claude-dev-env 2.31.1 → 2.32.0

package/hooks/observability/test_test_failure_recorder.py

@@ -0,0 +1,173 @@
+"""Behavior tests for the test_failure_recorder PostToolUse hook.
+
+Drives the hook's main through real stdin payloads shaped like a genuine
+Bash PostToolUse call, then reads the shared content-hash store back to
+confirm what -- if anything -- it recorded. The store's real state file
+under the OS temp directory is read directly, the same way
+test_content_hash_store.py and test_tdd_enforcer.py already do, rather than
+mocking tempfile.gettempdir. ``hooks/conftest.py`` already puts the hooks
+and blocking directories on sys.path for test collection, so this file needs
+no bootstrap of its own before importing content_hash_store.
+"""
+
+import contextlib
+import importlib.util
+import io
+import json
+from pathlib import Path
+from unittest import mock
+
+from tdd_enforcer_parts import content_hash_store
+
+_HOOK_DIRECTORY = Path(__file__).parent
+_hook_spec = importlib.util.spec_from_file_location(
+    "test_failure_recorder_under_test", _HOOK_DIRECTORY / "test_failure_recorder.py"
+)
+assert _hook_spec is not None
+assert _hook_spec.loader is not None
+_hook_module = importlib.util.module_from_spec(_hook_spec)
+_hook_spec.loader.exec_module(_hook_module)
+
+
+def _run_hook_with_payload(payload: dict) -> None:
+    with (
+        mock.patch("sys.stdin", io.StringIO(json.dumps(payload))),
+        contextlib.suppress(SystemExit),
+    ):
+        _hook_module.main()
+
+
+def _recorded_failure_entry(test_file: Path, session_id: str, repository_root: str) -> dict | None:
+    state_file = content_hash_store._state_file_path(session_id, repository_root)
+    if not state_file.exists():
+        return None
+    state = json.loads(state_file.read_text())
+    return state.get(content_hash_store._state_key_for(test_file))
+
+
+def _bash_payload(command: str, tool_response: object, cwd: Path, session_id: str) -> dict:
+    return {
+        "session_id": session_id,
+        "cwd": str(cwd),
+        "tool_name": "Bash",
+        "tool_input": {"command": command},
+        "tool_response": tool_response,
+    }
+
+
+_FAILING_OUTPUT = (
+    "Error: Exit code 1\n"
+    "F                                                                    [100%]\n"
+    "=================================== FAILURES ===================================\n"
+    "FAILED test_orders.py::test_fulfill - AssertionError\n"
+    "1 failed in 0.02s"
+)
+_PASSING_OUTPUT = {"stdout": "1 passed in 0.02s", "stderr": "", "interrupted": False}
+
+
+def test_records_a_failure_for_a_bare_pytest_command_naming_a_real_file(
+    tmp_path: Path,
+) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "recorder-session-1"
+
+    _run_hook_with_payload(
+        _bash_payload("pytest test_orders.py", _FAILING_OUTPUT, tmp_path, session_id)
+    )
+
+    entry = _recorded_failure_entry(test_file, session_id, str(tmp_path))
+    assert entry is not None
+    assert entry[content_hash_store.STORED_FAILURE_EXIT_STATUS_KEY] == 1
+    assert entry[content_hash_store.STORED_FAILURE_COMMAND_KEY] == "pytest test_orders.py"
+
+
+def test_does_not_record_for_a_passing_command(tmp_path: Path) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): pass\n")
+    session_id = "recorder-session-2"
+
+    _run_hook_with_payload(
+        _bash_payload("pytest test_orders.py", _PASSING_OUTPUT, tmp_path, session_id)
+    )
+
+    assert _recorded_failure_entry(test_file, session_id, str(tmp_path)) is None
+
+
+def test_does_not_record_for_a_non_pytest_command(tmp_path: Path) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "recorder-session-3"
+
+    _run_hook_with_payload(
+        _bash_payload("npm test", "Error: Exit code 1\n1 failing", tmp_path, session_id)
+    )
+
+    assert _recorded_failure_entry(test_file, session_id, str(tmp_path)) is None
+
+
+def test_does_not_record_for_a_chained_command(tmp_path: Path) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "recorder-session-4"
+
+    _run_hook_with_payload(
+        _bash_payload("cd /repo && pytest test_orders.py", _FAILING_OUTPUT, tmp_path, session_id)
+    )
+
+    assert _recorded_failure_entry(test_file, session_id, str(tmp_path)) is None
+
+
+def test_does_not_record_for_a_bare_pytest_run_with_no_path_argument(
+    tmp_path: Path,
+) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "recorder-session-5"
+
+    _run_hook_with_payload(_bash_payload("pytest -q", _FAILING_OUTPUT, tmp_path, session_id))
+
+    assert _recorded_failure_entry(test_file, session_id, str(tmp_path)) is None
+
+
+def test_records_only_the_named_file_not_an_option_or_expression_token(
+    tmp_path: Path,
+) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "recorder-session-6"
+
+    _run_hook_with_payload(
+        _bash_payload("pytest test_orders.py -k fulfill", _FAILING_OUTPUT, tmp_path, session_id)
+    )
+
+    entry = _recorded_failure_entry(test_file, session_id, str(tmp_path))
+    assert entry is not None
+    state_file = content_hash_store._state_file_path(session_id, str(tmp_path))
+    state = json.loads(state_file.read_text())
+    assert len(state) == 1
+
+
+def test_ignores_a_tool_other_than_bash(tmp_path: Path) -> None:
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "recorder-session-7"
+    payload = _bash_payload("pytest test_orders.py", _FAILING_OUTPUT, tmp_path, session_id)
+    payload["tool_name"] = "Write"
+
+    _run_hook_with_payload(payload)
+
+    assert _recorded_failure_entry(test_file, session_id, str(tmp_path)) is None
+
+
+def test_does_not_record_when_the_named_file_does_not_exist_on_disk(
+    tmp_path: Path,
+) -> None:
+    session_id = "recorder-session-8"
+    missing_file = tmp_path / "test_missing.py"
+
+    _run_hook_with_payload(
+        _bash_payload("pytest test_missing.py", _FAILING_OUTPUT, tmp_path, session_id)
+    )
+
+    assert _recorded_failure_entry(missing_file, session_id, str(tmp_path)) is None

package/hooks/validators/config/directory_exemption_constants.py

@@ -38,15 +38,6 @@ ALL_PYTEST_SANITIZED_TEST_NAME_CHARACTERS: frozenset[str] = frozenset(
     LOWERCASE_ASCII_LETTER_CHARACTERS + DECIMAL_DIGIT_CHARACTERS + UNDERSCORE_CHARACTER
 )
 
-ALL_SYSTEM_TEMPORARY_ROOT_ENVIRONMENT_VARIABLE_NAMES: frozenset[str] = frozenset(
-    {
-        "TEMP",
-        "TMP",
-        "TMPDIR",
-        "RUNNER_TEMP",
-    }
-)
-
 ALL_AUTHORITATIVE_DIRECTORY_PATH_PATTERN_SETS: tuple[Iterable[str], ...] = (
     TEST_PATH_PATTERNS,
     WORKFLOW_REGISTRY_PATTERNS,

package/hooks/validators/config/system_temporary_roots_constants.py

@@ -0,0 +1,15 @@
+"""Constants naming where the system keeps temporary directories."""
+
+from __future__ import annotations
+
+# A run reaches its temp root through any of these, so a walk that stops at
+# that boundary checks all four rather than gettempdir() alone. RUNNER_TEMP
+# is the hosted-CI case: pytest writes there while gettempdir() stays /tmp.
+ALL_SYSTEM_TEMPORARY_ROOT_ENVIRONMENT_VARIABLE_NAMES: frozenset[str] = frozenset(
+    {
+        "TEMP",
+        "TMP",
+        "TMPDIR",
+        "RUNNER_TEMP",
+    }
+)

package/hooks/validators/mypy_integration.py

@@ -13,28 +13,26 @@ _validators_directory = str(Path(__file__).resolve().parent)
 _hooks_directory = str(Path(__file__).resolve().parent.parent)
 
 try:
+    from project_roots import enclosing_project_root
     from pyproject_config_discovery import (
-        ancestor_directories,
+        ancestor_directories,  # noqa: F401  re-exported for validation/mypy_validator
         find_pyproject_configuring_tool,
     )
-    from system_temporary_roots import enclosing_system_temporary_root
 except ModuleNotFoundError:
     if _validators_directory not in sys.path:
         sys.path.insert(0, _validators_directory)
+    from project_roots import enclosing_project_root
     from pyproject_config_discovery import (
-        ancestor_directories,
+        ancestor_directories,  # noqa: F401  re-exported for validation/mypy_validator
         find_pyproject_configuring_tool,
     )
-    from system_temporary_roots import enclosing_system_temporary_root
 
 try:
     from hooks_constants.mypy_integration_constants import (
         FOLLOW_IMPORTS_FLAG,
         FOLLOW_IMPORTS_SKIP_VALUE,
-        GIT_DIRECTORY_NAME,
         MYPY_DETACHED_SUBPROCESS_TIMEOUT_SECONDS,
         MYPY_DETACHED_TIMEOUT_SKIP_MESSAGE,
-        PYPROJECT_FILENAME,
         PYTHON_SOURCE_SUFFIX,
     )
     from hooks_constants.pyproject_config_discovery_constants import MYPY_TOOL_TABLE_NAME
@@ -44,10 +42,8 @@ except ModuleNotFoundError:
     from hooks_constants.mypy_integration_constants import (
         FOLLOW_IMPORTS_FLAG,
         FOLLOW_IMPORTS_SKIP_VALUE,
-        GIT_DIRECTORY_NAME,
         MYPY_DETACHED_SUBPROCESS_TIMEOUT_SECONDS,
         MYPY_DETACHED_TIMEOUT_SKIP_MESSAGE,
-        PYPROJECT_FILENAME,
         PYTHON_SOURCE_SUFFIX,
     )
     from hooks_constants.pyproject_config_discovery_constants import MYPY_TOOL_TABLE_NAME
@@ -97,41 +93,19 @@ def find_pyproject_with_mypy_config(starting_file: Path) -> Path | None:
 
 
 def find_module_resolution_root(starting_file: Path) -> Path | None:
-    """Return the nearest ancestor directory that roots a project, else None.
+    """Return the project root mypy resolves this file's first-party imports against.
 
-    A project root is the first ancestor holding a ``.git`` entry or a
-    ``pyproject.toml``. Mypy resolves a first-party import against its working
-    directory, so anchoring there binds ``config.*`` to the target file's own
-    project and keeps a foreign ``config`` in the caller's directory out of scope.
-
-    The walk does not climb out of the system temp directory. A PreToolUse
-    staging copy lives under ``%TEMP%``, and a ``.git`` in the user home above
-    that temp root is not this file's project.
-
-    ::
-
-        target_repo/.git + target_repo/tools/x.py -> target_repo
-        /tmp/detached/x.py (home .git above temp) -> None
-        flag: walk past %TEMP% into ~/.git        -> mypy cwd=home, hook timeout
+    Mypy resolves a first-party import against its working directory, so
+    anchoring there binds ``config.*`` to the target file's own project and
+    keeps a foreign ``config`` in the caller's directory out of scope.
 
     Args:
         starting_file: The file (or directory) the walk begins from.
 
     Returns:
-        The nearest ancestor Path that holds ``.git`` or ``pyproject.toml``,
-        or ``None`` when no such ancestor exists inside the walk limit.
+        The project root, or None when the file sits inside none.
     """
-    git_entry_name = GIT_DIRECTORY_NAME
-    pyproject_filename = PYPROJECT_FILENAME
-    enclosing_temporary_root = enclosing_system_temporary_root(starting_file)
-    for each_candidate_directory in ancestor_directories(starting_file):
-        has_git_entry = (each_candidate_directory / git_entry_name).exists()
-        has_pyproject = (each_candidate_directory / pyproject_filename).is_file()
-        if has_git_entry or has_pyproject:
-            return each_candidate_directory
-        if each_candidate_directory == enclosing_temporary_root:
-            return None
-    return None
+    return enclosing_project_root(starting_file)
 
 
 def _first_module_resolution_root(all_py_files: list[str]) -> Path | None:

package/hooks/validators/project_roots.py

@@ -0,0 +1,58 @@
+"""Resolve the project root that contains a path, if any.
+
+A project root is the nearest ancestor holding a ``.git`` entry or a
+``pyproject.toml``. Callers need that anchor for unrelated reasons: binding a
+first-party import, deciding which directory segments a project owns. One
+module answers it rather than each re-coding the walk.
+
+::
+
+    target_repo/.git + target_repo/tools/x.py  -> target_repo
+    /tmp/detached/x.py (home .git above temp)  -> None
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_validators_directory = str(Path(__file__).resolve().parent)
+_hooks_directory = str(Path(__file__).resolve().parent.parent)
+for each_directory in (_validators_directory, _hooks_directory):
+    if each_directory not in sys.path:
+        sys.path.insert(0, each_directory)
+
+from pyproject_config_discovery import ancestor_directories  # noqa: E402
+from system_temporary_roots import (  # noqa: E402
+    enclosing_system_temporary_root,
+)
+
+from hooks_constants.mypy_integration_constants import (  # noqa: E402
+    GIT_DIRECTORY_NAME,
+    PYPROJECT_FILENAME,
+)
+
+
+def enclosing_project_root(starting_file: Path) -> Path | None:
+    """Return the nearest ancestor directory that roots a project, else None.
+
+    The walk stops at the system temp root. A staging copy lives under a temp
+    directory, and a ``.git`` in the user home above that root roots no
+    project of the staged file's.
+
+    Args:
+        starting_file: The file (or directory) the walk begins from.
+
+    Returns:
+        The nearest ancestor holding ``.git`` or ``pyproject.toml``, or None
+        when the walk reaches the temp root or runs out of ancestors.
+    """
+    enclosing_temporary_root = enclosing_system_temporary_root(starting_file)
+    for each_candidate_directory in ancestor_directories(starting_file):
+        has_git_entry = (each_candidate_directory / GIT_DIRECTORY_NAME).exists()
+        has_pyproject = (each_candidate_directory / PYPROJECT_FILENAME).is_file()
+        if has_git_entry or has_pyproject:
+            return each_candidate_directory
+        if each_candidate_directory == enclosing_temporary_root:
+            return None
+    return None

package/hooks/validators/run_all_validators.py

@@ -16,6 +16,7 @@ import tempfile
 import time
 from collections import Counter
 from dataclasses import dataclass
+from functools import lru_cache
 from datetime import datetime
 from pathlib import Path
 from typing import Callable, Dict, List, Optional, Tuple
@@ -35,16 +36,24 @@ from .config.directory_exemption_constants import (
 )
 from .fast_save_validators import run_fast_save_validators
 from .health_check import get_system_health, get_validator_version, print_health_report
-from .mypy_integration import (
-    check_mypy_available,
-    find_module_resolution_root,
-    run_mypy_check,
-)
+from .mypy_integration import check_mypy_available, run_mypy_check
 from .output_formatter import OutputFormatter, OutputMode, ValidatorResultDict
+from .project_roots import enclosing_project_root
 from .python_style_checks import fix_file
 from .ruff_integration import run_ruff_check
+from .config.validator_base_constants import SOURCE_CACHE_ENTRIES
 from .validator_base import ValidatorResult
 from blocking.code_rules_shared import is_ephemeral_path
+from blocking.codex_apply_patch import (
+    CODEX_DELETE_OPERATION,
+    CodexPatchError,
+    CodexPatchFile,
+    parse_codex_apply_patch,
+    payload_patch_command,
+)
+from hooks_constants.pre_tool_use_dispatcher_constants import (
+    APPLY_PATCH_TOOL_NAME,
+)
 from hooks_constants.hook_block_logger import log_hook_block
 from hooks_constants.multi_edit_reconstruction import (
     apply_edits,
@@ -793,8 +802,8 @@ def _path_parts_the_project_owns(destination_path: Path) -> tuple[str, ...]:
 
     ::
 
-        ok:   "/home/tests/proj/src/worker.py" (proj is the root) -> ("src", "worker.py")
-        ok:   "/home/dana/.claude/hooks/gate.py" (no root)  -> (".claude", "hooks", "gate.py")
+        ok:   "/srv/tests/proj/src/worker.py" (proj is the root) -> ("src", "worker.py")
+        ok:   "/srv/anna/.claude/hooks/gate.py" (no root)  -> (".claude", "hooks", "gate.py")
         ok:   "config/x.py" (relative)                      -> ("config", "x.py")
 
     Directory names above the project root were chosen by whoever laid out the
@@ -819,13 +828,13 @@ def _path_parts_the_project_owns(destination_path: Path) -> tuple[str, ...]:
     if not destination_path.anchor:
         return all_path_parts
     all_path_parts = all_path_parts[1:]
-    project_root = find_module_resolution_root(destination_path)
+    project_root = enclosing_project_root(destination_path)
     if project_root is None:
         return all_path_parts
-    try:
-        return destination_path.resolve().relative_to(project_root).parts
-    except ValueError:
+    resolved_destination = destination_path.resolve()
+    if not resolved_destination.is_relative_to(project_root):
         return all_path_parts
+    return resolved_destination.relative_to(project_root).parts
 
 
 def _temporary_path_preserving_directory_signal(
@@ -1158,6 +1167,7 @@ def _line_identity(
     )
 
 
+@lru_cache(maxsize=SOURCE_CACHE_ENTRIES)
 def _scope_agnostic_message(identity_scope: str, violation_message: str) -> str:
     """Return the message with its own function's name and shape metrics masked.
 
@@ -1199,22 +1209,6 @@ def _scope_agnostic_message(identity_scope: str, violation_message: str) -> str:
     )
 
 
-def _shape_key(violation_identity: ViolationIdentity) -> tuple[str, str]:
-    """Return an identity's ``(validator, scope-agnostic message)`` shape key.
-
-    Args:
-        violation_identity: One violation's full identity key.
-
-    Returns:
-        The key a violation keeps when only its enclosing function's name
-        changes, so a rename, a split, or a move still finds its baseline.
-    """
-    return (
-        violation_identity[0],
-        _scope_agnostic_message(violation_identity[1], violation_identity[2]),
-    )
-
-
 def _violation_identities(
     failed_results: List[ValidatorResult], content: str
 ) -> Counter[ViolationIdentity]:
@@ -1283,9 +1277,12 @@ def _compatible_baseline_identity(
     for each_identity in all_available_identities:
         if each_identity[1] == line_identity[1]:
             return each_identity
-    line_shape_key = _shape_key(line_identity)
+    line_shape_message = _scope_agnostic_message(line_identity[1], line_identity[2])
     for each_identity in all_available_identities:
-        if _shape_key(each_identity) == line_shape_key:
+        if (
+            _scope_agnostic_message(each_identity[1], each_identity[2])
+            == line_shape_message
+        ):
             return each_identity
     return None
 
@@ -1448,26 +1445,80 @@ def _emit_pre_existing_warning(all_preexisting_results: List[ValidatorResult]) -
     sys.stderr.flush()
 
 
-def _decide_pre_tool_use(file_path: str, proposed_content: str) -> None:
+def _decide_pre_tool_use(file_path: str, proposed_content: str) -> bool:
     """Deny only violations absent from the baseline; warn on the ones that persist.
 
     Args:
         file_path: The write's target path.
         proposed_content: The reconstructed post-edit content of that file.
+
+    Returns:
+        True when this target denies, so a caller holding several targets stops
+        at the first one and emits a single decision.
     """
     all_proposed_failed = _failed_results(
         validate_proposed_file(file_path, proposed_content)
     )
     if not all_proposed_failed:
-        return
+        return False
     baseline_identities = _baseline_violation_identities(file_path)
     all_new_results, all_preexisting_results = _scope_new_and_preexisting(
         all_proposed_failed, proposed_content, baseline_identities
     )
     if all_preexisting_results:
         _emit_pre_existing_warning(all_preexisting_results)
-    if all_new_results:
-        _emit_pre_tool_use_deny(_proposed_content_deny_reason(all_new_results))
+    if not all_new_results:
+        return False
+    _emit_pre_tool_use_deny(_proposed_content_deny_reason(all_new_results))
+    return True
+
+
+def _decide_codex_patch_file(
+    each_patch_file: CodexPatchFile, pre_tool_use_payload: dict
+) -> bool:
+    """Grade one path a Codex patch writes, skipping a deletion and an exemption.
+
+    Args:
+        each_patch_file: One parsed path with its projected post-edit content.
+        pre_tool_use_payload: The whole payload, read for its working directory.
+
+    Returns:
+        True when this path denies the patch.
+    """
+    if each_patch_file.operation == CODEX_DELETE_OPERATION:
+        return False
+    if is_ephemeral_path(each_patch_file.file_path, pre_tool_use_payload):
+        return False
+    return _decide_pre_tool_use(each_patch_file.file_path, each_patch_file.post_content)
+
+
+def _evaluate_codex_apply_patch(pre_tool_use_payload: dict, tool_input: dict) -> None:
+    """Grade every path a Codex apply_patch writes, stopping at the first denial.
+
+    ::
+
+        one patch adding two files, the second violating  -> deny, names file two
+        one patch deleting a file                         -> allow, nothing to grade
+
+    A patch carries several paths in one call, so each is graded on its own
+    projected post-edit content and the first denial is the decision.
+
+    Args:
+        pre_tool_use_payload: The whole PreToolUse payload.
+        tool_input: The payload's tool input mapping.
+    """
+    patch_command, working_directory = payload_patch_command(
+        pre_tool_use_payload, tool_input
+    )
+    if not patch_command:
+        return
+    try:
+        all_patch_files = parse_codex_apply_patch(patch_command, working_directory)
+    except CodexPatchError:
+        return
+    for each_patch_file in all_patch_files:
+        if _decide_codex_patch_file(each_patch_file, pre_tool_use_payload):
+            return
 
 
 def _evaluate_pre_tool_use_payload() -> None:
@@ -1491,6 +1542,9 @@ def _evaluate_pre_tool_use_payload() -> None:
     tool_input = pre_tool_use_payload.get("tool_input", {})
     if not isinstance(tool_name, str) or not isinstance(tool_input, dict):
         return
+    if tool_name == APPLY_PATCH_TOOL_NAME:
+        _evaluate_codex_apply_patch(pre_tool_use_payload, tool_input)
+        return
     file_path = tool_input.get("file_path", "")
     if not isinstance(file_path, str) or not file_path:
         return

package/hooks/validators/system_temporary_roots.py

@@ -22,7 +22,7 @@ _hooks_directory = str(Path(__file__).resolve().parent.parent)
 if _hooks_directory not in sys.path:
     sys.path.insert(0, _hooks_directory)
 
-from validators.config.directory_exemption_constants import (  # noqa: E402
+from validators.config.system_temporary_roots_constants import (  # noqa: E402
     ALL_SYSTEM_TEMPORARY_ROOT_ENVIRONMENT_VARIABLE_NAMES,
 )
 

package/hooks/validators/test_run_all_validators.py

@@ -398,3 +398,25 @@ class TestHooksSubprocessWorkingDirectory:
             )
         assert working_directory_string == tempfile.gettempdir()
         assert not working_directory_string.startswith("\\\\")
+
+
+class TestDocstringExamplePaths:
+    def test_module_source_carries_no_home_directory_example_paths(self) -> None:
+        """Example paths avoid /home so the privacy gate reads no personal data.
+
+        The gate allowlists a fixed set of placeholder home usernames, so an
+        invented name outside that set reads as somebody's real home directory
+        and denies the commit. Rooting an example somewhere other than /home
+        keeps the illustration and leaves nothing for the gate to flag.
+        """
+        module_source = (Path(__file__).parent / "run_all_validators.py").read_text(
+            encoding="utf-8"
+        )
+
+        all_home_example_lines = [
+            each_line
+            for each_line in module_source.splitlines()
+            if '"/home/' in each_line
+        ]
+
+        assert all_home_example_lines == []