claude-dev-env 2.18.0 → 2.20.0

package/hooks/advisory/test_refactor_guard_advisory.py

@@ -0,0 +1,171 @@
+"""Tests for direct and dispatched refactor guidance."""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ADVISORY_DIRECTORY = Path(__file__).resolve().parent
+HOOK_SCRIPT_PATH = ADVISORY_DIRECTORY / "refactor_guard.py"
+DISPATCHER_SCRIPT_PATH = ADVISORY_DIRECTORY.parent / "blocking" / "pre_tool_use_dispatcher.py"
+if str(ADVISORY_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(ADVISORY_DIRECTORY))
+
+import refactor_guard  # noqa: E402
+from refactor_guard_test_support import commit_file, stage_file  # noqa: E402
+
+
+def _refactor_payload(file_path: Path) -> str:
+    return json.dumps(
+        {
+            "tool_name": "Edit",
+            "tool_input": {
+                "file_path": str(file_path),
+                "old_string": "def calculate_total(amount: int) -> int:\n    return amount",
+                "new_string": "def compute_total(amount: int) -> int:\n    return amount",
+            },
+        }
+    )
+
+
+def _ordinary_edit_payload(file_path: Path) -> str:
+    return json.dumps(
+        {
+            "tool_name": "Edit",
+            "tool_input": {
+                "file_path": str(file_path),
+                "old_string": "return amount",
+                "new_string": "return amount + 1",
+            },
+        }
+    )
+
+
+def _run_hook(
+    script_path: Path, repository_path: Path, payload_text: str
+) -> subprocess.CompletedProcess[str]:
+    environment_by_key = os.environ.copy()
+    environment_by_key["HOME"] = str(repository_path)
+    environment_by_key["USERPROFILE"] = str(repository_path)
+    return subprocess.run(
+        [sys.executable, str(script_path)],
+        cwd=repository_path,
+        input=payload_text,
+        capture_output=True,
+        text=True,
+        env=environment_by_key,
+        check=False,
+    )
+
+
+def test_direct_hook_emits_edit_stage_guidance_for_eligible_refactor(
+    git_repository: Path,
+) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(
+        git_repository,
+        source_path,
+        "def calculate_total(amount: int) -> int:\n    return amount\n",
+    )
+    stage_file(
+        git_repository,
+        source_path,
+        "def calculate_total(amount: int) -> int:\n    return amount + 1\n",
+    )
+
+    completed_hook = _run_hook(HOOK_SCRIPT_PATH, git_repository, _refactor_payload(source_path))
+    advisory_payload = json.loads(completed_hook.stdout)
+    hook_specific_output = advisory_payload["hookSpecificOutput"]
+
+    assert hook_specific_output["permissionDecision"] == "allow"
+    assert "Edit-stage" in advisory_payload["systemMessage"]
+    assert "current git diff" in hook_specific_output["additionalContext"]
+    assert str(source_path) in advisory_payload["systemMessage"]
+
+
+def test_direct_hook_stays_silent_for_ordinary_edit(git_repository: Path) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(
+        git_repository,
+        source_path,
+        "def calculate_total(amount: int) -> int:\n    return amount\n",
+    )
+
+    completed_hook = _run_hook(
+        HOOK_SCRIPT_PATH,
+        git_repository,
+        _ordinary_edit_payload(source_path),
+    )
+
+    assert completed_hook.returncode == 0
+    assert completed_hook.stdout == ""
+
+
+def test_direct_hook_stays_silent_for_write_payload(git_repository: Path) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(
+        git_repository,
+        source_path,
+        "def calculate_total(amount: int) -> int:\n    return amount\n",
+    )
+    write_payload = json.dumps(
+        {
+            "tool_name": "Write",
+            "tool_input": {"file_path": str(source_path), "content": "new content"},
+        }
+    )
+
+    completed_hook = _run_hook(HOOK_SCRIPT_PATH, git_repository, write_payload)
+
+    assert completed_hook.returncode == 0
+    assert completed_hook.stdout == ""
+
+
+def test_dispatcher_preserves_edit_stage_guidance(git_repository: Path) -> None:
+    source_path = git_repository / "module.py"
+    matching_test_path = git_repository / "test_module.py"
+    commit_file(
+        git_repository,
+        source_path,
+        "def calculate_total(amount: int) -> int:\n    return amount\n",
+    )
+    commit_file(
+        git_repository,
+        matching_test_path,
+        "def calculate_total(amount: int) -> int:\n    return amount\n\n"
+        "def test_calculate_total() -> None:\n    assert calculate_total(1) == 1\n",
+    )
+    stage_file(
+        git_repository,
+        source_path,
+        "def calculate_total(amount: int) -> int:\n    return amount + 1\n",
+    )
+
+    completed_dispatch = _run_hook(
+        DISPATCHER_SCRIPT_PATH,
+        git_repository,
+        _refactor_payload(source_path),
+    )
+    dispatcher_payload = json.loads(completed_dispatch.stdout)
+    hook_specific_output = dispatcher_payload["hookSpecificOutput"]
+
+    assert hook_specific_output["permissionDecision"] == "allow", (
+        f"Dispatcher output: {completed_dispatch.stdout!r}; stderr: {completed_dispatch.stderr!r}"
+    )
+    assert "Edit-stage" in dispatcher_payload["systemMessage"]
+    assert "Refactor guard" in dispatcher_payload["systemMessage"]
+
+
+def test_bypass_token_is_consumed_once(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    bypass_token_path = tmp_path / "refactor-bypass-token"
+    monkeypatch.setattr(refactor_guard, "REFACTOR_BYPASS_TOKEN_PATH", bypass_token_path)
+    bypass_token_path.write_text("approved", encoding="utf-8")
+
+    assert refactor_guard.is_bypass_approved()
+    assert not bypass_token_path.exists()
+    assert not refactor_guard.is_bypass_approved()

package/hooks/advisory/test_refactor_guard_eligibility.py

@@ -0,0 +1,166 @@
+"""Tests for refactor candidate eligibility against a temporary Git repository."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+ADVISORY_DIRECTORY = Path(__file__).resolve().parent
+if str(ADVISORY_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(ADVISORY_DIRECTORY))
+
+import refactor_guard  # noqa: E402
+from refactor_guard_test_support import commit_file, stage_file  # noqa: E402
+
+
+def test_refactor_candidate_is_eligible_when_old_lines_are_outside_changed_surface(
+    git_repository: Path,
+) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(
+        git_repository,
+        source_path,
+        "def calculate_total(amount: int) -> int:\n    return amount\n",
+    )
+    stage_file(
+        git_repository,
+        source_path,
+        "def calculate_total(amount: int) -> int:\n    return amount + 1\n",
+    )
+
+    old_function = "def calculate_total(amount: int) -> int:\n    return amount"
+    renamed_function = "def compute_total(amount: int) -> int:\n    return amount"
+
+    assert refactor_guard.is_refactor_eligible(str(source_path), old_function, renamed_function)
+
+
+def test_refactor_candidate_is_ineligible_when_old_lines_are_in_changed_surface(
+    git_repository: Path,
+) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(git_repository, source_path, "pass\n")
+    old_function = "def calculate_total(amount: int) -> int:\n    return amount"
+    stage_file(git_repository, source_path, f"{old_function}\n")
+    renamed_function = "def compute_total(amount: int) -> int:\n    return amount"
+
+    assert not refactor_guard.is_refactor_eligible(str(source_path), old_function, renamed_function)
+
+
+def test_changed_surface_reads_staged_and_unstaged_lines(
+    git_repository: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(git_repository, source_path, "baseline = 1\n")
+
+    stage_file(git_repository, source_path, "staged_line = 1\n")
+    source_path.write_text("unstaged_line = 1\n", encoding="utf-8")
+
+    monkeypatch.setenv("GIT_DIR", str(git_repository / "missing-git-dir"))
+    monkeypatch.setenv("GIT_WORK_TREE", str(git_repository / "missing-work-tree"))
+    monkeypatch.setenv("GIT_INDEX_FILE", str(git_repository / "missing-index"))
+    monkeypatch.setenv("GIT_COMMON_DIR", str(git_repository / "missing-common-dir"))
+    monkeypatch.setenv("GIT_PREFIX", "adversarial-prefix")
+    scrubbed_environment = refactor_guard._git_environment()
+    assert not any(each_name.startswith("GIT_") for each_name in scrubbed_environment)
+    all_added_lines = refactor_guard.get_git_diff_added_lines(str(source_path))
+
+    assert all_added_lines == {"staged_line = 1", "unstaged_line = 1"}
+
+
+def test_duplicate_old_lines_require_duplicate_changed_occurrences(
+    git_repository: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(git_repository, source_path, "pass\n")
+    old_function = "def calculate_total(amount: int) -> int:\n    return amount\n    return amount"
+    stage_file(
+        git_repository,
+        source_path,
+        "def calculate_total(amount: int) -> int:\n    return amount\n",
+    )
+    renamed_function = old_function.replace("calculate_total", "compute_total")
+    monkeypatch.setattr(
+        refactor_guard,
+        "_get_added_line_occurrences",
+        lambda _file_path: ["def calculate_total(amount: int) -> int:", "    return amount"],
+    )
+
+    assert refactor_guard.is_refactor_edit(old_function, renamed_function)
+    assert not refactor_guard.is_edit_within_changed_surface(str(source_path), old_function)
+
+
+def test_ordinary_edit_is_not_a_refactor_candidate(git_repository: Path) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(git_repository, source_path, "return_amount = 1\n")
+
+    assert not refactor_guard.is_refactor_eligible(
+        str(source_path), "return_amount = 1", "return_amount = 2"
+    )
+
+
+def test_new_file_is_not_a_refactor_candidate(git_repository: Path) -> None:
+    source_path = git_repository / "new_module.py"
+    source_path.write_text(
+        "def calculate_total(amount: int) -> int:\n    return amount\n",
+        encoding="utf-8",
+    )
+
+    assert refactor_guard.is_new_file(str(source_path))
+    assert not refactor_guard.is_refactor_eligible(
+        str(source_path),
+        "def calculate_total(amount: int) -> int:\n    return amount",
+        "def compute_total(amount: int) -> int:\n    return amount",
+    )
+
+
+def test_hook_infrastructure_is_not_a_refactor_candidate(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("USERPROFILE", str(tmp_path))
+    hook_path = str(Path.home() / ".claude" / "settings.json")
+
+    assert refactor_guard.is_hook_infrastructure(hook_path)
+    assert not refactor_guard.is_refactor_eligible(
+        hook_path,
+        "def calculate_total(amount: int) -> int:\n    return amount",
+        "def compute_total(amount: int) -> int:\n    return amount",
+    )
+
+
+def test_changed_surface_below_half_is_false(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        refactor_guard,
+        "_get_added_line_occurrences",
+        lambda _file_path: ["changed line"],
+    )
+
+    assert not refactor_guard.is_edit_within_changed_surface(
+        "module.py", "changed line\noriginal line\noriginal line"
+    )
+
+
+def test_changed_surface_at_half_is_true(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        refactor_guard,
+        "_get_added_line_occurrences",
+        lambda _file_path: ["changed one", "changed two"],
+    )
+
+    assert refactor_guard.is_edit_within_changed_surface(
+        "module.py", "changed one\nchanged two\noriginal one\noriginal two"
+    )
+
+
+def test_changed_surface_above_half_is_true(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        refactor_guard,
+        "_get_added_line_occurrences",
+        lambda _file_path: ["changed one", "changed two", "changed three"],
+    )
+
+    assert refactor_guard.is_edit_within_changed_surface(
+        "module.py", "changed one\nchanged two\nchanged three\noriginal line"
+    )

package/hooks/atomic_file_writer.py

@@ -0,0 +1,81 @@
+"""Atomic text replacement for hook-state files."""
+
+import os
+import tempfile
+from pathlib import Path
+
+from hooks_constants.atomic_file_writer_constants import TEXT_WRITE_MODE
+
+
+def _remove_orphaned_temporary_files(
+    parent_directory: Path, temporary_prefix: str, temporary_suffix: str
+) -> None:
+    for each_temporary_path in parent_directory.glob(f"{temporary_prefix}*{temporary_suffix}"):
+        try:
+            each_temporary_path.unlink(missing_ok=True)
+        except OSError:
+            continue
+
+
+def _write_temporary_text(
+    parent_directory: Path,
+    serialized_text: str,
+    encoding: str,
+    temporary_prefix: str,
+    temporary_suffix: str,
+) -> Path:
+    temporary_path: Path | None = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode=TEXT_WRITE_MODE,
+            encoding=encoding,
+            dir=parent_directory,
+            prefix=temporary_prefix,
+            suffix=temporary_suffix,
+            delete=False,
+        ) as writable_handle:
+            temporary_path = Path(writable_handle.name)
+            writable_handle.write(serialized_text)
+        return temporary_path
+    except (OSError, UnicodeError):
+        if temporary_path is not None:
+            temporary_path.unlink(missing_ok=True)
+        raise
+
+
+def write_text_atomically(
+    target_path: Path,
+    serialized_text: str,
+    encoding: str,
+    temporary_prefix: str,
+    temporary_suffix: str,
+    should_reap_orphans: bool,
+) -> None:
+    """Replace one text file through a unique sibling temporary file.
+
+    Args:
+        target_path: The destination file path.
+        serialized_text: The complete replacement text.
+        encoding: The text encoding.
+        temporary_prefix: Prefix for sibling temporary files.
+        temporary_suffix: Suffix for sibling temporary files.
+        should_reap_orphans: Whether to remove same-pattern temporary files first.
+    """
+    parent_directory = target_path.parent
+    parent_directory.mkdir(parents=True, exist_ok=True)
+    if should_reap_orphans:
+        _remove_orphaned_temporary_files(parent_directory, temporary_prefix, temporary_suffix)
+    temporary_path = _write_temporary_text(
+        parent_directory,
+        serialized_text,
+        encoding,
+        temporary_prefix,
+        temporary_suffix,
+    )
+    try:
+        os.replace(temporary_path, target_path)
+    finally:
+        try:
+            temporary_path.unlink(missing_ok=True)
+        except OSError:
+            pass

package/hooks/blocking/AGENTS.md

@@ -95,7 +95,7 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `pytest_testpaths_orphan_blocker.py` | PreToolUse (Write/Edit/MultiEdit) | New `test_*.py` files created under a directory absent from a package's explicit pytest `testpaths` allowlist |
 | `question_to_user_enforcer.py` | Stop | User-directed questions not routed through `AskUserQuestion` |
 | `send_user_file_open_locally_blocker.py` | PreToolUse (SendUserFile) | A desk-side file attach (`SendUserFile` with `status` not `proactive`); points to opening the file with its native Windows app |
-| `sensitive_file_protector.py` | PreToolUse (Write/Edit) | Writes to sensitive credential or config files |
+| `sensitive_file_protector.py` | PreToolUse (Write/Edit/MultiEdit) | Writes to sensitive credential or config files |
 | `session_edit_stage_gate.py` | PreToolUse (Bash) | A `git commit` that would drop files edited this session because they are tracked but left unstaged |
 | `session_handoff_blocker.py` | Stop | Responses suggesting a new session mid-task |
 | `shell_substitution_blocker.py` | PreToolUse (Bash) | A command carrying `$(...)`, a live backtick, or `<(...)`/`>(...)` process substitution, which the allowlist matcher cannot descend into |
@@ -114,6 +114,7 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | File | Role |
 |---|---|
 | `_gh_body_arg_utils.py` | Parsing helpers for `gh_body_arg_blocker.py` |
+| `test_hook_subprocess_support.py` | Shared subprocess runner for blocking-hook behavior tests |
 
 ## Conventions
 

package/hooks/blocking/block_main_commit.py

@@ -28,46 +28,73 @@ PROTECTED_BRANCHES = ("main", "master")
 PROTECTED_REMOTE_PATTERNS: list[str] = []
 
 
-def extract_git_working_directory(bash_command: str) -> str | None:
-    """Extract the directory where git commit will actually execute.
-
-    Parses the bash command for directory-changing patterns that precede
-    the git commit, and for git's own -C flag.
-
-    Returns None if the commit runs in the hook's CWD.
-    """
-    git_c_match = re.search(
-        r"git\s+-C\s+[\"']?([^\"';&|]+?)[\"']?\s+commit",
+def _match_git_c_commit(bash_command: str) -> re.Match[str] | None:
+    """Return the match for a Git commit with an explicit directory."""
+    return re.search(
+        r"(?:^|(?<=[;&|]))\s*git\s+-C\s+[\"']?([^\"';&|]+?)[\"']?\s+commit(?:\s|$)",
         bash_command,
+        flags=re.IGNORECASE,
     )
+
+
+def parse_git_commit_directory(bash_command: str) -> tuple[bool, str | None]:
+    """Return the Git commit match state and selected working directory."""
+    git_c_match = _match_git_c_commit(bash_command)
     if git_c_match:
-        return git_c_match.group(1).strip()
+        return True, git_c_match.group(1).strip()
 
-    commit_pos = bash_command.lower().find("git commit")
-    if commit_pos == -1:
-        return None
+    git_commit_match = re.search(
+        r"(?:^|(?<=[;&|]))\s*git\s+commit(?:\s|$)",
+        bash_command,
+        flags=re.IGNORECASE,
+    )
+    if git_commit_match is None:
+        return False, None
 
-    prefix = bash_command[:commit_pos]
+    prefix = bash_command[:git_commit_match.start()]
 
     cd_matches = re.findall(
         r"(?:cd|pushd)\s+[\"']?([^\"';&|]+?)[\"']?\s*[;&|]",
         prefix,
+        flags=re.IGNORECASE,
     )
     if cd_matches:
-        return cd_matches[-1].strip()
+        return True, cd_matches[-1].strip()
+
+    return True, None
+
+
+def extract_git_working_directory(bash_command: str) -> str | None:
+    """Return the working directory selected by a Git commit command."""
+    _, working_directory = parse_git_commit_directory(bash_command)
+    return working_directory
 
-    return None
+
+def is_commit_command(bash_command: str) -> bool:
+    """Return the Git commit match state for the shell command."""
+    is_commit, _ = parse_git_commit_directory(bash_command)
+    return is_commit
+
+
+def is_git_c_commit_command(bash_command: str) -> bool:
+    """Return whether the command names a Git commit target with ``-C``."""
+    return _match_git_c_commit(bash_command) is not None
 
 
-def resolve_directory(directory: str | None) -> str | None:
+def resolve_directory(
+    directory: str | None,
+    from_directory: str | None = None,
+) -> str | None:
     """Resolve a directory path, expanding ~ and validating existence."""
-    if directory is None:
+    selected_directory = directory if directory is not None else from_directory
+    if selected_directory is None:
         return None
 
-    expanded = os.path.expanduser(directory)
+    expanded = os.path.expanduser(selected_directory)
 
     if not os.path.isabs(expanded):
-        expanded = os.path.abspath(expanded)
+        base_directory = from_directory or os.getcwd()
+        expanded = os.path.abspath(os.path.join(base_directory, expanded))
 
     if os.path.isdir(expanded):
         return expanded
@@ -112,22 +139,25 @@ def is_protected_repo(working_dir: str | None = None) -> bool:
     return False
 
 
-def is_commit_command(bash_command: str) -> bool:
-    return "git commit" in bash_command.lower().strip()
-
-
 def is_main_commit_confirmed(bash_command: str) -> bool:
     """Return True if the command includes the explicit confirmation sentinel."""
     return "--allow-main-commit" in bash_command
 
 
-def parse_bash_command_from_stdin() -> str:
+def parse_hook_context_from_stdin() -> tuple[str, str | None]:
     try:
         hook_event = json.load(sys.stdin)
     except json.JSONDecodeError:
-        return ""
+        return "", None
+
+    bash_command = hook_event.get("tool_input", {}).get("command", "")
+    return bash_command, hook_event.get("cwd")
+
 
-    return hook_event.get("tool_input", {}).get("command", "")
+def parse_bash_command_from_stdin() -> str:
+    """Return the Bash command from the hook payload on standard input."""
+    bash_command, _ = parse_hook_context_from_stdin()
+    return bash_command
 
 
 DRAFT_PR_INSTRUCTION = (
@@ -156,18 +186,21 @@ def build_denial_response(branch_name: str, repo_dir: str | None) -> dict:
 
 
 def main() -> None:
-    bash_command = parse_bash_command_from_stdin()
+    bash_command, event_cwd = parse_hook_context_from_stdin()
+    has_commit_command, target_dir_raw = parse_git_commit_directory(bash_command)
 
-    if not is_commit_command(bash_command):
+    if not has_commit_command:
         sys.exit(0)
 
     if is_main_commit_confirmed(bash_command):
         sys.exit(0)
 
-    target_dir_raw = extract_git_working_directory(bash_command)
-    target_dir = resolve_directory(target_dir_raw)
+    if event_cwd is None and is_git_c_commit_command(bash_command):
+        sys.exit(0)
+
+    target_dir = resolve_directory(target_dir_raw, from_directory=event_cwd)
 
-    if target_dir_raw and not target_dir:
+    if (target_dir_raw or event_cwd) and not target_dir:
         sys.exit(0)
 
     current_branch = get_branch_at_directory(working_dir=target_dir)