claude-dev-env 1.62.1 → 1.64.0

package/hooks/blocking/config/verified_commit_constants.py

@@ -48,6 +48,7 @@ WRITE_CALL_REGION_PATTERN = (
 VERDICT_KEY_ALL_PASS = "all_pass"
 VERDICT_KEY_MANIFEST_SHA256 = "manifest_sha256"
 VERDICT_KEY_FINDINGS = "findings"
+VERDICT_FILE_GLOB = "*.json"
 SUBAGENTS_DIRECTORY_NAME = "subagents"
 AGENT_TRANSCRIPT_GLOB = "agent-*.jsonl"
 AGENT_META_SIDECAR_SUFFIX = ".meta.json"
@@ -61,6 +62,21 @@ TRANSCRIPT_TEXT_CONTENT_TYPE = "text"
 TRANSCRIPT_TEXT_KEY = "text"
 VERDICT_FENCE_PATTERN = r"```verdict\s*\n(.*?)```"
 MANIFEST_HASH_CLI_FLAG = "--manifest-hash"
+MANIFEST_HASH_FOR_BRANCH_CLI_FLAG = "--manifest-hash-for-branch"
+WORKTREE_LIST_PATH_PREFIX = "worktree "
+WORKTREE_LIST_BRANCH_PREFIX = "branch "
+BRANCH_REFERENCE_PREFIX = "refs/heads/"
+EMPTY_SURFACE_GUARD_MESSAGE = (
+    "ERROR: The work tree at {repo_root} has no changed or untracked files "
+    "versus origin/main (empty change surface). This work tree holds nothing "
+    "to verify — you are pointed at the wrong work tree. Run `git worktree list` "
+    "to see all checked-out work trees and target the one on the branch under review."
+)
+BRANCH_WORKTREE_ABSENT_MESSAGE = (
+    "ERROR: No work tree has branch '{branch}' checked out. "
+    "Check it out in a work tree first: "
+    "`git worktree add <path> <branch>` or `git checkout <branch>`."
+)
 DOCS_ONLY_EXTENSIONS = frozenset(
     {".md", ".txt", ".rst", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp", ".ico"}
 )

package/hooks/blocking/test_code_rules_enforcer_dead_argparse_argument.py

@@ -0,0 +1,534 @@
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+
+ENFORCER_PATH = Path(__file__).resolve().parent / "code_rules_enforcer.py"
+specification = importlib.util.spec_from_file_location("code_rules_enforcer", ENFORCER_PATH)
+assert specification is not None and specification.loader is not None
+code_rules_enforcer = importlib.util.module_from_spec(specification)
+specification.loader.exec_module(code_rules_enforcer)
+
+PRODUCTION_FILE_PATH = "packages/app/services/render_report.py"
+TEST_FILE_PATH = "packages/app/services/test_render_report.py"
+MIGRATION_FILE_PATH = "packages/app/migrations/0001_initial.py"
+
+
+def _check(source: str, file_path: str) -> list[str]:
+    return code_rules_enforcer.check_dead_argparse_arguments(source, file_path)
+
+
+def test_should_flag_optional_argument_whose_dest_is_never_read() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    print('done')\n"
+    )
+    issues = _check(source, PRODUCTION_FILE_PATH)
+    assert any("'repo'" in each_issue for each_issue in issues), (
+        f"Expected dead '--repo' argument flagged, got: {issues}"
+    )
+    assert any("Line 5" in each_issue for each_issue in issues), (
+        f"Expected the add_argument line reported, got: {issues}"
+    )
+
+
+def test_should_not_flag_when_dest_is_read_via_attribute_access() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> str:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    return parsed_arguments.repo\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_not_flag_a_positional_argument() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('path')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    print('done')\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_not_flag_help_action_argument() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser(add_help=False)\n"
+        "    argument_parser.add_argument('--help', action='help')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    print('done')\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_not_flag_version_action_argument() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--version', action='version', version='1.0')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    print('done')\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_respect_explicit_dest_when_unread() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', dest='repository')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    print('done')\n"
+    )
+    issues = _check(source, PRODUCTION_FILE_PATH)
+    assert any("'repository'" in each_issue for each_issue in issues), (
+        f"Expected the explicit dest flagged, got: {issues}"
+    )
+    assert not any("'repo'" in each_issue for each_issue in issues), (
+        f"The option string must not be flagged when dest is explicit, got: {issues}"
+    )
+
+
+def test_should_respect_explicit_dest_when_read() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> str:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', dest='repository')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    return parsed_arguments.repository\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_skip_argument_with_non_literal_dest() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "DEST_NAME = 'repository'\n"
+        "\n"
+        "def build() -> str:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', dest=DEST_NAME)\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    return parsed_arguments.repository\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_derive_dest_from_dashed_long_option() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> bool:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--dry-run', action='store_true')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    return parsed_arguments.dry_run\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_flag_dashed_long_option_when_dest_unread() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--dry-run', action='store_true')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    print('done')\n"
+    )
+    issues = _check(source, PRODUCTION_FILE_PATH)
+    assert any("'dry_run'" in each_issue for each_issue in issues), (
+        f"Expected the dashed long option dest flagged, got: {issues}"
+    )
+
+
+def test_should_derive_dest_from_long_option_when_short_precedes() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('-r', '--repo')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    print('done')\n"
+    )
+    issues = _check(source, PRODUCTION_FILE_PATH)
+    assert any("'repo'" in each_issue for each_issue in issues), (
+        f"Expected dest derived from the long option, got: {issues}"
+    )
+
+
+def test_should_suppress_when_namespace_is_forwarded_to_a_call() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def run(parsed_arguments: argparse.Namespace) -> None:\n"
+        "    print('run')\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    run(parsed_arguments)\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_tuple_unpacked_namespace_is_forwarded() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def main(parsed_arguments: argparse.Namespace) -> None:\n"
+        "    print('run')\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--verbose', action='store_true')\n"
+        "    parsed_arguments, remaining = argument_parser.parse_known_args()\n"
+        "    main(parsed_arguments)\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_aliased_namespace_is_forwarded() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def run(parsed_arguments: argparse.Namespace) -> None:\n"
+        "    print('run')\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    alias = parsed_arguments\n"
+        "    run(alias)\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_namespace_consumed_by_vars() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> dict:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    return vars(parsed_arguments)\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_namespace_dict_accessed() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> dict:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    return parsed_arguments.__dict__\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_be_silent_for_test_files() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    print('done')\n"
+    )
+    assert _check(source, TEST_FILE_PATH) == []
+
+
+def test_should_be_silent_for_migration_files() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    print('done')\n"
+    )
+    assert _check(source, MIGRATION_FILE_PATH) == []
+
+
+def test_should_tolerate_syntax_error() -> None:
+    assert _check("def broken(:\n", PRODUCTION_FILE_PATH) == []
+
+
+def test_should_return_empty_when_no_add_argument_present() -> None:
+    source = "def build() -> int:\n    return 1\n"
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_namespace_unpacked_with_double_star() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def run(repo: str) -> None:\n"
+        "    print(repo)\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    run(**vars(parsed_arguments))\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_not_flag_when_dest_read_via_literal_getattr() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> str:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    return getattr(parsed_arguments, 'repo')\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_namespace_stored_on_attribute_target() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "class App:\n"
+        "    def build(self) -> None:\n"
+        "        argument_parser = argparse.ArgumentParser()\n"
+        "        argument_parser.add_argument('--repo', default='.')\n"
+        "        argument_parser.add_argument('--verbose', action='store_true')\n"
+        "        self.parsed_arguments = argument_parser.parse_args()\n"
+        "\n"
+        "    def run(self) -> dict:\n"
+        "        return dict(**vars(self.parsed_arguments))\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_parse_method_is_aliased() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def run(parsed_arguments: argparse.Namespace) -> None:\n"
+        "    print('run')\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parse = argument_parser.parse_args\n"
+        "    parsed_arguments = parse()\n"
+        "    run(parsed_arguments)\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_namespace_forwarded_inside_container() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def run(payload: dict) -> None:\n"
+        "    print('run')\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    run({'args': parsed_arguments})\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_namespace_keyword_object_is_consumed() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> dict:\n"
+        "    options = argparse.Namespace()\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    argument_parser.parse_args(namespace=options)\n"
+        "    return vars(options)\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_namespace_keyword_object_is_forwarded() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def run(parsed_arguments: argparse.Namespace) -> None:\n"
+        "    print('run')\n"
+        "\n"
+        "def build() -> None:\n"
+        "    options = argparse.Namespace()\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    argument_parser.parse_args(namespace=options)\n"
+        "    run(options)\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_flag_when_namespace_keyword_object_only_attribute_read() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> str:\n"
+        "    options = argparse.Namespace()\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    argument_parser.add_argument('--verbose', action='store_true')\n"
+        "    argument_parser.parse_args(namespace=options)\n"
+        "    return options.repo\n"
+    )
+    issues = _check(source, PRODUCTION_FILE_PATH)
+    assert any("'verbose'" in each_issue for each_issue in issues), (
+        f"Expected the unread '--verbose' flag flagged, got: {issues}"
+    )
+    assert not any("'repo'" in each_issue for each_issue in issues), (
+        f"The read namespace= attribute must not be flagged, got: {issues}"
+    )
+
+
+def test_should_suppress_when_parse_result_consumed_by_vars_inline() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> dict:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    return vars(argument_parser.parse_args())\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_parse_result_returned_inline() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> argparse.Namespace:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    return argument_parser.parse_args()\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_parse_result_double_star_unpacked_inline() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def run(repo: str) -> None:\n"
+        "    print(repo)\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    run(**vars(argument_parser.parse_args()))\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_flag_when_annotated_namespace_dest_is_unread() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments: argparse.Namespace = argument_parser.parse_args()\n"
+        "    print('done')\n"
+    )
+    issues = _check(source, PRODUCTION_FILE_PATH)
+    assert any("'repo'" in each_issue for each_issue in issues), (
+        f"Expected the dead flag flagged through the annotated binding, got: {issues}"
+    )
+
+
+def test_should_not_flag_when_annotated_namespace_dest_is_read() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> str:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments: argparse.Namespace = argument_parser.parse_args()\n"
+        "    return parsed_arguments.repo\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_annotated_namespace_is_forwarded() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def run(parsed_arguments: argparse.Namespace) -> None:\n"
+        "    print('run')\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments: argparse.Namespace = argument_parser.parse_args()\n"
+        "    run(parsed_arguments)\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_should_suppress_when_parse_result_bound_by_walrus() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> dict:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    return vars(parsed_arguments := argument_parser.parse_args())\n"
+    )
+    assert _check(source, PRODUCTION_FILE_PATH) == []
+
+
+def test_validate_content_runs_dead_argparse_check() -> None:
+    source = (
+        "import argparse\n"
+        "\n"
+        "def build() -> None:\n"
+        "    argument_parser = argparse.ArgumentParser()\n"
+        "    argument_parser.add_argument('--repo', default='.')\n"
+        "    parsed_arguments = argument_parser.parse_args()\n"
+        "    print('done')\n"
+    )
+    issues = code_rules_enforcer.validate_content(source, PRODUCTION_FILE_PATH)
+    assert any("'repo'" in each_issue for each_issue in issues), (
+        f"Expected the enforcer dispatch to surface the dead argument, got: {issues}"
+    )