claude-dev-env 1.59.0 → 1.61.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CLAUDE.md +4 -0
- package/audit-rubrics/category_rubrics/category-b-selector-engine-compat.md +1 -1
- package/audit-rubrics/category_rubrics/category-e-dead-code.md +1 -0
- package/audit-rubrics/category_rubrics/category-f-silent-failures.md +1 -1
- package/audit-rubrics/category_rubrics/category-o-docstring-vs-impl-drift.md +1 -1
- package/audit-rubrics/prompts/category-b-selector-engine-compat.md +2 -2
- package/audit-rubrics/prompts/category-e-dead-code.md +17 -4
- package/audit-rubrics/prompts/category-f-silent-failures.md +1 -0
- package/docs/CODE_RULES.md +2 -2
- package/hooks/blocking/code_rules_annotations_length.py +189 -10
- package/hooks/blocking/code_rules_dead_module_constant.py +321 -0
- package/hooks/blocking/code_rules_duplicate_body.py +152 -0
- package/hooks/blocking/code_rules_enforcer.py +38 -15
- package/hooks/blocking/code_rules_orphan_css_class.py +196 -0
- package/hooks/blocking/code_rules_typeddict_stub.py +172 -0
- package/hooks/blocking/config/__init__.py +5 -0
- package/hooks/blocking/config/verified_commit_constants.py +118 -0
- package/hooks/blocking/destructive_command_blocker.py +483 -61
- package/hooks/blocking/test_code_rules_enforcer_annotations.py +240 -0
- package/hooks/blocking/test_code_rules_enforcer_cap_meta.py +1 -0
- package/hooks/blocking/test_code_rules_enforcer_cross_skill_duplicate.py +146 -0
- package/hooks/blocking/test_code_rules_enforcer_dead_module_constant.py +188 -0
- package/hooks/blocking/test_code_rules_enforcer_dispatch_wiring.py +82 -0
- package/hooks/blocking/test_code_rules_enforcer_orphan_css_class.py +196 -0
- package/hooks/blocking/test_code_rules_enforcer_zero_payload_alias.py +415 -0
- package/hooks/blocking/test_code_rules_enforcer_zero_payload_alias_hook_routing.py +156 -0
- package/hooks/blocking/test_destructive_command_blocker.py +213 -0
- package/hooks/blocking/test_verdict_directory_write_blocker.py +720 -0
- package/hooks/blocking/test_verification_verdict_store.py +490 -0
- package/hooks/blocking/test_verified_commit_gate.py +495 -0
- package/hooks/blocking/test_verified_commit_message_accuracy_blocker.py +131 -0
- package/hooks/blocking/test_verifier_verdict_minter.py +193 -0
- package/hooks/blocking/verdict_directory_write_blocker.py +667 -0
- package/hooks/blocking/verification_verdict_store.py +686 -0
- package/hooks/blocking/verified_commit_gate.py +535 -0
- package/hooks/blocking/verified_commit_message_accuracy_blocker.py +152 -0
- package/hooks/blocking/verifier_verdict_minter.py +221 -0
- package/hooks/diagnostic/test_hook_log_extractor.py +3 -3
- package/hooks/hooks.json +43 -1
- package/hooks/hooks_constants/blocking_check_limits.py +1 -0
- package/hooks/hooks_constants/code_rules_enforcer_constants.py +6 -0
- package/hooks/hooks_constants/dead_module_constant_constants.py +20 -0
- package/hooks/hooks_constants/destructive_command_segment_constants.py +15 -0
- package/hooks/hooks_constants/duplicate_function_body_constants.py +22 -5
- package/hooks/hooks_constants/orphan_css_class_constants.py +40 -0
- package/hooks/hooks_constants/precommit_code_rules_gate_constants.py +1 -1
- package/hooks/validation/mypy_validator.py +59 -7
- package/hooks/validation/test_mypy_validator.py +94 -0
- package/package.json +1 -1
- package/rules/file-global-constants.md +7 -1
- package/rules/no-cross-skill-duplicate-helpers.md +29 -0
- package/rules/orphan-css-class.md +23 -0
- package/skills/_shared/pr-loop/scripts/preflight_worktree.py +392 -0
- package/skills/_shared/pr-loop/scripts/skills_pr_loop_constants/preflight_constants.py +70 -0
- package/skills/_shared/pr-loop/scripts/test_preflight_worktree.py +263 -0
- package/skills/autoconverge/SKILL.md +54 -17
- package/skills/autoconverge/reference/closing-report.md +59 -17
- package/skills/autoconverge/workflow/aggregate_runs.py +371 -0
- package/skills/autoconverge/workflow/autoconverge_report_constants/render_report_constants.py +192 -76
- package/skills/autoconverge/workflow/converge.clean-audit.test.mjs +76 -0
- package/skills/autoconverge/workflow/converge.contract.test.mjs +395 -206
- package/skills/autoconverge/workflow/converge.mjs +520 -57
- package/skills/autoconverge/workflow/convergence_summary.py +110 -0
- package/skills/autoconverge/workflow/fixtures/wf_run/subagents/workflows/wf_881252e6-700/agent-ab1c2d3e4f5a6b7c8.jsonl +2 -0
- package/skills/autoconverge/workflow/fixtures/wf_run/workflows/wf_881252e6-700.json +7 -0
- package/skills/autoconverge/workflow/render_report.py +488 -397
- package/skills/autoconverge/workflow/test_aggregate_runs.py +134 -0
- package/skills/autoconverge/workflow/test_convergence_summary.py +132 -0
- package/skills/autoconverge/workflow/test_render_report.py +518 -259
- package/skills/pr-converge/reference/per-tick.md +28 -8
- package/skills/rebase/SKILL.md +2 -4
- package/system-prompts/software-engineer.xml +2 -6
- package/hooks/blocking/content_search_to_zoekt_redirector.py +0 -59
- package/hooks/blocking/content_search_zoekt_bash_block_reason.py +0 -25
- package/hooks/blocking/content_search_zoekt_block_payload.py +0 -21
- package/hooks/blocking/content_search_zoekt_indexed_paths.py +0 -24
- package/hooks/blocking/content_search_zoekt_indexed_roots_config.py +0 -131
- package/hooks/blocking/content_search_zoekt_redirect_guidance.py +0 -52
- package/hooks/blocking/test_content_search_to_zoekt_redirector_integration.py +0 -61
- package/hooks/blocking/test_content_search_to_zoekt_redirector_unit.py +0 -92
- package/hooks/blocking/test_content_search_zoekt_indexed_roots_config.py +0 -102
|
@@ -0,0 +1,495 @@
|
|
|
1
|
+
"""Tests for the gated-invocation parser in verified_commit_gate.
|
|
2
|
+
|
|
3
|
+
Each test asserts which directories a command string's git commit/push verbs
|
|
4
|
+
target, exercising the same token-walk the verified_commit_gate hook runs to
|
|
5
|
+
decide what to gate.
|
|
6
|
+
"""
|
|
7
|
+
|
|
8
|
+
import importlib.util
|
|
9
|
+
import json
|
|
10
|
+
import os
|
|
11
|
+
import pathlib
|
|
12
|
+
import subprocess
|
|
13
|
+
import sys
|
|
14
|
+
|
|
15
|
+
import pytest
|
|
16
|
+
|
|
17
|
+
_HOOK_DIR = pathlib.Path(__file__).parent
|
|
18
|
+
if str(_HOOK_DIR) not in sys.path:
|
|
19
|
+
sys.path.insert(0, str(_HOOK_DIR))
|
|
20
|
+
|
|
21
|
+
gate_spec = importlib.util.spec_from_file_location(
|
|
22
|
+
"verified_commit_gate",
|
|
23
|
+
_HOOK_DIR / "verified_commit_gate.py",
|
|
24
|
+
)
|
|
25
|
+
assert gate_spec is not None
|
|
26
|
+
assert gate_spec.loader is not None
|
|
27
|
+
gate_module = importlib.util.module_from_spec(gate_spec)
|
|
28
|
+
gate_spec.loader.exec_module(gate_module)
|
|
29
|
+
gated_repo_directories = gate_module.gated_repo_directories
|
|
30
|
+
deny_reason_for_directory = gate_module.deny_reason_for_directory
|
|
31
|
+
|
|
32
|
+
store_spec = importlib.util.spec_from_file_location(
|
|
33
|
+
"verification_verdict_store",
|
|
34
|
+
_HOOK_DIR / "verification_verdict_store.py",
|
|
35
|
+
)
|
|
36
|
+
assert store_spec is not None
|
|
37
|
+
assert store_spec.loader is not None
|
|
38
|
+
store_module = importlib.util.module_from_spec(store_spec)
|
|
39
|
+
store_spec.loader.exec_module(store_module)
|
|
40
|
+
resolve_merge_base = store_module.resolve_merge_base
|
|
41
|
+
branch_surface_manifest = store_module.branch_surface_manifest
|
|
42
|
+
manifest_sha256 = store_module.manifest_sha256
|
|
43
|
+
|
|
44
|
+
PRODUCTION_SOURCE = "def add(left: int, right: int) -> int:\n return left + right\n"
|
|
45
|
+
|
|
46
|
+
|
|
47
|
+
def test_plain_git_commit_is_gated() -> None:
|
|
48
|
+
assert gated_repo_directories("git commit -m x", "FALLBACK") == ["FALLBACK"]
|
|
49
|
+
|
|
50
|
+
|
|
51
|
+
def test_git_exe_commit_is_gated() -> None:
|
|
52
|
+
assert gated_repo_directories("git.exe commit -m x", "FALLBACK") == ["FALLBACK"]
|
|
53
|
+
|
|
54
|
+
|
|
55
|
+
def test_git_exe_push_is_gated() -> None:
|
|
56
|
+
assert gated_repo_directories("git.exe push origin main", "FALLBACK") == [
|
|
57
|
+
"FALLBACK"
|
|
58
|
+
]
|
|
59
|
+
|
|
60
|
+
|
|
61
|
+
def test_git_exe_commit_records_repo_directory_option() -> None:
|
|
62
|
+
assert gated_repo_directories('git.exe -C "/repo" commit -m x', "FALLBACK") == [
|
|
63
|
+
"/repo"
|
|
64
|
+
]
|
|
65
|
+
|
|
66
|
+
|
|
67
|
+
def test_git_log_grep_commit_is_not_gated() -> None:
|
|
68
|
+
assert gated_repo_directories("git log --grep commit", "FALLBACK") == []
|
|
69
|
+
|
|
70
|
+
|
|
71
|
+
def test_git_stash_push_is_not_gated() -> None:
|
|
72
|
+
assert gated_repo_directories("git stash push", "FALLBACK") == []
|
|
73
|
+
|
|
74
|
+
|
|
75
|
+
def test_git_dir_option_value_yields_single_entry() -> None:
|
|
76
|
+
assert gated_repo_directories(
|
|
77
|
+
"git --git-dir=/x/.git commit", "FALLBACK"
|
|
78
|
+
) == ["FALLBACK"]
|
|
79
|
+
|
|
80
|
+
|
|
81
|
+
def test_substring_git_in_branch_name_is_not_a_git_word() -> None:
|
|
82
|
+
assert gated_repo_directories("git push origin legit-branch", "FALLBACK") == [
|
|
83
|
+
"FALLBACK"
|
|
84
|
+
]
|
|
85
|
+
|
|
86
|
+
|
|
87
|
+
def test_two_real_git_commits_yield_two_entries() -> None:
|
|
88
|
+
assert gated_repo_directories(
|
|
89
|
+
"git commit -m x && git push origin main", "FALLBACK"
|
|
90
|
+
) == ["FALLBACK", "FALLBACK"]
|
|
91
|
+
|
|
92
|
+
|
|
93
|
+
def test_unix_path_prefixed_git_commit_is_gated() -> None:
|
|
94
|
+
assert gated_repo_directories("/usr/bin/git commit -m x", "FALLBACK") == [
|
|
95
|
+
"FALLBACK"
|
|
96
|
+
]
|
|
97
|
+
|
|
98
|
+
|
|
99
|
+
def test_windows_path_prefixed_git_exe_commit_is_gated() -> None:
|
|
100
|
+
assert gated_repo_directories(
|
|
101
|
+
"C:/Program Files/Git/bin/git.exe commit -m x", "FALLBACK"
|
|
102
|
+
) == ["FALLBACK"]
|
|
103
|
+
|
|
104
|
+
|
|
105
|
+
def test_backslash_path_prefixed_git_exe_commit_is_gated() -> None:
|
|
106
|
+
assert gated_repo_directories(
|
|
107
|
+
"C:\\Program Files\\Git\\cmd\\git.exe commit", "FALLBACK"
|
|
108
|
+
) == ["FALLBACK"]
|
|
109
|
+
|
|
110
|
+
|
|
111
|
+
def test_quoted_git_word_commit_is_gated() -> None:
|
|
112
|
+
assert gated_repo_directories('"git" commit -m x', "FALLBACK") == ["FALLBACK"]
|
|
113
|
+
|
|
114
|
+
|
|
115
|
+
def test_call_operator_path_git_exe_commit_is_gated() -> None:
|
|
116
|
+
assert gated_repo_directories("& 'C:/x/git.exe' commit", "FALLBACK") == [
|
|
117
|
+
"FALLBACK"
|
|
118
|
+
]
|
|
119
|
+
|
|
120
|
+
|
|
121
|
+
def test_call_operator_program_files_git_exe_commit_is_gated() -> None:
|
|
122
|
+
assert gated_repo_directories(
|
|
123
|
+
'& "C:\\Program Files\\Git\\cmd\\git.exe" commit -m x', "C:/repo"
|
|
124
|
+
) == ["C:/repo"]
|
|
125
|
+
|
|
126
|
+
|
|
127
|
+
def test_quoted_program_files_git_exe_commit_is_gated() -> None:
|
|
128
|
+
assert gated_repo_directories(
|
|
129
|
+
'"C:/Program Files/Git/cmd/git.exe" commit', "C:/repo"
|
|
130
|
+
) == ["C:/repo"]
|
|
131
|
+
|
|
132
|
+
|
|
133
|
+
def test_quoted_program_files_path_without_git_segment_is_not_gated() -> None:
|
|
134
|
+
assert gated_repo_directories(
|
|
135
|
+
'"C:/Program Files/Other/tool.exe" commit', "C:/repo"
|
|
136
|
+
) == []
|
|
137
|
+
|
|
138
|
+
|
|
139
|
+
def test_path_prefixed_git_log_grep_commit_is_not_gated() -> None:
|
|
140
|
+
assert gated_repo_directories("/usr/bin/git log --grep commit", "FALLBACK") == []
|
|
141
|
+
|
|
142
|
+
|
|
143
|
+
def test_mygit_commit_is_not_a_git_word() -> None:
|
|
144
|
+
assert gated_repo_directories("mygit commit", "FALLBACK") == []
|
|
145
|
+
|
|
146
|
+
|
|
147
|
+
def test_legit_commit_is_not_a_git_word() -> None:
|
|
148
|
+
assert gated_repo_directories("legit commit", "FALLBACK") == []
|
|
149
|
+
|
|
150
|
+
|
|
151
|
+
def test_cd_then_git_commit_gates_the_cd_directory() -> None:
|
|
152
|
+
assert gated_repo_directories(
|
|
153
|
+
"cd /other/repo && git commit -m x", "FALLBACK"
|
|
154
|
+
) == ["/other/repo"]
|
|
155
|
+
|
|
156
|
+
|
|
157
|
+
def test_pushd_then_git_commit_gates_the_pushd_directory() -> None:
|
|
158
|
+
assert gated_repo_directories(
|
|
159
|
+
"pushd /other/repo; git commit -m x", "FALLBACK"
|
|
160
|
+
) == ["/other/repo"]
|
|
161
|
+
|
|
162
|
+
|
|
163
|
+
def test_cd_with_quoted_directory_gates_the_quoted_directory() -> None:
|
|
164
|
+
assert gated_repo_directories(
|
|
165
|
+
'cd "/path with spaces" && git commit -m x', "FALLBACK"
|
|
166
|
+
) == ["/path with spaces"]
|
|
167
|
+
|
|
168
|
+
|
|
169
|
+
def test_explicit_repo_option_overrides_cd_directory() -> None:
|
|
170
|
+
assert gated_repo_directories(
|
|
171
|
+
'cd /other/repo && git -C "/repo" commit -m x', "FALLBACK"
|
|
172
|
+
) == ["/repo"]
|
|
173
|
+
|
|
174
|
+
|
|
175
|
+
def test_later_cd_applies_to_later_git_commit() -> None:
|
|
176
|
+
assert gated_repo_directories(
|
|
177
|
+
"git commit -m a && cd /second && git commit -m b", "FALLBACK"
|
|
178
|
+
) == ["FALLBACK", "/second"]
|
|
179
|
+
|
|
180
|
+
|
|
181
|
+
def test_cd_without_argument_keeps_the_fallback_directory() -> None:
|
|
182
|
+
assert gated_repo_directories("cd && git commit -m x", "FALLBACK") == [
|
|
183
|
+
"FALLBACK"
|
|
184
|
+
]
|
|
185
|
+
|
|
186
|
+
|
|
187
|
+
def test_set_location_then_git_commit_gates_the_set_location_directory() -> None:
|
|
188
|
+
assert gated_repo_directories(
|
|
189
|
+
"Set-Location /other/repo; git commit -m x", "FALLBACK"
|
|
190
|
+
) == ["/other/repo"]
|
|
191
|
+
|
|
192
|
+
|
|
193
|
+
def test_sl_alias_then_git_commit_gates_the_sl_directory() -> None:
|
|
194
|
+
assert gated_repo_directories(
|
|
195
|
+
"sl /other/repo; git commit -m x", "FALLBACK"
|
|
196
|
+
) == ["/other/repo"]
|
|
197
|
+
|
|
198
|
+
|
|
199
|
+
def test_set_location_is_matched_case_insensitively() -> None:
|
|
200
|
+
assert gated_repo_directories(
|
|
201
|
+
"set-location /other/repo; git commit -m x", "FALLBACK"
|
|
202
|
+
) == ["/other/repo"]
|
|
203
|
+
|
|
204
|
+
|
|
205
|
+
def test_relative_cd_target_resolves_against_the_fallback_directory() -> None:
|
|
206
|
+
expected_directory = os.path.join("/session/dir", "subdir")
|
|
207
|
+
assert gated_repo_directories(
|
|
208
|
+
"cd subdir && git commit -m x", "/session/dir"
|
|
209
|
+
) == [expected_directory]
|
|
210
|
+
|
|
211
|
+
|
|
212
|
+
def test_relative_set_location_target_resolves_against_the_fallback_directory() -> None:
|
|
213
|
+
expected_directory = os.path.join("/session/dir", "subdir")
|
|
214
|
+
assert gated_repo_directories(
|
|
215
|
+
"Set-Location subdir; git commit -m x", "/session/dir"
|
|
216
|
+
) == [expected_directory]
|
|
217
|
+
|
|
218
|
+
|
|
219
|
+
def test_absolute_cd_target_is_not_joined_to_the_fallback_directory() -> None:
|
|
220
|
+
assert gated_repo_directories(
|
|
221
|
+
"cd /other/repo && git commit -m x", "/session/dir"
|
|
222
|
+
) == ["/other/repo"]
|
|
223
|
+
|
|
224
|
+
|
|
225
|
+
def test_work_tree_option_gates_the_work_tree_directory() -> None:
|
|
226
|
+
assert gated_repo_directories(
|
|
227
|
+
"git --git-dir=/other/.git --work-tree=/other commit", "/session"
|
|
228
|
+
) == ["/other"]
|
|
229
|
+
|
|
230
|
+
|
|
231
|
+
def test_work_tree_space_separated_option_gates_the_work_tree_directory() -> None:
|
|
232
|
+
assert gated_repo_directories(
|
|
233
|
+
"git --work-tree /other commit -m x", "/session"
|
|
234
|
+
) == ["/other"]
|
|
235
|
+
|
|
236
|
+
|
|
237
|
+
def test_repo_option_overrides_work_tree_option() -> None:
|
|
238
|
+
assert gated_repo_directories(
|
|
239
|
+
'git -C "/repo" --work-tree=/other commit', "/session"
|
|
240
|
+
) == ["/repo"]
|
|
241
|
+
|
|
242
|
+
|
|
243
|
+
def test_relative_repo_option_resolves_against_the_active_directory() -> None:
|
|
244
|
+
expected_directory = os.path.join("/repo", "subdir")
|
|
245
|
+
assert gated_repo_directories(
|
|
246
|
+
"cd /repo && git -C subdir commit -m x", "FALLBACK"
|
|
247
|
+
) == [expected_directory]
|
|
248
|
+
|
|
249
|
+
|
|
250
|
+
def test_relative_work_tree_option_resolves_against_the_active_directory() -> None:
|
|
251
|
+
expected_directory = os.path.join("/repo", "subtree")
|
|
252
|
+
assert gated_repo_directories(
|
|
253
|
+
"cd /repo && git --work-tree subtree commit -m x", "FALLBACK"
|
|
254
|
+
) == [expected_directory]
|
|
255
|
+
|
|
256
|
+
|
|
257
|
+
def test_relative_repo_option_resolves_against_the_fallback_directory() -> None:
|
|
258
|
+
expected_directory = os.path.join("/session/dir", "subdir")
|
|
259
|
+
assert gated_repo_directories(
|
|
260
|
+
"git -C subdir commit -m x", "/session/dir"
|
|
261
|
+
) == [expected_directory]
|
|
262
|
+
|
|
263
|
+
|
|
264
|
+
def _set_fake_home(monkeypatch: pytest.MonkeyPatch, fake_home: pathlib.Path) -> str:
|
|
265
|
+
home_text = str(fake_home)
|
|
266
|
+
monkeypatch.setenv("HOME", home_text)
|
|
267
|
+
monkeypatch.setenv("USERPROFILE", home_text)
|
|
268
|
+
monkeypatch.delenv("HOMEDRIVE", raising=False)
|
|
269
|
+
monkeypatch.delenv("HOMEPATH", raising=False)
|
|
270
|
+
return home_text
|
|
271
|
+
|
|
272
|
+
|
|
273
|
+
def test_cd_into_tilde_repo_gates_the_expanded_home_path(
|
|
274
|
+
monkeypatch: pytest.MonkeyPatch, tmp_path: pathlib.Path
|
|
275
|
+
) -> None:
|
|
276
|
+
home_text = _set_fake_home(monkeypatch, tmp_path)
|
|
277
|
+
expected_directory = os.path.expanduser("~/myrepo")
|
|
278
|
+
assert home_text in expected_directory
|
|
279
|
+
assert gated_repo_directories(
|
|
280
|
+
"cd ~/myrepo && git commit -m x", "FALLBACK"
|
|
281
|
+
) == [expected_directory]
|
|
282
|
+
|
|
283
|
+
|
|
284
|
+
def test_git_dash_c_tilde_repo_gates_the_expanded_home_path(
|
|
285
|
+
monkeypatch: pytest.MonkeyPatch, tmp_path: pathlib.Path
|
|
286
|
+
) -> None:
|
|
287
|
+
home_text = _set_fake_home(monkeypatch, tmp_path)
|
|
288
|
+
expected_directory = os.path.expanduser("~/myrepo")
|
|
289
|
+
assert home_text in expected_directory
|
|
290
|
+
assert gated_repo_directories(
|
|
291
|
+
"git -C ~/myrepo commit -m x", "FALLBACK"
|
|
292
|
+
) == [expected_directory]
|
|
293
|
+
|
|
294
|
+
|
|
295
|
+
def test_git_work_tree_tilde_repo_gates_the_expanded_home_path(
|
|
296
|
+
monkeypatch: pytest.MonkeyPatch, tmp_path: pathlib.Path
|
|
297
|
+
) -> None:
|
|
298
|
+
home_text = _set_fake_home(monkeypatch, tmp_path)
|
|
299
|
+
expected_directory = os.path.expanduser("~/myrepo")
|
|
300
|
+
assert home_text in expected_directory
|
|
301
|
+
assert gated_repo_directories(
|
|
302
|
+
"git --work-tree ~/myrepo commit -m x", "FALLBACK"
|
|
303
|
+
) == [expected_directory]
|
|
304
|
+
|
|
305
|
+
|
|
306
|
+
def test_set_location_path_option_gates_the_path_value() -> None:
|
|
307
|
+
assert gated_repo_directories(
|
|
308
|
+
"Set-Location -Path /repo; git commit -m x", "FALLBACK"
|
|
309
|
+
) == ["/repo"]
|
|
310
|
+
|
|
311
|
+
|
|
312
|
+
def test_pushd_literal_path_option_gates_the_path_value() -> None:
|
|
313
|
+
assert gated_repo_directories(
|
|
314
|
+
"pushd -LiteralPath /repo; git commit", "FALLBACK"
|
|
315
|
+
) == ["/repo"]
|
|
316
|
+
|
|
317
|
+
|
|
318
|
+
def test_cd_double_dash_terminator_gates_the_path_value() -> None:
|
|
319
|
+
assert gated_repo_directories(
|
|
320
|
+
"cd -- /repo && git commit", "FALLBACK"
|
|
321
|
+
) == ["/repo"]
|
|
322
|
+
|
|
323
|
+
|
|
324
|
+
def test_cd_inside_double_quoted_commit_message_does_not_divert_later_push() -> None:
|
|
325
|
+
assert gated_repo_directories(
|
|
326
|
+
'git commit -m "context: cd /var/empty/nonrepo first" && git push',
|
|
327
|
+
"/real/repo/worktree",
|
|
328
|
+
) == ["/real/repo/worktree", "/real/repo/worktree"]
|
|
329
|
+
|
|
330
|
+
|
|
331
|
+
def test_cd_inside_single_quoted_commit_message_does_not_divert_later_push() -> None:
|
|
332
|
+
assert gated_repo_directories(
|
|
333
|
+
"git commit -m 'context: cd /var/empty/nonrepo first' && git push",
|
|
334
|
+
"/real/repo/worktree",
|
|
335
|
+
) == ["/real/repo/worktree", "/real/repo/worktree"]
|
|
336
|
+
|
|
337
|
+
|
|
338
|
+
def test_pushd_inside_quoted_commit_message_does_not_divert_later_push() -> None:
|
|
339
|
+
assert gated_repo_directories(
|
|
340
|
+
'git commit -m "context: pushd /var/empty/nonrepo first" && git push',
|
|
341
|
+
"/real/repo/worktree",
|
|
342
|
+
) == ["/real/repo/worktree", "/real/repo/worktree"]
|
|
343
|
+
|
|
344
|
+
|
|
345
|
+
def test_real_cd_outside_quotes_still_diverts_after_a_quoted_message() -> None:
|
|
346
|
+
assert gated_repo_directories(
|
|
347
|
+
'git commit -m "msg" && cd /other/repo && git push',
|
|
348
|
+
"/real/repo/worktree",
|
|
349
|
+
) == ["/real/repo/worktree", "/other/repo"]
|
|
350
|
+
|
|
351
|
+
|
|
352
|
+
def test_git_word_inside_quoted_commit_message_yields_one_entry() -> None:
|
|
353
|
+
assert gated_repo_directories(
|
|
354
|
+
'git commit -m "remember to git commit later"', "FB"
|
|
355
|
+
) == ["FB"]
|
|
356
|
+
|
|
357
|
+
|
|
358
|
+
def test_git_word_inside_single_quoted_message_value_yields_one_entry() -> None:
|
|
359
|
+
assert gated_repo_directories(
|
|
360
|
+
"git commit -m 'remember to git commit later'", "FB"
|
|
361
|
+
) == ["FB"]
|
|
362
|
+
|
|
363
|
+
|
|
364
|
+
def test_backslash_newline_after_git_word_is_gated() -> None:
|
|
365
|
+
assert gated_repo_directories("git \\\n commit -m x", "FB") == ["FB"]
|
|
366
|
+
|
|
367
|
+
|
|
368
|
+
def test_backslash_newline_abutting_subcommand_is_gated() -> None:
|
|
369
|
+
assert gated_repo_directories("git commit\\\n -m x", "FB") == ["FB"]
|
|
370
|
+
|
|
371
|
+
|
|
372
|
+
def test_backslash_newline_splitting_git_word_is_gated() -> None:
|
|
373
|
+
assert gated_repo_directories("g\\\nit commit -m x", "FB") == ["FB"]
|
|
374
|
+
|
|
375
|
+
|
|
376
|
+
def test_git_verb_inside_echo_prose_is_not_gated() -> None:
|
|
377
|
+
assert gated_repo_directories(
|
|
378
|
+
'echo "Next: git commit and git push"', "/d"
|
|
379
|
+
) == []
|
|
380
|
+
|
|
381
|
+
|
|
382
|
+
def test_git_verb_inside_gh_comment_body_is_not_gated() -> None:
|
|
383
|
+
assert gated_repo_directories(
|
|
384
|
+
'gh pr comment -b "please git commit your work"', "/d"
|
|
385
|
+
) == []
|
|
386
|
+
|
|
387
|
+
|
|
388
|
+
def _run_git(repo_dir: pathlib.Path, *git_arguments: str) -> None:
|
|
389
|
+
subprocess.run(
|
|
390
|
+
["git", "-C", str(repo_dir), *git_arguments],
|
|
391
|
+
check=True,
|
|
392
|
+
capture_output=True,
|
|
393
|
+
text=True,
|
|
394
|
+
)
|
|
395
|
+
|
|
396
|
+
|
|
397
|
+
def _make_gated_repo(tmp_path: pathlib.Path) -> pathlib.Path:
|
|
398
|
+
origin_dir = tmp_path / "origin.git"
|
|
399
|
+
work_dir = tmp_path / "work"
|
|
400
|
+
work_dir.mkdir()
|
|
401
|
+
subprocess.run(
|
|
402
|
+
["git", "init", "--bare", "--initial-branch=main", str(origin_dir)],
|
|
403
|
+
check=True,
|
|
404
|
+
capture_output=True,
|
|
405
|
+
text=True,
|
|
406
|
+
)
|
|
407
|
+
_run_git(work_dir, "init", "--initial-branch=main")
|
|
408
|
+
_run_git(work_dir, "config", "user.email", "tests@example.com")
|
|
409
|
+
_run_git(work_dir, "config", "user.name", "Gate Tests")
|
|
410
|
+
(work_dir / "app.py").write_text(PRODUCTION_SOURCE, encoding="utf-8")
|
|
411
|
+
_run_git(work_dir, "add", "-A")
|
|
412
|
+
_run_git(work_dir, "commit", "-m", "base")
|
|
413
|
+
_run_git(work_dir, "remote", "add", "origin", str(origin_dir))
|
|
414
|
+
_run_git(work_dir, "push", "-u", "origin", "main")
|
|
415
|
+
(work_dir / "app.py").write_text(
|
|
416
|
+
"def add(left: int, right: int) -> int:\n return left - right\n",
|
|
417
|
+
encoding="utf-8",
|
|
418
|
+
)
|
|
419
|
+
return work_dir
|
|
420
|
+
|
|
421
|
+
|
|
422
|
+
def _live_surface_hash(work_dir: pathlib.Path) -> str:
|
|
423
|
+
merge_base_sha = resolve_merge_base(str(work_dir))
|
|
424
|
+
assert merge_base_sha is not None
|
|
425
|
+
surface_manifest_text = branch_surface_manifest(str(work_dir), merge_base_sha)
|
|
426
|
+
assert surface_manifest_text is not None
|
|
427
|
+
return manifest_sha256(surface_manifest_text)
|
|
428
|
+
|
|
429
|
+
|
|
430
|
+
def _write_workflow_verdict(
|
|
431
|
+
transcript_path: pathlib.Path, bound_manifest_sha256: str
|
|
432
|
+
) -> None:
|
|
433
|
+
subagents_dir = transcript_path.with_suffix("") / "subagents"
|
|
434
|
+
workflow_dir = subagents_dir / "workflows" / "wf_x"
|
|
435
|
+
workflow_dir.mkdir(parents=True)
|
|
436
|
+
verdict_record = {
|
|
437
|
+
"all_pass": True,
|
|
438
|
+
"findings": [],
|
|
439
|
+
"manifest_sha256": bound_manifest_sha256,
|
|
440
|
+
}
|
|
441
|
+
assistant_text = (
|
|
442
|
+
"Verification complete.\n\n```verdict\n"
|
|
443
|
+
+ json.dumps(verdict_record)
|
|
444
|
+
+ "\n```\n"
|
|
445
|
+
)
|
|
446
|
+
assistant_entry = {
|
|
447
|
+
"type": "assistant",
|
|
448
|
+
"message": {"content": [{"type": "text", "text": assistant_text}]},
|
|
449
|
+
}
|
|
450
|
+
(workflow_dir / "agent-01.jsonl").write_text(
|
|
451
|
+
json.dumps(assistant_entry) + "\n", encoding="utf-8"
|
|
452
|
+
)
|
|
453
|
+
(workflow_dir / "agent-01.meta.json").write_text(
|
|
454
|
+
json.dumps({"agentType": "code-verifier"}), encoding="utf-8"
|
|
455
|
+
)
|
|
456
|
+
|
|
457
|
+
|
|
458
|
+
def _isolate_home(monkeypatch: pytest.MonkeyPatch, fake_home: pathlib.Path) -> None:
|
|
459
|
+
home_text = str(fake_home)
|
|
460
|
+
monkeypatch.setenv("HOME", home_text)
|
|
461
|
+
monkeypatch.setenv("USERPROFILE", home_text)
|
|
462
|
+
monkeypatch.delenv("HOMEDRIVE", raising=False)
|
|
463
|
+
monkeypatch.delenv("HOMEPATH", raising=False)
|
|
464
|
+
|
|
465
|
+
|
|
466
|
+
def test_workflow_verdict_allows_commit_without_a_minted_verdict_file(
|
|
467
|
+
monkeypatch: pytest.MonkeyPatch, tmp_path: pathlib.Path
|
|
468
|
+
) -> None:
|
|
469
|
+
fake_home = tmp_path / "home"
|
|
470
|
+
fake_home.mkdir()
|
|
471
|
+
_isolate_home(monkeypatch, fake_home)
|
|
472
|
+
work_dir = _make_gated_repo(tmp_path)
|
|
473
|
+
live_surface_hash = _live_surface_hash(work_dir)
|
|
474
|
+
transcript_path = tmp_path / "projects" / "demo" / "sess1.jsonl"
|
|
475
|
+
transcript_path.parent.mkdir(parents=True)
|
|
476
|
+
transcript_path.write_text("", encoding="utf-8")
|
|
477
|
+
_write_workflow_verdict(transcript_path, live_surface_hash)
|
|
478
|
+
assert (
|
|
479
|
+
deny_reason_for_directory(str(work_dir), str(transcript_path)) is None
|
|
480
|
+
)
|
|
481
|
+
|
|
482
|
+
|
|
483
|
+
def test_no_verdict_of_either_kind_denies_the_commit(
|
|
484
|
+
monkeypatch: pytest.MonkeyPatch, tmp_path: pathlib.Path
|
|
485
|
+
) -> None:
|
|
486
|
+
fake_home = tmp_path / "home"
|
|
487
|
+
fake_home.mkdir()
|
|
488
|
+
_isolate_home(monkeypatch, fake_home)
|
|
489
|
+
work_dir = _make_gated_repo(tmp_path)
|
|
490
|
+
transcript_path = tmp_path / "projects" / "demo" / "sess1.jsonl"
|
|
491
|
+
transcript_path.parent.mkdir(parents=True)
|
|
492
|
+
transcript_path.write_text("", encoding="utf-8")
|
|
493
|
+
deny_reason = deny_reason_for_directory(str(work_dir), str(transcript_path))
|
|
494
|
+
assert deny_reason is not None
|
|
495
|
+
assert "VERIFIED_COMMIT_GATE" in deny_reason
|
|
@@ -0,0 +1,131 @@
|
|
|
1
|
+
"""Unit tests for the verified-commit-message-accuracy PreToolUse hook."""
|
|
2
|
+
|
|
3
|
+
import importlib.util
|
|
4
|
+
import pathlib
|
|
5
|
+
import sys
|
|
6
|
+
|
|
7
|
+
_HOOK_DIR = pathlib.Path(__file__).parent
|
|
8
|
+
if str(_HOOK_DIR) not in sys.path:
|
|
9
|
+
sys.path.insert(0, str(_HOOK_DIR))
|
|
10
|
+
|
|
11
|
+
hook_spec = importlib.util.spec_from_file_location(
|
|
12
|
+
"verified_commit_message_accuracy_blocker",
|
|
13
|
+
_HOOK_DIR / "verified_commit_message_accuracy_blocker.py",
|
|
14
|
+
)
|
|
15
|
+
assert hook_spec is not None
|
|
16
|
+
assert hook_spec.loader is not None
|
|
17
|
+
hook_module = importlib.util.module_from_spec(hook_spec)
|
|
18
|
+
hook_spec.loader.exec_module(hook_module)
|
|
19
|
+
is_guarded_file = hook_module.is_guarded_file
|
|
20
|
+
claims_blanket_comment_exemption = hook_module.claims_blanket_comment_exemption
|
|
21
|
+
extract_written_text = hook_module.extract_written_text
|
|
22
|
+
build_corrective_message = hook_module.build_corrective_message
|
|
23
|
+
|
|
24
|
+
OFFENDING_MESSAGE = (
|
|
25
|
+
"CORRECTIVE_MESSAGE = (\n"
|
|
26
|
+
' "BLOCKED: [VERIFIED_COMMIT_GATE] This branch surface has no passing "\n'
|
|
27
|
+
' "verification verdict. Spawn the code-verifier agent (Agent tool, "\n'
|
|
28
|
+
" \"subagent_type 'code-verifier') with the task texts, the diff scope, \"\n"
|
|
29
|
+
' "and recorded baselines; when it finishes with a clean verdict the "\n'
|
|
30
|
+
' "SubagentStop hook mints the verdict and this command will pass. Any "\n'
|
|
31
|
+
' "file change after verification invalidates the verdict, so verify "\n'
|
|
32
|
+
' "last. Docs-, docstring-, comment-, and test-only surfaces are exempt "\n'
|
|
33
|
+
' "automatically."\n'
|
|
34
|
+
")\n"
|
|
35
|
+
)
|
|
36
|
+
ACCURATE_DOCS_EXEMPTION_MENTIONING_COMMENTS = (
|
|
37
|
+
"Comments inside Python files are stripped; docs are exempt "
|
|
38
|
+
"automatically by extension."
|
|
39
|
+
)
|
|
40
|
+
ACCURATE_MESSAGE = (
|
|
41
|
+
"CORRECTIVE_MESSAGE = (\n"
|
|
42
|
+
' "BLOCKED: [VERIFIED_COMMIT_GATE] ... Docs and images are exempt by "\n'
|
|
43
|
+
' "extension, and Python files whose docstring- and comment-stripped AST "\n'
|
|
44
|
+
' "is unchanged."\n'
|
|
45
|
+
")\n"
|
|
46
|
+
)
|
|
47
|
+
|
|
48
|
+
|
|
49
|
+
def test_constants_file_is_guarded() -> None:
|
|
50
|
+
assert is_guarded_file(
|
|
51
|
+
"/repo/.claude/hooks/blocking/config/verified_commit_constants.py"
|
|
52
|
+
)
|
|
53
|
+
|
|
54
|
+
|
|
55
|
+
def test_unrelated_file_is_not_guarded() -> None:
|
|
56
|
+
assert not is_guarded_file("/repo/.claude/hooks/blocking/gh_body_arg_blocker.py")
|
|
57
|
+
|
|
58
|
+
|
|
59
|
+
def test_blanket_comment_exemption_claim_is_detected() -> None:
|
|
60
|
+
assert claims_blanket_comment_exemption(OFFENDING_MESSAGE)
|
|
61
|
+
|
|
62
|
+
|
|
63
|
+
def test_blanket_claim_detected_regardless_of_leading_words() -> None:
|
|
64
|
+
assert claims_blanket_comment_exemption(
|
|
65
|
+
"Comment-only surfaces are exempt automatically."
|
|
66
|
+
)
|
|
67
|
+
|
|
68
|
+
|
|
69
|
+
def test_accurate_exemption_wording_passes() -> None:
|
|
70
|
+
assert not claims_blanket_comment_exemption(ACCURATE_MESSAGE)
|
|
71
|
+
|
|
72
|
+
|
|
73
|
+
def test_accurate_docs_exemption_mentioning_comments_passes() -> None:
|
|
74
|
+
assert not claims_blanket_comment_exemption(
|
|
75
|
+
ACCURATE_DOCS_EXEMPTION_MENTIONING_COMMENTS
|
|
76
|
+
)
|
|
77
|
+
|
|
78
|
+
|
|
79
|
+
def test_comma_joined_docs_exemption_mentioning_comments_passes() -> None:
|
|
80
|
+
assert not claims_blanket_comment_exemption(
|
|
81
|
+
"Comments are handled, and docs are exempt automatically."
|
|
82
|
+
)
|
|
83
|
+
|
|
84
|
+
|
|
85
|
+
def test_python_ast_clause_mentioning_comments_passes() -> None:
|
|
86
|
+
assert not claims_blanket_comment_exemption(
|
|
87
|
+
"Python comment-stripped AST changes and docs are exempt automatically "
|
|
88
|
+
"by extension"
|
|
89
|
+
)
|
|
90
|
+
|
|
91
|
+
|
|
92
|
+
def test_single_clause_python_ast_exemption_passes() -> None:
|
|
93
|
+
assert not claims_blanket_comment_exemption(
|
|
94
|
+
"Python files whose comment-stripped AST is unchanged are exempt "
|
|
95
|
+
"automatically."
|
|
96
|
+
)
|
|
97
|
+
|
|
98
|
+
|
|
99
|
+
def test_commentary_word_stem_passes() -> None:
|
|
100
|
+
assert not claims_blanket_comment_exemption(
|
|
101
|
+
"Our commentary on the approach is exempt automatically from blame."
|
|
102
|
+
)
|
|
103
|
+
|
|
104
|
+
|
|
105
|
+
def test_corrective_message_names_only_the_two_real_exemptions() -> None:
|
|
106
|
+
corrective_message = build_corrective_message()
|
|
107
|
+
assert "exempt by extension" in corrective_message
|
|
108
|
+
assert "docstring- and comment-stripped AST" in corrective_message
|
|
109
|
+
assert "test file" not in corrective_message
|
|
110
|
+
assert "by name convention" not in corrective_message
|
|
111
|
+
|
|
112
|
+
|
|
113
|
+
def test_message_without_exemption_claim_passes() -> None:
|
|
114
|
+
assert not claims_blanket_comment_exemption(
|
|
115
|
+
'CORRECTIVE_MESSAGE = "Spawn the code-verifier agent to earn a verdict."'
|
|
116
|
+
)
|
|
117
|
+
|
|
118
|
+
|
|
119
|
+
def test_write_content_is_extracted() -> None:
|
|
120
|
+
written_text = extract_written_text({"content": OFFENDING_MESSAGE})
|
|
121
|
+
assert claims_blanket_comment_exemption(written_text)
|
|
122
|
+
|
|
123
|
+
|
|
124
|
+
def test_edit_new_string_is_extracted() -> None:
|
|
125
|
+
written_text = extract_written_text({"new_string": OFFENDING_MESSAGE})
|
|
126
|
+
assert claims_blanket_comment_exemption(written_text)
|
|
127
|
+
|
|
128
|
+
|
|
129
|
+
def test_edit_new_string_with_accurate_wording_is_clean() -> None:
|
|
130
|
+
written_text = extract_written_text({"new_string": ACCURATE_MESSAGE})
|
|
131
|
+
assert not claims_blanket_comment_exemption(written_text)
|