claude-dev-env 1.92.0 → 1.93.0

package/hooks/blocking/test_bash_pre_tool_use_dispatcher.py

@@ -0,0 +1,294 @@
+"""Golden-differential and unit tests for the Bash/PowerShell PreToolUse dispatcher.
+
+The golden-differential tests run a payload through every applicable hook as its
+own subprocess (the standalone path), compute the precedence decision the chain
+produced, then run the dispatcher on the same payload and assert an equal
+decision. The unit tests pin the deny>ask>allow precedence, the es_exe
+updatedInput passthrough, and the fail-open posture on a crashed hook.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+_HOOKS_DIR = str(Path(__file__).resolve().parent.parent)
+_BLOCKING_DIR = Path(__file__).resolve().parent
+if _HOOKS_DIR not in sys.path:
+    sys.path.insert(0, _HOOKS_DIR)
+_blocking_dir_text = str(_BLOCKING_DIR)
+if _blocking_dir_text not in sys.path:
+    sys.path.insert(0, _blocking_dir_text)
+
+from bash_pre_tool_use_dispatcher import (  # noqa: E402
+    BashDispatcherDecision,
+    _emit_decision,
+    aggregate_bash_hook_results,
+    dispatch,
+    select_applicable_entries,
+)
+from hooks_constants.bash_pre_tool_use_dispatcher_constants import (  # noqa: E402
+    BASH_TOOL_NAME,
+    POWERSHELL_TOOL_NAME,
+)
+from hooks_constants.hosted_hook_runner import HostedHookRun  # noqa: E402
+
+_HOOKS_ROOT = _BLOCKING_DIR.parent
+_DISPATCHER_SCRIPT = str(_BLOCKING_DIR / "bash_pre_tool_use_dispatcher.py")
+
+
+def _bash_payload(command: str) -> str:
+    """Build a Bash tool payload JSON string carrying command."""
+    return json.dumps({"tool_name": BASH_TOOL_NAME, "tool_input": {"command": command}})
+
+
+def _decision_from_stdout(stdout_text: str) -> tuple[str, str]:
+    """Parse a hook or dispatcher stdout into (permissionDecision, reason)."""
+    stripped = stdout_text.strip()
+    if not stripped:
+        return "", ""
+    try:
+        parsed = json.loads(stripped)
+    except json.JSONDecodeError:
+        return "", ""
+    hook_specific = parsed.get("hookSpecificOutput", {})
+    if not isinstance(hook_specific, dict):
+        return "", ""
+    decision = hook_specific.get("permissionDecision", "")
+    reason = hook_specific.get("permissionDecisionReason", "")
+    decision_text = decision if isinstance(decision, str) else ""
+    return decision_text, (reason if isinstance(reason, str) else "")
+
+
+def _run_process(script_or_hook_path: str, payload_text: str) -> subprocess.CompletedProcess[str]:
+    """Run a hook or the dispatcher as a subprocess with the current environment."""
+    return subprocess.run(
+        [sys.executable, script_or_hook_path],
+        check=False,
+        input=payload_text,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+    )
+
+
+def _expected_precedence(payload_text: str, tool_name: str) -> str:
+    """Return the decision the standalone chain yields for payload by precedence."""
+    all_decisions = []
+    for each_entry in select_applicable_entries(tool_name):
+        hook_path = str(_HOOKS_ROOT / each_entry.script_relative_path)
+        decision, _reason = _decision_from_stdout(_run_process(hook_path, payload_text).stdout)
+        all_decisions.append(decision)
+    for each_winning in ("deny", "ask", "allow"):
+        if each_winning in all_decisions:
+            return each_winning
+    return ""
+
+
+def test_clean_command_yields_no_decision_matching_the_standalone_chain() -> None:
+    """A benign command produces no decision from the chain and from the dispatcher."""
+    payload_text = _bash_payload("echo hello world")
+    expected_decision = _expected_precedence(payload_text, BASH_TOOL_NAME)
+    dispatcher_decision, _reason = _decision_from_stdout(
+        _run_process(_DISPATCHER_SCRIPT, payload_text).stdout
+    )
+    assert dispatcher_decision == expected_decision
+
+
+def test_destructive_command_asks_matching_the_standalone_chain() -> None:
+    """A destructive command the chain asks on makes the dispatcher ask too."""
+    payload_text = _bash_payload("rm -rf /")
+    expected_decision = _expected_precedence(payload_text, BASH_TOOL_NAME)
+    dispatcher_decision, _reason = _decision_from_stdout(
+        _run_process(_DISPATCHER_SCRIPT, payload_text).stdout
+    )
+    assert dispatcher_decision == expected_decision
+    assert expected_decision == "ask"
+
+
+def test_dispatcher_exits_zero_on_a_clean_command() -> None:
+    """The dispatcher exits zero for a command no hook decides on."""
+    completed = _run_process(_DISPATCHER_SCRIPT, _bash_payload("echo hi"))
+    assert completed.returncode == 0
+
+
+def _run(stdout: str) -> HostedHookRun:
+    """Build a HostedHookRun carrying stdout with no crash."""
+    return HostedHookRun(captured_stdout=stdout, did_crash=False)
+
+
+def _decision_json(decision: str, reason: str) -> str:
+    """Build a hook stdout string carrying one permission decision."""
+    return json.dumps(
+        {"hookSpecificOutput": {"permissionDecision": decision, "permissionDecisionReason": reason}}
+    )
+
+
+def test_deny_wins_over_ask_and_allow() -> None:
+    """A deny from any hook overrides an ask and an allow from others."""
+    all_runs = [
+        _run(_decision_json("allow", "")),
+        _run(_decision_json("ask", "please confirm")),
+        _run(_decision_json("deny", "blocked hard")),
+    ]
+    aggregated = aggregate_bash_hook_results(all_runs)
+    assert aggregated.decision == "deny"
+    assert "blocked hard" in aggregated.reasons
+
+
+def test_ask_wins_over_allow() -> None:
+    """An ask overrides an allow when no hook denies."""
+    all_runs = [_run(_decision_json("allow", "")), _run(_decision_json("ask", "confirm this"))]
+    aggregated = aggregate_bash_hook_results(all_runs)
+    assert aggregated.decision == "ask"
+    assert "confirm this" in aggregated.reasons
+
+
+def test_allow_with_updated_input_is_carried_through() -> None:
+    """An allow carrying updatedInput surfaces that rewrite when no hook denies or asks."""
+    rewritten = json.dumps(
+        {
+            "hookSpecificOutput": {
+                "permissionDecision": "allow",
+                "updatedInput": {"command": "es.exe rewritten"},
+            }
+        }
+    )
+    aggregated = aggregate_bash_hook_results([_run(rewritten)])
+    assert aggregated.decision == "allow"
+    assert aggregated.updated_input == {"command": "es.exe rewritten"}
+
+
+def test_no_decision_when_every_hook_is_silent() -> None:
+    """A chain where every hook emits nothing produces no dispatcher decision."""
+    aggregated = aggregate_bash_hook_results([_run(""), _run("")])
+    assert aggregated.decision == ""
+
+
+def test_a_crashed_hook_contributes_no_decision() -> None:
+    """A crashed hook fails open: its empty output adds no deny, ask, or allow."""
+    crashed_run = HostedHookRun(captured_stdout="", did_crash=True)
+    aggregated = aggregate_bash_hook_results([crashed_run])
+    assert aggregated.decision == ""
+    assert isinstance(aggregated, BashDispatcherDecision)
+
+
+def test_deny_preserves_system_message_and_suppress_output() -> None:
+    """A silent-deny shape carries systemMessage and suppressOutput through aggregation."""
+    silent_deny = json.dumps(
+        {
+            "hookSpecificOutput": {
+                "permissionDecision": "deny",
+                "permissionDecisionReason": "GH-REDIRECT GATE: duplicate blocked",
+            },
+            "suppressOutput": True,
+            "systemMessage": "[gh-gate] blocked redirected gh pr create",
+        }
+    )
+    aggregated = aggregate_bash_hook_results([_run(silent_deny)])
+    assert aggregated.decision == "deny"
+    assert aggregated.should_suppress_output is True
+    assert aggregated.all_system_messages == ["[gh-gate] blocked redirected gh pr create"]
+    assert "GH-REDIRECT GATE" in aggregated.reasons[0]
+
+
+def test_additional_context_is_collected_from_deciding_hooks() -> None:
+    """additionalContext from hosted hooks is retained for the emitted payload."""
+    deny_with_context = json.dumps(
+        {
+            "hookSpecificOutput": {
+                "permissionDecision": "deny",
+                "permissionDecisionReason": "blocked",
+                "additionalContext": "see docs/runbook.md",
+            }
+        }
+    )
+    aggregated = aggregate_bash_hook_results([_run(deny_with_context)])
+    assert aggregated.all_additional_context == ["see docs/runbook.md"]
+
+
+def test_powershell_selects_the_three_shared_hooks() -> None:
+    """Selecting for PowerShell yields the three shared hooks in registration order."""
+    powershell_paths = [
+        each_entry.script_relative_path
+        for each_entry in select_applicable_entries(POWERSHELL_TOOL_NAME)
+    ]
+    assert powershell_paths == [
+        "blocking/pii_prevention_blocker.py",
+        "blocking/verified_commit_gate.py",
+        "blocking/verdict_directory_write_blocker.py",
+    ]
+
+
+def test_dispatcher_imports_standalone_with_only_blocking_on_the_path() -> None:
+    """The dispatcher's bootstrap resolves hooks_constants without hooks/ on PYTHONPATH."""
+    subprocess_environment = {**os.environ, "PYTHONPATH": str(_BLOCKING_DIR)}
+    completed = subprocess.run(
+        [sys.executable, "-c", "import bash_pre_tool_use_dispatcher; print('ok')"],
+        check=False,
+        capture_output=True,
+        text=True,
+        env=subprocess_environment,
+    )
+    assert completed.returncode == 0, completed.stderr
+    assert completed.stdout.strip() == "ok"
+
+
+def test_emit_decision_re_emits_silent_deny_fields(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """_emit_decision writes systemMessage, suppressOutput, and additionalContext."""
+    silent_deny = BashDispatcherDecision(
+        decision="deny",
+        reasons=["GH-REDIRECT GATE: duplicate blocked"],
+        all_system_messages=["[gh-gate] blocked redirected gh pr create"],
+        all_additional_context=["see docs/runbook.md"],
+        should_suppress_output=True,
+    )
+    _emit_decision(silent_deny)
+    captured = capsys.readouterr()
+    emitted_payload = json.loads(captured.out.strip())
+    hook_specific = emitted_payload["hookSpecificOutput"]
+    assert hook_specific["permissionDecision"] == "deny"
+    assert "GH-REDIRECT GATE" in hook_specific["permissionDecisionReason"]
+    assert hook_specific["additionalContext"] == "see docs/runbook.md"
+    assert emitted_payload["systemMessage"] == "[gh-gate] blocked redirected gh pr create"
+    assert emitted_payload["suppressOutput"] is True
+
+
+def test_dispatch_emits_deny_immediately_and_skips_later_hooks(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A mid-chain deny emits at once and does not invoke later hosted hooks."""
+    all_call_paths: list[str] = []
+
+    def _fake_run_hook(script_path: str, payload_text: str) -> HostedHookRun:
+        del payload_text
+        all_call_paths.append(script_path)
+        script_name = Path(script_path).name
+        if script_name == "destructive_command_blocker.py":
+            return HostedHookRun(
+                captured_stdout=_decision_json("deny", "blocked early"),
+                did_crash=False,
+            )
+        if script_name == "precommit_code_rules_gate.py":
+            raise AssertionError("later hooks must not run after an early deny")
+        return HostedHookRun(captured_stdout="", did_crash=False)
+
+    monkeypatch.setattr(
+        "bash_pre_tool_use_dispatcher.run_hook_capturing_output",
+        _fake_run_hook,
+    )
+    dispatch(_bash_payload("rm -rf /"), BASH_TOOL_NAME)
+    captured = capsys.readouterr()
+    decision, reason = _decision_from_stdout(captured.out)
+    assert decision == "deny"
+    assert "blocked early" in reason
+    assert any(path.endswith("destructive_command_blocker.py") for path in all_call_paths)
+    assert not any(path.endswith("precommit_code_rules_gate.py") for path in all_call_paths)

package/hooks/blocking/test_code_rules_enforcer_cross_skill_duplicate.py

@@ -1,6 +1,6 @@
 """Tests for the cross-skill duplicate-helper advisory.
 
-PR #233 on JonEcho/python-automation copied a Chrome-launch helper from the
+PR #101 on example-org/example-repo copied a Chrome-launch helper from the
 ``stp-recolor`` skill's ``scripts`` directory into the ``iconize-and-recolor-stp``
 skill's ``scripts`` directory. The two skills install on their own, so a shared
 module would couple them and break independent install; the copy is a defensible

package/hooks/blocking/test_code_rules_enforcer_dead_module_constant.py

@@ -364,6 +364,57 @@ def test_returns_empty_list_at_file_cap(
     assert issues == [], f"File cap hit must return [] (cannot prove dead), got: {issues}"
 
 
+def _write_noise_modules(directory: Path, count: int) -> None:
+    directory.mkdir(parents=True)
+    for each_index in range(count):
+        (directory / f"mod_{each_index}.py").write_text(
+            "def noop() -> int:\n    return 1\n", encoding="utf-8"
+        )
+
+
+def test_dead_exported_constant_flagged_despite_many_noncandidate_siblings(
+    neutral_root: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setattr("code_rules_dead_module_constant.MAX_SCAN_ROOT_FILE_COUNT", 3)
+    package_directory = neutral_root / "pkg"
+    package_directory.mkdir(parents=True)
+    constants_body = 'DEAD_EXPORTED = "x"\n__all__ = ["DEAD_EXPORTED"]\n'
+    constants_path = package_directory / "settings_constants.py"
+    constants_path.write_text(constants_body, encoding="utf-8")
+    _write_noise_modules(neutral_root / "noise", 10)
+    issues = _check(constants_body, str(constants_path))
+    assert any("DEAD_EXPORTED" in each_issue for each_issue in issues), (
+        "A dead exported constant must stay flagged when the widened scan meets "
+        f"many sibling modules that never import from this module, got: {issues}"
+    )
+
+
+def test_live_qualified_importer_found_despite_many_noncandidate_siblings(
+    neutral_root: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setattr("code_rules_dead_module_constant.MAX_SCAN_ROOT_FILE_COUNT", 3)
+    package_directory = neutral_root / "pkg"
+    package_directory.mkdir(parents=True)
+    constants_body = 'LIVE_EXPORTED = "y"\n__all__ = ["LIVE_EXPORTED"]\n'
+    constants_path = package_directory / "settings_constants.py"
+    constants_path.write_text(constants_body, encoding="utf-8")
+    _write_noise_modules(neutral_root / "noise", 10)
+    consumer_directory = neutral_root / "app"
+    consumer_directory.mkdir(parents=True)
+    consumer_body = (
+        "from pkg.settings_constants import LIVE_EXPORTED\n"
+        "\n"
+        "def use() -> str:\n"
+        "    return LIVE_EXPORTED\n"
+    )
+    (consumer_directory / "consumer.py").write_text(consumer_body, encoding="utf-8")
+    issues = _check(constants_body, str(constants_path))
+    assert issues == [], (
+        "A constant imported through a qualified from-import must stay live even "
+        f"when many non-importing siblings surround it, got: {issues}"
+    )
+
+
 def test_widened_scan_reads_each_file_at_most_once(
     neutral_root: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:

package/hooks/blocking/test_code_rules_enforcer_dead_module_constant_read_cap.py

@@ -0,0 +1,103 @@
+from __future__ import annotations
+
+import importlib.util
+import os
+import shutil
+import stat
+import tempfile
+from collections.abc import Callable, Iterator
+from pathlib import Path
+
+import pytest
+
+ENFORCER_PATH = Path(__file__).resolve().parent / "code_rules_enforcer.py"
+specification = importlib.util.spec_from_file_location("code_rules_enforcer", ENFORCER_PATH)
+assert specification is not None and specification.loader is not None
+code_rules_enforcer = importlib.util.module_from_spec(specification)
+specification.loader.exec_module(code_rules_enforcer)
+
+
+def _strip_read_only_and_retry(
+    removal_function: Callable[[str], object],
+    target_path: str,
+    _exc_info: BaseException,
+) -> None:
+    try:
+        os.chmod(target_path, stat.S_IWRITE)
+        removal_function(target_path)
+    except OSError:
+        pass
+
+
+@pytest.fixture
+def neutral_root() -> Iterator[Path]:
+    """Yield a temp directory whose path carries no ``test_`` segment.
+
+    ::
+
+        tmp_path (pytest default)  -> embeds "test_..." in its name
+                                        -> is_test_file() misreads every
+                                           synthetic constants path
+        mkdtemp(prefix="deadconst-") -> no "test_" segment
+                                        -> reads as a production path  ok
+
+    A ``.git`` marker is planted at the root so the cross-tree widening
+    resolves the repository root to this synthetic tree.
+    """
+    neutral_directory = Path(tempfile.mkdtemp(prefix="deadconst-")).resolve()
+    (neutral_directory / ".git").mkdir()
+    try:
+        yield neutral_directory
+    finally:
+        shutil.rmtree(neutral_directory, onexc=_strip_read_only_and_retry)
+
+
+def _check(source: str, file_path: str) -> list[str]:
+    return code_rules_enforcer.check_dead_module_constants(source, file_path)
+
+
+def _write_noise_modules(directory: Path, count: int) -> None:
+    directory.mkdir(parents=True)
+    for each_index in range(count):
+        (directory / f"mod_{each_index}.py").write_text(
+            "def noop() -> int:\n    return 1\n", encoding="utf-8"
+        )
+
+
+def test_widened_scan_bounds_total_disk_reads_on_noncandidate_flood(
+    neutral_root: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A read-attempt cap stops the widened pass from reading every sibling.
+
+    ::
+
+        MAX_SCAN_ROOT_READ_COUNT = 3, 50 non-candidate noise files
+        ok:   read_text() called a bounded number of times   (< 50)
+        flag: read_text() called once per noise file          (== 50)
+
+    Without the cap, ``_read_candidate_source`` opens and reads every
+    repository ``.py`` file's full text before testing it for the module
+    stem, so disk-read cost scales with repository size regardless of how
+    quickly the file cap would otherwise stop the parse-and-collect work.
+    """
+    monkeypatch.setattr("code_rules_dead_module_constant.MAX_SCAN_ROOT_READ_COUNT", 3)
+    package_directory = neutral_root / "pkg"
+    package_directory.mkdir(parents=True)
+    constants_body = 'DEAD_EXPORTED = "x"\n__all__ = ["DEAD_EXPORTED"]\n'
+    constants_path = package_directory / "settings_constants.py"
+    constants_path.write_text(constants_body, encoding="utf-8")
+    _write_noise_modules(neutral_root / "noise", 50)
+    read_count = 0
+    original_read_text = Path.read_text
+
+    def counting_read_text(self: Path, *positional: object, **keyword: object) -> str:
+        nonlocal read_count
+        read_count += 1
+        return original_read_text(self, *positional, **keyword)  # type: ignore[arg-type]  # forwards positional/keyword args mypy cannot resolve
+
+    monkeypatch.setattr(Path, "read_text", counting_read_text)
+    _check(constants_body, str(constants_path))
+    assert read_count < 50, (
+        "A read-count cap must stop the widened pass from reading every "
+        f"non-candidate sibling's full text, got {read_count} reads across 50 noise files"
+    )

package/hooks/blocking/test_code_rules_enforcer_dot_test_pattern.py

@@ -47,7 +47,7 @@ def test_is_hook_infrastructure_should_recognize_packages_claude_dev_env_hooks_v
 
 
 def test_is_hook_infrastructure_should_still_recognize_dot_claude_hooks():
-    assert enforcer.is_hook_infrastructure("C:/Users/jon/.claude/hooks/blocking/foo.py") is True
+    assert enforcer.is_hook_infrastructure("C:/Users/example/.claude/hooks/blocking/foo.py") is True
     assert enforcer.is_hook_infrastructure("/home/user/.claude/hooks/blocking/foo.py") is True
 
 

package/hooks/blocking/test_code_rules_enforcer_file_global_constants.py

@@ -1,4 +1,4 @@
-"""Tests for file-global constants use-count rule (jl-cmd/claude-code-config#180).
+"""Tests for file-global constants use-count rule (jl-cmd/claude-dev-env#180).
 
 A module-level UPPER_SNAKE constant must be referenced by at least two
 distinct functions/methods. A constant referenced by only one function

package/hooks/blocking/test_code_rules_enforcer_hardcoded_user_path.py

@@ -1,6 +1,6 @@
 """Tests for hardcoded user path detection.
 
-Bot reviewers on PR #257 flagged 6+ instances of 'C:/Users/jon/' embedded
+Bot reviewers on PR #257 flagged 6+ instances of 'C:/Users/example/' embedded
 in production source code, which breaks portability across machines.
 The new rule flags any string literal in production code that names a
 specific user's home directory.
@@ -35,24 +35,24 @@ HOOK_INFRASTRUCTURE_FILE_PATH = "/repo/packages/claude-dev-env/hooks/blocking/co
 
 
 def test_should_match_user_directory_without_consuming_following_separator() -> None:
-    windows = HARDCODED_USER_PATH_PATTERN.search("C:/Users/jon/more")
+    windows = HARDCODED_USER_PATH_PATTERN.search("C:/Users/example/more")
     macos = HARDCODED_USER_PATH_PATTERN.search("/Users/bob/more")
     linux = HARDCODED_USER_PATH_PATTERN.search("/home/alice/more")
-    assert windows is not None and windows.group(0) == "C:/Users/jon"
+    assert windows is not None and windows.group(0) == "C:/Users/example"
     assert macos is not None and macos.group(0) == "/Users/bob"
     assert linux is not None and linux.group(0) == "/home/alice"
 
 
 def test_should_flag_windows_user_path_with_forward_slashes() -> None:
-    source = 'def find() -> str:\n    return "C:/Users/jon/notes.md"\n'
+    source = 'def find() -> str:\n    return "C:/Users/example/notes.md"\n'
     issues = check_hardcoded_user_paths(source, PRODUCTION_FILE_PATH)
-    assert any("C:/Users/jon" in each_issue for each_issue in issues), (
+    assert any("C:/Users/example" in each_issue for each_issue in issues), (
         f"Expected Windows user path flagged, got: {issues}"
     )
 
 
 def test_should_flag_windows_user_path_when_users_segment_is_not_title_case() -> None:
-    source = 'def find() -> str:\n    return "c:/users/jon/notes.md"\n'
+    source = 'def find() -> str:\n    return "c:/users/example/notes.md"\n'
     issues = check_hardcoded_user_paths(source, PRODUCTION_FILE_PATH)
     assert any("users" in each_issue.lower() for each_issue in issues), (
         f"Expected Windows user path flagged (case-insensitive Users segment), got: {issues}"
@@ -60,7 +60,7 @@ def test_should_flag_windows_user_path_when_users_segment_is_not_title_case() ->
 
 
 def test_should_flag_windows_user_path_with_backslashes() -> None:
-    source = 'def find() -> str:\n    return "C:\\\\Users\\\\jon\\\\notes.md"\n'
+    source = 'def find() -> str:\n    return "C:\\\\Users\\\\example\\\\notes.md"\n'
     issues = check_hardcoded_user_paths(source, PRODUCTION_FILE_PATH)
     assert any("Users" in each_issue for each_issue in issues), (
         f"Expected Windows backslash user path flagged, got: {issues}"
@@ -106,7 +106,7 @@ def test_should_not_flag_users_directory_without_specific_user() -> None:
 
 
 def test_should_skip_test_files() -> None:
-    source = 'def test_path() -> None:\n    fixture = "C:/Users/jon/scratch.txt"\n'
+    source = 'def test_path() -> None:\n    fixture = "C:/Users/example/scratch.txt"\n'
     issues = check_hardcoded_user_paths(source, TEST_FILE_PATH)
     assert issues == [], (
         f"Test files exempt — fixtures often need real paths, got: {issues}"
@@ -114,7 +114,7 @@ def test_should_skip_test_files() -> None:
 
 
 def test_should_skip_config_files() -> None:
-    source = 'DEFAULT_PATH = "C:/Users/jon/notes.md"\n'
+    source = 'DEFAULT_PATH = "C:/Users/example/notes.md"\n'
     issues = check_hardcoded_user_paths(source, CONFIG_FILE_PATH)
     assert issues == [], (
         f"Config files exempt — that is the right place for paths, got: {issues}"
@@ -122,7 +122,7 @@ def test_should_skip_config_files() -> None:
 
 
 def test_should_include_line_number_in_issue() -> None:
-    source = '\n\ndef find() -> str:\n    return "C:/Users/jon/notes.md"\n'
+    source = '\n\ndef find() -> str:\n    return "C:/Users/example/notes.md"\n'
     issues = check_hardcoded_user_paths(source, PRODUCTION_FILE_PATH)
     assert any("Line 4" in each_issue for each_issue in issues), (
         f"Expected line 4 reference, got: {issues}"
@@ -165,7 +165,7 @@ def test_should_skip_hook_infrastructure_files() -> None:
     source = (
         'HARDCODED_USER_PATH_PATTERN = "/Users/[^/]+|/home/[^/]+"\n'
         'def find() -> str:\n'
-        '    return "C:/Users/jon/notes.md"\n'
+        '    return "C:/Users/example/notes.md"\n'
     )
     issues = check_hardcoded_user_paths(source, HOOK_INFRASTRUCTURE_FILE_PATH)
     assert issues == [], (

package/hooks/blocking/test_code_rules_enforcer_naive_datetime.py

@@ -1,7 +1,7 @@
 """Tests for the naive-datetime-construction check in code_rules_imports_logging.py.
 
 The check catches the DST-fold-ambiguity class Copilot flagged on
-python-automation PR #557: ``datetime.fromtimestamp(epoch)`` builds a datetime
+example-repo PR #101: ``datetime.fromtimestamp(epoch)`` builds a datetime
 with no timezone, and a later ``.astimezone()`` on that naive value has to guess
 the local offset. The check flags the naive-producing constructors
 (``fromtimestamp``/``utcfromtimestamp`` without ``tz=``, and ``utcnow``) and

package/hooks/blocking/test_code_rules_enforcer_same_file_inline_duplicate.py

@@ -1,6 +1,6 @@
 """Tests for same-file inline duplicate function-body detection.
 
-PR #470 (JonEcho/python-automation) added ``_wait_for_content_image_to_render``,
+PR #101 (example-org/example-repo) added ``_wait_for_content_image_to_render``,
 a top-level async helper whose body is byte-for-structure identical to a
 content-image-wait block already inlined inside ``_wait_for_page_after_account_switch``
 in the same module. The cross-file duplicate-body check never compares two