claude-dev-env 2.19.0 → 2.21.0

package/hooks/git-hooks/test_post_commit.py

@@ -0,0 +1,203 @@
+from __future__ import annotations
+
+import os
+import subprocess
+from pathlib import Path
+
+import post_commit
+import pytest
+from git_hooks_constants import GIT_EXECUTABLE_NAME
+
+
+def build_fixture_git_environment() -> dict[str, str]:
+    """Copy the process environment without inherited Git state overrides."""
+    return {
+        each_name: each_value
+        for each_name, each_value in os.environ.items()
+        if not each_name.upper().startswith("GIT_")
+    }
+
+
+def clear_inherited_git_environment(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Remove inherited Git state overrides from the current test process."""
+    for each_name in list(os.environ):
+        if each_name.upper().startswith("GIT_"):
+            monkeypatch.delenv(each_name, raising=False)
+
+
+def test_fixture_git_environment_preserves_process_execution_path(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """The fixture environment keeps PATH while removing Git overrides."""
+    monkeypatch.setenv("PATH", "fixture-execution-path")
+    monkeypatch.setenv("GIT_DIR", "unrelated-repository")
+
+    fixture_environment = build_fixture_git_environment()
+
+    assert fixture_environment["PATH"] == "fixture-execution-path"
+    assert all(not each_name.upper().startswith("GIT_") for each_name in fixture_environment)
+
+
+def run_fixture_git(repository_path: Path, *arguments: str) -> str:
+    """Run Git in a fixture repository and return standard output."""
+    completed_process = subprocess.run(
+        [GIT_EXECUTABLE_NAME, *arguments],
+        cwd=repository_path,
+        check=False,
+        capture_output=True,
+        text=True,
+        env=build_fixture_git_environment(),
+    )
+    assert completed_process.returncode == 0, completed_process.stderr
+    return completed_process.stdout.strip()
+
+
+def configure_fixture_identity(repository_path: Path) -> None:
+    """Configure a stable identity for a fixture repository."""
+    run_fixture_git(repository_path, "config", "user.name", "Fixture User")
+    run_fixture_git(
+        repository_path,
+        "config",
+        "user.email",
+        "fixture@example.invalid",
+    )
+    run_fixture_git(repository_path, "config", "commit.gpgsign", "false")
+    fixture_hooks_directory = repository_path / ".fixture-hooks"
+    fixture_hooks_directory.mkdir(exist_ok=True)
+    run_fixture_git(
+        repository_path,
+        "config",
+        "core.hooksPath",
+        str(fixture_hooks_directory),
+    )
+
+
+def initialize_fixture_repository(repository_path: Path) -> None:
+    """Create and configure a fixture Git repository."""
+    repository_path.mkdir()
+    run_fixture_git(repository_path, "init", "-b", "main")
+    configure_fixture_identity(repository_path)
+
+
+def test_native_submodule_commit_records_parent_pointer(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A real submodule commit creates the matching parent pointer commit."""
+    unrelated_repository = tmp_path / "unrelated-repository"
+    initialize_fixture_repository(unrelated_repository)
+    monkeypatch.setenv("GIT_DIR", str(unrelated_repository / ".git"))
+
+    source_repository = tmp_path / "source-repository"
+    parent_repository = tmp_path / "parent-repository"
+    initialize_fixture_repository(source_repository)
+    (source_repository / "README.md").write_text("fixture source\n", encoding="utf-8")
+    run_fixture_git(source_repository, "add", "README.md")
+    run_fixture_git(source_repository, "commit", "-m", "Create fixture source")
+
+    initialize_fixture_repository(parent_repository)
+    (parent_repository / "README.md").write_text("fixture parent\n", encoding="utf-8")
+    run_fixture_git(parent_repository, "add", "README.md")
+    run_fixture_git(parent_repository, "commit", "-m", "Create fixture parent")
+    run_fixture_git(
+        parent_repository,
+        "-c",
+        "protocol.file.allow=always",
+        "submodule",
+        "add",
+        str(source_repository),
+        "nested/sub[module]",
+    )
+    run_fixture_git(parent_repository, "commit", "-am", "Add fixture submodule")
+
+    submodule_repository = parent_repository / "nested" / "sub[module]"
+    configure_fixture_identity(submodule_repository)
+    (parent_repository / "staged-note.txt").write_text("keep staged\n", encoding="utf-8")
+    run_fixture_git(parent_repository, "add", "staged-note.txt")
+    (submodule_repository / "change.txt").write_text("fixture change\n", encoding="utf-8")
+    run_fixture_git(submodule_repository, "add", "change.txt")
+    run_fixture_git(submodule_repository, "commit", "-m", "Record fixture change")
+    clear_inherited_git_environment(monkeypatch)
+    monkeypatch.chdir(submodule_repository)
+    assert post_commit.main() == 0
+
+    submodule_commit_hash = run_fixture_git(submodule_repository, "rev-parse", "HEAD")
+    parent_commit_subject = run_fixture_git(parent_repository, "log", "-1", "--pretty=%s")
+    parent_commit_body = run_fixture_git(parent_repository, "log", "-1", "--pretty=%B")
+    recorded_pointer_hash = run_fixture_git(
+        parent_repository,
+        "rev-parse",
+        "HEAD:nested/sub[module]",
+    )
+
+    assert recorded_pointer_hash == submodule_commit_hash
+    assert parent_commit_subject == (
+        f"chore: update sub[module] submodule to {submodule_commit_hash}"
+    )
+    assert "Submodule commit: Record fixture change" in parent_commit_body
+    assert run_fixture_git(parent_repository, "status", "--short") == "A  staged-note.txt"
+
+
+def test_parent_update_returns_git_diagnostic_for_failed_add(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A failed parent add returns the Git diagnostic and literal pathspec."""
+    parent_repository = tmp_path / "parent-repository"
+    submodule_repository = parent_repository / "sub[module]"
+    submodule_repository.mkdir(parents=True)
+    recorded_commands: list[tuple[str, ...]] = []
+
+    def fail_git_add(*arguments: str, cwd: Path) -> subprocess.CompletedProcess[str]:
+        recorded_commands.append(arguments)
+        return subprocess.CompletedProcess(
+            ["git", *arguments],
+            1,
+            "",
+            "fatal: fixture add failure",
+        )
+
+    monkeypatch.setattr(post_commit, "execute_git", fail_git_add)
+
+    parent_update = post_commit.update_parent_pointer(
+        parent_repository,
+        submodule_repository,
+        "a" * 40,
+        "Fixture commit",
+    )
+
+    assert parent_update == (
+        post_commit.ParentPointerStatus.FAILED,
+        "fatal: fixture add failure",
+    )
+    assert recorded_commands == [("add", "--", ":(literal)sub[module]")]
+
+
+def test_main_prints_git_failure_diagnostic(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """The hook prints the Git diagnostic when the parent update fails."""
+    submodule_repository = tmp_path / "submodule"
+    parent_repository = tmp_path / "parent"
+    submodule_repository.mkdir()
+    parent_repository.mkdir()
+    monkeypatch.setattr(
+        post_commit,
+        "run_git_from_current_directory",
+        lambda *arguments: str(submodule_repository),
+    )
+    monkeypatch.setattr(post_commit, "find_parent_repo", lambda repo: parent_repository)
+    monkeypatch.setattr(post_commit, "run_git", lambda *arguments, cwd: "a" * 40)
+    monkeypatch.setattr(
+        post_commit,
+        "update_parent_pointer",
+        lambda *arguments: (
+            post_commit.ParentPointerStatus.FAILED,
+            "fatal: fixture commit failure",
+        ),
+    )
+
+    assert post_commit.main() == 0
+    assert "Git diagnostic: fatal: fixture commit failure" in capsys.readouterr().out

package/hooks/git-hooks/test_pre_commit.py

@@ -60,7 +60,7 @@ def test_main_propagates_passing_exit_code_from_gate(
     assert exit_code == 0
 
 
-def test_main_invokes_gate_with_staged_flag(
+def test_main_invokes_gate_with_immediate_flag(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
@@ -84,7 +84,7 @@ def test_main_invokes_gate_with_staged_flag(
     recorded_arguments = recorded_arguments_path.read_text(
         encoding="utf-8"
     ).splitlines()
-    assert recorded_arguments == ["--staged"]
+    assert recorded_arguments == ["--immediate"]
 
 
 def test_main_exits_two_when_invoke_gate_raises_oserror(

package/hooks/hooks_constants/blast_radius_constants.py

@@ -0,0 +1,14 @@
+"""Constants for the blast-radius declaration check."""
+
+BLAST_RADIUS_RUN_SUFFIX = "RunFatal"
+BLAST_RADIUS_ITEM_SUFFIX = "ItemBlocked"
+ALL_BLAST_RADIUS_SUFFIXES = (BLAST_RADIUS_RUN_SUFFIX, BLAST_RADIUS_ITEM_SUFFIX)
+
+MAX_BLAST_RADIUS_ISSUES = 20
+
+BLAST_RADIUS_MESSAGE_SUFFIX = (
+    "raises inside per-item work; name its blast radius by ending the type in "
+    f"{BLAST_RADIUS_RUN_SUFFIX} when the whole run stops, or {BLAST_RADIUS_ITEM_SUFFIX} "
+    "when this one item stops and the batch carries on. See "
+    "rules/failure-blast-radius.md."
+)

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -36,6 +36,7 @@ ADVISORY_LINE_THRESHOLD_SOFT = 400
 ADVISORY_LINE_THRESHOLD_HARD = 1000
 
 DENY_REASON_ISSUE_PREVIEW_COUNT = 10
+VIOLATION_SEPARATOR = "; "
 
 ALL_BOOLEAN_NAME_PREFIXES: tuple[str, ...] = ("is_", "has_", "should_", "can_", "was_", "did_")
 UPPER_SNAKE_CONSTANT_PATTERN = re.compile(r"^[A-Z][A-Z0-9_]*$")

package/hooks/hooks_constants/refactor_guard_constants.py

@@ -0,0 +1,75 @@
+"""Constants for the changed-surface refactor advisory."""
+
+from __future__ import annotations
+
+MAXIMUM_REFACTOR_LINE_DELTA: int = 3
+REFACTOR_LINE_DELTA_DIVISOR: int = 2
+CHANGED_SURFACE_MATCH_RATIO: float = 0.5
+ALL_PYTHON_KEYWORDS: frozenset[str] = frozenset(
+    {
+        "def",
+        "class",
+        "return",
+        "import",
+        "from",
+        "if",
+        "elif",
+        "else",
+        "for",
+        "while",
+        "try",
+        "except",
+        "finally",
+        "with",
+        "as",
+        "yield",
+        "raise",
+        "pass",
+        "break",
+        "continue",
+        "and",
+        "or",
+        "not",
+        "in",
+        "is",
+        "lambda",
+        "None",
+        "True",
+        "False",
+        "self",
+        "cls",
+        "async",
+        "await",
+        "global",
+        "nonlocal",
+        "assert",
+        "del",
+        "print",
+        "len",
+        "range",
+        "list",
+        "dict",
+        "set",
+        "str",
+        "int",
+        "float",
+        "bool",
+        "type",
+        "isinstance",
+        "hasattr",
+        "getattr",
+        "setattr",
+        "super",
+        "property",
+        "staticmethod",
+        "classmethod",
+        "abstractmethod",
+        "Optional",
+        "Union",
+        "List",
+        "Dict",
+        "Set",
+        "Tuple",
+        "Any",
+    }
+)

package/hooks/hooks_constants/test_refactor_guard_constants.py

@@ -0,0 +1,21 @@
+"""Tests for refactor advisory constants."""
+
+import sys
+from pathlib import Path
+
+_HOOKS_ROOT = Path(__file__).resolve().parent.parent
+if str(_HOOKS_ROOT) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_ROOT))
+
+from hooks_constants.refactor_guard_constants import (
+    ALL_PYTHON_KEYWORDS,
+    CHANGED_SURFACE_MATCH_RATIO,
+    MAXIMUM_REFACTOR_LINE_DELTA,
+    REFACTOR_LINE_DELTA_DIVISOR,
+)
+
+
+def test_refactor_threshold_constants_define_a_half_boundary() -> None:
+    assert CHANGED_SURFACE_MATCH_RATIO * REFACTOR_LINE_DELTA_DIVISOR == 1
+    assert MAXIMUM_REFACTOR_LINE_DELTA > REFACTOR_LINE_DELTA_DIVISOR
+    assert "return" in ALL_PYTHON_KEYWORDS

package/hooks/observability/test_instructions_loaded_logger.py

@@ -48,6 +48,60 @@ def test_should_write_record_with_known_payload_fields_to_jsonl_log() -> None:
         assert "timestamp" in record
 
 
+def test_should_exclude_instruction_body_and_unrelated_secret_like_fields(
+    tmp_path: Path,
+) -> None:
+    fake_home = tmp_path / "home"
+    fake_home.mkdir()
+    payload = {
+        "file_path": "/tmp/CLAUDE.md",
+        "instruction_body": "private instruction text",
+        "api_key": "secret-api-key",
+        "authorization": "Bearer secret-token",
+        "metadata": {
+            "instruction_body": "nested private instruction text",
+            "api_key": "nested-secret-api-key",
+            "authorization": "Nested bearer secret-token",
+            "unrelated_secret_like_field": "nested private payload",
+        },
+    }
+
+    completed = _run_hook(payload, fake_home)
+
+    assert completed.returncode == 0, completed.stderr
+    log_path = fake_home / ".claude" / "logs" / "instructions_loaded.jsonl"
+    serialized_record = log_path.read_text(encoding="utf-8").strip()
+    record = json.loads(serialized_record)
+    assert set(record) == {
+        "timestamp",
+        "file_path",
+        "load_reason",
+        "memory_type",
+        "trigger_file_path",
+        "parent_file_path",
+        "globs",
+        "session_id",
+    }
+    sensitive_field_names = {
+        "instruction_body",
+        "api_key",
+        "authorization",
+        "metadata",
+        "unrelated_secret_like_field",
+    }
+    sensitive_field_values = {
+        "private instruction text",
+        "secret-api-key",
+        "Bearer secret-token",
+        "nested private instruction text",
+        "nested-secret-api-key",
+        "Nested bearer secret-token",
+        "nested private payload",
+    }
+    for each_sensitive_text in sensitive_field_names | sensitive_field_values:
+        assert each_sensitive_text not in serialized_record
+
+
 def test_should_exit_zero_and_record_error_when_stdin_payload_is_invalid_json() -> None:
     with tempfile.TemporaryDirectory() as fake_home_string:
         fake_home = Path(fake_home_string)

package/hooks/session/test_plugin_data_dir_cleanup.py

@@ -0,0 +1,70 @@
+"""Behavior tests for plugin data directory cleanup."""
+
+from __future__ import annotations
+
+import importlib.util
+import stat
+from pathlib import Path
+
+
+HOOK_DIRECTORY = Path(__file__).parent
+HOOK_SPEC = importlib.util.spec_from_file_location(
+    "plugin_data_dir_cleanup",
+    HOOK_DIRECTORY / "plugin_data_dir_cleanup.py",
+)
+assert HOOK_SPEC is not None
+assert HOOK_SPEC.loader is not None
+HOOK_MODULE = importlib.util.module_from_spec(HOOK_SPEC)
+HOOK_SPEC.loader.exec_module(HOOK_MODULE)
+
+
+def _configure_plugin_data_directory(plugin_data_directory: Path) -> None:
+    HOOK_MODULE.__dict__["PLUGINS_DATA_DIRECTORY"] = str(plugin_data_directory)
+    HOOK_MODULE.__dict__["AFFECTED_PLUGIN_DIRECTORIES"] = ["sample-plugin"]
+
+
+def test_main_removes_empty_plugin_data_directory(tmp_path: Path) -> None:
+    plugin_data_directory = tmp_path / "plugin-data"
+    plugin_data_directory.mkdir()
+    empty_plugin_directory = plugin_data_directory / "sample-plugin"
+    empty_plugin_directory.mkdir()
+    _configure_plugin_data_directory(plugin_data_directory)
+
+    HOOK_MODULE.main()
+
+    assert not empty_plugin_directory.exists()
+
+
+def test_main_keeps_plugin_data_directory_with_files(tmp_path: Path) -> None:
+    plugin_data_directory = tmp_path / "plugin-data"
+    plugin_data_directory.mkdir()
+    retained_plugin_directory = plugin_data_directory / "sample-plugin"
+    retained_plugin_directory.mkdir()
+    (retained_plugin_directory / "state.json").write_text("{}", encoding="utf-8")
+    _configure_plugin_data_directory(plugin_data_directory)
+
+    HOOK_MODULE.main()
+
+    assert retained_plugin_directory.is_dir()
+
+
+def test_main_keeps_read_only_plugin_data_directory_with_files(
+    tmp_path: Path,
+) -> None:
+    plugin_data_directory = tmp_path / "plugin-data"
+    plugin_data_directory.mkdir()
+    retained_plugin_directory = plugin_data_directory / "sample-plugin"
+    retained_plugin_directory.mkdir()
+    state_file = retained_plugin_directory / "state.json"
+    state_file.write_text("{}", encoding="utf-8")
+    state_file.chmod(stat.S_IREAD)
+    _configure_plugin_data_directory(plugin_data_directory)
+
+    try:
+        HOOK_MODULE.main()
+
+        assert retained_plugin_directory.is_dir()
+        assert state_file.is_file()
+        assert state_file.read_text(encoding="utf-8") == "{}"
+    finally:
+        state_file.chmod(stat.S_IREAD | stat.S_IWRITE)

package/hooks/session/test_session_edit_tracker_cleanup.py

@@ -127,12 +127,25 @@ def test_should_keep_current_session_tracker_on_continuation(
     redirected_temp_directory: pathlib.Path, continuation_source: str
 ) -> None:
     current_file = _seed_edit_file(redirected_temp_directory, "currentsession")
-    _run_main_with_stdin(
-        _session_continuation_payload("currentsession", continuation_source)
-    )
+    _run_main_with_stdin(_session_continuation_payload("currentsession", continuation_source))
     assert current_file.exists()
 
 
+def test_resume_preserves_edit_record(
+    redirected_temp_directory: pathlib.Path,
+) -> None:
+    current_file = _seed_edit_file(redirected_temp_directory, "currentsession")
+    current_file.write_text(
+        json.dumps({ALL_EDITED_FILE_PATHS_KEY: ["packages/example.py"]}),
+        encoding="utf-8",
+    )
+    _run_main_with_stdin(_session_continuation_payload("currentsession", "resume"))
+
+    assert json.loads(current_file.read_text(encoding="utf-8")) == {
+        ALL_EDITED_FILE_PATHS_KEY: ["packages/example.py"]
+    }
+
+
 def test_should_remove_current_session_tracker_on_session_end(
     redirected_temp_directory: pathlib.Path,
 ) -> None: