claude-dev-env 1.94.0 → 2.0.0

package/hooks/hooks_constants/test_local_identity.py

@@ -8,9 +8,11 @@ import sys
 from pathlib import Path
 from unittest.mock import patch
 
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from hooks_constants import local_identity  # noqa: E402
+try:
+    from hooks_constants import local_identity
+except ImportError:
+    sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+    from hooks_constants import local_identity
 
 ALL_NAS_ENV_VARS = ("CLAUDE_NAS_HOST", "CLAUDE_NAS_SSH_USER", "CLAUDE_NAS_SSH_PORT")
 
@@ -134,6 +136,106 @@ class TestPiiExemptRepositorySlugs:
                 assert slugs == frozenset({"fileowner/file-repo"})
 
 
+class TestPiiAllowlistedValuesByRepository:
+    def test_reads_the_mapping_lowercasing_slugs_and_keeping_values_exact(
+        self, tmp_path: Path
+    ) -> None:
+        allowed_value = "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
+        identity_path = tmp_path / "local-identity.json"
+        identity_path.write_text(
+            json.dumps(
+                {"pii_allowlisted_values": {"Owner/Private-Repo": [allowed_value]}}
+            ),
+            encoding="utf-8",
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(identity_path)},
+            clear=False,
+        ):
+            values_by_slug = local_identity.pii_allowlisted_values_by_repository()
+            assert values_by_slug == {"owner/private-repo": frozenset({allowed_value})}
+
+    def test_returns_empty_mapping_when_the_file_is_missing(
+        self, tmp_path: Path
+    ) -> None:
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(tmp_path / "absent.json")},
+            clear=False,
+        ):
+            assert local_identity.pii_allowlisted_values_by_repository() == {}
+
+    def test_returns_empty_mapping_when_the_json_is_corrupt(
+        self, tmp_path: Path
+    ) -> None:
+        identity_path = tmp_path / "local-identity.json"
+        identity_path.write_text("{ not valid json", encoding="utf-8")
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(identity_path)},
+            clear=False,
+        ):
+            assert local_identity.pii_allowlisted_values_by_repository() == {}
+
+    def test_returns_empty_mapping_when_the_key_is_absent(
+        self, tmp_path: Path
+    ) -> None:
+        identity_path = tmp_path / "local-identity.json"
+        identity_path.write_text(
+            json.dumps({"nas": {"host": "10.0.0.5"}}), encoding="utf-8"
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(identity_path)},
+            clear=False,
+        ):
+            assert local_identity.pii_allowlisted_values_by_repository() == {}
+
+    def test_drops_blank_slugs_and_non_list_value_entries(
+        self, tmp_path: Path
+    ) -> None:
+        allowed_value = "keep.fixture" + "@" + "acme-corp" + ".example" + ".io"
+        identity_path = tmp_path / "local-identity.json"
+        identity_path.write_text(
+            json.dumps(
+                {
+                    "pii_allowlisted_values": {
+                        "  ": [allowed_value],
+                        "Owner/Repo": allowed_value,
+                        "Owner/Kept": [allowed_value, 7],
+                    }
+                }
+            ),
+            encoding="utf-8",
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(identity_path)},
+            clear=False,
+        ):
+            values_by_slug = local_identity.pii_allowlisted_values_by_repository()
+            assert values_by_slug == {"owner/kept": frozenset({allowed_value})}
+
+
+class TestLocalIdentityPathOverride:
+    def test_prefers_the_env_path_over_the_home_directory_file(
+        self, tmp_path: Path
+    ) -> None:
+        override_path = tmp_path / "override" / "local-identity.json"
+        override_path.parent.mkdir()
+        override_path.write_text(
+            json.dumps({"nas": {"host": "10.9.9.9"}}), encoding="utf-8"
+        )
+        with patch.dict(
+            os.environ,
+            {"CLAUDE_LOCAL_IDENTITY_PATH": str(override_path)},
+            clear=False,
+        ), patch.object(Path, "home", return_value=tmp_path):
+            _clear_nas_env()
+            assert local_identity.nas_host() == "10.9.9.9"
+
+
 class TestDenyMessagesQuoteTheResolvedHost:
     def should_include_the_resolved_host_and_port_in_the_bare_binary_message(
         self,

package/hooks/pyproject.toml

@@ -9,10 +9,23 @@
 mypy_path = "."
 python_version = "3.13"
 ignore_missing_imports = true
-warn_unused_ignores = true
+warn_unused_ignores = false
 warn_redundant_casts = true
 no_implicit_optional = true
 strict_equality = true
+exclude = [
+    "validators/test_files/",
+    "test_",
+    "abbreviation_checks.py",
+    "git_checks.py",
+    "exempt_paths.py",
+    "code_rules_typeddict_stub.py",
+]
+
+
+[[tool.mypy.overrides]]
+module = ["exempt_paths", "code_rules_path_utils", "gh_pr_author_enforcer"]
+warn_unused_ignores = false
 
 [[tool.mypy.overrides]]
 module = "tests.*"
@@ -26,6 +39,7 @@ extend-exclude = [
     ".claude",
     "node_modules",
     "__pycache__",
+    "validators/test_files",
 ]
 
 [tool.ruff.lint]
@@ -39,16 +53,50 @@ select = [
     "SIM",
     "PL",
 ]
+# Principled + pure-style ignores (#51/#57). Non-negotiable defect classes stay selected.
 ignore = [
     "E501",
+    "E402",
+    "UP038",
+    "UP006",
+    "UP007",
+    "UP015",
+    "UP017",
+    "UP020",
+    "UP024",
+    "UP035",
+    "UP045",
+    "I001",
+    "B009",
+    "F541",
+    "PLR0911",
+    "PLR0912",
     "PLR0913",
+    "PLR0915",
+    "PLR1714",
     "PLR2004",
+    "PLR5501",
+    "PLC0414",
+    "PLC0415",
+    "SIM101",
+    "SIM102",
+    "SIM103",
+    "SIM105",
+    "SIM109",
+    "SIM110",
+    "SIM113",
+    "SIM114",
+    "SIM117",
+    "SIM300",
 ]
 
 [tool.ruff.lint.per-file-ignores]
-"test_*.py" = ["B011", "PLR2004"]
-"*_test.py" = ["B011", "PLR2004"]
-"conftest.py" = ["B011"]
+# Residual production carve-outs re-homed on #57 (gate friction on multi-line touch).
+"validators/run_all_validators.py" = ["PLW1510"]
+"validators/exempt_paths.py" = ["F401"]
+"test_*.py" = ["B011", "PLR2004", "F401", "F841", "PLW1510", "B905", "B033", "SIM115", "B007", "B018", "B904"]
+"*_test.py" = ["B011", "PLR2004", "F401", "F841", "PLW1510", "B905", "B033", "SIM115", "B007", "B018", "B904"]
+"conftest.py" = ["B011", "F401", "F841", "PLW1510"]
 
 [tool.coverage.run]
 branch = true

package/hooks/session/plugin_data_dir_cleanup.py

@@ -13,7 +13,6 @@ separate from the EEXIST fixes in v2.1.70-v2.1.72.
 """
 
 import os
-import sys
 
 PLUGINS_DATA_DIRECTORY = os.path.join(
     os.path.expanduser("~"), ".claude", "plugins", "data"

package/hooks/validation/mypy_validator.py

@@ -70,7 +70,7 @@ def discover_project_root(target_file: str) -> Path | None:
     try:
         completed_process = subprocess.run(
             ["git", "rev-parse", "--show-toplevel"],
-            capture_output=True,
+            check=False, capture_output=True,
             text=True,
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=str(Path(target_file).parent),
@@ -359,7 +359,7 @@ def run_mypy(target_file: str, project_root: str) -> tuple[int, str]:
 
     completed_process = subprocess.run(
         mypy_command,
-        capture_output=True,
+        check=False, capture_output=True,
         text=True,
         env=os.environ.copy(),
         timeout=MYPY_TIMEOUT_SECONDS,

package/hooks/validators/CLAUDE.md

@@ -12,6 +12,7 @@ A library of check modules used by the validation hooks. Each module focuses on
 | `output_formatter.py` | Formats `Violation` lists into human-readable output |
 | `run_all_validators.py` | Entry point — runs every check module and aggregates results |
 | `health_check.py` | Verifies that all validator dependencies (ruff, mypy) are reachable |
+| `python_style_helpers.py` | Shared source-line splitting and function-discovery helpers imported by `python_style_checks.py` |
 
 ## Check modules
 
@@ -33,7 +34,6 @@ A library of check modules used by the validation hooks. Each module focuses on
 | `todo_checks.py` | TODO/FIXME markers without an associated issue reference |
 | `type_safety_checks.py` | Type-safety rules (no `Any`, no `cast`, no `# type: ignore`) |
 | `useless_test_checks.py` | Tests that check only existence or constant values |
-| `verify_paths.py` | Validates that file paths referenced in code actually exist |
 
 ## Subdirectory
 

package/hooks/validators/README.md

@@ -2,6 +2,8 @@
 
 AST-based Python style checks for code quality enforcement.
 
+The checks live in `python_style_checks.py`; the shared source-line splitting and function-discovery helpers they build on live in `python_style_helpers.py`.
+
 ## Checks Implemented
 
 1. **Imports at top** - All import statements must be at the top of the file

package/hooks/validators/health_check.py

@@ -110,6 +110,7 @@ def check_optional_tool(tool_name: str) -> bool:
     try:
         result = subprocess.run(
             [tool_name, "--version"],
+            check=False,
             capture_output=True,
             text=True,
         )

package/hooks/validators/mypy_integration.py

@@ -18,6 +18,7 @@ def check_mypy_available() -> bool:
     try:
         result = subprocess.run(
             ["mypy", "--version"],
+            check=False,
             capture_output=True,
             text=True,
         )
@@ -85,6 +86,7 @@ def run_mypy_check(files: list[Path]) -> MypyResult:
     result = subprocess.run(
         ["mypy", *config_argument, "--ignore-missing-imports", "--no-error-summary"]
         + py_files,
+        check=False,
         capture_output=True,
         text=True,
     )