claude-dev-env 1.30.1 → 1.31.0

package/hooks/blocking/test_destructive_command_blocker.py

@@ -265,6 +265,403 @@ def test_rm_rf_asks_when_command_is_compound_with_ampersand() -> None:
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
 
 
+def test_rm_rf_allowed_when_leading_cd_into_ephemeral_subdirectory_double_quoted() -> None:
+    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf .bugteam-tmp')
+
+    result = _run_rm_hook(payload)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_allowed_when_leading_cd_into_ephemeral_subdirectory_single_quoted() -> None:
+    payload = _make_bash_payload("cd '/tmp/bugteam_scratch' && rm -rf .bugteam-tmp")
+
+    result = _run_rm_hook(payload)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_allowed_when_leading_cd_into_ephemeral_subdirectory_unquoted() -> None:
+    payload = _make_bash_payload("cd /tmp/bugteam_scratch && rm -rf .bugteam-tmp")
+
+    result = _run_rm_hook(payload)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_allowed_when_leading_cd_into_windows_temp_worktree_subdirectory() -> None:
+    windows_style_temp_worktree = (
+        r"C:\Users\jon\AppData\Local\Temp\bugteam-pr-58-20260424071040\pr-58\worktree"
+    )
+    payload = _make_bash_payload(
+        f'cd "{windows_style_temp_worktree}" && rm -rf .bugteam-tmp'
+    )
+
+    result = _run_rm_hook(payload)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_allowed_when_leading_cd_into_ephemeral_with_extra_compound_after_rm() -> None:
+    payload = _make_bash_payload(
+        'cd "/tmp/bugteam_scratch" && rm -rf .bugteam-tmp && gh pr checks 19'
+    )
+
+    result = _run_rm_hook(payload)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_asks_when_leading_cd_into_ephemeral_with_wildcard_target() -> None:
+    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf *')
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_cwd_ephemeral_and_relative_target_escapes_via_dotdot() -> None:
+    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf ../../etc')
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_rm_uses_files0_from_long_option_with_equals() -> None:
+    payload = _make_bash_payload(
+        'cd "/tmp/bugteam_scratch" && rm -rf --files0-from=/etc/passwd'
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_rm_uses_unknown_long_option() -> None:
+    payload = _make_bash_payload(
+        'cd "/tmp/bugteam_scratch" && rm -rf --nuke /tmp/bugteam_scratch/stuff'
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_rm_target_uses_windows_backslash_absolute_path_unquoted() -> None:
+    payload = _make_bash_payload(
+        r'cd "/tmp/bugteam_scratch" && rm -rf C:\sensitive\path'
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_relative_target_without_declared_cwd_fails_closed() -> None:
+    payload_with_no_cwd = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "rm -rf relative/path"},
+    }
+
+    result = _run_rm_hook(payload_with_no_cwd)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_allowed_when_cwd_ephemeral_and_relative_target_stays_within() -> None:
+    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf ./build')
+
+    result = _run_rm_hook(payload)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_asks_when_tool_input_cwd_is_ephemeral_but_rm_target_is_absolute_non_ephemeral() -> None:
+    payload_with_tool_input_cwd = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "rm -rf /var/log/myapp",
+            "cwd": "/tmp/bugteam_scratch",
+        },
+    }
+
+    result = _run_rm_hook(payload_with_tool_input_cwd)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_git_push_force_asks_when_leading_cd_into_ephemeral_subdirectory() -> None:
+    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && git push --force')
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+    assert "git push --force" in response["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_git_clean_force_recursive_asks_when_leading_cd_into_ephemeral_subdirectory() -> None:
+    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && git clean -fd')
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+    assert "git clean -fd" in response["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_rm_rf_plus_git_push_force_piggyback_asks_when_leading_cd_into_ephemeral() -> None:
+    payload = _make_bash_payload(
+        'cd "/tmp/bugteam_scratch" && rm -rf cache && git push --force'
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_plus_git_clean_piggyback_asks_when_leading_cd_into_ephemeral() -> None:
+    payload = _make_bash_payload(
+        'cd "/tmp/bugteam_scratch" && rm -rf cache && git clean -fd'
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_plus_mkfs_piggyback_asks_when_leading_cd_into_ephemeral() -> None:
+    payload = _make_bash_payload(
+        'cd "/tmp/bugteam_scratch" && rm -rf cache && mkfs.ext4 /dev/sda1'
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_plus_drop_table_piggyback_asks_when_leading_cd_into_ephemeral() -> None:
+    payload = _make_bash_payload(
+        'cd "/tmp/bugteam_scratch" && rm -rf cache && psql -c "DROP TABLE users"'
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_leading_cd_into_ephemeral_but_rm_target_is_bare_tmp_root() -> None:
+    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf /tmp')
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_leading_cd_into_ephemeral_but_rm_target_is_bare_worktrees_root() -> None:
+    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf /worktrees')
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_command_fails_shlex_parse_with_unbalanced_quotes() -> None:
+    payload_with_tool_input_cwd = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": 'rm -rf "unclosed_quote',
+            "cwd": "/tmp/bugteam_scratch",
+        },
+    }
+
+    result = _run_rm_hook(payload_with_tool_input_cwd)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_leading_cd_target_is_non_ephemeral_directory() -> None:
+    payload = _make_bash_payload('cd "/etc" && rm -rf scratch')
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_leading_cd_target_is_bare_ephemeral_root() -> None:
+    payload = _make_bash_payload('cd "/tmp" && rm -rf scratch')
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_allowed_when_leading_cd_target_is_git_worktrees_directory() -> None:
+    payload = _make_bash_payload('cd "/Users/me/repo/worktrees" && rm -rf feature')
+
+    result = _run_rm_hook(payload)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_asks_when_leading_cd_target_is_relative_path() -> None:
+    payload = _make_bash_payload('cd "./scratch" && rm -rf inner')
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_allowed_for_chat_observed_bugteam_backslash_worktree_scratch_cleanup() -> None:
+    payload = _make_bash_payload(
+        r'cd "C:\Users\jon\AppData\Local\Temp\bugteam-pr-58-20260424071040\pr-58\worktree" && rm -rf .bugteam-tmp'
+    )
+
+    result = _run_rm_hook(payload)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_allowed_for_chat_observed_bugteam_forward_slash_worktree_scratch_cleanup() -> None:
+    payload = _make_bash_payload(
+        'cd "C:/Users/jon/AppData/Local/Temp/bugteam-pr-58-20260424071040/pr-58/worktree" && rm -rf .bugteam-tmp'
+    )
+
+    result = _run_rm_hook(payload)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_allowed_for_chat_observed_bugfix_reply_scratch_file_cleanup() -> None:
+    payload = _make_bash_payload(
+        'cd "C:/Users/jon/AppData/Local/Temp/bugteam-pr-58-20260424071040/pr-58/worktree" && rm -rf tmp_reply_loop1-1.md'
+    )
+
+    result = _run_rm_hook(payload)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_allowed_for_chat_observed_bugfind_multiple_scratch_files_cleanup() -> None:
+    payload = _make_bash_payload(
+        'cd "C:/Users/jon/AppData/Local/Temp/bugteam-pr-58-20260424071040/pr-256/worktree" && rm -rf tmp_review_body.md tmp_finding_1.md'
+    )
+
+    result = _run_rm_hook(payload)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_allowed_via_tool_input_cwd_pointing_at_chat_observed_bugteam_worktree() -> None:
+    payload_with_tool_input_cwd = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "rm -rf .bugteam-tmp",
+            "cwd": "C:/Users/jon/AppData/Local/Temp/bugteam-pr-58-20260424071040/pr-58/worktree",
+        },
+    }
+
+    result = _run_rm_hook(payload_with_tool_input_cwd)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_allowed_for_chat_observed_absolute_path_in_bugteam_windows_worktree_scratch() -> None:
+    payload = _make_bash_payload(
+        'rm -rf "C:/Users/jon/AppData/Local/Temp/bugteam-pr-58-20260424071040/pr-58/worktree/.bugteam-tmp"'
+    )
+
+    result = _run_rm_hook(payload)
+
+    assert result.stdout.strip() == ""
+    assert result.returncode == 0
+
+
+def test_rm_rf_asks_when_leading_cd_target_contains_command_substitution_dollar_parenthesis() -> None:
+    payload = _make_bash_payload(
+        'cd "/tmp/$(rm -rf ~/.ssh)" && ls'
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_leading_cd_target_contains_backtick_command_substitution() -> None:
+    payload = _make_bash_payload(
+        'cd "/tmp/`rm -rf ~/.ssh`" && rm -rf .bugteam-tmp'
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_leading_cd_target_contains_variable_expansion() -> None:
+    payload = _make_bash_payload(
+        'cd "/tmp/$SNEAKY_VAR" && rm -rf .bugteam-tmp'
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_leading_cd_adjacent_quoted_strings_resolve_outside_ephemeral() -> None:
+    payload = _make_bash_payload(
+        'cd "/tmp/a""/../../etc" && rm -rf .'
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+def test_rm_rf_asks_when_leading_cd_adjacent_quoted_strings_use_mixed_quotes() -> None:
+    payload = _make_bash_payload(
+        """cd "/tmp/a"'/../../etc' && rm -rf ."""
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
 def test_rm_rf_asks_when_target_is_bare_tmp_root() -> None:
     payload = _make_bash_payload("rm -rf /tmp")
 

package/hooks/blocking/test_question_to_user_enforcer.py

@@ -0,0 +1,163 @@
+"""Tests for question_to_user_enforcer hook response shape and detection logic."""
+
+import json
+import os
+import subprocess
+import sys
+
+HOOK_SCRIPT_PATH = os.path.join(
+    os.path.dirname(__file__), "question_to_user_enforcer.py"
+)
+_HOOKS_DIR = os.path.dirname(HOOK_SCRIPT_PATH)
+_HOOKS_ROOT = os.path.join(_HOOKS_DIR, "..")
+if _HOOKS_DIR not in sys.path:
+    sys.path.insert(0, _HOOKS_DIR)
+if _HOOKS_ROOT not in sys.path:
+    sys.path.insert(0, _HOOKS_ROOT)
+from config.messages import USER_FACING_ASKUSERQUESTION_NOTICE
+
+CLEAN_DECLARATIVE_MESSAGE = "I applied the rename across both files. The tests pass."
+TRAILING_QUESTION_MESSAGE = (
+    "I applied the rename across both files. Should this also propagate to the docs?"
+)
+WANT_ME_TO_MESSAGE = "I finished the refactor.\n\nWant me to open the PR now?"
+SHOULD_I_STATEMENT_MESSAGE = (
+    "The diff is ready.\n\nShould I proceed with committing it."
+)
+FENCED_CODE_QUESTION_MESSAGE = (
+    "Here is the diagnostic snippet:\n\n"
+    "```python\n"
+    "print('does this work?')\n"
+    "```\n\n"
+    "The snippet confirms the behavior."
+)
+RHETORICAL_MIDDLE_MESSAGE = (
+    "Consider the failure mode.\n\n"
+    "What happens if the queue is empty? The handler short-circuits cleanly.\n\n"
+    "That covers the edge case."
+)
+QUESTION_WITH_TRAILING_DOUBLE_QUOTE_MESSAGE = (
+    'I renamed the flag.\n\nDid you mean "enable_fast_path?"'
+)
+QUESTION_WITH_TRAILING_SINGLE_QUOTE_MESSAGE = (
+    "I renamed the flag.\n\nDid you mean 'enable_fast_path?'"
+)
+QUESTION_WITH_TRAILING_PAREN_MESSAGE = (
+    "I finished the refactor.\n\nShould I also bump the version (minor or patch?)"
+)
+QUESTION_WITH_TRAILING_BRACKET_MESSAGE = (
+    "I finished the refactor.\n\nShould I also bump the version [minor or patch?]"
+)
+QUESTION_WITH_TRAILING_SPACE_MESSAGE = (
+    "I finished the refactor.\n\nShould I also bump the version? "
+)
+
+
+def run_hook_with_payload(payload: dict) -> subprocess.CompletedProcess:
+    hook_input_payload = json.dumps(payload)
+    return subprocess.run(
+        [sys.executable, HOOK_SCRIPT_PATH],
+        input=hook_input_payload,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+
+def run_hook_with_message(assistant_message: str) -> subprocess.CompletedProcess:
+    return run_hook_with_payload({"last_assistant_message": assistant_message})
+
+
+def test_clean_declarative_message_passes_through():
+    completed_process = run_hook_with_message(CLEAN_DECLARATIVE_MESSAGE)
+    assert completed_process.returncode == 0
+    assert completed_process.stdout == ""
+
+
+def test_final_paragraph_ending_with_question_mark_emits_block():
+    completed_process = run_hook_with_message(TRAILING_QUESTION_MESSAGE)
+    assert completed_process.returncode == 0
+    parsed_response = json.loads(completed_process.stdout)
+    assert parsed_response["decision"] == "block"
+
+
+def test_want_me_to_preamble_in_final_paragraph_emits_block():
+    completed_process = run_hook_with_message(WANT_ME_TO_MESSAGE)
+    assert completed_process.returncode == 0
+    parsed_response = json.loads(completed_process.stdout)
+    assert parsed_response["decision"] == "block"
+
+
+def test_should_i_preamble_without_question_mark_emits_block():
+    completed_process = run_hook_with_message(SHOULD_I_STATEMENT_MESSAGE)
+    assert completed_process.returncode == 0
+    parsed_response = json.loads(completed_process.stdout)
+    assert parsed_response["decision"] == "block"
+
+
+def test_question_mark_inside_fenced_code_block_passes_through():
+    completed_process = run_hook_with_message(FENCED_CODE_QUESTION_MESSAGE)
+    assert completed_process.returncode == 0
+    assert completed_process.stdout == ""
+
+
+def test_stop_hook_active_flag_passes_through():
+    completed_process = run_hook_with_payload(
+        {
+            "last_assistant_message": TRAILING_QUESTION_MESSAGE,
+            "stop_hook_active": True,
+        }
+    )
+    assert completed_process.returncode == 0
+    assert completed_process.stdout == ""
+
+
+def test_rhetorical_middle_paragraph_with_declarative_final_passes_through():
+    completed_process = run_hook_with_message(RHETORICAL_MIDDLE_MESSAGE)
+    assert completed_process.returncode == 0
+    assert completed_process.stdout == ""
+
+
+def test_block_response_json_shape():
+    completed_process = run_hook_with_message(TRAILING_QUESTION_MESSAGE)
+    assert completed_process.returncode == 0
+    parsed_response = json.loads(completed_process.stdout)
+    assert parsed_response["decision"] == "block"
+    assert "AskUserQuestion" in parsed_response["reason"]
+    assert parsed_response["systemMessage"] == USER_FACING_ASKUSERQUESTION_NOTICE
+    assert parsed_response["suppressOutput"] is True
+
+
+def test_question_followed_by_double_quote_emits_block():
+    completed_process = run_hook_with_message(QUESTION_WITH_TRAILING_DOUBLE_QUOTE_MESSAGE)
+    assert completed_process.returncode == 0
+    parsed_response = json.loads(completed_process.stdout)
+    assert parsed_response["decision"] == "block"
+
+
+def test_question_followed_by_single_quote_emits_block():
+    completed_process = run_hook_with_message(QUESTION_WITH_TRAILING_SINGLE_QUOTE_MESSAGE)
+    assert completed_process.returncode == 0
+    parsed_response = json.loads(completed_process.stdout)
+    assert parsed_response["decision"] == "block"
+
+
+def test_question_followed_by_closing_paren_emits_block():
+    completed_process = run_hook_with_message(QUESTION_WITH_TRAILING_PAREN_MESSAGE)
+    assert completed_process.returncode == 0
+    parsed_response = json.loads(completed_process.stdout)
+    assert parsed_response["decision"] == "block"
+
+
+def test_question_followed_by_closing_bracket_emits_block():
+    completed_process = run_hook_with_message(QUESTION_WITH_TRAILING_BRACKET_MESSAGE)
+    assert completed_process.returncode == 0
+    parsed_response = json.loads(completed_process.stdout)
+    assert parsed_response["decision"] == "block"
+
+
+def test_question_followed_by_trailing_space_emits_block():
+    completed_process = run_hook_with_message(QUESTION_WITH_TRAILING_SPACE_MESSAGE)
+    assert completed_process.returncode == 0
+    parsed_response = json.loads(completed_process.stdout)
+    assert parsed_response["decision"] == "block"