claude-dev-env 4.3.0 → 7.1.0

package/hooks/blocking/test_bash_pre_tool_use_dispatcher.py

@@ -100,17 +100,6 @@ def test_clean_command_yields_no_decision_matching_the_standalone_chain() -> Non
     assert dispatcher_decision == expected_decision
 
 
-def test_destructive_command_asks_matching_the_standalone_chain() -> None:
-    """A destructive command the chain asks on makes the dispatcher ask too."""
-    payload_text = _bash_payload("rm -rf /")
-    expected_decision = _expected_precedence(payload_text, BASH_TOOL_NAME)
-    dispatcher_decision, _reason = _decision_from_stdout(
-        _run_process(_DISPATCHER_SCRIPT, payload_text).stdout
-    )
-    assert dispatcher_decision == expected_decision
-    assert expected_decision == "ask"
-
-
 def test_dispatcher_exits_zero_on_a_clean_command() -> None:
     """The dispatcher exits zero for a command no hook decides on."""
     completed = _run_process(_DISPATCHER_SCRIPT, _bash_payload("echo hi"))
@@ -212,19 +201,6 @@ def test_additional_context_is_collected_from_deciding_hooks() -> None:
     assert aggregated.all_additional_context == ["see docs/runbook.md"]
 
 
-def test_powershell_selects_the_shared_hooks_in_registration_order() -> None:
-    """Selecting for PowerShell yields the shared hooks in registration order."""
-    powershell_paths = [
-        each_entry.script_relative_path
-        for each_entry in select_applicable_entries(POWERSHELL_TOOL_NAME)
-    ]
-    assert powershell_paths == [
-        "blocking/cursor_cli_python_misfire_blocker.py",
-        "blocking/unscoped_search_blocker.py",
-        "blocking/pii_prevention_blocker.py",
-    ]
-
-
 def test_dispatcher_imports_standalone_with_only_blocking_on_the_path() -> None:
     """The dispatcher's bootstrap resolves hooks_constants without hooks/ on PYTHONPATH."""
     subprocess_environment = {**os.environ, "PYTHONPATH": str(_BLOCKING_DIR)}
@@ -259,48 +235,3 @@ def test_emit_decision_re_emits_silent_deny_fields(
     assert hook_specific["additionalContext"] == "see docs/runbook.md"
     assert emitted_payload["systemMessage"] == "[gh-gate] blocked redirected gh pr create"
     assert emitted_payload["suppressOutput"] is True
-
-
-def test_dispatcher_denies_subshell_disguised_as_arithmetic_expansion() -> None:
-    """The dispatcher denies a `$((cd X) && Y)` subshell, not only the bare hook.
-
-    `echo $((cd /tmp) && pwd)` opens with a `$((` two-character lookahead
-    match, so a function-level test alone does not prove the block reaches
-    the live Bash tool path.
-    """
-    payload_text = _bash_payload("echo $((cd /tmp) && pwd)")
-    decision, _reason = _decision_from_stdout(_run_process(_DISPATCHER_SCRIPT, payload_text).stdout)
-    assert decision == "deny"
-
-
-def test_dispatch_emits_deny_immediately_and_skips_later_hooks(
-    monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
-) -> None:
-    """A mid-chain deny emits at once and does not invoke later hosted hooks."""
-    all_call_paths: list[str] = []
-
-    def _fake_run_hook(script_path: str, payload_text: str) -> HostedHookRun:
-        del payload_text
-        all_call_paths.append(script_path)
-        script_name = Path(script_path).name
-        if script_name == "destructive_command_blocker.py":
-            return HostedHookRun(
-                captured_stdout=_decision_json("deny", "blocked early"),
-                did_crash=False,
-            )
-        if script_name == "precommit_code_rules_gate.py":
-            raise AssertionError("later hooks must not run after an early deny")
-        return HostedHookRun(captured_stdout="", did_crash=False)
-
-    monkeypatch.setattr(
-        "bash_pre_tool_use_dispatcher.run_hook_capturing_output",
-        _fake_run_hook,
-    )
-    dispatch(_bash_payload("rm -rf /"), BASH_TOOL_NAME)
-    captured = capsys.readouterr()
-    decision, reason = _decision_from_stdout(captured.out)
-    assert decision == "deny"
-    assert "blocked early" in reason
-    assert any(path.endswith("destructive_command_blocker.py") for path in all_call_paths)
-    assert not any(path.endswith("precommit_code_rules_gate.py") for path in all_call_paths)

package/hooks/blocking/test_code_rules_banned_identifiers.py

@@ -0,0 +1,64 @@
+from __future__ import annotations
+
+from code_rules_banned_identifiers import (
+    _find_banned_noun_word,
+    check_banned_noun_word_boundary,
+)
+
+PRODUCTION_FILE_PATH = "packages/app/services/customer_pipeline.py"
+
+
+def test_should_return_no_banned_word_for_item_blocked_exception_suffix() -> None:
+    assert _find_banned_noun_word("AssetSizingItemBlocked") is None
+    assert _find_banned_noun_word("NinePatchGuideFrameItemBlocked") is None
+
+
+def test_should_return_no_banned_word_for_run_fatal_exception_suffix() -> None:
+    assert _find_banned_noun_word("AssetVariantRunFatal") is None
+
+
+def test_should_return_banned_word_for_item_without_blast_radius_suffix() -> None:
+    assert _find_banned_noun_word("IconGridItem") == "item"
+    assert _find_banned_noun_word("item_key") == "item"
+
+
+def test_should_allow_class_ending_with_item_blocked_suffix() -> None:
+    source = "class AssetSizingItemBlocked(Exception):\n    pass\n"
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_allow_long_class_ending_with_item_blocked_suffix() -> None:
+    source = "class NinePatchGuideFrameItemBlocked(Exception):\n    pass\n"
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_allow_class_ending_with_run_fatal_suffix() -> None:
+    source = "class AssetVariantRunFatal(Exception):\n    pass\n"
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_flag_class_ending_with_item_without_blast_radius_suffix() -> None:
+    source = "class IconGridItem:\n    pass\n"
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert any("IconGridItem" in each_issue for each_issue in issues)
+
+
+def test_should_flag_item_key_assignment() -> None:
+    source = "item_key = 'slot'\n"
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert any("item_key" in each_issue for each_issue in issues)
+
+
+def test_should_flag_output_path_assignment() -> None:
+    source = "output_path = 'slot'\n"
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert any("output_path" in each_issue for each_issue in issues)
+
+
+def test_should_flag_each_value_assignment() -> None:
+    source = "each_value = 1\n"
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert any("each_value" in each_issue for each_issue in issues)

package/hooks/blocking/test_code_rules_enforcer_paired_test.py

@@ -19,6 +19,10 @@ _BLOCKING_DIRECTORY = Path(__file__).resolve().parent
 if str(_BLOCKING_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(_BLOCKING_DIRECTORY))
 
+from hooks_constants.paired_test_coverage_constants import (  # noqa: E402
+    MAX_TEST_FILES_SCANNED,
+)
+
 from code_rules_paired_test import (  # noqa: E402
     check_public_function_missing_paired_test,
     check_test_file_omits_module_public_function,
@@ -26,9 +30,7 @@ from code_rules_paired_test import (  # noqa: E402
 
 _TWO_PUBLIC_FUNCTIONS = "def alpha():\n    return 1\n\n\ndef beta():\n    return 2\n"
 _THREE_PUBLIC_FUNCTIONS = (
-    "def alpha():\n    return 1\n\n\n"
-    "def beta():\n    return 2\n\n\n"
-    "def gamma():\n    return 3\n"
+    "def alpha():\n    return 1\n\n\ndef beta():\n    return 2\n\n\ndef gamma():\n    return 3\n"
 )
 
 
@@ -145,6 +147,28 @@ def test_counts_coverage_across_sibling_test_files(
     assert all_issues == []
 
 
+def test_reads_the_stem_test_when_the_suite_exceeds_the_scan_cap(
+    neutral_package_directory: Path,
+) -> None:
+    filler_body = "def test_nothing():\n    assert True\n"
+    _write_test_file(
+        neutral_package_directory,
+        "test_a0000.py",
+        "from pkg.mod import alpha\n\ndef test_alpha():\n    assert alpha() == 1\n",
+    )
+    for each_index in range(1, MAX_TEST_FILES_SCANNED + 1):
+        _write_test_file(neutral_package_directory, f"test_a{each_index:04d}.py", filler_body)
+    _write_test_file(
+        neutral_package_directory,
+        "test_mod.py",
+        "from pkg.mod import beta\n\ndef test_beta():\n    assert beta() == 2\n",
+    )
+    all_issues = check_public_function_missing_paired_test(
+        _TWO_PUBLIC_FUNCTIONS, str(neutral_package_directory / "mod.py")
+    )
+    assert all_issues == []
+
+
 def test_main_and_private_functions_are_never_required(
     neutral_package_directory: Path,
 ) -> None:
@@ -183,8 +207,7 @@ def _write_module(package_directory: Path, body: str) -> None:
 
 
 _SUITE_COVERS_ALPHA_BETA = (
-    "from pkg.mod import alpha, beta\n\n"
-    "def test_pair():\n    assert alpha() == 1 and beta() == 2\n"
+    "from pkg.mod import alpha, beta\n\ndef test_pair():\n    assert alpha() == 1 and beta() == 2\n"
 )
 
 
@@ -193,9 +216,7 @@ def test_flags_module_public_function_when_test_suite_omits_it(
 ) -> None:
     _write_module(neutral_package_directory, _THREE_PUBLIC_FUNCTIONS)
     test_path = str(neutral_package_directory / "tests" / "test_mod.py")
-    all_issues = check_test_file_omits_module_public_function(
-        _SUITE_COVERS_ALPHA_BETA, test_path
-    )
+    all_issues = check_test_file_omits_module_public_function(_SUITE_COVERS_ALPHA_BETA, test_path)
     assert len(all_issues) == 1
     assert "gamma" in all_issues[0]
     assert "mod.py" in all_issues[0]
@@ -231,9 +252,7 @@ def test_skips_test_file_with_no_paired_production_module(
     neutral_package_directory: Path,
 ) -> None:
     test_path = str(neutral_package_directory / "tests" / "test_mod.py")
-    all_issues = check_test_file_omits_module_public_function(
-        _SUITE_COVERS_ALPHA_BETA, test_path
-    )
+    all_issues = check_test_file_omits_module_public_function(_SUITE_COVERS_ALPHA_BETA, test_path)
     assert all_issues == []
 
 
@@ -242,9 +261,7 @@ def test_ignores_a_non_stem_matched_written_file(
 ) -> None:
     _write_module(neutral_package_directory, _THREE_PUBLIC_FUNCTIONS)
     helper_path = str(neutral_package_directory / "helper.py")
-    all_issues = check_test_file_omits_module_public_function(
-        _SUITE_COVERS_ALPHA_BETA, helper_path
-    )
+    all_issues = check_test_file_omits_module_public_function(_SUITE_COVERS_ALPHA_BETA, helper_path)
     assert all_issues == []
 
 
@@ -274,9 +291,7 @@ def test_judges_post_edit_content_over_stale_on_disk_test(
         "from pkg.mod import alpha, beta, gamma\n\n"
         "def test_all():\n    assert alpha() and beta() and gamma()\n"
     )
-    all_issues = check_test_file_omits_module_public_function(
-        post_edit_covers_all, test_path
-    )
+    all_issues = check_test_file_omits_module_public_function(post_edit_covers_all, test_path)
     assert all_issues == []
 
 
@@ -290,9 +305,7 @@ def test_counts_coverage_across_sibling_test_files_on_test_write(
         "from pkg.mod import gamma\n\ndef test_gamma():\n    assert gamma() == 3\n",
     )
     test_path = str(neutral_package_directory / "tests" / "test_mod.py")
-    all_issues = check_test_file_omits_module_public_function(
-        _SUITE_COVERS_ALPHA_BETA, test_path
-    )
+    all_issues = check_test_file_omits_module_public_function(_SUITE_COVERS_ALPHA_BETA, test_path)
     assert all_issues == []
 
 
@@ -301,9 +314,7 @@ def test_test_side_message_names_module_and_function_without_line_prefix(
 ) -> None:
     _write_module(neutral_package_directory, _THREE_PUBLIC_FUNCTIONS)
     test_path = str(neutral_package_directory / "tests" / "test_mod.py")
-    all_issues = check_test_file_omits_module_public_function(
-        _SUITE_COVERS_ALPHA_BETA, test_path
-    )
+    all_issues = check_test_file_omits_module_public_function(_SUITE_COVERS_ALPHA_BETA, test_path)
     assert len(all_issues) == 1
     assert not all_issues[0].startswith("Line ")
     assert "mod.py" in all_issues[0]
@@ -315,9 +326,7 @@ def test_test_side_omission_blocks_on_any_test_file_edit(
 ) -> None:
     _write_module(neutral_package_directory, _THREE_PUBLIC_FUNCTIONS)
     test_path = str(neutral_package_directory / "tests" / "test_mod.py")
-    all_issues = check_test_file_omits_module_public_function(
-        _SUITE_COVERS_ALPHA_BETA, test_path
-    )
+    all_issues = check_test_file_omits_module_public_function(_SUITE_COVERS_ALPHA_BETA, test_path)
     assert len(all_issues) == 1
     assert "gamma" in all_issues[0]
 
@@ -333,7 +342,5 @@ def test_skips_when_paired_production_module_is_exempt(
         "from pkg import alpha, beta, gamma\n\n"
         "def test_all():\n    assert alpha() and beta() and gamma()\n"
     )
-    all_issues = check_test_file_omits_module_public_function(
-        suite_covers_all, beside_test_path
-    )
+    all_issues = check_test_file_omits_module_public_function(suite_covers_all, beside_test_path)
     assert all_issues == []

package/hooks/blocking/test_code_rules_js_resume_task_enumeration.py

@@ -17,8 +17,8 @@ import pathlib
 import sys
 
 _PACKAGE_ROOT = pathlib.Path(__file__).resolve().parents[2]
-_SHIPPED_CONVERGE_MJS = (
-    _PACKAGE_ROOT / ".agents" / "skills" / "autoconverge" / "workflow" / "converge.mjs"
+_ARCHIVED_CONVERGE_MJS = (
+    _PACKAGE_ROOT.parents[1] / "skill-archive" / "autoconverge" / "workflow" / "converge.mjs"
 )
 
 _HOOK_DIRECTORY = pathlib.Path(__file__).parent
@@ -750,8 +750,8 @@ def should_still_flag_real_dispatch_alongside_task_substring_identifier() -> Non
     assert "spawnVerifierAgent" in issues[0]
 
 
-def should_not_flag_shipped_converge_workflow() -> None:
-    converge_source = _SHIPPED_CONVERGE_MJS.read_text(encoding="utf-8")
+def should_not_flag_archived_converge_regression_fixture() -> None:
+    converge_source = _ARCHIVED_CONVERGE_MJS.read_text(encoding="utf-8")
     issues = check_js_resume_task_enumeration_coverage(
         converge_source, "skills/autoconverge/workflow/converge.mjs"
     )

package/hooks/blocking/test_code_rules_js_returns_object_schemaless.py

@@ -34,8 +34,8 @@ check_js_returns_object_schemaless_branch = (
 
 _MJS_PATH = "skills/autoconverge/workflow/converge.mjs"
 
-_SHIPPED_CONVERGE_MJS = (
-    _HOOK_DIRECTORY.parents[1] / ".agents" / "skills" / "autoconverge" / "workflow" / "converge.mjs"
+_ARCHIVED_CONVERGE_MJS = (
+    _HOOK_DIRECTORY.parents[3] / "skill-archive" / "autoconverge" / "workflow" / "converge.mjs"
 )
 
 
@@ -161,7 +161,7 @@ def test_skips_python_files() -> None:
     assert issues == []
 
 
-def test_shipped_converge_mjs_passes_its_own_check() -> None:
-    shipped_source = _SHIPPED_CONVERGE_MJS.read_text(encoding="utf-8")
-    issues = check_js_returns_object_schemaless_branch(shipped_source, _MJS_PATH)
+def test_archived_converge_regression_fixture_passes_the_check() -> None:
+    archived_source = _ARCHIVED_CONVERGE_MJS.read_text(encoding="utf-8")
+    issues = check_js_returns_object_schemaless_branch(archived_source, _MJS_PATH)
     assert issues == []