Append debug message to log file with timestamp.

Execute callback with exclusive access to the state file. The callback receives the state dict and can modify it in place. State is saved

Render a vuln list into the user-facing guidance block. Shared by analyze_code_security, agentic_review, and the late-dedup paths in the Stop

Absolute repo root for `cwd`, or None if not in a work tree.

Write a SyncHookJSONOutput line to stdout for Claude Code to pick up. For asyncRewake (Stop) hooks, CC scans stdout for the first {-prefixed

Evaluate all rules and return combined results. Checks all rules and accumulates matches. Blocking rules take priority over warning r

Use Haiku to perform a security review of code. files: list of (file_path, content_or_diff) tuples is_diff: if True, the content is a uni

Load all hookify rules from .claude directory. Args: event: Optional event filter ("bash", "file", "stop", etc.) Returns: Li

Cap per-file and total content bytes before they're packed into the review prompt. Returns the capped (path, content) list. Sets module-level

Drop vulns that a CONCURRENT asyncRewake hook wrote to previous_findings while this hook's LLM was running. `prompted` is the (filePath, cate

One-liner for the user-facing task-notification summary. The full guidance goes to the model via stderr; this is the line the user actually s

When `diff_files` exceeds `cap`, return the top-`cap` by security relevance plus the count dropped. Otherwise return (diff_files, 0). Score =

Parse unified diff output into a list of (file_path, diff_content) tuples. Only includes files with source code extensions.

Agentic commit review gate. Enabled by default. SG_AGENTIC_COMMIT_REVIEW (=1/on or =0/off) remains as an explicit per-user override for opt-o

Race the agentic reviewer against a delayed single-shot fallback. Agentic starts at t=0. After SG_AGENTIC_RACE_DELAY_S (default 180s), the si

Resolve the Anthropic-protocol endpoint base URL. Honors ANTHROPIC_BASE_URL (the convention the Anthropic SDK and CC itself use) so customers

Record that `shas` were reviewed. Best-effort; never raises. Uses fcntl.flock for the read-gc-write; appends are O_APPEND-atomic but GC needs

Call the configured LLM model with extended thinking and structured outputs. Model defaults to Sonnet 4.6 but can be overridden via SECURITY_

Run prompt through the model 2× in parallel and OR-merge the results. The second look samples the model again on the same prompt — independent

Existing config file paths, lowest precedence first (so concat reads in precedence order user → project → project-local). Truncation is done on

Absolute shared `.git` directory for repo_root. Uses `rev-parse --git-common-dir` so linked worktrees resolve to the SHARED gitdir, not the p

Return the current HEAD SHA, or None if not a git repo / no commits.

Set of full 40-hex shas previously reviewed in this clone.

Return the slice of `bash_output` that contains the push's range lines. `_PUSH_RANGE_RE` is not push-specific — `git fetch` and `git pull` print

Accumulate one API response's token usage. `usage` is the Anthropic `usage` dict (HTTP) or the SDK ResultMessage.usage dict — both use the sam

Yield an env dict pointing GIT_INDEX_FILE at a throwaway copy of the repo's index with `git add --intent-to-add` applied, so untracked files s

Two-stage Agent-SDK review: investigate (Read/Grep/Glob over the repo) then a self-refute filter pass. Returns (guidance_or_None, vulns, metri

Rolling-window rate limit: allow at most `max_per_window` calls per `window_s` seconds, per (session_id, key). Returns (allowed: bool, count_

Check if file path or content matches any security patterns. Returns ALL matches.

Run once. Under a remote/proxied environment, probe api.anthropic.com; if blackholed, scrub NO_PROXY and re-probe. Returns True if reachable (

Extract YAML frontmatter and message body from markdown. Returns (frontmatter_dict, message_body). Supports multi-line dictionary items in l

Create Rule from frontmatter dict and message body.

Get session-specific state file path.

Put consumed touched_paths back so the next Stop reviews them. consume_stop_state cleared touched_paths on disk; if Stop then exits early for

Pack a set of rule names into a bitmask. Bit N set means RuleId(N) matched. User-defined patterns (rule_name starting with "user:") have no static

opts.env for the SDK-spawned inner `claude` CLI. Always neutralizes the fd-passing vars (a stale/closed fd makes the inner CLI runaway-alloca

Single-turn SDK call as a substitute for the HTTP _call_claude path on 3P providers. Uses the same `output_format` JSON-schema contract so the

Check if a single condition matches. Args: condition: Condition to check tool_name: Tool being used tool_

De-dupe across hooks.json `if` matchers firing for the same Bash call. `git commit -m x && git push` matches both `Bash(git commit:*)` and `B

Advance the diff base past the contiguous reviewed prefix. Spec: review `git diff B..HEAD` where `B` is the newest commit such that `prev_ups

Where the remote was BEFORE this push. Preference order: 1. Parse `abc..def` from push stdout — authoritative, exact. 2. `<branch>@{u

Convert absolute touched-paths to repo-relative pathspec args for git diff. Paths outside cwd (e.g. ~/.claude/…) are dropped. Returns the list

Gate for the two-call dual_or review path. Default OFF — the second call roughly doubles API spend for the review. For users paying their own

Extract field value from tool input or hook input data. Args: field: Field name like "command", "new_text", "file_path", "reason"

Find the real index file for a git repo. Handles worktrees where .git is a file pointing to the main repo's gitdir. Returns the absolute

`git diff -p base head` as text on success, None on error. Distinguishing failure from success-with-empty-diff matters: the push-sweep caller

Return the set of repo-root-relative paths that differ from `base`, or None if git failed (unresolvable ref, not a repo, timeout). Callers mus

Return (fresh_commit_shas, stale_count) from the HEAD reflog. Scans the last `max_n` reflog entries and returns the SHAs whose action is `com

Shas in `base..head`, oldest→newest. Empty list on error.

One `git status --porcelain=v1 -z` → (tracked_dirty, untracked) sets of repo-root-relative paths, or (None, None) on error. Replaces the `_tem

Match a path against include/exclude globs. ``**`` matches any depth.

Heuristic catastrophic-backtracking check. Not a proof. Catches: - nested quantifiers ((a+)*, (a*b)+) - wildcard groups under repetition (

True iff a 3P provider env var is set to a truthy value. Mirrors how the CC harness itself decides 1P vs 3P at startup. Cheap to call — no ne

True if `maybe_ancestor` is reachable from `descendant` (i.e. HEAD moved forward via commit/merge, not sideways via checkout).

Repo-root-relative untracked (and not-ignored) path → mtime_ns, or {} on error. Used at UPS to snapshot the pre-turn untracked set so the Stop

Check if tool_name matches the matcher pattern. Args: matcher: Pattern like "Bash", "Edit|Write", "*" tool_name: Actu

Fire-and-forget SDK bootstrap, for remote-pod environments. Under CLAUDE_CODE_SYNC_PLUGIN_INSTALL=true (CCR-style remote pods), plugins are s

True for models that reject the budget_tokens thinking form (4.6+).

Read a YAML or JSON config file. Returns None on missing/malformed.

Encode plugin.json version "M.m.p" as M*10000 + m*100 + p so it fits the bool|number metrics constraint. Returns 0 if unreadable.

Check if pattern matches text using regex. Args: pattern: Regex pattern text: Text to match against Returns:

For a `git commit --amend` we just ran, return the pre-amend SHA via reflog, or None if it can't be safely determined. expected_post_sha: the

Check if rule matches input data. Args: rule: Rule to evaluate input_data: Hook input data Returns:

Snapshot the accumulator as metric keys. Returns {} when no API calls were made so skip-path emits don't burn key budget. cost_usd rounded to

Validate one user pattern entry. Returns a rule dict in the same shape as the built-in SECURITY_PATTERNS, or None if invalid (logged).

Atomically check if a warning has been shown and mark it as shown if not. Returns True if this is the first time seeing this warning (should