claude-dev-env 1.38.1 → 1.40.0

package/hooks/blocking/test_code_rules_enforcer_typed_dict_pairs.py

@@ -0,0 +1,141 @@
+"""Tests for check_typed_dict_encode_decode — flags TypedDicts missing companion encoders.
+
+Per Plan 1c.typed_dict_validator / Phase B2: every TypedDict declaration in
+production code must have a companion `_encode_<snake_name>` and
+`_decode_<snake_name>` function so untyped dicts cannot leak across module
+boundaries without explicit validation.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+from types import ModuleType
+
+
+def _load_enforcer_module() -> ModuleType:
+    module_path = Path(__file__).parent / "code_rules_enforcer.py"
+    spec = importlib.util.spec_from_file_location("code_rules_enforcer", module_path)
+    assert spec is not None
+    assert spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+code_rules_enforcer = _load_enforcer_module()
+
+
+def check_typed_dict_encode_decode(content: str, file_path: str) -> list[str]:
+    return code_rules_enforcer.check_typed_dict_encode_decode(content, file_path)
+
+
+PRODUCTION_FILE_PATH = "/project/src/contracts.py"
+TEST_FILE_PATH = "/project/src/test_contracts.py"
+HOOK_INFRASTRUCTURE_PATH = "/home/user/.claude/hooks/blocking/example.py"
+
+
+def test_should_flag_typed_dict_without_encode_or_decode() -> None:
+    source = (
+        "from typing import TypedDict\n"
+        "class InvoicePayload(TypedDict):\n"
+        "    amount: int\n"
+    )
+    issues = check_typed_dict_encode_decode(source, PRODUCTION_FILE_PATH)
+    assert any("InvoicePayload" in each for each in issues), (
+        f"Expected InvoicePayload to be flagged, got: {issues!r}"
+    )
+
+
+def test_should_flag_typed_dict_with_only_encode() -> None:
+    source = (
+        "from typing import TypedDict\n"
+        "class InvoicePayload(TypedDict):\n"
+        "    amount: int\n"
+        "def _encode_invoice_payload(value: InvoicePayload) -> bytes:\n"
+        "    return b''\n"
+    )
+    issues = check_typed_dict_encode_decode(source, PRODUCTION_FILE_PATH)
+    assert any(
+        "InvoicePayload" in each and "decode" in each.lower() for each in issues
+    ), f"Expected missing _decode_ to be flagged, got: {issues!r}"
+
+
+def test_should_flag_typed_dict_with_only_decode() -> None:
+    source = (
+        "from typing import TypedDict\n"
+        "class InvoicePayload(TypedDict):\n"
+        "    amount: int\n"
+        "def _decode_invoice_payload(raw: bytes) -> InvoicePayload:\n"
+        "    return {'amount': 0}\n"
+    )
+    issues = check_typed_dict_encode_decode(source, PRODUCTION_FILE_PATH)
+    assert any(
+        "InvoicePayload" in each and "encode" in each.lower() for each in issues
+    ), f"Expected missing _encode_ to be flagged, got: {issues!r}"
+
+
+def test_should_not_flag_typed_dict_with_both_companions() -> None:
+    source = (
+        "from typing import TypedDict\n"
+        "class InvoicePayload(TypedDict):\n"
+        "    amount: int\n"
+        "def _encode_invoice_payload(value: InvoicePayload) -> bytes:\n"
+        "    return b''\n"
+        "def _decode_invoice_payload(raw: bytes) -> InvoicePayload:\n"
+        "    return {'amount': 0}\n"
+    )
+    issues = check_typed_dict_encode_decode(source, PRODUCTION_FILE_PATH)
+    assert issues == [], f"Both companions present, got: {issues!r}"
+
+
+def test_should_handle_pascal_to_snake_conversion() -> None:
+    source = (
+        "from typing import TypedDict\n"
+        "class TypedAuthRequest(TypedDict):\n"
+        "    token: str\n"
+    )
+    issues = check_typed_dict_encode_decode(source, PRODUCTION_FILE_PATH)
+    assert any("TypedAuthRequest" in each for each in issues), (
+        f"PascalCase conversion expected; got: {issues!r}"
+    )
+
+
+def test_should_skip_test_file() -> None:
+    source = "from typing import TypedDict\nclass MockPayload(TypedDict):\n    x: int\n"
+    issues = check_typed_dict_encode_decode(source, TEST_FILE_PATH)
+    assert issues == [], f"Test files exempt, got: {issues!r}"
+
+
+def test_should_skip_hook_infrastructure() -> None:
+    source = "from typing import TypedDict\nclass HookPayload(TypedDict):\n    x: int\n"
+    issues = check_typed_dict_encode_decode(source, HOOK_INFRASTRUCTURE_PATH)
+    assert issues == [], f"Hook infrastructure exempt, got: {issues!r}"
+
+
+def test_should_handle_syntax_error_gracefully() -> None:
+    source = "class InvoicePayload(TypedDict\n"
+    issues = check_typed_dict_encode_decode(source, PRODUCTION_FILE_PATH)
+    assert issues == [], f"Syntax error must yield no issues, got: {issues!r}"
+
+
+def test_should_not_flag_typed_dict_nested_inside_class() -> None:
+    source = (
+        "from typing import TypedDict\n"
+        "class Service:\n"
+        "    class RequestPayload(TypedDict):\n"
+        "        token: str\n"
+    )
+    issues = check_typed_dict_encode_decode(source, PRODUCTION_FILE_PATH)
+    assert issues == [], f"Nested TypedDict must not be flagged, got: {issues!r}"
+
+
+def test_should_not_flag_non_typed_dict_class() -> None:
+    source = (
+        "from dataclasses import dataclass\n"
+        "@dataclass\n"
+        "class Invoice:\n"
+        "    amount: int\n"
+    )
+    issues = check_typed_dict_encode_decode(source, PRODUCTION_FILE_PATH)
+    assert issues == [], f"Regular dataclass must not be flagged, got: {issues!r}"

package/hooks/blocking/test_convergence_gate_blocker.py

@@ -0,0 +1,63 @@
+"""Unit tests for convergence-gate-blocker PreToolUse hook."""
+
+import importlib.util
+import pathlib
+import sys
+
+_HOOK_DIR = pathlib.Path(__file__).parent
+if str(_HOOK_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIR))
+
+import re
+
+_GH_PR_READY_PATTERN = re.compile(r"\bgh\s+pr\s+ready\b(?![^&|;\n]*--undo)")
+
+hook_spec = importlib.util.spec_from_file_location(
+    "convergence_gate_blocker",
+    _HOOK_DIR / "convergence_gate_blocker.py",
+)
+assert hook_spec is not None
+assert hook_spec.loader is not None
+hook_module = importlib.util.module_from_spec(hook_spec)
+hook_spec.loader.exec_module(hook_module)
+_resolve_pr_number = hook_module._resolve_pr_number
+
+
+def test_matches_gh_pr_ready_with_number() -> None:
+    assert _GH_PR_READY_PATTERN.search("gh pr ready 418")
+
+
+def test_matches_gh_pr_ready_without_number() -> None:
+    assert _GH_PR_READY_PATTERN.search("gh pr ready")
+
+
+def test_matches_gh_pr_ready_with_flags() -> None:
+    assert not _GH_PR_READY_PATTERN.search("gh pr ready --undo")
+
+
+def test_does_not_match_gh_pr_create() -> None:
+    assert not _GH_PR_READY_PATTERN.search("gh pr create --title T")
+
+
+def test_does_not_match_gh_pr_view() -> None:
+    assert not _GH_PR_READY_PATTERN.search("gh pr view 418")
+
+
+def test_does_not_match_gh_issue_close() -> None:
+    assert not _GH_PR_READY_PATTERN.search("gh issue close 42")
+
+
+def test_extracts_pr_number_from_command() -> None:
+    assert _resolve_pr_number("gh pr ready 418", None) == 418
+
+
+def test_extracts_pr_number_with_flags() -> None:
+    assert _resolve_pr_number("gh pr ready 99 --undo", None) == 99
+
+
+def test_returns_none_when_no_number_and_no_repo() -> None:
+    assert _resolve_pr_number("gh pr ready", "/nonexistent/path") is None
+
+
+def test_matches_gh_pr_ready_in_compound_command() -> None:
+    assert not _GH_PR_READY_PATTERN.search("gh pr ready --undo && gh pr create")

package/hooks/blocking/test_destructive_command_blocker.py

@@ -1008,3 +1008,149 @@ def test_git_reset_hard_asks_when_settings_file_is_invalid_json(tmp_path: Path)
 
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+# --- convergence branch exemption unit tests ---
+
+import importlib.util
+
+_HOOK_DIR = Path(__file__).parent
+_hook_spec = importlib.util.spec_from_file_location(
+    "destructive_command_blocker",
+    _HOOK_DIR / "destructive_command_blocker.py",
+)
+assert _hook_spec is not None
+assert _hook_spec.loader is not None
+_hook_module = importlib.util.module_from_spec(_hook_spec)
+_hook_spec.loader.exec_module(_hook_module)
+_force_push_targets_convergence_branch = _hook_module._force_push_targets_convergence_branch
+_is_convergence_branch = _hook_module._is_convergence_branch
+_all_refspecs_are_convergence_branches = _hook_module._all_refspecs_are_convergence_branches
+
+
+def test_convergence_branch_claude_prefix_allowed() -> None:
+    assert _force_push_targets_convergence_branch(
+        "git push --force origin claude/fix-123"
+    )
+
+
+def test_convergence_branch_worktree_prefix_allowed() -> None:
+    assert _force_push_targets_convergence_branch(
+        "git push --force origin worktree-pr-converge-418"
+    )
+
+
+def test_convergence_branch_pr_converge_allowed() -> None:
+    assert _force_push_targets_convergence_branch(
+        "git push --force origin pr-423-converge"
+    )
+
+
+def test_convergence_branch_f_variant_allowed() -> None:
+    assert _force_push_targets_convergence_branch(
+        "git push -f origin claude/fix-123"
+    )
+
+
+def test_convergence_branch_main_blocked() -> None:
+    assert not _force_push_targets_convergence_branch(
+        "git push --force origin main"
+    )
+
+
+def test_convergence_branch_refspec_destination_checked() -> None:
+    assert not _force_push_targets_convergence_branch(
+        "git push --force origin claude/fix:main"
+    )
+
+
+def test_convergence_branch_multi_refspec_main_blocked() -> None:
+    assert not _force_push_targets_convergence_branch(
+        "git push --force origin claude/fix-123 main"
+    )
+
+
+def test_convergence_branch_multi_refspec_all_convergence() -> None:
+    assert _force_push_targets_convergence_branch(
+        "git push --force origin claude/fix-123 worktree-other"
+    )
+
+
+def test_convergence_branch_multi_refspec_mixed_blocked() -> None:
+    assert not _force_push_targets_convergence_branch(
+        "git push --force origin claude/fix-123 main worktree-other"
+    )
+
+
+def test_convergence_branch_compound_main_piggyback_blocked() -> None:
+    assert not _force_push_targets_convergence_branch(
+        "git push --force origin claude/foo && git push --force origin main"
+    )
+
+
+def test_is_convergence_branch_claude_prefix() -> None:
+    assert _is_convergence_branch("claude/fix-123")
+
+
+def test_is_convergence_branch_worktree_prefix() -> None:
+    assert _is_convergence_branch("worktree-pr-418")
+
+
+def test_is_convergence_branch_pr_converge() -> None:
+    assert _is_convergence_branch("pr-423-converge")
+
+
+def test_is_convergence_branch_main_rejected() -> None:
+    assert not _is_convergence_branch("main")
+
+
+def test_is_convergence_branch_pr_converge_no_end_anchor() -> None:
+    assert not _is_convergence_branch("pr-423-converge-extra")
+
+
+def test_all_refspecs_empty_string_returns_false() -> None:
+    assert not _all_refspecs_are_convergence_branches("")
+
+
+def test_all_refspecs_whitespace_only_returns_false() -> None:
+    assert not _all_refspecs_are_convergence_branches("   ")
+
+
+def test_all_refspecs_flag_only_returns_false() -> None:
+    assert not _all_refspecs_are_convergence_branches("--no-verify")
+
+
+def test_all_refspecs_multiple_flags_only_returns_false() -> None:
+    assert not _all_refspecs_are_convergence_branches("--no-verify --force")
+
+
+def test_all_refspecs_flag_then_branch_checks_branch() -> None:
+    assert not _all_refspecs_are_convergence_branches("--force main")
+
+
+def test_all_refspecs_convergence_branch_with_flags() -> None:
+    assert _all_refspecs_are_convergence_branches("--force claude/fix-123")
+
+
+def test_force_push_convergence_with_no_verify_blocked() -> None:
+    payload = _make_bash_payload(
+        "git push --force origin --no-verify claude/fix-123"
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+    assert "--no-verify" in response["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_force_push_convergence_with_no_gpg_sign_blocked() -> None:
+    payload = _make_bash_payload(
+        "git push --force origin --no-gpg-sign claude/fix-123"
+    )
+
+    result = _run_rm_hook(payload)
+
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
+    assert "--no-gpg-sign" in response["hookSpecificOutput"]["permissionDecisionReason"]

package/hooks/blocking/test_destructive_command_blocker_no_verify.py

@@ -0,0 +1,102 @@
+"""Tests for --no-verify / --no-gpg-sign blocking in destructive_command_blocker.
+
+git-workflow.md:30-33 marks these as NON-NEGOTIABLE to skip — they bypass
+hook signing and verification. The blocker must ASK before allowing them.
+"""
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+
+SCRIPT_PATH = Path(__file__).parent / "destructive_command_blocker.py"
+
+
+def _run_hook(payload: dict) -> subprocess.CompletedProcess[str]:
+    child_environment = os.environ.copy()
+    return subprocess.run(
+        [sys.executable, str(SCRIPT_PATH)],
+        input=json.dumps(payload),
+        text=True,
+        capture_output=True,
+        check=False,
+        env=child_environment,
+    )
+
+
+def _make_bash_payload(command: str) -> dict:
+    return {"tool_name": "Bash", "tool_input": {"command": command}}
+
+
+def test_asks_on_git_commit_no_verify() -> None:
+    payload = _make_bash_payload('git commit -m "wip" --no-verify')
+    result = _run_hook(payload)
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
+        f"Expected ask for git commit --no-verify, got: {response!r}"
+    )
+    assert "no-verify" in response["hookSpecificOutput"]["permissionDecisionReason"], (
+        f"Reason must mention --no-verify, got: {response!r}"
+    )
+
+
+def test_asks_on_git_push_no_verify() -> None:
+    payload = _make_bash_payload("git push --no-verify origin main")
+    result = _run_hook(payload)
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
+        f"Expected ask for git push --no-verify, got: {response!r}"
+    )
+
+
+def test_asks_on_git_no_gpg_sign() -> None:
+    payload = _make_bash_payload("git commit --no-gpg-sign -m wip")
+    result = _run_hook(payload)
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
+        f"Expected ask for git --no-gpg-sign, got: {response!r}"
+    )
+    assert (
+        "no-gpg-sign" in response["hookSpecificOutput"]["permissionDecisionReason"]
+    ), f"Reason must mention --no-gpg-sign, got: {response!r}"
+
+
+def test_asks_on_git_commit_with_no_gpg_sign_config() -> None:
+    payload = _make_bash_payload("git -c commit.gpgsign=false commit -m wip")
+    result = _run_hook(payload)
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
+        f"Expected ask for -c commit.gpgsign=false, got: {response!r}"
+    )
+
+
+def test_asks_on_quoted_gpgsign_config() -> None:
+    payload = _make_bash_payload("git -c 'commit.gpgsign=false' commit -m wip")
+    result = _run_hook(payload)
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
+        f"Expected ask for quoted -c commit.gpgsign=false, got: {response!r}"
+    )
+
+
+def test_asks_on_value_quoted_gpgsign_config() -> None:
+    payload = _make_bash_payload("git -c commit.gpgsign='false' commit -m wip")
+    result = _run_hook(payload)
+    response = json.loads(result.stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
+        f"Expected ask for value-quoted -c commit.gpgsign='false', got: {response!r}"
+    )
+
+
+def test_normal_git_commit_passes() -> None:
+    payload = _make_bash_payload('git commit -m "real commit"')
+    result = _run_hook(payload)
+    if not result.stdout.strip():
+        return
+    response = json.loads(result.stdout)
+    decision = response.get("hookSpecificOutput", {}).get("permissionDecision", "allow")
+    assert decision != "ask", (
+        f"Normal git commit must not be flagged as destructive, got: {response!r}"
+    )

package/hooks/blocking/test_gh_body_arg_blocker.py

@@ -17,6 +17,7 @@ assert hook_spec.loader is not None
 hook_module = importlib.util.module_from_spec(hook_spec)
 hook_spec.loader.exec_module(hook_module)
 _uses_body_string_arg = hook_module._uses_body_string_arg
+_has_backtick = hook_module._has_backtick
 
 from _gh_body_arg_utils import iter_significant_tokens
 
@@ -373,3 +374,47 @@ def test_all_body_flag_prefixes_used_for_equals_skip() -> None:
     for each_prefix in all_body_flag_prefixes:
         assert each_prefix in _all_equals_prefixes_for_skip
 
+
+def test_has_backtick_with_plain_text_body() -> None:
+    assert not _has_backtick('gh issue comment 42 --body "bugbot run"')
+
+
+def test_has_backtick_with_markdown_body() -> None:
+    assert _has_backtick('gh pr create --title "T" --body "Fixes `foo`"')
+
+
+def test_has_backtick_with_short_b_plain_text() -> None:
+    assert not _has_backtick('gh pr comment 10 -b "LGTM"')
+
+
+def test_has_backtick_with_equals_form_plain_text() -> None:
+    assert not _has_backtick('gh pr create --title "T" --body="bugbot run"')
+
+
+def test_has_backtick_with_empty_body() -> None:
+    assert not _has_backtick('gh pr create --title "T" --body=""')
+
+
+def test_has_backtick_bash_continuation_stripped() -> None:
+    """Bash backslash line continuations are stripped before checking."""
+    command = 'gh pr create \\\n  --title "T" \\\n  --body "bugbot run"\n'
+    assert not _has_backtick(command)
+
+
+def test_has_backtick_powershell_continuation_stripped() -> None:
+    """PowerShell backtick line continuations are stripped before checking."""
+    command = 'gh pr create `\n  --title "T" `\n  --body "bugbot run"\n'
+    assert not _has_backtick(command)
+
+
+def test_has_backtick_content_backtick_at_line_end() -> None:
+    """A backtick at end of line in body content must be detected (not mistaken for continuation)."""
+    command = 'gh pr create --title "T" --body "Thanks `\n@user"'
+    assert _has_backtick(command)
+
+
+def test_has_backtick_multi_line_body() -> None:
+    """Backtick on a non-first line of a multi-line body must be detected."""
+    command = 'gh pr create --title "T" --body "First line.\nSecond with `code`."'
+    assert _has_backtick(command)
+