claude-dev-env 1.93.0 → 1.94.0

package/hooks/hooks_constants/pr_description_enforcer_constants.py

@@ -121,6 +121,7 @@ DEFAULT_READABILITY_THRESHOLDS: ReadabilityThresholds = ReadabilityThresholds(
 __all__ = [
     "ALL_HEAVY_OPENING_HEADERS",
     "ALL_HEAVY_TESTING_HEADERS",
+    "ALL_PR_NUMBER_BEARING_GH_PR_SUBCOMMANDS",
     "ALL_READABILITY_CLI_FLAG_TOKENS",
     "ATOMIC_WRITE_TEMP_SUFFIX",
     "BLOCKQUOTE_LINE_PATTERN",
@@ -135,7 +136,6 @@ __all__ = [
     "FLESCH_SYLLABLES_PER_WORD_COEFFICIENT",
     "FLESCH_WORDS_PER_SENTENCE_COEFFICIENT",
     "GH_PR_COMMAND_MIN_TOKEN_COUNT",
-    "ALL_PR_NUMBER_BEARING_GH_PR_SUBCOMMANDS",
     "HEADING_LINE_PATTERN",
     "HEAVY_MIN_BODY_CHARS_FOR_CLASSIFICATION",
     "HEAVY_SHAPE",

package/hooks/hooks_constants/test_local_identity.py

@@ -66,6 +66,74 @@ class TestNasValuesPlaceholderDefault:
                 assert local_identity.nas_ssh_port() == 22
 
 
+class TestPiiExemptRepositorySlugs:
+    def should_read_slugs_from_the_environment_lowercased(self) -> None:
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_PII_EXEMPT_REPOS": "ExemptOwner/exempt-repo, Other/Repo"},
+            clear=False,
+        ):
+            slugs = local_identity.pii_exempt_repository_slugs()
+            assert slugs == frozenset({"exemptowner/exempt-repo", "other/repo"})
+
+    def should_read_slugs_from_the_local_identity_file(self, tmp_path: Path) -> None:
+        claude_home = tmp_path / ".claude"
+        claude_home.mkdir()
+        (claude_home / "local-identity.json").write_text(
+            json.dumps({"pii_exempt_repositories": ["FileOwner/file-repo"]}),
+            encoding="utf-8",
+        )
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("CLAUDE_PII_EXEMPT_REPOS", None)
+            with patch.object(Path, "home", return_value=tmp_path):
+                slugs = local_identity.pii_exempt_repository_slugs()
+                assert slugs == frozenset({"fileowner/file-repo"})
+
+    def should_return_an_empty_set_when_no_env_and_no_file(
+        self, tmp_path: Path
+    ) -> None:
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("CLAUDE_PII_EXEMPT_REPOS", None)
+            with patch.object(Path, "home", return_value=tmp_path):
+                assert local_identity.pii_exempt_repository_slugs() == frozenset()
+
+    def should_prefer_environment_slugs_over_local_identity_file(
+        self, tmp_path: Path
+    ) -> None:
+        claude_home = tmp_path / ".claude"
+        claude_home.mkdir()
+        (claude_home / "local-identity.json").write_text(
+            json.dumps({"pii_exempt_repositories": ["FileOwner/file-repo"]}),
+            encoding="utf-8",
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_PII_EXEMPT_REPOS": "EnvOwner/env-repo"},
+            clear=False,
+        ):
+            with patch.object(Path, "home", return_value=tmp_path):
+                slugs = local_identity.pii_exempt_repository_slugs()
+                assert slugs == frozenset({"envowner/env-repo"})
+
+    def should_fall_through_to_json_when_environment_is_whitespace_only(
+        self, tmp_path: Path
+    ) -> None:
+        claude_home = tmp_path / ".claude"
+        claude_home.mkdir()
+        (claude_home / "local-identity.json").write_text(
+            json.dumps({"pii_exempt_repositories": ["FileOwner/file-repo"]}),
+            encoding="utf-8",
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_PII_EXEMPT_REPOS": " , , "},
+            clear=False,
+        ):
+            with patch.object(Path, "home", return_value=tmp_path):
+                slugs = local_identity.pii_exempt_repository_slugs()
+                assert slugs == frozenset({"fileowner/file-repo"})
+
+
 class TestDenyMessagesQuoteTheResolvedHost:
     def should_include_the_resolved_host_and_port_in_the_bare_binary_message(
         self,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "1.93.0",
+    "version": "1.94.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/CLAUDE.md

@@ -21,6 +21,7 @@ Utility scripts installed into `~/.claude/scripts/` by `bin/install.mjs`. Each s
 | `Install-SweepEmptyDirs.ps1` | Registers `sweep_empty_dirs.py` as a scheduled task on Windows |
 | `check.ps1` | Runs the full code-quality check suite |
 | `Show-Asset.ps1` | Opens files on screen, sizing each image window to the image's pixel dimensions (scaled to fit the screen); non-image files open in their default application |
+| `Get-SessionAccount.ps1` | Reports which Claude account the current session is actually logged into by comparing `~/.claude.json`'s CLI login against a `CLAUDE_USER_DATA_DIR` desktop profile's `lastKnownAccountUuid`, recovering the desktop account's email from profile storage when the two accounts differ |
 
 ## Subdirectories
 
@@ -28,10 +29,18 @@ Utility scripts installed into `~/.claude/scripts/` by `bin/install.mjs`. Each s
 |---|---|
 | `dev_env_scripts_constants/` | Named constants (`timing.py`) for scripts in this directory |
 | `sync_to_cursor/` | Package that builds Cursor `.mdc` files from Claude rules and docs |
-| `tests/` | pytest suite for the Python scripts in this directory |
+| `tests/` | pytest suite for the Python scripts and Pester (`*.Tests.ps1`) suite for the PowerShell scripts in this directory |
 
 ## Running tests
 
+Python scripts (pytest):
+
 ```bash
 python -m pytest packages/claude-dev-env/scripts/tests/
 ```
+
+PowerShell scripts (Pester 5+, `*.Tests.ps1`):
+
+```powershell
+Invoke-Pester -Path packages/claude-dev-env/scripts/tests/
+```

package/scripts/Get-SessionAccount.ps1

@@ -0,0 +1,210 @@
+#!/usr/bin/env pwsh
+[CmdletBinding()]
+param(
+    [switch]$AsJson
+)
+
+$noiseEmailPatterns = @(
+    '@example\.(com|org|net)$',
+    '(@|\.)sentry\.io$',
+    '@anthropic\.',
+    '^Claude@\d'
+)
+
+$isoLatin1CodePage = 28591
+
+$profileStorageDirectoryNames = @('sentry', 'IndexedDB', 'Session Storage', 'WebStorage')
+
+$emailAddressPattern = '(?<![a-zA-Z0-9._%+-])[a-zA-Z0-9][a-zA-Z0-9._%+-]*@[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)+(?![a-zA-Z0-9-])'
+
+$maximumStorageFileBytes = 50MB
+
+function Test-NoiseEmail {
+    param([string]$Email)
+    foreach ($pattern in $noiseEmailPatterns) {
+        if ($Email -imatch $pattern) { return $true }
+    }
+    return $false
+}
+
+function Get-EncodingAgnosticTextView {
+    param([string]$FilePath)
+    try {
+        $fileBytes = [System.IO.File]::ReadAllBytes($FilePath)
+        if ($fileBytes.Length -eq 0) { return @() }
+        $isoLatin1Encoding = [System.Text.Encoding]::GetEncoding($isoLatin1CodePage)
+        return @(
+            $isoLatin1Encoding.GetString($fileBytes),
+            [System.Text.Encoding]::Unicode.GetString($fileBytes)
+        )
+    }
+    catch {
+        return @()
+    }
+}
+
+function Get-EmailCandidatesFromProfile {
+    param(
+        [string]$ProfileDirectory,
+        [string]$ExcludeEmail
+    )
+    $scanDirectories = $profileStorageDirectoryNames |
+        ForEach-Object { Join-Path $ProfileDirectory $_ } |
+        Where-Object { Test-Path -LiteralPath $_ }
+    $foundEmails = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+
+    foreach ($scanDirectory in $scanDirectories) {
+        $candidateFiles = Get-ChildItem -LiteralPath $scanDirectory -Recurse -File -ErrorAction SilentlyContinue |
+            Where-Object { $_.Length -lt $maximumStorageFileBytes }
+        foreach ($candidateFile in $candidateFiles) {
+            $decodedTextViews = Get-EncodingAgnosticTextView -FilePath $candidateFile.FullName
+            foreach ($decodedText in $decodedTextViews) {
+                foreach ($match in [regex]::Matches($decodedText, $emailAddressPattern)) {
+                    $candidateEmail = $match.Value
+                    $isKnownCliEmail = $ExcludeEmail -and ($candidateEmail -ieq $ExcludeEmail)
+                    if (-not (Test-NoiseEmail -Email $candidateEmail) -and -not $isKnownCliEmail) {
+                        [void]$foundEmails.Add($candidateEmail)
+                    }
+                }
+            }
+        }
+    }
+    return $foundEmails
+}
+
+function Write-AccountResult {
+    param(
+        [string]$Email,
+        [string]$AccountUuid,
+        [string]$Source,
+        [string]$CliEmail,
+        [string]$CliAccountUuid,
+        [switch]$AsJson
+    )
+    if ($AsJson) {
+        [pscustomobject]@{
+            account        = $Email
+            accountUuid    = $AccountUuid
+            source         = $Source
+            cliAccount     = $CliEmail
+            cliAccountUuid = $CliAccountUuid
+        } | ConvertTo-Json
+        return
+    }
+    Write-Output "Account: $Email"
+    Write-Output "AccountUuid: $AccountUuid"
+    Write-Output "Source: $Source"
+    if ($CliEmail) {
+        Write-Output "CliAccount: $CliEmail"
+        Write-Output "CliAccountUuid: $CliAccountUuid"
+    }
+}
+
+function Get-SessionAccountResult {
+    param(
+        [int]$ExitCode,
+        [string]$Email = $null,
+        [string]$AccountUuid = $null,
+        [string]$Source = $null,
+        [string]$CliEmail = $null,
+        [string]$CliAccountUuid = $null,
+        [string]$ErrorMessage = $null
+    )
+    [pscustomobject]@{
+        ExitCode       = $ExitCode
+        Email          = $Email
+        AccountUuid    = $AccountUuid
+        Source         = $Source
+        CliEmail       = $CliEmail
+        CliAccountUuid = $CliAccountUuid
+        ErrorMessage   = $ErrorMessage
+    }
+}
+
+function Resolve-SessionAccount {
+    param(
+        [string]$CliConfigPath,
+        [string]$ProfileDirectory
+    )
+    if (-not (Test-Path -LiteralPath $CliConfigPath)) {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "CLI config not found: $CliConfigPath"
+    }
+
+    try {
+        $cliConfig = Get-Content -LiteralPath $CliConfigPath -Raw -ErrorAction Stop | ConvertFrom-Json -AsHashtable -ErrorAction Stop
+    }
+    catch {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "Failed to parse CLI config as JSON: $CliConfigPath"
+    }
+
+    if ($cliConfig -isnot [System.Collections.IDictionary]) {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "CLI config top level is not a JSON object: $CliConfigPath"
+    }
+
+    $oauthAccount = $cliConfig['oauthAccount']
+    $cliEmail = if ($oauthAccount) { $oauthAccount['emailAddress'] } else { $null }
+    $cliAccountUuid = if ($oauthAccount) { $oauthAccount['accountUuid'] } else { $null }
+    if (-not $cliEmail -or -not $cliAccountUuid) {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "CLI config is missing oauthAccount.emailAddress or oauthAccount.accountUuid: $CliConfigPath"
+    }
+
+    if (-not $ProfileDirectory -or -not (Test-Path -LiteralPath $ProfileDirectory)) {
+        return Get-SessionAccountResult -ExitCode 0 -Email $cliEmail -AccountUuid $cliAccountUuid -Source 'cli-config'
+    }
+
+    $profileConfigPath = Join-Path $ProfileDirectory 'config.json'
+    if (-not (Test-Path -LiteralPath $profileConfigPath)) {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "Desktop profile config not found: $profileConfigPath"
+    }
+
+    try {
+        $profileConfig = Get-Content -LiteralPath $profileConfigPath -Raw -ErrorAction Stop | ConvertFrom-Json -AsHashtable -ErrorAction Stop
+    }
+    catch {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "Failed to parse desktop profile config as JSON: $profileConfigPath"
+    }
+
+    if ($profileConfig -isnot [System.Collections.IDictionary]) {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "Desktop profile config top level is not a JSON object: $profileConfigPath"
+    }
+
+    $profileAccountUuid = $profileConfig['lastKnownAccountUuid']
+    if (-not $profileAccountUuid) {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "Desktop profile config is missing lastKnownAccountUuid: $profileConfigPath"
+    }
+
+    if ($profileAccountUuid -eq $cliAccountUuid) {
+        return Get-SessionAccountResult -ExitCode 0 -Email $cliEmail -AccountUuid $cliAccountUuid -Source 'desktop-profile (matches cli-config)'
+    }
+
+    $candidateEmails = @(Get-EmailCandidatesFromProfile -ProfileDirectory $ProfileDirectory -ExcludeEmail $cliEmail)
+    if ($candidateEmails.Count -eq 1) {
+        return Get-SessionAccountResult -ExitCode 0 -Email $candidateEmails[0] -AccountUuid $profileAccountUuid -Source 'desktop-profile (differs from cli-config)' -CliEmail $cliEmail -CliAccountUuid $cliAccountUuid
+    }
+
+    if ($candidateEmails.Count -eq 0) {
+        return Get-SessionAccountResult -ExitCode 1 -ErrorMessage "Desktop profile account ($profileAccountUuid) differs from CLI config, but no candidate email was recovered from profile storage: $ProfileDirectory"
+    }
+
+    return Get-SessionAccountResult -ExitCode 1 -ErrorMessage "Desktop profile account ($profileAccountUuid) differs from CLI config, and multiple candidate emails were found in profile storage: $($candidateEmails -join ', ')"
+}
+
+function Invoke-GetSessionAccount {
+    param(
+        [switch]$AsJson
+    )
+    $cliConfigPath = Join-Path $HOME '.claude.json'
+    $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory $env:CLAUDE_USER_DATA_DIR
+    if ($sessionAccount.ErrorMessage) {
+        Write-Error $sessionAccount.ErrorMessage -ErrorAction Continue
+        exit $sessionAccount.ExitCode
+    }
+    Write-AccountResult -Email $sessionAccount.Email -AccountUuid $sessionAccount.AccountUuid -Source $sessionAccount.Source -CliEmail $sessionAccount.CliEmail -CliAccountUuid $sessionAccount.CliAccountUuid -AsJson:$AsJson
+    exit $sessionAccount.ExitCode
+}
+
+if ($MyInvocation.InvocationName -ne '.') {
+    Set-StrictMode -Version Latest
+    $ErrorActionPreference = 'Stop'
+    Invoke-GetSessionAccount -AsJson:$AsJson
+}

package/scripts/tests/CLAUDE.md

@@ -1,6 +1,6 @@
 # scripts/tests
 
-pytest suite for the Python scripts in `scripts/`.
+pytest suite for the Python scripts and Pester suite for the PowerShell scripts in `scripts/`.
 
 ## Test files
 
@@ -11,8 +11,22 @@ pytest suite for the Python scripts in `scripts/`.
 | `test_sweep_empty_dirs.py` | `sweep_empty_dirs.py` — age check, one-shot mode, and continuous-watch behavior |
 | `test_sync_to_cursor.py` | `sync_to_cursor/` package — mapping, hashing, manifest, and path resolution |
 
+## PowerShell test files
+
+| File | Covers |
+|---|---|
+| `Get-SessionAccount.Tests.ps1` | `Get-SessionAccount.ps1` — noise filtering, profile-storage email recovery, CLI-vs-desktop account resolution, and output formatting |
+
 ## Running
 
+Python scripts (pytest):
+
 ```bash
 python -m pytest packages/claude-dev-env/scripts/tests/
 ```
+
+PowerShell scripts (Pester 5+, `*.Tests.ps1`):
+
+```powershell
+Invoke-Pester -Path packages/claude-dev-env/scripts/tests/
+```