Repository: streamlit/streamlit
File: .claude/hooks/pre_bash_redirect.py (Python)

Code before:
    ^                       # start of string
    (?:                     # non-capturing group for optional python invocation
        python              # 'python'
        (?:3)?              # optional '3'
        \s+                 # whitespace
        -m                  # '-m'
        \s+                 # whitespace
    )?
    pytest                  # 'pytest'
    \b                      # word boundary
    """,
    re.IGNORECASE | re.VERBOSE,
)


def main():
    try:
        payload = json.load(sys.stdin)
    except Exception as e:
        # Fail secure: block (exit 2) if we can't parse input to verify safety
        print(  # noqa: T201
            f"Policy: Failed to parse hook input ({type(e).__name__}: {e}). "
            f"Blocking tool call for safety.",
            file=sys.stderr,
        )
        sys.exit(2)

    if payload.get("hook_event_name") != "PreToolUse":
        sys.exit(0)
    if payload.get("tool_name") != "Bash":
        sys.exit(0)

    cmd = (payload.get("tool_input") or {}).get("command", "") or ""
    norm = re.sub(r"\s+", " ", cmd).strip()

    # Check if this is a pytest command targeting e2e_playwright
    if PYTEST_PATTERN.search(norm) and "e2e_playwright" in norm:
        print(  # noqa: T201
            f"Policy: Bash('{norm}') is blocked.\n"
            f"E2E tests should use make commands instead:\n"
            f"  - Run 'make help' to see available targets\n"
            f"  - Use 'make run-e2e-test <filename>' for e2e tests\n",
            file=sys.stderr,
        )
        sys.exit(2)

    sys.exit(0)


if __name__ == "__main__":
    main()

Review comment (security):
The exception handler for JSON parsing previously exited with code 0 (allow), which silently bypassed policy enforcement if stdin was malformed or missing. Any parsing error would allow the tool call to proceed unchecked, defeating the security policy intent.

@sfc-gh-nbellante Do you agree with this aspect? 

Code after:
    ^                       # start of string
    (?:                     # non-capturing group for optional python invocation
        python              # 'python'
        (?:3)?              # optional '3'
        \s+                 # whitespace
        -m                  # '-m'
        \s+                 # whitespace
    )?
    pytest                  # 'pytest'
    \b                      # word boundary
    """,
    re.IGNORECASE | re.VERBOSE,
)


def main():
    try:
        payload = json.load(sys.stdin)
    except Exception as e:
        # Fail secure: block (exit 2) if we can't parse input to verify safety.
        print(  # noqa: T201
            f"Policy: Failed to parse hook input ({type(e).__name__}: {e}). "
            f"Blocking tool call for safety.",
            file=sys.stderr,
        )
        sys.exit(2)

    if payload.get("hook_event_name") != "PreToolUse":
        sys.exit(0)
    if payload.get("tool_name") != "Bash":
        sys.exit(0)

    cmd = (payload.get("tool_input") or {}).get("command", "") or ""
    norm = re.sub(r"\s+", " ", cmd).strip()

    # Check if this is a pytest command targeting e2e_playwright
    if PYTEST_PATTERN.search(norm) and "e2e_playwright" in norm:
        print(  # noqa: T201
            f"Policy: Bash('{norm}') is blocked.\n"
            f"E2E tests should use make commands instead:\n"
            f"  - Run 'make help' to see available targets\n"
            f"  - Use 'make run-e2e-test <filename>' for e2e tests\n",
            file=sys.stderr,
        )
        sys.exit(2)

    sys.exit(0)


if __name__ == "__main__":
    main()