claude-dev-env 1.36.1 → 1.37.0

package/_shared/pr-loop/scripts/revoke_project_claude_permissions.py

@@ -0,0 +1,156 @@
+"""Revoke the permissions previously granted by grant_project_claude_permissions.
+
+Run from the same project root you previously granted. Removes the matching
+allow rules, the additionalDirectories entry, and the autoMode environment
+entry from ~/.claude/settings.json. Safe to run when no prior grant exists.
+After removals, prunes any newly empty lists and their parent permissions or
+autoMode sections so repeated grant/revoke cycles leave no dead structure.
+"""
+
+import sys
+from pathlib import Path
+
+sys.modules.pop("config", None)
+if str(Path(__file__).resolve().parent) not in sys.path:
+    sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from _claude_permissions_common import (  # noqa: E402
+    build_permission_rules,
+    exit_with_error,
+    get_current_project_path,
+    is_valid_project_root,
+    load_settings,
+    prune_empty_list_then_empty_section,
+    save_settings,
+)
+from config.claude_permissions_constants import (  # noqa: E402
+    ALL_PERMISSION_ALLOW_TOOLS,
+    AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE,
+    get_claude_user_settings_path,
+)
+from config.claude_settings_keys_constants import (  # noqa: E402
+    CLAUDE_SETTINGS_ADDITIONAL_DIRECTORIES_KEY,
+    CLAUDE_SETTINGS_ALLOW_KEY,
+    CLAUDE_SETTINGS_AUTO_MODE_KEY,
+    CLAUDE_SETTINGS_ENVIRONMENT_KEY,
+    CLAUDE_SETTINGS_PERMISSIONS_KEY,
+)
+
+
+def remove_values_from_list(
+    all_target_list: list[object], all_values_to_remove: set[str]
+) -> int:
+    original_length = len(all_target_list)
+    all_target_list[:] = [
+        each_value
+        for each_value in all_target_list
+        if not (isinstance(each_value, str) and each_value in all_values_to_remove)
+    ]
+    return original_length - len(all_target_list)
+
+
+def remove_rules_from_allow_list(
+    all_settings: dict[str, object], all_rules_to_remove: list[str]
+) -> int:
+    permissions_section = all_settings.get(CLAUDE_SETTINGS_PERMISSIONS_KEY)
+    if not isinstance(permissions_section, dict):
+        return 0
+    existing_allow_list = permissions_section.get(CLAUDE_SETTINGS_ALLOW_KEY)
+    if not isinstance(existing_allow_list, list):
+        return 0
+    return remove_values_from_list(existing_allow_list, set(all_rules_to_remove))
+
+
+def remove_directory_from_additional_directories(
+    all_settings: dict[str, object], directory_path: str
+) -> int:
+    permissions_section = all_settings.get(CLAUDE_SETTINGS_PERMISSIONS_KEY)
+    if not isinstance(permissions_section, dict):
+        return 0
+    existing_directories = permissions_section.get(
+        CLAUDE_SETTINGS_ADDITIONAL_DIRECTORIES_KEY
+    )
+    if not isinstance(existing_directories, list):
+        return 0
+    return remove_values_from_list(existing_directories, {directory_path})
+
+
+def remove_auto_mode_environment_entry(
+    all_settings: dict[str, object], entry_text: str
+) -> int:
+    auto_mode_section = all_settings.get(CLAUDE_SETTINGS_AUTO_MODE_KEY)
+    if not isinstance(auto_mode_section, dict):
+        return 0
+    existing_environment = auto_mode_section.get(CLAUDE_SETTINGS_ENVIRONMENT_KEY)
+    if not isinstance(existing_environment, list):
+        return 0
+    return remove_values_from_list(existing_environment, {entry_text})
+
+
+def prune_settings_after_revoke(all_settings: dict[str, object]) -> None:
+    prune_empty_list_then_empty_section(
+        all_settings,
+        CLAUDE_SETTINGS_PERMISSIONS_KEY,
+        CLAUDE_SETTINGS_ALLOW_KEY,
+    )
+    prune_empty_list_then_empty_section(
+        all_settings,
+        CLAUDE_SETTINGS_PERMISSIONS_KEY,
+        CLAUDE_SETTINGS_ADDITIONAL_DIRECTORIES_KEY,
+    )
+    prune_empty_list_then_empty_section(
+        all_settings,
+        CLAUDE_SETTINGS_AUTO_MODE_KEY,
+        CLAUDE_SETTINGS_ENVIRONMENT_KEY,
+    )
+
+
+def revoke_permissions_for_current_directory() -> None:
+    claude_user_settings_path: Path = get_claude_user_settings_path()
+    project_root_path = Path.cwd()
+    if not is_valid_project_root(project_root_path):
+        print(
+            f"ERROR: cwd {project_root_path} is not a project root "
+            f"(no .git or .claude). Run from a project root.",
+            file=sys.stderr,
+        )
+        raise SystemExit(1)
+    project_path = get_current_project_path()
+    permission_rules = build_permission_rules(project_path, ALL_PERMISSION_ALLOW_TOOLS)
+    environment_entry = AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE.format(
+        project_path=project_path
+    )
+    settings = load_settings(claude_user_settings_path)
+    rules_removed_count = remove_rules_from_allow_list(settings, permission_rules)
+    directories_removed_count = remove_directory_from_additional_directories(
+        settings, project_path
+    )
+    environment_entries_removed_count = remove_auto_mode_environment_entry(
+        settings, environment_entry
+    )
+    total_changes_count = (
+        rules_removed_count
+        + directories_removed_count
+        + environment_entries_removed_count
+    )
+    if total_changes_count == 0:
+        print(f"Project path: {project_path}")
+        print(f"Settings file: {claude_user_settings_path}")
+        print("No changes to revoke; settings file left untouched.")
+        return
+    prune_settings_after_revoke(settings)
+    save_settings(claude_user_settings_path, settings)
+    print(f"Project path: {project_path}")
+    print(f"Settings file: {claude_user_settings_path}")
+    print(f"Allow rules removed: {rules_removed_count} of {len(permission_rules)}")
+    print(f"Additional directories removed: {directories_removed_count}")
+    print(
+        f"Auto-mode environment entries removed: {environment_entries_removed_count}"
+    )
+
+
+if __name__ == "__main__":
+    try:
+        revoke_permissions_for_current_directory()
+    except ValueError as path_error:
+        exit_with_error(str(path_error))

package/_shared/pr-loop/scripts/tests/conftest.py

@@ -0,0 +1,51 @@
+"""Test fixtures for _shared/pr-loop/scripts/.
+
+Two unrelated Python packages live under the name ``config`` in this repo:
+  - ``_shared/pr-loop/scripts/config/`` (constants for grant/revoke/gate/preflight scripts)
+  - ``hooks/config/`` (constants for the code-rules enforcer and other hooks)
+
+When tests under this directory exercise the gate (which loads
+``hooks/blocking/code_rules_enforcer.py``) and also load the grant/revoke
+scripts in the same pytest process, ``sys.modules['config']`` and
+``sys.modules['config.<submodule>']`` cache entries from one package leak
+into the other. The next ``from config.<submodule> import ...`` then fails
+with ``ModuleNotFoundError`` because the cached parent package does not
+expose that submodule.
+
+Independently, several scripts in this folder do
+``Path(__file__).resolve()`` then prepend the resulting directory to
+``sys.path``. On Windows when the working tree lives under a mapped drive
+backed by a UNC share (``Y:`` -> ``\\\\server\\share\\...``), ``.resolve()``
+returns the UNC form, and Python's import machinery on this host cannot
+locate ``config`` packages from a UNC ``sys.path`` entry. The Y:-form entry
+gets pushed to a later index by subsequent inserts, making ``from
+config.<submodule> import ...`` fail.
+
+This autouse fixture restores both invariants before each test:
+  1. evict every ``config`` and ``config.*`` entry from ``sys.modules``
+  2. prepend the drive-letter (``.absolute()``) form of the scripts
+     directory to ``sys.path`` so package resolution always has a
+     non-UNC path to search first
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+SCRIPTS_DIRECTORY_DRIVE_LETTER_FORM = str(Path(__file__).absolute().parent.parent)
+
+
+@pytest.fixture(autouse=True)
+def _evict_config_namespace_between_tests() -> None:
+    for each_module_name in [
+        each_key
+        for each_key in list(sys.modules)
+        if each_key == "config" or each_key.startswith("config.")
+    ]:
+        sys.modules.pop(each_module_name, None)
+    if SCRIPTS_DIRECTORY_DRIVE_LETTER_FORM in sys.path:
+        sys.path.remove(SCRIPTS_DIRECTORY_DRIVE_LETTER_FORM)
+    sys.path.insert(0, SCRIPTS_DIRECTORY_DRIVE_LETTER_FORM)

package/_shared/pr-loop/scripts/tests/test__claude_permissions_common.py

@@ -0,0 +1,135 @@
+"""Regression tests for the leading-underscore _claude_permissions_common module.
+
+The companion test_claude_permissions_common.py covers the public-name
+matched suite. This file holds tests the TDD enforcer pairs to the
+leading-underscore production filename.
+"""
+
+import importlib.util
+import json
+import sys
+from pathlib import Path
+from types import ModuleType
+
+import pytest
+
+
+def _load_common_module() -> ModuleType:
+    module_path = Path(__file__).parent.parent / "_claude_permissions_common.py"
+    parent_directory = str(module_path.parent.resolve())
+    if parent_directory not in sys.path:
+        sys.path.insert(0, parent_directory)
+    spec = importlib.util.spec_from_file_location(
+        "_claude_permissions_common", module_path
+    )
+    assert spec is not None
+    assert spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+common = _load_common_module()
+
+
+def test_save_settings_chmods_after_replace_to_defeat_umask(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Regression: POSIX umask masks the mode passed to os.open, so the
+    "preserve mode" intent is silently defeated unless save_settings
+    chmods the final file after os.replace.
+    """
+    settings_path = tmp_path / "settings.json"
+    settings_path.write_text(json.dumps({}), encoding="utf-8")
+    captured_mode_to_preserve = 0o600
+    monkeypatch.setattr(
+        common, "get_mode_to_preserve", lambda _path: captured_mode_to_preserve
+    )
+
+    ordered_calls: list[tuple[str, str, int | None]] = []
+    real_replace = common.os.replace
+    real_chmod = common.os.chmod
+
+    def recording_replace(source_path: str, destination_path: str) -> None:
+        ordered_calls.append(("replace", str(destination_path), None))
+        real_replace(source_path, destination_path)
+
+    def recording_chmod(target_path: str, file_mode: int) -> None:
+        ordered_calls.append(("chmod", str(target_path), file_mode))
+        real_chmod(target_path, file_mode)
+
+    monkeypatch.setattr(common.os, "replace", recording_replace)
+    monkeypatch.setattr(common.os, "chmod", recording_chmod)
+
+    common.save_settings(settings_path, {"writer": "only"})
+
+    final_replace_index = next(
+        each_index
+        for each_index, each_call in enumerate(ordered_calls)
+        if each_call[0] == "replace" and each_call[1] == str(settings_path)
+    )
+    final_chmod_index = next(
+        (
+            each_index
+            for each_index, each_call in enumerate(ordered_calls)
+            if each_call[0] == "chmod"
+            and each_call[1] == str(settings_path)
+            and each_call[2] == captured_mode_to_preserve
+        ),
+        None,
+    )
+    assert final_chmod_index is not None
+    assert final_replace_index < final_chmod_index
+
+
+def test_path_contains_glob_metacharacters_rejects_true_metacharacters() -> None:
+    assert common.path_contains_glob_metacharacters("C:/some/path/*.py") is True
+    assert common.path_contains_glob_metacharacters("C:/some/path/[abc].py") is True
+    assert common.path_contains_glob_metacharacters("C:/some/{a,b}/file") is True
+
+
+
+
+def test_write_atomically_with_mode_closes_descriptor_when_fdopen_raises(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Regression: if os.fdopen fails, the raw descriptor from os.open must close.
+
+    Cursor Bugbot: without a failure path, the descriptor
+    leaks when fdopen raises before the file object assumes ownership.
+    """
+    closed_descriptors: list[int] = []
+    sentinel_descriptor = 91
+
+    def fake_open(_path: str, _flags: int, _mode: int = 0o777) -> int:
+        return sentinel_descriptor
+
+    def fake_fdopen(_file_descriptor: int, *_args: object, **_kwargs: object) -> object:
+        raise OSError("simulated fdopen failure")
+
+    def recording_close(file_descriptor: int) -> None:
+        closed_descriptors.append(file_descriptor)
+
+    monkeypatch.setattr(common.os, "open", fake_open)
+    monkeypatch.setattr(common.os, "fdopen", fake_fdopen)
+    monkeypatch.setattr(common.os, "close", recording_close)
+
+    temporary_path = tmp_path / "tempfile.tmp"
+    with pytest.raises(OSError, match="simulated fdopen failure"):
+        common.write_atomically_with_mode(temporary_path, "{}", 0o600)
+
+    assert closed_descriptors == [sentinel_descriptor]
+
+
+def test_path_contains_glob_metacharacters_accepts_windows_paths_with_parens() -> None:
+    """Regression: Windows paths like C:/Program Files (x86)/ must not raise ValueError.
+
+    `(`, `)`, and `,` are not glob metacharacters in Claude Code's permission
+    rule matching. Including them in the metacharacter set causes
+    get_current_project_path to raise ValueError for any user whose home
+    directory contains parentheses (e.g. `C:/Users/Jon (Admin)/...`).
+    """
+    assert common.path_contains_glob_metacharacters("C:/Program Files (x86)/app") is False
+    assert common.path_contains_glob_metacharacters("C:/Users/Jon (Admin)/project") is False
+    assert common.path_contains_glob_metacharacters("C:/Projects/a,b/file.py") is False
+

package/_shared/pr-loop/scripts/tests/test_claude_permissions_common.py

@@ -0,0 +1,169 @@
+"""Tests for _shared permission helpers extracted from skills/bugteam/scripts/."""
+
+import importlib.util
+import inspect
+import json
+import sys
+from pathlib import Path
+from types import ModuleType
+
+import pytest
+
+
+def _load_common_module() -> ModuleType:
+    module_path = Path(__file__).parent.parent / "_claude_permissions_common.py"
+    parent_directory = str(module_path.parent.resolve())
+    if parent_directory not in sys.path:
+        sys.path.insert(0, parent_directory)
+    spec = importlib.util.spec_from_file_location(
+        "_claude_permissions_common", module_path
+    )
+    assert spec is not None
+    assert spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+common = _load_common_module()
+
+
+def test_return_normalized_path_when_cwd_contains_spaces(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    directory_with_spaces = tmp_path / "dir with spaces"
+    directory_with_spaces.mkdir()
+    monkeypatch.chdir(directory_with_spaces)
+    returned_project_path = common.get_current_project_path()
+    expected_suffix = "/dir with spaces"
+    assert returned_project_path.endswith(expected_suffix)
+    assert "\\" not in returned_project_path
+    built_rule = common.build_permission_rule("Edit", returned_project_path)
+    assert built_rule.startswith("Edit(")
+    assert built_rule.endswith("/.claude/**)")
+    assert "dir with spaces" in built_rule
+
+
+def test_raise_when_cwd_contains_glob_metacharacters(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    directory_with_star = tmp_path / "weird[dir]"
+    directory_with_star.mkdir()
+    monkeypatch.chdir(directory_with_star)
+    with pytest.raises(ValueError, match="glob metacharacters"):
+        common.get_current_project_path()
+
+
+def test_flag_glob_metacharacters_in_any_position() -> None:
+    assert common.path_contains_glob_metacharacters("/home/user/[dir]/project")
+    assert common.path_contains_glob_metacharacters("/home/user/project*")
+    assert not common.path_contains_glob_metacharacters("/home/user/dir with spaces")
+
+
+def test_text_file_encoding_remains_local_constant() -> None:
+    assert common.TEXT_FILE_ENCODING == "utf-8"
+
+
+def test_module_no_longer_redeclares_migrated_constants() -> None:
+    assert not hasattr(common, "ALL_PERMISSION_ALLOW_TOOLS")
+    assert not hasattr(common, "AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE")
+
+
+def test_save_settings_uses_unique_per_call_temp_suffix(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Regression for atomic-write race: each save_settings call must
+    derive its own unique temp path so concurrent writers do not collide
+    on the same `.tmp` filename.
+    """
+    settings_path = tmp_path / "settings.json"
+    settings_path.write_text(json.dumps({}), encoding="utf-8")
+
+    captured_temp_paths: list[Path] = []
+    real_write_atomically_with_mode = common.write_atomically_with_mode
+
+    def capturing_write(
+        temporary_path: Path, serialized_content: str, file_mode: int
+    ) -> None:
+        captured_temp_paths.append(Path(temporary_path))
+        real_write_atomically_with_mode(
+            temporary_path, serialized_content, file_mode
+        )
+
+    monkeypatch.setattr(common, "write_atomically_with_mode", capturing_write)
+
+    common.save_settings(settings_path, {"writer": "first"})
+    common.save_settings(settings_path, {"writer": "second"})
+
+    assert len(captured_temp_paths) == 2
+    assert captured_temp_paths[0] != captured_temp_paths[1]
+    for each_temp_path in captured_temp_paths:
+        assert ".tmp." in each_temp_path.name
+
+
+def test_save_settings_temp_suffix_includes_pid_and_random_token(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The unique temp suffix must include the process id and a random
+    hex token so two processes cannot collide on the same temp filename.
+    """
+    settings_path = tmp_path / "settings.json"
+    settings_path.write_text(json.dumps({}), encoding="utf-8")
+
+    captured_temp_paths: list[Path] = []
+    real_write_atomically_with_mode = common.write_atomically_with_mode
+
+    def capturing_write(
+        temporary_path: Path, serialized_content: str, file_mode: int
+    ) -> None:
+        captured_temp_paths.append(Path(temporary_path))
+        real_write_atomically_with_mode(
+            temporary_path, serialized_content, file_mode
+        )
+
+    monkeypatch.setattr(common, "write_atomically_with_mode", capturing_write)
+
+    common.save_settings(settings_path, {"writer": "only"})
+
+    assert len(captured_temp_paths) == 1
+    suffix_token = captured_temp_paths[0].name.split(".tmp.", maxsplit=1)[1]
+    pid_text, random_token = suffix_token.split(".", maxsplit=1)
+    assert pid_text.isdigit()
+    minimum_random_token_hex_chars = 4
+    assert len(random_token) >= minimum_random_token_hex_chars
+    assert all(
+        each_character in "0123456789abcdef" for each_character in random_token
+    )
+
+
+def test_text_file_encoding_sourced_from_config() -> None:
+    config_module_path = (
+        Path(__file__).parent.parent / "config" / "claude_permissions_constants.py"
+    )
+    specification = importlib.util.spec_from_file_location(
+        "config.claude_permissions_constants", config_module_path
+    )
+    assert specification is not None
+    assert specification.loader is not None
+    config_module = importlib.util.module_from_spec(specification)
+    specification.loader.exec_module(config_module)
+    assert common.TEXT_FILE_ENCODING == config_module.TEXT_FILE_ENCODING
+
+
+def test_path_contains_glob_metacharacters_local_tuple_uses_all_collection_prefix() -> None:
+    source_text = inspect.getsource(common.path_contains_glob_metacharacters)
+    assert "all_glob_metacharacters_in_path" in source_text
+    assert "glob_metacharacters_in_path:" not in source_text.replace(
+        "all_glob_metacharacters_in_path", ""
+    )
+
+
+def test_is_valid_project_root_uses_extracted_directory_marker_constants() -> None:
+    """is_valid_project_root must reference extracted constants, not inline string literals."""
+    source_text = inspect.getsource(common.is_valid_project_root)
+    assert "GIT_DIRECTORY_NAME" in source_text
+    assert "CLAUDE_SETTINGS_DIRECTORY_NAME" in source_text
+    assert "'.git'" not in source_text
+    assert '".git"' not in source_text
+    assert "'.claude'" not in source_text
+    assert '".claude"' not in source_text

package/_shared/pr-loop/scripts/tests/test_claude_permissions_constants.py

@@ -0,0 +1,58 @@
+"""Tests for shared constants powering grant/revoke claude permissions."""
+
+import importlib.util
+from pathlib import Path
+from types import ModuleType
+
+
+def _load_constants_module() -> ModuleType:
+    module_path = (
+        Path(__file__).parent.parent / "config" / "claude_permissions_constants.py"
+    )
+    specification = importlib.util.spec_from_file_location(
+        "config.claude_permissions_constants", module_path
+    )
+    assert specification is not None
+    assert specification.loader is not None
+    module = importlib.util.module_from_spec(specification)
+    specification.loader.exec_module(module)
+    return module
+
+
+constants_module = _load_constants_module()
+
+
+def test_exposes_all_permission_allow_tools_tuple() -> None:
+    assert constants_module.ALL_PERMISSION_ALLOW_TOOLS == ("Edit", "Write", "Read")
+
+
+def test_auto_mode_environment_entry_template_is_format_string() -> None:
+    rendered_template_text = (
+        constants_module.AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE.format(
+            project_path="/tmp/x"
+        )
+    )
+    assert "/tmp/x" in rendered_template_text
+    assert ".claude/**" in rendered_template_text
+
+
+def test_get_claude_user_settings_path_ends_in_settings_json() -> None:
+    resolved_settings_path = constants_module.get_claude_user_settings_path()
+    assert resolved_settings_path.name == constants_module.CLAUDE_SETTINGS_FILENAME
+    assert (
+        resolved_settings_path.parent.name
+        == constants_module.CLAUDE_SETTINGS_DIRECTORY_NAME
+    )
+
+
+def test_text_file_encoding_lives_in_config() -> None:
+    assert constants_module.TEXT_FILE_ENCODING == "utf-8"
+
+
+def test_unique_temporary_suffix_byte_length_is_positive_integer() -> None:
+    assert isinstance(constants_module.UNIQUE_TEMPORARY_SUFFIX_BYTE_LENGTH, int)
+    assert constants_module.UNIQUE_TEMPORARY_SUFFIX_BYTE_LENGTH > 0
+
+
+def test_git_directory_name_lives_in_config() -> None:
+    assert constants_module.GIT_DIRECTORY_NAME == ".git"

package/_shared/pr-loop/scripts/tests/test_claude_settings_keys_constants.py

@@ -0,0 +1,50 @@
+"""Tests for claude_settings_keys_constants.py extracted constant set."""
+
+import importlib.util
+from pathlib import Path
+from types import ModuleType
+
+
+def _load_constants_module() -> ModuleType:
+    module_path = (
+        Path(__file__).parent.parent / "config" / "claude_settings_keys_constants.py"
+    )
+    specification = importlib.util.spec_from_file_location(
+        "config.claude_settings_keys_constants", module_path
+    )
+    assert specification is not None
+    assert specification.loader is not None
+    module = importlib.util.module_from_spec(specification)
+    specification.loader.exec_module(module)
+    return module
+
+
+constants_module = _load_constants_module()
+
+
+def test_permissions_key_is_typed_string() -> None:
+    assert isinstance(constants_module.CLAUDE_SETTINGS_PERMISSIONS_KEY, str)
+    assert constants_module.CLAUDE_SETTINGS_PERMISSIONS_KEY == "permissions"
+
+
+def test_allow_key_is_typed_string() -> None:
+    assert isinstance(constants_module.CLAUDE_SETTINGS_ALLOW_KEY, str)
+    assert constants_module.CLAUDE_SETTINGS_ALLOW_KEY == "allow"
+
+
+def test_additional_directories_key_is_typed_string() -> None:
+    assert isinstance(constants_module.CLAUDE_SETTINGS_ADDITIONAL_DIRECTORIES_KEY, str)
+    assert (
+        constants_module.CLAUDE_SETTINGS_ADDITIONAL_DIRECTORIES_KEY
+        == "additionalDirectories"
+    )
+
+
+def test_auto_mode_key_is_typed_string() -> None:
+    assert isinstance(constants_module.CLAUDE_SETTINGS_AUTO_MODE_KEY, str)
+    assert constants_module.CLAUDE_SETTINGS_AUTO_MODE_KEY == "autoMode"
+
+
+def test_environment_key_is_typed_string() -> None:
+    assert isinstance(constants_module.CLAUDE_SETTINGS_ENVIRONMENT_KEY, str)
+    assert constants_module.CLAUDE_SETTINGS_ENVIRONMENT_KEY == "environment"