claude-dev-env 4.1.0 → 4.3.0

package/.agents/skills/pull-request/reference/publication-tasks.md

@@ -0,0 +1,18 @@
+# Pull request publication tasks
+
+Register each line as one session task before starting the process. Complete
+each task with `PASS`, `FAIL` plus file and line evidence, or `N/A` plus a
+reason when the task is conditional. This file is a task seed catalog, not a
+markdown progress board.
+
+1. Resolve one repository, action, and selected author. For create, resolve the source branch, base, and head. For other actions, resolve one existing pull request target. Create actions publish drafts.
+2. Invoke the required `pr-description-writer` for create or full body rewrite, then record its title and body file. `pr-title-description` may assist. Mark `N/A` for comment or review bodies that do not rewrite the pull request description.
+3. Validate every title, body, artifact, and local path input. Reject inline body input.
+4. Run `_shared/pr-loop/scripts/durable_post_lint.py` for the matching action and record exit code `0` before credential lookup or network work.
+5. Run `privacy-hygiene` before the GitHub post and record its clean result.
+6. Upload binary evidence through `scripts/gh_artifact_upload.py`, replace local references with permanent URLs, and rerun the shared body linter. Mark `N/A` when no binary evidence exists.
+7. Resolve the selected author in the child process environment and prove that the parent environment and global `gh` account remain unchanged.
+8. Run `.agents/skills/pull-request/scripts/pull_request.py` for exactly one action: `create`, `edit`, `comment`, or `review`.
+9. When the user selects a legacy state file, run `recover_legacy_author.py <exact-state-file> --confirm-inactive` for exactly that record. Preserve every other record and delete the selected record only after successful restore. Mark `N/A` otherwise.
+10. Read back the remote pull request title, body, head SHA, draft state, and requested comment or review, then record the URL and number without credentials.
+11. Mark every session task complete with evidence and report the action, remote URL, readback result, and any remaining blocker.

package/.agents/skills/pull-request/scripts/github_pr_command_constants/__init__.py

@@ -0,0 +1 @@
+"""Constants for the explicit GitHub pull request command."""

package/.agents/skills/pull-request/scripts/github_pr_command_constants/config/__init__.py

@@ -0,0 +1 @@
+"""Configuration constants for the explicit GitHub pull request command."""

package/.agents/skills/pull-request/scripts/github_pr_command_constants/config/constants.py

@@ -0,0 +1,61 @@
+"""Configuration constants for process-local GitHub pull request actions."""
+
+import re
+
+ACTION_COMMENT = "comment"
+ACTION_CREATE = "create"
+ACTION_EDIT = "edit"
+ACTION_REVIEW = "review"
+
+LINTER_ACTION_COMMENT = "pr-comment"
+LINTER_ACTION_CREATE = "pr-create"
+LINTER_ACTION_EDIT = "pr-edit"
+LINTER_ACTION_REVIEW = "pr-review"
+
+REVIEW_EVENT_APPROVE = "approve"
+REVIEW_EVENT_COMMENT = "comment"
+REVIEW_EVENT_REQUEST_CHANGES = "request-changes"
+ALL_REVIEW_FLAGS_BY_EVENT: dict[str, str] = {
+    REVIEW_EVENT_APPROVE: "--approve",
+    REVIEW_EVENT_COMMENT: "--comment",
+    REVIEW_EVENT_REQUEST_CHANGES: "--request-changes",
+}
+
+ALL_LINTER_ACTIONS_BY_COMMAND: dict[str, str] = {
+    ACTION_COMMENT: LINTER_ACTION_COMMENT,
+    ACTION_CREATE: LINTER_ACTION_CREATE,
+    ACTION_EDIT: LINTER_ACTION_EDIT,
+    ACTION_REVIEW: LINTER_ACTION_REVIEW,
+}
+
+SELECTED_ACCOUNT_ENVIRONMENT_KEY = "GITHUB_DEFAULT_ACCOUNT"
+
+ACCOUNT_LOOKUP_FAILED_MESSAGE = "error: GitHub account lookup failed\n"
+ACCOUNT_LOOKUP_EMPTY_MESSAGE = "error: GitHub account lookup returned no value\n"
+ACTION_FAILED_MESSAGE = "error: GitHub action failed\n"
+ACCOUNT_LOOKUP_FAILURE_EXIT_CODE = 1
+PACKAGE_ROOT_PARENT_INDEX = 4
+SKILLS_DIRECTORY_PARENT_INDEX = 2
+
+ALL_GH_AUTH_SWITCH_COMMAND_HEAD: tuple[str, ...] = (
+    "gh",
+    "auth",
+    "switch",
+    "--user",
+)
+LEGACY_RECORD_ACTIVE_MESSAGE = "error: selected legacy state record is active\n"
+LEGACY_RECORD_CHANGED_MESSAGE = "error: selected legacy state record changed\n"
+LEGACY_RECORD_CONFIRMATION_MESSAGE = "error: confirm inactive legacy state\n"
+LEGACY_RECORD_REJECTED_MESSAGE = "error: selected legacy state record is invalid\n"
+LEGACY_RESTORE_FAILED_MESSAGE = "error: GitHub account restore failed\n"
+LEGACY_RECORD_INACTIVE_CONFIRMATION_FLAG = "--confirm-inactive"
+LEGACY_RECORD_ORIGINAL_ACCOUNT_KEY = "original_account"
+LEGACY_RECORD_PERMISSION_MODE = 0o600
+LEGACY_RECORD_STALE_AGE_SECONDS = 1800
+LEGACY_RECORD_NAME_PATTERN: re.Pattern[str] = re.compile(
+    r"^gh_pr_author_swap_[A-Za-z0-9_-]+\.json$"
+)
+RECOVERY_CLEAN_EXIT_CODE = 0
+RECOVERY_FAILED_EXIT_CODE = 1
+RECOVERY_REJECTED_EXIT_CODE = 2
+RECOVERY_UNRESOLVED_EXIT_CODE = 3

package/.agents/skills/pull-request/scripts/pull_request.py

@@ -0,0 +1,276 @@
+"""Run validated GitHub pull request actions with process-local account selection."""
+
+from __future__ import annotations
+
+import argparse
+import importlib
+import os
+import subprocess
+import sys
+from collections.abc import Callable, Mapping, Sequence
+from pathlib import Path
+
+from github_pr_command_constants.config.constants import (
+    ACCOUNT_LOOKUP_EMPTY_MESSAGE,
+    ACCOUNT_LOOKUP_FAILED_MESSAGE,
+    ACCOUNT_LOOKUP_FAILURE_EXIT_CODE,
+    ACTION_COMMENT,
+    ACTION_CREATE,
+    ACTION_EDIT,
+    ACTION_FAILED_MESSAGE,
+    ACTION_REVIEW,
+    ALL_LINTER_ACTIONS_BY_COMMAND,
+    ALL_REVIEW_FLAGS_BY_EVENT,
+    PACKAGE_ROOT_PARENT_INDEX,
+    REVIEW_EVENT_COMMENT,
+    SELECTED_ACCOUNT_ENVIRONMENT_KEY,
+    SKILLS_DIRECTORY_PARENT_INDEX,
+)
+
+CommandRunner = Callable[..., subprocess.CompletedProcess[str]]
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
+    all_actions = parser.add_subparsers(dest="action", required=True)
+    create = all_actions.add_parser(ACTION_CREATE, allow_abbrev=False)
+    create.add_argument("--repo", required=True)
+    create.add_argument("--base", required=True)
+    create.add_argument("--head", required=True)
+    create.add_argument("--title", required=True)
+    create.add_argument("--body-file", required=True, type=Path)
+    edit = all_actions.add_parser(ACTION_EDIT, allow_abbrev=False)
+    edit.add_argument("--repo", required=True)
+    edit.add_argument("--number", required=True)
+    edit.add_argument("--title")
+    edit.add_argument("--body-file", type=Path)
+    comment = all_actions.add_parser(ACTION_COMMENT, allow_abbrev=False)
+    comment.add_argument("--repo", required=True)
+    comment.add_argument("--number", required=True)
+    comment.add_argument("--body-file", required=True, type=Path)
+    review = all_actions.add_parser(ACTION_REVIEW, allow_abbrev=False)
+    review.add_argument("--repo", required=True)
+    review.add_argument("--number", required=True)
+    review.add_argument("--body-file", required=True, type=Path)
+    review.add_argument(
+        "--event",
+        choices=tuple(ALL_REVIEW_FLAGS_BY_EVENT),
+        default=REVIEW_EVENT_COMMENT,
+    )
+    return parser
+
+
+def _linter_path() -> Path:
+    return (
+        Path(__file__).resolve().parents[SKILLS_DIRECTORY_PARENT_INDEX]
+        / "_shared/pr-loop/scripts/durable_post_lint.py"
+    )
+
+
+def _linter_arguments(arguments: argparse.Namespace) -> list[str]:
+    all_arguments = [
+        sys.executable,
+        str(_linter_path()),
+        "--action",
+        ALL_LINTER_ACTIONS_BY_COMMAND[arguments.action],
+    ]
+    if getattr(arguments, "title", None) is not None:
+        all_arguments.extend(["--title", arguments.title])
+    if getattr(arguments, "body_file", None) is not None:
+        all_arguments.extend(["--body-file", str(arguments.body_file)])
+    return all_arguments
+
+
+def _create_arguments(arguments: argparse.Namespace) -> list[str]:
+    return [
+        "gh",
+        "pr",
+        "create",
+        "--draft",
+        "--repo",
+        arguments.repo,
+        "--base",
+        arguments.base,
+        "--head",
+        arguments.head,
+        "--title",
+        arguments.title,
+        "--body-file",
+        str(arguments.body_file),
+    ]
+
+
+def _edit_arguments(arguments: argparse.Namespace) -> list[str]:
+    all_arguments = ["gh", "pr", "edit", arguments.number, "--repo", arguments.repo]
+    if arguments.title is not None:
+        all_arguments.extend(["--title", arguments.title])
+    if arguments.body_file is not None:
+        all_arguments.extend(["--body-file", str(arguments.body_file)])
+    return all_arguments
+
+
+def _post_arguments(arguments: argparse.Namespace) -> list[str]:
+    if arguments.action == ACTION_CREATE:
+        return _create_arguments(arguments)
+    if arguments.action == ACTION_EDIT:
+        return _edit_arguments(arguments)
+    if arguments.action == ACTION_COMMENT:
+        return [
+            "gh",
+            "pr",
+            "comment",
+            arguments.number,
+            "--repo",
+            arguments.repo,
+            "--body-file",
+            str(arguments.body_file),
+        ]
+    return [
+        "gh",
+        "pr",
+        "review",
+        arguments.number,
+        "--repo",
+        arguments.repo,
+        ALL_REVIEW_FLAGS_BY_EVENT[arguments.event],
+        "--body-file",
+        str(arguments.body_file),
+    ]
+
+
+def _shared_environment_key_names() -> tuple[str, str, tuple[str, ...]]:
+    shared_directory = (
+        Path(__file__).resolve().parents[PACKAGE_ROOT_PARENT_INDEX]
+        / "_shared/pr-loop/scripts"
+    )
+    shared_directory_text = str(shared_directory)
+    if shared_directory_text not in sys.path:
+        sys.path.insert(0, shared_directory_text)
+    constants_module = importlib.import_module(
+        "pr_loop_shared_constants.post_audit_thread_constants"
+    )
+    return (
+        constants_module.GITHUB_TOKEN_ENV_VAR_NAME,
+        constants_module.GH_TOKEN_ENV_VAR_NAME,
+        constants_module.ALL_GH_TOKEN_ENV_VAR_NAMES,
+    )
+
+
+def _lookup_environment(all_environment: Mapping[str, str]) -> dict[str, str]:
+    lookup_environment = dict(all_environment)
+    _, _, all_authorization_names = _shared_environment_key_names()
+    for each_name in all_authorization_names:
+        lookup_environment.pop(each_name, None)
+    return lookup_environment
+
+
+def _lookup_account_authorization(
+    selected_account: str,
+    all_environment: Mapping[str, str],
+    command_runner: CommandRunner,
+) -> str | None:
+    try:
+        completed_lookup = command_runner(
+            ["gh", "auth", "token", "--user", selected_account],
+            capture_output=True,
+            check=False,
+            env=_lookup_environment(all_environment),
+            shell=False,
+            text=True,
+        )
+    except OSError:
+        sys.stderr.write(ACCOUNT_LOOKUP_FAILED_MESSAGE)
+        return None
+    if completed_lookup.returncode != 0:
+        sys.stderr.write(ACCOUNT_LOOKUP_FAILED_MESSAGE)
+        return None
+    account_authorization = completed_lookup.stdout.strip()
+    if not account_authorization:
+        sys.stderr.write(ACCOUNT_LOOKUP_EMPTY_MESSAGE)
+        return None
+    return account_authorization
+
+
+def _action_environment(
+    all_environment: Mapping[str, str],
+    command_runner: CommandRunner,
+) -> dict[str, str] | None:
+    selected_account = all_environment.get(SELECTED_ACCOUNT_ENVIRONMENT_KEY)
+    if not selected_account:
+        return dict(all_environment)
+    account_authorization = _lookup_account_authorization(
+        selected_account, all_environment, command_runner
+    )
+    if account_authorization is None:
+        return None
+    parent_authorization_name, child_authorization_name, _ = (
+        _shared_environment_key_names()
+    )
+    action_environment = dict(all_environment)
+    action_environment.pop(parent_authorization_name, None)
+    action_environment[child_authorization_name] = account_authorization
+    return action_environment
+
+
+def _run_post_action(
+    arguments: argparse.Namespace,
+    all_action_environment: Mapping[str, str],
+    command_runner: CommandRunner,
+) -> int:
+    try:
+        completed_action = command_runner(
+            _post_arguments(arguments),
+            check=False,
+            env=all_action_environment,
+            shell=False,
+        )
+    except OSError:
+        sys.stderr.write(ACTION_FAILED_MESSAGE)
+        return ACCOUNT_LOOKUP_FAILURE_EXIT_CODE
+    return completed_action.returncode
+
+
+def _run_action(
+    arguments: argparse.Namespace,
+    all_environment: Mapping[str, str],
+    command_runner: CommandRunner,
+) -> int:
+    action_environment = _action_environment(all_environment, command_runner)
+    if action_environment is None:
+        return ACCOUNT_LOOKUP_FAILURE_EXIT_CODE
+    return _run_post_action(arguments, action_environment, command_runner)
+
+
+def main(
+    all_arguments: Sequence[str],
+    *,
+    all_environment: Mapping[str, str],
+    command_runner: CommandRunner,
+) -> int:
+    """Run one validated pull request action.
+
+    Args:
+        all_arguments: Command arguments after the script name.
+        all_environment: Parent environment copied for child processes.
+        command_runner: Process runner used by tests and production.
+
+    Returns:
+        The linter, account lookup, or GitHub action exit status.
+    """
+    arguments = _build_parser().parse_args(list(all_arguments))
+    completed_lint = command_runner(
+        _linter_arguments(arguments), check=False, shell=False
+    )
+    if completed_lint.returncode != 0:
+        return completed_lint.returncode
+    return _run_action(arguments, all_environment, command_runner)
+
+
+if __name__ == "__main__":
+    raise SystemExit(
+        main(
+            sys.argv[1:],
+            all_environment=os.environ,
+            command_runner=subprocess.run,
+        )
+    )

package/.agents/skills/pull-request/scripts/recover_legacy_author.py

@@ -0,0 +1,251 @@
+"""Restore one explicitly selected legacy GitHub author-swap record."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import stat
+import subprocess
+import sys
+import time
+from collections.abc import Callable, Sequence
+from pathlib import Path
+
+from github_pr_command_constants.config.constants import (
+    ALL_GH_AUTH_SWITCH_COMMAND_HEAD,
+    LEGACY_RECORD_ACTIVE_MESSAGE,
+    LEGACY_RECORD_CHANGED_MESSAGE,
+    LEGACY_RECORD_CONFIRMATION_MESSAGE,
+    LEGACY_RECORD_INACTIVE_CONFIRMATION_FLAG,
+    LEGACY_RECORD_NAME_PATTERN,
+    LEGACY_RECORD_ORIGINAL_ACCOUNT_KEY,
+    LEGACY_RECORD_PERMISSION_MODE,
+    LEGACY_RECORD_REJECTED_MESSAGE,
+    LEGACY_RECORD_STALE_AGE_SECONDS,
+    LEGACY_RESTORE_FAILED_MESSAGE,
+    RECOVERY_CLEAN_EXIT_CODE,
+    RECOVERY_FAILED_EXIT_CODE,
+    RECOVERY_REJECTED_EXIT_CODE,
+    RECOVERY_UNRESOLVED_EXIT_CODE,
+)
+
+CommandRunner = Callable[..., subprocess.CompletedProcess[str]]
+FileFingerprint = tuple[int, int, int, int, int]
+VerifiedRecord = tuple[str, FileFingerprint]
+
+
+class LegacyRecordRejected(ValueError):
+    """Report an invalid legacy state record."""
+
+
+class LegacyRecordActive(ValueError):
+    """Report a legacy state record that is not old enough for recovery."""
+
+
+class LegacyRecordChanged(ValueError):
+    """Report a legacy state record that changed during recovery."""
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
+    parser.add_argument("state_file", type=Path)
+    parser.add_argument(LEGACY_RECORD_INACTIVE_CONFIRMATION_FLAG, action="store_true")
+    return parser
+
+
+def _posix_metadata_is_secure(
+    file_mode: int,
+    file_owner_id: int,
+    current_user_id: int | None,
+) -> bool:
+    if not stat.S_ISREG(file_mode):
+        return False
+    if current_user_id is None:
+        return True
+    return (
+        stat.S_IMODE(file_mode) == LEGACY_RECORD_PERMISSION_MODE
+        and file_owner_id == current_user_id
+    )
+
+
+def _secure_metadata(
+    state_file: Path,
+    current_user_id: int | None,
+) -> os.stat_result:
+    try:
+        file_metadata = state_file.lstat()
+    except OSError as error:
+        raise LegacyRecordRejected from error
+    if not _posix_metadata_is_secure(
+        file_metadata.st_mode,
+        file_metadata.st_uid,
+        current_user_id,
+    ):
+        raise LegacyRecordRejected
+    return file_metadata
+
+
+def _fingerprint(file_metadata: os.stat_result) -> FileFingerprint:
+    return (
+        file_metadata.st_dev,
+        file_metadata.st_ino,
+        file_metadata.st_mode,
+        file_metadata.st_size,
+        file_metadata.st_mtime_ns,
+    )
+
+
+def _parse_original_account(record_text: str) -> str:
+    try:
+        decoded_record = json.loads(record_text)
+    except json.JSONDecodeError as error:
+        raise LegacyRecordRejected from error
+    if not isinstance(decoded_record, dict):
+        raise LegacyRecordRejected
+    if set(decoded_record) != {LEGACY_RECORD_ORIGINAL_ACCOUNT_KEY}:
+        raise LegacyRecordRejected
+    original_account = decoded_record[LEGACY_RECORD_ORIGINAL_ACCOUNT_KEY]
+    if not isinstance(original_account, str) or not original_account.strip():
+        raise LegacyRecordRejected
+    return original_account.strip()
+
+
+def _read_verified_record(
+    state_file: Path,
+    now_seconds: float,
+    current_user_id: int | None,
+) -> VerifiedRecord:
+    if LEGACY_RECORD_NAME_PATTERN.fullmatch(state_file.name) is None:
+        raise LegacyRecordRejected
+    initial_metadata = _secure_metadata(state_file, current_user_id)
+    if now_seconds - initial_metadata.st_mtime < LEGACY_RECORD_STALE_AGE_SECONDS:
+        raise LegacyRecordActive
+    try:
+        record_text = state_file.read_text(encoding="utf-8")
+    except (OSError, UnicodeError) as error:
+        raise LegacyRecordRejected from error
+    original_account = _parse_original_account(record_text)
+    initial_fingerprint = _fingerprint(initial_metadata)
+    verified_metadata = _secure_metadata(state_file, current_user_id)
+    if _fingerprint(verified_metadata) != initial_fingerprint:
+        raise LegacyRecordChanged
+    return original_account, initial_fingerprint
+
+
+def _delete_unchanged_record(
+    state_file: Path,
+    expected_fingerprint: FileFingerprint,
+    current_user_id: int | None,
+) -> None:
+    current_metadata = _secure_metadata(state_file, current_user_id)
+    if _fingerprint(current_metadata) != expected_fingerprint:
+        raise LegacyRecordChanged
+    try:
+        state_file.unlink()
+    except OSError as error:
+        raise LegacyRecordChanged from error
+
+
+def _load_record_with_diagnostics(
+    state_file: Path,
+    now_seconds: float,
+    current_user_id: int | None,
+) -> tuple[VerifiedRecord | None, int]:
+    try:
+        return _read_verified_record(state_file, now_seconds, current_user_id), 0
+    except LegacyRecordActive:
+        sys.stderr.write(LEGACY_RECORD_ACTIVE_MESSAGE)
+        return None, RECOVERY_REJECTED_EXIT_CODE
+    except LegacyRecordChanged:
+        sys.stderr.write(LEGACY_RECORD_CHANGED_MESSAGE)
+        return None, RECOVERY_FAILED_EXIT_CODE
+    except LegacyRecordRejected:
+        sys.stderr.write(LEGACY_RECORD_REJECTED_MESSAGE)
+        return None, RECOVERY_REJECTED_EXIT_CODE
+
+
+def _restore_and_delete(
+    state_file: Path,
+    verified_record: VerifiedRecord,
+    current_user_id: int | None,
+    command_runner: CommandRunner,
+) -> int:
+    original_account, expected_fingerprint = verified_record
+    try:
+        completed_restore = command_runner(
+            [*ALL_GH_AUTH_SWITCH_COMMAND_HEAD, original_account],
+            capture_output=True,
+            check=False,
+            shell=False,
+            text=True,
+        )
+    except OSError:
+        sys.stderr.write(LEGACY_RESTORE_FAILED_MESSAGE)
+        return RECOVERY_FAILED_EXIT_CODE
+    if completed_restore.returncode != 0:
+        sys.stderr.write(LEGACY_RESTORE_FAILED_MESSAGE)
+        return RECOVERY_FAILED_EXIT_CODE
+    try:
+        _delete_unchanged_record(state_file, expected_fingerprint, current_user_id)
+    except (LegacyRecordChanged, LegacyRecordRejected):
+        sys.stderr.write(LEGACY_RECORD_CHANGED_MESSAGE)
+        return RECOVERY_FAILED_EXIT_CODE
+    return RECOVERY_CLEAN_EXIT_CODE
+
+
+def _recover_selected_record(
+    state_file: Path,
+    now_seconds: float,
+    current_user_id: int | None,
+    command_runner: CommandRunner,
+) -> int:
+    verified_record, exit_code = _load_record_with_diagnostics(
+        state_file, now_seconds, current_user_id
+    )
+    if verified_record is None:
+        return exit_code
+    return _restore_and_delete(
+        state_file, verified_record, current_user_id, command_runner
+    )
+
+
+def main(
+    all_arguments: Sequence[str],
+    *,
+    now_seconds: float,
+    current_user_id: int | None,
+    command_runner: CommandRunner,
+) -> int:
+    """Recover one confirmed-inactive legacy state record.
+
+    Args:
+        all_arguments: Command arguments after the script name.
+        now_seconds: Current wall-clock time in seconds.
+        current_user_id: Current POSIX user identifier, or None on Windows.
+        command_runner: Process runner used by tests and production.
+
+    Returns:
+        Zero on success, one on failure, two on rejection, or three when unresolved.
+    """
+    arguments = _build_parser().parse_args(list(all_arguments))
+    if not arguments.confirm_inactive:
+        sys.stderr.write(LEGACY_RECORD_CONFIRMATION_MESSAGE)
+        return RECOVERY_UNRESOLVED_EXIT_CODE
+    return _recover_selected_record(
+        arguments.state_file,
+        now_seconds,
+        current_user_id,
+        command_runner,
+    )
+
+
+if __name__ == "__main__":
+    raise SystemExit(
+        main(
+            sys.argv[1:],
+            now_seconds=time.time(),
+            current_user_id=os.getuid() if hasattr(os, "getuid") else None,
+            command_runner=subprocess.run,
+        )
+    )

package/.agents/skills/pull-request/scripts/test_github_pr_command_constants.py

@@ -0,0 +1,49 @@
+"""Tests for explicit GitHub pull request command constants."""
+
+import sys
+from pathlib import Path
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+
+from github_pr_command_constants.config import constants
+
+
+def test_action_and_linter_mappings_are_complete() -> None:
+    assert constants.ALL_LINTER_ACTIONS_BY_COMMAND == {
+        constants.ACTION_COMMENT: constants.LINTER_ACTION_COMMENT,
+        constants.ACTION_CREATE: constants.LINTER_ACTION_CREATE,
+        constants.ACTION_EDIT: constants.LINTER_ACTION_EDIT,
+        constants.ACTION_REVIEW: constants.LINTER_ACTION_REVIEW,
+    }
+
+
+def test_review_event_flags_are_complete() -> None:
+    assert constants.ALL_REVIEW_FLAGS_BY_EVENT == {
+        constants.REVIEW_EVENT_APPROVE: "--approve",
+        constants.REVIEW_EVENT_COMMENT: "--comment",
+        constants.REVIEW_EVENT_REQUEST_CHANGES: "--request-changes",
+    }
+
+
+def test_account_boundary_constants_are_safe_and_stable() -> None:
+    assert constants.SELECTED_ACCOUNT_ENVIRONMENT_KEY == "GITHUB_DEFAULT_ACCOUNT"
+    assert constants.ACCOUNT_LOOKUP_FAILURE_EXIT_CODE == 1
+    assert constants.ACCOUNT_LOOKUP_FAILED_MESSAGE.endswith("lookup failed\n")
+    assert constants.ACCOUNT_LOOKUP_EMPTY_MESSAGE.endswith("returned no value\n")
+
+
+def test_legacy_recovery_constants_define_one_record_boundary() -> None:
+    assert constants.ALL_GH_AUTH_SWITCH_COMMAND_HEAD == (
+        "gh",
+        "auth",
+        "switch",
+        "--user",
+    )
+    assert constants.LEGACY_RECORD_NAME_PATTERN.fullmatch(
+        "gh_pr_author_swap_session-a.json"
+    )
+    assert not constants.LEGACY_RECORD_NAME_PATTERN.fullmatch("other.json")
+    assert constants.LEGACY_RECORD_STALE_AGE_SECONDS == 1800
+    assert constants.RECOVERY_UNRESOLVED_EXIT_CODE == 3