claude-dev-env 2.4.0 → 2.7.0

package/hooks/blocking/test_pre_tool_use_dispatcher.py

@@ -300,6 +300,15 @@ def test_plain_language_denial_on_multi_edit_of_markdown_file() -> None:
     _assert_dispatcher_matches_individual_hooks(payload_text, MULTI_EDIT_TOOL_NAME)
 
 
+def test_dispatcher_docstring_points_at_roster_not_hardcoded_counts() -> None:
+    """The dispatcher docstring names the roster, not per-tool counts that drift."""
+    dispatcher_source = Path(_DISPATCHER_SCRIPT).read_text(encoding="utf-8")
+    assert "ALL_HOSTED_HOOK_ENTRIES" in dispatcher_source
+    assert "-> 20 hooks" not in dispatcher_source
+    assert "-> 21 hooks" not in dispatcher_source
+    assert "-> 9 hooks" not in dispatcher_source
+
+
 def test_multi_edit_runs_only_group_b_hooks() -> None:
     """Dispatcher invokes only Group-B hooks on MultiEdit, not Group-A hooks.
 
@@ -667,7 +676,7 @@ def test_proceed_after_run_all_validators_removal_allows() -> None:
     it was never a PreToolUse hook and never hosted by the PreToolUse dispatcher.
     A Python Write payload that run_all_validators would have flagged (mypy errors, for
     instance) still produces ALLOW from the PreToolUse dispatcher because the PreToolUse
-    dispatcher covers only its 22 hosted blocking hooks — none of which includes the
+    dispatcher covers only its 23 hosted blocking hooks — none of which includes the
     validators runner.
     """
     python_content_with_type_error = (

package/hooks/blocking/test_shell_substitution_blocker.py

@@ -0,0 +1,124 @@
+"""Tests for shell_substitution_blocker hook."""
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+
+SCRIPT_PATH = Path(__file__).parent / "shell_substitution_blocker.py"
+
+
+def _run_hook(payload: dict) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        [sys.executable, str(SCRIPT_PATH)],
+        input=json.dumps(payload),
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+
+
+def test_denies_dollar_paren_substitution() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": 'echo "head: $(git rev-parse HEAD)"'},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert (
+        "shell-substitution"
+        in response["hookSpecificOutput"]["permissionDecisionReason"]
+    )
+
+
+def test_denies_unescaped_backtick_substitution() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo `date`"},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_allows_plain_command_without_substitution() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "git rev-parse HEAD"},
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_allows_escaped_backtick_in_prose() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": r'echo "use \`foo\` like this"'},
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_ignores_non_bash_tool() -> None:
+    payload = {
+        "tool_name": "Edit",
+        "tool_input": {"command": 'echo "$(date)"'},
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_denies_double_backslash_backtick_bypass() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": r"echo \\`date`"},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_allows_dollar_paren_inside_single_quotes() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo '$(not-executed)'"},
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_allows_backtick_inside_single_quotes() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo '`not-executed`'"},
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_denies_input_process_substitution() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "diff <(cat a) <(cat b)"},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_denies_output_process_substitution() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "tee >(gzip > out.gz)"},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_allows_process_substitution_inside_single_quotes() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo '<(not-executed)'"},
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_allows_arithmetic_expansion() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo $((2+2))"},
+    }
+    assert _run_hook(payload).stdout == ""

package/hooks/blocking/test_stop_dispatcher.py

@@ -173,6 +173,29 @@ def test_dispatcher_blocks_hedging_message_matching_standalone() -> None:
     assert "probably" in parsed["reason"].lower() or "hedging" in parsed["reason"].lower()
 
 
+def test_dispatcher_blocks_overlong_reply_matching_standalone() -> None:
+    """An overlong last_assistant_message blocks through the dispatcher."""
+    overlong_message = "\n".join(
+        " ".join(f"finding{each_index}" for each_index in range(10))
+        for _ in range(30)
+    )
+    payload_text = json.dumps(
+        {"stop_hook_active": False, "last_assistant_message": overlong_message}
+    )
+    completed = subprocess.run(
+        [sys.executable, _DISPATCHER_SCRIPT],
+        check=False,
+        input=payload_text,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+    )
+    assert completed.returncode == 0
+    parsed = json.loads(completed.stdout)
+    assert parsed["decision"] == "block"
+    assert "ELI11 REPLY SHAPE" in parsed["reason"]
+
+
 def test_dispatcher_imports_standalone_with_only_blocking_on_the_path() -> None:
     """The dispatcher's bootstrap resolves hooks_constants without hooks/ on PYTHONPATH."""
     subprocess_environment = {**os.environ, "PYTHONPATH": str(_BLOCKING_DIR)}

package/hooks/blocking/test_unscoped_search_blocker.py

@@ -0,0 +1,102 @@
+"""Tests for unscoped_search_blocker hook."""
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+
+SCRIPT_PATH = Path(__file__).parent / "unscoped_search_blocker.py"
+
+ALL_DENIED_COMMANDS = [
+    "find / -iname code_rules_gate.py",
+    "find /c -name '*.py'",
+    "find ~ -name README.md",
+    "find $HOME -type f",
+    "ls -R /",
+    "ls -laR /",
+    "ls -Rl /",
+    "find //server/share -name x",
+    "find \\\\server\\share -name x",
+    "bash -c 'find / -name x'",
+]
+
+ALL_ALLOWED_COMMANDS = [
+    "find . -iname '*.py'",
+    "find packages/claude-dev-env -name code_rules_gate.py",
+    "find /c/Users/example/repo -iname SKILL.md",
+    "ls -r /",
+    "ls -la /tmp/x",
+    "find //server/share/project/src -name x",
+    "es.exe path:C:\\dev\\repo ext:py gate",
+    "git status --short",
+]
+
+
+def _run_hook(payload: dict) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        [sys.executable, str(SCRIPT_PATH)],
+        input=json.dumps(payload),
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+
+
+def _bash_payload(command: str) -> dict:
+    return {"tool_name": "Bash", "tool_input": {"command": command}}
+
+
+def _powershell_payload(command: str) -> dict:
+    return {"tool_name": "PowerShell", "tool_input": {"command": command}}
+
+
+@pytest.mark.parametrize("each_command", ALL_DENIED_COMMANDS)
+def test_denies_unscoped_root_walk(each_command: str) -> None:
+    response = json.loads(_run_hook(_bash_payload(each_command)).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+@pytest.mark.parametrize("each_command", ALL_ALLOWED_COMMANDS)
+def test_allows_scoped_search(each_command: str) -> None:
+    assert _run_hook(_bash_payload(each_command)).stdout == ""
+
+
+def test_denies_recursive_listing_on_windows_drive_root() -> None:
+    response = json.loads(
+        _run_hook(_powershell_payload("Get-ChildItem -Path C:\\ -Recurse")).stdout
+    )
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_allows_recursive_listing_under_project_directory() -> None:
+    assert _run_hook(_powershell_payload("Get-ChildItem -Path .\\src -Recurse")).stdout == ""
+
+
+def test_allows_recursive_listing_without_recurse_flag() -> None:
+    assert _run_hook(_powershell_payload("Get-ChildItem -Path C:\\")).stdout == ""
+
+
+def test_denies_find_root_in_a_chained_segment() -> None:
+    response = json.loads(
+        _run_hook(_bash_payload("cd /tmp && find / -name x.py")).stdout
+    )
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_ignores_unsupported_tool_name() -> None:
+    payload = {"tool_name": "Edit", "tool_input": {"command": "find / -name x"}}
+    assert _run_hook(payload).stdout == ""
+
+
+def test_ignores_payload_without_a_command() -> None:
+    payload = {"tool_name": "Bash", "tool_input": {}}
+    assert _run_hook(payload).stdout == ""
+
+
+def test_deny_message_names_the_scoped_alternative() -> None:
+    response = json.loads(_run_hook(_bash_payload("find / -name x.py")).stdout)
+    deny_reason = response["hookSpecificOutput"]["permissionDecisionReason"]
+    assert "scope" in deny_reason.lower()