claude-dev-env 2.3.0 → 2.5.0

package/hooks/lifecycle/test_enter_worktree_origin_prefetch.py

@@ -1,178 +1,185 @@
-"""Unit tests for the enter_worktree_origin_prefetch PreToolUse hook.
-
-Uses real git repositories (a "remote" repo cloned into a "local" one) so the
-fetch behavior is exercised against actual git plumbing, not mocked calls.
-"""
-
-from __future__ import annotations
-
-import importlib.util
-import io
-import json
-import pathlib
-import subprocess
-import sys
-
-import pytest
-
-_HOOK_DIR = pathlib.Path(__file__).parent
-_HOOKS_TREE = _HOOK_DIR.parent
-for each_path in (str(_HOOK_DIR), str(_HOOKS_TREE)):
-    if each_path not in sys.path:
-        sys.path.insert(0, each_path)
-
-hook_spec = importlib.util.spec_from_file_location(
-    "enter_worktree_origin_prefetch",
-    _HOOK_DIR / "enter_worktree_origin_prefetch.py",
-)
-assert hook_spec is not None
-assert hook_spec.loader is not None
-hook_module = importlib.util.module_from_spec(hook_spec)
-hook_spec.loader.exec_module(hook_module)
-
-
-def _run_git(repo_directory: pathlib.Path, *args: str) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(
-        ["git", *args],
-        cwd=repo_directory,
-        capture_output=True,
-        text=True,
-        check=True,
-    )
-
-
-def _init_repo_with_commit(repo_directory: pathlib.Path) -> None:
-    repo_directory.mkdir(parents=True, exist_ok=True)
-    _run_git(repo_directory, "init", "--quiet", "--initial-branch=main")
-    _run_git(repo_directory, "config", "user.email", "test@example.com")
-    _run_git(repo_directory, "config", "user.name", "Test")
-    _run_git(repo_directory, "commit", "--allow-empty", "--quiet", "-m", "init")
-
-
-def _clone_as_local(remote_directory: pathlib.Path, local_directory: pathlib.Path) -> None:
-    subprocess.run(
-        ["git", "clone", "--quiet", str(remote_directory), str(local_directory)],
-        capture_output=True,
-        text=True,
-        check=True,
-    )
-    _run_git(local_directory, "config", "user.email", "test@example.com")
-    _run_git(local_directory, "config", "user.name", "Test")
-
-
-def test_is_enter_worktree_creation_true_when_no_path_given() -> None:
-    payload = {"tool_name": "EnterWorktree", "tool_input": {}}
-    assert hook_module.is_enter_worktree_creation(payload) is True
-
-
-def test_is_enter_worktree_creation_true_with_name_only() -> None:
-    payload = {"tool_name": "EnterWorktree", "tool_input": {"name": "my-branch"}}
-    assert hook_module.is_enter_worktree_creation(payload) is True
-
-
-def test_is_enter_worktree_creation_false_when_path_given() -> None:
-    payload = {"tool_name": "EnterWorktree", "tool_input": {"path": "/some/worktree"}}
-    assert hook_module.is_enter_worktree_creation(payload) is False
-
-
-def test_is_enter_worktree_creation_false_for_other_tool() -> None:
-    payload = {"tool_name": "Bash", "tool_input": {}}
-    assert hook_module.is_enter_worktree_creation(payload) is False
-
-
-def test_resolve_origin_default_branch_reads_cloned_head(tmp_path: pathlib.Path) -> None:
-    remote_directory = tmp_path / "remote"
-    local_directory = tmp_path / "local"
-    _init_repo_with_commit(remote_directory)
-    _clone_as_local(remote_directory, local_directory)
-
-    resolved_branch = hook_module.resolve_origin_default_branch(str(local_directory))
-
-    assert resolved_branch == "main"
-
-
-def test_resolve_origin_default_branch_returns_none_without_origin(
-    tmp_path: pathlib.Path,
-) -> None:
-    solo_directory = tmp_path / "solo"
-    _init_repo_with_commit(solo_directory)
-
-    resolved_branch = hook_module.resolve_origin_default_branch(str(solo_directory))
-
-    assert resolved_branch is None
-
-
-def test_fetch_origin_branch_updates_stale_local_ref(tmp_path: pathlib.Path) -> None:
-    remote_directory = tmp_path / "remote"
-    local_directory = tmp_path / "local"
-    _init_repo_with_commit(remote_directory)
-    _clone_as_local(remote_directory, local_directory)
-
-    _run_git(remote_directory, "commit", "--allow-empty", "--quiet", "-m", "second")
-    remote_head_sha = _run_git(remote_directory, "rev-parse", "HEAD").stdout.strip()
-    local_cached_sha_before = _run_git(
-        local_directory, "rev-parse", "refs/remotes/origin/main"
-    ).stdout.strip()
-    assert local_cached_sha_before != remote_head_sha
-
-    hook_module.fetch_origin_branch(str(local_directory), "main")
-
-    local_cached_sha_after = _run_git(
-        local_directory, "rev-parse", "refs/remotes/origin/main"
-    ).stdout.strip()
-    assert local_cached_sha_after == remote_head_sha
-
-
-def test_fetch_origin_branch_never_raises_when_remote_missing(tmp_path: pathlib.Path) -> None:
-    solo_directory = tmp_path / "solo"
-    _init_repo_with_commit(solo_directory)
-
-    hook_module.fetch_origin_branch(str(solo_directory), "main")
-
-
-def test_main_fetches_stale_ref_and_exits_zero(
-    tmp_path: pathlib.Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    remote_directory = tmp_path / "remote"
-    local_directory = tmp_path / "local"
-    _init_repo_with_commit(remote_directory)
-    _clone_as_local(remote_directory, local_directory)
-    _run_git(remote_directory, "commit", "--allow-empty", "--quiet", "-m", "second")
-    remote_head_sha = _run_git(remote_directory, "rev-parse", "HEAD").stdout.strip()
-
-    payload = {
-        "tool_name": "EnterWorktree",
-        "tool_input": {},
-        "cwd": str(local_directory),
-    }
-    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(payload)))
-
-    with pytest.raises(SystemExit) as exit_info:
-        hook_module.main()
-
-    assert exit_info.value.code == 0
-    local_cached_sha_after = _run_git(
-        local_directory, "rev-parse", "refs/remotes/origin/main"
-    ).stdout.strip()
-    assert local_cached_sha_after == remote_head_sha
-
-
-def test_main_exits_zero_for_non_enter_worktree_tool(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    payload = {"tool_name": "Bash", "tool_input": {"command": "ls"}, "cwd": "/tmp"}
-    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(payload)))
-
-    with pytest.raises(SystemExit) as exit_info:
-        hook_module.main()
-
-    assert exit_info.value.code == 0
-
-
-def test_main_exits_zero_on_malformed_json(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr(sys, "stdin", io.StringIO("not json"))
-
-    with pytest.raises(SystemExit) as exit_info:
-        hook_module.main()
-
-    assert exit_info.value.code == 0
+"""Unit tests for the enter_worktree_origin_prefetch PreToolUse hook.
+
+Uses real git repositories (a "remote" repo cloned into a "local" one) so the
+fetch behavior is exercised against actual git plumbing, not mocked calls.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import io
+import json
+import pathlib
+import subprocess
+import sys
+
+import pytest
+
+_HOOK_DIR = pathlib.Path(__file__).parent
+_HOOKS_TREE = _HOOK_DIR.parent
+for each_path in (str(_HOOK_DIR), str(_HOOKS_TREE)):
+    if each_path not in sys.path:
+        sys.path.insert(0, each_path)
+
+hook_spec = importlib.util.spec_from_file_location(
+    "enter_worktree_origin_prefetch",
+    _HOOK_DIR / "enter_worktree_origin_prefetch.py",
+)
+assert hook_spec is not None
+assert hook_spec.loader is not None
+hook_module = importlib.util.module_from_spec(hook_spec)
+hook_spec.loader.exec_module(hook_module)
+
+
+def _run_git(repo_directory: pathlib.Path, *args: str) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        ["git", *args],
+        cwd=repo_directory,
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+
+
+def _init_repo_with_commit(repo_directory: pathlib.Path) -> None:
+    repo_directory.mkdir(parents=True, exist_ok=True)
+    _run_git(repo_directory, "init", "--quiet", "--initial-branch=main")
+    _run_git(repo_directory, "config", "user.email", "test@example.com")
+    _run_git(repo_directory, "config", "user.name", "Test")
+    _run_git(repo_directory, "commit", "--allow-empty", "--quiet", "-m", "init")
+
+
+def _clone_as_local(remote_directory: pathlib.Path, local_directory: pathlib.Path) -> None:
+    subprocess.run(
+        ["git", "clone", "--quiet", str(remote_directory), str(local_directory)],
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    _run_git(local_directory, "config", "user.email", "test@example.com")
+    _run_git(local_directory, "config", "user.name", "Test")
+
+
+def test_is_enter_worktree_creation_true_when_no_path_given() -> None:
+    payload = {"tool_name": "EnterWorktree", "tool_input": {}}
+    assert hook_module.is_enter_worktree_creation(payload) is True
+
+
+def test_is_enter_worktree_creation_true_with_name_only() -> None:
+    payload = {"tool_name": "EnterWorktree", "tool_input": {"name": "my-branch"}}
+    assert hook_module.is_enter_worktree_creation(payload) is True
+
+
+def test_is_enter_worktree_creation_false_when_path_given() -> None:
+    payload = {"tool_name": "EnterWorktree", "tool_input": {"path": "/some/worktree"}}
+    assert hook_module.is_enter_worktree_creation(payload) is False
+
+
+def test_is_enter_worktree_creation_false_for_other_tool() -> None:
+    payload = {"tool_name": "Bash", "tool_input": {}}
+    assert hook_module.is_enter_worktree_creation(payload) is False
+
+
+def test_resolve_origin_default_branch_reads_cloned_head(tmp_path: pathlib.Path) -> None:
+    remote_directory = tmp_path / "remote"
+    local_directory = tmp_path / "local"
+    _init_repo_with_commit(remote_directory)
+    _clone_as_local(remote_directory, local_directory)
+
+    resolved_branch = hook_module.resolve_origin_default_branch(str(local_directory))
+
+    assert resolved_branch == "main"
+
+
+def test_resolve_origin_default_branch_returns_none_without_origin(
+    tmp_path: pathlib.Path,
+) -> None:
+    solo_directory = tmp_path / "solo"
+    _init_repo_with_commit(solo_directory)
+
+    resolved_branch = hook_module.resolve_origin_default_branch(str(solo_directory))
+
+    assert resolved_branch is None
+
+
+def test_fetch_origin_branch_updates_stale_local_ref(tmp_path: pathlib.Path) -> None:
+    remote_directory = tmp_path / "remote"
+    local_directory = tmp_path / "local"
+    _init_repo_with_commit(remote_directory)
+    _clone_as_local(remote_directory, local_directory)
+
+    _run_git(remote_directory, "commit", "--allow-empty", "--quiet", "-m", "second")
+    remote_head_sha = _run_git(remote_directory, "rev-parse", "HEAD").stdout.strip()
+    local_cached_sha_before = _run_git(
+        local_directory, "rev-parse", "refs/remotes/origin/main"
+    ).stdout.strip()
+    assert local_cached_sha_before != remote_head_sha
+
+    hook_module.fetch_origin_branch(str(local_directory), "main")
+
+    local_cached_sha_after = _run_git(
+        local_directory, "rev-parse", "refs/remotes/origin/main"
+    ).stdout.strip()
+    assert local_cached_sha_after == remote_head_sha
+
+
+def test_fetch_origin_branch_never_raises_when_remote_missing(tmp_path: pathlib.Path) -> None:
+    solo_directory = tmp_path / "solo"
+    _init_repo_with_commit(solo_directory)
+
+    hook_module.fetch_origin_branch(str(solo_directory), "main")
+
+
+def test_main_fetches_stale_ref_and_exits_zero(
+    tmp_path: pathlib.Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    remote_directory = tmp_path / "remote"
+    local_directory = tmp_path / "local"
+    _init_repo_with_commit(remote_directory)
+    _clone_as_local(remote_directory, local_directory)
+    _run_git(remote_directory, "commit", "--allow-empty", "--quiet", "-m", "second")
+    remote_head_sha = _run_git(remote_directory, "rev-parse", "HEAD").stdout.strip()
+
+    payload = {
+        "tool_name": "EnterWorktree",
+        "tool_input": {},
+        "cwd": str(local_directory),
+    }
+    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(payload)))
+
+    with pytest.raises(SystemExit) as exit_info:
+        hook_module.main()
+
+    assert exit_info.value.code == 0
+    local_cached_sha_after = _run_git(
+        local_directory, "rev-parse", "refs/remotes/origin/main"
+    ).stdout.strip()
+    assert local_cached_sha_after == remote_head_sha
+
+
+def test_main_exits_zero_for_non_enter_worktree_tool(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    payload = {"tool_name": "Bash", "tool_input": {"command": "ls"}, "cwd": "/tmp"}
+    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(payload)))
+
+    with pytest.raises(SystemExit) as exit_info:
+        hook_module.main()
+
+    assert exit_info.value.code == 0
+
+
+@pytest.mark.parametrize(
+    "stdin_text",
+    ["not json", "", "   \n\t  ", "[]", "42"],
+    ids=["malformed-json", "empty", "whitespace-only", "json-array-root", "json-scalar-root"],
+)
+def test_main_exits_zero_on_fail_soft_stdin(
+    stdin_text: str, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setattr(sys, "stdin", io.StringIO(stdin_text))
+
+    with pytest.raises(SystemExit) as exit_info:
+        hook_module.main()
+
+    assert exit_info.value.code == 0

package/hooks/pyproject.toml

@@ -73,6 +73,7 @@ ignore = [
     "PLR0912",
     "PLR0913",
     "PLR0915",
+    "PLR0917",
     "PLR1714",
     "PLR2004",
     "PLR5501",

package/hooks/validators/CLAUDE.md

@@ -12,6 +12,7 @@ A library of check modules used by the validation hooks. Each module focuses on
 | `output_formatter.py` | Formats `Violation` lists into human-readable output |
 | `run_all_validators.py` | Entry point — runs every check module and aggregates results |
 | `health_check.py` | Verifies that all validator dependencies (ruff, mypy) are reachable |
+| `pyproject_config_discovery.py` | Shared walk-up primitive that resolves a tool's pyproject.toml config from an original target path, matching the `[tool.<name>]` table the tool owns |
 | `python_style_helpers.py` | Shared source-line splitting and function-discovery helpers imported by `python_style_checks.py` |
 
 ## Check modules
@@ -39,6 +40,7 @@ A library of check modules used by the validation hooks. Each module focuses on
 
 | Directory | Role |
 |---|---|
+| `config/` | Constants module (`directory_exemption_constants.py`) holding the exemption directory-segment names that `validate_proposed_file` staging keeps |
 | `test_files/` | Fixture files used by the validator tests — not checked-in test code |
 
 ## Conventions

package/hooks/validators/config/directory_exemption_constants.py

@@ -0,0 +1,183 @@
+"""Directory-segment signals that anchor validator temp-path staging.
+
+``validate_proposed_file`` keeps the target's path from the first directory
+segment that either matches an exemption directory name exactly or contains a
+separator-free substring pattern (``test_``, ``conftest``, ``.spec.``, and
+siblings). Exact names come from the authoritative path-exemption pattern sets
+and CLI markers, unioned with the config-directory allowlist. Substring
+patterns come from the separator-free members of those same pattern sets so a
+directory such as ``pkg/test_helpers/`` stages with the same test exemption as
+the real path.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+
+from hooks_constants.code_rules_enforcer_constants import ALL_CLI_FILE_PATH_MARKERS
+from hooks_constants.code_rules_path_utils_constants import ALL_CONFIG_DIRECTORY_NAMES
+
+from ..exempt_paths import (
+    HOOK_INFRASTRUCTURE_PATTERNS,
+    MIGRATION_PATH_PATTERNS,
+    TEST_PATH_PATTERNS,
+    WORKFLOW_REGISTRY_PATTERNS,
+)
+
+POSIX_DIRECTORY_SEPARATOR = "/"
+WINDOWS_DIRECTORY_SEPARATOR = "\\"
+
+ALL_SYSTEM_TEMPORARY_ROOT_ENVIRONMENT_VARIABLE_NAMES: frozenset[str] = frozenset(
+    {
+        "TEMP",
+        "TMP",
+        "TMPDIR",
+        "RUNNER_TEMP",
+    }
+)
+
+ALL_AUTHORITATIVE_DIRECTORY_PATH_PATTERN_SETS: tuple[Iterable[str], ...] = (
+    TEST_PATH_PATTERNS,
+    WORKFLOW_REGISTRY_PATTERNS,
+    MIGRATION_PATH_PATTERNS,
+    HOOK_INFRASTRUCTURE_PATTERNS,
+    ALL_CLI_FILE_PATH_MARKERS,
+)
+
+
+def is_filename_like_path_segment(path_segment: str) -> bool:
+    """Return True when *path_segment* looks like a file name, not a directory.
+
+    ::
+
+        is_filename_like_path_segment("states.py")  # True
+        is_filename_like_path_segment(".claude")    # False
+        is_filename_like_path_segment("tests")      # False
+
+    A leading-dot name is treated as a directory (``.claude``). Any other
+    segment that contains a dot is treated as a filename (``states.py``).
+
+    Args:
+        path_segment: One path component with no separators.
+
+    Returns:
+        True when the segment should be ignored as a directory token.
+    """
+    if path_segment.startswith("."):
+        return False
+    return "." in path_segment
+
+
+def all_directory_segments_in_path_pattern(path_pattern: str) -> list[str]:
+    """Return lowercased directory tokens from one path-exemption pattern.
+
+    ::
+
+        all_directory_segments_in_path_pattern("/.claude/hooks/")
+        # ['.claude', 'hooks']
+
+        all_directory_segments_in_path_pattern("/tests.py")
+        # []
+
+        all_directory_segments_in_path_pattern("conftest")
+        # []
+
+    Separators normalize to POSIX. Filename-like segments and empty splits
+    are dropped so only directory tokens remain.
+
+    Args:
+        path_pattern: One entry from an exemption or CLI marker pattern set.
+
+    Returns:
+        Lowercased directory segment names in path order.
+    """
+    normalized_pattern = path_pattern.replace(
+        WINDOWS_DIRECTORY_SEPARATOR, POSIX_DIRECTORY_SEPARATOR
+    )
+    if POSIX_DIRECTORY_SEPARATOR not in normalized_pattern:
+        return []
+    all_directory_segments: list[str] = []
+    for each_segment in normalized_pattern.split(POSIX_DIRECTORY_SEPARATOR):
+        if not each_segment:
+            continue
+        if is_filename_like_path_segment(each_segment):
+            continue
+        all_directory_segments.append(each_segment.lower())
+    return all_directory_segments
+
+
+def directory_segment_names_from_path_patterns(
+    all_path_patterns: Iterable[str],
+) -> frozenset[str]:
+    """Collect unique directory segment names from path-exemption patterns.
+
+    ::
+
+        directory_segment_names_from_path_patterns({"/tests/", "\\workflow\\", "/cli.py"})
+        # frozenset({'tests', 'workflow'})
+
+    Basename markers without a directory token contribute nothing. Adding a
+    new ``/foo/`` pattern to an authoritative set surfaces ``foo`` here
+    automatically.
+
+    Args:
+        all_path_patterns: Path substrings used by exemption or CLI checks.
+
+    Returns:
+        Lowercased directory segment names present in the patterns.
+    """
+    all_segment_names: set[str] = set()
+    for each_pattern in all_path_patterns:
+        all_segment_names.update(all_directory_segments_in_path_pattern(each_pattern))
+    return frozenset(all_segment_names)
+
+
+def substring_patterns_from_path_patterns(
+    all_path_patterns: Iterable[str],
+) -> frozenset[str]:
+    """Collect separator-free substring patterns from path-exemption patterns.
+
+    ::
+
+        substring_patterns_from_path_patterns({"test_", "/tests/", "conftest"})
+        # frozenset({'test_', 'conftest'})
+
+    ``is_test_file`` and its siblings match these fragments anywhere in a path,
+    including inside a directory segment name such as ``pkg/test_helpers/``.
+    Patterns carrying a separator are directory tokens handled by
+    ``directory_segment_names_from_path_patterns`` and are skipped here.
+
+    Args:
+        all_path_patterns: Path substrings used by exemption or CLI checks.
+
+    Returns:
+        Lowercased separator-free substring patterns.
+    """
+    all_substring_patterns: set[str] = set()
+    for each_pattern in all_path_patterns:
+        if (
+            POSIX_DIRECTORY_SEPARATOR in each_pattern
+            or WINDOWS_DIRECTORY_SEPARATOR in each_pattern
+        ):
+            continue
+        all_substring_patterns.add(each_pattern.lower())
+    return frozenset(all_substring_patterns)
+
+
+ALL_DIRECTORY_SEGMENTS_FROM_PATH_PATTERNS: frozenset[str] = frozenset().union(
+    *(
+        directory_segment_names_from_path_patterns(each_pattern_set)
+        for each_pattern_set in ALL_AUTHORITATIVE_DIRECTORY_PATH_PATTERN_SETS
+    )
+)
+
+ALL_DIRECTORY_EXEMPTION_SEGMENT_NAMES: frozenset[str] = (
+    ALL_CONFIG_DIRECTORY_NAMES | ALL_DIRECTORY_SEGMENTS_FROM_PATH_PATTERNS
+)
+
+ALL_DIRECTORY_EXEMPTION_SUBSTRING_PATTERNS: frozenset[str] = frozenset().union(
+    *(
+        substring_patterns_from_path_patterns(each_pattern_set)
+        for each_pattern_set in ALL_AUTHORITATIVE_DIRECTORY_PATH_PATTERN_SETS
+    )
+)

package/hooks/validators/config/test_directory_exemption_constants.py

@@ -0,0 +1,21 @@
+"""Tests for the derived directory-exemption segment set."""
+
+from hooks_constants.code_rules_path_utils_constants import ALL_CONFIG_DIRECTORY_NAMES
+
+from .directory_exemption_constants import ALL_DIRECTORY_EXEMPTION_SEGMENT_NAMES
+
+
+def test_exemption_set_covers_every_config_directory_name() -> None:
+    missing_names = ALL_CONFIG_DIRECTORY_NAMES - ALL_DIRECTORY_EXEMPTION_SEGMENT_NAMES
+    assert missing_names == frozenset()
+
+
+def test_exemption_set_covers_constants_package_directories() -> None:
+    assert "hooks_constants" in ALL_DIRECTORY_EXEMPTION_SEGMENT_NAMES
+    assert "pr_loop_shared_constants" in ALL_DIRECTORY_EXEMPTION_SEGMENT_NAMES
+    assert "git_hooks_constants" in ALL_DIRECTORY_EXEMPTION_SEGMENT_NAMES
+
+
+def test_exemption_set_keeps_path_marker_segments() -> None:
+    for each_marker in ("scripts", "tests", "migrations", "workflow", "hooks"):
+        assert each_marker in ALL_DIRECTORY_EXEMPTION_SEGMENT_NAMES

package/hooks/validators/conftest.py

@@ -5,6 +5,10 @@ from pathlib import Path
 
 
 VALIDATORS_DIRECTORY = Path(__file__).resolve().parent
+HOOKS_DIRECTORY = VALIDATORS_DIRECTORY.parent
 
 if str(VALIDATORS_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(VALIDATORS_DIRECTORY))
+
+if str(HOOKS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(HOOKS_DIRECTORY))