claude-dev-env 1.92.1 → 1.93.0

package/hooks/blocking/test_code_rules_enforcer_test_layout.py

@@ -0,0 +1,111 @@
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+
+ENFORCER_PATH = Path(__file__).resolve().parent / "code_rules_enforcer.py"
+specification = importlib.util.spec_from_file_location("code_rules_enforcer", ENFORCER_PATH)
+assert specification is not None and specification.loader is not None
+code_rules_enforcer = importlib.util.module_from_spec(specification)
+specification.loader.exec_module(code_rules_enforcer)
+
+PRODUCTION_FILE_PATH = "packages/app/services/report.py"
+TEST_FILE_PATH = "packages/app/services/test_report.py"
+UNDERSCORE_TEST_FILE_PATH = "packages/app/services/report_test.py"
+CONFTEST_FILE_PATH = "packages/app/tests/conftest.py"
+SHARED_TEST_MODULE_PATH = "packages/app/tests/expected_values.py"
+TEST_CONSTANTS_MODULE_PATH = "packages/app/hooks_constants/test_layout_constants.py"
+CONFIG_UNDER_TESTS_PATH = "packages/app/tests/config/timing.py"
+
+
+def _dead_constant(source: str, file_path: str) -> list[str]:
+    return code_rules_enforcer.check_dead_test_module_constant(source, file_path)
+
+def _unused_parameter(source: str, file_path: str) -> list[str]:
+    return code_rules_enforcer.check_unused_test_helper_parameter(source, file_path)
+
+def test_should_flag_dead_private_constant_in_test_file() -> None:
+    source = (
+        "_ABSENT_DOTENV_FILENAME = 'absent.env'\n"
+        "\n"
+        "def test_reads_environment() -> None:\n"
+        "    assert True\n"
+    )
+    issues = _dead_constant(source, TEST_FILE_PATH)
+    assert any("_ABSENT_DOTENV_FILENAME" in each_issue for each_issue in issues), issues
+
+def test_should_flag_dead_constant_in_underscore_test_module() -> None:
+    source = (
+        "_UNREAD_CONSTANT = 'x'\n"
+        "\n"
+        "def test_something() -> None:\n"
+        "    assert True\n"
+    )
+    issues = _dead_constant(source, UNDERSCORE_TEST_FILE_PATH)
+    assert any("_UNREAD_CONSTANT" in each_issue for each_issue in issues), issues
+
+def test_should_not_flag_dead_public_constant_in_test_file() -> None:
+    source = (
+        "EXPECTED_TOTAL = 3\n"
+        "\n"
+        "def test_total() -> None:\n"
+        "    assert True\n"
+    )
+    assert _dead_constant(source, TEST_FILE_PATH) == []
+
+def test_should_not_flag_constant_read_by_a_later_line() -> None:
+    source = (
+        "_EXPECTED_TOTAL = 208\n"
+        "\n"
+        "def test_total_matches() -> None:\n"
+        "    assert compute_total() == _EXPECTED_TOTAL\n"
+    )
+    assert _dead_constant(source, TEST_FILE_PATH) == []
+
+def test_should_not_flag_dead_constant_in_production_file() -> None:
+    source = "_UNUSED_CONSTANT = 'x'\n"
+    assert _dead_constant(source, PRODUCTION_FILE_PATH) == []
+
+def test_should_not_flag_shared_constant_in_conftest() -> None:
+    source = (
+        "SHARED_TIMEOUT_SECONDS = 30\n"
+        "\n"
+        "def _database() -> object:\n"
+        "    return connect()\n"
+    )
+    assert _dead_constant(source, CONFTEST_FILE_PATH) == []
+
+def test_should_not_flag_shared_constant_module_under_tests() -> None:
+    source = "EXPECTED_TOTAL = 208\n"
+    assert _dead_constant(source, SHARED_TEST_MODULE_PATH) == []
+
+def test_should_not_flag_constant_in_a_constants_module() -> None:
+    source = "SHARED_LAYOUT_LIMIT = 50\n"
+    assert _dead_constant(source, TEST_CONSTANTS_MODULE_PATH) == []
+
+def test_should_not_flag_constant_in_config_module_under_tests() -> None:
+    source = "REQUEST_TIMEOUT_SECONDS = 30\n"
+    assert _dead_constant(source, CONFIG_UNDER_TESTS_PATH) == []
+
+def test_should_flag_unused_private_helper_parameter() -> None:
+    source = "def _configuration(monkeypatch, tmp_path):\n    return build_config()\n"
+    issues = _unused_parameter(source, TEST_FILE_PATH)
+    flagged_parameters = {"monkeypatch", "tmp_path"}
+    assert all(
+        any(each_name in each_issue for each_issue in issues) for each_name in flagged_parameters
+    ), issues
+
+def test_should_not_flag_parameter_the_body_reads() -> None:
+    source = "def _configuration(database_url):\n    return build_config(database_url)\n"
+    assert _unused_parameter(source, TEST_FILE_PATH) == []
+
+def test_should_not_flag_fixture_parameters() -> None:
+    source = "import pytest\n\n@pytest.fixture\ndef _database(monkeypatch):\n    return connect()\n"
+    assert _unused_parameter(source, TEST_FILE_PATH) == []
+
+def test_should_not_flag_public_test_function_parameters() -> None:
+    source = (
+        "def test_writes_row(postgres_database_url) -> None:\n"
+        "    assert postgres_database_url is not None\n"
+    )
+    assert _unused_parameter(source, TEST_FILE_PATH) == []

package/hooks/blocking/test_code_rules_enforcer_type_checking_scope.py

@@ -192,3 +192,79 @@ def test_should_skip_module_level_docstring_text() -> None:
     )
     issues = check_imports_at_top(content)
     assert issues == []
+
+
+def test_should_flag_module_level_import_after_top_level_def() -> None:
+    """A module-scope import placed below a top-level function must flag.
+
+    This is the "imports mid-file after test functions" drift: the imports sit
+    at indent zero (module scope), so the inside-function tracker never sees
+    them, yet they violate the imports-at-top rule.
+    """
+    content = (
+        "import os\n"
+        "\n"
+        "def first_test():\n"
+        "    return os.getcwd()\n"
+        "\n"
+        "from pathlib import Path\n"
+        "\n"
+        "def second_test():\n"
+        "    return Path('.')\n"
+    )
+    issues = check_imports_at_top(content)
+    assert len(issues) == 1
+    assert issues[0].startswith("Line 6:")
+    assert "after top-level definition" in issues[0]
+
+
+def test_should_flag_module_level_import_after_top_level_class() -> None:
+    content = (
+        "class Widget:\n"
+        "    pass\n"
+        "\n"
+        "from collections import OrderedDict\n"
+    )
+    issues = check_imports_at_top(content)
+    assert len(issues) == 1
+    assert issues[0].startswith("Line 4:")
+    assert "after top-level definition" in issues[0]
+
+
+def test_should_allow_type_checking_import_after_top_level_def() -> None:
+    content = (
+        "from typing import TYPE_CHECKING\n"
+        "\n"
+        "def helper():\n"
+        "    return 1\n"
+        "\n"
+        "if TYPE_CHECKING:\n"
+        "    from foo import Bar\n"
+    )
+    issues = check_imports_at_top(content)
+    assert issues == []
+
+
+def test_should_allow_indented_import_in_main_guard_after_def() -> None:
+    content = (
+        "def helper():\n"
+        "    return 1\n"
+        "\n"
+        "if __name__ == '__main__':\n"
+        "    import argparse\n"
+        "    helper()\n"
+    )
+    issues = check_imports_at_top(content)
+    assert issues == []
+
+
+def test_should_not_flag_top_level_imports_before_any_definition() -> None:
+    content = (
+        "import os\n"
+        "from pathlib import Path\n"
+        "\n"
+        "def helper():\n"
+        "    return Path(os.getcwd())\n"
+    )
+    issues = check_imports_at_top(content)
+    assert issues == []

package/hooks/blocking/test_destructive_command_blocker.py

@@ -14,6 +14,14 @@ GH_REDIRECT_ACTIVE_ENV_VAR = "CLAUDE_GH_REDIRECT_ACTIVE"
 GH_REDIRECT_ACTIVE_VALUE = "1"
 
 
+def _windows_style_system_temporary_root() -> str:
+    return tempfile.gettempdir().replace("/", "\\")
+
+
+def _posix_style_system_temporary_root() -> str:
+    return tempfile.gettempdir().replace("\\", "/")
+
+
 def _run_hook(
     payload: dict,
     gh_redirect_active: bool = True,
@@ -42,7 +50,7 @@ def _make_bash_payload(command: str) -> dict:
 
 def test_denies_gh_issue_comment_as_redirect_duplicate_guard() -> None:
     payload = _make_bash_payload(
-        'gh issue comment 83 --repo jl-cmd/claude-code-config --body "hello"'
+        'gh issue comment 83 --repo jl-cmd/claude-dev-env --body "hello"'
     )
     result = _run_hook(payload)
     response = json.loads(result.stdout)
@@ -298,7 +306,8 @@ def test_rm_rf_allowed_when_leading_cd_into_ephemeral_subdirectory_unquoted() ->
 
 def test_rm_rf_allowed_when_leading_cd_into_windows_temp_worktree_subdirectory() -> None:
     windows_style_temp_worktree = (
-        r"C:\Users\jon\AppData\Local\Temp\bugteam-pr-58-20260424071040\pr-58\worktree"
+        _windows_style_system_temporary_root()
+        + r"\bugteam-pr-58-20260424071040\pr-58\worktree"
     )
     payload = _make_bash_payload(
         f'cd "{windows_style_temp_worktree}" && rm -rf .bugteam-tmp'
@@ -563,7 +572,9 @@ def test_rm_rf_asks_when_leading_cd_target_is_relative_path() -> None:
 
 def test_rm_rf_allowed_for_chat_observed_bugteam_backslash_worktree_scratch_cleanup() -> None:
     payload = _make_bash_payload(
-        r'cd "C:\Users\jon\AppData\Local\Temp\bugteam-pr-58-20260424071040\pr-58\worktree" && rm -rf .bugteam-tmp'
+        'cd "'
+        + _windows_style_system_temporary_root()
+        + r'\bugteam-pr-58-20260424071040\pr-58\worktree" && rm -rf .bugteam-tmp'
     )
 
     result = _run_rm_hook(payload)
@@ -574,7 +585,9 @@ def test_rm_rf_allowed_for_chat_observed_bugteam_backslash_worktree_scratch_clea
 
 def test_rm_rf_allowed_for_chat_observed_bugteam_forward_slash_worktree_scratch_cleanup() -> None:
     payload = _make_bash_payload(
-        'cd "C:/Users/jon/AppData/Local/Temp/bugteam-pr-58-20260424071040/pr-58/worktree" && rm -rf .bugteam-tmp'
+        'cd "'
+        + _posix_style_system_temporary_root()
+        + '/bugteam-pr-58-20260424071040/pr-58/worktree" && rm -rf .bugteam-tmp'
     )
 
     result = _run_rm_hook(payload)
@@ -585,7 +598,9 @@ def test_rm_rf_allowed_for_chat_observed_bugteam_forward_slash_worktree_scratch_
 
 def test_rm_rf_allowed_for_chat_observed_bugfix_reply_scratch_file_cleanup() -> None:
     payload = _make_bash_payload(
-        'cd "C:/Users/jon/AppData/Local/Temp/bugteam-pr-58-20260424071040/pr-58/worktree" && rm -rf tmp_reply_loop1-1.md'
+        'cd "'
+        + _posix_style_system_temporary_root()
+        + '/bugteam-pr-58-20260424071040/pr-58/worktree" && rm -rf tmp_reply_loop1-1.md'
     )
 
     result = _run_rm_hook(payload)
@@ -596,7 +611,9 @@ def test_rm_rf_allowed_for_chat_observed_bugfix_reply_scratch_file_cleanup() ->
 
 def test_rm_rf_allowed_for_chat_observed_bugfind_multiple_scratch_files_cleanup() -> None:
     payload = _make_bash_payload(
-        'cd "C:/Users/jon/AppData/Local/Temp/bugteam-pr-58-20260424071040/pr-256/worktree" && rm -rf tmp_review_body.md tmp_finding_1.md'
+        'cd "'
+        + _posix_style_system_temporary_root()
+        + '/bugteam-pr-58-20260424071040/pr-256/worktree" && rm -rf tmp_review_body.md tmp_finding_1.md'
     )
 
     result = _run_rm_hook(payload)
@@ -610,7 +627,8 @@ def test_rm_rf_allowed_via_tool_input_cwd_pointing_at_chat_observed_bugteam_work
         "tool_name": "Bash",
         "tool_input": {
             "command": "rm -rf .bugteam-tmp",
-            "cwd": "C:/Users/jon/AppData/Local/Temp/bugteam-pr-58-20260424071040/pr-58/worktree",
+            "cwd": _posix_style_system_temporary_root()
+            + "/bugteam-pr-58-20260424071040/pr-58/worktree",
         },
     }
 
@@ -622,7 +640,9 @@ def test_rm_rf_allowed_via_tool_input_cwd_pointing_at_chat_observed_bugteam_work
 
 def test_rm_rf_allowed_for_chat_observed_absolute_path_in_bugteam_windows_worktree_scratch() -> None:
     payload = _make_bash_payload(
-        'rm -rf "C:/Users/jon/AppData/Local/Temp/bugteam-pr-58-20260424071040/pr-58/worktree/.bugteam-tmp"'
+        'rm -rf "'
+        + _posix_style_system_temporary_root()
+        + '/bugteam-pr-58-20260424071040/pr-58/worktree/.bugteam-tmp"'
     )
 
     result = _run_rm_hook(payload)
@@ -839,7 +859,7 @@ def test_rm_rf_allowed_when_unquoted_windows_backslash_target_contains_worktrees
 
 def test_rm_rf_allowed_when_finding_example_windows_backslash_ephemeral_target() -> None:
     payload = _make_bash_payload(
-        r"rm -rf C:\Users\jon\AppData\Local\Temp\scratch"
+        "rm -rf " + _windows_style_system_temporary_root() + r"\scratch"
     )
 
     result = _run_rm_hook(payload)

package/hooks/blocking/test_gh_body_arg_blocker.py

@@ -138,7 +138,7 @@ def test_no_false_positive_body_as_title_value() -> None:
 def test_no_false_positive_windows_path_in_body_file() -> None:
     """Unquoted Windows path with backslashes in --body-file must be approved without token corruption."""
     assert not _uses_body_string_arg(
-        r'gh pr create --title "T" --body-file C:\Users\jon\tmp\body.md'
+        r'gh pr create --title "T" --body-file C:\Users\example\tmp\body.md'
     )
 
 
@@ -222,7 +222,7 @@ def test_blocks_body_file_followed_by_body_string() -> None:
 
 
 def test_blocks_windows_path_with_trailing_backslash_continuation() -> None:
-    """C1: prior line ending in `C:\\Users\\jon\\` must still continue lines.
+    """C1: prior line ending in `C:\\Users\\example\\` must still continue lines.
 
     Naive `count("\\\\") % 2 == 1` mis-classifies this (count=4, even -> no
     continuation) and misses --body on the next line. Counting only the
@@ -230,7 +230,7 @@ def test_blocks_windows_path_with_trailing_backslash_continuation() -> None:
     backslash as a continuation marker.
     """
     command = (
-        'gh pr create --title C:\\Users\\jon\\ \\\n'
+        'gh pr create --title C:\\Users\\example\\ \\\n'
         '  --body "real body text"\n'
     )
     assert _uses_body_string_arg(command)

package/hooks/blocking/test_nas_ssh_binary_enforcer.py

@@ -1,12 +1,24 @@
-"""Unit tests for nas-ssh-binary-enforcer PreToolUse hook."""
+"""Unit tests for nas-ssh-binary-enforcer PreToolUse hook.
+
+The real NAS host, ssh user, and port are private, so these tests set them via
+the ``CLAUDE_NAS_*`` environment variables and drive the real hook, asserting
+the runtime-built host pattern and deny messages.
+"""
 
 import importlib.util
+import os
 import pathlib
 import sys
+from collections.abc import Iterator
+from unittest.mock import patch
+
+import pytest
 
 _HOOK_DIR = pathlib.Path(__file__).parent
 if str(_HOOK_DIR) not in sys.path:
     sys.path.insert(0, str(_HOOK_DIR))
+if str(_HOOK_DIR.parent) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIR.parent))
 
 hook_spec = importlib.util.spec_from_file_location(
     "nas_ssh_binary_enforcer",
@@ -18,55 +30,88 @@ hook_module = importlib.util.module_from_spec(hook_spec)
 hook_spec.loader.exec_module(hook_module)
 _find_nas_ssh_violation = hook_module._find_nas_ssh_violation
 
-from hooks_constants.nas_ssh_binary_enforcer_constants import (
-    BARE_SSH_BINARY_MESSAGE as _BARE_SSH_BINARY_MESSAGE,
-    MISSING_BATCH_MODE_MESSAGE as _MISSING_BATCH_MODE_MESSAGE,
+from hooks_constants.local_identity import (  # noqa: E402
+    bare_ssh_binary_deny_message,
+    missing_batch_mode_deny_message,
 )
 
+NAS_HOST = "test-nas.example.net"
+NAS_SSH_USER = "tester"
+NAS_SSH_PORT = "2222"
+
+
+@pytest.fixture(autouse=True)
+def _set_nas_identity_env() -> Iterator[None]:
+    with patch.dict(
+        os.environ,
+        {
+            "CLAUDE_NAS_HOST": NAS_HOST,
+            "CLAUDE_NAS_SSH_USER": NAS_SSH_USER,
+            "CLAUDE_NAS_SSH_PORT": NAS_SSH_PORT,
+        },
+        clear=False,
+    ):
+        yield
+
 
 def test_bare_ssh_to_nas_is_denied_with_binary_message() -> None:
     assert (
-        _find_nas_ssh_violation('ssh -p 9222 jon@192.168.1.100 "ls /volume1"')
-        == _BARE_SSH_BINARY_MESSAGE
+        _find_nas_ssh_violation(
+            f'ssh -p {NAS_SSH_PORT} {NAS_SSH_USER}@{NAS_HOST} "ls /volume1"'
+        )
+        == bare_ssh_binary_deny_message()
     )
 
 
 def test_bare_scp_to_nas_is_denied() -> None:
     assert (
-        _find_nas_ssh_violation("scp -P 9222 file.txt jon@192.168.1.100:/volume1/")
-        == _BARE_SSH_BINARY_MESSAGE
+        _find_nas_ssh_violation(
+            f"scp -P {NAS_SSH_PORT} file.txt {NAS_SSH_USER}@{NAS_HOST}:/volume1/"
+        )
+        == bare_ssh_binary_deny_message()
     )
 
 
 def test_bare_sftp_to_nas_is_denied() -> None:
-    assert _find_nas_ssh_violation("sftp -P 9222 jon@192.168.1.100") == _BARE_SSH_BINARY_MESSAGE
+    assert (
+        _find_nas_ssh_violation(f"sftp -P {NAS_SSH_PORT} {NAS_SSH_USER}@{NAS_HOST}")
+        == bare_ssh_binary_deny_message()
+    )
 
 
 def test_bare_ssh_to_nas_behind_launcher_wrapper_is_denied() -> None:
     assert (
-        _find_nas_ssh_violation('timeout 10 ssh -p 9222 jon@192.168.1.100 "uptime"')
-        == _BARE_SSH_BINARY_MESSAGE
+        _find_nas_ssh_violation(
+            f'timeout 10 ssh -p {NAS_SSH_PORT} {NAS_SSH_USER}@{NAS_HOST} "uptime"'
+        )
+        == bare_ssh_binary_deny_message()
     )
 
 
 def test_bare_ssh_to_nas_after_shell_operator_is_denied() -> None:
     assert (
-        _find_nas_ssh_violation('cd /tmp && ssh -p 9222 jon@192.168.1.100 "uptime"')
-        == _BARE_SSH_BINARY_MESSAGE
+        _find_nas_ssh_violation(
+            f'cd /tmp && ssh -p {NAS_SSH_PORT} {NAS_SSH_USER}@{NAS_HOST} "uptime"'
+        )
+        == bare_ssh_binary_deny_message()
     )
 
 
 def test_bare_ssh_to_nas_after_glued_operator_is_denied() -> None:
     assert (
-        _find_nas_ssh_violation('true;ssh -p 9222 jon@192.168.1.100 "uptime"')
-        == _BARE_SSH_BINARY_MESSAGE
+        _find_nas_ssh_violation(
+            f'true;ssh -p {NAS_SSH_PORT} {NAS_SSH_USER}@{NAS_HOST} "uptime"'
+        )
+        == bare_ssh_binary_deny_message()
     )
 
 
 def test_bare_ssh_to_nas_after_pipe_ampersand_operator_is_denied() -> None:
     assert (
-        _find_nas_ssh_violation('echo start |& ssh -p 9222 jon@192.168.1.100 "echo hi"')
-        == _BARE_SSH_BINARY_MESSAGE
+        _find_nas_ssh_violation(
+            f'echo start |& ssh -p {NAS_SSH_PORT} {NAS_SSH_USER}@{NAS_HOST} "echo hi"'
+        )
+        == bare_ssh_binary_deny_message()
     )
 
 
@@ -74,18 +119,19 @@ def test_full_openssh_binary_to_nas_without_batchmode_is_denied() -> None:
     assert (
         _find_nas_ssh_violation(
             '"/c/Windows/System32/OpenSSH/ssh.exe" -o ConnectTimeout=10 '
-            '-p 9222 jon@192.168.1.100 "uptime"'
+            f'-p {NAS_SSH_PORT} {NAS_SSH_USER}@{NAS_HOST} "uptime"'
         )
-        == _MISSING_BATCH_MODE_MESSAGE
+        == missing_batch_mode_deny_message()
     )
 
 
 def test_full_openssh_scp_to_nas_without_batchmode_is_denied() -> None:
     assert (
         _find_nas_ssh_violation(
-            '"/c/Windows/System32/OpenSSH/scp.exe" -P 9222 file.txt jon@192.168.1.100:/volume1/'
+            '"/c/Windows/System32/OpenSSH/scp.exe" '
+            f"-P {NAS_SSH_PORT} file.txt {NAS_SSH_USER}@{NAS_HOST}:/volume1/"
         )
-        == _MISSING_BATCH_MODE_MESSAGE
+        == missing_batch_mode_deny_message()
     )
 
 
@@ -93,7 +139,7 @@ def test_full_openssh_binary_to_nas_with_batchmode_is_allowed() -> None:
     assert (
         _find_nas_ssh_violation(
             '"/c/Windows/System32/OpenSSH/ssh.exe" -o BatchMode=yes '
-            '-o ConnectTimeout=10 -p 9222 jon@192.168.1.100 "uptime"'
+            f'-o ConnectTimeout=10 -p {NAS_SSH_PORT} {NAS_SSH_USER}@{NAS_HOST} "uptime"'
         )
         is None
     )
@@ -103,61 +149,72 @@ def test_full_openssh_binary_glued_batchmode_flag_is_allowed() -> None:
     assert (
         _find_nas_ssh_violation(
             '"/c/Windows/System32/OpenSSH/ssh.exe" -oBatchMode=yes '
-            '-p 9222 jon@192.168.1.100 "uptime"'
+            f'-p {NAS_SSH_PORT} {NAS_SSH_USER}@{NAS_HOST} "uptime"'
         )
         is None
     )
 
 
 def test_bare_ssh_to_other_host_is_allowed() -> None:
-    assert _find_nas_ssh_violation('ssh -p 22 jon@example.com "uptime"') is None
+    assert _find_nas_ssh_violation(f'ssh -p 22 {NAS_SSH_USER}@example.com "uptime"') is None
 
 
 def test_full_openssh_binary_to_other_host_without_batchmode_is_allowed() -> None:
     assert (
         _find_nas_ssh_violation(
-            '"/c/Windows/System32/OpenSSH/ssh.exe" -p 22 jon@example.com "uptime"'
+            f'"/c/Windows/System32/OpenSSH/ssh.exe" -p 22 {NAS_SSH_USER}@example.com "uptime"'
         )
         is None
     )
 
 
-def test_nas_ip_as_echoed_data_is_allowed() -> None:
-    assert _find_nas_ssh_violation('echo "connect via ssh to 192.168.1.100"') is None
+def test_nas_host_as_echoed_data_is_allowed() -> None:
+    assert _find_nas_ssh_violation(f'echo "connect via ssh to {NAS_HOST}"') is None
 
 
-def test_nas_ip_mentioned_without_ssh_command_word_is_allowed() -> None:
-    assert _find_nas_ssh_violation("ping -c 1 192.168.1.100") is None
+def test_nas_host_mentioned_without_ssh_command_word_is_allowed() -> None:
+    assert _find_nas_ssh_violation(f"ping -c 1 {NAS_HOST}") is None
 
 
 def test_ssh_family_word_only_in_remote_command_argument_is_allowed() -> None:
     assert (
         _find_nas_ssh_violation(
             '"/c/Windows/System32/OpenSSH/ssh.exe" -o BatchMode=yes '
-            '-p 9222 jon@192.168.1.100 "grep ssh /etc/config"'
+            f'-p {NAS_SSH_PORT} {NAS_SSH_USER}@{NAS_HOST} "grep ssh /etc/config"'
         )
         is None
     )
 
 
-def test_nas_ip_in_different_segment_than_ssh_is_allowed() -> None:
-    assert _find_nas_ssh_violation('echo 192.168.1.100 && ssh -p 22 jon@example.com "id"') is None
+def test_nas_host_in_different_segment_than_ssh_is_allowed() -> None:
+    assert (
+        _find_nas_ssh_violation(
+            f'echo {NAS_HOST} && ssh -p 22 {NAS_SSH_USER}@example.com "id"'
+        )
+        is None
+    )
 
 
-def test_ssh_to_other_host_with_nas_ip_in_remote_command_is_allowed() -> None:
+def test_ssh_to_other_host_with_nas_host_in_remote_command_is_allowed() -> None:
     assert (
-        _find_nas_ssh_violation('ssh -p 22 jon@example.com "ping -c1 192.168.1.100"') is None
+        _find_nas_ssh_violation(
+            f'ssh -p 22 {NAS_SSH_USER}@example.com "ping -c1 {NAS_HOST}"'
+        )
+        is None
     )
 
 
-def test_scp_to_other_host_with_nas_ip_in_remote_path_is_allowed() -> None:
+def test_scp_to_other_host_with_nas_host_in_remote_path_is_allowed() -> None:
     assert (
-        _find_nas_ssh_violation("scp -P 22 f.txt jon@example.com:/backup/192.168.1.100/") is None
+        _find_nas_ssh_violation(
+            f"scp -P 22 f.txt {NAS_SSH_USER}@example.com:/backup/{NAS_HOST}/"
+        )
+        is None
     )
 
 
-def test_similar_ip_prefix_is_not_matched() -> None:
-    assert _find_nas_ssh_violation('ssh -p 22 jon@192.168.1.1000 "id"') is None
+def test_similar_host_suffix_is_not_matched() -> None:
+    assert _find_nas_ssh_violation(f'ssh -p 22 {NAS_SSH_USER}@{NAS_HOST}x "id"') is None
 
 
 def test_empty_command_is_allowed() -> None:
@@ -165,4 +222,4 @@ def test_empty_command_is_allowed() -> None:
 
 
 def test_unbalanced_quotes_command_is_allowed() -> None:
-    assert _find_nas_ssh_violation("ssh 'unterminated 192.168.1.100") is None
+    assert _find_nas_ssh_violation(f"ssh 'unterminated {NAS_HOST}") is None