claude-dev-env 2.31.0 → 2.31.1

package/hooks/blocking/code_rules_shared.py

@@ -251,10 +251,50 @@ def _extract_fstring_literal_parts(
     return "".join(display_segments), "".join(shape_segments)
 
 
-def is_ephemeral_script_path(file_path: str) -> bool:
+def _normalized_absolute_comparison_path(raw_path: str) -> str:
+    """Return raw_path as an absolute, lowercase, forward-slash path for root comparison.
+
+    Strips a leading Windows drive letter after normalizing, so a POSIX root
+    check and a Windows root check compare on the same shape.
+
+    Args:
+        raw_path: The path to normalize.
+
+    Returns:
+        The absolute, lowercase, forward-slash path with any leading drive
+        letter removed.
+    """
+    return LEADING_DRIVE_LETTER_PATTERN.sub("", os.path.abspath(raw_path).replace("\\", "/").lower())
+
+
+def _is_at_or_under_root(normalized_candidate: str, normalized_root: str) -> bool:
+    """Return whether normalized_candidate sits at or under normalized_root.
+
+    Requires a path-segment boundary (an exact match or a ``/`` before the
+    remainder), so ``/tmp/repo-sibling`` never counts as under ``/tmp/repo``.
+
+    Args:
+        normalized_candidate: A path already run through
+            ``_normalized_absolute_comparison_path``.
+        normalized_root: A root path already run through
+            ``_normalized_absolute_comparison_path``.
+
+    Returns:
+        True when normalized_candidate equals normalized_root or names a
+        descendant of it.
+    """
+    return normalized_candidate == normalized_root or normalized_candidate.startswith(normalized_root + "/")
+
+
+def is_ephemeral_script_path(file_path: str, repository_root: str = "") -> bool:
     """Return True when the path is rooted at a throwaway scratch directory.
 
     Checks these sources in order:
+    - ``repository_root`` — when given, a path inside it is never ephemeral,
+      whatever directory the repository itself is checked out under. This
+      keeps a repository placed under ``/tmp`` fully gated: the exemption
+      below is for scratch outside every repository, not for the repository's
+      own files.
     - ``$CLAUDE_JOB_DIR/tmp`` — only when ``CLAUDE_JOB_DIR`` is set.
     - Root-anchored ``/tmp`` and ``/temp`` (drive-letter tolerant).
 
@@ -262,20 +302,28 @@ def is_ephemeral_script_path(file_path: str) -> bool:
     its sandbox fixtures there, so matching it would exempt the suite's own
     targets. Returns False when ``CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT``
     is truthy, when ``file_path`` is empty, and when no root matches. Path
-    classification is string-only; the file need not exist.
+    classification is string-only; neither path need exist.
 
     Args:
         file_path: The candidate path to classify.
+        repository_root: The session's working directory — typically the
+            PreToolUse payload's ``cwd`` — or empty when no such directory is
+            known. A path outside this directory is unaffected by it.
 
     Returns:
-        True when the path is rooted at a recognized ephemeral scratch directory.
+        True when the path is rooted at a recognized ephemeral scratch
+        directory and does not sit inside ``repository_root``.
     """
     if not file_path:
         return False
     disable_value = os.environ.get(EPHEMERAL_EXEMPT_DISABLE_ENVIRONMENT_VARIABLE_NAME, "").strip().lower()
     if disable_value in ALL_EPHEMERAL_EXEMPT_DISABLE_TRUTHY_VALUES:
         return False
-    normalized = LEADING_DRIVE_LETTER_PATTERN.sub("", os.path.abspath(file_path).replace("\\", "/").lower())
+    normalized = _normalized_absolute_comparison_path(file_path)
+    if repository_root and _is_at_or_under_root(
+        normalized, _normalized_absolute_comparison_path(repository_root)
+    ):
+        return False
     all_temp_roots: list[str] = []
     job_dir = os.environ.get(CLAUDE_JOB_DIR_ENVIRONMENT_VARIABLE_NAME)
     if job_dir:
@@ -286,7 +334,7 @@ def is_ephemeral_script_path(file_path: str) -> bool:
     for each_root in ALL_ROOT_ANCHORED_EPHEMERAL_DIRECTORIES:
         all_temp_roots.append(each_root)
     for each_temp_root in all_temp_roots:
-        if normalized == each_temp_root or normalized.startswith(each_temp_root + "/"):
+        if _is_at_or_under_root(normalized, each_temp_root):
             return True
     return False
 
@@ -426,23 +474,25 @@ def is_ephemeral_path(file_path: str, hook_payload: dict | None = None) -> bool:
     Combines the path families a repo gate skips: the root-anchored ephemeral
     scratch directories (``/tmp`` and ``$CLAUDE_JOB_DIR/tmp``), the harness
     session scratchpad, and a coding agent's own home-directory tooling such as
-    ``~/.grok/runs/``. The session scratchpad match reads the session id from the
-    payload when one is supplied, and from the harness environment variable
-    otherwise, so a caller that holds no payload still gets the match. The
-    run_all_validators PreToolUse gate calls this predicate to skip an exempt
-    target before it validates. The code-rules and TDD gates call the underlying
-    predicates ``is_ephemeral_script_path``, ``is_agent_home_tooling``, and
+    ``~/.grok/runs/``. A path inside the payload's own working directory
+    (``cwd``) is never treated as scratch, so a repository checked out under
+    ``/tmp`` still receives full enforcement. The scratchpad match reads the
+    session id from the payload when supplied, else the harness environment
+    variable. The code-rules and TDD gates call the underlying predicates
+    ``is_ephemeral_script_path``, ``is_agent_home_tooling``, and
     ``is_under_session_scratchpad`` directly.
 
     Args:
         file_path: The candidate path to classify.
-        hook_payload: The PreToolUse payload carrying the session id, or None to
-            read the session id from the environment alone.
+        hook_payload: The PreToolUse payload carrying the session id and the
+            working directory (``cwd``), or None to read the session id from
+            the environment alone.
 
     Returns:
         True when the path is scratch, agent tooling, or the session scratchpad.
     """
-    if is_ephemeral_script_path(file_path):
+    repository_root = str((hook_payload or {}).get("cwd") or "")
+    if is_ephemeral_script_path(file_path, repository_root):
         return True
     if is_agent_home_tooling(file_path):
         return True

package/hooks/blocking/pr_description_writer_gate.py

@@ -26,7 +26,6 @@ from __future__ import annotations
 import json
 import shlex
 import sys
-import tempfile
 from pathlib import Path
 
 _blocking_dir = str(Path(__file__).resolve().parent)
@@ -41,6 +40,9 @@ from hooks_constants.bash_pre_tool_use_dispatcher_constants import (  # noqa: E4
     ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
 )
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+from hooks_constants.pre_tool_use_stdin import (  # noqa: E402
+    read_hook_input_dictionary_from_stdin,
+)
 from hooks_constants.pr_description_writer_gate_constants import (  # noqa: E402
     ALL_GH_EXECUTABLE_BASENAMES,
     COMMAND_FIELD_NAME,
@@ -49,15 +51,14 @@ from hooks_constants.pr_description_writer_gate_constants import (  # noqa: E402
     GH_PR_CREATE_MINIMUM_TOKEN_COUNT,
     PR_SUBCOMMAND_TOKEN,
     SPAWN_BYPASS_MARKER,
-    SPAWN_MARKER_FILE_PREFIX,
-    SPAWN_MARKER_FILE_SUFFIX,
     TOOL_INPUT_FIELD_NAME,
     TOOL_NAME_FIELD_NAME,
+    spawn_marker_path,
 )
 from hooks_constants.session_edit_stage_gate_constants import (  # noqa: E402
     ALL_COMMAND_SEPARATOR_TOKENS,
-    SESSION_ID_UNSAFE_CHARACTERS_PATTERN,
 )
+from sensitive_file_protector import build_deny_response  # noqa: E402
 
 
 def _all_command_tokens(shell_command: str) -> list[str] | None:
@@ -149,7 +150,9 @@ def _all_pull_request_creation_segment_indexes(all_segments: list[list[str]]) ->
 
 
 def _only_final_create_carries_bypass(
-    all_tokens: list[str], all_creation_segment_indexes: list[int]
+    all_tokens: list[str],
+    all_segments: list[list[str]],
+    all_creation_segment_indexes: list[int],
 ) -> bool:
     """Report whether one final gh pr create carries the final bypass comment.
 
@@ -159,6 +162,7 @@ def _only_final_create_carries_bypass(
 
     Args:
         all_tokens: The tokens of the whole command.
+        all_segments: The command's token segments, already split by the caller.
         all_creation_segment_indexes: Indexes of segments that create pull requests.
 
     Returns:
@@ -166,7 +170,7 @@ def _only_final_create_carries_bypass(
     """
     if not _carries_trailing_bypass_marker(all_tokens):
         return False
-    final_segment_index = len(_all_command_segments(all_tokens)) - 1
+    final_segment_index = len(all_segments) - 1
     return all_creation_segment_indexes == [final_segment_index]
 
 
@@ -182,11 +186,8 @@ def _spawn_is_recorded(session_id: str) -> bool:
     Returns:
         True when this session's marker file is present.
     """
-    sanitized_session_id = SESSION_ID_UNSAFE_CHARACTERS_PATTERN.sub("", session_id)
-    if not sanitized_session_id:
-        return False
-    file_name = f"{SPAWN_MARKER_FILE_PREFIX}{sanitized_session_id}{SPAWN_MARKER_FILE_SUFFIX}"
-    return (Path(tempfile.gettempdir()) / file_name).exists()
+    marker_file = spawn_marker_path(session_id)
+    return marker_file is not None and marker_file.exists()
 
 
 def _shell_command_or_none(all_hook_payload: dict[str, object]) -> str | None:
@@ -211,19 +212,12 @@ def _shell_command_or_none(all_hook_payload: dict[str, object]) -> str | None:
 
 def _emit_denial() -> None:
     """Write the PreToolUse deny payload to stdout and log the block."""
-    deny_payload = {
-        "hookSpecificOutput": {
-            "hookEventName": "PreToolUse",
-            "permissionDecision": "deny",
-            "permissionDecisionReason": CORRECTIVE_MESSAGE,
-        }
-    }
     log_hook_block(
         calling_hook_name="pr_description_writer_gate.py",
         hook_event="PreToolUse",
         block_reason=CORRECTIVE_MESSAGE,
     )
-    sys.stdout.write(json.dumps(deny_payload) + "\n")
+    sys.stdout.write(json.dumps(build_deny_response(CORRECTIVE_MESSAGE)) + "\n")
     sys.stdout.flush()
 
 
@@ -235,11 +229,8 @@ def main() -> None:
     tokenize, a command opening no pull request, a trailing bypass marker, and
     a recorded spawn each pass through untouched.
     """
-    try:
-        hook_payload = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        sys.exit(0)
-    if not isinstance(hook_payload, dict):
+    hook_payload = read_hook_input_dictionary_from_stdin()
+    if hook_payload is None:
         sys.exit(0)
     shell_command = _shell_command_or_none(hook_payload)
     if shell_command is None:
@@ -251,7 +242,9 @@ def main() -> None:
     all_creation_segment_indexes = _all_pull_request_creation_segment_indexes(all_segments)
     if not all_creation_segment_indexes:
         sys.exit(0)
-    if _only_final_create_carries_bypass(all_tokens, all_creation_segment_indexes):
+    if _only_final_create_carries_bypass(
+        all_tokens, all_segments, all_creation_segment_indexes
+    ):
         sys.exit(0)
     if _spawn_is_recorded(str(hook_payload.get("session_id") or "")):
         sys.exit(0)

package/hooks/blocking/tdd_enforcer.py

@@ -80,8 +80,12 @@ def _resolve_payload(input_data: dict) -> tuple[str, dict, str]:
     return input_data.get("tool_name", ""), tool_input, tool_input.get("file_path", "")
 
 
-def _is_silently_skipped(file_path: str, extension: str, path: Path) -> bool:
-    if _is_inside_dotclaude_segment(file_path) or is_ephemeral_script_path(file_path):
+def _is_silently_skipped(
+    file_path: str, extension: str, path: Path, repository_root: str = ""
+) -> bool:
+    if _is_inside_dotclaude_segment(file_path) or is_ephemeral_script_path(
+        file_path, repository_root
+    ):
         return True
     if _is_agent_home_tooling_write(file_path):
         return True
@@ -135,13 +139,13 @@ def _decide_for_target(
         return None
     path = Path(file_path)
     extension = path.suffix.lower()
-    if _is_silently_skipped(file_path, extension, path):
+    repository_root = str(input_data.get("cwd") or "")
+    if _is_silently_skipped(file_path, extension, path, repository_root):
         return None
     if _write_is_exempt(tool_name, tool_input, path, extension):
         return True, ""
     all_candidates = candidate_test_paths_for(path)
     session_id = str(input_data.get("session_id") or "")
-    repository_root = str(input_data.get("cwd") or "")
     is_recorded_or_fresh = has_recorded_or_fresh_test(
         all_candidates, session_id, repository_root, _freshness_seconds()
     )

package/hooks/blocking/test_code_rules_enforcer_ephemeral.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import os
 import subprocess
 import sys
 import tempfile
@@ -168,8 +169,18 @@ def test_should_return_true_for_root_anchored_tmp_and_temp(
     raw_path: str,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    """B4: classifier returns True for root-anchored /tmp and /temp paths."""
+    """B4: classifier returns True for root-anchored /tmp and /temp paths.
+
+    A Windows drive-letter literal is absolute only on Windows. On POSIX,
+    os.path.abspath() joins a non-absolute path with the process cwd, so a
+    drive-letter case's pass or fail state depends on whatever directory the
+    runner happens to sit in. Skip it on a host that does not treat the
+    literal as absolute, so the assertion checks its own precondition rather
+    than the runner's ambient cwd.
+    """
     monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
+    if not os.path.isabs(raw_path):
+        pytest.skip(f"{raw_path!r} is not absolute on this host")
     assert is_ephemeral_script_path(raw_path) is True
 
 

package/hooks/blocking/test_code_rules_enforcer_ephemeral_repository_root.py

@@ -0,0 +1,118 @@
+"""Repository-root exemption tests for code_rules_enforcer and the classifier.
+
+A path inside the session's repository root is never ephemeral, whatever
+directory the repository itself is checked out under. These tests cover the
+classifier directly and the enforcer's real PreToolUse Write path, plus the
+guard cases a too-broad fix could break: an absent cwd, a cwd that covers no
+repository, and an unrelated sibling worktree that merely shares a name
+prefix under /tmp.
+"""
+
+from __future__ import annotations
+
+import json
+
+from blocking import _path_setup  # noqa: F401  (pins this checkout ahead of sibling worktrees)
+from blocking.code_rules_enforcer import main as enforcer_main
+from blocking.code_rules_shared import is_ephemeral_script_path
+from code_rules_enforcer_test_support import run_serialized_payload_entrypoint
+
+_VIOLATING_PRODUCTION_SOURCE = "def process_data(payload: str) -> None:\n    print(payload)\n"
+
+
+def _build_write_payload_with_cwd(file_path: str, content: str, cwd: str) -> str:
+    """Build the JSON payload for a Write tool call that also carries a cwd."""
+    return json.dumps(
+        {
+            "tool_name": "Write",
+            "tool_input": {"file_path": file_path, "content": content},
+            "cwd": cwd,
+        }
+    )
+
+
+def _run_main_with_write_payload_and_cwd(
+    file_path: str,
+    content: str,
+    cwd: str,
+) -> tuple[str, int]:
+    """Drive enforcer_main through its stdin entry point for a Write payload carrying cwd."""
+    captured_stdout, exit_code = run_serialized_payload_entrypoint(
+        enforcer_main, _build_write_payload_with_cwd(file_path, content, cwd)
+    )
+    return captured_stdout, int(exit_code or 0)
+
+
+def test_should_return_false_for_file_inside_repository_root_under_tmp() -> None:
+    """R1: a path inside repository_root is never ephemeral, even under /tmp."""
+    repository_root = "/tmp/pr-alpha"
+    file_path = "/tmp/pr-alpha/hooks/blocking/orders.py"
+    assert is_ephemeral_script_path(file_path, repository_root) is False
+
+
+def test_should_return_true_for_sibling_directory_outside_repository_root() -> None:
+    """R2: a /tmp sibling that merely shares repository_root's name prefix stays ephemeral."""
+    repository_root = "/tmp/pr-alpha"
+    sibling_file_path = "/tmp/pr-alpha-sibling/hooks/orders.py"
+    assert is_ephemeral_script_path(sibling_file_path, repository_root) is True
+
+
+def test_should_return_true_when_repository_root_does_not_cover_target() -> None:
+    """R3: an unrelated cwd must not blanket-exempt a /tmp target outside it."""
+    unrelated_repository_root = "/tmp/scratch-workspace"
+    scratch_target = "/tmp/scratch-elsewhere/notes.py"
+    assert is_ephemeral_script_path(scratch_target, unrelated_repository_root) is True
+
+
+def test_should_deny_pretooluse_target_inside_repository_root_under_tmp() -> None:
+    """B22: a production file inside a repository checked out under /tmp is gated for real."""
+    repository_root = "/tmp/pr-alpha"
+    file_path = f"{repository_root}/hooks/blocking/orders.py"
+    captured_stdout, exit_code = _run_main_with_write_payload_and_cwd(
+        file_path,
+        _VIOLATING_PRODUCTION_SOURCE,
+        repository_root,
+    )
+    assert "deny" in captured_stdout.lower(), (
+        f"enforcer must gate a repository file under /tmp, got exit_code={exit_code}, "
+        f"stdout={captured_stdout!r}"
+    )
+
+
+def test_should_stay_exempt_for_scratch_outside_repository_root() -> None:
+    """B23: a genuine scratch file outside the repository stays exempt."""
+    repository_root = "/tmp/pr-alpha"
+    scratch_target = "/tmp/scratch/one_off.py"
+    captured_stdout, exit_code = _run_main_with_write_payload_and_cwd(
+        scratch_target,
+        _VIOLATING_PRODUCTION_SOURCE,
+        repository_root,
+    )
+    assert exit_code == 0
+    assert "deny" not in captured_stdout.lower()
+
+
+def test_should_stay_exempt_when_working_directory_covers_no_repository() -> None:
+    """B24: a cwd that covers no repository must not exempt an unrelated /tmp target."""
+    unrelated_working_directory = "/tmp/scratch-workspace"
+    scratch_target = "/tmp/scratch-elsewhere/notes.py"
+    captured_stdout, exit_code = _run_main_with_write_payload_and_cwd(
+        scratch_target,
+        _VIOLATING_PRODUCTION_SOURCE,
+        unrelated_working_directory,
+    )
+    assert exit_code == 0
+    assert "deny" not in captured_stdout.lower()
+
+
+def test_should_stay_exempt_for_unrelated_worktree_sibling_under_tmp() -> None:
+    """B25: a sibling worktree sharing repository_root's name prefix stays exempt."""
+    repository_root = "/tmp/pr-alpha"
+    unrelated_sibling_target = "/tmp/pr-alpha-sibling/hooks/orders.py"
+    captured_stdout, exit_code = _run_main_with_write_payload_and_cwd(
+        unrelated_sibling_target,
+        _VIOLATING_PRODUCTION_SOURCE,
+        repository_root,
+    )
+    assert exit_code == 0
+    assert "deny" not in captured_stdout.lower()