claude-dev-env 2.17.0 → 2.19.0

package/hooks/blocking/test_destructive_command_blocker_no_verify.py

@@ -5,34 +5,30 @@ hook signing and verification. The blocker must ASK before allowing them.
 """
 
 import json
-import os
-import subprocess
 import sys
 from pathlib import Path
 
+_BLOCKING_DIRECTORY = Path(__file__).resolve().parent
+if str(_BLOCKING_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_BLOCKING_DIRECTORY))
 
-SCRIPT_PATH = Path(__file__).parent / "destructive_command_blocker.py"
+import _path_setup  # noqa: E402, F401
 
+from test_hook_subprocess_support import (  # noqa: E402
+    build_bash_payload,
+    run_hook_as_subprocess,
+)
 
-def _run_hook(payload: dict) -> subprocess.CompletedProcess[str]:
-    child_environment = os.environ.copy()
-    return subprocess.run(
-        [sys.executable, str(SCRIPT_PATH)],
-        input=json.dumps(payload),
-        text=True,
-        capture_output=True,
-        check=False,
-        env=child_environment,
-    )
-
-
-def _make_bash_payload(command: str) -> dict:
-    return {"tool_name": "Bash", "tool_input": {"command": command}}
+SCRIPT_PATH = _BLOCKING_DIRECTORY / "destructive_command_blocker.py"
 
 
-def test_asks_on_git_commit_no_verify() -> None:
-    payload = _make_bash_payload('git commit -m "wip" --no-verify')
-    result = _run_hook(payload)
+def test_asks_on_git_commit_no_verify(tmp_path: Path) -> None:
+    result = run_hook_as_subprocess(
+        hook_script_path=SCRIPT_PATH,
+        payload_text=build_bash_payload('git commit -m "wip" --no-verify'),
+        working_directory=tmp_path,
+        home_directory=tmp_path,
+    )
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
         f"Expected ask for git commit --no-verify, got: {response!r}"
@@ -42,18 +38,26 @@ def test_asks_on_git_commit_no_verify() -> None:
     )
 
 
-def test_asks_on_git_push_no_verify() -> None:
-    payload = _make_bash_payload("git push --no-verify origin main")
-    result = _run_hook(payload)
+def test_asks_on_git_push_no_verify(tmp_path: Path) -> None:
+    result = run_hook_as_subprocess(
+        hook_script_path=SCRIPT_PATH,
+        payload_text=build_bash_payload("git push --no-verify origin main"),
+        working_directory=tmp_path,
+        home_directory=tmp_path,
+    )
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
         f"Expected ask for git push --no-verify, got: {response!r}"
     )
 
 
-def test_asks_on_git_no_gpg_sign() -> None:
-    payload = _make_bash_payload("git commit --no-gpg-sign -m wip")
-    result = _run_hook(payload)
+def test_asks_on_git_no_gpg_sign(tmp_path: Path) -> None:
+    result = run_hook_as_subprocess(
+        hook_script_path=SCRIPT_PATH,
+        payload_text=build_bash_payload("git commit --no-gpg-sign -m wip"),
+        working_directory=tmp_path,
+        home_directory=tmp_path,
+    )
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
         f"Expected ask for git --no-gpg-sign, got: {response!r}"
@@ -63,36 +67,52 @@ def test_asks_on_git_no_gpg_sign() -> None:
     ), f"Reason must mention --no-gpg-sign, got: {response!r}"
 
 
-def test_asks_on_git_commit_with_no_gpg_sign_config() -> None:
-    payload = _make_bash_payload("git -c commit.gpgsign=false commit -m wip")
-    result = _run_hook(payload)
+def test_asks_on_git_commit_with_no_gpg_sign_config(tmp_path: Path) -> None:
+    result = run_hook_as_subprocess(
+        hook_script_path=SCRIPT_PATH,
+        payload_text=build_bash_payload("git -c commit.gpgsign=false commit -m wip"),
+        working_directory=tmp_path,
+        home_directory=tmp_path,
+    )
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
         f"Expected ask for -c commit.gpgsign=false, got: {response!r}"
     )
 
 
-def test_asks_on_quoted_gpgsign_config() -> None:
-    payload = _make_bash_payload("git -c 'commit.gpgsign=false' commit -m wip")
-    result = _run_hook(payload)
+def test_asks_on_quoted_gpgsign_config(tmp_path: Path) -> None:
+    result = run_hook_as_subprocess(
+        hook_script_path=SCRIPT_PATH,
+        payload_text=build_bash_payload("git -c 'commit.gpgsign=false' commit -m wip"),
+        working_directory=tmp_path,
+        home_directory=tmp_path,
+    )
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
         f"Expected ask for quoted -c commit.gpgsign=false, got: {response!r}"
     )
 
 
-def test_asks_on_value_quoted_gpgsign_config() -> None:
-    payload = _make_bash_payload("git -c commit.gpgsign='false' commit -m wip")
-    result = _run_hook(payload)
+def test_asks_on_value_quoted_gpgsign_config(tmp_path: Path) -> None:
+    result = run_hook_as_subprocess(
+        hook_script_path=SCRIPT_PATH,
+        payload_text=build_bash_payload("git -c commit.gpgsign='false' commit -m wip"),
+        working_directory=tmp_path,
+        home_directory=tmp_path,
+    )
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
         f"Expected ask for value-quoted -c commit.gpgsign='false', got: {response!r}"
     )
 
 
-def test_normal_git_commit_passes() -> None:
-    payload = _make_bash_payload('git commit -m "real commit"')
-    result = _run_hook(payload)
+def test_normal_git_commit_passes(tmp_path: Path) -> None:
+    result = run_hook_as_subprocess(
+        hook_script_path=SCRIPT_PATH,
+        payload_text=build_bash_payload('git commit -m "real commit"'),
+        working_directory=tmp_path,
+        home_directory=tmp_path,
+    )
     if not result.stdout.strip():
         return
     response = json.loads(result.stdout)

package/hooks/blocking/test_docstring_rule_gate_count_blocker.py

@@ -2,11 +2,63 @@
 
 import json
 import os
+import runpy
 import subprocess
 import sys
 from pathlib import Path
 
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+_local_hooks_directory = str(Path(__file__).resolve().parent.parent)
+_all_local_import_directories = (
+    str(Path(_local_hooks_directory) / "blocking"),
+    _local_hooks_directory,
+)
+_all_normalized_local_import_directories = tuple(
+    os.path.normcase(os.path.realpath(each_directory))
+    for each_directory in _all_local_import_directories
+)
+_all_normalized_import_directories = tuple(
+    (
+        os.path.normcase(os.path.realpath(os.fspath(each_directory)))
+        if each_directory != "" and isinstance(each_directory, (str, os.PathLike))
+        else None
+    )
+    for each_directory in sys.path
+)
+_all_prioritized_import_directories = [
+    *_all_local_import_directories,
+    *(
+        each_directory
+        for each_directory, normalized_directory in zip(
+            sys.path,
+            _all_normalized_import_directories,
+        )
+        if normalized_directory not in _all_normalized_local_import_directories
+    ),
+]
+if sys.path != _all_prioritized_import_directories:
+    sys.path[:] = _all_prioritized_import_directories
+
+_all_local_module_prefixes = ("docstring_rule_gate_count_blocker", "hooks_constants")
+for each_module_name, each_module in tuple(sys.modules.items()):
+    if not isinstance(each_module_name, str) or not any(
+        each_module_name == each_prefix or each_module_name.startswith(each_prefix + ".")
+        for each_prefix in _all_local_module_prefixes
+    ):
+        continue
+    module_file = getattr(each_module, "__file__", None)
+    is_local_module = False
+    if isinstance(module_file, (str, os.PathLike)):
+        try:
+            is_local_module = Path(module_file).resolve().is_relative_to(_local_hooks_directory)
+        except (OSError, RuntimeError, TypeError, ValueError):
+            is_local_module = False
+    if not is_local_module:
+        sys.modules.pop(each_module_name, None)
+
+del _all_local_module_prefixes
+del _all_normalized_import_directories
+del _all_normalized_local_import_directories
+del _all_prioritized_import_directories
 
 from docstring_rule_gate_count_blocker import (
     find_gate_count_drift,
@@ -105,6 +157,66 @@ def _target_rule_path(tmp_path: Path) -> Path:
     return tmp_path / TARGET_RULE_BASENAME
 
 
+def _run_test_module_bootstrap(
+    all_import_directories: list[str], run_count: int
+) -> list[str]:
+    """Run this test module against a supplied import path.
+
+    Args:
+        all_import_directories: Import path entries supplied to the module.
+        run_count: Number of module executions.
+
+    Returns:
+        Import path after the final module execution.
+    """
+    all_original_import_directories = list(sys.path)
+    try:
+        sys.path[:] = all_import_directories
+        for each_run_number in range(run_count):
+            runpy.run_path(__file__, run_name=f"bootstrap_probe_{each_run_number}")
+        return list(sys.path)
+    finally:
+        sys.path[:] = all_original_import_directories
+
+
+def should_prioritize_local_import_directories_over_foreign_hooks(tmp_path: Path) -> None:
+    foreign_hooks_directory = str(tmp_path / "hooks")
+    all_import_directories = [
+        foreign_hooks_directory,
+        _local_hooks_directory,
+        "",
+        "tail",
+    ]
+
+    assert _run_test_module_bootstrap(all_import_directories, 1) == [
+        *_all_local_import_directories,
+        foreign_hooks_directory,
+        "",
+        "tail",
+    ]
+
+
+def should_prioritize_local_import_directories_idempotently(tmp_path: Path) -> None:
+    foreign_hooks_directory = str(tmp_path / "hooks")
+    all_import_directories = [
+        foreign_hooks_directory,
+        _local_hooks_directory,
+        _all_local_import_directories[0] + os.sep + ".",
+        _local_hooks_directory + os.sep + ".",
+        "tail",
+    ]
+
+    all_import_directories_after_runs = _run_test_module_bootstrap(all_import_directories, 2)
+
+    assert all_import_directories_after_runs == [
+        *_all_local_import_directories,
+        foreign_hooks_directory,
+        "tail",
+    ]
+    assert all_import_directories_after_runs.count(_all_local_import_directories[0]) == 1
+    assert all_import_directories_after_runs.count(_local_hooks_directory) == 1
+
+
 def should_flag_target_rule_basename() -> None:
     assert is_target_rule_file("/somewhere/" + TARGET_RULE_BASENAME) is True
 

package/hooks/blocking/test_env_var_table_code_drift_blocker.py

@@ -8,17 +8,41 @@ environment variable to a code file whose source never references that variable.
 
 from __future__ import annotations
 
+import json
+import subprocess
 import sys
 from pathlib import Path
 
-_blocking_dir = str(Path(__file__).resolve().parent)
-if _blocking_dir not in sys.path:
-    sys.path.insert(0, _blocking_dir)
+_BLOCKING_DIRECTORY = Path(__file__).resolve().parent
+if str(_BLOCKING_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_BLOCKING_DIRECTORY))
 
 from env_var_table_code_drift_blocker import (  # noqa: E402
     find_drift_rows,
     is_markdown_file,
 )
+from test_hook_subprocess_support import (  # noqa: E402
+    assert_hook_deny_log_contains,
+    run_hook_as_subprocess,
+)
+
+HOOK_PATH = _BLOCKING_DIRECTORY / "env_var_table_code_drift_blocker.py"
+
+
+def _run_hook(
+    file_path: Path, content: str, temporary_repository_root: Path
+) -> subprocess.CompletedProcess[str]:
+    relative_file_path = file_path.relative_to(temporary_repository_root)
+    payload = {
+        "tool_name": "Write",
+        "tool_input": {"file_path": str(relative_file_path), "content": content},
+    }
+    return run_hook_as_subprocess(
+        hook_script_path=HOOK_PATH,
+        payload_text=json.dumps(payload),
+        working_directory=temporary_repository_root,
+        home_directory=temporary_repository_root,
+    )
 
 
 def _write(file_path: Path, content: str) -> None:
@@ -64,6 +88,49 @@ def test_passes_when_variable_present_in_code_file(tmp_path: Path) -> None:
     assert find_drift_rows(content, doc_path.parent) == []
 
 
+def test_production_entrypoint_allows_aligned_table(tmp_path: Path) -> None:
+    _anchor_repo_root(tmp_path)
+    _write(
+        tmp_path / "automation_logging" / "__init__.py",
+        'topic = os.environ["NTFY_TOPIC"]\n',
+    )
+    doc_path = tmp_path / "docs" / "configuration.md"
+    doc_path.parent.mkdir()
+    content = (
+        "| Variable | Used By | Purpose |\n"
+        "|----------|---------|---------|\n"
+        "| `NTFY_TOPIC` | `automation_logging/__init__.py` | ntfy topic |\n"
+    )
+
+    completed = _run_hook(doc_path, content, tmp_path)
+
+    assert completed.returncode == 0, completed.stderr
+    assert completed.stdout == ""
+
+
+def test_production_entrypoint_denies_drifted_table(tmp_path: Path) -> None:
+    _anchor_repo_root(tmp_path)
+    _write(tmp_path / "auth" / "google_auth.py", "def load():\n    return read_bws_secret()\n")
+    doc_path = tmp_path / "docs" / "configuration.md"
+    doc_path.parent.mkdir()
+    content = (
+        "| Variable | Used By | Purpose |\n"
+        "|----------|---------|---------|\n"
+        "| `GOOGLE_APPLICATION_CREDENTIALS` | `auth/google_auth.py` | Path to JSON |\n"
+    )
+
+    completed = _run_hook(doc_path, content, tmp_path)
+
+    parsed_payload = json.loads(completed.stdout)
+    hook_specific_output = parsed_payload["hookSpecificOutput"]
+    assert completed.returncode == 0, completed.stderr
+    assert hook_specific_output["permissionDecision"] == "deny"
+    assert "GOOGLE_APPLICATION_CREDENTIALS -> auth/google_auth.py" in hook_specific_output[
+        "permissionDecisionReason"
+    ]
+    assert_hook_deny_log_contains(tmp_path, "env_var_table_code_drift_blocker.py")
+
+
 def test_skips_row_whose_code_file_is_absent(tmp_path: Path) -> None:
     _anchor_repo_root(tmp_path)
     doc_path = tmp_path / "docs" / "configuration.md"

package/hooks/blocking/test_hook_subprocess_support.py

@@ -0,0 +1,296 @@
+"""Shared subprocess support for blocking-hook behavior tests."""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from collections.abc import Mapping
+from pathlib import Path
+
+import pytest
+
+HOOK_SUBPROCESS_TIMEOUT_SECONDS: int = 10
+
+
+def run_hook_as_subprocess(
+    hook_script_path: str | Path,
+    payload_text: str,
+    working_directory: str | Path,
+    home_directory: str | Path,
+    *,
+    all_environment_names_to_remove: tuple[str, ...] = (),
+    environment_updates_by_name: Mapping[str, str] | None = None,
+) -> subprocess.CompletedProcess[str]:
+    """Run a hook through its real ``__main__`` path with captured text streams."""
+    resolved_hook_script_path = Path(hook_script_path).resolve()
+    environment_update_by_name = environment_updates_by_name or {}
+    all_environment_names_to_exclude = {
+        _environment_name_comparison_key(each_environment_name)
+        for each_environment_name in (
+            *all_environment_names_to_remove,
+            *environment_update_by_name,
+        )
+    }
+    environment_variable_by_name = {
+        each_environment_name: each_environment_value
+        for each_environment_name, each_environment_value in os.environ.items()
+        if _environment_name_comparison_key(each_environment_name)
+        not in all_environment_names_to_exclude
+    }
+    environment_variable_by_name.update(environment_update_by_name)
+    resolved_home_directory = Path(home_directory).resolve()
+    for each_environment_name in ("HOME", "USERPROFILE", "TEMP", "TMP", "TMPDIR"):
+        environment_variable_by_name[each_environment_name] = str(resolved_home_directory)
+    environment_variable_by_name["PYTHONIOENCODING"] = "utf-8"
+    return subprocess.run(
+        [sys.executable, str(resolved_hook_script_path)],
+        input=payload_text,
+        cwd=working_directory,
+        env=environment_variable_by_name,
+        capture_output=True,
+        encoding="utf-8",
+        check=False,
+        timeout=HOOK_SUBPROCESS_TIMEOUT_SECONDS,
+    )
+
+
+def build_bash_payload(command: str, *, tool_input_cwd: str | Path | None = None) -> str:
+    """Build the serialized Bash tool payload for a command."""
+    command_field_by_name = {"command": command}
+    if tool_input_cwd is not None:
+        command_field_by_name["cwd"] = str(tool_input_cwd)
+    return json.dumps(
+        {
+            "tool_name": "Bash",
+            "tool_input": command_field_by_name,
+        }
+    )
+
+
+def read_hook_permission_decision(stdout_text: str) -> tuple[str, str]:
+    """Read the hook permission decision and reason from serialized output."""
+    if not stdout_text.strip():
+        return "", ""
+    hook_output_by_name = json.loads(stdout_text)["hookSpecificOutput"]
+    return (
+        hook_output_by_name["permissionDecision"],
+        hook_output_by_name["permissionDecisionReason"],
+    )
+
+
+def _environment_name_comparison_key(environment_name: str) -> str:
+    if os.name == "nt":
+        return environment_name.casefold()
+    return environment_name
+
+
+def assert_hook_deny_log_contains(
+    home_directory: str | Path, hook_filename: str
+) -> None:
+    """Assert that the isolated hook-block log records the named hook."""
+    deny_log_path = Path(home_directory) / ".claude" / "logs" / "hook-blocks.log"
+    assert deny_log_path.is_file(), f"Missing deny log: {deny_log_path}"
+    deny_log_text = deny_log_path.read_text(encoding="utf-8")
+    assert hook_filename in deny_log_text, (
+        f"Missing {hook_filename} in deny log: {deny_log_text}"
+    )
+
+
+def test_run_hook_as_subprocess_resolves_relative_path_and_isolates_home(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    absolute_hook_script_path = (
+        Path(__file__).resolve().parent / "open_questions_in_plans_blocker.py"
+    )
+    monkeypatch.chdir(absolute_hook_script_path.parent)
+    relative_hook_script_path = Path(absolute_hook_script_path.name)
+    isolated_home_directory = tmp_path / "isolated-home"
+    isolated_home_directory.mkdir()
+    plan_path = tmp_path / "docs" / "plans" / "feature.md"
+    payload_text = json.dumps(
+        {
+            "tool_name": "Write",
+            "tool_input": {
+                "file_path": str(plan_path),
+                "content": "# Feature Plan\n\n## Open Questions\n\n- Choose a value.\n",
+            },
+        }
+    )
+
+    completed = run_hook_as_subprocess(
+        hook_script_path=relative_hook_script_path,
+        payload_text=payload_text,
+        working_directory=tmp_path,
+        home_directory=isolated_home_directory,
+    )
+
+    parsed_stdout = json.loads(completed.stdout)
+    assert completed.returncode == 0, completed.stderr
+    assert parsed_stdout["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert_hook_deny_log_contains(
+        isolated_home_directory, "open_questions_in_plans_blocker.py"
+    )
+
+
+def test_run_hook_as_subprocess_returns_nonzero_probe_streams(
+    tmp_path: Path,
+) -> None:
+    probe_script_path = tmp_path / "probe.py"
+    probe_script_path.write_text(
+        "import sys\n"
+        "sys.stdout.write('probe stdout\\n')\n"
+        "sys.stderr.write('probe stderr\\n')\n"
+        "sys.exit(7)\n",
+        encoding="utf-8",
+    )
+
+    completed = run_hook_as_subprocess(
+        hook_script_path=probe_script_path,
+        payload_text="",
+        working_directory=tmp_path,
+        home_directory=tmp_path / "isolated-home",
+    )
+
+    assert completed.returncode == 7, completed.stderr
+    assert completed.stdout == "probe stdout\n"
+    assert completed.stderr == "probe stderr\n"
+
+
+def test_build_bash_payload_omits_optional_cwd() -> None:
+    payload_text = build_bash_payload("rm -rf /tmp/example")
+
+    assert json.loads(payload_text) == {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "rm -rf /tmp/example",
+        },
+    }
+
+
+def test_build_bash_payload_includes_optional_cwd() -> None:
+    payload_text = build_bash_payload(
+        "rm -rf /tmp/example", tool_input_cwd="/tmp/work"
+    )
+
+    assert json.loads(payload_text) == {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "rm -rf /tmp/example",
+            "cwd": "/tmp/work",
+        },
+    }
+
+
+def test_run_hook_as_subprocess_handles_unicode_stdin_as_utf8(
+    tmp_path: Path,
+) -> None:
+    probe_script_path = tmp_path / "probe.py"
+    probe_script_path.write_text(
+        "import sys\n"
+        "sys.stdout.write(','.join(str(ord(each_character)) for each_character in sys.stdin.read()))\n",
+        encoding="utf-8",
+    )
+    unicode_payload = "café 日本語"
+
+    completed = run_hook_as_subprocess(
+        hook_script_path=probe_script_path,
+        payload_text=unicode_payload,
+        working_directory=tmp_path,
+        home_directory=tmp_path / "isolated-home",
+    )
+
+    assert completed.returncode == 0, completed.stderr
+    assert completed.stdout == "99,97,102,233,32,26085,26412,35486"
+
+
+def test_run_hook_as_subprocess_preserves_posix_mixed_case_environment_names(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    probe_script_path = tmp_path / "probe.py"
+    probe_script_path.write_text(
+        "import json\n"
+        "import os\n"
+        "print(json.dumps(sorted((each_name, each_value) for each_name, each_value in os.environ.items() if each_name.casefold() == 'casesensitiveprobe')))\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setenv("CaseSensitiveProbe", "before")
+
+    completed = run_hook_as_subprocess(
+        hook_script_path=probe_script_path,
+        payload_text="",
+        working_directory=tmp_path,
+        home_directory=tmp_path / "isolated-home",
+        environment_updates_by_name={"CASESENSITIVEPROBE": "after"},
+    )
+
+    child_environment_variable_by_name = json.loads(completed.stdout)
+    if os.name == "nt":
+        assert child_environment_variable_by_name == [["CASESENSITIVEPROBE", "after"]]
+    else:
+        assert child_environment_variable_by_name == [
+            ["CASESENSITIVEPROBE", "after"],
+            ["CaseSensitiveProbe", "before"],
+        ]
+
+
+def test_run_hook_as_subprocess_handles_windows_mixed_case_environment_names(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    probe_script_path = tmp_path / "probe.py"
+    probe_script_path.write_text(
+        "import json\n"
+        "import os\n"
+        "print(json.dumps(sorted((each_name, each_value) for each_name, each_value in os.environ.items() if each_name.casefold() == 'casesensitiveprobe')))\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setenv("CaseSensitiveProbe", "before")
+
+    completed = run_hook_as_subprocess(
+        hook_script_path=probe_script_path,
+        payload_text="",
+        working_directory=tmp_path,
+        home_directory=tmp_path / "isolated-home",
+        all_environment_names_to_remove=("casesensitiveprobe",),
+        environment_updates_by_name={"CASESENSITIVEPROBE": "after"},
+    )
+
+    child_environment_variable_by_name = json.loads(completed.stdout)
+    if os.name == "nt":
+        assert child_environment_variable_by_name == [["CASESENSITIVEPROBE", "after"]]
+    else:
+        assert child_environment_variable_by_name == [
+            ["CASESENSITIVEPROBE", "after"],
+            ["CaseSensitiveProbe", "before"],
+        ]
+
+
+def test_run_hook_as_subprocess_keeps_default_home_and_temp_isolation(
+    tmp_path: Path,
+) -> None:
+    probe_script_path = tmp_path / "probe.py"
+    probe_script_path.write_text(
+        "import json\n"
+        "import os\n"
+        "print(json.dumps({each_name: os.environ.get(each_name) for each_name in (\n"
+        "    'HOME', 'USERPROFILE', 'TEMP', 'TMP', 'TMPDIR'\n"
+        ")}))\n",
+        encoding="utf-8",
+    )
+    isolated_home_directory = tmp_path / "isolated-home"
+    isolated_home_directory.mkdir()
+
+    completed = run_hook_as_subprocess(
+        hook_script_path=probe_script_path,
+        payload_text="",
+        working_directory=tmp_path,
+        home_directory=isolated_home_directory,
+    )
+
+    child_environment_variable_by_name = json.loads(completed.stdout)
+    expected_home = str(isolated_home_directory.resolve())
+    assert set(child_environment_variable_by_name.values()) == {expected_home}

package/hooks/blocking/test_package_inventory_stale_blocker.py

@@ -6,7 +6,7 @@ import subprocess
 import sys
 from pathlib import Path
 
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+sys.path.insert(0, str(Path(__file__).resolve().parent))
 
 from package_inventory_stale_blocker import (
     find_stale_inventory,