claude-dev-env 2.30.1 → 2.31.1

package/scripts/dev_env_scripts_constants/grok_worker_constants.py

@@ -56,6 +56,21 @@ DEFAULT_PING_TIMEOUT_SECONDS: int = 120
 CLAUDE_HOME_SUBDIRECTORY: str = ".claude"
 """Per-user directory under the home directory that holds Claude config."""
 
+CLAUDE_CONFIG_DIR_ENV_VAR: str = "CLAUDE_CONFIG_DIR"
+"""Environment variable naming the managed Claude config root."""
+
+PROCESS_TREE_KILL_MODULE_FILENAME: str = "process_tree_kill.py"
+"""Filename of the shared process-tree kill helper."""
+
+SHARED_PACKAGE_DIRECTORY_NAME: str = "_shared"
+"""Directory name of the shared install tree under the managed root."""
+
+PROCESS_TREE_DIRECTORY_NAME: str = "process-tree"
+"""Directory name of the process-tree helper package under ``_shared``."""
+
+SCRIPTS_DIRECTORY_NAME: str = "scripts"
+"""Directory name holding Python helpers under a process-tree package."""
+
 MANIFEST_FILENAME: str = ".claude-dev-env-manifest.json"
 """Install manifest written by ``claude-dev-env`` into the user Claude home."""
 

package/scripts/grok_headless_runner.py

@@ -25,24 +25,14 @@ Import ``run_headless_worker`` for the outcome object::
 
 from __future__ import annotations
 
+import os
 import subprocess
 import sys
 import uuid
 from dataclasses import dataclass
 from pathlib import Path
 
-_shared_process_tree_scripts_directory = (
-    Path(__file__).resolve().parents[1] / "_shared" / "process-tree" / "scripts"
-)
-if str(_shared_process_tree_scripts_directory) not in sys.path:
-    sys.path.insert(0, str(_shared_process_tree_scripts_directory))
-
-from process_tree_kill import (  # noqa: E402
-    should_start_new_session,
-    terminate_process_tree,
-)
-
-from dev_env_scripts_constants.grok_worker_constants import (  # noqa: E402
+from dev_env_scripts_constants.grok_worker_constants import (
     AGENT_FLAG,
     ALL_AUTH_FAILURE_SIGNATURES,
     ALL_USAGE_LIMIT_SIGNATURES,
@@ -81,6 +71,19 @@ from dev_env_scripts_constants.grok_worker_constants import (  # noqa: E402
     UTF8_ENCODING,
     WORKER_SPEC_TIMEOUT_KEY,
 )
+from shared_tree_paths import resolve_shared_process_tree_scripts_directory
+
+_shared_process_tree_scripts_directory = resolve_shared_process_tree_scripts_directory(
+    __file__,
+    all_environment=os.environ,
+)
+if str(_shared_process_tree_scripts_directory) not in sys.path:
+    sys.path.insert(0, str(_shared_process_tree_scripts_directory))
+
+from process_tree_kill import (  # noqa: E402
+    should_start_new_session,
+    terminate_process_tree,
+)
 
 runner_popen = subprocess.Popen
 

package/scripts/shared_tree_paths.py

@@ -0,0 +1,70 @@
+"""Resolve directories inside the installed shared tree."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from pathlib import Path
+
+from dev_env_scripts_constants.grok_worker_constants import (
+    CLAUDE_CONFIG_DIR_ENV_VAR,
+    PROCESS_TREE_DIRECTORY_NAME,
+    PROCESS_TREE_KILL_MODULE_FILENAME,
+    SCRIPTS_DIRECTORY_NAME,
+    SHARED_PACKAGE_DIRECTORY_NAME,
+)
+
+
+def _process_tree_scripts_directory(from_root: Path) -> Path:
+    return (
+        from_root
+        / SHARED_PACKAGE_DIRECTORY_NAME
+        / PROCESS_TREE_DIRECTORY_NAME
+        / SCRIPTS_DIRECTORY_NAME
+    )
+
+
+def _has_process_tree_kill_module(from_directory: Path) -> bool:
+    return (from_directory / PROCESS_TREE_KILL_MODULE_FILENAME).is_file()
+
+
+def resolve_shared_process_tree_scripts_directory(
+    module_file: str | Path,
+    all_environment: Mapping[str, str],
+) -> Path:
+    """Return the first process-tree scripts directory that holds the kill helper.
+
+    ::
+
+        scripts dir is a junction; the kill helper sits beside the un-resolved parent
+        ok:   Path(module_file).absolute().parent.parent then the _shared scripts dir
+        flag: Path(module_file).resolve().parents[1] walks the junction and misses it
+
+    Tries the un-resolved parent first, then the configured managed root, then
+    the resolved parent. When none hold the helper, return the un-resolved
+    candidate so import failure names a readable path.
+
+    Args:
+        module_file: Path of the importing module (``__file__``).
+        all_environment: Mapping that may hold ``CLAUDE_CONFIG_DIR``.
+
+    Returns:
+        Directory that should hold ``process_tree_kill.py``.
+    """
+    un_resolved_candidate = _process_tree_scripts_directory(
+        Path(module_file).absolute().parent.parent
+    )
+    all_candidates = [un_resolved_candidate]
+    configured_root_text = all_environment.get(
+        CLAUDE_CONFIG_DIR_ENV_VAR, ""
+    ).strip()
+    if configured_root_text:
+        all_candidates.append(
+            _process_tree_scripts_directory(Path(configured_root_text))
+        )
+    all_candidates.append(
+        _process_tree_scripts_directory(Path(module_file).resolve().parents[1])
+    )
+    for each_candidate in all_candidates:
+        if _has_process_tree_kill_module(each_candidate):
+            return each_candidate
+    return un_resolved_candidate

package/scripts/test_shared_tree_paths.py

@@ -0,0 +1,143 @@
+"""Behavioral tests for shared-tree directory resolution."""
+
+from __future__ import annotations
+
+import importlib
+import os
+import sys
+from pathlib import Path
+
+import pytest
+
+_SCRIPTS_DIR = Path(__file__).resolve().parent
+if str(_SCRIPTS_DIR) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIR))
+
+import shared_tree_paths  # noqa: E402
+from dev_env_scripts_constants.grok_worker_constants import (  # noqa: E402
+    CLAUDE_CONFIG_DIR_ENV_VAR,
+    PROCESS_TREE_DIRECTORY_NAME,
+    PROCESS_TREE_KILL_MODULE_FILENAME,
+    SCRIPTS_DIRECTORY_NAME,
+    SHARED_PACKAGE_DIRECTORY_NAME,
+)
+
+
+def _create_directory_link(*, from_link: Path, to_target: Path) -> None:
+    if sys.platform.startswith("win32"):
+        importlib.import_module("_winapi").CreateJunction(
+            str(to_target), str(from_link)
+        )
+        return
+    try:
+        os.symlink(to_target, from_link, target_is_directory=True)
+    except OSError:
+        pytest.skip("directory symlink creation is not available")
+
+
+def _build_junction_scripts_layout(tmp_path: Path) -> Path:
+    real_scripts_directory = tmp_path / "real" / SCRIPTS_DIRECTORY_NAME
+    real_scripts_directory.mkdir(parents=True)
+    (real_scripts_directory / "runner.py").write_text("", encoding="utf-8")
+    managed_root = tmp_path / "root"
+    managed_root.mkdir()
+    _create_directory_link(
+        from_link=managed_root / SCRIPTS_DIRECTORY_NAME,
+        to_target=real_scripts_directory,
+    )
+    return managed_root / SCRIPTS_DIRECTORY_NAME / "runner.py"
+
+
+def _write_process_tree_kill_stub(from_root: Path) -> Path:
+    scripts_directory = (
+        from_root
+        / SHARED_PACKAGE_DIRECTORY_NAME
+        / PROCESS_TREE_DIRECTORY_NAME
+        / SCRIPTS_DIRECTORY_NAME
+    )
+    scripts_directory.mkdir(parents=True)
+    (scripts_directory / PROCESS_TREE_KILL_MODULE_FILENAME).write_text(
+        "", encoding="utf-8"
+    )
+    return scripts_directory
+
+
+def test_junction_scripts_dir_finds_shared_tree_on_unresolved_parent(
+    tmp_path: Path,
+) -> None:
+    module_file = _build_junction_scripts_layout(tmp_path)
+    expected_scripts_directory = _write_process_tree_kill_stub(tmp_path / "root")
+    resolved_scripts_directory = (
+        shared_tree_paths.resolve_shared_process_tree_scripts_directory(
+            module_file, all_environment={}
+        )
+    )
+    assert resolved_scripts_directory == expected_scripts_directory
+
+
+def test_resolved_parent_is_used_when_link_side_has_no_shared_tree(
+    tmp_path: Path,
+) -> None:
+    module_file = _build_junction_scripts_layout(tmp_path)
+    expected_scripts_directory = _write_process_tree_kill_stub(tmp_path / "real")
+    resolved_scripts_directory = (
+        shared_tree_paths.resolve_shared_process_tree_scripts_directory(
+            module_file, all_environment={}
+        )
+    )
+    assert resolved_scripts_directory == expected_scripts_directory
+
+
+def test_configured_root_is_used_when_neither_parent_holds_the_module(
+    tmp_path: Path,
+) -> None:
+    module_file = _build_junction_scripts_layout(tmp_path)
+    configured_root = tmp_path / "configured"
+    expected_scripts_directory = _write_process_tree_kill_stub(configured_root)
+    resolved_scripts_directory = (
+        shared_tree_paths.resolve_shared_process_tree_scripts_directory(
+            module_file,
+            all_environment={
+                CLAUDE_CONFIG_DIR_ENV_VAR: str(configured_root)
+            },
+        )
+    )
+    assert resolved_scripts_directory == expected_scripts_directory
+
+
+def test_unresolved_parent_wins_when_configured_root_also_holds_the_module(
+    tmp_path: Path,
+) -> None:
+    module_file = _build_junction_scripts_layout(tmp_path)
+    expected_scripts_directory = _write_process_tree_kill_stub(tmp_path / "root")
+    configured_root = tmp_path / "configured"
+    _write_process_tree_kill_stub(configured_root)
+    resolved_scripts_directory = (
+        shared_tree_paths.resolve_shared_process_tree_scripts_directory(
+            module_file,
+            all_environment={
+                CLAUDE_CONFIG_DIR_ENV_VAR: str(configured_root)
+            },
+        )
+    )
+    assert resolved_scripts_directory == expected_scripts_directory
+
+
+def test_missing_module_returns_unresolved_candidate(tmp_path: Path) -> None:
+    module_file = _build_junction_scripts_layout(tmp_path)
+    expected_scripts_directory = (
+        tmp_path
+        / "root"
+        / SHARED_PACKAGE_DIRECTORY_NAME
+        / PROCESS_TREE_DIRECTORY_NAME
+        / SCRIPTS_DIRECTORY_NAME
+    )
+    resolved_scripts_directory = (
+        shared_tree_paths.resolve_shared_process_tree_scripts_directory(
+            module_file, all_environment={}
+        )
+    )
+    assert resolved_scripts_directory == expected_scripts_directory
+    assert not (
+        expected_scripts_directory / PROCESS_TREE_KILL_MODULE_FILENAME
+    ).is_file()

package/scripts/tests/test_codex_compat_materializer.py

@@ -1,4 +1,5 @@
 import json
+import os
 import subprocess
 import sys
 from pathlib import Path
@@ -841,23 +842,35 @@ def test_build_plan_publishes_owned_agents_projection_and_tracks_drift(
     assert drifted_projection != first_projection
 
 
-def test_codex_hook_manifest_keeps_dispatcher_order_and_adds_enforcer() -> None:
+def test_codex_hook_manifest_folds_apply_patch_into_the_dispatcher_matcher() -> None:
+    """apply_patch's code_rules_enforcer coverage comes from the dispatcher's own matcher.
+
+    hooks.json once ran a separate apply_patch -> code_rules_enforcer.py
+    PreToolUse command after the dispatcher entry. That coverage is now
+    folded into the dispatcher's own Write|Edit|MultiEdit|apply_patch
+    matcher, so no standalone apply_patch entry remains.
+    """
     hooks_path = Path(__file__).parents[2] / "hooks" / "hooks.json"
     hooks_configuration = json.loads(hooks_path.read_text(encoding="utf-8"))
     pre_tool_use_entries = hooks_configuration["hooks"]["PreToolUse"]
-    matcher_names = [each_entry.get("matcher") for each_entry in pre_tool_use_entries]
 
-    dispatcher_index = matcher_names.index("Write|Edit|MultiEdit")
-    enforcer_entries = [
+    dispatcher_entries = [
+        each_entry
+        for each_entry in pre_tool_use_entries
+        if any(
+            "/hooks/blocking/pre_tool_use_dispatcher.py" in each_hook.get("command", "")
+            for each_hook in each_entry.get("hooks", [])
+        )
+    ]
+    assert len(dispatcher_entries) == 1
+    assert dispatcher_entries[0]["matcher"] == "Write|Edit|MultiEdit|apply_patch"
+
+    standalone_apply_patch_entries = [
         each_entry
         for each_entry in pre_tool_use_entries
         if each_entry.get("matcher") == "apply_patch"
     ]
-    assert len(enforcer_entries) == 1
-    assert matcher_names.index("apply_patch") > dispatcher_index
-    assert enforcer_entries[0]["hooks"][0]["command"].endswith(
-        "/hooks/blocking/code_rules_enforcer.py"
-    )
+    assert standalone_apply_patch_entries == []
 
 
 def _prepare_projection_fixture(
@@ -1008,7 +1021,18 @@ def _assert_projection_and_manifest(
 
 
 def _assert_detached_enforcer_behavior(target: Path) -> None:
+    """Prove the detached, materialized enforcer allows a clean add and denies an unnamed raise.
+
+    Disables the ephemeral-path exemption for both runs: without it, a target
+    rooted under the OS temp directory (where this fixture lives) would skip
+    code_rules_enforcer's checks entirely and both assertions would pass
+    without the enforcer ever judging the payload.
+    """
     target_entrypoint = target / materializer.codex_enforcer_script_relative_path
+    subprocess_environment = {
+        **os.environ,
+        "CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1",
+    }
     allow_payload = {
         "tool_name": "apply_patch",
         "cwd": str(target),
@@ -1029,8 +1053,9 @@ def _assert_detached_enforcer_behavior(target: Path) -> None:
         capture_output=True,
         text=True,
         check=False,
+        env=subprocess_environment,
     )
-    assert allow_run.returncode == 0
+    assert allow_run.returncode == 0, allow_run.stderr
     assert allow_run.stdout == ""
 
     allow_tool_input = allow_payload["tool_input"]
@@ -1050,8 +1075,9 @@ def _assert_detached_enforcer_behavior(target: Path) -> None:
         capture_output=True,
         text=True,
         check=False,
+        env=subprocess_environment,
     )
-    assert deny_run.returncode == 0
+    assert deny_run.returncode == 0, deny_run.stderr
     assert json.loads(deny_run.stdout)["hookSpecificOutput"]["permissionDecision"] == "deny"
     assert target_entrypoint.is_file()
 

package/hooks/blocking/tests/conftest.py

@@ -1,10 +0,0 @@
-"""Put the blocking and hooks directories on sys.path for the blocking tests."""
-
-import sys
-from pathlib import Path
-
-_blocking_directory = str(Path(__file__).resolve().parents[1])
-_hooks_directory = str(Path(__file__).resolve().parents[2])
-for each_bootstrap_directory in (_blocking_directory, _hooks_directory):
-    if each_bootstrap_directory not in sys.path:
-        sys.path.insert(0, each_bootstrap_directory)