmware files, the hook fingerprints the tree and allows
-instantly if that exact state already passed hardware verify (~0.7 s
-cached). Otherwise it runs the full verify on the real board and blocks
-the stop on failure, feeding the agent the board's testimony:
+touching watched firmware files, the hook fingerprints the tree (plus the
+board profile — editing verification semantics must not reuse a cached
+green) and allows instantly if that exact state already passed hardware
+verify (~0.7 s cached). Otherwise it runs the full verify on the real
+board and blocks the stop on failure, feeding the agent the board's
+testimony:
 
 ```
 [flashgate] BLOCKED (attempt 1/2): firmware changes are not verified on hardware (verify rc=7).

{flashgate-0.5.2 → flashgate-0.5.4}/flashgate.egg-info/SOURCES.txt

@@ -21,7 +21,9 @@ flashgate.egg-info/requires.txt
 flashgate.egg-info/top_level.txt
 tests/test_board.py
 tests/test_cli.py
+tests/test_flasher.py
 tests/test_gatestate.py
+tests/test_hook_stop.py
 tests/test_mcp.py
 tests/test_probes.py
 tests/test_swdsig.py

{flashgate-0.5.2 → flashgate-0.5.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "flashgate"
-version = "0.5.2"
+version = "0.5.4"
 description = "Hardware-in-the-loop verification gate: your agent can't claim the firmware works until the board says so."
 readme = "README.md"
 requires-python = ">=3.11"

{flashgate-0.5.2 → flashgate-0.5.4}/tests/test_board.py

@@ -63,6 +63,18 @@ class TestLoadBoard:
         b = load_board(make_profile(tmp_path, body))
         assert b.banner_regex == "BOOT git={git}"
 
+    def test_malformed_document_rejected_not_crash(self, tmp_path):
+        # Adversarial review F4: an empty file parses to None and a
+        # list/scalar document is equally malformed — both must raise
+        # BoardError (the Stop hook's "gate misconfigured" branch), never
+        # a bare AttributeError out of raw.get().
+        import pytest
+        for bad in ("", "- a\n- b\n", "just a scalar\n"):
+            p = tmp_path / "bad.yaml"
+            p.write_text(bad, encoding="utf-8")
+            with pytest.raises(BoardError):
+                load_board(p)
+
 
 class TestHeadSha:
     def test_clean_then_dirty(self, tmp_path, git_repo):

flashgate-0.5.4/tests/test_flasher.py

@@ -0,0 +1,48 @@
+"""_kill_stlinkserver guards the flash-retry path across platforms.
+
+External review (2026-09-13): the bare `taskkill` invocation raised
+FileNotFoundError on Linux/macOS, crashing the retry that follows a failed
+flash attempt — the retry loop must survive cleanup failures on any OS.
+"""
+
+from flashgate import flasher
+
+
+class TestKillStlinkserver:
+    def test_noop_off_windows(self, monkeypatch):
+        monkeypatch.setattr(flasher.sys, "platform", "linux")
+
+        def boom(*args, **kwargs):
+            raise AssertionError("no process may be spawned off Windows")
+
+        monkeypatch.setattr(flasher.subprocess, "run", boom)
+        flasher._kill_stlinkserver()          # must neither raise nor spawn
+
+    def test_windows_invokes_taskkill(self, monkeypatch):
+        monkeypatch.setattr(flasher.sys, "platform", "win32")
+        calls = []
+        monkeypatch.setattr(flasher.subprocess, "run",
+                            lambda *a, **kw: calls.append(a) or None)
+        flasher._kill_stlinkserver()
+        assert calls, "on Windows the stale stlink-server must be killed"
+        assert calls[0][0][:2] == ["taskkill", "/F"]
+
+    def test_taskkill_failure_never_aborts_retry(self, monkeypatch):
+        monkeypatch.setattr(flasher.sys, "platform", "win32")
+
+        def boom(*args, **kwargs):
+            raise OSError("blocked by policy")
+
+        monkeypatch.setattr(flasher.subprocess, "run", boom)
+        flasher._kill_stlinkserver()          # best-effort cleanup: swallow
+
+    def test_taskkill_timeout_never_aborts_retry(self, monkeypatch):
+        # Adversarial review F1: TimeoutExpired is a SubprocessError, not an
+        # OSError — the retry loop must survive a kill that hangs 15 s too.
+        monkeypatch.setattr(flasher.sys, "platform", "win32")
+
+        def hang(*args, **kwargs):
+            raise flasher.subprocess.TimeoutExpired(cmd="taskkill", timeout=15)
+
+        monkeypatch.setattr(flasher.subprocess, "run", hang)
+        flasher._kill_stlinkserver()

flashgate-0.5.4/tests/test_gatestate.py

@@ -0,0 +1,158 @@
+"""Tree fingerprint and watched-path filtering over a real git repo."""
+
+from flashgate import gatestate
+
+
+class TestWatchedPaths:
+    def test_watch_filter(self, git_repo):
+        (git_repo / "App" / "extra.c").write_text("int x;\n")
+        (git_repo / "readme2.md").write_text("docs\n")
+        watched = gatestate.watched_paths(git_repo, ["*.c", "*.h"])
+        assert "App/extra.c" in watched
+        assert all(w.endswith((".c", ".h")) for w in watched)
+
+    def test_no_changes(self, git_repo):
+        assert gatestate.watched_paths(git_repo, ["*.c"]) == []
+
+
+class TestTreeFingerprint:
+    def test_stable_when_unchanged(self, git_repo):
+        a = gatestate.tree_fingerprint(git_repo)
+        b = gatestate.tree_fingerprint(git_repo)
+        assert a == b
+
+    def test_changes_with_content(self, git_repo):
+        before = gatestate.tree_fingerprint(git_repo)
+        (git_repo / "App" / "main.c").write_text("int main(void) { return 2; }\n")
+        assert gatestate.tree_fingerprint(git_repo) != before
+
+    def test_two_dirty_states_differ(self, git_repo):
+        (git_repo / "App" / "main.c").write_text("/* a */\n")
+        a = gatestate.tree_fingerprint(git_repo)
+        (git_repo / "App" / "main.c").write_text("/* b */\n")
+        assert gatestate.tree_fingerprint(git_repo) != a
+
+
+class TestState:
+    def test_roundtrip_and_missing(self, tmp_path, git_repo):
+        assert gatestate.load_state(git_repo) == {}
+        gatestate.save_state(git_repo, verified_fingerprint="abc", consecutive_blocks=0)
+        s = gatestate.load_state(git_repo)
+        assert s["verified_fingerprint"] == "abc"
+        assert "updated" in s
+
+
+class TestUntrackedContentFingerprint:
+    def test_untracked_content_edit_changes_fingerprint(self, git_repo):
+        # 2026-09-13 external-review finding: git status lists untracked
+        # paths only, so editing an untracked file's CONTENT kept the tree
+        # fingerprint unchanged — the Stop hook would reuse a cached PASS
+        # over silently-modified code. Contents must be hashed in.
+        from flashgate.gatestate import tree_fingerprint
+        untracked = git_repo / "App" / "new.c"
+        untracked.write_text("int x = 1;\n")
+        fp1 = tree_fingerprint(git_repo)
+        untracked.write_text("int x = 999; /* silently changed */\n")
+        fp2 = tree_fingerprint(git_repo)
+        assert fp1 != fp2, "untracked content edit MUST change the fingerprint"
+
+    def test_untracked_appearance_changes_fingerprint(self, git_repo):
+        from flashgate.gatestate import tree_fingerprint
+        fp1 = tree_fingerprint(git_repo)
+        (git_repo / "App" / "added.c").write_text("int y;\n")
+        assert tree_fingerprint(git_repo) != fp1
+
+    def test_tracked_edit_still_changes_fingerprint(self, git_repo):
+        from flashgate.gatestate import tree_fingerprint
+        fp1 = tree_fingerprint(git_repo)
+        (git_repo / "App" / "main.c").write_text("int main(void){return 1;}\n")
+        assert tree_fingerprint(git_repo) != fp1
+
+    def test_clean_tree_fingerprint_stable(self, git_repo):
+        from flashgate.gatestate import tree_fingerprint
+        assert tree_fingerprint(git_repo) == tree_fingerprint(git_repo)
+
+
+class TestUntrackedFingerprintCompleteness:
+    """Residual holes found by the adversarial re-review of the first fix:
+    untracked NEW directories (git status collapses to '?? dir/') and
+    non-ASCII paths (core.quotepath escaping) must not hide content edits,
+    and the gate's own state writes must not invalidate the PASS cache."""
+
+    def test_new_directory_content_edit_changes_fingerprint(self, git_repo):
+        from flashgate.gatestate import tree_fingerprint
+        mod = git_repo / "NewModule"
+        mod.mkdir()
+        (mod / "mod.c").write_text("int f(void){return 1;}\n")
+        fp1 = tree_fingerprint(git_repo)
+        (mod / "mod.c").write_text("int f(void){return 999;}\n")
+        fp2 = tree_fingerprint(git_repo)
+        assert fp1 != fp2, "content edit inside an untracked NEW dir must be visible"
+
+    def test_non_ascii_path_content_edit_changes_fingerprint(self, git_repo):
+        from flashgate.gatestate import tree_fingerprint
+        src = git_repo / "App" / "新模块.c"
+        src.write_text("int a = 1;\n")
+        fp1 = tree_fingerprint(git_repo)
+        src.write_text("int a = 999; /* silently changed */\n")
+        fp2 = tree_fingerprint(git_repo)
+        assert fp1 != fp2, "non-ASCII path (quotepath escaping) must not hide edits"
+
+    def test_state_dir_writes_do_not_change_fingerprint(self, git_repo):
+        from flashgate.gatestate import save_state, tree_fingerprint
+        save_state(git_repo, status="pass", fingerprint="x")   # state dir exists
+        fp1 = tree_fingerprint(git_repo)
+        save_state(git_repo, status="pass", fingerprint="y")   # timestamp moves
+        assert tree_fingerprint(git_repo) == fp1, ".flashgate/ must stay out of the digest"
+
+    def test_new_dir_source_triggers_watch(self, git_repo):
+        from flashgate.gatestate import DEFAULT_WATCH, watched_paths
+        (git_repo / "NewModule").mkdir()
+        (git_repo / "NewModule" / "mod.c").write_text("int x;\n")
+        assert watched_paths(git_repo, DEFAULT_WATCH) == ["NewModule/mod.c"]
+
+
+class TestProfileFingerprint:
+    """The board profile defines what PASS means (probe expectations, build
+    command). Its content must be part of the fingerprint, or a cached
+    green survives edits to the verification semantics themselves."""
+
+    def test_profile_edit_changes_fingerprint(self, git_repo, tmp_path):
+        from flashgate.gatestate import tree_fingerprint
+        profile = tmp_path / "board.yaml"
+        profile.write_text("probes: [strict]\n")
+        fp1 = tree_fingerprint(git_repo, profile)
+        profile.write_text("probes: [loose]\n")     # semantics changed
+        assert tree_fingerprint(git_repo, profile) != fp1
+
+    def test_tree_untouched_by_profile_only_change(self, git_repo, tmp_path):
+        # A profile edit alone must flip the combined fingerprint while the
+        # tree-only view stays identical — the delta comes from the profile.
+        from flashgate.gatestate import tree_fingerprint
+        profile = tmp_path / "board.yaml"
+        profile.write_text("probes: [a]\n")
+        before_tree = tree_fingerprint(git_repo)
+        combined1 = tree_fingerprint(git_repo, profile)
+        profile.write_text("probes: [b]\n")
+        assert tree_fingerprint(git_repo) == before_tree
+        assert tree_fingerprint(git_repo, profile) != combined1
+
+    def test_same_content_same_fingerprint(self, git_repo, tmp_path):
+        # Content-only identity: identical bytes, different name → same digest.
+        from flashgate.gatestate import tree_fingerprint
+        a = tmp_path / "a.yaml"
+        b = tmp_path / "b.yaml"
+        a.write_text("same: true\n")
+        b.write_text("same: true\n")
+        assert tree_fingerprint(git_repo, a) == tree_fingerprint(git_repo, b)
+
+    def test_missing_profile_is_stable_not_crashing(self, git_repo, tmp_path):
+        from flashgate.gatestate import tree_fingerprint
+        ghost = tmp_path / "ghost.yaml"
+        assert tree_fingerprint(git_repo, ghost) == tree_fingerprint(git_repo, ghost)
+
+    def test_profile_none_differs_from_empty_profile(self, git_repo, tmp_path):
+        from flashgate.gatestate import tree_fingerprint
+        empty = tmp_path / "empty.yaml"
+        empty.write_text("")
+        assert tree_fingerprint(git_repo) != tree_fingerprint(git_repo, empty)

flashgate-0.5.4/tests/test_hook_stop.py

@@ -0,0 +1,85 @@
+"""Stop hook wiring: the board profile must reach the fingerprint.
+
+Gatestate-level tests prove profile edits change the fingerprint; this
+file guards the CALLER. If hooks/flashgate_stop.py ever stops passing
+board.yaml_path into tree_fingerprint, a cached PASS would survive edits
+to the verification semantics (probe expectations, build command) and no
+gatestate test would notice — this is the test that goes red.
+"""
+
+import importlib.util
+import io
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+HOOK_PATH = Path(__file__).resolve().parent.parent / "hooks" / "flashgate_stop.py"
+
+
+def load_hook():
+    spec = importlib.util.spec_from_file_location("flashgate_stop_under_test", HOOK_PATH)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+@pytest.fixture()
+def hook(git_repo, tmp_path, monkeypatch):
+    mod = load_hook()
+    # A watched change must exist, or the hook allows the stop before it
+    # ever reaches the fingerprint comparison.
+    (git_repo / "App" / "extra.c").write_text("int x;\n")
+    profile = tmp_path / "board.yaml"
+    profile.write_text("board: t\nprobes: [strict]\n")
+    board = SimpleNamespace(
+        firmware_dir=git_repo, watch_globs=("*",), yaml_path=profile,
+    )
+    monkeypatch.setattr(mod, "load_board", lambda p: board)
+    monkeypatch.delenv("FLASHGATE_BOARD", raising=False)
+    monkeypatch.setattr(sys, "argv", ["flashgate_stop.py"])
+    return mod, board, profile
+
+
+def run_stop(mod, monkeypatch, state):
+    monkeypatch.setattr(sys, "stdin", io.StringIO("{}"))
+    monkeypatch.setattr(mod.gatestate, "load_state", lambda d: dict(state))
+    return mod.main()
+
+
+class TestProfileInvalidatesCache:
+    def test_profile_edit_after_cached_pass_reruns_verify(
+            self, hook, git_repo, monkeypatch):
+        mod, board, profile = hook
+        calls = []
+
+        def fake_verify(board_arg):
+            calls.append(board_arg)
+            return 0, "PASS"
+
+        monkeypatch.setattr(mod, "run_verify", fake_verify)
+        saved = {}
+
+        def fake_save(d, **fields):
+            saved.update(fields)
+
+        monkeypatch.setattr(mod.gatestate, "save_state", fake_save)
+
+        # 1st stop: no cache → real verify → PASS cached (tree + profile).
+        assert run_stop(mod, monkeypatch, {}) == 0
+        assert len(calls) == 1
+        cached = saved["verified_fingerprint"]
+
+        # 2nd stop: identical tree AND profile → cache hit, no verify.
+        assert run_stop(mod, monkeypatch,
+                        {"verified_fingerprint": cached}) == 0
+        assert len(calls) == 1
+
+        # 3rd stop: firmware tree untouched, but the verification SEMANTICS
+        # changed (profile edit) → the cached green must NOT be reused.
+        profile.write_text("board: t\nprobes: [loose]\n")
+        assert run_stop(mod, monkeypatch,
+                        {"verified_fingerprint": cached}) == 0
+        assert len(calls) == 2, "a profile edit must force a re-verify"
+        assert saved["verified_fingerprint"] != cached

flashgate-0.5.2/flashgate/gatestate.py

@@ -1,81 +0,0 @@
-"""Gate state: fingerprint the firmware tree, remember the last PASS.
-
-The Stop hook only re-runs the (slow) hardware verify when the firmware tree
-actually changed since the last passing run. The fingerprint covers HEAD,
-the full diff against HEAD, and the untracked-file list — so any content
-change to a watched file produces a new fingerprint.
-
-Escalation: after MAX_CONSECUTIVE_BLOCKS failed blocks for the SAME
-fingerprint, the gate releases with a warning instead of blocking forever
-(coderio VerifyGate semantics: never wedge the session, never silently
-give up).
-"""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import subprocess
-from datetime import datetime, timezone
-from fnmatch import fnmatch
-from pathlib import Path
-
-STATE_DIR = ".flashgate"
-STATE_FILE = "state.json"
-MAX_CONSECUTIVE_BLOCKS = 2
-
-DEFAULT_WATCH = [
-    "*.c", "*.h", "*.s", "*.ld", "*.ioc",
-    "CMakeLists.txt", "*.cmake", "cmake/*",
-]
-
-
-def _git(args: list[str], cwd: Path) -> str:
-    try:
-        return subprocess.run(
-            ["git", *args], cwd=cwd, capture_output=True, text=True,
-            timeout=20, check=True,
-        ).stdout
-    except (subprocess.SubprocessError, OSError):
-        return ""
-
-
-def tree_fingerprint(fw_dir: Path) -> str:
-    """Content-identity of the working tree (not just HEAD: dirty trees with
-    different edits must NOT share a fingerprint)."""
-    head = _git(["rev-parse", "HEAD"], fw_dir)
-    diff = _git(["diff", "HEAD"], fw_dir)
-    status = _git(["status", "--porcelain"], fw_dir)
-    blob = "\x00".join((head, diff, status))
-    return hashlib.sha256(blob.encode("utf-8", errors="replace")).hexdigest()
-
-
-def watched_paths(fw_dir: Path, patterns: list[str]) -> list[str]:
-    """Working-tree changes that match the watch globs (gate triggers)."""
-    status = _git(["status", "--porcelain"], fw_dir)
-    watched: list[str] = []
-    for line in status.splitlines():
-        path = line[3:].strip().strip('"')
-        if " -> " in path:                     # rename: judge by the new name
-            path = path.split(" -> ")[1]
-        if path and any(fnmatch(path, pat) for pat in patterns):
-            watched.append(path)
-    return watched
-
-
-def state_path(fw_dir: Path) -> Path:
-    return fw_dir / STATE_DIR / STATE_FILE
-
-
-def load_state(fw_dir: Path) -> dict:
-    try:
-        return json.loads(state_path(fw_dir).read_text(encoding="utf-8"))
-    except (OSError, ValueError):
-        return {}
-
-
-def save_state(fw_dir: Path, **fields) -> None:
-    path = state_path(fw_dir)
-    path.parent.mkdir(parents=True, exist_ok=True)
-    payload = {"updated": datetime.now(timezone.utc).isoformat(), **fields}
-    path.write_text(json.dumps(payload, indent=2), encoding="utf-8")

flashgate-0.5.2/tests/test_gatestate.py

@@ -1,42 +0,0 @@
-"""Tree fingerprint and watched-path filtering over a real git repo."""
-
-from flashgate import gatestate
-
-
-class TestWatchedPaths:
-    def test_watch_filter(self, git_repo):
-        (git_repo / "App" / "extra.c").write_text("int x;\n")
-        (git_repo / "readme2.md").write_text("docs\n")
-        watched = gatestate.watched_paths(git_repo, ["*.c", "*.h"])
-        assert "App/extra.c" in watched
-        assert all(w.endswith((".c", ".h")) for w in watched)
-
-    def test_no_changes(self, git_repo):
-        assert gatestate.watched_paths(git_repo, ["*.c"]) == []
-
-
-class TestTreeFingerprint:
-    def test_stable_when_unchanged(self, git_repo):
-        a = gatestate.tree_fingerprint(git_repo)
-        b = gatestate.tree_fingerprint(git_repo)
-        assert a == b
-
-    def test_changes_with_content(self, git_repo):
-        before = gatestate.tree_fingerprint(git_repo)
-        (git_repo / "App" / "main.c").write_text("int main(void) { return 2; }\n")
-        assert gatestate.tree_fingerprint(git_repo) != before
-
-    def test_two_dirty_states_differ(self, git_repo):
-        (git_repo / "App" / "main.c").write_text("/* a */\n")
-        a = gatestate.tree_fingerprint(git_repo)
-        (git_repo / "App" / "main.c").write_text("/* b */\n")
-        assert gatestate.tree_fingerprint(git_repo) != a
-
-
-class TestState:
-    def test_roundtrip_and_missing(self, tmp_path, git_repo):
-        assert gatestate.load_state(git_repo) == {}
-        gatestate.save_state(git_repo, verified_fingerprint="abc", consecutive_blocks=0)
-        s = gatestate.load_state(git_repo)
-        assert s["verified_fingerprint"] == "abc"
-        assert "updated" in s