claude-dev-env 2.4.0 → 2.5.0

package/hooks/validators/test_python_antipattern_checks.py

@@ -4,8 +4,6 @@ import ast
 import sys
 from pathlib import Path
 
-import pytest
-
 from .python_antipattern_checks import (
     check_mutable_default_args,
     check_bare_except,
@@ -198,16 +196,23 @@ def emit_status(message):
 '''
 
 
-def _antipattern_result_for(file_path: str, content: str) -> ValidatorResult:
-    """Return the Python Anti-patterns result for content proposed at file_path."""
+def _named_result(
+    file_path: str, content: str, validator_name: str
+) -> ValidatorResult:
+    """Return the named validator result for content proposed at file_path."""
     all_results = validate_proposed_file(file_path, content)
     return next(
         each_result
         for each_result in all_results
-        if each_result.name == ANTIPATTERN_VALIDATOR_NAME
+        if each_result.name == validator_name
     )
 
 
+def _antipattern_result_for(file_path: str, content: str) -> ValidatorResult:
+    """Return the Python Anti-patterns result for content proposed at file_path."""
+    return _named_result(file_path, content, ANTIPATTERN_VALIDATOR_NAME)
+
+
 class TestPrintCliExemptionThroughPipeline:
     """Pin the CLI-marker print exemption through the validate_proposed_file pipeline.
 
@@ -222,3 +227,103 @@ class TestPrintCliExemptionThroughPipeline:
         antipattern_result = _antipattern_result_for(CLI_BASENAME, PIPELINE_PRINT_SOURCE)
         assert antipattern_result.passed
         assert PRINT_FINDING_FRAGMENT not in antipattern_result.output
+
+
+SCRIPTS_DIRECTORY_PATH = "packages/foo/scripts/run_job.py"
+NON_EXEMPT_PRODUCTION_PATH = "packages/foo/services/worker.py"
+TEST_FILE_PROPOSED_PATH = "packages/foo/tests/test_helpers.py"
+USELESS_TEST_VALIDATOR_NAME = "Useless Tests"
+USELESS_TEST_SOURCE = '''
+def test_exists():
+    assert callable(str)
+'''
+TEST_HELPER_DIRECTORY_PATH = "packages/foo/tests/helper_functions.py"
+NON_TEST_DIRECTORY_HELPER_PATH = "packages/foo/helpers/helper_functions.py"
+CONFIG_DIRECTORY_MAGIC_PATH = "packages/foo/config/threshold_values.py"
+CONFIG_CONSTANTS_DIRECTORY_MAGIC_PATH = (
+    "packages/foo/pr_converge_skill_constants/threshold_values.py"
+)
+NON_EXEMPT_MAGIC_PATH = "packages/foo/services/threshold_values.py"
+MAGIC_VALUE_VALIDATOR_NAME = "Magic Values"
+MAGIC_NUMBER_SOURCE = '''
+def scale_amount(quantity):
+    return quantity * 199 * 42
+'''
+
+
+class TestDirectoryExemptionThroughPipeline:
+    """Directory-based exemptions must survive validate_proposed_file staging.
+
+    Basename-only temp staging drops /scripts/, so print() was falsely denied.
+    The real-path unit check allows the same content; the pipeline must match.
+    """
+
+    def test_scripts_directory_print_passes_through_pipeline(self) -> None:
+        tree = ast.parse(PIPELINE_PRINT_SOURCE)
+        basename_only = Path(SCRIPTS_DIRECTORY_PATH).name
+
+        assert len(check_print_in_production(tree, basename_only)) == 1
+        assert check_print_in_production(tree, SCRIPTS_DIRECTORY_PATH) == []
+
+        antipattern_result = _antipattern_result_for(
+            SCRIPTS_DIRECTORY_PATH, PIPELINE_PRINT_SOURCE
+        )
+        assert antipattern_result.passed
+        assert PRINT_FINDING_FRAGMENT not in antipattern_result.output
+
+    def test_non_exempt_production_print_still_fails_through_pipeline(self) -> None:
+        antipattern_result = _antipattern_result_for(
+            NON_EXEMPT_PRODUCTION_PATH, PIPELINE_PRINT_SOURCE
+        )
+        assert not antipattern_result.passed
+        assert PRINT_FINDING_FRAGMENT in antipattern_result.output
+
+    def test_test_filename_filtering_still_recognizes_test_path(self) -> None:
+        all_results = validate_proposed_file(TEST_FILE_PROPOSED_PATH, USELESS_TEST_SOURCE)
+        useless_result = next(
+            each_result
+            for each_result in all_results
+            if each_result.name == USELESS_TEST_VALIDATOR_NAME
+        )
+        assert not useless_result.passed
+        assert "callable" in useless_result.output.lower()
+
+        antipattern_result = _antipattern_result_for(
+            TEST_FILE_PROPOSED_PATH, TEST_FILE_WITH_PRINT
+        )
+        assert antipattern_result.passed
+        assert PRINT_FINDING_FRAGMENT not in antipattern_result.output
+
+    def test_tests_directory_recognized_without_test_basename(self) -> None:
+        exempt_result = _antipattern_result_for(
+            TEST_HELPER_DIRECTORY_PATH, PIPELINE_PRINT_SOURCE
+        )
+        assert exempt_result.passed
+        assert PRINT_FINDING_FRAGMENT not in exempt_result.output
+
+        flagged_result = _antipattern_result_for(
+            NON_TEST_DIRECTORY_HELPER_PATH, PIPELINE_PRINT_SOURCE
+        )
+        assert not flagged_result.passed
+        assert PRINT_FINDING_FRAGMENT in flagged_result.output
+
+    def test_config_directory_magic_value_exempt_through_pipeline(self) -> None:
+        exempt_result = _named_result(
+            CONFIG_DIRECTORY_MAGIC_PATH, MAGIC_NUMBER_SOURCE, MAGIC_VALUE_VALIDATOR_NAME
+        )
+        assert exempt_result.passed
+
+        denied_result = _named_result(
+            NON_EXEMPT_MAGIC_PATH, MAGIC_NUMBER_SOURCE, MAGIC_VALUE_VALIDATOR_NAME
+        )
+        assert not denied_result.passed
+
+    def test_config_exemption_survives_with_skill_constants_directory_ancestor(
+        self,
+    ) -> None:
+        exempt_result = _named_result(
+            CONFIG_CONSTANTS_DIRECTORY_MAGIC_PATH,
+            MAGIC_NUMBER_SOURCE,
+            MAGIC_VALUE_VALIDATOR_NAME,
+        )
+        assert exempt_result.passed

package/hooks/validators/test_ruff_integration.py

@@ -1,5 +1,7 @@
 """Tests for ruff integration module."""
 
+import subprocess
+import sys
 from pathlib import Path
 from unittest.mock import patch
 
@@ -7,6 +9,7 @@ from .ruff_integration import (
     RuffResult,
     _config_relative_stdin_filename,
     _parse_fixed_count,
+    _staged_ruff_result,
     check_ruff_available,
     run_ruff_check,
 )
@@ -94,6 +97,92 @@ def test_run_ruff_check_applies_config_resolved_from_config_source_path(
     assert "B011" in with_source.output
 
 
+def test_run_ruff_check_grades_a_staged_copy_holding_non_ascii_text(
+    tmp_path: Path,
+) -> None:
+    """A staged copy carrying non-ASCII text reaches ruff intact.
+
+    The staged shape pipes the copy's text to ruff on stdin, and ruff reads
+    stdin as UTF-8. Encoding that pipe with the host locale codec instead
+    hands ruff a byte it rejects, so every Python file holding a non-ASCII
+    character fails the gate on a host whose locale codec is not UTF-8.
+    """
+    ruff_repo = tmp_path / "ruff_repo"
+    ruff_repo.mkdir()
+    (ruff_repo / "pyproject.toml").write_text("[tool.ruff]\n", encoding="utf-8")
+    original_target = ruff_repo / "dashes.py"
+    staged_copy = tmp_path / "detached" / "dashes.py"
+    staged_copy.parent.mkdir(parents=True)
+    staged_copy.write_text('DASH_NOTE = "an em dash — here"\n', encoding="utf-8")
+
+    result = run_ruff_check([staged_copy], config_source_path=original_target)
+
+    assert result.passed is True
+
+
+def test_staged_ruff_result_pins_utf8_encoding_with_tolerant_decode(
+    tmp_path: Path,
+) -> None:
+    """The staged ruff call pins UTF-8 and decodes ruff output tolerantly.
+
+    ::
+
+        subprocess.run(..., encoding="utf-8", errors="replace", ...)
+        ok:   locale-independent stdin; a non-UTF-8 byte in ruff output never raises
+        flag: encoding omitted -> locale codec; errors omitted -> strict decode
+              raises out of subprocess.run on POSIX (fail-open in the gate)
+
+    The kwargs carry the contract host-independently. The locale fallback the
+    integration test above depends on cannot be forced portably, so this guard
+    asserts the call itself rather than the emergent behavior.
+    """
+    pyproject = tmp_path / "pyproject.toml"
+    pyproject.write_text("[tool.ruff]\n", encoding="utf-8")
+    captured_keyword_arguments: dict[str, object] = {}
+
+    def record_call(*positional: object, **keyword: object) -> subprocess.CompletedProcess[str]:
+        captured_keyword_arguments.update(keyword)
+        return subprocess.CompletedProcess([], 0, stdout="", stderr="")
+
+    with patch("subprocess.run", side_effect=record_call):
+        _staged_ruff_result(pyproject, "probe.py", "x = 1\n")
+
+    assert captured_keyword_arguments["encoding"] == "utf-8"
+    assert captured_keyword_arguments["errors"] == "replace"
+
+
+def test_staged_ruff_result_tolerates_non_utf8_bytes_in_ruff_output(
+    tmp_path: Path,
+) -> None:
+    """A non-UTF-8 byte in ruff's output is decoded tolerantly, not dropped.
+
+    ::
+
+        ruff output carries byte 0x92 (a cp1252 curly quote, invalid UTF-8)
+        ok:   errors="replace" -> output keeps the surrounding text
+        flag: errors="strict"  -> POSIX raises out of run; Windows drops the
+              stream to None and the surrounding text is lost
+
+    Swaps the ruff argv for a python one-liner emitting the bad byte, so the
+    real subprocess decode path runs against real bytes.
+    """
+    pyproject = tmp_path / "pyproject.toml"
+    pyproject.write_text("[tool.ruff]\n", encoding="utf-8")
+    emit_bad_byte_command = [
+        sys.executable,
+        "-c",
+        "import sys; sys.stdout.buffer.write(bytes([0x62, 0x92, 0x63]))",
+    ]
+    staged_module = sys.modules[_staged_ruff_result.__module__]
+    with patch.object(
+        staged_module, "_staged_ruff_command", return_value=emit_bad_byte_command
+    ):
+        result = _staged_ruff_result(pyproject, "probe.py", "x = 1\n")
+
+    assert "b" in result.output
+    assert "c" in result.output
+
+
 def test_run_ruff_check_emits_location_prefixed_lines(tmp_path: Path) -> None:
     """Each reported violation carries a ``path:line:col:`` prefix on its own line.
 
@@ -105,7 +194,8 @@ def test_run_ruff_check_emits_location_prefixed_lines(tmp_path: Path) -> None:
     violating_file = tmp_path / "unused_import_module.py"
     violating_file.write_text("import os\n", encoding="utf-8")
 
-    result = run_ruff_check([violating_file])
+    with patch.dict("os.environ", {"FORCE_COLOR": "1"}):
+        result = run_ruff_check([violating_file])
 
     assert result.passed is False
     location_prefix = f"{violating_file}:1:8:"
@@ -113,3 +203,4 @@ def test_run_ruff_check_emits_location_prefixed_lines(tmp_path: Path) -> None:
         each_line.startswith(location_prefix) and "F401" in each_line
         for each_line in result.output.splitlines()
     ), result.output
+    assert "\x1b[" not in result.output

package/hooks/validators/test_run_all_validators.py

@@ -8,9 +8,11 @@ from unittest.mock import MagicMock, patch
 
 import pytest
 
+from .exempt_paths import is_test_file
 from .run_all_validators import (
     ValidatorResult,
     _hooks_subprocess_working_directory_and_environment,
+    _temporary_path_preserving_directory_signal,
     add_timing,
     build_json_output,
     create_timing_metrics,
@@ -28,6 +30,22 @@ _ASSERT_FALSE_SOURCE = (
     "def probe_condition(observed_total: int) -> None:\n"
     "    assert False, observed_total\n"
 )
+PRINT_PRODUCTION_CONTENT = 'def run() -> None:\n    print("x")\n'
+ALL_PYTHON_TEST_EXEMPT_PATHS = [
+    "pkg/test_helpers/worker.py",
+    "pkg/conftest.py",
+    "pkg/foo_test.py",
+]
+ALL_NON_TEST_PRODUCTION_PATHS = [
+    "pkg/worker.py",
+    "pkg/latest/worker.py",
+    "pkg/protest/worker.py",
+]
+ALL_IS_TEST_FILE_PARITY_PATHS = (
+    ALL_PYTHON_TEST_EXEMPT_PATHS
+    + ALL_NON_TEST_PRODUCTION_PATHS
+    + ["pkg/data.spec.helpers/worker.py"]
+)
 
 
 def test_validate_proposed_file_threads_ruff_config_from_original_path() -> None:
@@ -48,6 +66,52 @@ def test_validate_proposed_file_threads_ruff_config_from_original_path() -> None
     assert "B011" in ruff_output
 
 
+def _validators_deny_print(file_path: str) -> bool:
+    all_results = validate_proposed_file(file_path, PRINT_PRODUCTION_CONTENT)
+    return any(not each_result.passed for each_result in all_results)
+
+
+@pytest.mark.parametrize("file_path", ALL_PYTHON_TEST_EXEMPT_PATHS)
+def test_staging_keeps_substring_test_exemption(file_path: str) -> None:
+    assert is_test_file(file_path) is True
+    assert _validators_deny_print(file_path) is False
+
+
+@pytest.mark.parametrize("file_path", ALL_NON_TEST_PRODUCTION_PATHS)
+def test_staging_leaves_non_test_paths_denied(file_path: str) -> None:
+    assert is_test_file(file_path) is False
+    assert _validators_deny_print(file_path) is True
+
+
+@pytest.mark.parametrize("file_path", ALL_IS_TEST_FILE_PARITY_PATHS)
+def test_staged_path_matches_is_test_file_verdict(
+    file_path: str, tmp_path: Path
+) -> None:
+    staged_path = _temporary_path_preserving_directory_signal(tmp_path, file_path)
+    staged_relative_path = staged_path.relative_to(tmp_path)
+    assert is_test_file(str(staged_relative_path)) == is_test_file(file_path)
+
+
+def _passing_mock_result() -> MagicMock:
+    """Return a mock validator result that reports a passing check."""
+    mock_result = MagicMock()
+    mock_result.passed = True
+    mock_result.name = "Test"
+    mock_result.checks = "test"
+    mock_result.output = ""
+    return mock_result
+
+
+def _run_main_with_argv(command_line_arguments: list[str]) -> int | None:
+    """Run ``main`` under the given argv and always restore the original argv."""
+    original_argv = sys.argv
+    try:
+        sys.argv = command_line_arguments
+        return main()
+    finally:
+        sys.argv = original_argv
+
+
 class TestFixFlag:
     """Test --fix flag functionality."""
 
@@ -56,25 +120,11 @@ class TestFixFlag:
         with patch("validators.run_all_validators.get_changed_files") as mock_get_files, \
              patch("validators.run_all_validators.run_file_structure_checks") as mock_file, \
              patch("validators.run_all_validators.run_git_checks") as mock_git:
-
             mock_get_files.return_value = []
+            mock_file.return_value = _passing_mock_result()
+            mock_git.return_value = _passing_mock_result()
 
-            mock_result = MagicMock()
-            mock_result.passed = True
-            mock_result.name = "Test"
-            mock_result.checks = "test"
-            mock_result.output = ""
-
-            mock_file.return_value = mock_result
-            mock_git.return_value = mock_result
-
-            original_argv = sys.argv
-            try:
-                sys.argv = ["run_all_validators.py", "--fix"]
-                result = main()
-                assert result == 0
-            finally:
-                sys.argv = original_argv
+            assert _run_main_with_argv(["run_all_validators.py", "--fix"]) == 0
 
     def test_fix_flag_calls_fix_python_style(self) -> None:
         """Verify --fix flag triggers fix_python_style when files exist."""
@@ -86,29 +136,12 @@ class TestFixFlag:
              patch("validators.run_all_validators.run_comment_checks") as mock_comment, \
              patch("validators.run_all_validators.run_file_structure_checks") as mock_file, \
              patch("validators.run_all_validators.run_git_checks") as mock_git:
-
             mock_get_files.return_value = [Path("test.py")]
             mock_fix.return_value = ["test.py"]
+            for each_mock in (mock_style, mock_test, mock_react, mock_comment, mock_file, mock_git):
+                each_mock.return_value = _passing_mock_result()
 
-            mock_result = MagicMock()
-            mock_result.passed = True
-            mock_result.name = "Test"
-            mock_result.checks = "test"
-            mock_result.output = ""
-
-            mock_style.return_value = mock_result
-            mock_test.return_value = mock_result
-            mock_react.return_value = mock_result
-            mock_comment.return_value = mock_result
-            mock_file.return_value = mock_result
-            mock_git.return_value = mock_result
-
-            original_argv = sys.argv
-            try:
-                sys.argv = ["run_all_validators.py", "--fix"]
-                main()
-            finally:
-                sys.argv = original_argv
+            _run_main_with_argv(["run_all_validators.py", "--fix"])
 
             mock_fix.assert_called_once()
 
@@ -122,59 +155,71 @@ class TestFixFlag:
              patch("validators.run_all_validators.run_comment_checks") as mock_comment, \
              patch("validators.run_all_validators.run_file_structure_checks") as mock_file, \
              patch("validators.run_all_validators.run_git_checks") as mock_git:
-
             mock_get_files.return_value = [Path("test.py")]
+            for each_mock in (mock_style, mock_test, mock_react, mock_comment, mock_file, mock_git):
+                each_mock.return_value = _passing_mock_result()
 
-            mock_result = MagicMock()
-            mock_result.passed = True
-            mock_result.name = "Test"
-            mock_result.checks = "test"
-            mock_result.output = ""
-
-            mock_style.return_value = mock_result
-            mock_test.return_value = mock_result
-            mock_react.return_value = mock_result
-            mock_comment.return_value = mock_result
-            mock_file.return_value = mock_result
-            mock_git.return_value = mock_result
-
-            original_argv = sys.argv
-            try:
-                sys.argv = ["run_all_validators.py"]
-                main()
-            finally:
-                sys.argv = original_argv
+            _run_main_with_argv(["run_all_validators.py"])
 
             mock_fix.assert_not_called()
 
 
+class TestStagedPathContainment:
+    """Staged validation paths must never escape the temporary root."""
+
+    def test_parent_traversal_path_stays_inside_temp_root(self, tmp_path: Path) -> None:
+        temporary_root = tmp_path / "staging"
+        temporary_root.mkdir()
+        traversal_path = "scripts/../../../../escaped_evil.py"
+
+        staged_file = _temporary_path_preserving_directory_signal(
+            temporary_root, traversal_path
+        )
+        staged_file.write_text("payload", encoding="utf-8")
+
+        assert staged_file.resolve().is_relative_to(temporary_root.resolve())
+        assert staged_file.read_text(encoding="utf-8") == "payload"
+
+    def test_absolute_component_path_stays_inside_temp_root(self, tmp_path: Path) -> None:
+        temporary_root = tmp_path / "staging"
+        temporary_root.mkdir()
+        absolute_style_path = "/etc/cron.d/evil.py"
+
+        staged_file = _temporary_path_preserving_directory_signal(
+            temporary_root, absolute_style_path
+        )
+        staged_file.write_text("payload", encoding="utf-8")
+
+        assert staged_file.resolve().is_relative_to(temporary_root.resolve())
+
+
 class TestGracefulDegradation:
     def test_missing_validator_returns_skipped_result(self) -> None:
         def failing_validator() -> ValidatorResult:
             raise FileNotFoundError("validator.py not found")
 
-        result = run_with_fallback(
+        skipped_result = run_with_fallback(
             failing_validator,
             "Missing Validator",
             "99",
         )
 
-        assert result.skipped is True
-        assert "skipped" in result.output.lower()
-        assert result.passed is False
+        assert skipped_result.skipped is True
+        assert "skipped" in skipped_result.output.lower()
+        assert skipped_result.passed is False
 
     def test_validator_exception_returns_skipped_result(self) -> None:
         def crashing_validator() -> ValidatorResult:
             raise RuntimeError("Unexpected crash")
 
-        result = run_with_fallback(
+        skipped_result = run_with_fallback(
             crashing_validator,
             "Crashing Validator",
             "99",
         )
 
-        assert result.skipped is True
-        assert "skipped" in result.output.lower()
+        assert skipped_result.skipped is True
+        assert "skipped" in skipped_result.output.lower()
 
     def test_successful_validator_returns_normal_result(self) -> None:
         def working_validator() -> ValidatorResult:
@@ -185,14 +230,14 @@ class TestGracefulDegradation:
                 output="All good",
             )
 
-        result = run_with_fallback(
+        normal_result = run_with_fallback(
             working_validator,
             "Working",
             "1",
         )
 
-        assert result.skipped is False
-        assert result.passed is True
+        assert normal_result.skipped is False
+        assert normal_result.passed is True
 
 
 class TestStderrSurfacing:
@@ -269,7 +314,9 @@ class TestTimingMetrics:
 
 
 class TestVersionHeader:
-    def test_print_header_includes_version(self, capsys) -> None:
+    def test_print_header_includes_version(
+        self, capsys: pytest.CaptureFixture[str]
+    ) -> None:
         print_header()
         captured = capsys.readouterr()