claude-dev-env 2.20.0 → 2.21.1

package/hooks/blocking/test_code_rules_enforcer_codex_apply_patch.py

@@ -0,0 +1,173 @@
+"""Tests for the Codex apply_patch adapter."""
+
+from __future__ import annotations
+
+import contextlib
+import io
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+_HOOK_DIRECTORY = Path(__file__).resolve().parent
+_HOOKS_PARENT = _HOOK_DIRECTORY.parent
+if str(_HOOK_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIRECTORY))
+if str(_HOOKS_PARENT) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_PARENT))
+
+import code_rules_enforcer
+import codex_apply_patch
+
+
+def _run_codex_payload(
+    payload: dict[str, object],
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> str:
+    """Run the real enforcer entry point and return its stdout."""
+    monkeypatch.setattr(code_rules_enforcer.sys, "stdin", io.StringIO(json.dumps(payload)))
+    with contextlib.suppress(SystemExit):
+        code_rules_enforcer.main([])
+    return capsys.readouterr().out
+
+
+def _production_directory(tmp_path: Path) -> Path:
+    """Return a temporary directory whose path carries production semantics."""
+    production_directory = tmp_path.parent / "codex-prod"
+    production_directory.mkdir(exist_ok=True)
+    return production_directory
+
+
+def test_parse_codex_apply_patch_projects_every_multi_file_operation(
+    tmp_path: Path,
+) -> None:
+    """The parser returns pre-edit and post-edit content for update, add, and delete."""
+    updated_path = tmp_path / "updated.py"
+    deleted_path = tmp_path / "deleted.py"
+    updated_path.write_text("before\nkeep\n", encoding="utf-8")
+    deleted_path.write_text("remove\n", encoding="utf-8")
+    patch = (
+        "*** Begin Patch\n"
+        "*** Update File: updated.py\n"
+        "@@\n"
+        "-before\n"
+        "+after\n"
+        " keep\n"
+        "*** Add File: added.py\n"
+        "+new\n"
+        "*** Delete File: deleted.py\n"
+        "*** End Patch"
+    )
+
+    all_patch_files = codex_apply_patch.parse_codex_apply_patch(patch, str(tmp_path))
+
+    views_by_name = {
+        Path(each_patch.file_path).name: each_patch for each_patch in all_patch_files
+    }
+    assert views_by_name["updated.py"].prior_content == "before\nkeep\n"
+    assert views_by_name["updated.py"].post_content == "after\nkeep\n"
+    assert views_by_name["added.py"].prior_content == ""
+    assert views_by_name["added.py"].post_content == "new\n"
+    assert views_by_name["deleted.py"].prior_content == "remove\n"
+    assert views_by_name["deleted.py"].post_content == ""
+
+
+def test_codex_payload_allows_declared_blast_radius(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A loop raise with a declared stopping scope passes the Codex hook."""
+    production_directory = _production_directory(tmp_path)
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(production_directory),
+        "tool_input": {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: module.py\n"
+                "+for each_member in all_members:\n"
+                "+    raise AssetItemBlocked()\n"
+                "*** End Patch"
+            )
+        },
+    }
+
+    stdout = _run_codex_payload(payload, monkeypatch, capsys)
+
+    assert stdout == ""
+
+
+def test_codex_payload_blocks_undeclared_blast_radius(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A loop raise requires a stopping-scope declaration for acceptance."""
+    production_directory = _production_directory(tmp_path)
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(production_directory),
+        "tool_input": {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: module.py\n"
+                "+for each_member in all_members:\n"
+                "+    raise RuntimeError()\n"
+                "*** End Patch"
+            )
+        },
+    }
+
+    stdout = _run_codex_payload(payload, monkeypatch, capsys)
+
+    deny_payload = json.loads(stdout)
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "blast radius" in deny_payload["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_codex_payload_blocks_malformed_patch(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A malformed Codex patch returns a blocking diagnostic."""
+    production_directory = _production_directory(tmp_path)
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(production_directory),
+        "tool_input": {"command": "*** Begin Patch\n*** End Patch"},
+    }
+
+    stdout = _run_codex_payload(payload, monkeypatch, capsys)
+
+    deny_payload = json.loads(stdout)
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "payload requires accepted patch markers" in deny_payload["hookSpecificOutput"]["permissionDecisionReason"]
+def test_codex_payload_blocks_a_nul_containing_patch_path(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A path containing NUL is converted into the standard JSON deny response."""
+    production_directory = _production_directory(tmp_path)
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(production_directory),
+        "tool_input": {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: unsafe\x00.py\n"
+                "+raise RuntimeError()\n"
+                "*** End Patch"
+            )
+        },
+    }
+
+    stdout = _run_codex_payload(payload, monkeypatch, capsys)
+
+    deny_payload = json.loads(stdout)
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "payload requires accepted patch markers" in deny_payload["hookSpecificOutput"]["permissionDecisionReason"]

package/hooks/blocking/test_plain_language_blocker.py

@@ -0,0 +1,119 @@
+"""Production-path tests for the AskUserQuestion plain-language blocker."""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+HOOK_PATH = Path(__file__).with_name("plain_language_blocker.py")
+
+
+def _run_hook(
+    payload: dict[str, object], *, enabled: bool
+) -> subprocess.CompletedProcess[str]:
+    environment = os.environ.copy()
+    if enabled:
+        environment["CLAUDE_PROSE_STYLE_ENFORCEMENT"] = "1"
+    else:
+        environment.pop("CLAUDE_PROSE_STYLE_ENFORCEMENT", None)
+    return subprocess.run(
+        [sys.executable, str(HOOK_PATH)],
+        input=json.dumps(payload),
+        capture_output=True,
+        check=False,
+        env=environment,
+        text=True,
+    )
+
+
+def _decision(result: subprocess.CompletedProcess[str]) -> str | None:
+    if not result.stdout:
+        return None
+    parsed_payload = json.loads(result.stdout)
+    return parsed_payload.get("hookSpecificOutput", {}).get("permissionDecision")
+
+
+def test_default_off_allows_formal_question_word() -> None:
+    result = _run_hook(
+        {
+            "tool_name": "AskUserQuestion",
+            "tool_input": {
+                "questions": [{"question": "Should we utilize this path?"}]
+            },
+        },
+        enabled=False,
+    )
+    assert result.returncode == 0
+    assert result.stdout == ""
+
+
+def test_enabled_blocks_formal_question_word() -> None:
+    result = _run_hook(
+        {
+            "tool_name": "AskUserQuestion",
+            "tool_input": {
+                "questions": [
+                    {
+                        "question": "Should we utilize this path?",
+                        "options": [{"description": "Initiate the migration."}],
+                    }
+                ]
+            },
+        },
+        enabled=True,
+    )
+    assert result.returncode == 0
+    assert _decision(result) == "deny"
+    assert "utilize -> use" in result.stdout
+    assert "initiate -> start" in result.stdout
+
+
+def test_exact_code_url_and_path_text_is_exempt() -> None:
+    result = _run_hook(
+        {
+            "tool_name": "AskUserQuestion",
+            "tool_input": {
+                "questions": [
+                    {
+                        "question": (
+                            "Use `utilize` in src/initiate.py or "
+                            "https://example.test/utilize."
+                        )
+                    }
+                ]
+            },
+        },
+        enabled=True,
+    )
+    assert result.returncode == 0
+    assert result.stdout == ""
+
+
+def test_other_tools_are_ignored() -> None:
+    result = _run_hook(
+        {
+            "tool_name": "Write",
+            "tool_input": {"content": "Utilize the existing helper."},
+        },
+        enabled=True,
+    )
+    assert result.returncode == 0
+    assert result.stdout == ""
+
+
+@pytest.mark.parametrize("raw_input", ["", "[]", "not json"])
+def test_invalid_input_is_fail_open(raw_input: str) -> None:
+    result = subprocess.run(
+        [sys.executable, str(HOOK_PATH)],
+        input=raw_input,
+        capture_output=True,
+        check=False,
+        text=True,
+    )
+    assert result.returncode == 0
+    assert result.stdout == ""

package/hooks/hooks.json

@@ -22,6 +22,16 @@
           }
         ]
       },
+      {
+        "matcher": "apply_patch",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/code_rules_enforcer.py",
+            "timeout": 60
+          }
+        ]
+      },
       {
         "matcher": "Bash|PowerShell",
         "hooks": [
@@ -80,6 +90,11 @@
       {
         "matcher": "AskUserQuestion",
         "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/plain_language_blocker.py",
+            "timeout": 10
+          },
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/ask_user_question_shape_blocker.py",

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -36,6 +36,7 @@ ADVISORY_LINE_THRESHOLD_SOFT = 400
 ADVISORY_LINE_THRESHOLD_HARD = 1000
 
 DENY_REASON_ISSUE_PREVIEW_COUNT = 10
+VIOLATION_SEPARATOR = "; "
 
 ALL_BOOLEAN_NAME_PREFIXES: tuple[str, ...] = ("is_", "has_", "should_", "can_", "was_", "did_")
 UPPER_SNAKE_CONSTANT_PATTERN = re.compile(r"^[A-Z][A-Z0-9_]*$")

package/hooks/hooks_constants/plain_language_blocker_constants.py

@@ -0,0 +1,26 @@
+"""Configuration for the AskUserQuestion plain-language blocker."""
+
+from __future__ import annotations
+
+import re
+
+ALL_PLAIN_LANGUAGE_TERM_PATTERNS: tuple[tuple[re.Pattern[str], str], ...] = (
+    (re.compile(r"\butilize\b", re.IGNORECASE), "use"),
+    (re.compile(r"\binitiate\b", re.IGNORECASE), "start"),
+    (re.compile(r"\bsufficient\b", re.IGNORECASE), "enough"),
+    (re.compile(r"\bprior to\b", re.IGNORECASE), "before"),
+    (re.compile(r"\bin order to\b", re.IGNORECASE), "to"),
+)
+
+FENCED_CODE_PATTERN = re.compile(r"```[\s\S]*?```")
+INLINE_CODE_PATTERN = re.compile(r"`[^`\n]+`")
+URL_PATTERN = re.compile(r"https?://\S+", re.IGNORECASE)
+FILE_PATH_PATTERN = re.compile(
+    r"(?<!\w)(?:[A-Za-z]:[\\/]|\.\.?[\\/])?[\w.-]+(?:[\\/][\w.-]+)+"
+)
+
+PLAIN_LANGUAGE_BLOCK_PREFIX = "BLOCKED: [PLAIN_LANGUAGE] Use familiar words: "
+PLAIN_LANGUAGE_TERM_SEPARATOR = "; "
+PLAIN_LANGUAGE_NOTICE = (
+    "Plain-language check: use familiar words in the question and its options."
+)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "2.20.0",
+    "version": "2.21.1",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {