claude-dev-env 1.38.0 → 1.39.0

package/skills/bugteam/scripts/test_claude_permissions_common.py

@@ -0,0 +1,195 @@
+import importlib
+import sys
+from pathlib import Path
+from types import ModuleType
+from unittest.mock import patch
+
+import pytest
+
+_script_directory = str(Path(__file__).resolve().parent)
+if _script_directory not in sys.path:
+    sys.path.insert(0, _script_directory)
+
+import _claude_permissions_common as common_module
+from _claude_permissions_common import (
+    build_permission_rule,
+    get_current_project_path,
+    path_contains_glob_metacharacters,
+    save_settings,
+)
+from config.claude_permissions_common_constants import DEFAULT_SETTINGS_FILE_MODE
+import grant_project_claude_permissions as grant_module
+import revoke_project_claude_permissions as revoke_module
+
+
+def test_return_normalized_path_when_cwd_contains_spaces(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    directory_with_spaces = tmp_path / "dir with spaces"
+    directory_with_spaces.mkdir()
+    monkeypatch.chdir(directory_with_spaces)
+    returned_project_path = get_current_project_path()
+    expected_suffix = "/dir with spaces"
+    assert returned_project_path.endswith(expected_suffix)
+    assert "\\" not in returned_project_path
+    built_rule = build_permission_rule("Edit", returned_project_path)
+    assert built_rule.startswith("Edit(")
+    assert built_rule.endswith("/.claude/**)")
+    assert "dir with spaces" in built_rule
+
+
+def test_raise_when_cwd_contains_glob_metacharacters(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    directory_with_star = tmp_path / "weird[dir]"
+    directory_with_star.mkdir()
+    monkeypatch.chdir(directory_with_star)
+    with pytest.raises(ValueError, match="glob metacharacters"):
+        get_current_project_path()
+
+
+def test_flag_glob_metacharacters_in_any_position() -> None:
+    assert path_contains_glob_metacharacters("/home/user/[dir]/project")
+    assert path_contains_glob_metacharacters("/home/user/project*")
+    assert not path_contains_glob_metacharacters("/home/user/dir with spaces")
+
+
+def test_save_settings_logs_when_temp_unlink_fails(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """A swallowed unlink in the finally block must surface to stderr.
+
+    Forces a write success followed by os.replace failure so the temp file
+    survives into the finally branch, then makes Path.unlink raise.
+    """
+    settings_path = tmp_path / "settings.json"
+    settings_path.write_text('{"existing": true}\n', encoding="utf-8")
+
+    def failing_replace(*_args: object, **_kwargs: object) -> None:
+        raise OSError("replace blocked by AV")
+
+    def failing_unlink(self: Path, *args: object, **kwargs: object) -> None:
+        raise PermissionError("temp file held by AV")
+
+    with patch.object(common_module.os, "replace", failing_replace):
+        with patch.object(Path, "unlink", failing_unlink):
+            with pytest.raises(SystemExit):
+                save_settings(settings_path, {"new_key": "value"})
+    captured = capsys.readouterr()
+    assert ".tmp" in captured.err
+    assert "PermissionError" in captured.err or "held by AV" in captured.err
+
+
+def test_save_settings_finally_skips_unlink_when_no_temp_was_created(
+    tmp_path: Path,
+) -> None:
+    """When this invocation never created the temp file, finally must not unlink it."""
+    settings_path = tmp_path / "settings.json"
+    settings_path.write_text('{"existing": true}\n', encoding="utf-8")
+
+    unlink_call_paths: list[Path] = []
+    original_unlink = Path.unlink
+
+    def recording_unlink(self: Path, *args: object, **kwargs: object) -> None:
+        unlink_call_paths.append(self)
+        original_unlink(self, *args, **kwargs)
+
+    def write_raises(*_args: object, **_kwargs: object) -> None:
+        raise FileExistsError("another writer's temp")
+
+    with patch.object(common_module, "write_atomically_with_mode", write_raises):
+        with patch.object(Path, "unlink", recording_unlink):
+            with pytest.raises(SystemExit):
+                common_module.save_settings(settings_path, {"new_key": "value"})
+    assert all(
+        each_path.suffix != ".tmp"
+        for each_path in unlink_call_paths
+    ), (
+        "finally must not unlink a temp file this invocation never created"
+    )
+
+
+def test_default_settings_file_mode_used_when_settings_file_missing(
+    tmp_path: Path,
+) -> None:
+    """get_mode_to_preserve must fall back to DEFAULT_SETTINGS_FILE_MODE."""
+    missing_settings_path = tmp_path / "no_such_file.json"
+    returned_mode = common_module.get_mode_to_preserve(missing_settings_path)
+    assert returned_mode == DEFAULT_SETTINGS_FILE_MODE
+
+
+def test_is_valid_project_root_helper_is_not_orphaned_in_common_module() -> None:
+    """The orphan helper in the common module must be removed.
+
+    Both grant and revoke keep their own local copies and consume them from
+    module scope; the common-module copy was dead code with zero call sites.
+    """
+    assert not hasattr(common_module, "is_valid_project_root"), (
+        "is_valid_project_root must not live in _claude_permissions_common — "
+        "neither grant nor revoke imports it from there"
+    )
+    assert callable(grant_module.is_valid_project_root)
+    assert callable(revoke_module.is_valid_project_root)
+
+
+def _reload_with_stale_config_cache(module_name: str) -> ModuleType:
+    fake_submodule_name = "config.claude_permissions_common_constants"
+    fake_parent_name = "config"
+    sentinel_module_a = ModuleType(fake_parent_name)
+    sentinel_module_b = ModuleType(fake_submodule_name)
+    sys.modules[fake_parent_name] = sentinel_module_a
+    sys.modules[fake_submodule_name] = sentinel_module_b
+    try:
+        target_module = sys.modules.get(module_name)
+        if target_module is None:
+            target_module = importlib.import_module(module_name)
+        else:
+            target_module = importlib.reload(target_module)
+    finally:
+        sys.modules.pop(fake_parent_name, None)
+        sys.modules.pop(fake_submodule_name, None)
+    return target_module
+
+
+def test_grant_module_import_evicts_cached_config_submodules(
+    tmp_path: Path,
+) -> None:
+    """grant_project_claude_permissions must evict cached `config.*` on import.
+
+    Regression for loop1-2: without a defensive cache pop above sys.path.insert,
+    a cached `config` package shadows scripts/config/ and the from-import raises.
+    Calls the rebound `is_valid_project_root` to confirm the real implementation
+    survived the cache eviction (a stale shadow would either raise on import or
+    bind a placeholder that returns the wrong value).
+    """
+    reloaded_module = _reload_with_stale_config_cache(
+        "grant_project_claude_permissions"
+    )
+    real_project_root = tmp_path / "project_root"
+    (real_project_root / ".claude").mkdir(parents=True)
+    bare_directory = tmp_path / "no_claude_marker"
+    bare_directory.mkdir()
+    assert reloaded_module.is_valid_project_root(real_project_root) is True
+    assert reloaded_module.is_valid_project_root(bare_directory) is False
+
+
+def test_revoke_module_import_evicts_cached_config_submodules(
+    tmp_path: Path,
+) -> None:
+    """revoke_project_claude_permissions must evict cached `config.*` on import.
+
+    Regression for loop1-3: without a defensive cache pop above sys.path.insert,
+    a cached `config` package shadows scripts/config/ and the from-import raises.
+    Calls the rebound `is_valid_project_root` to confirm the real implementation
+    survived the cache eviction (a stale shadow would either raise on import or
+    bind a placeholder that returns the wrong value).
+    """
+    reloaded_module = _reload_with_stale_config_cache(
+        "revoke_project_claude_permissions"
+    )
+    real_project_root = tmp_path / "project_root"
+    (real_project_root / ".claude").mkdir(parents=True)
+    bare_directory = tmp_path / "no_claude_marker"
+    bare_directory.mkdir()
+    assert reloaded_module.is_valid_project_root(real_project_root) is True
+    assert reloaded_module.is_valid_project_root(bare_directory) is False

package/skills/bugteam/scripts/test_grant_project_claude_permissions.py

@@ -0,0 +1,55 @@
+"""Regression tests for grant_project_claude_permissions module-import behavior.
+
+Pins the loop1-2 fix: a defensive cache pop above sys.path.insert evicts every
+cached `config` and `config.<submodule>` entry so the from-import binds against
+scripts/config/ rather than a stale parent package shadowing it.
+"""
+
+from __future__ import annotations
+
+import importlib
+import sys
+from pathlib import Path
+from types import ModuleType
+
+
+_script_directory = str(Path(__file__).resolve().parent)
+if _script_directory not in sys.path:
+    sys.path.insert(0, _script_directory)
+
+
+def _reload_grant_with_stale_config_cache() -> ModuleType:
+    fake_submodule_name = "config.claude_permissions_common_constants"
+    fake_parent_name = "config"
+    sentinel_module_a = ModuleType(fake_parent_name)
+    sentinel_module_b = ModuleType(fake_submodule_name)
+    sys.modules[fake_parent_name] = sentinel_module_a
+    sys.modules[fake_submodule_name] = sentinel_module_b
+    try:
+        target_module = sys.modules.get("grant_project_claude_permissions")
+        if target_module is None:
+            target_module = importlib.import_module("grant_project_claude_permissions")
+        else:
+            target_module = importlib.reload(target_module)
+    finally:
+        sys.modules.pop(fake_parent_name, None)
+        sys.modules.pop(fake_submodule_name, None)
+    return target_module
+
+
+def test_grant_module_imports_when_config_is_already_cached(tmp_path: Path) -> None:
+    """Module import must succeed even when sys.modules carries a stale `config`.
+
+    Regression for loop1-2 — invokes is_valid_project_root after reload to
+    prove the binding came from scripts/config/ rather than the sentinel.
+    """
+    reloaded_module = _reload_grant_with_stale_config_cache()
+    not_a_project_root = tmp_path / "empty_dir"
+    not_a_project_root.mkdir()
+    assert reloaded_module.is_valid_project_root(not_a_project_root) is False, (
+        "is_valid_project_root must run normally after the reload — proof that "
+        "the from-import bound real constants, not the stale cached ones"
+    )
+    a_git_project_root = tmp_path / "git_project"
+    (a_git_project_root / ".git").mkdir(parents=True)
+    assert reloaded_module.is_valid_project_root(a_git_project_root) is True

package/skills/bugteam/scripts/test_probe_code_rules_enforcer_check.py

@@ -0,0 +1,76 @@
+"""Tests for probe_code_rules_enforcer_check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+_script_directory = str(Path(__file__).resolve().parent)
+if _script_directory not in sys.path:
+    sys.path.insert(0, _script_directory)
+
+import probe_code_rules_enforcer_check as probe_module
+from probe_code_rules_enforcer_check import main, run_probe
+
+
+class _FakeEnforcerModule:
+    @staticmethod
+    def check_dummy(content: str, reported_path: str) -> list[str]:
+        if "trigger" in content:
+            return [f"{reported_path}: trigger detected"]
+        return []
+
+
+def _install_fake_loader(
+    monkeypatch: pytest.MonkeyPatch,
+    fake_module: Any,
+) -> None:
+    monkeypatch.setattr(probe_module, "_load_enforcer_module", lambda: fake_module)
+
+
+def test_run_probe_returns_check_function_output(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_fake_loader(monkeypatch, _FakeEnforcerModule())
+    fixture = tmp_path / "fixture.py"
+    fixture.write_text("trigger me", encoding="utf-8")
+    issues = run_probe("check_dummy", str(fixture), "reported.py")
+    assert issues == ["reported.py: trigger detected"]
+
+
+def test_run_probe_raises_when_check_function_missing(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_fake_loader(monkeypatch, _FakeEnforcerModule())
+    fixture = tmp_path / "fixture.py"
+    fixture.write_text("no-op", encoding="utf-8")
+    with pytest.raises(AttributeError):
+        run_probe("does_not_exist", str(fixture), "reported.py")
+
+
+def test_main_prints_each_issue(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    _install_fake_loader(monkeypatch, _FakeEnforcerModule())
+    fixture = tmp_path / "fixture.py"
+    fixture.write_text("trigger me", encoding="utf-8")
+    exit_code = main(
+        ["probe_code_rules_enforcer_check.py", "check_dummy", str(fixture)]
+    )
+    captured = capsys.readouterr()
+    assert exit_code == 0
+    assert "trigger detected" in captured.out
+
+
+def test_main_returns_usage_exit_code_when_argv_count_wrong(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    exit_code = main(["probe_code_rules_enforcer_check.py"])
+    captured = capsys.readouterr()
+    assert exit_code != 0
+    assert "usage" in captured.err.lower()

package/skills/bugteam/scripts/test_revoke_project_claude_permissions.py

@@ -0,0 +1,55 @@
+"""Regression tests for revoke_project_claude_permissions module-import behavior.
+
+Pins the loop1-3 fix: a defensive cache pop above sys.path.insert evicts every
+cached `config` and `config.<submodule>` entry so the from-import binds against
+scripts/config/ rather than a stale parent package shadowing it.
+"""
+
+from __future__ import annotations
+
+import importlib
+import sys
+from pathlib import Path
+from types import ModuleType
+
+
+_script_directory = str(Path(__file__).resolve().parent)
+if _script_directory not in sys.path:
+    sys.path.insert(0, _script_directory)
+
+
+def _reload_revoke_with_stale_config_cache() -> ModuleType:
+    fake_submodule_name = "config.claude_permissions_common_constants"
+    fake_parent_name = "config"
+    sentinel_module_a = ModuleType(fake_parent_name)
+    sentinel_module_b = ModuleType(fake_submodule_name)
+    sys.modules[fake_parent_name] = sentinel_module_a
+    sys.modules[fake_submodule_name] = sentinel_module_b
+    try:
+        target_module = sys.modules.get("revoke_project_claude_permissions")
+        if target_module is None:
+            target_module = importlib.import_module("revoke_project_claude_permissions")
+        else:
+            target_module = importlib.reload(target_module)
+    finally:
+        sys.modules.pop(fake_parent_name, None)
+        sys.modules.pop(fake_submodule_name, None)
+    return target_module
+
+
+def test_revoke_module_imports_when_config_is_already_cached(tmp_path: Path) -> None:
+    """Module import must succeed even when sys.modules carries a stale `config`.
+
+    Regression for loop1-3 — invokes is_valid_project_root after reload to
+    prove the binding came from scripts/config/ rather than the sentinel.
+    """
+    reloaded_module = _reload_revoke_with_stale_config_cache()
+    not_a_project_root = tmp_path / "empty_dir"
+    not_a_project_root.mkdir()
+    assert reloaded_module.is_valid_project_root(not_a_project_root) is False, (
+        "is_valid_project_root must run normally after the reload — proof that "
+        "the from-import bound real constants, not the stale cached ones"
+    )
+    a_claude_project_root = tmp_path / "claude_project"
+    (a_claude_project_root / ".claude").mkdir(parents=True)
+    assert reloaded_module.is_valid_project_root(a_claude_project_root) is True

package/skills/bugteam/scripts/test_windows_safe_rmtree.py

@@ -0,0 +1,108 @@
+"""Tests for windows_safe_rmtree."""
+
+from __future__ import annotations
+
+import os
+import stat
+import sys
+from pathlib import Path
+
+import pytest
+
+_script_directory = str(Path(__file__).resolve().parent)
+if _script_directory not in sys.path:
+    sys.path.insert(0, _script_directory)
+
+from unittest.mock import patch
+
+from windows_safe_rmtree import _strip_read_only_and_retry, main, remove_tree
+
+
+def test_strip_read_only_and_retry_logs_when_retry_still_fails(
+    capsys: pytest.CaptureFixture[str],
+    tmp_path: Path,
+) -> None:
+    """The chmod-then-retry handler must surface residual failures to stderr."""
+    target_path = tmp_path / "locked_file.txt"
+    target_path.write_text("payload", encoding="utf-8")
+
+    def always_fails(_path: str) -> None:
+        raise PermissionError("file held by another process")
+
+    _strip_read_only_and_retry(always_fails, str(target_path), None, None, None)
+    captured = capsys.readouterr()
+    assert str(target_path) in captured.err
+    assert "PermissionError" in captured.err or "held by another process" in captured.err
+
+
+def test_remove_tree_returns_nonzero_when_residual_oserror(
+    capsys: pytest.CaptureFixture[str],
+    tmp_path: Path,
+) -> None:
+    """When shutil.rmtree raises after handler retries, remove_tree must signal."""
+    target_path = tmp_path / "ghost"
+    target_path.mkdir()
+    with patch(
+        "shutil.rmtree",
+        side_effect=PermissionError("residual lock"),
+    ):
+        exit_code = remove_tree(str(target_path))
+    captured = capsys.readouterr()
+    assert exit_code != 0, "remove_tree must report failure when rmtree raises"
+    assert str(target_path) in captured.err
+    assert "residual lock" in captured.err or "PermissionError" in captured.err
+
+
+def test_main_propagates_remove_tree_failure(
+    capsys: pytest.CaptureFixture[str],
+    tmp_path: Path,
+) -> None:
+    """main must return non-zero when remove_tree could not finish cleanup."""
+    target_path = tmp_path / "stubborn"
+    target_path.mkdir()
+    with patch(
+        "shutil.rmtree",
+        side_effect=PermissionError("still locked"),
+    ):
+        exit_code = main(["windows_safe_rmtree.py", str(target_path)])
+    assert exit_code != 0
+
+
+def test_remove_tree_deletes_plain_directory(tmp_path: Path) -> None:
+    target = tmp_path / "victim"
+    target.mkdir()
+    (target / "file.txt").write_text("payload", encoding="utf-8")
+    remove_tree(str(target))
+    assert not target.exists()
+
+
+def test_remove_tree_handles_read_only_file(tmp_path: Path) -> None:
+    target = tmp_path / "victim"
+    target.mkdir()
+    locked_file = target / "locked.txt"
+    locked_file.write_text("payload", encoding="utf-8")
+    os.chmod(locked_file, stat.S_IREAD)
+    remove_tree(str(target))
+    assert not target.exists()
+
+
+def test_remove_tree_swallows_missing_path(tmp_path: Path) -> None:
+    missing_path = tmp_path / "does-not-exist"
+    remove_tree(str(missing_path))
+
+
+def test_main_returns_zero_on_success(tmp_path: Path) -> None:
+    target = tmp_path / "victim"
+    target.mkdir()
+    exit_code = main(["windows_safe_rmtree.py", str(target)])
+    assert exit_code == 0
+    assert not target.exists()
+
+
+def test_main_returns_usage_exit_code_when_argv_count_wrong(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    exit_code = main(["windows_safe_rmtree.py"])
+    captured = capsys.readouterr()
+    assert exit_code != 0
+    assert "usage" in captured.err.lower()

package/skills/bugteam/scripts/windows_safe_rmtree.py

@@ -0,0 +1,100 @@
+"""Recursively remove a directory tree, stripping Windows ReadOnly attributes.
+
+Required by ~/.claude/rules/windows-filesystem-safe.md so bugteam teardown does
+not silently swallow Windows ReadOnly-attribute failures the way the unsafe
+shutil ignore-errors flag does.
+
+Usage:
+    python windows_safe_rmtree.py <absolute-path>
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import stat
+import sys
+from collections.abc import Callable
+
+from config.windows_safe_rmtree_constants import (
+    EXIT_CODE_REMOVE_TREE_FAILURE,
+    EXIT_CODE_USAGE_ERROR,
+    EXPECTED_ARGUMENT_COUNT,
+    ONEXC_PYTHON_MAJOR_VERSION,
+    ONEXC_PYTHON_MINOR_VERSION,
+)
+
+
+def _strip_read_only_and_retry(
+    removal_function: Callable[[str], None],
+    target_path: str,
+    *_exc_info: object,
+) -> None:
+    try:
+        os.chmod(target_path, os.stat(target_path).st_mode | stat.S_IWRITE)
+        removal_function(target_path)
+    except OSError as residual_error:
+        sys.stderr.write(
+            f"windows_safe_rmtree: chmod-and-retry could not remove {target_path}: "
+            f"{type(residual_error).__name__}: {residual_error}\n"
+        )
+
+
+def _select_handler_keyword() -> dict[str, Callable[..., None]]:
+    onexc_required_version = (
+        ONEXC_PYTHON_MAJOR_VERSION,
+        ONEXC_PYTHON_MINOR_VERSION,
+    )
+    if sys.version_info >= onexc_required_version:
+        return {"onexc": _strip_read_only_and_retry}
+    return {"onerror": _strip_read_only_and_retry}
+
+
+def remove_tree(target_path: str) -> int:
+    """Recursively remove a directory tree, handling Windows ReadOnly attributes.
+
+    Args:
+        target_path: Absolute path to the directory tree to remove.
+
+    Returns:
+        Zero when the tree was removed (or never existed). Non-zero when
+        the chmod-and-retry handler could not finish cleanup; callers must
+        treat a non-zero return as "tree may still be present".
+    """
+    if not os.path.exists(target_path):
+        return 0
+    handler_keyword = _select_handler_keyword()
+    try:
+        shutil.rmtree(target_path, **handler_keyword)
+    except OSError as residual_error:
+        sys.stderr.write(
+            f"windows_safe_rmtree: residual failure removing {target_path}: "
+            f"{type(residual_error).__name__}: {residual_error}\n"
+        )
+        return EXIT_CODE_REMOVE_TREE_FAILURE
+    return 0
+
+
+def _print_usage_to_stderr() -> None:
+    sys.stderr.write("usage: python windows_safe_rmtree.py <absolute-path>\n")
+
+
+def main(all_arguments: list[str]) -> int:
+    """Parse command-line arguments and invoke remove_tree.
+
+    Args:
+        all_arguments: Command-line arguments including script name
+                       and the target directory path.
+
+    Returns:
+        Exit code 0 on success, EXIT_CODE_USAGE_ERROR on invalid usage,
+        EXIT_CODE_REMOVE_TREE_FAILURE when remove_tree could not finish.
+    """
+    if len(all_arguments) != EXPECTED_ARGUMENT_COUNT:
+        _print_usage_to_stderr()
+        return EXIT_CODE_USAGE_ERROR
+    return remove_tree(all_arguments[1])
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))

package/skills/bugteam/test_skill_additions.py

@@ -10,21 +10,11 @@ def _read_skill_text() -> str:
     return skill_path.read_text(encoding="utf-8")
 
 
-def test_skill_references_fix_implementer_env_var():
-    skill_text = _read_skill_text()
-    assert "BUGTEAM_FIX_IMPLEMENTER" in skill_text
-
-
-def test_skill_names_default_implementer_subagent_type():
+def test_skill_names_implementer_subagent_type():
     skill_text = _read_skill_text()
     assert "clean-coder" in skill_text
 
 
-def test_skill_names_optional_groq_implementer_subagent_type():
-    skill_text = _read_skill_text()
-    assert "groq-coder" in skill_text
-
-
 def test_skill_documents_bugbot_retrigger_flag():
     skill_text = _read_skill_text()
     assert "--bugbot-retrigger" in skill_text