claude-dev-env 1.50.0 → 1.50.2

package/hooks/blocking/test_code_rules_enforcer_split_isolation_2.py

@@ -0,0 +1,283 @@
+"""Behavior tests for the code_rules_test_isolation code-rules check module."""
+
+from __future__ import annotations
+
+import ast
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+
+_BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
+_HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
+if _BLOCKING_DIRECTORY not in sys.path:
+    sys.path.insert(0, _BLOCKING_DIRECTORY)
+if _HOOKS_DIRECTORY not in sys.path:
+    sys.path.insert(0, _HOOKS_DIRECTORY)
+
+from code_rules_test_isolation import (  # noqa: E402
+    _build_alias_canonicalization_map,
+    _collect_os_environ_local_binding_names,
+    _collect_pathlib_path_local_binding_names,
+    check_tests_use_isolated_filesystem_paths,
+)
+
+code_rules_enforcer = SimpleNamespace(
+    _build_alias_canonicalization_map=_build_alias_canonicalization_map,
+    _collect_os_environ_local_binding_names=_collect_os_environ_local_binding_names,
+    _collect_pathlib_path_local_binding_names=_collect_pathlib_path_local_binding_names,
+    check_tests_use_isolated_filesystem_paths=check_tests_use_isolated_filesystem_paths,
+)
+
+
+def _function_node_named(source: str, function_name: str) -> ast.FunctionDef:
+    syntax_tree = ast.parse(source)
+    for each_node in syntax_tree.body:
+        if isinstance(each_node, ast.FunctionDef) and each_node.name == function_name:
+            return each_node
+    raise AssertionError(f"no function named {function_name!r} in source")
+
+
+def test_isolation_check_ignores_path_constructor_expanduser_with_tilde_free_argument() -> None:
+    """`Path('/tmp/x').expanduser()` carries no leading tilde, so it expands no
+    home directory and must stay symmetric with `os.path.expanduser` of a
+    tilde-free literal — neither fires."""
+    source = (
+        "from pathlib import Path\n"
+        "def test_resolves_absolute() -> None:\n"
+        "    target = Path('/tmp/x').expanduser()\n"
+        "    target.read_text()\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert issues == []
+
+
+def test_isolation_check_ignores_static_pathlib_expanduser_with_dynamic_argument() -> None:
+    """`pathlib.Path.expanduser(some_path)` with a non-constant argument cannot
+    be inspected for a leading tilde, so it follows the conservative rule and
+    does not fire — symmetric with `os.path.expanduser(some_path)`."""
+    source = (
+        "import pathlib\n"
+        "def test_resolves_dynamic(some_path) -> None:\n"
+        "    target = pathlib.Path.expanduser(some_path)\n"
+        "    target.read_text()\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert issues == []
+
+
+def test_isolation_check_flags_path_home_via_function_local_class_alias() -> None:
+    """`path_class = Path` then `path_class.home()` reaches the real home
+    directory through a per-test class alias and must fire just like the bare
+    `Path.home()` form."""
+    source = (
+        "from pathlib import Path\n"
+        "def test_reads_home() -> None:\n"
+        "    path_class = Path\n"
+        "    home_dir = path_class.home()\n"
+        "    (home_dir / '.myapp').write_text('x')\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("home" in each_issue.lower() for each_issue in issues)
+
+
+def test_isolation_check_flags_getenv_via_function_local_callable_alias() -> None:
+    """`read_env = os.getenv` then `read_env('HOME')` reads HOME through a
+    per-test callable alias and must fire just like the bare `os.getenv('HOME')`
+    form."""
+    source = (
+        "import os\n"
+        "def test_reads_home() -> None:\n"
+        "    read_env = os.getenv\n"
+        "    home = read_env('HOME')\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("HOME" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_flags_tempfile_spooled_temporary_file() -> None:
+    """`tempfile.SpooledTemporaryFile()` allocates in the shared temp dir and
+    must fire as a temp-isolation probe alongside the other tempfile factories."""
+    source = (
+        "import tempfile\n"
+        "def test_writes_spooled_temp() -> None:\n"
+        "    handle = tempfile.SpooledTemporaryFile()\n"
+        "    handle.write(b'x')\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("SpooledTemporaryFile" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_flags_tempfile_gettempdirb() -> None:
+    """`tempfile.gettempdirb()` returns the shared temp dir as bytes and must
+    fire just like the string-returning `tempfile.gettempdir()`."""
+    source = (
+        "import tempfile\n"
+        "def test_resolves_temp_bytes() -> None:\n"
+        "    base = tempfile.gettempdirb()\n"
+        "    print(base)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("gettempdirb" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_flags_module_level_from_os_import_environ_subscript() -> None:
+    """A module-level `from os import environ` binds `environ` to `os.environ`,
+    so `environ['HOME']` inside a test must fire even without a per-test
+    local binding."""
+    source = (
+        "from os import environ\n"
+        "def test_resolves_home() -> None:\n"
+        "    home = environ['HOME']\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("HOME" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_reports_probes_in_source_order_on_new_file() -> None:
+    """On a new file (``all_changed_lines is None``) every probe is in scope and
+    reported in source order — none dropped by the cap, which now trims only
+    out-of-scope advisory noise."""
+    probe_count = 20
+    repeated_probes = "\n".join(
+        f"    p{each_index} = Path.home()" for each_index in range(probe_count)
+    )
+    source = (
+        f"from pathlib import Path\ndef test_many_probes() -> None:\n{repeated_probes}\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    first_probe_line_number = 3
+    reported_line_numbers = [
+        int(each_issue.split(":", maxsplit=1)[0].removeprefix("Line ").strip())
+        for each_issue in issues
+    ]
+    expected_line_numbers = [
+        first_probe_line_number + each_offset for each_offset in range(probe_count)
+    ]
+    assert reported_line_numbers == expected_line_numbers
+
+
+def test_collect_pathlib_path_bindings_only_sees_the_scope_node_function() -> None:
+    """The Path-binding collector must scope its walk to the function node it
+    is given. A `p = Path('~/x')` binding in test_a must not appear when the
+    collector is handed test_b's node (test_b never binds `p` to a Path)."""
+    source = (
+        "from pathlib import Path\n"
+        "def test_a() -> None:\n"
+        "    p = Path('~/x')\n"
+        "    p.expanduser()\n"
+        "def test_b(p) -> None:\n"
+        "    p.expanduser()\n"
+    )
+    syntax_tree = ast.parse(source)
+    alias_map = code_rules_enforcer._build_alias_canonicalization_map(syntax_tree)
+    test_a_node = _function_node_named(source, "test_a")
+    test_b_node = _function_node_named(source, "test_b")
+
+    test_a_bindings = code_rules_enforcer._collect_pathlib_path_local_binding_names(
+        test_a_node, alias_map
+    )
+    test_b_bindings = code_rules_enforcer._collect_pathlib_path_local_binding_names(
+        test_b_node, alias_map
+    )
+
+    assert "p" in test_a_bindings
+    assert "p" not in test_b_bindings
+
+
+def test_collect_os_environ_bindings_only_sees_the_scope_node_function() -> None:
+    """The environ-binding collector must scope its walk to the function node
+    it is given. An `e = os.environ` binding in test_a must not appear when the
+    collector is handed test_b's node (test_b never binds `e`)."""
+    source = (
+        "import os\n"
+        "def test_a() -> None:\n"
+        "    e = os.environ\n"
+        "    home = e['HOME']\n"
+        "    print(home)\n"
+        "def test_b(e) -> None:\n"
+        "    home = e['HOME']\n"
+        "    print(home)\n"
+    )
+    syntax_tree = ast.parse(source)
+    alias_map = code_rules_enforcer._build_alias_canonicalization_map(syntax_tree)
+    test_a_node = _function_node_named(source, "test_a")
+    test_b_node = _function_node_named(source, "test_b")
+
+    test_a_bindings = code_rules_enforcer._collect_os_environ_local_binding_names(
+        test_a_node, alias_map
+    )
+    test_b_bindings = code_rules_enforcer._collect_os_environ_local_binding_names(
+        test_b_node, alias_map
+    )
+
+    assert "e" in test_a_bindings
+    assert "e" not in test_b_bindings
+
+
+def test_function_local_from_os_import_environ_does_not_leak_into_sibling_test() -> None:
+    """bugbot-1: a function-local `from os import environ` in test_a binds
+    `environ` only for test_a's runtime. A sibling test_b that references the
+    bare name `environ` without importing it must not be flagged, while the
+    test that actually imports and probes HOME (test_a) must be flagged."""
+    source = (
+        "def test_a() -> None:\n"
+        "    from os import environ\n"
+        "    home = environ['HOME']\n"
+        "    print(home)\n"
+        "def test_b() -> None:\n"
+        "    home = environ['HOME']\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("test_a" in each_issue for each_issue in issues), (
+        f"test_a's own function-local environ import must be flagged, got: {issues!r}"
+    )
+    assert not any("test_b" in each_issue for each_issue in issues), (
+        "test_b references bare `environ` it never imports, so the function-local "
+        f"import in test_a must not leak into it, got: {issues!r}"
+    )
+
+
+def test_function_local_aliased_module_import_does_not_leak_into_sibling_test() -> None:
+    """bugbot-1 sibling: a function-local `import os as o` in test_a aliases
+    `o` only for test_a. test_b referencing `o.getenv('HOME')` without its own
+    import must not be flagged; test_a's own probe must be flagged."""
+    source = (
+        "def test_a() -> None:\n"
+        "    import os as o\n"
+        "    home = o.getenv('HOME')\n"
+        "    print(home)\n"
+        "def test_b() -> None:\n"
+        "    home = o.getenv('HOME')\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("test_a" in each_issue for each_issue in issues), (
+        f"test_a's own function-local aliased import must be flagged, got: {issues!r}"
+    )
+    assert not any("test_b" in each_issue for each_issue in issues), (
+        "test_b references alias `o` it never bound, so the function-local "
+        f"import in test_a must not leak into it, got: {issues!r}"
+    )

package/hooks/blocking/test_code_rules_enforcer_split_isolation_3.py

@@ -0,0 +1,268 @@
+"""Behavior tests for the code_rules_test_isolation code-rules check module."""
+
+from __future__ import annotations
+
+import ast
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+
+_BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
+_HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
+if _BLOCKING_DIRECTORY not in sys.path:
+    sys.path.insert(0, _BLOCKING_DIRECTORY)
+if _HOOKS_DIRECTORY not in sys.path:
+    sys.path.insert(0, _HOOKS_DIRECTORY)
+
+from code_rules_test_isolation import (  # noqa: E402
+    _build_alias_canonicalization_map,
+    check_tests_use_isolated_filesystem_paths,
+)
+
+code_rules_enforcer = SimpleNamespace(
+    _build_alias_canonicalization_map=_build_alias_canonicalization_map,
+    check_tests_use_isolated_filesystem_paths=check_tests_use_isolated_filesystem_paths,
+)
+
+
+def test_build_alias_map_excludes_function_local_imports() -> None:
+    """bugbot-1: the module-wide alias canonicalization map must be built only
+    from top-level imports. A function-local `import os as o` and a
+    function-local `from os import environ` must not appear in the shared map."""
+    source = (
+        "import tempfile as module_temp\n"
+        "def test_a() -> None:\n"
+        "    import os as o\n"
+        "    from os import environ\n"
+        "    print(o, environ)\n"
+    )
+    syntax_tree = ast.parse(source)
+    alias_map = code_rules_enforcer._build_alias_canonicalization_map(syntax_tree)
+    assert alias_map.get("module_temp") == "tempfile", (
+        f"top-level alias must be recorded, got: {alias_map!r}"
+    )
+    assert "o" not in alias_map, (
+        f"function-local `import os as o` must not leak into the module map, got: {alias_map!r}"
+    )
+    assert "environ" not in alias_map, (
+        f"function-local `from os import environ` must not leak into the module map, got: {alias_map!r}"
+    )
+
+
+def test_module_level_from_os_import_environ_still_flags_every_referencing_test() -> None:
+    """bugbot-1 guard: a genuine module-level `from os import environ` binds the
+    name for the whole module, so every test that probes HOME through it must
+    still be flagged. The per-function scoping must not suppress this case."""
+    source = (
+        "from os import environ\n"
+        "def test_a() -> None:\n"
+        "    print(environ['HOME'])\n"
+        "def test_b() -> None:\n"
+        "    print(environ['HOME'])\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("test_a" in each_issue for each_issue in issues)
+    assert any("test_b" in each_issue for each_issue in issues), (
+        f"module-level import must flag every probing test, got: {issues!r}"
+    )
+
+
+def test_build_alias_map_excludes_class_body_imports() -> None:
+    """A probe alias imported inside a class body binds only inside that class
+    scope, so it must not enter the module-wide alias canonicalization map. A
+    genuine module-level alias in the same source must still be recorded."""
+    source = (
+        "import tempfile as module_temp\n"
+        "class TestAlpha:\n"
+        "    import tempfile as t\n"
+        "    def test_alpha_probe(self) -> None:\n"
+        "        assert self.t is not None\n"
+    )
+    syntax_tree = ast.parse(source)
+    alias_map = code_rules_enforcer._build_alias_canonicalization_map(syntax_tree)
+    assert alias_map.get("module_temp") == "tempfile", (
+        f"top-level alias must be recorded, got: {alias_map!r}"
+    )
+    assert "t" not in alias_map, (
+        f"class-body `import tempfile as t` must not leak into the module map, got: {alias_map!r}"
+    )
+
+
+def test_class_body_aliased_import_does_not_leak_into_sibling_test() -> None:
+    """A class-body `import tempfile as t` aliases `t` only inside that class.
+    A sibling top-level test taking `t` as a parameter and calling `t.mkdtemp()`
+    must not be flagged, since the class-scoped alias never enters the
+    module-wide map."""
+    source = (
+        "class TestAlpha:\n"
+        "    import tempfile as t\n"
+        "    def test_alpha_probe(self) -> None:\n"
+        "        assert self.t is not None\n"
+        "def test_sibling(t) -> None:\n"
+        "    t.mkdtemp()\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert not any("test_sibling" in each_issue for each_issue in issues), (
+        "class-body alias must not leak into a sibling test through the "
+        f"module-wide map, got: {issues!r}"
+    )
+
+
+def test_build_alias_map_records_module_top_level_but_excludes_function_and_class_imports() -> None:
+    """Only true module-top-level imports enter the alias map. Imports lexically
+    inside a function body or a class body are excluded, while a module-level
+    try-guarded optional import is still recorded module-wide."""
+    source = (
+        "try:\n"
+        "    import tempfile as guarded_temp\n"
+        "except ImportError:\n"
+        "    guarded_temp = None\n"
+        "def test_function_local() -> None:\n"
+        "    import tempfile as function_temp\n"
+        "    assert function_temp is not None\n"
+        "class TestBeta:\n"
+        "    import tempfile as class_temp\n"
+        "    def test_beta_probe(self) -> None:\n"
+        "        assert self.class_temp is not None\n"
+    )
+    syntax_tree = ast.parse(source)
+    alias_map = code_rules_enforcer._build_alias_canonicalization_map(syntax_tree)
+    assert alias_map.get("guarded_temp") == "tempfile", (
+        f"module-level try-guarded alias must be recorded, got: {alias_map!r}"
+    )
+    assert "function_temp" not in alias_map, (
+        f"function-local alias must not enter the module map, got: {alias_map!r}"
+    )
+    assert "class_temp" not in alias_map, (
+        f"class-body alias must not enter the module map, got: {alias_map!r}"
+    )
+
+
+def test_isolation_message_carries_enclosing_function_definition_span() -> None:
+    """The isolation message must carry the enclosing test's definition line
+    and line span so the commit gate can scope by the same function span the
+    enforcer uses, while keeping the ``Line N:`` probe-line prefix intact."""
+    header = "from pathlib import Path\n"
+    test_body = (
+        "def test_reads_home() -> None:\n"
+        "    target_path = Path.home()\n"
+        "    assert target_path\n"
+    )
+    source = header + test_body
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    definition_line = 2
+    function_span = 3
+    expected_span_fragment = (
+        f"(defined at line {definition_line}, spanning {function_span} lines)"
+    )
+    assert any(
+        each_issue.startswith("Line ") and expected_span_fragment in each_issue
+        for each_issue in issues
+    ), f"isolation message must carry the def-line + span fragment, got: {issues!r}"
+
+
+def test_module_import_inside_top_level_try_is_retained_in_alias_map() -> None:
+    """loop7-P2 (2566): a module-level ``try: import os as o`` is genuinely
+    module-scoped; its alias must enter the shared canonicalization map so a
+    later ``o.path.expanduser('~')`` inside a test is flagged."""
+    source = (
+        "try:\n"
+        "    import os as o\n"
+        "except ImportError:\n"
+        "    o = None\n"
+        "def test_reads_home() -> None:\n"
+        "    discovered = o.path.expanduser('~')\n"
+        "    assert discovered\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_optional_import.py"
+    )
+    assert any(
+        "test_reads_home" in each_issue for each_issue in issues
+    ), f"module import nested in top-level try must be retained, got: {issues!r}"
+
+
+def test_direct_module_aliased_import_is_retained_in_alias_map() -> None:
+    """loop7-P2 (2566): a plain top-level ``import os as o`` must still resolve so
+    ``o.path.expanduser('~')`` inside a test is flagged."""
+    source = (
+        "import os as o\n"
+        "def test_reads_home() -> None:\n"
+        "    discovered = o.path.expanduser('~')\n"
+        "    assert discovered\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_direct_import.py"
+    )
+    assert any(
+        "test_reads_home" in each_issue for each_issue in issues
+    ), f"direct module aliased import must resolve, got: {issues!r}"
+
+
+def test_function_local_import_does_not_enter_shared_alias_map() -> None:
+    """loop7-P2 (2566): an import inside one test must not canonicalize a
+    same-named reference in a sibling test that never imported it."""
+    source = (
+        "def test_imports_locally() -> None:\n"
+        "    import os as o\n"
+        "    assert o\n"
+        "def test_sibling_uses_o() -> None:\n"
+        "    o = make_unrelated_object()\n"
+        "    discovered = o.path.expanduser('~')\n"
+        "    assert discovered\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_local_import_scope.py"
+    )
+    assert not any(
+        "test_sibling_uses_o" in each_issue for each_issue in issues
+    ), f"function-local import must not leak to a sibling test, got: {issues!r}"
+
+
+def test_import_inside_nested_helper_does_not_leak_to_outer_test_overlay() -> None:
+    """loop7-P2 (2690): an import inside a standalone nested helper runs in its own
+    callable scope; its alias must not enter the outer test's overlay and flag a
+    sibling reference in the outer body."""
+    source = (
+        "def test_outer() -> None:\n"
+        "    def nested_helper() -> None:\n"
+        "        import os as o\n"
+        "        assert o\n"
+        "    o = make_unrelated_object()\n"
+        "    discovered = o.path.expanduser('~')\n"
+        "    assert discovered\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_nested_helper_scope.py"
+    )
+    assert not any(
+        "test_outer" in each_issue for each_issue in issues
+    ), f"nested-helper import must not leak to the outer test, got: {issues!r}"
+
+
+def test_environ_binding_inside_nested_helper_does_not_leak_to_outer_test() -> None:
+    """loop7-P2 (2690 sibling): an ``os.environ`` binding inside a standalone
+    nested helper runs in its own scope; a same-named outer reference must not be
+    attributed to that binding."""
+    source = (
+        "import os\n"
+        "def test_outer() -> None:\n"
+        "    def nested_helper() -> None:\n"
+        "        captured = os.environ\n"
+        "        assert captured\n"
+        "    captured = make_unrelated_mapping()\n"
+        "    discovered = captured['HOME']\n"
+        "    assert discovered\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_environ_nested_scope.py"
+    )
+    assert not any(
+        "test_outer" in each_issue for each_issue in issues
+    ), f"nested-helper environ binding must not leak to the outer test, got: {issues!r}"

package/hooks/blocking/test_code_rules_enforcer_split_isolation_4.py

@@ -0,0 +1,85 @@
+"""Behavior tests for the code_rules_test_isolation code-rules check module."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+
+_BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
+_HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
+if _BLOCKING_DIRECTORY not in sys.path:
+    sys.path.insert(0, _BLOCKING_DIRECTORY)
+if _HOOKS_DIRECTORY not in sys.path:
+    sys.path.insert(0, _HOOKS_DIRECTORY)
+
+from code_rules_test_isolation import (  # noqa: E402
+    check_tests_use_isolated_filesystem_paths,
+)
+
+code_rules_enforcer = SimpleNamespace(
+    check_tests_use_isolated_filesystem_paths=check_tests_use_isolated_filesystem_paths,
+)
+
+
+def test_pathlib_binding_inside_nested_helper_does_not_leak_to_outer_test() -> None:
+    """loop7-P2 (2690 sibling): a home-tilde ``Path('~')`` binding inside a
+    standalone nested helper runs in its own scope; a same-named outer
+    ``.expanduser()`` call must not be attributed to that binding."""
+    source = (
+        "from pathlib import Path\n"
+        "def test_outer() -> None:\n"
+        "    def nested_helper() -> None:\n"
+        "        candidate = Path('~/config')\n"
+        "        assert candidate\n"
+        "    candidate = make_unrelated_path()\n"
+        "    discovered = candidate.expanduser()\n"
+        "    assert discovered\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_pathlib_nested_scope.py"
+    )
+    assert not any(
+        "test_outer" in each_issue for each_issue in issues
+    ), f"nested-helper pathlib binding must not leak to the outer test, got: {issues!r}"
+
+
+def test_isolation_check_exempts_usefixtures_monkeypatch_decorator() -> None:
+    """A test isolated via ``@pytest.mark.usefixtures("monkeypatch")`` injects the
+    monkeypatch fixture without a signature parameter and must be exempt from the
+    HOME/TMP probe, mirroring the signature-parameter suppression."""
+    source = (
+        "import os\n"
+        "import pytest\n"
+        "@pytest.mark.usefixtures('monkeypatch')\n"
+        "def test_reads_home() -> None:\n"
+        "    home = os.environ['HOME']\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert issues == [], (
+        "a test decorated with usefixtures('monkeypatch') is isolated and must "
+        f"not be flagged; got: {issues!r}"
+    )
+
+
+def test_isolation_check_still_flags_usefixtures_without_monkeypatch() -> None:
+    """``@pytest.mark.usefixtures("tmp_path")`` does not inject monkeypatch, so a
+    HOME probe in its body must still be flagged."""
+    source = (
+        "import os\n"
+        "import pytest\n"
+        "@pytest.mark.usefixtures('tmp_path')\n"
+        "def test_reads_home() -> None:\n"
+        "    home = os.environ['HOME']\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("HOME" in each_issue for each_issue in issues), (
+        "usefixtures('tmp_path') does not intercept env reads, so the HOME probe "
+        f"must still be flagged; got: {issues!r}"
+    )