claude-dev-env 2.17.0 → 2.19.0

package/hooks/blocking/test_code_rules_enforcer_agent_home_tooling.py

@@ -12,20 +12,21 @@ so the repository code rules do not govern it::
 from __future__ import annotations
 
 import os
-import subprocess
-import sys
+from subprocess import CompletedProcess
 import tempfile
 from pathlib import Path
 
+import pytest
+
 from blocking import _path_setup  # noqa: F401  (pins this checkout ahead of sibling worktrees)
+import code_rules_enforcer_test_support
 from blocking.code_rules_shared import is_agent_home_tooling, is_ephemeral_path
-
-_ENFORCER_SCRIPT = Path(__file__).resolve().parent / "code_rules_enforcer.py"
+from code_rules_enforcer_test_support import run_precheck
 
 _VIOLATING_PRODUCTION_SOURCE = "def process_data(payload: str) -> None:\n    print(payload)\n"
 
 
-def _check_as(candidate_source: str, target_path: str) -> subprocess.CompletedProcess[str]:
+def _check_as(candidate_source: str, target_path: str) -> CompletedProcess[str]:
     """Run the enforcer's pre-check on a candidate judged as another path.
 
     Args:
@@ -38,13 +39,37 @@ def _check_as(candidate_source: str, target_path: str) -> subprocess.CompletedPr
     with tempfile.TemporaryDirectory() as scratch:
         candidate = Path(scratch) / "candidate.py"
         candidate.write_text(candidate_source, encoding="utf-8")
-        return subprocess.run(
-            [sys.executable, str(_ENFORCER_SCRIPT), "--check", str(candidate), "--as", target_path],
-            input="",
-            capture_output=True,
-            text=True,
-            check=False,
-        )
+        return run_precheck(candidate, target_path, None)
+
+
+def test_run_precheck_forwards_environment_mapping(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    expected_environment_by_name = {"CLAUDE_JOB_DIR": "/agent/jobs"}
+    captured_environment_by_name: dict[str, str] | None = None
+
+    def capture_run_enforcer_cli(
+        _script_path: Path,
+        _all_arguments: list[str],
+        extra_environment_by_name: dict[str, str] | None,
+    ) -> CompletedProcess[str]:
+        nonlocal captured_environment_by_name
+        captured_environment_by_name = extra_environment_by_name
+        return CompletedProcess(args=[], returncode=0, stdout="", stderr="")
+
+    monkeypatch.setattr(
+        code_rules_enforcer_test_support,
+        "run_enforcer_cli",
+        capture_run_enforcer_cli,
+    )
+    completed = run_precheck(
+        Path("candidate.py"),
+        "target.py",
+        expected_environment_by_name,
+    )
+
+    assert completed.returncode == 0
+    assert captured_environment_by_name == {"CLAUDE_JOB_DIR": "/agent/jobs"}
 
 
 def test_posix_agent_home_path_is_agent_tooling() -> None:

package/hooks/blocking/test_code_rules_enforcer_banned_noun_word.py

@@ -107,6 +107,60 @@ def test_should_not_flag_exact_match_banned_identifier() -> None:
     assert issues == []
 
 
+def test_should_allow_annotated_public_definition_name_and_parameters() -> None:
+    source = (
+        "def validate_nine_patch_output_path(output_path: str) -> str:  # pragma: no-banned-noun\n"
+        "    local_output_path = output_path\n"
+        "    return local_output_path\n"
+    )
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert any("local_output_path" in each_issue for each_issue in issues)
+    assert not any(
+        "Identifier 'validate_nine_patch_output_path'" in each_issue
+        or "Identifier 'output_path'" in each_issue
+        for each_issue in issues
+    )
+
+
+def test_enforcer_keeps_annotation_scope_on_definition_signature() -> None:
+    source = (
+        "def validate_nine_patch_output_path(output_path: str) -> str:  # pragma: no-banned-noun\n"
+        "    local_output_path = output_path\n"
+        "    return local_output_path\n"
+    )
+    issues = validate_content(source, PRODUCTION_FILE_PATH)
+    assert any("Identifier 'local_output_path'" in each_issue for each_issue in issues)
+    assert not any(
+        "Identifier 'validate_nine_patch_output_path'" in each_issue
+        or "Identifier 'output_path'" in each_issue
+        for each_issue in issues
+    )
+
+
+def test_should_keep_annotation_scoped_to_other_definitions_and_near_matches() -> None:
+    source = (
+        "def validate_nine_patch_output_paths(output_path: str) -> str:\n"
+        "    return output_path\n"
+        "def other_handler(other_output_path: str) -> str:\n"
+        "    return other_output_path\n"
+    )
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert any(
+        "validate_nine_patch_output_paths" in each_issue for each_issue in issues
+    )
+    assert any("other_output_path" in each_issue for each_issue in issues)
+
+
+def test_should_require_the_exact_compatibility_annotation() -> None:
+    source = (
+        "def validate_nine_patch_output_path(output_path: str) -> str:  # pragma: no-banned-nouns\n"
+        "    return output_path\n"
+    )
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert any("validate_nine_patch_output_path" in each_issue for each_issue in issues)
+    assert any("output_path" in each_issue for each_issue in issues)
+
+
 def test_should_not_flag_dunder_method_with_banned_word() -> None:
     source = "class Foo:\n    def __init_data__(self) -> None: pass\n"
     issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)

package/hooks/blocking/test_code_rules_enforcer_duplicate_body_hook_routing.py

@@ -14,15 +14,12 @@ target path the same way it would for the real directory.
 
 from __future__ import annotations
 
-import io
 import json
 import pathlib
 import shutil
-import subprocess
 import sys
 import tempfile
 from collections.abc import Iterator
-from types import SimpleNamespace
 
 import pytest
 
@@ -34,10 +31,10 @@ if str(_HOOKS_PARENT) not in sys.path:
     sys.path.insert(0, str(_HOOKS_PARENT))
 
 from code_rules_enforcer import main  # noqa: E402
-
-code_rules_enforcer = SimpleNamespace(main=main, sys=sys)
-
-_ENFORCER_SCRIPT_PATH = _HOOK_DIRECTORY / "code_rules_enforcer.py"
+from code_rules_enforcer_test_support import (  # noqa: E402
+    run_precheck,
+    run_write_entrypoint,
+)
 
 SHARED_HELPER_SOURCE = (
     "import re\n"
@@ -66,38 +63,18 @@ def hook_blocking_dir() -> Iterator[pathlib.Path]:
 def _run_main_with_write_payload(
     file_path: str,
     content: str,
-    monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> str:
-    """Drive ``main()`` through its stdin entry point for a Write and return stdout.
-
-    Args:
-        file_path: The on-disk path the Write targets.
-        content: The whole-file body the Write would create.
-        monkeypatch: The fixture used to redirect ``sys.stdin``.
-        capsys: The fixture used to capture the deny payload on stdout.
-
-    Returns:
-        The captured stdout, which holds the deny payload when violations fire.
-    """
-    write_payload = json.dumps(
-        {
-            "tool_name": "Write",
-            "tool_input": {"file_path": file_path, "content": content},
-        }
+    """Drive ``main()`` through its stdin entry point for a Write."""
+    captured_stdout, _exit_code = run_write_entrypoint(
+        main,
+        file_path,
+        content,
     )
-    monkeypatch.setattr(code_rules_enforcer.sys, "stdin", io.StringIO(write_payload))
-    try:
-        code_rules_enforcer.main([])
-    except SystemExit:
-        pass
-    return capsys.readouterr().out
+    return captured_stdout
 
 
 def test_write_of_copied_helper_into_hook_directory_denies(
     hook_blocking_dir: pathlib.Path,
-    monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> None:
     """A Write that copies a sibling helper into a second hook file is denied.
 
@@ -106,7 +83,7 @@ def test_write_of_copied_helper_into_hook_directory_denies(
     directory its module docstring names as the primary target."""
     (hook_blocking_dir / "existing_blocker.py").write_text(SHARED_HELPER_SOURCE, encoding="utf-8")
     new_file = hook_blocking_dir / "new_blocker.py"
-    stdout = _run_main_with_write_payload(str(new_file), SHARED_HELPER_SOURCE, monkeypatch, capsys)
+    stdout = _run_main_with_write_payload(str(new_file), SHARED_HELPER_SOURCE)
     assert stdout != "", (
         "A copied helper written into a second hook-infrastructure file must "
         "produce a deny payload, got empty stdout"
@@ -122,8 +99,6 @@ def test_write_of_copied_helper_into_hook_directory_denies(
 
 def test_write_of_unique_helper_into_hook_directory_allows(
     hook_blocking_dir: pathlib.Path,
-    monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> None:
     """A Write of a hook file with no sibling duplicate produces no deny payload.
 
@@ -137,13 +112,13 @@ def test_write_of_unique_helper_into_hook_directory_allows(
         "    return widened\n"
     )
     new_file = hook_blocking_dir / "unique_blocker.py"
-    stdout = _run_main_with_write_payload(str(new_file), unique_helper_source, monkeypatch, capsys)
+    stdout = _run_main_with_write_payload(str(new_file), unique_helper_source)
     assert stdout == "", f"a unique hook helper must not be denied, got stdout: {stdout!r}"
 
 
 def test_precheck_of_copied_helper_at_hook_target_exits_nonzero(
     hook_blocking_dir: pathlib.Path,
-    tmp_path_factory: pytest.TempPathFactory,
+    tmp_path: pathlib.Path,
 ) -> None:
     """The pre-check CLI flags a copied helper judged at a hook-infrastructure target.
 
@@ -151,24 +126,11 @@ def test_precheck_of_copied_helper_at_hook_target_exits_nonzero(
     routes a hook ``.py`` target through the duplicate-body check rather than
     exiting clean on the blanket hook-infrastructure exemption."""
     (hook_blocking_dir / "existing_blocker.py").write_text(SHARED_HELPER_SOURCE, encoding="utf-8")
-    staging_directory = tmp_path_factory.mktemp("staging")
+    staging_directory = tmp_path
     candidate_file = staging_directory / "candidate.py"
     candidate_file.write_text(SHARED_HELPER_SOURCE, encoding="utf-8")
     target_path = str(hook_blocking_dir / "new_blocker.py")
-    completed = subprocess.run(
-        [
-            sys.executable,
-            str(_ENFORCER_SCRIPT_PATH),
-            "--check",
-            str(candidate_file),
-            "--as",
-            target_path,
-        ],
-        input="",
-        capture_output=True,
-        text=True,
-        check=False,
-    )
+    completed = run_precheck(candidate_file, target_path, None)
     assert completed.returncode == 1, (
         "a copied helper at a hook target must exit nonzero, got: "
         f"{completed.returncode}, stdout: {completed.stdout!r}, "

package/hooks/blocking/test_code_rules_enforcer_ephemeral.py

@@ -2,14 +2,11 @@
 
 from __future__ import annotations
 
-import io
 import json
-import os
 import subprocess
 import sys
 import tempfile
 from pathlib import Path
-from types import SimpleNamespace
 
 import pytest
 
@@ -22,70 +19,40 @@ if _HOOKS_DIRECTORY not in sys.path:
 
 from code_rules_enforcer import main as enforcer_main  # noqa: E402
 from code_rules_shared import is_ephemeral_script_path  # noqa: E402
+from code_rules_enforcer_test_support import (  # noqa: E402
+    build_write_payload,
+    run_enforcer_cli,
+    run_write_entrypoint,
+)
 
 _ENFORCER_SCRIPT = Path(__file__).resolve().parent / "code_rules_enforcer.py"
 _TDD_SCRIPT = Path(__file__).resolve().parent / "tdd_enforcer.py"
 
 _VIOLATING_PRODUCTION_SOURCE = "def process_data(payload: str) -> None:\n    print(payload)\n"
 
-code_rules_enforcer_module = SimpleNamespace(main=enforcer_main, sys=sys)
-
 
 def _run_enforcer_cli(
     all_cli_arguments: list[str],
-    extra_env: dict[str, str],
+    extra_environment_by_name: dict[str, str] | None = None,
 ) -> subprocess.CompletedProcess[str]:
     """Drive the enforcer script through its real argv entry point.
 
     Args:
         all_cli_arguments: The argument vector appended after the script path.
-        extra_env: Additional environment variables merged into the subprocess env.
+        extra_environment_by_name: Additional environment variables merged into the subprocess environment.
 
     Returns:
         The completed process carrying stdout, stderr, and the exit code.
     """
-    subprocess_env = {**os.environ, **extra_env}
-    return subprocess.run(
-        [sys.executable, str(_ENFORCER_SCRIPT), *all_cli_arguments],
-        input="",
-        capture_output=True,
-        text=True,
-        check=False,
-        env=subprocess_env,
-    )
+    return run_enforcer_cli(_ENFORCER_SCRIPT, all_cli_arguments, extra_environment_by_name)
 
 
 def _run_main_with_write_payload(
     file_path: str,
     content: str,
-    monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> tuple[str, int]:
-    """Drive enforcer_main through its stdin entry point for a Write payload.
-
-    Args:
-        file_path: The destination path the Write targets.
-        content: The content of the Write.
-        monkeypatch: The pytest fixture used to redirect sys.stdin.
-        capsys: The pytest fixture used to capture the deny payload on stdout.
-
-    Returns:
-        A tuple of (captured_stdout, exit_code).
-    """
-    write_payload = json.dumps(
-        {
-            "tool_name": "Write",
-            "tool_input": {"file_path": file_path, "content": content},
-        }
-    )
-    monkeypatch.setattr(code_rules_enforcer_module.sys, "stdin", io.StringIO(write_payload))
-    exit_code = 0
-    try:
-        code_rules_enforcer_module.main([])
-    except SystemExit as each_exit:
-        exit_code = int(each_exit.code or 0)
-    captured = capsys.readouterr()
-    return captured.out, exit_code
+    """Drive enforcer_main through its stdin entry point for a Write payload."""
+    return run_write_entrypoint(enforcer_main, file_path, content)
 
 
 def _run_tdd_with_write_payload(
@@ -101,18 +68,12 @@ def _run_tdd_with_write_payload(
     Returns:
         The completed process carrying stdout, stderr, and the exit code.
     """
-    write_payload = json.dumps(
-        {
-            "tool_name": "Write",
-            "tool_input": {"file_path": file_path, "content": content},
-        }
-    )
+    write_payload = build_write_payload(file_path, content)
     return subprocess.run(
         [sys.executable, str(_TDD_SCRIPT)],
         input=write_payload,
         capture_output=True,
         text=True,
-        check=False,
     )
 
 
@@ -279,7 +240,6 @@ def test_should_return_false_for_empty_path() -> None:
 def test_should_exit_zero_for_ephemeral_pretooluse_target(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> None:
     """B11: enforcer main exits 0 with no deny payload for an ephemeral file_path."""
     monkeypatch.setenv("CLAUDE_JOB_DIR", str(tmp_path))
@@ -287,8 +247,6 @@ def test_should_exit_zero_for_ephemeral_pretooluse_target(
     captured_stdout, exit_code = _run_main_with_write_payload(
         ephemeral_path,
         _VIOLATING_PRODUCTION_SOURCE,
-        monkeypatch,
-        capsys,
     )
     assert exit_code == 0
     assert "deny" not in captured_stdout.lower()
@@ -297,7 +255,6 @@ def test_should_exit_zero_for_ephemeral_pretooluse_target(
 def test_should_exit_zero_for_ephemeral_path_with_hooks_substring(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> None:
     """B12: an ephemeral path carrying /hooks/ exits 0 (hook-infra route short-circuited)."""
     monkeypatch.setenv("CLAUDE_JOB_DIR", str(tmp_path))
@@ -305,8 +262,6 @@ def test_should_exit_zero_for_ephemeral_path_with_hooks_substring(
     captured_stdout, exit_code = _run_main_with_write_payload(
         ephemeral_hooks_path,
         _VIOLATING_PRODUCTION_SOURCE,
-        monkeypatch,
-        capsys,
     )
     assert exit_code == 0
     assert "deny" not in captured_stdout.lower()
@@ -319,7 +274,7 @@ def test_should_return_zero_from_precheck_for_ephemeral_target(
     candidate_file = tmp_path / "candidate.py"
     candidate_file.write_text(_VIOLATING_PRODUCTION_SOURCE, encoding="utf-8")
     ephemeral_target = "/tmp/target.py"
-    completed = _run_enforcer_cli(["--check", str(candidate_file), "--as", ephemeral_target], extra_env={})
+    completed = _run_enforcer_cli(["--check", str(candidate_file), "--as", ephemeral_target])
     assert completed.returncode == 0
 
 
@@ -332,7 +287,6 @@ def test_should_run_full_suite_for_non_ephemeral_target(
     non_ephemeral_target = "/repo/src/orders.py"
     completed = _run_enforcer_cli(
         ["--check", str(candidate_file), "--as", non_ephemeral_target],
-        extra_env={},
     )
     assert completed.returncode == 1
 
@@ -346,7 +300,7 @@ def test_should_run_full_suite_when_override_truthy(
     ephemeral_target = "/tmp/scratch.py"
     completed = _run_enforcer_cli(
         ["--check", str(candidate_file), "--as", ephemeral_target],
-        extra_env={"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"},
+        extra_environment_by_name={"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"},
     )
     assert completed.returncode == 1
 
@@ -354,7 +308,6 @@ def test_should_run_full_suite_when_override_truthy(
 def test_should_exempt_same_path_set_on_both_gates(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> None:
     """B21: every ephemeral path exits 0 on both enforcer main and TDD enforcer main."""
     monkeypatch.setenv("CLAUDE_JOB_DIR", str(tmp_path))
@@ -367,8 +320,6 @@ def test_should_exempt_same_path_set_on_both_gates(
         captured_stdout, exit_code = _run_main_with_write_payload(
             each_ephemeral_path,
             _VIOLATING_PRODUCTION_SOURCE,
-            monkeypatch,
-            capsys,
         )
         assert exit_code == 0, (
             f"enforcer must exit 0 for ephemeral path {each_ephemeral_path!r}, "