claude-dev-env 4.3.0 → 7.1.0

package/hooks/git-hooks/test_installed_policy_lint.py

@@ -0,0 +1,208 @@
+"""Prove retirement and local enforcement through an actual disposable install."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+from test_native_hook_support import run_git
+
+ALL_RETIRED_HOOK_PATHS = (
+    "blocking/code_rules_enforcer.py",
+    "blocking/tdd_enforcer.py",
+    "blocking/windows_rmtree_blocker.py",
+    "blocking/state_description_blocker.py",
+    "blocking/subprocess_budget_completeness.py",
+    "blocking/hook_prose_detector_consistency.py",
+    "blocking/workflow_substitution_slot_blocker.py",
+    "validation/hook_format_validator.py",
+    "blocking/open_questions_in_plans_blocker.py",
+    "blocking/docstring_rule_gate_count_blocker.py",
+    "blocking/plain_language_blocker.py",
+    "lifecycle/config_change_guard.py",
+)
+PACKAGE_ROOT = Path(__file__).resolve().parents[2]
+ALL_RULE_FIXTURES = (
+    ("code-rules", "src/worker.py", "from typing import Any\n\ndef worker() -> Any:\n    return None\n"),
+    ("test-pairing", "src/feature.py", "def work() -> None:\n    pass\n"),
+    ("state-description", "docs/config.md", "# Config\n\nPreviously set via env var.\n"),
+    ("subprocess-budget", "src/timing.py", "import subprocess\nPYTHON_FORMAT_TIMEOUT_SECONDS = 12\nGIT_CHECK_TIMEOUT_SECONDS = 5\ndef worst_case_python_format_seconds() -> int:\n    fix_phase_seconds = PYTHON_FORMAT_TIMEOUT_SECONDS\n    format_phase_seconds = PYTHON_FORMAT_TIMEOUT_SECONDS\n    return fix_phase_seconds + format_phase_seconds\ndef is_untracked_in_git(file_path: str) -> bool:\n    git_check = subprocess.run(['git', 'ls-files', file_path], timeout=GIT_CHECK_TIMEOUT_SECONDS)\n    return git_check.returncode != 0\ndef run_format(file_path: str) -> None:\n    subprocess.run(['ruff', 'format', file_path], timeout=PYTHON_FORMAT_TIMEOUT_SECONDS)\ndef main(file_path: str) -> None:\n    if is_untracked_in_git(file_path):\n        return\n    run_format(file_path)\n"),
+    ("hook-prose-consistency", "hooks/hooks_constants/probe_constants.py", 'CORRECTIVE_MESSAGE = "appears as a path or output-key segment"\n'),
+    ("workflow-substitution", "scripts/sample.workflow.js", "For EACH candidate i, build a bible dir cand_i per the contract.\n   & ${PY} compose.py --out ${args.work_dir}\\\\cand_i\\\\sample.png --glow <candidate glow_hex>\nReturn: {key: \"cand_i\", name, sample_png}\n"),
+)
+
+
+def _git(repository_path: Path, *arguments: str) -> str:
+    return run_git(repository_path, *arguments).stdout.strip()
+
+
+def _stage(repository_path: Path, relative_path: str, content: str) -> Path:
+    file_path = repository_path / relative_path
+    file_path.parent.mkdir(parents=True, exist_ok=True)
+    file_path.write_text(content, encoding="utf-8")
+    _git(repository_path, "add", "--", relative_path)
+    return file_path
+
+
+@pytest.fixture()
+def repository_root(tmp_path_factory: pytest.TempPathFactory, monkeypatch: pytest.MonkeyPatch) -> Path:
+    temporary_root = tmp_path_factory.mktemp("policy-fixture")
+    home_directory = temporary_root / "home"
+    home_directory.mkdir()
+    monkeypatch.setenv("HOME", str(home_directory))
+    monkeypatch.setenv("USERPROFILE", str(home_directory))
+    monkeypatch.setenv("GIT_CONFIG_GLOBAL", os.devnull)
+    monkeypatch.setenv("GIT_CONFIG_NOSYSTEM", "1")
+    repository_path = temporary_root / "repository"
+    repository_path.mkdir()
+    _git(repository_path, "init")
+    _git(repository_path, "config", "core.hooksPath", str(temporary_root / "disabled-fixture-hooks"))
+    _git(repository_path, "config", "user.name", "Fixture")
+    _git(repository_path, "config", "user.email", "fixture@example.com")
+    _git(repository_path, "commit", "--allow-empty", "-m", "fixture base")
+    monkeypatch.chdir(repository_path)
+    return repository_path
+
+
+def _legacy_settings_bytes(managed_root: Path, foreign_command: str) -> bytes:
+    original_settings = {
+        "permissions": {"allow": ["Read"]},
+        "hooks": {"PreToolUse": [{
+            "matcher": "Write|Edit|MultiEdit|apply_patch",
+            "hooks": [
+                {"type": "command", "command": foreign_command, "timeout": 17},
+                *({
+                    "type": "command",
+                    "command": f"python {managed_root.as_posix()}/hooks/{each_path}",
+                    "timeout": 10,
+                } for each_path in ALL_RETIRED_HOOK_PATHS),
+            ],
+        }]},
+    }
+    return json.dumps(original_settings, indent=2).encode("utf-8")
+
+
+def _install_environment(home: Path) -> dict[str, str]:
+    environment = {
+        each_name: each_value for each_name, each_value in os.environ.items()
+        if not each_name.startswith("GIT_")
+    }
+    environment.update({
+        "HOME": str(home),
+        "USERPROFILE": str(home),
+        "CLAUDE_CONFIG_DIR": str(home / ".claude"),
+        "CODEX_HOME": str(home / ".codex"),
+        "GIT_CONFIG_GLOBAL": str(home / "gitconfig"),
+        "GIT_CONFIG_NOSYSTEM": "1",
+    })
+    return environment
+
+
+def _install_twice(home: Path, settings_path: Path) -> bytes:
+    all_settings_bytes: list[bytes] = []
+    for each_run in range(2):
+        completed = subprocess.run(
+            ["node", str(PACKAGE_ROOT / "bin/install.mjs"), "--only", "core"],
+            cwd=PACKAGE_ROOT, env=_install_environment(home),
+            capture_output=True, text=True, check=False, timeout=180,
+        )
+        (home / f"install-{each_run}.log").write_text(
+            completed.stdout + completed.stderr, encoding="utf-8"
+        )
+        assert completed.returncode == 0, completed.stdout + completed.stderr
+        all_settings_bytes.append(settings_path.read_bytes())
+    assert all_settings_bytes[0] == all_settings_bytes[1]
+    return all_settings_bytes[-1]
+
+
+def _assert_retired_registrations(managed_root: Path, settings_bytes: bytes, foreign_command: str) -> None:
+    settings = json.loads(settings_bytes)
+    all_commands = [
+        each_hook["command"]
+        for each_groups in settings["hooks"].values()
+        for each_group in each_groups
+        for each_hook in each_group["hooks"]
+    ]
+    assert all_commands.count(foreign_command) == 1
+    assert "Read" in settings["permissions"]["allow"]
+    for each_relative_path in ALL_RETIRED_HOOK_PATHS:
+        assert not any(each_relative_path in each_command for each_command in all_commands)
+        source = PACKAGE_ROOT / "hooks" / each_relative_path
+        installed = managed_root / "hooks" / each_relative_path
+        assert hashlib.sha256(installed.read_bytes()).digest() == hashlib.sha256(source.read_bytes()).digest()
+
+
+@pytest.fixture(scope="module")
+def managed_installation(tmp_path_factory: pytest.TempPathFactory) -> Path:
+    """Install twice into a private home while retaining exact prior settings."""
+    home = tmp_path_factory.mktemp("installed-policy")
+    managed_root = home / ".claude"
+    managed_root.mkdir()
+    foreign_command = "python /unmanaged/fixture_notice.py"
+    original_bytes = _legacy_settings_bytes(managed_root, foreign_command)
+    settings_path = managed_root / "settings.json"
+    settings_path.write_bytes(original_bytes)
+    backup_directory = home / "before-cutover"
+    backup_directory.mkdir()
+    (backup_directory / "settings.json").write_bytes(original_bytes)
+    installed_settings = _install_twice(home, settings_path)
+    _assert_retired_registrations(managed_root, installed_settings, foreign_command)
+    assert (backup_directory / "settings.json").read_bytes() == original_bytes
+    hook_path = _git(home, "config", "--file", str(home / "gitconfig"), "--get", "core.hooksPath")
+    assert Path(hook_path).resolve() == (managed_root / "hooks/git-hooks").resolve()
+    return managed_root
+
+
+@pytest.mark.parametrize(("rule_id", "relative_path", "content"), ALL_RULE_FIXTURES)
+def test_installed_linter_reports_each_retired_file_rule_before_soft_commit(
+    managed_installation: Path,
+    repository_root: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    rule_id: str,
+    relative_path: str,
+    content: str,
+) -> None:
+    _git(repository_root, "config", "core.hooksPath", str(managed_installation / "hooks/git-hooks"))
+    monkeypatch.delenv("CLAUDE_CONFIG_DIR", raising=False)
+    monkeypatch.setenv("CODE_RULES_GATE_PATH", str(repository_root / "missing-old-gate.py"))
+    before = _git(repository_root, "rev-parse", "HEAD")
+    _stage(repository_root, relative_path, content)
+    lint_completed = subprocess.run(
+        [sys.executable, str(managed_installation / "scripts/cde_lint.py"), "--staged", "--format", "json"],
+        cwd=repository_root, capture_output=True, text=True, check=False, timeout=240,
+    )
+    assert lint_completed.returncode != 0
+    assert rule_id in lint_completed.stdout + lint_completed.stderr
+    completed = subprocess.run(
+        ["git", "commit", "-m", "invalid fixture"],
+        cwd=repository_root, capture_output=True, text=True, check=False, timeout=240,
+    )
+    assert completed.returncode == 0
+    assert _git(repository_root, "rev-parse", "HEAD") != before
+
+
+def test_installed_linter_and_native_commit_allow_valid_changes(
+    managed_installation: Path,
+    repository_root: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    _git(repository_root, "config", "core.hooksPath", str(managed_installation / "hooks/git-hooks"))
+    monkeypatch.delenv("CLAUDE_CONFIG_DIR", raising=False)
+    monkeypatch.setenv("CODE_RULES_GATE_PATH", str(repository_root / "missing-old-gate.py"))
+    _stage(repository_root, "docs/guide.md", "# Guide\n\nThe API uses port 8080.\n")
+    completed = subprocess.run(
+        [sys.executable, str(managed_installation / "scripts/cde_lint.py"), "--staged", "--format", "json"],
+        cwd=repository_root, capture_output=True, text=True, check=False, timeout=240,
+    )
+    assert completed.returncode == 0, completed.stdout + completed.stderr
+    report = json.loads(completed.stdout)
+    assert report["failed_rules"] == []
+    assert "terminology-sweep" in report["executed_rules"]
+    before = _git(repository_root, "rev-parse", "HEAD")
+    _git(repository_root, "commit", "-m", "valid installed fixture")
+    assert _git(repository_root, "rev-parse", "HEAD") != before

package/hooks/git-hooks/test_native_hook_support.py

@@ -0,0 +1,129 @@
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+
+def run_git(
+    repository_path: Path,
+    *arguments: str,
+) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        ["git", *arguments],
+        cwd=repository_path,
+        check=True,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+    )
+
+
+def run_native_git_action(
+    repository_path: Path,
+    *arguments: str,
+) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        ["git", *arguments],
+        cwd=repository_path,
+        check=False,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+    )
+
+
+def run_native_hook(
+    repository_path: Path,
+    hook_script_name: str,
+) -> subprocess.CompletedProcess[str]:
+    hook_script_path = Path(__file__).resolve().parent / hook_script_name
+    return subprocess.run(
+        [sys.executable, str(hook_script_path)],
+        cwd=repository_path,
+        check=False,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+    )
+
+
+def read_git_head(repository_path: Path, reference_name: str) -> str:
+    return run_git(repository_path, "rev-parse", reference_name).stdout.strip()
+
+
+def create_bare_repository(temporary_directory: Path) -> Path:
+    bare_repository_path = temporary_directory / "remote.git"
+    subprocess.run(
+        ["git", "init", "--bare", "--quiet", str(bare_repository_path)],
+        cwd=temporary_directory,
+        check=True,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+    )
+    return bare_repository_path
+
+
+def configure_remote_url_rewrite(
+    repository_path: Path,
+    bare_repository_path: Path,
+    remote_url: str,
+) -> None:
+    run_git(
+        repository_path,
+        "config",
+        f"url.{bare_repository_path.as_uri()}.insteadOf",
+        remote_url,
+    )
+
+
+def configure_native_repository(repository_path: Path, remote_url: str) -> None:
+    run_git(repository_path, "init", "--quiet")
+    run_git(repository_path, "config", "user.email", "test@example.invalid")
+    run_git(repository_path, "config", "user.name", "Verification Test")
+    run_git(repository_path, "remote", "add", "origin", remote_url)
+    (repository_path / "README.md").write_text("check\n", encoding="utf-8")
+
+
+def create_native_repository(
+    temporary_directory: Path,
+    repository_name: str,
+    remote_url: str,
+    initial_branch: str | None = None,
+) -> Path:
+    repository_path = temporary_directory / repository_name
+    repository_path.mkdir()
+    all_init_arguments = ["init", "--quiet"]
+    if initial_branch:
+        all_init_arguments.insert(1, f"--initial-branch={initial_branch}")
+    run_git(repository_path, *all_init_arguments)
+    run_git(repository_path, "config", "user.email", "test@example.invalid")
+    run_git(repository_path, "config", "user.name", "Verification Test")
+    run_git(repository_path, "remote", "add", "origin", remote_url)
+    (repository_path / "README.md").write_text("check\n", encoding="utf-8")
+    return repository_path
+
+
+def install_native_hook(
+    repository_path: Path,
+    hook_directory: Path,
+    hook_name: str,
+    module_name: str,
+) -> None:
+    source_directory = Path(__file__).resolve().parent
+    hook_directory.mkdir()
+    shim_text = (
+        "#!/usr/bin/env python3\n"
+        "import sys\n"
+        "from pathlib import Path\n"
+        f"hook_source_directory = Path({str(source_directory)!r})\n"
+        "if str(hook_source_directory) not in sys.path:\n"
+        "    sys.path.insert(0, str(hook_source_directory))\n"
+        f"import {module_name}\n"
+        f"sys.exit({module_name}.main())\n"
+    )
+    hook_path = hook_directory / hook_name
+    hook_path.write_text(shim_text, encoding="utf-8")
+    hook_path.chmod(0o755)
+    run_git(repository_path, "config", "core.hooksPath", str(hook_directory))

package/hooks/git-hooks/test_native_policy_commit.py

@@ -0,0 +1,120 @@
+"""Exercise the native Git commit boundary in disposable repositories."""
+
+from __future__ import annotations
+
+import json
+import shlex
+import subprocess
+import sys
+from pathlib import Path
+
+import pre_commit
+import pytest
+from test_native_hook_support import run_git
+
+
+def _git(repository_path: Path, *arguments: str) -> str:
+    return run_git(repository_path, *arguments).stdout.strip()
+
+
+def _stage(repository_path: Path, relative_path: str, content: str) -> Path:
+    file_path = repository_path / relative_path
+    file_path.parent.mkdir(parents=True, exist_ok=True)
+    file_path.write_text(content, encoding="utf-8")
+    _git(repository_path, "add", "--", relative_path)
+    return file_path
+
+
+@pytest.fixture()
+def repository_root(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
+    repository_path = tmp_path / "repository"
+    repository_path.mkdir()
+    _git(repository_path, "init")
+    _git(repository_path, "config", "user.name", "Fixture")
+    _git(repository_path, "config", "user.email", "fixture@example.com")
+    _git(repository_path, "commit", "--allow-empty", "-m", "fixture base")
+    monkeypatch.chdir(repository_path)
+    return repository_path
+
+
+@pytest.fixture()
+def installed_native_hook(
+    repository_root: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> Path:
+    """Install a native fixture shim pointing to the actual pre-commit owner."""
+    hook_directory = repository_root / ".git" / "fixture-native-hooks"
+    hook_directory.mkdir()
+    hook_path = hook_directory / "pre-commit"
+    command = " ".join(
+        shlex.quote(each_argument)
+        for each_argument in (sys.executable, str(Path(pre_commit.__file__).resolve()))
+    )
+    hook_path.write_text(f"#!/bin/sh\nexec {command}\n", encoding="utf-8")
+    hook_path.chmod(0o755)
+    _git(repository_root, "config", "core.hooksPath", str(hook_directory))
+    monkeypatch.setenv("CODE_RULES_GATE_PATH", str(repository_root / "missing-legacy-gate.py"))
+    return repository_root
+
+
+def test_valid_commit_passes_the_installed_native_hook(installed_native_hook: Path) -> None:
+    before = _git(installed_native_hook, "rev-parse", "HEAD")
+    _stage(installed_native_hook, "docs/config.md", "The API uses port 8080.\n")
+    _git(installed_native_hook, "commit", "-m", "valid fixture")
+    assert _git(installed_native_hook, "rev-parse", "HEAD") != before
+
+
+def _assert_write_proceeds(repository_root: Path, relative_path: str, content: str) -> None:
+    """Exercise the actual dispatcher before attempting the staged commit."""
+    hooks_root = Path(pre_commit.__file__).resolve().parent.parent
+    payload = {
+        "tool_name": "Write",
+        "cwd": str(repository_root),
+        "tool_input": {
+            "file_path": str(repository_root / relative_path),
+            "content": content,
+        },
+    }
+    edit_result = subprocess.run(
+        [sys.executable, str(hooks_root / "blocking/pre_tool_use_dispatcher.py")],
+        cwd=repository_root,
+        input=json.dumps(payload),
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=90,
+    )
+    assert edit_result.returncode == 0, edit_result.stderr
+    edit_output = json.loads(edit_result.stdout or "{}")
+    assert edit_output.get("hookSpecificOutput", {}).get("permissionDecision") != "deny"
+
+
+def test_retired_write_check_allows_edit_but_explicit_lint_reports_violation(
+    installed_native_hook: Path,
+) -> None:
+    relative_path = "docs/config.md"
+    content = "Previously set via env var.\n"
+    _assert_write_proceeds(installed_native_hook, relative_path, content)
+    before = _git(installed_native_hook, "rev-parse", "HEAD")
+    _stage(installed_native_hook, relative_path, content)
+    package_root = Path(pre_commit.__file__).resolve().parents[2]
+    lint_result = subprocess.run(
+        [sys.executable, str(package_root / "scripts/cde_lint.py"), "--staged", "--format", "json"],
+        cwd=installed_native_hook,
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=240,
+    )
+    assert lint_result.returncode != 0
+    assert "state-description" in lint_result.stdout + lint_result.stderr
+    commit_result = subprocess.run(
+        ["git", "commit", "-m", "invalid fixture"],
+        cwd=installed_native_hook,
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=240,
+    )
+    assert commit_result.returncode == 0
+    assert _git(installed_native_hook, "rev-parse", "HEAD") != before

package/hooks/git-hooks/test_post_commit.py

@@ -0,0 +1,43 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import post_commit
+import pytest
+from test_native_hook_support import (
+    create_native_repository,
+    install_native_hook,
+    read_git_head,
+    run_git,
+    run_native_git_action,
+)
+
+
+def test_main_always_returns_zero_when_notice_reports_failure(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(post_commit, "verification_notice_main", lambda *args, **kwargs: 1)
+
+    exit_code = post_commit.main()
+
+    assert exit_code == 0
+
+
+def test_native_git_commit_notice_reports_the_new_head(tmp_path: Path) -> None:
+    repository_path = create_native_repository(
+        tmp_path,
+        "repo",
+        "https://github.com/JonEcho/python-automation.git",
+    )
+    hook_directory = tmp_path / "hooks"
+    install_native_hook(repository_path, hook_directory, "post-commit", "post_commit")
+    run_git(repository_path, "add", "README.md")
+
+    completed_commit = run_native_git_action(repository_path, "commit", "-m", "initial")
+
+    current_head = read_git_head(repository_path, "HEAD")
+    combined_output = completed_commit.stdout + completed_commit.stderr
+    assert completed_commit.returncode == 0
+    assert "Event: commit" in combined_output
+    assert f"Current SHA: {current_head}" in combined_output
+    assert "State: pending" in combined_output