claude-dev-env 1.95.0 → 2.0.1

package/hooks/blocking/test_pii_payload_scan.py

@@ -0,0 +1,168 @@
+"""Behavior tests for the Write/Edit payload PII evaluation."""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+_HOOK_DIR = Path(__file__).parent
+_HOOKS_DIR = _HOOK_DIR.parent
+
+try:
+    from pii_payload_scan import evaluate_post_body_texts, evaluate_write_edit_payload
+except ImportError:
+    for each_bootstrap_directory in (str(_HOOK_DIR), str(_HOOKS_DIR)):
+        if each_bootstrap_directory not in sys.path:
+            sys.path.insert(0, each_bootstrap_directory)
+    from pii_payload_scan import evaluate_post_body_texts, evaluate_write_edit_payload
+
+_ALLOW_SLUG = "AllowOwner/allow-repo"
+_OTHER_SLUG = "OtherOwner/other-repo"
+
+
+def test_post_body_with_pii_is_blocked_by_default() -> None:
+    deny_reason = evaluate_post_body_texts([_assembled_fixture_email()])
+    assert deny_reason is not None
+    assert "post body" in deny_reason
+
+
+def test_post_body_allowlisted_values_plumb_through_to_the_scan() -> None:
+    allowed_value = _assembled_fixture_email()
+    deny_reason = evaluate_post_body_texts(
+        [allowed_value], all_allowlisted_values=frozenset({allowed_value})
+    )
+    assert deny_reason is None
+
+
+def test_post_body_unlisted_value_still_blocked_beside_allowlist() -> None:
+    deny_reason = evaluate_post_body_texts(
+        [_assembled_unlisted_email()],
+        all_allowlisted_values=frozenset({_assembled_fixture_email()}),
+    )
+    assert deny_reason is not None
+    assert "post body" in deny_reason
+
+
+def _assembled_fixture_email() -> str:
+    return "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
+
+
+def _assembled_unlisted_email() -> str:
+    return "other.person" + "@" + "different-co" + ".example" + ".io"
+
+
+def _write_allowlist_identity(identity_path: Path, slug: str, value: str) -> None:
+    identity_path.write_text(
+        json.dumps({"pii_allowlisted_values": {slug: [value]}}),
+        encoding="utf-8",
+    )
+
+
+def _init_repo_with_github_origin(repository_root: Path, origin_slug: str) -> None:
+    repository_root.mkdir(parents=True, exist_ok=True)
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    origin_url = "https://github.com/" + origin_slug + ".git"
+    subprocess.run(
+        ["git", "remote", "add", "origin", origin_url],
+        cwd=repository_root,
+        check=True,
+    )
+
+
+def _write_deny_reason(target_path: Path, value: str) -> str | None:
+    content = "owner email " + value + "\n"
+    return evaluate_write_edit_payload(
+        "Write", {"file_path": str(target_path), "content": content}
+    )
+
+
+def test_write_payload_with_a_fixture_email_is_flagged(tmp_path: Path) -> None:
+    deny_reason = _write_deny_reason(tmp_path / "notes.md", _assembled_fixture_email())
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_allowlisted_value_under_the_allowlisted_repo_is_allowed(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    allowed_value = _assembled_fixture_email()
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+    assert _write_deny_reason(repository_root / "notes.md", allowed_value) is None
+
+
+def test_allowlisted_value_in_a_different_repo_is_blocked(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    allowed_value = _assembled_fixture_email()
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _OTHER_SLUG)
+    deny_reason = _write_deny_reason(repository_root / "notes.md", allowed_value)
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_unlisted_value_in_the_allowlisted_repo_is_blocked(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, _assembled_fixture_email())
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+    deny_reason = _write_deny_reason(
+        repository_root / "notes.md", _assembled_unlisted_email()
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_clean_write_payload_skips_repository_resolution(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, _assembled_fixture_email())
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+
+    def _fail_if_called(_working_directory: str | None) -> None:
+        raise AssertionError(
+            "resolve_repository_root should not run for a payload with no PII"
+        )
+
+    monkeypatch.setattr(
+        sys.modules["pii_payload_scan"], "resolve_repository_root", _fail_if_called
+    )
+    deny_reason = evaluate_write_edit_payload(
+        "Write",
+        {
+            "file_path": str(repository_root / "notes.md"),
+            "content": "nothing sensitive here\n",
+        },
+    )
+    assert deny_reason is None
+
+
+def test_allowlisted_value_under_missing_nested_parent_is_allowed(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    allowed_value = _assembled_fixture_email()
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+    nested_target = repository_root / "new_dir" / "deeper" / "notes.md"
+    assert not nested_target.parent.exists()
+    assert _write_deny_reason(nested_target, allowed_value) is None

package/hooks/blocking/test_tdd_enforcer_restore.py

@@ -0,0 +1,108 @@
+"""End-to-end tests for the absent-but-tracked restore exemption.
+
+Drives the real ``tdd_enforcer.py`` entry hook over a Write payload in a temp
+git repository, proving a remove-then-Write rewrite of committed code is allowed
+even when the paired test's freshness window has lapsed, while new untracked
+code and real edits to a present file stay gated.
+"""
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+SCRIPT_PATH = Path(__file__).parent / "tdd_enforcer.py"
+STALE_MTIME_OFFSET_SECONDS = 700
+DISABLE_EPHEMERAL_ENVIRONMENT = {"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"}
+
+
+def _run_hook(payload: dict) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        [sys.executable, str(SCRIPT_PATH)],
+        input=json.dumps(payload),
+        text=True,
+        capture_output=True,
+        check=False,
+        env={**os.environ, **DISABLE_EPHEMERAL_ENVIRONMENT},
+    )
+
+
+def _write_payload(file_path: Path, content: str) -> dict:
+    return {"tool_name": "Write", "tool_input": {"file_path": str(file_path), "content": content}}
+
+
+def _decision_from(completed: subprocess.CompletedProcess[str]) -> str | None:
+    if not completed.stdout:
+        return None
+    hook_output = json.loads(completed.stdout).get("hookSpecificOutput", {})
+    return hook_output.get("permissionDecision")
+
+
+def _run_git(repository_root: Path, *arguments: str) -> None:
+    subprocess.run(
+        ["git", *arguments],
+        cwd=str(repository_root),
+        check=True,
+        capture_output=True,
+        env={**os.environ, "GIT_CONFIG_GLOBAL": os.devnull, "GIT_CONFIG_SYSTEM": os.devnull},
+    )
+
+
+def _init_git_repository(repository_root: Path) -> None:
+    _run_git(repository_root, "init", "-q")
+    _run_git(repository_root, "config", "user.email", "test@example.com")
+    _run_git(repository_root, "config", "user.name", "Test")
+    _run_git(repository_root, "config", "commit.gpgsign", "false")
+
+
+def _commit_tracked_service(repository_root: Path) -> tuple[Path, Path]:
+    production_file = repository_root / "service.py"
+    production_file.write_text("def serve(): return 1\n")
+    sibling_test = repository_root / "test_service.py"
+    sibling_test.write_text("def test_serve(): pass\n")
+    _run_git(repository_root, "add", "-A")
+    _run_git(repository_root, "commit", "-q", "-m", "init")
+    return production_file, sibling_test
+
+
+def test_should_allow_restore_write_of_absent_but_tracked_file_despite_stale_window(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _init_git_repository(repository_root)
+    production_file, sibling_test = _commit_tracked_service(repository_root)
+    stale_timestamp = os.stat(sibling_test).st_mtime - STALE_MTIME_OFFSET_SECONDS
+    os.utime(sibling_test, (stale_timestamp, stale_timestamp))
+    production_file.unlink()
+
+    completed = _run_hook(_write_payload(production_file, "def serve(): return 2\n"))
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_still_deny_write_of_absent_untracked_file_without_fresh_test(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _init_git_repository(repository_root)
+    untracked_file = repository_root / "brand_new.py"
+
+    completed = _run_hook(_write_payload(untracked_file, "def fresh(): return 1\n"))
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_still_deny_write_of_present_file_with_stale_test(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _init_git_repository(repository_root)
+    production_file, sibling_test = _commit_tracked_service(repository_root)
+    stale_timestamp = os.stat(sibling_test).st_mtime - STALE_MTIME_OFFSET_SECONDS
+    os.utime(sibling_test, (stale_timestamp, stale_timestamp))
+
+    completed = _run_hook(_write_payload(production_file, "def serve(): return 2\n"))
+
+    assert _decision_from(completed) == "deny"

package/hooks/blocking/test_verifier_verdict_minter.py

@@ -69,6 +69,36 @@ def _write_sidecar(agent_transcript_file: pathlib.Path, agent_type: str) -> None
     )
 
 
+def _write_verdict_transcript(agent_transcript_file: pathlib.Path, verdict_body: str) -> None:
+    verdict_text = f"ok\n```verdict\n{verdict_body}\n```\n"
+    agent_transcript_file.write_text(
+        json.dumps(
+            {
+                "type": "assistant",
+                "message": {"content": [{"type": "text", "text": verdict_text}]},
+            }
+        )
+        + "\n",
+        encoding="utf-8",
+    )
+
+
+def _make_repo(tmp_path: pathlib.Path) -> pathlib.Path:
+    repo_root = tmp_path / "repo"
+    repo_root.mkdir()
+    return repo_root
+
+
+def _mint_payload(
+    agent_transcript_file: pathlib.Path, repo_root: pathlib.Path, agent_id: str
+) -> dict[str, str]:
+    return {
+        "agent_transcript_path": str(agent_transcript_file),
+        "cwd": str(repo_root),
+        "agent_id": agent_id,
+    }
+
+
 def test_resolves_subagent_type_from_sidecar(tmp_path: pathlib.Path) -> None:
     agent_transcript = tmp_path / "agent-7.jsonl"
     agent_transcript.write_text("", encoding="utf-8")
@@ -141,7 +171,7 @@ def test_verifier_type_without_a_verdict_mints_nothing(tmp_path: pathlib.Path) -
     assert mint_for_payload(payload) is None
 
 
-def _init_repo_with_upstream_and_edit(repo_root: pathlib.Path) -> None:
+def _init_repo_with_upstream(repo_root: pathlib.Path) -> None:
     subprocess.run(["git", "-C", str(repo_root), "init", "-q"], check=True)
     subprocess.run(
         ["git", "-C", str(repo_root), "config", "user.email", "verifier@test"], check=True
@@ -151,37 +181,20 @@ def _init_repo_with_upstream_and_edit(repo_root: pathlib.Path) -> None:
     subprocess.run(["git", "-C", str(repo_root), "add", "-A"], check=True)
     subprocess.run(["git", "-C", str(repo_root), "commit", "-qm", "init"], check=True)
     subprocess.run(["git", "-C", str(repo_root), "branch", "-f", "origin/main", "HEAD"], check=True)
+
+
+def _init_repo_with_upstream_and_edit(repo_root: pathlib.Path) -> None:
+    _init_repo_with_upstream(repo_root)
     (repo_root / "module.py").write_text("answer = 2\n", encoding="utf-8")
 
 
 def test_clean_verifier_verdict_mints_a_verdict_file(tmp_path: pathlib.Path) -> None:
-    repo_root = tmp_path / "repo"
-    repo_root.mkdir()
+    repo_root = _make_repo(tmp_path)
     _init_repo_with_upstream_and_edit(repo_root)
     agent_transcript = tmp_path / "agent-7.jsonl"
-    agent_transcript.write_text(
-        json.dumps(
-            {
-                "type": "assistant",
-                "message": {
-                    "content": [
-                        {
-                            "type": "text",
-                            "text": 'ok\n```verdict\n{"all_pass": true, "findings": []}\n```\n',
-                        }
-                    ]
-                },
-            }
-        )
-        + "\n",
-        encoding="utf-8",
-    )
+    _write_verdict_transcript(agent_transcript, '{"all_pass": true, "findings": []}')
     _write_sidecar(agent_transcript, MINTING_AGENT_TYPE)
-    payload = {
-        "agent_transcript_path": str(agent_transcript),
-        "cwd": str(repo_root),
-        "agent_id": "a02b9583eedc74093",
-    }
+    payload = _mint_payload(agent_transcript, repo_root, "a02b9583eedc74093")
     verdict_path = mint_for_payload(payload)
     try:
         assert verdict_path is not None
@@ -199,7 +212,8 @@ def _deny_rules() -> list[str]:
 
 
 def test_settings_deny_verdict_directory_write() -> None:
-    assert "Write($HOME/.claude/verification/**)" in _deny_rules()
+    assert "Edit($HOME/.claude/verification/**)" in _deny_rules()
+    assert "Write($HOME/.claude/verification/**)" not in _deny_rules()
 
 
 def test_settings_deny_verdict_directory_edit() -> None:
@@ -209,87 +223,28 @@ def test_settings_deny_verdict_directory_edit() -> None:
 def test_minter_refuses_when_attested_hash_equals_empty_surface_hash(
     tmp_path: pathlib.Path,
 ) -> None:
-    repo_root = tmp_path / "repo"
-    repo_root.mkdir()
+    repo_root = _make_repo(tmp_path)
     _init_repo_with_upstream_and_edit(repo_root)
     attested_empty = empty_surface_hash()
     verdict_fence = json.dumps(
         {"all_pass": True, "findings": [], "manifest_sha256": attested_empty}
     )
     agent_transcript = tmp_path / "agent-7.jsonl"
-    agent_transcript.write_text(
-        json.dumps(
-            {
-                "type": "assistant",
-                "message": {
-                    "content": [
-                        {
-                            "type": "text",
-                            "text": f"ok\n```verdict\n{verdict_fence}\n```\n",
-                        }
-                    ]
-                },
-            }
-        )
-        + "\n",
-        encoding="utf-8",
-    )
+    _write_verdict_transcript(agent_transcript, verdict_fence)
     _write_sidecar(agent_transcript, MINTING_AGENT_TYPE)
-    payload = {
-        "agent_transcript_path": str(agent_transcript),
-        "cwd": str(repo_root),
-        "agent_id": "empty-surface-1",
-    }
+    payload = _mint_payload(agent_transcript, repo_root, "empty-surface-1")
     assert mint_for_payload(payload) is None
 
 
 def test_minter_refuses_when_recomputed_surface_is_empty(
     tmp_path: pathlib.Path,
 ) -> None:
-    repo_root = tmp_path / "repo"
-    repo_root.mkdir()
-    subprocess.run(["git", "-C", str(repo_root), "init", "-q"], check=True)
-    subprocess.run(
-        ["git", "-C", str(repo_root), "config", "user.email", "verifier@test"],
-        check=True,
-    )
-    subprocess.run(
-        ["git", "-C", str(repo_root), "config", "user.name", "verifier"],
-        check=True,
-    )
-    (repo_root / "module.py").write_text("answer = 1\n", encoding="utf-8")
-    subprocess.run(["git", "-C", str(repo_root), "add", "-A"], check=True)
-    subprocess.run(
-        ["git", "-C", str(repo_root), "commit", "-qm", "init"], check=True
-    )
-    subprocess.run(
-        ["git", "-C", str(repo_root), "branch", "-f", "origin/main", "HEAD"],
-        check=True,
-    )
+    repo_root = _make_repo(tmp_path)
+    _init_repo_with_upstream(repo_root)
     agent_transcript = tmp_path / "agent-7.jsonl"
-    agent_transcript.write_text(
-        json.dumps(
-            {
-                "type": "assistant",
-                "message": {
-                    "content": [
-                        {
-                            "type": "text",
-                            "text": 'ok\n```verdict\n{"all_pass": true, "findings": []}\n```\n',
-                        }
-                    ]
-                },
-            }
-        )
-        + "\n",
-        encoding="utf-8",
-    )
+    _write_verdict_transcript(agent_transcript, '{"all_pass": true, "findings": []}')
     _write_sidecar(agent_transcript, MINTING_AGENT_TYPE)
-    payload = {
-        "agent_transcript_path": str(agent_transcript),
-        "cwd": str(repo_root),
-        "agent_id": "empty-recompute-1",
-    }
+    payload = _mint_payload(agent_transcript, repo_root, "empty-recompute-1")
     assert mint_for_payload(payload) is None
 
 
@@ -297,23 +252,7 @@ def test_resolves_none_when_sidecar_absent_even_with_verdict_fence(
     tmp_path: pathlib.Path,
 ) -> None:
     agent_transcript = tmp_path / "agent-7.jsonl"
-    agent_transcript.write_text(
-        json.dumps(
-            {
-                "type": "assistant",
-                "message": {
-                    "content": [
-                        {
-                            "type": "text",
-                            "text": 'ok\n```verdict\n{"all_pass": true, "findings": []}\n```\n',
-                        }
-                    ]
-                },
-            }
-        )
-        + "\n",
-        encoding="utf-8",
-    )
+    _write_verdict_transcript(agent_transcript, '{"all_pass": true, "findings": []}')
     payload = {"agent_transcript_path": str(agent_transcript)}
     assert resolved_subagent_type(payload) is None
 
@@ -321,67 +260,25 @@ def test_resolves_none_when_sidecar_absent_even_with_verdict_fence(
 def test_does_not_mint_when_sidecar_absent_but_transcript_has_verdict(
     tmp_path: pathlib.Path,
 ) -> None:
-    repo_root = tmp_path / "repo"
-    repo_root.mkdir()
+    repo_root = _make_repo(tmp_path)
     _init_repo_with_upstream_and_edit(repo_root)
     agent_transcript = tmp_path / "agent-7.jsonl"
-    agent_transcript.write_text(
-        json.dumps(
-            {
-                "type": "assistant",
-                "message": {
-                    "content": [
-                        {
-                            "type": "text",
-                            "text": 'ok\n```verdict\n{"all_pass": true, "findings": []}\n```\n',
-                        }
-                    ]
-                },
-            }
-        )
-        + "\n",
-        encoding="utf-8",
-    )
-    payload = {
-        "agent_transcript_path": str(agent_transcript),
-        "cwd": str(repo_root),
-        "agent_id": "no-sidecar-1",
-    }
+    _write_verdict_transcript(agent_transcript, '{"all_pass": true, "findings": []}')
+    payload = _mint_payload(agent_transcript, repo_root, "no-sidecar-1")
     assert mint_for_payload(payload) is None
 
 
 def test_attested_manifest_hash_binds_over_cwd_surface(tmp_path: pathlib.Path) -> None:
-    repo_root = tmp_path / "repo"
-    repo_root.mkdir()
+    repo_root = _make_repo(tmp_path)
     _init_repo_with_upstream_and_edit(repo_root)
     attested_hash = "c" * 64
-    agent_transcript = tmp_path / "agent-7.jsonl"
     verdict_fence = json.dumps(
         {"all_pass": True, "findings": [], "manifest_sha256": attested_hash}
     )
-    agent_transcript.write_text(
-        json.dumps(
-            {
-                "type": "assistant",
-                "message": {
-                    "content": [
-                        {
-                            "type": "text",
-                            "text": f"ok\n```verdict\n{verdict_fence}\n```\n",
-                        }
-                    ]
-                },
-            }
-        )
-        + "\n",
-        encoding="utf-8",
-    )
+    agent_transcript = tmp_path / "agent-7.jsonl"
+    _write_verdict_transcript(agent_transcript, verdict_fence)
     _write_sidecar(agent_transcript, MINTING_AGENT_TYPE)
-    payload = {
-        "agent_transcript_path": str(agent_transcript),
-        "cwd": str(repo_root),
-        "agent_id": "attest-1",
-    }
+    payload = _mint_payload(agent_transcript, repo_root, "attest-1")
     verdict_path = mint_for_payload(payload)
     try:
         assert verdict_path is not None

package/hooks/blocking/tests/conftest.py

@@ -0,0 +1,10 @@
+"""Put the blocking and hooks directories on sys.path for the blocking tests."""
+
+import sys
+from pathlib import Path
+
+_blocking_directory = str(Path(__file__).resolve().parents[1])
+_hooks_directory = str(Path(__file__).resolve().parents[2])
+for each_bootstrap_directory in (_blocking_directory, _hooks_directory):
+    if each_bootstrap_directory not in sys.path:
+        sys.path.insert(0, each_bootstrap_directory)