add uncommitted files

2026-07-29 23:32:26 +09:00
parent fb0f8f39a0
commit f5379472ce
80 changed files with 7461 additions and 1 deletions
@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+"""Codex PreToolUse 정책: 위험 명령과 테스트 없는 구현 파일 수정을 차단한다."""
+
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+SCRIPTS_DIR = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIR) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIR))
+
+from msvc_harness.config import ConfigError, load_config
+from msvc_harness.tdd_policy import CPP_SUFFIXES, evaluate_paths
+
+
+DANGEROUS_PATTERNS = (
+    re.compile(r"\bgit\s+reset\s+--hard\b", re.IGNORECASE),
+    re.compile(r"\bgit\s+push\b[^\n]*--force(?:-with-lease)?\b", re.IGNORECASE),
+    re.compile(r"\brm\s+-rf\b", re.IGNORECASE),
+    re.compile(
+        r"\bRemove-Item\b(?=[^\n]*-Recurse\b)(?=[^\n]*-Force\b)",
+        re.IGNORECASE,
+    ),
+    re.compile(
+        r"\b(?:rmdir|rd)\b(?=[^\n]*/s\b)(?=[^\n]*/q\b)",
+        re.IGNORECASE,
+    ),
+    re.compile(r"\bDROP\s+TABLE\b", re.IGNORECASE),
+)
+PATCH_PATH = re.compile(
+    r"^\*\*\* (?:(?:Add|Update|Delete) File:|Move to:) (?P<path>.+?)\s*$",
+    re.MULTILINE,
+)
+
+
+def _tool_input(payload: dict[str, Any]) -> dict[str, Any]:
+    value = payload.get("tool_input", {})
+    return value if isinstance(value, dict) else {}
+
+
+def _candidate_paths(payload: dict[str, Any], root: Path) -> list[Path]:
+    tool_input = _tool_input(payload)
+    raw_paths: list[str] = []
+    for key in ("path", "file_path"):
+        value = tool_input.get(key)
+        if isinstance(value, str) and value.strip():
+            raw_paths.append(value.strip())
+
+    edits = tool_input.get("edits")
+    if isinstance(edits, list):
+        for edit in edits:
+            if not isinstance(edit, dict):
+                continue
+            value = edit.get("path")
+            if isinstance(value, str) and value.strip():
+                raw_paths.append(value.strip())
+
+    for key in ("patch", "input"):
+        value = tool_input.get(key)
+        if isinstance(value, str):
+            raw_paths.extend(match.group("path") for match in PATCH_PATH.finditer(value))
+
+    paths: list[Path] = []
+    for raw_path in raw_paths:
+        path = Path(raw_path)
+        paths.append(path.resolve() if path.is_absolute() else (root / path).resolve())
+    return list(dict.fromkeys(paths))
+
+
+def evaluate(payload: dict[str, Any], root: Path) -> str | None:
+    """Return a blocking reason, or None when the tool call is allowed."""
+    tool_name = str(payload.get("tool_name", ""))
+    tool_input = _tool_input(payload)
+
+    if tool_name in {"Bash", "shell_command", "PowerShell"}:
+        command = tool_input.get("command", "")
+        if isinstance(command, str) and any(
+            pattern.search(command) for pattern in DANGEROUS_PATTERNS
+        ):
+            return "위험한 명령어가 감지되어 실행을 차단했습니다."
+
+    if tool_name not in {"apply_patch", "Edit", "MultiEdit", "Write"}:
+        return None
+
+    paths = _candidate_paths(payload, root)
+    try:
+        config = load_config(root)
+    except ConfigError as exc:
+        if any(path.suffix.lower() in CPP_SUFFIXES for path in paths):
+            return f"TDD GUARD: .harness/config.json must be repaired: {exc}"
+        return None
+    return evaluate_paths(paths, root, config.tdd)
+
+
+def main() -> int:
+    try:
+        payload = json.load(sys.stdin)
+        if not isinstance(payload, dict):
+            raise TypeError("hook input must be a JSON object")
+        cwd = payload.get("cwd")
+        if cwd is not None and not isinstance(cwd, str):
+            raise TypeError("hook cwd must be a string")
+    except (json.JSONDecodeError, TypeError) as exc:
+        print(f"TDD GUARD: hook 입력을 해석하지 못해 검사를 건너뜁니다: {exc}", file=sys.stderr)
+        return 0
+
+    root = Path(payload.get("cwd") or Path.cwd()).resolve()
+    reason = evaluate(payload, root)
+    if reason:
+        print(reason, file=sys.stderr)
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,148 @@
+#!/usr/bin/env python3
+"""Codex Stop hook: validate discovered C/C++ projects with MSVC."""
+
+import json
+import os
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+
+SCRIPTS = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SCRIPTS))
+
+from msvc_harness.adapters.base import AdapterError
+from msvc_harness.adapters.cmake import CMakeAdapter
+from msvc_harness.adapters.msbuild import MSBuildAdapter
+from msvc_harness.config import ConfigError, load_config
+from msvc_harness.discovery import DiscoveryError, discover_project
+from msvc_harness.models import ProjectKind
+from msvc_harness.process import ValidationFailure, execute_plan
+from msvc_harness.toolchain import ToolchainError, discover_toolchain
+
+
+REENTRY_ENV = "CODEX_STOP_VALIDATION_ACTIVE"
+TOTAL_TIMEOUT_SECONDS = 1800
+
+
+def _remaining(deadline, clock, stage):
+    remaining = deadline - clock()
+    if remaining <= 0:
+        raise ValidationFailure(f"{stage} timed out before it could start")
+    return remaining
+
+
+def _project_root(
+    cwd: Path,
+    *,
+    deadline: float,
+    run=subprocess.run,
+    clock=time.monotonic,
+) -> Path:
+    argv = ["git", "rev-parse", "--show-toplevel"]
+    resolved_cwd = cwd.resolve()
+    try:
+        result = run(
+            argv,
+            cwd=resolved_cwd,
+            capture_output=True,
+            text=True,
+            shell=False,
+            timeout=_remaining(deadline, clock, "repository discovery"),
+        )
+    except subprocess.TimeoutExpired as exc:
+        raise ValidationFailure(
+            f"repository discovery timed out; argv={argv!r}; "
+            f"cwd={str(resolved_cwd)!r}"
+        ) from exc
+    if result.returncode == 0 and result.stdout.strip():
+        return Path(result.stdout.strip()).resolve()
+    return resolved_cwd
+
+
+def run_validations(
+    root: Path,
+    *,
+    deadline: float | None = None,
+    clock=time.monotonic,
+) -> tuple[bool, str]:
+    """Build and test a discovered C/C++ project, when one exists."""
+    if deadline is None:
+        deadline = clock() + TOTAL_TIMEOUT_SECONDS
+    try:
+        config = load_config(root)
+        discovery = discover_project(root, config)
+        if discovery.selection is None:
+            return True, ""
+        selection = discovery.selection
+        tools = discover_toolchain(
+            selection.kind,
+            deadline=deadline,
+            clock=clock,
+        )
+        adapter = (
+            CMakeAdapter()
+            if selection.kind is ProjectKind.CMAKE
+            else MSBuildAdapter()
+        )
+        plan = adapter.create_plan(root, selection, config, tools)
+        child_env = os.environ.copy()
+        child_env[REENTRY_ENV] = "1"
+        execute_plan(
+            plan,
+            root,
+            env=child_env,
+            deadline=deadline,
+            clock=clock,
+        )
+        return True, ""
+    except (
+        ConfigError,
+        DiscoveryError,
+        ToolchainError,
+        AdapterError,
+        ValidationFailure,
+        OSError,
+    ) as exc:
+        return False, str(exc)
+
+
+def _emit_stop_response(message: str) -> None:
+    print(
+        json.dumps(
+            {
+                "continue": False,
+                "stopReason": message,
+                "systemMessage": message,
+            },
+            ensure_ascii=False,
+        )
+    )
+
+
+def main(*, run=subprocess.run, clock=time.monotonic) -> int:
+    if os.environ.get(REENTRY_ENV) == "1":
+        return 0
+
+    deadline = clock() + TOTAL_TIMEOUT_SECONDS
+    try:
+        root = _project_root(
+            Path.cwd(),
+            deadline=deadline,
+            run=run,
+            clock=clock,
+        )
+        ok, message = run_validations(root, deadline=deadline, clock=clock)
+    except (OSError, ValidationFailure) as exc:
+        _emit_stop_response(f"validation hook failed: {exc}")
+        return 0
+
+    if ok:
+        return 0
+    _emit_stop_response(message)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())