claude-dev-env 1.50.0 → 1.50.2

package/hooks/blocking/code_rules_probe_chains.py

@@ -0,0 +1,305 @@
+"""Attribute-chain and os.environ alias-resolution primitives for the test-isolation check."""
+
+import ast
+import sys
+from collections.abc import Iterator
+from pathlib import Path
+
+_blocking_directory = str(Path(__file__).resolve().parent)
+_hooks_directory = str(Path(__file__).resolve().parent.parent)
+if _blocking_directory not in sys.path:
+    sys.path.insert(0, _blocking_directory)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
+    ALL_CANONICAL_DOTTED_NAMES_BY_BARE_IMPORT,
+    ALL_ENVIRONMENT_GETTER_DOTTED_NAMES,
+    ALL_PROBE_ALIASABLE_CANONICAL_PREFIXES,
+    ALL_PROBE_RELEVANT_MODULE_CANONICAL_NAMES,
+    ENVIRON_GET_METHOD_NAME,
+    OS_ENVIRON_DOTTED_NAME,
+)
+
+
+def _dotted_call_attribute_chain(call_node: ast.Call) -> str | None:
+    """Return the dotted name path of *call_node*'s callee, or None.
+
+    For ``pathlib.Path.home()`` returns ``"pathlib.Path.home"``; for
+    ``Path.home()`` returns ``"Path.home"``; for ``tempfile.gettempdir()``
+    returns ``"tempfile.gettempdir"``. Returns ``None`` when the call target
+    is not a pure attribute chain rooted at an ``ast.Name`` (for example,
+    ``obj.method()`` where ``obj`` is the result of another expression).
+    """
+    chain_parts: list[str] = []
+    walker: ast.expr = call_node.func
+    while isinstance(walker, ast.Attribute):
+        chain_parts.append(walker.attr)
+        walker = walker.value
+    if not isinstance(walker, ast.Name):
+        return None
+    chain_parts.append(walker.id)
+    chain_parts.reverse()
+    return ".".join(chain_parts)
+
+
+def _record_probe_import_aliases(
+    import_node: ast.Import | ast.ImportFrom,
+    all_canonical_names_by_alias: dict[str, str],
+) -> None:
+    """Record the probe-relevant alias entries from a single import statement.
+
+    Module aliases are recorded only for the probe-relevant modules in
+    ``ALL_PROBE_RELEVANT_MODULE_CANONICAL_NAMES``. Bare-imported names are
+    recorded only for the ``(module, name)`` pairs in
+    ``ALL_CANONICAL_DOTTED_NAMES_BY_BARE_IMPORT``. Imports outside those sets are
+    ignored so unrelated bindings never rewrite a chain.
+
+    Args:
+        import_node: A single ``ast.Import`` or ``ast.ImportFrom`` statement.
+        all_canonical_names_by_alias: The alias map to mutate in place with any
+            probe-relevant local-name to canonical-dotted-prefix entries.
+    """
+    if isinstance(import_node, ast.Import):
+        for each_alias in import_node.names:
+            if each_alias.name not in ALL_PROBE_RELEVANT_MODULE_CANONICAL_NAMES:
+                continue
+            local_name = each_alias.asname or each_alias.name
+            all_canonical_names_by_alias[local_name] = each_alias.name
+        return
+    for each_alias in import_node.names:
+        canonical_dotted = ALL_CANONICAL_DOTTED_NAMES_BY_BARE_IMPORT.get(
+            (import_node.module or "", each_alias.name)
+        )
+        if canonical_dotted is None:
+            continue
+        local_name = each_alias.asname or each_alias.name
+        all_canonical_names_by_alias[local_name] = canonical_dotted
+
+
+def _node_is_lexically_inside_function_or_class(
+    node: ast.AST, parent_by_child_id: dict[int, ast.AST],
+) -> bool:
+    """Return True when *node* is nested inside a function or class body.
+
+    Walks ancestors via *parent_by_child_id*. A node nested only inside
+    module-level ``try``/``if``/``with`` blocks has no enclosing function or
+    class and is module-scoped; a node inside a
+    ``FunctionDef``/``AsyncFunctionDef``/``ClassDef`` body is scoped to that
+    enclosing definition and is not module-scoped. A class-body import binds
+    its alias only within the class namespace, so it must not enter the
+    module-wide alias map any more than a function-local import does.
+
+    Args:
+        node: The node whose lexical scope is being classified.
+        parent_by_child_id: Child-``id()``-to-parent map from
+            ``_build_parent_map``.
+
+    Returns:
+        True when an enclosing
+        ``FunctionDef``/``AsyncFunctionDef``/``ClassDef`` exists.
+    """
+    current_ancestor = parent_by_child_id.get(id(node))
+    while current_ancestor is not None:
+        if isinstance(
+            current_ancestor,
+            (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef),
+        ):
+            return True
+        current_ancestor = parent_by_child_id.get(id(current_ancestor))
+    return False
+
+
+def _canonical_probe_prefix_for_value(
+    node: ast.expr, all_canonical_names_by_alias: dict[str, str],
+) -> str | None:
+    if isinstance(node, ast.Name):
+        candidate_prefix = all_canonical_names_by_alias.get(node.id, node.id)
+    elif isinstance(node, ast.Attribute):
+        attribute_chain = _dotted_attribute_chain(node)
+        if attribute_chain is None:
+            return None
+        candidate_prefix = _resolve_chain_through_aliases(
+            attribute_chain, all_canonical_names_by_alias
+        )
+    else:
+        return None
+    if candidate_prefix in ALL_PROBE_ALIASABLE_CANONICAL_PREFIXES:
+        return candidate_prefix
+    return None
+
+
+def _attribute_chain_resolves_to_os_environ(
+    node: ast.expr, all_canonical_names_by_alias: dict[str, str],
+) -> bool:
+    if not isinstance(node, ast.Attribute):
+        return False
+    chain = _dotted_attribute_chain(node)
+    if chain is None:
+        return False
+    canonical_chain = _resolve_chain_through_aliases(
+        chain, all_canonical_names_by_alias
+    )
+    return canonical_chain == OS_ENVIRON_DOTTED_NAME
+
+
+def _dotted_attribute_chain(attribute_node: ast.Attribute) -> str | None:
+    chain_parts: list[str] = []
+    walker: ast.expr = attribute_node
+    while isinstance(walker, ast.Attribute):
+        chain_parts.append(walker.attr)
+        walker = walker.value
+    if not isinstance(walker, ast.Name):
+        return None
+    chain_parts.append(walker.id)
+    chain_parts.reverse()
+    return ".".join(chain_parts)
+
+
+def _resolve_chain_through_aliases(
+    chain: str, all_canonical_names_by_alias: dict[str, str],
+) -> str:
+    """Rewrite the leading segment of *chain* through the alias map.
+
+    Args:
+        chain: A dotted callee chain such as ``"P.home"``,
+            ``"op.expanduser"``, or ``"o.path.expanduser"``.
+        all_canonical_names_by_alias: Local-binding-to-canonical-prefix
+            mapping from ``_build_alias_canonicalization_map``.
+
+    Returns:
+        The chain with its leading segment replaced by the canonical
+        (possibly multi-segment) prefix when a binding matches; otherwise
+        the chain unchanged.
+    """
+    first_segment, separator, remainder = chain.partition(".")
+    canonical_prefix = all_canonical_names_by_alias.get(first_segment)
+    if canonical_prefix is None:
+        return chain
+    if not separator:
+        return canonical_prefix
+    return f"{canonical_prefix}{separator}{remainder}"
+
+
+def _environ_key_string_from_call(
+    call_node: ast.Call,
+    all_canonical_names_by_alias: dict[str, str],
+    all_environ_local_bindings: set[str],
+) -> str | None:
+    if not _call_is_environment_getter(call_node, all_canonical_names_by_alias, all_environ_local_bindings):
+        return None
+    if not call_node.args:
+        return None
+    first_argument = call_node.args[0]
+    if isinstance(first_argument, ast.Constant) and isinstance(first_argument.value, str):
+        return first_argument.value
+    return None
+
+
+def _call_is_environment_getter(
+    call_node: ast.Call,
+    all_canonical_names_by_alias: dict[str, str],
+    all_environ_local_bindings: set[str],
+) -> bool:
+    """Return True when *call_node* reads an env var via a recognized getter.
+
+    Recognizes the canonical ``os.getenv(...)`` / ``os.environ.get(...)``
+    chains and the local-alias ``e.get(...)`` form where ``e`` is a name in
+    *all_environ_local_bindings* (a binding to ``os.environ`` collected from
+    the same test function).
+
+    Args:
+        call_node: The call to inspect.
+        all_canonical_names_by_alias: Import-alias map from
+            ``_build_alias_canonicalization_map``.
+        all_environ_local_bindings: Local names bound to ``os.environ`` within
+            the test function being analyzed.
+
+    Returns:
+        True when the call is an environment getter whose key argument is
+        worth inspecting.
+    """
+    if _call_targets_local_environ_get(call_node, all_environ_local_bindings):
+        return True
+    raw_chain = _dotted_call_attribute_chain(call_node)
+    if raw_chain is None:
+        return False
+    canonical_chain = _resolve_chain_through_aliases(raw_chain, all_canonical_names_by_alias)
+    return canonical_chain in ALL_ENVIRONMENT_GETTER_DOTTED_NAMES
+
+
+def _call_targets_local_environ_get(
+    call_node: ast.Call, all_environ_local_bindings: set[str],
+) -> bool:
+    callee = call_node.func
+    if not isinstance(callee, ast.Attribute):
+        return False
+    if callee.attr != ENVIRON_GET_METHOD_NAME:
+        return False
+    receiver = callee.value
+    return isinstance(receiver, ast.Name) and receiver.id in all_environ_local_bindings
+
+
+def _environ_key_string_from_subscript(
+    subscript_node: ast.Subscript,
+    all_canonical_names_by_alias: dict[str, str],
+    all_environ_local_bindings: set[str],
+) -> str | None:
+    if not _subscript_target_is_os_environ(
+        subscript_node.value, all_canonical_names_by_alias, all_environ_local_bindings
+    ):
+        return None
+    key_node = subscript_node.slice
+    if isinstance(key_node, ast.Constant) and isinstance(key_node.value, str):
+        return key_node.value
+    return None
+
+
+def _subscript_target_is_os_environ(
+    target_node: ast.expr,
+    all_canonical_names_by_alias: dict[str, str],
+    all_environ_local_bindings: set[str],
+) -> bool:
+    if isinstance(target_node, ast.Name):
+        if target_node.id in all_environ_local_bindings:
+            return True
+        return all_canonical_names_by_alias.get(target_node.id) == OS_ENVIRON_DOTTED_NAME
+    if isinstance(target_node, ast.Attribute):
+        return _attribute_chain_resolves_to_os_environ(target_node, all_canonical_names_by_alias)
+    return False
+
+
+def _children_to_descend_into(node: ast.AST) -> list[ast.AST]:
+    if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda)):
+        return []
+    if isinstance(node, ast.ClassDef):
+        return list(node.body)
+    return list(ast.iter_child_nodes(node))
+
+
+def _descend_within_test_scope(
+    function_node: ast.FunctionDef | ast.AsyncFunctionDef,
+) -> Iterator[ast.AST]:
+    """Yield every descendant of *function_node* on the test's own runtime path.
+
+    Bounded traversal that shares ``_children_to_descend_into`` so every caller
+    treats the same nodes as in scope. Nested function definitions, methods, and
+    lambdas are scope boundaries — Python does not run a callable's body just
+    because the callable (or its enclosing class) is defined, so a binding or
+    probe inside one does not leak onto the test's runtime path. Nested
+    ``ClassDef`` bodies stay in scope because their class-creation statements
+    (class attribute initializers) run as the ``class`` statement executes
+    during the test; descent stops at the methods declared in that class body.
+
+    Args:
+        function_node: The test function whose in-scope descendants to yield.
+
+    Yields:
+        Each descendant node within the test's bounded scope, in stack-pop
+        order.
+    """
+    nodes_to_visit: list[ast.AST] = list(ast.iter_child_nodes(function_node))
+    while nodes_to_visit:
+        each_descendant = nodes_to_visit.pop()
+        yield each_descendant
+        nodes_to_visit.extend(_children_to_descend_into(each_descendant))

package/hooks/blocking/code_rules_probe_detection.py

@@ -0,0 +1,257 @@
+"""Home-directory and shared-temp value-reference detection for the test-isolation check."""
+
+import ast
+import sys
+from pathlib import Path
+
+_blocking_directory = str(Path(__file__).resolve().parent)
+_hooks_directory = str(Path(__file__).resolve().parent.parent)
+if _blocking_directory not in sys.path:
+    sys.path.insert(0, _blocking_directory)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+from code_rules_probe_chains import (  # noqa: E402
+    _dotted_call_attribute_chain,
+    _environ_key_string_from_call,
+    _environ_key_string_from_subscript,
+    _resolve_chain_through_aliases,
+)
+
+from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
+    ALL_HOME_DIRECTORY_ENV_VAR_NAMES,
+    ALL_PATHLIB_PATH_CONSTRUCTOR_CANONICAL_NAMES,
+    ALL_SHARED_TEMP_SOURCE_PROBE_DOTTED_NAMES,
+    ENVIRONMENT_VARIABLE_REFERENCE_PATTERN,
+    HOME_DIRECTORY_TILDE_PREFIX,
+    PATHLIB_EXPANDUSER_METHOD_NAME,
+    TEMPFILE_FACTORY_ISOLATION_DIRECTORY_KEYWORD,
+    WINDOWS_PERCENT_VARIABLE_REFERENCE_PATTERN,
+)
+
+
+def _pathlib_path_construction_uses_home_tilde(
+    node: ast.expr, all_canonical_names_by_alias: dict[str, str],
+) -> bool:
+    """Return True for a ``pathlib.Path('~...')`` construction with a home tilde.
+
+    The node is a Path construction when its callee chain resolves (directly,
+    aliased, or fully qualified) to a member of
+    ``ALL_PATHLIB_PATH_CONSTRUCTOR_CANONICAL_NAMES``. It uses the home tilde
+    when its first argument is a literal string beginning with ``~``. A
+    tilde-free or dynamic first argument expands no home directory and returns
+    False, mirroring ``_expanduser_argument_references_home``.
+
+    Args:
+        node: The candidate ``Path(...)`` construction expression.
+        all_canonical_names_by_alias: Import-alias map from
+            ``_build_alias_canonicalization_map``.
+
+    Returns:
+        True when *node* constructs a ``pathlib.Path`` from a leading-tilde
+        literal string.
+    """
+    if not isinstance(node, ast.Call):
+        return False
+    constructor_chain = _dotted_call_attribute_chain(node)
+    if constructor_chain is None:
+        return False
+    canonical_chain = _resolve_chain_through_aliases(
+        constructor_chain, all_canonical_names_by_alias
+    )
+    if canonical_chain not in ALL_PATHLIB_PATH_CONSTRUCTOR_CANONICAL_NAMES:
+        return False
+    return _expanduser_argument_references_home(node)
+
+
+def _expanduser_method_call_targets_pathlib_path(
+    call_node: ast.Call,
+    all_canonical_names_by_alias: dict[str, str],
+    all_path_local_bindings: set[str],
+) -> bool:
+    """Return True for a ``.expanduser()`` call on a home-tilde ``pathlib.Path``.
+
+    ``Path.expanduser`` expands the ``~`` bound into the receiver Path, so the
+    call resolves the home directory only when that receiver carries a leading
+    tilde. The receiver carries a tilde when it is a ``pathlib.Path('~...')``
+    construction (directly, aliased, or fully qualified) or a local variable
+    previously bound to such a construction. A tilde-free or dynamic receiver
+    (``Path('/tmp/x').expanduser()`` / ``Path(some_path).expanduser()``)
+    expands no home directory and is not flagged, keeping the form symmetric
+    with ``os.path.expanduser`` argument inspection.
+
+    Args:
+        call_node: The call whose callee attribute is ``expanduser``.
+        all_canonical_names_by_alias: Import-alias map from
+            ``_build_alias_canonicalization_map``.
+        all_path_local_bindings: Local names bound to a home-tilde
+            ``pathlib.Path`` construction from
+            ``_collect_pathlib_path_local_binding_names``.
+
+    Returns:
+        True when the ``expanduser`` receiver resolves to a home-tilde
+        ``pathlib.Path``.
+    """
+    callee = call_node.func
+    if not isinstance(callee, ast.Attribute):
+        return False
+    if callee.attr != PATHLIB_EXPANDUSER_METHOD_NAME:
+        return False
+    receiver = callee.value
+    if isinstance(receiver, ast.Name):
+        return receiver.id in all_path_local_bindings
+    return _pathlib_path_construction_uses_home_tilde(receiver, all_canonical_names_by_alias)
+
+
+def _expandvars_argument_references_home_or_temp(call_node: ast.Call) -> bool:
+    """Return True when an ``expandvars`` call expands a home/temp env var.
+
+    Inspects the first string argument for dollar-style ``$NAME`` / ``${NAME}``
+    references and Windows percent-style ``%NAME%`` references, then reports
+    whether any referenced name is a home/temp env var. ``os.path.expandvars``
+    expands percent syntax on Windows, so both forms reach the same home/temp
+    env-var name set. A non-constant or absent argument is treated as not
+    referencing a home/temp variable, mirroring the conservative env-name
+    filtering applied to ``os.getenv``.
+
+    Args:
+        call_node: The ``os.path.expandvars(...)`` call node.
+
+    Returns:
+        True when at least one expanded variable name is in
+        ``ALL_HOME_DIRECTORY_ENV_VAR_NAMES``.
+    """
+    if not call_node.args:
+        return False
+    first_argument = call_node.args[0]
+    if not (
+        isinstance(first_argument, ast.Constant)
+        and isinstance(first_argument.value, str)
+    ):
+        return False
+    dollar_style_names = ENVIRONMENT_VARIABLE_REFERENCE_PATTERN.findall(
+        first_argument.value
+    )
+    percent_style_names = WINDOWS_PERCENT_VARIABLE_REFERENCE_PATTERN.findall(
+        first_argument.value
+    )
+    all_referenced_names = dollar_style_names + percent_style_names
+    return any(
+        each_name in ALL_HOME_DIRECTORY_ENV_VAR_NAMES
+        for each_name in all_referenced_names
+    )
+
+
+def _expanduser_argument_references_home(call_node: ast.Call) -> bool:
+    """Return True when an ``expanduser`` call expands the home directory.
+
+    ``os.path.expanduser`` only substitutes a leading ``~`` (``~`` alone or
+    ``~user``); a string without a leading tilde is returned unchanged and
+    never touches HOME. A non-constant or absent argument is treated as not
+    referencing home, mirroring the conservative argument inspection applied
+    to ``expandvars``.
+
+    Args:
+        call_node: The ``os.path.expanduser(...)`` call node.
+
+    Returns:
+        True when the first string argument begins with the home-directory
+        tilde prefix.
+    """
+    if not call_node.args:
+        return False
+    first_argument = call_node.args[0]
+    if not (
+        isinstance(first_argument, ast.Constant)
+        and isinstance(first_argument.value, str)
+    ):
+        return False
+    return first_argument.value.startswith(HOME_DIRECTORY_TILDE_PREFIX)
+
+
+def _tempfile_factory_call_is_isolated_by_dir(
+    call_node: ast.Call,
+    all_canonical_names_by_alias: dict[str, str],
+    all_environ_local_bindings: set[str],
+) -> bool:
+    """Return True when a tempfile factory's ``dir=`` sandboxes the allocation.
+
+    A ``dir=`` keyword sandboxes the allocation only when its value is a
+    plausibly isolated path (typically the pytest ``tmp_path`` fixture). A
+    ``dir=`` value that resolves to the shared temp directory does not isolate
+    the call and is treated as absent:
+
+    - a constant ``None`` selects the default shared temp directory; and
+    - a shared-temp source — ``os.getenv('TMPDIR'|'TEMP'|'TMP')`` /
+      ``os.environ['TMPDIR'|...]`` / ``os.environ.get('TMPDIR'|...)``, or
+      ``tempfile.gettempdir()`` / ``tempfile.gettempprefix()`` — returns the
+      shared temp directory.
+
+    Only an explicit ``dir=`` keyword counts; a ``**kwargs`` ``dir`` cannot be
+    resolved statically and is treated as absent, mirroring the conservative
+    argument inspection applied to ``expandvars`` and ``expanduser``.
+
+    Args:
+        call_node: The tempfile factory call node.
+        all_canonical_names_by_alias: Import-alias map used to resolve aliased
+            shared-temp sources passed as the ``dir=`` value.
+        all_environ_local_bindings: Local names bound to ``os.environ`` within
+            the test function, used to recognize aliased ``os.environ`` reads.
+
+    Returns:
+        True when an explicit ``dir=`` keyword is present and its value is not
+        a recognized shared-temp source.
+    """
+    for each_keyword in call_node.keywords:
+        if each_keyword.arg != TEMPFILE_FACTORY_ISOLATION_DIRECTORY_KEYWORD:
+            continue
+        return not _dir_value_resolves_to_shared_temp(
+            each_keyword.value,
+            all_canonical_names_by_alias,
+            all_environ_local_bindings,
+        )
+    return False
+
+
+def _dir_value_resolves_to_shared_temp(
+    dir_value: ast.expr,
+    all_canonical_names_by_alias: dict[str, str],
+    all_environ_local_bindings: set[str],
+) -> bool:
+    """Return True when a tempfile ``dir=`` value points at the shared temp dir.
+
+    Args:
+        dir_value: The expression supplied as the factory's ``dir=`` value.
+        all_canonical_names_by_alias: Import-alias map used to resolve aliased
+            ``os.getenv`` / ``os.environ`` / ``tempfile`` references.
+        all_environ_local_bindings: Local names bound to ``os.environ`` within
+            the test function.
+
+    Returns:
+        True when the value is a constant ``None``, a call or subscript that
+        reads a home or temp environment variable named in
+        ``ALL_HOME_DIRECTORY_ENV_VAR_NAMES``, or a call whose dotted chain is
+        a recognized shared-temp source in
+        ``ALL_SHARED_TEMP_SOURCE_PROBE_DOTTED_NAMES``.
+    """
+    if isinstance(dir_value, ast.Constant) and dir_value.value is None:
+        return True
+    if isinstance(dir_value, ast.Call):
+        environ_key = _environ_key_string_from_call(
+            dir_value, all_canonical_names_by_alias, all_environ_local_bindings
+        )
+        if environ_key in ALL_HOME_DIRECTORY_ENV_VAR_NAMES:
+            return True
+        raw_chain = _dotted_call_attribute_chain(dir_value)
+        if raw_chain is None:
+            return False
+        canonical_chain = _resolve_chain_through_aliases(
+            raw_chain, all_canonical_names_by_alias
+        )
+        return canonical_chain in ALL_SHARED_TEMP_SOURCE_PROBE_DOTTED_NAMES
+    if isinstance(dir_value, ast.Subscript):
+        environ_key = _environ_key_string_from_subscript(
+            dir_value, all_canonical_names_by_alias, all_environ_local_bindings
+        )
+        return environ_key in ALL_HOME_DIRECTORY_ENV_VAR_NAMES
+    return False