claude-dev-env 2.5.0 → 2.7.0

package/scripts/test_invoke_code_review.py

@@ -0,0 +1,143 @@
+"""Specifications for what a blocked mint tells the person it blocked.
+
+Enforcement refuses every push until a clean stamp covers the branch surface,
+and ``invoke_code_review.py --record-stamp`` is the only way to mint one. When
+that call cannot run, the reason it names is the person's only route back to a
+working push.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+import invoke_code_review as invoker
+from claude_chain_runner import ChainConfigurationError, ChainInvocationOutcome
+from _code_review_test_support import FIXTURE_SESSION_OPUS
+from dev_env_scripts_constants.code_review_constants import (
+    DEFAULT_CODE_REVIEW_EFFORT,
+    PERMISSION_MODE_ACCEPT_EDITS,
+    PERMISSION_MODE_BYPASS,
+    REVIEW_PERMISSION_MODE,
+)
+
+
+def test_review_arguments_carry_the_permission_mode_this_caller_resolves() -> None:
+    """The review command asks for a permission mode the binary accepts here.
+
+    The binary refuses the bypass mode outright for a root caller, so asking
+    for it there means no review runs and no stamp is ever minted.
+    """
+    all_arguments = invoker.build_code_review_arguments(DEFAULT_CODE_REVIEW_EFFORT)
+
+    assert REVIEW_PERMISSION_MODE in all_arguments
+
+
+def test_the_resolved_permission_mode_is_one_the_binary_knows() -> None:
+    assert REVIEW_PERMISSION_MODE in (
+        PERMISSION_MODE_ACCEPT_EDITS,
+        PERMISSION_MODE_BYPASS,
+    )
+
+
+CHAIN_CONFIG_REMEDY_TEXT: str = (
+    "Claude chain config not found at the path this specification names. "
+    "Copy the example config there and list your account binaries."
+)
+HOST_PROFILE_FAILURE_TEXT: str = "session model alias carries no host profile"
+MINT_TIMEOUT_SECONDS: int = 1
+SERVED_COMMAND_NAME: str = "claude"
+REVIEW_BINARY_REFUSAL_TEXT: str = (
+    "--dangerously-skip-permissions cannot be used with root privileges"
+)
+REVIEW_FAILURE_RETURNCODE: int = 1
+EMPTY_REVIEW_STDOUT: str = ""
+ROOT_USER_ID: int = 0
+UNPRIVILEGED_USER_ID: int = 1000
+
+
+def _serve_a_refusing_binary(
+    *_all_positional: object, **_all_keyword: object
+) -> ChainInvocationOutcome:
+    return ChainInvocationOutcome(
+        served_command=SERVED_COMMAND_NAME,
+        returncode=REVIEW_FAILURE_RETURNCODE,
+        stdout=EMPTY_REVIEW_STDOUT,
+        stderr=REVIEW_BINARY_REFUSAL_TEXT,
+        attempts=(),
+    )
+
+
+def test_failed_review_reports_what_the_served_binary_wrote(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A review that a served binary refused names the refusal.
+
+    The binary can decline for reasons the caller must act on, such as a
+    permission mode it will not accept. Dropping its words leaves a bare
+    exit code, and no stamp is minted either way.
+    """
+    monkeypatch.setattr(
+        invoker, "_run_claude_with_empty_stdin", _serve_a_refusing_binary
+    )
+
+    outcome = invoker._run_chain_review(
+        working_directory=tmp_path,
+        timeout_seconds=MINT_TIMEOUT_SECONDS,
+        effort=DEFAULT_CODE_REVIEW_EFFORT,
+    )
+
+    captured_streams = capsys.readouterr()
+    assert outcome.returncode == REVIEW_FAILURE_RETURNCODE
+    assert REVIEW_BINARY_REFUSAL_TEXT in captured_streams.err
+
+
+def test_missing_chain_config_reports_its_remedy_on_stderr(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    def raise_chain_configuration_error(**_all_keyword_arguments: object) -> None:
+        raise ChainConfigurationError(CHAIN_CONFIG_REMEDY_TEXT)
+
+    monkeypatch.setattr(
+        invoker, "invoke_code_review_and_record_stamp", raise_chain_configuration_error
+    )
+
+    outcome = invoker._mint_or_config_outcome(
+        working_directory=tmp_path,
+        session_model=FIXTURE_SESSION_OPUS,
+        timeout_seconds=MINT_TIMEOUT_SECONDS,
+        effort=DEFAULT_CODE_REVIEW_EFFORT,
+    )
+
+    captured_streams = capsys.readouterr()
+    assert outcome.is_stamp_minted is False
+    assert CHAIN_CONFIG_REMEDY_TEXT in captured_streams.err
+
+
+def test_host_profile_failure_reports_its_reason_on_stderr(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    def raise_host_profile_error(**_all_keyword_arguments: object) -> None:
+        raise ValueError(HOST_PROFILE_FAILURE_TEXT)
+
+    monkeypatch.setattr(
+        invoker, "invoke_code_review_and_record_stamp", raise_host_profile_error
+    )
+
+    outcome = invoker._mint_or_config_outcome(
+        working_directory=tmp_path,
+        session_model=FIXTURE_SESSION_OPUS,
+        timeout_seconds=MINT_TIMEOUT_SECONDS,
+        effort=DEFAULT_CODE_REVIEW_EFFORT,
+    )
+
+    captured_streams = capsys.readouterr()
+    assert outcome.is_stamp_minted is False
+    assert HOST_PROFILE_FAILURE_TEXT in captured_streams.err

package/scripts/test_invoke_code_review_chain.py

@@ -19,7 +19,7 @@ from _code_review_test_support import (
 from dev_env_scripts_constants.code_review_constants import (
     CODE_REVIEW_MODEL_ALIAS,
     DEFAULT_CODE_REVIEW_EFFORT,
-    PERMISSION_MODE_BYPASS,
+    REVIEW_PERMISSION_MODE as PERMISSION_MODE_BYPASS,
     PERMISSION_MODE_FLAG,
 )
 from dev_env_scripts_constants.grok_worker_constants import (

package/scripts/test_invoke_code_review_contract.py

@@ -33,7 +33,7 @@ from dev_env_scripts_constants.code_review_constants import (
     MAXIMUM_STAMP_MINT_PASSES,
     MODE_CHAIN,
     MODE_IN_SESSION,
-    PERMISSION_MODE_BYPASS,
+    REVIEW_PERMISSION_MODE as PERMISSION_MODE_BYPASS,
     PERMISSION_MODE_FLAG,
     RESULT_KEY_BOUND_HASH,
     RESULT_KEY_DIRTY_TREE,

package/scripts/tests/test_code_review_constants.py

@@ -0,0 +1,80 @@
+"""Specifications for the permission modes the review binary is asked for.
+
+The review binary accepts one permission mode for an ordinary caller and a
+different one for root. Naming the wrong mode means the binary refuses the
+call, no review runs, and no stamp is ever minted.
+"""
+
+from __future__ import annotations
+
+import importlib
+import os
+
+import pytest
+
+from dev_env_scripts_constants import code_review_constants
+
+
+BYPASS_MODE_TOKEN: str = "bypassPermissions"
+ACCEPT_EDITS_MODE_TOKEN: str = "acceptEdits"
+ROOT_USER_ID: int = 0
+UNPRIVILEGED_USER_ID: int = 1000
+
+
+def _permission_mode_seen_by(
+    monkeypatch: pytest.MonkeyPatch, effective_user_id: int
+) -> str:
+    """Read the review permission mode a caller with this user id resolves."""
+    monkeypatch.setattr(os, "geteuid", lambda: effective_user_id)
+    reloaded_constants = importlib.reload(code_review_constants)
+    return str(reloaded_constants.REVIEW_PERMISSION_MODE)
+
+
+def test_root_detection_agrees_with_this_process(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(os, "geteuid", lambda: ROOT_USER_ID)
+    reloaded_constants = importlib.reload(code_review_constants)
+
+    assert reloaded_constants.IS_ROOT_CALLER is True
+    assert reloaded_constants.ROOT_EFFECTIVE_USER_ID == ROOT_USER_ID
+
+
+def test_bypass_mode_names_the_token_the_binary_reads() -> None:
+    assert code_review_constants.PERMISSION_MODE_BYPASS == BYPASS_MODE_TOKEN
+
+
+def test_accept_edits_mode_names_the_token_the_binary_reads() -> None:
+    assert code_review_constants.PERMISSION_MODE_ACCEPT_EDITS == ACCEPT_EDITS_MODE_TOKEN
+
+
+def test_a_root_caller_resolves_the_mode_the_binary_accepts(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    assert _permission_mode_seen_by(monkeypatch, ROOT_USER_ID) == (
+        ACCEPT_EDITS_MODE_TOKEN
+    )
+
+
+def test_an_ordinary_caller_resolves_the_bypass_mode(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    assert _permission_mode_seen_by(monkeypatch, UNPRIVILEGED_USER_ID) == (
+        BYPASS_MODE_TOKEN
+    )
+
+
+def test_a_platform_without_a_user_id_still_loads_the_constants(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Windows exposes no ``os.geteuid``, and the module still imports.
+
+    Reading a missing ``os.geteuid`` raises, and every caller of the review
+    invoker dies at import. A platform that reports no user id is never the
+    root the review binary refuses, so it reads as an ordinary caller.
+    """
+    monkeypatch.delattr(os, "geteuid", raising=False)
+    reloaded_constants = importlib.reload(code_review_constants)
+
+    assert reloaded_constants.IS_ROOT_CALLER is False
+    assert reloaded_constants.REVIEW_PERMISSION_MODE == BYPASS_MODE_TOKEN

package/scripts/tests/test_codex_capability_bridge.py

@@ -0,0 +1,91 @@
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+from codex_capability_bridge import translate_capability
+
+
+@pytest.mark.parametrize("source_surface, expected_target, capability_payload", [("TaskList", "update_plan", {"plan": []}), ("TaskCreate", "update_plan", {"name": "review", "status": "pending"}), ("TaskUpdate", "update_plan", {"name": "review", "status": "pending"}), ("Task", "multi_agent_v1__spawn_agent", {"prompt": "review"}), ("SendMessage", "multi_agent_v1__send_input", {"message": "review"}), ("TaskOutput", "multi_agent_v1__wait_agent", {"task_id": "task-1"}), ("TaskStop", "multi_agent_v1__close_agent", {"task_id": "task-1"})])
+def test_maps_capability(source_surface: str, expected_target: str, capability_payload: dict[str, object]) -> None:
+    translated_record = translate_capability(source_surface, capability_payload)
+    assert translated_record["target"] == expected_target
+
+
+def test_normalizes_alias_and_task_payload() -> None:
+    translated_record = translate_capability("task_create", {"subject": "write tests", "status": "in-progress"})
+    assert translated_record["payload"] == {"plan": [{"step": "write tests", "status": "in_progress"}]}
+
+
+def test_rejects_bad_payload_and_schedule() -> None:
+    assert translate_capability("TaskUpdate", {"name": "x", "status": "later"})["status"] == "malformed"
+    assert translate_capability("ScheduleWakeup", {})["status"] == "unsupported"
+
+
+def test_rejects_unknown_and_private_paths() -> None:
+    assert translate_capability("NoSuchSurface", {})["status"] == "unknown"
+    assert translate_capability("SendMessage", {"message": "C:\\Users\\melan\\secret"})["status"] == "rejected"
+
+
+@pytest.mark.parametrize("private_path", ["C:/private/file", "\\\\server\\share\\file", "/private/file", "~/secret", "$HOME/secret", "%USERPROFILE%\\secret", "safe/../secret"])
+def test_rejects_absolute_private_and_traversal_paths(private_path: str) -> None:
+    assert translate_capability("SendMessage", {"message": private_path})["status"] == "rejected"
+
+
+def test_validates_mapped_surface_payloads() -> None:
+    assert translate_capability("spawn", {"message": "hello"})["status"] == "malformed"
+    assert translate_capability("stop", {"task_id": 3})["status"] == "malformed"
+    assert translate_capability("TaskList", {"plan": [{"step": "review"}]})["status"] == "malformed"
+
+
+def test_translation_is_byte_identical_for_repeated_input() -> None:
+    payload = {"message": "hello", "agent_id": "agent-1"}
+    first_json = json.dumps(translate_capability("message", payload), sort_keys=True, separators=(",", ":"))
+    second_json = json.dumps(translate_capability("message", payload), sort_keys=True, separators=(",", ":"))
+    assert first_json == second_json
+
+
+def test_translation_does_not_execute_payload() -> None:
+    payload = {"message": "__import__('subprocess').run('whoami')"}
+    translated_record = translate_capability("message", payload)
+    assert translated_record["payload"] == payload
+
+
+def test_translation_is_deterministic_and_cli_is_json() -> None:
+    payload = {"message": "hello", "agent_id": "agent-1"}
+    first_record = translate_capability("SendMessage", payload)
+    second_record = translate_capability("SendMessage", payload)
+    assert first_record == second_record
+    script_path = Path(__file__).parents[1] / "codex_capability_bridge.py"
+    cli_run = subprocess.run([sys.executable, str(script_path), "SendMessage", json.dumps(payload)], capture_output=True, text=True, check=True)
+    assert json.loads(cli_run.stdout) == first_record
+
+
+def test_cli_rejects_malformed_payload_with_one_json_error_record() -> None:
+    script_path = Path(__file__).parents[1] / "codex_capability_bridge.py"
+    cli_run = subprocess.run(
+        [sys.executable, str(script_path), "SendMessage", "{"],
+        capture_output=True,
+        text=True,
+    )
+    assert cli_run.returncode != 0
+    assert json.loads(cli_run.stdout) == {
+        "source": "unknown",
+        "status": "error",
+        "error": "payload must be valid JSON",
+    }
+    assert cli_run.stderr == ""
+
+
+def test_cli_rejects_malformed_arguments_with_one_json_error_record() -> None:
+    script_path = Path(__file__).parents[1] / "codex_capability_bridge.py"
+    cli_run = subprocess.run(
+        [sys.executable, str(script_path)],
+        capture_output=True,
+        text=True,
+    )
+    assert cli_run.returncode != 0
+    assert json.loads(cli_run.stdout)["status"] == "error"
+    assert cli_run.stderr == ""