claude-dev-env 2.30.1 → 2.31.1

package/hooks/observability/test_pr_description_writer_spawn_tracker.py

@@ -0,0 +1,150 @@
+"""Unit tests for the pr-description-writer spawn tracker PostToolUse hook."""
+
+from __future__ import annotations
+
+import importlib.util
+import io
+import json
+import sys
+from pathlib import Path
+from unittest import mock
+
+import pytest
+
+_OBSERVABILITY_DIRECTORY = Path(__file__).resolve().parent
+_HOOKS_DIRECTORY = _OBSERVABILITY_DIRECTORY.parent
+for each_directory in (_OBSERVABILITY_DIRECTORY, _HOOKS_DIRECTORY):
+    if str(each_directory) not in sys.path:
+        sys.path.insert(0, str(each_directory))
+
+_TRACKER_SPEC = importlib.util.spec_from_file_location(
+    "pr_description_writer_spawn_tracker",
+    _OBSERVABILITY_DIRECTORY / "pr_description_writer_spawn_tracker.py",
+)
+assert _TRACKER_SPEC is not None
+assert _TRACKER_SPEC.loader is not None
+tracker_module = importlib.util.module_from_spec(_TRACKER_SPEC)
+_TRACKER_SPEC.loader.exec_module(tracker_module)
+
+_GATE_CONSTANTS = importlib.import_module(
+    "hooks_constants.pr_description_writer_gate_constants"
+)
+
+_SESSION_ID = "session-abc123"
+_OTHER_SUBAGENT_TYPE = "general-purpose"
+
+
+def _spawn_payload(
+    subagent_type: str,
+    tool_name: str = "Agent",
+    session_id: str = _SESSION_ID,
+) -> dict[str, object]:
+    """Build a PostToolUse payload for one agent spawn.
+
+    Args:
+        subagent_type: The agent type the spawn names.
+        tool_name: The spawning tool name.
+        session_id: The session the spawn belongs to.
+
+    Returns:
+        The payload dictionary the tracker reads from stdin.
+    """
+    return {
+        "tool_name": tool_name,
+        "session_id": session_id,
+        "tool_input": {
+            "subagent_type": subagent_type,
+            "description": "Write the PR body",
+            "prompt": "Write a PR description from the diff.",
+        },
+    }
+
+
+def _run_tracker(payload: dict[str, object], temp_directory: Path) -> None:
+    """Run the tracker's main against a payload with temp redirected.
+
+    Args:
+        payload: The PostToolUse payload to feed on stdin.
+        temp_directory: The directory standing in for the system temp root.
+    """
+    with mock.patch("sys.stdin", io.StringIO(json.dumps(payload))):
+        with mock.patch.object(
+            _GATE_CONSTANTS.tempfile, "gettempdir", return_value=str(temp_directory)
+        ):
+            tracker_module.main()
+
+
+def should_record_marker_when_pr_description_writer_spawns(tmp_path: Path) -> None:
+    """A pr-description-writer spawn leaves this session's marker on disk."""
+    _run_tracker(_spawn_payload(tracker_module.PR_DESCRIPTION_WRITER_SUBAGENT_TYPE), tmp_path)
+    assert tracker_module.spawn_marker_path(_SESSION_ID, tmp_path).exists() is True
+
+
+def should_leave_no_marker_when_another_agent_spawns(tmp_path: Path) -> None:
+    """A spawn of a different agent type records nothing."""
+    _run_tracker(_spawn_payload(_OTHER_SUBAGENT_TYPE), tmp_path)
+    assert tracker_module.spawn_marker_path(_SESSION_ID, tmp_path).exists() is False
+
+
+@pytest.mark.parametrize("spawn_tool_name", ["Agent", "Task"])
+def should_record_marker_for_each_spawn_tool_name(spawn_tool_name: str, tmp_path: Path) -> None:
+    """Both spawning tool names record the marker."""
+    payload = _spawn_payload(
+        tracker_module.PR_DESCRIPTION_WRITER_SUBAGENT_TYPE, tool_name=spawn_tool_name
+    )
+    _run_tracker(payload, tmp_path)
+    assert tracker_module.spawn_marker_path(_SESSION_ID, tmp_path).exists() is True
+
+
+def should_leave_no_marker_for_an_unrelated_tool(tmp_path: Path) -> None:
+    """A tool that is not a spawn records nothing, even naming the agent."""
+    payload = _spawn_payload(tracker_module.PR_DESCRIPTION_WRITER_SUBAGENT_TYPE, tool_name="Bash")
+    _run_tracker(payload, tmp_path)
+    assert tracker_module.spawn_marker_path(_SESSION_ID, tmp_path).exists() is False
+
+
+def should_keep_each_session_marker_separate(tmp_path: Path) -> None:
+    """A spawn in one session leaves another session's marker absent."""
+    payload = _spawn_payload(
+        tracker_module.PR_DESCRIPTION_WRITER_SUBAGENT_TYPE, session_id="session-one"
+    )
+    _run_tracker(payload, tmp_path)
+    assert tracker_module.spawn_marker_path("session-one", tmp_path).exists() is True
+    assert tracker_module.spawn_marker_path("session-two", tmp_path).exists() is False
+
+
+def should_record_twice_without_error(tmp_path: Path) -> None:
+    """A second spawn in one session leaves the marker in place."""
+    payload = _spawn_payload(tracker_module.PR_DESCRIPTION_WRITER_SUBAGENT_TYPE)
+    _run_tracker(payload, tmp_path)
+    _run_tracker(payload, tmp_path)
+    assert tracker_module.spawn_marker_path(_SESSION_ID, tmp_path).exists() is True
+
+
+def should_ignore_a_malformed_payload(tmp_path: Path) -> None:
+    """Unparseable stdin records nothing and raises nothing."""
+    with mock.patch("sys.stdin", io.StringIO("this is not json")):
+        with mock.patch.object(_GATE_CONSTANTS.tempfile, "gettempdir", return_value=str(tmp_path)):
+            tracker_module.main()
+    assert list(tmp_path.iterdir()) == []
+
+
+def should_ignore_a_payload_with_no_tool_input(tmp_path: Path) -> None:
+    """A spawn payload missing tool_input records nothing."""
+    payload: dict[str, object] = {"tool_name": "Agent", "session_id": _SESSION_ID}
+    _run_tracker(payload, tmp_path)
+    assert tracker_module.spawn_marker_path(_SESSION_ID, tmp_path).exists() is False
+
+
+@pytest.mark.parametrize("unusable_session_id", ["", "///"])
+def should_record_nothing_without_a_usable_session_id(
+    unusable_session_id: str, tmp_path: Path
+) -> None:
+    """A payload naming no usable session records no marker at all."""
+    payload = _spawn_payload(
+        tracker_module.PR_DESCRIPTION_WRITER_SUBAGENT_TYPE,
+        session_id=unusable_session_id,
+    )
+    _run_tracker(payload, tmp_path)
+    assert tracker_module.spawn_marker_path(unusable_session_id, tmp_path) is None
+    assert list(tmp_path.iterdir()) == []

package/hooks/observability/test_session_file_edit_tracker.py

@@ -172,3 +172,35 @@ def test_should_exit_zero_on_malformed_stdin(
 ) -> None:
     _run_main_with_stdin("not valid json {{{")
     assert not any(redirected_temp_directory.iterdir())
+
+
+def test_should_record_every_apply_patch_target_file(
+    redirected_temp_directory: pathlib.Path,
+) -> None:
+    working_directory = redirected_temp_directory / "repo"
+    working_directory.mkdir()
+    (working_directory / "updated.py").write_text("before\n", encoding="utf-8")
+    patch_command = (
+        "*** Begin Patch\n"
+        "*** Update File: updated.py\n"
+        "@@\n"
+        "-before\n"
+        "+after\n"
+        "*** Add File: added.py\n"
+        "+new\n"
+        "*** End Patch"
+    )
+    payload = json.dumps(
+        {
+            "session_id": _SESSION_ID,
+            "tool_name": "apply_patch",
+            "cwd": str(working_directory),
+            "tool_input": {"command": patch_command},
+        }
+    )
+
+    _run_main_with_stdin(payload)
+
+    recorded = _read_recorded_paths(redirected_temp_directory, _SESSION_ID)
+    assert str((working_directory / "updated.py").resolve()) in recorded
+    assert str((working_directory / "added.py").resolve()) in recorded

package/hooks/validation/hook_format_validator.py

@@ -9,17 +9,34 @@ import re
 import sys
 from pathlib import Path
 
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+try:
+    _hooks_dir = str(Path(__file__).resolve().parent.parent)
+    if _hooks_dir not in sys.path:
+        sys.path.insert(0, _hooks_dir)
+
+    from hooks_constants.hook_block_logger import log_hook_block
+    from hooks_constants.multi_edit_reconstruction import joined_new_strings
+except ImportError as import_error:
+    raise ImportError(
+        "hook_format_validator: cannot import its sibling modules; "
+        "ensure the hooks directory is importable."
+    ) from import_error
 
 SIMPLE_PATTERN = re.compile(
     r'python3?\s+~/\.claude/hooks/'
 )
 
 
+def _resolve_content(tool_name: str, all_tool_input: dict) -> str:
+    """Return the text a Write, Edit, or MultiEdit payload introduces."""
+    if tool_name == "MultiEdit":
+        return joined_new_strings(all_tool_input)
+    content = all_tool_input.get("content", "")
+    if not content:
+        content = all_tool_input.get("new_string", "")
+    return content
+
+
 def main() -> None:
     try:
         hook_input = json.load(sys.stdin)
@@ -36,10 +53,7 @@ def main() -> None:
         sys.exit(0)
 
     tool_name = hook_input.get("tool_name", "")
-    content = tool_input.get("content", "")
-    if not content:
-        new_string = tool_input.get("new_string", "")
-        content = new_string
+    content = _resolve_content(tool_name, tool_input)
 
     if tool_name == "Write" and content:
         try:

package/hooks/validation/test_hook_format_validator.py

@@ -41,6 +41,64 @@ def test_simple_pattern_blocks_with_deny_payload(tmp_path: Path) -> None:
     assert hook_specific_output["permissionDecision"] == "deny"
 
 
+def test_write_payload_reads_the_content_field(tmp_path: Path) -> None:
+    """_resolve_content's non-MultiEdit branch reads a Write payload's "content" key."""
+    settings_path = tmp_path / ".claude" / "settings.json"
+    payload = {
+        "tool_name": "Write",
+        "tool_input": {
+            "file_path": str(settings_path),
+            "content": "python3 ~/.claude/hooks/blocking/my-hook.py",
+        },
+    }
+
+    hook_run = _run_hook(payload)
+
+    assert hook_run.returncode == 0
+    deny_payload = json.loads(hook_run.stdout)
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_second_multi_edit_new_string_is_caught(tmp_path: Path) -> None:
+    """A simple-pattern hook command in the second edit of a MultiEdit is denied."""
+    settings_path = tmp_path / ".claude" / "settings.json"
+    payload = {
+        "tool_name": "MultiEdit",
+        "tool_input": {
+            "file_path": str(settings_path),
+            "edits": [
+                {"old_string": "a", "new_string": "b"},
+                {"old_string": "c", "new_string": "python3 ~/.claude/hooks/blocking/my-hook.py"},
+            ],
+        },
+    }
+
+    hook_run = _run_hook(payload)
+
+    assert hook_run.returncode == 0
+    deny_payload = json.loads(hook_run.stdout)
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_clean_multi_edit_passes(tmp_path: Path) -> None:
+    settings_path = tmp_path / ".claude" / "settings.json"
+    payload = {
+        "tool_name": "MultiEdit",
+        "tool_input": {
+            "file_path": str(settings_path),
+            "edits": [
+                {"old_string": "a", "new_string": "b"},
+                {"old_string": "c", "new_string": "node -e \"require('run-hook-wrapper')\""},
+            ],
+        },
+    }
+
+    hook_run = _run_hook(payload)
+
+    assert hook_run.returncode == 0
+    assert hook_run.stdout.strip() == ""
+
+
 def test_block_logs_pre_tool_use_event(tmp_path: Path) -> None:
     fake_home = tmp_path / "home"
     fake_home.mkdir()

package/hooks/validators/README.md

@@ -2,7 +2,7 @@
 
 AST-based Python style checks for code quality enforcement.
 
-The checks live in `python_style_checks.py`; the shared source-line splitting and function-discovery helpers they build on live in `python_style_helpers.py`. `hook_timing_harness.py` measures real wall-clock time for the Write/Edit hooks `hooks.json` registers, reporting p50 and p95 over a configurable run count.
+The checks live in `python_style_checks.py`; the shared source-line splitting, function-discovery, and statement-classification helpers they build on live in `python_style_helpers.py`. `python_style_import_bootstrap.py` recognizes the repo's sys.path bootstrap-guard idiom so the imports-at-top check does not penalize a file for following it. `hook_timing_harness.py` measures real wall-clock time for the Write/Edit hooks `hooks.json` registers, reporting p50 and p95 over a configurable run count. `fast_save_validators.py` runs the twelve non-Mypy, non-Ruff checks in-process for the Write/Edit save-path gate, with no per-check subprocess.
 
 ## Checks Implemented
 

package/hooks/validators/abbreviation_checks.py

@@ -11,12 +11,10 @@ Detects:
 import ast
 import sys
 from pathlib import Path
-from typing import List, Set
+from typing import List
 
-from .validator_base import Violation
-
-
-ALLOWED_SINGLE_LETTERS: Set[str] = frozenset({"i", "j", "k", "_"})
+from .config.abbreviation_checks_constants import ALL_ALLOWED_SINGLE_LETTERS
+from .validator_base import Violation, source_text, syntax_tree
 
 
 def check_single_letter_variables(tree: ast.AST, filename: str) -> List[Violation]:
@@ -24,7 +22,7 @@ def check_single_letter_variables(tree: ast.AST, filename: str) -> List[Violatio
 
     for node in ast.walk(tree):
         if isinstance(node, ast.Name) and isinstance(node.ctx, ast.Store):
-            if len(node.id) == 1 and node.id not in ALLOWED_SINGLE_LETTERS:
+            if len(node.id) == 1 and node.id not in ALL_ALLOWED_SINGLE_LETTERS:
                 violations.append(
                     Violation(
                         filename,
@@ -41,13 +39,13 @@ def validate_file(file_path: Path) -> List[Violation]:
     filename = str(file_path)
 
     try:
-        source = file_path.read_text(encoding="utf-8")
+        source = source_text(file_path)
     except Exception as error:
         violations.append(Violation(filename, 0, f"Error reading file: {error}"))
         return violations
 
     try:
-        tree = ast.parse(source)
+        tree = syntax_tree(source)
     except SyntaxError as error:
         violations.append(
             Violation(filename, error.lineno or 0, f"Syntax error: {error.msg}")

package/hooks/validators/code_quality_checks.py

@@ -11,7 +11,7 @@ import sys
 from pathlib import Path
 from typing import List
 
-from .validator_base import Violation
+from .validator_base import Violation, source_text, syntax_tree
 
 
 MAX_FUNCTION_LINES = 30
@@ -75,7 +75,7 @@ def check_file_length(file_path: Path) -> List[Violation]:
     filename = str(file_path)
 
     try:
-        lines = file_path.read_text(encoding="utf-8").splitlines()
+        lines = source_text(file_path).splitlines()
     except Exception as error:
         return [Violation(filename, 0, f"Error reading file: {error}")]
 
@@ -98,8 +98,8 @@ def validate_file(file_path: Path) -> List[Violation]:
     violations.extend(check_file_length(file_path))
 
     try:
-        source = file_path.read_text(encoding="utf-8")
-        tree = ast.parse(source)
+        source = source_text(file_path)
+        tree = syntax_tree(source)
     except Exception as error:
         return violations + [Violation(filename, 0, f"Error: {error}")]
 

package/hooks/validators/config/abbreviation_checks_constants.py

@@ -0,0 +1,3 @@
+"""Shared constants for abbreviation_checks.py's single-letter-name check."""
+
+ALL_ALLOWED_SINGLE_LETTERS: frozenset[str] = frozenset({"i", "j", "k", "_"})

package/hooks/validators/config/baseline_identity_constants.py

@@ -0,0 +1,12 @@
+"""Patterns and placeholders the baseline gate masks a violation message with.
+
+Config files are exempt from the string-literal magic-value checks, so the
+regex fragments and the placeholder text the scope-agnostic message shape needs
+live here rather than inline in ``run_all_validators.py``.
+"""
+
+QUALIFIED_SCOPE_NAME_SEPARATOR = "."
+WORD_BOUNDARY_PATTERN = r"\b"
+STANDALONE_NUMBER_PATTERN = r"(?<![A-Za-z0-9_])\d+(?![A-Za-z0-9_])"
+SCOPE_NAME_PLACEHOLDER = "<name>"
+SHAPE_NUMBER_PLACEHOLDER = "<number>"

package/hooks/validators/config/directory_exemption_constants.py

@@ -7,7 +7,9 @@ siblings). Exact names come from the authoritative path-exemption pattern sets
 and CLI markers, unioned with the config-directory allowlist. Substring
 patterns come from the separator-free members of those same pattern sets so a
 directory such as ``pkg/test_helpers/`` stages with the same test exemption as
-the real path.
+the real path. Directories pytest generates for its own scratch tree are
+recognized by name and contribute no signal, whatever ``--basetemp`` they sit
+under.
 """
 
 from __future__ import annotations
@@ -27,6 +29,15 @@ from ..exempt_paths import (
 POSIX_DIRECTORY_SEPARATOR = "/"
 WINDOWS_DIRECTORY_SEPARATOR = "\\"
 
+PYTEST_TEMPORARY_ROOT_NAME_PREFIX = "pytest-"
+DECIMAL_DIGIT_CHARACTERS = "0123456789"
+LOWERCASE_ASCII_LETTER_CHARACTERS = "abcdefghijklmnopqrstuvwxyz"
+UNDERSCORE_CHARACTER = "_"
+PYTEST_SANITIZED_TEST_NAME_LENGTH_LIMIT = 30
+ALL_PYTEST_SANITIZED_TEST_NAME_CHARACTERS: frozenset[str] = frozenset(
+    LOWERCASE_ASCII_LETTER_CHARACTERS + DECIMAL_DIGIT_CHARACTERS + UNDERSCORE_CHARACTER
+)
+
 ALL_SYSTEM_TEMPORARY_ROOT_ENVIRONMENT_VARIABLE_NAMES: frozenset[str] = frozenset(
     {
         "TEMP",
@@ -68,6 +79,38 @@ def is_filename_like_path_segment(path_segment: str) -> bool:
     return "." in path_segment
 
 
+def is_pytest_scratch_directory_segment(segment_lower: str) -> bool:
+    """Return True when *segment_lower* is a directory pytest itself created.
+
+    ::
+
+        is_pytest_scratch_directory_segment("test_drops_leading_anchor0")  # True
+        is_pytest_scratch_directory_segment("pytest-of-root")  # True
+        is_pytest_scratch_directory_segment("test_helpers")  # False
+
+    ``TempPathFactory`` names its roots ``pytest-of-<user>`` and ``pytest-<n>``, and
+    each per-test directory as a length-capped test-name stem with a number appended.
+    Those generated names carry ``test_`` without naming a real project directory.
+
+    Args:
+        segment_lower: One lowercased directory component of a target path.
+
+    Returns:
+        True when pytest generated the segment rather than the project.
+    """
+    if segment_lower.startswith(PYTEST_TEMPORARY_ROOT_NAME_PREFIX):
+        return True
+    sanitized_test_name = segment_lower.rstrip(DECIMAL_DIGIT_CHARACTERS)
+    if not sanitized_test_name or sanitized_test_name == segment_lower:
+        return False
+    if len(sanitized_test_name) > PYTEST_SANITIZED_TEST_NAME_LENGTH_LIMIT:
+        return False
+    return all(
+        each_character in ALL_PYTEST_SANITIZED_TEST_NAME_CHARACTERS
+        for each_character in sanitized_test_name
+    )
+
+
 def all_directory_segments_in_path_pattern(path_pattern: str) -> list[str]:
     """Return lowercased directory tokens from one path-exemption pattern.
 

package/hooks/validators/config/fast_save_validator_constants.py

@@ -0,0 +1,32 @@
+"""File suffixes and report text the save-path validator roster reuses.
+
+Config files are exempt from the string-literal magic-value checks, so the
+per-language file suffixes and shared report strings live here rather than
+inline in ``fast_save_validators.py``.
+"""
+
+from hooks_constants.mypy_integration_constants import PYTHON_SOURCE_SUFFIX
+
+TYPESCRIPT_SOURCE_SUFFIX = ".ts"
+REACT_TYPESCRIPT_SOURCE_SUFFIX = ".tsx"
+JAVASCRIPT_SOURCE_SUFFIX = ".js"
+REACT_JAVASCRIPT_SOURCE_SUFFIX = ".jsx"
+
+ALL_REACT_COMPONENT_FILE_SUFFIXES: tuple[str, ...] = (
+    REACT_TYPESCRIPT_SOURCE_SUFFIX,
+    REACT_JAVASCRIPT_SOURCE_SUFFIX,
+)
+ALL_CODE_REFERENCE_FILE_SUFFIXES: tuple[str, ...] = (
+    PYTHON_SOURCE_SUFFIX,
+    TYPESCRIPT_SOURCE_SUFFIX,
+    REACT_TYPESCRIPT_SOURCE_SUFFIX,
+    JAVASCRIPT_SOURCE_SUFFIX,
+    REACT_JAVASCRIPT_SOURCE_SUFFIX,
+)
+
+NO_PYTHON_FILES_MESSAGE = "No Python files to check"
+NO_TEST_FILES_MESSAGE = "No test files to check"
+NO_REACT_FILES_MESSAGE = "No React files to check"
+NO_CODE_REFERENCE_FILES_MESSAGE = "No code files to check"
+NO_VIOLATIONS_FOUND_MESSAGE = "All checks passed"
+VIOLATION_REPORT_LINE_SEPARATOR = "\n"

package/hooks/validators/config/hook_timing_harness_constants.py

@@ -9,7 +9,9 @@ P50_FRACTION = 0.50
 P95_FRACTION = 0.95
 DEFAULT_TARGET_RELATIVE_PATH = "hooks/blocking/code_rules_shared.py"
 SUBPROCESS_TIMEOUT_SECONDS = 60.0
-ALL_WRITE_EDIT_MATCHER_PATTERNS = frozenset({"Write|Edit", "Write|Edit|MultiEdit"})
+ALL_WRITE_EDIT_MATCHER_PATTERNS = frozenset(
+    {"Write|Edit", "Write|Edit|MultiEdit", "Write|Edit|MultiEdit|apply_patch"}
+)
 ALL_TIMED_EVENT_NAMES = ("PreToolUse", "PostToolUse")
 RUN_ALL_VALIDATORS_LABEL = "run_all_validators"
 CLAUDE_PLUGIN_ROOT_PLACEHOLDER = "${CLAUDE_PLUGIN_ROOT}"

package/hooks/validators/config/test_abbreviation_checks_constants.py

@@ -0,0 +1,11 @@
+"""Tests for the shared abbreviation_checks allow-list constant."""
+
+from .abbreviation_checks_constants import ALL_ALLOWED_SINGLE_LETTERS
+
+
+def test_allowed_single_letters_covers_loop_counters_and_underscore() -> None:
+    assert ALL_ALLOWED_SINGLE_LETTERS == frozenset({"i", "j", "k", "_"})
+
+
+def test_allowed_single_letters_is_immutable() -> None:
+    assert isinstance(ALL_ALLOWED_SINGLE_LETTERS, frozenset)

package/hooks/validators/config/validator_base_constants.py

@@ -0,0 +1,9 @@
+"""Constants for the shared source reader and parser in validator_base."""
+
+from __future__ import annotations
+
+# One save validates one file, so a handful of entries covers a run and keeps
+# a long-lived CLI pass from holding every file it ever read.
+SOURCE_CACHE_ENTRIES: int = 8
+
+SOURCE_ENCODING: str = "utf-8"