claude-dev-env 4.3.0 → 7.1.0

package/scripts/shared_tree_paths.py

@@ -11,7 +11,9 @@ from collections.abc import Mapping
 from pathlib import Path
 
 from dev_env_scripts_constants.shared_tree_constants import (
+    AGENTS_DIRECTORY_SUFFIX,
     CLAUDE_CONFIG_DIR_ENV_VAR,
+    DEFAULT_MANAGED_ROOT_NAME,
     PROCESS_TREE_DIRECTORY_NAME,
     PROCESS_TREE_KILL_MODULE_FILENAME,
     SCRIPTS_DIRECTORY_NAME,
@@ -29,6 +31,29 @@ def _shared_scripts_directory(from_root: Path, shared_subpackage_name: str) -> P
     )
 
 
+def _linked_managed_root(module_path: Path, anchor_depth: int) -> Path | None:
+    """Resolve the managed root whose scripts pointer targets this installed tree.
+
+    Args:
+        module_path: The module path inside the managed scripts tree.
+        anchor_depth: Parent index of the package or agents root.
+
+    Returns:
+        The Claude managed root when its scripts pointer resolves to this tree.
+    """
+    package_root = module_path.resolve().parents[anchor_depth]
+    if not package_root.name.endswith(AGENTS_DIRECTORY_SUFFIX):
+        return None
+    managed_name = package_root.name.removesuffix(AGENTS_DIRECTORY_SUFFIX) or DEFAULT_MANAGED_ROOT_NAME
+    managed_root = package_root.parent / managed_name
+    linked_scripts = managed_root / SCRIPTS_DIRECTORY_NAME
+    if not linked_scripts.is_dir():
+        return None
+    if linked_scripts.resolve() != package_root / SCRIPTS_DIRECTORY_NAME:
+        return None
+    return managed_root
+
+
 def resolve_shared_scripts_directory(
     module_file: str | Path,
     all_environment: Mapping[str, str],
@@ -44,9 +69,10 @@ def resolve_shared_scripts_directory(
         ok:   an un-resolved parent keeps the link side, where _shared sits
         flag: a resolved parent walks the link and misses _shared entirely
 
-    Tries the un-resolved parent first, then the configured managed root,
-    then the resolved parent. When none holds the marker, returns the
-    un-resolved candidate, so an import failure names a readable path.
+    Tries the un-resolved parent first, then a verified installed scripts
+    pointer, then the configured managed root, then the resolved parent.
+    If none holds the marker, returns the un-resolved candidate so an
+    import failure names a readable path.
 
     Args:
         module_file: Path of the importing module (``__file__``).
@@ -63,6 +89,9 @@ def resolve_shared_scripts_directory(
         module_path.absolute().parents[anchor_depth], shared_subpackage_name
     )
     all_candidates = [un_resolved_candidate]
+    linked_root = _linked_managed_root(module_path, anchor_depth)
+    if linked_root is not None:
+        all_candidates.append(_shared_scripts_directory(linked_root, shared_subpackage_name))
     configured_root_text = all_environment.get(CLAUDE_CONFIG_DIR_ENV_VAR, "").strip()
     if configured_root_text:
         all_candidates.append(

package/{.agents/skills/_shared/pr-loop/scripts → scripts}/test_durable_post_lint.py

@@ -330,3 +330,100 @@ def test_cli_has_no_inline_body_flag() -> None:
     )
     assert completed_process.returncode == 2
     assert "unrecognized arguments" in completed_process.stderr
+
+
+RELEASE_BRANCH = "release-please--branches--main--components--claude-dev-env"
+RELEASE_BODY = """:robot: I have created a release *beep* *boop*
+---
+
+
+## [7.0.0](https://example.invalid/compare/v6.0.0...v7.0.0) (2026-01-01)
+
+
+### Features
+
+* a shipped change
+
+---
+This PR was generated with [Release Please](https://example.invalid/release-please).
+"""
+
+
+def should_accept_a_release_body_without_the_house_headings() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-edit",
+        title=None,
+        body_text=RELEASE_BODY,
+        head_branch=RELEASE_BRANCH,
+    )
+    assert all_findings == ()
+
+
+@pytest.mark.parametrize(
+    "damaged_body",
+    [
+        RELEASE_BODY.replace(":robot: I have created a release *beep* *boop*", ""),
+        RELEASE_BODY.replace("This PR was generated with [Release Please]", ""),
+    ],
+)
+def should_report_a_release_body_that_lost_a_marker(damaged_body: str) -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-edit",
+        title=None,
+        body_text=damaged_body,
+        head_branch=RELEASE_BRANCH,
+    )
+    assert [each_finding.code for each_finding in all_findings] == [
+        "rewritten-release-body"
+    ]
+
+
+def should_report_a_release_body_rewritten_into_house_prose() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-edit",
+        title=None,
+        body_text="This pull request publishes claude-dev-env 2.37.0.",
+        head_branch=RELEASE_BRANCH,
+    )
+    assert [each_finding.code for each_finding in all_findings] == [
+        "rewritten-release-body"
+    ]
+
+
+def should_keep_the_house_headings_for_an_ordinary_branch() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-create",
+        title="fix(cli): tighten input handling",
+        body_text="Body without the required headings.",
+        head_branch="fix/ordinary-branch",
+    )
+    assert MISSING_HEADING_CODE_NAME in {
+        each_finding.code for each_finding in all_findings
+    }
+
+
+MISSING_HEADING_CODE_NAME = "missing-pr-description-heading"
+
+
+def should_report_a_rewritten_release_body_through_the_command_line(
+    tmp_path: Path,
+) -> None:
+    body_path = tmp_path / "body.md"
+    body_path.write_text("This pull request publishes the package.", encoding="utf-8")
+    completed_process = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT_PATH),
+            "--action",
+            "pr-edit",
+            "--body-file",
+            str(body_path),
+            "--head-branch",
+            RELEASE_BRANCH,
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert completed_process.returncode == 1
+    assert "keep the generated text whole" in completed_process.stderr

package/scripts/test_shared_tree_paths.py

@@ -171,3 +171,36 @@ def test_generalized_resolver_serves_a_deeper_anchor(tmp_path: Path) -> None:
         3,
     )
     assert resolved_scripts_directory == expected_scripts_directory
+
+
+@pytest.mark.parametrize("managed_name", (".claude", "profile-a"))
+def test_resolved_agents_scripts_find_the_verified_managed_root(
+    tmp_path: Path, managed_name: str,
+) -> None:
+    agents_name = ".agents" if managed_name == ".claude" else f"{managed_name}.agents"
+    agents_root = tmp_path / agents_name
+    scripts_directory = agents_root / "scripts"
+    scripts_directory.mkdir(parents=True)
+    module_file = scripts_directory / "runner.py"
+    module_file.write_text("", encoding="utf-8")
+    managed_root = tmp_path / managed_name
+    managed_root.mkdir()
+    _create_directory_link(from_link=managed_root / "scripts", to_target=scripts_directory)
+    expected = _write_process_tree_kill_stub(managed_root)
+    resolved_directory = shared_tree_paths.resolve_shared_process_tree_scripts_directory(module_file, {})
+    assert resolved_directory == expected
+
+
+def test_neighboring_managed_root_cannot_supply_a_foreign_shared_tree(tmp_path: Path) -> None:
+    agents_root = tmp_path / ".agents"
+    scripts_directory = agents_root / "scripts"
+    scripts_directory.mkdir(parents=True)
+    module_file = scripts_directory / "runner.py"
+    module_file.write_text("", encoding="utf-8")
+    managed_root = tmp_path / ".claude"
+    foreign_scripts = managed_root / "scripts"
+    foreign_scripts.mkdir(parents=True)
+    _write_process_tree_kill_stub(managed_root)
+    resolved_directory = shared_tree_paths.resolve_shared_process_tree_scripts_directory(module_file, {})
+    expected = agents_root / "_shared" / "process-tree" / "scripts"
+    assert resolved_directory == expected

package/scripts/tests/test-audit-hooks-cli.mjs

@@ -0,0 +1,150 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const auditCliPath = path.join(packageRoot, "audit-hooks-cli.mjs");
+
+function writeJson(filePath, jsonDocument) {
+  writeFileSync(filePath, JSON.stringify(jsonDocument), "utf8");
+}
+
+function createAuditFixture({
+  canonicalHooks = {},
+  claudeHooks = { hooks: {} },
+  codexHooks = { hooks: {} },
+} = {}) {
+  const fixtureRoot = mkdtempSync(path.join(tmpdir(), "hook-audit-cli-"));
+  const canonicalHooksRoot = path.join(fixtureRoot, "packages", "claude-dev-env", "hooks");
+  const homeDirectory = path.join(fixtureRoot, "home");
+  mkdirSync(canonicalHooksRoot, { recursive: true });
+  mkdirSync(path.join(homeDirectory, ".claude", "hooks"), { recursive: true });
+  mkdirSync(path.join(homeDirectory, ".codex", "hooks"), { recursive: true });
+  writeJson(path.join(canonicalHooksRoot, "hooks.json"), { hooks: canonicalHooks });
+  writeJson(path.join(homeDirectory, ".claude", "settings.json"), claudeHooks);
+  writeJson(path.join(homeDirectory, ".codex", "hooks.json"), codexHooks);
+  return { fixtureRoot, homeDirectory };
+}
+
+function runAuditCli(allArguments) {
+  const childProcess = spawnSync(process.execPath, [auditCliPath, ...allArguments], {
+    cwd: packageRoot,
+    encoding: "utf8",
+    env: { ...process.env, HOME: path.join(tmpdir(), "unused-audit-cli-home") },
+    shell: false,
+  });
+  assert.equal(childProcess.error, undefined);
+  return childProcess;
+}
+
+test("writes a JSON audit report to stdout through the CLI", () => {
+  const fixture = createAuditFixture({
+    canonicalHooks: {
+      PreToolUse: [{
+        matcher: "Write",
+        hooks: [{
+          type: "command",
+          command: "python3 " + "$" + "{CLAUDE_PLUGIN_ROOT}/hooks/blocking/write_existing_file_blocker.py",
+        }],
+      }],
+    },
+  });
+  try {
+    const childProcess = runAuditCli([
+      "--format",
+      "json",
+      "--repository-root",
+      fixture.fixtureRoot,
+    ]);
+
+    assert.equal(childProcess.status, 0);
+    assert.equal(childProcess.stderr, "");
+    const report = JSON.parse(childProcess.stdout);
+    assert.equal(report.summary.directCount, 1);
+    assert.equal(report.registrationEligibility.status, "not_checked");
+  } finally {
+    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
+  }
+});
+
+test("writes the JSON audit report to the requested file through the CLI", () => {
+  const fixture = createAuditFixture();
+  const reportPath = path.join(fixture.fixtureRoot, "audit-report.json");
+  try {
+    const childProcess = runAuditCli([
+      "--format",
+      "json",
+      "--output",
+      reportPath,
+      "--repository-root",
+      fixture.fixtureRoot,
+    ]);
+
+    assert.equal(childProcess.status, 0);
+    assert.equal(childProcess.stdout, "");
+    const report = JSON.parse(readFileSync(reportPath, "utf8"));
+    assert.equal(report.summary.directCount, 0);
+    assert.equal(report.summary.findingCount, 0);
+  } finally {
+    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
+  }
+});
+
+test("returns a strict nonblocking failure through the CLI", () => {
+  const fixture = createAuditFixture({
+    claudeHooks: {
+      hooks: {
+        SessionStart: [{
+          hooks: [{ command: "node cleanup.mjs", type: "command" }],
+        }],
+      },
+    },
+  });
+  const catalogPath = path.join(fixture.fixtureRoot, "lifecycle.json");
+  writeJson(catalogPath, {
+    hooks: {
+      "external:cleanup.mjs": {
+        lifecycle: "delete",
+        reason: "The installed entry is retired.",
+        replacement: null,
+      },
+    },
+  });
+  try {
+    const childProcess = runAuditCli([
+      "--format",
+      "json",
+      "--catalog",
+      catalogPath,
+      "--home",
+      fixture.homeDirectory,
+      "--installed",
+      "--require-nonblocking",
+      "--repository-root",
+      fixture.fixtureRoot,
+    ]);
+
+    assert.equal(childProcess.status, 1);
+    assert.equal(childProcess.stderr, "");
+    const report = JSON.parse(childProcess.stdout);
+    assert.equal(report.registrationEligibility.status, "ineligible");
+    assert.equal(
+      report.findings.some(({ code, target }) =>
+        code === "NONBLOCKING_LIFECYCLE_MISMATCH" && target === "external:cleanup.mjs",
+      ),
+      true,
+    );
+  } finally {
+    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
+  }
+});

package/scripts/tests/test-audit-hooks.mjs

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import test from "node:test";
@@ -73,6 +73,37 @@ test("renders deterministic private JSON", () => {
   assert.equal(first.includes("python3 ${CLAUDE_PLUGIN_ROOT}"), false);
 });
 
+test("does not compare the live graph with retired baseline counts", () => {
+  const report = auditHooks({ repositoryRoot });
+  assert.equal(report.summary.directCount, report.directRegistrations.length);
+  assert.equal(report.summary.effectiveCount, report.hostedRegistrations.length);
+  assert.equal(report.summary.logicalAssociationCount, report.logicalRegistrations.length);
+  assert.ok(report.summary.directCount > 0);
+  assert.ok(report.summary.effectiveCount > 0);
+  assert.ok(report.summary.logicalAssociationCount > report.summary.directCount);
+  assert.equal(report.findings.some(({ code }) => code === "DIRECT_COUNT_DRIFT"), false);
+  assert.equal(report.findings.some(({ code }) => code === "HOSTED_COUNT_DRIFT"), false);
+});
+
+test("does not execute registered commands", () => {
+  const fixture = createAuditFixture({
+    canonicalHooks: {
+      PreToolUse: [{
+        hooks: [{
+          command: "node -e \"require('node:fs').writeFileSync('audit-executed', 'yes')\"",
+          type: "command",
+        }],
+      }],
+    },
+  });
+  try {
+    auditHooks({ repositoryRoot: fixture.fixtureRoot });
+    assert.equal(existsSync(path.join(fixture.fixtureRoot, "audit-executed")), false);
+  } finally {
+    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
+  }
+});
+
 test("reports every unclassified target", () => {
   const temporaryRoot = mkdtempSync(path.join(tmpdir(), "hook-audit-"));
   const catalogPath = path.join(temporaryRoot, "lifecycle.json");
@@ -86,6 +117,15 @@ test("reports every unclassified target", () => {
   }
 });
 
+test("reports canonical native Git hooks from the installer registry", () => {
+  const report = auditHooks({ repositoryRoot });
+  assert.deepEqual(
+    report.knownGitRegistrations.map(({ target }) => target),
+    ["git:pre-commit", "git:pre-push", "git:post-commit"],
+  );
+  assert.equal(report.summary.knownGitHookCount, 3);
+});
+
 test("keeps each hosted matcher as narrow as its roster", () => {
   const fixture = createAuditFixture({
     canonicalHooks: {
@@ -161,6 +201,7 @@ test("classifies installed-only targets", () => {
       catalogPath,
       homeDirectory: fixture.homeDirectory,
       includeInstalled: true,
+      requireNonblocking: true,
       repositoryRoot: temporaryRoot,
     });
     const missingTargets = new Set(
@@ -266,6 +307,46 @@ test("reports missing installed dispatcher targets", () => {
   }
 });
 
+test("rejects an installed-only registration without nonblocking lifecycle", () => {
+  const fixture = createAuditFixture({
+    claudeHooks: {
+      hooks: {
+        SessionStart: [{
+          hooks: [{ command: "node cleanup.mjs", type: "command" }],
+        }],
+      },
+    },
+  });
+  const catalogPath = path.join(fixture.fixtureRoot, "lifecycle.json");
+  writeJson(catalogPath, {
+    hooks: {
+      "external:cleanup.mjs": {
+        lifecycle: "delete",
+        reason: "The installed entry is retired.",
+        replacement: null,
+      },
+    },
+  });
+  try {
+    const report = auditHooks({
+      catalogPath,
+      homeDirectory: fixture.homeDirectory,
+      includeInstalled: true,
+      requireNonblocking: true,
+      repositoryRoot: fixture.fixtureRoot,
+    });
+    assert.equal(report.registrationEligibility.status, "ineligible");
+    assert.equal(
+      report.findings.some(({ code, target }) =>
+        code === "NONBLOCKING_LIFECYCLE_MISMATCH" && target === "external:cleanup.mjs",
+      ),
+      true,
+    );
+  } finally {
+    rmSync(fixture.fixtureRoot, { force: true, recursive: true });
+  }
+});
+
 test("checks canonical managed parity for Codex registrations", () => {
   const fixture = createAuditFixture({
     canonicalHooks: {
@@ -355,6 +436,7 @@ test("finds default Git hooks from a worktree", () => {
     runGit(sourceRoot, ["commit", "--quiet", "--allow-empty", "-m", "fixture"], environment);
     runGit(sourceRoot, ["worktree", "add", "--quiet", worktreeRoot, "HEAD"], environment);
     writeHookFile(path.join(sourceRoot, ".git", "hooks"), "pre-commit");
+    writeHookFile(path.join(sourceRoot, ".git", "hooks"), "post-commit");
     const canonicalHooksRoot = path.join(worktreeRoot, "packages", "claude-dev-env", "hooks");
     const homeDirectory = path.join(sourceRoot, "home");
     mkdirSync(canonicalHooksRoot, { recursive: true });
@@ -366,9 +448,19 @@ test("finds default Git hooks from a worktree", () => {
     const report = auditHooks({
       homeDirectory,
       includeInstalled: true,
+      requireNonblocking: true,
       repositoryRoot: worktreeRoot,
     });
-    assert.deepEqual(report.gitRegistrations.map(({ target }) => target), ["git:pre-commit"]);
+    assert.deepEqual(report.gitRegistrations.map(({ target }) => target), [
+      "git:pre-commit",
+      "git:post-commit",
+    ]);
+    assert.equal(
+      report.findings.some(({ code, target }) =>
+        code === "NATIVE_GIT_BLOCKING_HOOK" && target === "git:pre-commit",
+      ),
+      true,
+    );
   } finally {
     if (previousGlobalConfig === undefined) delete process.env.GIT_CONFIG_GLOBAL;
     else process.env.GIT_CONFIG_GLOBAL = previousGlobalConfig;