claude-dev-env 2.31.0 → 2.32.0

package/hooks/blocking/stop_dispatcher.py

@@ -12,11 +12,14 @@ from __future__ import annotations
 
 import json
 import sys
-from pathlib import Path
 
 import _path_setup  # noqa: F401
 
-from hooks_constants.hosted_hook_runner import HostedHookRun, run_hook_capturing_output
+from hooks_constants.hosted_hook_runner import (
+    run_hook_capturing_output,
+    HostedHookRun,
+    resolved_hook_script_path,
+)
 from hooks_constants.stop_dispatcher_constants import (
     ALL_STOP_HOSTED_HOOK_PATHS,
     BLOCK_DECISION,
@@ -24,12 +27,6 @@ from hooks_constants.stop_dispatcher_constants import (
 )
 
 
-def _resolve_hook_script_path(relative_path: str) -> str:
-    """Resolve a hooks/-relative path to an absolute script path."""
-    hooks_root = Path(__file__).resolve().parent.parent
-    return str(hooks_root / relative_path)
-
-
 def _is_block_decision(stdout_text: str) -> bool:
     """Return True when stdout carries a Stop decision of block."""
     stripped_text = stdout_text.strip()
@@ -58,7 +55,7 @@ def dispatch(payload_text: str) -> None:
     """Run every Stop hosted hook and emit the first block decision if any."""
     all_runs: list[HostedHookRun] = []
     for each_relative_path in ALL_STOP_HOSTED_HOOK_PATHS:
-        script_path = _resolve_hook_script_path(each_relative_path)
+        script_path = resolved_hook_script_path(each_relative_path)
         hook_run = run_hook_capturing_output(script_path, payload_text)
         all_runs.append(hook_run)
     block_stdout = select_first_block_stdout(all_runs)

package/hooks/blocking/tdd_enforcer.py

@@ -4,7 +4,9 @@ Blocks a write to a production source file when no matching test was modified
 within the freshness window, enforcing "TDD IS NON-NEGOTIABLE" from CLAUDE.md.
 The gate records each candidate test's content hash at every sighting and
 compares that hash on the next write. A first sighting requires content that
-differs from HEAD.
+differs from HEAD. A recorded failing pytest run, written by
+``hooks/observability/test_failure_recorder.py``, is read before that fallback
+and applies while the candidate's content still matches what failed.
 Each concern lives in a ``tdd_enforcer_parts`` submodule; this entry wires them
 into one PreToolUse gate and re-exports their surface for the test suite.
 """
@@ -80,8 +82,12 @@ def _resolve_payload(input_data: dict) -> tuple[str, dict, str]:
     return input_data.get("tool_name", ""), tool_input, tool_input.get("file_path", "")
 
 
-def _is_silently_skipped(file_path: str, extension: str, path: Path) -> bool:
-    if _is_inside_dotclaude_segment(file_path) or is_ephemeral_script_path(file_path):
+def _is_silently_skipped(
+    file_path: str, extension: str, path: Path, repository_root: str = ""
+) -> bool:
+    if _is_inside_dotclaude_segment(file_path) or is_ephemeral_script_path(
+        file_path, repository_root
+    ):
         return True
     if _is_agent_home_tooling_write(file_path):
         return True
@@ -135,13 +141,13 @@ def _decide_for_target(
         return None
     path = Path(file_path)
     extension = path.suffix.lower()
-    if _is_silently_skipped(file_path, extension, path):
+    repository_root = str(input_data.get("cwd") or "")
+    if _is_silently_skipped(file_path, extension, path, repository_root):
         return None
     if _write_is_exempt(tool_name, tool_input, path, extension):
         return True, ""
     all_candidates = candidate_test_paths_for(path)
     session_id = str(input_data.get("session_id") or "")
-    repository_root = str(input_data.get("cwd") or "")
     is_recorded_or_fresh = has_recorded_or_fresh_test(
         all_candidates, session_id, repository_root, _freshness_seconds()
     )

package/hooks/blocking/tdd_enforcer_parts/config/tdd_enforcer_constants.py

@@ -3,6 +3,9 @@
 Centralizes the freshness window, the ancestor-walk limit, the git-tracking
 and git-diff command tokens, the source-file extension sets, the join
 separator, and the last-observed-hash store's filename shape and JSON keys.
+The store's JSON keys also cover a recorded failing-test-run entry: the test
+file's content hash at failure time, the failure timestamp, the failing
+command, and its exit status.
 """
 
 from __future__ import annotations
@@ -22,6 +25,10 @@ HASH_STATE_FILE_SUFFIX: str = ".json"
 REPOSITORY_ROOT_DIGEST_LENGTH: int = 16
 STORED_CONTENT_HASH_KEY: str = "hash"
 STORED_CHANGED_AT_KEY: str = "changed_at"
+STORED_FAILURE_HASH_KEY: str = "failed_hash"
+STORED_FAILED_AT_KEY: str = "failed_at"
+STORED_FAILURE_COMMAND_KEY: str = "failed_command"
+STORED_FAILURE_EXIT_STATUS_KEY: str = "failed_exit_status"
 PYTHON_SOURCE_EXTENSION: str = ".py"
 ENTRY_HOOK_FILE_NAME: str = "tdd_enforcer.py"
 NEWLINE_JOIN_SEPARATOR: str = "\n"

package/hooks/blocking/tdd_enforcer_parts/content_hash_store.py

@@ -30,6 +30,7 @@ import time
 from pathlib import Path
 
 from atomic_file_writer import write_text_atomically
+from hooks_constants.state_file_lock import hold_state_file_lock
 from hooks_constants.session_edit_stage_gate_constants import (
     SESSION_ID_UNSAFE_CHARACTERS_PATTERN,
     STATE_FILE_ATOMIC_WRITE_SUFFIX,
@@ -45,6 +46,10 @@ from tdd_enforcer_parts.config.tdd_enforcer_constants import (
     REPOSITORY_ROOT_DIGEST_LENGTH,
     STORED_CHANGED_AT_KEY,
     STORED_CONTENT_HASH_KEY,
+    STORED_FAILED_AT_KEY,
+    STORED_FAILURE_COMMAND_KEY,
+    STORED_FAILURE_EXIT_STATUS_KEY,
+    STORED_FAILURE_HASH_KEY,
 )
 
 
@@ -96,6 +101,26 @@ def _recorded_entry(current_hash: str, current_time: float) -> dict[str, object]
     return {STORED_CONTENT_HASH_KEY: current_hash, STORED_CHANGED_AT_KEY: current_time}
 
 
+def _has_matching_recorded_failure(
+    stored_entry: object, current_hash: str, current_time: float, freshness_seconds: int
+) -> bool:
+    """Return whether a recorded test failure still evidences the candidate's content.
+
+    A failure counts as evidence only while the candidate's content is
+    exactly what failed and the record has not aged past the freshness
+    window -- editing the test again, or letting the record go stale, drops
+    it as evidence and falls back to the ordinary content-hash tracking.
+    """
+    if not isinstance(stored_entry, dict):
+        return False
+    if stored_entry.get(STORED_FAILURE_HASH_KEY) != current_hash:
+        return False
+    failed_at = stored_entry.get(STORED_FAILED_AT_KEY)
+    if not isinstance(failed_at, (int, float)):
+        return False
+    return current_time - failed_at <= freshness_seconds
+
+
 def _is_qualifying_first_sight(
     candidate_path: Path, candidate_text: str, current_time: float, freshness_seconds: int
 ) -> bool:
@@ -107,6 +132,34 @@ def _is_qualifying_first_sight(
     return git_tracking.has_uncommitted_change_from_head(candidate_path)
 
 
+def _first_sight_decision(
+    candidate_path: Path,
+    candidate_text: str,
+    current_time: float,
+    freshness_seconds: int,
+    current_hash: str,
+) -> tuple[bool, dict[str, object] | None]:
+    if not _is_qualifying_first_sight(
+        candidate_path, candidate_text, current_time, freshness_seconds
+    ):
+        return False, None
+    return True, _recorded_entry(current_hash, current_time)
+
+
+def _content_hash_decision(
+    all_stored_entry_fields: dict[str, object],
+    current_hash: str,
+    current_time: float,
+    freshness_seconds: int,
+) -> tuple[bool, dict[str, object] | None]:
+    if current_hash != all_stored_entry_fields.get(STORED_CONTENT_HASH_KEY):
+        return True, _recorded_entry(current_hash, current_time)
+    stored_changed_at = all_stored_entry_fields.get(STORED_CHANGED_AT_KEY)
+    if not isinstance(stored_changed_at, (int, float)):
+        return False, None
+    return current_time - stored_changed_at <= freshness_seconds, None
+
+
 def _evaluate_candidate(
     candidate_path: Path,
     stored_entry: object,
@@ -117,18 +170,15 @@ def _evaluate_candidate(
     if candidate_text is None:
         return False, None
     current_hash = _content_hash(candidate_text)
-    if not isinstance(stored_entry, dict):
-        if _is_qualifying_first_sight(
-            candidate_path, candidate_text, current_time, freshness_seconds
-        ):
-            return True, _recorded_entry(current_hash, current_time)
-        return False, None
-    if current_hash != stored_entry.get(STORED_CONTENT_HASH_KEY):
-        return True, _recorded_entry(current_hash, current_time)
-    stored_changed_at = stored_entry.get(STORED_CHANGED_AT_KEY)
-    if not isinstance(stored_changed_at, (int, float)):
-        return False, None
-    return current_time - stored_changed_at <= freshness_seconds, None
+    if _has_matching_recorded_failure(
+        stored_entry, current_hash, current_time, freshness_seconds
+    ):
+        return True, None
+    if not isinstance(stored_entry, dict) or STORED_CONTENT_HASH_KEY not in stored_entry:
+        return _first_sight_decision(
+            candidate_path, candidate_text, current_time, freshness_seconds, current_hash
+        )
+    return _content_hash_decision(stored_entry, current_hash, current_time, freshness_seconds)
 
 
 def _apply_candidate_decisions(
@@ -142,7 +192,10 @@ def _apply_candidate_decisions(
     for each_candidate in all_candidates:
         candidate_key = _state_key_for(each_candidate)
         candidate_allowed, updated_entry = _evaluate_candidate(
-            each_candidate, all_stored_hashes.get(candidate_key), current_time, freshness_seconds
+            each_candidate,
+            all_stored_hashes.get(candidate_key),
+            current_time,
+            freshness_seconds,
         )
         if candidate_allowed:
             is_allowed = True
@@ -162,19 +215,84 @@ def has_recorded_or_fresh_test(
 
     Args:
         all_candidates: Candidate test paths for the production file.
-        session_id: Raw ``session_id`` from the hook payload.
-        repository_root: Raw ``cwd`` from the hook payload.
+        session_id: Raw session_id from the hook payload.
+        repository_root: Raw cwd from the hook payload.
         freshness_seconds: Maximum age, in seconds, a stored hash may have.
 
     Returns:
-        True when at least one candidate is a fresh, dirty first sighting, a
-        recorded hash that now differs, or a recorded hash still in window.
+        True when at least one candidate carries a matching recorded test
+        failure, is a fresh dirty first sighting, has a recorded hash that
+        now differs, or has a recorded hash still in window.
     """
     state_file = _state_file_path(session_id, repository_root)
-    all_stored_hashes = _load_state(state_file)
-    is_allowed, state_changed = _apply_candidate_decisions(
-        all_candidates, all_stored_hashes, time.time(), freshness_seconds
-    )
-    if state_changed:
-        _atomic_write_state(state_file, all_stored_hashes)
+    with hold_state_file_lock(state_file):
+        all_stored_hashes = _load_state(state_file)
+        is_allowed, state_changed = _apply_candidate_decisions(
+            all_candidates, all_stored_hashes, time.time(), freshness_seconds
+        )
+        if state_changed:
+            _atomic_write_state(state_file, all_stored_hashes)
     return is_allowed
+
+
+def _merged_failure_entry(
+    existing_entry: object,
+    candidate_text: str,
+    command: str,
+    exit_status: int,
+    current_time: float,
+) -> dict[str, object]:
+    merged_entry = dict(existing_entry) if isinstance(existing_entry, dict) else {}
+    merged_entry[STORED_FAILURE_HASH_KEY] = _content_hash(candidate_text)
+    merged_entry[STORED_FAILED_AT_KEY] = current_time
+    merged_entry[STORED_FAILURE_COMMAND_KEY] = command
+    merged_entry[STORED_FAILURE_EXIT_STATUS_KEY] = exit_status
+    return merged_entry
+
+
+def _record_one_test_file_failure(
+    test_file_path: Path,
+    all_stored_hashes: dict[str, object],
+    command: str,
+    exit_status: int,
+    current_time: float,
+) -> bool:
+    candidate_text = freshness._read_candidate_text(test_file_path)
+    if candidate_text is None:
+        return False
+    candidate_key = _state_key_for(test_file_path)
+    all_stored_hashes[candidate_key] = _merged_failure_entry(
+        all_stored_hashes.get(candidate_key),
+        candidate_text,
+        command,
+        exit_status,
+        current_time,
+    )
+    return True
+
+
+def record_test_command_failure(
+    all_test_file_paths: list[Path],
+    command: str,
+    exit_status: int,
+    session_id: str,
+    repository_root: str,
+) -> None:
+    """Record a failing test command as gate evidence, one entry per test file.
+
+    Keyed exactly as the gate looks candidates up, so a failure satisfies the
+    gate only for the file it names, never a sibling the command also ran.
+    Existing content-hash fields on that entry are preserved, not overwritten.
+    """
+    state_file = _state_file_path(session_id, repository_root)
+    current_time = time.time()
+    with hold_state_file_lock(state_file):
+        all_stored_hashes = _load_state(state_file)
+        all_recorded = [
+            _record_one_test_file_failure(
+                each_path, all_stored_hashes, command, exit_status, current_time
+            )
+            for each_path in all_test_file_paths
+        ]
+        if any(all_recorded):
+            _atomic_write_state(state_file, all_stored_hashes)

package/hooks/blocking/tdd_enforcer_parts/tests/test_content_hash_store.py

@@ -1,4 +1,11 @@
-"""Behavioral tests for the content_hash_store parts module."""
+"""Behavioral tests for the content_hash_store parts module.
+
+Covers the recorded-test-failure evidence path: a genuinely failing test
+command outranks a stale mtime, never satisfies a candidate it did not
+name, expires after the freshness window, and applies only while the
+candidate's content still matches what actually failed. Also covers the
+private decision helpers by name, so a rename keeps its own paired test.
+"""
 
 import json
 import os
@@ -141,3 +148,109 @@ def test_denies_when_no_candidate_file_exists(tmp_path: Path) -> None:
     )
 
     assert is_allowed is False
+
+
+def test_recorded_failure_allows_a_stale_candidate(tmp_path: Path) -> None:
+    """RED-evidence: a genuinely recorded failure outranks a stale mtime."""
+    candidate = _write_fresh_test_file(tmp_path)
+    stale_timestamp = time.time() - 700
+    os.utime(candidate, (stale_timestamp, stale_timestamp))
+    session_id, repository_root = "session-failure-1", str(tmp_path)
+    content_hash_store.record_test_command_failure(
+        [candidate], "pytest test_orders.py", 1, session_id, repository_root
+    )
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [candidate], session_id, repository_root, 600
+    )
+
+    assert is_allowed is True
+
+
+def test_recorded_failure_stores_the_command_and_exit_status(tmp_path: Path) -> None:
+    candidate = _write_fresh_test_file(tmp_path)
+    session_id, repository_root = "session-failure-2", str(tmp_path)
+
+    content_hash_store.record_test_command_failure(
+        [candidate], "pytest test_orders.py -q", 1, session_id, repository_root
+    )
+
+    state_file = content_hash_store._state_file_path(session_id, repository_root)
+    state = json.loads(state_file.read_text())
+    entry = state[content_hash_store._state_key_for(candidate)]
+    assert entry[content_hash_store.STORED_FAILURE_COMMAND_KEY] == "pytest test_orders.py -q"
+    assert entry[content_hash_store.STORED_FAILURE_EXIT_STATUS_KEY] == 1
+
+
+def test_recorded_failure_does_not_satisfy_a_different_candidate(tmp_path: Path) -> None:
+    """Anti-bypass: a failure recorded for one test file must not unlock a sibling."""
+    failing_candidate = tmp_path / "test_bar.py"
+    failing_candidate.write_text("def test_bar(): pass\n")
+    unrelated_candidate = tmp_path / "test_foo.py"
+    unrelated_candidate.write_text("def test_foo(): pass\n")
+    stale_timestamp = time.time() - 700
+    os.utime(unrelated_candidate, (stale_timestamp, stale_timestamp))
+    session_id, repository_root = "session-failure-3", str(tmp_path)
+    content_hash_store.record_test_command_failure(
+        [failing_candidate], "pytest test_bar.py", 1, session_id, repository_root
+    )
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [unrelated_candidate], session_id, repository_root, 600
+    )
+
+    assert is_allowed is False
+
+
+def test_recorded_failure_expires_after_the_freshness_window(tmp_path: Path) -> None:
+    candidate = _write_fresh_test_file(tmp_path)
+    stale_timestamp = time.time() - 700
+    os.utime(candidate, (stale_timestamp, stale_timestamp))
+    session_id, repository_root = "session-failure-4", str(tmp_path)
+    state_file = content_hash_store._state_file_path(session_id, repository_root)
+    candidate_key = content_hash_store._state_key_for(candidate)
+    stale_failed_at = time.time() - 700
+    state_file.write_text(
+        json.dumps(
+            {
+                candidate_key: {
+                    content_hash_store.STORED_FAILURE_HASH_KEY: content_hash_store._content_hash(
+                        candidate.read_text()
+                    ),
+                    content_hash_store.STORED_FAILED_AT_KEY: stale_failed_at,
+                }
+            }
+        )
+    )
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [candidate], session_id, repository_root, 600
+    )
+
+    assert is_allowed is False
+
+
+def test_recorded_failure_does_not_apply_once_content_no_longer_matches(
+    tmp_path: Path,
+) -> None:
+    """Anti-bypass: editing the test after a recorded RED clears that RED as evidence.
+
+    A bare failure-only entry (no prior content-hash tracking) must not fall
+    through to the unconditional hash-differs allow either -- it still needs a
+    real qualifying first sight (fresh mtime plus a real git-visible edit).
+    """
+    candidate = tmp_path / "test_orders.py"
+    candidate.write_text("def test_fulfill(): pass\n")
+    session_id, repository_root = "session-failure-5", str(tmp_path)
+    content_hash_store.record_test_command_failure(
+        [candidate], "pytest test_orders.py", 1, session_id, repository_root
+    )
+    candidate.write_text("def test_fulfill(): assert True\n")
+    stale_timestamp = time.time() - 700
+    os.utime(candidate, (stale_timestamp, stale_timestamp))
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [candidate], session_id, repository_root, 600
+    )
+
+    assert is_allowed is False

package/hooks/blocking/test_bash_post_call_dispatcher.py

@@ -0,0 +1,112 @@
+"""Behavior tests for the Bash PostToolUse dispatcher.
+
+One interpreter start runs every hosted PostToolUse hook a Bash call fires.
+The unit tests pin selection, call order, and crash isolation with a fake
+runner; the end-to-end test drives the real hosted hooks through a real
+payload and confirms the recorder's own real side effect lands.
+``hooks/conftest.py`` already puts the hooks and blocking directories on
+sys.path for test collection, so this file needs no bootstrap of its own.
+"""
+
+import io
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+from bash_post_call_dispatcher import dispatch, main, select_applicable_entries
+from hooks_constants.bash_pre_tool_use_dispatcher_constants import BASH_TOOL_NAME
+from hooks_constants.hosted_hook_runner import HostedHookRun
+from tdd_enforcer_parts import content_hash_store
+
+
+def test_select_applicable_entries_returns_both_hosted_hooks_for_bash() -> None:
+    all_entries = select_applicable_entries(BASH_TOOL_NAME)
+    all_script_paths = [each_entry.script_relative_path for each_entry in all_entries]
+    assert all_script_paths == [
+        "blocking/gh_pr_author_restore.py",
+        "observability/test_failure_recorder.py",
+    ]
+
+
+def test_select_applicable_entries_returns_none_for_a_write_tool() -> None:
+    assert select_applicable_entries("Write") == []
+
+
+def test_dispatch_runs_every_hosted_hook_in_roster_order(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    all_call_paths: list[str] = []
+
+    def _fake_run_hook(script_path: str, payload_text: str) -> HostedHookRun:
+        del payload_text
+        all_call_paths.append(Path(script_path).name)
+        return HostedHookRun(captured_stdout="", did_crash=False)
+
+    monkeypatch.setattr("bash_post_call_dispatcher.run_hook_capturing_output", _fake_run_hook)
+
+    dispatch('{"tool_name": "Bash"}', BASH_TOOL_NAME)
+
+    assert all_call_paths == ["gh_pr_author_restore.py", "test_failure_recorder.py"]
+
+
+def test_dispatch_runs_the_later_hook_after_an_earlier_one_crashes(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    all_call_paths: list[str] = []
+
+    def _fake_run_hook(script_path: str, payload_text: str) -> HostedHookRun:
+        del payload_text
+        script_name = Path(script_path).name
+        all_call_paths.append(script_name)
+        if script_name == "gh_pr_author_restore.py":
+            return HostedHookRun(captured_stdout="", did_crash=True)
+        return HostedHookRun(captured_stdout="", did_crash=False)
+
+    monkeypatch.setattr("bash_post_call_dispatcher.run_hook_capturing_output", _fake_run_hook)
+
+    dispatch('{"tool_name": "Bash"}', BASH_TOOL_NAME)
+
+    assert all_call_paths == ["gh_pr_author_restore.py", "test_failure_recorder.py"]
+
+
+def test_main_exits_zero_and_writes_nothing_to_stdout(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    payload = json.dumps({"tool_name": "Write", "tool_input": {}})
+    monkeypatch.setattr(sys, "stdin", io.StringIO(payload))
+
+    with pytest.raises(SystemExit) as raised_exit:
+        main()
+
+    assert int(raised_exit.value.code or 0) == 0
+    assert capsys.readouterr().out == ""
+
+
+def test_end_to_end_real_hosted_hooks_record_a_real_pytest_failure(tmp_path: Path) -> None:
+    """Drives the real, unfaked roster: both scripts run in one process."""
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "post-dispatcher-session"
+    failing_output = (
+        "Error: Exit code 1\n"
+        "FAILED test_orders.py::test_fulfill - AssertionError\n"
+        "1 failed in 0.02s"
+    )
+    payload = json.dumps(
+        {
+            "session_id": session_id,
+            "cwd": str(tmp_path),
+            "tool_name": "Bash",
+            "tool_input": {"command": "pytest test_orders.py"},
+            "tool_response": failing_output,
+        }
+    )
+
+    dispatch(payload, BASH_TOOL_NAME)
+
+    state_file = content_hash_store._state_file_path(session_id, str(tmp_path))
+    state = json.loads(state_file.read_text())
+    entry = state[content_hash_store._state_key_for(test_file)]
+    assert entry[content_hash_store.STORED_FAILURE_EXIT_STATUS_KEY] == 1

package/hooks/blocking/test_code_rules_enforcer_ephemeral.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import os
 import subprocess
 import sys
 import tempfile
@@ -168,8 +169,18 @@ def test_should_return_true_for_root_anchored_tmp_and_temp(
     raw_path: str,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    """B4: classifier returns True for root-anchored /tmp and /temp paths."""
+    """B4: classifier returns True for root-anchored /tmp and /temp paths.
+
+    A Windows drive-letter literal is absolute only on Windows. On POSIX,
+    os.path.abspath() joins a non-absolute path with the process cwd, so a
+    drive-letter case's pass or fail state depends on whatever directory the
+    runner happens to sit in. Skip it on a host that does not treat the
+    literal as absolute, so the assertion checks its own precondition rather
+    than the runner's ambient cwd.
+    """
     monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
+    if not os.path.isabs(raw_path):
+        pytest.skip(f"{raw_path!r} is not absolute on this host")
     assert is_ephemeral_script_path(raw_path) is True