claude-dev-env 2.35.0 → 4.0.0

package/scripts/tests/test_cde_lint.py

@@ -0,0 +1,398 @@
+"""Behavioral tests for the public policy-lint command."""
+
+from __future__ import annotations
+
+import io
+import json
+import subprocess
+import sys
+from collections.abc import Callable
+from pathlib import Path, PurePosixPath
+from types import ModuleType
+
+import pytest
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+
+import cde_lint
+from policy_lint import render as render_module
+from policy_lint.model import (
+    BaseChanges,
+    Diagnostic,
+    ExplicitFiles,
+    LintReport,
+    LintRequest,
+    Location,
+    RepositoryTree,
+    Severity,
+    StagedChanges,
+    TextDocument,
+)
+from policy_lint.selection import SelectionRunFatal
+
+
+def _cli_module() -> ModuleType:
+    return cde_lint
+
+
+def _render_module() -> ModuleType:
+    return render_module
+
+
+def _clean_report() -> LintReport:
+    return LintReport(1, (), (), ("rule-a",), (), ())
+
+
+def _located_diagnostic() -> Diagnostic:
+    return Diagnostic(
+        "rule-a",
+        Severity.ERROR,
+        "located finding",
+        Location(PurePosixPath("src/app.py"), 4, 2),
+    )
+
+
+def _unlocated_diagnostic() -> Diagnostic:
+    return Diagnostic("rule-b", Severity.WARNING, "unlocated finding")
+
+
+def _mixed_report() -> LintReport:
+    return LintReport(
+        1,
+        (_located_diagnostic(), _unlocated_diagnostic()),
+        (PurePosixPath("src/app.py"),),
+        ("rule-a", "rule-b"),
+        (),
+        (),
+    )
+
+
+def _run_cli(
+    all_arguments: list[str],
+    *,
+    stdin_text: str = "",
+    lint_runner: Callable[[LintRequest], LintReport],
+    repository_root: Path,
+) -> tuple[int, str, str]:
+    stdout = io.StringIO()
+    stderr = io.StringIO()
+    exit_code = _cli_module().main(
+        all_arguments,
+        stdin=io.StringIO(stdin_text),
+        stdout=stdout,
+        stderr=stderr,
+        lint_runner=lint_runner,
+        repository_root=repository_root,
+    )
+    return exit_code, stdout.getvalue(), stderr.getvalue()
+
+
+def _capture_request(
+    all_arguments: list[str],
+    repository_root: Path,
+    stdin_text: str = "",
+) -> LintRequest:
+    captured_request: dict[str, LintRequest] = {}
+
+    def fake_lint(request: LintRequest) -> LintReport:
+        captured_request["request"] = request
+        return _clean_report()
+
+    exit_code, _, stderr_text = _run_cli(
+        all_arguments,
+        stdin_text=stdin_text,
+        lint_runner=fake_lint,
+        repository_root=repository_root,
+    )
+    assert exit_code == 0, stderr_text
+    return captured_request["request"]
+
+
+def test_should_build_explicit_files_request(tmp_path: Path) -> None:
+    request = _capture_request(
+        ["--files", "src/a.py", "src/b.py"],
+        repository_root=tmp_path,
+    )
+    assert isinstance(request.source, ExplicitFiles)
+    assert request.source.paths == (Path("src/a.py"), Path("src/b.py"))
+    assert request.repository_root == tmp_path
+    assert request.rule_sets == frozenset({"changed"})
+
+
+def test_should_build_staged_request(tmp_path: Path) -> None:
+    request = _capture_request(["--staged"], repository_root=tmp_path)
+    assert isinstance(request.source, StagedChanges)
+    assert request.rule_sets == frozenset({"changed"})
+
+
+def test_should_build_base_request(tmp_path: Path) -> None:
+    request = _capture_request(
+        ["--base", "origin/main"],
+        repository_root=tmp_path,
+    )
+    assert isinstance(request.source, BaseChanges)
+    assert request.source.revision == "origin/main"
+
+
+def test_should_build_repository_request(tmp_path: Path) -> None:
+    request = _capture_request(["--repository"], repository_root=tmp_path)
+    assert isinstance(request.source, RepositoryTree)
+    assert request.rule_sets == frozenset({"repository"})
+
+
+def test_should_read_text_as_from_stdin_not_disk(tmp_path: Path) -> None:
+    buffer_path = tmp_path / "draft.py"
+    buffer_path.write_text("DISK CONTENTS\n", encoding="utf-8")
+    request = _capture_request(
+        ["--text-as", str(buffer_path)],
+        repository_root=tmp_path,
+        stdin_text="EDITOR BUFFER",
+    )
+    assert isinstance(request.source, TextDocument)
+    assert request.source.path == buffer_path
+    assert request.source.text == "EDITOR BUFFER"
+
+
+def test_should_reject_combined_source_flags(tmp_path: Path) -> None:
+    calls: list[LintRequest] = []
+
+    def fake_lint(request: LintRequest) -> LintReport:
+        calls.append(request)
+        return _clean_report()
+
+    exit_code, _, stderr_text = _run_cli(
+        ["--files", "a.py", "--staged"],
+        lint_runner=fake_lint,
+        repository_root=tmp_path,
+    )
+    assert exit_code == 2
+    assert calls == []
+    assert stderr_text != ""
+
+
+def test_should_exit_two_when_no_source_flag(tmp_path: Path) -> None:
+    exit_code, _, stderr_text = _run_cli(
+        [],
+        lint_runner=lambda _request: _clean_report(),
+        repository_root=tmp_path,
+    )
+    assert exit_code == 2
+    assert stderr_text != ""
+
+
+def test_should_discover_repository_root_from_nested_directory(tmp_path: Path) -> None:
+    subprocess.run(
+        ["git", "init", "--quiet"],
+        cwd=tmp_path,
+        check=True,
+        capture_output=True,
+    )
+    nested_directory = tmp_path / "nested"
+    nested_directory.mkdir()
+    assert _cli_module()._discover_repository_root(nested_directory) == tmp_path.resolve()
+
+
+def test_should_resolve_files_from_the_caller_directory(tmp_path: Path) -> None:
+    all_arguments = _cli_module()._resolve_shell_file_arguments(
+        ["--files", "nested.py", "--format", "json"], tmp_path
+    )
+    assert all_arguments == [
+        "--files",
+        str(tmp_path / "nested.py"),
+        "--format",
+        "json",
+    ]
+
+
+def test_should_resolve_text_path_from_the_caller_directory(tmp_path: Path) -> None:
+    all_arguments = _cli_module()._resolve_shell_file_arguments(
+        ["--text-as", "nested.py", "--format", "editor"], tmp_path
+    )
+    assert all_arguments == [
+        "--text-as",
+        str(tmp_path / "nested.py"),
+        "--format",
+        "editor",
+    ]
+
+
+def test_should_report_missing_git_as_invalid_input(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    def missing_git(_repository_root: Path, _all_arguments: tuple[str, ...]) -> bytes:
+        raise FileNotFoundError("git")
+
+    monkeypatch.setattr(_cli_module(), "git_bytes_for", missing_git)
+    with pytest.raises(_cli_module()._LintUsageError, match="Git repository"):
+        _cli_module()._discover_repository_root(tmp_path)
+
+
+def test_should_exit_two_for_unknown_format(tmp_path: Path) -> None:
+    exit_code, _, stderr_text = _run_cli(
+        ["--files", "a.py", "--format", "xml"],
+        lint_runner=lambda _request: _clean_report(),
+        repository_root=tmp_path,
+    )
+    assert exit_code == 2
+    assert stderr_text != ""
+
+
+def test_should_exit_two_when_selection_fails(tmp_path: Path) -> None:
+    def fake_lint(request: LintRequest) -> LintReport:
+        del request
+        raise SelectionRunFatal("File does not exist: missing.py")
+
+    exit_code, _, stderr_text = _run_cli(
+        ["--files", "missing.py"],
+        lint_runner=fake_lint,
+        repository_root=tmp_path,
+    )
+    assert exit_code == 2
+    assert "File does not exist: missing.py" in stderr_text
+
+
+def test_should_exit_zero_when_the_report_is_clean(tmp_path: Path) -> None:
+    exit_code, stdout_text, stderr_text = _run_cli(
+        ["--staged"],
+        lint_runner=lambda _request: _clean_report(),
+        repository_root=tmp_path,
+    )
+    assert exit_code == 0
+    assert stderr_text == ""
+    assert stdout_text == ""
+
+
+def _stage_oversized_test_file(repository_root: Path) -> None:
+    subprocess.run(
+        ["git", "init", "--quiet"],
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )
+    oversized_path = repository_root / "tests" / "oversized.mjs"
+    oversized_path.parent.mkdir()
+    oversized_path.write_bytes(b"\n" * 1001)
+    subprocess.run(
+        ["git", "add", "--", "tests/oversized.mjs"],
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )
+
+
+def _run_staged_format(
+    report_format: str, repository_root: Path
+) -> tuple[int, str, str]:
+    return _run_cli(
+        ["--staged", "--format", report_format],
+        lint_runner=_cli_module().lint,
+        repository_root=repository_root,
+    )
+
+
+def test_staged_clean_reports_keep_legacy_advisories_outside_renderer(
+    tmp_path: Path,
+) -> None:
+    _stage_oversized_test_file(tmp_path)
+    json_exit_code, json_stdout, json_stderr = _run_staged_format("json", tmp_path)
+    text_exit_code, text_stdout, text_stderr = _run_staged_format("text", tmp_path)
+    editor_exit_code, editor_stdout, editor_stderr = _run_staged_format(
+        "editor", tmp_path
+    )
+
+    assert json_exit_code == 0
+    assert json_stderr == ""
+    json_report = json.loads(json_stdout)
+    assert json_report["diagnostics"] == []
+    assert "terminology-sweep" in json_report["executed_rules"]
+    assert text_exit_code == 0
+    assert text_stdout == ""
+    assert text_stderr == ""
+    assert editor_exit_code == 0
+    assert editor_stdout == ""
+    assert editor_stderr == ""
+
+
+def test_staged_git_failure_exits_three_with_valid_json(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _stage_oversized_test_file(tmp_path)
+    adapter_module = sys.modules["policy_lint.adapters"]
+    terminology_module = adapter_module._pr_loop_script_module("terminology_sweep")
+
+    def fail_git(
+        _repository_root: Path, _all_arguments: object
+    ) -> subprocess.CompletedProcess[str]:
+        raise RuntimeError("simulated Git failure")
+
+    monkeypatch.setattr(terminology_module, "_run_strict_git", fail_git)
+    exit_code, stdout_text, stderr_text = _run_staged_format("json", tmp_path)
+    parsed_report = json.loads(stdout_text)
+
+    assert exit_code == 3
+    assert stderr_text == ""
+    assert parsed_report["diagnostics"] == []
+    assert parsed_report["failed_rules"] == ["terminology-sweep"]
+
+
+def test_should_exit_one_when_diagnostics_exist(tmp_path: Path) -> None:
+    exit_code, stdout_text, _stderr_text = _run_cli(
+        ["--files", "src/app.py"],
+        lint_runner=lambda _request: _mixed_report(),
+        repository_root=tmp_path,
+    )
+    assert exit_code == 1
+    assert "located finding" in stdout_text
+    assert "unlocated finding" in stdout_text
+
+
+def test_should_exit_three_when_a_rule_fails(tmp_path: Path) -> None:
+    failed_report = LintReport(1, (), (), (), ("rule-a",), ())
+    exit_code, stdout_text, _stderr_text = _run_cli(
+        ["--staged"],
+        lint_runner=lambda _request: failed_report,
+        repository_root=tmp_path,
+    )
+    assert exit_code == 3
+    assert "rule-a" in stdout_text
+
+
+def test_should_emit_schema_versioned_deterministic_json(tmp_path: Path) -> None:
+    render_module = _render_module()
+    first_text = render_module.render(_mixed_report(), render_module.ReportFormat.JSON)
+    second_text = render_module.render(_mixed_report(), render_module.ReportFormat.JSON)
+    assert first_text == second_text
+    parsed_report = json.loads(first_text)
+    assert parsed_report["schema_version"] == 1
+    assert parsed_report == json.loads(
+        json.dumps(parsed_report, sort_keys=True)
+    )
+    exit_code, stdout_text, _stderr_text = _run_cli(
+        ["--files", "src/app.py", "--format", "json"],
+        lint_runner=lambda _request: _mixed_report(),
+        repository_root=tmp_path,
+    )
+    assert exit_code == 1
+    assert json.loads(stdout_text) == parsed_report
+
+
+def test_should_emit_only_located_diagnostics_in_editor_format(
+    tmp_path: Path,
+) -> None:
+    render_module = _render_module()
+    rendered_text = render_module.render(
+        _mixed_report(), render_module.ReportFormat.EDITOR
+    )
+    assert "src/app.py:4:2:" in rendered_text
+    assert "located finding" in rendered_text
+    assert "unlocated finding" not in rendered_text
+    exit_code, stdout_text, _stderr_text = _run_cli(
+        ["--files", "src/app.py", "--format", "editor"],
+        lint_runner=lambda _request: _mixed_report(),
+        repository_root=tmp_path,
+    )
+    assert exit_code == 1
+    assert "src/app.py:4:2:" in stdout_text
+    assert "unlocated finding" not in stdout_text

package/scripts/tests/test_claude_md.py

@@ -0,0 +1,68 @@
+"""Behavior tests for committed CLAUDE.md references."""
+
+from __future__ import annotations
+
+import sys
+from collections.abc import Iterator
+from pathlib import Path
+
+import pytest
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_checks.config.constants import (
+    CHECK_ID_CLAUDE_MD_ORPHANS,
+    FAILED_CHECK_EXIT_CODE,
+    FINDINGS_EXIT_CODE,
+)
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    run_policy,
+    write_text,
+)
+
+
+def test_should_flag_a_broken_claude_md_file_reference(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(
+        repository_root / "notes" / "CLAUDE.md",
+        "# notes\n\n"
+        "| File | Role |\n"
+        "|---|---|\n"
+        "| `absent_helper.py` | Missing helper |\n",
+    )
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert CHECK_ID_CLAUDE_MD_ORPHANS in stdout_text
+    assert "notes/CLAUDE.md" in stdout_text
+    assert "absent_helper.py" in stdout_text
+
+
+def test_should_fail_closed_when_claude_md_walk_fails_after_first_entry(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(
+        repository_root / "notes" / "CLAUDE.md",
+        "# notes\n\n"
+        "| File | Role |\n"
+        "|---|---|\n"
+        "| `absent_helper.py` | Missing helper |\n",
+    )
+    commit_tracked_files(repository_root)
+
+    def fail_after_first_entry(_file_path: Path, _pattern: str = "*") -> Iterator[Path]:
+        yield repository_root / "notes" / "CLAUDE.md"
+        raise OSError("scan root unreadable")
+
+    monkeypatch.setattr(Path, "rglob", fail_after_first_entry)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert CHECK_ID_CLAUDE_MD_ORPHANS in stdout_text
+    assert "error: rule failed:" in stdout_text

package/scripts/tests/test_env_var_documentation.py

@@ -0,0 +1,133 @@
+"""Behavior tests for environment-variable documentation checks."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_checks.config.constants import (
+    CHECK_ID_ENV_VAR_DOCUMENTATION,
+    FAILED_CHECK_EXIT_CODE,
+    FINDINGS_EXIT_CODE,
+    SUCCESS_EXIT_CODE,
+)
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    patch_unreadable_named_file,
+    run_policy,
+    write_text,
+)
+
+
+def test_should_flag_environment_variable_documentation_drift(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(
+        repository_root / "auth" / "google_auth.py", "def load() -> None:\n    return\n"
+    )
+    write_text(
+        repository_root / "docs" / "configuration.md",
+        "## Summary: Environment Variables\n\n"
+        "| Variable | Used By | Purpose |\n"
+        "|----------|---------|---------|\n"
+        "| `GOOGLE_APPLICATION_CREDENTIALS` | `auth/google_auth.py` | Path to JSON |\n",
+    )
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert CHECK_ID_ENV_VAR_DOCUMENTATION in stdout_text
+    assert "docs/configuration.md" in stdout_text
+    assert "GOOGLE_APPLICATION_CREDENTIALS -> auth/google_auth.py" in stdout_text
+
+
+def test_should_ignore_long_code_reference_inside_code_fence(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    long_code_reference = ("x" * 300) + ".py"
+    write_text(
+        repository_root / "docs" / "review.md",
+        f"# Review\n\n~~~diff\n+ `{long_code_reference}`\n~~~\n",
+    )
+    commit_tracked_files(repository_root)
+    original_is_file = Path.is_file
+
+    def reject_long_filename(candidate_path: Path) -> bool:
+        if len(candidate_path.name) > 255:
+            raise OSError(candidate_path)
+        return original_is_file(candidate_path)
+
+    monkeypatch.setattr(Path, "is_file", reject_long_filename)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == SUCCESS_EXIT_CODE
+    assert CHECK_ID_ENV_VAR_DOCUMENTATION not in stdout_text
+
+
+def test_should_fail_closed_when_an_env_var_code_file_cannot_be_read(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(
+        repository_root / "packages" / "service" / "auth" / "google_auth.py",
+        "def load() -> None:\n    return\n",
+    )
+    write_text(
+        repository_root / "docs" / "configuration.md",
+        "## Summary: Environment Variables\n\n"
+        "| Variable | Used By | Purpose |\n"
+        "|----------|---------|---------|\n"
+        "| `GOOGLE_APPLICATION_CREDENTIALS` | `auth/google_auth.py` | Path to JSON |\n",
+    )
+    commit_tracked_files(repository_root)
+    patch_unreadable_named_file(monkeypatch, "google_auth.py", "code file unreadable")
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert CHECK_ID_ENV_VAR_DOCUMENTATION in stdout_text
+    assert "error: rule failed:" in stdout_text
+
+
+def test_should_fail_closed_before_reading_env_var_code_file_outside_repository(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    outside_path = tmp_path / "outside.py"
+    write_text(outside_path, "def load() -> None:\n    return\n")
+    write_text(
+        repository_root / "docs" / "configuration.md",
+        "## Summary: Environment Variables\n\n"
+        "| Variable | Used By | Purpose |\n"
+        "|----------|---------|---------|\n"
+        "| `EXTERNAL_TOKEN` | `../outside.py` | External consumer |\n",
+    )
+    commit_tracked_files(repository_root)
+    all_read_paths = record_read_paths(monkeypatch)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert CHECK_ID_ENV_VAR_DOCUMENTATION in stdout_text
+    assert outside_path not in all_read_paths
+
+
+def record_read_paths(monkeypatch: pytest.MonkeyPatch) -> list[Path]:
+    original_read_text = Path.read_text
+    all_read_paths: list[Path] = []
+
+    def record_read_path(
+        file_path: Path,
+        encoding: str | None = None,
+        errors: str | None = None,
+    ) -> str:
+        all_read_paths.append(file_path.resolve())
+        return original_read_text(file_path, encoding=encoding, errors=errors)
+
+    monkeypatch.setattr(Path, "read_text", record_read_path)
+    return all_read_paths

package/scripts/tests/test_hook_modules.py

@@ -0,0 +1,17 @@
+"""Behavior tests for repository-check hook module loading."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+
+from repository_checks.hook_modules import load_hooks_module
+
+
+def test_should_load_a_hooks_module_by_its_dotted_name() -> None:
+    loaded_module = load_hooks_module("hooks_constants.pii_prevention_constants")
+    assert loaded_module.__name__ == "hooks_constants.pii_prevention_constants"

package/scripts/tests/test_models.py

@@ -0,0 +1,26 @@
+"""Behavior tests for repository-check report models."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+
+from repository_checks.config.constants import (
+    FAILED_CHECK_EXIT_CODE,
+    FINDINGS_EXIT_CODE,
+    SUCCESS_EXIT_CODE,
+)
+from repository_checks.models import RepositoryCheckReport, RepositoryFinding
+
+
+def test_should_choose_exit_code_by_report_severity() -> None:
+    finding = RepositoryFinding("check", "file.py", "message")
+    assert RepositoryCheckReport((), ()).exit_code == SUCCESS_EXIT_CODE
+    assert RepositoryCheckReport((finding,), ()).exit_code == FINDINGS_EXIT_CODE
+    assert RepositoryCheckReport((finding,), ("check",)).exit_code == (
+        FAILED_CHECK_EXIT_CODE
+    )