claude-dev-env 1.83.0 → 1.85.0

package/skills/bugteam/scripts/test__bugteam_permissions_common.py

@@ -1,160 +0,0 @@
-"""TDD-pair tests for the underscore-prefixed _bugteam_permissions_common module.
-
-The TDD enforcer matches a production filename ``X.py`` to ``test_X.py``;
-``_bugteam_permissions_common.py`` carries a leading underscore that the
-enforcer treats as part of the name. This file's tests are the canonical
-match. The broader behavioral suite continues to live alongside, in
-``test_bugteam_permissions_common.py``.
-"""
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-from unittest.mock import patch
-
-import pytest
-
-_script_directory = str(Path(__file__).resolve().parent)
-if _script_directory not in sys.path:
-    sys.path.insert(0, _script_directory)
-
-import _bugteam_permissions_common as common_module
-import grant_project_claude_permissions as grant_module
-import revoke_project_claude_permissions as revoke_module
-
-
-def test_is_valid_project_root_not_defined_on_common_module() -> None:
-    """The common module must not expose ``is_valid_project_root``.
-
-    Both grant and revoke define their own local copy. A shared copy on
-    the common module would be a third parallel definition with no
-    production caller, so its absence is the asserted contract.
-    """
-    assert not hasattr(common_module, "is_valid_project_root")
-
-
-def test_grant_is_valid_project_root_detects_git_marker(tmp_path: Path) -> None:
-    git_project_root = tmp_path / "git_project"
-    (git_project_root / ".git").mkdir(parents=True)
-    assert grant_module.is_valid_project_root(git_project_root) is True
-
-
-def test_grant_is_valid_project_root_detects_claude_marker(tmp_path: Path) -> None:
-    claude_project_root = tmp_path / "claude_project"
-    (claude_project_root / ".claude").mkdir(parents=True)
-    assert grant_module.is_valid_project_root(claude_project_root) is True
-
-
-def test_grant_is_valid_project_root_rejects_unmarked_directory(tmp_path: Path) -> None:
-    unmarked_directory = tmp_path / "no_marker"
-    unmarked_directory.mkdir()
-    assert grant_module.is_valid_project_root(unmarked_directory) is False
-
-
-def test_revoke_is_valid_project_root_detects_git_marker(tmp_path: Path) -> None:
-    git_project_root = tmp_path / "git_project"
-    (git_project_root / ".git").mkdir(parents=True)
-    assert revoke_module.is_valid_project_root(git_project_root) is True
-
-
-def test_revoke_is_valid_project_root_detects_claude_marker(tmp_path: Path) -> None:
-    claude_project_root = tmp_path / "claude_project"
-    (claude_project_root / ".claude").mkdir(parents=True)
-    assert revoke_module.is_valid_project_root(claude_project_root) is True
-
-
-def test_revoke_is_valid_project_root_rejects_unmarked_directory(tmp_path: Path) -> None:
-    unmarked_directory = tmp_path / "no_marker"
-    unmarked_directory.mkdir()
-    assert revoke_module.is_valid_project_root(unmarked_directory) is False
-
-
-def test_write_atomically_with_mode_releases_fd_when_fdopen_raises(
-    tmp_path: Path,
-) -> None:
-    """A failure inside os.fdopen must close the raw file descriptor."""
-    target_path = tmp_path / "settings.json.tmp"
-    with patch.object(
-        common_module.os, "fdopen", side_effect=MemoryError("fdopen failure")
-    ):
-        with pytest.raises(MemoryError):
-            common_module.write_atomically_with_mode(
-                target_path, "payload", file_mode=0o600
-            )
-
-
-def test_get_mode_to_preserve_returns_existing_file_mode(
-    tmp_path: Path,
-) -> None:
-    """When the file exists, the actual filesystem mode must be returned (not the default)."""
-    target_path = tmp_path / "settings.json"
-    target_path.write_text("{}", encoding="utf-8")
-    actual_filesystem_mode = target_path.stat().st_mode & 0o777
-    returned_mode = common_module.get_mode_to_preserve(target_path)
-    assert returned_mode == actual_filesystem_mode
-
-
-def test_write_atomically_with_mode_raises_oserror_when_open_fails(
-    tmp_path: Path,
-) -> None:
-    """OSError from os.open must propagate (no fd leak path to test here)."""
-    target_path = tmp_path / "subdirectory" / "missing" / "settings.json.tmp"
-    with pytest.raises(OSError):
-        common_module.write_atomically_with_mode(
-            target_path, "payload", file_mode=0o600
-        )
-
-
-def test_write_atomically_unlinks_temp_when_fdopen_raises(
-    tmp_path: Path,
-) -> None:
-    """A failure inside os.fdopen must remove the on-disk temp file.
-
-    Regression for loop1-9: the file existed the moment os.open returned,
-    but the OSError/MemoryError handler only closed the raw FD — leaving an
-    empty .tmp sibling on disk after the exception propagated up to
-    save_settings, where the unlink in the finally block was skipped because
-    `is_temp_owned_by_this_invocation` had not yet been set.
-    """
-    target_path = tmp_path / "settings.json.tmp"
-    with patch.object(
-        common_module.os, "fdopen", side_effect=MemoryError("fdopen failure")
-    ):
-        with pytest.raises(MemoryError):
-            common_module.write_atomically_with_mode(
-                target_path, "payload", file_mode=0o600
-            )
-    assert not target_path.exists(), (
-        "the temp file created by os.open must be unlinked before re-raising"
-    )
-
-
-def test_save_settings_uses_pid_keyed_temp_suffix(tmp_path: Path) -> None:
-    """Concurrent save_settings invocations must not race on a deterministic temp name.
-
-    Regression for loop1-10: building the temp path as `settings.json.tmp` is
-    deterministic and unkeyed by PID, so two parallel /bugteam invocations
-    racing on Step 0 (grant) or Step 5 (revoke) collide on O_CREAT|O_EXCL —
-    the second caller hits FileExistsError and the OSError handler hard-exits,
-    silently dropping that PR's permission grant.
-    """
-    settings_path = tmp_path / "settings.json"
-    settings_path.write_text("{}", encoding="utf-8")
-    captured_temp_paths: list[str] = []
-    real_open = common_module.os.open
-
-    def capturing_open(target: str, *args: object, **kwargs: object) -> int:
-        captured_temp_paths.append(target)
-        return real_open(target, *args, **kwargs)
-
-    with patch.object(common_module.os, "open", side_effect=capturing_open):
-        common_module.save_settings(settings_path, {"first": True})
-        common_module.save_settings(settings_path, {"second": True})
-    assert len(captured_temp_paths) == 2
-    assert all(
-        str(common_module.os.getpid()) in each_temp_path
-        for each_temp_path in captured_temp_paths
-    ), (
-        "temp filename must include os.getpid() so concurrent runs do not "
-        f"collide on a deterministic name; saw: {captured_temp_paths!r}"
-    )

package/skills/bugteam/scripts/test_agent_config_carveout.py

@@ -1,356 +0,0 @@
-"""Behavior tests for the agent-config carve-out and stale-trust-entry purge.
-
-Covers two Bugbot findings on PR #467:
-  - Deny rules must be written to permissions.deny so agent-config edits
-    require explicit per-edit user approval.
-  - Trust entries in autoMode.environment must be purged on grant
-    (preventing accumulation across template revisions) and removed on
-    revoke regardless of the exact template wording.
-"""
-
-from __future__ import annotations
-
-import json
-import sys
-from pathlib import Path
-from typing import Any
-
-import pytest
-
-_script_directory = str(Path(__file__).resolve().parent)
-if _script_directory not in sys.path:
-    sys.path.insert(0, _script_directory)
-
-import _bugteam_permissions_common as common_module
-import grant_project_claude_permissions as grant_module
-import revoke_project_claude_permissions as revoke_module
-from bugteam_scripts_constants.claude_permissions_common_constants import (
-    ALL_AGENT_CONFIG_DENY_TOOLS,
-    ALL_AGENT_CONFIG_PATH_PATTERNS,
-    ALL_PERMISSION_ALLOW_TOOLS,
-    AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE,
-)
-
-
-def _make_fake_project(tmp_path: Path) -> Path:
-    fake_project_root = tmp_path / "fake_project"
-    (fake_project_root / ".claude").mkdir(parents=True)
-    return fake_project_root
-
-
-def _project_path_as_posix(fake_project_root: Path) -> str:
-    return str(fake_project_root).replace("\\", "/")
-
-
-def _redirect_settings_to_fake_path(
-    fake_settings_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    fake_home_directory = fake_settings_path.parent.parent
-    monkeypatch.setattr(Path, "home", classmethod(lambda _cls: fake_home_directory))
-
-
-def _prepare_fake_home(tmp_path: Path) -> Path:
-    fake_home_directory = tmp_path / "fake_home"
-    claude_settings_directory = fake_home_directory / ".claude"
-    claude_settings_directory.mkdir(parents=True)
-    return claude_settings_directory / "settings.json"
-
-
-def _seed_grant_then_run(
-    fake_settings_path: Path,
-    fake_project_root: Path,
-    monkeypatch: pytest.MonkeyPatch,
-    pre_existing_settings: dict[str, Any],
-) -> None:
-    fake_settings_path.write_text(json.dumps(pre_existing_settings), encoding="utf-8")
-    _redirect_settings_to_fake_path(fake_settings_path, monkeypatch)
-    monkeypatch.chdir(fake_project_root)
-    grant_module.grant_permissions_for_current_directory()
-
-
-def _seed_revoke_then_run(
-    fake_settings_path: Path,
-    fake_project_root: Path,
-    monkeypatch: pytest.MonkeyPatch,
-    pre_existing_settings: dict[str, Any],
-) -> None:
-    fake_settings_path.write_text(json.dumps(pre_existing_settings), encoding="utf-8")
-    _redirect_settings_to_fake_path(fake_settings_path, monkeypatch)
-    monkeypatch.chdir(fake_project_root)
-    revoke_module.revoke_permissions_for_current_directory()
-
-
-def test_grant_writes_deny_rules_for_every_tool_and_pattern(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
-) -> None:
-    fake_project_root = _make_fake_project(tmp_path)
-    fake_settings_path = _prepare_fake_home(tmp_path)
-    _seed_grant_then_run(
-        fake_settings_path, fake_project_root, monkeypatch, pre_existing_settings={}
-    )
-    capsys.readouterr()
-    written_settings = json.loads(fake_settings_path.read_text(encoding="utf-8"))
-    deny_list = written_settings["permissions"]["deny"]
-    project_path_posix = _project_path_as_posix(fake_project_root)
-    for each_tool in ALL_AGENT_CONFIG_DENY_TOOLS:
-        for each_pattern in ALL_AGENT_CONFIG_PATH_PATTERNS:
-            expected_rule = f"{each_tool}({project_path_posix}/.claude/{each_pattern})"
-            assert expected_rule in deny_list, (
-                f"deny list missing expected rule {expected_rule!r}"
-            )
-
-
-def test_grant_writes_glob_deny_rules_for_every_agent_config_pattern(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
-) -> None:
-    """Glob must be in the deny tuple so agent-config paths require approval.
-
-    The AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE promises Edit/Write/Read/Glob
-    trust EXCEPT for agent-config files. Glob deny rules are how the EXCEPT
-    clause is honored for the Glob tool.
-    """
-    fake_project_root = _make_fake_project(tmp_path)
-    fake_settings_path = _prepare_fake_home(tmp_path)
-    _seed_grant_then_run(
-        fake_settings_path, fake_project_root, monkeypatch, pre_existing_settings={}
-    )
-    capsys.readouterr()
-    written_settings = json.loads(fake_settings_path.read_text(encoding="utf-8"))
-    deny_list = written_settings["permissions"]["deny"]
-    project_path_posix = _project_path_as_posix(fake_project_root)
-    assert "Glob" in ALL_AGENT_CONFIG_DENY_TOOLS
-    assert "Glob" not in ALL_PERMISSION_ALLOW_TOOLS
-    for each_pattern in ALL_AGENT_CONFIG_PATH_PATTERNS:
-        expected_glob_rule = f"Glob({project_path_posix}/.claude/{each_pattern})"
-        assert expected_glob_rule in deny_list, (
-            f"deny list missing expected Glob rule {expected_glob_rule!r}"
-        )
-
-
-def test_grant_purges_stale_trust_entries_then_writes_current_template(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
-) -> None:
-    fake_project_root = _make_fake_project(tmp_path)
-    fake_settings_path = _prepare_fake_home(tmp_path)
-    project_path_posix = _project_path_as_posix(fake_project_root)
-    stale_entry_a = (
-        f"Trusted local workspace: {project_path_posix}/.claude/** old wording form A"
-    )
-    stale_entry_b = (
-        f"Trusted local workspace: {project_path_posix}/.claude/** "
-        f"different earlier wording"
-    )
-    unrelated_entry = "Some unrelated environment hint"
-    pre_existing_settings: dict[str, Any] = {
-        "autoMode": {
-            "environment": [stale_entry_a, stale_entry_b, unrelated_entry],
-        },
-    }
-    _seed_grant_then_run(
-        fake_settings_path,
-        fake_project_root,
-        monkeypatch,
-        pre_existing_settings=pre_existing_settings,
-    )
-    captured = capsys.readouterr()
-    written_settings = json.loads(fake_settings_path.read_text(encoding="utf-8"))
-    environment_list = written_settings["autoMode"]["environment"]
-    assert stale_entry_a not in environment_list
-    assert stale_entry_b not in environment_list
-    assert unrelated_entry in environment_list
-    matching_trust_entries = [
-        each_entry
-        for each_entry in environment_list
-        if isinstance(each_entry, str)
-        and each_entry.startswith("Trusted local workspace:")
-        and f"{project_path_posix}/.claude/**" in each_entry
-    ]
-    assert len(matching_trust_entries) == 1
-    assert "Stale auto-mode environment entries purged" in captured.out
-
-
-def test_revoke_removes_deny_rules(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
-) -> None:
-    fake_project_root = _make_fake_project(tmp_path)
-    fake_settings_path = _prepare_fake_home(tmp_path)
-    project_path_posix = _project_path_as_posix(fake_project_root)
-    all_deny_rules = common_module.build_agent_config_deny_rules(
-        project_path_posix,
-        ALL_AGENT_CONFIG_DENY_TOOLS,
-        ALL_AGENT_CONFIG_PATH_PATTERNS,
-    )
-    pre_existing_settings: dict[str, Any] = {
-        "permissions": {
-            "deny": list(all_deny_rules),
-        },
-    }
-    _seed_revoke_then_run(
-        fake_settings_path,
-        fake_project_root,
-        monkeypatch,
-        pre_existing_settings=pre_existing_settings,
-    )
-    capsys.readouterr()
-    written_settings = json.loads(fake_settings_path.read_text(encoding="utf-8"))
-    permissions_section = written_settings.get("permissions", {})
-    remaining_deny_list = permissions_section.get("deny", [])
-    for each_rule in all_deny_rules:
-        assert each_rule not in remaining_deny_list
-
-
-def test_revoke_removes_every_legacy_trust_entry_for_project(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    fake_project_root = _make_fake_project(tmp_path)
-    fake_settings_path = _prepare_fake_home(tmp_path)
-    project_path_posix = _project_path_as_posix(fake_project_root)
-    legacy_entry_a = (
-        f"Trusted local workspace: {project_path_posix}/.claude/** template revision A"
-    )
-    legacy_entry_b = (
-        f"Trusted local workspace: {project_path_posix}/.claude/** template revision B"
-    )
-    unrelated_other_project_entry = (
-        "Trusted local workspace: /some/other/project/.claude/** still valid"
-    )
-    pre_existing_settings: dict[str, Any] = {
-        "autoMode": {
-            "environment": [
-                legacy_entry_a,
-                legacy_entry_b,
-                unrelated_other_project_entry,
-            ],
-        },
-    }
-    _seed_revoke_then_run(
-        fake_settings_path,
-        fake_project_root,
-        monkeypatch,
-        pre_existing_settings=pre_existing_settings,
-    )
-    written_settings = json.loads(fake_settings_path.read_text(encoding="utf-8"))
-    environment_list = written_settings.get("autoMode", {}).get("environment", [])
-    assert legacy_entry_a not in environment_list
-    assert legacy_entry_b not in environment_list
-    assert unrelated_other_project_entry in environment_list
-
-
-def test_template_constant_documents_agent_config_carveout() -> None:
-    assert "agent-config files always require explicit per-edit user approval" in (
-        AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE
-    )
-
-
-def test_is_trust_entry_for_project_predicate_filters_by_prefix_and_project_path() -> (
-    None
-):
-    project_path_posix = "/fake/proj"
-    trust_prefix = "Trusted local workspace:"
-    non_string_value: object = 42
-    assert (
-        common_module.is_trust_entry_for_project(
-            non_string_value, project_path_posix, trust_prefix
-        )
-        is False
-    )
-    wrong_prefix_entry = (
-        f"Something else: {project_path_posix}/.claude/** with marker token"
-    )
-    assert (
-        common_module.is_trust_entry_for_project(
-            wrong_prefix_entry, project_path_posix, trust_prefix
-        )
-        is False
-    )
-    different_project_entry = (
-        "Trusted local workspace: /other/project/.claude/** unrelated"
-    )
-    assert (
-        common_module.is_trust_entry_for_project(
-            different_project_entry, project_path_posix, trust_prefix
-        )
-        is False
-    )
-    matching_entry = (
-        f"Trusted local workspace: {project_path_posix}/.claude/** any wording form"
-    )
-    assert (
-        common_module.is_trust_entry_for_project(
-            matching_entry, project_path_posix, trust_prefix
-        )
-        is True
-    )
-
-
-def test_is_trust_entry_rejects_cross_project_path_suffix_collision() -> None:
-    """When the project_path is a path suffix of an unrelated entry's path,
-    the predicate must reject the unrelated entry (the boundary anchor case)."""
-    short_project_path = "/projects/foo"
-    trust_prefix = "Trusted local workspace:"
-    longer_unrelated_path_entry = (
-        "Trusted local workspace: /Users/jon/projects/foo/.claude/** unrelated path"
-    )
-    assert (
-        common_module.is_trust_entry_for_project(
-            longer_unrelated_path_entry, short_project_path, trust_prefix
-        )
-        is False
-    )
-    quoted_matching_entry = (
-        f'Trusted local workspace: "{short_project_path}/.claude/**" quoted form'
-    )
-    assert (
-        common_module.is_trust_entry_for_project(
-            quoted_matching_entry, short_project_path, trust_prefix
-        )
-        is True
-    )
-
-
-def test_second_grant_is_idempotent_when_no_other_settings_changed(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
-) -> None:
-    """Running grant twice in a row must perform zero changes the second time.
-
-    On the second call the existing trust entry is byte-identical to the
-    freshly-formatted current entry, so purge_stale_trust_entries treats it as
-    protected and does not remove it; add_auto_mode_environment_entry then
-    no-ops because the entry is already present.
-    """
-    fake_project_root = _make_fake_project(tmp_path)
-    fake_settings_path = _prepare_fake_home(tmp_path)
-    _seed_grant_then_run(
-        fake_settings_path, fake_project_root, monkeypatch, pre_existing_settings={}
-    )
-    first_run_output = capsys.readouterr()
-    assert "No changes needed" not in first_run_output.out
-    _redirect_settings_to_fake_path(fake_settings_path, monkeypatch)
-    monkeypatch.chdir(fake_project_root)
-    grant_module.grant_permissions_for_current_directory()
-    second_run_output = capsys.readouterr()
-    assert "No changes needed; settings file left untouched." in second_run_output.out
-    assert "Stale auto-mode environment entries purged" not in second_run_output.out
-
-
-def test_template_derives_human_readable_pattern_list_from_pattern_tuple() -> None:
-    """Every pattern in ALL_AGENT_CONFIG_PATH_PATTERNS must surface in the
-    rendered template through its derived human-readable form, and the
-    template must still expose the {project_path} placeholder for .format()
-    substitution at runtime."""
-    template_text: str = AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE
-    assert "{project_path}" in template_text
-    for each_pattern in ALL_AGENT_CONFIG_PATH_PATTERNS:
-        if each_pattern.endswith("/**"):
-            directory_name = each_pattern[: -len("/**")]
-            expected_phrase = f"anything under {directory_name}/"
-        elif each_pattern == "mcp.json":
-            expected_phrase = "the mcp.json file"
-        else:
-            expected_phrase = each_pattern
-        assert expected_phrase in template_text, (
-            f"template missing derived phrase for pattern {each_pattern!r}: "
-            f"expected {expected_phrase!r}"
-        )
-    rendered_template_text = template_text.format(project_path="/tmp/x")
-    assert "/tmp/x" in rendered_template_text

package/skills/bugteam/scripts/test_bugteam_permissions_common.py

@@ -1,140 +0,0 @@
-import sys
-from pathlib import Path
-from unittest.mock import patch
-
-import pytest
-
-_script_directory = str(Path(__file__).resolve().parent)
-if _script_directory not in sys.path:
-    sys.path.insert(0, _script_directory)
-
-import _bugteam_permissions_common as common_module
-from _bugteam_permissions_common import (
-    build_permission_rule,
-    get_current_project_path,
-    path_contains_glob_metacharacters,
-    save_settings,
-)
-from bugteam_scripts_constants.claude_permissions_common_constants import DEFAULT_SETTINGS_FILE_MODE
-import grant_project_claude_permissions as grant_module
-import revoke_project_claude_permissions as revoke_module
-
-
-def test_return_normalized_path_when_cwd_contains_spaces(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    directory_with_spaces = tmp_path / "dir with spaces"
-    directory_with_spaces.mkdir()
-    monkeypatch.chdir(directory_with_spaces)
-    returned_project_path = get_current_project_path()
-    expected_suffix = "/dir with spaces"
-    assert returned_project_path.endswith(expected_suffix)
-    assert "\\" not in returned_project_path
-    built_rule = build_permission_rule("Edit", returned_project_path)
-    assert built_rule.startswith("Edit(")
-    assert built_rule.endswith("/.claude/**)")
-    assert "dir with spaces" in built_rule
-
-
-def test_raise_when_cwd_contains_glob_metacharacters(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    directory_with_star = tmp_path / "weird[dir]"
-    directory_with_star.mkdir()
-    monkeypatch.chdir(directory_with_star)
-    with pytest.raises(ValueError, match="glob metacharacters"):
-        get_current_project_path()
-
-
-def test_flag_glob_metacharacters_in_any_position() -> None:
-    assert path_contains_glob_metacharacters("/home/user/[dir]/project")
-    assert path_contains_glob_metacharacters("/home/user/project*")
-    assert not path_contains_glob_metacharacters("/home/user/dir with spaces")
-
-
-def test_save_settings_logs_when_temp_unlink_fails(
-    tmp_path: Path, capsys: pytest.CaptureFixture[str]
-) -> None:
-    """A swallowed unlink in the finally block must surface to stderr.
-
-    Forces a write success followed by os.replace failure so the temp file
-    survives into the finally branch, then makes Path.unlink raise.
-    """
-    settings_path = tmp_path / "settings.json"
-    settings_path.write_text('{"existing": true}\n', encoding="utf-8")
-
-    def failing_replace(*_args: object, **_kwargs: object) -> None:
-        raise OSError("replace blocked by AV")
-
-    def failing_unlink(self: Path, *args: object, **kwargs: object) -> None:
-        raise PermissionError("temp file held by AV")
-
-    with patch.object(common_module.os, "replace", failing_replace):
-        with patch.object(Path, "unlink", failing_unlink):
-            with pytest.raises(SystemExit):
-                save_settings(settings_path, {"new_key": "value"})
-    captured = capsys.readouterr()
-    assert ".tmp" in captured.err
-    assert "PermissionError" in captured.err or "held by AV" in captured.err
-
-
-def test_save_settings_finally_skips_unlink_when_no_temp_was_created(
-    tmp_path: Path,
-) -> None:
-    """When this invocation never created the temp file, finally must not unlink it."""
-    settings_path = tmp_path / "settings.json"
-    settings_path.write_text('{"existing": true}\n', encoding="utf-8")
-
-    unlink_call_paths: list[Path] = []
-    original_unlink = Path.unlink
-
-    def recording_unlink(self: Path, *args: object, **kwargs: object) -> None:
-        unlink_call_paths.append(self)
-        original_unlink(self, *args, **kwargs)
-
-    def write_raises(*_args: object, **_kwargs: object) -> None:
-        raise FileExistsError("another writer's temp")
-
-    with patch.object(common_module, "write_atomically_with_mode", write_raises):
-        with patch.object(Path, "unlink", recording_unlink):
-            with pytest.raises(SystemExit):
-                common_module.save_settings(settings_path, {"new_key": "value"})
-    assert all(
-        each_path.suffix != ".tmp"
-        for each_path in unlink_call_paths
-    ), (
-        "finally must not unlink a temp file this invocation never created"
-    )
-
-
-def test_default_settings_file_mode_used_when_settings_file_missing(
-    tmp_path: Path,
-) -> None:
-    """get_mode_to_preserve must fall back to DEFAULT_SETTINGS_FILE_MODE."""
-    missing_settings_path = tmp_path / "no_such_file.json"
-    returned_mode = common_module.get_mode_to_preserve(missing_settings_path)
-    assert returned_mode == DEFAULT_SETTINGS_FILE_MODE
-
-
-def test_is_valid_project_root_exported_from_consumer_modules(
-    tmp_path: Path,
-) -> None:
-    """is_valid_project_root behaviour matches across both consumers.
-
-    Grant and revoke each define their own local copy of the helper, so
-    both copies must agree on the .git / .claude marker contract.
-    """
-    git_marker_project_root = tmp_path / "git_project"
-    (git_marker_project_root / ".git").mkdir(parents=True)
-    claude_marker_project_root = tmp_path / "claude_project"
-    (claude_marker_project_root / ".claude").mkdir(parents=True)
-    bare_directory = tmp_path / "no_marker"
-    bare_directory.mkdir()
-    assert grant_module.is_valid_project_root(git_marker_project_root) is True
-    assert grant_module.is_valid_project_root(claude_marker_project_root) is True
-    assert grant_module.is_valid_project_root(bare_directory) is False
-    assert revoke_module.is_valid_project_root(git_marker_project_root) is True
-    assert revoke_module.is_valid_project_root(claude_marker_project_root) is True
-    assert revoke_module.is_valid_project_root(bare_directory) is False
-
-

package/skills/doc-gist/CLAUDE.md

@@ -1,25 +0,0 @@
-# doc-gist
-
-Designs fresh HTML artifacts and publishes them as secret GitHub gists with a shareable htmlpreview URL. Triggered by `/doc-gist`, `publish this`, `share as a gist`, `open this as a webpage`, `make me a writeup`, or any request ending in a shareable HTML preview URL.
-
-## Purpose
-
-The skill ships transport, not templates. For each request the model designs a fresh HTML artifact suited to the work, marks it with `<!-- @publish-as-gist -->`, and writes it to disk. A PostToolUse hook (`hooks/workflow/doc_gist_auto_publish.py`) spots the marker, runs `packages/claude-dev-env/skills/doc-gist/scripts/gist_upload.py`, and prints the gist and htmlpreview URLs into the tool output for the user to click.
-
-## Key files
-
-| File | Purpose |
-|---|---|
-| `SKILL.md` | Full instructions: the auto-publish hook flow, the transport script CLI, a gallery-to-artifact-type mapping table, and gotchas (`gh` auth, marker syntax, self-contained HTML only, secret-not-private note). |
-
-## Subdirectories
-
-| Directory | Role |
-|---|---|
-| `references/` | Reference material — the example HTML gallery and related docs. |
-| `scripts/` | The `gist_upload.py` transport script and its constants package. |
-
-## Auto-publish vs manual
-
-- **Auto:** write HTML with `<!-- @publish-as-gist -->` anywhere in the file; the hook handles the rest.
-- **Manual:** run `python scripts/gist_upload.py --input <path>` for an existing file or when the marker route does not apply.