claude-dev-env 2.18.0 → 2.20.0

package/hooks/hooks_constants/hardcoded_user_path_constants.py

@@ -4,9 +4,15 @@ import re
 
 HARDCODED_USER_PATH_PATTERN: re.Pattern[str] = re.compile(
     r"(?:"
-    r"[A-Za-z]:[\\/](?i:users)[\\/](?!(?i:Public|Shared|All Users)(?:[\\/]|$))[^\\/]+(?=[\\/]|$)"
-    r"|(?<![A-Za-z:])/Users/(?!(?i:Shared|Public)(?:/|$))[^/]+(?=/|$)"
-    r"|/home/[^/]+(?=/|$))"
+    r"[A-Za-z]:[\\/]+(?i:users)[\\/]+(?!(?i:Public|Shared|All Users)(?:[\\/]|$))[^\\/]+(?=[\\/]|$)"
+    r"|\\{2,}(?:[^\\/\r\n]+[\\/]+)+(?i:users)[\\/]+(?!(?i:Public|Shared|All Users)(?:[\\/]|$))[^\\/]+(?=[\\/]|$)"
+    r"|(?<!:)//(?:[^\\/\r\n]+/)+(?i:users)/(?!(?i:Public|Shared|All Users)(?:/|$))[^/]+(?=/|$)"
+    r"|(?i:file):///Users/(?!(?i:Shared|Public)(?:/|$))[^/]+(?=/|$)"
+    r"|(?i:file)://(?:[^/\r\n]+/)+(?i:Users)/(?!(?i:Shared|Public)(?:/|$))[^/]+(?=/|$)"
+    r"|(?i:file):///home/[^/]+(?=/|$)"
+    r"|(?i:file)://(?:[^/\r\n]+/)+(?i:home)/[^/]+(?=/|$)"
+    r"|(?<![A-Za-z0-9._:/\-\]])/Users/(?!(?i:Shared|Public)(?:/|$))[^/]+(?=/|$)"
+    r"|(?<![A-Za-z0-9._:/\-\]])/home/[^/]+(?=/|$))"
 )
 MAX_HARDCODED_USER_PATH_ISSUES: int = 25
 HARDCODED_USER_PATH_GUIDANCE: str = "use pathlib.Path.home() or os.path.expanduser('~') instead of a hardcoded user directory"

package/hooks/hooks_constants/pre_tool_use_dispatcher_constants.py

@@ -82,7 +82,7 @@ ALL_HOSTED_HOOK_ENTRIES: tuple[HostedHookEntry, ...] = (
     ),
     HostedHookEntry(
         script_relative_path="blocking/sensitive_file_protector.py",
-        applicable_tool_names=ALL_WRITE_AND_EDIT_TOOL_NAMES,
+        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
     ),
     HostedHookEntry(
         script_relative_path="blocking/pii_prevention_blocker.py",

package/hooks/hooks_constants/refactor_guard_constants.py

@@ -0,0 +1,75 @@
+"""Constants for the changed-surface refactor advisory."""
+
+from __future__ import annotations
+
+MAXIMUM_REFACTOR_LINE_DELTA: int = 3
+REFACTOR_LINE_DELTA_DIVISOR: int = 2
+CHANGED_SURFACE_MATCH_RATIO: float = 0.5
+ALL_PYTHON_KEYWORDS: frozenset[str] = frozenset(
+    {
+        "def",
+        "class",
+        "return",
+        "import",
+        "from",
+        "if",
+        "elif",
+        "else",
+        "for",
+        "while",
+        "try",
+        "except",
+        "finally",
+        "with",
+        "as",
+        "yield",
+        "raise",
+        "pass",
+        "break",
+        "continue",
+        "and",
+        "or",
+        "not",
+        "in",
+        "is",
+        "lambda",
+        "None",
+        "True",
+        "False",
+        "self",
+        "cls",
+        "async",
+        "await",
+        "global",
+        "nonlocal",
+        "assert",
+        "del",
+        "print",
+        "len",
+        "range",
+        "list",
+        "dict",
+        "set",
+        "str",
+        "int",
+        "float",
+        "bool",
+        "type",
+        "isinstance",
+        "hasattr",
+        "getattr",
+        "setattr",
+        "super",
+        "property",
+        "staticmethod",
+        "classmethod",
+        "abstractmethod",
+        "Optional",
+        "Union",
+        "List",
+        "Dict",
+        "Set",
+        "Tuple",
+        "Any",
+    }
+)

package/hooks/hooks_constants/sensitive_file_protector_constants.py

@@ -1,7 +1,7 @@
 """Constants for the ``sensitive_file_protector`` PreToolUse hook.
 
-The hook denies a Write or Edit whose target basename names a live secret or a
-lock file, and steps aside for a placeholders-only committed template.
+The hook denies a Write, Edit, or MultiEdit whose target basename names a live
+secret or a lock file, and steps aside for a placeholders-only committed template.
 """
 
 from __future__ import annotations
@@ -28,8 +28,6 @@ ALL_SENSITIVE_PATTERNS = (
 
 ALL_TEMPLATE_SUFFIXES = (".example", ".sample", ".template")
 
-ALL_WRITE_EDIT_TOOLS = ("Write", "Edit")
-
 HOOK_SCRIPT_NAME = "sensitive_file_protector.py"
 
 HOOK_EVENT_NAME = "PreToolUse"

package/hooks/hooks_constants/test_refactor_guard_constants.py

@@ -0,0 +1,21 @@
+"""Tests for refactor advisory constants."""
+
+import sys
+from pathlib import Path
+
+_HOOKS_ROOT = Path(__file__).resolve().parent.parent
+if str(_HOOKS_ROOT) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_ROOT))
+
+from hooks_constants.refactor_guard_constants import (
+    ALL_PYTHON_KEYWORDS,
+    CHANGED_SURFACE_MATCH_RATIO,
+    MAXIMUM_REFACTOR_LINE_DELTA,
+    REFACTOR_LINE_DELTA_DIVISOR,
+)
+
+
+def test_refactor_threshold_constants_define_a_half_boundary() -> None:
+    assert CHANGED_SURFACE_MATCH_RATIO * REFACTOR_LINE_DELTA_DIVISOR == 1
+    assert MAXIMUM_REFACTOR_LINE_DELTA > REFACTOR_LINE_DELTA_DIVISOR
+    assert "return" in ALL_PYTHON_KEYWORDS

package/hooks/json_file_reader.py

@@ -0,0 +1,22 @@
+"""Safe JSON-object reads for hook-state files."""
+
+import json
+from pathlib import Path
+
+
+def read_json_object(file_path: Path, encoding: str) -> dict[str, object] | None:
+    """Return one decoded JSON object.
+
+    Args:
+        file_path: The JSON file path.
+        encoding: The text encoding.
+
+    Returns:
+        The decoded object, or ``None`` for missing, unreadable, or malformed data.
+    """
+    try:
+        raw_text = file_path.read_text(encoding=encoding)
+        parsed_payload = json.loads(raw_text)
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError):
+        return None
+    return parsed_payload if isinstance(parsed_payload, dict) else None

package/hooks/observability/test_instructions_loaded_logger.py

@@ -48,6 +48,60 @@ def test_should_write_record_with_known_payload_fields_to_jsonl_log() -> None:
         assert "timestamp" in record
 
 
+def test_should_exclude_instruction_body_and_unrelated_secret_like_fields(
+    tmp_path: Path,
+) -> None:
+    fake_home = tmp_path / "home"
+    fake_home.mkdir()
+    payload = {
+        "file_path": "/tmp/CLAUDE.md",
+        "instruction_body": "private instruction text",
+        "api_key": "secret-api-key",
+        "authorization": "Bearer secret-token",
+        "metadata": {
+            "instruction_body": "nested private instruction text",
+            "api_key": "nested-secret-api-key",
+            "authorization": "Nested bearer secret-token",
+            "unrelated_secret_like_field": "nested private payload",
+        },
+    }
+
+    completed = _run_hook(payload, fake_home)
+
+    assert completed.returncode == 0, completed.stderr
+    log_path = fake_home / ".claude" / "logs" / "instructions_loaded.jsonl"
+    serialized_record = log_path.read_text(encoding="utf-8").strip()
+    record = json.loads(serialized_record)
+    assert set(record) == {
+        "timestamp",
+        "file_path",
+        "load_reason",
+        "memory_type",
+        "trigger_file_path",
+        "parent_file_path",
+        "globs",
+        "session_id",
+    }
+    sensitive_field_names = {
+        "instruction_body",
+        "api_key",
+        "authorization",
+        "metadata",
+        "unrelated_secret_like_field",
+    }
+    sensitive_field_values = {
+        "private instruction text",
+        "secret-api-key",
+        "Bearer secret-token",
+        "nested private instruction text",
+        "nested-secret-api-key",
+        "Nested bearer secret-token",
+        "nested private payload",
+    }
+    for each_sensitive_text in sensitive_field_names | sensitive_field_values:
+        assert each_sensitive_text not in serialized_record
+
+
 def test_should_exit_zero_and_record_error_when_stdin_payload_is_invalid_json() -> None:
     with tempfile.TemporaryDirectory() as fake_home_string:
         fake_home = Path(fake_home_string)

package/hooks/pending_sidecars.py

@@ -0,0 +1,33 @@
+"""Pending-sidecar discovery and cleanup for hook state."""
+
+from pathlib import Path
+
+
+def pending_sidecar_paths(
+    main_file: Path, pending_marker: str, pending_suffix: str
+) -> tuple[Path, ...]:
+    """Return pending sidecars for one main state file.
+
+    Args:
+        main_file: The primary state file.
+        pending_marker: The marker before the unique sidecar token.
+        pending_suffix: The sidecar filename suffix.
+
+    Returns:
+        The matching pending sidecar paths.
+    """
+    pending_pattern = f"{main_file.name}{pending_marker}*{pending_suffix}"
+    return tuple(main_file.parent.glob(pending_pattern))
+
+
+def remove_pending_sidecars(all_pending_files: tuple[Path, ...]) -> None:
+    """Remove a captured pending-sidecar set.
+
+    Args:
+        all_pending_files: The exact sidecars already merged or consumed.
+    """
+    for each_pending_file in all_pending_files:
+        try:
+            each_pending_file.unlink(missing_ok=True)
+        except OSError:
+            continue

package/hooks/session/test_plugin_data_dir_cleanup.py

@@ -0,0 +1,70 @@
+"""Behavior tests for plugin data directory cleanup."""
+
+from __future__ import annotations
+
+import importlib.util
+import stat
+from pathlib import Path
+
+
+HOOK_DIRECTORY = Path(__file__).parent
+HOOK_SPEC = importlib.util.spec_from_file_location(
+    "plugin_data_dir_cleanup",
+    HOOK_DIRECTORY / "plugin_data_dir_cleanup.py",
+)
+assert HOOK_SPEC is not None
+assert HOOK_SPEC.loader is not None
+HOOK_MODULE = importlib.util.module_from_spec(HOOK_SPEC)
+HOOK_SPEC.loader.exec_module(HOOK_MODULE)
+
+
+def _configure_plugin_data_directory(plugin_data_directory: Path) -> None:
+    HOOK_MODULE.__dict__["PLUGINS_DATA_DIRECTORY"] = str(plugin_data_directory)
+    HOOK_MODULE.__dict__["AFFECTED_PLUGIN_DIRECTORIES"] = ["sample-plugin"]
+
+
+def test_main_removes_empty_plugin_data_directory(tmp_path: Path) -> None:
+    plugin_data_directory = tmp_path / "plugin-data"
+    plugin_data_directory.mkdir()
+    empty_plugin_directory = plugin_data_directory / "sample-plugin"
+    empty_plugin_directory.mkdir()
+    _configure_plugin_data_directory(plugin_data_directory)
+
+    HOOK_MODULE.main()
+
+    assert not empty_plugin_directory.exists()
+
+
+def test_main_keeps_plugin_data_directory_with_files(tmp_path: Path) -> None:
+    plugin_data_directory = tmp_path / "plugin-data"
+    plugin_data_directory.mkdir()
+    retained_plugin_directory = plugin_data_directory / "sample-plugin"
+    retained_plugin_directory.mkdir()
+    (retained_plugin_directory / "state.json").write_text("{}", encoding="utf-8")
+    _configure_plugin_data_directory(plugin_data_directory)
+
+    HOOK_MODULE.main()
+
+    assert retained_plugin_directory.is_dir()
+
+
+def test_main_keeps_read_only_plugin_data_directory_with_files(
+    tmp_path: Path,
+) -> None:
+    plugin_data_directory = tmp_path / "plugin-data"
+    plugin_data_directory.mkdir()
+    retained_plugin_directory = plugin_data_directory / "sample-plugin"
+    retained_plugin_directory.mkdir()
+    state_file = retained_plugin_directory / "state.json"
+    state_file.write_text("{}", encoding="utf-8")
+    state_file.chmod(stat.S_IREAD)
+    _configure_plugin_data_directory(plugin_data_directory)
+
+    try:
+        HOOK_MODULE.main()
+
+        assert retained_plugin_directory.is_dir()
+        assert state_file.is_file()
+        assert state_file.read_text(encoding="utf-8") == "{}"
+    finally:
+        state_file.chmod(stat.S_IREAD | stat.S_IWRITE)

package/hooks/session/test_session_edit_tracker_cleanup.py

@@ -127,12 +127,25 @@ def test_should_keep_current_session_tracker_on_continuation(
     redirected_temp_directory: pathlib.Path, continuation_source: str
 ) -> None:
     current_file = _seed_edit_file(redirected_temp_directory, "currentsession")
-    _run_main_with_stdin(
-        _session_continuation_payload("currentsession", continuation_source)
-    )
+    _run_main_with_stdin(_session_continuation_payload("currentsession", continuation_source))
     assert current_file.exists()
 
 
+def test_resume_preserves_edit_record(
+    redirected_temp_directory: pathlib.Path,
+) -> None:
+    current_file = _seed_edit_file(redirected_temp_directory, "currentsession")
+    current_file.write_text(
+        json.dumps({ALL_EDITED_FILE_PATHS_KEY: ["packages/example.py"]}),
+        encoding="utf-8",
+    )
+    _run_main_with_stdin(_session_continuation_payload("currentsession", "resume"))
+
+    assert json.loads(current_file.read_text(encoding="utf-8")) == {
+        ALL_EDITED_FILE_PATHS_KEY: ["packages/example.py"]
+    }
+
+
 def test_should_remove_current_session_tracker_on_session_end(
     redirected_temp_directory: pathlib.Path,
 ) -> None:

package/hooks/test_atomic_file_writer.py

@@ -0,0 +1,73 @@
+"""Behavior tests for atomic hook-state text replacement."""
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_hooks_directory = str(Path(__file__).resolve().parent)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+import atomic_file_writer
+from atomic_file_writer import write_text_atomically
+
+
+def test_write_text_atomically_creates_parent_and_replaces_complete_text(
+    tmp_path: Path,
+) -> None:
+    target_path = tmp_path / "state" / "cache.json"
+
+    write_text_atomically(
+        target_path,
+        '{"complete": true}',
+        encoding="utf-8",
+        temporary_prefix=".cache-",
+        temporary_suffix=".tmp",
+        should_reap_orphans=False,
+    )
+
+    assert target_path.read_text(encoding="utf-8") == '{"complete": true}'
+
+
+def test_write_text_atomically_preserves_target_and_cleans_temp_after_replace_error(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    target_path = tmp_path / "cache.json"
+    target_path.write_text("stable", encoding="utf-8")
+
+    def _raise_replace_error(source_path: object, destination_path: object) -> None:
+        del source_path, destination_path
+        raise OSError("replace failed")
+
+    monkeypatch.setattr(atomic_file_writer.os, "replace", _raise_replace_error)
+
+    with pytest.raises(OSError, match="replace failed"):
+        write_text_atomically(
+            target_path,
+            "replacement",
+            encoding="utf-8",
+            temporary_prefix=".cache-",
+            temporary_suffix=".tmp",
+            should_reap_orphans=False,
+        )
+
+    assert target_path.read_text(encoding="utf-8") == "stable"
+    assert list(tmp_path.glob(".cache-*.tmp")) == []
+
+
+def test_write_text_atomically_reaps_orphans(tmp_path: Path) -> None:
+    target_path = tmp_path / "cache.json"
+    orphan_path = tmp_path / ".cache-orphan.tmp"
+    orphan_path.write_text("orphan", encoding="utf-8")
+
+    write_text_atomically(
+        target_path,
+        "replacement",
+        encoding="utf-8",
+        temporary_prefix=".cache-",
+        temporary_suffix=".tmp",
+        should_reap_orphans=True,
+    )
+
+    assert not orphan_path.exists()

package/hooks/test_json_file_reader.py

@@ -0,0 +1,24 @@
+"""Behavior tests for safe JSON-object reads."""
+
+import sys
+from pathlib import Path
+
+_hooks_directory = str(Path(__file__).resolve().parent)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+from json_file_reader import read_json_object
+
+
+def test_read_json_object_returns_decoded_mapping(tmp_path: Path) -> None:
+    file_path = tmp_path / "state.json"
+    file_path.write_text('{"status": "ready"}', encoding="utf-8")
+
+    assert read_json_object(file_path, "utf-8") == {"status": "ready"}
+
+
+def test_read_json_object_returns_none_for_invalid_bytes(tmp_path: Path) -> None:
+    file_path = tmp_path / "state.json"
+    file_path.write_bytes(b"\xff")
+
+    assert read_json_object(file_path, "utf-8") is None

package/hooks/test_pending_sidecars.py

@@ -0,0 +1,25 @@
+"""Behavior tests for pending-sidecar discovery and cleanup."""
+
+import sys
+from pathlib import Path
+
+_hooks_directory = str(Path(__file__).resolve().parent)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+from pending_sidecars import pending_sidecar_paths, remove_pending_sidecars
+
+
+def test_pending_sidecar_paths_and_remove_pending_sidecars(tmp_path: Path) -> None:
+    main_file = tmp_path / "state.json"
+    first_pending = tmp_path / "state.json.pending-first.json"
+    second_pending = tmp_path / "state.json.pending-second.json"
+    unrelated_file = tmp_path / "other.json"
+    for each_file in (first_pending, second_pending, unrelated_file):
+        each_file.write_text("state", encoding="utf-8")
+
+    all_pending_files = pending_sidecar_paths(main_file, ".pending-", ".json")
+    remove_pending_sidecars(all_pending_files)
+
+    assert sorted(all_pending_files) == sorted((first_pending, second_pending))
+    assert unrelated_file.is_file()