claude-dev-env 2.34.0 → 2.36.0

package/scripts/tests/test_policy_lint_rules_engine.py

@@ -0,0 +1,381 @@
+"""Engine and diagnostic adapter tests for policy lint."""
+
+from __future__ import annotations
+
+import subprocess
+import types
+from collections.abc import Callable, Iterable
+from pathlib import Path, PurePosixPath
+
+import pytest
+from policy_lint import adapters
+from policy_lint.config.constants import INCOMPLETE_EXIT_CODE
+from policy_lint.engine import lint
+from policy_lint.model import (
+    ContentOrigin,
+    Diagnostic,
+    Document,
+    DocumentRule,
+    DocumentSet,
+    LintReport,
+    LintRequest,
+    Location,
+    SelectionKind,
+    Severity,
+)
+
+_CHANGED_RULE_SETS = frozenset({"changed"})
+_SAMPLE_SOURCE = "x = 1\n"
+
+
+def _accepts_every_document(document: Document) -> bool:
+    return document.path.as_posix() != ""
+
+
+def _source_document(
+    relative_path: str,
+    changed_lines: frozenset[int] | None = None,
+) -> Document:
+    return Document(
+        PurePosixPath(relative_path),
+        _SAMPLE_SOURCE,
+        None,
+        changed_lines,
+        ContentOrigin.EDITOR,
+    )
+
+
+def _changed_document_rule(
+    rule_id: str,
+    collect_diagnostics: Callable[[Document, Path], Iterable[Diagnostic]],
+) -> DocumentRule:
+    return DocumentRule(
+        rule_id, _CHANGED_RULE_SETS, _accepts_every_document, collect_diagnostics
+    )
+
+
+def _ensure_git_repository(repository_root: Path) -> None:
+    git_directory = repository_root / ".git"
+    if git_directory.exists():
+        return
+    subprocess.run(
+        ("git", "init"),
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )
+
+
+def _lint_documents(
+    repository_root: Path,
+    all_documents: tuple[Document, ...],
+    all_rules: tuple[DocumentRule, ...],
+) -> LintReport:
+    _ensure_git_repository(repository_root)
+    document_set = DocumentSet(all_documents, SelectionKind.TEXT, repository_root)
+    request = LintRequest(repository_root, document_set)
+    return lint(request, all_registry=all_rules)
+
+
+def _flaky_diagnostics(document: Document) -> tuple[Diagnostic, ...]:
+    if document.path.name == "second.py":
+        raise ImportError("detector missing")
+    return (
+        Diagnostic(
+            "flaky",
+            Severity.ERROR,
+            "partial finding",
+            Location(document.path, 2, 1),
+        ),
+    )
+
+
+def _stable_diagnostics(document: Document) -> tuple[Diagnostic, ...]:
+    return (
+        Diagnostic(
+            "stable",
+            Severity.ERROR,
+            "kept finding",
+            Location(document.path, 3, 1),
+        ),
+    )
+
+
+def test_line_prefix_message_keeps_real_line(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    def fake_hooks_module(module_name: str) -> object:
+        if not module_name:
+            raise AssertionError("missing module")
+        return types.SimpleNamespace(
+            validate_content_for_full_gate=lambda *args, **kwargs: [
+                "Line 47: comment found"
+            ]
+        )
+
+    monkeypatch.setattr(adapters, "_hooks_module", fake_hooks_module)
+    all_diagnostics = adapters.code_rule_diagnostics(
+        Document.from_text("pkg/mod.py", _SAMPLE_SOURCE), tmp_path
+    )
+    assert len(all_diagnostics) == 1
+    assert all_diagnostics[0].location is not None
+    assert all_diagnostics[0].location.start_line == 47
+
+
+def test_path_line_message_keeps_real_line(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    fake_outcome = types.SimpleNamespace(
+        name="ruff",
+        passed=False,
+        output="C:/Users/example/AppData/Local/Temp/tmp123/pkg/mod.py:47: magic number",
+    )
+
+    def fake_hooks_module(module_name: str) -> object:
+        if not module_name:
+            raise AssertionError("missing module")
+        return types.SimpleNamespace(
+            validate_proposed_file=lambda *args, **kwargs: [fake_outcome]
+        )
+
+    monkeypatch.setattr(adapters, "_hooks_module", fake_hooks_module)
+    all_diagnostics = adapters.validator_diagnostics(
+        Document.from_text("pkg/mod.py", _SAMPLE_SOURCE), tmp_path
+    )
+    assert len(all_diagnostics) == 1
+    assert all_diagnostics[0].location is not None
+    assert all_diagnostics[0].location.start_line == 47
+    assert all_diagnostics[0].message == "pkg/mod.py:47: magic number"
+
+
+def test_unknown_line_has_no_location() -> None:
+    document = Document.from_text("pkg/mod.py", _SAMPLE_SOURCE)
+    all_diagnostics = adapters._diagnostics_for_messages(
+        document, "plain-language", ("Banned prose term: landscape",)
+    )
+    assert len(all_diagnostics) == 1
+    assert all_diagnostics[0].location is None
+
+
+def test_changed_line_filter_keeps_matching_line(tmp_path: Path) -> None:
+    repository_root = tmp_path.resolve()
+    document = _source_document("pkg/mod.py", changed_lines=frozenset({47}))
+
+    def collect_diagnostics(
+        document: Document, repository_root: Path | None = None
+    ) -> tuple[Diagnostic, ...]:
+        del repository_root
+        return (
+            Diagnostic(
+                "code-rules",
+                Severity.ERROR,
+                "Line 47: comment found",
+                Location(document.path, 47, 1),
+            ),
+        )
+
+    lint_report = _lint_documents(
+        repository_root,
+        (document,),
+        (_changed_document_rule("code-rules", collect_diagnostics),),
+    )
+    assert len(lint_report.diagnostics) == 1
+    assert lint_report.diagnostics[0].location is not None
+    assert lint_report.diagnostics[0].location.start_line == 47
+
+
+def test_changed_line_filter_drops_other_located_line(tmp_path: Path) -> None:
+    repository_root = tmp_path.resolve()
+    document = _source_document("pkg/mod.py", changed_lines=frozenset({1}))
+
+    def collect_diagnostics(
+        document: Document, repository_root: Path | None = None
+    ) -> tuple[Diagnostic, ...]:
+        del repository_root
+        return (
+            Diagnostic(
+                "code-rules",
+                Severity.ERROR,
+                "Line 47: comment found",
+                Location(document.path, 47, 1),
+            ),
+        )
+
+    lint_report = _lint_documents(
+        repository_root,
+        (document,),
+        (_changed_document_rule("code-rules", collect_diagnostics),),
+    )
+    assert lint_report.diagnostics == ()
+
+
+def test_lint_keeps_located_findings_when_changed_lines_are_empty(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path.resolve()
+    document = _source_document("pkg/mod.py", changed_lines=frozenset())
+
+    def collect_diagnostics(
+        document: Document, repository_root: Path | None = None
+    ) -> tuple[Diagnostic, ...]:
+        del repository_root
+        return (
+            Diagnostic(
+                "probe",
+                Severity.ERROR,
+                "finding",
+                Location(document.path, 1, 1),
+            ),
+        )
+
+    lint_report = _lint_documents(
+        repository_root,
+        (document,),
+        (_changed_document_rule("probe", collect_diagnostics),),
+    )
+    assert len(lint_report.diagnostics) == 1
+
+
+def test_code_rule_diagnostics_includes_comment_policy_without_prior_text(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    include_comment_policy: dict[str, bool] = {}
+
+    def validate_content_for_full_gate(
+        *all_arguments: object, **all_keywords: object
+    ) -> list[str]:
+        del all_arguments
+        include_comment_policy["enabled"] = bool(all_keywords["include_comment_policy"])
+        return []
+
+    monkeypatch.setattr(
+        adapters,
+        "_hooks_module",
+        lambda _module_name: types.SimpleNamespace(
+            validate_content_for_full_gate=validate_content_for_full_gate
+        ),
+    )
+    adapters.code_rule_diagnostics(
+        Document.from_text("pkg/new.py", _SAMPLE_SOURCE), tmp_path
+    )
+    assert include_comment_policy == {"enabled": True}
+
+
+def test_code_rule_diagnostics_keeps_legacy_stdout_private(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    def validate_content_for_full_gate(
+        *all_arguments: object, **all_keywords: object
+    ) -> list[str]:
+        del all_arguments, all_keywords
+        print("large file advisory")
+        return ["Line 2: real diagnostic"]
+
+    monkeypatch.setattr(
+        adapters,
+        "_hooks_module",
+        lambda _module_name: types.SimpleNamespace(
+            validate_content_for_full_gate=validate_content_for_full_gate
+        ),
+    )
+    all_diagnostics = adapters.code_rule_diagnostics(
+        Document.from_text("pkg/mod.py", _SAMPLE_SOURCE), tmp_path
+    )
+    captured_output = capsys.readouterr()
+    assert captured_output.out == ""
+    assert captured_output.err == ""
+    assert [each_diagnostic.message for each_diagnostic in all_diagnostics] == [
+        "Line 2: real diagnostic"
+    ]
+
+
+def test_state_description_diagnostics_maps_and_scopes_phrases(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setattr(
+        adapters,
+        "_hooks_module",
+        lambda _module_name: types.SimpleNamespace(
+            find_violations=lambda _text, _path: ["used to", "replaced by"]
+        ),
+    )
+    source_document = Document(
+        PurePosixPath("module.py"),
+        "# " + "replaced" + " by unchanged\n# " + "used" + " to changed\n",
+        None,
+        frozenset({2}),
+        ContentOrigin.EDITOR,
+    )
+    lint_report = _lint_documents(
+        tmp_path,
+        (source_document,),
+        (_changed_document_rule("state-description", adapters.state_description_diagnostics),),
+    )
+    assert len(lint_report.diagnostics) == 1
+    assert lint_report.diagnostics[0].location is not None
+    assert lint_report.diagnostics[0].location.start_line == 2
+
+
+def test_unlocated_finding_survives_changed_line_filter(tmp_path: Path) -> None:
+    repository_root = tmp_path.resolve()
+    document = _source_document("pkg/mod.py", changed_lines=frozenset({8}))
+
+    def collect_diagnostics(
+        document: Document, repository_root: Path | None = None
+    ) -> tuple[Diagnostic, ...]:
+        del repository_root
+        return (
+            Diagnostic(
+                "plain-language",
+                Severity.ERROR,
+                "Banned prose term: landscape",
+                None,
+            ),
+        )
+
+    lint_report = _lint_documents(
+        repository_root,
+        (document,),
+        (_changed_document_rule("plain-language", collect_diagnostics),),
+    )
+    assert len(lint_report.diagnostics) == 1
+    assert lint_report.diagnostics[0].location is None
+
+
+def test_failed_adapter_rolls_back_continues_and_exits_incomplete(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path.resolve()
+    all_documents = (
+        _source_document("pkg/first.py"),
+        _source_document("pkg/second.py"),
+    )
+    all_rules = (
+        _changed_document_rule("flaky", lambda document, _root: _flaky_diagnostics(document)),
+        _changed_document_rule("stable", lambda document, _root: _stable_diagnostics(document)),
+    )
+    lint_report = _lint_documents(repository_root, all_documents, all_rules)
+    assert lint_report.failed_rules == ("flaky",)
+    assert lint_report.executed_rules == ("stable",)
+    assert lint_report.exit_code == INCOMPLETE_EXIT_CODE
+    assert [each_rule.rule_id for each_rule in lint_report.diagnostics] == [
+        "stable",
+        "stable",
+    ]
+
+
+def test_process_interrupt_is_not_swallowed(tmp_path: Path) -> None:
+    repository_root = tmp_path.resolve()
+
+    def interrupt_diagnostics(
+        document: Document, repository_root: Path | None = None
+    ) -> tuple[Diagnostic, ...]:
+        del document, repository_root
+        raise KeyboardInterrupt
+
+    with pytest.raises(KeyboardInterrupt):
+        _lint_documents(
+            repository_root,
+            (_source_document("pkg/mod.py"),),
+            (_changed_document_rule("interrupt", interrupt_diagnostics),),
+        )

package/scripts/tests/test_policy_lint_rules_registry.py

@@ -0,0 +1,252 @@
+"""Registry, grouping, and configuration tests for policy lint."""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import types
+from pathlib import Path, PurePosixPath
+
+import pytest
+from policy_lint import adapters, registry
+from policy_lint.engine import lint
+from policy_lint.model import (
+    Document,
+    DocumentRule,
+    DocumentSet,
+    LintRequest,
+    SelectionKind,
+)
+
+_FUNCTION_SOURCE = "def work() -> None:\n    pass\n"
+_CHANGED_RULE_SETS = frozenset({"changed"})
+
+
+def _rule_named(rule_id: str) -> DocumentRule:
+    for each_rule in registry.default_registry():
+        if each_rule.rule_id == rule_id and isinstance(each_rule, DocumentRule):
+            return each_rule
+    raise AssertionError(rule_id)
+
+
+def _ensure_git_repository(repository_root: Path) -> None:
+    git_directory = repository_root / ".git"
+    if git_directory.exists():
+        return
+    subprocess.run(
+        ("git", "init"),
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )
+
+
+def test_hook_format_accepts_claude_settings() -> None:
+    settings_document = Document.from_text(".claude/settings.json", "{}")
+    hooks_document = Document.from_text("hooks/hooks.json", "{}")
+    format_rule = _rule_named("hook-format")
+    configuration_rule = _rule_named("hook-configuration")
+    assert format_rule.accepts(settings_document) is True
+    assert format_rule.accepts(hooks_document) is False
+    assert configuration_rule.accepts(hooks_document) is True
+    assert configuration_rule.accepts(settings_document) is False
+
+
+def test_workflow_substitution_accepts_workflow_js_suffix() -> None:
+    workflow_document = Document.from_text("packages/foo/bar.workflow.js", "loop")
+    directory_document = Document.from_text("docs/workflow/readme.md", "loop")
+    assert adapters.accepts_workflow(workflow_document) is True
+    assert adapters.accepts_workflow(directory_document) is False
+
+
+def test_open_questions_cover_repository_and_claude_plans() -> None:
+    docs_plan = Document.from_text("docs/plans/packet.md", "# Plan\n")
+    claude_plan = Document.from_text(".claude/plans/packet.md", "# Plan\n")
+    other_markdown = Document.from_text("docs/notes.md", "# Notes\n")
+    assert adapters.accepts_plans(docs_plan) is True
+    assert adapters.accepts_plans(claude_plan) is True
+    assert adapters.accepts_plans(other_markdown) is False
+
+
+def test_open_question_diagnostics_scan_claude_plans(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    def fake_hooks_module(module_name: str) -> object:
+        if not module_name:
+            raise AssertionError("missing module")
+        return types.SimpleNamespace(_content_has_open_questions=lambda text: True)
+
+    monkeypatch.setattr(adapters, "_hooks_module", fake_hooks_module)
+    all_diagnostics = adapters.open_question_diagnostics(
+        Document.from_text(".claude/plans/packet.md", "## Open Questions\n"),
+        tmp_path,
+    )
+    assert len(all_diagnostics) == 1
+    assert all_diagnostics[0].rule_id == "open-questions"
+
+
+def test_test_pairing_diagnostics_reports_unmatched_changed_production_file(
+    tmp_path: Path,
+) -> None:
+    document_set = DocumentSet(
+        (Document.from_text("src/feature.py", _FUNCTION_SOURCE),),
+        SelectionKind.STAGED,
+        tmp_path,
+    )
+    all_diagnostics = adapters.test_pairing_diagnostics(document_set)
+    assert len(all_diagnostics) == 1
+    assert all_diagnostics[0].location is not None
+    assert all_diagnostics[0].location.path == PurePosixPath("src/feature.py")
+
+
+def test_test_pairing_diagnostics_exempts_constants_only_python_modules(
+    tmp_path: Path,
+) -> None:
+    document_set = DocumentSet(
+        (
+            Document.from_text(
+                "hooks_constants/tool_names.py",
+                "TOOL_NAME: str = \"tool\"\n",
+            ),
+        ),
+        SelectionKind.STAGED,
+        tmp_path,
+    )
+    assert adapters.test_pairing_diagnostics(document_set) == ()
+
+
+def test_test_pairing_diagnostics_accepts_changed_matching_test(tmp_path: Path) -> None:
+    document_set = DocumentSet(
+        (
+            Document.from_text("src/feature.py", _FUNCTION_SOURCE),
+            Document.from_text("tests/test_feature.py", _FUNCTION_SOURCE),
+        ),
+        SelectionKind.BASE,
+        tmp_path,
+    )
+    assert adapters.test_pairing_diagnostics(document_set) == ()
+
+
+@pytest.mark.parametrize(
+    ("production_path", "test_path"),
+    (
+        ("scripts/policy_lint/adapters.py", "scripts/tests/test_policy_lint_rules.py"),
+        (
+            "scripts/policy_lint/selection.py",
+            "scripts/tests/test_policy_lint_selection.py",
+        ),
+        (
+            "hooks/validators/run_all_validators.py",
+            "hooks/validators/test_run_all_validators_integration.py",
+        ),
+        ("bin/install-plan.mjs", "bin/install.plan.test.mjs"),
+    ),
+)
+def test_test_pairing_diagnostics_accepts_grouped_families(
+    tmp_path: Path, production_path: str, test_path: str
+) -> None:
+    document_set = DocumentSet(
+        (
+            Document.from_text(production_path, _FUNCTION_SOURCE),
+            Document.from_text(test_path, _FUNCTION_SOURCE),
+        ),
+        SelectionKind.STAGED,
+        tmp_path,
+    )
+    assert adapters.test_pairing_diagnostics(document_set) == ()
+
+
+def test_test_pairing_diagnostics_rejects_a_different_family(tmp_path: Path) -> None:
+    document_set = DocumentSet(
+        (
+            Document.from_text("src/feature.py", _FUNCTION_SOURCE),
+            Document.from_text("tests/test_feature_helper.py", _FUNCTION_SOURCE),
+        ),
+        SelectionKind.STAGED,
+        tmp_path,
+    )
+    all_diagnostics = adapters.test_pairing_diagnostics(document_set)
+    assert len(all_diagnostics) == 1
+
+
+def test_test_pairing_diagnostics_recognizes_spec_test_paths(tmp_path: Path) -> None:
+    document_set = DocumentSet(
+        (
+            Document.from_text("src/widget.ts", _FUNCTION_SOURCE),
+            Document.from_text("tests/widget.spec.ts", _FUNCTION_SOURCE),
+        ),
+        SelectionKind.STAGED,
+        tmp_path,
+    )
+    assert adapters.test_pairing_diagnostics(document_set) == ()
+
+
+def test_hook_configuration_diagnostics_rejects_registered_action_boundary_path(
+    tmp_path: Path,
+) -> None:
+    configuration_document = Document.from_text(
+        "hooks/hooks.json",
+        json.dumps(
+            {
+                "hooks": {
+                    "PreToolUse": [
+                        {"hooks": [{"command": "hooks/blocking/deny.py"}]}
+                    ]
+                }
+            }
+        ),
+    )
+    all_diagnostics = adapters.hook_configuration_diagnostics(
+        configuration_document, tmp_path
+    )
+    assert len(all_diagnostics) == 1
+    assert all_diagnostics[0].rule_id == "hook-configuration"
+
+
+def test_hook_configuration_diagnostics_ignore_description_text(tmp_path: Path) -> None:
+    configuration_document = Document.from_text(
+        "hooks/hooks.json",
+        json.dumps({"description": "blocking safety controls", "hooks": {}}),
+    )
+    assert adapters.hook_configuration_diagnostics(configuration_document, tmp_path) == ()
+
+
+def test_hook_configuration_diagnostics_ignore_task_path(tmp_path: Path) -> None:
+    configuration_document = Document.from_text(
+        "hooks/hooks.json",
+        json.dumps({"hooks": {"PostToolUse": [{"command": "task_runner.py"}]}}),
+    )
+    assert adapters.hook_configuration_diagnostics(configuration_document, tmp_path) == ()
+
+
+def test_registry_omits_native_ruff_mypy_javascript_adapters() -> None:
+    all_rule_ids = {each_rule.rule_id for each_rule in registry.default_registry()}
+    assert "ruff" not in all_rule_ids
+    assert "mypy" not in all_rule_ids
+    assert "eslint" not in all_rule_ids
+    assert "javascript" not in all_rule_ids
+
+
+def test_registry_registers_unique_python_validator_rule() -> None:
+    validator_rule = _rule_named("validators")
+    assert validator_rule.accepts(Document.from_text("module.py", _FUNCTION_SOURCE))
+    assert not validator_rule.accepts(Document.from_text("module.ts", _FUNCTION_SOURCE))
+
+
+def test_lint_keeps_skipped_rules_out_of_executed_rules(tmp_path: Path) -> None:
+    skipped_rule = DocumentRule(
+        "skipped",
+        _CHANGED_RULE_SETS,
+        lambda _document: False,
+        lambda _document, _root: (),
+    )
+    _ensure_git_repository(tmp_path)
+    document_set = DocumentSet(
+        (Document.from_text("pkg/mod.py", "x = 1\n"),),
+        SelectionKind.TEXT,
+        tmp_path,
+    )
+    request = LintRequest(tmp_path, document_set)
+    all_rules_report = lint(request, all_registry=(skipped_rule,))
+    assert all_rules_report.executed_rules == ()
+    assert all_rules_report.skipped_rules == ("skipped",)