claude-dev-env 1.51.0 → 1.52.0

package/hooks/blocking/test_tdd_enforcer.py

@@ -690,3 +690,402 @@ def test_should_deny_code_rules_edit_when_split_family_sibling_is_stale(
     completed = _run_hook_with_payload(payload)
 
     assert _decision_from(completed) == "deny"
+
+
+def test_should_offer_nested_package_mirroring_candidate_for_subpackage_module(
+    tmp_path: Path,
+) -> None:
+    sandbox = _sandbox(tmp_path)
+    package_root = sandbox / "pkg"
+    subpackage_directory = package_root / "services" / "mouse_movement"
+    subpackage_directory.mkdir(parents=True)
+    (package_root / "tests").mkdir()
+    production_module = subpackage_directory / "tremor.py"
+
+    all_candidates = _PRODUCTION_MODULE.candidate_test_paths_for(production_module)
+
+    assert package_root / "tests" / "services" / "test_tremor.py" in all_candidates
+    assert (
+        package_root / "tests" / "services" / "mouse_movement" / "test_tremor.py"
+        in all_candidates
+    )
+
+
+def test_should_offer_flat_candidate_alongside_nested_candidates(
+    tmp_path: Path,
+) -> None:
+    sandbox = _sandbox(tmp_path)
+    package_root = sandbox / "pkg"
+    subpackage_directory = package_root / "services" / "mouse_movement"
+    subpackage_directory.mkdir(parents=True)
+    (package_root / "tests").mkdir()
+    production_module = subpackage_directory / "tremor.py"
+
+    all_candidates = _PRODUCTION_MODULE.candidate_test_paths_for(production_module)
+
+    assert package_root / "tests" / "test_tremor.py" in all_candidates
+    assert (
+        package_root / "tests" / "services" / "mouse_movement" / "test_tremor.py"
+        in all_candidates
+    )
+
+
+def test_should_allow_write_when_nested_package_mirroring_test_is_fresh(
+    tmp_path: Path,
+) -> None:
+    sandbox = _sandbox(tmp_path)
+    package_root = sandbox / "pkg"
+    subpackage_directory = package_root / "services" / "mouse_movement"
+    subpackage_directory.mkdir(parents=True)
+    nested_tests_directory = package_root / "tests" / "services" / "mouse_movement"
+    nested_tests_directory.mkdir(parents=True)
+    production_module = subpackage_directory / "tremor.py"
+    production_module.write_text("def jitter(): pass\n")
+    nested_test = nested_tests_directory / "test_tremor.py"
+    nested_test.write_text("def test_jitter(): pass\n")
+
+    completed = _run_hook_with_payload(_make_write_payload(production_module))
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_collect_tests_directories_from_every_ancestor_up_to_repo_boundary(
+    tmp_path: Path,
+) -> None:
+    sandbox = _sandbox(tmp_path)
+    package_root = sandbox / "pkg"
+    subpackage_directory = package_root / "services"
+    subpackage_directory.mkdir(parents=True)
+    (package_root / "tests").mkdir()
+    (subpackage_directory / "tests").mkdir()
+
+    all_pairs = _PRODUCTION_MODULE._ancestor_tests_directories(subpackage_directory)
+
+    collected_tests_directories = [each_tests_directory for _, each_tests_directory in all_pairs]
+    assert subpackage_directory / "tests" in collected_tests_directories
+    assert package_root / "tests" in collected_tests_directories
+
+
+def test_ancestor_tests_walk_stops_at_repo_boundary(tmp_path: Path) -> None:
+    outer_tests_directory = tmp_path / "tests"
+    outer_tests_directory.mkdir()
+    sandbox = _sandbox(tmp_path)
+    package_directory = sandbox / "pkg"
+    package_directory.mkdir()
+
+    all_pairs = _PRODUCTION_MODULE._ancestor_tests_directories(package_directory)
+
+    collected_tests_directories = [each_tests_directory for _, each_tests_directory in all_pairs]
+    assert outer_tests_directory not in collected_tests_directories
+
+
+def test_ancestor_tests_walk_honors_parent_walk_limit(tmp_path: Path) -> None:
+    walk_limit = _PRODUCTION_MODULE._parent_walk_limit()
+    deep_directory = tmp_path
+    for each_level_index in range(walk_limit + 2):
+        deep_directory = deep_directory / f"level_{each_level_index}"
+    deep_directory.mkdir(parents=True)
+    top_tests_directory = tmp_path / "tests"
+    top_tests_directory.mkdir()
+
+    all_pairs = _PRODUCTION_MODULE._ancestor_tests_directories(deep_directory)
+
+    collected_tests_directories = [each_tests_directory for _, each_tests_directory in all_pairs]
+    assert top_tests_directory not in collected_tests_directories
+
+
+def test_should_deny_edit_that_swaps_an_import_target(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("import os\n\ndef fulfill(): pass\n")
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="import os",
+            new_string="import sys",
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_allow_edit_that_removes_an_import_statement(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("import os\n\ndef fulfill(): pass\n")
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="import os\n",
+            new_string="",
+        )
+    )
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_allow_multiedit_when_every_pair_removes_an_import(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("import os\nimport json\nimport time\n\ndef fulfill(): pass\n")
+
+    completed = _run_hook_with_payload(
+        _make_multiedit_payload(
+            production_module,
+            edits=[
+                {"old_string": "import os\n", "new_string": ""},
+                {"old_string": "import json\n", "new_string": ""},
+            ],
+        )
+    )
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_deny_multiedit_when_one_pair_is_not_import_only(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("import os\n\ndef fulfill(): pass\n")
+
+    completed = _run_hook_with_payload(
+        _make_multiedit_payload(
+            production_module,
+            edits=[
+                {"old_string": "import os", "new_string": "import sys"},
+                {
+                    "old_string": "def fulfill(): pass",
+                    "new_string": "def fulfill(): return 1",
+                },
+            ],
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_not_exempt_write_with_behavior_under_import_only_rule(
+    tmp_path: Path,
+) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    write_content_with_behavior = "import os\n\ndef fulfill(): return os.getpid()\n"
+
+    completed = _run_hook_with_payload(
+        _make_write_payload(production_module, write_content_with_behavior)
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_deny_behavior_edit_without_a_fresh_candidate_test(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("def fulfill(): pass\n")
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="def fulfill(): pass",
+            new_string="def fulfill(): return 1",
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_deny_edit_of_import_text_inside_a_string_literal(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text('banner = "import os is great"\n\ndef fulfill(): return banner\n')
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="import os",
+            new_string="import sys",
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_allow_import_reorder_when_old_string_carries_context_lines(
+    tmp_path: Path,
+) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("import os\nimport sys\n\ndef fulfill(): pass\n")
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="import os\nimport sys\n\ndef fulfill(): pass",
+            new_string="import sys\nimport os\n\ndef fulfill(): pass",
+        )
+    )
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_allow_import_only_edit_after_a_constants_assignment(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("import os\nimport sys\n\nMAX_ORDERS = 5\n\ndef fulfill(): pass\n")
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="import os\n",
+            new_string="",
+        )
+    )
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_deny_replace_all_edit_that_rewrites_call_sites(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("import json\n\ndef parse(line): return json.loads(line)\n")
+
+    completed = _run_hook_with_payload(
+        {
+            "tool_name": "Edit",
+            "tool_input": {
+                "file_path": str(production_module),
+                "old_string": "json",
+                "new_string": "pickle",
+                "replace_all": True,
+            },
+        }
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_allow_edit_that_reorders_import_statements(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("import os\nimport sys\n\ndef fulfill(): pass\n")
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="import os\nimport sys",
+            new_string="import sys\nimport os",
+        )
+    )
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_deny_edit_that_retargets_an_import_source(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("from fast import compute\n\ndef run(): return compute()\n")
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="from fast import compute",
+            new_string="from slow import compute",
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_deny_edit_that_adds_a_future_import(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("import os\n\ndef fulfill(): return os.getpid()\n")
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="import os",
+            new_string="from __future__ import annotations\nimport os",
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_deny_multiedit_with_an_empty_edits_list(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("import os\n\ndef fulfill(): return os.getpid()\n")
+
+    completed = _run_hook_with_payload(
+        _make_multiedit_payload(production_module, edits=[])
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_deny_edit_that_removes_a_future_import(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text(
+        "from __future__ import annotations\nimport os\n\ndef fulfill(): return os.getpid()\n"
+    )
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="from __future__ import annotations\n",
+            new_string="",
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_deny_edit_that_adds_an_import(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("import os\n\ndef fulfill(): pass\n")
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="import os",
+            new_string="import os\nimport sys",
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_deny_edit_that_duplicates_an_import(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("import os\n\ndef fulfill(): pass\n")
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="import os",
+            new_string="import os\nimport os",
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_deny_changing_a_future_import_on_a_constants_only_file(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_module = sandbox / "orders.py"
+    production_module.write_text("from __future__ import annotations\nMAX_ORDERS = 5\n")
+
+    completed = _run_hook_with_payload(
+        _make_edit_payload(
+            production_module,
+            old_string="from __future__ import annotations",
+            new_string="from __future__ import division",
+        )
+    )
+
+    assert _decision_from(completed) == "deny"

package/hooks/hooks.json

@@ -2,16 +2,6 @@
   "description": "Code standards enforcement, safety guards, and development workflow hooks",
   "hooks": {
     "PreToolUse": [
-      {
-        "matcher": "Grep|Search",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/content_search_to_zoekt_redirector.py",
-            "timeout": 10
-          }
-        ]
-      },
       {
         "matcher": "Write|Edit",
         "hooks": [
@@ -130,11 +120,6 @@
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/convergence_gate_blocker.py",
             "timeout": 15
           },
-          {
-            "type": "command",
-            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/content_search_to_zoekt_redirector.py",
-            "timeout": 10
-          },
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/windows_rmtree_blocker.py",

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -124,6 +124,11 @@ FUNCTION_LENGTH_BLOCKING_MESSAGE_SUFFIX: str = (
     "function review hint)"
 )
 
+PRECHECK_USAGE_EXIT_CODE: int = 2
+PRECHECK_USAGE_MESSAGE: str = (
+    "usage: code_rules_enforcer.py --check <candidate> [--as <target>]\n"
+)
+
 BANNED_NOUN_SPAN_FRAGMENT_TEMPLATE: str = (
     "(binding span at line {definition_line}, spanning {line_span} lines)"
 )

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "1.51.0",
+    "version": "1.52.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/skills/update/SKILL.md

@@ -0,0 +1,143 @@
+---
+name: update
+description: Fast-forwards a local git repository's main branch to a remote's main, after confirming both the local repo path and the source remote through AskUserQuestion. Fetches the chosen remote, checks that the move is a true fast-forward (never a force, never a merge commit), and updates main whether or not main is the checked-out branch. Use when the user says "/update", "update main", "fast-forward main", "sync main from origin", "pull latest main into <path>", or "bring main up to date". Triggers on "/update", "update main", "fast-forward main", "sync main".
+---
+
+# update
+
+## Overview
+
+Fast-forwards the local `main` branch of a given repository to a chosen remote's `main`. The move is always a true fast-forward: the skill fetches the remote, checks that local `main` is an ancestor of the remote's `main`, and advances the ref. It never forces, never creates a merge commit, and never touches any branch other than `main`.
+
+The repository is whatever path the user gives as the `/update <path>` argument. With no argument, the default is the current repository's top level. Either way the path is confirmed before any write.
+
+**Announce at start:** "Confirming the repo path and source remote, then fast-forwarding main."
+
+## When this applies
+
+Trigger on a request to bring a repo's `main` up to date from a remote: "/update", "update main", "fast-forward main", "sync main from origin", "pull latest main into <path>".
+
+**Refusals — first match wins; respond with the quoted line exactly and stop:**
+
+- Path is not a git repository → `<path> is not a git repository. Give me the path to a git working tree.`
+- The chosen remote has no `main` → `<remote> has no main branch. Pick a remote whose main you want.`
+- Local `main` has diverged from the remote's `main` (not a fast-forward) → `main has diverged from <remote>/main (ahead N, behind M). A fast-forward is not possible — use /rebase or reconcile manually.`
+
+## Instructions
+
+### Phase 1 — Resolve the local path
+
+Take the path from the `/update <path>` argument. With no argument, use the current repo's top level:
+
+```
+git -C "<path>" rev-parse --show-toplevel
+```
+
+Confirm the path is a git working tree (`git -C "<path>" rev-parse --git-dir`). If not, give the first refusal line.
+
+### Phase 2 — Confirm the path and the source remote
+
+List the candidate repo's remotes and their URLs:
+
+```
+git -C "<path>" remote -v
+```
+
+Confirm both in **one** `AskUserQuestion` question — header "Target". Each choice pairs the resolved path with one remote, labelled `<path> ← <remote>/main` and described with that remote's fetch URL. Picking a choice confirms the path and the remote together.
+
+Recommend `<path> ← origin/main` first; the source-of-truth remote is not always the one named `origin`. The user picks "Other" to name a different path or remote. If they switch to a different repository, re-list its remotes and ask once more — remote names are per-repo.
+
+### Phase 3 — Fetch and fast-forward
+
+Run every command with `git -C "<path>"`. Do not `cd` into the repo.
+
+1. Fetch the chosen remote's `main`, which moves the remote-tracking ref:
+
+   ```
+   git -C "<path>" fetch <remote> main
+   ```
+
+   Stop and report on failure (no network, no remote). If the remote has no `main`, give the second refusal line.
+
+2. Read the current branch and the two commits:
+
+   ```
+   git -C "<path>" branch --show-current
+   git -C "<path>" rev-parse <remote>/main
+   git -C "<path>" rev-parse --verify main   # may not exist yet
+   ```
+
+3. Decide the case:
+
+   | Case | Condition | Action |
+   |---|---|---|
+   | Create | local `main` does not exist | `git -C "<path>" branch main <remote>/main` |
+   | Up to date | local `main` == `<remote>/main` | report, done |
+   | Diverged | `merge-base --is-ancestor main <remote>/main` is false | third refusal line, stop |
+   | Fast-forward, on main | current branch is `main` | clean check, then `merge --ff-only` |
+   | Fast-forward, off main | current branch is not `main` | `fetch <remote> main:main` |
+
+   The fast-forward gate:
+
+   ```
+   git -C "<path>" merge-base --is-ancestor main <remote>/main
+   ```
+
+   Exit 0 means a fast-forward is possible. Non-zero means diverged — refuse, never force.
+
+4. Apply the fast-forward for the matched case:
+
+   - **On `main`:** the working tree must be clean first — `git -C "<path>" status --porcelain` must be empty. If dirty, stop and report; never stash or discard. Then:
+
+     ```
+     git -C "<path>" merge --ff-only <remote>/main
+     ```
+
+   - **Off `main`:** advance the ref without touching the working tree:
+
+     ```
+     git -C "<path>" fetch <remote> main:main
+     ```
+
+     This is fast-forward-only (no leading `+`) and leaves the checked-out branch alone.
+
+### Phase 4 — Report
+
+State the old and new `main` SHAs and the one-line subject of the new tip:
+
+```
+git -C "<path>" log --oneline -1 main
+```
+
+Report the move as `main <old> → <new>`, or "already up to date" when nothing changed.
+
+## Constraints (non-negotiable)
+
+- **Fast-forward only.** If the remote's `main` is not a descendant of local `main`, stop. Never `--force`, never `branch -f`, never a merge commit. Divergence is a job for `/rebase`.
+- **Always confirm both** the path and the source remote first, even when the path is given as an argument. Skipping a confirmation is not allowed — the confirmation is the point of this skill.
+- **Touch only `main`.** Never switch the repo's checked-out branch. The single exception is advancing `main` in place when `main` is already checked out.
+- **Never discard local work.** A dirty tree blocks the in-place fast-forward; stop and report rather than stash or reset.
+
+## Gotchas
+
+- `git fetch <remote> main:main` refuses with "Refusing to fetch into branch ... checked out" when `main` is the current branch. That is why Phase 3 branches on `git branch --show-current` and uses `merge --ff-only` when on `main`.
+- The same refusal fires when `main` is checked out in a **different worktree** of the same repo. Find it with `git -C "<path>" worktree list`, then run the fast-forward from that worktree's path, or report it and stop.
+- `<remote>/main` only moves after an explicit `git fetch`. Fetch inside every run; never compare against a remote-tracking ref left over from an earlier fetch.
+- `origin` is not always the source of truth. When a fork is `origin` and the canonical repo is another remote (often `upstream`), the confirmed remote should be the canonical one, not whichever is named `origin`.
+- Quote the path on every command — `git -C "<path>"` — so paths with spaces or a NAS drive letter survive.
+
+## What this skill does NOT do
+
+- Does not push, open a PR, or change any branch other than `main`.
+- Does not create or switch feature branches — that is `/fresh-branch`.
+- Does not reconcile a diverged `main` — that is `/rebase`.
+
+## File index
+
+| File | Purpose |
+|------|---------|
+| `SKILL.md` | This hub — the complete skill. |
+
+## Folder map
+
+- `SKILL.md` — the whole skill. Flat by design: the operation is a short, deterministic git sequence with no scripts or reference files to load.