|
| 1 | +#!/usr/bin/env bash |
| 2 | +# warn-signature-changes.sh — PreToolUse hook for Bash (git commit) |
| 3 | +# Warns when staged changes modify function signatures, highlighting risk |
| 4 | +# level based on the symbol's role (core > utility > others). |
| 5 | +# Informational only — never blocks. |
| 6 | + |
| 7 | +set -euo pipefail |
| 8 | + |
| 9 | +INPUT=$(cat) |
| 10 | + |
| 11 | +# Extract the command from tool_input JSON |
| 12 | +COMMAND=$(echo "$INPUT" | node -e " |
| 13 | + let d=''; |
| 14 | + process.stdin.on('data',c=>d+=c); |
| 15 | + process.stdin.on('end',()=>{ |
| 16 | + const p=JSON.parse(d).tool_input?.command||''; |
| 17 | + if(p)process.stdout.write(p); |
| 18 | + }); |
| 19 | +" 2>/dev/null) || true |
| 20 | + |
| 21 | +if [ -z "$COMMAND" ]; then |
| 22 | + exit 0 |
| 23 | +fi |
| 24 | + |
| 25 | +# Only trigger on git commit commands |
| 26 | +if ! echo "$COMMAND" | grep -qE '(^|\s|&&\s*)git\s+commit\b'; then |
| 27 | + exit 0 |
| 28 | +fi |
| 29 | + |
| 30 | +# Guard: codegraph DB must exist |
| 31 | +WORK_ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || WORK_ROOT="${CLAUDE_PROJECT_DIR:-.}" |
| 32 | +if [ ! -f "$WORK_ROOT/.codegraph/graph.db" ]; then |
| 33 | + exit 0 |
| 34 | +fi |
| 35 | + |
| 36 | +# Guard: must have staged changes |
| 37 | +STAGED=$(git diff --cached --name-only 2>/dev/null) || true |
| 38 | +if [ -z "$STAGED" ]; then |
| 39 | + exit 0 |
| 40 | +fi |
| 41 | + |
| 42 | +# Run check --staged to get signature violations, then enrich with role + caller count |
| 43 | +WARNING=$(echo "" | node --input-type=module -e " |
| 44 | + import path from 'path'; |
| 45 | + const workRoot = process.argv[2]; |
| 46 | + const { checkData } = await import(path.join(workRoot, 'src/check.js')); |
| 47 | + const { openReadonlyOrFail } = await import(path.join(workRoot, 'src/db.js')); |
| 48 | +
|
| 49 | + const result = checkData(undefined, { staged: true, noTests: true }); |
| 50 | + if (!result || result.error) process.exit(0); |
| 51 | +
|
| 52 | + const sigPred = (result.predicates || []).find(p => p.name === 'signatures'); |
| 53 | + if (!sigPred || sigPred.passed || !sigPred.violations.length) process.exit(0); |
| 54 | +
|
| 55 | + const db = openReadonlyOrFail(); |
| 56 | + const lines = []; |
| 57 | +
|
| 58 | + for (const v of sigPred.violations) { |
| 59 | + // Get role from DB |
| 60 | + const node = db.prepare( |
| 61 | + 'SELECT role FROM nodes WHERE name = ? AND file = ? AND line = ?' |
| 62 | + ).get(v.name, v.file, v.line); |
| 63 | + const role = node?.role || 'unknown'; |
| 64 | +
|
| 65 | + // Count transitive callers (BFS, depth 3) |
| 66 | + const defNode = db.prepare( |
| 67 | + 'SELECT id FROM nodes WHERE name = ? AND file = ? AND line = ?' |
| 68 | + ).get(v.name, v.file, v.line); |
| 69 | +
|
| 70 | + let callerCount = 0; |
| 71 | + if (defNode) { |
| 72 | + const visited = new Set([defNode.id]); |
| 73 | + let frontier = [defNode.id]; |
| 74 | + for (let d = 0; d < 3; d++) { |
| 75 | + const next = []; |
| 76 | + for (const fid of frontier) { |
| 77 | + const callers = db.prepare( |
| 78 | + 'SELECT DISTINCT n.id FROM edges e JOIN nodes n ON e.source_id = n.id WHERE e.target_id = ? AND e.kind = \\'calls\\'' |
| 79 | + ).all(fid); |
| 80 | + for (const c of callers) { |
| 81 | + if (!visited.has(c.id)) { |
| 82 | + visited.add(c.id); |
| 83 | + next.push(c.id); |
| 84 | + callerCount++; |
| 85 | + } |
| 86 | + } |
| 87 | + } |
| 88 | + frontier = next; |
| 89 | + if (!frontier.length) break; |
| 90 | + } |
| 91 | + } |
| 92 | +
|
| 93 | + const risk = role === 'core' ? 'HIGH' : role === 'utility' ? 'MEDIUM' : 'low'; |
| 94 | + lines.push(risk + ': ' + v.name + ' (' + v.kind + ') [' + role + '] at ' + v.file + ':' + v.line + ' — ' + callerCount + ' transitive callers'); |
| 95 | + } |
| 96 | +
|
| 97 | + db.close(); |
| 98 | +
|
| 99 | + if (lines.length > 0) { |
| 100 | + process.stdout.write(lines.join('\\n')); |
| 101 | + } |
| 102 | +" -- "$WORK_ROOT" 2>/dev/null) || true |
| 103 | + |
| 104 | +if [ -z "$WARNING" ]; then |
| 105 | + exit 0 |
| 106 | +fi |
| 107 | + |
| 108 | +# Escape for JSON |
| 109 | +ESCAPED=$(printf '%s' "$WARNING" | node -e " |
| 110 | + let d=''; |
| 111 | + process.stdin.on('data',c=>d+=c); |
| 112 | + process.stdin.on('end',()=>process.stdout.write(JSON.stringify(d))); |
| 113 | +" 2>/dev/null) || true |
| 114 | + |
| 115 | +if [ -z "$ESCAPED" ]; then |
| 116 | + exit 0 |
| 117 | +fi |
| 118 | + |
| 119 | +# Inject as additionalContext — informational, never blocks |
| 120 | +node -e " |
| 121 | + console.log(JSON.stringify({ |
| 122 | + hookSpecificOutput: { |
| 123 | + hookEventName: 'PreToolUse', |
| 124 | + permissionDecision: 'allow', |
| 125 | + additionalContext: '[codegraph] Signature changes detected in staged files:\\n' + JSON.parse(process.argv[1]) |
| 126 | + } |
| 127 | + })); |
| 128 | +" "$ESCAPED" 2>/dev/null || true |
| 129 | + |
| 130 | +exit 0 |
0 commit comments