claude-dev-env 2.35.0 → 2.36.0

package/scripts/policy_lint/adapter_detectors.py

@@ -0,0 +1,328 @@
+from __future__ import annotations
+
+from collections.abc import Iterable
+from contextlib import redirect_stderr, redirect_stdout
+from io import StringIO
+from pathlib import Path
+
+from . import adapter_support
+from .config import constants
+from .model import Diagnostic, Document
+
+
+def _stable_validator_message(document: Document, raw_message: str) -> str:
+    _prefix, path_separator, message_tail = raw_message.partition(document.path.name)
+    if not path_separator or not message_tail.startswith(":"):
+        return raw_message
+    return f"{document.path.as_posix()}{message_tail}"
+
+
+def _validator_messages(
+    document: Document, did_pass: bool, printed_text: str
+) -> tuple[str, ...]:
+    if did_pass:
+        return ()
+    return tuple(
+        _stable_validator_message(document, each_line)
+        for each_line in printed_text.splitlines()
+        if each_line.strip()
+    )
+
+
+def _messages_for_validator_outcomes(
+    document: Document, all_validator_outcomes: Iterable[object]
+) -> tuple[str, ...]:
+    return tuple(
+        each_message
+        for each_outcome in all_validator_outcomes
+        for each_message in _validator_messages(
+            document,
+            bool(vars(each_outcome)["passed"]),
+            str(vars(each_outcome)["output"]),
+        )
+    )
+
+
+def validator_diagnostics(
+    document: Document,
+    repository_root: Path,
+    load_module: adapter_support.HookModuleLoader,
+) -> tuple[Diagnostic, ...]:
+    """Run the fast validator set on one document.
+
+    Args:
+        document: Current source text and path.
+        repository_root: Request repository root for configuration resolution.
+        load_module: Hook module loader.
+
+    Returns:
+        Path-normalized diagnostics for failed validators.
+    """
+    absolute_path = adapter_support._document_path(repository_root, document)
+    validator_module = load_module("validators.run_all_validators")
+    all_validator_outcomes = validator_module.validate_proposed_file(
+        absolute_path.as_posix(),
+        document.text,
+        config_source_path=absolute_path,
+        include_ruff=False,
+        excluded_validator_names=constants.ALL_OVERLAPPING_VALIDATOR_NAMES,
+    )
+    all_messages = _messages_for_validator_outcomes(document, all_validator_outcomes)
+    return adapter_support._diagnostics_for_messages(document, "validators", all_messages)
+
+
+def code_rule_diagnostics(
+    document: Document,
+    repository_root: Path,
+    load_module: adapter_support.HookModuleLoader,
+) -> tuple[Diagnostic, ...]:
+    """Run the code-rule engine on one document.
+
+    Args:
+        document: Current text and optional prior text.
+        repository_root: Request repository root for sibling-file resolution.
+        load_module: Hook module loader.
+
+    Returns:
+        Diagnostics from the code-rule engine.
+    """
+    absolute_path = adapter_support._document_path(repository_root, document)
+    legacy_module = load_module("blocking.code_rules_enforcer")
+    legacy_stdout = StringIO()
+    legacy_stderr = StringIO()
+    with redirect_stdout(legacy_stdout), redirect_stderr(legacy_stderr):
+        all_messages = legacy_module.validate_content_for_full_gate(
+            document.text,
+            absolute_path.as_posix(),
+            old_content=document.prior_text or "",
+            defer_scope_to_caller=True,
+            sibling_directory=absolute_path.parent,
+            include_comment_policy=True,
+        )
+    return adapter_support._diagnostics_for_messages(document, "code-rules", all_messages)
+
+
+def state_description_diagnostics(
+    document: Document,
+    repository_root: Path,
+    load_module: adapter_support.HookModuleLoader,
+) -> tuple[Diagnostic, ...]:
+    """Run the state-description detector on one document.
+
+    Args:
+        document: Current document text.
+        repository_root: Request repository root for document-path resolution.
+        load_module: Hook module loader.
+
+    Returns:
+        State-description diagnostics.
+    """
+    absolute_path = adapter_support._document_path(repository_root, document)
+    detector_module = load_module("blocking.state_description_blocker")
+    all_messages = detector_module.find_violations(
+        document.text, absolute_path.as_posix()
+    )
+    return adapter_support._diagnostics_for_state_messages(document, all_messages)
+
+
+def plain_language_diagnostics(
+    document: Document,
+    repository_root: Path,
+    load_module: adapter_support.HookModuleLoader,
+) -> tuple[Diagnostic, ...]:
+    """Run the stored-prose detector on one document.
+
+    Args:
+        document: Current document text.
+        repository_root: Request repository root for document-path resolution.
+        load_module: Hook module loader.
+
+    Returns:
+        Plain-language diagnostics.
+    """
+    adapter_support._document_path(repository_root, document)
+    detector_module = load_module("blocking.plain_language_blocker")
+    all_matches = detector_module.find_banned_terms(document.text)
+    all_messages = [f"Banned prose term: {each_term}" for each_term, _ in all_matches]
+    return adapter_support._diagnostics_for_messages(document, "plain-language", all_messages)
+
+
+def docstring_gate_diagnostics(
+    document: Document,
+    repository_root: Path,
+    load_module: adapter_support.HookModuleLoader,
+) -> tuple[Diagnostic, ...]:
+    """Run the docstring gate-count detector on one document.
+
+    Args:
+        document: Current document text.
+        repository_root: Request repository root for document-path resolution.
+        load_module: Hook module loader.
+
+    Returns:
+        Docstring gate diagnostics.
+    """
+    absolute_path = adapter_support._document_path(repository_root, document)
+    detector_module = load_module("blocking.docstring_rule_gate_count_blocker")
+    if not detector_module.is_target_rule_file(absolute_path.as_posix()):
+        return ()
+    all_messages = detector_module.find_gate_count_drift(document.text)
+    return adapter_support._diagnostics_for_messages(document, "docstring-gate-count", all_messages)
+
+
+def workflow_substitution_diagnostics(
+    document: Document,
+    repository_root: Path,
+    load_module: adapter_support.HookModuleLoader,
+) -> tuple[Diagnostic, ...]:
+    """Run the workflow substitution detector on one document.
+
+    Args:
+        document: Current document text.
+        repository_root: Request repository root for document-path resolution.
+        load_module: Hook module loader.
+
+    Returns:
+        Workflow substitution diagnostics.
+    """
+    adapter_support._document_path(repository_root, document)
+    detector_module = load_module("blocking.workflow_substitution_slot_blocker")
+    if not detector_module.content_has_violation(document.text):
+        return ()
+    return adapter_support._diagnostics_for_messages(
+        document, "workflow-substitution", ("Workflow substitution slot is incomplete",)
+    )
+
+
+def rmtree_diagnostics(
+    document: Document,
+    repository_root: Path,
+    load_module: adapter_support.HookModuleLoader,
+) -> tuple[Diagnostic, ...]:
+    """Run the Windows cleanup detectors on one document.
+
+    Args:
+        document: Current text.
+        repository_root: Request repository root for document-path resolution.
+        load_module: Hook module loader.
+
+    Returns:
+        Cleanup safety diagnostics.
+    """
+    absolute_path = adapter_support._document_path(repository_root, document)
+    unsafe_module = load_module("blocking.windows_rmtree_blocker")
+    duplicate_module = load_module("blocking.duplicate_rmtree_helper_blocker")
+    all_messages: list[str] = []
+    if unsafe_module.payload_contains_unsafe_rmtree(document.text):
+        all_messages.append("Unsafe rmtree ignore_errors usage")
+    if (
+        not duplicate_module.path_is_exempt(absolute_path.as_posix())
+        and duplicate_module.payload_defines_sanctioned_helper(document.text)
+    ):
+        all_messages.append("Duplicate sanctioned rmtree helper")
+    return adapter_support._diagnostics_for_messages(document, "rmtree-safety", all_messages)
+
+
+def subprocess_budget_diagnostics(
+    document: Document,
+    repository_root: Path,
+    load_module: adapter_support.HookModuleLoader,
+) -> tuple[Diagnostic, ...]:
+    """Run the subprocess budget detector on one document.
+
+    Args:
+        document: Current text.
+        repository_root: Request repository root for document-path resolution.
+        load_module: Hook module loader.
+
+    Returns:
+        Subprocess budget diagnostics.
+    """
+    adapter_support._document_path(repository_root, document)
+    detector_module = load_module("blocking.subprocess_budget_completeness")
+    maybe_issue = detector_module.find_undercounted_budget(document.text)
+    if maybe_issue is None:
+        return ()
+    function_name, all_omitted_counts = maybe_issue
+    message = f"Subprocess budget omits counts in {function_name}: {sorted(all_omitted_counts)}"
+    return adapter_support._diagnostics_for_messages(document, "subprocess-budget", (message,))
+
+
+def hook_prose_diagnostics(
+    document: Document,
+    repository_root: Path,
+    load_module: adapter_support.HookModuleLoader,
+) -> tuple[Diagnostic, ...]:
+    """Run the hook-prose consistency detector on one document.
+
+    Args:
+        document: Current text.
+        repository_root: Request repository root for document-path resolution.
+        load_module: Hook module loader.
+
+    Returns:
+        Hook-prose diagnostics.
+    """
+    absolute_path = adapter_support._document_path(repository_root, document)
+    detector_module = load_module("blocking.hook_prose_detector_consistency")
+    if not detector_module.is_hook_python_module(absolute_path.as_posix()):
+        return ()
+    if not detector_module.content_has_violation(
+        document.text, absolute_path.as_posix()
+    ):
+        return ()
+    return adapter_support._diagnostics_for_messages(
+        document,
+        "hook-prose-consistency",
+        ("Hook prose detector does not match its output contract",),
+    )
+
+
+def open_question_diagnostics(
+    document: Document,
+    repository_root: Path,
+    load_module: adapter_support.HookModuleLoader,
+) -> tuple[Diagnostic, ...]:
+    """Run the open-question plan detector on one document.
+
+    Args:
+        document: Current plan text.
+        repository_root: Request repository root for document-path resolution.
+        load_module: Hook module loader.
+
+    Returns:
+        Plan question diagnostics.
+    """
+    adapter_support._document_path(repository_root, document)
+    detector_module = load_module("blocking.open_questions_in_plans_blocker")
+    if not detector_module._content_has_open_questions(document.text):
+        return ()
+    return adapter_support._diagnostics_for_messages(
+        document, "open-questions", ("Plan contains an open question",)
+    )
+
+
+def hook_format_diagnostics(
+    document: Document,
+    repository_root: Path,
+    load_module: adapter_support.HookModuleLoader,
+) -> tuple[Diagnostic, ...]:
+    """Check one settings document for a nonportable hook command.
+
+    Args:
+        document: Current settings text and path.
+        repository_root: Request repository root for document-path resolution.
+        load_module: Hook module loader.
+
+    Returns:
+        A diagnostic when the command uses a home-relative Python script path.
+    """
+    adapter_support._document_path(repository_root, document)
+    detector_module = load_module("validation.hook_format_validator")
+    if detector_module.SIMPLE_PATTERN.search(document.text) is None:
+        return ()
+    return adapter_support._diagnostics_for_messages(
+        document,
+        "hook-format",
+        ("Hook command uses a home-relative Python script path",),
+    )

package/scripts/policy_lint/adapter_pairing.py

@@ -0,0 +1,145 @@
+from __future__ import annotations
+
+from pathlib import PurePosixPath
+
+from . import adapter_support
+from .config import constants
+from .model import Diagnostic, Document, DocumentSet, Location, SelectionKind, Severity
+
+
+def _is_test_path(path: PurePosixPath) -> bool:
+    normalized_name = path.name.lower()
+    normalized_parts = {each_part.lower() for each_part in path.parts}
+    return (
+        normalized_name.startswith(constants.ALL_TEST_FILE_PREFIXES)
+        or normalized_name.endswith(constants.ALL_TEST_FILE_SUFFIXES)
+        or ".test." in normalized_name
+        or ".spec." in normalized_name
+        or bool(normalized_parts.intersection(constants.ALL_TEST_DIRECTORY_NAMES))
+    )
+
+
+def _is_constants_only_python_document(
+    document: Document, load_module: adapter_support.HookModuleLoader
+) -> bool:
+    if document.path.suffix.lower() != constants.PYTHON_SUFFIX:
+        return False
+    analysis_module = load_module("blocking.tdd_enforcer_parts.content_analysis")
+    return analysis_module._is_constants_only_python_content(document.text)
+
+
+def _candidate_test_names(path: PurePosixPath) -> frozenset[str]:
+    stem = path.stem
+    suffix = path.suffix.lower()
+    if suffix == constants.PYTHON_SUFFIX:
+        return frozenset({f"test_{stem}.py", f"{stem}_test.py"})
+    if suffix in constants.ALL_CODE_SUFFIXES:
+        return frozenset({f"{stem}.test{suffix}", f"{stem}.spec{suffix}"})
+    return frozenset()
+
+
+def _family_tokens(path: PurePosixPath) -> tuple[str, ...]:
+    normalized_stem = path.stem.lower().replace("-", "_").replace(".", "_")
+    normalized_stem = normalized_stem.removeprefix("test_")
+    normalized_stem = normalized_stem.removesuffix("_test")
+    return tuple(each_token for each_token in normalized_stem.split("_") if each_token)
+
+
+def _is_policy_lint_test_match(
+    production_path: PurePosixPath, test_path: PurePosixPath
+) -> bool:
+    if constants.POLICY_LINT_DIRECTORY_NAME not in production_path.parts:
+        return False
+    test_prefix = (
+        constants.POLICY_LINT_SELECTION_TEST_PREFIX
+        if production_path.stem.lower() in {"selection", "selection_git"}
+        else constants.POLICY_LINT_RULES_TEST_PREFIX
+    )
+    normalized_test_stem = test_path.stem.lower()
+    return normalized_test_stem == test_prefix or normalized_test_stem.startswith(
+        f"{test_prefix}_"
+    )
+
+
+def _is_grouped_test_match(
+    production_path: PurePosixPath, test_path: PurePosixPath
+) -> bool:
+    if _is_policy_lint_test_match(production_path, test_path):
+        return True
+    if production_path.stem.lower() in {
+        constants.RUN_ALL_VALIDATORS_STEM,
+        constants.FAST_SAVE_VALIDATORS_STEM,
+    }:
+        all_production_tokens = _family_tokens(production_path)
+        all_test_tokens = _family_tokens(test_path)
+        return all_test_tokens[: len(all_production_tokens)] == all_production_tokens
+    return _family_tokens(production_path) == _family_tokens(test_path)
+
+
+def _has_changed_test(
+    production_path: PurePosixPath,
+    all_changed_test_paths: frozenset[PurePosixPath],
+) -> bool:
+    all_candidate_names = _candidate_test_names(production_path)
+    return any(
+        each_test_path.name.lower() in all_candidate_names
+        or _is_grouped_test_match(production_path, each_test_path)
+        for each_test_path in all_changed_test_paths
+    )
+
+
+def _is_unpaired_production(
+    production_document: Document,
+    all_changed_test_paths: frozenset[PurePosixPath],
+    load_module: adapter_support.HookModuleLoader,
+) -> bool:
+    production_path = production_document.path
+    if production_path.suffix.lower() not in constants.ALL_CODE_SUFFIXES:
+        return False
+    if _is_test_path(production_path):
+        return False
+    if _is_constants_only_python_document(production_document, load_module):
+        return False
+    return not _has_changed_test(production_path, all_changed_test_paths)
+
+
+def _changed_test_paths(document_set: DocumentSet) -> frozenset[PurePosixPath]:
+    return frozenset(
+        each_document.path
+        for each_document in document_set.documents
+        if _is_test_path(each_document.path)
+    )
+
+
+def _pairing_diagnostic(document: Document) -> Diagnostic:
+    return Diagnostic(
+        "test-pairing",
+        Severity.ERROR,
+        "Changed production file has no changed matching test",
+        Location(document.path, 1, 1),
+    )
+
+
+def test_pairing_diagnostics(
+    document_set: DocumentSet,
+    load_module: adapter_support.HookModuleLoader,
+) -> tuple[Diagnostic, ...]:
+    """Report changed production files without a changed matching test.
+
+    Args:
+        document_set: Staged or base change selection.
+        load_module: Hook module loader.
+
+    Returns:
+        Test-pairing diagnostics for unmatched production files.
+    """
+    if document_set.selection not in {SelectionKind.STAGED, SelectionKind.BASE}:
+        return ()
+    all_changed_test_paths = _changed_test_paths(document_set)
+    return tuple(
+        _pairing_diagnostic(each_document)
+        for each_document in document_set.documents
+        if _is_unpaired_production(
+            each_document, all_changed_test_paths, load_module
+        )
+    )

package/scripts/policy_lint/adapter_support.py

@@ -0,0 +1,97 @@
+from __future__ import annotations
+
+from collections.abc import Callable, Iterable
+from pathlib import Path
+from types import ModuleType
+
+from .model import Diagnostic, Document, Location, Severity
+
+HookModuleLoader = Callable[[str], ModuleType]
+
+
+def _document_path(repository_root: Path, document: Document) -> Path:
+    return repository_root / document.path.as_posix()
+
+
+def _line_number(message: str) -> int | None:
+    line_prefix = "Line "
+    if not message.startswith(line_prefix):
+        return _path_line_number(message) or None
+    remainder = message[len(line_prefix) :]
+    line_text, separator, _tail = remainder.partition(":")
+    if not separator or not line_text.isdigit():
+        return _path_line_number(message) or None
+    parsed_line = int(line_text)
+    if parsed_line < 1:
+        return _path_line_number(message) or None
+    return parsed_line
+
+
+def _path_line_number(message: str) -> int:
+    all_prefix_fields = message.partition(": ")[0].split(":")
+    for each_field_index, each_field in enumerate(all_prefix_fields):
+        if each_field.isdigit():
+            return _line_number_when_prefix_is_a_location(
+                all_prefix_fields, each_field_index
+            )
+    return 0
+
+
+def _line_number_when_prefix_is_a_location(
+    all_prefix_fields: list[str], digit_field_index: int
+) -> int:
+    all_non_path_characters = ("|", '"')
+    if digit_field_index == 0:
+        return 0
+    all_path_fields = all_prefix_fields[:digit_field_index]
+    looks_like_a_path = not any(
+        each_character in each_path_field
+        for each_path_field in all_path_fields
+        for each_character in all_non_path_characters
+    )
+    all_trailing_fields = all_prefix_fields[digit_field_index + 1 :]
+    if not looks_like_a_path:
+        return 0
+    if not all(each_field.isdigit() for each_field in all_trailing_fields):
+        return 0
+    return int(all_prefix_fields[digit_field_index])
+
+
+def _diagnostics_for_messages(
+    document: Document,
+    rule_id: str,
+    all_messages: Iterable[str],
+) -> tuple[Diagnostic, ...]:
+    all_diagnostics: list[Diagnostic] = []
+    for each_message in all_messages:
+        maybe_line = _line_number(each_message)
+        location = (
+            None if maybe_line is None else Location(document.path, maybe_line, 1)
+        )
+        all_diagnostics.append(
+            Diagnostic(rule_id, Severity.ERROR, each_message, location)
+        )
+    return tuple(all_diagnostics)
+
+
+def _source_line_for_phrase(source_text: str, phrase: str) -> int | None:
+    normalized_phrase = phrase.casefold()
+    for each_line_number, each_line in enumerate(source_text.splitlines(), 1):
+        if normalized_phrase in each_line.casefold():
+            return each_line_number
+    return None
+
+
+def _diagnostics_for_state_messages(
+    document: Document, all_messages: Iterable[str]
+) -> tuple[Diagnostic, ...]:
+    all_diagnostics: list[Diagnostic] = []
+    for each_message in all_messages:
+        maybe_line = _source_line_for_phrase(document.text, each_message)
+        location = (
+            None if maybe_line is None else Location(document.path, maybe_line, 1)
+        )
+        all_diagnostics.append(
+            Diagnostic("state-description", Severity.ERROR, each_message, location)
+        )
+    return tuple(all_diagnostics)