claude-dev-env 2.17.0 → 2.19.0

package/hooks/blocking/test_code_rules_enforcer_narrow_edit.py

@@ -0,0 +1,308 @@
+"""Test narrow Edit classification and required rule selection."""
+
+from __future__ import annotations
+
+import ast
+import io
+import inspect
+import json
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+import pytest
+_BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
+_HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
+if _BLOCKING_DIRECTORY not in sys.path:
+    sys.path.insert(0, _BLOCKING_DIRECTORY)
+if _HOOKS_DIRECTORY not in sys.path:
+    sys.path.insert(0, _HOOKS_DIRECTORY)
+
+from code_rules_enforcer import (  # noqa: E402
+    main,
+    validate_content,
+)
+
+
+PRODUCTION_FILE_PATH = "packages/app/services.py"
+
+
+@dataclass(frozen=True)
+class NarrowEditFixture:
+    """One accepted Edit family with a clean prior fragment and a violation."""
+
+    old_fragment: str
+    new_fragment: str
+    expected_marker: str
+    rule_name: str
+
+ALL_SCOPE_AWARE_RULE_NAMES = frozenset(
+    {
+        "check_import_block_sorted",
+        "check_magic_values",
+        "check_duplicate_function_body_across_files",
+        "check_same_file_inline_duplicate_body",
+        "check_banned_identifiers",
+        "check_banned_noun_word_boundary",
+        "check_docstring_runon_sentence",
+        "check_docstring_prose_wall_without_illustration",
+        "check_boolean_naming",
+        "check_ignored_must_check_return",
+        "check_tests_use_isolated_filesystem_paths",
+        "check_return_annotations",
+        "check_function_length",
+        "check_public_function_missing_paired_test",
+        "check_join_separator_string_magic",
+        "check_string_literal_magic",
+        "check_js_boolean_naming",
+        "check_js_banned_identifiers",
+        "check_js_bare_flag_return_directive",
+    }
+)
+
+
+SCOPE_AWARE_RULE_NAMES = ALL_SCOPE_AWARE_RULE_NAMES
+NARROW_EDIT_ACCEPTED_RULE_NAMES = frozenset(
+    {
+        "check_string_literal_magic",
+        "check_join_separator_string_magic",
+        "check_banned_noun_word_boundary",
+        "check_boolean_naming",
+        "check_ignored_must_check_return",
+    }
+)
+
+
+EXPECTED_RULE_TEXT_BY_NAME = {
+    "check_string_literal_magic": "string magic value",
+    "check_join_separator_string_magic": "string separator",
+    "check_banned_noun_word_boundary": "Identifier",
+    "check_boolean_naming": "Boolean",
+    "check_ignored_must_check_return": "return value",
+}
+
+
+ALL_REQUIRED_RULE_FIXTURES = (
+    NarrowEditFixture(
+        old_fragment=(
+            "import os\n\n"
+            "def fetch_secret() -> str:\n"
+            "    return os.environ.get('missing', '')\n"
+        ),
+        new_fragment=(
+            "import os\n\n"
+            "def fetch_secret() -> str:\n"
+            "    return os.environ['STRIPE_SECRET']\n"
+        ),
+        expected_marker="STRIPE_SECRET",
+        rule_name="check_string_literal_magic",
+    ),
+    NarrowEditFixture(
+        old_fragment=(
+            "def render_paths(all_paths: list[str]) -> str:\n"
+            "    return JOIN_DELIMITER.join(all_paths)\n"
+        ),
+        new_fragment=(
+            "def render_paths(all_paths: list[str]) -> str:\n"
+            "    return ', '.join(all_paths)\n"
+        ),
+        expected_marker="join",
+        rule_name="check_join_separator_string_magic",
+    ),
+    NarrowEditFixture(
+        old_fragment=(
+            "def read_count() -> int:\n"
+            "    clean_count = 0\n"
+            "    return clean_count\n"
+        ),
+        new_fragment=(
+            "def read_count() -> int:\n"
+            "    result_count = 0\n"
+            "    return result_count\n"
+        ),
+        expected_marker="result_count",
+        rule_name="check_banned_noun_word_boundary",
+    ),
+    NarrowEditFixture(
+        old_fragment=(
+            "def check_ready() -> bool:\n"
+            "    is_ready = True\n"
+            "    return is_ready\n"
+        ),
+        new_fragment=(
+            "def check_ready() -> bool:\n"
+            "    ready = True\n"
+            "    return ready\n"
+        ),
+        expected_marker="ready",
+        rule_name="check_boolean_naming",
+    ),
+    NarrowEditFixture(
+        old_fragment=(
+            "def submit_form() -> None:\n"
+            "    if find_and_click('#submit'):\n"
+            "        return\n"
+        ),
+        new_fragment=(
+            "def submit_form() -> None:\n"
+            "    find_and_click('#submit')\n"
+        ),
+        expected_marker="find_and_click",
+        rule_name="check_ignored_must_check_return",
+    ),
+)
+
+
+def _validate_narrow_edit(narrow_edit_fixture: NarrowEditFixture) -> list[str]:
+    prior_full_file = narrow_edit_fixture.old_fragment
+    post_edit_full_file = narrow_edit_fixture.new_fragment
+    return validate_content(
+        narrow_edit_fixture.new_fragment,
+        PRODUCTION_FILE_PATH,
+        old_content=narrow_edit_fixture.old_fragment,
+        full_file_content=post_edit_full_file,
+        prior_full_file_content=prior_full_file,
+    )
+
+
+def _scope_aware_rule_names_from_source() -> frozenset[str]:
+    source_tree = ast.parse(inspect.getsource(validate_content))
+    all_rule_names: set[str] = set()
+    for each_call in ast.walk(source_tree):
+        if not isinstance(each_call, ast.Call):
+            continue
+        if not isinstance(each_call.func, ast.Name):
+            continue
+        if each_call.func.id == "_fragment_or_deferred_check":
+            all_argument_names = {
+                each_name.id
+                for each_argument in each_call.args[1:]
+                for each_name in ast.walk(each_argument)
+                if isinstance(each_name, ast.Name)
+            }
+            if (
+                "defer_scope_to_caller" in all_argument_names
+                and each_call.args
+                and isinstance(each_call.args[0], ast.Name)
+            ):
+                all_rule_names.add(each_call.args[0].id)
+            continue
+        if not each_call.func.id.startswith("check_"):
+            continue
+        all_argument_names = {
+            each_name.id
+            for each_argument in each_call.args
+            for each_name in ast.walk(each_argument)
+            if isinstance(each_name, ast.Name)
+        }
+        all_argument_names.update(
+            each_name.id
+            for each_keyword in each_call.keywords
+            for each_name in ast.walk(each_keyword.value)
+            if isinstance(each_name, ast.Name)
+        )
+        if (
+            "all_changed_lines" in all_argument_names
+            or "defer_scope_to_caller" in all_argument_names
+        ):
+            all_rule_names.add(each_call.func.id)
+    return frozenset(all_rule_names)
+
+
+@pytest.mark.parametrize("narrow_edit_fixture", ALL_REQUIRED_RULE_FIXTURES)
+def test_narrow_edit_selects_each_accepted_rule(
+    narrow_edit_fixture: NarrowEditFixture,
+) -> None:
+    all_issues = _validate_narrow_edit(narrow_edit_fixture)
+    expected_rule_text = EXPECTED_RULE_TEXT_BY_NAME[narrow_edit_fixture.rule_name]
+
+    assert any(
+        narrow_edit_fixture.expected_marker in each_issue
+        and expected_rule_text in each_issue
+        for each_issue in all_issues
+    ), (
+        "the changed fragment must select its checker and report its diagnostic marker "
+        f"{narrow_edit_fixture.expected_marker!r}, got {all_issues!r}"
+    )
+
+
+def test_scope_aware_inventory_matches_enforcer_dispatch() -> None:
+    assert _scope_aware_rule_names_from_source() == ALL_SCOPE_AWARE_RULE_NAMES
+def test_narrow_edit_acceptance_set_is_source_backed_and_complete() -> None:
+    all_fixture_rule_names = {
+        each_fixture.rule_name for each_fixture in ALL_REQUIRED_RULE_FIXTURES
+    }
+
+    assert all_fixture_rule_names == NARROW_EDIT_ACCEPTED_RULE_NAMES
+    assert NARROW_EDIT_ACCEPTED_RULE_NAMES <= ALL_SCOPE_AWARE_RULE_NAMES
+
+def test_narrow_edit_drops_an_untouched_banned_noun() -> None:
+    untouched_source = "OLD_RESULT_PATH = 0\n"
+    old_fragment = "PLACEHOLDER_NAME = 0\n"
+    new_fragment = "NEW_RESULT_PATH = 0\n"
+    issues = validate_content(
+        new_fragment,
+        PRODUCTION_FILE_PATH,
+        old_content=old_fragment,
+        full_file_content=untouched_source + new_fragment,
+        prior_full_file_content=untouched_source + old_fragment,
+    )
+
+    assert any("NEW_RESULT_PATH" in each_issue for each_issue in issues)
+    assert not any("OLD_RESULT_PATH" in each_issue for each_issue in issues)
+
+
+def test_narrow_edit_skips_python_rules_for_a_non_python_target() -> None:
+    source = "def process_data() -> None:\n    print('payload')\n"
+
+    issues = validate_content(source, "packages/app/services.txt", old_content="")
+
+    assert issues == []
+def _run_edit_stage(
+    file_path: Path,
+    old_fragment: str,
+    new_fragment: str,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> str:
+    payload = json.dumps(
+        {
+            "tool_name": "Edit",
+            "tool_input": {
+                "file_path": str(file_path),
+                "old_string": old_fragment,
+                "new_string": new_fragment,
+            },
+        }
+    )
+    monkeypatch.setattr(sys, "stdin", io.StringIO(payload))
+    try:
+        main([])
+    except SystemExit:
+        pass
+    return capsys.readouterr().out
+
+
+def test_edit_entrypoint_reports_an_accepted_rule_for_the_changed_fragment(
+    tmp_path_factory: pytest.TempPathFactory,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    staging_directory = tmp_path_factory.mktemp("narrow_edit")
+    source_file = staging_directory / "service.py"
+    old_fragment = "def read_count() -> int:\n    clean_count = 0\n    return clean_count\n"
+    new_fragment = "def read_count() -> int:\n    result_count = 0\n    return result_count\n"
+    source_file.write_text(old_fragment, encoding="utf-8")
+
+    captured_stdout = _run_edit_stage(
+        source_file,
+        old_fragment,
+        new_fragment,
+        monkeypatch,
+        capsys,
+    )
+
+    deny_payload = json.loads(captured_stdout)
+    deny_reason = deny_payload["hookSpecificOutput"]["permissionDecisionReason"]
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "result_count" in deny_reason

package/hooks/blocking/test_code_rules_enforcer_precheck_forecast.py

@@ -2,12 +2,10 @@
 
 from __future__ import annotations
 
-import io
 import json
 import subprocess
 import sys
 from pathlib import Path
-from types import SimpleNamespace
 
 _BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
 _HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
@@ -20,11 +18,10 @@ from code_rules_enforcer import (  # noqa: E402
     main,
     validate_content,
 )
-
-code_rules_enforcer = SimpleNamespace(
-    main=main,
-    sys=sys,
-    validate_content=validate_content,
+from code_rules_enforcer_test_support import (  # noqa: E402
+    run_enforcer_cli,
+    run_precheck,
+    run_serialized_payload_entrypoint,
 )
 
 _ENFORCER_SCRIPT_PATH = Path(__file__).resolve().parent / "code_rules_enforcer.py"
@@ -57,13 +54,7 @@ def _run_enforcer_cli(
     Returns:
         The completed process carrying stdout, stderr, and the exit code.
     """
-    return subprocess.run(
-        [sys.executable, str(_ENFORCER_SCRIPT_PATH), *all_cli_arguments],
-        input="",
-        capture_output=True,
-        text=True,
-        check=False,
-    )
+    return run_enforcer_cli(_ENFORCER_SCRIPT_PATH, all_cli_arguments, None)
 
 
 def _run_precheck(
@@ -80,28 +71,15 @@ def _run_precheck(
     Returns:
         The completed process carrying the pre-check stdout, stderr, and exit code.
     """
-    return _run_enforcer_cli(["--check", candidate_path, "--as", target_path])
+    return run_precheck(Path(candidate_path), target_path, None)
 
 
 def _run_main_with_edit_payload(
     file_path: str,
     old_string: str,
     new_string: str,
-    monkeypatch: object,
-    capsys: object,
 ) -> str:
-    """Drive ``main()`` through its stdin entry point for an Edit and return stdout.
-
-    Args:
-        file_path: The on-disk path the Edit targets.
-        old_string: The Edit's ``old_string`` fragment.
-        new_string: The Edit's ``new_string`` fragment.
-        monkeypatch: The pytest fixture used to redirect ``sys.stdin``.
-        capsys: The pytest fixture used to capture the deny payload on stdout.
-
-    Returns:
-        The captured stdout, which holds the deny payload when violations fire.
-    """
+    """Drive ``main()`` through its stdin entry point for an Edit."""
     edit_payload = json.dumps(
         {
             "tool_name": "Edit",
@@ -112,13 +90,8 @@ def _run_main_with_edit_payload(
             },
         }
     )
-    getattr(monkeypatch, "setattr")(code_rules_enforcer.sys, "stdin", io.StringIO(edit_payload))
-    try:
-        code_rules_enforcer.main([])
-    except SystemExit:
-        pass
-    captured = getattr(capsys, "readouterr")()
-    return captured.out
+    captured_stdout, _exit_code = run_serialized_payload_entrypoint(main, edit_payload)
+    return captured_stdout
 
 
 def test_precheck_stream_parameter_carries_no_banned_noun() -> None:
@@ -130,9 +103,7 @@ def test_precheck_stream_parameter_carries_no_banned_noun() -> None:
     banned-noun check fires. Scanning the enforcer source at a production path
     proves the introduced stream parameter is free of that violation."""
     enforcer_source = _ENFORCER_SCRIPT_PATH.read_text(encoding="utf-8")
-    issues = code_rules_enforcer.validate_content(
-        enforcer_source, "/project/src/code_rules_enforcer.py"
-    )
+    issues = validate_content(enforcer_source, "/project/src/code_rules_enforcer.py")
     banned_noun_issues = [
         each_issue
         for each_issue in issues
@@ -234,8 +205,6 @@ def test_precheck_missing_candidate_errors_on_stderr_without_traceback(
 
 def test_edit_deny_reason_includes_forecast_and_precheck_hint(
     tmp_path_factory: object,
-    monkeypatch: object,
-    capsys: object,
 ) -> None:
     """An Edit whose new_string introduces a violation on a file that already
     contains a separate violation elsewhere blocks on the fragment violation and
@@ -244,9 +213,7 @@ def test_edit_deny_reason_includes_forecast_and_precheck_hint(
     production_directory = getattr(tmp_path_factory, "mktemp")("production_pkg")
     untouched_print_violation = _UNTOUCHED_PRINT_VIOLATION_SOURCE
     clean_before = _CLEAN_FRAGMENT_BEFORE
-    introduces_banned_noun_after = (
-        "def short_helper() -> int:\n    output = 0\n    return output\n"
-    )
+    introduces_banned_noun_after = "def short_helper() -> int:\n    output = 0\n    return output\n"
     on_disk_before = untouched_print_violation + "\n" + clean_before
     source_file = production_directory / "production_module.py"
     source_file.write_text(on_disk_before, encoding="utf-8")
@@ -254,8 +221,6 @@ def test_edit_deny_reason_includes_forecast_and_precheck_hint(
         str(source_file),
         clean_before,
         introduces_banned_noun_after,
-        monkeypatch,
-        capsys,
     )
     deny_payload = json.loads(stdout)
     reason = deny_payload["hookSpecificOutput"]["permissionDecisionReason"]
@@ -263,9 +228,7 @@ def test_edit_deny_reason_includes_forecast_and_precheck_hint(
     assert "output" in blocking_section, (
         f"fragment-introduced banned-noun must block, got reason: {reason!r}"
     )
-    assert forecast_section != "", (
-        f"forecast section must be present, got reason: {reason!r}"
-    )
+    assert forecast_section != "", f"forecast section must be present, got reason: {reason!r}"
     assert "Library print()" in forecast_section, (
         f"forecast must name the untouched print violation, got reason: {reason!r}"
     )
@@ -274,8 +237,6 @@ def test_edit_deny_reason_includes_forecast_and_precheck_hint(
 
 def test_edit_clean_fragment_on_dirty_file_produces_no_deny_payload(
     tmp_path_factory: object,
-    monkeypatch: object,
-    capsys: object,
 ) -> None:
     """A clean Edit fragment on a file that is dirty elsewhere must not block —
     the forecast never converts a clean-fragment edit into a deny."""
@@ -290,8 +251,6 @@ def test_edit_clean_fragment_on_dirty_file_produces_no_deny_payload(
         str(source_file),
         clean_before,
         clean_after,
-        monkeypatch,
-        capsys,
     )
     assert stdout == "", (
         f"a clean fragment on a dirty file must not produce a deny payload, got stdout: {stdout!r}"
@@ -300,8 +259,6 @@ def test_edit_clean_fragment_on_dirty_file_produces_no_deny_payload(
 
 def test_every_deny_reason_carries_the_precheck_hint(
     tmp_path_factory: object,
-    monkeypatch: object,
-    capsys: object,
 ) -> None:
     """A deny with no forecast still appends the pre-check hint to the reason."""
     production_directory = getattr(tmp_path_factory, "mktemp")("production_pkg")
@@ -313,8 +270,6 @@ def test_every_deny_reason_carries_the_precheck_hint(
         str(source_file),
         clean_before,
         introduces_violation_after,
-        monkeypatch,
-        capsys,
     )
     deny_payload = json.loads(stdout)
     reason = deny_payload["hookSpecificOutput"]["permissionDecisionReason"]
@@ -333,8 +288,6 @@ def test_every_deny_reason_carries_the_precheck_hint(
 
 def test_forecast_skipped_when_edit_prior_is_unreconstructable(
     tmp_path_factory: object,
-    monkeypatch: object,
-    capsys: object,
 ) -> None:
     """An Edit whose old_string is absent from the file has no reliable prior to
     diff against, so the full-file forecast must not run: a pre-existing inline
@@ -350,8 +303,6 @@ def test_forecast_skipped_when_edit_prior_is_unreconstructable(
         str(source_file),
         absent_old,
         introduces_print_new,
-        monkeypatch,
-        capsys,
     )
     deny_payload = json.loads(stdout)
     reason = deny_payload["hookSpecificOutput"]["permissionDecisionReason"]
@@ -363,8 +314,6 @@ def test_forecast_skipped_when_edit_prior_is_unreconstructable(
 
 def test_forecast_omits_the_fragment_introduced_violation(
     tmp_path_factory: object,
-    monkeypatch: object,
-    capsys: object,
 ) -> None:
     """An Edit that introduces the file's only print() blocks on it without the
     forecast re-listing that same violation under its full-file line number."""
@@ -378,8 +327,6 @@ def test_forecast_omits_the_fragment_introduced_violation(
         str(source_file),
         _CLEAN_FRAGMENT_BEFORE,
         introduces_print_after,
-        monkeypatch,
-        capsys,
     )
     deny_payload = json.loads(stdout)
     reason = deny_payload["hookSpecificOutput"]["permissionDecisionReason"]
@@ -454,9 +401,7 @@ def test_precheck_strips_candidate_byte_order_mark_before_validation(
     staging_directory = getattr(tmp_path_factory, "mktemp")("staging")
     production_directory = getattr(tmp_path_factory, "mktemp")("production_pkg")
     candidate_file = staging_directory / "candidate.py"
-    candidate_file.write_text(
-        "\ufeff" + _VIOLATING_PRODUCTION_SOURCE, encoding="utf-8"
-    )
+    candidate_file.write_text("\ufeff" + _VIOLATING_PRODUCTION_SOURCE, encoding="utf-8")
     target_path = str(production_directory / "production_module.py")
     completed = _run_precheck(str(candidate_file), target_path)
     assert completed.returncode == 1, (
@@ -478,9 +423,7 @@ def test_precheck_strips_every_leading_byte_order_mark_before_validation(
     staging_directory = getattr(tmp_path_factory, "mktemp")("staging")
     production_directory = getattr(tmp_path_factory, "mktemp")("production_pkg")
     candidate_file = staging_directory / "candidate.py"
-    candidate_file.write_text(
-        "\ufeff\ufeff" + _VIOLATING_PRODUCTION_SOURCE, encoding="utf-8"
-    )
+    candidate_file.write_text("\ufeff\ufeff" + _VIOLATING_PRODUCTION_SOURCE, encoding="utf-8")
     target_path = str(production_directory / "production_module.py")
     completed = _run_precheck(str(candidate_file), target_path)
     assert completed.returncode == 1, (

package/hooks/blocking/test_code_rules_enforcer_scratchpad.py

@@ -1,7 +1,6 @@
 """Tests for the session-scratchpad exemption wired into code_rules_enforcer.main."""
 
 import importlib.util
-import io
 import json
 import os
 import sys
@@ -11,6 +10,13 @@ from types import ModuleType
 
 import pytest
 
+_HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
+if _HOOKS_DIRECTORY not in sys.path:
+    sys.path.insert(0, _HOOKS_DIRECTORY)
+from blocking import _path_setup  # noqa: F401
+
+from code_rules_enforcer_test_support import run_serialized_payload_entrypoint
+
 ENFORCER_PATH = Path(__file__).parent / "code_rules_enforcer.py"
 FIXED_USER_ID = 6070
 WORKING_DIRECTORY = "/home/user/project"
@@ -55,19 +61,11 @@ def _write_payload(target: Path) -> dict[str, object]:
     }
 
 
-def _run_main(
-    monkeypatch: pytest.MonkeyPatch, payload: dict[str, object]
-) -> tuple[int | None, str]:
-    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(payload)))
-    captured_stdout = io.StringIO()
-    monkeypatch.setattr(sys, "stdout", captured_stdout)
-    exit_code: int | None = None
-    try:
-        _ENFORCER.main([])
-    except SystemExit as raised_exit:
-        raw_code = raised_exit.code
-        exit_code = raw_code if isinstance(raw_code, int) else None
-    return exit_code, captured_stdout.getvalue()
+def _run_main(payload_by_key: dict[str, object]) -> tuple[int | None, str]:
+    captured_stdout, exit_code = run_serialized_payload_entrypoint(
+        _ENFORCER.main, json.dumps(payload_by_key)
+    )
+    return exit_code, captured_stdout
 
 
 def _decision_from(stdout_text: str) -> str | None:
@@ -84,7 +82,7 @@ def test_scratchpad_write_is_exempt_from_code_rules(
     monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
     throwaway_script = scratchpad_directory / "one_off_probe.py"
 
-    exit_code, stdout_text = _run_main(monkeypatch, _write_payload(throwaway_script))
+    exit_code, stdout_text = _run_main(_write_payload(throwaway_script))
 
     assert exit_code == 0
     assert _decision_from(stdout_text) != "deny"
@@ -99,7 +97,7 @@ def test_identical_non_scratchpad_write_is_still_blocked(
     outside_directory.mkdir(parents=True)
     production_module = outside_directory / "one_off_probe.py"
 
-    exit_code, stdout_text = _run_main(monkeypatch, _write_payload(production_module))
+    exit_code, stdout_text = _run_main(_write_payload(production_module))
 
     assert exit_code == 0
     assert _decision_from(stdout_text) == "deny"