claude-dev-env 2.30.1 → 2.31.1

package/hooks/blocking/test_state_description_blocker.py

@@ -1,4 +1,11 @@
-"""Tests for state_description_blocker hook."""
+"""Tests for state_description_blocker hook.
+
+Every payload here names an absolute file under this repository and carries
+the repository root as its ``cwd``, so each decision belongs to this
+checkout rather than to the directory pytest runs from. The one exception is
+the ephemeral-path test, which keeps its scratch target outside the
+repository root on purpose.
+"""
 
 import json
 import os
@@ -26,6 +33,28 @@ HOOK_SCRIPT_PATH = os.path.join(
     os.path.dirname(__file__), "state_description_blocker.py"
 )
 
+_REPOSITORY_ROOT = str(Path(__file__).resolve().parents[4])
+
+
+def _repository_file_path(relative_path: str) -> str:
+    """Return the absolute path of a repository-relative file in this checkout.
+
+    The hook resolves a bare relative path against the process working
+    directory, so a payload carrying one answers to the directory pytest was
+    invoked from. An absolute path under the repository root, paired with a
+    payload ``cwd`` naming that root, keeps the decision stable for a
+    checkout under a temporary root as well.
+
+    Args:
+        relative_path: The path of the target file relative to the repository
+            root.
+
+    Returns:
+        The absolute path of that file inside this repository.
+    """
+    return str(Path(_REPOSITORY_ROOT) / relative_path)
+
+
 CLEAN_PYTHON = "x = 1  # Uses a default timeout"
 CLEAN_MD = "# Config\n\nThe API uses port 8080."
 CLEAN_COMMENT = "# Configured with a 30-second timeout"
@@ -46,7 +75,11 @@ def evaluate(payload_by_key: dict[str, object]) -> str | None:
 
 
 class _RunHook:
-    """Helper to test the hook via subprocess."""
+    """Run the hook as a subprocess on a payload anchored in this repository.
+
+    The payload names the repository root as the session working directory,
+    so the hook treats each target inside it as a real production file.
+    """
 
     def __call__(
         self,
@@ -55,7 +88,9 @@ class _RunHook:
         *,
         is_prose_style_enabled: bool = True,
     ) -> subprocess.CompletedProcess:
-        payload = json.dumps({"tool_name": tool_name, "tool_input": tool_input})
+        payload = json.dumps(
+            {"tool_name": tool_name, "tool_input": tool_input, "cwd": _REPOSITORY_ROOT}
+        )
         environment_by_key = os.environ.copy()
         if is_prose_style_enabled:
             environment_by_key["CLAUDE_PROSE_STYLE_ENFORCEMENT"] = "1"
@@ -81,7 +116,7 @@ def test_historical_phrase_scan_runs_with_the_env_flag_unset(
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "content": VIOLATION_INSTEAD_OF_COMMENT,
         },
         is_prose_style_enabled=False,
@@ -92,9 +127,10 @@ def test_historical_phrase_scan_runs_with_the_env_flag_unset(
         {
             "tool_name": "Write",
             "tool_input": {
-                "file_path": "src/main.py",
+                "file_path": _repository_file_path("src/main.py"),
                 "content": VIOLATION_INSTEAD_OF_COMMENT,
             },
+            "cwd": _REPOSITORY_ROOT,
         }
     )
     assert deny_reason is not None
@@ -105,7 +141,7 @@ def test_block_clean_python_comment_passes():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "content": CLEAN_PYTHON,
         },
     )
@@ -117,7 +153,7 @@ def test_block_clean_markdown_passes():
     result = _run_hook(
         "Write",
         {
-            "file_path": "docs/README.md",
+            "file_path": _repository_file_path("docs/README.md"),
             "content": CLEAN_MD,
         },
     )
@@ -129,7 +165,7 @@ def test_block_clean_comment_passes():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.py",
+            "file_path": _repository_file_path("src/config.py"),
             "content": CLEAN_COMMENT,
         },
     )
@@ -141,7 +177,7 @@ def test_block_irrelevant_file_passes():
     result = _run_hook(
         "Write",
         {
-            "file_path": "data.txt",
+            "file_path": _repository_file_path("data.txt"),
             "content": VIOLATION_INSTEAD_OF_COMMENT,
         },
     )
@@ -153,7 +189,7 @@ def test_block_empty_content_passes():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "content": "",
         },
     )
@@ -177,7 +213,7 @@ def test_detects_instead_of_in_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "content": VIOLATION_INSTEAD_OF_COMMENT,
         },
     )
@@ -191,7 +227,7 @@ def test_detects_previously_in_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.py",
+            "file_path": _repository_file_path("src/config.py"),
             "content": VIOLATION_PREVIOUSLY_COMMENT,
         },
     )
@@ -205,7 +241,7 @@ def test_detects_now_uses_in_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/client.py",
+            "file_path": _repository_file_path("src/client.py"),
             "content": VIOLATION_NOW_USES_COMMENT,
         },
     )
@@ -219,7 +255,7 @@ def test_detects_instead_of_in_markdown():
     result = _run_hook(
         "Write",
         {
-            "file_path": "docs/api.md",
+            "file_path": _repository_file_path("docs/api.md"),
             "content": VIOLATION_MD_INSTEAD,
         },
     )
@@ -232,7 +268,7 @@ def test_detects_previously_in_markdown():
     result = _run_hook(
         "Write",
         {
-            "file_path": "docs/config.md",
+            "file_path": _repository_file_path("docs/config.md"),
             "content": VIOLATION_MD_PREVIOUSLY,
         },
     )
@@ -245,7 +281,7 @@ def test_detects_now_uses_in_markdown():
     result = _run_hook(
         "Write",
         {
-            "file_path": "docs/auth.md",
+            "file_path": _repository_file_path("docs/auth.md"),
             "content": VIOLATION_MD_NOW_USES,
         },
     )
@@ -271,7 +307,7 @@ def test_detects_edit_new_string():
     result = _run_hook(
         "Edit",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "old_string": "old_comment",
             "new_string": VIOLATION_PREVIOUSLY_COMMENT,
         },
@@ -286,7 +322,7 @@ def test_clean_edit_passes():
     result = _run_hook(
         "Edit",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "old_string": "x = 1",
             "new_string": CLEAN_PYTHON,
         },
@@ -295,11 +331,79 @@ def test_clean_edit_passes():
     assert result.stdout == ""
 
 
+def test_detects_multi_edit_second_new_string() -> None:
+    """A violation in the second edit of a MultiEdit is denied, not only the first."""
+    result = _run_hook(
+        "MultiEdit",
+        {
+            "file_path": _repository_file_path("src/main.py"),
+            "edits": [
+                {"old_string": "a = 1", "new_string": CLEAN_PYTHON},
+                {"old_string": "old_comment", "new_string": VIOLATION_PREVIOUSLY_COMMENT},
+            ],
+        },
+    )
+    assert result.returncode == 0
+    output = json.loads(result.stdout)
+    assert output["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "previously" in output["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_clean_multi_edit_passes() -> None:
+    result = _run_hook(
+        "MultiEdit",
+        {
+            "file_path": _repository_file_path("src/main.py"),
+            "edits": [
+                {"old_string": "a = 1", "new_string": CLEAN_PYTHON},
+                {"old_string": "b = 2", "new_string": CLEAN_COMMENT},
+            ],
+        },
+    )
+    assert result.returncode == 0
+    assert result.stdout == ""
+
+
+def test_multi_edit_new_strings_join_on_a_separator_not_concatenation() -> None:
+    """Two clean edit fragments stay clean even when one ends where the next begins.
+
+    The first edit's new_string ends in "# describes the previous", and the
+    second's begins with "ly implemented step.". Concatenated with no
+    separator the two would spell "previously" and trip a false deny; joined
+    on a real separator they stay two distinct fragments.
+    """
+    result = _run_hook(
+        "MultiEdit",
+        {
+            "file_path": _repository_file_path("src/main.py"),
+            "edits": [
+                {"old_string": "a = 1", "new_string": "# describes the previous"},
+                {"old_string": "b = 2", "new_string": "ly implemented step."},
+            ],
+        },
+    )
+    assert result.returncode == 0
+    assert result.stdout == ""
+
+
+def test_multi_edit_with_a_single_edit_still_denies() -> None:
+    result = _run_hook(
+        "MultiEdit",
+        {
+            "file_path": _repository_file_path("src/main.py"),
+            "edits": [{"old_string": "old_comment", "new_string": VIOLATION_PREVIOUSLY_COMMENT}],
+        },
+    )
+    assert result.returncode == 0
+    output = json.loads(result.stdout)
+    assert output["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
 def test_system_message_and_suppress_output():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "content": VIOLATION_INSTEAD_OF_COMMENT,
         },
     )
@@ -314,7 +418,7 @@ def test_detects_no_longer_in_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.py",
+            "file_path": _repository_file_path("src/config.py"),
             "content": "# No longer supports legacy mode",
         },
     )
@@ -328,7 +432,7 @@ def test_detects_used_to_in_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.py",
+            "file_path": _repository_file_path("src/config.py"),
             "content": "# Used to be hardcoded",
         },
     )
@@ -342,7 +446,7 @@ def test_detects_switched_to_in_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.py",
+            "file_path": _repository_file_path("src/config.py"),
             "content": "# Switched to async processing",
         },
     )
@@ -360,7 +464,7 @@ def test_detects_comment_with_close_block_token():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.py",
+            "file_path": _repository_file_path("src/config.py"),
             "content": VIOLATION_COMMENT_WITH_CLOSE_BLOCK,
         },
     )
@@ -377,7 +481,7 @@ def test_detects_inline_trailing_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "content": "max_retries = 3  # No longer needed since async retry handles it",
         },
     )
@@ -393,7 +497,7 @@ def test_ignores_c_preprocessor_directive():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/config.h",
+            "file_path": _repository_file_path("src/config.h"),
             "content": '#error "This code previously used replaced API"',
         },
     )
@@ -409,7 +513,7 @@ def test_ignores_hash_in_javascript_inline():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.js",
+            "file_path": _repository_file_path("src/main.js"),
             "content": 'const selector = "#originally-dark"  // Use dark as default',
         },
     )
@@ -425,7 +529,7 @@ def test_ignores_double_slash_in_js_url():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/fetch.ts",
+            "file_path": _repository_file_path("src/fetch.ts"),
             "content": 'fetch("https://api.example.com/replaces")',
         },
     )
@@ -441,7 +545,7 @@ def test_block_comment_continuation_with_nested_glob():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/cache.ts",
+            "file_path": _repository_file_path("src/cache.ts"),
             "content": content,
         },
     )
@@ -458,7 +562,7 @@ def test_detects_inline_after_url_on_same_line():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/fetch.ts",
+            "file_path": _repository_file_path("src/fetch.ts"),
             "content": 'const url = "https://api.com"; // no longer used',
         },
     )
@@ -475,7 +579,7 @@ def test_ignores_code_before_block_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/cache.ts",
+            "file_path": _repository_file_path("src/cache.ts"),
             "content": "cache.replaces(old); /* Use fresh cache */",
         },
     )
@@ -491,7 +595,7 @@ def test_ignores_url_with_double_slash_in_python():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "content": 'url = "https://api.example.com/replaces/v1"',
         },
     )
@@ -506,7 +610,7 @@ def test_ignores_instead_of_in_code_string_with_inline_comment():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "content": "msg = 'instead of'  # Use the default timeout",
         },
     )
@@ -522,7 +626,7 @@ def test_ignores_glob_pattern_with_star_in_python():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "content": content,
         },
     )
@@ -538,7 +642,7 @@ def test_ignores_comment_with_glob_pattern():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "content": content,
         },
     )
@@ -553,7 +657,7 @@ def test_single_line_block_comment_closes():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/cache.ts",
+            "file_path": _repository_file_path("src/cache.ts"),
             "content": content,
         },
     )
@@ -571,7 +675,7 @@ def test_block_comment_with_url_closes_correctly():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/cache.ts",
+            "file_path": _repository_file_path("src/cache.ts"),
             "content": content,
         },
     )
@@ -588,7 +692,7 @@ def test_same_line_block_comment_with_trailing_inline():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/fetch.ts",
+            "file_path": _repository_file_path("src/fetch.ts"),
             "content": content,
         },
     )
@@ -606,7 +710,7 @@ def test_multi_line_block_comment_close_with_trailing_inline():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/cache.ts",
+            "file_path": _repository_file_path("src/cache.ts"),
             "content": content,
         },
     )
@@ -623,7 +727,7 @@ def test_detects_earliest_inline_marker_in_php():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/index.php",
+            "file_path": _repository_file_path("src/index.php"),
             "content": 'echo $x; // previously used #tag',
         },
     )
@@ -637,7 +741,7 @@ def test_additional_context_contains_examples():
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/main.py",
+            "file_path": _repository_file_path("src/main.py"),
             "content": VIOLATION_INSTEAD_OF_COMMENT,
         },
     )
@@ -682,7 +786,13 @@ def test_handles_non_dict_tool_input():
 def test_handles_non_string_tool_name():
     """A tool_name that is not a string should exit cleanly — the hook must
     guard against tool_name not being a string."""
-    payload = json.dumps({"tool_name": 123, "tool_input": {"file_path": "src/main.py"}})
+    payload = json.dumps(
+        {
+            "tool_name": 123,
+            "tool_input": {"file_path": _repository_file_path("src/main.py")},
+            "cwd": _REPOSITORY_ROOT,
+        }
+    )
     result = subprocess.run(
         [sys.executable, HOOK_SCRIPT_PATH],
         input=payload,
@@ -706,7 +816,7 @@ def test_detects_used_to_in_python_module_docstring() -> None:
     result = _run_hook(
         "Write",
         {
-            "file_path": "tests/test_exports.py",
+            "file_path": _repository_file_path("tests/test_exports.py"),
             "content": written_source,
         },
     )
@@ -727,7 +837,7 @@ def test_detects_previously_in_python_function_docstring() -> None:
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/configuration.py",
+            "file_path": _repository_file_path("src/configuration.py"),
             "content": written_source,
         },
     )
@@ -744,7 +854,7 @@ def test_ignores_transitional_phrase_in_regular_python_string() -> None:
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/messages.py",
+            "file_path": _repository_file_path("src/messages.py"),
             "content": 'PADDING_NOTE = "used to pad with a flat sleep"\n',
         },
     )
@@ -763,7 +873,7 @@ def test_ignores_quoted_mention_inside_python_docstring() -> None:
     result = _run_hook(
         "Write",
         {
-            "file_path": "src/scanner.py",
+            "file_path": _repository_file_path("src/scanner.py"),
             "content": written_source,
         },
     )
@@ -779,7 +889,7 @@ def test_detects_docstring_at_start_of_unparseable_edit_fragment() -> None:
     result = _run_hook(
         "Edit",
         {
-            "file_path": "src/exports.py",
+            "file_path": _repository_file_path("src/exports.py"),
             "old_string": "placeholder",
             "new_string": fragment,
         },
@@ -801,7 +911,7 @@ def test_detects_docstring_after_def_header_in_unparseable_fragment() -> None:
     result = _run_hook(
         "Edit",
         {
-            "file_path": "src/reporting.py",
+            "file_path": _repository_file_path("src/reporting.py"),
             "old_string": "placeholder",
             "new_string": fragment,
         },
@@ -820,7 +930,7 @@ def test_ignores_assigned_triple_quoted_string_in_unparseable_fragment() -> None
     result = _run_hook(
         "Edit",
         {
-            "file_path": "src/fixtures.py",
+            "file_path": _repository_file_path("src/fixtures.py"),
             "old_string": "placeholder",
             "new_string": fragment,
         },
@@ -839,7 +949,11 @@ def test_native_dispatch_path_logs_the_block(tmp_path: Path) -> None:
     """
     deny_payload = {
         "tool_name": "Write",
-        "tool_input": {"file_path": "src/main.py", "content": VIOLATION_INSTEAD_OF_COMMENT},
+        "tool_input": {
+            "file_path": _repository_file_path("src/main.py"),
+            "content": VIOLATION_INSTEAD_OF_COMMENT,
+        },
+        "cwd": _REPOSITORY_ROOT,
     }
     native_hook = NativeHook(evaluate=evaluate, build_deny_payload=build_deny_payload)
 

package/hooks/blocking/test_subprocess_budget_completeness.py

@@ -586,3 +586,70 @@ def test_full_hook_denies_edit_that_adds_a_timeout_to_a_non_budget_helper(
     hook_output = json.loads(completed_hook.stdout)
     assert hook_output["hookSpecificOutput"]["permissionDecision"] == "deny"
     assert "45s" in hook_output["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+_HARMLESS_COMMENT_EDIT = {
+    "old_string": "return git_check.returncode != 0\n",
+    "new_string": "return git_check.returncode != 0  # checked\n",
+}
+_UNCOUNTED_TIMEOUT_EDIT = {
+    "old_string": (
+        '    git_check = subprocess.run(["git", "ls-files", file_path],'
+        " timeout=GIT_CHECK_TIMEOUT_SECONDS)\n"
+    ),
+    "new_string": '    git_check = subprocess.run(["git", "ls-files", file_path], timeout=45)\n',
+}
+
+
+def _run_multi_edit_hook(edited_module_path: pathlib.Path, all_edits: list[dict[str, str]]):
+    hook_input = json.dumps(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {"file_path": str(edited_module_path), "edits": all_edits},
+        }
+    )
+    return subprocess.run(
+        [sys.executable, str(_HOOK_DIR / "subprocess_budget_completeness.py")],
+        input=hook_input,
+        capture_output=True,
+        text=True,
+        timeout=15,
+        check=False,
+    )
+
+
+def test_resolved_content_reconstructs_the_full_file_for_a_multi_edit(
+    tmp_path: pathlib.Path,
+) -> None:
+    """The whole reconstructed file reflects every edit, not only the first."""
+    edited_module_path = tmp_path / "timing_module.py"
+    edited_module_path.write_text(_BUDGET_COUNTS_EVERY_TIMEOUT, encoding="utf-8")
+    reconstructed_content = resolved_content(
+        {
+            "file_path": str(edited_module_path),
+            "edits": [_HARMLESS_COMMENT_EDIT, _UNCOUNTED_TIMEOUT_EDIT],
+        }
+    )
+    assert "timeout=45" in reconstructed_content
+    assert "# checked" in reconstructed_content
+
+
+def test_full_hook_denies_multi_edit_that_adds_a_timeout_in_the_second_edit(
+    production_module_path: pathlib.Path,
+) -> None:
+    """A new timeout introduced by the second edit of a MultiEdit is caught."""
+    production_module_path.write_text(_BUDGET_COUNTS_EVERY_TIMEOUT, encoding="utf-8")
+    completed_hook = _run_multi_edit_hook(
+        production_module_path, [_HARMLESS_COMMENT_EDIT, _UNCOUNTED_TIMEOUT_EDIT]
+    )
+    assert completed_hook.returncode == 0
+    hook_output = json.loads(completed_hook.stdout)
+    assert hook_output["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "45s" in hook_output["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_full_hook_allows_a_clean_multi_edit(production_module_path: pathlib.Path) -> None:
+    production_module_path.write_text(_BUDGET_COUNTS_EVERY_TIMEOUT, encoding="utf-8")
+    completed_hook = _run_multi_edit_hook(production_module_path, [_HARMLESS_COMMENT_EDIT])
+    assert completed_hook.returncode == 0
+    assert completed_hook.stdout == ""