claude-dev-env 2.4.0 → 2.7.0

package/_shared/pr-loop/scripts/pr_loop_shared_constants/claude_permissions_constants.py

@@ -7,15 +7,22 @@ from pr_loop_shared_constants.preflight_constants import GIT_DIRECTORY_NAME
 __all__ = (
     "ALL_AGENT_CONFIG_DENY_TOOLS",
     "ALL_AGENT_CONFIG_PATH_PATTERNS",
+    "ALL_INERT_FILE_PERMISSION_TOOLS",
+    "ALL_LEGACY_PERMISSION_REAP_TOOLS",
     "ALL_PERMISSION_ALLOW_TOOLS",
     "ALL_TRUST_ENTRY_PROJECT_PATH_BOUNDARY_QUOTE_CHARACTERS",
     "AUTO_MODE_ENVIRONMENT_ENTRY_PREFIX",
     "AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE",
     "CLAUDE_SETTINGS_DIRECTORY_NAME",
     "CLAUDE_SETTINGS_FILENAME",
+    "CLAUDE_SETTINGS_LOCAL_FILENAME",
     "GIT_DIRECTORY_NAME",
+    "HOME_PROJECT_PATH_ALIAS",
+    "INERT_RULES_REMOVED_LOG_PREFIX",
+    "PROJECT_LOCAL_INERT_RULES_REMOVED_LOG_PREFIX",
     "TEXT_FILE_ENCODING",
     "UNIQUE_TEMPORARY_SUFFIX_BYTE_LENGTH",
+    "get_claude_project_local_settings_path",
     "get_claude_user_settings_path",
 )
 
@@ -24,6 +31,20 @@ ALL_PERMISSION_ALLOW_TOOLS: tuple[str, ...] = ("Edit", "Read")
 
 ALL_AGENT_CONFIG_DENY_TOOLS: tuple[str, ...] = ("Edit", "Read")
 
+ALL_LEGACY_PERMISSION_REAP_TOOLS: tuple[str, ...] = ("Write", "Glob")
+
+ALL_INERT_FILE_PERMISSION_TOOLS: tuple[str, ...] = ("Write", "Glob", "NotebookEdit")
+
+HOME_PROJECT_PATH_ALIAS: str = "$HOME"
+
+INERT_RULES_REMOVED_LOG_PREFIX: str = (
+    "Inert Write/Glob/NotebookEdit rules removed: "
+)
+
+PROJECT_LOCAL_INERT_RULES_REMOVED_LOG_PREFIX: str = (
+    "Project-local inert Write/Glob/NotebookEdit rules removed: "
+)
+
 ALL_AGENT_CONFIG_PATH_PATTERNS: tuple[str, ...] = (
     "settings*.json",
     "hooks/**",
@@ -81,6 +102,8 @@ CLAUDE_SETTINGS_DIRECTORY_NAME: str = ".claude"
 
 CLAUDE_SETTINGS_FILENAME: str = "settings.json"
 
+CLAUDE_SETTINGS_LOCAL_FILENAME: str = "settings.local.json"
+
 TEXT_FILE_ENCODING: str = "utf-8"
 
 UNIQUE_TEMPORARY_SUFFIX_BYTE_LENGTH: int = 8
@@ -88,3 +111,24 @@ UNIQUE_TEMPORARY_SUFFIX_BYTE_LENGTH: int = 8
 
 def get_claude_user_settings_path() -> Path:
     return Path.home() / CLAUDE_SETTINGS_DIRECTORY_NAME / CLAUDE_SETTINGS_FILENAME
+
+
+def get_claude_project_local_settings_path(
+    project_root_path: Path | None = None,
+) -> Path:
+    """Return ``<project>/.claude/settings.local.json`` for the project root.
+
+    Args:
+        project_root_path: Project root; defaults to the process cwd.
+
+    Returns:
+        Path to the project-local Claude settings file (may not exist yet).
+    """
+    resolved_project_root_path = (
+        project_root_path if project_root_path is not None else Path.cwd()
+    )
+    return (
+        resolved_project_root_path
+        / CLAUDE_SETTINGS_DIRECTORY_NAME
+        / CLAUDE_SETTINGS_LOCAL_FILENAME
+    )

package/_shared/pr-loop/scripts/pr_loop_shared_constants/code_rules_gate_constants.py

@@ -146,3 +146,205 @@ STAGED_TEST_GROUP_FAILURE_MESSAGE: str = (
 MINIMUM_STAGED_PYTEST_PYTHON_MAJOR: int = 3
 
 MINIMUM_STAGED_PYTEST_PYTHON_MINOR: int = 12
+
+JUNIT_XML_FLAG_PREFIX: str = "--junitxml="
+
+JUNIT_XML_TESTCASE_TAG: str = "testcase"
+
+JUNIT_XML_FAILURE_TAG: str = "failure"
+
+JUNIT_XML_ERROR_TAG: str = "error"
+
+JUNIT_XML_CLASSNAME_ATTRIBUTE: str = "classname"
+
+JUNIT_XML_NAME_ATTRIBUTE: str = "name"
+
+JUNIT_XML_MISSING_ATTRIBUTE_FALLBACK: str = ""
+
+REGRESSION_JUNIT_TEMP_DIRECTORY_PREFIX: str = "code_rules_gate_junit_"
+
+REGRESSION_STAGED_JUNIT_SUBDIRECTORY_NAME: str = "staged"
+
+REGRESSION_BASELINE_JUNIT_SUBDIRECTORY_NAME: str = "baseline"
+
+REGRESSION_BASELINE_WORKTREE_TEMP_DIRECTORY_PREFIX: str = "code_rules_gate_baseline_"
+
+REGRESSION_BASELINE_WORKTREE_DIRECTORY_NAME: str = "tree"
+
+GIT_HEAD_REVISION: str = "HEAD"
+
+ALL_GIT_HEAD_EXISTS_ARGS: tuple[str, ...] = ("rev-parse", "--verify", "HEAD")
+
+ALL_GIT_WORKTREE_ADD_DETACH_ARGS: tuple[str, ...] = (
+    "worktree",
+    "add",
+    "--detach",
+    "--quiet",
+)
+
+ALL_GIT_WORKTREE_REMOVE_FORCE_ARGS: tuple[str, ...] = ("worktree", "remove", "--force")
+
+ALL_GIT_WORKTREE_PRUNE_ARGS: tuple[str, ...] = ("worktree", "prune")
+
+REGRESSION_NO_BASELINE_MESSAGE: str = (
+    "code_rules_gate: no prior commit to compare against (first commit on this branch); "
+    "every staged test failure blocks."
+)
+
+REGRESSION_WORKTREE_ADD_FAILED_MESSAGE: str = (
+    "code_rules_gate: could not open a detached HEAD worktree for the pre-staged baseline "
+    "(git worktree add --detach failed); falling back to blocking on every staged test "
+    "failure."
+)
+
+REGRESSION_WORKTREE_REMOVE_FAILED_MESSAGE: str = (
+    "code_rules_gate: git worktree remove --force failed after the baseline check — your "
+    "staged changes are untouched in this worktree. Run 'git worktree list' and "
+    "'git worktree prune' if a temporary baseline tree remains registered."
+)
+
+REGRESSION_PRE_EXISTING_FAILURE_BYPASSED_MESSAGE: str = (
+    "code_rules_gate: staged test group rooted at {group_root} has {count} failure(s) "
+    "already present before this change (not caused by it); not blocking."
+)
+
+REGRESSION_GROUP_FAILURE_MESSAGE: str = (
+    "code_rules_gate: staged test group rooted at {group_root} has {count} failure(s) "
+    "this change introduces; commit blocked."
+)
+
+BASELINE_LEAK_PLUGIN_DIRECTORY_NAME: str = "baseline_import_plugin"
+
+BASELINE_LEAK_PLUGIN_MODULE_NAME: str = "code_rules_gate_baseline_import_plugin"
+
+BASELINE_LEAK_REPORT_FILENAME: str = "imported_from_primary_tree.json"
+
+BASELINE_PRIMARY_ROOT_ENV_VAR: str = "CODE_RULES_GATE_BASELINE_PRIMARY_ROOT"
+
+BASELINE_LEAK_REPORT_ENV_VAR: str = "CODE_RULES_GATE_BASELINE_LEAK_REPORT"
+
+PYTEST_PLUGINS_ENV_VAR: str = "PYTEST_PLUGINS"
+
+PYTEST_PLUGINS_SEPARATOR: str = ","
+
+BASELINE_IMPORT_PROBE_TIMEOUT_SECONDS: int = 120
+
+BASELINE_IMPORT_PROBE_DEGRADED_TAIL: str = (
+    "The HEAD baseline runs with its import roots un-rebased; a module that still "
+    "resolves into your working tree is reported after that run and blocks the group."
+)
+
+BASELINE_IMPORT_PROBE_TIMED_OUT_MESSAGE: str = (
+    "code_rules_gate: the import-root probe did not finish within {seconds} seconds. "
+    + BASELINE_IMPORT_PROBE_DEGRADED_TAIL
+)
+
+BASELINE_IMPORT_PROBE_UNSTARTABLE_MESSAGE: str = (
+    "code_rules_gate: the import-root probe did not start ({reason}). "
+    + BASELINE_IMPORT_PROBE_DEGRADED_TAIL
+)
+
+BASELINE_IMPORT_PROBE_REJECTED_MESSAGE: str = (
+    "code_rules_gate: the import-root probe exited with status {status}. "
+    + BASELINE_IMPORT_PROBE_DEGRADED_TAIL
+)
+
+PYTHON_INTERPRETER_COMMAND_FLAG: str = "-c"
+
+BASELINE_IMPORT_ROOT_PROBE_SOURCE: str = (
+    "import json\n"
+    "import sys\n"
+    "from pathlib import Path\n"
+    "all_roots = [each_entry for each_entry in sys.path if each_entry]\n"
+    "for each_finder in list(sys.meta_path):\n"
+    "    owning_module = sys.modules.get(getattr(each_finder, '__module__', '') or '')\n"
+    "    for each_attribute in ('MAPPING', 'NAMESPACES'):\n"
+    "        mapping = getattr(owning_module, each_attribute, None)\n"
+    "        if not isinstance(mapping, dict):\n"
+    "            continue\n"
+    "        for each_name, each_target in mapping.items():\n"
+    "            all_targets = each_target if isinstance(each_target, list) else [each_target]\n"
+    "            for each_package_directory in all_targets:\n"
+    "                try:\n"
+    "                    all_roots.append(\n"
+    "                        str(Path(each_package_directory).parents[str(each_name).count('.')])\n"
+    "                    )\n"
+    "                except (IndexError, TypeError, OSError):\n"
+    "                    continue\n"
+    "print(json.dumps(all_roots))\n"
+)
+
+BASELINE_LEAK_PLUGIN_SOURCE: str = '''"""Report every module the baseline pytest run imported out of the user's own tree."""
+
+import json
+import os
+import sys
+import sysconfig
+from pathlib import Path
+
+PRIMARY_ROOT_ENV_VAR = "{primary_root_env_var}"
+REPORT_PATH_ENV_VAR = "{report_path_env_var}"
+
+
+def _resolved(path_text):
+    if not path_text:
+        return None
+    try:
+        return Path(path_text).resolve()
+    except OSError:
+        return None
+
+
+def _is_under(candidate, root):
+    return candidate == root or root in candidate.parents
+
+
+def _interpreter_roots():
+    all_texts = [sys.prefix, sys.base_prefix, *sysconfig.get_paths().values()]
+    all_roots = [_resolved(each_text) for each_text in all_texts]
+    return [each_root for each_root in all_roots if each_root is not None]
+
+
+def _already_reported(report_path):
+    try:
+        return set(json.loads(report_path.read_text(encoding="utf-8")))
+    except (OSError, ValueError):
+        return set()
+
+
+def _imported_from_primary_tree(primary_root, report_path):
+    all_interpreter_roots = _interpreter_roots()
+    all_leaked = _already_reported(report_path)
+    for each_module in list(sys.modules.values()):
+        module_path = _resolved(getattr(each_module, "__file__", None))
+        if module_path is None or not _is_under(module_path, primary_root):
+            continue
+        if any(_is_under(module_path, each_root) for each_root in all_interpreter_roots):
+            continue
+        all_leaked.add(str(module_path))
+    return sorted(all_leaked)
+
+
+def pytest_sessionfinish(session, exitstatus):
+    primary_root = _resolved(os.environ.get(PRIMARY_ROOT_ENV_VAR))
+    report_path = _resolved(os.environ.get(REPORT_PATH_ENV_VAR))
+    if primary_root is None or report_path is None:
+        return
+    report_path.write_text(
+        json.dumps(_imported_from_primary_tree(primary_root, report_path)), encoding="utf-8"
+    )
+'''
+
+REGRESSION_BASELINE_IMPORT_LEAK_MESSAGE: str = (
+    "code_rules_gate: the HEAD baseline run for the group rooted at {group_root} imported "
+    "{count} module(s) from your working tree, starting with {first_module}. It measured the "
+    "staged code, not HEAD, so that baseline is not trusted and every staged failure in this "
+    "group blocks. An editable install whose import hook runs ahead of the path scan is the "
+    "usual cause."
+)
+
+REGRESSION_BASELINE_LEAK_UNREPORTED_MESSAGE: str = (
+    "code_rules_gate: the HEAD baseline run for the group rooted at {group_root} wrote no "
+    "import-origin report, so whether it loaded your working-tree code is unknown. That "
+    "baseline is not trusted and every staged failure in this group blocks."
+)

package/_shared/pr-loop/scripts/pr_loop_shared_constants/copilot_quota_constants.py

@@ -1,24 +1,24 @@
-"""Configuration constants for the Copilot premium-interaction quota pre-check."""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-COPILOT_QUOTA_ACCOUNT_ENV_VAR_NAME: str = "COPILOT_QUOTA_ACCOUNT"
-GH_TOKEN_ENV_VAR_NAME: str = "GH_TOKEN"
-COPILOT_INTERNAL_USER_API_PATH: str = "copilot_internal/user"
-
-QUOTA_SNAPSHOTS_FIELD_NAME: str = "quota_snapshots"
-PREMIUM_INTERACTIONS_FIELD_NAME: str = "premium_interactions"
-PREMIUM_UNLIMITED_FIELD_NAME: str = "unlimited"
-PREMIUM_REMAINING_FIELD_NAME: str = "remaining"
-PREMIUM_OVERAGE_PERMITTED_FIELD_NAME: str = "overage_permitted"
-PREMIUM_ENTITLEMENT_FIELD_NAME: str = "entitlement"
-PREMIUM_PERCENT_REMAINING_FIELD_NAME: str = "percent_remaining"
-
-EXIT_CODE_QUOTA_AVAILABLE: int = 0
-EXIT_CODE_OUT_OF_QUOTA: int = 1
-EXIT_CODE_QUOTA_API_DOWN: int = 2
-EXIT_CODE_NO_ACCOUNT_CONFIGURED: int = 3
-
-COPILOT_QUOTA_DEFAULT_ENV_FILE_PATH: Path = Path(__file__).resolve().parents[4] / ".env"
+"""Configuration constants for the Copilot premium-interaction quota pre-check."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+COPILOT_QUOTA_ACCOUNT_ENV_VAR_NAME: str = "COPILOT_QUOTA_ACCOUNT"
+GH_TOKEN_ENV_VAR_NAME: str = "GH_TOKEN"
+COPILOT_INTERNAL_USER_API_PATH: str = "copilot_internal/user"
+
+QUOTA_SNAPSHOTS_FIELD_NAME: str = "quota_snapshots"
+PREMIUM_INTERACTIONS_FIELD_NAME: str = "premium_interactions"
+PREMIUM_UNLIMITED_FIELD_NAME: str = "unlimited"
+PREMIUM_REMAINING_FIELD_NAME: str = "remaining"
+PREMIUM_OVERAGE_PERMITTED_FIELD_NAME: str = "overage_permitted"
+PREMIUM_ENTITLEMENT_FIELD_NAME: str = "entitlement"
+PREMIUM_PERCENT_REMAINING_FIELD_NAME: str = "percent_remaining"
+
+EXIT_CODE_QUOTA_AVAILABLE: int = 0
+EXIT_CODE_OUT_OF_QUOTA: int = 1
+EXIT_CODE_QUOTA_API_DOWN: int = 2
+EXIT_CODE_NO_ACCOUNT_CONFIGURED: int = 3
+
+COPILOT_QUOTA_DEFAULT_ENV_FILE_PATH: Path = Path(__file__).resolve().parents[4] / ".env"

package/_shared/pr-loop/scripts/pr_loop_shared_constants/stale_worktree_rule_sweep_constants.py

@@ -1,107 +1,107 @@
-"""Constants and rule-format readers for stale_worktree_rule_sweep.
-
-The worktrees root is derived from the same ~/.claude home the permission
-grant script mints its rules under, so the location is named in exactly one
-place. A worktree rule points at a directory one or more segments below that
-root (flat or nested layouts)::
-
-    Edit(<claude home>/worktrees/<worktree name>/.claude/**)
-                                 ^^^^^^^^^^^^^^^
-                                 segment 1 (flat)
-
-    Edit(<claude home>/worktrees/<repository>/<worktree name>/.claude/**)
-                                 ^^^^^^^^^^^^  ^^^^^^^^^^^^^^^
-                                 nested layout
-
-    worktree_directory_for_rule(rule, root)  ->  project directory under root
-
-A rule whose target path lies outside the worktrees root reads back as None,
-so the sweep leaves it untouched.
-"""
-
-from pathlib import Path
-
-from pr_loop_shared_constants.claude_permissions_constants import (
-    get_claude_user_settings_path,
-)
-
-WORKTREES_SUBDIRECTORY_NAME: str = "worktrees"
-
-MINIMUM_WORKTREE_PATH_SEGMENT_COUNT: int = 1
-
-RULE_PATH_OPEN_DELIMITER: str = "("
-
-RULE_PATH_CLOSE_DELIMITER: str = ")"
-
-CLAUDE_HOME_PATH_MARKER: str = "/.claude"
-
-
-def get_claude_worktrees_root() -> Path:
-    """Return the ~/.claude/worktrees directory the grant rules point under.
-
-    Reuses get_claude_user_settings_path so the ~/.claude home is resolved
-    in one place: the settings file's parent directory is the home, and the
-    worktrees live directly beneath it.
-
-    Returns:
-        The absolute path to the user's worktrees root directory.
-    """
-    claude_home_directory = get_claude_user_settings_path().parent
-    return claude_home_directory / WORKTREES_SUBDIRECTORY_NAME
-
-
-def extract_rule_target_path(rule: str) -> str | None:
-    """Return the path a permission rule targets, or None when unparsable.
-
-    A rule reads `Tool(<path>)`; the target is the text between the first
-    open delimiter and the last close delimiter::
-
-        Edit(/repo/wt/.claude/**)  ->  /repo/wt/.claude/**
-        not a rule                 ->  None
-
-    Args:
-        rule: The permission rule string to read.
-
-    Returns:
-        The target path string, or None when the delimiters are absent.
-    """
-    open_index = rule.find(RULE_PATH_OPEN_DELIMITER)
-    close_index = rule.rfind(RULE_PATH_CLOSE_DELIMITER)
-    if open_index == -1 or close_index <= open_index:
-        return None
-    return rule[open_index + 1 : close_index]
-
-
-def worktree_directory_for_rule(rule: str, worktrees_root: Path) -> Path | None:
-    """Return the worktree directory a rule targets, or None when it is not one.
-
-    Keeps every path segment below the worktrees root so flat
-    (`worktrees/<name>`) and nested (`worktrees/<repo>/<name>`) layouts
-    both resolve to the on-disk project directory::
-
-        Edit(<root>/flat-wt/.claude/**)  ->  <root>/flat-wt
-        Edit(<root>/repo/wt/.claude/**)  ->  <root>/repo/wt
-        Edit(/elsewhere/project/.claude/**)  ->  None
-
-    Args:
-        rule: The permission rule string to read.
-        worktrees_root: The ~/.claude/worktrees directory rules live under.
-
-    Returns:
-        The worktree directory, or None when the target lies outside the
-        worktrees root or has no path segments under it.
-    """
-    target_path = extract_rule_target_path(rule)
-    if target_path is None:
-        return None
-    project_portion = target_path.rsplit(CLAUDE_HOME_PATH_MARKER, 1)[0]
-    if not project_portion:
-        return None
-    try:
-        relative_path = Path(project_portion).relative_to(worktrees_root)
-    except ValueError:
-        return None
-    all_segments = relative_path.parts
-    if len(all_segments) < MINIMUM_WORKTREE_PATH_SEGMENT_COUNT:
-        return None
-    return worktrees_root.joinpath(*all_segments)
+"""Constants and rule-format readers for stale_worktree_rule_sweep.
+
+The worktrees root is derived from the same ~/.claude home the permission
+grant script mints its rules under, so the location is named in exactly one
+place. A worktree rule points at a directory one or more segments below that
+root (flat or nested layouts)::
+
+    Edit(<claude home>/worktrees/<worktree name>/.claude/**)
+                                 ^^^^^^^^^^^^^^^
+                                 segment 1 (flat)
+
+    Edit(<claude home>/worktrees/<repository>/<worktree name>/.claude/**)
+                                 ^^^^^^^^^^^^  ^^^^^^^^^^^^^^^
+                                 nested layout
+
+    worktree_directory_for_rule(rule, root)  ->  project directory under root
+
+A rule whose target path lies outside the worktrees root reads back as None,
+so the sweep leaves it untouched.
+"""
+
+from pathlib import Path
+
+from pr_loop_shared_constants.claude_permissions_constants import (
+    get_claude_user_settings_path,
+)
+
+WORKTREES_SUBDIRECTORY_NAME: str = "worktrees"
+
+MINIMUM_WORKTREE_PATH_SEGMENT_COUNT: int = 1
+
+RULE_PATH_OPEN_DELIMITER: str = "("
+
+RULE_PATH_CLOSE_DELIMITER: str = ")"
+
+CLAUDE_HOME_PATH_MARKER: str = "/.claude"
+
+
+def get_claude_worktrees_root() -> Path:
+    """Return the ~/.claude/worktrees directory the grant rules point under.
+
+    Reuses get_claude_user_settings_path so the ~/.claude home is resolved
+    in one place: the settings file's parent directory is the home, and the
+    worktrees live directly beneath it.
+
+    Returns:
+        The absolute path to the user's worktrees root directory.
+    """
+    claude_home_directory = get_claude_user_settings_path().parent
+    return claude_home_directory / WORKTREES_SUBDIRECTORY_NAME
+
+
+def extract_rule_target_path(rule: str) -> str | None:
+    """Return the path a permission rule targets, or None when unparsable.
+
+    A rule reads `Tool(<path>)`; the target is the text between the first
+    open delimiter and the last close delimiter::
+
+        Edit(/repo/wt/.claude/**)  ->  /repo/wt/.claude/**
+        not a rule                 ->  None
+
+    Args:
+        rule: The permission rule string to read.
+
+    Returns:
+        The target path string, or None when the delimiters are absent.
+    """
+    open_index = rule.find(RULE_PATH_OPEN_DELIMITER)
+    close_index = rule.rfind(RULE_PATH_CLOSE_DELIMITER)
+    if open_index == -1 or close_index <= open_index:
+        return None
+    return rule[open_index + 1 : close_index]
+
+
+def worktree_directory_for_rule(rule: str, worktrees_root: Path) -> Path | None:
+    """Return the worktree directory a rule targets, or None when it is not one.
+
+    Keeps every path segment below the worktrees root so flat
+    (`worktrees/<name>`) and nested (`worktrees/<repo>/<name>`) layouts
+    both resolve to the on-disk project directory::
+
+        Edit(<root>/flat-wt/.claude/**)  ->  <root>/flat-wt
+        Edit(<root>/repo/wt/.claude/**)  ->  <root>/repo/wt
+        Edit(/elsewhere/project/.claude/**)  ->  None
+
+    Args:
+        rule: The permission rule string to read.
+        worktrees_root: The ~/.claude/worktrees directory rules live under.
+
+    Returns:
+        The worktree directory, or None when the target lies outside the
+        worktrees root or has no path segments under it.
+    """
+    target_path = extract_rule_target_path(rule)
+    if target_path is None:
+        return None
+    project_portion = target_path.rsplit(CLAUDE_HOME_PATH_MARKER, 1)[0]
+    if not project_portion:
+        return None
+    try:
+        relative_path = Path(project_portion).relative_to(worktrees_root)
+    except ValueError:
+        return None
+    all_segments = relative_path.parts
+    if len(all_segments) < MINIMUM_WORKTREE_PATH_SEGMENT_COUNT:
+        return None
+    return worktrees_root.joinpath(*all_segments)