claude-dev-env 2.2.0 → 2.3.0

package/hooks/blocking/pii_prevention_blocker.py

@@ -329,7 +329,9 @@ def evaluate(payload_by_key: dict[str, object]) -> str | None:
     raw_tool_input = payload_by_key.get("tool_input", {})
     all_tool_input = raw_tool_input if isinstance(raw_tool_input, dict) else {}
     if tool_name in ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES:
-        return evaluate_write_edit_payload(tool_name, all_tool_input)
+        return evaluate_write_edit_payload(
+            tool_name, all_tool_input, hook_payload=payload_by_key
+        )
     if tool_name in ALL_SHELL_TOOL_NAMES:
         return _evaluate_shell_tool(all_tool_input, payload_by_key)
     if tool_name.startswith(MCP_GITHUB_TOOL_PREFIX):

package/hooks/blocking/test_code_verifier_tools_contract.py

@@ -0,0 +1,28 @@
+"""Contract: code-verifier cannot message a warm session-advisor."""
+
+from pathlib import Path
+
+_PACKAGE_ROOT = Path(__file__).resolve().parents[2]
+_CODE_VERIFIER_AGENT_PATH = _PACKAGE_ROOT / "agents" / "code-verifier.md"
+_FRONTMATTER_OPEN = "---\n"
+_FRONTMATTER_CLOSE = "\n---\n"
+_TOOLS_PREFIX = "tools:"
+_SEND_MESSAGE_TOOL_NAME = "SendMessage"
+
+
+def test_code_verifier_tools_exclude_sendmessage() -> None:
+    """tools frontmatter must not list SendMessage (warm-advisor path closed)."""
+    agent_text = _CODE_VERIFIER_AGENT_PATH.read_text(encoding="utf-8")
+    assert agent_text.startswith(_FRONTMATTER_OPEN), "missing frontmatter open"
+    frontmatter_end = agent_text.find(_FRONTMATTER_CLOSE, len(_FRONTMATTER_OPEN))
+    assert frontmatter_end > 0, "missing frontmatter close"
+    frontmatter_body = agent_text[len(_FRONTMATTER_OPEN) : frontmatter_end]
+    all_tools_lines = [
+        each_line
+        for each_line in frontmatter_body.splitlines()
+        if each_line.startswith(_TOOLS_PREFIX)
+    ]
+    assert len(all_tools_lines) == 1, all_tools_lines
+    tools_value = all_tools_lines[0].removeprefix(_TOOLS_PREFIX).strip()
+    all_tool_names = {each_name.strip() for each_name in tools_value.split(",")}
+    assert _SEND_MESSAGE_TOOL_NAME not in all_tool_names, all_tool_names

package/hooks/blocking/test_pii_write_surface_ephemeral.py

@@ -0,0 +1,221 @@
+"""Behavior tests for the ephemeral-path skip on the Write/Edit PII surface.
+
+Sub-defect (ii): the Write/Edit surface scanned files under an ephemeral scratch
+root that sit outside every git repository. Such a draft only becomes durable
+through ``gh --body-file`` or a staged commit, and each of those surfaces keeps
+its own PII scan, so scanning the draft at write time is a pure false positive.
+
+The write surface consults the shared ``is_ephemeral_path`` predicate directly.
+These tests drive that real predicate on genuine ephemeral shapes: a harness
+session scratchpad under the user temp directory, and a ``CLAUDE_JOB_DIR``
+scratch tree. A write inside a git repository keeps full scanning, and the
+durable-post and staged-commit surfaces stay gated even from ephemeral sources.
+"""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+import sys
+import uuid
+from collections.abc import Iterator
+from pathlib import Path
+
+import pytest
+
+_HOOK_DIR = Path(__file__).parent
+_HOOKS_DIR = _HOOK_DIR.parent
+if str(_HOOK_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIR))
+if str(_HOOKS_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_DIR))
+
+import tempfile  # noqa: E402
+
+from pii_payload_scan import evaluate_write_edit_payload  # noqa: E402
+from pii_prevention_blocker import evaluate, evaluate_bash_command  # noqa: E402
+
+from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
+    CLAUDE_JOB_DIR_ENVIRONMENT_VARIABLE_NAME,
+    CLAUDE_JOB_DIR_SCRATCH_SUBDIRECTORY,
+    EPHEMERAL_EXEMPT_DISABLE_ENVIRONMENT_VARIABLE_NAME,
+)
+from hooks_constants.harness_scratchpad_constants import (  # noqa: E402
+    HARNESS_SCRATCHPAD_LEAF_DIRECTORY_NAME,
+    HARNESS_SCRATCHPAD_USER_DIRECTORY_NAME,
+    HOOK_PAYLOAD_SESSION_ID_KEY,
+)
+
+
+def _real_pii_email() -> str:
+    return "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
+
+
+def _bot_trailer_address() -> str:
+    return "noreply" + "@" + "anthropic" + ".com"
+
+
+def _write_deny_reason(
+    target_path: Path,
+    sensitive_text: str,
+    hook_payload: dict[str, object] | None = None,
+) -> str | None:
+    content = "owner contact " + sensitive_text + "\n"
+    return evaluate_write_edit_payload(
+        "Write",
+        {"file_path": str(target_path), "content": content},
+        hook_payload=hook_payload,
+    )
+
+
+def _enable_job_dir_ephemeral_root(
+    monkeypatch: pytest.MonkeyPatch, job_directory: Path
+) -> Path:
+    monkeypatch.delenv(EPHEMERAL_EXEMPT_DISABLE_ENVIRONMENT_VARIABLE_NAME, raising=False)
+    monkeypatch.setenv(CLAUDE_JOB_DIR_ENVIRONMENT_VARIABLE_NAME, str(job_directory))
+    ephemeral_root = job_directory / CLAUDE_JOB_DIR_SCRATCH_SUBDIRECTORY
+    ephemeral_root.mkdir(parents=True, exist_ok=True)
+    return ephemeral_root
+
+
+@pytest.fixture
+def harness_scratchpad() -> Iterator[tuple[Path, str]]:
+    session_id = "session-" + uuid.uuid4().hex
+    mangled_working_directory = "cwd-" + uuid.uuid4().hex
+    temp_root = Path(tempfile.gettempdir())
+    user_root = temp_root / HARNESS_SCRATCHPAD_USER_DIRECTORY_NAME
+    scratchpad_root = (
+        user_root
+        / mangled_working_directory
+        / session_id
+        / HARNESS_SCRATCHPAD_LEAF_DIRECTORY_NAME
+    )
+    scratchpad_root.mkdir(parents=True, exist_ok=True)
+    try:
+        yield scratchpad_root, session_id
+    finally:
+        try:
+            shutil.rmtree(user_root / mangled_working_directory)
+        except OSError:
+            pass
+
+
+def _init_repo_with_github_origin(repository_root: Path, origin_slug: str) -> None:
+    repository_root.mkdir(parents=True, exist_ok=True)
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    origin_url = "https://github.com/" + origin_slug + ".git"
+    subprocess.run(
+        ["git", "remote", "add", "origin", origin_url],
+        cwd=repository_root,
+        check=True,
+    )
+
+
+def _init_repo_with_staged_email(repository_root: Path, staged_email: str) -> None:
+    repository_root.mkdir(parents=True, exist_ok=True)
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    subprocess.run(
+        ["git", "config", "user.email", "dev@example.com"],
+        cwd=repository_root,
+        check=True,
+    )
+    subprocess.run(
+        ["git", "config", "user.name", "Fixture Dev"],
+        cwd=repository_root,
+        check=True,
+    )
+    tracked_file = repository_root / "notes.md"
+    tracked_file.write_text("owner email " + staged_email + "\n", encoding="utf-8")
+    subprocess.run(["git", "add", "notes.md"], cwd=repository_root, check=True)
+
+
+def test_windows_shaped_scratchpad_write_is_skipped(
+    harness_scratchpad: tuple[Path, str],
+) -> None:
+    scratchpad_root, session_id = harness_scratchpad
+    scratch_target = scratchpad_root / "blocker-matrix.txt"
+    payload = {HOOK_PAYLOAD_SESSION_ID_KEY: session_id}
+    assert _write_deny_reason(scratch_target, _bot_trailer_address(), payload) is None
+
+
+def test_write_with_no_scannable_texts_returns_none(tmp_path: Path) -> None:
+    target_path = tmp_path / "empty-write.md"
+    assert (
+        evaluate_write_edit_payload(
+            "Write",
+            {"file_path": str(target_path), "content": ""},
+        )
+        is None
+    )
+
+
+def test_entry_point_threads_payload_session_id_to_scratchpad_skip(
+    monkeypatch: pytest.MonkeyPatch,
+    harness_scratchpad: tuple[Path, str],
+) -> None:
+    scratchpad_root, session_id = harness_scratchpad
+    monkeypatch.delenv("CLAUDE_CODE_SESSION_ID", raising=False)
+    scratch_target = scratchpad_root / "blocker-matrix.txt"
+    content = "owner contact " + _real_pii_email() + "\n"
+    payload = {
+        "tool_name": "Write",
+        "tool_input": {"file_path": str(scratch_target), "content": content},
+        HOOK_PAYLOAD_SESSION_ID_KEY: session_id,
+    }
+    assert evaluate(payload) is None
+
+
+def test_job_dir_ephemeral_write_outside_repo_is_skipped(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    ephemeral_root = _enable_job_dir_ephemeral_root(monkeypatch, tmp_path)
+    scratch_target = ephemeral_root / "drafts" / "draft.md"
+    scratch_target.parent.mkdir(parents=True)
+    assert _write_deny_reason(scratch_target, _real_pii_email()) is None
+
+
+def test_write_inside_ordinary_repository_is_still_denied(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, "SomeOwner/some-repo")
+    deny_reason = _write_deny_reason(repository_root / "notes.md", _real_pii_email())
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_ephemeral_path_inside_a_repository_is_still_denied(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    ephemeral_root = _enable_job_dir_ephemeral_root(monkeypatch, tmp_path)
+    repository_root = ephemeral_root / "repo"
+    _init_repo_with_github_origin(repository_root, "SomeOwner/some-repo")
+    deny_reason = _write_deny_reason(repository_root / "notes.md", _real_pii_email())
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_gh_body_file_from_ephemeral_path_is_still_scanned(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    ephemeral_root = _enable_job_dir_ephemeral_root(monkeypatch, tmp_path)
+    body_path = ephemeral_root / "pr_body.md"
+    body_path.write_text("contact " + _real_pii_email() + "\n", encoding="utf-8")
+    command = 'gh pr comment 12 --body-file "' + str(body_path) + '"'
+    deny_reason = evaluate_bash_command(command, working_directory=None)
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_staged_commit_from_ephemeral_tree_is_still_scanned(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    ephemeral_root = _enable_job_dir_ephemeral_root(monkeypatch, tmp_path)
+    repository_root = ephemeral_root / "repo"
+    _init_repo_with_staged_email(repository_root, _real_pii_email())
+    deny_reason = evaluate_bash_command(
+        "git commit -m test", working_directory=str(repository_root)
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+    assert "staged commit" in deny_reason

package/hooks/blocking/test_verification_verdict_store.py

@@ -808,3 +808,96 @@ def test_store_imports_under_foreign_config_shadow(
     )
     assert completed_probe.returncode == 0, completed_probe.stderr
     assert "IMPORT_OK" in completed_probe.stdout
+
+
+def _ledger_path(fake_home: pathlib.Path) -> pathlib.Path:
+    return (
+        fake_home
+        / constants_module.CLAUDE_HOME_DIRECTORY_NAME
+        / constants_module.LOGS_DIRECTORY_NAME
+        / constants_module.VERIFIER_VERDICTS_JSONL_FILENAME
+    )
+
+
+def _read_ledger_rows(fake_home: pathlib.Path) -> list[dict]:
+    ledger_file = _ledger_path(fake_home)
+    all_rows: list[dict] = []
+    for each_line in ledger_file.read_text(encoding="utf-8").splitlines():
+        if each_line.strip():
+            all_rows.append(json.loads(each_line))
+    return all_rows
+
+
+def test_write_verdict_appends_failing_row_that_survives_later_clean_mint(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: pathlib.Path
+) -> None:
+    """A failing mint's check names stay readable after a later clean mint."""
+    fake_home = tmp_path / "home"
+    fake_home.mkdir()
+    _isolate_home(monkeypatch, fake_home)
+    monkeypatch.setattr(pathlib.Path, "home", classmethod(lambda cls: fake_home))
+    work_dir = _make_repo_with_origin(tmp_path)
+    failing_findings = [
+        {"check": "gates.import", "detail": "ImportError: boom"},
+        {"check": "task.item-2", "detail": "missing hunk"},
+    ]
+    write_verdict(
+        str(work_dir),
+        MATCHING_MANIFEST_SHA256,
+        False,
+        failing_findings,
+        "agent-fail",
+    )
+    write_verdict(
+        str(work_dir),
+        MATCHING_MANIFEST_SHA256,
+        True,
+        [],
+        "agent-pass",
+    )
+    all_rows = _read_ledger_rows(fake_home)
+    assert len(all_rows) == 2
+    failing_row = all_rows[0]
+    clean_row = all_rows[1]
+    assert failing_row[constants_module.LEDGER_KEY_ALL_PASS] is False
+    assert failing_row[constants_module.LEDGER_KEY_FINDING_COUNT] == 2
+    assert failing_row[constants_module.LEDGER_KEY_FINDING_CHECK_NAMES] == [
+        "gates.import",
+        "task.item-2",
+    ]
+    assert failing_row[constants_module.LEDGER_KEY_MINTED_FROM_AGENT_ID] == "agent-fail"
+    assert failing_row[constants_module.LEDGER_KEY_MANIFEST_HASH] == MATCHING_MANIFEST_SHA256
+    assert failing_row[constants_module.LEDGER_KEY_REPO_ROOT] == str(work_dir)
+    assert failing_row[constants_module.LEDGER_KEY_BRANCH] == "main"
+    assert clean_row[constants_module.LEDGER_KEY_ALL_PASS] is True
+    assert clean_row[constants_module.LEDGER_KEY_FINDING_COUNT] == 0
+    assert clean_row[constants_module.LEDGER_KEY_FINDING_CHECK_NAMES] == []
+    assert clean_row[constants_module.LEDGER_KEY_MINTED_FROM_AGENT_ID] == "agent-pass"
+
+
+def test_write_verdict_returns_path_when_ledger_append_fails(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: pathlib.Path
+) -> None:
+    """A ledger IO failure never changes the mint path or verdict file write."""
+    fake_home = tmp_path / "home"
+    fake_home.mkdir()
+    _isolate_home(monkeypatch, fake_home)
+    monkeypatch.setattr(pathlib.Path, "home", classmethod(lambda cls: fake_home))
+    logs_as_file = (
+        fake_home
+        / constants_module.CLAUDE_HOME_DIRECTORY_NAME
+        / constants_module.LOGS_DIRECTORY_NAME
+    )
+    logs_as_file.parent.mkdir(parents=True, exist_ok=True)
+    logs_as_file.write_text("not-a-directory", encoding="utf-8")
+    work_dir = _make_repo_with_origin(tmp_path)
+    verdict_file = write_verdict(
+        str(work_dir),
+        MATCHING_MANIFEST_SHA256,
+        True,
+        [],
+        "agent-x",
+    )
+    assert verdict_file.is_file()
+    verdict_record = json.loads(verdict_file.read_text(encoding="utf-8"))
+    assert verdict_record[constants_module.VERDICT_KEY_ALL_PASS] is True

package/hooks/blocking/verification_verdict_store.py

@@ -13,6 +13,7 @@ and reading/writing verdict files.
 from __future__ import annotations
 
 import ast
+import datetime
 import hashlib
 import json
 import re
@@ -20,6 +21,7 @@ import subprocess
 import sys
 import time
 from pathlib import Path
+from collections.abc import Mapping
 
 blocking_directory = str(Path(__file__).resolve().parent)
 if blocking_directory not in sys.path:
@@ -45,6 +47,15 @@ from config.verified_commit_constants import (
     ALL_FALLBACK_BASE_REFERENCES,
     EMPTY_SURFACE_GUARD_MESSAGE,
     GIT_TIMEOUT_SECONDS,
+    LEDGER_KEY_ALL_PASS,
+    LEDGER_KEY_BRANCH,
+    LEDGER_KEY_FINDING_CHECK_NAMES,
+    LEDGER_KEY_FINDING_COUNT,
+    LEDGER_KEY_MANIFEST_HASH,
+    LEDGER_KEY_MINTED_FROM_AGENT_ID,
+    LEDGER_KEY_REPO_ROOT,
+    LEDGER_KEY_TIMESTAMP,
+    LOGS_DIRECTORY_NAME,
     MANIFEST_HASH_CLI_FLAG,
     MANIFEST_HASH_FOR_BRANCH_CLI_FLAG,
     MINIMUM_STATUS_FIELD_COUNT,
@@ -65,10 +76,12 @@ from config.verified_commit_constants import (
     VERDICT_DIRECTORY_NAME,
     VERDICT_FENCE_PATTERN,
     VERDICT_FILE_GLOB,
+    VERDICT_FINDING_CHECK_KEY,
     VERDICT_JSON_INDENT,
     VERDICT_KEY_ALL_PASS,
     VERDICT_KEY_FINDINGS,
     VERDICT_KEY_MANIFEST_SHA256,
+    VERIFIER_VERDICTS_JSONL_FILENAME,
     WORKTREE_LIST_BRANCH_PREFIX,
     WORKTREE_LIST_PATH_PREFIX,
 )
@@ -654,6 +667,74 @@ def workflow_verdict_covers_surface(
     return False
 
 
+def _finding_check_names(all_findings: list) -> list[str]:
+    """Collect the ``check`` name from each finding mapping that carries one.
+
+    Args:
+        all_findings: The verifier's findings list (empty when clean).
+
+    Returns:
+        Ordered list of non-empty check name strings; entries without a
+        string ``check`` field are omitted.
+    """
+    all_check_names: list[str] = []
+    for each_finding in all_findings:
+        if not isinstance(each_finding, Mapping):
+            continue
+        check_name = each_finding.get(VERDICT_FINDING_CHECK_KEY)
+        if isinstance(check_name, str) and check_name:
+            all_check_names.append(check_name)
+    return all_check_names
+
+
+def _append_verdict_ledger_row(
+    repo_root: str,
+    bound_manifest_sha256: str,
+    is_all_pass: bool,
+    all_findings: list,
+    minted_from_agent_id: str,
+) -> None:
+    """Append one fail-safe JSONL row for a minted verdict.
+
+    Writes to ``~/.claude/logs/verifier-verdicts.jsonl``. Swallows home
+    resolution and IO errors so a ledger failure never changes the mint.
+
+    Args:
+        repo_root: The repository top-level directory.
+        bound_manifest_sha256: Hash of the surface the verdict covers.
+        is_all_pass: Whether the verifier reported a clean verdict.
+        all_findings: The verifier's findings list (empty when clean).
+        minted_from_agent_id: The subagent invocation id, kept for audit.
+    """
+    try:
+        home_directory = Path.home()
+    except RuntimeError:
+        return
+    try:
+        ledger_path = (
+            home_directory
+            / CLAUDE_HOME_DIRECTORY_NAME
+            / LOGS_DIRECTORY_NAME
+            / VERIFIER_VERDICTS_JSONL_FILENAME
+        )
+        ledger_path.parent.mkdir(parents=True, exist_ok=True)
+        branch_name = _head_branch_name(repo_root)
+        ledger_row = {
+            LEDGER_KEY_TIMESTAMP: datetime.datetime.now(datetime.timezone.utc).isoformat(),
+            LEDGER_KEY_REPO_ROOT: repo_root,
+            LEDGER_KEY_BRANCH: branch_name,
+            LEDGER_KEY_MANIFEST_HASH: bound_manifest_sha256,
+            LEDGER_KEY_ALL_PASS: is_all_pass,
+            LEDGER_KEY_FINDING_COUNT: len(all_findings),
+            LEDGER_KEY_FINDING_CHECK_NAMES: _finding_check_names(all_findings),
+            LEDGER_KEY_MINTED_FROM_AGENT_ID: minted_from_agent_id,
+        }
+        with ledger_path.open("a", encoding="utf-8") as ledger_file:
+            ledger_file.write(json.dumps(ledger_row) + "\n")
+    except OSError:
+        return
+
+
 def write_verdict(
     repo_root: str,
     bound_manifest_sha256: str,
@@ -663,6 +744,9 @@ def write_verdict(
 ) -> Path:
     """Write a verdict file binding a verification outcome to a surface hash.
 
+    Also appends one durable JSONL ledger row under the Claude logs directory.
+    A ledger write failure never changes the mint outcome.
+
     Args:
         repo_root: The repository top-level directory.
         bound_manifest_sha256: Hash of the surface manifest the verdict covers.
@@ -686,6 +770,13 @@ def write_verdict(
     verdict_file.write_text(
         json.dumps(verdict_record, indent=VERDICT_JSON_INDENT), encoding="utf-8"
     )
+    _append_verdict_ledger_row(
+        repo_root,
+        bound_manifest_sha256,
+        is_all_pass,
+        all_findings,
+        minted_from_agent_id,
+    )
     return verdict_file
 
 

package/hooks/validators/ruff_integration.py

@@ -38,8 +38,9 @@ def run_ruff_check(files: list[Path]) -> RuffResult:
     if not py_files:
         return RuffResult(passed=True, output="No Python files", fixed_count=0)
 
+    concise_output_arguments = ["--output-format", "concise"]
     result = subprocess.run(
-        ["ruff", "check"] + py_files,
+        ["ruff", "check", *concise_output_arguments] + py_files,
         check=False,
         capture_output=True,
         text=True,