claude-dev-env 2.30.1 → 2.31.1

package/hooks/blocking/test_code_rules_enforcer_cap_meta.py

@@ -24,6 +24,8 @@ consideration will trip this test.
 
 from __future__ import annotations
 
+import ast
+import functools
 import importlib.util
 import inspect
 import pathlib
@@ -31,12 +33,13 @@ import sys
 
 
 _HOOK_DIRECTORY = pathlib.Path(__file__).parent
+_ENFORCER_SOURCE_PATH = _HOOK_DIRECTORY / "code_rules_enforcer.py"
 if str(_HOOK_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(_HOOK_DIRECTORY))
 
 _hook_spec = importlib.util.spec_from_file_location(
     "code_rules_enforcer",
-    _HOOK_DIRECTORY / "code_rules_enforcer.py",
+    _ENFORCER_SOURCE_PATH,
 )
 assert _hook_spec is not None
 assert _hook_spec.loader is not None
@@ -45,11 +48,14 @@ _hook_spec.loader.exec_module(_hook_module)
 
 VOID_ADVISORY_CHECK_FUNCTION_NAMES: frozenset[str] = frozenset(
     {
+        "check_constants_outside_config_advisory",
         "check_duplicated_format_patterns",
         "check_flag_gated_scenario_test_naming",
     }
 )
 
+PAYLOAD_COLLECTING_METHOD_NAMES: frozenset[str] = frozenset({"extend", "append"})
+
 DIFF_SCOPED_CHECK_FUNCTION_NAMES: frozenset[str] = frozenset(
     {
         "check_banned_noun_word_boundary",
@@ -65,7 +71,6 @@ KNOWN_UNCAPPED_CHECKS_PENDING_REVIEW: frozenset[str] = frozenset(
         "check_comment_changes",
         "check_constant_equality_tests",
         "check_constants_outside_config",
-        "check_constants_outside_config_advisory",
         "check_existence_check_tests",
         "check_file_global_constants_use_count",
         "check_imports_at_top",
@@ -174,6 +179,80 @@ def test_void_advisory_checks_are_registered_and_disjoint() -> None:
     )
 
 
+@functools.lru_cache(maxsize=1)
+def _enforcer_syntax_tree() -> ast.Module:
+    """Parse code_rules_enforcer.py once and hand the same tree to every caller.
+
+    The source does not change while the suite runs, so re-reading and
+    re-parsing it for each test buys nothing.
+    """
+    return ast.parse(_ENFORCER_SOURCE_PATH.read_text(encoding="utf-8"))
+
+
+def _void_advisory_names_called_under(node: ast.AST) -> set[str]:
+    return {
+        each_node.func.id
+        for each_node in ast.walk(node)
+        if isinstance(each_node, ast.Call)
+        and isinstance(each_node.func, ast.Name)
+        and each_node.func.id in VOID_ADVISORY_CHECK_FUNCTION_NAMES
+    }
+
+
+def _payload_collecting_calls(syntax_tree: ast.Module) -> list[ast.Call]:
+    return [
+        each_node
+        for each_node in ast.walk(syntax_tree)
+        if isinstance(each_node, ast.Call)
+        and isinstance(each_node.func, ast.Attribute)
+        and each_node.func.attr in PAYLOAD_COLLECTING_METHOD_NAMES
+    ]
+
+
+def _void_advisory_names_fed_into_the_deny_payload(syntax_tree: ast.Module) -> set[str]:
+    """Return void-advisory names whose result is collected into the blocking payload.
+
+    The enforcer builds its deny payload by extending a list::
+
+        ok:   check_duplicated_format_patterns(content, file_path)
+        flag: all_issues.extend(check_duplicated_format_patterns(content, file_path))
+
+    The flagged form routes a stderr-only advisory into the payload that denies
+    the write, so the advisory stops being advisory.
+    """
+    fed_names: set[str] = set()
+    for each_call in _payload_collecting_calls(syntax_tree):
+        for each_argument in each_call.args:
+            fed_names |= _void_advisory_names_called_under(each_argument)
+    return fed_names
+
+
+def _bare_call_names(syntax_tree: ast.Module) -> set[str]:
+    return {
+        each_node.value.func.id
+        for each_node in ast.walk(syntax_tree)
+        if isinstance(each_node, ast.Expr)
+        and isinstance(each_node.value, ast.Call)
+        and isinstance(each_node.value.func, ast.Name)
+    }
+
+
+def test_void_advisory_checks_never_feed_the_deny_payload() -> None:
+    fed_names = _void_advisory_names_fed_into_the_deny_payload(_enforcer_syntax_tree())
+    assert fed_names == set(), (
+        f"Void-advisory checks must run for their stderr side effect alone, never collected "
+        f"into the blocking payload. Fed into extend/append: {sorted(fed_names)}"
+    )
+
+
+def test_void_advisory_checks_are_each_called_by_the_enforcer() -> None:
+    uncalled_names = VOID_ADVISORY_CHECK_FUNCTION_NAMES - _bare_call_names(_enforcer_syntax_tree())
+    assert uncalled_names == set(), (
+        f"Every void-advisory check must appear as a bare call in code_rules_enforcer.py so "
+        f"its findings reach stderr. Never called: {sorted(uncalled_names)}"
+    )
+
+
 def test_diff_scoped_checks_are_registered_and_disjoint() -> None:
     all_check_names = set(_all_check_function_names())
     assert DIFF_SCOPED_CHECK_FUNCTION_NAMES <= all_check_names, (

package/hooks/blocking/test_code_rules_enforcer_codex_apply_patch.py

@@ -20,6 +20,8 @@ if str(_HOOKS_PARENT) not in sys.path:
 import code_rules_enforcer
 import codex_apply_patch
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 
 def _run_codex_payload(
     payload: dict[str, object],
@@ -146,6 +148,39 @@ def test_codex_payload_blocks_malformed_patch(
     deny_payload = json.loads(stdout)
     assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
     assert "payload requires accepted patch markers" in deny_payload["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_codex_patch_operation_targets_names_every_section_without_reading_content(
+    tmp_path: Path, three_operation_patch: str
+) -> None:
+    """The path-only helper resolves every section's target without any disk read.
+
+    Unlike ``parse_codex_apply_patch``, it never reads prior file content, so a
+    caller that only needs each target path is not tripped up by an unreadable
+    prior file.
+    """
+    all_targets = codex_apply_patch.codex_patch_operation_targets(
+        three_operation_patch, str(tmp_path)
+    )
+
+    all_target_names = {
+        (each_operation, Path(each_path).name) for each_operation, each_path in all_targets
+    }
+    assert all_target_names == {
+        ("update", "updated.py"),
+        (codex_apply_patch.CODEX_ADD_OPERATION, "added.py"),
+        ("delete", "deleted.py"),
+    }
+
+
+def test_codex_patch_operation_targets_rejects_path_traversal(tmp_path: Path) -> None:
+    """A patch path that escapes the working directory is rejected before any read."""
+    escaping_patch = "*** Begin Patch\n*** Add File: ../outside.py\n+content\n*** End Patch"
+
+    with pytest.raises(codex_apply_patch.CodexPatchError):
+        codex_apply_patch.codex_patch_operation_targets(escaping_patch, str(tmp_path))
+
+
 def test_codex_payload_blocks_a_nul_containing_patch_path(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,

package/hooks/blocking/test_code_rules_enforcer_config_path.py

@@ -4,6 +4,7 @@ Covers:
 - is_config_file: must use directory-segment matching, not filename-stem matching
 - check_constants_outside_config: advisory (not blocking) for function-body UPPER_SNAKE
 - check_constants_outside_config: stable sort order by line number
+- validate_content_for_edit_lane: function-local advisories stay out of the deny payload
 """
 
 from __future__ import annotations
@@ -19,19 +20,22 @@ if _BLOCKING_DIRECTORY not in sys.path:
 if _HOOKS_DIRECTORY not in sys.path:
     sys.path.insert(0, _HOOKS_DIRECTORY)
 
-from code_rules_constants_config import (  # noqa: E402
-    check_constants_outside_config,
-    check_constants_outside_config_advisory,
-)
+from code_rules_constants_config import check_constants_outside_config  # noqa: E402
+from code_rules_enforcer import validate_content_for_edit_lane  # noqa: E402
 from code_rules_path_utils import is_config_file  # noqa: E402
 
 code_rules_enforcer = SimpleNamespace(
     check_constants_outside_config=check_constants_outside_config,
-    check_constants_outside_config_advisory=check_constants_outside_config_advisory,
     is_config_file=is_config_file,
 )
 
 PRODUCTION_FILE_PATH = "packages/claude-dev-env/src/example.py"
+FUNCTION_LOCAL_UPPER_SNAKE_SOURCE = (
+    "def fetch_data():\n"
+    "    MAX_RETRIES = 3\n"
+    "    for attempt in range(MAX_RETRIES):\n"
+    "        pass\n"
+)
 
 
 def test_should_return_false_for_filename_named_config_dot_py() -> None:
@@ -63,22 +67,22 @@ def test_should_return_true_for_config_dir_backslash() -> None:
 
 
 def test_should_produce_advisory_not_blocking_for_function_local_upper_snake() -> None:
-    source = (
-        "def fetch_data():\n"
-        "    MAX_RETRIES = 3\n"
-        "    for attempt in range(MAX_RETRIES):\n"
-        "        pass\n"
-    )
-    advisory_issues = code_rules_enforcer.check_constants_outside_config_advisory(
-        source, PRODUCTION_FILE_PATH
-    )
     blocking_issues = code_rules_enforcer.check_constants_outside_config(
-        source, PRODUCTION_FILE_PATH
+        FUNCTION_LOCAL_UPPER_SNAKE_SOURCE, PRODUCTION_FILE_PATH
     )
-    assert any("MAX_RETRIES" in issue for issue in advisory_issues)
     assert not any("MAX_RETRIES" in issue for issue in blocking_issues)
 
 
+def test_function_local_upper_snake_advisory_never_reaches_the_deny_payload() -> None:
+    edit_lane_issues = validate_content_for_edit_lane(
+        FUNCTION_LOCAL_UPPER_SNAKE_SOURCE, PRODUCTION_FILE_PATH
+    )
+    assert not any("MAX_RETRIES" in issue for issue in edit_lane_issues), (
+        f"Expected function-local MAX_RETRIES to stay out of the deny payload, "
+        f"got: {edit_lane_issues}"
+    )
+
+
 def test_should_produce_blocking_for_module_level_upper_snake_outside_config() -> None:
     source = "MAX_RETRIES = 3\n\ndef fetch_data():\n    pass\n"
     blocking_issues = code_rules_enforcer.check_constants_outside_config(
@@ -87,6 +91,15 @@ def test_should_produce_blocking_for_module_level_upper_snake_outside_config() -
     assert any("MAX_RETRIES" in issue for issue in blocking_issues)
 
 
+def test_module_level_upper_snake_still_reaches_the_deny_payload() -> None:
+    source = "MAXIMUM_RETRIES = 3\n\ndef fetch_data() -> int:\n    return MAXIMUM_RETRIES\n"
+    edit_lane_issues = validate_content_for_edit_lane(source, PRODUCTION_FILE_PATH)
+    assert any(
+        "MAXIMUM_RETRIES" in issue and "move to config/" in issue
+        for issue in edit_lane_issues
+    ), f"Expected module-level MAXIMUM_RETRIES to keep denying the write, got: {edit_lane_issues}"
+
+
 def test_should_produce_stable_ordering_sorted_by_line_number() -> None:
     source = (
         "ALPHA_CONSTANT = 1\n"

package/hooks/blocking/test_code_rules_enforcer_duplicate_body_hook_routing.py

@@ -36,6 +36,8 @@ from code_rules_enforcer_test_support import (  # noqa: E402
     run_write_entrypoint,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 SHARED_HELPER_SOURCE = (
     "import re\n"
     "\n"

package/hooks/blocking/test_code_rules_enforcer_ephemeral.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import os
 import subprocess
 import sys
 import tempfile
@@ -168,8 +169,18 @@ def test_should_return_true_for_root_anchored_tmp_and_temp(
     raw_path: str,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    """B4: classifier returns True for root-anchored /tmp and /temp paths."""
+    """B4: classifier returns True for root-anchored /tmp and /temp paths.
+
+    A Windows drive-letter literal is absolute only on Windows. On POSIX,
+    os.path.abspath() joins a non-absolute path with the process cwd, so a
+    drive-letter case's pass or fail state depends on whatever directory the
+    runner happens to sit in. Skip it on a host that does not treat the
+    literal as absolute, so the assertion checks its own precondition rather
+    than the runner's ambient cwd.
+    """
     monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
+    if not os.path.isabs(raw_path):
+        pytest.skip(f"{raw_path!r} is not absolute on this host")
     assert is_ephemeral_script_path(raw_path) is True
 
 

package/hooks/blocking/test_code_rules_enforcer_ephemeral_repository_root.py

@@ -0,0 +1,118 @@
+"""Repository-root exemption tests for code_rules_enforcer and the classifier.
+
+A path inside the session's repository root is never ephemeral, whatever
+directory the repository itself is checked out under. These tests cover the
+classifier directly and the enforcer's real PreToolUse Write path, plus the
+guard cases a too-broad fix could break: an absent cwd, a cwd that covers no
+repository, and an unrelated sibling worktree that merely shares a name
+prefix under /tmp.
+"""
+
+from __future__ import annotations
+
+import json
+
+from blocking import _path_setup  # noqa: F401  (pins this checkout ahead of sibling worktrees)
+from blocking.code_rules_enforcer import main as enforcer_main
+from blocking.code_rules_shared import is_ephemeral_script_path
+from code_rules_enforcer_test_support import run_serialized_payload_entrypoint
+
+_VIOLATING_PRODUCTION_SOURCE = "def process_data(payload: str) -> None:\n    print(payload)\n"
+
+
+def _build_write_payload_with_cwd(file_path: str, content: str, cwd: str) -> str:
+    """Build the JSON payload for a Write tool call that also carries a cwd."""
+    return json.dumps(
+        {
+            "tool_name": "Write",
+            "tool_input": {"file_path": file_path, "content": content},
+            "cwd": cwd,
+        }
+    )
+
+
+def _run_main_with_write_payload_and_cwd(
+    file_path: str,
+    content: str,
+    cwd: str,
+) -> tuple[str, int]:
+    """Drive enforcer_main through its stdin entry point for a Write payload carrying cwd."""
+    captured_stdout, exit_code = run_serialized_payload_entrypoint(
+        enforcer_main, _build_write_payload_with_cwd(file_path, content, cwd)
+    )
+    return captured_stdout, int(exit_code or 0)
+
+
+def test_should_return_false_for_file_inside_repository_root_under_tmp() -> None:
+    """R1: a path inside repository_root is never ephemeral, even under /tmp."""
+    repository_root = "/tmp/pr-alpha"
+    file_path = "/tmp/pr-alpha/hooks/blocking/orders.py"
+    assert is_ephemeral_script_path(file_path, repository_root) is False
+
+
+def test_should_return_true_for_sibling_directory_outside_repository_root() -> None:
+    """R2: a /tmp sibling that merely shares repository_root's name prefix stays ephemeral."""
+    repository_root = "/tmp/pr-alpha"
+    sibling_file_path = "/tmp/pr-alpha-sibling/hooks/orders.py"
+    assert is_ephemeral_script_path(sibling_file_path, repository_root) is True
+
+
+def test_should_return_true_when_repository_root_does_not_cover_target() -> None:
+    """R3: an unrelated cwd must not blanket-exempt a /tmp target outside it."""
+    unrelated_repository_root = "/tmp/scratch-workspace"
+    scratch_target = "/tmp/scratch-elsewhere/notes.py"
+    assert is_ephemeral_script_path(scratch_target, unrelated_repository_root) is True
+
+
+def test_should_deny_pretooluse_target_inside_repository_root_under_tmp() -> None:
+    """B22: a production file inside a repository checked out under /tmp is gated for real."""
+    repository_root = "/tmp/pr-alpha"
+    file_path = f"{repository_root}/hooks/blocking/orders.py"
+    captured_stdout, exit_code = _run_main_with_write_payload_and_cwd(
+        file_path,
+        _VIOLATING_PRODUCTION_SOURCE,
+        repository_root,
+    )
+    assert "deny" in captured_stdout.lower(), (
+        f"enforcer must gate a repository file under /tmp, got exit_code={exit_code}, "
+        f"stdout={captured_stdout!r}"
+    )
+
+
+def test_should_stay_exempt_for_scratch_outside_repository_root() -> None:
+    """B23: a genuine scratch file outside the repository stays exempt."""
+    repository_root = "/tmp/pr-alpha"
+    scratch_target = "/tmp/scratch/one_off.py"
+    captured_stdout, exit_code = _run_main_with_write_payload_and_cwd(
+        scratch_target,
+        _VIOLATING_PRODUCTION_SOURCE,
+        repository_root,
+    )
+    assert exit_code == 0
+    assert "deny" not in captured_stdout.lower()
+
+
+def test_should_stay_exempt_when_working_directory_covers_no_repository() -> None:
+    """B24: a cwd that covers no repository must not exempt an unrelated /tmp target."""
+    unrelated_working_directory = "/tmp/scratch-workspace"
+    scratch_target = "/tmp/scratch-elsewhere/notes.py"
+    captured_stdout, exit_code = _run_main_with_write_payload_and_cwd(
+        scratch_target,
+        _VIOLATING_PRODUCTION_SOURCE,
+        unrelated_working_directory,
+    )
+    assert exit_code == 0
+    assert "deny" not in captured_stdout.lower()
+
+
+def test_should_stay_exempt_for_unrelated_worktree_sibling_under_tmp() -> None:
+    """B25: a sibling worktree sharing repository_root's name prefix stays exempt."""
+    repository_root = "/tmp/pr-alpha"
+    unrelated_sibling_target = "/tmp/pr-alpha-sibling/hooks/orders.py"
+    captured_stdout, exit_code = _run_main_with_write_payload_and_cwd(
+        unrelated_sibling_target,
+        _VIOLATING_PRODUCTION_SOURCE,
+        repository_root,
+    )
+    assert exit_code == 0
+    assert "deny" not in captured_stdout.lower()

package/hooks/blocking/test_code_rules_enforcer_multi_edit.py

@@ -0,0 +1,118 @@
+"""Behavior tests for code_rules_enforcer's MultiEdit reconstruction.
+
+A MultiEdit payload carries an ``edits`` list rather than a single
+``old_string``/``new_string`` pair. These tests prove the enforcer reconstructs
+the whole post-edit file from every entry in that list — not only the first —
+so a violation introduced by the second or later edit is denied exactly like
+one introduced by the first.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Callable
+
+import pytest
+
+from code_rules_enforcer import main
+from code_rules_enforcer_test_support import run_serialized_payload_entrypoint
+
+_TWO_FUNCTION_SOURCE = (
+    "def first_helper() -> int:\n    return 1\n\n\ndef second_helper() -> int:\n    return 2\n"
+)
+
+
+def _production_directory(tmp_path: Path) -> Path:
+    """Return a sibling directory whose path carries no test-name substring.
+
+    ``code_rules_enforcer``'s own path-based exemptions treat any path segment
+    matching a test-name pattern as a test file, and pytest's ``tmp_path``
+    embeds the test function's name, so scanning directly under ``tmp_path``
+    would be silently exempted. A sibling directory named after ordinary
+    production code sidesteps that.
+    """
+    production_directory = tmp_path.parent / "multi-edit-prod"
+    production_directory.mkdir(exist_ok=True)
+    return production_directory
+
+
+def _run_multi_edit(
+    file_path: str,
+    all_edits: list[dict[str, str]],
+    multi_edit_payload: Callable[[str, list[dict[str, str]]], str],
+) -> str:
+    stdout_text, _exit_code = run_serialized_payload_entrypoint(
+        main, multi_edit_payload(file_path, all_edits)
+    )
+    return stdout_text
+
+
+def test_violation_in_second_edit_is_denied(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    multi_edit_payload: Callable[[str, list[dict[str, str]]], str],
+) -> None:
+    """A library print() introduced only by the second edit is caught and denied."""
+    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
+    target_file = _production_directory(tmp_path) / "services.py"
+    target_file.write_text(_TWO_FUNCTION_SOURCE, encoding="utf-8")
+
+    stdout_text = _run_multi_edit(
+        str(target_file),
+        [
+            {"old_string": "return 1", "new_string": "return 11"},
+            {
+                "old_string": "    return 2",
+                "new_string": "    print(2)\n    return 2",
+            },
+        ],
+        multi_edit_payload,
+    )
+
+    assert stdout_text.strip(), "expected a deny payload, got no output"
+    deny_payload = json.loads(stdout_text)
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+    deny_reason = deny_payload["hookSpecificOutput"]["permissionDecisionReason"].lower()
+    assert "print" in deny_reason
+
+
+def test_multi_edit_on_a_missing_target_is_allowed(
+    tmp_path: Path, multi_edit_payload: Callable[[str, list[dict[str, str]]], str]
+) -> None:
+    """A MultiEdit naming a target file that does not exist on disk is not denied.
+
+    The reconstruction has no prior content to read, so it returns no
+    validatable view rather than crashing or denying a payload it cannot judge.
+    """
+    missing_target = _production_directory(tmp_path) / "not_on_disk.py"
+
+    stdout_text = _run_multi_edit(
+        str(missing_target),
+        [{"old_string": "return 1", "new_string": "return 11"}],
+        multi_edit_payload,
+    )
+
+    assert stdout_text.strip() == ""
+
+
+def test_clean_multi_edit_is_allowed(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    multi_edit_payload: Callable[[str, list[dict[str, str]]], str],
+) -> None:
+    """A MultiEdit whose reconstructed file carries no violation is allowed."""
+    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
+    target_file = _production_directory(tmp_path) / "services.py"
+    target_file.write_text(_TWO_FUNCTION_SOURCE, encoding="utf-8")
+
+    stdout_text = _run_multi_edit(
+        str(target_file),
+        [
+            {"old_string": "return 1", "new_string": "return 11"},
+            {"old_string": "return 2", "new_string": "return 22"},
+        ],
+        multi_edit_payload,
+    )
+
+    assert stdout_text.strip() == ""

package/hooks/blocking/test_code_rules_enforcer_narrow_edit.py

@@ -23,6 +23,8 @@ from code_rules_enforcer import (  # noqa: E402
     validate_content_for_full_gate as validate_content,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 
 PRODUCTION_FILE_PATH = "packages/app/services.py"
 

package/hooks/blocking/test_code_rules_enforcer_precheck_forecast.py

@@ -26,6 +26,8 @@ from code_rules_enforcer_test_support import (  # noqa: E402
     run_serialized_payload_entrypoint,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 _ENFORCER_SCRIPT_PATH = Path(__file__).resolve().parent / "code_rules_enforcer.py"
 
 _VIOLATING_PRODUCTION_SOURCE = "def process_data(payload: str) -> None:\n    print(payload)\n"