claude-dev-env 2.2.1 → 2.4.0

package/skills/prototype/scripts/test_build_sandbox_settings.py

@@ -0,0 +1,275 @@
+"""Tests for the sandbox safety-settings builder."""
+
+from __future__ import annotations
+
+import importlib.util
+import json
+from pathlib import Path
+from types import ModuleType
+
+from prototype_scripts_constants.config.build_sandbox_settings_constants import (
+    ALL_DESTRUCTIVE_REQUIRED_MATCHERS,
+    ALL_PII_REQUIRED_MATCHERS,
+    ALL_SAFETY_HOOK_SCRIPT_BASENAMES,
+    BUILD_SUCCESS_EXIT_CODE,
+    COMMAND_KEY,
+    HOOKS_KEY,
+    MATCHER_KEY,
+    PRE_TOOL_USE_KEY,
+    SETTINGS_MISSING_SAFETY_HOOK_EXIT_CODE,
+)
+
+SCRIPTS_DIRECTORY = Path(__file__).resolve().parent
+BUILDER_PATH = SCRIPTS_DIRECTORY / "build_sandbox_settings.py"
+
+PII_HOOK_BASENAME = ALL_SAFETY_HOOK_SCRIPT_BASENAMES[0]
+DESTRUCTIVE_HOOK_BASENAME = ALL_SAFETY_HOOK_SCRIPT_BASENAMES[1]
+
+CODE_RULES_HOOK_BASENAME = "code_rules_enforcer.py"
+TDD_HOOK_BASENAME = "tdd_enforcer.py"
+PLAIN_LANGUAGE_HOOK_BASENAME = "plain_language_blocker.py"
+
+BASH_MATCHER = "Bash"
+WRITE_MATCHER = "Write"
+EDIT_MATCHER = "Edit"
+MULTI_EDIT_MATCHER = "MultiEdit"
+NARROW_PII_MATCHER = "mcp__plugin_github_github__.*"
+
+SUBHOOK_TIMEOUT = 15
+PII_COMMAND = f"python hooks/blocking/{PII_HOOK_BASENAME}"
+DESTRUCTIVE_COMMAND = f"python hooks/blocking/{DESTRUCTIVE_HOOK_BASENAME}"
+CODE_RULES_COMMAND = f"python hooks/blocking/{CODE_RULES_HOOK_BASENAME}"
+
+
+def load_builder_module() -> ModuleType:
+    spec = importlib.util.spec_from_file_location(
+        "build_sandbox_settings", BUILDER_PATH
+    )
+    assert spec is not None
+    assert spec.loader is not None
+    builder_module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(builder_module)
+    return builder_module
+
+
+def make_subhook(command: str) -> dict:
+    return {"type": "command", "command": command, "timeout": SUBHOOK_TIMEOUT}
+
+
+def sample_settings_document() -> dict:
+    """Build a settings document that registers pii on a narrow matcher only.
+
+    ::
+
+        Write block  -> [code_rules_enforcer]
+        Bash block   -> [destructive_command_blocker]
+        GitHub block -> [pii_prevention_blocker]   (narrow matcher)
+
+    The live pii gate is scoped to the GitHub MCP tool family, so a
+    presence-only copy would leave disk writes ungated.
+    """
+    write_block = {
+        MATCHER_KEY: WRITE_MATCHER,
+        HOOKS_KEY: [make_subhook(CODE_RULES_COMMAND)],
+    }
+    bash_block = {
+        MATCHER_KEY: BASH_MATCHER,
+        HOOKS_KEY: [make_subhook(DESTRUCTIVE_COMMAND)],
+    }
+    github_block = {
+        MATCHER_KEY: NARROW_PII_MATCHER,
+        HOOKS_KEY: [make_subhook(PII_COMMAND)],
+    }
+    return {HOOKS_KEY: {PRE_TOOL_USE_KEY: [write_block, bash_block, github_block]}}
+
+
+def document_without_destructive() -> dict:
+    """Build a settings document that registers pii but no destructive hook."""
+    github_block = {
+        MATCHER_KEY: NARROW_PII_MATCHER,
+        HOOKS_KEY: [make_subhook(PII_COMMAND)],
+    }
+    return {HOOKS_KEY: {PRE_TOOL_USE_KEY: [github_block]}}
+
+
+def minimal_settings_for(builder: ModuleType, settings_document: dict) -> dict:
+    entry_by_basename = builder.resolve_safety_hook_entries(settings_document)
+    return builder.build_minimal_settings(entry_by_basename)
+
+
+def blocks_of(minimal_settings: dict) -> list[dict]:
+    return minimal_settings[HOOKS_KEY][PRE_TOOL_USE_KEY]
+
+
+def commands_by_matcher(minimal_settings: dict) -> dict[str, list[str]]:
+    commands_by_each_matcher: dict[str, list[str]] = {}
+    for each_block in blocks_of(minimal_settings):
+        commands_by_each_matcher[each_block[MATCHER_KEY]] = [
+            each_subhook[COMMAND_KEY] for each_subhook in each_block[HOOKS_KEY]
+        ]
+    return commands_by_each_matcher
+
+
+def test_read_settings_document_parses_the_source_json(tmp_path: Path) -> None:
+    builder = load_builder_module()
+    source_path = tmp_path / "settings.json"
+    source_path.write_text(json.dumps(sample_settings_document()), encoding="utf-8")
+    parsed_document = builder.read_settings_document(source_path)
+    assert parsed_document == sample_settings_document()
+
+
+def test_resolve_safety_hook_entries_copies_each_live_command_through() -> None:
+    builder = load_builder_module()
+    entry_by_basename = builder.resolve_safety_hook_entries(sample_settings_document())
+    assert set(entry_by_basename) == set(ALL_SAFETY_HOOK_SCRIPT_BASENAMES)
+    assert entry_by_basename[PII_HOOK_BASENAME][COMMAND_KEY] == PII_COMMAND
+    assert (
+        entry_by_basename[DESTRUCTIVE_HOOK_BASENAME][COMMAND_KEY] == DESTRUCTIVE_COMMAND
+    )
+    assert entry_by_basename[PII_HOOK_BASENAME]["timeout"] == SUBHOOK_TIMEOUT
+
+
+def test_find_unresolved_safety_hook_basenames_names_the_missing_hook() -> None:
+    builder = load_builder_module()
+    entry_by_basename = builder.resolve_safety_hook_entries(
+        document_without_destructive()
+    )
+    assert builder.find_unresolved_safety_hook_basenames(entry_by_basename) == [
+        DESTRUCTIVE_HOOK_BASENAME
+    ]
+
+
+def test_find_unresolved_safety_hook_basenames_empty_when_both_resolve() -> None:
+    builder = load_builder_module()
+    entry_by_basename = builder.resolve_safety_hook_entries(sample_settings_document())
+    assert builder.find_unresolved_safety_hook_basenames(entry_by_basename) == []
+
+
+def test_build_registers_pii_on_every_required_write_and_command_matcher() -> None:
+    builder = load_builder_module()
+    commands = commands_by_matcher(
+        minimal_settings_for(builder, sample_settings_document())
+    )
+    assert set(commands) == set(ALL_PII_REQUIRED_MATCHERS)
+    for each_matcher in ALL_PII_REQUIRED_MATCHERS:
+        assert PII_COMMAND in commands[each_matcher]
+
+
+def test_build_registers_destructive_on_the_command_matcher_only() -> None:
+    builder = load_builder_module()
+    commands = commands_by_matcher(
+        minimal_settings_for(builder, sample_settings_document())
+    )
+    for each_matcher, each_command_list in commands.items():
+        has_destructive = DESTRUCTIVE_COMMAND in each_command_list
+        assert has_destructive == (each_matcher in ALL_DESTRUCTIVE_REQUIRED_MATCHERS)
+
+
+def test_build_bash_block_carries_both_safety_hooks() -> None:
+    builder = load_builder_module()
+    commands = commands_by_matcher(
+        minimal_settings_for(builder, sample_settings_document())
+    )
+    assert commands[BASH_MATCHER] == [PII_COMMAND, DESTRUCTIVE_COMMAND]
+
+
+def test_build_excludes_every_non_safety_hook() -> None:
+    builder = load_builder_module()
+    commands = commands_by_matcher(
+        minimal_settings_for(builder, sample_settings_document())
+    )
+    all_commands = [
+        each_command
+        for each_command_list in commands.values()
+        for each_command in each_command_list
+    ]
+    for each_excluded in (
+        CODE_RULES_HOOK_BASENAME,
+        TDD_HOOK_BASENAME,
+        PLAIN_LANGUAGE_HOOK_BASENAME,
+    ):
+        assert all(each_excluded not in each_command for each_command in all_commands)
+
+
+def test_narrow_live_pii_matcher_does_not_leak_into_output() -> None:
+    builder = load_builder_module()
+    all_matchers = set(
+        commands_by_matcher(minimal_settings_for(builder, sample_settings_document()))
+    )
+    assert NARROW_PII_MATCHER not in all_matchers
+    assert all_matchers.issuperset(
+        {WRITE_MATCHER, EDIT_MATCHER, MULTI_EDIT_MATCHER, BASH_MATCHER}
+    )
+
+
+def test_build_emits_blocks_in_sorted_matcher_order() -> None:
+    builder = load_builder_module()
+    minimal_settings = minimal_settings_for(builder, sample_settings_document())
+    emitted_matchers = [
+        each_block[MATCHER_KEY] for each_block in blocks_of(minimal_settings)
+    ]
+    assert emitted_matchers == sorted(emitted_matchers)
+
+
+def test_build_emits_the_deny_mode_env_block() -> None:
+    builder = load_builder_module()
+    minimal_settings = minimal_settings_for(builder, sample_settings_document())
+    assert minimal_settings[builder.ENV_KEY] == {
+        builder.DESTRUCTIVE_DENY_MODE_ENV_VAR: builder.DESTRUCTIVE_DENY_MODE_ENV_VALUE
+    }
+
+
+def test_write_minimal_settings_round_trips_the_document(tmp_path: Path) -> None:
+    builder = load_builder_module()
+    minimal_settings = minimal_settings_for(builder, sample_settings_document())
+    out_path = tmp_path / "sandbox-settings.json"
+    builder.write_minimal_settings(minimal_settings, out_path)
+    assert json.loads(out_path.read_text(encoding="utf-8")) == minimal_settings
+
+
+def test_main_writes_minimal_settings_and_succeeds(tmp_path: Path) -> None:
+    builder = load_builder_module()
+    source_path = tmp_path / "settings.json"
+    source_path.write_text(json.dumps(sample_settings_document()), encoding="utf-8")
+    out_path = tmp_path / "sandbox-settings.json"
+    exit_code = builder.main(
+        ["--out", str(out_path), "--settings-source", str(source_path)]
+    )
+    assert exit_code == BUILD_SUCCESS_EXIT_CODE
+    written = json.loads(out_path.read_text(encoding="utf-8"))
+    assert set(commands_by_matcher(written)) == set(ALL_PII_REQUIRED_MATCHERS)
+
+
+def test_main_exits_when_the_settings_source_is_unreadable(tmp_path: Path) -> None:
+    builder = load_builder_module()
+    absent_source_path = tmp_path / "does-not-exist.json"
+    out_path = tmp_path / "sandbox-settings.json"
+    exit_code = builder.main(
+        ["--out", str(out_path), "--settings-source", str(absent_source_path)]
+    )
+    assert exit_code == builder.SETTINGS_SOURCE_UNREADABLE_EXIT_CODE
+    assert not out_path.exists()
+
+
+def test_main_exits_when_the_settings_source_is_invalid_json(tmp_path: Path) -> None:
+    builder = load_builder_module()
+    source_path = tmp_path / "settings.json"
+    source_path.write_text("{not valid json", encoding="utf-8")
+    out_path = tmp_path / "sandbox-settings.json"
+    exit_code = builder.main(
+        ["--out", str(out_path), "--settings-source", str(source_path)]
+    )
+    assert exit_code == builder.SETTINGS_SOURCE_UNREADABLE_EXIT_CODE
+    assert not out_path.exists()
+
+
+def test_main_exits_when_a_safety_hook_is_missing(tmp_path: Path) -> None:
+    builder = load_builder_module()
+    source_path = tmp_path / "settings.json"
+    source_path.write_text(json.dumps(document_without_destructive()), encoding="utf-8")
+    out_path = tmp_path / "sandbox-settings.json"
+    exit_code = builder.main(
+        ["--out", str(out_path), "--settings-source", str(source_path)]
+    )
+    assert exit_code == SETTINGS_MISSING_SAFETY_HOOK_EXIT_CODE
+    assert not out_path.exists()

package/skills/prototype/scripts/test_launch_sandbox.py

@@ -0,0 +1,303 @@
+"""Tests for the hookless sandbox launcher."""
+
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+from types import ModuleType
+
+import pytest
+
+from prototype_scripts_constants.config.launch_sandbox_constants import (
+    BARE_FLAG,
+    CLAUDE_EXECUTABLE_NAME,
+    LAUNCH_MISSING_PATH_EXIT_CODE,
+    PROMPT_FLAG,
+    SETTINGS_FLAG,
+    SKIP_PERMISSIONS_FLAG,
+)
+
+SCRIPTS_DIRECTORY = Path(__file__).resolve().parent
+LAUNCHER_PATH = SCRIPTS_DIRECTORY / "launch_sandbox.py"
+
+SANDBOX_TASK_TEXT = "Build a proof of concept for the widget cache."
+SANDBOX_TIMEOUT_SECONDS = 42
+FAKE_RUNNER_EXIT_CODE = 7
+
+
+def load_launcher_module() -> ModuleType:
+    spec = importlib.util.spec_from_file_location("launch_sandbox", LAUNCHER_PATH)
+    assert spec is not None
+    assert spec.loader is not None
+    launcher_module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(launcher_module)
+    return launcher_module
+
+
+class RecordingCommandRunner:
+    def __init__(self, exit_code: int) -> None:
+        self.exit_code = exit_code
+        self.recorded_tokens: list[str] = []
+        self.recorded_working_directory: Path | None = None
+        self.recorded_timeout_seconds: int | None = None
+        self.call_count = 0
+
+    def __call__(
+        self,
+        all_command_tokens: list[str],
+        working_directory: Path,
+        timeout_seconds: int | None,
+    ) -> int:
+        self.call_count += 1
+        self.recorded_tokens = all_command_tokens
+        self.recorded_working_directory = working_directory
+        self.recorded_timeout_seconds = timeout_seconds
+        return self.exit_code
+
+
+def make_sandbox_worktree(tmp_path: Path) -> tuple[Path, Path]:
+    worktree_path = tmp_path / "worktree"
+    worktree_path.mkdir()
+    settings_path = tmp_path / "sandbox-settings.json"
+    settings_path.write_text("{}", encoding="utf-8")
+    return worktree_path, settings_path
+
+
+def make_task_file(tmp_path: Path) -> Path:
+    task_file_path = tmp_path / "task.txt"
+    task_file_path.write_text(SANDBOX_TASK_TEXT, encoding="utf-8")
+    return task_file_path
+
+
+def test_build_sandbox_command_has_the_exact_ordered_argv() -> None:
+    launcher = load_launcher_module()
+    settings_path = Path("/tmp/sandbox-settings.json")
+    sandbox_command = launcher.build_sandbox_command(SANDBOX_TASK_TEXT, settings_path)
+    assert sandbox_command == [
+        CLAUDE_EXECUTABLE_NAME,
+        PROMPT_FLAG,
+        SANDBOX_TASK_TEXT,
+        BARE_FLAG,
+        SKIP_PERMISSIONS_FLAG,
+        SETTINGS_FLAG,
+        str(settings_path),
+    ]
+
+
+def test_run_sandbox_records_cwd_and_argv_without_launching_claude(
+    tmp_path: Path,
+) -> None:
+    launcher = load_launcher_module()
+    worktree_path, settings_path = make_sandbox_worktree(tmp_path)
+    recording_runner = RecordingCommandRunner(FAKE_RUNNER_EXIT_CODE)
+    exit_code = launcher.run_sandbox(
+        worktree_path,
+        settings_path,
+        SANDBOX_TASK_TEXT,
+        SANDBOX_TIMEOUT_SECONDS,
+        recording_runner,
+    )
+    assert exit_code == FAKE_RUNNER_EXIT_CODE
+    assert recording_runner.call_count == 1
+    assert recording_runner.recorded_working_directory == worktree_path
+    assert recording_runner.recorded_tokens == launcher.build_sandbox_command(
+        SANDBOX_TASK_TEXT, settings_path
+    )
+    assert recording_runner.recorded_timeout_seconds == SANDBOX_TIMEOUT_SECONDS
+
+
+def test_validate_sandbox_paths_passes_when_every_path_exists(tmp_path: Path) -> None:
+    launcher = load_launcher_module()
+    worktree_path, settings_path = make_sandbox_worktree(tmp_path)
+    task_file_path = make_task_file(tmp_path)
+    error_message = launcher.validate_sandbox_paths(
+        worktree_path, settings_path, task_file_path
+    )
+    assert error_message is None
+
+
+def test_validate_sandbox_paths_reports_a_missing_worktree(tmp_path: Path) -> None:
+    launcher = load_launcher_module()
+    _, settings_path = make_sandbox_worktree(tmp_path)
+    task_file_path = make_task_file(tmp_path)
+    error_message = launcher.validate_sandbox_paths(
+        tmp_path / "absent-worktree", settings_path, task_file_path
+    )
+    assert error_message is not None
+    assert "worktree" in error_message
+
+
+def test_validate_sandbox_paths_reports_a_missing_task_file(tmp_path: Path) -> None:
+    launcher = load_launcher_module()
+    worktree_path, settings_path = make_sandbox_worktree(tmp_path)
+    error_message = launcher.validate_sandbox_paths(
+        worktree_path, settings_path, tmp_path / "absent-task.txt"
+    )
+    assert error_message is not None
+    assert "task file" in error_message
+
+
+def test_validate_sandbox_paths_reports_a_missing_settings_file(tmp_path: Path) -> None:
+    launcher = load_launcher_module()
+    worktree_path, _ = make_sandbox_worktree(tmp_path)
+    task_file_path = make_task_file(tmp_path)
+    error_message = launcher.validate_sandbox_paths(
+        worktree_path, tmp_path / "absent-settings.json", task_file_path
+    )
+    assert error_message is not None
+    assert "settings" in error_message
+
+
+def test_main_returns_the_missing_path_exit_code_for_an_absent_worktree(
+    tmp_path: Path,
+) -> None:
+    launcher = load_launcher_module()
+    _, settings_path = make_sandbox_worktree(tmp_path)
+    task_file_path = make_task_file(tmp_path)
+    exit_code = launcher.main(
+        [
+            "--worktree",
+            str(tmp_path / "absent-worktree"),
+            "--settings",
+            str(settings_path),
+            "--task-file",
+            str(task_file_path),
+        ]
+    )
+    assert exit_code == LAUNCH_MISSING_PATH_EXIT_CODE
+
+
+def test_main_runs_the_sandbox_and_returns_the_runner_exit_code(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    launcher = load_launcher_module()
+    worktree_path, settings_path = make_sandbox_worktree(tmp_path)
+    task_file_path = make_task_file(tmp_path)
+    recording_runner = RecordingCommandRunner(FAKE_RUNNER_EXIT_CODE)
+    monkeypatch.setattr(launcher, "_run_via_subprocess", recording_runner)
+    exit_code = launcher.main(
+        [
+            "--worktree",
+            str(worktree_path),
+            "--settings",
+            str(settings_path),
+            "--task-file",
+            str(task_file_path),
+        ]
+    )
+    assert exit_code == FAKE_RUNNER_EXIT_CODE
+    assert recording_runner.call_count == 1
+    assert recording_runner.recorded_working_directory == worktree_path.resolve()
+
+
+def test_run_via_subprocess_returns_the_timeout_code_when_the_session_outruns(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    launcher = load_launcher_module()
+    worktree_path, _ = make_sandbox_worktree(tmp_path)
+
+    def raise_timeout(*_args: object, **_kwargs: object) -> object:
+        raise launcher.subprocess.TimeoutExpired(
+            cmd=[CLAUDE_EXECUTABLE_NAME], timeout=SANDBOX_TIMEOUT_SECONDS
+        )
+
+    monkeypatch.setattr(launcher.subprocess, "run", raise_timeout)
+    exit_code = launcher._run_via_subprocess(
+        [CLAUDE_EXECUTABLE_NAME], worktree_path, SANDBOX_TIMEOUT_SECONDS
+    )
+    assert exit_code == launcher.LAUNCH_TIMEOUT_EXIT_CODE
+
+
+def test_run_via_subprocess_returns_the_missing_path_code_when_claude_is_absent(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    launcher = load_launcher_module()
+    worktree_path, _ = make_sandbox_worktree(tmp_path)
+
+    def raise_file_not_found(*_args: object, **_kwargs: object) -> object:
+        raise FileNotFoundError(CLAUDE_EXECUTABLE_NAME)
+
+    monkeypatch.setattr(launcher.subprocess, "run", raise_file_not_found)
+    exit_code = launcher._run_via_subprocess(
+        [CLAUDE_EXECUTABLE_NAME], worktree_path, SANDBOX_TIMEOUT_SECONDS
+    )
+    assert exit_code == LAUNCH_MISSING_PATH_EXIT_CODE
+
+
+def test_main_returns_the_missing_path_code_when_claude_is_absent(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    launcher = load_launcher_module()
+    worktree_path, settings_path = make_sandbox_worktree(tmp_path)
+    task_file_path = make_task_file(tmp_path)
+
+    def raise_file_not_found(*_args: object, **_kwargs: object) -> object:
+        raise FileNotFoundError(CLAUDE_EXECUTABLE_NAME)
+
+    monkeypatch.setattr(launcher.subprocess, "run", raise_file_not_found)
+    exit_code = launcher.main(
+        [
+            "--worktree",
+            str(worktree_path),
+            "--settings",
+            str(settings_path),
+            "--task-file",
+            str(task_file_path),
+        ]
+    )
+    assert exit_code == LAUNCH_MISSING_PATH_EXIT_CODE
+    emitted_summary = launcher.json.loads(capsys.readouterr().out)
+    assert emitted_summary["exit_code"] == LAUNCH_MISSING_PATH_EXIT_CODE
+
+
+def test_main_returns_the_timeout_code_and_emits_the_summary_on_timeout(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    launcher = load_launcher_module()
+    worktree_path, settings_path = make_sandbox_worktree(tmp_path)
+    task_file_path = make_task_file(tmp_path)
+
+    def raise_timeout(*_args: object, **_kwargs: object) -> object:
+        raise launcher.subprocess.TimeoutExpired(
+            cmd=[CLAUDE_EXECUTABLE_NAME], timeout=SANDBOX_TIMEOUT_SECONDS
+        )
+
+    monkeypatch.setattr(launcher.subprocess, "run", raise_timeout)
+    exit_code = launcher.main(
+        [
+            "--worktree",
+            str(worktree_path),
+            "--settings",
+            str(settings_path),
+            "--task-file",
+            str(task_file_path),
+        ]
+    )
+    assert exit_code == launcher.LAUNCH_TIMEOUT_EXIT_CODE
+    emitted_summary = launcher.json.loads(capsys.readouterr().out)
+    assert emitted_summary["exit_code"] == launcher.LAUNCH_TIMEOUT_EXIT_CODE
+
+
+def test_main_resolves_a_relative_settings_path_to_absolute(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    launcher = load_launcher_module()
+    worktree_path, settings_path = make_sandbox_worktree(tmp_path)
+    task_file_path = make_task_file(tmp_path)
+    recording_runner = RecordingCommandRunner(FAKE_RUNNER_EXIT_CODE)
+    monkeypatch.setattr(launcher, "_run_via_subprocess", recording_runner)
+    monkeypatch.chdir(tmp_path)
+    launcher.main(
+        [
+            "--worktree",
+            worktree_path.name,
+            "--settings",
+            settings_path.name,
+            "--task-file",
+            task_file_path.name,
+        ]
+    )
+    recorded_settings_token = recording_runner.recorded_tokens[-1]
+    assert Path(recorded_settings_token).is_absolute()
+    assert Path(recorded_settings_token) == settings_path.resolve()
+    assert recording_runner.recorded_working_directory == worktree_path.resolve()