claude-dev-env 1.38.0 → 1.39.0

package/hooks/blocking/test_code_rules_enforcer_unused_imports.py

@@ -30,6 +30,7 @@ assert _hook_spec.loader is not None
 _hook_module = importlib.util.module_from_spec(_hook_spec)
 _hook_spec.loader.exec_module(_hook_module)
 check_unused_module_level_imports = _hook_module.check_unused_module_level_imports
+_reconstruct_post_edit_file_content = _hook_module._reconstruct_post_edit_file_content
 
 
 PRODUCTION_FILE_PATH = "packages/app/services/loader.py"
@@ -297,6 +298,163 @@ def test_should_skip_when_noqa_is_bare() -> None:
     assert issues == [], f"Bare noqa must suppress unused import, got: {issues}"
 
 
+def test_should_not_flag_imports_referenced_only_in_full_file_content() -> None:
+    fragment = "from config.constants import NEW_NAME\n"
+    full_file = (
+        "from config.constants import NEW_NAME\n"
+        "\n"
+        "def existing_function() -> str:\n"
+        "    return NEW_NAME\n"
+    )
+    issues = check_unused_module_level_imports(
+        fragment, PRODUCTION_FILE_PATH, full_file_content=full_file,
+    )
+    assert issues == [], (
+        f"When the post-edit file references the import, it must not flag, got: {issues}"
+    )
+
+
+def test_should_flag_imports_unused_in_full_file_content() -> None:
+    fragment = "from config.constants import TRULY_UNUSED\n"
+    full_file = (
+        "from config.constants import TRULY_UNUSED\n"
+        "\n"
+        "def existing_function() -> None:\n"
+        "    return None\n"
+    )
+    issues = check_unused_module_level_imports(
+        fragment, PRODUCTION_FILE_PATH, full_file_content=full_file,
+    )
+    assert any("TRULY_UNUSED" in each_issue for each_issue in issues), (
+        f"Imports unused in the post-edit file must still flag, got: {issues}"
+    )
+
+
+def test_should_only_flag_imports_in_fragment_not_full_file() -> None:
+    fragment = "from config.constants import FRAGMENT_IMPORT\n"
+    full_file = (
+        "from config.other import PRE_EXISTING_UNUSED\n"
+        "from config.constants import FRAGMENT_IMPORT\n"
+        "\n"
+        "def existing_function() -> str:\n"
+        "    return FRAGMENT_IMPORT\n"
+    )
+    issues = check_unused_module_level_imports(
+        fragment, PRODUCTION_FILE_PATH, full_file_content=full_file,
+    )
+    assert issues == [], (
+        "Pre-existing imports outside the fragment must not be flagged on Edit; "
+        f"got: {issues}"
+    )
+
+
+def test_should_skip_when_full_file_declares_dunder_all() -> None:
+    fragment = "from config.constants import NEW_NAME\n"
+    full_file = (
+        "from config.constants import NEW_NAME\n"
+        "\n"
+        "__all__ = ['NEW_NAME']\n"
+    )
+    issues = check_unused_module_level_imports(
+        fragment, PRODUCTION_FILE_PATH, full_file_content=full_file,
+    )
+    assert issues == [], (
+        "__all__ in the post-edit file must skip the scan even when the fragment "
+        f"itself does not contain __all__, got: {issues}"
+    )
+
+
+def test_should_skip_when_full_file_uses_type_checking_gate() -> None:
+    fragment = "from config.constants import NEW_NAME\n"
+    full_file = (
+        "from typing import TYPE_CHECKING\n"
+        "from config.constants import NEW_NAME\n"
+        "\n"
+        "if TYPE_CHECKING:\n"
+        "    from somewhere import OtherName\n"
+        "\n"
+        "def run() -> None:\n"
+        "    return None\n"
+    )
+    issues = check_unused_module_level_imports(
+        fragment, PRODUCTION_FILE_PATH, full_file_content=full_file,
+    )
+    assert issues == [], (
+        "TYPE_CHECKING gate in the post-edit file must skip the scan, "
+        f"got: {issues}"
+    )
+
+
+def test_should_fall_back_to_content_when_full_file_content_is_none() -> None:
+    source = (
+        "from config.constants import VENV_DIRECTORY_NAME\n"
+        "\n"
+        "def run() -> None:\n"
+        "    return None\n"
+    )
+    issues = check_unused_module_level_imports(source, PRODUCTION_FILE_PATH, full_file_content=None)
+    assert any("VENV_DIRECTORY_NAME" in each_issue for each_issue in issues), (
+        f"Backward-compat: with full_file_content=None, behavior must match "
+        f"the existing single-argument scan, got: {issues}"
+    )
+
+
+def test_should_fall_back_when_full_file_content_has_syntax_error() -> None:
+    fragment = "from config.constants import NEW_NAME\n"
+    full_file_with_syntax_error = "from config import (\n  not python\n"
+    issues = check_unused_module_level_imports(
+        fragment, PRODUCTION_FILE_PATH, full_file_content=full_file_with_syntax_error,
+    )
+    assert issues == [], (
+        "When the reconstructed post-edit content cannot be parsed, return empty "
+        f"rather than raising, got: {issues}"
+    )
+
+
+def test_reconstruct_post_edit_returns_replaced_content(tmp_path: pathlib.Path) -> None:
+    target_file = tmp_path / "module.py"
+    target_file.write_text("ALPHA = 1\nBETA = 2\n", encoding="utf-8")
+    post_edit = _reconstruct_post_edit_file_content(
+        str(target_file), "BETA = 2", "BETA = 22\nGAMMA = 3",
+    )
+    assert post_edit == "ALPHA = 1\nBETA = 22\nGAMMA = 3\n", (
+        f"Helper must return the file body with the first occurrence replaced, got: {post_edit!r}"
+    )
+
+
+def test_reconstruct_post_edit_returns_none_when_file_missing(tmp_path: pathlib.Path) -> None:
+    missing_file = tmp_path / "does_not_exist.py"
+    post_edit = _reconstruct_post_edit_file_content(
+        str(missing_file), "any_old", "any_new",
+    )
+    assert post_edit is None, (
+        f"Missing file must yield None so the caller treats it as 'no full-file context', got: {post_edit!r}"
+    )
+
+
+def test_reconstruct_post_edit_returns_none_when_old_string_absent(tmp_path: pathlib.Path) -> None:
+    target_file = tmp_path / "module.py"
+    target_file.write_text("ALPHA = 1\n", encoding="utf-8")
+    post_edit = _reconstruct_post_edit_file_content(
+        str(target_file), "ZETA = 9", "OMEGA = 0",
+    )
+    assert post_edit is None, (
+        f"Absent old_string means the Edit will not apply cleanly — return None, got: {post_edit!r}"
+    )
+
+
+def test_reconstruct_post_edit_replaces_only_first_occurrence(tmp_path: pathlib.Path) -> None:
+    target_file = tmp_path / "module.py"
+    target_file.write_text("X = 1\nX = 1\n", encoding="utf-8")
+    post_edit = _reconstruct_post_edit_file_content(
+        str(target_file), "X = 1", "X = 2",
+    )
+    assert post_edit == "X = 2\nX = 1\n", (
+        "Edit replaces only the first occurrence; helper must mirror that, got: "
+        f"{post_edit!r}"
+    )
+
+
 def test_should_flag_import_when_only_shadowed_local_name_is_loaded() -> None:
     source = (
         "import json\n"

package/hooks/blocking/test_convergence_gate_blocker.py

@@ -0,0 +1,63 @@
+"""Unit tests for convergence-gate-blocker PreToolUse hook."""
+
+import importlib.util
+import pathlib
+import sys
+
+_HOOK_DIR = pathlib.Path(__file__).parent
+if str(_HOOK_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIR))
+
+import re
+
+_GH_PR_READY_PATTERN = re.compile(r"\bgh\s+pr\s+ready\b(?![^&|;\n]*--undo)")
+
+hook_spec = importlib.util.spec_from_file_location(
+    "convergence_gate_blocker",
+    _HOOK_DIR / "convergence_gate_blocker.py",
+)
+assert hook_spec is not None
+assert hook_spec.loader is not None
+hook_module = importlib.util.module_from_spec(hook_spec)
+hook_spec.loader.exec_module(hook_module)
+_resolve_pr_number = hook_module._resolve_pr_number
+
+
+def test_matches_gh_pr_ready_with_number() -> None:
+    assert _GH_PR_READY_PATTERN.search("gh pr ready 418")
+
+
+def test_matches_gh_pr_ready_without_number() -> None:
+    assert _GH_PR_READY_PATTERN.search("gh pr ready")
+
+
+def test_matches_gh_pr_ready_with_flags() -> None:
+    assert not _GH_PR_READY_PATTERN.search("gh pr ready --undo")
+
+
+def test_does_not_match_gh_pr_create() -> None:
+    assert not _GH_PR_READY_PATTERN.search("gh pr create --title T")
+
+
+def test_does_not_match_gh_pr_view() -> None:
+    assert not _GH_PR_READY_PATTERN.search("gh pr view 418")
+
+
+def test_does_not_match_gh_issue_close() -> None:
+    assert not _GH_PR_READY_PATTERN.search("gh issue close 42")
+
+
+def test_extracts_pr_number_from_command() -> None:
+    assert _resolve_pr_number("gh pr ready 418", None) == 418
+
+
+def test_extracts_pr_number_with_flags() -> None:
+    assert _resolve_pr_number("gh pr ready 99 --undo", None) == 99
+
+
+def test_returns_none_when_no_number_and_no_repo() -> None:
+    assert _resolve_pr_number("gh pr ready", "/nonexistent/path") is None
+
+
+def test_matches_gh_pr_ready_in_compound_command() -> None:
+    assert not _GH_PR_READY_PATTERN.search("gh pr ready --undo && gh pr create")

package/hooks/blocking/test_destructive_command_blocker.py

@@ -1008,3 +1008,149 @@ def test_git_reset_hard_asks_when_settings_file_is_invalid_json(tmp_path: Path)
 
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+# --- convergence branch exemption unit tests ---
+
+import importlib.util
+
+_HOOK_DIR = Path(__file__).parent
+_hook_spec = importlib.util.spec_from_file_location(
+    "destructive_command_blocker",
+    _HOOK_DIR / "destructive_command_blocker.py",
+)
+assert _hook_spec is not None
+assert _hook_spec.loader is not None
+_hook_module = importlib.util.module_from_spec(_hook_spec)
+_hook_spec.loader.exec_module(_hook_module)
+_force_push_targets_convergence_branch = _hook_module._force_push_targets_convergence_branch
+_is_convergence_branch = _hook_module._is_convergence_branch
+_all_refspecs_are_convergence_branches = _hook_module._all_refspecs_are_convergence_branches
+
+
+def test_convergence_branch_claude_prefix_allowed() -> None:
+    assert _force_push_targets_convergence_branch(
+        "git push --force origin claude/fix-123"
+    )
+
+
+def test_convergence_branch_worktree_prefix_allowed() -> None:
+    assert _force_push_targets_convergence_branch(
+        "git push --force origin worktree-pr-converge-418"
+    )
+
+
+def test_convergence_branch_pr_converge_allowed() -> None:
+    assert _force_push_targets_convergence_branch(
+        "git push --force origin pr-423-converge"
+    )
+
+
+def test_convergence_branch_f_variant_allowed() -> None:
+    assert _force_push_targets_convergence_branch(
+        "git push -f origin claude/fix-123"
+    )
+
+
+def test_convergence_branch_main_blocked() -> None:
+    assert not _force_push_targets_convergence_branch(
+        "git push --force origin main"
+    )
+
+
+def test_convergence_branch_refspec_destination_checked() -> None:
+    assert not _force_push_targets_convergence_branch(
+        "git push --force origin claude/fix:main"
+    )
+
+
+def test_convergence_branch_multi_refspec_main_blocked() -> None:
+    assert not _force_push_targets_convergence_branch(
+        "git push --force origin claude/fix-123 main"
+    )
+
+
+def test_convergence_branch_multi_refspec_all_convergence() -> None:
+    assert _force_push_targets_convergence_branch(
+        "git push --force origin claude/fix-123 worktree-other"
+    )
+
+
+def test_convergence_branch_multi_refspec_mixed_blocked() -> None:
+    assert not _force_push_targets_convergence_branch(
+        "git push --force origin claude/fix-123 main worktree-other"
+    )
+
+
+def test_convergence_branch_compound_main_piggyback_blocked() -> None:
+    assert not _force_push_targets_convergence_branch(
+        "git push --force origin claude/foo && git push --force origin main"
+    )
+
+
+def test_is_convergence_branch_claude_prefix() -> None:
+    assert _is_convergence_branch("claude/fix-123")
+
+
+def test_is_convergence_branch_worktree_prefix() -> None:
+    assert _is_convergence_branch("worktree-pr-418")
+
+
+def test_is_convergence_branch_pr_converge() -> None:
+    assert _is_convergence_branch("pr-423-converge")
+
+
+def test_is_convergence_branch_main_rejected() -> None:
+    assert not _is_convergence_branch("main")
+
+
+def test_is_convergence_branch_pr_converge_no_end_anchor() -> None:
+    assert not _is_convergence_branch("pr-423-converge-extra")
+
+
+def test_all_refspecs_empty_string_returns_false() -> None:
+    assert not _all_refspecs_are_convergence_branches("")
+
+
+def test_all_refspecs_whitespace_only_returns_false() -> None:
+    assert not _all_refspecs_are_convergence_branches("   ")
+
+
+def test_all_refspecs_flag_only_returns_false() -> None:
+    assert not _all_refspecs_are_convergence_branches("--no-verify")
+
+
+def test_all_refspecs_multiple_flags_only_returns_false() -> None:
+    assert not _all_refspecs_are_convergence_branches("--no-verify --force")
+
+
+def test_all_refspecs_flag_then_branch_checks_branch() -> None:
+    assert not _all_refspecs_are_convergence_branches("--force main")
+
+
+def test_all_refspecs_convergence_branch_with_flags() -> None:
+    assert _all_refspecs_are_convergence_branches("--force claude/fix-123")
+
+
+def test_force_push_convergence_with_no_verify_blocked() -> None:
+    payload = _make_bash_payload(
+        "git push --force origin --no-verify claude/fix-123"
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+    assert "--no-verify" in response["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_force_push_convergence_with_no_gpg_sign_blocked() -> None:
+    payload = _make_bash_payload(
+        "git push --force origin --no-gpg-sign claude/fix-123"
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+    assert "--no-gpg-sign" in response["hookSpecificOutput"]["permissionDecisionReason"]

package/hooks/blocking/test_destructive_command_blocker_no_verify.py

@@ -0,0 +1,102 @@
+"""Tests for --no-verify / --no-gpg-sign blocking in destructive_command_blocker.
+
+git-workflow.md:30-33 marks these as NON-NEGOTIABLE to skip — they bypass
+hook signing and verification. The blocker must ASK before allowing them.
+"""
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+
+SCRIPT_PATH = Path(__file__).parent / "destructive_command_blocker.py"
+
+
+def _run_hook(payload: dict) -> subprocess.CompletedProcess[str]:
+    child_environment = os.environ.copy()
+    return subprocess.run(
+        [sys.executable, str(SCRIPT_PATH)],
+        input=json.dumps(payload),
+        text=True,
+        capture_output=True,
+        check=False,
+        env=child_environment,
+    )
+
+
+def _make_bash_payload(command: str) -> dict:
+    return {"tool_name": "Bash", "tool_input": {"command": command}}
+
+
+def test_asks_on_git_commit_no_verify() -> None:
+    payload = _make_bash_payload('git commit -m "wip" --no-verify')
+    result = _run_hook(payload)
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
+        f"Expected ask for git commit --no-verify, got: {response!r}"
+    )
+    assert "no-verify" in response["hookSpecificOutput"]["permissionDecisionReason"], (
+        f"Reason must mention --no-verify, got: {response!r}"
+    )
+
+
+def test_asks_on_git_push_no_verify() -> None:
+    payload = _make_bash_payload("git push --no-verify origin main")
+    result = _run_hook(payload)
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
+        f"Expected ask for git push --no-verify, got: {response!r}"
+    )
+
+
+def test_asks_on_git_no_gpg_sign() -> None:
+    payload = _make_bash_payload("git commit --no-gpg-sign -m wip")
+    result = _run_hook(payload)
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
+        f"Expected ask for git --no-gpg-sign, got: {response!r}"
+    )
+    assert (
+        "no-gpg-sign" in response["hookSpecificOutput"]["permissionDecisionReason"]
+    ), f"Reason must mention --no-gpg-sign, got: {response!r}"
+
+
+def test_asks_on_git_commit_with_no_gpg_sign_config() -> None:
+    payload = _make_bash_payload("git -c commit.gpgsign=false commit -m wip")
+    result = _run_hook(payload)
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
+        f"Expected ask for -c commit.gpgsign=false, got: {response!r}"
+    )
+
+
+def test_asks_on_quoted_gpgsign_config() -> None:
+    payload = _make_bash_payload("git -c 'commit.gpgsign=false' commit -m wip")
+    result = _run_hook(payload)
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
+        f"Expected ask for quoted -c commit.gpgsign=false, got: {response!r}"
+    )
+
+
+def test_asks_on_value_quoted_gpgsign_config() -> None:
+    payload = _make_bash_payload("git -c commit.gpgsign='false' commit -m wip")
+    result = _run_hook(payload)
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
+        f"Expected ask for value-quoted -c commit.gpgsign='false', got: {response!r}"
+    )
+
+
+def test_normal_git_commit_passes() -> None:
+    payload = _make_bash_payload('git commit -m "real commit"')
+    result = _run_hook(payload)
+    if not result.stdout.strip():
+        return
+    response = json.loads(result.stdout)
+    decision = response.get("hookSpecificOutput", {}).get("permissionDecision", "allow")
+    assert decision != "ask", (
+        f"Normal git commit must not be flagged as destructive, got: {response!r}"
+    )

package/hooks/blocking/test_gh_body_arg_blocker.py

@@ -17,6 +17,7 @@ assert hook_spec.loader is not None
 hook_module = importlib.util.module_from_spec(hook_spec)
 hook_spec.loader.exec_module(hook_module)
 _uses_body_string_arg = hook_module._uses_body_string_arg
+_has_backtick = hook_module._has_backtick
 
 from _gh_body_arg_utils import iter_significant_tokens
 
@@ -373,3 +374,47 @@ def test_all_body_flag_prefixes_used_for_equals_skip() -> None:
     for each_prefix in all_body_flag_prefixes:
         assert each_prefix in _all_equals_prefixes_for_skip
 
+
+def test_has_backtick_with_plain_text_body() -> None:
+    assert not _has_backtick('gh issue comment 42 --body "bugbot run"')
+
+
+def test_has_backtick_with_markdown_body() -> None:
+    assert _has_backtick('gh pr create --title "T" --body "Fixes `foo`"')
+
+
+def test_has_backtick_with_short_b_plain_text() -> None:
+    assert not _has_backtick('gh pr comment 10 -b "LGTM"')
+
+
+def test_has_backtick_with_equals_form_plain_text() -> None:
+    assert not _has_backtick('gh pr create --title "T" --body="bugbot run"')
+
+
+def test_has_backtick_with_empty_body() -> None:
+    assert not _has_backtick('gh pr create --title "T" --body=""')
+
+
+def test_has_backtick_bash_continuation_stripped() -> None:
+    """Bash backslash line continuations are stripped before checking."""
+    command = 'gh pr create \\\n  --title "T" \\\n  --body "bugbot run"\n'
+    assert not _has_backtick(command)
+
+
+def test_has_backtick_powershell_continuation_stripped() -> None:
+    """PowerShell backtick line continuations are stripped before checking."""
+    command = 'gh pr create `\n  --title "T" `\n  --body "bugbot run"\n'
+    assert not _has_backtick(command)
+
+
+def test_has_backtick_content_backtick_at_line_end() -> None:
+    """A backtick at end of line in body content must be detected (not mistaken for continuation)."""
+    command = 'gh pr create --title "T" --body "Thanks `\n@user"'
+    assert _has_backtick(command)
+
+
+def test_has_backtick_multi_line_body() -> None:
+    """Backtick on a non-first line of a multi-line body must be detected."""
+    command = 'gh pr create --title "T" --body "First line.\nSecond with `code`."'
+    assert _has_backtick(command)
+